2023 CVEs (page 153)
Page 153 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-40386 | Low | 3.3 | 2023-09-27 | A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sonoma 14. An app may be able to access Notes attachments. |
CVE-2023-40384 | Low | 3.3 | 2023-09-27 | A permissions issue was addressed with improved redaction of sensitive information. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, macOS Sonoma 14. An a… |
CVE-2023-40333 | High | 7.1 | 2023-09-27 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Qode Interactive Bridge Core plugin <= 3.0.9 versions. |
CVE-2023-40330 | High | 7.1 | 2023-09-27 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Milan Petrovic GD Security Headers plugin <= 1.6.1 versions. |
CVE-2023-40219 | High | 7.2 | 2023-09-27 | Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with editor or higher privilege to upload an arbitrary file to an unauthorized directory. |
CVE-2023-40049 | Medium | 5.3 | 2023-09-27 | In WS_FTP Server version prior to 8.8.2, an unauthenticated user could enumerate files under the 'WebServiceHost' directory listing. |
CVE-2023-40048 | Medium | 6.8 | 2023-09-27 | In WS_FTP Server version prior to 8.8.2, the WS_FTP Server Manager interface was missing cross-site request forgery (CSRF) protection on a POST transactio… |
CVE-2023-40047 | High | 8.3 | 2023-09-27 | In WS_FTP Server version prior to 8.8.2, a stored cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Management module. An attacker with ad… |
CVE-2023-40046 | High | 8.2 | 2023-09-27 | In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a SQL injection vulnerability exists in the WS_FTP Server manager interface. An attacker may be able t… |
CVE-2023-40045 | High | 8.3 | 2023-09-27 | In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a reflected cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Ad Hoc Transfer module… |
CVE-2023-40044 | Critical | 10.0 | 2023-09-27 | In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer mod… |
CVE-2023-3767 | Critical | 9.8 | 2023-09-27 | An OS command injection vulnerability has been found on EasyPHP Webserver affecting version 14.1. This vulnerability could allow an attacker to get full acces… |
CVE-2023-3223 | High | 7.5 | 2023-09-27 | A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorize… |
CVE-2023-39434 | High | 8.8 | 2023-09-27 | A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. Processing web… |
CVE-2023-39378 | High | 8.8 | 2023-09-27 | SiberianCMS - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') by an unauthenticated user |
CVE-2023-39377 | High | 7.2 | 2023-09-27 | SiberianCMS - CWE-434: Unrestricted Upload of File with Dangerous Type - A malicious user with administrative privileges may be able to upload a dangerous fil… |
CVE-2023-39376 | Medium | 6.5 | 2023-09-27 | SiberianCMS - CWE-284 Improper Access Control Authorized user may disable a security feature over the network |
CVE-2023-39375 | High | 7.5 | 2023-09-27 | SiberianCMS - CWE-274: Improper Handling of Insufficient Privileges |
CVE-2023-39347 | High | 7.6 | 2023-09-27 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An attacker with the ability to update pod labels can cause Cilium t… |
CVE-2023-39233 | Medium | 6.5 | 2023-09-27 | The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may disclose sensitive information. |
CVE-2023-38615 | High | 7.8 | 2023-09-27 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14. An app may be able to execute arbitrary code with kernel privile… |
CVE-2023-38596 | Medium | 5.5 | 2023-09-27 | The issue was addressed with improved handling of protocols. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. An app may fail… |
CVE-2023-38586 | Critical | 10.0 | 2023-09-27 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sonoma 14. A sandboxed process may be able to circumvent sandb… |
CVE-2023-37448 | Low | 3.3 | 2023-09-27 | A lock screen issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14. A user may be able to view restricted content from th… |
CVE-2023-36851 | Medium | 5.3 | 2023-09-27 | A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to ca… |
CVE-2023-35990 | Low | 3.3 | 2023-09-27 | The issue was addressed with improved checks. This issue is fixed in iOS 17 and iPadOS 17, watchOS 10, iOS 16.7 and iPadOS 16.7, macOS Sonoma 14. An app may be… |
