2023 CVEs (page 171)
Page 171 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-40753 | Medium | 5.4 | 2023-08-28 | There is a Cross Site Scripting (XSS) vulnerability in the message parameter of index.php in PHPJabbers Ticket Support Script v3.2. |
CVE-2023-40752 | Medium | 6.1 | 2023-08-28 | There is a Cross Site Scripting (XSS) vulnerability in the "action" parameter of index.php in PHPJabbers Make an Offer Widget v1.0. |
CVE-2023-40751 | Medium | 6.1 | 2023-08-28 | PHPJabbers Fundraising Script v1.0 is vulnerable to Cross Site Scripting (XSS) via the "action" parameter of index.php. |
CVE-2023-40750 | Medium | 6.1 | 2023-08-28 | There is a Cross Site Scripting (XSS) vulnerability in the "action" parameter of index.php in PHPJabbers Yacht Listing Script v1.0. |
CVE-2023-40749 | Critical | 9.8 | 2023-08-28 | PHPJabbers Food Delivery Script v3.0 is vulnerable to SQL Injection in the "column" parameter of index.php. |
CVE-2023-40748 | Critical | 9.8 | 2023-08-28 | PHPJabbers Food Delivery Script 3.0 has a SQL injection (SQLi) vulnerability in the "q" parameter of index.php. |
CVE-2023-36481 | High | 7.5 | 2023-08-28 | An issue was discovered in Samsung Exynos Mobile Processor and Wearable Processor 9810, 9610, 9820, 980, 850, 1080, 2100, 2200, 1280, 1380, 1330, 9110, and W92… |
CVE-2023-34758 | High | 8.1 | 2023-08-28 | Sliver from v1.5.x to v1.5.39 has an improper cryptographic implementation, which allows attackers to execute a man-in-the-middle attack via intercepted and cr… |
CVE-2023-26095 | High | 7.5 | 2023-08-28 | ASQ in Stormshield Network Security (SNS) 4.3.15 before 4.3.16 and 4.6.x before 4.6.3 allows a crash when analysing a crafted SIP packet. |
CVE-2023-40195 | High | 8.8 | 2023-08-28 | Deserialization of Untrusted Data, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Software Foundation Apache Airflow Spark Pr… |
CVE-2023-27604 | High | 8.8 | 2023-08-28 | Apache Airflow Sqoop Provider, versions before 4.0.0, is affected by a vulnerability that allows an attacker pass parameters with the connections, which makes… |
CVE-2023-38030 | High | 7.5 | 2023-08-28 | Saho’s attendance devices ADM100 and ADM-100FP have a vulnerability of missing authentication for critical functions. An unauthenticated remote attacker can e… |
CVE-2023-38029 | Critical | 9.8 | 2023-08-28 | Saho’s attendance devices ADM100 and ADM-100FP has insufficient filtering for special characters and file type within their file uploading function. A unauthe… |
CVE-2023-38028 | Critical | 9.1 | 2023-08-28 | Saho’s attendance devices ADM100 and ADM-100FP have insufficient authentication. An unauthenticated remote attacker can exploit this vulnerability to bypass a… |
CVE-2023-38027 | Critical | 9.8 | 2023-08-28 | SpotCam Co., Ltd. SpotCam Sense’s hidden Telnet function has a vulnerability of OS command injection. An remote unauthenticated attacker can exploit this vulne… |
CVE-2023-38026 | Critical | 9.8 | 2023-08-28 | SpotCam Co., Ltd. SpotCam FHD 2 has a vulnerability of using hard-coded uBoot credentials. An remote attacker can exploit this vulnerability to access the sys… |
CVE-2023-38025 | Critical | 9.8 | 2023-08-28 | SpotCam Co., Ltd. SpotCam FHD 2’s hidden Telnet function has a vulnerability of OS command injection. An remote unauthenticated attacker can exploit this vuln… |
CVE-2023-38024 | Critical | 9.8 | 2023-08-28 | SpotCam Co., Ltd. SpotCam FHD 2’s hidden Telnet function has a vulnerability of using hard-coded Telnet credentials. An remote unauthenticated attacker can ex… |
CVE-2023-4561 | Medium | 4.8 | 2023-08-28 | Cross-site Scripting (XSS) - Stored in GitHub repository omeka/omeka-s prior to 4.0.4. |
CVE-2023-4560 | Medium | 6.5 | 2023-08-28 | Improper Authorization of Index Containing Sensitive Information in GitHub repository omeka/omeka-s prior to 4.0.4. |
CVE-2023-26272 | Medium | 5.3 | 2023-08-28 | IBM Security Guardium Data Encryption (IBM Guardium Cloud Key Manager (GCKM) 1.10.3)) could allow a remote attacker to obtain sensitive information when a deta… |
CVE-2023-26271 | Medium | 5.3 | 2023-08-28 | IBM Security Guardium Data Encryption (IBM Guardium Cloud Key Manager (GCKM) 1.10.3)) uses an inadequate account lockout setting that could allow a remote atta… |
CVE-2023-26270 | Medium | 6.5 | 2023-08-28 | IBM Security Guardium Data Encryption (IBM Guardium Cloud Key Manager (GCKM) 1.10.3)) could allow a remote attacker to execute arbitrary code on the system, ca… |
