2023 CVEs (page 187)
Page 187 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-38952 | High | 7.5 | 2023-08-03 | Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that session ids are not va… |
CVE-2023-38951 | Critical | 9.8 | 2023-08-03 | ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the server via crafted… |
CVE-2023-38950 | High | 7.5 | 2023-08-03 | A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payl… |
CVE-2023-38949 | High | 7.5 | 2023-08-03 | An issue in a hidden API in ZKTeco BioTime v8.5.5 allows unauthenticated attackers to arbitrarily reset the Administrator password via a crafted web request. |
CVE-2023-37501 | High | 8.1 | 2023-08-03 | A Persistent XSS vulnerability can be carried out in a certain field of Unica Campaign. An attacker could hijack a user's session and perform other attacks. |
CVE-2023-37500 | High | 8.1 | 2023-08-03 | A Persistent Cross-site Scripting (XSS) vulnerability can be carried out on certain pages of Unica Platform. An attacker could hijack a user's session and per… |
CVE-2023-37499 | High | 8.1 | 2023-08-03 | A Persistent Cross-site Scripting (XSS) vulnerability can be carried out in a certain field of the Unica Platform. An attacker could hijack a user's session a… |
CVE-2023-37498 | High | 8.1 | 2023-08-03 | A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator. It is possible that an attacker could pot… |
CVE-2023-37497 | High | 8.1 | 2023-08-03 | The Unica application exposes an API which accepts arbitrary XML input. By manipulating the given XML, an authenticated attacker with certain rights can succes… |
CVE-2023-30958 | Medium | 4.7 | 2023-08-03 | A security defect was identified in Foundry Frontend that enabled users to potentially conduct DOM XSS attacks if Foundry's CSP were to be bypassed. This defe… |
CVE-2023-30952 | Medium | 5.0 | 2023-08-03 | A security defect was discovered in Foundry Issues that enabled users to create convincing phishing links by editing the request sent when creating an Issue. T… |
CVE-2023-30951 | Medium | 6.3 | 2023-08-03 | The Foundry Magritte plugin rest-source was found to be vulnerable to an an XML external Entity attack (XXE). |
CVE-2023-30950 | Medium | 6.5 | 2023-08-03 | The foundry campaigns service was found to be vulnerable to an unauthenticated information disclosure in a rest endpoint |
CVE-2023-20218 | Medium | 5.8 | 2023-08-03 | A vulnerability in web-based management interface of Cisco SPA500 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to to m… |
CVE-2023-20216 | Medium | 4.4 | 2023-08-03 | A vulnerability in the privilege management functionality of all Cisco BroadWorks server types could allow an authenticated, local attacker to elevate privileg… |
CVE-2023-20215 | Medium | 5.8 | 2023-08-03 | A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to bypass a co… |
CVE-2023-20214 | Critical | 9.1 | 2023-08-03 | A vulnerability in the request authentication validation for the REST API of Cisco SD-WAN vManage software could allow an unauthenticated, remote attacker to g… |
CVE-2023-20204 | Medium | 5.4 | 2023-08-03 | A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker to condu… |
CVE-2023-20181 | Medium | 6.1 | 2023-08-03 | A vulnerability in the web-based management interface of Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to conduc… |
CVE-2023-3749 | High | 7.1 | 2023-08-03 | A local user could edit the VideoEdge configuration file and interfere with VideoEdge operation. |
CVE-2023-39121 | High | 7.2 | 2023-08-03 | emlog v2.1.9 was discovered to contain a SQL injection vulnerability via the component /admin/user.php. |
CVE-2023-33666 | Critical | 9.8 | 2023-08-03 | ai-dev aioptimizedcombinations before v0.1.3 was discovered to contain a SQL injection vulnerability via the component /includes/ajax.php. |
CVE-2023-38942 | Critical | 9.8 | 2023-08-03 | Dango-Translator v4.5.5 was discovered to contain a remote command execution (RCE) vulnerability via the component app/config/cloud_config.json. |
CVE-2023-0956 | High | 7.5 | 2023-08-03 | External input could be used on TEL-STER TelWin SCADA WebInterface to construct paths to files and directories without properly neutralizing special elements… |
CVE-2023-39075 | Medium | 4.6 | 2023-08-03 | Renault Zoe EV 2021 automotive infotainment system versions 283C35202R to 283C35519R (builds 11.10.2021 to 16.01.2023) allows attackers to crash the infotainme… |
CVE-2023-36217 | Critical | 9.0 | 2023-08-03 | Cross Site Scripting vulnerability in Xoops CMS v.2.5.10 allows a remote attacker to execute arbitrary code via the category name field of the image manager fu… |
CVE-2023-35081 | High | 7.2 | 2023-08-03 | A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticated administrator to… |
CVE-2023-32764 | High | 7.8 | 2023-08-03 | Fabasoft Cloud Enterprise Client 23.3.0.130 allows a user to escalate their privileges to local administrator. |
CVE-2023-4145 | Medium | 5.4 | 2023-08-03 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/customer-data-framework prior to 3.4.2. |
CVE-2023-36213 | Critical | 9.8 | 2023-08-03 | SQL injection vulnerability in MotoCMS v.3.4.3 allows a remote attacker to gain privileges via the keyword parameter of the search function. |
CVE-2023-25524 | Medium | 4.0 | 2023-08-03 | NVIDIA Omniverse Workstation Launcher for Windows and Linux contains a vulnerability in the authentication flow, where a user’s access token is displayed in t… |
CVE-2023-38948 | High | 7.2 | 2023-08-03 | An arbitrary file download vulnerability in the /c/PluginsController.php component of jizhi CMS 1.9.5 allows attackers to execute arbitrary code via downloadin… |
CVE-2023-38947 | High | 7.2 | 2023-08-03 | An arbitrary file upload vulnerability in the /languages/install.php component of WBCE CMS v1.6.1 allows attackers to execute arbitrary code via a crafted PHP… |
CVE-2023-33366 | High | 8.8 | 2023-08-03 | A SQL injection vulnerability exists in Suprema BioStar 2 before 2.9.1, which allows authenticated users to inject arbitrary SQL directives into an SQL stateme… |
CVE-2023-33365 | High | 7.5 | 2023-08-03 | A path traversal vulnerability exists in Suprema BioStar 2 before 2.9.1, which allows unauthenticated attackers to fetch arbitrary files from the server's web… |
CVE-2023-33364 | High | 8.8 | 2023-08-03 | An OS Command injection vulnerability exists in Suprema BioStar 2 before V2.9.1, which allows authenticated users to execute arbitrary OS commands on the BioSt… |
CVE-2023-33363 | High | 7.5 | 2023-08-03 | An authentication bypass vulnerability exists in Suprema BioStar 2 before 2.9.1, which allows unauthenticated users to access some functionality on BioStar 2 s… |
CVE-2023-4138 | Medium | 6.5 | 2023-08-03 | Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.8.0. |
CVE-2023-4136 | High | 7.4 | 2023-08-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64… |
CVE-2023-4133 | Medium | 5.5 | 2023-08-03 | A use-after-free vulnerability was found in the cxgb4 driver in the Linux kernel. The bug occurs when the cxgb4 device is detaching due to a possible rearming… |
CVE-2023-4132 | Medium | 5.5 | 2023-08-03 | A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs during device initialization when the siano device is p… |
CVE-2023-3766 | Medium | 5.9 | 2023-08-03 | A vulnerability was discovered in the odoh-rs rust crate that stems from faulty logic during the parsing of encrypted queries. This issue specifically occurs w… |
CVE-2023-3348 | Medium | 5.7 | 2023-08-03 | The Wrangler command line tool (<=wrangler@3.1.0 or <=wrangler@2.20.1) was affected by a directory traversal vulnerability when running a local development se… |
CVE-2023-3180 | Medium | 6.0 | 2023-08-03 | A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtio_crypto_handle_sym_req. There is no check for th… |
CVE-2023-39097 | Medium | 5.4 | 2023-08-03 | WebBoss.io CMS v3.7.0.1 contains a stored cross-site scripting (XSS) vulnerability. |
CVE-2023-39096 | Medium | 5.4 | 2023-08-03 | WebBoss.io CMS v3.7.0.1 contains a stored Cross-Site Scripting (XSS) vulnerability due to lack of input validation and output encoding. |
CVE-2023-36299 | High | 8.8 | 2023-08-03 | A File Upload vulnerability in typecho v.1.2.1 allows a remote attacker to execute arbitrary code via the upload and options-general parameters in index.php. |
CVE-2023-36298 | High | 8.8 | 2023-08-03 | DedeCMS v5.7.109 has a File Upload vulnerability, leading to remote code execution (RCE). |
CVE-2023-2754 | High | 7.4 | 2023-08-03 | The Cloudflare WARP client for Windows assigns loopback IPv4 addresses for the DNS Servers, since WARP acts as local DNS server that performs DNS queries in a… |
CVE-2023-28468 | Medium | 6.5 | 2023-08-03 | An issue was discovered in FvbServicesRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. The FvbServicesRuntimeDxe SMM module exposes an SMI handler t… |
CVE-2023-25600 | High | 7.1 | 2023-08-03 | An issue was discovered in InsydeH2O. A malicious operating system can tamper with a runtime-writable EFI variable, leading to out-of-bounds memory reads and a… |
CVE-2023-22277 | High | 7.8 | 2023-08-03 | Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or ar… |
CVE-2023-22317 | High | 7.8 | 2023-08-03 | Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or ar… |
CVE-2023-22314 | High | 7.8 | 2023-08-03 | Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or ar… |
CVE-2023-3669 | Low | 3.3 | 2023-08-03 | A missing Brute-Force protection in CODESYS Development System prior to 3.5.19.20 allows a local attacker to have unlimited attempts of guessing the password w… |
CVE-2023-37559 | Medium | 6.5 | 2023-08-03 | After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent… |
CVE-2023-37558 | Medium | 6.5 | 2023-08-03 | After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent… |
CVE-2023-37557 | Medium | 6.5 | 2023-08-03 | After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted remote communication requests can cause the CmpAp… |
CVE-2023-37556 | Medium | 6.5 | 2023-08-03 | In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent… |
CVE-2023-37555 | Medium | 6.5 | 2023-08-03 | In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent… |
CVE-2023-37554 | Medium | 6.5 | 2023-08-03 | In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent… |
CVE-2023-37553 | Medium | 6.5 | 2023-08-03 | In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent… |
CVE-2023-37552 | Medium | 6.5 | 2023-08-03 | In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent… |
CVE-2023-37551 | Medium | 6.5 | 2023-08-03 | In multiple Codesys products in multiple versions, after successful authentication as a user, specially crafted network communication requests can utilize the… |
CVE-2023-37550 | Medium | 6.5 | 2023-08-03 | In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent… |
CVE-2023-37549 | Medium | 6.5 | 2023-08-03 | In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent… |
CVE-2023-37548 | Medium | 6.5 | 2023-08-03 | In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent… |
CVE-2023-37547 | Medium | 6.5 | 2023-08-03 | In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent… |
CVE-2023-37546 | Medium | 6.5 | 2023-08-03 | In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent… |
CVE-2023-3663 | High | 8.8 | 2023-08-03 | In CODESYS Development System versions from 3.5.11.20 and before 3.5.19.20 a missing integrity check might allow an unauthenticated remote attacker to manipula… |
CVE-2023-3662 | High | 7.3 | 2023-08-03 | In CODESYS Development System versions from 3.5.17.0 and prior to 3.5.19.20 a vulnerability allows for execution of binaries from the current working directory… |
CVE-2023-37545 | Medium | 6.5 | 2023-08-03 | In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent… |
CVE-2023-4121 | Medium | 6.3 | 2023-08-03 | A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230722. It has been classified as critical. Affected is an unknown function. The man… |
CVE-2023-4120 | Medium | 6.3 | 2023-08-03 | A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230722 and classified as critical. This issue affects some unknown processing of the… |
CVE-2023-4119 | Medium | 4.3 | 2023-08-03 | A vulnerability has been found in Academy LMS 6.0 and classified as problematic. This vulnerability affects unknown code of the file /academy/home/courses. The… |
CVE-2023-4118 | Low | 3.5 | 2023-08-03 | A vulnerability, which was classified as problematic, was found in Cute Http File Server 2.0. This affects an unknown part of the component Search. The manipul… |
CVE-2023-4117 | Medium | 4.3 | 2023-08-03 | A vulnerability, which was classified as problematic, has been found in PHP Jabbers Rental Property Booking 2.0. Affected by this issue is some unknown functio… |
CVE-2023-4116 | Medium | 4.3 | 2023-08-03 | A vulnerability classified as problematic was found in PHP Jabbers Taxi Booking 2.0. Affected by this vulnerability is an unknown functionality of the file /in… |
CVE-2023-4008 | Medium | 5.3 | 2023-08-03 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versio… |
CVE-2023-21412 | High | 7.2 | 2023-08-03 | User provided input is not sanitized on the AXIS License Plate Verifier specific “search.cgi” allowing for SQL injections. |
CVE-2023-21411 | High | 7.2 | 2023-08-03 | User provided input is not sanitized in the “Settings > Access Control” configuration interface allowing for arbitrary code execution. |
CVE-2023-21410 | High | 7.2 | 2023-08-03 | User provided input is not sanitized on the AXIS License Plate Verifier specific “api.cgi” allowing for arbitrary code execution. |
CVE-2023-21409 | High | 8.4 | 2023-08-03 | Due to insufficient file permissions, unprivileged users could gain access to unencrypted administrator credentials allowing the configuration of the applicat… |
CVE-2023-21408 | High | 8.4 | 2023-08-03 | Due to insufficient file permissions, unprivileged users could gain access to unencrypted user credentials that are used in the integration interface towards… |
CVE-2023-21407 | High | 8.8 | 2023-08-03 | A broken access control was found allowing for privileged escalation of the operator account to gain administrator privileges. |
CVE-2023-4115 | Medium | 4.3 | 2023-08-03 | A vulnerability classified as problematic has been found in PHP Jabbers Cleaning Business 1.0. Affected is an unknown function of the file /index.php. The mani… |
CVE-2023-4114 | Medium | 4.3 | 2023-08-03 | A vulnerability was found in PHP Jabbers Night Club Booking Software 1.0. It has been rated as problematic. This issue affects some unknown processing of the f… |
CVE-2023-38748 | High | 7.8 | 2023-08-03 | Use after free vulnerability exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By having a user open a specially crafted CXP file… |
CVE-2023-38747 | High | 7.8 | 2023-08-03 | Heap-based buffer overflow vulnerability exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By having a user open a specially craft… |
CVE-2023-4113 | Medium | 4.3 | 2023-08-03 | A vulnerability was found in PHP Jabbers Service Booking Script 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /… |
CVE-2023-4112 | Medium | 4.3 | 2023-08-03 | A vulnerability was found in PHP Jabbers Shuttle Booking Software 1.0. It has been classified as problematic. This affects an unknown part of the file /index.p… |
CVE-2023-3932 | High | 8.2 | 2023-08-03 | An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions… |
CVE-2023-3346 | Critical | 9.8 | 2023-08-03 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in MITSUBSHI CNC Series allows a remote unauthenticated attacker to cause… |
CVE-2023-38746 | High | 7.8 | 2023-08-03 | Out-of-bounds read vulnerability/issue exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By having a user open a specially crafted… |
CVE-2023-38744 | High | 7.5 | 2023-08-03 | Denial-of-service (DoS) vulnerability due to improper validation of specified type of input issue exists in the built-in EtherNet/IP port of the CJ Series CJ2… |
CVE-2023-4127 | Medium | 5.9 | 2023-08-03 | Race Condition within a Thread in GitHub repository answerdev/answer prior to v1.1.1. |
CVE-2023-4126 | High | 8.8 | 2023-08-03 | Insufficient Session Expiration in GitHub repository answerdev/answer prior to v1.1.0. |
CVE-2023-4125 | High | 8.8 | 2023-08-03 | Weak Password Requirements in GitHub repository answerdev/answer prior to v1.1.0. |
CVE-2023-4124 | Medium | 6.5 | 2023-08-03 | Missing Authorization in GitHub repository answerdev/answer prior to v1.1.1. |
CVE-2023-4111 | Medium | 4.3 | 2023-08-03 | A vulnerability was found in PHP Jabbers Bus Reservation System 1.1 and classified as problematic. Affected by this issue is some unknown functionality of the… |