2023 CVEs (page 170)
Page 170 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-32740 | Medium | 5.8 | 2023-08-30 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Kunal Nagar Custom 404 Pro plugin <= 3.8.1 versions. |
CVE-2023-3136 | High | 7.2 | 2023-08-30 | The MailArchiver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 2.10.1 due to insuffi… |
CVE-2023-4522 | Medium | 4.3 | 2023-08-30 | An issue has been discovered in GitLab affecting all versions before 16.2.0. Committing directories containing LF character results in 500 errors when viewing… |
CVE-2023-4599 | Medium | 6.4 | 2023-08-30 | The Email Encoder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eeb_mailto' shortcode in versions up to, and including, 2.1.8 due… |
CVE-2023-4597 | Medium | 6.4 | 2023-08-30 | The Slimstat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slimstat' shortcode in versions up to, and including, 5.0.9 d… |
CVE-2023-4596 | Critical | 9.8 | 2023-08-30 | The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server… |
CVE-2023-41266 | High | 8.2 | 2023-08-29 | A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, Novembe… |
CVE-2023-41265 | Critical | 9.6 | 2023-08-29 | An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier… |
CVE-2023-39559 | Medium | 5.3 | 2023-08-29 | AudimexEE 15.0 was discovered to contain a full path disclosure vulnerability. |
CVE-2023-39558 | Medium | 6.1 | 2023-08-29 | AudimexEE v15.0 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the Show Kai Data component. |
CVE-2023-4611 | High | 7.0 | 2023-08-29 | A use-after-free flaw was found in mm/mempolicy.c in the memory management subsystem in the Linux Kernel. This issue is caused by a race between mbind() and VM… |
CVE-2023-4296 | High | 8.8 | 2023-08-29 | If an attacker tricks an admin user of PTC Codebeamer into clicking on a malicious link, it may allow the attacker to inject arbitrary code to be executed in… |
CVE-2023-41153 | Medium | 5.4 | 2023-08-29 | A Stored Cross-Site Scripting (XSS) vulnerability in the SSH configuration tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or HTML… |
CVE-2023-38975 | High | 7.5 | 2023-08-29 | * Buffer Overflow vulnerability in qdrant v.1.3.2 allows a remote attacker cause a denial of service via the chucnked_vectors.rs component. |
CVE-2023-38971 | Medium | 5.4 | 2023-08-29 | Cross Site Scripting vulnerabiltiy in Badaso v.0.0.1 thru v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload to the rack number p… |
CVE-2023-32241 | High | 7.1 | 2023-08-29 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPDeveloper Essential Addons for Elementor Pro plugin <= 5.4.8 versions. |
CVE-2023-4572 | High | 8.8 | 2023-08-29 | Use after free in MediaStream in Google Chrome prior to 116.0.5845.140 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2023-4346 | High | 7.5 | 2023-08-29 | KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable… |
CVE-2023-3253 | Medium | 4.3 | 2023-08-29 | An improper authorization vulnerability exists where an authenticated, low privileged remote attacker could view a list of all the users available in the app… |
CVE-2023-39678 | Medium | 6.1 | 2023-08-29 | A cross-site scripting (XSS) vulnerability in the device web interface (Log Query page) of BDCOM OLT P3310D-2AC 10.1.0F Build 69083 allows attackers to execute… |
CVE-2023-39663 | High | 7.5 | 2023-08-29 | Mathjax up to v2.7.9 was discovered to contain two Regular expression Denial of Service (ReDoS) vulnerabilities in MathJax.js via the components pattern and ma… |
CVE-2023-39268 | Medium | 4.5 | 2023-08-29 | A memory corruption vulnerability in ArubaOS-Switch could lead to unauthenticated remote code execution by receiving specially crafted packets. Successful expl… |
CVE-2023-39267 | Medium | 6.6 | 2023-08-29 | An authenticated remote code execution vulnerability exists in the command line interface in ArubaOS-Switch. Successful exploitation results in a Denial-of-Ser… |
CVE-2023-39266 | High | 8.3 | 2023-08-29 | A vulnerability in the ArubaOS-Switch web management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) at… |
CVE-2023-3252 | Medium | 6.8 | 2023-08-29 | An arbitrary file write vulnerability exists where an authenticated, remote attacker with administrator privileges could alter logging variables to overwrite… |
CVE-2023-3251 | Medium | 4.1 | 2023-08-29 | A pass-back vulnerability exists where an authenticated, remote attacker with administrator privileges could uncover stored SMTP credentials within the Nessus… |