CVE-2023-24959 | Medium | 5.3 | 2023-08-28 | IBM InfoSphere Information Systems 11.7 could expose information about the host system and environment configuration. IBM X-Force ID: 246332. |
CVE-2023-23473 | Medium | 5.3 | 2023-08-28 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions… |
CVE-2023-22877 | High | 7.0 | 2023-08-28 | IBM InfoSphere Information Server 11.7 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by… |
CVE-2023-4559 | Medium | 6.3 | 2023-08-27 | A vulnerability, which was classified as critical, has been found in Bettershop LaikeTui. Affected by this issue is some unknown functionality of the file inde… |
CVE-2023-4558 | Medium | 6.3 | 2023-08-27 | A vulnerability classified as critical was found in SourceCodester Inventory Management System 1.0. Affected by this vulnerability is an unknown functionality… |
CVE-2023-4557 | Medium | 6.3 | 2023-08-27 | A vulnerability classified as critical has been found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file app/ajax/s… |
CVE-2023-38730 | Medium | 5.9 | 2023-08-27 | IBM Storage Copy Data Management 2.2.0.0 through 2.2.19.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sen… |
CVE-2023-33852 | High | 7.6 | 2023-08-27 | IBM Security Guardium 11.4 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to vie… |
CVE-2023-30437 | Medium | 5.3 | 2023-08-27 | IBM Security Guardium 11.3, 11.4, and 11.5 could allow an unauthorized user to enumerate usernames by sending a specially crafted HTTP request. IBM X-Force ID… |
CVE-2023-30436 | Medium | 5.5 | 2023-08-27 | IBM Security Guardium 11.3, 11.4, and 11.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2023-30435 | High | 8.9 | 2023-08-27 | IBM Security Guardium 11.3, 11.4, and 11.5 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2023-4556 | Medium | 6.3 | 2023-08-27 | A vulnerability was found in SourceCodester Online Graduate Tracer System 1.0 and classified as critical. Affected by this issue is the function mysqli_query o… |
CVE-2023-4555 | Low | 3.5 | 2023-08-27 | A vulnerability has been found in SourceCodester Inventory Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown fu… |
CVE-2023-4548 | Medium | 6.3 | 2023-08-26 | A vulnerability classified as critical has been found in SPA-Cart eCommerce CMS 1.9.0.3. This affects an unknown part of the file /search of the component GET… |
CVE-2023-4547 | Low | 3.5 | 2023-08-26 | A vulnerability was found in SPA-Cart eCommerce CMS 1.9.0.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file… |
CVE-2023-4546 | Low | 3.5 | 2023-08-26 | A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230816. It has been declared as problematic. Affected by this vulnerability is an un… |
CVE-2023-4545 | Medium | 6.3 | 2023-08-26 | A vulnerability was found in IBOS OA 4.5.5. It has been classified as critical. Affected is an unknown function of the file ?r=recruit/bgchecks/export&checkids… |
CVE-2023-4544 | Medium | 4.3 | 2023-08-26 | A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230809. It has been rated as problematic. This issue affects some unknown processing… |
CVE-2023-36741 | High | 8.3 | 2023-08-26 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2023-4543 | Medium | 6.3 | 2023-08-25 | A vulnerability was found in IBOS OA 4.5.5. It has been declared as critical. This vulnerability affects unknown code of the file ?r=recruit/contact/export&con… |
CVE-2023-4542 | Medium | 6.3 | 2023-08-25 | A vulnerability was found in D-Link DAR-8000-10 up to 20230809. It has been classified as critical. This affects an unknown part of the file /app/sys1.php. The… |
CVE-2023-41121 | High | 7.5 | 2023-08-25 | Array AG OS before 9.4.0.499 allows denial of service: remote attackers can cause system service processes to crash through abnormal HTTP operations. |
CVE-2023-39291 | Medium | 4.9 | 2023-08-25 | A vulnerability in the Connect Mobility Router component of MiVoice Connect through 9.6.2304.102 could allow an authenticated attacker with elevated privileges… |
CVE-2023-39290 | Medium | 4.9 | 2023-08-25 | A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through R19.3 SP3 (22.24.5800.0) could allow an authenticated attacker with elevated pri… |
CVE-2023-39289 | High | 7.5 | 2023-08-25 | A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2208.101 could allow an unauthenticated attacker to conduct an ac… |
CVE-2023-39288 | Medium | 5.5 | 2023-08-25 | A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2304.102 could allow an authenticated attacker with elevated priv… |