CVE-2023-35984 | Medium | 4.3 | 2023-09-27 | The issue was addressed with improved checks. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. An attacker in physical proxim… |
CVE-2023-35793 | High | 8.8 | 2023-09-27 | An issue was discovered in Cassia Access Controller 2.1.1.2303271039. Establishing a web SSH session to gateways is vulnerable to Cross Site Request Forgery (C… |
CVE-2023-35074 | High | 8.8 | 2023-09-27 | The issue was addressed with improved memory handling. This issue is fixed in tvOS 17, Safari 17, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing… |
CVE-2023-35071 | Critical | 9.8 | 2023-09-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MRV Tech Logging Administration Panel allows SQL Injectio… |
CVE-2023-34043 | Medium | 6.7 | 2023-09-27 | VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privi… |
CVE-2023-32541 | High | 8.8 | 2023-09-27 | A use-after-free vulnerability exists in the footerr functionality of Hancom Office 2020 HWord 11.0.0.7520. A specially crafted .doc file can lead to a use-aft… |
CVE-2023-32421 | Medium | 5.5 | 2023-09-27 | A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sonoma 14. An app may be able to observe unprotected user… |
CVE-2023-32396 | High | 7.8 | 2023-09-27 | This issue was addressed with improved checks. This issue is fixed in Xcode 15, tvOS 17, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able… |
CVE-2023-32377 | High | 7.8 | 2023-09-27 | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14. An app may be able to execute arbitrary code with… |
CVE-2023-32361 | Medium | 5.5 | 2023-09-27 | The issue was addressed with improved handling of caches. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. An app may be able… |
CVE-2023-30961 | Medium | 6.5 | 2023-09-27 | Palantir Gotham was found to be vulnerable to a bug where under certain circumstances, the frontend could have applied an incorrect classification to a newly c… |
CVE-2023-30959 | Medium | 4.1 | 2023-09-27 | In Apollo change requests, comments added by users could contain a javascript URI link that when rendered will result in an XSS that require user interaction. |
CVE-2023-30493 | High | 7.1 | 2023-09-27 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Themefic Ultimate Addons for Contact Form 7 plugin <= 3.2.0 versions. |
CVE-2023-30472 | High | 7.1 | 2023-09-27 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in MyThemeShop URL Shortener by MyThemeShop plugin <= 1.0.17 versions. |
CVE-2023-30471 | High | 7.1 | 2023-09-27 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Cornel Raiu WP Search Analytics plugin <= 1.4.7 versions. |
CVE-2023-2358 | Medium | 4.3 | 2023-09-27 | Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.5.0.0 and 9.3.0.4, including 8.3.x.x, saves passwords of the Hadoop Copy Files step in p… |
CVE-2023-2315 | High | 8.1 | 2023-09-27 | Path Traversal in OpenCart versions 4.0.0.0 to 4.0.2.2 allows an authenticated user with access/modify privilege on the Log component to empty out arbitrary fi… |
CVE-2023-29497 | Low | 3.3 | 2023-09-27 | A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sonoma 14. An app may be able to access calendar data sav… |
CVE-2023-28790 | Medium | 5.9 | 2023-09-27 | Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Brett Shumaker Simple Staff List plugin <= 2.2.3 versions. |
CVE-2023-28490 | High | 7.1 | 2023-09-27 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Estatik Estatik Mortgage Calculator plugin <= 2.0.7 versions. |
CVE-2023-28055 | High | 8.8 | 2023-09-27 | Dell NetWorker, Version 19.7 has an improper authorization vulnerability in the NetWorker client. An unauthenticated attacker within the same network could po… |
CVE-2023-27628 | Medium | 6.5 | 2023-09-27 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Webvitaly Sitekit plugin <= 1.3 versions. |
CVE-2023-27622 | Medium | 5.9 | 2023-09-27 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Abel Ruiz GuruWalk Affiliates plugin <= 1.0.0 versions. |
CVE-2023-27617 | Medium | 5.9 | 2023-09-27 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in David F. Carr RSVPMaker plugin <= 10.6.6 versions. |
CVE-2023-27616 | High | 7.1 | 2023-09-27 | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in David F. Carr RSVPMaker plugin <= 10.6.6 versions. |
CVE-2023-25483 | Medium | 5.9 | 2023-09-27 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ankit Agarwal, Priyanshu Mittal Easy Coming Soon plugin <= 2.3 versions. |
