2023 CVEs (page 155)
Page 155 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-38876 | Medium | 6.1 | 2023-09-20 | A reflected cross-site scripting (XSS) vulnerability in msaad1999's PHP-Login-System 2.0.1 allows remote attackers to execute arbitrary JavaScript in the web b… |
CVE-2023-38875 | Medium | 6.1 | 2023-09-20 | A reflected cross-site scripting (XSS) vulnerability in msaad1999's PHP-Login-System 2.0.1 allows remote attackers to execute arbitrary JavaScript in the web b… |
CVE-2023-22024 | Medium | 5.5 | 2023-09-20 | In the Unbreakable Enterprise Kernel (UEK), the RDS module in UEK has two setsockopt(2) options, RDS_CONN_RESET and RDS6_CONN_RESET, that are not re-entrant… |
CVE-2023-43138 | High | 8.8 | 2023-09-20 | TPLINK TL-ER5120G 4.0 2.0.0 Build 210817 Rel.80868n has a command injection vulnerability, when an attacker adds NAPT rules after authentication, and the rule… |
CVE-2023-43137 | High | 8.8 | 2023-09-20 | TPLINK TL-ER5120G 4.0 2.0.0 Build 210817 Rel.80868n has a command injection vulnerability, when an attacker adds ACL rules after authentication, and the rule n… |
CVE-2023-43134 | Critical | 9.8 | 2023-09-20 | There is an unauthorized access vulnerability in Netis 360RAC1200 v1.3.4517, which allows attackers to obtain sensitive information of the device without authe… |
CVE-2023-42335 | High | 8.8 | 2023-09-20 | Unrestricted File Upload vulnerability in Fl3xx Dispatch 2.10.37 and fl3xx Crew 2.10.37 allows a remote attacker to execute arbitrary code via the add attachme… |
CVE-2023-42334 | Medium | 6.5 | 2023-09-20 | An Indirect Object Reference (IDOR) in Fl3xx Dispatch 2.10.37 and fl3xx Crew 2.10.37 allows a remote attacker to escalate privileges via the user parameter. |
CVE-2023-42331 | High | 8.8 | 2023-09-20 | A file upload vulnerability in EliteCMS v1.01 allows a remote attacker to execute arbitrary code via the manage_uploads.php component. |
CVE-2023-42147 | High | 7.5 | 2023-09-20 | An issue in CloudExplorer Lite 1.3.1 allows an attacker to obtain sensitive information via the login key component. |
CVE-2023-41484 | High | 8.1 | 2023-09-20 | An issue in cimg.eu Cimg Library v2.9.3 allows an attacker to obtain sensitive information via a crafted JPEG file. |
CVE-2023-40930 | Medium | 6.8 | 2023-09-20 | An issue in the directory /system/bin/blkid of Skyworth v3.0 allows attackers to perform a directory traversal via mounting the Udisk to /mnt/. |
CVE-2023-39052 | Medium | 6.5 | 2023-09-20 | An information leak in Earthgarden_waiting 13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39045 | Medium | 6.5 | 2023-09-20 | An information leak in kokoroe_members card Line 13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-38718 | Low | 3.7 | 2023-09-20 | IBM Robotic Process Automation 21.0.0 through 21.0.7.8 could disclose sensitive information from access to RPA scripts, workflows and related data. IBM X-Forc… |
CVE-2023-37410 | High | 8.4 | 2023-09-20 | IBM Personal Communications 14.05, 14.06, and 15.0.0 could allow a local user to escalate their privileges to the SYSTEM user due to overly permissive access c… |
CVE-2023-43377 | Medium | 5.4 | 2023-09-20 | A cross-site scripting (XSS) vulnerability in /hoteldruid/visualizza_contratto.php of Hoteldruid v3.0.5 allows attackers to execute arbitrary web scripts or HT… |
CVE-2023-43376 | Medium | 5.4 | 2023-09-20 | A cross-site scripting (XSS) vulnerability in /hoteldruid/clienti.php of Hoteldruid v3.0.5 allows attackers to execute arbitrary web scripts or HTML via a craf… |
CVE-2023-43375 | Critical | 9.8 | 2023-09-20 | Hoteldruid v3.0.5 was discovered to contain multiple SQL injection vulnerabilities at /hoteldruid/clienti.php via the annonascita, annoscaddoc, giornonascita… |
CVE-2023-43374 | Critical | 9.8 | 2023-09-20 | Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the id_utente_log parameter at /hoteldruid/personalizza.php. |
CVE-2023-43373 | Critical | 9.8 | 2023-09-20 | Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the n_utente_agg parameter at /hoteldruid/interconnessioni.php. |
CVE-2023-43371 | Critical | 9.8 | 2023-09-20 | Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the numcaselle parameter at /hoteldruid/creaprezzi.php. |
CVE-2023-40368 | Medium | 4.4 | 2023-09-20 | IBM Storage Protect 8.1.0.0 through 8.1.19.0 could allow a privileged user to obtain sensitive information from the administrative command line client. IBM X-… |
