2023 CVEs (page 167)
Page 167 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-37220 | High | 7.2 | 2023-09-03 | Synel Terminals - CWE-494: Download of Code Without Integrity Check |
CVE-2023-38521 | Medium | 5.9 | 2023-09-03 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Exifography plugin <= 1.3.1 versions. |
CVE-2023-38518 | Medium | 5.9 | 2023-09-03 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Visualmodo Borderless plugin <= 1.4.8 versions. |
CVE-2023-38517 | Medium | 5.9 | 2023-09-03 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Realwebcare WRC Pricing Tables plugin <= 2.3.7 versions. |
CVE-2023-38516 | Medium | 6.5 | 2023-09-03 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WP OnlineSupport, Essential Plugin Audio Player with Playlist Ultimate plugin <= 1.2.2… |
CVE-2023-38482 | Medium | 5.9 | 2023-09-03 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in QualityUnit Post Affiliate Pro plugin <= 1.25.0 versions. |
CVE-2023-38476 | Medium | 5.9 | 2023-09-03 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SuiteDash :: ONE Dashboard® Client Portal : SuiteDash Direct Login plugin <= 1.7.6 versions. |
CVE-2023-38387 | Medium | 5.9 | 2023-09-03 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Elastic Email Sender plugin <= 1.2.6 versions. |
CVE-2023-4738 | High | 7.8 | 2023-09-02 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1848. |
CVE-2023-4736 | High | 7.8 | 2023-09-02 | Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833. |
CVE-2023-4735 | High | 7.8 | 2023-09-02 | Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1847. |
CVE-2023-4734 | High | 7.8 | 2023-09-02 | Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1846. |
CVE-2023-39983 | Medium | 5.3 | 2023-09-02 | A vulnerability that poses a potential risk of polluting the MXsecurity sqlite database and the nsm-web UI has been identified in MXsecurity versions prior to… |
CVE-2023-39982 | High | 7.5 | 2023-09-02 | A vulnerability has been identified in MXsecurity versions prior to v1.0.1. The vulnerability may put the confidentiality and integrity of SSH communications a… |
CVE-2023-39981 | High | 7.5 | 2023-09-02 | A vulnerability that allows for unauthorized access has been discovered in MXsecurity versions prior to v1.0.1. This vulnerability arises from inadequate authe… |
CVE-2023-39980 | High | 7.1 | 2023-09-02 | A vulnerability that allows the unauthorized disclosure of authenticated information has been identified in MXsecurity versions prior to v1.0.1. This vulnerabi… |
CVE-2023-39979 | Critical | 9.8 | 2023-09-02 | There is a vulnerability in MXsecurity versions prior to 1.0.1 that can be exploited to bypass authentication. A remote attacker might access the system if the… |
CVE-2023-4718 | Medium | 6.4 | 2023-09-02 | The Font Awesome 4 Menus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fa' and 'fa-stack' shortcodes in versions up to, and includ… |
CVE-2023-3297 | High | 8.1 | 2023-09-01 | In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the acco… |
CVE-2023-4714 | Medium | 4.3 | 2023-09-01 | A vulnerability was found in PlayTube 3.0.1 and classified as problematic. This issue affects some unknown processing of the component Redirect Handler. The ma… |
CVE-2023-4713 | Medium | 5.5 | 2023-09-01 | A vulnerability has been found in IBOS OA 4.5.5 and classified as critical. This vulnerability affects the function addComment of the file ?r=weibo/comment/add… |
CVE-2023-4712 | Medium | 5.5 | 2023-09-01 | A vulnerability, which was classified as critical, was found in Xintian Smart Table Integrated Management System 5.6.9. This affects an unknown part of the fil… |
CVE-2023-4711 | Medium | 5.0 | 2023-09-01 | A vulnerability, which was classified as critical, has been found in D-Link DAR-8000-10 up to 20230819. Affected by this issue is some unknown functionality of… |
CVE-2023-4710 | Medium | 4.3 | 2023-09-01 | A vulnerability classified as problematic was found in TOTVS RM 12.1. Affected by this vulnerability is an unknown functionality of the component Portal. The m… |
