2023 CVEs (page 169)
Page 169 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-39136 | Medium | 5.5 | 2023-08-30 | An unhandled edge case in the component _sanitizedPath of ZipArchive v2.5.4 allows attackers to cause a Denial of Service (DoS) via a crafted zip file. |
CVE-2023-39135 | High | 7.8 | 2023-08-30 | An issue in Zip Swift v2.1.2 allows attackers to execute a path traversal attack via a crafted zip entry. |
CVE-2023-38970 | Medium | 5.4 | 2023-08-30 | Cross Site Scripting vulnerabiltiy in Badaso v.0.0.1 thru v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload to the Name of membe… |
CVE-2023-31714 | Critical | 9.8 | 2023-08-30 | Chitor-CMS before v1.1.2 was discovered to contain multiple SQL injection vulnerabilities. |
CVE-2023-41039 | High | 8.3 | 2023-08-30 | RestrictedPython is a restricted execution environment for Python to run untrusted code. Python's "format" functionality allows someone controlling the format… |
CVE-2023-40582 | Critical | 9.8 | 2023-08-30 | find-exec is a utility to discover available shell commands. Versions prior to 1.0.3 did not properly escape user input and are vulnerable to Command Injection… |
CVE-2023-40184 | Low | 2.6 | 2023-08-30 | xrdp is an open source remote desktop protocol (RDP) server. In versions prior to 0.9.23 improper handling of session establishment errors allows bypassing OS-… |
CVE-2023-36811 | Medium | 4.7 | 2023-08-30 | borgbackup is an opensource, deduplicating archiver with compression and authenticated encryption. A flaw in the cryptographic authentication scheme in borgbac… |
CVE-2023-4640 | Medium | 6.5 | 2023-08-30 | The controller responsible for setting the logging level does not include any authorization checks to ensure the user is authenticated. This can be seen by not… |
CVE-2023-4571 | High | 8.6 | 2023-08-30 | In Splunk IT Service Intelligence (ITSI) versions below below 4.13.3, 4.15.3, or 4.17.1, a malicious actor can inject American National Standards Institute (AN… |
CVE-2023-40848 | Critical | 9.8 | 2023-08-30 | Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via the function "sub_7D858." |
CVE-2023-40847 | Critical | 9.8 | 2023-08-30 | Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via the function "initIpAddrInfo." In the function, it reads in a user-prov… |
CVE-2023-40845 | Critical | 9.8 | 2023-08-30 | Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via function 'sub_34FD0.' In the function, it reads user provided parameter… |
CVE-2023-40844 | Critical | 9.8 | 2023-08-30 | Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via function 'formWifiBasicSet.' |
CVE-2023-40843 | Critical | 9.8 | 2023-08-30 | Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via function "sub_73004." |
CVE-2023-40842 | Critical | 9.8 | 2023-08-30 | Tengda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via function "R7WebsSecurityHandler." |
CVE-2023-40841 | Critical | 9.8 | 2023-08-30 | Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via function "add_white_node," |
CVE-2023-40840 | Critical | 9.8 | 2023-08-30 | Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via function "fromGetWirelessRepeat." |
CVE-2023-40839 | Critical | 9.8 | 2023-08-30 | Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin function 'sub_ADF3C' contains a command execution vulnerability. In the "formSetIptv" function, obtaining th… |
CVE-2023-40838 | Critical | 9.8 | 2023-08-30 | Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin function 'sub_3A1D0' contains a command execution vulnerability. |
CVE-2023-40837 | Critical | 9.8 | 2023-08-30 | Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin function 'sub_ADD50' contains a command execution vulnerability. In the "formSetIptv" function, obtaining th… |
CVE-2023-40598 | High | 8.5 | 2023-08-30 | In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can… |
CVE-2023-40597 | High | 7.8 | 2023-08-30 | In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is located… |
CVE-2023-40596 | High | 7.0 | 2023-08-30 | In Splunk Enterprise versions earlier than 8.2.12, 9.0.6, and 9.1.1, a dynamic link library (DLL) that ships with Splunk Enterprise references an insecure path… |
