2023 CVEs (page 172)
Page 172 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-25649 | Medium | 6.8 | 2023-08-25 | There is a command injection vulnerability in a mobile internet product of ZTE. Due to insufficient validation of SET_DEVICE_LED interface parameter, an authe… |
CVE-2023-3425 | Medium | 6.5 | 2023-08-25 | Out-of-bounds read issue in M-Files Server versions below 23.8.12892.6 and LTS Service Release Versions before 23.2 LTS SR3 allows unauthenticated user to read… |
CVE-2023-3406 | High | 7.7 | 2023-08-25 | Path Traversal issue in M-Files Classic Web versions below 23.6.12695.3 and LTS Service Release Versions before 23.2 LTS SR3 allows authenticated user to read… |
CVE-2023-32591 | Medium | 5.9 | 2023-08-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Cloud Primero B.V DBargain plugin <= 3.0.0 versions. |
CVE-2023-32584 | Medium | 5.9 | 2023-08-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in John Newcombe eBecas plugin <= 3.1.3 versions. |
CVE-2023-32577 | Medium | 5.9 | 2023-08-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Eji Osigwe DevBuddy Twitter Feed plugin <= 4.0.0 versions. |
CVE-2023-32576 | Medium | 6.5 | 2023-08-25 | Auth. (subscriber+) Stored Cross-Site Scripting') vulnerability in Plainware Locatoraid Store Locator plugin <= 3.9.18 versions. |
CVE-2023-32518 | High | 7.1 | 2023-08-25 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ono Oogami WP Chinese Conversion plugin <= 1.1.16 versions. |
CVE-2023-32757 | Critical | 9.8 | 2023-08-25 | e-Excellence U-Office Force file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker without logging t… |
CVE-2023-32756 | High | 7.5 | 2023-08-25 | e-Excellence U-Office Force has a path traversal vulnerability within its file uploading and downloading functions. An unauthenticated remote attacker can exp… |
CVE-2023-41173 | High | 7.5 | 2023-08-25 | AdGuard DNS before 2.2 allows remote attackers to cause a denial of service via malformed UDP packets. |
CVE-2023-32755 | Medium | 5.3 | 2023-08-25 | e-Excellence U-Office Force generates an error message in webiste service. An unauthenticated remote attacker can obtain partial sensitive system information… |
CVE-2023-40530 | Medium | 4.7 | 2023-08-25 | Improper authorization in handler for custom URL scheme issue in 'Skylark' App for Android 6.2.13 and earlier and 'Skylark' App for iOS 6.2.13 and earlier all… |
CVE-2023-4520 | Medium | 5.4 | 2023-08-25 | The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_fv_player_user_video’ parameter saved via the 'save'… |
CVE-2023-40599 | High | 7.5 | 2023-08-25 | Regular expression Denial-of-Service (ReDoS) exists in multiple add-ons for Mailform Pro CGI 4.3.1.3 and earlier, which allows a remote unauthenticated attacke… |
CVE-2023-40577 | High | 7.5 | 2023-08-25 | Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/… |
CVE-2023-40570 | Medium | 5.3 | 2023-08-25 | Datasette is an open source multi-tool for exploring and publishing data. This bug affects Datasette instances running a Datasette 1.0 alpha - 1.0a0, 1.0a1, 1… |
CVE-2023-40217 | Medium | 5.3 | 2023-08-25 | An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HT… |
CVE-2023-40182 | Low | 3.7 | 2023-08-25 | Silverware Games is a premium social network where people can play games online. When using the Recovery form, a noticeably different amount of time passes dep… |
CVE-2023-40179 | Medium | 5.3 | 2023-08-25 | Silverware Games is a premium social network where people can play games online. Prior to version 1.3.6, the Password Recovery form would throw an error if the… |
CVE-2023-38974 | Medium | 5.4 | 2023-08-25 | A stored cross-site scripting (XSS) vulnerability in the Edit Category function of Badaso v2.9.7 allows attackers to execute arbitrary web scripts or HTML via… |
CVE-2023-38973 | Medium | 5.4 | 2023-08-25 | A stored cross-site scripting (XSS) vulnerability in the Add Tag function of Badaso v2.9.7 allows attackers to execute arbitrary web scripts or HTML via a craf… |
CVE-2023-39700 | Medium | 6.1 | 2023-08-25 | IceWarp Mail Server v10.4.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the color parameter. |
CVE-2023-39699 | Critical | 9.8 | 2023-08-25 | IceWarp Mail Server v10.4.5 was discovered to contain a local file inclusion (LFI) vulnerability via the component /calendar/minimizer/index.php. This vulnerab… |