CVE-2023-39522 | Medium | 5.3 | 2023-08-29 | goauthentik is an open-source Identity Provider. In affected versions using a recovery flow with an identification stage an attacker is able to determine if a… |
CVE-2023-34039 | Critical | 9.8 | 2023-08-29 | Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation. A malicious actor with netwo… |
CVE-2023-20890 | High | 7.2 | 2023-08-29 | Aria Operations for Networks contains an arbitrary file write vulnerability. An authenticated malicious actor with administrative access to VMware Aria Operati… |
CVE-2023-41037 | Medium | 4.3 | 2023-08-29 | OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. In affected versions OpenPGP Cleartext Signed Messages are cryptographically signed messages… |
CVE-2023-40890 | Critical | 9.8 | 2023-08-29 | A stack-based buffer overflow vulnerability exists in the lookup_sequence function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosu… |
CVE-2023-40889 | Critical | 9.8 | 2023-08-29 | A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/… |
CVE-2023-3646 | Medium | 5.9 | 2023-08-29 | On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error may trigger a kernel panic and cause syst… |
CVE-2023-39616 | High | 7.5 | 2023-08-29 | AOMedia v3.0.0 to v3.5.0 was discovered to contain an invalid read memory access via the component assign_frame_buffer_p in av1/common/av1_common_int.h. |
CVE-2023-39615 | Medium | 6.5 | 2023-08-29 | Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows at… |
CVE-2023-24548 | Medium | 5.3 | 2023-08-29 | On affected platforms running Arista EOS with VXLAN configured, malformed or truncated packets received over a VXLAN tunnel and forwarded in hardware can cause… |
CVE-2023-41376 | High | 7.5 | 2023-08-29 | Nokia Service Router Operating System (SR OS) 22.10 and SR Linux, when error-handling update-fault-tolerance is not enabled, mishandle BGP path attributes. |
CVE-2023-41362 | High | 7.2 | 2023-08-29 | MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of… |
CVE-2023-38802 | High | 7.5 | 2023-08-29 | FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of service via a crafted BGP update with a corrupted attribut… |
CVE-2023-38283 | Medium | 5.3 | 2023-08-29 | In OpenBGPD before 8.1, incorrect handling of BGP update data (length of path attributes) set by a potentially distant remote actor may cause the system to inc… |
CVE-2023-0654 | Low | 3.9 | 2023-08-29 | Due to a misconfiguration, the WARP Mobile Client (< 6.29) for Android was susceptible to a tapjacking attack. In the event that an attacker built a malicious… |
CVE-2023-0238 | Low | 3.9 | 2023-08-29 | Due to lack of a security policy, the WARP Mobile Client (<=6.29) for Android was susceptible to this vulnerability which allowed a malicious app installed on… |
CVE-2023-40787 | Critical | 9.8 | 2023-08-29 | In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks, which leads to SQL injection. |
CVE-2023-23774 | High | 8.4 | 2023-08-29 | Motorola EBTS/MBTS Site Controller drops to debug prompt on unhandled exception. The Motorola MBTS Site Controller exposes a debug prompt on the device's seria… |
CVE-2023-23773 | High | 7.2 | 2023-08-29 | Motorola EBTS/MBTS Base Radio fails to check firmware authenticity. The Motorola MBTS Base Radio lacks cryptographic signature validation for firmware update p… |
CVE-2023-23772 | High | 7.2 | 2023-08-29 | Motorola MBTS Site Controller fails to check firmware update authenticity. The Motorola MBTS Site Controller lacks cryptographic signature validation for firmw… |
CVE-2023-23771 | High | 8.4 | 2023-08-29 | Motorola MBTS Base Radio accepts hard-coded backdoor password. The Motorola MBTS Base Radio Man Machine Interface (MMI), allowing for service technicians to di… |
CVE-2023-23770 | Critical | 9.4 | 2023-08-29 | Motorola MBTS Site Controller accepts hard-coded backdoor password. The Motorola MBTS Site Controller Man Machine Interface (MMI), allowing for service technic… |
CVE-2023-32457 | High | 7.5 | 2023-08-29 | Dell PowerScale OneFS, versions 8.2.2.x-9.5.0.x, contains an improper privilege management vulnerability. A remote attacker with low privileges could potentia… |
CVE-2023-41363 | Medium | 4.3 | 2023-08-29 | In Cerebrate 1.14, a vulnerability in UserSettingsController allows authenticated users to change user settings of other users. |
CVE-2023-41361 | Critical | 9.8 | 2023-08-29 | An issue was discovered in FRRouting FRR 9.0. bgpd/bgp_open.c does not check for an overly large length of the rcv software version. |