CVE-2023-39041 | Medium | 6.5 | 2023-09-20 | An information leak in KUKURUDELI Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-40619 | Critical | 9.8 | 2023-09-20 | phpPgAdmin 7.14.4 and earlier is vulnerable to deserialization of untrusted data which may lead to remote code execution because user-controlled data is direct… |
CVE-2023-40618 | Medium | 6.1 | 2023-09-20 | A reflected cross-site scripting (XSS) vulnerability in OpenKnowledgeMaps Head Start versions 4, 5, 6, 7 as well as Visual Project Explorer 1.0, allows remote… |
CVE-2023-39044 | Medium | 6.5 | 2023-09-20 | An information leak in ajino-Shiretoko Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-20597 | Medium | 5.5 | 2023-09-20 | Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access. |
CVE-2023-20594 | Medium | 4.4 | 2023-09-20 | Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access. |
CVE-2023-43502 | Medium | 4.3 | 2023-09-20 | A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to delete Failure Causes. |
CVE-2023-43501 | Medium | 6.5 | 2023-09-20 | A missing permission check in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-s… |
CVE-2023-43500 | High | 8.8 | 2023-09-20 | A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to connect to an attacker-specifi… |
CVE-2023-43499 | Medium | 5.4 | 2023-09-20 | Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not escape Failure Cause names in build logs, resulting in a stored cross-site scripting (XSS) vul… |
CVE-2023-43498 | High | 8.1 | 2023-09-20 | In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates temporary files in the default system temp… |
CVE-2023-43497 | High | 8.1 | 2023-09-20 | In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using the Stapler web framework creates temporary files in the default system te… |
CVE-2023-43496 | High | 8.8 | 2023-09-20 | Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates a temporary file in the system temporary directory with the default permissions for newly created fi… |
CVE-2023-43495 | Medium | 5.4 | 2023-09-20 | Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the 'caption' constructor parameter of 'ExpandableDetailsNote', resulting in a… |
CVE-2023-43494 | Medium | 4.3 | 2023-09-20 | Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive build variables (e.g., password parameter v… |
CVE-2023-42660 | High | 8.8 | 2023-09-20 | In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability… |
CVE-2023-42656 | Medium | 6.1 | 2023-09-20 | In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a reflected cross-site script… |
CVE-2023-40043 | High | 7.2 | 2023-09-20 | In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability… |
CVE-2023-5074 | Critical | 9.8 | 2023-09-20 | Use of a static key to protect a JWT token used in user authentication can allow an for an authentication bypass in D-Link D-View 8 v2.0.1.28 |
CVE-2023-2508 | Medium | 5.3 | 2023-09-20 | The `PaperCutNG Mobility Print` version 1.0.3512 application allows an unauthenticated attacker to perform a CSRF attack on an instance administrator to conf… |
CVE-2023-2262 | Critical | 9.8 | 2023-09-20 | A buffer overflow vulnerability exists in the Rockwell Automation select 1756-EN* communication devices. If exploited, a threat actor could potentially leve… |
CVE-2023-43636 | High | 8.8 | 2023-09-20 | In EVE OS, the “measured boot” mechanism prevents a compromised device from accessing the encrypted data located in the vault. As per the “measured boot” d… |
CVE-2023-43635 | High | 8.8 | 2023-09-20 | Vault Key Sealed With SHA1 PCRs The measured boot solution implemented in EVE OS leans on a PCR locking mechanism. Different parts of the system update… |
CVE-2023-43630 | High | 8.8 | 2023-09-20 | PCR14 is not in the list of PCRs that seal/unseal the “vault” key, but due to the change that was implemented in commit “7638364bc0acf8b5c481b5ce5fea11ad44ad7f… |
CVE-2023-42464 | Critical | 9.8 | 2023-09-20 | A Type Confusion vulnerability was found in the Spotlight RPC functions in afpd in Netatalk 3.1.x before 3.1.17. When parsing Spotlight RPC packets, one encode… |
CVE-2023-43478 | High | 8.8 | 2023-09-20 | fake_upload.cgi on the Telstra Smart Modem Gen 2 (Arcadyan LH1000), firmware versions < 0.18.15r, allows unauthenticated attackers to upload firmware images an… |
CVE-2023-43207 | Critical | 9.8 | 2023-09-20 | D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function config_upload_handler. This vulnerability allows… |
CVE-2023-43206 | Critical | 9.8 | 2023-09-20 | D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function web_cert_download_handler. This vulnerability all… |
CVE-2023-43204 | Critical | 9.8 | 2023-09-20 | D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function sub_2EF50. This vulnerability allows attackers to… |
CVE-2023-43203 | Critical | 9.8 | 2023-09-20 | D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a stack overflow vulnerability in the function update_users. |
CVE-2023-43202 | Critical | 9.8 | 2023-09-20 | D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function pcap_download_handler. This vulnerability allows… |
CVE-2023-43201 | Critical | 9.8 | 2023-09-20 | D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the hi_up parameter in the qos_ext.asp function. |
CVE-2023-43200 | Critical | 9.8 | 2023-09-20 | D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the id parameter in the yyxz.data function. |
CVE-2023-43199 | Critical | 9.8 | 2023-09-20 | D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the prev parameter in the H5/login.cgi function. |
CVE-2023-43198 | Critical | 9.8 | 2023-09-20 | D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the popupId parameter in the H5/hi_block.asp function. |
CVE-2023-43197 | Critical | 9.8 | 2023-09-20 | D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the fn parameter in the tgfile.asp function. |
CVE-2023-43196 | Critical | 9.8 | 2023-09-20 | D-Link DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the zn_jb parameter in the arp_sys.asp function. |
CVE-2023-41902 | High | 7.8 | 2023-09-20 | An XPC misconfiguration vulnerability in CoreCode MacUpdater before 2.3.8, and 3.x before 3.1.2, allows attackers to escalate privileges by crafting malicious… |
CVE-2023-0462 | High | 8.0 | 2023-09-20 | An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary code on the underlying operating system by setti… |
CVE-2023-0118 | Critical | 9.1 | 2023-09-20 | An arbitrary code execution flaw was found in Foreman. This flaw allows an admin user to bypass safe mode in templates and execute arbitrary code on the underl… |
CVE-2023-4236 | High | 7.5 | 2023-09-20 | A flaw in the networking code handling DNS-over-TLS queries may cause `named` to terminate unexpectedly due to an assertion failure. This happens when internal… |
CVE-2023-43477 | Medium | 6.8 | 2023-09-20 | The ping_from parameter of ping_tracerte.cgi in the web UI of Telstra Smart Modem Gen 2 (Arcadyan LH1000), firmware versions < 0.18.15r, was not properly sanit… |
CVE-2023-3341 | High | 7.5 | 2023-09-20 | The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing. Recursion depth is only limited by… |
CVE-2023-0829 | High | 8.8 | 2023-09-20 | Plesk 17.0 through 18.0.31 version, is vulnerable to a Cross-Site Scripting. A malicious subscription owner (either a customer or an additional user), can full… |
CVE-2023-5042 | High | 7.5 | 2023-09-20 | Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before bu… |
CVE-2023-5084 | Low | 3.9 | 2023-09-20 | Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.8.8. |
CVE-2023-4853 | High | 8.1 | 2023-09-20 | A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in inco… |
CVE-2023-34047 | Low | 3.1 | 2023-09-20 | A batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context with values, including security contex… |
CVE-2023-41375 | High | 7.8 | 2023-09-20 | Use after free vulnerability exists in Kostac PLC Programming Software Version 1.6.11.0. Arbitrary code may be executed by having a user open a specially craft… |
CVE-2023-41374 | High | 7.8 | 2023-09-20 | Double free issue exists in Kostac PLC Programming Software Version 1.6.11.0 and earlier. Arbitrary code may be executed by having a user open a specially craf… |
CVE-2023-22644 | Medium | 5.5 | 2023-09-20 | A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malici… |
CVE-2023-43621 | Medium | 4.7 | 2023-09-20 | An issue was discovered in Croc through 9.6.5. The shared secret, located on a command line, can be read by local users who list all processes and their argume… |
CVE-2023-43620 | High | 7.8 | 2023-09-20 | An issue was discovered in Croc through 9.6.5. A sender may place ANSI or CSI escape sequences in a filename to attack the terminal device of a receiver. |
