2023 CVEs (page 186)
Page 186 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-37581 | Medium | 5.4 | 2023-08-06 | Insufficient input validation and sanitation in Weblog Category name, Website About and File Upload features in all versions of Apache Roller on all platforms… |
CVE-2023-4177 | Low | 2.6 | 2023-08-06 | A vulnerability was found in EmpowerID up to 7.205.0.0. It has been rated as problematic. This issue affects some unknown processing of the component Multi-Fac… |
CVE-2023-4176 | Medium | 6.3 | 2023-08-06 | A vulnerability was found in SourceCodester Hospital Management System 1.0. It has been classified as critical. This affects an unknown part of the file appoin… |
CVE-2023-4175 | Low | 3.5 | 2023-08-06 | A vulnerability was found in mooSocial mooTravel 3.1.8 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation le… |
CVE-2023-4190 | Medium | 6.5 | 2023-08-06 | Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.2.11. |
CVE-2023-4174 | Low | 3.5 | 2023-08-06 | A vulnerability has been found in mooSocial mooStore 3.1.6 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manip… |
CVE-2023-4173 | Low | 3.5 | 2023-08-06 | A vulnerability, which was classified as problematic, was found in mooSocial mooStore 3.1.6. Affected is an unknown function of the file /search/index. The man… |
CVE-2023-32600 | Medium | 6.5 | 2023-08-06 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Rank Math SEO plugin <= 1.0.119 versions. |
CVE-2023-4172 | Medium | 4.3 | 2023-08-05 | A vulnerability, which was classified as problematic, has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This issue affects some… |
CVE-2023-37874 | Medium | 5.9 | 2023-08-05 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Dimitar Ivanov HTTP Headers plugin <= 1.18.11 versions. |
CVE-2023-37873 | High | 7.1 | 2023-08-05 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Shipping Multiple Addresses plugin <= 3.8.5 versions. |
CVE-2023-36689 | High | 7.1 | 2023-08-05 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPFactory WPFactory Helper plugin <= 1.5.2 versions. |
CVE-2023-36686 | High | 7.1 | 2023-08-05 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CartFlows Pro plugin <= 1.11.11 versions. |
CVE-2023-36678 | Medium | 5.9 | 2023-08-05 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP-buy WP Content Copy Protection & No Right Click plugin <= 3.5.5 versions. |
CVE-2023-34377 | Medium | 5.9 | 2023-08-05 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Joseph C Dolson My Content Management plugin <= 1.7.6 versions. |
CVE-2023-34010 | Medium | 5.8 | 2023-08-05 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in submodule of David Lingren Media Library Assistant plugin <= 3.0.7 versions. |
CVE-2023-30491 | High | 7.1 | 2023-08-05 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CodeBard CodeBard's Patron Button and Widgets for Patreon plugin <= 2.1.8 versions. |
CVE-2023-4171 | Medium | 4.3 | 2023-08-05 | A vulnerability classified as problematic was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This vulnerability affects unknown code… |
CVE-2023-4189 | Medium | 4.8 | 2023-08-05 | Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1-git. |
CVE-2023-4188 | Critical | 9.1 | 2023-08-05 | SQL Injection in GitHub repository instantsoft/icms2 prior to 2.16.1-git. |
CVE-2023-4170 | Low | 3.5 | 2023-08-05 | A vulnerability was found in DedeBIZ 6.2.10. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Article Ha… |
CVE-2023-4187 | Medium | 4.8 | 2023-08-05 | Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git. |
CVE-2023-4169 | Medium | 6.3 | 2023-08-05 | A vulnerability was found in Ruijie RG-EW1200G 1.0(1)B1P5. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the… |
CVE-2023-4168 | Medium | 4.3 | 2023-08-05 | A vulnerability was found in Templatecookie Adlisting 2.14.0. It has been classified as problematic. Affected is an unknown function of the file /ad-list of th… |
CVE-2023-4167 | Low | 3.5 | 2023-08-05 | A vulnerability was found in Media Browser Emby Server 4.7.13.0 and classified as problematic. This issue affects some unknown processing of the file /web/. Th… |
CVE-2023-4166 | Medium | 5.5 | 2023-08-05 | A vulnerability has been found in Tongda OA and classified as critical. This vulnerability affects unknown code of the file general/system/seal_manage/dianju/d… |
CVE-2023-4165 | Medium | 5.5 | 2023-08-05 | A vulnerability, which was classified as critical, was found in Tongda OA. This affects an unknown part of the file general/system/seal_manage/iweboffice/delet… |
CVE-2023-39508 | High | 8.8 | 2023-08-05 | Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow… |
CVE-2023-36095 | Critical | 9.8 | 2023-08-05 | An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions inclu… |
CVE-2023-38943 | High | 8.8 | 2023-08-05 | ShuiZe_0x727 v1.0 was discovered to contain a remote command execution (RCE) vulnerability via the component /iniFile/config.ini. |
CVE-2023-33367 | Critical | 9.8 | 2023-08-05 | A SQL injection vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing unauthenticated attackers to write PHP files on the server's root dire… |
CVE-2023-39346 | High | 8.8 | 2023-08-04 | LinuxASMCallGraph is software for drawing the call graph of the programming code. Linux ASMCallGraph before commit 20dba06bd1a3cf260612d4f21547c25002121cd5 all… |
CVE-2023-39344 | Critical | 10.0 | 2023-08-04 | social-media-skeleton is an uncompleted social media project. A SQL injection vulnerability in the project allows UNION based injections, which indirectly lead… |
CVE-2023-39551 | Critical | 9.8 | 2023-08-04 | PHPGurukul Online Security Guards Hiring System v.1.0 is vulnerable to SQL Injection via osghs/admin/search.php. |
CVE-2023-38702 | Critical | 9.9 | 2023-08-04 | Knowage is an open source analytics and business intelligence suite. Starting in the 6.x.x branch and prior to version 8.1.8, the endpoint `/knowage/restful-se… |
CVE-2023-38700 | Low | 3.5 | 2023-08-04 | matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it was possible to craft an event such that it would leak part of a targeted… |
CVE-2023-4159 | High | 8.8 | 2023-08-04 | Unrestricted Upload of File with Dangerous Type in GitHub repository omeka/omeka-s prior to 4.0.3. |
CVE-2023-4158 | Medium | 5.4 | 2023-08-04 | Cross-site Scripting (XSS) - Stored in GitHub repository omeka/omeka-s prior to 4.0.3. |
CVE-2023-4157 | Medium | 5.2 | 2023-08-04 | CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in GitHub repository omeka/omeka-s prior to version 4… |
CVE-2023-39107 | Critical | 9.1 | 2023-08-04 | An arbitrary file overwrite vulnerability in NoMachine Free Edition and Enterprise Client for macOS before v8.8.1 allows attackers to overwrite root-owned file… |
CVE-2023-38699 | Critical | 9.1 | 2023-08-04 | MindsDB's AI Virtual Database allows developers to connect any AI/ML model to any datasource. Prior to version 23.7.4.0, a call to requests with `verify=False`… |
CVE-2023-38698 | Medium | 4.9 | 2023-08-04 | Ethereum Name Service (ENS) is a distributed, open, and extensible naming system based on the Ethereum blockchain. According to the documentation, controllers… |
CVE-2023-38697 | Medium | 5.8 | 2023-08-04 | protocol-http1 provides a low-level implementation of the HTTP/1 protocol. RFC 9112 Section 7.1 defined the format of chunk size, chunk data and chunk extensio… |
CVE-2023-38695 | Medium | 6.5 | 2023-08-04 | cypress-image-snapshot shows visual regressions in Cypress with jest-image-snapshot. Prior to version 8.0.2, it's possible for a user to pass a relative file p… |
CVE-2023-38692 | Critical | 9.8 | 2023-08-04 | CloudExplorer Lite is an open source, lightweight cloud management platform. Versions prior to 1.3.1 contain a command injection vulnerability in the installat… |
CVE-2023-38332 | Medium | 6.5 | 2023-08-04 | Zoho ManageEngine ADManager Plus through 7201 allow authenticated users to take over another user's account via sensitive information disclosure. |
CVE-2023-33379 | Critical | 9.8 | 2023-08-04 | Connected IO v2.1.0 and prior has a misconfiguration in their MQTT broker used for management and device communication, which allows devices to connect to the… |
CVE-2023-33378 | Critical | 9.8 | 2023-08-04 | Connected IO v2.1.0 and prior has an argument injection vulnerability in its AT command message in its communication protocol, enabling attackers to execute ar… |
CVE-2023-33377 | Critical | 9.8 | 2023-08-04 | Connected IO v2.1.0 and prior has an OS command injection vulnerability in the set firewall command in part of its communication protocol, enabling attackers t… |
CVE-2023-33376 | Critical | 9.8 | 2023-08-04 | Connected IO v2.1.0 and prior has an argument injection vulnerability in its iptables command message in its communication protocol, enabling attackers to exec… |
CVE-2023-33375 | Critical | 9.8 | 2023-08-04 | Connected IO v2.1.0 and prior has a stack-based buffer overflow vulnerability in its communication protocol, enabling attackers to take control over devices. |
CVE-2023-33374 | Critical | 9.8 | 2023-08-04 | Connected IO v2.1.0 and prior has a command as part of its communication protocol allowing the management platform to specify arbitrary OS commands for devices… |
CVE-2023-33373 | Critical | 9.8 | 2023-08-04 | Connected IO v2.1.0 and prior keeps passwords and credentials in clear-text format, allowing attackers to exfiltrate the credentials and use them to impersonat… |
CVE-2023-33372 | Critical | 9.8 | 2023-08-04 | Connected IO v2.1.0 and prior uses a hard-coded username/password pair embedded in their device's firmware used for device communication using MQTT. An attacke… |
CVE-2023-0264 | Medium | 5.0 | 2023-08-04 | A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain infor… |
CVE-2023-39143 | Critical | 9.8 | 2023-08-04 | PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files. This leads to remote… |
CVE-2023-39112 | Medium | 6.5 | 2023-08-04 | ECShop v4.1.16 contains an arbitrary file deletion vulnerability in the Admin Panel. |
CVE-2023-38691 | Medium | 5.0 | 2023-08-04 | matrix-appservice-bridge provides an API for setting up bridges. Starting in version 4.0.0 and prior to versions 8.1.2 and 9.0.1, a malicious Matrix server can… |
CVE-2023-38690 | Medium | 5.8 | 2023-08-04 | matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it is possible to craft a command with newlines which would not be properly p… |
CVE-2023-38689 | High | 8.1 | 2023-08-04 | Logistics Pipes is a modification (a.k.a. mod) for the computer game Minecraft Java Edition. The mod used Java's `ObjectInputStream#readObject` on untrusted da… |
CVE-2023-38688 | High | 7.5 | 2023-08-04 | twitch-tui provides Twitch chat in a terminal. Prior to version 2.4.1, the connection is not using TLS for communication. In the configuration of the irc conne… |
CVE-2023-38964 | Medium | 6.1 | 2023-08-04 | Creative Item Academy LMS 6.0 was discovered to contain a cross-site scripting (XSS) vulnerability. |
CVE-2023-38686 | Critical | 9.3 | 2023-08-04 | Sydent is an identity server for the Matrix communications protocol. Prior to version 2.5.6, if configured to send emails using TLS, Sydent does not verify SMT… |
CVE-2023-38497 | High | 7.9 | 2023-08-04 | Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not res… |
CVE-2023-38494 | Medium | 5.9 | 2023-08-04 | MeterSphere is an open-source continuous testing platform. Prior to version 2.10.4 LTS, some interfaces of the Cloud version of MeterSphere do not have configu… |
CVE-2023-38487 | Medium | 6.5 | 2023-08-04 | HedgeDoc is software for creating real-time collaborative markdown notes. Prior to version 1.9.9, the API of HedgeDoc 1 can be used to create notes with an ali… |
CVE-2023-37896 | High | 7.5 | 2023-08-04 | Nuclei is a vulnerability scanner. Prior to version 2.9.9, a security issue in the Nuclei project affected users utilizing Nuclei as Go code (SDK) running cust… |
CVE-2023-37470 | Critical | 10.0 | 2023-08-04 | Metabase is an open-source business intelligence and analytics platform. Prior to versions 0.43.7.3, 0.44.7.3, 0.45.4.3, 0.46.6.4, 1.43.7.3, 1.44.7.3, 1.45.4.3… |
CVE-2023-36480 | Critical | 9.8 | 2023-08-04 | The Aerospike Java client is a Java application that implements a network protocol to communicate with an Aerospike server. Prior to versions 7.0.0, 6.2.0, 5.2… |
CVE-2023-29689 | Critical | 9.8 | 2023-08-04 | PyroCMS 3.9 contains a remote code execution (RCE) vulnerability that can be exploited through a server-side template injection (SSTI) flaw. This vulnerability… |
CVE-2023-29505 | Medium | 4.3 | 2023-08-04 | An issue was discovered in Zoho ManageEngine Network Configuration Manager 12.6.165. The WebSocket endpoint allows Cross-site WebSocket hijacking. |
CVE-2023-4135 | Medium | 6.0 | 2023-08-04 | A heap out-of-bounds memory read flaw was found in the virtual nvme device in QEMU. The QEMU process does not validate an offset provided by the guest before c… |
CVE-2023-34038 | Medium | 5.3 | 2023-08-04 | VMware Horizon Server contains an information disclosure vulnerability. A malicious actor with network access may be able to access information relating to the… |
CVE-2023-34037 | Medium | 5.3 | 2023-08-04 | VMware Horizon Server contains a HTTP request smuggling vulnerability. A malicious actor with network access may be able to perform HTTP smuggle requests. |
CVE-2023-39379 | High | 7.5 | 2023-08-04 | Fujitsu Software Infrastructure Manager (ISM) stores sensitive information at the product's maintenance data (ismsnap) in cleartext form. As a result, the pass… |
CVE-2023-4142 | High | 8.0 | 2023-08-04 | The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus1' parameter. Th… |
CVE-2023-4141 | High | 8.0 | 2023-08-04 | The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus2' parameter. Th… |
CVE-2023-4140 | Medium | 6.6 | 2023-08-04 | The WP Ultimate CSV Importer plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 7.9.8 due to insufficient restriction… |
CVE-2023-4139 | High | 7.5 | 2023-08-04 | The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Sensitive Information Exposure via Directory Listing due to missing restriction in export f… |
CVE-2023-4002 | Medium | 5.3 | 2023-08-04 | An issue has been discovered in GitLab EE affecting all versions starting from 14.1 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions… |
CVE-2023-39343 | Medium | 4.3 | 2023-08-04 | Sulu is an open-source PHP content management system based on the Symfony framework. It allows over the Admin Login form to detect which user (username, email)… |
CVE-2023-38708 | Medium | 6.3 | 2023-08-04 | Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce. A path traversal vulnerability exists in the `… |
CVE-2023-30146 | High | 7.5 | 2023-08-04 | Assmann Digitus Plug&View IP Camera HT-IP211HDP, version 2.000.022 allows unauthenticated attackers to download a copy of the camera's settings and the adminis… |
CVE-2023-3373 | Medium | 5.9 | 2023-08-04 | Predictable Exact Value from Previous Values vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT21 model versions 01.49.000 and prior and GOT SI… |
CVE-2023-38991 | Medium | 5.4 | 2023-08-04 | An issue in the delete function in the ActModelController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete models created by the Ad… |
CVE-2023-38941 | Critical | 9.8 | 2023-08-04 | django-sspanel v2022.2.2 was discovered to contain a remote command execution (RCE) vulnerability via the component sspanel/admin_view.py -> GoodsCreateView._p… |
CVE-2023-36159 | Medium | 6.1 | 2023-08-04 | Cross Site Scripting (XSS) vulnerability in sourcecodester Lost and Found Information System 1.0 allows remote attackers to run arbitrary code via the First Na… |
CVE-2023-36158 | Medium | 6.1 | 2023-08-04 | Cross Site Scripting (XSS) vulnerability in sourcecodester Toll Tax Management System 1.0 allows remote attackers to run arbitrary code via the First Name and… |
CVE-2023-36141 | Medium | 5.3 | 2023-08-04 | User enumeration is found in in PHPJabbers Cleaning Business Software 1.0. This issue occurs during password recovery, where a difference in messages could all… |
CVE-2023-36139 | Critical | 9.8 | 2023-08-04 | In PHPJabbers Cleaning Business Software 1.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers… |
CVE-2023-36138 | Medium | 6.1 | 2023-08-04 | PHPJabbers Cleaning Business Software 1.0 is vulnerable to Cross Site Scripting (XSS) via the theme parameter of preview.php. |
CVE-2023-36137 | Medium | 6.1 | 2023-08-04 | There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Class Scheduling System 1.0. |
CVE-2023-36135 | High | 7.5 | 2023-08-04 | User enumeration is found in in PHPJabbers Class Scheduling System v1.0. This issue occurs during password recovery, where a difference in messages could allow… |
CVE-2023-36134 | Critical | 9.8 | 2023-08-04 | In PHP Jabbers Class Scheduling System 1.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers t… |
CVE-2023-36133 | Critical | 9.8 | 2023-08-04 | PHPJabbers Availability Booking Calendar 5.0 is vulnerable to User Account Takeover through username/password change. |
CVE-2023-36132 | Critical | 9.8 | 2023-08-04 | PHP Jabbers Availability Booking Calendar 5.0 is vulnerable to Incorrect Access Control. |
CVE-2023-36131 | Critical | 9.8 | 2023-08-04 | PHPJabbers Availability Booking Calendar 5.0 is vulnerable to Incorrect Access Control due to improper input validation of password parameter. |
CVE-2023-33665 | Critical | 9.8 | 2023-08-04 | ai-dev aitable before v0.2.2 was discovered to contain a SQL injection vulnerability via the component /includes/ajax.php. |
CVE-2023-30297 | High | 7.0 | 2023-08-04 | An issue found in N-able Technologies N-central Server before 2023.4 allows a local attacker to execute arbitrary code via the monitoring function of the serve… |
CVE-2023-0525 | High | 7.5 | 2023-08-04 | Weak Encoding for Password vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.49.000 and prior, GT25 model versions 01.49.0… |