2023 CVEs (page 158)
Page 158 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-41880 | Low | 2.2 | 2023-09-15 | Wasmtime is a standalone runtime for WebAssembly. Wasmtime versions from 10.0.0 to versions 10.02, 11.0.2, and 12.0.1 contain a miscompilation of the WebAssemb… |
CVE-2023-41325 | High | 7.4 | 2023-09-15 | OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technolog… |
CVE-2023-41043 | Medium | 6.5 | 2023-09-15 | Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branche… |
CVE-2023-41042 | Medium | 4.9 | 2023-09-15 | Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branche… |
CVE-2023-40588 | Medium | 6.5 | 2023-09-15 | Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branche… |
CVE-2023-40167 | Medium | 5.3 | 2023-09-15 | Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the con… |
CVE-2023-40019 | High | 7.5 | 2023-09-15 | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on… |
CVE-2023-40018 | High | 7.5 | 2023-09-15 | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on… |
CVE-2023-38706 | Medium | 6.5 | 2023-09-15 | Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branche… |
CVE-2023-38507 | High | 7.3 | 2023-09-15 | Strapi is the an open-source headless content management system. Prior to version 4.12.1, there is a rate limit on the login function of Strapi's admin screen… |
CVE-2023-37459 | Medium | 5.3 | 2023-09-15 | Contiki-NG is an operating system for internet-of-things devices. In versions 4.9 and prior, when a packet is received, the Contiki-NG network stack attempts t… |
CVE-2023-37281 | Medium | 5.3 | 2023-09-15 | Contiki-NG is an operating system for internet-of-things devices. In versions 4.9 and prior, when processing the various IPv6 header fields during IPHC header… |
CVE-2023-37263 | Medium | 6.8 | 2023-09-15 | Strapi is the an open-source headless content management system. Prior to version 4.12.1, field level permissions are not respected in the relationship title… |
CVE-2023-36479 | Low | 3.5 | 2023-09-15 | Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have t… |
CVE-2023-36472 | Medium | 5.8 | 2023-09-15 | Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if the… |
CVE-2023-42398 | Critical | 9.8 | 2023-09-15 | An issue in zzCMS v.2023 allows a remote attacker to execute arbitrary code and obtain sensitive information via the ueditor component in controller.php. |
CVE-2023-28614 | Critical | 9.8 | 2023-09-15 | Freewill iFIS (aka SMART Trade) 20.01.01.04 allows OS Command Injection via shell metacharacters to a report page. |
CVE-2023-4991 | High | 7.8 | 2023-09-15 | A vulnerability was found in NextBX QWAlerter 4.50. It has been rated as critical. Affected by this issue is some unknown functionality of the file QWAlerter.e… |
CVE-2023-4988 | Medium | 6.3 | 2023-09-15 | A vulnerability, which was classified as problematic, was found in Bettershop LaikeTui. This affects an unknown part of the file index.php?module=system&action… |
CVE-2023-4987 | Medium | 5.5 | 2023-09-15 | A vulnerability, which was classified as critical, has been found in infinitietech taskhub 2.8.7. Affected by this issue is some unknown functionality of the f… |
CVE-2023-4986 | Low | 2.5 | 2023-09-15 | A vulnerability classified as problematic was found in Supcon InPlant SCADA up to 20230901. Affected by this vulnerability is an unknown functionality of the f… |
CVE-2023-4985 | Medium | 5.9 | 2023-09-15 | A vulnerability classified as critical has been found in Supcon InPlant SCADA up to 20230901. Affected is an unknown function of the file Project.xml. The mani… |
CVE-2023-4984 | Medium | 4.3 | 2023-09-15 | A vulnerability was found in didi KnowSearch 0.3.2/0.3.1.2. It has been rated as problematic. This issue affects some unknown processing of the file /api/es/ad… |
CVE-2023-4983 | Medium | 4.3 | 2023-09-15 | A vulnerability was found in app1pro Shopicial up to 20230830. It has been declared as problematic. This vulnerability affects unknown code of the file search… |
CVE-2023-42270 | High | 8.8 | 2023-09-15 | Grocy <= 4.0.2 is vulnerable to Cross Site Request Forgery (CSRF). |
CVE-2023-4959 | Medium | 6.5 | 2023-09-15 | A flaw was found in Quay. Cross-site request forgery (CSRF) attacks force a user to perform unwanted actions in an application. During the pentest, it was dete… |
