2023 CVEs (page 173)
Page 173 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-20115 | Medium | 5.4 | 2023-08-23 | A vulnerability in the SFTP server implementation for Cisco Nexus 3000 Series Switches and 9000 Series Switches in standalone NX-OS mode could allow an authent… |
CVE-2023-38831 | High | 7.8 | 2023-08-23 | RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because… |
CVE-2023-40273 | High | 8.0 | 2023-08-23 | The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by… |
CVE-2023-39441 | Medium | 5.9 | 2023-08-23 | Apache Airflow SMTP Provider before 1.3.0, Apache Airflow IMAP Provider before 3.3.0, and Apache Airflow before 2.7.0 are affected by the Validation of OpenSSL… |
CVE-2023-37379 | High | 8.1 | 2023-08-23 | Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privile… |
CVE-2023-1409 | Medium | 5.3 | 2023-08-23 | If the MongoDB Server running on Windows or macOS is configured to use TLS with a specific set of configuration options that are already known to work securely… |
CVE-2023-32509 | High | 7.1 | 2023-08-23 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Rolf van Gelder Order Your Posts Manually plugin <= 2.2.5 versions. |
CVE-2023-32505 | Medium | 5.9 | 2023-08-23 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Arshid Easy Hide Login plugin <= 1.0.7 versions. |
CVE-2023-32300 | High | 7.1 | 2023-08-23 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Yoast Yoast SEO: Local plugin <= 14.8 versions. |
CVE-2023-28994 | High | 7.1 | 2023-08-23 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in UX-themes Flatsome plugin <= 3.16.8 versions. |
CVE-2023-32499 | High | 7.1 | 2023-08-23 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Tony Zeoli, Tony Hayes Radio Station by netmix® – Manage and play your Show Schedule in WordPress… |
CVE-2023-32498 | Medium | 5.9 | 2023-08-23 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Easy Form team Easy Form by AYS plugin <= 1.2.0 versions. |
CVE-2023-32497 | Medium | 5.1 | 2023-08-23 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Supersoju Block Referer Spam plugin <= 1.1.9.4 versions. |
CVE-2023-32496 | Medium | 5.9 | 2023-08-23 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Bill Minozzi Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection p… |
CVE-2023-32236 | High | 7.1 | 2023-08-23 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Booking Ultra Pro Booking Ultra Pro Appointments Booking Calendar Plugin <= 1.1.8 versions. |
CVE-2023-4042 | Medium | 5.5 | 2023-08-23 | A flaw was found in ghostscript. The fix for CVE-2020-16305 in ghostscript was not included in RHSA-2021:1852-06 advisory as it was claimed to be. This issue o… |
CVE-2023-32119 | Medium | 5.8 | 2023-08-23 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPO365 | Mail Integration for Office 365 / Outlook plugin <= 1.9.0 versions. |
CVE-2023-3899 | High | 7.8 | 2023-08-23 | A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1… |
CVE-2023-41105 | High | 7.5 | 2023-08-23 | An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated unexpectedly… |
CVE-2023-41104 | Medium | 6.5 | 2023-08-23 | libvmod-digest before 1.0.3, as used in Varnish Enterprise 6.0.x before 6.0.11r5, has an out-of-bounds memory access during base64 decoding, leading to both au… |
CVE-2023-41100 | Medium | 5.3 | 2023-08-23 | An issue was discovered in the hcaptcha (aka hCaptcha for EXT:form) extension before 2.1.2 for TYPO3. It fails to check that the required captcha field is subm… |
CVE-2023-41098 | Medium | 6.1 | 2023-08-23 | An issue was discovered in MISP 2.4.174. In app/Controller/DashboardsController.php, a reflected XSS issue exists via the id parameter upon a dashboard edit. |
CVE-2023-4041 | Critical | 9.8 | 2023-08-23 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Out-of-bounds Write, Download of Code Without Integrity Check vulnerability in Silicon… |
CVE-2023-40282 | Medium | 5.4 | 2023-08-23 | Improper authentication vulnerability in Rakuten WiFi Pocket all versions allows a network-adjacent attacker to log in to the product's Management Screen. As a… |
