2023 CVEs (page 157)
Page 157 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-5033 | Medium | 6.3 | 2023-09-18 | A vulnerability classified as critical has been found in OpenRapid RapidCMS 1.3.1. This affects an unknown part of the file /admin/category/cate-edit-run.php… |
CVE-2023-5032 | Medium | 6.3 | 2023-09-18 | A vulnerability was found in OpenRapid RapidCMS 1.3.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/a… |
CVE-2023-41349 | High | 8.8 | 2023-09-18 | ASUS router RT-AX88U has a vulnerability of using externally controllable format strings within its Advanced Open VPN function. An authenticated remote attack… |
CVE-2023-35851 | High | 7.5 | 2023-09-18 | SUNNET WMPro portal's FAQ function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL commands to obtain… |
CVE-2023-35850 | High | 7.2 | 2023-09-18 | SUNNET WMPro portal's file management function has a vulnerability of insufficient filtering for user input. A remote attacker with administrator privilege or… |
CVE-2023-5031 | Medium | 6.3 | 2023-09-18 | A vulnerability was found in OpenRapid RapidCMS 1.3.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2023-5030 | Medium | 5.5 | 2023-09-17 | A vulnerability has been found in Tongda OA up to 11.10 and classified as critical. This vulnerability affects unknown code of the file general/hr/recruit/plan… |
CVE-2023-5029 | Medium | 5.5 | 2023-09-17 | A vulnerability, which was classified as critical, was found in mccms 2.6. This affects an unknown part of the file /category/order/hits/copyright/46/finish/1/… |
CVE-2023-5027 | Medium | 6.3 | 2023-09-17 | A vulnerability classified as critical was found in SourceCodester Simple Membership System 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2023-5028 | Low | 2.0 | 2023-09-17 | A vulnerability, which was classified as problematic, has been found in China Unicom TEWA-800G 4.16L.04_CT2015_Yueme. Affected by this issue is some unknown fu… |
CVE-2023-5026 | Low | 3.5 | 2023-09-17 | A vulnerability classified as problematic has been found in Tongda OA 11.10. Affected is an unknown function of the file /general/ipanel/menu_code.php?MENU_TYP… |
CVE-2023-5025 | Low | 3.5 | 2023-09-17 | A vulnerability was found in KOHA up to 23.05.03. It has been declared as problematic. This vulnerability affects unknown code of the file /cgi-bin/koha/catalo… |
CVE-2023-5024 | Low | 3.5 | 2023-09-17 | A vulnerability was found in Planno 23.04.04. It has been classified as problematic. This affects an unknown part of the component Comment Handler. The manipul… |
CVE-2023-5023 | Medium | 5.5 | 2023-09-17 | A vulnerability was found in Tongda OA 2017 and classified as critical. Affected by this issue is some unknown functionality of the file general/hr/manage/staf… |
CVE-2023-5022 | Medium | 5.5 | 2023-09-17 | A vulnerability has been found in DedeCMS up to 5.7.100 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /inc… |
CVE-2023-5021 | Low | 3.5 | 2023-09-17 | A vulnerability, which was classified as problematic, was found in SourceCodester AC Repair and Services System 1.0. Affected is an unknown function of the fil… |
CVE-2023-5020 | High | 7.3 | 2023-09-17 | A vulnerability, which was classified as critical, has been found in 07FLY CRM V2. This issue affects some unknown processing of the file /index.php/sysmanage/… |
CVE-2023-38040 | Medium | 6.1 | 2023-09-17 | A reflected XSS vulnerability exists in Revive Adserver 5.4.1 and earlier versions.. |
CVE-2023-5019 | Medium | 6.3 | 2023-09-17 | A vulnerability classified as critical was found in Tongda OA. This vulnerability affects unknown code of the file general/hr/manage/staff_reinstatement/delete… |
CVE-2023-5018 | Medium | 6.3 | 2023-09-17 | A vulnerability classified as critical has been found in SourceCodester Lost and Found Information System 1.0. This affects an unknown part of the file /classe… |
CVE-2023-5017 | Medium | 5.5 | 2023-09-17 | A vulnerability was found in lmxcms up to 1.41. It has been rated as critical. Affected by this issue is some unknown functionality of the file admin.php. The… |
CVE-2023-5016 | Medium | 6.3 | 2023-09-17 | A vulnerability was found in spider-flow up to 0.5.0. It has been declared as critical. Affected by this vulnerability is the function DriverManager.getConnect… |
