2023 CVEs (page 157)
Page 157 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-5009 | High | 8.2 | 2023-09-19 | An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.2.7, all versions starting from 16.3 before 16.3.4. It was possi… |
CVE-2023-5054 | Medium | 5.8 | 2023-09-19 | The Super Store Finder plugin for WordPress is vulnerable to unauthenticated arbitrary email creation and relay in versions up to, and including, 6.9.3. This i… |
CVE-2023-26143 | Medium | 6.5 | 2023-09-19 | Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile() API. The library does not sanitize for user in… |
CVE-2023-42399 | Medium | 6.1 | 2023-09-19 | Cross Site Scripting vulnerability in xdsoft.net Jodit Editor v.4.0.0-beta.86 allows a remote attacker to obtain sensitive information via the rich text editor… |
CVE-2023-5060 | Medium | 6.1 | 2023-09-19 | Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.1. |
CVE-2023-41599 | Medium | 5.3 | 2023-09-19 | An issue in the component /common/DownController.java of JFinalCMS v5.0.0 allows attackers to execute a directory traversal. |
CVE-2023-40788 | Medium | 5.3 | 2023-09-19 | SpringBlade <=V3.6.0 is vulnerable to Incorrect Access Control due to incorrect configuration in the default gateway resulting in unauthorized access to error… |
CVE-2023-42454 | Critical | 10.0 | 2023-09-18 | SQLpage is a SQL-only webapp builder. Someone using SQLpage versions prior to 0.11.1, whose SQLpage instance is exposed publicly, with a database connection st… |
CVE-2023-42446 | Medium | 6.5 | 2023-09-18 | Pow is a authentication and user management solution for Phoenix and Plug-based apps. Starting in version 1.0.14 and prior to version 1.0.34, use of `Pow.Store… |
CVE-2023-41443 | High | 7.2 | 2023-09-18 | SQL injection vulnerability in Novel-Plus v.4.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parameter in /sys/menu/li… |
CVE-2023-39056 | Medium | 6.5 | 2023-09-18 | An information leak in Coffee-jumbo v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39049 | Medium | 6.5 | 2023-09-18 | An information leak in youmart-tokunaga v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39046 | Medium | 6.5 | 2023-09-18 | An information leak in TonTon-Tei_waiting Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-37611 | Medium | 5.4 | 2023-09-18 | Cross Site Scripting (XSS) vulnerability in Neos CMS 8.3.3 allows a remote authenticated attacker to execute arbitrary code via a crafted SVG file to the neos/… |
CVE-2023-42443 | High | 8.1 | 2023-09-18 | Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In version 0.3.9 and prior, under certain conditions, the memory used by th… |
CVE-2023-42441 | Medium | 5.3 | 2023-09-18 | Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Starting in version 0.2.9 and prior to version 0.3.10, locks of the type `@… |
CVE-2023-39452 | High | 7.5 | 2023-09-18 | The web application that owns the device clearly stores the credentials within the user management section. Obtaining this information can be do… |
CVE-2023-39446 | High | 8.9 | 2023-09-18 | Thanks to the weaknesses that the web application has at the user management level, an attacker could obtain the information from the headers that is ne… |
CVE-2023-39058 | Medium | 6.5 | 2023-09-18 | An information leak in THE_B_members card v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39043 | Medium | 6.5 | 2023-09-18 | An information leak in YKC Tokushima_awayokocho Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39040 | Medium | 6.5 | 2023-09-18 | An information leak in Cheese Cafe Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39039 | Medium | 6.5 | 2023-09-18 | An information leak in Camp Style Project Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-38582 | Medium | 6.3 | 2023-09-18 | Persistent cross-site scripting (XSS) in the web application of MOD3GP-SY-120K allows an authenticated remote attacker to introduce arbitrary JavaScri… |
CVE-2023-38255 | Medium | 6.5 | 2023-09-18 | A potential attacker with or without (cookie theft) access to the device would be able to include malicious code (XSS) when uploading new devi… |
CVE-2023-41965 | High | 7.5 | 2023-09-18 | Sending some requests in the web application of the vulnerable device allows information to be obtained due to the lack of security in the authentication proce… |
CVE-2023-41084 | Critical | 10.0 | 2023-09-18 | Session management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions that the… |