CVE-2023-41360 | Critical | 9.1 | 2023-08-29 | An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c can read the initial byte of the ORF header in an ahead-of-stream situation. |
CVE-2023-41359 | Critical | 9.1 | 2023-08-29 | An issue was discovered in FRRouting FRR through 9.0. There is an out-of-bounds read in bgp_attr_aigp_valid in bgpd/bgp_attr.c because there is no check for th… |
CVE-2023-41358 | High | 7.5 | 2023-08-29 | An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c processes NLRIs if the attribute length is zero. |
CVE-2023-1995 | Medium | 5.3 | 2023-08-29 | Insufficient Logging vulnerability in Hitachi HiRDB Server, HiRDB Server With Addtional Function, HiRDB Structured Data Access Facility.This issue affects HiRD… |
CVE-2023-39650 | Critical | 9.8 | 2023-08-28 | Theme Volty CMS Blog up to version v4.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /tvcmsblog/single. |
CVE-2023-4569 | Medium | 5.5 | 2023-08-28 | A memory leak flaw was found in nft_set_catchall_flush in net/netfilter/nf_tables_api.c in the Linux Kernel. This issue may allow a local attacker to cause dou… |
CVE-2023-41005 | High | 7.8 | 2023-08-28 | An issue in Pagekit pagekit v.1.0.18 alows a remote attacker to execute arbitrary code via thedownloadAction and updateAction functions in UpdateController.php |
CVE-2023-40998 | High | 7.5 | 2023-08-28 | Buffer Overflow vulnerability in O-RAN Software Community ric-plt-lib-rmr v.4.9.0 allows a remote attacker to cause a denial of service via the packet size com… |
CVE-2023-40997 | High | 7.5 | 2023-08-28 | Buffer Overflow vulnerability in O-RAN Software Community ric-plt-lib-rmr v.4.9.0 allows a remote attacker to cause a denial of service via a crafted packet. |
CVE-2023-40857 | High | 8.8 | 2023-08-28 | Buffer Overflow vulnerability in VirusTotal yara v.4.3.2 allows a remote attacker to execute arbtirary code via the yr_execute_cod function in the exe.c compon… |
CVE-2023-40828 | High | 7.5 | 2023-08-28 | An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the expandIfZip method in the… |
CVE-2023-40827 | High | 7.5 | 2023-08-28 | An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the loadpluginPath parameter. |
CVE-2023-40826 | High | 7.5 | 2023-08-28 | An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the zippluginPath parameter. |
CVE-2023-40825 | High | 7.2 | 2023-08-28 | An issue in Perfree PerfreeBlog v.3.1.2 allows a remote attacker to execute arbitrary code via crafted plugin listed in admin/plugin/access/list. |
CVE-2023-40781 | Medium | 6.5 | 2023-08-28 | Buffer Overflow vulnerability in Libming Libming v.0.4.8 allows a remote attacker to cause a denial of service via a crafted .swf file to the makeswf function. |
CVE-2023-39059 | High | 8.8 | 2023-08-28 | An issue in ansible semaphore v.2.8.90 allows a remote attacker to execute arbitrary code via a crafted payload to the extra variables parameter. |
CVE-2023-34725 | Medium | 6.8 | 2023-08-28 | An issue was discovered in TechView LA-5570 Wireless Gateway 1.0.19_T53, allows physical attackers to gain escalated privileges via a telnet connection. |
CVE-2023-34724 | Medium | 6.8 | 2023-08-28 | An issue was discovered in TECHView LA5570 Wireless Gateway 1.0.19_T53, allows physical attackers to gain escalated privileges via the UART interface. |
CVE-2023-40170 | Medium | 4.6 | 2023-08-28 | jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on `/files/` URLs could allow exposure of certain file conten… |
CVE-2023-39968 | Medium | 4.3 | 2023-08-28 | jupyter-server is the backend for Jupyter web applications. Open Redirect Vulnerability. Maliciously crafted login links to known Jupyter Servers can cause suc… |
CVE-2023-39652 | Critical | 9.8 | 2023-08-28 | theme volty tvcmsvideotab up to v4.0.0 was discovered to contain a SQL injection vulnerability via the component TvcmsVideoTabConfirmDeleteModuleFrontControlle… |
CVE-2023-38969 | Medium | 5.4 | 2023-08-28 | Cross Site Scripting vulnerabiltiy in Badaso v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload to the title parameter in the new… |
CVE-2023-41109 | Critical | 9.8 | 2023-08-28 | SmartNode SN200 (aka SN200) 3.21.2-23021 allows unauthenticated OS Command Injection. |
CVE-2023-39578 | Medium | 4.8 | 2023-08-28 | A stored cross-site scripting (XSS) vulnerability in the Create function of Zenario CMS v9.4 allows attackers to execute arbitrary web scripts or HTML via a cr… |