CVE-2023-5015 | Low | 3.5 | 2023-09-17 | A vulnerability was found in UCMS 1.4.7. It has been classified as problematic. Affected is an unknown function of the file ajax.php?do=strarraylist. The manip… |
CVE-2023-5014 | Medium | 6.3 | 2023-09-17 | A vulnerability was found in Sakshi2610 Food Ordering Website 1.0 and classified as critical. This issue affects some unknown processing of the file categoryfo… |
CVE-2023-5013 | Low | 2.6 | 2023-09-16 | A vulnerability has been found in Pluck CMS 4.7.18 and classified as problematic. This vulnerability affects unknown code of the file install.php of the compon… |
CVE-2023-5012 | Medium | 5.3 | 2023-09-16 | A vulnerability, which was classified as problematic, was found in Topaz OFD 2.11.0.201. This affects an unknown part of the file C:\Program Files\Topaz OFD\Wa… |
CVE-2023-3025 | High | 7.2 | 2023-09-16 | The Dropbox Folder Share plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.9.7 via the 'link' parameter. Th… |
CVE-2023-41157 | Medium | 5.4 | 2023-09-16 | Multiple stored cross-site scripting (XSS) vulnerabilities in Usermin 2.000 allow remote attackers to inject arbitrary web script or HTML via the folder name p… |
CVE-2023-5001 | Medium | 6.4 | 2023-09-16 | The Horizontal scrolling announcement plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'horizontal-scrolling' shortcode in versions up to… |
CVE-2023-4994 | Critical | 9.9 | 2023-09-16 | The Allow PHP in Posts and Pages plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.0.4 via the 'php' shortcode. T… |
CVE-2023-42336 | Critical | 9.8 | 2023-09-16 | An issue in NETIS SYSTEMS WF2409Ev4 v.1.0.1.705 allows a remote attacker to execute arbitrary code and obtain sensitive information via the password parameter… |
CVE-2023-39777 | Medium | 5.4 | 2023-09-16 | A cross-site scripting (XSS) vulnerability in the Admin Control Panel of vBulletin 5.7.5 and 6.0.0 allows attackers to execute arbitrary web scripts or HTML vi… |
CVE-2023-39612 | Critical | 9.0 | 2023-09-16 | A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate privileges to Administrator via user inte… |
CVE-2023-41436 | Medium | 5.4 | 2023-09-16 | Cross Site Scripting vulnerability in CSZCMS v.1.3.0 allows a local attacker to execute arbitrary code via a crafted script to the Additional Meta Tag paramete… |
CVE-2023-36160 | Medium | 5.5 | 2023-09-16 | An issue was discovered in Qubo Smart Plug10A version HSP02_01_01_14_SYSTEM-10 A, allows local attackers to gain sensitive information and other unspecified im… |
CVE-2023-41626 | Medium | 4.8 | 2023-09-15 | Gradio v3.27.0 was discovered to contain an arbitrary file upload vulnerability via the /upload interface. |
CVE-2023-36735 | Critical | 9.6 | 2023-09-15 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2023-36727 | Medium | 6.1 | 2023-09-15 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2023-36562 | High | 7.1 | 2023-09-15 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2023-42442 | High | 8.2 | 2023-09-15 | JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3… |
CVE-2023-42439 | High | 7.5 | 2023-09-15 | GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. A SSRF vulnerability exists starting in ve… |
CVE-2023-41900 | Low | 3.5 | 2023-09-15 | Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `Op… |
CVE-2023-41889 | Medium | 5.3 | 2023-09-15 | SHIRASAGI is a Content Management System. Prior to version 1.18.0, SHIRASAGI is vulnerable to a Post-Unicode normalization issue. This happens when a logical v… |
CVE-2023-41887 | Critical | 9.8 | 2023-09-15 | OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, a remote code execution vulnerability allows any unauthent… |
CVE-2023-41886 | High | 7.5 | 2023-09-15 | OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, an arbitrary file read vulnerability allows any unauthenti… |
CVE-2023-0923 | High | 8.8 | 2023-09-15 | A flaw was found in the Kubernetes service for notebooks in RHODS, where it does not prevent pods from other namespaces and applications from making requests t… |
CVE-2023-0813 | High | 7.5 | 2023-09-15 | A flaw was found in the Network Observability plugin for OpenShift console. Unless the Loki authToken configuration is set to FORWARD mode, authentication is n… |