CVE-2023-4508 | Medium | 5.5 | 2023-08-24 | A user able to control file input to Gerbv, between versions 2.4.0 and 2.10.0, can cause a crash and cause denial-of-service with a specially crafted Gerber RS… |
CVE-2023-40030 | Medium | 6.1 | 2023-08-24 | Cargo downloads a Rust project’s dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names whe… |
CVE-2023-40022 | High | 7.8 | 2023-08-24 | Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.6.0 and prior are vulnerable to integer overflow in `consume_count` of… |
CVE-2023-40017 | High | 7.5 | 2023-08-24 | GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. In versions 3.2.0 through 4.1.2, the endpo… |
CVE-2023-39521 | Medium | 4.8 | 2023-08-24 | Tuleap is an open source suite to improve management of software developments and collaboration. In Tuleap Community Edition prior to version 14.11.99.28 and T… |
CVE-2023-39519 | High | 7.5 | 2023-08-24 | Cloud Explorer Lite is an open source cloud management platform. Prior to version 1.4.0, there is a risk of sensitive information leakage in the user informati… |
CVE-2023-38508 | Medium | 6.5 | 2023-08-24 | Tuleap is an open source suite to improve management of software developments and collaboration. In Tuleap Community Edition prior to version 14.11.99.28 and T… |
CVE-2023-37469 | High | 8.8 | 2023-08-24 | CasaOS is an open-source personal cloud system. Prior to version 0.4.4, if an authenticated user using CasaOS is able to successfully connect to a controlled S… |
CVE-2023-32079 | High | 8.8 | 2023-08-24 | Netmaker makes networks with WireGuard. A Mass assignment vulnerability was found in versions prior to 0.17.1 and 0.18.6 that allows a non-admin user to escala… |
CVE-2023-32078 | High | 7.5 | 2023-08-24 | Netmaker makes networks with WireGuard. An Insecure Direct Object Reference (IDOR) vulnerability was found in versions prior to 0.17.1 and 0.18.6 in the user u… |
CVE-2023-32077 | High | 7.5 | 2023-08-24 | Netmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing unauth users to intera… |
CVE-2023-39801 | Medium | 4.6 | 2023-08-24 | A lack of exception handling in the Renault Easy Link Multimedia System Software Version 283C35519R allows attackers to cause a Denial of Service (DoS) via sup… |
CVE-2023-4420 | Critical | 9.8 | 2023-08-24 | A remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to the absence of Transport Layer Security (TLS) in the SICK LMS… |
CVE-2023-4419 | Critical | 9.8 | 2023-08-24 | The LMS5xx uses hard-coded credentials, which potentially allow low-skilled unauthorized remote attackers to reconfigure settings and /or disrupt the functiona… |
CVE-2023-4418 | High | 7.5 | 2023-08-24 | A remote unprivileged attacker can sent multiple packages to the LMS5xx to disrupt its availability through a TCP SYN-based denial-of-service (DDoS) attack. B… |
CVE-2023-31412 | High | 7.5 | 2023-08-24 | The LMS5xx uses weak hash generation methods, resulting in the creation of insecure hashs. If an attacker manages to retrieve the hash, it could lead to collis… |
CVE-2023-40904 | Critical | 9.8 | 2023-08-24 | Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter macFilterType and parameter deviceList at /goform/setMacFi… |
CVE-2023-40902 | Critical | 9.8 | 2023-08-24 | Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter list and bindnum at /goform/SetIpMacBind. |
CVE-2023-40901 | Critical | 9.8 | 2023-08-24 | Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter macFilterType and parameter deviceList at url /goform/setM… |
CVE-2023-40900 | Critical | 9.8 | 2023-08-24 | Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter list at /goform/SetNetControlList. |
CVE-2023-40899 | Critical | 9.8 | 2023-08-24 | Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter macFilterType and parameter deviceList at /goform/setMacFilt… |
CVE-2023-40898 | Critical | 9.8 | 2023-08-24 | Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter timeZone at /goform/SetSysTimeCfg. |
CVE-2023-40897 | Critical | 9.8 | 2023-08-24 | Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter mac at /goform/GetParentControlInfo. |
CVE-2023-40896 | Critical | 9.8 | 2023-08-24 | Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter list and bindnum at /goform/SetIpMacBind. |
CVE-2023-40895 | Critical | 9.8 | 2023-08-24 | Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter list at /goform/SetVirtualServerCfg. |
CVE-2023-40894 | Critical | 9.8 | 2023-08-24 | Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter list at /goform/SetStaticRouteCfg. |