CVE-2023-40595 | High | 8.8 | 2023-08-30 | In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can execute a specially crafted query that they can then use to serialize untrus… |
CVE-2023-40594 | Medium | 6.5 | 2023-08-30 | In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can use the `printf` SPL function to perform a denial of service (DoS) against t… |
CVE-2023-40593 | Medium | 6.3 | 2023-08-30 | In Splunk Enterprise versions lower than 9.0.6 and 8.2.12, a malicious actor can send a malformed security assertion markup language (SAML) request to the `/sa… |
CVE-2023-40592 | High | 8.4 | 2023-08-30 | In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12, an attacker can craft a special web request that can result in reflected cross-site scripting (XS… |
CVE-2023-20266 | Medium | 6.5 | 2023-08-30 | A vulnerability in Cisco Emergency Responder, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Editio… |
CVE-2023-35094 | Medium | 6.5 | 2023-08-30 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Julien Berthelot / MPEmbed WP Matterport Shortcode plugin <= 2.1.4 versions. |
CVE-2023-35092 | Medium | 5.9 | 2023-08-30 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Abhay Yadav Breadcrumb simple plugin <= 1.3 versions. |
CVE-2023-34372 | Medium | 5.9 | 2023-08-30 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Didier Sampaolo SpamReferrerBlock plugin <= 2.22 versions. |
CVE-2023-32294 | Medium | 5.9 | 2023-08-30 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Radical Web Design GDPR Cookie Consent Notice Box plugin <= 1.1.6 versions. |
CVE-2023-28692 | Medium | 5.9 | 2023-08-30 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kevon Adonis WP Abstracts plugin <= 2.6.3 versions. |
CVE-2023-28415 | Medium | 5.9 | 2023-08-30 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in XootiX Side Cart Woocommerce (Ajax) plugin <= 2.2 versions. |
CVE-2023-27621 | Medium | 5.9 | 2023-08-30 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in MrDemonWolf Livestream Notice plugin <= 1.2.0 versions. |
CVE-2023-25471 | High | 7.1 | 2023-08-30 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Webcodin WCP OpenWeather plugin <= 2.5.0 versions. |
CVE-2023-25466 | Medium | 5.8 | 2023-08-30 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Mahlamusa Who Hit The Page – Hit Counter plugin <= 1.4.14.3 versions. |
CVE-2023-25453 | High | 7.1 | 2023-08-30 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ian Sadovy WordPress Tables plugin <= 1.3.9 versions. |
CVE-2023-24401 | Medium | 5.9 | 2023-08-30 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Davidsword Mobile Call Now & Map Buttons plugin <= 1.5.0 versions. |
CVE-2023-24397 | Medium | 5.9 | 2023-08-30 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Reservation.Studio Reservation.Studio widget plugin <= 1.0.11 versions. |
CVE-2023-4209 | Medium | 4.3 | 2023-08-30 | The POEditor WordPress plugin before 0.9.8 does not have CSRF checks in various places, which could allow attackers to make logged in admins perform unwanted a… |
CVE-2023-4150 | Medium | 4.3 | 2023-08-30 | The User Activity Tracking and Log WordPress plugin before 4.0.9 does not have proper CSRF checks when managing its license, which could allow attackers to mak… |
CVE-2023-4109 | Medium | 4.8 | 2023-08-30 | The Ninja Forms WordPress Ninja Forms Contact Form WordPress plugin before 3.6.26 was affected by a HTML Injection security vulnerability. |
CVE-2023-4036 | Medium | 4.3 | 2023-08-30 | The Simple Blog Card WordPress plugin before 1.32 does not ensure that posts to be displayed via a shortcode are public, allowing any authenticated users, such… |
CVE-2023-4035 | Medium | 5.4 | 2023-08-30 | The Simple Blog Card WordPress plugin before 1.31 does not validate and escape some of its shortcode attributes before outputting them back in a page/post wher… |
CVE-2023-4023 | Medium | 4.3 | 2023-08-30 | The All Users Messenger WordPress plugin through 1.24 does not prevent non-administrator users from deleting messages from the all-users messenger. |
CVE-2023-4013 | Medium | 6.5 | 2023-08-30 | The GDPR Cookie Compliance (CCPA, DSGVO, Cookie Consent) WordPress plugin before 4.12.5 does not have proper CSRF checks when managing its license, which could… |
