2023 CVEs (page 153)
Page 153 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-23495 | Medium | 5.5 | 2023-09-27 | A permissions issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sonoma 14. An app may be able to access sensit… |
CVE-2023-0833 | Medium | 4.7 | 2023-09-27 | A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exception triggered by a he… |
CVE-2023-0456 | High | 7.4 | 2023-09-27 | A flaw was found in APICast, when 3Scale's OIDC module does not properly evaluate the response to a mismatched token from a separate realm. This could allow a… |
CVE-2023-4259 | High | 7.1 | 2023-09-26 | Two potential buffer overflow vulnerabilities at the following locations in the Zephyr eS-WiFi driver source code. |
CVE-2023-43325 | Medium | 6.1 | 2023-09-26 | A reflected cross-site scripting (XSS) vulnerability in the data[redirect_url] parameter of mooSocial v3.1.8 allows attackers to steal user's session cookies a… |
CVE-2023-43278 | High | 8.8 | 2023-09-25 | A Cross-Site Request Forgery (CSRF) in admin_manager.php of Seacms up to v12.8 allows attackers to arbitrarily add an admin account. |
CVE-2023-38907 | High | 7.5 | 2023-09-25 | An issue in TPLink Smart Bulb Tapo series L530 before 1.2.4, L510E before 1.1.0, L630 before 1.0.4, P100 before 1.5.0, and Tapo Application 2.8.14 allows a rem… |
CVE-2023-4258 | High | 8.6 | 2023-09-25 | In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be sent back and will be accepted by provisio… |
CVE-2023-43326 | Medium | 6.1 | 2023-09-25 | A reflected cross-site scripting (XSS) vulnerability exisits in multiple url of mooSocial v3.1.8 allows attackers to steal user's session cookies and impersona… |
CVE-2023-43457 | Critical | 9.8 | 2023-09-25 | An issue in Service Provider Management System v.1.0 allows a remote attacker to gain privileges via the ID parameter in the /php-spms/admin/?page=user/ endpoi… |
CVE-2023-43132 | Medium | 6.5 | 2023-09-25 | szvone vmqphp <=1.13 is vulnerable to SQL Injection. Unauthorized remote users can use sql injection attacks to obtain the hash of the administrator password. |
CVE-2023-42753 | High | 7.0 | 2023-09-25 | An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the `h->nets` array… |
CVE-2023-42426 | Medium | 6.1 | 2023-09-25 | Cross-site scripting (XSS) vulnerability in Froala Froala Editor v.4.1.1 allows remote attackers to execute arbitrary code via the 'Insert link' parameter in t… |
CVE-2023-43644 | Critical | 9.1 | 2023-09-25 | Sing-box is an open source proxy system. Affected versions are subject to an authentication bypass when specially crafted requests are sent to sing-box. This a… |
CVE-2023-43642 | High | 7.5 | 2023-09-25 | snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of… |
CVE-2023-43458 | Medium | 5.4 | 2023-09-25 | Cross Site Scripting (XSS) vulnerability in Resort Reservation System v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitive information… |
CVE-2023-43319 | Medium | 6.1 | 2023-09-25 | Cross Site Scripting (XSS) vulnerability in the Sign-In page of IceWarp WebClient 10.3.5 allows attackers to execute arbitrary web scripts or HTML via a crafte… |
CVE-2023-42817 | Medium | 5.4 | 2023-09-25 | Pimcore admin-ui-classic-bundle provides a Backend UI for Pimcore. The translation value with text including “%s” (from “%suggest%) is parsed by sprintf() even… |
CVE-2023-41871 | High | 7.1 | 2023-09-25 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Poll Maker Team Poll Maker plugin <= 4.7.0 versions. |
CVE-2023-41868 | High | 7.1 | 2023-09-25 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ram Ratan Maurya, Codestag StagTools plugin <= 2.3.7 versions. |
CVE-2023-41867 | High | 7.1 | 2023-09-25 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in AcyMailing Newsletter Team AcyMailing plugin <= 8.6.2 versions. |
CVE-2023-41863 | High | 7.1 | 2023-09-25 | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Pepro Dev. Group PeproDev CF7 Database plugin <= 1.7.0 versions. |
CVE-2023-40581 | High | 8.3 | 2023-09-25 | yt-dlp is a youtube-dl fork with additional features and fixes. yt-dlp allows the user to provide shell command lines to be executed at various stages in its d… |
CVE-2023-39640 | Critical | 9.8 | 2023-09-25 | UpLight cookiebanner before 1.5.1 was discovered to contain a SQL injection vulnerability via the component Hook::getHookModuleExecList(). |
CVE-2023-4156 | Medium | 4.4 | 2023-09-25 | A heap out-of-bounds read flaw was found in builtin.c in the gawk package. This issue may lead to a crash and could be used to read sensitive information. |