CVE-2023-40221 | High | 8.8 | 2023-09-18 | The absence of filters when loading some sections in the web application of the vulnerable device allows potential attackers to inject malicious c… |
CVE-2023-33831 | Critical | 9.8 | 2023-09-18 | A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST… |
CVE-2023-41030 | Medium | 6.3 | 2023-09-18 | Hard-coded credentials in Juplink RX4-1500 versions V1.0.2 through V1.0.5 allow unauthenticated attackers to log in to the web interface or telnet service as t… |
CVE-2023-4806 | Medium | 5.9 | 2023-09-18 | A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an applicatio… |
CVE-2023-4527 | Medium | 6.5 | 2023-09-18 | A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/re… |
CVE-2023-42328 | High | 8.8 | 2023-09-18 | An issue in PeppermintLabs Peppermint v.0.2.4 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the hardcoded… |
CVE-2023-42320 | Critical | 9.8 | 2023-09-18 | Buffer Overflow vulnerability in Tenda AC10V4 v.US_AC10V4.0si_V16.03.10.13_cn_TDC01 allows a remote attacker to cause a denial of service via the mac parameter… |
CVE-2023-41595 | High | 7.5 | 2023-09-18 | An issue in xui-xray v1.8.3 allows attackers to obtain sensitive information via default password. |
CVE-2023-42387 | High | 7.5 | 2023-09-18 | An issue in TDSQL Chitu management platform v.10.3.19.5.0 allows a remote attacker to obtain sensitive information via get_db_info function in install.php. |
CVE-2023-42371 | Medium | 5.4 | 2023-09-18 | Cross Site Scripting vulnerability in Summernote Rich Text Editor v.0.8.18 and before allows a remote attacker to execute arbitrary code via a crafted script t… |
CVE-2023-34195 | High | 7.8 | 2023-09-18 | An issue was discovered in SystemFirmwareManagementRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. The implementation of the GetImage method retrie… |
CVE-2023-32187 | High | 7.5 | 2023-09-18 | An Allocation of Resources Without Limits or Throttling vulnerability in SUSE k3s allows attackers with access to K3s servers' apiserver/supervisor port (TCP 6… |
CVE-2023-42359 | Critical | 9.8 | 2023-09-18 | SQL injection vulnerability in Exam Form Submission in PHP with Source Code v.1.0 allows a remote attacker to escalate privileges via the val-username paramete… |
CVE-2023-42253 | Medium | 6.1 | 2023-09-18 | Code-Projects Vehicle Management 1.0 is vulnerable to Cross Site Scripting (XSS) in Add Accounts via Invoice No, To, and Mammul. |
CVE-2023-41929 | High | 7.3 | 2023-09-18 | A DLL hijacking vulnerability in Samsung Memory Card & UFD Authentication Utility PC Software before 1.0.1 could allow a local attacker to escalate privileges… |
CVE-2023-34999 | High | 8.4 | 2023-09-18 | A command injection vulnerability exists in RTS VLink Virtual Matrix Software Versions v5 (< 5.7.6) and v6 (< 6.5.0) that allows an attacker to perform arbitra… |
CVE-2023-43115 | High | 8.8 | 2023-09-18 | In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted PostScript documents because they can switch to the… |
CVE-2023-43114 | Medium | 5.5 | 2023-09-18 | An issue was discovered in Qt before 5.15.16, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3 on Windows. When using the GDI font engine, if a corrupte… |
CVE-2023-42525 | High | 7.5 | 2023-09-18 | Certain WithSecure products allow an infinite loop in a scanning engine via unspecified file types. This affects WithSecure Client Security 15, WithSecure Serv… |
CVE-2023-42524 | High | 7.5 | 2023-09-18 | Certain WithSecure products allow an infinite loop in a scanning engine via unspecified file types. This affects WithSecure Client Security 15, WithSecure Serv… |
CVE-2023-42523 | High | 7.5 | 2023-09-18 | Certain WithSecure products allow a remote crash of a scanning engine via unpacking of a PE file. This affects WithSecure Client Security 15, WithSecure Server… |
CVE-2023-42522 | High | 7.5 | 2023-09-18 | Certain WithSecure products allow a remote crash of a scanning engine via processing of an import struct in a PE file. This affects WithSecure Client Security… |
CVE-2023-42521 | High | 7.5 | 2023-09-18 | Certain WithSecure products allow a remote crash of a scanning engine via processing of a compressed file. This affects WithSecure Client Security 15, WithSecu… |
CVE-2023-5036 | High | 8.8 | 2023-09-18 | Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.15.1. |
CVE-2023-42526 | High | 7.5 | 2023-09-18 | Certain WithSecure products allow a remote crash of a scanning engine via decompression of crafted data files. This affects WithSecure Client Security 15, With… |