CVE-2023-3992 | Medium | 6.1 | 2023-08-30 | The PostX WordPress plugin before 3.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scrip… |
CVE-2023-3720 | Medium | 6.5 | 2023-08-30 | The Upload Media By URL WordPress plugin before 1.0.8 does not have CSRF check when uploading files, which could allow attackers to make logged in admins uploa… |
CVE-2023-3501 | Medium | 4.8 | 2023-08-30 | The FormCraft WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2023-3356 | Medium | 4.3 | 2023-08-30 | The Subscribers Text Counter WordPress plugin before 1.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a… |
CVE-2023-34173 | Medium | 5.9 | 2023-08-30 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alexander Semikashev Yandex Metrica Counter plugin <= 1.4.3 versions. |
CVE-2023-34172 | Medium | 5.9 | 2023-08-30 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Miled WordPress Social Login plugin <= 3.0.4 versions. |
CVE-2023-34032 | High | 7.1 | 2023-08-30 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Pascal Casier bbPress Toolkit plugin <= 1.0.12 versions. |
CVE-2023-34023 | High | 7.1 | 2023-08-30 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Miled WordPress Social Login plugin <= 3.0.4 versions. |
CVE-2023-34022 | High | 7.1 | 2023-08-30 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Rakib Hasan Dynamic QR Code Generator plugin <= 0.0.5 versions. |
CVE-2023-34008 | High | 7.1 | 2023-08-30 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in weDevs WP ERP plugin <= 1.12.3 versions. |
CVE-2023-34004 | Medium | 6.5 | 2023-08-30 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Box Office plugin <= 1.1.50 versions. |
CVE-2023-1982 | Medium | 4.8 | 2023-08-30 | The Front Editor WordPress plugin through 4.0.4 does not sanitize and escape some of its form settings, which could allow high-privilege users to perform Store… |
CVE-2023-41539 | High | 7.5 | 2023-08-30 | phpjabbers Business Directory Script 3.2 is vulnerable to SQL Injection via the column parameter. |
CVE-2023-41538 | Medium | 6.1 | 2023-08-30 | phpjabbers PHP Forum Script 3.0 is vulnerable to Cross Site Scripting (XSS) via the keyword parameter. |
CVE-2023-41537 | Medium | 6.1 | 2023-08-30 | phpjabbers Business Directory Script 3.2 is vulnerable to Cross Site Scripting (XSS) via the keyword parameter. |
CVE-2023-34187 | Medium | 5.9 | 2023-08-30 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alan Tien Call Now Icon Animate plugin <= 0.1.0 versions. |
CVE-2023-34184 | High | 7.1 | 2023-08-30 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Bhavik Patel Woocommerce Order address Print plugin <= 3.2 versions. |
CVE-2023-34183 | Medium | 5.9 | 2023-08-30 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Valiano Unite Gallery Lite plugin <= 1.7.61 versions. |
CVE-2023-34180 | High | 7.1 | 2023-08-30 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in KAPlugins Google Fonts For WordPress plugin <= 3.0.0 versions. |
CVE-2023-34176 | High | 7.1 | 2023-08-30 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Chilexpress Chilexpress woo oficial plugin <= 1.2.9 versions. |
CVE-2023-34175 | High | 7.1 | 2023-08-30 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in GrandSlambert Login Configurator plugin <= 2.1 versions. |
CVE-2023-34174 | High | 7.1 | 2023-08-30 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in BBS e-Theme BBS e-Popup plugin <= 2.4.5 versions. |
CVE-2023-4624 | Low | 2.4 | 2023-08-30 | Server-Side Request Forgery (SSRF) in GitHub repository bookstackapp/bookstack prior to v23.08. |
CVE-2023-41563 | Critical | 9.8 | 2023-08-30 | Tenda AC9 V3.0 V15.03.06.42_multi and Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 were discovered to contain a stack overflow via parameter mac at url /goform/GetPare… |
CVE-2023-41562 | Critical | 9.8 | 2023-08-30 | Tenda AC7 V1.0 V15.03.06.44, Tenda AC9 V3.0 V15.03.06.42_multi, and Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 were discovered to contain a stack overflow via parame… |
CVE-2023-41561 | Critical | 9.8 | 2023-08-30 | Tenda AC9 V3.0 V15.03.06.42_multi and Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 were discovered to contain a stack overflow via parameter startIp and endIp at url /… |