CVE-2023-5166 | High | 8.0 | 2023-09-25 | Docker Desktop before 4.23.0 allows Access Token theft via a crafted extension icon URL. This issue affects Docker Desktop: before 4.23.0. |
CVE-2023-5165 | High | 7.1 | 2023-09-25 | Docker Desktop before 4.23.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions via the debug shell which remains accessible… |
CVE-2023-5158 | Medium | 6.5 | 2023-09-25 | A flaw was found in vringh_kiov_advance in drivers/vhost/vringh.c in the host side of a virtio ring in the Linux Kernel. This issue may result in a denial of s… |
CVE-2023-5156 | High | 7.5 | 2023-09-25 | A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash. |
CVE-2023-4892 | Medium | 5.7 | 2023-09-25 | Teedy v1.11 has a vulnerability in its text editor that allows events to be executed in HTML tags that an attacker could manipulate. Thanks to this, it is po… |
CVE-2023-4631 | Medium | 5.3 | 2023-09-25 | The DoLogin Security WordPress plugin before 3.7 uses headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP spo… |
CVE-2023-4549 | Medium | 6.1 | 2023-09-25 | The DoLogin Security WordPress plugin before 3.7 does not properly sanitize IP addresses coming from the X-Forwarded-For header, which can be used by attackers… |
CVE-2023-4521 | Critical | 9.8 | 2023-09-25 | The Import XML and RSS Feeds WordPress plugin before 2.1.5 contains a web shell, allowing unauthenticated attackers to perform RCE. The plugin/vendor was not c… |
CVE-2023-4502 | Medium | 4.8 | 2023-09-25 | The Translate WordPress with GTranslate WordPress plugin before 3.0.4 does not sanitise and escape some of its settings, which could allow high privilege users… |
CVE-2023-4490 | Critical | 9.8 | 2023-09-25 | The WP Job Portal WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploit… |
CVE-2023-4476 | Medium | 6.1 | 2023-09-25 | The Locatoraid Store Locator WordPress plugin before 3.9.24 does not sanitise and escape the lpr-search parameter before outputting it back in the page, leadin… |
CVE-2023-4300 | High | 7.2 | 2023-09-25 | The Import XML and RSS Feeds WordPress plugin before 2.1.4 does not filter file extensions for uploaded files, allowing an attacker to upload a malicious PHP f… |
CVE-2023-4281 | Medium | 5.3 | 2023-09-25 | This Activity Log WordPress plugin before 2.8.8 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value… |
CVE-2023-4238 | High | 7.2 | 2023-09-25 | The Prevent files / folders access WordPress plugin before 2.5.2 does not validate files to be uploaded, which could allow attackers to upload arbitrary files… |
CVE-2023-4148 | Medium | 6.1 | 2023-09-25 | The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before outputting them back in attributes, leading to… |
CVE-2023-43382 | High | 8.8 | 2023-09-25 | Directory Traversal vulnerability in itechyou dreamer CMS v.4.1.3 allows a remote attacker to execute arbitrary code via the themePath in the uploaded template… |
CVE-2023-43339 | Medium | 6.1 | 2023-09-25 | Cross-Site Scripting (XSS) vulnerability in cmsmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload injected into the Da… |
CVE-2023-43141 | Critical | 9.8 | 2023-09-25 | TOTOLINK A3700R V9.1.2u.6134_B20201202 and N600R V5.3c.5137 are vulnerable to Incorrect Access Control. |
CVE-2023-40163 | Critical | 9.8 | 2023-09-25 | An out-of-bounds write vulnerability exists in the allocate_buffer_for_jpeg_decoding functionality of Accusoft ImageGear 20.1. A specially crafted malformed fi… |
CVE-2023-3664 | High | 7.2 | 2023-09-25 | The FileOrganizer WordPress plugin through 1.0.2 does not restrict functionality on multisite instances, allowing site admins to gain full control over the ser… |
CVE-2023-3550 | High | 7.3 | 2023-09-25 | Mediawiki v1.40.0 does not validate namespaces used in XML files. Therefore, if the instance administrator allows XML file uploads, a remote attacker with a… |
CVE-2023-3547 | High | 8.8 | 2023-09-25 | The All in One B2B for WooCommerce WordPress plugin through 1.0.3 does not properly check nonce values in several actions, allowing an attacker to perform CSRF… |
CVE-2023-3226 | Medium | 4.8 | 2023-09-25 | The Popup Builder WordPress plugin before 4.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2023-39453 | Critical | 9.8 | 2023-09-25 | A use-after-free vulnerability exists in the tif_parse_sub_IFD functionality of Accusoft ImageGear 20.1. A specially crafted malformed file can lead to arbitra… |
