2023 CVEs (page 189)
Page 189 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-3730 | High | 8.8 | 2023-08-01 | Use after free in Tab Groups in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who convinced a user to engage in specific UI interactions to po… |
CVE-2023-3729 | High | 8.8 | 2023-08-01 | Use after free in Splitscreen in Google Chrome on ChromeOS prior to 115.0.5790.131 allowed a remote attacker who convinced a user to engage in specific UI inte… |
CVE-2023-3728 | High | 8.8 | 2023-08-01 | Use after free in WebRTC in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2023-3727 | High | 8.8 | 2023-08-01 | Use after free in WebRTC in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2023-3494 | High | 8.8 | 2023-08-01 | The fwctl driver implements a state machine which is executed when a bhyve guest accesses certain x86 I/O ports. The interface lets the guest copy a string in… |
CVE-2023-3107 | High | 7.5 | 2023-08-01 | A set of carefully crafted ipv6 packets can trigger an integer overflow in the calculation of a fragment reassembled packet's payload length field. This allows… |
CVE-2023-36351 | High | 7.8 | 2023-08-01 | An issue in Viatom Health ViHealth for Android v.2.74.58 and before allows a remote attacker to execute arbitrary code via the com.viatom.baselib.mvvm.webWebVi… |
CVE-2023-36118 | Medium | 5.4 | 2023-08-01 | Cross Site Scripting vulnerability in Faculty Evaulation System using PHP/MySQLi v.1.0 allows an attacker to execute arbitrary code via a crafted payload to th… |
CVE-2023-34869 | Medium | 6.1 | 2023-08-01 | PHPJabbers Catering System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /index.php?controller=pjAdmin&action=pjA… |
CVE-2023-33564 | Medium | 6.1 | 2023-08-01 | There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Time Slots Booking Calendar v3.3. |
CVE-2023-33563 | High | 8.8 | 2023-08-01 | In PHP Jabbers Time Slots Booking Calendar 3.3 , lack of verification when changing an email address and/or password (on the Profile Page) allows remote attack… |
CVE-2023-33562 | Critical | 9.8 | 2023-08-01 | User enumeration is found in in PHP Jabbers Time Slots Booking Calendar v3.3. This issue occurs during password recovery, where a difference in messages could… |
CVE-2023-33561 | Critical | 9.8 | 2023-08-01 | Improper input validation of password parameter in PHP Jabbers Time Slots Booking Calendar v 3.3 results in insecure passwords. |
CVE-2023-33560 | Medium | 6.1 | 2023-08-01 | There is a Cross Site Scripting (XSS) vulnerability in "cid" parameter of preview.php in PHPJabbers Time Slots Booking Calendar v3.3. |
CVE-2023-31427 | High | 7.8 | 2023-08-01 | Brocade Fabric OS versions before Brocade Fabric OS v9.1.1c, and v9.2.0 Could allow an authenticated, local user with knowledge of full path names inside Broca… |
CVE-2023-31426 | Medium | 6.8 | 2023-08-01 | The Brocade Fabric OS Commands “configupload” and “configdownload” before Brocade Fabric OS v9.1.1c, v8.2.3d, v9.2.0 print scp, sftp, ftp servers passwords… |
CVE-2023-31429 | Medium | 5.5 | 2023-08-01 | Brocade Fabric OS before Brocade Fabric OS 9.1.1c, 9.2.0 contains a vulnerability when using various commands such as “chassisdistribute”, “reboot”, “rasman”… |
CVE-2023-31425 | High | 7.8 | 2023-08-01 | A vulnerability in the fosexec command of Brocade Fabric OS after Brocade Fabric OS v9.1.0 and, before Brocade Fabric OS v9.1.1 could allow a local authenticat… |
CVE-2023-3718 | High | 8.8 | 2023-08-01 | An authenticated command injection vulnerability exists in the AOS-CX command line interface. Successful exploitation of this vulnerability results in the abi… |
CVE-2023-20583 | Medium | 4.7 | 2023-08-01 | A potential power side-channel vulnerability in AMD processors may allow an authenticated attacker to monitor the CPU power consumption as the data in a cache… |
CVE-2023-39147 | High | 7.8 | 2023-08-01 | An arbitrary file upload vulnerability in Uvdesk 1.1.3 allows attackers to execute arbitrary code via uploading a crafted image file. |
CVE-2023-34552 | High | 8.8 | 2023-08-01 | In certain EZVIZ products, two stack based buffer overflows in mulicast_parse_sadp_packet and mulicast_get_pack_type functions of the SADP multicast protocol c… |
CVE-2023-34551 | High | 8.0 | 2023-08-01 | In certain EZVIZ products, two stack buffer overflows in netClientSetWlanCfg function of the EZVIZ SDK command server can allow an authenticated attacker prese… |
