2023 CVEs (page 190)

Page 190 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.

All CVEs published in 2023 — newest first (page 190 of 307)
CVESeverityScorePublishedSummary
CVE-2023-34360High8.22023-07-31A stored cross-site scripting (XSS) issue was discovered within the Custom User Icons functionality of ASUS RT-AX88U running firmware versions 3.0.0.4.388.2311…
CVE-2023-34359High7.52023-07-31ASUS RT-AX88U's httpd is subject to an unauthenticated DoS condition. A remote attacker can send a specially crafted request to the device which causes the htt…
CVE-2023-34358High7.52023-07-31ASUS RT-AX88U's httpd is subject to an unauthenticated DoS condition. A remote attacker can send a specially crafted request to a device which contains a speci…
CVE-2023-24971High7.52023-07-31 IBM B2B Advanced Communications 1.0.0.0 and IBM Multi-Enterprise Integration Gateway 1.0.0.1 could allow a user to cause a denial of service due to the deseri…
CVE-2023-22595Medium5.42023-07-31IBM B2B Advanced Communications 1.0.0.0 and IBM Multi-Enterprise Integration Gateway 1.0.0.1 are vulnerable to cross-site scripting. This vulnerability allows…
CVE-2023-4007Medium5.42023-07-31Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.16.
CVE-2023-4006Critical9.82023-07-31Improper Neutralization of Formula Elements in a CSV File in GitHub repository thorsten/phpmyfaq prior to 3.1.16.
CVE-2023-4005Critical9.82023-07-31Insufficient Session Expiration in GitHub repository fossbilling/fossbilling prior to 0.5.5.
CVE-2023-35019High7.22023-07-31IBM Security Verify Governance, Identity Manager 10.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a spec…
CVE-2023-35016Medium6.52023-07-31IBM Security Verify Governance, Identity Manager 10.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially c…
CVE-2023-37219High7.32023-07-30 Tadiran Telecom Composit - CWE-1236: Improper Neutralization of Formula Elements in a CSV File
CVE-2023-37218High7.52023-07-30 Tadiran Telecom Aeonix - CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2023-37217Medium5.32023-07-30 Tadiran Telecom Aeonix - CWE-204: Observable Response Discrepancy
CVE-2023-37216High7.52023-07-30 AnaSystem SensMini M4 – Using the configuration tool, an authenticated user can cause Denial of Service for the device
CVE-2023-37215Medium6.22023-07-30 JBL soundbar multibeam 5.1 - CWE-798: Use of Hard-coded Credentials
CVE-2023-37214Critical9.82023-07-30 Heights Telecom ERO1xS-Pro Dual-Band FW version BZ_ERO1XP.025.
CVE-2023-37213High8.82023-07-30 Synel SYnergy Fingerprint Terminals - CWE-78: 'OS Command Injection'
CVE-2023-32227Critical9.82023-07-30 Synel SYnergy Fingerprint Terminals - CWE-798: Use of Hard-coded Credentials
CVE-2023-32226High8.32023-07-30 Sysaid - CWE-552: Files or Directories Accessible to External Parties -  Authenticated users may exfiltrate files from the server via an unspecified method…
CVE-2023-32225Critical9.82023-07-30 Sysaid - CWE-434: Unrestricted Upload of File with Dangerous Type -  A malicious user with administrative privileges may be able to upload a dangerous filety…
CVE-2023-36542High8.82023-07-29Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authentica…
CVE-2023-2314Medium6.52023-07-29Insufficient data validation in DevTools in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass navigation restrictions via a crafted HTML…
CVE-2023-2313High8.82023-07-29Inappropriate implementation in Sandbox in Google Chrome on Windows prior to 112.0.5615.49 allowed a remote attacker who had compromised the renderer process t…
CVE-2023-2311Medium6.52023-07-29Insufficient policy enforcement in File System API in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to bypass filesystem restrictions via a cr…
CVE-2023-3598High8.82023-07-28Out of bounds read and write in ANGLE in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HT…
CVE-2023-38988Medium4.32023-07-28An issue in the delete function in the OaNotifyController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete notifications created by…
CVE-2023-3488Low3.82023-07-28Uninitialized buffer in GBL parser in Silicon Labs GSDK v4.3.0 and earlier allows attacker to leak data from Secure stack via malformed GBL file.