CVE-2023-35002 | Critical | 9.8 | 2023-09-25 | A heap-based buffer overflow vulnerability exists in the pictwread functionality of Accusoft ImageGear 20.1. A specially crafted malformed file can lead to arb… |
CVE-2023-32653 | Critical | 9.8 | 2023-09-25 | An out-of-bounds write vulnerability exists in the dcm_pixel_data_decode functionality of Accusoft ImageGear 20.1. A specially crafted malformed file can lead… |
CVE-2023-32614 | High | 7.0 | 2023-09-25 | A heap-based buffer overflow vulnerability exists in the create_png_object functionality of Accusoft ImageGear 20.1. A specially crafted malformed file can lea… |
CVE-2023-32284 | High | 8.1 | 2023-09-25 | An out-of-bounds write vulnerability exists in the tiff_planar_adobe functionality of Accusoft ImageGear 20.1. A specially crafted malformed file can lead to m… |
CVE-2023-28393 | Medium | 5.6 | 2023-09-25 | A stack-based buffer overflow vulnerability exists in the tif_processing_dng_channel_count functionality of Accusoft ImageGear 20.1. A specially crafted malfor… |
CVE-2023-23567 | High | 8.1 | 2023-09-25 | A heap-based buffer overflow vulnerability exists in the CreateDIBfromPict functionality of Accusoft ImageGear 20.1. A specially crafted file can lead to arbit… |
CVE-2023-0633 | High | 7.2 | 2023-09-25 | In Docker Desktop on Windows before 4.12.0 an argument injection to installer may result in local privilege escalation (LPE).This issue affects Docker Desktop… |
CVE-2023-0627 | Medium | 6.7 | 2023-09-25 | Docker Desktop 4.11.x allows --no-windows-containers flag bypass via IPC response spoofing which may lead to Local Privilege Escalation (LPE).This issue affect… |
CVE-2023-0626 | High | 8.0 | 2023-09-25 | Docker Desktop before 4.12.0 is vulnerable to RCE via query parameters in message-box route. This issue affects Docker Desktop: before 4.12.0. |
CVE-2023-0625 | High | 8.0 | 2023-09-25 | Docker Desktop before 4.12.0 is vulnerable to RCE via a crafted extension description or changelog. This issue affects Docker Desktop: before 4.12.0. |
CVE-2023-43456 | Medium | 5.4 | 2023-09-25 | Cross Site Scripting vulnerability in Service Provider Management System v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitive informat… |
CVE-2023-43131 | Critical | 9.8 | 2023-09-25 | General Device Manager 2.5.2.2 is vulnerable to Buffer Overflow. |
CVE-2023-43256 | Medium | 6.5 | 2023-09-25 | A path traversal in Gladys Assistant v4.26.1 and below allows authenticated attackers to extract sensitive files in the host machine by exploiting a non-saniti… |
CVE-2023-41303 | High | 7.5 | 2023-09-25 | Command injection vulnerability in the distributed file system module. Successful exploitation of this vulnerability may cause variables in the sock structure… |
CVE-2023-41302 | High | 7.5 | 2023-09-25 | Redirection permission verification vulnerability in the home screen module. Successful exploitation of this vulnerability may cause features to perform abnorm… |
CVE-2023-41301 | High | 7.5 | 2023-09-25 | Vulnerability of unauthorized API access in the PMS module. Successful exploitation of this vulnerability may cause features to perform abnormally. |
CVE-2023-41300 | High | 7.5 | 2023-09-25 | Vulnerability of parameters not being strictly verified in the PMS module. Successful exploitation of this vulnerability may cause the system to restart. |
CVE-2023-41293 | High | 7.5 | 2023-09-25 | Data security classification vulnerability in the DDMP module. Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2023-41419 | Critical | 9.8 | 2023-09-25 | An issue in Gevent before version 23.9.0 allows a remote attacker to escalate privileges via a crafted script to the WSGIServer component. |
CVE-2023-41299 | High | 7.5 | 2023-09-25 | DoS vulnerability in the PMS module. Successful exploitation of this vulnerability may cause the system to restart. |
CVE-2023-41298 | High | 7.5 | 2023-09-25 | Vulnerability of permission control in the window module. Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2023-41297 | Critical | 9.8 | 2023-09-25 | Vulnerability of defects introduced in the design process in the HiviewTunner module. Successful exploitation of this vulnerability may cause service hijacking. |
CVE-2023-41296 | Critical | 9.1 | 2023-09-25 | Vulnerability of missing authorization in the kernel module. Successful exploitation of this vulnerability may affect integrity and confidentiality. |
CVE-2023-41295 | Medium | 5.3 | 2023-09-25 | Vulnerability of improper permission management in the displayengine module. Successful exploitation of this vulnerability may cause the screen to turn dim. |
