2023 CVEs (page 154)
Page 154 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-3226 | Medium | 4.8 | 2023-09-25 | The Popup Builder WordPress plugin before 4.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2023-39453 | Critical | 9.8 | 2023-09-25 | A use-after-free vulnerability exists in the tif_parse_sub_IFD functionality of Accusoft ImageGear 20.1. A specially crafted malformed file can lead to arbitra… |
CVE-2023-35002 | Critical | 9.8 | 2023-09-25 | A heap-based buffer overflow vulnerability exists in the pictwread functionality of Accusoft ImageGear 20.1. A specially crafted malformed file can lead to arb… |
CVE-2023-32653 | Critical | 9.8 | 2023-09-25 | An out-of-bounds write vulnerability exists in the dcm_pixel_data_decode functionality of Accusoft ImageGear 20.1. A specially crafted malformed file can lead… |
CVE-2023-32614 | High | 7.0 | 2023-09-25 | A heap-based buffer overflow vulnerability exists in the create_png_object functionality of Accusoft ImageGear 20.1. A specially crafted malformed file can lea… |
CVE-2023-32284 | High | 8.1 | 2023-09-25 | An out-of-bounds write vulnerability exists in the tiff_planar_adobe functionality of Accusoft ImageGear 20.1. A specially crafted malformed file can lead to m… |
CVE-2023-28393 | Medium | 5.6 | 2023-09-25 | A stack-based buffer overflow vulnerability exists in the tif_processing_dng_channel_count functionality of Accusoft ImageGear 20.1. A specially crafted malfor… |
CVE-2023-23567 | High | 8.1 | 2023-09-25 | A heap-based buffer overflow vulnerability exists in the CreateDIBfromPict functionality of Accusoft ImageGear 20.1. A specially crafted file can lead to arbit… |
CVE-2023-0633 | High | 7.2 | 2023-09-25 | In Docker Desktop on Windows before 4.12.0 an argument injection to installer may result in local privilege escalation (LPE).This issue affects Docker Desktop… |
CVE-2023-0627 | Medium | 6.7 | 2023-09-25 | Docker Desktop 4.11.x allows --no-windows-containers flag bypass via IPC response spoofing which may lead to Local Privilege Escalation (LPE).This issue affect… |
CVE-2023-0626 | High | 8.0 | 2023-09-25 | Docker Desktop before 4.12.0 is vulnerable to RCE via query parameters in message-box route. This issue affects Docker Desktop: before 4.12.0. |
CVE-2023-0625 | High | 8.0 | 2023-09-25 | Docker Desktop before 4.12.0 is vulnerable to RCE via a crafted extension description or changelog. This issue affects Docker Desktop: before 4.12.0. |
CVE-2023-43456 | Medium | 5.4 | 2023-09-25 | Cross Site Scripting vulnerability in Service Provider Management System v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitive informat… |
CVE-2023-43131 | Critical | 9.8 | 2023-09-25 | General Device Manager 2.5.2.2 is vulnerable to Buffer Overflow. |
CVE-2023-43256 | Medium | 6.5 | 2023-09-25 | A path traversal in Gladys Assistant v4.26.1 and below allows authenticated attackers to extract sensitive files in the host machine by exploiting a non-saniti… |
CVE-2023-41303 | High | 7.5 | 2023-09-25 | Command injection vulnerability in the distributed file system module. Successful exploitation of this vulnerability may cause variables in the sock structure… |
CVE-2023-41302 | High | 7.5 | 2023-09-25 | Redirection permission verification vulnerability in the home screen module. Successful exploitation of this vulnerability may cause features to perform abnorm… |
CVE-2023-41301 | High | 7.5 | 2023-09-25 | Vulnerability of unauthorized API access in the PMS module. Successful exploitation of this vulnerability may cause features to perform abnormally. |
CVE-2023-41300 | High | 7.5 | 2023-09-25 | Vulnerability of parameters not being strictly verified in the PMS module. Successful exploitation of this vulnerability may cause the system to restart. |
CVE-2023-41293 | High | 7.5 | 2023-09-25 | Data security classification vulnerability in the DDMP module. Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2023-41419 | Critical | 9.8 | 2023-09-25 | An issue in Gevent before version 23.9.0 allows a remote attacker to escalate privileges via a crafted script to the WSGIServer component. |
CVE-2023-41299 | High | 7.5 | 2023-09-25 | DoS vulnerability in the PMS module. Successful exploitation of this vulnerability may cause the system to restart. |