CVE-2023-38685Medium4.32023-07-28Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branche…
CVE-2023-38684Medium5.32023-07-28Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branche…
CVE-2023-38498Medium4.32023-07-28Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branche…
CVE-2023-37906Medium4.32023-07-28Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branche…
CVE-2023-37904Low2.62023-07-28Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branche…
CVE-2023-39023Critical9.82023-07-28university compass v2.2.0 and below was discovered to contain a code injection vulnerability in the component org.compass.core.executor.DefaultExecutorManager…
CVE-2023-39022Critical9.82023-07-28oscore v2.2.6 and below was discovered to contain a code injection vulnerability in the component com.opensymphony.util.EJBUtils.createStateless. This vulnerab…
CVE-2023-39021Critical9.82023-07-28wix-embedded-mysql v4.6.1 and below was discovered to contain a code injection vulnerability in the component com.wix.mysql.distribution.Setup.apply. This vuln…
CVE-2023-39020Critical9.82023-07-28stanford-parser v3.9.2 and below was discovered to contain a code injection vulnerability in the component edu.stanford.nlp.io.getBZip2PipedInputStream. This v…
CVE-2023-39018Critical9.82023-07-28FFmpeg 0.7.0 and below was discovered to contain a code injection vulnerability in the component net.bramp.ffmpeg.FFmpeg.<constructor>. This vulnerability is e…
CVE-2023-39017Critical9.82023-07-28quartz-jobs 2.3.2 and below was discovered to contain a code injection vulnerability in the component org.quartz.jobs.ee.jms.SendQueueMessageJob.execute. This…
CVE-2023-39016Critical9.82023-07-28bboss-persistent v6.0.9 and below was discovered to contain a code injection vulnerability in the component com.frameworkset.common.poolman.util.SQLManager.cre…
CVE-2023-39015Critical9.82023-07-28webmagic-extension v0.9.0 and below was discovered to contain a code injection vulnerability via the component us.codecraft.webmagic.downloader.PhantomJSDownlo…
CVE-2023-39013Critical9.82023-07-28Duke v1.2 and below was discovered to contain a code injection vulnerability via the component no.priv.garshol.duke.server.CommonJTimer.init.
CVE-2023-39010Critical9.82023-07-28BoofCV 0.42 was discovered to contain a code injection vulnerability via the component boofcv.io.calibration.CalibrationIO.load. This vulnerability is exploite…
CVE-2023-38992Critical9.82023-07-28jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData.
CVE-2023-37754Critical9.82023-07-28PowerJob v4.3.3 was discovered to contain a remote command execution (RCE) vulnerability via the instanceId parameter at /instance/detail.
CVE-2023-37467Medium6.82023-07-28Discourse is an open source discussion platform. Prior to version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a CSP (Content Security Policy) nonce…
CVE-2023-31937High7.22023-07-28Sql injection vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to execute arbitrary code via the editid parameter of the edit-…
CVE-2023-31936High7.22023-07-28Sql injection vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to execute arbitrary code via the viewid parameter of the view-…
CVE-2023-31935Medium4.82023-07-28Cross Site Scripting vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to obtain sensitive information via the emial parameter…
CVE-2023-31934Medium4.82023-07-28Cross Site Scripting vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to obtain sensitive information via the adminname parame…
CVE-2023-31933High7.22023-07-28Sql injection vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to execute arbitrary code via the editid parameter of the edit-…
CVE-2023-31932High7.22023-07-28Sql injection vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to execute arbitrary code via the viewid parameter of the view-…
CVE-2023-2685High7.22023-07-28A vulnerability was found in AO-OPC server versions mentioned above. As the directory information for the service entry is not enclosed in quotation marks, pot…
CVE-2023-3670High7.32023-07-28In CODESYS Development System 3.5.9.0 to 3.5.17.0 and CODESYS Scripting 4.0.0.0 to 4.1.0.0 unsafe directory permissions would allow an attacker with local acce…
CVE-2023-3990Low3.52023-07-28A vulnerability classified as problematic has been found in Mingsoft MCMS up to 5.3.1. This affects an unknown part of the file search.do of the component HTTP…
CVE-2023-3989Low3.52023-07-28A vulnerability was found in SourceCodester Jewelry Store System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of…
CVE-2023-3988Medium6.32023-07-28A vulnerability was found in Cafe Billing System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file…
CVE-2023-3987Medium6.32023-07-28A vulnerability was found in SourceCodester Simple Online Mens Salon Management System 1.0. It has been classified as critical. Affected is an unknown function…
CVE-2023-3986Low2.42023-07-28A vulnerability was found in SourceCodester Simple Online Mens Salon Management System 1.0 and classified as problematic. This issue affects some unknown proce…
CVE-2023-3985High7.32023-07-28A vulnerability has been found in SourceCodester Online Jewelry Store 1.0 and classified as critical. This vulnerability affects unknown code of the file login…
CVE-2023-3977Medium4.32023-07-28Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on th…
CVE-2023-38609High7.52023-07-28An injection issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13.5. An app may be able to bypass certain Privacy prefer…
CVE-2023-38604Critical9.82023-07-28An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in watchOS 9.6, macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS 15.7…
CVE-2023-38601High7.52023-07-28This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Big Sur 11.7.9, macOS Monterey 12.6.8, macOS Ventura 13.5. An app may be…
CVE-2023-38599Medium6.52023-07-28A logic issue was addressed with improved state management. This issue is fixed in Safari 16.6, watchOS 9.6, iOS 15.7.8 and iPadOS 15.7.8, tvOS 16.6, iOS 16.6…
CVE-2023-38598Critical9.82023-07-28A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 9.6, macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS 15.7.8, m…
CVE-2023-38592High8.82023-07-28A logic issue was addressed with improved restrictions. This issue is fixed in iOS 16.6 and iPadOS 16.6, watchOS 9.6, tvOS 16.6, macOS Ventura 13.5. Processing…
CVE-2023-38590High8.82023-07-28A buffer overflow issue was addressed with improved memory handling. This issue is fixed in watchOS 9.6, macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS 15.7.8, ma…
CVE-2023-38571High7.52023-07-28This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Big Sur 11.7.9, macOS Monterey 12.6.8, macOS Ventura 13.5. An app m…
CVE-2023-37285Critical9.82023-07-28An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 15.7.8 and iPadOS 15.7.8, macOS Big Sur 11.7.9, macOS Monterey 12…
CVE-2023-36495Critical9.82023-07-28An integer overflow was addressed with improved input validation. This issue is fixed in watchOS 9.6, macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, tvOS…
CVE-2023-34425Critical9.82023-07-28The issue was addressed with improved memory handling. This issue is fixed in watchOS 9.6, macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, macOS Big Sur 1…
CVE-2023-32654Medium6.52023-07-28A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.5. A user may be able to read information belonging to anot…
CVE-2023-32445Medium6.12023-07-28This issue was addressed with improved checks. This issue is fixed in Safari 16.6, watchOS 9.6, iOS 15.7.8 and iPadOS 15.7.8, tvOS 16.6, iOS 16.6 and iPadOS 16…
CVE-2023-32444High7.52023-07-28A logic issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.7.9, macOS Monterey 12.6.8, macOS Ventura 13.5. A sandboxed proce…
CVE-2023-32427Medium5.92023-07-28This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in Apple Music 4.2.0 for Android. An attacker in a privi…
CVE-2023-28203Medium5.52023-07-28The issue was addressed with improved checks. This issue is fixed in Apple Music 4.2.0 for Android. An app may be able to access contacts.
