2023 CVEs (page 174)
Page 174 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-3667 | Medium | 4.8 | 2023-08-21 | The Bit Assist WordPress plugin before 1.1.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2023-3604 | High | 7.5 | 2023-08-21 | The Change WP Admin Login WordPress plugin before 1.1.4 discloses the URL of the hidden login page when accessing a crafted URL, bypassing the protection offer… |
CVE-2023-3366 | Medium | 4.3 | 2023-08-21 | The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.2 does not have CRSF check when deleting a shipment, allowing attackers to make any logg… |
CVE-2023-39660 | Critical | 9.8 | 2023-08-21 | An issue in Gaberiele Venturi pandasai v.0.8.0 and before allows a remote attacker to execute arbitrary code via a crafted request to the prompt function. |
CVE-2023-39106 | High | 8.8 | 2023-08-21 | An issue in Nacos Group Nacos Spring Project v.1.1.1 and before allows a remote attacker to execute arbitrary code via the SnakeYamls Constructor() component. |
CVE-2023-39094 | Medium | 5.4 | 2023-08-21 | Cross Site Scripting vulnerability in ZeroWdd studentmanager v.1.0 allows a remote attacker to execute arbitrary code via the username parameter in the student… |
CVE-2023-39061 | Low | 3.5 | 2023-08-21 | Cross Site Request Forgery (CSRF) vulnerability in Chamilo v.1.11 thru v.1.11.20 allows a remote authenticated privileged attacker to execute arbitrary code. |
CVE-2023-38976 | High | 7.5 | 2023-08-21 | An issue in weaviate v.1.20.0 allows a remote attacker to cause a denial of service via the handleUnbatchedGraphQLRequest function. |
CVE-2023-38961 | Critical | 9.8 | 2023-08-21 | Buffer Overflwo vulnerability in JerryScript Project jerryscript v.3.0.0 allows a remote attacker to execute arbitrary code via the scanner_is_context_needed c… |
CVE-2023-38836 | High | 8.8 | 2023-08-21 | File Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code by adding a GIF header to bypass MIME type checks. |
CVE-2023-38035 | Critical | 9.8 | 2023-08-21 | A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication contr… |
CVE-2023-32002 | Critical | 9.8 | 2023-08-21 | The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability a… |
CVE-2023-31447 | Critical | 9.8 | 2023-08-21 | user_login.cgi on Draytek Vigor2620 devices before 3.9.8.4 (and on all versions of Vigor2925 devices) allows attackers to send a crafted payload to modify the… |
CVE-2023-40735 | High | 7.5 | 2023-08-21 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Cavo – Connecting for a Safer World BUTTERFLY BUTTON (Architecture flaw) allows los… |
CVE-2023-38899 | High | 7.8 | 2023-08-21 | SQL injection vulnerability in berkaygediz O_Blog v.1.0 allows a local attacker to escalate privileges via the secure_file_priv component. |
CVE-2023-3481 | Medium | 5.7 | 2023-08-21 | Critters versions 0.0.17-0.0.19 have an issue when parsing the HTML, which leads to a potential cross-site scripting (XSS) bug. We recommend upgrading to versi… |
CVE-2023-4455 | Medium | 6.5 | 2023-08-21 | Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3. |
CVE-2023-4454 | Medium | 5.7 | 2023-08-21 | Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3. |
CVE-2023-4453 | Medium | 5.4 | 2023-08-21 | Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.6.8. |
CVE-2023-40068 | Medium | 5.4 | 2023-08-21 | Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 allows a remote aut… |
CVE-2023-39939 | Critical | 9.1 | 2023-08-21 | SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.3M (MySQL version) and LuxCal Web Calendar prior to 5.2.3L (SQLite version) allows a remote una… |
CVE-2023-39543 | Medium | 6.1 | 2023-08-21 | Cross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.3M (MySQL version) and LuxCal Web Calendar prior to 5.2.3L (SQLite version) allows a rem… |
CVE-2023-4450 | Medium | 6.3 | 2023-08-21 | A vulnerability was found in jeecgboot JimuReport up to 1.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2023-39751 | Critical | 9.8 | 2023-08-21 | TP-Link TL-WR941ND V6 were discovered to contain a buffer overflow via the pSize parameter at /userRpm/PingIframeRpm. |
CVE-2023-39750 | Critical | 9.8 | 2023-08-21 | D-Link DAP-2660 v1.13 was discovered to contain a buffer overflow via the f_ipv6_enable parameter at /bsc_ipv6. This vulnerability is exploited via a crafted P… |