CVE-2023-41298 | High | 7.5 | 2023-09-25 | Vulnerability of permission control in the window module. Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2023-41297 | Critical | 9.8 | 2023-09-25 | Vulnerability of defects introduced in the design process in the HiviewTunner module. Successful exploitation of this vulnerability may cause service hijacking. |
CVE-2023-41296 | Critical | 9.1 | 2023-09-25 | Vulnerability of missing authorization in the kernel module. Successful exploitation of this vulnerability may affect integrity and confidentiality. |
CVE-2023-41295 | Medium | 5.3 | 2023-09-25 | Vulnerability of improper permission management in the displayengine module. Successful exploitation of this vulnerability may cause the screen to turn dim. |
CVE-2023-41294 | Critical | 9.8 | 2023-09-25 | The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super Device services. |
CVE-2023-39409 | High | 7.5 | 2023-09-25 | DoS vulnerability in the PMS module. Successful exploitation of this vulnerability may cause the system to restart. |
CVE-2023-39408 | High | 7.5 | 2023-09-25 | DoS vulnerability in the PMS module. Successful exploitation of this vulnerability may cause the system to restart. |
CVE-2023-39407 | Critical | 9.1 | 2023-09-25 | The Watchkit has a risk of unauthorized file access.Successful exploitation of this vulnerability may affect confidentiality and integrity. |
CVE-2023-5154 | Medium | 6.3 | 2023-09-25 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in D-Link DAR-8000 up to 20151231 and classified as critical. This vulnerability affects unknown… |
CVE-2023-5153 | Medium | 6.3 | 2023-09-25 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DAR-8000 up to 20151231. This affects an unknown part of… |
CVE-2023-5152 | Medium | 6.3 | 2023-09-25 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DAR-7000 and DAR-8000 up to 20151231. Affected by t… |
CVE-2023-5151 | Medium | 6.3 | 2023-09-25 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in D-Link DAR-8000 up to 20151231. Affected by this vulnerability is an unknow… |
CVE-2023-5150 | Medium | 6.3 | 2023-09-25 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in D-Link DAR-7000 and DAR-8000 up to 20151231. Affected is an unknown fu… |
CVE-2023-41872 | High | 7.1 | 2023-09-25 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Xtemos WoodMart plugin <= 7.2.4 versions. |
CVE-2023-5149 | Medium | 6.3 | 2023-09-25 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 up to 20151231. It has been rated as critical. This issue affects some unknown pro… |
CVE-2023-5148 | Medium | 6.3 | 2023-09-25 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 and DAR-8000 up to 20151231. It has been declared as critical. This vulnerability… |
CVE-2023-5147 | Medium | 6.3 | 2023-09-25 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 up to 20151231. It has been classified as critical. This affects an unknown part o… |
CVE-2023-41949 | Medium | 5.9 | 2023-09-25 | Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Avirtum iFolders plugin <= 1.5.0 versions. |
CVE-2023-41948 | Medium | 5.9 | 2023-09-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Christoph Rado Cookie Notice & Consent plugin <= 1.6.0 versions. |
CVE-2023-41874 | High | 7.1 | 2023-09-25 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Tyche Softwares Order Delivery Date for WooCommerce plugin <= 3.20.0 versions. |
CVE-2023-5146 | Medium | 6.3 | 2023-09-25 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 and DAR-8000 up to 20151231 and classified as critical. Affected by this issue is… |
CVE-2023-5145 | Medium | 6.3 | 2023-09-25 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in D-Link DAR-7000 up to 20151231 and classified as critical. Affected by this vulnerability is… |
CVE-2023-5144 | Medium | 6.3 | 2023-09-24 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DAR-7000 and DAR-8000 up to 20151231. Affected is an unk… |
CVE-2023-5143 | Medium | 6.3 | 2023-09-24 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DAR-7000 up to 20151231. This issue affects some un… |
CVE-2023-5142 | Low | 3.7 | 2023-09-24 | A vulnerability classified as problematic was found in H3C GR-1100-P, GR-1108-P, GR-1200W, GR-1800AX, GR-2200, GR-3200, GR-5200, GR-8300, ER2100n, ER2200G2, ER… |
CVE-2023-1636 | Medium | 6.0 | 2023-09-24 | A vulnerability was found in OpenStack Barbican containers. This vulnerability is only applicable to deployments that utilize an all-in-one configuration. Barb… |
CVE-2023-1633 | Medium | 6.6 | 2023-09-24 | A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to sens… |