CVE-2023-4835 | Critical | 9.8 | 2023-09-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CF Software Oil Management Software allows SQL Injection… |
CVE-2023-4833 | Critical | 9.8 | 2023-09-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Besttem Network Marketing Software allows SQL Injection. … |
CVE-2023-4665 | High | 8.8 | 2023-09-15 | Incorrect Execution-Assigned Permissions vulnerability in Saphira Saphira Connect allows Privilege Escalation. This issue affects Saphira Connect: before 9. |
CVE-2023-4664 | High | 8.8 | 2023-09-15 | Incorrect Default Permissions vulnerability in Saphira Saphira Connect allows Privilege Escalation. This issue affects Saphira Connect: before 9. |
CVE-2023-4663 | Medium | 6.1 | 2023-09-15 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Saphira Saphira Connect allows Reflected XSS. This issue affect… |
CVE-2023-4662 | Critical | 9.8 | 2023-09-15 | Execution with Unnecessary Privileges vulnerability in Saphira Saphira Connect allows Remote Code Inclusion. This issue affects Saphira Connect: before 9. |
CVE-2023-4661 | Critical | 9.8 | 2023-09-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saphira Saphira Connect allows SQL Injection. This issue… |
CVE-2023-4831 | Critical | 9.8 | 2023-09-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ncode Ncep allows SQL Injection.This issue affects Ncep… |
CVE-2023-4670 | Critical | 9.8 | 2023-09-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Innosa Probbys allows SQL Injection. This issue affects… |
CVE-2023-4231 | Critical | 9.8 | 2023-09-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cevik Informatics Online Payment System allows SQL Inject… |
CVE-2023-32461 | Medium | 5.0 | 2023-09-15 | Dell PowerEdge BIOS and Dell Precision BIOS contain a buffer overflow vulnerability. A local malicious user with high privileges could potentially exploit th… |
CVE-2023-4830 | Critical | 9.8 | 2023-09-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tura Signalix allows SQL Injection. This issue affects S… |
CVE-2023-4673 | Critical | 9.8 | 2023-09-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sanalogy Turasistan allows SQL Injection. This issue aff… |
CVE-2023-36659 | Critical | 9.8 | 2023-09-15 | An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. Long inputs were not properly processed, which allows remote attackers to cause a denial of se… |
CVE-2023-36657 | Critical | 9.8 | 2023-09-15 | An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. Built-in features of Windows (desktop shortcuts, narrator) can be abused for privilege escalat… |
CVE-2023-36658 | High | 7.8 | 2023-09-15 | An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. It has an unquoted service path that can be abused locally. |
CVE-2023-40983 | Medium | 6.1 | 2023-09-15 | A reflected cross-site scripting (XSS) vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting… |
CVE-2023-38039 | High | 7.5 | 2023-09-15 | When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not hav… |
CVE-2023-4974 | Medium | 6.3 | 2023-09-15 | A vulnerability was found in Academy LMS 6.2. It has been rated as critical. Affected by this issue is some unknown functionality of the file /academy/tutor/fi… |
CVE-2023-4963 | Medium | 6.4 | 2023-09-15 | The WS Facebook Like Box Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'ws-facebook-likebox' shortcode in versions up to, and in… |
CVE-2023-40982 | Medium | 5.4 | 2023-09-15 | A stored cross-site scripting (XSS) vulnerability in Webmin v2.100 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected int… |
CVE-2023-3891 | High | 7.3 | 2023-09-15 | Race condition in Lapce v0.2.8 allows an attacker to elevate privileges on the system |
CVE-2023-4973 | Low | 3.5 | 2023-09-15 | A vulnerability was found in Academy LMS 6.2 on Windows. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the… |
CVE-2023-4982 | Medium | 5.4 | 2023-09-15 | Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 23.9.0. |
CVE-2023-4981 | Medium | 5.4 | 2023-09-15 | Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.0. |
CVE-2023-4980 | Medium | 5.4 | 2023-09-15 | Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 23.9.0. |