CVE-2023-43619 | High | 7.8 | 2023-09-20 | An issue was discovered in Croc through 9.6.5. A sender may send dangerous new files to a receiver, such as executable content or a .ssh/authorized_keys file. |
CVE-2023-43618 | Medium | 5.3 | 2023-09-20 | An issue was discovered in Croc through 9.6.5. The protocol requires a sender to provide its local IP addresses in cleartext via an ips? message. |
CVE-2023-43617 | Medium | 5.3 | 2023-09-20 | An issue was discovered in Croc through 9.6.5. When a custom shared secret is used, the sender and receiver may divulge parts of this secret to an untrusted Re… |
CVE-2023-43616 | Medium | 5.5 | 2023-09-20 | An issue was discovered in Croc through 9.6.5. A sender can cause a receiver to overwrite files during ZIP extraction. |
CVE-2023-2163 | Critical | 10.0 | 2023-09-20 | Incorrect verifier pruning in BPF in Linux Kernel >=5.4 leads to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kerne… |
CVE-2023-26144 | Medium | 5.3 | 2023-09-20 | Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanB… |
CVE-2023-5063 | Medium | 6.4 | 2023-09-20 | The Widget Responsive for Youtube plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'youtube' shortcode in versions up to, and including, 1… |
CVE-2023-5062 | Medium | 6.4 | 2023-09-20 | The WordPress Charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wp_charts' shortcode in versions up to, and including, 0.7.0 due to… |
CVE-2023-4088 | Critical | 9.3 | 2023-09-20 | Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products allows a malicious local attacker to e… |
CVE-2023-31015 | Medium | 6.6 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in the REST service where a host user may cause as improper authentication issue. A successful exploit of this vul… |
CVE-2023-31014 | Medium | 4.2 | 2023-09-20 | NVIDIA GeForce Now for Android contains a vulnerability in the game launcher component, where a malicious application on the same device can process the implic… |
CVE-2023-31013 | Medium | 6.1 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in the REST service, where an attacker may cause improper input validation. A successful exploit of this vulnerabi… |
CVE-2023-31012 | Medium | 6.1 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in the REST service where an attacker may cause improper input validation. A successful exploit of this vulnerabil… |
CVE-2023-31011 | Medium | 5.2 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in the REST service where an attacker may cause improper input validation. A successful exploit of this vulnerabil… |
CVE-2023-31010 | Medium | 6.8 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause improper input validation. A successful exploit of this vulnerability may lea… |
CVE-2023-38888 | Critical | 9.6 | 2023-09-20 | Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code… |
CVE-2023-38887 | High | 8.8 | 2023-09-20 | File Upload vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to execute arbitrary code and obtain sensitive information via the e… |
CVE-2023-38886 | High | 7.2 | 2023-09-20 | An issue in Dolibarr ERP CRM v.17.0.1 and before allows a remote privileged attacker to execute arbitrary code via a crafted command/script. |
CVE-2023-31009 | High | 8.3 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in the REST service, where an attacker may cause improper input validation. A successful exploit of this vulnerabi… |
CVE-2023-31008 | High | 7.3 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause improper input validation. A successful exploit of this vulnerability may lea… |
CVE-2023-25534 | Medium | 5.7 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause improper input validation. A successful exploit of this vulnerability may lea… |
CVE-2023-25533 | High | 8.3 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in the web UI, where an attacker may cause improper input validation. A successful exploit of this vulnerability m… |
CVE-2023-25532 | Medium | 6.5 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause insufficient protection of credentials. A successful exploit of this vulnerab… |
CVE-2023-25531 | High | 7.6 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause insufficient protection of credentials. A successful exploit of this vulnerab… |