CVE-2023-40144 | High | 8.8 | 2023-08-23 | OS command injection vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its set… |
CVE-2023-40158 | High | 8.8 | 2023-08-23 | Hidden functionality vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its set… |
CVE-2023-38585 | High | 8.8 | 2023-08-23 | Improper authentication vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its… |
CVE-2023-4404 | Critical | 9.8 | 2023-08-23 | The Donation Forms by Charitable plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.7.0.12 due to insufficient rest… |
CVE-2023-3495 | High | 7.8 | 2023-08-23 | ** UNSUPPORTED WHEN ASSIGNED ** Out-of-bounds Write vulnerability in Hitachi EH-VIEW (KeypadDesigner) allows local attackers to potentially execute arbitray co… |
CVE-2023-39986 | High | 7.8 | 2023-08-23 | ** UNSUPPORTED WHEN ASSIGNED ** Out-of-bounds Read vulnerability in Hitachi EH-VIEW (Designer) allows local attackers to potentially disclose information on af… |
CVE-2023-39985 | High | 7.8 | 2023-08-23 | ** UNSUPPORTED WHEN ASSIGNED ** Out-of-bounds Write vulnerability in Hitachi EH-VIEW (Designer) allows local attackers to potentially execute arbitray code on… |
CVE-2023-39984 | High | 7.8 | 2023-08-23 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Hitachi EH-VIEW (KeypadDesigner) allow… |
CVE-2023-4431 | High | 8.1 | 2023-08-23 | Out of bounds memory access in Fonts in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to perform an out of bounds memory read via a crafted H… |
CVE-2023-4430 | High | 8.8 | 2023-08-23 | Use after free in Vulkan in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2023-4429 | High | 8.8 | 2023-08-23 | Use after free in Loader in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2023-4428 | High | 8.1 | 2023-08-23 | Out of bounds memory access in CSS in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to perform an out of bounds memory read via a crafted HTM… |
CVE-2023-4427 | High | 8.1 | 2023-08-23 | Out of bounds memory access in V8 in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML… |
CVE-2023-40370 | Low | 3.7 | 2023-08-22 | IBM Robotic Process Automation 21.0.0 through 21.0.7.1 runtime is vulnerable to information disclosure of script content if the remote REST request computer p… |
CVE-2023-39026 | High | 7.5 | 2023-08-22 | Directory Traversal vulnerability in FileMage Gateway Windows Deployments v.1.10.8 and before allows a remote attacker to obtain sensitive information via a cr… |
CVE-2023-38734 | Medium | 6.6 | 2023-08-22 | IBM Robotic Process Automation 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 is vulnerable to incorrect privilege assignment when importing users from an… |
CVE-2023-38733 | Medium | 4.3 | 2023-08-22 | IBM Robotic Process Automation 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 server could allow an authenticated user to view sensitive information from i… |
CVE-2023-33850 | High | 7.5 | 2023-08-22 | IBM GSKit-Crypto could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel in the RSA Decryption implementation. By… |
CVE-2023-4475 | High | 7.5 | 2023-08-22 | An Arbitrary File Movement vulnerability was found in ASUSTOR Data Master (ADM) allows an attacker to exploit the file renaming feature to move files to uninte… |
CVE-2023-4212 | Medium | 6.8 | 2023-08-22 | A command injection vulnerability exists in Trane XL824, XL850, XL1050, and Pivot thermostats allowing an attacker to execute arbitrary commands as root usin… |
CVE-2023-3699 | High | 8.7 | 2023-08-22 | An Improper Privilege Management vulnerability was found in ASUSTOR Data Master (ADM) allows an unprivileged local users to modify the storage devices configur… |
CVE-2023-39599 | Medium | 5.4 | 2023-08-22 | Cross-Site Scripting (XSS) vulnerability in CSZ CMS v.1.3.0 allows attackers to execute arbitrary code via a crafted payload to the Social Settings parameter. |
CVE-2023-39141 | High | 7.5 | 2023-08-22 | webui-aria2 commit 4fe2e was discovered to contain a path traversal vulnerability. |
CVE-2023-38996 | Medium | 6.7 | 2023-08-22 | An issue in all versions of Douran DSGate allows a local authenticated privileged attacker to execute arbitrary code via the debug command. |