CVE-2023-4979 | Medium | 5.4 | 2023-09-15 | Cross-site Scripting (XSS) - Reflected in GitHub repository librenms/librenms prior to 23.9.0. |
CVE-2023-4978 | Medium | 6.1 | 2023-09-15 | Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.0. |
CVE-2023-4977 | Medium | 5.4 | 2023-09-15 | Code Injection in GitHub repository librenms/librenms prior to 23.9.0. |
CVE-2023-40986 | Medium | 5.4 | 2023-09-15 | A stored cross-site scripting (XSS) vulnerability in the Usermin Configuration function of Webmin v2.100 allows attackers to execute arbitrary web sripts or HT… |
CVE-2023-40985 | Medium | 5.4 | 2023-09-15 | An issue was discovered in Webmin 2.100. The File Manager functionality allows an attacker to exploit a Cross-Site Scripting (XSS) vulnerability. By providing… |
CVE-2023-40984 | Medium | 5.4 | 2023-09-15 | A reflected cross-site scripting (XSS) vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting… |
CVE-2023-39643 | Critical | 9.8 | 2023-09-15 | Bl Modules xmlfeeds before v3.9.8 was discovered to contain a SQL injection vulnerability via the component SearchApiXml::Xmlfeeds(). |
CVE-2023-4680 | Medium | 6.8 | 2023-09-15 | HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The… |
CVE-2023-40958 | High | 8.8 | 2023-09-15 | A SQL injection vulnerability in Didotech srl Engineering & Lifecycle Management (aka pdm) v.14.0, v.15.0 and v.16.0 fixed in pdm-14.0.1.0.0, pdm-15.0.1.0.0, a… |
CVE-2023-40957 | High | 8.8 | 2023-09-15 | A SQL injection vulnerability in Didotech srl Engineering & Lifecycle Management (aka pdm) v.14.0, v.15.0 and v.16.0 fixed in pdm-14.0.1.0.0, pdm-15.0.1.0.0, a… |
CVE-2023-40956 | High | 8.8 | 2023-09-15 | A SQL injection vulnerability in Cloudroits Website Job Search v.15.0 allows a remote authenticated attacker to execute arbitrary code via the name parameter i… |
CVE-2023-40955 | High | 8.8 | 2023-09-15 | A SQL injection vulnerability in Didotech srl Engineering & Lifecycle Management (aka pdm) v.14.0, v.15.0 and v.16.0 fixed in pdm-14.0.1.0.0, pdm-15.0.1.0.0, a… |
CVE-2023-39642 | Critical | 9.8 | 2023-09-15 | Carts Guru cartsguru up to v2.4.2 was discovered to contain a SQL injection vulnerability via the component CartsGuruCatalogModuleFrontController::display(). |
CVE-2023-39641 | Critical | 9.8 | 2023-09-15 | Active Design psaffiliate before v1.9.8 was discovered to contain a SQL injection vulnerability via the component PsaffiliateGetaffiliatesdetailsModuleFrontCon… |
CVE-2023-39639 | Critical | 9.8 | 2023-09-15 | LeoTheme leoblog up to v3.1.2 was discovered to contain a SQL injection vulnerability via the component LeoBlogBlog::getListBlogs. |
CVE-2023-42405 | Critical | 9.8 | 2023-09-14 | SQL injection vulnerability in FIT2CLOUD RackShift v1.7.1 allows attackers to execute arbitrary code via the `sort` parameter to taskService.list(), bareMetalS… |
CVE-2023-41592 | Medium | 5.4 | 2023-09-14 | Froala Editor v4.0.1 to v4.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability. |
CVE-2023-38891 | High | 8.8 | 2023-09-14 | SQL injection vulnerability in Vtiger CRM v.7.5.0 allows a remote authenticated attacker to escalate privileges via the getQueryColumnsList function in ReportR… |
CVE-2023-40869 | Medium | 6.1 | 2023-09-14 | Cross Site Scripting vulnerability in mooSocial mooSocial Software 3.1.6 and 3.1.7 allows a remote attacker to execute arbitrary code via a crafted script to t… |
CVE-2023-40868 | High | 8.8 | 2023-09-14 | Cross Site Request Forgery vulnerability in mooSocial MooSocial Software v.Demo allows a remote attacker to execute arbitrary code via the Delete Account and D… |
CVE-2023-39638 | Critical | 9.8 | 2023-09-14 | D-LINK DIR-859 A1 1.05 and A1 1.06B01 Beta01 was discovered to contain a command injection vulnerability via the lxmldbc_system function at /htdocs/cgibin. |
CVE-2023-42362 | Medium | 5.4 | 2023-09-14 | An arbitrary file upload vulnerability in Teller Web App v.4.4.0 allows a remote attacker to execute arbitrary commands and obtain sensitive information via up… |
CVE-2023-41160 | Medium | 5.4 | 2023-09-14 | A Stored Cross-Site Scripting (XSS) vulnerability in the SSH configuration tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or HTML… |
CVE-2023-41159 | Medium | 5.4 | 2023-09-14 | A Stored Cross-Site Scripting (XSS) vulnerability while editing the autoreply file page in Usermin 2.000 allows remote attackers to inject arbitrary web script… |