CVE-2023-42520 | High | 7.5 | 2023-09-18 | Certain WithSecure products allow a remote crash of a scanning engine via unpacking of crafted data files. This affects WithSecure Client Security 15, WithSecu… |
CVE-2023-5034 | Medium | 6.3 | 2023-09-18 | A vulnerability classified as problematic was found in SourceCodester My Food Recipe 1.0. This vulnerability affects unknown code of the file index.php of the… |
CVE-2023-5033 | Medium | 6.3 | 2023-09-18 | A vulnerability classified as critical has been found in OpenRapid RapidCMS 1.3.1. This affects an unknown part of the file /admin/category/cate-edit-run.php… |
CVE-2023-5032 | Medium | 6.3 | 2023-09-18 | A vulnerability was found in OpenRapid RapidCMS 1.3.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/a… |
CVE-2023-41349 | High | 8.8 | 2023-09-18 | ASUS router RT-AX88U has a vulnerability of using externally controllable format strings within its Advanced Open VPN function. An authenticated remote attack… |
CVE-2023-35851 | High | 7.5 | 2023-09-18 | SUNNET WMPro portal's FAQ function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL commands to obtain… |
CVE-2023-35850 | High | 7.2 | 2023-09-18 | SUNNET WMPro portal's file management function has a vulnerability of insufficient filtering for user input. A remote attacker with administrator privilege or… |
CVE-2023-5031 | Medium | 6.3 | 2023-09-18 | A vulnerability was found in OpenRapid RapidCMS 1.3.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2023-5030 | Medium | 5.5 | 2023-09-17 | A vulnerability has been found in Tongda OA up to 11.10 and classified as critical. This vulnerability affects unknown code of the file general/hr/recruit/plan… |
CVE-2023-5029 | Medium | 5.5 | 2023-09-17 | A vulnerability, which was classified as critical, was found in mccms 2.6. This affects an unknown part of the file /category/order/hits/copyright/46/finish/1/… |
CVE-2023-5027 | Medium | 6.3 | 2023-09-17 | A vulnerability classified as critical was found in SourceCodester Simple Membership System 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2023-5028 | Low | 2.0 | 2023-09-17 | A vulnerability, which was classified as problematic, has been found in China Unicom TEWA-800G 4.16L.04_CT2015_Yueme. Affected by this issue is some unknown fu… |
CVE-2023-5026 | Low | 3.5 | 2023-09-17 | A vulnerability classified as problematic has been found in Tongda OA 11.10. Affected is an unknown function of the file /general/ipanel/menu_code.php?MENU_TYP… |
CVE-2023-5025 | Low | 3.5 | 2023-09-17 | A vulnerability was found in KOHA up to 23.05.03. It has been declared as problematic. This vulnerability affects unknown code of the file /cgi-bin/koha/catalo… |
CVE-2023-5024 | Low | 3.5 | 2023-09-17 | A vulnerability was found in Planno 23.04.04. It has been classified as problematic. This affects an unknown part of the component Comment Handler. The manipul… |
CVE-2023-5023 | Medium | 5.5 | 2023-09-17 | A vulnerability was found in Tongda OA 2017 and classified as critical. Affected by this issue is some unknown functionality of the file general/hr/manage/staf… |
CVE-2023-5022 | Medium | 5.5 | 2023-09-17 | A vulnerability has been found in DedeCMS up to 5.7.100 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /inc… |
CVE-2023-5021 | Low | 3.5 | 2023-09-17 | A vulnerability, which was classified as problematic, was found in SourceCodester AC Repair and Services System 1.0. Affected is an unknown function of the fil… |
CVE-2023-5020 | High | 7.3 | 2023-09-17 | A vulnerability, which was classified as critical, has been found in 07FLY CRM V2. This issue affects some unknown processing of the file /index.php/sysmanage/… |
CVE-2023-38040 | Medium | 6.1 | 2023-09-17 | A reflected XSS vulnerability exists in Revive Adserver 5.4.1 and earlier versions.. |
CVE-2023-5019 | Medium | 6.3 | 2023-09-17 | A vulnerability classified as critical was found in Tongda OA. This vulnerability affects unknown code of the file general/hr/manage/staff_reinstatement/delete… |
CVE-2023-5018 | Medium | 6.3 | 2023-09-17 | A vulnerability classified as critical has been found in SourceCodester Lost and Found Information System 1.0. This affects an unknown part of the file /classe… |
CVE-2023-5017 | Medium | 5.5 | 2023-09-17 | A vulnerability was found in lmxcms up to 1.41. It has been rated as critical. Affected by this issue is some unknown functionality of the file admin.php. The… |