CVE-2023-40893 | Critical | 9.8 | 2023-08-24 | Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter time at /goform/PowerSaveSet. |
CVE-2023-40892 | Critical | 9.8 | 2023-08-24 | Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter schedStartTime and schedEndTime at /goform/openSchedWifi. |
CVE-2023-40891 | Critical | 9.8 | 2023-08-24 | Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter firewallEn at /goform/SetFirewallCfg. |
CVE-2023-39834 | Critical | 9.8 | 2023-08-24 | PbootCMS below v3.2.0 was discovered to contain a command injection vulnerability via create_function. |
CVE-2023-40710 | Medium | 6.8 | 2023-08-24 | An adversary could cause a continuous restart loop to the entire device by sending a large quantity of HTTP GET requests if the controller has the built-in web… |
CVE-2023-40709 | Medium | 6.8 | 2023-08-24 | An adversary could crash the entire device by sending a large quantity of ICMP requests if the controller has the built-in web server enabled but does not have… |
CVE-2023-40708 | Medium | 5.8 | 2023-08-24 | The File Transfer Protocol (FTP) port is open by default in the SNAP PAC S1 Firmware version R10.3b. This could allow an adversary to access some device files. |
CVE-2023-40707 | High | 8.6 | 2023-08-24 | There are no requirements for setting a complex password in the built-in web server of the SNAP PAC S1 Firmware version R10.3b, which could allow for a success… |
CVE-2023-40706 | High | 8.6 | 2023-08-24 | There is no limit on the number of login attempts in the web server for the SNAP PAC S1 Firmware version R10.3b. This could allow for a brute-force attack on t… |
CVE-2023-34973 | Low | 3.1 | 2023-08-24 | An insufficient entropy vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote users to predi… |
CVE-2023-34972 | Low | 3.5 | 2023-08-24 | A cleartext transmission of sensitive information vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly al… |
CVE-2023-34971 | High | 7.1 | 2023-08-24 | An inadequate encryption strength vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows local netwo… |
CVE-2023-40877 | Medium | 5.4 | 2023-08-24 | DedeCMS up to and including 5.7.110 was discovered to contain a cross-site scripting (XSS) vulnerability at /dede/freelist_edit.php via the title parameter. |
CVE-2023-40876 | Medium | 5.4 | 2023-08-24 | DedeCMS up to and including 5.7.110 was discovered to contain a cross-site scripting (XSS) vulnerability at /dede/freelist_add.php via the title parameter. |
CVE-2023-40875 | Medium | 5.4 | 2023-08-24 | DedeCMS up to and including 5.7.110 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities at /dede/vote_edit.php via the votename and v… |
CVE-2023-40874 | Medium | 5.4 | 2023-08-24 | DedeCMS up to and including 5.7.110 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities at /dede/vote_add.php via the votename and vo… |
CVE-2023-40371 | Medium | 6.2 | 2023-08-24 | IBM AIX 7.2, 7.3, VIOS 3.1's OpenSSH implementation could allow a non-privileged local user to access files outside of those allowed due to improper access con… |
CVE-2023-34040 | Medium | 5.3 | 2023-08-24 | In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configurati… |
CVE-2023-32516 | High | 7.1 | 2023-08-24 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in GloriaFood Restaurant Menu – Food Ordering System – Table Reservation plugin <= 2.3.6 versions. |
CVE-2023-32511 | High | 7.1 | 2023-08-24 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Booking Ultra Pro Booking Ultra Pro Appointments Booking Calendar Plugin plugin <= 1.1.8 versions. |
CVE-2023-32510 | High | 7.1 | 2023-08-24 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Rolf van Gelder Order Your Posts Manually plugin <= 2.2.5 versions. |
CVE-2023-3705 | High | 7.5 | 2023-08-24 | The vulnerability exists in CP-Plus NVR due to an improper input handling at the web-based management interface of the affected product. An unauthenticated rem… |
CVE-2023-4513 | Medium | 5.3 | 2023-08-24 | BT SDP dissector memory leak in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file |
CVE-2023-4512 | Medium | 5.3 | 2023-08-24 | CBOR dissector crash in Wireshark 4.0.0 to 4.0.6 allows denial of service via packet injection or crafted capture file |
CVE-2023-4511 | Medium | 5.3 | 2023-08-24 | BT SDP dissector infinite loop in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file |
CVE-2023-4230 | Medium | 5.3 | 2023-08-24 | A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, which has the potential to facilitate the collecti… |