CVE-2023-38732 | Medium | 4.3 | 2023-08-22 | IBM Robotic Process Automation 21.0.0 through 21.0.7 server could allow an authenticated user to view sensitive information from application logs. IBM X-Force… |
CVE-2023-38668 | Medium | 5.5 | 2023-08-22 | Stack-based buffer over-read in disasm in nasm 2.16 allows attackers to cause a denial of service (crash). |
CVE-2023-38667 | Medium | 5.5 | 2023-08-22 | Stack-based buffer over-read in function disasm in nasm 2.16 allows attackers to cause a denial of service. |
CVE-2023-38666 | Medium | 5.5 | 2023-08-22 | Bento4 v1.6.0-639 was discovered to contain a segmentation violation via the AP4_Processor::ProcessFragments function in mp4encrypt. |
CVE-2023-38665 | Medium | 5.5 | 2023-08-22 | Null pointer dereference in ieee_write_file in nasm 2.16rc0 allows attackers to cause a denial of service (crash). |
CVE-2023-37440 | Medium | 5.5 | 2023-08-22 | A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to conduct a server-sid… |
CVE-2023-37439 | Medium | 6.1 | 2023-08-22 | Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL i… |
CVE-2023-37438 | Medium | 6.5 | 2023-08-22 | Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL i… |
CVE-2023-37437 | Medium | 6.5 | 2023-08-22 | Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL i… |
CVE-2023-37436 | Medium | 6.5 | 2023-08-22 | Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL i… |
CVE-2023-37435 | Medium | 6.5 | 2023-08-22 | Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL i… |
CVE-2023-37434 | Medium | 6.5 | 2023-08-22 | Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL i… |
CVE-2023-37433 | Medium | 6.5 | 2023-08-22 | Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL i… |
CVE-2023-37432 | Medium | 6.5 | 2023-08-22 | Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL i… |
CVE-2023-37431 | Medium | 6.5 | 2023-08-22 | Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL i… |
CVE-2023-37430 | Medium | 6.5 | 2023-08-22 | Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL i… |
CVE-2023-37429 | Medium | 6.5 | 2023-08-22 | Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL i… |
CVE-2023-37428 | High | 7.2 | 2023-08-22 | A vulnerability in the EdgeConnect SD-WAN Orchestrator web-based management interface allows remote authenticated users to run arbitrary commands on the underl… |
CVE-2023-37427 | High | 7.2 | 2023-08-22 | A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to run arbitrary commands… |
CVE-2023-37426 | High | 7.4 | 2023-08-22 | EdgeConnect SD-WAN Orchestrator instances prior to the versions resolved in this advisory were found to have shared static SSH host keys for all installations… |
CVE-2023-37425 | High | 8.0 | 2023-08-22 | A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to conduct a stored cro… |
CVE-2023-37424 | High | 8.1 | 2023-08-22 | A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to run arbitrary comman… |
CVE-2023-37423 | High | 8.1 | 2023-08-22 | Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross… |
CVE-2023-37422 | High | 8.1 | 2023-08-22 | Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross… |
CVE-2023-37421 | High | 8.1 | 2023-08-22 | Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross… |
CVE-2023-36281 | Critical | 9.8 | 2023-08-22 | An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via a JSON file to load_prompt. This is related to __subclasses__ or a templ… |
CVE-2023-34853 | High | 7.8 | 2023-08-22 | Buffer Overflow vulnerability in Supermicro motherboard X12DPG-QR 1.4b allows local attackers to hijack control flow via manipulation of SmcSecurityEraseSetupV… |
CVE-2023-24517 | Medium | 6.4 | 2023-08-22 | Unrestricted Upload of File with Dangerous Type vulnerability in the Pandora FMS File Manager component, allows an attacker to make make use of this issue ( un… |
CVE-2023-24516 | Medium | 5.9 | 2023-08-22 | Cross-site Scripting (XSS) vulnerability in the Pandora FMS Special Days component allows an attacker to use it to steal the session cookie value of admin use… |
CVE-2023-24515 | Medium | 5.2 | 2023-08-22 | Server-Side Request Forgery (SSRF) vulnerability in API checker of Pandora FMS. Application does not have a check on the URL scheme used while retrieving API U… |