CVE-2023-39749 | Critical | 9.8 | 2023-08-21 | D-Link DAP-2660 v1.13 was discovered to contain a buffer overflow via the component /adv_resource. This vulnerability is exploited via a crafted GET request. |
CVE-2023-39748 | High | 7.5 | 2023-08-21 | An issue in the component /userRpm/NetworkCfgRpm of TP-Link TL-WR1041N V2 allows attackers to cause a Denial of Service (DoS) via a crafted GET request. |
CVE-2023-39747 | Critical | 9.8 | 2023-08-21 | TP-Link WR841N V8, TP-Link TL-WR940N V2, and TL-WR941ND V5 were discovered to contain a buffer overflow via the radiusSecret parameter at /userRpm/WlanSecurity… |
CVE-2023-39745 | High | 7.5 | 2023-08-21 | TP-Link TL-WR940N V2, TP-Link TL-WR941ND V5 and TP-Link TL-WR841N V8 were discovered to contain a buffer overflow via the component /userRpm/AccessCtrlAccessRu… |
CVE-2023-4449 | Medium | 6.3 | 2023-08-21 | A vulnerability was found in SourceCodester Free and Open Source Inventory Management System 1.0. It has been classified as critical. Affected is an unknown fu… |
CVE-2023-4448 | Medium | 6.3 | 2023-08-21 | A vulnerability was found in OpenRapid RapidCMS 1.3.1 and classified as critical. This issue affects some unknown processing of the file admin/run-movepass.php… |
CVE-2023-4447 | Medium | 6.3 | 2023-08-21 | A vulnerability has been found in OpenRapid RapidCMS 1.3.1 and classified as critical. This vulnerability affects unknown code of the file admin/article-chat.p… |
CVE-2023-39618 | Critical | 9.8 | 2023-08-21 | TOTOLINK X5000R B20210419 was discovered to contain a remote code execution (RCE) vulnerability via the setTracerouteCfg interface. |
CVE-2023-39617 | Critical | 9.8 | 2023-08-21 | TOTOLINK X5000R_V9.1.0cu.2089_B20211224 and X5000R_V9.1.0cu.2350_B20230313 were discovered to contain a remote code execution (RCE) vulnerability via the lang… |
CVE-2023-4446 | Medium | 5.5 | 2023-08-21 | A vulnerability, which was classified as critical, was found in OpenRapid RapidCMS 1.3.1. This affects an unknown part of the file template/default/category.ph… |
CVE-2023-4445 | Medium | 6.3 | 2023-08-21 | A vulnerability, which was classified as critical, has been found in Mini-Tmall up to 20230811. Affected by this issue is some unknown functionality of the fil… |
CVE-2023-4444 | Medium | 6.3 | 2023-08-21 | A vulnerability classified as critical was found in SourceCodester Free Hospital Management System for Small Practices 1.0. Affected by this vulnerability is a… |
CVE-2023-4443 | Medium | 6.3 | 2023-08-21 | A vulnerability classified as critical has been found in SourceCodester Free Hospital Management System for Small Practices 1.0/5.0.12. Affected is an unknown… |
CVE-2023-39809 | Critical | 9.8 | 2023-08-21 | N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain an OS command injection vulnerability via shell metacharacters in the system_hostname parameter… |
CVE-2023-39808 | Critical | 9.8 | 2023-08-21 | N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain a hardcoded root password that allows attackers to login with root privileges via the SSH servi… |
CVE-2023-39807 | Critical | 9.8 | 2023-08-21 | N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain a SQL injection vulnerability via the a_passwd parameter at /portal/user-register.php. |
CVE-2023-39786 | High | 7.5 | 2023-08-21 | Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the time parameter in the sscanf function. |
CVE-2023-39785 | High | 7.5 | 2023-08-21 | Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the list parameter in the set_qosMib_list function. |
CVE-2023-39784 | High | 7.5 | 2023-08-21 | Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the list parameter in the save_virtualser_data function. |
CVE-2023-4442 | Medium | 6.3 | 2023-08-21 | A vulnerability was found in SourceCodester Free Hospital Management System for Small Practices 1.0. It has been rated as critical. This issue affects some unk… |
CVE-2023-4441 | Medium | 6.3 | 2023-08-21 | A vulnerability was found in SourceCodester Free Hospital Management System for Small Practices 1.0. It has been declared as critical. This vulnerability affec… |
CVE-2023-4440 | Medium | 6.3 | 2023-08-20 | A vulnerability was found in SourceCodester Free Hospital Management System for Small Practices 1.0. It has been classified as critical. This affects an unknow… |
CVE-2023-4439 | Medium | 4.3 | 2023-08-20 | A vulnerability was found in SourceCodester Card Holder Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionali… |
CVE-2023-4438 | Medium | 6.3 | 2023-08-20 | A vulnerability has been found in SourceCodester Inventory Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown funct… |
CVE-2023-4437 | Medium | 6.3 | 2023-08-20 | A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file app… |
CVE-2023-4436 | Medium | 6.3 | 2023-08-20 | A vulnerability, which was classified as critical, has been found in SourceCodester Inventory Management System 1.0. This issue affects some unknown processing… |
CVE-2023-36674 | Medium | 5.3 | 2023-08-20 | An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. It is possible to byp… |
CVE-2023-4451 | Medium | 6.1 | 2023-08-20 | Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4. |
CVE-2023-37250 | High | 7.0 | 2023-08-20 | Unity Parsec has a TOCTOU race condition that permits local attackers to escalate privileges to SYSTEM if Parsec was installed in "Per User" mode. The applicat… |
CVE-2023-37369 | High | 7.5 | 2023-08-20 | In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlStreamReader via a crafted XML string th… |
CVE-2023-4435 | Medium | 5.5 | 2023-08-20 | Improper Input Validation in GitHub repository hamza417/inure prior to build88. |
CVE-2023-4434 | Medium | 6.1 | 2023-08-20 | Missing Authorization in GitHub repository hamza417/inure prior to build88. |
CVE-2023-40711 | High | 7.5 | 2023-08-20 | Veilid before 0.1.9 does not check the size of uncompressed data during decompression upon an envelope receipt, which allows remote attackers to cause a denial… |
CVE-2023-2971 | Medium | 6.3 | 2023-08-19 | Improper path handling in Typora before 1.7.0-dev on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers… |
CVE-2023-2318 | High | 8.6 | 2023-08-19 | DOM-based XSS in src/muya/lib/contentState/pasteCtrl.js in MarkText 0.17.1 and before on Windows, Linux and macOS allows arbitrary JavaScript code to run in th… |
CVE-2023-2317 | High | 8.6 | 2023-08-19 | DOM-based XSS in updater/update.html in Typora before 1.6.7 on Windows and Linux allows a crafted markdown file to run arbitrary JavaScript code in the context… |
CVE-2023-2316 | High | 7.4 | 2023-08-19 | Improper path handling in Typora before 1.6.7 on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via… |
CVE-2023-2110 | High | 8.2 | 2023-08-19 | Improper path handling in Obsidian desktop before 1.2.8 on Windows, Linux and macOS allows a crafted webpage to access local files and exfiltrate them to remot… |
CVE-2023-4433 | Medium | 5.4 | 2023-08-19 | Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4. |
CVE-2023-4432 | Medium | 6.1 | 2023-08-19 | Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4. |
CVE-2023-40175 | High | 7.3 | 2023-08-18 | Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited incorrect behavior when parsing chunked transfer encodi… |
CVE-2023-40174 | Medium | 6.8 | 2023-08-18 | Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. Insufficient session expiration is a… |
CVE-2023-40173 | High | 7.5 | 2023-08-18 | Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. Prior to version 1.0.5 Social media s… |
CVE-2023-40172 | Medium | 6.5 | 2023-08-18 | Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. A Cross-site request forgery (CSRF) a… |
CVE-2023-40037 | Medium | 6.5 | 2023-08-18 | Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not p… |
CVE-2023-38839 | High | 7.5 | 2023-08-18 | SQL injection vulnerability in Kidus Minimati v.1.0.0 allows a remote attacker to obtain sensitive information via theID parameter in the fulldelete.php compon… |
CVE-2023-20212 | High | 7.5 | 2023-08-18 | A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected devi… |
CVE-2023-4422 | Medium | 4.8 | 2023-08-18 | Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3. |
CVE-2023-38911 | Medium | 5.4 | 2023-08-18 | A Cross-Site Scripting (XSS) vulnerability in CSZ CMS 1.3.0 allows attackers to execute arbitrary code via a crafted payload to the Gallery parameter in the Yo… |
CVE-2023-38910 | Medium | 6.1 | 2023-08-18 | CSZ CMS 1.3.0 is vulnerable to cross-site scripting (XSS), which allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered in the… |