CVE-2023-23958 | Medium | 6.8 | 2023-09-27 | Symantec Protection Engine, prior to 9.1.0, may be susceptible to a Hash Leak vulnerability. |
CVE-2023-23495 | Medium | 5.5 | 2023-09-27 | A permissions issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sonoma 14. An app may be able to access sensit… |
CVE-2023-0833 | Medium | 4.7 | 2023-09-27 | A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exception triggered by a he… |
CVE-2023-0456 | High | 7.4 | 2023-09-27 | A flaw was found in APICast, when 3Scale's OIDC module does not properly evaluate the response to a mismatched token from a separate realm. This could allow a… |
CVE-2023-4259 | High | 7.1 | 2023-09-26 | Two potential buffer overflow vulnerabilities at the following locations in the Zephyr eS-WiFi driver source code. |
CVE-2023-43325 | Medium | 6.1 | 2023-09-26 | A reflected cross-site scripting (XSS) vulnerability in the data[redirect_url] parameter of mooSocial v3.1.8 allows attackers to steal user's session cookies a… |
CVE-2023-43278 | High | 8.8 | 2023-09-25 | A Cross-Site Request Forgery (CSRF) in admin_manager.php of Seacms up to v12.8 allows attackers to arbitrarily add an admin account. |
CVE-2023-38907 | High | 7.5 | 2023-09-25 | An issue in TPLink Smart Bulb Tapo series L530 before 1.2.4, L510E before 1.1.0, L630 before 1.0.4, P100 before 1.5.0, and Tapo Application 2.8.14 allows a rem… |
CVE-2023-4258 | High | 8.6 | 2023-09-25 | In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be sent back and will be accepted by provisio… |
CVE-2023-43326 | Medium | 6.1 | 2023-09-25 | A reflected cross-site scripting (XSS) vulnerability exisits in multiple url of mooSocial v3.1.8 allows attackers to steal user's session cookies and impersona… |
CVE-2023-43457 | Critical | 9.8 | 2023-09-25 | An issue in Service Provider Management System v.1.0 allows a remote attacker to gain privileges via the ID parameter in the /php-spms/admin/?page=user/ endpoi… |
CVE-2023-43132 | Medium | 6.5 | 2023-09-25 | szvone vmqphp <=1.13 is vulnerable to SQL Injection. Unauthorized remote users can use sql injection attacks to obtain the hash of the administrator password. |
CVE-2023-42753 | High | 7.0 | 2023-09-25 | An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the `h->nets` array… |
CVE-2023-42426 | Medium | 6.1 | 2023-09-25 | Cross-site scripting (XSS) vulnerability in Froala Froala Editor v.4.1.1 allows remote attackers to execute arbitrary code via the 'Insert link' parameter in t… |
CVE-2023-43644 | Critical | 9.1 | 2023-09-25 | Sing-box is an open source proxy system. Affected versions are subject to an authentication bypass when specially crafted requests are sent to sing-box. This a… |
CVE-2023-43642 | High | 7.5 | 2023-09-25 | snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of… |
CVE-2023-43458 | Medium | 5.4 | 2023-09-25 | Cross Site Scripting (XSS) vulnerability in Resort Reservation System v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitive information… |
CVE-2023-43319 | Medium | 6.1 | 2023-09-25 | Cross Site Scripting (XSS) vulnerability in the Sign-In page of IceWarp WebClient 10.3.5 allows attackers to execute arbitrary web scripts or HTML via a crafte… |
CVE-2023-42817 | Medium | 5.4 | 2023-09-25 | Pimcore admin-ui-classic-bundle provides a Backend UI for Pimcore. The translation value with text including “%s” (from “%suggest%) is parsed by sprintf() even… |
CVE-2023-41871 | High | 7.1 | 2023-09-25 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Poll Maker Team Poll Maker plugin <= 4.7.0 versions. |
CVE-2023-41868 | High | 7.1 | 2023-09-25 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ram Ratan Maurya, Codestag StagTools plugin <= 2.3.7 versions. |
CVE-2023-41867 | High | 7.1 | 2023-09-25 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in AcyMailing Newsletter Team AcyMailing plugin <= 8.6.2 versions. |
CVE-2023-41863 | High | 7.1 | 2023-09-25 | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Pepro Dev. Group PeproDev CF7 Database plugin <= 1.7.0 versions. |
CVE-2023-40581 | High | 8.3 | 2023-09-25 | yt-dlp is a youtube-dl fork with additional features and fixes. yt-dlp allows the user to provide shell command lines to be executed at various stages in its d… |
