2023 CVEs (page 168)
Page 168 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-40186 | Medium | 6.5 | 2023-08-31 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an IntegerOverflow l… |
CVE-2023-40181 | Medium | 5.3 | 2023-08-31 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Integer-Underflow… |
CVE-2023-4688 | Medium | 5.5 | 2023-08-31 | Sensitive information leak through log files. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 35433. |
CVE-2023-4299 | Critical | 9.0 | 2023-08-31 | Digi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass authentication to access connected equipment. |
CVE-2023-41751 | Medium | 5.5 | 2023-08-31 | Sensitive information disclosure due to improper token expiration validation. The following products are affected: Acronis Agent (Windows) before build 32047. |
CVE-2023-41750 | Medium | 5.5 | 2023-08-31 | Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 32047. |
CVE-2023-41749 | High | 7.5 | 2023-08-31 | Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Agent (Windows) before build 3… |
CVE-2023-39356 | Medium | 5.3 | 2023-08-31 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions a missing offset validation may… |
CVE-2023-39353 | Medium | 5.3 | 2023-08-31 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to a missing offset val… |
CVE-2023-39352 | Medium | 5.3 | 2023-08-31 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an invalid offset va… |
CVE-2023-39355 | High | 7.0 | 2023-08-31 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Versions of FreeRDP on the 3.x release branch before… |
CVE-2023-39354 | Medium | 5.9 | 2023-08-31 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Rea… |
CVE-2023-39351 | Medium | 5.3 | 2023-08-31 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions of FreeRDP are subject to a Null Po… |
CVE-2023-39350 | Medium | 5.9 | 2023-08-31 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. This issue affects Clients only. Integer underflow le… |
CVE-2023-40589 | Medium | 4.3 | 2023-08-31 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions there is a Global-Buffer-Overflo… |
CVE-2023-41748 | Critical | 9.8 | 2023-08-31 | Remote command execution due to improper input validation. The following products are affected: Acronis Cloud Manager (Windows) before build 6.2.23089.203. |
CVE-2023-41747 | Medium | 6.5 | 2023-08-31 | Sensitive information disclosure due to unauthenticated path traversal. The following products are affected: Acronis Cloud Manager (Windows) before build 6.2.2… |
CVE-2023-41746 | Critical | 9.8 | 2023-08-31 | Remote command execution due to improper input validation. The following products are affected: Acronis Cloud Manager (Windows) before build 6.2.23089.203. |
CVE-2023-41745 | Medium | 5.5 | 2023-08-31 | Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Agent (Linux, macOS, Windows)… |
CVE-2023-41045 | Low | 3.7 | 2023-08-31 | Graylog is a free and open log management platform. Graylog makes use of only one single source port for DNS queries. Graylog binds a single socket for outgoin… |
CVE-2023-41044 | Low | 3.3 | 2023-08-31 | Graylog is a free and open log management platform. A partial path traversal vulnerability exists in Graylog's `Support Bundle` feature. The vulnerability is c… |
CVE-2023-41034 | Medium | 6.5 | 2023-08-31 | Eclipse Leshan is a device management server and client Java implementation. In affected versions DDFFileParser` and `DefaultDDFFileValidator` (and so `ObjectL… |
CVE-2023-4683 | Medium | 5.5 | 2023-08-31 | NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.3-DEV. |
CVE-2023-4682 | Medium | 5.5 | 2023-08-31 | Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.3-DEV. |
CVE-2023-4681 | Medium | 5.5 | 2023-08-31 | NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.3-DEV. |
CVE-2023-4678 | Medium | 5.5 | 2023-08-31 | Divide By Zero in GitHub repository gpac/gpac prior to 2.3-DEV. |
CVE-2023-41744 | High | 7.8 | 2023-08-31 | Local privilege escalation due to unrestricted loading of unsigned libraries. The following products are affected: Acronis Agent (macOS) before build 30600, Ac… |