CVE-2023-38890 | High | 8.8 | 2023-08-18 | Online Shopping Portal Project 3.1 allows remote attackers to execute arbitrary SQL commands/queries via the login form, leading to unauthorized access and pot… |
CVE-2023-27471 | Medium | 5.5 | 2023-08-18 | An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. UEFI implementations do not correctly protect and validate information contained in th… |
CVE-2023-4415 | High | 7.3 | 2023-08-18 | A vulnerability was found in Ruijie RG-EW1200G 07161417 r483. It has been rated as critical. Affected by this issue is some unknown functionality of the file /… |
CVE-2023-4414 | Medium | 6.3 | 2023-08-18 | A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230807. It has been declared as critical. Affected by this vulnerability is an unkno… |
CVE-2023-32130 | Medium | 5.9 | 2023-08-18 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Daniel Powney Multi Rating plugin <= 5.0.6 versions. |
CVE-2023-32122 | Medium | 5.8 | 2023-08-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Spiffy Plugins Spiffy Calendar plugin <= 4.9.3 versions. |
CVE-2023-4412 | Medium | 6.3 | 2023-08-18 | A vulnerability was found in TOTOLINK EX1200L EN_V9.3.5u.6146_B20201023 and classified as critical. This issue affects the function setWanCfg. The manipulation… |
CVE-2023-32109 | High | 7.1 | 2023-08-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ignazio Scimone Albo Pretorio On line plugin <= 4.6.3 versions. |
CVE-2023-32108 | High | 7.1 | 2023-08-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ignazio Scimone Albo Pretorio On line plugin <= 4.6.3 versions. |
CVE-2023-30499 | High | 7.1 | 2023-08-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in FolioVision FV Flowplayer Video Player plugin <= 7.5.32.7212 versions. |
CVE-2023-29387 | Medium | 6.5 | 2023-08-18 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Julien Crego Manager for Icomoon plugin <= 2.0 versions. |
CVE-2023-27576 | Medium | 6.7 | 2023-08-18 | An issue was discovered in phpList before 3.6.14. Due to an access error, it was possible to manipulate and edit data of the system's super admin, allowing one… |
CVE-2023-4411 | Medium | 6.3 | 2023-08-18 | A vulnerability has been found in TOTOLINK EX1200L EN_V9.3.5u.6146_B20201023 and classified as critical. This vulnerability affects the function setTracerouteC… |
CVE-2023-4410 | Medium | 6.3 | 2023-08-18 | A vulnerability, which was classified as critical, was found in TOTOLINK EX1200L EN_V9.3.5u.6146_B20201023. This affects the function setDiagnosisCfg. The mani… |
CVE-2023-32107 | High | 7.1 | 2023-08-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Photo Gallery Team Photo Gallery by Ays – Responsive Image Gallery plugin <= 5.1.3 versions. |
CVE-2023-32106 | High | 7.1 | 2023-08-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Fahad Mahmood WP Docs plugin <= 1.9.9 versions. |
CVE-2023-32105 | High | 7.1 | 2023-08-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ollybach WPPizza – A Restaurant Plugin plugin <= 3.17.1 versions. |
CVE-2023-32103 | Medium | 6.5 | 2023-08-18 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Theme Palace TP Education plugin <= 4.4 versions. |
CVE-2023-31232 | Medium | 5.9 | 2023-08-18 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in David Artiss Plugins List plugin <= 2.5 versions. |
CVE-2023-31218 | High | 7.1 | 2023-08-18 | Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Profe… |
CVE-2023-4409 | Medium | 6.3 | 2023-08-18 | A vulnerability, which was classified as critical, has been found in NBS&HappySoftWeChat 1.1.6. Affected by this issue is some unknown functionality. The manip… |
CVE-2023-4407 | Medium | 6.3 | 2023-08-18 | A vulnerability classified as critical was found in Codecanyon Credit Lite 1.5.4. Affected by this vulnerability is an unknown functionality of the file /porta… |
CVE-2023-31228 | Medium | 5.9 | 2023-08-18 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CreativeMindsSolutions CM On Demand Search And Replace plugin <= 1.3.0 versions. |
CVE-2023-31094 | High | 7.1 | 2023-08-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Lauri Karisola / WP Trio Stock Sync for WooCommerce plugin <= 2.4.0 versions. |
CVE-2023-40072 | High | 8.8 | 2023-08-18 | OS command injection vulnerability in ELECOM wireless LAN access point devices allows an authenticated user to execute an arbitrary OS command by sending a spe… |