CVE-2023-24514 | Medium | 6.3 | 2023-08-22 | Cross-site Scripting (XSS) vulnerability in Visual Console Module of Pandora FMS could be used to hijack admin users session cookie values, carry out phishing… |
CVE-2023-23565 | Medium | 4.9 | 2023-08-22 | An issue was discovered in Geomatika IsiGeo Web 6.0. It allows remote authenticated users to retrieve PHP files from the server via Local File Inclusion. |
CVE-2023-23564 | High | 8.8 | 2023-08-22 | An issue was discovered in Geomatika IsiGeo Web 6.0. It allows remote authenticated users to execute commands. |
CVE-2023-23563 | Medium | 6.5 | 2023-08-22 | An issue was discovered in Geomatika IsiGeo Web 6.0. It allows remote authenticated users to obtain sensitive database content via SQL Injection. |
CVE-2023-38909 | Medium | 6.5 | 2023-08-22 | An issue in TPLink Smart Bulb Tapo series L530 before 1.2.4, L510E before 1.1.0, L630 before 1.0.4, P100 before 1.5.0, and Tapo Application 2.8.14 allows a rem… |
CVE-2023-38908 | Medium | 6.5 | 2023-08-22 | An issue in TPLink Smart Bulb Tapo series L530 before 1.2.4, L510E before 1.1.0, L630 before 1.0.4, P100 before 1.5.0, and Tapo Application 2.8.14 allows a rem… |
CVE-2023-38906 | Medium | 6.5 | 2023-08-22 | An issue in TPLink Smart Bulb Tapo series L530 1.1.9, L510E 1.0.8, L630 1.0.3, P100 1.4.9, Smart Camera Tapo series C200 1.1.18, and Tapo Application 2.8.14 al… |
CVE-2023-4303 | Medium | 4.3 | 2023-08-21 | Jenkins Fortify Plugin 22.1.38 and earlier does not escape the error message for a form validation method, resulting in an HTML injection vulnerability. |
CVE-2023-4302 | Medium | 4.2 | 2023-08-21 | A missing permission check in Jenkins Fortify Plugin 22.1.38 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL… |
CVE-2023-4301 | Medium | 4.2 | 2023-08-21 | A cross-site request forgery (CSRF) vulnerability in Jenkins Fortify Plugin 22.1.38 and earlier allows attackers to connect to an attacker-specified URL using… |
CVE-2023-25915 | Critical | 9.9 | 2023-08-21 | Due to improper input validation, an authenticated remote attacker could execute arbitrary commands on the target system. |
CVE-2023-25914 | High | 8.8 | 2023-08-21 | Due to improper restriction, authenticated attackers could retrieve and read system files of the underlying server through the XML interface. The information t… |
CVE-2023-25913 | High | 7.5 | 2023-08-21 | Because of an authentication flaw an attacker would be capable of generating a web report that discloses sensitive information such as internal IP addresses, u… |
CVE-2023-38158 | Low | 3.1 | 2023-08-21 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability |
CVE-2023-36787 | High | 8.8 | 2023-08-21 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2023-4459 | Medium | 5.5 | 2023-08-21 | A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers/net/vmxnet3/vmxnet3_drv.c in the networking sub-component in vmxnet3 in the Linux Ke… |
CVE-2023-4417 | Medium | 6.5 | 2023-08-21 | Improper access controls in the entry duplication component in Devolutions Remote Desktop Manager 2023.2.19 and earlier versions on Windows allows an authentic… |
CVE-2023-4373 | Critical | 9.8 | 2023-08-21 | Inadequate validation of permissions when employing remote tools and macros within Devolutions Remote Desktop Manager versions 2023.2.19 and earlier permits a… |
CVE-2023-40352 | High | 7.2 | 2023-08-21 | McAfee Safe Connect before 2.16.1.126 may allow an adversary with system privileges to achieve privilege escalation by loading arbitrary DLLs. |
CVE-2023-4456 | Medium | 5.7 | 2023-08-21 | A flaw was found in openshift-logging LokiStack. The key used for caching is just the token, which is too broad. This issue allows a user with a token valid fo… |
CVE-2023-3954 | Medium | 6.1 | 2023-08-21 | The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.4 does not sanitise and escape a parameter before outputting it back in the page, leadin… |
CVE-2023-3936 | Medium | 6.1 | 2023-08-21 | The Blog2Social WordPress plugin before 7.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |