2023 CVEs (page 176)
Page 176 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-25647 | Medium | 4.7 | 2023-08-17 | There is a permission and access control vulnerability in some ZTE mobile phones. Due to improper access control, applications in mobile phone could monitor… |
CVE-2023-33237 | High | 8.8 | 2023-08-17 | TN-5900 Series firmware version v3.3 and prior is vulnerable to improper-authentication vulnerability. This vulnerability arises from inadequate authentication… |
CVE-2023-35011 | Medium | 5.4 | 2023-08-16 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthori… |
CVE-2023-35009 | Medium | 5.3 | 2023-08-16 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a remote attacker to obtain system information without authentication which could be used in reconn… |
CVE-2023-39846 | Critical | 9.8 | 2023-08-16 | An issue in Konga v0.14.9 allows attackers to bypass authentication via a crafted JWT token. |
CVE-2023-38894 | Critical | 9.8 | 2023-08-16 | A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code via the extend function. |
CVE-2023-35893 | Critical | 9.9 | 2023-08-16 | IBM Security Guardium 10.6, 11.3, 11.4, and 11.5 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially… |
CVE-2023-20237 | Medium | 4.3 | 2023-08-16 | A vulnerability in Cisco Intersight Virtual Appliance could allow an unauthenticated, adjacent attacker to access internal HTTP services that are otherwise ina… |
CVE-2023-20232 | Medium | 5.3 | 2023-08-16 | A vulnerability in the Tomcat implementation for Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to cause a… |
CVE-2023-20229 | High | 7.1 | 2023-08-16 | A vulnerability in the CryptoService function of Cisco Duo Device Health Application for Windows could allow an authenticated, local attacker with low privileg… |
CVE-2023-20224 | High | 7.8 | 2023-08-16 | A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent, Virtual Appliance installation type, could allow an authenticated, local attacker to elevate… |
CVE-2023-20222 | Medium | 4.8 | 2023-08-16 | A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow an unauth… |
CVE-2023-20221 | Medium | 6.5 | 2023-08-16 | A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an unauthenticated… |
CVE-2023-20217 | Medium | 5.5 | 2023-08-16 | A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent, Virtual Appliance installation type, could allow an authenticated, local attacker to elevate… |
CVE-2023-20211 | High | 8.1 | 2023-08-16 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Man… |
CVE-2023-20205 | Medium | 5.4 | 2023-08-16 | Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow… |
CVE-2023-20203 | Medium | 5.4 | 2023-08-16 | Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow… |
CVE-2023-20201 | Medium | 4.8 | 2023-08-16 | Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow… |
CVE-2023-20197 | High | 7.5 | 2023-08-16 | A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthenticated, remote attacker to cause a de… |
CVE-2023-20111 | Medium | 6.5 | 2023-08-16 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access sensitive… |
CVE-2023-20017 | Medium | 6.5 | 2023-08-16 | Multiple vulnerabilities in Cisco Intersight Private Virtual Appliance could allow an authenticated, remote attacker to execute arbitrary commands using root-l… |
CVE-2023-20013 | Medium | 6.5 | 2023-08-16 | Multiple vulnerabilities in Cisco Intersight Private Virtual Appliance could allow an authenticated, remote attacker to execute arbitrary commands using root-l… |
CVE-2023-40034 | High | 8.1 | 2023-08-16 | Woodpecker is a community fork of the Drone CI system. In affected versions an attacker can post malformed webhook data witch lead to an update of the reposito… |
CVE-2023-40033 | High | 7.1 | 2023-08-16 | Flarum is an open source forum software. Flarum is affected by a vulnerability that allows an attacker to conduct a Blind Server-Side Request Forgery (SSRF) at… |
CVE-2023-40021 | Medium | 5.3 | 2023-08-16 | Oppia is an online learning platform. When comparing a received CSRF token against the expected token, Oppia uses the string equality operator (`==`), which is… |
CVE-2023-20242 | Medium | 4.8 | 2023-08-16 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified CM Session Management Edition (Unifie… |
CVE-2023-20228 | Medium | 6.1 | 2023-08-16 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to conduc… |
CVE-2023-20209 | Medium | 6.5 | 2023-08-16 | A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authent… |
