2023 CVEs (page 158)
Page 158 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-4978 | Medium | 6.1 | 2023-09-15 | Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.0. |
CVE-2023-4977 | Medium | 5.4 | 2023-09-15 | Code Injection in GitHub repository librenms/librenms prior to 23.9.0. |
CVE-2023-40986 | Medium | 5.4 | 2023-09-15 | A stored cross-site scripting (XSS) vulnerability in the Usermin Configuration function of Webmin v2.100 allows attackers to execute arbitrary web sripts or HT… |
CVE-2023-40985 | Medium | 5.4 | 2023-09-15 | An issue was discovered in Webmin 2.100. The File Manager functionality allows an attacker to exploit a Cross-Site Scripting (XSS) vulnerability. By providing… |
CVE-2023-40984 | Medium | 5.4 | 2023-09-15 | A reflected cross-site scripting (XSS) vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting… |
CVE-2023-39643 | Critical | 9.8 | 2023-09-15 | Bl Modules xmlfeeds before v3.9.8 was discovered to contain a SQL injection vulnerability via the component SearchApiXml::Xmlfeeds(). |
CVE-2023-4680 | Medium | 6.8 | 2023-09-15 | HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The… |
CVE-2023-40958 | High | 8.8 | 2023-09-15 | A SQL injection vulnerability in Didotech srl Engineering & Lifecycle Management (aka pdm) v.14.0, v.15.0 and v.16.0 fixed in pdm-14.0.1.0.0, pdm-15.0.1.0.0, a… |
CVE-2023-40957 | High | 8.8 | 2023-09-15 | A SQL injection vulnerability in Didotech srl Engineering & Lifecycle Management (aka pdm) v.14.0, v.15.0 and v.16.0 fixed in pdm-14.0.1.0.0, pdm-15.0.1.0.0, a… |
CVE-2023-40956 | High | 8.8 | 2023-09-15 | A SQL injection vulnerability in Cloudroits Website Job Search v.15.0 allows a remote authenticated attacker to execute arbitrary code via the name parameter i… |
CVE-2023-40955 | High | 8.8 | 2023-09-15 | A SQL injection vulnerability in Didotech srl Engineering & Lifecycle Management (aka pdm) v.14.0, v.15.0 and v.16.0 fixed in pdm-14.0.1.0.0, pdm-15.0.1.0.0, a… |
CVE-2023-39642 | Critical | 9.8 | 2023-09-15 | Carts Guru cartsguru up to v2.4.2 was discovered to contain a SQL injection vulnerability via the component CartsGuruCatalogModuleFrontController::display(). |
CVE-2023-39641 | Critical | 9.8 | 2023-09-15 | Active Design psaffiliate before v1.9.8 was discovered to contain a SQL injection vulnerability via the component PsaffiliateGetaffiliatesdetailsModuleFrontCon… |
CVE-2023-39639 | Critical | 9.8 | 2023-09-15 | LeoTheme leoblog up to v3.1.2 was discovered to contain a SQL injection vulnerability via the component LeoBlogBlog::getListBlogs. |
CVE-2023-42405 | Critical | 9.8 | 2023-09-14 | SQL injection vulnerability in FIT2CLOUD RackShift v1.7.1 allows attackers to execute arbitrary code via the `sort` parameter to taskService.list(), bareMetalS… |
CVE-2023-41592 | Medium | 5.4 | 2023-09-14 | Froala Editor v4.0.1 to v4.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability. |
CVE-2023-38891 | High | 8.8 | 2023-09-14 | SQL injection vulnerability in Vtiger CRM v.7.5.0 allows a remote authenticated attacker to escalate privileges via the getQueryColumnsList function in ReportR… |
CVE-2023-40869 | Medium | 6.1 | 2023-09-14 | Cross Site Scripting vulnerability in mooSocial mooSocial Software 3.1.6 and 3.1.7 allows a remote attacker to execute arbitrary code via a crafted script to t… |
CVE-2023-40868 | High | 8.8 | 2023-09-14 | Cross Site Request Forgery vulnerability in mooSocial MooSocial Software v.Demo allows a remote attacker to execute arbitrary code via the Delete Account and D… |
CVE-2023-39638 | Critical | 9.8 | 2023-09-14 | D-LINK DIR-859 A1 1.05 and A1 1.06B01 Beta01 was discovered to contain a command injection vulnerability via the lxmldbc_system function at /htdocs/cgibin. |
CVE-2023-42362 | Medium | 5.4 | 2023-09-14 | An arbitrary file upload vulnerability in Teller Web App v.4.4.0 allows a remote attacker to execute arbitrary commands and obtain sensitive information via up… |
CVE-2023-41160 | Medium | 5.4 | 2023-09-14 | A Stored Cross-Site Scripting (XSS) vulnerability in the SSH configuration tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or HTML… |
CVE-2023-41159 | Medium | 5.4 | 2023-09-14 | A Stored Cross-Site Scripting (XSS) vulnerability while editing the autoreply file page in Usermin 2.000 allows remote attackers to inject arbitrary web script… |
CVE-2023-41156 | Medium | 5.4 | 2023-09-14 | A Stored Cross-Site Scripting (XSS) vulnerability in the filter and forward mail tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or… |