CVE-2023-41880 | Low | 2.2 | 2023-09-15 | Wasmtime is a standalone runtime for WebAssembly. Wasmtime versions from 10.0.0 to versions 10.02, 11.0.2, and 12.0.1 contain a miscompilation of the WebAssemb… |
CVE-2023-41325 | High | 7.4 | 2023-09-15 | OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technolog… |
CVE-2023-41043 | Medium | 6.5 | 2023-09-15 | Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branche… |
CVE-2023-41042 | Medium | 4.9 | 2023-09-15 | Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branche… |
CVE-2023-40588 | Medium | 6.5 | 2023-09-15 | Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branche… |
CVE-2023-40167 | Medium | 5.3 | 2023-09-15 | Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the con… |
CVE-2023-40019 | High | 7.5 | 2023-09-15 | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on… |
CVE-2023-40018 | High | 7.5 | 2023-09-15 | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on… |
CVE-2023-38706 | Medium | 6.5 | 2023-09-15 | Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branche… |
CVE-2023-38507 | High | 7.3 | 2023-09-15 | Strapi is the an open-source headless content management system. Prior to version 4.12.1, there is a rate limit on the login function of Strapi's admin screen… |
CVE-2023-37459 | Medium | 5.3 | 2023-09-15 | Contiki-NG is an operating system for internet-of-things devices. In versions 4.9 and prior, when a packet is received, the Contiki-NG network stack attempts t… |
CVE-2023-37281 | Medium | 5.3 | 2023-09-15 | Contiki-NG is an operating system for internet-of-things devices. In versions 4.9 and prior, when processing the various IPv6 header fields during IPHC header… |
CVE-2023-37263 | Medium | 6.8 | 2023-09-15 | Strapi is the an open-source headless content management system. Prior to version 4.12.1, field level permissions are not respected in the relationship title… |
CVE-2023-36479 | Low | 3.5 | 2023-09-15 | Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have t… |
CVE-2023-36472 | Medium | 5.8 | 2023-09-15 | Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if the… |
CVE-2023-42398 | Critical | 9.8 | 2023-09-15 | An issue in zzCMS v.2023 allows a remote attacker to execute arbitrary code and obtain sensitive information via the ueditor component in controller.php. |
CVE-2023-28614 | Critical | 9.8 | 2023-09-15 | Freewill iFIS (aka SMART Trade) 20.01.01.04 allows OS Command Injection via shell metacharacters to a report page. |
CVE-2023-4991 | High | 7.8 | 2023-09-15 | A vulnerability was found in NextBX QWAlerter 4.50. It has been rated as critical. Affected by this issue is some unknown functionality of the file QWAlerter.e… |
CVE-2023-4988 | Medium | 6.3 | 2023-09-15 | A vulnerability, which was classified as problematic, was found in Bettershop LaikeTui. This affects an unknown part of the file index.php?module=system&action… |
CVE-2023-4987 | Medium | 5.5 | 2023-09-15 | A vulnerability, which was classified as critical, has been found in infinitietech taskhub 2.8.7. Affected by this issue is some unknown functionality of the f… |
CVE-2023-4986 | Low | 2.5 | 2023-09-15 | A vulnerability classified as problematic was found in Supcon InPlant SCADA up to 20230901. Affected by this vulnerability is an unknown functionality of the f… |
CVE-2023-4985 | Medium | 5.9 | 2023-09-15 | A vulnerability classified as critical has been found in Supcon InPlant SCADA up to 20230901. Affected is an unknown function of the file Project.xml. The mani… |
CVE-2023-4984 | Medium | 4.3 | 2023-09-15 | A vulnerability was found in didi KnowSearch 0.3.2/0.3.1.2. It has been rated as problematic. This issue affects some unknown processing of the file /api/es/ad… |
CVE-2023-4983 | Medium | 4.3 | 2023-09-15 | A vulnerability was found in app1pro Shopicial up to 20230830. It has been declared as problematic. This vulnerability affects unknown code of the file search… |
CVE-2023-42270 | High | 8.8 | 2023-09-15 | Grocy <= 4.0.2 is vulnerable to Cross Site Request Forgery (CSRF). |
CVE-2023-4959 | Medium | 6.5 | 2023-09-15 | A flaw was found in Quay. Cross-site request forgery (CSRF) attacks force a user to perform unwanted actions in an application. During the pentest, it was dete… |