CVE-2023-4384 | Low | 3.7 | 2023-08-16 | A vulnerability has been found in MaximaTech Portal Executivo 21.9.1.140 and classified as problematic. This vulnerability affects unknown code of the componen… |
CVE-2023-4383 | High | 7.8 | 2023-08-16 | A vulnerability, which was classified as critical, was found in MicroWorld eScan Anti-Virus 7.0.32 on Linux. This affects an unknown part of the file runasroot… |
CVE-2023-4382 | Low | 3.5 | 2023-08-16 | A vulnerability, which was classified as problematic, has been found in tdevs Hyip Rio 2.1. Affected by this issue is some unknown functionality of the file /u… |
CVE-2023-32453 | Medium | 4.6 | 2023-08-16 | Dell BIOS contains an improper authentication vulnerability. A malicious user with physical access to the system may potentially exploit this vulnerability in… |
CVE-2023-28075 | Medium | 6.9 | 2023-08-16 | Dell BIOS contain a Time-of-check Time-of-use vulnerability in BIOS. A local authenticated malicious user with physical access to the system could potentially… |
CVE-2023-4389 | High | 7.0 | 2023-08-16 | A flaw was found in btrfs_get_root_ref in fs/btrfs/disk-io.c in the btrfs filesystem in the Linux Kernel due to a double decrement of the reference count. This… |
CVE-2023-4387 | High | 7.1 | 2023-08-16 | A use-after-free flaw was found in vmxnet3_rq_alloc_rx_buf in drivers/net/vmxnet3/vmxnet3_drv.c in VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. Th… |
CVE-2023-38737 | Medium | 5.9 | 2023-08-16 | IBM WebSphere Application Server Liberty 22.0.0.13 through 23.0.0.7 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remo… |
CVE-2023-4385 | Medium | 5.5 | 2023-08-16 | A NULL pointer dereference flaw was found in dbFree in fs/jfs/jfs_dmap.c in the journaling file system (JFS) in the Linux Kernel. This issue may allow a local… |
CVE-2023-4204 | Medium | 5.4 | 2023-08-16 | NPort IAW5000A-I/O Series firmware version v2.2 and prior is affected by a hardcoded credential vulnerabilitywhich poses a potential risk to the security and i… |
CVE-2023-39250 | High | 7.8 | 2023-08-16 | Dell Storage Integration Tools for VMware (DSITV) and Dell Storage vSphere Client Plugin (DSVCP) versions prior to 6.1.1 and Replay Manager for VMware (RMSV… |
CVE-2023-2737 | Medium | 5.7 | 2023-08-16 | Improper log permissions in SafeNet Authentication Service Version 3.4.0 on Windows allows an authenticated attacker to cause a denial of service via local pri… |
CVE-2023-40351 | Medium | 4.3 | 2023-08-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins Favorite View Plugin 5.v77a_37f62782d and earlier allows attackers to add or remove views from ano… |
CVE-2023-40350 | Medium | 5.4 | 2023-08-16 | Jenkins Docker Swarm Plugin 1.11 and earlier does not escape values returned from Docker before inserting them into the Docker Swarm Dashboard view, resulting… |
CVE-2023-40349 | Medium | 5.3 | 2023-08-16 | Jenkins Gogs Plugin 1.0.15 and earlier improperly initializes an option to secure its webhook endpoint, allowing unauthenticated attackers to trigger builds of… |
CVE-2023-40348 | Medium | 5.3 | 2023-08-16 | The webhook endpoint in Jenkins Gogs Plugin 1.0.15 and earlier provides unauthenticated attackers information about the existence of jobs in its output. |
CVE-2023-40347 | Medium | 6.5 | 2023-08-16 | Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin 1.14 and earlier does not set the appropriate context for credentials lookup, allowing attackers with… |
CVE-2023-40346 | Medium | 5.4 | 2023-08-16 | Jenkins Shortcut Job Plugin 0.4 and earlier does not escape the shortcut redirection URL, resulting in a stored cross-site scripting (XSS) vulnerability exploi… |
CVE-2023-40345 | Medium | 6.5 | 2023-08-16 | Jenkins Delphix Plugin 3.0.2 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Overall/Read permission to access… |
CVE-2023-40344 | Medium | 4.3 | 2023-08-16 | A missing permission check in Jenkins Delphix Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credential… |
CVE-2023-40343 | Medium | 5.9 | 2023-08-16 | Jenkins Tuleap Authentication Plugin 1.1.20 and earlier uses a non-constant time comparison function when validating an authentication token allowing attackers… |
CVE-2023-40342 | Medium | 5.4 | 2023-08-16 | Jenkins Flaky Test Handler Plugin 1.2.2 and earlier does not escape JUnit test contents when showing them on the Jenkins UI, resulting in a stored cross-site s… |
CVE-2023-40341 | High | 8.8 | 2023-08-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.27.5 and earlier allows attackers to connect to an attacker-specified URL, cap… |
CVE-2023-40340 | High | 7.5 | 2023-08-16 | Jenkins NodeJS Plugin 1.6.0 and earlier does not properly mask (i.e., replace with asterisks) credentials specified in the Npm config file in Pipeline build lo… |
CVE-2023-40339 | High | 7.5 | 2023-08-16 | Jenkins Config File Provider Plugin 952.va_544a_6234b_46 and earlier does not mask (i.e., replace with asterisks) credentials specified in configuration files… |
CVE-2023-40338 | Medium | 4.3 | 2023-08-16 | Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier displays an error message that includes an absolute path of a log file when attempting to access the Sca… |
CVE-2023-40337 | Medium | 4.3 | 2023-08-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy a view inside a folder. |
CVE-2023-40336 | High | 8.8 | 2023-08-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy folders. |
CVE-2023-39975 | High | 8.8 | 2023-08-16 | kdc/do_tgs_req.c in MIT Kerberos 5 (aka krb5) 1.21 before 1.21.2 has a double free that is reachable if an authenticated user can trigger an authorization-data… |
CVE-2023-39115 | Critical | 9.8 | 2023-08-16 | install/aiz-uploader/upload in Campcodes Online Matrimonial Website System Script 3.3 allows XSS via a crafted SVG document. |
CVE-2023-38904 | Medium | 5.4 | 2023-08-16 | A Cross Site Scripting (XSS) vulnerability in Netlify CMS v.2.10.192 allows a remote attacker to execute arbitrary code via a crafted payload to the body param… |
CVE-2023-33663 | Critical | 9.8 | 2023-08-16 | In the module “Customization fields fee for your store” (aicustomfee) from ai-dev module for PrestaShop, an attacker can perform SQL injection up to 0.2.0. Rel… |
CVE-2023-32495 | High | 7.8 | 2023-08-16 | Dell PowerScale OneFS, 8.2.x-9.5.x, contains a exposure of sensitive information to an unauthorized Actor vulnerability. An authorized local attacker could po… |
CVE-2023-32493 | High | 7.3 | 2023-08-16 | Dell PowerScale OneFS, 9.5.0.x, contains a protection mechanism bypass vulnerability. An unprivileged, remote attacker could potentially exploit this vulnerab… |
CVE-2023-32492 | Medium | 5.3 | 2023-08-16 | Dell PowerScale OneFS 9.5.0.x contains an incorrect default permissions vulnerability. A low-privileged local attacker could potentially exploit this vulnerab… |
CVE-2023-32491 | Medium | 6.3 | 2023-08-16 | Dell PowerScale OneFS 9.5.0.x, contains an insertion of sensitive information into log file vulnerability in SNMPv3. A low privileges user could potentially e… |
CVE-2023-32490 | Medium | 6.7 | 2023-08-16 | Dell PowerScale OneFS 8.2x -9.5x contains an improper privilege management vulnerability. A high privilege local attacker could potentially exploit this vulne… |
CVE-2023-32489 | Medium | 6.7 | 2023-08-16 | Dell PowerScale OneFS 8.2x -9.5x contains a privilege escalation vulnerability. A local attacker with high privileges could potentially exploit this vulnerabi… |
CVE-2023-32488 | Medium | 5.3 | 2023-08-16 | Dell PowerScale OneFS, 8.2.x-9.5.0.x, contains an information disclosure vulnerability in NFS. A low privileged attacker could potentially exploit this vulner… |
CVE-2023-32487 | High | 7.8 | 2023-08-16 | Dell PowerScale OneFS, 8.2.x - 9.5.0.x, contains an elevation of privilege vulnerability. A low privileged local attacker could potentially exploit this vulne… |
CVE-2023-32486 | Medium | 6.7 | 2023-08-16 | Dell PowerScale OneFS 9.5.x version contain a privilege escalation vulnerability. A low privilege local attacker could potentially exploit this vulnerability… |
CVE-2023-32494 | Medium | 6.7 | 2023-08-16 | Dell PowerScale OneFS, 8.0.x-9.5.x, contains an improper handling of insufficient privileges vulnerability. A local privileged attacker could potentially exp… |
CVE-2023-4381 | Medium | 4.3 | 2023-08-16 | Unverified Password Change in GitHub repository instantsoft/icms2 prior to 2.16.1-git. |
CVE-2023-2272 | Medium | 6.1 | 2023-08-16 | The Tiempo.com WordPress plugin through 0.1.2 does not sanitise and escape the page parameter before outputting it back in the page, leading to a Reflected Cro… |
CVE-2023-2271 | Medium | 4.3 | 2023-08-16 | The Tiempo.com WordPress plugin through 0.1.2 does not have CSRF check when deleting its shortcode, which could allow attackers to make logged in admins delete… |
CVE-2023-2254 | Medium | 4.8 | 2023-08-16 | The Ko-fi Button WordPress plugin before 1.3.3 does not properly some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scri… |
CVE-2023-2225 | Medium | 4.8 | 2023-08-16 | The SEO ALert WordPress plugin through 1.59 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2023-2123 | Medium | 6.1 | 2023-08-16 | The WP Inventory Manager WordPress plugin before 2.1.0.13 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflecte… |
CVE-2023-2122 | Medium | 6.1 | 2023-08-16 | The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitise and escape the iowd_tabs_active parameter before rendering it in the plugin admin… |
CVE-2023-1977 | High | 8.8 | 2023-08-16 | The Booking Manager WordPress plugin before 2.0.29 does not validate URLs input in it's admin panel or in shortcodes for showing events from a remote .ics file… |
CVE-2023-1465 | Medium | 6.1 | 2023-08-16 | The WP EasyPay WordPress plugin before 4.1 does not escape some generated URLs before outputting them back in pages, leading to Reflected Cross-Site Scripting… |
CVE-2023-1110 | Medium | 5.4 | 2023-08-16 | The Yellow Yard Searchbar WordPress plugin before 2.8.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/po… |
CVE-2023-0579 | High | 8.8 | 2023-08-16 | The YARPP WordPress plugin before 5.30.3 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow… |
CVE-2023-0551 | Medium | 5.4 | 2023-08-16 | The REST API TO MiniProgram WordPress plugin through 4.6.1 does not have authorisation and CSRF checks in an AJAX action, allowing ay authenticated users, such… |
CVE-2023-0274 | Medium | 5.4 | 2023-08-16 | The URL Params WordPress plugin before 2.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the s… |
CVE-2023-0058 | Medium | 6.1 | 2023-08-16 | The Tiempo.com WordPress plugin through 0.1.2 does not have CSRF check when creating and editing its shortcode, and is missing sanitisation as well as escaping… |
CVE-2023-4241 | High | 7.5 | 2023-08-16 | lol-html can cause panics on certain HTML inputs. Anyone processing arbitrary 3rd party HTML with the library is affected. |
CVE-2023-30871 | High | 7.1 | 2023-08-16 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in PT Woo Plugins (by Webdados) Stock Exporter for WooCommerce plugin <= 1.1.0 versions. |
CVE-2023-30779 | High | 7.1 | 2023-08-16 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Jonathan Daggerhart Query Wrangler plugin <= 1.5.51 versions. |
CVE-2023-30786 | Medium | 5.9 | 2023-08-16 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Benjamin Guy Captcha Them All plugin <= 1.3.3 versions. |
CVE-2023-30785 | High | 7.1 | 2023-08-16 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Video Grid plugin <= 1.21 versions. |
CVE-2023-30784 | Medium | 6.5 | 2023-08-16 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Kaya Studio Kaya QR Code Generator plugin <= 1.5.2 versions. |
CVE-2023-30782 | High | 7.1 | 2023-08-16 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Andy Moyle Church Admin plugin <= 3.7.5 versions. |
CVE-2023-30473 | High | 7.1 | 2023-08-16 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Maxim Glazunov YML for Yandex Market plugin <= 3.10.7 versions. |
CVE-2023-39507 | Medium | 6.1 | 2023-08-16 | Improper authorization in the custom URL scheme handler in "Rikunabi NEXT" App for Android prior to ver. 11.5.0 allows a malicious intent to lead the vulnerabl… |
CVE-2023-4374 | Medium | 4.3 | 2023-08-16 | The WP Remote Users Sync plugin for WordPress is vulnerable to unauthorized access of data and addition of data due to a missing capability check on the 'refre… |
CVE-2023-3958 | High | 8.5 | 2023-08-16 | The WP Remote Users Sync plugin for WordPress is vulnerable to Server Side Request Forgery via the 'notify_ping_remote' AJAX function in versions up to, and in… |
CVE-2023-26140 | Medium | 6.1 | 2023-08-16 | Versions of the package @excalidraw/excalidraw from 0.0.0 are vulnerable to Cross-site Scripting (XSS) via embedded links in whiteboard objects due to improper… |
CVE-2023-39851 | Critical | 9.8 | 2023-08-15 | webchess v1.0 was discovered to contain a SQL injection vulnerability via the $playerID parameter at mainmenu.php. NOTE: this is disputed by a third party who… |
CVE-2023-39850 | Critical | 9.8 | 2023-08-15 | Schoolmate v1.3 was discovered to contain multiple SQL injection vulnerabilities via the $courseid and $teacherid parameters at DeleteFunctions.php. |
CVE-2023-20564 | Medium | 6.7 | 2023-08-15 | Insufficient validation in the IOCTL (Input Output Control) input buffer in AMD Ryzen™ Master may permit a privileged attacker to perform memory reads/w… |
CVE-2023-20560 | Medium | 4.4 | 2023-08-15 | Insufficient validation of the IOCTL (Input Output Control) input buffer in AMD Ryzen™ Master may allow a privileged attacker to provide a null value… |