CVE-2023-38912 | Critical | 9.8 | 2023-09-14 | SQL injection vulnerability in Super Store Finder PHP Script v.3.6 allows a remote attacker to execute arbitrary code via a crafted payload to the username par… |
CVE-2023-37756 | Critical | 9.8 | 2023-09-14 | I-doit pro 25 and below and I-doit open 25 and below employ weak password requirements for Administrator account creation. Attackers are able to easily guess u… |
CVE-2023-25588 | Medium | 4.7 | 2023-09-14 | A flaw was found in Binutils. The field `the_bfd` of `asymbol`struct is uninitialized in the `bfd_mach_o_get_synthetic_symtab` function, which may lead to an a… |
CVE-2023-25586 | Medium | 4.7 | 2023-09-14 | A flaw was found in Binutils. A logic fail in the bfd_init_section_decompress_status function may lead to the use of an uninitialized variable that can cause a… |
CVE-2023-25585 | Medium | 4.7 | 2023-09-14 | A flaw was found in Binutils. The use of an uninitialized field in the struct module *module may lead to application crash and local denial of service. |
CVE-2023-25584 | Medium | 6.3 | 2023-09-14 | An out-of-bounds read flaw was found in the parse_module function in bfd/vms-alpha.c in Binutils. |
CVE-2023-4972 | Critical | 9.8 | 2023-09-14 | Incorrect Use of Privileged APIs vulnerability in Yepas Digital Yepas allows Collect Data as Provided by Users. This issue affects Digital Yepas: before 1.0.1. |
CVE-2023-4965 | Low | 2.7 | 2023-09-14 | A vulnerability was found in phpipam 1.5.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Header Hand… |
CVE-2023-4702 | Critical | 9.8 | 2023-09-14 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Yepas Digital Yepas allows Authentication Bypass. This issue affects Digital Yepas… |
CVE-2023-4676 | Medium | 6.1 | 2023-09-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yordam MedasPro allows Reflected XSS. This issue affects… |
CVE-2023-41588 | Medium | 6.1 | 2023-09-14 | A cross-site scripting (XSS) vulnerability in Time to SLA plugin v10.13.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injec… |
CVE-2023-37755 | Critical | 9.8 | 2023-09-14 | i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default administrator credentials, and there is no warning or prompt to ask u… |
CVE-2023-37739 | Medium | 6.5 | 2023-09-14 | i-doit Pro v25 and below was discovered to be vulnerable to path traversal. |
CVE-2023-32665 | Medium | 5.5 | 2023-09-14 | A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leadin… |
CVE-2023-32643 | Medium | 5.3 | 2023-09-14 | A flaw was found in GLib. The GVariant deserialization code is vulnerable to a heap buffer overflow introduced by the fix for CVE-2023-32665. This bug does not… |
CVE-2023-32636 | Medium | 4.7 | 2023-09-14 | A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resol… |
CVE-2023-32611 | Medium | 5.5 | 2023-09-14 | A flaw was found in GLib. GVariant deserialization is vulnerable to a slowdown issue where a crafted GVariant can cause excessive processing, leading to denial… |
CVE-2023-29499 | Medium | 5.5 | 2023-09-14 | A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service. |
CVE-2023-4766 | Critical | 9.8 | 2023-09-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Movus allows SQL Injection. This issue affects Movus: be… |
CVE-2023-4669 | Critical | 9.8 | 2023-09-14 | Authentication Bypass by Assumed-Immutable Data vulnerability in Exagate SYSGuard 3001 allows Authentication Bypass. This issue affects SYSGuard 3001: before… |
CVE-2023-41011 | Critical | 9.8 | 2023-09-14 | Command Execution vulnerability in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows a remote attacker to execute arbitrary c… |
CVE-2023-39286 | Medium | 4.3 | 2023-09-14 | A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2304.102 could allow an unauthenticated attacker to perform a Cro… |
CVE-2023-39285 | Medium | 4.3 | 2023-09-14 | A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 SP3 (22.24.5800.0) could allow an unauthenticated attacker to perform a Cro… |
CVE-2023-4832 | Critical | 9.8 | 2023-09-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aceka Company Management allows SQL Injection. This issu… |
CVE-2023-41010 | Medium | 5.5 | 2023-09-14 | Insecure Permissions vulnerability in Sichuan Tianyi Kanghe Communication Co., Ltd China Telecom Tianyi Home Gateway v.TEWA-700G allows a local attacker to obt… |