CVE-2023-39640 | Critical | 9.8 | 2023-09-25 | UpLight cookiebanner before 1.5.1 was discovered to contain a SQL injection vulnerability via the component Hook::getHookModuleExecList(). |
CVE-2023-4156 | Medium | 4.4 | 2023-09-25 | A heap out-of-bounds read flaw was found in builtin.c in the gawk package. This issue may lead to a crash and could be used to read sensitive information. |
CVE-2023-5166 | High | 8.0 | 2023-09-25 | Docker Desktop before 4.23.0 allows Access Token theft via a crafted extension icon URL. This issue affects Docker Desktop: before 4.23.0. |
CVE-2023-5165 | High | 7.1 | 2023-09-25 | Docker Desktop before 4.23.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions via the debug shell which remains accessible… |
CVE-2023-5158 | Medium | 6.5 | 2023-09-25 | A flaw was found in vringh_kiov_advance in drivers/vhost/vringh.c in the host side of a virtio ring in the Linux Kernel. This issue may result in a denial of s… |
CVE-2023-5156 | High | 7.5 | 2023-09-25 | A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash. |
CVE-2023-4892 | Medium | 5.7 | 2023-09-25 | Teedy v1.11 has a vulnerability in its text editor that allows events to be executed in HTML tags that an attacker could manipulate. Thanks to this, it is po… |
CVE-2023-4631 | Medium | 5.3 | 2023-09-25 | The DoLogin Security WordPress plugin before 3.7 uses headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP spo… |
CVE-2023-4549 | Medium | 6.1 | 2023-09-25 | The DoLogin Security WordPress plugin before 3.7 does not properly sanitize IP addresses coming from the X-Forwarded-For header, which can be used by attackers… |
CVE-2023-4521 | Critical | 9.8 | 2023-09-25 | The Import XML and RSS Feeds WordPress plugin before 2.1.5 contains a web shell, allowing unauthenticated attackers to perform RCE. The plugin/vendor was not c… |
CVE-2023-4502 | Medium | 4.8 | 2023-09-25 | The Translate WordPress with GTranslate WordPress plugin before 3.0.4 does not sanitise and escape some of its settings, which could allow high privilege users… |
CVE-2023-4490 | Critical | 9.8 | 2023-09-25 | The WP Job Portal WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploit… |
CVE-2023-4476 | Medium | 6.1 | 2023-09-25 | The Locatoraid Store Locator WordPress plugin before 3.9.24 does not sanitise and escape the lpr-search parameter before outputting it back in the page, leadin… |
CVE-2023-4300 | High | 7.2 | 2023-09-25 | The Import XML and RSS Feeds WordPress plugin before 2.1.4 does not filter file extensions for uploaded files, allowing an attacker to upload a malicious PHP f… |
CVE-2023-4281 | Medium | 5.3 | 2023-09-25 | This Activity Log WordPress plugin before 2.8.8 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value… |
CVE-2023-4238 | High | 7.2 | 2023-09-25 | The Prevent files / folders access WordPress plugin before 2.5.2 does not validate files to be uploaded, which could allow attackers to upload arbitrary files… |
CVE-2023-4148 | Medium | 6.1 | 2023-09-25 | The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before outputting them back in attributes, leading to… |
CVE-2023-43382 | High | 8.8 | 2023-09-25 | Directory Traversal vulnerability in itechyou dreamer CMS v.4.1.3 allows a remote attacker to execute arbitrary code via the themePath in the uploaded template… |
CVE-2023-43339 | Medium | 6.1 | 2023-09-25 | Cross-Site Scripting (XSS) vulnerability in cmsmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload injected into the Da… |
CVE-2023-43141 | Critical | 9.8 | 2023-09-25 | TOTOLINK A3700R V9.1.2u.6134_B20201202 and N600R V5.3c.5137 are vulnerable to Incorrect Access Control. |
CVE-2023-40163 | Critical | 9.8 | 2023-09-25 | An out-of-bounds write vulnerability exists in the allocate_buffer_for_jpeg_decoding functionality of Accusoft ImageGear 20.1. A specially crafted malformed fi… |
CVE-2023-3664 | High | 7.2 | 2023-09-25 | The FileOrganizer WordPress plugin through 1.0.2 does not restrict functionality on multisite instances, allowing site admins to gain full control over the ser… |
CVE-2023-3550 | High | 7.3 | 2023-09-25 | Mediawiki v1.40.0 does not validate namespaces used in XML files. Therefore, if the instance administrator allows XML file uploads, a remote attacker with a… |
CVE-2023-3547 | High | 8.8 | 2023-09-25 | The All in One B2B for WooCommerce WordPress plugin through 1.0.3 does not properly check nonce values in several actions, allowing an attacker to perform CSRF… |