CVE-2023-41156 | Medium | 5.4 | 2023-09-14 | A Stored Cross-Site Scripting (XSS) vulnerability in the filter and forward mail tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or… |
CVE-2023-38912 | Critical | 9.8 | 2023-09-14 | SQL injection vulnerability in Super Store Finder PHP Script v.3.6 allows a remote attacker to execute arbitrary code via a crafted payload to the username par… |
CVE-2023-37756 | Critical | 9.8 | 2023-09-14 | I-doit pro 25 and below and I-doit open 25 and below employ weak password requirements for Administrator account creation. Attackers are able to easily guess u… |
CVE-2023-25588 | Medium | 4.7 | 2023-09-14 | A flaw was found in Binutils. The field `the_bfd` of `asymbol`struct is uninitialized in the `bfd_mach_o_get_synthetic_symtab` function, which may lead to an a… |
CVE-2023-25586 | Medium | 4.7 | 2023-09-14 | A flaw was found in Binutils. A logic fail in the bfd_init_section_decompress_status function may lead to the use of an uninitialized variable that can cause a… |
CVE-2023-25585 | Medium | 4.7 | 2023-09-14 | A flaw was found in Binutils. The use of an uninitialized field in the struct module *module may lead to application crash and local denial of service. |
CVE-2023-25584 | Medium | 6.3 | 2023-09-14 | An out-of-bounds read flaw was found in the parse_module function in bfd/vms-alpha.c in Binutils. |
CVE-2023-4972 | Critical | 9.8 | 2023-09-14 | Incorrect Use of Privileged APIs vulnerability in Yepas Digital Yepas allows Collect Data as Provided by Users. This issue affects Digital Yepas: before 1.0.1. |
CVE-2023-4965 | Low | 2.7 | 2023-09-14 | A vulnerability was found in phpipam 1.5.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Header Hand… |
CVE-2023-4702 | Critical | 9.8 | 2023-09-14 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Yepas Digital Yepas allows Authentication Bypass. This issue affects Digital Yepas… |
CVE-2023-4676 | Medium | 6.1 | 2023-09-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yordam MedasPro allows Reflected XSS. This issue affects… |
CVE-2023-41588 | Medium | 6.1 | 2023-09-14 | A cross-site scripting (XSS) vulnerability in Time to SLA plugin v10.13.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injec… |
CVE-2023-37755 | Critical | 9.8 | 2023-09-14 | i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default administrator credentials, and there is no warning or prompt to ask u… |
CVE-2023-37739 | Medium | 6.5 | 2023-09-14 | i-doit Pro v25 and below was discovered to be vulnerable to path traversal. |
CVE-2023-32665 | Medium | 5.5 | 2023-09-14 | A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leadin… |
CVE-2023-32643 | Medium | 5.3 | 2023-09-14 | A flaw was found in GLib. The GVariant deserialization code is vulnerable to a heap buffer overflow introduced by the fix for CVE-2023-32665. This bug does not… |
CVE-2023-32636 | Medium | 4.7 | 2023-09-14 | A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resol… |
CVE-2023-32611 | Medium | 5.5 | 2023-09-14 | A flaw was found in GLib. GVariant deserialization is vulnerable to a slowdown issue where a crafted GVariant can cause excessive processing, leading to denial… |
CVE-2023-29499 | Medium | 5.5 | 2023-09-14 | A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service. |
CVE-2023-4766 | Critical | 9.8 | 2023-09-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Movus allows SQL Injection. This issue affects Movus: be… |
CVE-2023-4669 | Critical | 9.8 | 2023-09-14 | Authentication Bypass by Assumed-Immutable Data vulnerability in Exagate SYSGuard 3001 allows Authentication Bypass. This issue affects SYSGuard 3001: before… |
CVE-2023-41011 | Critical | 9.8 | 2023-09-14 | Command Execution vulnerability in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows a remote attacker to execute arbitrary c… |
CVE-2023-39286 | Medium | 4.3 | 2023-09-14 | A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2304.102 could allow an unauthenticated attacker to perform a Cro… |
CVE-2023-39285 | Medium | 4.3 | 2023-09-14 | A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 SP3 (22.24.5800.0) could allow an unauthenticated attacker to perform a Cro… |