CVE-2023-40779 | Medium | 6.1 | 2023-09-14 | An issue in IceWarp Mail Server Deep Castle 2 v.13.0.1.2 allows a remote attacker to execute arbitrary code via a crafted request to the URL. |
CVE-2023-4951 | Low | 2.0 | 2023-09-14 | A cross site scripting issue was discovered with the pagination function on the "Client-based Authentication Policy Configuration" screen of the GreenRADIUS we… |
CVE-2023-36250 | High | 7.8 | 2023-09-14 | CSV Injection vulnerability in GNOME time tracker version 3.0.2, allows local attackers to execute arbitrary code via crafted .tsv file when creating a new rec… |
CVE-2023-42180 | High | 8.8 | 2023-09-14 | An arbitrary file upload vulnerability in the /user/upload component of lenosp 1.0-1.2.0 allows attackers to execute html code via a crafted JPG file. |
CVE-2023-42178 | Medium | 6.5 | 2023-09-14 | Lenosp 1.0.0-1.2.0 is vulnerable to SQL Injection via the log query module. |
CVE-2023-30909 | Critical | 9.8 | 2023-09-14 | A remote authentication bypass issue exists in some OneView APIs. |
CVE-2023-1108 | High | 7.5 | 2023-09-14 | A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the lo… |
CVE-2023-2848 | High | 8.0 | 2023-09-14 | Movim prior to version 0.22 is affected by a Cross-Site WebSocket Hijacking vulnerability. This was the result of a missing header validation. |
CVE-2023-38558 | Medium | 5.5 | 2023-09-14 | A vulnerability has been identified in SIMATIC PCS neo (Administration Console) V4.0 (All versions), SIMATIC PCS neo (Administration Console) V4.0 Update 1 (Al… |
CVE-2023-38557 | High | 8.2 | 2023-09-14 | A vulnerability has been identified in Spectrum Power 7 (All versions < V23Q3). The affected product assigns improper access rights to the update script. This… |
CVE-2023-4516 | High | 7.8 | 2023-09-14 | A CWE-306: Missing Authentication for Critical Function vulnerability exists in the IGSS Update Service that could allow a local attacker to change update sou… |
CVE-2023-42503 | Medium | 5.5 | 2023-09-14 | Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apache Commons Compress… |
CVE-2023-41267 | High | 7.8 | 2023-09-14 | In the Apache Airflow HDFS Provider, versions prior to 4.1.1, a documentation info pointed users to an install incorrect pip package. As this package name was… |
CVE-2023-38206 | Medium | 5.3 | 2023-09-14 | Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that co… |
CVE-2023-38205 | High | 7.5 | 2023-09-14 | Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that co… |
CVE-2023-38204 | Critical | 9.8 | 2023-09-14 | Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by a Deserialization of Untrusted Data vulnerabilit… |
CVE-2023-4814 | High | 7.1 | 2023-09-14 | A Privilege escalation vulnerability exists in Trellix Windows DLP endpoint for windows which can be abused to delete any file/folder for which the user does… |
CVE-2023-26141 | High | 7.5 | 2023-09-14 | Versions of the package sidekiq before 7.1.3 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.js file. An attacker… |
CVE-2023-4948 | Medium | 4.3 | 2023-09-14 | The WooCommerce CVR Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the refresh_or… |
CVE-2023-4945 | Medium | 6.4 | 2023-09-14 | The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in versions up to, and including, 7.1.0 d… |
CVE-2023-4944 | Medium | 6.4 | 2023-09-14 | The Awesome Weather Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'awesome-weather' shortcode in versions up to, and including… |
CVE-2023-4841 | Medium | 6.4 | 2023-09-14 | The Feeds for YouTube plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'youtube-feed' shortcode in versions up to, and including, 2.1 due… |
CVE-2023-23845 | Medium | 6.8 | 2023-09-13 | The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web… |
CVE-2023-23840 | Medium | 6.8 | 2023-09-13 | The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web… |
CVE-2023-41162 | Medium | 6.1 | 2023-09-13 | A Reflected Cross-site scripting (XSS) vulnerability in the file manager tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML vi… |
CVE-2023-41158 | Medium | 5.4 | 2023-09-13 | A Stored Cross-Site Scripting (XSS) vulnerability in the MIME type programs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML… |
CVE-2023-41155 | Medium | 5.4 | 2023-09-13 | A Stored Cross-Site Scripting (XSS) vulnerability in the mail forwarding and replies tab in Webmin and Usermin 2.000 allows remote attackers to inject arbitrar… |