CVE-2023-41049 | High | 7.5 | 2023-09-01 | @dcl/single-sign-on-client is an open source npm library which deals with single sign on authentication flows. Improper input validation in the `init` function… |
CVE-2023-41046 | Medium | 6.3 | 2023-09-01 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible in XWiki to execute Velocity code witho… |
CVE-2023-4709 | Low | 3.1 | 2023-09-01 | A vulnerability classified as problematic has been found in TOTVS RM 12.1. Affected is an unknown function of the file Login.aspx of the component Portal. The… |
CVE-2023-41633 | Medium | 5.5 | 2023-09-01 | Catdoc v0.95 was discovered to contain a NULL pointer dereference via the component xls2csv at src/fileutil.c. |
CVE-2023-41051 | Low | 2.5 | 2023-09-01 | In a typical Virtual Machine Monitor (VMM) there are several components, such as boot loader, virtual device drivers, virtio backend drivers and vhost drivers… |
CVE-2023-1523 | Critical | 10.0 | 2023-09-01 | Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it to cause arbitrary co… |
CVE-2023-4708 | Medium | 6.3 | 2023-09-01 | A vulnerability was found in Infosoftbd Clcknshop 1.0.0. It has been rated as critical. This issue affects some unknown processing of the file /collection/all… |
CVE-2023-4707 | Low | 3.5 | 2023-09-01 | A vulnerability was found in Infosoftbd Clcknshop 1.0.0. It has been declared as problematic. This vulnerability affects unknown code of the file /collection/a… |
CVE-2023-39714 | Medium | 6.1 | 2023-09-01 | Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts… |
CVE-2023-41628 | High | 7.5 | 2023-09-01 | An issue in O-RAN Software Community E2 G-Release allows attackers to cause a Denial of Service (DoS) by incorrectly initiating the messaging procedure between… |
CVE-2023-41627 | High | 7.5 | 2023-09-01 | O-RAN Software Community ric-plt-lib-rmr v4.9.0 does not validate the source of the routing tables it receives, potentially allowing attackers to send forged r… |
CVE-2023-4722 | Medium | 5.5 | 2023-09-01 | Integer Overflow or Wraparound in GitHub repository gpac/gpac prior to 2.3-DEV. |
CVE-2023-4721 | Medium | 5.5 | 2023-09-01 | Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV. |
CVE-2023-4720 | Medium | 5.5 | 2023-09-01 | Floating Point Comparison with Incorrect Operator in GitHub repository gpac/gpac prior to 2.3-DEV. |
CVE-2023-40980 | Critical | 9.8 | 2023-09-01 | File Upload vulnerability in DWSurvey DWSurvey-OSS v.3.2.0 and before allows a remote attacker to execute arbitrary code via the saveimage method and savveFile… |
CVE-2023-40968 | High | 7.5 | 2023-09-01 | Buffer Overflow vulnerability in hzeller timg v.1.5.1 and before allows a remote attacker to cause a denial of service via the 0x61200000045c address. |
CVE-2023-40771 | High | 7.5 | 2023-09-01 | SQL injection vulnerability in DataEase v.1.18.9 allows a remote attacker to obtain sensitive information via a crafted string outside of the blacklist functio… |
CVE-2023-39631 | Critical | 9.8 | 2023-09-01 | An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute arbitrary code via the evaluate function in the numexpr library. |
CVE-2023-39582 | Medium | 4.9 | 2023-09-01 | SQL Injection vulnerability in Chamilo LMS v.1.11 thru v.1.11.20 allows a remote privileged attacker to obtain sensitive information via the import sessions fu… |
CVE-2023-36328 | Critical | 9.8 | 2023-09-01 | Integer Overflow vulnerability in mp_grow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary co… |
CVE-2023-36327 | Critical | 9.8 | 2023-09-01 | Integer Overflow vulnerability in RELIC before commit 421f2e91cf2ba42473d4d54daf24e295679e290e, allows attackers to execute arbitrary code and cause a denial o… |
CVE-2023-36326 | Critical | 9.8 | 2023-09-01 | Integer Overflow vulnerability in RELIC before commit 34580d840469361ba9b5f001361cad659687b9ab, allows attackers to execute arbitrary code, cause a denial of s… |
CVE-2023-36187 | Critical | 9.8 | 2023-09-01 | Buffer Overflow vulnerability in NETGEAR R6400v2 before version 1.0.4.118, allows remote unauthenticated attackers to execute arbitrary code via crafted URL to… |