CVE-2023-39348 | Medium | 4.0 | 2023-08-28 | Spinnaker is an open source, multi-cloud continuous delivery platform. Log output when updating GitHub status is improperly set to FULL always. It's recommend… |
CVE-2023-35785 | High | 8.1 | 2023-08-28 | Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManager Plus 7200 and below, Asset Explorer 6993 and below and 7… |
CVE-2023-39810 | High | 7.8 | 2023-08-28 | An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal. |
CVE-2023-39709 | Medium | 6.1 | 2023-08-28 | Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts… |
CVE-2023-39562 | Medium | 5.5 | 2023-08-28 | GPAC v2.3-DEV-rev449-g5948e4f70-master was discovered to contain a heap-use-after-free via the gf_bs_align function at bitstream.c. This vulnerability allows a… |
CVE-2023-40590 | High | 7.8 | 2023-08-28 | GitPython is a python library used to interact with Git repositories. When resolving a program, Python/Windows look for the current working directory, and aft… |
CVE-2023-39062 | Medium | 6.1 | 2023-08-28 | Cross Site Scripting vulnerability in Spipu HTML2PDF before v.5.2.8 allows a remote attacker to execute arbitrary code via a crafted script to the forms.php. |
CVE-2023-39560 | Critical | 9.8 | 2023-08-28 | ECTouch v2 was discovered to contain a SQL injection vulnerability via the $arr['id'] parameter at \default\helpers\insert.php. |
CVE-2023-1997 | High | 8.8 | 2023-08-28 | An OS Command Injection vulnerability exists in SIMULIA 3DOrchestrate from Release 3DEXPERIENCE R2021x through Release 3DEXPERIENCE R2023x. A specially crafted… |
CVE-2023-40846 | Critical | 9.8 | 2023-08-28 | Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via function sub_90998. |
CVE-2023-39708 | Medium | 6.1 | 2023-08-28 | A stored cross-site scripting (XSS) vulnerability in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or… |
CVE-2023-40767 | Critical | 9.8 | 2023-08-28 | User enumeration is found in in PHPJabbers Make an Offer Widget v1.0. This issue occurs during password recovery, where a difference in messages could allow an… |
CVE-2023-40766 | Critical | 9.8 | 2023-08-28 | User enumeration is found in in PHPJabbers Ticket Support Script v3.2. This issue occurs during password recovery, where a difference in messages could allow a… |
CVE-2023-40765 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHPJabbers Event Booking Calendar v4.0. This issue occurs during password recovery, where a difference in messages could allow an… |
CVE-2023-40764 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHP Jabbers Car Rental Script v3.0. This issue occurs during password recovery, where a difference in messages could allow an atta… |
CVE-2023-40763 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHPJabbers Taxi Booking Script v2.0. This issue occurs during password recovery, where a difference in messages could allow an att… |
CVE-2023-40762 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHPJabbers Fundraising Script v1.0. This issue occurs during password recovery, where a difference in messages could allow an atta… |
CVE-2023-40761 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHPJabbers Yacht Listing Script v2.0. This issue occurs during password recovery, where a difference in messages could allow an at… |
CVE-2023-40760 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHP Jabbers Hotel Booking System v4.0. This issue occurs during password recovery, where a difference in messages could allow an a… |
CVE-2023-40759 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHP Jabbers Restaurant Booking Script v3.0. This issue occurs during password recovery, where a difference in messages could allow… |
CVE-2023-40758 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHPJabbers Document Creator v1.0. This issue occurs during password recovery, where a difference in messages could allow an attack… |
CVE-2023-40757 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHPJabbers Food Delivery Script v3.1. This issue occurs during password recovery, where a difference in messages could allow an at… |
CVE-2023-40756 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHPJabbers Callback Widget v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacke… |
CVE-2023-40755 | Medium | 6.1 | 2023-08-28 | There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Callback Widget v1.0. |
CVE-2023-40754 | High | 8.8 | 2023-08-28 | In PHPJabbers Car Rental Script 3.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take… |