CVE-2023-41154 | Medium | 5.4 | 2023-09-13 | A Stored Cross-Site Scripting (XSS) vulnerability in the scheduled cron jobs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTM… |
CVE-2023-41152 | Medium | 5.4 | 2023-09-13 | A Stored Cross-Site Scripting (XSS) vulnerability in the MIME type programs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML… |
CVE-2023-40617 | Medium | 6.1 | 2023-09-13 | A reflected cross-site scripting (XSS) vulnerability in OpenKnowledgeMaps Head Start 7 allows remote attackers to execute arbitrary JavaScript in the web brows… |
CVE-2023-4568 | Medium | 6.5 | 2023-09-13 | PaperCut NG allows for unauthenticated XMLRPC commands to be run by default. Versions 22.0.12 and below are confirmed to be affected, but later versions may al… |
CVE-2023-42468 | Medium | 5.3 | 2023-09-13 | The com.cutestudio.colordialer application through 2.1.8-2 for Android allows a remote attacker to initiate phone calls without user consent, because of improp… |
CVE-2023-41892 | Critical | 10.0 | 2023-09-13 | Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector. Users running Craft installations before 4.4.15… |
CVE-2023-40850 | High | 7.5 | 2023-09-13 | netentsec NS-ASG 6.3 is vulnerable to Incorrect Access Control. There is a file leak in the website source code of the application security gateway. |
CVE-2023-42469 | Low | 3.3 | 2023-09-13 | The com.full.dialer.top.secure.encrypted application through 1.0.1 for Android enables any installed application (with no permissions) to place phone calls wit… |
CVE-2023-3588 | Medium | 5.4 | 2023-09-13 | A stored Cross-site Scripting (XSS) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x allows an attacker to exe… |
CVE-2023-4785 | High | 7.5 | 2023-09-13 | Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial… |
CVE-2023-4155 | Medium | 5.3 | 2023-09-13 | A flaw was found in KVM AMD Secure Encrypted Virtualization (SEV) in the Linux kernel. A KVM guest using SEV-ES or SEV-SNP with multiple vCPUs can trigger a do… |
CVE-2023-3301 | Medium | 5.6 | 2023-09-13 | A flaw was found in QEMU. The async nature of hot-unplug enables a race scenario where the net device backend is cleared before the virtio-net pci frontend has… |
CVE-2023-3280 | Medium | 5.5 | 2023-09-13 | A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to disable the agent. |
CVE-2023-3255 | Medium | 6.5 | 2023-09-13 | A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. A wrong exit condition may lead to an infinite loop when inflating an… |
CVE-2023-2680 | High | 7.5 | 2023-09-13 | This CVE exists because of an incomplete fix for CVE-2021-3750. More specifically, the qemu-kvm package as released for Red Hat Enterprise Linux 9.1 via RHSA-2… |
CVE-2023-20236 | Medium | 6.7 | 2023-09-13 | A vulnerability in the iPXE boot function of Cisco IOS XR software could allow an authenticated, local attacker to install an unverified software image on an a… |
CVE-2023-20233 | Medium | 4.3 | 2023-09-13 | A vulnerability in the Connectivity Fault Management (CFM) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial o… |
CVE-2023-20191 | Medium | 5.8 | 2023-09-13 | A vulnerability in the access control list (ACL) processing on MPLS interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthenticated… |
CVE-2023-20190 | Medium | 5.8 | 2023-09-13 | A vulnerability in the classic access control list (ACL) compression feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass… |
CVE-2023-20135 | Medium | 5.7 | 2023-09-13 | A vulnerability in Cisco IOS XR Software image verification checks could allow an authenticated, local attacker to execute arbitrary code on the underlying ope… |
CVE-2023-4828 | Medium | 6.4 | 2023-09-13 | An improper check for an exceptional condition in the Insider Threat Management (ITM) Server could be used by an attacker to change the server's configuration… |
CVE-2023-4803 | Medium | 4.8 | 2023-09-13 | A reflected cross-site scripting vulnerability in the WriteWindowTitle endpoint of the Insider Threat Management (ITM) Server's web console could be used by an… |
CVE-2023-4802 | Medium | 4.8 | 2023-09-13 | A reflected cross-site scripting vulnerability in the UpdateInstalledSoftware endpoint of the Insider Threat Management (ITM) Server's web console could be use… |
CVE-2023-4801 | High | 7.5 | 2023-09-13 | An improper certification validation vulnerability in the Insider Threat Management (ITM) Agent for MacOS could be used by an anonymous actor on an adjacent ne… |