CVE-2023-41743 | High | 7.8 | 2023-08-31 | Local privilege escalation due to insecure driver communication port permissions. The following products are affected: Acronis Cyber Protect Home Office (Windo… |
CVE-2023-41717 | Medium | 5.5 | 2023-08-31 | Inappropriate file type control in Zscaler Proxy versions 3.6.1.25 and prior allows local attackers to bypass file download/upload restrictions. |
CVE-2023-34392 | High | 8.2 | 2023-08-31 | A Missing Authentication for Critical Function vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker… |
CVE-2023-34391 | High | 7.4 | 2023-08-31 | Insecure Inherited Permissions vulnerability in Schweitzer Engineering Laboratories SEL-5033 AcSELerator RTAC Software on Windows allows Leveraging/Manipulatin… |
CVE-2023-31175 | High | 8.8 | 2023-08-31 | An Execution with Unnecessary Privileges vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker to ru… |
CVE-2023-31174 | High | 7.4 | 2023-08-31 | A Cross-Site Request Forgery (CSRF) vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker to embed i… |
CVE-2023-31173 | High | 7.7 | 2023-08-31 | Use of Hard-coded Credentials vulnerability in Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator on Windows allows Authentication Bypass. S… |
CVE-2023-31172 | Medium | 5.9 | 2023-08-31 | An Incomplete Filtering of Special Elements vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software could allow an att… |
CVE-2023-31171 | Medium | 5.9 | 2023-08-31 | An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSE… |
CVE-2023-31170 | Medium | 5.9 | 2023-08-31 | An Inclusion of Functionality from Untrusted Control Sphere vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software co… |
CVE-2023-31169 | Medium | 4.8 | 2023-08-31 | An Improper Handling of Unicode Encoding vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software could allow an attack… |
CVE-2023-31168 | Medium | 5.5 | 2023-08-31 | An Inclusion of Functionality from Untrusted Control Sphere vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software co… |
CVE-2023-31167 | Medium | 5.0 | 2023-08-31 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Schweitzer Engineering Laboratories SEL-5036 acSELerator Bay Sc… |
CVE-2023-41742 | High | 7.5 | 2023-08-31 | Excessive attack surface due to binding to an unrestricted IP address. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build… |
CVE-2023-41642 | Medium | 6.1 | 2023-08-31 | Multiple reflected cross-site scripting (XSS) vulnerabilities in the ErroreNonGestito.aspx component of GruppoSCAI RealGimm 1.1.37p38 allow attackers to execut… |
CVE-2023-41640 | High | 8.8 | 2023-08-31 | An improper error handling vulnerability in the component ErroreNonGestito.aspx of GruppoSCAI RealGimm 1.1.37p38 allows attackers to obtain sensitive technical… |
CVE-2023-41638 | High | 8.8 | 2023-08-31 | An arbitrary file upload vulnerability in the Gestione Documentale module of GruppoSCAI RealGimm 1.1.37p38 allows attackers to execute arbitrary code via uploa… |
CVE-2023-41637 | Critical | 9.8 | 2023-08-31 | An arbitrary file upload vulnerability in the Carica immagine function of GruppoSCAI RealGimm 1.1.37p38 allows attackers to execute arbitrary code via uploadin… |
CVE-2023-41636 | Critical | 9.8 | 2023-08-31 | A SQL injection vulnerability in the Data Richiesta dal parameter of GruppoSCAI RealGimm v1.1.37p38 allows attackers to access the database and execute arbitra… |
CVE-2023-41635 | Medium | 6.5 | 2023-08-31 | A XML External Entity (XXE) vulnerability in the VerifichePeriodiche.aspx component of GruppoSCAI RealGimm v1.1.37p38 allows attackers to read any file in the… |
CVE-2023-33835 | Medium | 4.3 | 2023-08-31 | IBM Security Verify Information Queue 10.0.4 and 10.0.5 could allow a remote attacker to obtain sensitive information that could aid in further attacks against… |
CVE-2023-33834 | Medium | 4.3 | 2023-08-31 | IBM Security Verify Information Queue 10.0.4 and 10.0.5 could allow a remote attacker to obtain sensitive information that could aid in further attacks against… |