CVE-2023-38560 | Medium | 5.5 | 2023-08-01 | An integer overflow flaw was found in pcl/pl/plfont.c:418 in pl_glyph_name in ghostscript. This issue may allow a local attacker to cause a denial of service v… |
CVE-2023-38559 | Medium | 5.5 | 2023-08-01 | A buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle() in ghostscript. This issue may allow a local attacker to cause a denial of ser… |
CVE-2023-36211 | Medium | 5.4 | 2023-08-01 | The Barebones CMS v2.0.2 is vulnerable to Stored Cross-Site Scripting (XSS) when an authenticated user interacts with certain features on the admin panel. |
CVE-2023-36210 | Critical | 9.8 | 2023-08-01 | MotoCMS Version 3.4.3 Store Category Template was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the keyword parameter. |
CVE-2023-33493 | Critical | 9.8 | 2023-08-01 | An Unrestricted Upload of File with Dangerous Type vulnerability in the Ajaxmanager File and Database explorer (ajaxmanager) module for PrestaShop through 2.3… |
CVE-2023-4058 | Critical | 9.8 | 2023-08-01 | Memory safety bugs present in Firefox 115. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could h… |
CVE-2023-4057 | Critical | 9.8 | 2023-08-01 | Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0. Some of these bugs showed evidence of memory corruption and we presume tha… |
CVE-2023-4056 | Critical | 9.8 | 2023-08-01 | Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 102.13. Some of these bugs showed evidence… |
CVE-2023-4055 | High | 7.5 | 2023-08-01 | When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no longer consistent with expected cookie j… |
CVE-2023-4054 | Medium | 5.5 | 2023-08-01 | When opening appref-ms files, Firefox did not warn the user that these files may contain malicious code. *This bug only affects Firefox on Windows. Other oper… |
CVE-2023-4053 | Medium | 6.5 | 2023-08-01 | A website could have obscured the full screen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have l… |
CVE-2023-4052 | Medium | 6.5 | 2023-08-01 | The Firefox updater created a directory writable by non-privileged users. When uninstalling Firefox, any files in that directory would be recursively deleted w… |
CVE-2023-4051 | High | 7.5 | 2023-08-01 | A website could have obscured the full screen notification by using the file open dialog. This could have led to user confusion and possible spoofing attacks… |
CVE-2023-4050 | High | 7.5 | 2023-08-01 | In some cases, an untrusted input stream was copied to a stack buffer without checking its size. This resulted in a potentially exploitable crash which could h… |
CVE-2023-4049 | Medium | 5.9 | 2023-08-01 | Race conditions in reference counting code were found through code inspection. These could have resulted in potentially exploitable use-after-free vulnerabilit… |
CVE-2023-4048 | High | 7.5 | 2023-08-01 | An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations. This vulnerability affects Firefox < 11… |
CVE-2023-4047 | High | 8.8 | 2023-08-01 | A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affect… |
CVE-2023-4046 | Medium | 5.3 | 2023-08-01 | In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect compilation and a potentially… |
CVE-2023-4045 | Medium | 5.3 | 2023-08-01 | Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from another site in violation of same-origin po… |
CVE-2023-38357 | Medium | 5.3 | 2023-08-01 | Session tokens in RWS WorldServer 11.7.3 and earlier have a low entropy and can be enumerated, leading to unauthorized access to user sessions. |
CVE-2023-39110 | High | 8.8 | 2023-08-01 | rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path parameter at /ajaxGetFileByPath.php. This vulnerability allows authe… |
CVE-2023-39109 | High | 8.8 | 2023-08-01 | rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_a parameter in the doDiff Function of /classes/compareClass.php. Thi… |
CVE-2023-39108 | High | 8.8 | 2023-08-01 | rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_b parameter in the doDiff Function of /classes/compareClass.php. Thi… |
CVE-2023-34634 | High | 7.8 | 2023-08-01 | Greenshot 1.2.10 and below allows arbitrary code execution because .NET content is insecurely deserialized when a .greenshot file is opened. |
CVE-2023-31710 | Critical | 9.8 | 2023-08-01 | TP-Link Archer AX21(US)_V3_1.1.4 Build 20230219 and AX21(US)_V3.6_1.1.4 Build 20230219 are vulnerable to Buffer Overflow. |
CVE-2023-37478 | High | 7.5 | 2023-08-01 | pnpm is a package manager. It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when installed via pnpm is… |
CVE-2023-23548 | Medium | 5.4 | 2023-08-01 | Reflected XSS in business intelligence in Checkmk <2.2.0p8, <2.1.0p32, <2.0.0p38, <=1.6.0p30. |
CVE-2023-26139 | High | 7.5 | 2023-08-01 | Versions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the setProperty() function. Exploiting th… |
CVE-2023-36984 | High | 7.5 | 2023-08-01 | LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure. |
CVE-2023-36983 | High | 7.5 | 2023-08-01 | LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure. |
CVE-2023-34960 | Critical | 9.8 | 2023-08-01 | A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API… |
CVE-2023-4033 | High | 7.8 | 2023-08-01 | OS Command Injection in GitHub repository mlflow/mlflow prior to 2.6.0. |
CVE-2023-37772 | High | 8.8 | 2023-08-01 | Online Shopping Portal Project v3.1 was discovered to contain a SQL injection vulnerability via the Email parameter at /shopping/login.php. |
CVE-2023-37496 | High | 8.3 | 2023-08-01 | HCL Verse is susceptible to a Stored Cross Site Scripting (XSS) vulnerability. An attacker could execute script in a victim's web browser to perform operation… |
CVE-2023-3825 | High | 7.5 | 2023-07-31 | PTC’s KEPServerEX Versions 6.0 to 6.14.263 are vulnerable to being made to read a recursively defined object that leads to uncontrolled resource consumption… |
CVE-2023-3462 | Medium | 5.3 | 2023-07-31 | HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-… |
CVE-2023-39122 | Critical | 9.8 | 2023-07-31 | BMC Control-M through 9.0.20.200 allows SQL injection via the /RF-Server/report/deleteReport report-id parameter. This is fixed in 9.0.21 (and is also fixed by… |
CVE-2023-3983 | High | 8.8 | 2023-07-31 | An authenticated SQL injection vulnerability exists in Advantech iView versions prior to v5.7.4 build 6752. An authenticated remote attacker can bypass checks… |
CVE-2023-38989 | Medium | 4.3 | 2023-07-31 | An issue in the delete function in the UserController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete the Administrator's role inf… |
CVE-2023-4010 | Medium | 4.6 | 2023-07-31 | A flaw was found in the USB Host Controller Driver framework in the Linux kernel. The usb_giveback_urb function has a logic loophole in its implementation. Due… |
CVE-2023-4004 | High | 7.8 | 2023-07-31 | A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_E… |
CVE-2023-3997 | High | 8.6 | 2023-07-31 | Splunk SOAR versions lower than 6.1.0 are indirectly affected by a potential vulnerability accessed through the user’s terminal. A third party can send Splunk… |
CVE-2023-3817 | Medium | 5.3 | 2023-07-31 | Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex()… |
CVE-2023-38750 | High | 7.5 | 2023-07-31 | In Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41, 9 before 9.0.0 Patch 34, and 10 before 10.0.2, internal JSP and XML files can be exposed. |
CVE-2023-37771 | Critical | 9.8 | 2023-07-31 | Art Gallery Management System v1.0 contains a SQL injection vulnerability via the cid parameter at /agms/product.php. |
CVE-2023-37580 | Medium | 6.1 | 2023-07-31 | Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client. |
CVE-2023-34917 | Medium | 6.1 | 2023-07-31 | Fuge CMS v1.0 contains an Open Redirect vulnerability in member/RegisterAct.java. |
CVE-2023-34916 | Medium | 6.1 | 2023-07-31 | Fuge CMS v1.0 contains an Open Redirect vulnerability via /front/ProcessAct.java. |
CVE-2023-38311 | Medium | 5.4 | 2023-07-31 | An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the System Logs Viewer functionality. The vulnerab… |
CVE-2023-38310 | Medium | 5.4 | 2023-07-31 | An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the configuration settings of the system logs func… |
CVE-2023-38309 | Medium | 6.1 | 2023-07-31 | An issue was discovered in Webmin 2.021. A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the package search functionality. The vulnerabi… |
CVE-2023-38308 | Medium | 6.1 | 2023-07-31 | An issue was discovered in Webmin 2.021. A Cross-Site Scripting (XSS) vulnerability was discovered in the HTTP Tunnel functionality when handling third-party d… |
CVE-2023-38307 | Medium | 5.4 | 2023-07-31 | An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Users and Groups functionality. The vulnerabil… |
CVE-2023-38306 | Medium | 6.1 | 2023-07-31 | An issue was discovered in Webmin 2.021. A Cross-site Scripting (XSS) Bypass vulnerability was discovered in the file upload functionality. Normally, the appli… |
CVE-2023-38305 | Medium | 6.1 | 2023-07-31 | An issue was discovered in Webmin 2.021. The download functionality allows an attacker to exploit a Cross-Site Scripting (XSS) vulnerability. By providing a cr… |
CVE-2023-38304 | Medium | 5.4 | 2023-07-31 | An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Users and Groups functionality, allowing an at… |
CVE-2023-38303 | Medium | 5.4 | 2023-07-31 | An issue was discovered in Webmin 2.021. One can exploit a stored Cross-Site Scripting (XSS) attack to achieve Remote Command Execution (RCE) through the Users… |
CVE-2023-35792 | Medium | 5.4 | 2023-07-31 | Vound Intella Connect 2.6.0.3 is vulnerable to stored Cross-site Scripting (XSS). |
CVE-2023-35791 | Medium | 6.1 | 2023-07-31 | Vound Intella Connect 2.6.0.3 has an Open Redirect vulnerability. |
CVE-2023-36092 | Critical | 9.8 | 2023-07-31 | Authentication Bypass vulnerability in D-Link DIR-859 FW105b03 allows remote attackers to gain escalated privileges via via phpcgi_main. NOTE: This vulnerabili… |
CVE-2023-36091 | Critical | 9.8 | 2023-07-31 | Authentication Bypass vulnerability in D-Link DIR-895 FW102b07 allows remote attackers to gain escalated privileges via via function phpcgi_main in cgibin. NOT… |
CVE-2023-36090 | Critical | 9.8 | 2023-07-31 | Authentication Bypass vulnerability in D-Link DIR-885L FW102b01 allows remote attackers to gain escalated privileges via phpcgi. NOTE: This vulnerability only… |
CVE-2023-36089 | Critical | 9.8 | 2023-07-31 | Authentication Bypass vulnerability in D-Link DIR-645 firmware version 1.03 allows remote attackers to gain escalated privileges via function phpcgi_main in cg… |
CVE-2023-34872 | Medium | 5.5 | 2023-07-31 | A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in Outlin… |
CVE-2023-34842 | Critical | 9.8 | 2023-07-31 | Remote Code Execution vulnerability in DedeCMS through 5.7.109 allows remote attackers to run arbitrary code via crafted POST request to /dede/tpl.php. |
CVE-2023-34644 | Critical | 9.8 | 2023-07-31 | Remote code execution vulnerability in Ruijie Networks Product: RG-EW series home routers and repeaters EW_3.0(1)B11P204, RG-NBS and RG-S1930 series switches S… |
CVE-2023-34635 | Critical | 9.8 | 2023-07-31 | Wifi Soft Unibox Administration 3.0 and 3.1 is vulnerable to SQL Injection. The vulnerability occurs because of not validating or sanitizing the user input in… |
CVE-2023-33534 | High | 8.8 | 2023-07-31 | A Cross-Site Request Forgery (CSRF) in Guanzhou Tozed Kangwei Intelligent Technology ZLTS10G software version S10G_3.11.6 allows attackers to takeover user acc… |
CVE-2023-37647 | Critical | 9.8 | 2023-07-31 | SEMCMS v1.5 was discovered to contain a SQL injection vulnerability via the id parameter at /Ant_Suxin.php. |
CVE-2023-35861 | Critical | 9.8 | 2023-07-31 | A shell-injection vulnerability in email notifications on Supermicro motherboards (such as H12DST-B before 03.10.35) allows remote attackers to inject execute… |
CVE-2023-3508 | Medium | 6.5 | 2023-07-31 | The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when processing its tab actions, which could allow attackers to make logged in… |
CVE-2023-3507 | Medium | 6.5 | 2023-07-31 | The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when canceling pre-orders, which could allow attackers to make logged in admin… |
CVE-2023-3345 | Medium | 6.5 | 2023-07-31 | The LMS by Masteriyo WordPress plugin before 1.6.8 does not have proper authorization in one some of its REST API endpoints, making it possible for any student… |
CVE-2023-3292 | Medium | 6.1 | 2023-07-31 | The grid-kit-premium WordPress plugin before 2.2.0 does not escape some parameters as well as generated URLs before outputting them in attributes, leading to R… |
CVE-2023-3134 | Medium | 6.1 | 2023-07-31 | The Forminator WordPress plugin before 1.24.4 does not properly escape values that are being reflected inside form fields that use pre-populated query paramete… |
CVE-2023-3130 | Medium | 4.8 | 2023-07-31 | The Short URL WordPress plugin before 1.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2023-0602 | Medium | 6.1 | 2023-07-31 | The Twittee Text Tweet WordPress plugin through 1.0.8 does not properly escape POST values which are printed back to the user inside one of the plugin's admini… |