CVE-2023-5016 | Medium | 6.3 | 2023-09-17 | A vulnerability was found in spider-flow up to 0.5.0. It has been declared as critical. Affected by this vulnerability is the function DriverManager.getConnect… |
CVE-2023-5015 | Low | 3.5 | 2023-09-17 | A vulnerability was found in UCMS 1.4.7. It has been classified as problematic. Affected is an unknown function of the file ajax.php?do=strarraylist. The manip… |
CVE-2023-5014 | Medium | 6.3 | 2023-09-17 | A vulnerability was found in Sakshi2610 Food Ordering Website 1.0 and classified as critical. This issue affects some unknown processing of the file categoryfo… |
CVE-2023-5013 | Low | 2.6 | 2023-09-16 | A vulnerability has been found in Pluck CMS 4.7.18 and classified as problematic. This vulnerability affects unknown code of the file install.php of the compon… |
CVE-2023-5012 | Medium | 5.3 | 2023-09-16 | A vulnerability, which was classified as problematic, was found in Topaz OFD 2.11.0.201. This affects an unknown part of the file C:\Program Files\Topaz OFD\Wa… |
CVE-2023-3025 | High | 7.2 | 2023-09-16 | The Dropbox Folder Share plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.9.7 via the 'link' parameter. Th… |
CVE-2023-41157 | Medium | 5.4 | 2023-09-16 | Multiple stored cross-site scripting (XSS) vulnerabilities in Usermin 2.000 allow remote attackers to inject arbitrary web script or HTML via the folder name p… |
CVE-2023-5001 | Medium | 6.4 | 2023-09-16 | The Horizontal scrolling announcement plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'horizontal-scrolling' shortcode in versions up to… |
CVE-2023-4994 | Critical | 9.9 | 2023-09-16 | The Allow PHP in Posts and Pages plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.0.4 via the 'php' shortcode. T… |
CVE-2023-42336 | Critical | 9.8 | 2023-09-16 | An issue in NETIS SYSTEMS WF2409Ev4 v.1.0.1.705 allows a remote attacker to execute arbitrary code and obtain sensitive information via the password parameter… |
CVE-2023-39777 | Medium | 5.4 | 2023-09-16 | A cross-site scripting (XSS) vulnerability in the Admin Control Panel of vBulletin 5.7.5 and 6.0.0 allows attackers to execute arbitrary web scripts or HTML vi… |
CVE-2023-39612 | Critical | 9.0 | 2023-09-16 | A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate privileges to Administrator via user inte… |
CVE-2023-41436 | Medium | 5.4 | 2023-09-16 | Cross Site Scripting vulnerability in CSZCMS v.1.3.0 allows a local attacker to execute arbitrary code via a crafted script to the Additional Meta Tag paramete… |
CVE-2023-36160 | Medium | 5.5 | 2023-09-16 | An issue was discovered in Qubo Smart Plug10A version HSP02_01_01_14_SYSTEM-10 A, allows local attackers to gain sensitive information and other unspecified im… |
CVE-2023-41626 | Medium | 4.8 | 2023-09-15 | Gradio v3.27.0 was discovered to contain an arbitrary file upload vulnerability via the /upload interface. |
CVE-2023-36735 | Critical | 9.6 | 2023-09-15 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2023-36727 | Medium | 6.1 | 2023-09-15 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2023-36562 | High | 7.1 | 2023-09-15 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2023-42442 | High | 8.2 | 2023-09-15 | JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3… |
CVE-2023-42439 | High | 7.5 | 2023-09-15 | GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. A SSRF vulnerability exists starting in ve… |
CVE-2023-41900 | Low | 3.5 | 2023-09-15 | Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `Op… |
CVE-2023-41889 | Medium | 5.3 | 2023-09-15 | SHIRASAGI is a Content Management System. Prior to version 1.18.0, SHIRASAGI is vulnerable to a Post-Unicode normalization issue. This happens when a logical v… |
CVE-2023-41887 | Critical | 9.8 | 2023-09-15 | OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, a remote code execution vulnerability allows any unauthent… |
CVE-2023-41886 | High | 7.5 | 2023-09-15 | OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, an arbitrary file read vulnerability allows any unauthenti… |
CVE-2023-0923 | High | 8.8 | 2023-09-15 | A flaw was found in the Kubernetes service for notebooks in RHODS, where it does not prevent pods from other namespaces and applications from making requests t… |
CVE-2023-0813 | High | 7.5 | 2023-09-15 | A flaw was found in the Network Observability plugin for OpenShift console. Unless the Loki authToken configuration is set to FORWARD mode, authentication is n… |