CVE-2023-28801 | Critical | 9.6 | 2023-08-31 | An Improper Verification of Cryptographic Signature in the SAML authentication of the Zscaler Admin UI allows a Privilege Escalation.This issue affects Admin U… |
CVE-2023-33833 | Low | 2.9 | 2023-08-31 | IBM Security Verify Information Queue 10.0.4 and 10.0.5 stores sensitive information in plain clear text which can be read by a local user. IBM X-Force ID: 2… |
CVE-2023-41741 | Medium | 5.3 | 2023-08-31 | Exposure of sensitive information to an unauthorized actor vulnerability in cgi component in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote at… |
CVE-2023-41740 | Medium | 5.3 | 2023-08-31 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in cgi component in Synology Router Manager (SRM) before 1.3.1-934… |
CVE-2023-41739 | Medium | 4.9 | 2023-08-31 | Uncontrolled resource consumption vulnerability in File Functionality in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote authenticated users to… |
CVE-2023-41738 | High | 7.2 | 2023-08-31 | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Directory Domain Functionality in Synology Router M… |
CVE-2023-20900 | High | 7.1 | 2023-08-31 | A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A… |
CVE-2023-4500 | Medium | 4.7 | 2023-08-31 | The Order Tracking Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the order status parameter in versions up to, and including, 3.3.6… |
CVE-2023-4471 | Medium | 6.1 | 2023-08-31 | The Order Tracking Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the start_date and end_date parameters in versions up to, and i… |
CVE-2023-4315 | Medium | 6.1 | 2023-08-31 | The Woo Custom Emails for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wcemails_edit' parameter in versions up to, and including, 2.2 due… |
CVE-2023-4245 | Medium | 4.3 | 2023-08-31 | The WooCommerce PDF Invoice Builder for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the GetInvoiceDetail functi… |
CVE-2023-4161 | Medium | 4.3 | 2023-08-31 | The WooCommerce PDF Invoice Builder for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the SaveCustomField function in v… |
CVE-2023-4160 | Medium | 4.4 | 2023-08-31 | The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.2… |
CVE-2023-4000 | Medium | 6.3 | 2023-08-31 | The Waiting: One-click countdowns plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.6.2. This is due to miss… |
CVE-2023-3999 | Medium | 6.3 | 2023-08-31 | The Waiting: One-click countdowns plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on its AJAX calls in versions up… |
CVE-2023-3764 | Medium | 4.3 | 2023-08-31 | The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.90. This is due to m… |
CVE-2023-3677 | High | 8.8 | 2023-08-31 | The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to SQL Injection via the pageId parameter in versions up to, and including, 1.2.89 due t… |
CVE-2023-3636 | High | 8.8 | 2023-08-31 | The WP Project Manager plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.6.4 due to insufficient restriction on th… |
CVE-2023-3404 | Medium | 4.9 | 2023-08-31 | The ProfileGrid plugin for WordPress is vulnerable to unauthorized decryption of private information in versions up to, and including, 5.5.0. This is due to th… |
CVE-2023-3162 | Critical | 9.8 | 2023-08-31 | The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.7.7. This is due to i… |
CVE-2023-2354 | Medium | 4.9 | 2023-08-31 | The CHP Ads Block Detector plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings reachable though an AJAX action in versions up… |
CVE-2023-2353 | Medium | 4.3 | 2023-08-31 | The CHP Ads Block Detector plugin for WordPress is vulnerable to unauthorized plugin settings update and reset due to a missing capability check on the chp_abd… |
CVE-2023-2352 | Medium | 4.3 | 2023-08-31 | The CHP Ads Block Detector plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.9.4. This is due to missing or… |
CVE-2023-2279 | Medium | 5.4 | 2023-08-31 | The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due to missing or incorr… |
CVE-2023-2229 | High | 8.8 | 2023-08-31 | The Quick Post Duplicator for WordPress is vulnerable to SQL Injection via the ‘post_id’ parameter in versions up to, and including, 2.0 due to insufficient es… |