CVE-2023-36100 | Critical | 9.8 | 2023-09-01 | An issue was discovered in IceCMS version 2.0.1, allows attackers to escalate privileges and gain sensitive information via UserID parameter in api/User/Change… |
CVE-2023-36088 | High | 7.5 | 2023-09-01 | Server Side Request Forgery (SSRF) vulnerability in NebulaGraph Studio version 3.7.0, allows remote attackers to gain sensitive information. |
CVE-2023-36076 | Critical | 9.8 | 2023-09-01 | SQL Injection vulnerability in smanga version 3.1.9 and earlier, allows remote attackers to execute arbitrary code and gain sensitive information via mediaId… |
CVE-2023-28366 | High | 7.5 | 2023-09-01 | The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with dupl… |
CVE-2023-23763 | Medium | 5.3 | 2023-09-01 | An authorization/sensitive information disclosure vulnerability was identified in GitHub Enterprise Server that allowed a fork to retain read access to an upst… |
CVE-2023-39710 | Medium | 6.1 | 2023-09-01 | Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts… |
CVE-2023-39703 | Medium | 6.1 | 2023-09-01 | A cross site scripting (XSS) vulnerability in the Markdown Editor component of Typora v1.6.7 allows attackers to execute arbitrary code via uploading a crafted… |
CVE-2023-37830 | Medium | 6.1 | 2023-09-01 | A cross-site scripting (XSS) vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitrary web scripts or H… |
CVE-2023-37829 | Medium | 6.1 | 2023-09-01 | A cross-site scripting (XSS) vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitrary web scripts or H… |
CVE-2023-37828 | Medium | 6.1 | 2023-09-01 | A cross-site scripting (XSS) vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitrary web scripts or H… |
CVE-2023-37827 | Medium | 6.1 | 2023-09-01 | A cross-site scripting (XSS) vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitrary web scripts or H… |
CVE-2023-37826 | Medium | 6.1 | 2023-09-01 | A cross-site scripting (XSS) vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitrary web scripts or H… |
CVE-2023-37997 | High | 7.1 | 2023-09-01 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Dharmesh Patel Post List With Featured Image plugin <= 1.2 versions. |
CVE-2023-37994 | Medium | 6.5 | 2023-09-01 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Artem Abramovich Art Decoration Shortcode plugin <= 1.5.6 versions. |
CVE-2023-37986 | Medium | 5.9 | 2023-09-01 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in miniOrange YourMembership Single Sign On – YM SSO Login plugin <= 1.1.3 versions. |
CVE-2023-37893 | High | 7.1 | 2023-09-01 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Chop-Chop Coming Soon Chop Chop plugin <= 2.2.4 versions. |
CVE-2023-34011 | High | 7.1 | 2023-09-01 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in ShopConstruct plugin <= 1.1.2 versions. |
CVE-2023-4647 | Medium | 5.3 | 2023-09-01 | An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions sta… |
CVE-2023-4378 | Medium | 5.5 | 2023-09-01 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versio… |
CVE-2023-4018 | Medium | 4.3 | 2023-09-01 | An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper… |
CVE-2023-40970 | High | 8.8 | 2023-09-01 | Senayan Library Management Systems SLIMS 9 Bulian v 9.6.1 is vulnerable to SQL Injection via admin/modules/circulation/loan_rules.php. |
CVE-2023-40969 | Medium | 6.1 | 2023-09-01 | Senayan Library Management Systems SLIMS 9 Bulian v9.6.1 is vulnerable to Server Side Request Forgery (SSRF) via admin/modules/bibliography/pop_p2p.php. |
CVE-2023-40239 | High | 7.5 | 2023-09-01 | Certain Lexmark devices (such as CS310) before 2023-08-25 allow XXE attacks, leading to information disclosure. The fixed firmware version is LW80.*.P246, i.e… |
CVE-2023-3950 | Medium | 5.5 | 2023-09-01 | An information disclosure issue in GitLab EE affecting all versions from 16.2 prior to 16.2.5, and 16.3 prior to 16.3.1 allowed other Group Owners to see the P… |
CVE-2023-3915 | Medium | 6.5 | 2023-09-01 | An issue has been discovered in GitLab EE affecting all versions starting from 16.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions… |