CVE-2023-1625 | High | 7.4 | 2023-09-24 | An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal paramet… |
CVE-2023-1260 | High | 8.0 | 2023-09-24 | An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions… |
CVE-2023-5134 | Medium | 4.3 | 2023-09-23 | The Easy Registration Forms for WordPress is vulnerable to Information Disclosure via the 'erforms_user_meta' shortcode in versions up to, and including, 2.1.1… |
CVE-2023-5125 | Medium | 6.4 | 2023-09-23 | The Contact Form by FormGet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'formget' shortcode in versions up to, and including, 5.5.5 d… |
CVE-2023-43470 | Critical | 9.8 | 2023-09-23 | SQL injection vulnerability in janobe Online Voting System v.1.0 allows a remote attacker to execute arbitrary code via the checklogin.php component. |
CVE-2023-43469 | Critical | 9.8 | 2023-09-23 | SQL injection vulnerability in janobe Online Job Portal v.2020 allows a remote attacker to execute arbitrary code via the ForPass.php component. |
CVE-2023-43468 | Critical | 9.8 | 2023-09-23 | SQL injection vulnerability in janobe Online Job Portal v.2020 allows a remote attacker to execute arbitrary code via the login.php component. |
CVE-2023-43338 | Critical | 9.8 | 2023-09-23 | Cesanta mjs v2.20.0 was discovered to contain a function pointer hijacking vulnerability via the function mjs_get_ptr(). This vulnerability allows attackers to… |
CVE-2023-43130 | Critical | 9.8 | 2023-09-22 | D-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection. |
CVE-2023-43129 | Critical | 9.8 | 2023-09-22 | D-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection due to lax filtering of REMOTE_PORT parameters. |
CVE-2023-40989 | Critical | 9.8 | 2023-09-22 | SQL injection vulnerbility in jeecgboot jeecg-boot v 3.0, 3.5.3 that allows a remote attacker to execute arbitrary code via a crafted request to the report/jee… |
CVE-2023-43270 | Critical | 9.8 | 2023-09-22 | dst-admin v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the userId parameter at /home/playerOperate. |
CVE-2023-38346 | High | 8.8 | 2023-09-22 | An issue was discovered in Wind River VxWorks 6.9 and 7. The function ``tarExtract`` implements TAR file extraction and thereby also processes files within an… |
CVE-2023-43640 | Medium | 6.5 | 2023-09-22 | TaxonWorks is a web-based workbench designed for taxonomists and biodiversity scientists. Prior to version 0.34.0, a SQL injection vulnerability was found in T… |
CVE-2023-42821 | High | 7.5 | 2023-09-22 | The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion `0.0.0-20230922105210-14b1… |
CVE-2023-42812 | Medium | 6.3 | 2023-09-22 | Galaxy is an open-source platform for FAIR data analysis. Prior to version 22.05, Galaxy is vulnerable to server-side request forgery, which allows a malicious… |
CVE-2023-41031 | High | 8.0 | 2023-09-22 | Command injection in homemng.htm in Juplink RX4-1500 versions V1.0.2, V1.0.3, V1.0.4, and V1.0.5 allows remote authenticated attackers to execute commands via… |
CVE-2023-41029 | High | 8.0 | 2023-09-22 | Command injection vulnerability in the homemng.htm endpoint in Juplink RX4-1500 Wifi router firmware versions V1.0.2, V1.0.3, V1.0.4, and V1.0.5 allows authent… |
CVE-2023-41027 | High | 8.0 | 2023-09-22 | Credential disclosure in the '/webs/userpasswd.htm' endpoint in Juplink RX4-1500 Wifi router firmware versions V1.0.4 and V1.0.5 allows an authenticated attack… |
CVE-2023-42811 | Medium | 4.7 | 2023-09-22 | aes-gcm is a pure Rust implementation of the AES-GCM. Starting in version 0.10.0 and prior to version 0.10.3, in the AES GCM implementation of decrypt_in_place… |
CVE-2023-42798 | High | 8.2 | 2023-09-22 | AutomataCI is a template git repository equipped with a native built-in semi-autonomous CI tools. An issue in versions 1.4.1 and below can let a release job re… |
CVE-2023-43144 | Critical | 9.8 | 2023-09-22 | Projectworldsl Assets-management-system-in-php 1.0 is vulnerable to SQL Injection via the "id" parameter in delete.php. |
CVE-2023-23766 | Medium | 4.5 | 2023-09-22 | An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff in a re-opened P… |
CVE-2023-5002 | Medium | 6.0 | 2023-09-22 | A flaw was found in pgAdmin. This issue occurs when the pgAdmin server HTTP API validates the path a user selects to external PostgreSQL utilities such as pg_d… |
CVE-2023-34319 | High | 7.8 | 2023-09-22 | The fix for XSA-423 added logic to Linux'es netback driver to deal with a frontend splitting a packet in a way such that not all of the headers would come in o… |