CVE-2023-39287 | Medium | 5.5 | 2023-08-25 | A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 SP3 (22.24.5800.0) could allow an authenticated attacker with elevated priv… |
CVE-2023-34723 | High | 7.5 | 2023-08-25 | An issue was discovered in TechView LA-5570 Wireless Gateway 1.0.19_T53, allows attackers to gain sensitive information via /config/system.conf. |
CVE-2023-41080 | Medium | 6.1 | 2023-08-25 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1… |
CVE-2023-40587 | Medium | 4.3 | 2023-08-25 | Pyramid is an open source Python web framework. A path traversal vulnerability in Pyramid versions 2.0.0 and 2.0.1 impacts users of Python 3.11 that are using… |
CVE-2023-40586 | High | 7.5 | 2023-08-25 | OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Due to the misuse of `log.Fatalf`, the application using coraza crashed a… |
CVE-2023-40585 | High | 7.3 | 2023-08-25 | ironic-image is a container image to run OpenStack Ironic as part of Metal³. Prior to version capm3-v1.4.3, if Ironic is not deployed with TLS and it does not… |
CVE-2023-40583 | High | 7.5 | 2023-08-25 | libp2p is a networking stack and library modularized out of The IPFS Project, and bundled separately for other tools to use. In go-libp2p, by using signed peer… |
CVE-2023-40571 | Critical | 9.8 | 2023-08-25 | weblogic-framework is a tool for detecting weblogic vulnerabilities. Versions 0.2.3 and prior do not verify the returned data packets, and there is a deseriali… |
CVE-2023-40166 | Medium | 5.5 | 2023-08-25 | Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to heap buffer read overflow in `FileManager::detectLanguageFro… |
CVE-2023-40164 | Medium | 5.5 | 2023-08-25 | Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to global buffer read overflow in `nsCodingStateMachine::NextSt… |
CVE-2023-38712 | Medium | 6.5 | 2023-08-25 | An issue was discovered in Libreswan 3.x and 4.x before 4.12. When an IKEv1 ISAKMP SA Informational Exchange packet contains a Delete/Notify payload followed b… |
CVE-2023-38711 | Medium | 6.5 | 2023-08-25 | An issue was discovered in Libreswan before 4.12. When an IKEv1 Quick Mode connection configured with ID_IPV4_ADDR or ID_IPV6_ADDR receives an IDcr payload wit… |
CVE-2023-38710 | Medium | 6.5 | 2023-08-25 | An issue was discovered in Libreswan before 4.12. When an IKEv2 Child SA REKEY packet contains an invalid IPsec protocol ID number of 0 or 1, an error notify I… |
CVE-2023-32678 | Medium | 6.5 | 2023-08-25 | Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat. Users who used to be subscribed to a private stream an… |
CVE-2023-2906 | Medium | 6.5 | 2023-08-25 | Due to a failure in validating the length provided by an attacker-crafted CP2179 packet, Wireshark versions 2.0.0 through 4.0.7 is susceptible to a divide by z… |
CVE-2023-40580 | High | 8.1 | 2023-08-25 | Freighter is a Stellar chrome extension. It may be possible for a malicious website to access the recovery mnemonic phrase when the Freighter wallet is unlocke… |
CVE-2023-40579 | Medium | 6.5 | 2023-08-25 | OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. Some end users of OpenFGA v1.3.0 or earlier are vulnerable… |
CVE-2023-40036 | Medium | 5.5 | 2023-08-25 | Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to global buffer read overflow in `CharDistributionAnalysis::Ha… |
CVE-2023-40031 | High | 7.8 | 2023-08-25 | Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to heap buffer write overflow in `Utf8_16_Read::convert`. This… |
CVE-2023-39707 | Medium | 5.4 | 2023-08-25 | A stored cross-site scripting (XSS) vulnerability in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or… |
CVE-2023-39600 | Medium | 6.1 | 2023-08-25 | IceWarp 11.4.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the color parameter. |
CVE-2023-37249 | High | 8.8 | 2023-08-25 | Infoblox NIOS through 8.5.1 has a faulty component that accepts malicious input without sanitization, resulting in shell access. |
CVE-2023-36199 | High | 7.5 | 2023-08-25 | An issue in skalenetwork sgxwallet v.1.9.0 and below allows an attacker to cause a denial of service via the trustedGenerateEcdsaKey component. |
CVE-2023-36198 | High | 7.5 | 2023-08-25 | Buffer Overflow vulnerability in skalenetwork sgxwallet v.1.9.0 allows an attacker to cause a denial of service via the trustedBlsSignMessage function. |
CVE-2023-24621 | High | 7.8 | 2023-08-25 | An issue was discovered in Esoteric YamlBeans through 1.15. It allows untrusted deserialisation to Java classes by default, where the data and class are contro… |