CVE-2023-2188 | High | 7.2 | 2023-08-31 | The Colibri Page Builder for WordPress is vulnerable to SQL Injection via the ‘post_id’ parameter in versions up to, and including, 1.0.227 due to insufficient… |
CVE-2023-2174 | Medium | 4.3 | 2023-08-31 | The BadgeOS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_badgeos_log_entries functio… |
CVE-2023-2173 | Medium | 6.5 | 2023-08-31 | The BadgeOS plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.7.1.6. This is due to improper validatio… |
CVE-2023-2172 | Medium | 4.3 | 2023-08-31 | The BadgeOS plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.7.1.6. This is due to improper validatio… |
CVE-2023-2171 | Medium | 5.4 | 2023-08-31 | The BadgeOS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 3.7.1.6 due to in… |
CVE-2023-0689 | Medium | 4.3 | 2023-08-31 | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_first_name' shortcode in versions up to, and inclu… |
CVE-2023-4655 | Medium | 6.1 | 2023-08-31 | Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1. |
CVE-2023-4654 | Low | 3.5 | 2023-08-31 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository instantsoft/icms2 prior to 2.16.1. |
CVE-2023-4653 | Medium | 4.8 | 2023-08-31 | Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git. |
CVE-2023-4652 | Medium | 5.4 | 2023-08-31 | Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git. |
CVE-2023-4651 | Medium | 5.4 | 2023-08-31 | Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1. |
CVE-2023-4650 | Medium | 4.7 | 2023-08-31 | Improper Access Control in GitHub repository instantsoft/icms2 prior to 2.16.1-git. |
CVE-2023-4649 | Medium | 5.4 | 2023-08-31 | Session Fixation in GitHub repository instantsoft/icms2 prior to 2.16.1. |
CVE-2023-4163 | Medium | 4.4 | 2023-08-31 | In Brocade Fabric OS before v9.2.0a, a local authenticated privileged user can trigger a buffer overflow condition, leading to a kernel panic with large inp… |
CVE-2023-4162 | Medium | 4.4 | 2023-08-31 | A segmentation fault can occur in Brocade Fabric OS after Brocade Fabric OS v9.0 and before Brocade Fabric OS v9.2.0a through the passwdcfg command. This c… |
CVE-2023-31925 | Medium | 5.4 | 2023-08-31 | Brocade SANnav before v2.3.0 and v2.2.2a stores SNMPv3 Authentication passwords in plaintext. A privileged user could retrieve these credentials with knowle… |
CVE-2023-31424 | High | 8.1 | 2023-08-31 | Brocade SANnav Web interface before Brocade SANnav v2.3.0 and v2.2.2a allows remote unauthenticated users to bypass web authentication and authorization. |
CVE-2023-31423 | Medium | 5.7 | 2023-08-31 | Possible information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking on Brocade SANnav… |
CVE-2023-3489 | High | 8.6 | 2023-08-31 | The firmwaredownload command on Brocade Fabric OS v9.2.0 could log the FTP/SFTP/SCP server password in clear text in the SupportSave file when performing a… |
CVE-2023-23765 | Medium | 4.8 | 2023-08-30 | An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff in a re-opened P… |
CVE-2023-41163 | Medium | 6.1 | 2023-08-30 | A Reflected Cross-site scripting (XSS) vulnerability in the file manager tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML vi… |
CVE-2023-41041 | Low | 2.6 | 2023-08-30 | Graylog is a free and open log management platform. In a multi-node Graylog cluster, after a user has explicitly logged out, a user session may still be used f… |
CVE-2023-41040 | Medium | 4.0 | 2023-08-30 | GitPython is a python library used to interact with Git repositories. In order to resolve some git references, GitPython reads files from the `.git` directory… |
CVE-2023-39139 | High | 7.8 | 2023-08-30 | An issue in Archive v3.3.7 allows attackers to execute a path traversal via extracting a crafted zip file. |
CVE-2023-39138 | High | 7.8 | 2023-08-30 | An issue in ZIPFoundation v0.9.16 allows attackers to execute a path traversal via extracting a crafted zip file. |
CVE-2023-39137 | High | 7.8 | 2023-08-30 | An issue in Archive v3.3.7 allows attackers to spoof zip filenames which can lead to inconsistent filename parsing. |