CVE-2023-4229 | Medium | 4.3 | 2023-08-24 | A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, potentially exposing users to security risks. This… |
CVE-2023-4228 | Low | 3.1 | 2023-08-24 | A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, where the session cookies attribute is not set pro… |
CVE-2023-3704 | Medium | 5.3 | 2023-08-24 | The vulnerability exists in CP-Plus DVR due to an improper input validation within the web-based management interface of the affected products. An unauthentica… |
CVE-2023-4227 | Medium | 5.3 | 2023-08-24 | A vulnerability has been identified in the ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, which can be exploited by malicious actors to… |
CVE-2023-40573 | Critical | 9.0 | 2023-08-24 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki supports scheduled jobs that contain Groovy scri… |
CVE-2023-40572 | Critical | 9.0 | 2023-08-24 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The create action is vulnerable to a CSRF attack, allo… |
CVE-2023-32559 | High | 7.5 | 2023-08-24 | A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated A… |
CVE-2023-41028 | Critical | 9.0 | 2023-08-23 | A stack-based buffer overflow exists in Juplink RX4-1500, a WiFi router, in versions 1.0.2 through 1.0.5. An authenticated attacker can exploit this vulnerabil… |
CVE-2023-3453 | High | 7.1 | 2023-08-23 | ETIC Telecom RAS versions 4.7.0 and prior the web management portal authentication disabled by default. This could allow an attacker with adjacent network acc… |
CVE-2023-38422 | High | 7.5 | 2023-08-23 | Walchem Intuition 9 firmware versions prior to v4.21 are missing authentication for some of the API routes of the management web server. This could allow an at… |
CVE-2023-36317 | Medium | 4.8 | 2023-08-23 | Cross Site Scripting (XSS) vulnerability in sourcecodester Student Study Center Desk Management System 1.0 allows attackers to run arbitrary code via crafted G… |
CVE-2023-32202 | Medium | 6.5 | 2023-08-23 | Walchem Intuition 9 firmware versions prior to v4.21 are vulnerable to improper authentication. Login credentials are stored in a format that could allow an at… |
CVE-2023-40185 | Medium | 6.5 | 2023-08-23 | shescape is simple shell escape library for JavaScript. This may impact users that use Shescape on Windows in a threaded context. The vulnerability can result… |
CVE-2023-40178 | Medium | 5.3 | 2023-08-23 | Node-SAML is a SAML library not dependent on any frameworks that runs in Node. The lack of checking of current timestamp allows a LogoutRequest XML to be reuse… |
CVE-2023-40177 | Critical | 9.9 | 2023-08-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any registered user can use the content field of their… |
CVE-2023-40035 | High | 7.2 | 2023-08-23 | Craft is a CMS for creating custom digital experiences on the web and beyond. Bypassing the validatePath function can lead to potential remote code execution… |
CVE-2023-40176 | Critical | 9.0 | 2023-08-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any registered user can exploit a stored XSS through t… |
CVE-2023-40025 | Medium | 4.7 | 2023-08-23 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting from version 2.6.0 have a bug where open web termina… |
CVE-2023-40612 | Medium | 5.3 | 2023-08-23 | In OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2, the file editor which is accessible to any user with ROLE_FILESYSTEM_EDITOR privileges is vulnerabl… |
CVE-2023-20234 | Medium | 4.4 | 2023-08-23 | A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to create a file or overwrite any file on the filesystem of an a… |
CVE-2023-20230 | Medium | 5.4 | 2023-08-23 | A vulnerability in the restricted security domain implementation of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, rem… |
CVE-2023-20200 | High | 7.7 | 2023-08-23 | A vulnerability in the Simple Network Management Protocol (SNMP) service of Cisco FXOS Software for Firepower 4100 Series and Firepower 9300 Security Appliance… |
CVE-2023-20169 | High | 7.4 | 2023-08-23 | A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) protocol of Cisco NX-OS Software for the Cisco Nexus 3000 Series Switches and Cisco N… |
CVE-2023-20168 | High | 7.1 | 2023-08-23 | A vulnerability in TACACS+ and RADIUS remote authentication for Cisco NX-OS Software could allow an unauthenticated, local attacker to cause an affected device… |