CVE-2023-24620 | Medium | 5.5 | 2023-08-25 | An issue was discovered in Esoteric YamlBeans through 1.15. A crafted YAML document is able perform am XML Entity Expansion attack against YamlBeans YamlReader… |
CVE-2023-25848 | Medium | 5.3 | 2023-08-25 | ArcGIS Enterprise Server versions 11.0 and below have an information disclosure vulnerability where a remote, unauthorized attacker may submit a crafted query… |
CVE-2023-38201 | Medium | 6.5 | 2023-08-25 | A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attac… |
CVE-2023-40798 | High | 8.8 | 2023-08-25 | In Tenda AC23 v16.03.07.45_cn, the formSetIPv6status and formGetWanParameter functions do not authenticate user input parameters, resulting in a post-authentic… |
CVE-2023-40797 | High | 8.8 | 2023-08-25 | In Tenda AC23 v16.03.07.45_cn, the sub_4781A4 function does not validate the parameters entered by the user, resulting in a post-authentication stack overflow… |
CVE-2023-40796 | High | 7.8 | 2023-08-25 | Phicomm k2 v22.6.529.216 was discovered to contain a command injection vulnerability via the function luci.sys.call. |
CVE-2023-4534 | Low | 3.5 | 2023-08-25 | A vulnerability, which was classified as problematic, was found in NeoMind Fusion Platform up to 20230731. Affected is an unknown function of the file /fusion/… |
CVE-2023-40915 | High | 7.5 | 2023-08-25 | Tenda AX3 v16.03.12.11 has a stack buffer overflow vulnerability detected at function form_fast_setting_wifi_set. This vulnerability allows attackers to cause… |
CVE-2023-40802 | Medium | 6.5 | 2023-08-25 | The get_parentControl_list_Info function does not verify the parameters entered by the user, causing a post-authentication heap overflow vulnerability in Tenda… |
CVE-2023-40801 | High | 8.8 | 2023-08-25 | The sub_451784 function does not validate the parameters entered by the user, resulting in a stack overflow vulnerability in Tenda AC23 v16.03.07.45_cn |
CVE-2023-40800 | High | 8.8 | 2023-08-25 | The compare_parentcontrol_time function does not authenticate user input parameters, resulting in a post-authentication stack overflow vulnerability in Tenda A… |
CVE-2023-40799 | Critical | 9.8 | 2023-08-25 | Tenda AC23 Vv16.03.07.45_cn is vulnerable to Buffer Overflow via sub_450A4C function. |
CVE-2023-41167 | Medium | 4.8 | 2023-08-25 | @webiny/react-rich-text-renderer before 5.37.2 allows XSS attacks by content managers. This is a react component to render data coming from Webiny Headless CMS… |
CVE-2023-39742 | Medium | 5.5 | 2023-08-25 | giflib v5.2.1 was discovered to contain a segmentation fault via the component getarg.c. |
CVE-2023-41250 | Low | 3.5 | 2023-08-25 | In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during user registration |
CVE-2023-41249 | Medium | 4.6 | 2023-08-25 | In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during copying Build Step |
CVE-2023-41248 | Medium | 4.6 | 2023-08-25 | In JetBrains TeamCity before 2023.05.3 stored XSS was possible during Cloud Profiles configuration |
CVE-2023-32797 | High | 7.1 | 2023-08-25 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution video carousel slider with lightbox plugin <= 1.0.22 versions. |
CVE-2023-32603 | High | 7.1 | 2023-08-25 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in RedNao Donations Made Easy – Smart Donations plugin <= 4.0.12 versions. |
CVE-2023-32598 | High | 7.1 | 2023-08-25 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in A. R. Jones Featured Image Pro Post Grid plugin <= 5.14 versions. |
CVE-2023-32596 | Medium | 5.9 | 2023-08-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Wolfgang Ertl weebotLite plugin <= 1.0.0 versions. |
CVE-2023-32595 | Medium | 5.9 | 2023-08-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Palasthotel by Edward Bock, Katharina Rompf Sunny Search plugin <= 1.0.2 versions. |
CVE-2023-32575 | Medium | 5.9 | 2023-08-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PI Websolution Product page shipping calculator for WooCommerce plugin <= 1.3.25 versions. |
CVE-2023-24394 | Medium | 5.9 | 2023-08-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy iframe popup plugin <= 3.3 versions. |
CVE-2023-4478 | Medium | 4.3 | 2023-08-25 | Mattermost fails to restrict which parameters' values it takes from the request during signup allowing an attacker to register users as inactive, thus blocking… |
CVE-2023-25981 | Medium | 6.5 | 2023-08-25 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ThemeKraft Post Form plugin <= 2.8.1 versions. |