CVE-2023-0958Medium4.32023-07-28Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation fun…
CVE-2023-3984Medium6.32023-07-28A vulnerability, which was classified as critical, was found in phpscriptpoint RecipePoint 1.9. This affects an unknown part of the file /recipe-result. The ma…
CVE-2023-38331Medium5.42023-07-28Zoho ManageEngine Support Center Plus 14001 and below is vulnerable to stored XSS in the products module.
CVE-2023-3774Medium4.92023-07-28An unhandled error in Vault Enterprise's namespace creation may cause the Vault process to crash, potentially resulting in denial of service. Fixed in 1.14.1…
CVE-2023-33745Critical9.82023-07-27TeleAdapt RoomCast TA-2400 1.0 through 3.1 is vulnerable to Improper Privilege Management: from the shell available after an adb connection, simply entering th…
CVE-2023-33744Critical9.82023-07-27TeleAdapt RoomCast TA-2400 1.0 through 3.1 suffers from Use of a Hard-coded Password (PIN): 385521, 843646, and 592671.
CVE-2023-33743Critical9.82023-07-27TeleAdapt RoomCast TA-2400 1.0 through 3.1 is vulnerable to Improper Access Control; specifically, Android Debug Bridge (adb) is available.
CVE-2023-33742High7.52023-07-27TeleAdapt RoomCast TA-2400 1.0 through 3.1 suffers from Cleartext Storage of Sensitive Information: RSA private key in Update.exe.
CVE-2023-23764Medium4.82023-07-27An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff within the GitHu…
CVE-2023-36942Medium6.12023-07-27A cross-site scripting (XSS) vulnerability in PHPGurukul Online Fire Reporting System Using PHP and MySQL 1.2 allows attackers to execute arbitrary web scripts…
CVE-2023-3982Medium4.82023-07-27Cross-site Scripting (XSS) - Stored in GitHub repository omeka/omeka-s prior to 4.0.2.
CVE-2023-3981Medium4.92023-07-27Server-Side Request Forgery (SSRF) in GitHub repository omeka/omeka-s prior to 4.0.2.
CVE-2023-3980Medium4.82023-07-27Cross-site Scripting (XSS) - Stored in GitHub repository omeka/omeka-s prior to 4.0.2.
CVE-2023-38510High8.12023-07-27Tolgee is an open-source localization platform. Starting in version 3.14.0 and prior to version 3.23.1, when a request is made using an API key, the backend fa…
CVE-2023-38505High7.52023-07-27DietPi-Dashboard is a web dashboard for the operating system DietPi. The dashboard only allows for one TLS handshake to be in process at a given moment. Once a…
CVE-2023-38504High7.52023-07-27Sails is a realtime MVC Framework for Node.js. In Sails apps prior to version 1.5.7,, an attacker can send a virtual request that will cause the node process t…
CVE-2023-38495High8.32023-07-27Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, Crossplane's…
CVE-2023-36941Medium6.12023-07-27A cross-site scripting (XSS) vulnerability in PHPGurukul Online Fire Reporting System Using PHP and MySQL 1.2 allows attackers to execute arbitrary web scripts…
CVE-2023-38492Medium5.32023-07-27Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites with user acco…
CVE-2023-38491Medium5.72023-07-27Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites that might hav…
CVE-2023-37900Low3.42023-07-27Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, a high-privi…
CVE-2023-3975Critical9.82023-07-27OS Command Injection in GitHub repository jgraph/drawio prior to 21.5.0.
CVE-2023-3974Critical9.82023-07-27OS Command Injection in GitHub repository jgraph/drawio prior to 21.4.0.
CVE-2023-3973Medium6.12023-07-27Cross-site Scripting (XSS) - Reflected in GitHub repository jgraph/drawio prior to 21.6.3.