CVE-2023-4774 | Medium | 6.4 | 2023-09-22 | The WP-Matomo Integration (WP-Piwik) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wp-piwik' shortcode in versions up to, and incl… |
CVE-2023-4716 | Medium | 6.4 | 2023-09-22 | The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_gallery' shortcode in versions up to, and including… |
CVE-2023-43784 | High | 7.5 | 2023-09-22 | Plesk Onyx 17.8.11 has accessKeyId and secretAccessKey fields that are related to an Amazon AWS Firehose component. NOTE: the vendor's position is that there i… |
CVE-2023-43783 | High | 7.5 | 2023-09-22 | Cadence through 0.9.2 2023-08-21 uses an Insecure /tmp/cadence-wineasio.reg Temporary File. The filename is used even if it has been created by a local adversa… |
CVE-2023-43782 | Medium | 5.5 | 2023-09-22 | Cadence through 0.9.2 2023-08-21 uses an Insecure /tmp/.cadence-aloop-daemon.x Temporary File. The file is used even if it has been created by a local adversar… |
CVE-2023-43771 | Medium | 5.5 | 2023-09-22 | In nqptp-message-handlers.c in nqptp before 1.2.3, crafted packets received on the control port could crash the program. |
CVE-2023-43770 | Medium | 6.1 | 2023-09-22 | Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcu… |
CVE-2023-43090 | Medium | 5.5 | 2023-09-22 | A vulnerability was found in GNOME Shell. GNOME Shell's lock screen allows an unauthenticated local user to view windows of the locked desktop session by using… |
CVE-2023-43767 | High | 7.5 | 2023-09-22 | Certain WithSecure products allow Denial of Service via the aepack archive unpack handler. This affects WithSecure Client Security 15, WithSecure Server Securi… |
CVE-2023-43766 | High | 7.8 | 2023-09-22 | Certain WithSecure products allow Local privilege escalation via the lhz archive unpack handler. This affects WithSecure Client Security 15, WithSecure Server… |
CVE-2023-43765 | High | 7.5 | 2023-09-22 | Certain WithSecure products allow Denial of Service in the aeelf component. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecu… |
CVE-2023-43763 | Medium | 6.1 | 2023-09-22 | Certain WithSecure products allow XSS via an unvalidated parameter in the endpoint. This affects WithSecure Policy Manager 15 on Windows and Linux. |
CVE-2023-43762 | Critical | 9.8 | 2023-09-22 | Certain WithSecure products allow Unauthenticated Remote Code Execution via the web server (backend). This affects WithSecure Policy Manager 15 and Policy Mana… |
CVE-2023-43761 | High | 7.5 | 2023-09-22 | Certain WithSecure products allow Denial of Service (infinite loop). This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Emai… |
CVE-2023-43760 | High | 7.5 | 2023-09-22 | Certain WithSecure products allow Denial of Service via a fuzzed PE32 file. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecu… |
CVE-2023-23364 | High | 8.1 | 2023-09-22 | A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows… |
CVE-2023-23363 | High | 8.1 | 2023-09-22 | A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating system. If exploited, the vulnerability possibly allows r… |
CVE-2023-23362 | High | 8.8 | 2023-09-22 | An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability allows remote authenticated users to… |
CVE-2023-31719 | Critical | 9.8 | 2023-09-22 | FUXA <= 1.1.12 is vulnerable to SQL Injection via /api/signin. |
CVE-2023-31718 | High | 7.5 | 2023-09-22 | FUXA <= 1.1.12 is vulnerable to Local via Inclusion via /api/download. |
CVE-2023-31717 | High | 7.5 | 2023-09-22 | A SQL Injection attack in FUXA <= 1.1.12 allows exfiltration of confidential information from the database. |
CVE-2023-31716 | High | 7.5 | 2023-09-22 | FUXA <= 1.1.12 has a Local File Inclusion vulnerability via file=fuxa.log |
CVE-2023-5068 | High | 7.8 | 2023-09-21 | Delta Electronics DIAScreen may write past the end of an allocated buffer while parsing a specially crafted input file. This could allow an attacker to execu… |
CVE-2023-4504 | High | 7.0 | 2023-09-21 | Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflo… |
CVE-2023-43128 | Critical | 9.8 | 2023-09-21 | D-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection due to lax filtering of HTTP_ST parameters. |
CVE-2023-41616 | Medium | 4.8 | 2023-09-21 | A reflected cross-site scripting (XSS) vulnerability in the Search Student function of Student Management System v1.2.3 and before allows attackers to execute… |