CVE-2023-41560 | Critical | 9.8 | 2023-08-30 | Tenda AC9 V3.0 V15.03.06.42_multi was discovered to contain a stack overflow via parameter firewallEn at url /goform/SetFirewallCfg. |
CVE-2023-41559 | Critical | 9.8 | 2023-08-30 | Tenda AC7 V1.0 V15.03.06.44, Tenda AC9 V3.0 V15.03.06.42_multi, and Tenda AC5 V1.0RTL_V15.03.06.28 were discovered to contain a stack overflow via parameter pa… |
CVE-2023-41558 | Critical | 9.8 | 2023-08-30 | Tenda AC7 V1.0 V15.03.06.44 was discovered to contain a stack overflow via parameter timeZone at url /goform/SetSysTimeCfg. |
CVE-2023-41557 | Critical | 9.8 | 2023-08-30 | Tenda AC7 V1.0 V15.03.06.44 and Tenda AC5 V1.0RTL_V15.03.06.28 were discovered to contain a stack overflow via parameter entrys and mitInterface at url /goform… |
CVE-2023-41556 | Critical | 9.8 | 2023-08-30 | Tenda AC7 V1.0 V15.03.06.44, Tenda AC9 V3.0 V15.03.06.42_multi, and Tenda AC5 V1.0RTL_V15.03.06.28 were discovered to contain a stack overflow via parameter li… |
CVE-2023-41555 | Critical | 9.8 | 2023-08-30 | Tenda AC7 V1.0 V15.03.06.44 was discovered to contain a stack overflow via parameter security_5g at url /goform/WifiBasicSet. |
CVE-2023-41554 | Critical | 9.8 | 2023-08-30 | Tenda AC9 V3.0 V15.03.06.42_multi was discovered to contain a stack overflow via parameter wpapsk_crypto at url /goform/WifiExtraSet. |
CVE-2023-41553 | Critical | 9.8 | 2023-08-30 | Tenda AC9 V3.0 V15.03.06.42_multi and Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 were discovered to contain a stack overflow via parameter list at url /goform/SetSta… |
CVE-2023-41552 | Critical | 9.8 | 2023-08-30 | Tenda AC7 V1.0 V15.03.06.44 and Tenda AC9 V3.0 V15.03.06.42_multi were discovered to contain a stack overflow via parameter ssid at url /goform/fast_setting_wi… |
CVE-2023-33929 | Medium | 5.9 | 2023-08-30 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Joaquín Ruiz Easy Admin Menu plugin <= 1.3 versions. |
CVE-2023-33325 | High | 7.1 | 2023-08-30 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Teplitsa of social technologies Leyka plugin <= 3.30.1 versions. |
CVE-2023-33320 | High | 7.1 | 2023-08-30 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Mohammad I. Okfie WP-Hijri plugin <= 1.5.1 versions. |
CVE-2023-33317 | High | 7.1 | 2023-08-30 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Returns and Warranty Requests plugin <= 2.1.6 versions. |
CVE-2023-33210 | Medium | 5.9 | 2023-08-30 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in nuajik plugin <= 0.1.0 versions. |
CVE-2023-33208 | Medium | 5.9 | 2023-08-30 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gsmith Cookie Monster plugin <= 1.51 versions. |
CVE-2023-27426 | Medium | 5.9 | 2023-08-30 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Notifyvisitors NotifyVisitors plugin <= 1.0 versions. |
CVE-2023-25462 | Medium | 5.9 | 2023-08-30 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP htaccess Control plugin <= 3.5.1 versions. |
CVE-2023-4600 | Medium | 4.3 | 2023-08-30 | The AffiliateWP for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'affwp_activate_addons_page_plugin' f… |
CVE-2023-32962 | Medium | 5.9 | 2023-08-30 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in HasTheme WishSuite – Wishlist for WooCommerce plugin <= 1.3.4 versions. |
CVE-2023-32802 | High | 7.1 | 2023-08-30 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Pre-Orders plugin <= 1.9.0 versions. |
CVE-2023-32801 | High | 7.1 | 2023-08-30 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Composite Products plugin <= 8.7.5 versions. |
CVE-2023-32793 | Medium | 6.5 | 2023-08-30 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Pre-Orders plugin <= 2.0.0 versions. |
CVE-2023-32746 | Medium | 6.5 | 2023-08-30 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Brands plugin <= 1.6.45 versions. |
CVE-2023-32742 | High | 7.1 | 2023-08-30 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in VeronaLabs WP SMS plugin <= 6.1.4 versions. |
CVE-2023-32597 | High | 7.1 | 2023-08-30 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Video Gallery plugin <= 1.0.10 versions. |
CVE-2023-25019 | High | 7.1 | 2023-08-30 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Premio Chaty plugin <= 3.0.9 versions |