CVE-2023-3210 | Medium | 6.5 | 2023-09-01 | An issue has been discovered in GitLab affecting all versions starting from 15.11 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions st… |
CVE-2023-3205 | Medium | 6.5 | 2023-09-01 | An issue has been discovered in GitLab affecting all versions starting from 15.11 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions st… |
CVE-2023-25488 | Medium | 5.9 | 2023-09-01 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Duc Bui Quang WP Default Feature Image plugin <= 1.0.1.1 versions. |
CVE-2023-25477 | Medium | 5.9 | 2023-09-01 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Yotuwp Video Gallery plugin <= 1.3.12 versions. |
CVE-2023-25044 | Medium | 5.9 | 2023-09-01 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Sumo Social Share Boost plugin <= 4.4 versions. |
CVE-2023-25042 | Medium | 5.9 | 2023-09-01 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Liam Gladdy (Storm Consultancy) oAuth Twitter Feed for Developers plugin <= 2.3.0 versions. |
CVE-2023-24412 | Medium | 5.9 | 2023-09-01 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Web-Settler Image Social Feed plugin <= 1.7.6 versions. |
CVE-2023-1555 | Low | 2.7 | 2023-09-01 | An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions sta… |
CVE-2023-1279 | Low | 2.6 | 2023-09-01 | An issue has been discovered in GitLab affecting all versions starting from 4.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions star… |
CVE-2023-0120 | Low | 3.5 | 2023-09-01 | An issue has been discovered in GitLab affecting all versions starting from 10.0 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions sta… |
CVE-2023-4704 | Medium | 4.9 | 2023-09-01 | External Control of System or Configuration Setting in GitHub repository instantsoft/icms2 prior to 2.16.1-git. |
CVE-2023-41364 | Critical | 9.8 | 2023-09-01 | In tine through 2023.01.14.325, the sort parameter of the /index.php endpoint allows SQL Injection. |
CVE-2023-39685 | High | 7.5 | 2023-09-01 | An issue in hjson-java up to v3.0.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted JSON string. |
CVE-2023-24675 | Medium | 4.8 | 2023-09-01 | Cross Site Scripting Vulnerability in BluditCMS v.3.14.1 allows attackers to execute arbitrary code via the Categories Friendly URL. |
CVE-2023-24674 | High | 7.8 | 2023-09-01 | Permissions vulnerability found in Bludit CMS v.4.0.0 allows local attackers to escalate privileges via the role:admin parameter. |
CVE-2023-4698 | High | 7.5 | 2023-09-01 | Improper Input Validation in GitHub repository usememos/memos prior to 0.13.2. |
CVE-2023-4697 | High | 8.8 | 2023-09-01 | Improper Privilege Management in GitHub repository usememos/memos prior to 0.13.2. |
CVE-2023-4696 | Critical | 9.8 | 2023-09-01 | Improper Access Control in GitHub repository usememos/memos prior to 0.13.2. |
CVE-2023-4695 | High | 8.1 | 2023-09-01 | Use of Predictable Algorithm in Random Number Generator in GitHub repository pkp/pkp-lib prior to 3.3.0-16. |
CVE-2023-4481 | High | 7.5 | 2023-09-01 | An Improper Input Validation vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, ne… |
CVE-2023-39912 | Medium | 4.9 | 2023-08-31 | Zoho ManageEngine ADManager Plus before 7203 allows Help Desk Technician users to read arbitrary files on the machine where this product is installed. |
CVE-2023-40576 | Medium | 5.3 | 2023-08-31 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Rea… |
CVE-2023-40575 | Medium | 5.3 | 2023-08-31 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Rea… |
CVE-2023-40574 | Medium | 6.5 | 2023-08-31 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Wri… |
CVE-2023-40569 | Medium | 6.5 | 2023-08-31 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Wri… |
CVE-2023-40567 | Medium | 6.5 | 2023-08-31 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Wri… |
CVE-2023-40188 | Medium | 5.3 | 2023-08-31 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Rea… |
CVE-2023-40187 | High | 7.3 | 2023-08-31 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions of the 3.x beta branch are subject… |