CVE-2023-4835 | Critical | 9.8 | 2023-09-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CF Software Oil Management Software allows SQL Injection… |
CVE-2023-4833 | Critical | 9.8 | 2023-09-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Besttem Network Marketing Software allows SQL Injection. … |
CVE-2023-4665 | High | 8.8 | 2023-09-15 | Incorrect Execution-Assigned Permissions vulnerability in Saphira Saphira Connect allows Privilege Escalation. This issue affects Saphira Connect: before 9. |
CVE-2023-4664 | High | 8.8 | 2023-09-15 | Incorrect Default Permissions vulnerability in Saphira Saphira Connect allows Privilege Escalation. This issue affects Saphira Connect: before 9. |
CVE-2023-4663 | Medium | 6.1 | 2023-09-15 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Saphira Saphira Connect allows Reflected XSS. This issue affect… |
CVE-2023-4662 | Critical | 9.8 | 2023-09-15 | Execution with Unnecessary Privileges vulnerability in Saphira Saphira Connect allows Remote Code Inclusion. This issue affects Saphira Connect: before 9. |
CVE-2023-4661 | Critical | 9.8 | 2023-09-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saphira Saphira Connect allows SQL Injection. This issue… |
CVE-2023-4831 | Critical | 9.8 | 2023-09-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ncode Ncep allows SQL Injection.This issue affects Ncep… |
CVE-2023-4670 | Critical | 9.8 | 2023-09-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Innosa Probbys allows SQL Injection. This issue affects… |
CVE-2023-4231 | Critical | 9.8 | 2023-09-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cevik Informatics Online Payment System allows SQL Inject… |
CVE-2023-32461 | Medium | 5.0 | 2023-09-15 | Dell PowerEdge BIOS and Dell Precision BIOS contain a buffer overflow vulnerability. A local malicious user with high privileges could potentially exploit th… |
CVE-2023-4830 | Critical | 9.8 | 2023-09-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tura Signalix allows SQL Injection. This issue affects S… |
CVE-2023-4673 | Critical | 9.8 | 2023-09-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sanalogy Turasistan allows SQL Injection. This issue aff… |
CVE-2023-36659 | Critical | 9.8 | 2023-09-15 | An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. Long inputs were not properly processed, which allows remote attackers to cause a denial of se… |
CVE-2023-36657 | Critical | 9.8 | 2023-09-15 | An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. Built-in features of Windows (desktop shortcuts, narrator) can be abused for privilege escalat… |
CVE-2023-36658 | High | 7.8 | 2023-09-15 | An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. It has an unquoted service path that can be abused locally. |
CVE-2023-40983 | Medium | 6.1 | 2023-09-15 | A reflected cross-site scripting (XSS) vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting… |
CVE-2023-38039 | High | 7.5 | 2023-09-15 | When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not hav… |
CVE-2023-4974 | Medium | 6.3 | 2023-09-15 | A vulnerability was found in Academy LMS 6.2. It has been rated as critical. Affected by this issue is some unknown functionality of the file /academy/tutor/fi… |
CVE-2023-4963 | Medium | 6.4 | 2023-09-15 | The WS Facebook Like Box Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'ws-facebook-likebox' shortcode in versions up to, and in… |
CVE-2023-40982 | Medium | 5.4 | 2023-09-15 | A stored cross-site scripting (XSS) vulnerability in Webmin v2.100 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected int… |
CVE-2023-3891 | High | 7.3 | 2023-09-15 | Race condition in Lapce v0.2.8 allows an attacker to elevate privileges on the system |
CVE-2023-4973 | Low | 3.5 | 2023-09-15 | A vulnerability was found in Academy LMS 6.2 on Windows. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the… |
CVE-2023-4982 | Medium | 5.4 | 2023-09-15 | Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 23.9.0. |
CVE-2023-4981 | Medium | 5.4 | 2023-09-15 | Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.0. |
CVE-2023-4980 | Medium | 5.4 | 2023-09-15 | Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 23.9.0. |
CVE-2023-4979 | Medium | 5.4 | 2023-09-15 | Cross-site Scripting (XSS) - Reflected in GitHub repository librenms/librenms prior to 23.9.0. |