CVE-2023-41294 | Critical | 9.8 | 2023-09-25 | The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super Device services. |
CVE-2023-39409 | High | 7.5 | 2023-09-25 | DoS vulnerability in the PMS module. Successful exploitation of this vulnerability may cause the system to restart. |
CVE-2023-39408 | High | 7.5 | 2023-09-25 | DoS vulnerability in the PMS module. Successful exploitation of this vulnerability may cause the system to restart. |
CVE-2023-39407 | Critical | 9.1 | 2023-09-25 | The Watchkit has a risk of unauthorized file access.Successful exploitation of this vulnerability may affect confidentiality and integrity. |
CVE-2023-5154 | Medium | 6.3 | 2023-09-25 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in D-Link DAR-8000 up to 20151231 and classified as critical. This vulnerability affects unknown… |
CVE-2023-5153 | Medium | 6.3 | 2023-09-25 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DAR-8000 up to 20151231. This affects an unknown part of… |
CVE-2023-5152 | Medium | 6.3 | 2023-09-25 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DAR-7000 and DAR-8000 up to 20151231. Affected by t… |
CVE-2023-5151 | Medium | 6.3 | 2023-09-25 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in D-Link DAR-8000 up to 20151231. Affected by this vulnerability is an unknow… |
CVE-2023-5150 | Medium | 6.3 | 2023-09-25 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in D-Link DAR-7000 and DAR-8000 up to 20151231. Affected is an unknown fu… |
CVE-2023-41872 | High | 7.1 | 2023-09-25 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Xtemos WoodMart plugin <= 7.2.4 versions. |
CVE-2023-5149 | Medium | 6.3 | 2023-09-25 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 up to 20151231. It has been rated as critical. This issue affects some unknown pro… |
CVE-2023-5148 | Medium | 6.3 | 2023-09-25 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 and DAR-8000 up to 20151231. It has been declared as critical. This vulnerability… |
CVE-2023-5147 | Medium | 6.3 | 2023-09-25 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 up to 20151231. It has been classified as critical. This affects an unknown part o… |
CVE-2023-41949 | Medium | 5.9 | 2023-09-25 | Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Avirtum iFolders plugin <= 1.5.0 versions. |
CVE-2023-41948 | Medium | 5.9 | 2023-09-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Christoph Rado Cookie Notice & Consent plugin <= 1.6.0 versions. |
CVE-2023-41874 | High | 7.1 | 2023-09-25 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Tyche Softwares Order Delivery Date for WooCommerce plugin <= 3.20.0 versions. |
CVE-2023-5146 | Medium | 6.3 | 2023-09-25 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 and DAR-8000 up to 20151231 and classified as critical. Affected by this issue is… |
CVE-2023-5145 | Medium | 6.3 | 2023-09-25 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in D-Link DAR-7000 up to 20151231 and classified as critical. Affected by this vulnerability is… |
CVE-2023-5144 | Medium | 6.3 | 2023-09-24 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DAR-7000 and DAR-8000 up to 20151231. Affected is an unk… |
CVE-2023-5143 | Medium | 6.3 | 2023-09-24 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DAR-7000 up to 20151231. This issue affects some un… |
CVE-2023-5142 | Low | 3.7 | 2023-09-24 | A vulnerability classified as problematic was found in H3C GR-1100-P, GR-1108-P, GR-1200W, GR-1800AX, GR-2200, GR-3200, GR-5200, GR-8300, ER2100n, ER2200G2, ER… |
CVE-2023-1636 | Medium | 6.0 | 2023-09-24 | A vulnerability was found in OpenStack Barbican containers. This vulnerability is only applicable to deployments that utilize an all-in-one configuration. Barb… |
CVE-2023-1633 | Medium | 6.6 | 2023-09-24 | A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to sens… |
CVE-2023-1625 | High | 7.4 | 2023-09-24 | An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal paramet… |
CVE-2023-1260 | High | 8.0 | 2023-09-24 | An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions… |
CVE-2023-5134 | Medium | 4.3 | 2023-09-23 | The Easy Registration Forms for WordPress is vulnerable to Information Disclosure via the 'erforms_user_meta' shortcode in versions up to, and including, 2.1.1… |
CVE-2023-5125 | Medium | 6.4 | 2023-09-23 | The Contact Form by FormGet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'formget' shortcode in versions up to, and including, 5.5.5 d… |