2023 CVEs (page 192)
Page 192 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-38555 | High | 8.8 | 2023-07-26 | Authentication bypass vulnerability in Fujitsu network devices Si-R series and SR-M series allows a network-adjacent unauthenticated attacker to obtain, change… |
CVE-2023-38433 | High | 7.5 | 2023-07-26 | Fujitsu Real-time Video Transmission Gear "IP series" use hard-coded credentials, which may allow a remote unauthenticated attacker to initialize or reboot the… |
CVE-2023-32468 | Medium | 5.8 | 2023-07-26 | Dell ECS Streamer, versions prior to 2.0.7.1, contain an insertion of sensitive information in log files vulnerability. A remote malicious high-privileged use… |
CVE-2023-1401 | Medium | 5.0 | 2023-07-26 | An issue has been discovered in GitLab DAST scanner affecting all versions starting from 3.0.29 before 4.0.5, in which the DAST scanner leak cross site cookies… |
CVE-2023-3946 | Medium | 5.4 | 2023-07-26 | A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 SP1 Update 1allows a remote unauthenticated attacker to potentially obtain access to… |
CVE-2023-20891 | Medium | 6.5 | 2023-07-26 | The VMware Tanzu Application Service for VMs and Isolation Segment contain an information disclosure vulnerability due to the logging of credentials in hex enc… |
CVE-2023-3947 | Low | 3.7 | 2023-07-26 | The Video Conferencing with Zoom plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'vczapi_encrypt_de… |
CVE-2023-32629 | High | 7.8 | 2023-07-26 | Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_copy_up_meta_inode_data skip permission checks when calling ovl_do_setxattr on Ubuntu… |
CVE-2023-2640 | High | 7.8 | 2023-07-26 | On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs", an unprivileged user may… |
CVE-2023-38503 | Medium | 5.7 | 2023-07-25 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 10.3.0 and prior to version 10.5.0, the permission filters… |
CVE-2023-3945 | Low | 3.5 | 2023-07-25 | A vulnerability was found in phpscriptpoint Lawyer 1.6. It has been classified as problematic. This affects an unknown part of the file search.php. The manipul… |
CVE-2023-38502 | Medium | 6.5 | 2023-07-25 | TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to version 3.0.7.1, TDengine DataBase crashes on UDF nested qu… |
CVE-2023-38501 | Medium | 6.3 | 2023-07-25 | copyparty is file server software. Prior to version 1.8.7, the application contains a reflected cross-site scripting via URL-parameter `?k304=...` and `?setck=… |
CVE-2023-38496 | Medium | 6.1 | 2023-07-25 | Apptainer is an open source container platform. Version 1.2.0-rc.2 introduced an ineffective privilege drop when requesting container network setup, therefore… |
CVE-2023-38500 | Medium | 4.7 | 2023-07-25 | TYPO3 HTML Sanitizer is an HTML sanitizer, written in PHP, aiming to provide cross-site-scripting-safe markup based on explicitly allowed tags, attributes and… |
CVE-2023-38499 | Low | 3.7 | 2023-07-25 | TYPO3 is an open source PHP based web content management system. Starting in version 9.4.0 and prior to versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, and 12.4.4… |
CVE-2023-38493 | High | 7.5 | 2023-07-25 | Armeria is a microservice framework Spring supports Matrix variables. When Spring integration is used, Armeria calls Spring controllers via `TomcatService` or… |
CVE-2023-37920 | High | 7.5 | 2023-07-25 | Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi… |
CVE-2023-37919 | Medium | 6.5 | 2023-07-25 | Cal.com is open-source scheduling software. A vulnerability allows active sessions associated with an account to remain active even after enabling 2FA. When ac… |
CVE-2023-37907 | High | 7.0 | 2023-07-25 | Cryptomator is data encryption software for users who store their files in the cloud. Prior to version 1.9.2, the MSI installer provided on the homepage allows… |
CVE-2023-37902 | Medium | 5.3 | 2023-07-25 | Vyper is a Pythonic programming language that targets the Ethereum Virtual Machine (EVM). Prior to version 0.3.10, the ecrecover precompile does not fill the o… |
CVE-2023-3944 | Low | 3.5 | 2023-07-25 | A vulnerability was found in phpscriptpoint Lawyer 1.6 and classified as problematic. Affected by this issue is some unknown functionality of the file page.php… |
CVE-2023-37677 | Critical | 9.8 | 2023-07-25 | Pligg CMS v2.0.2 (also known as Kliqqi) was discovered to contain a remote code execution (RCE) vulnerability in the component admin_editor.php. |
CVE-2023-37460 | High | 8.1 | 2023-07-25 | Plexis Archiver is a collection of Plexus components to create archives or extract archives to a directory with a unified `Archiver`/`UnArchiver` API. Prior to… |
CVE-2023-37258 | High | 8.8 | 2023-07-25 | DataEase is an open source data visualization analysis tool. Prior to version 1.18.9, DataEase has a SQL injection vulnerability that can bypass blacklists. Th… |
CVE-2023-37257 | Medium | 5.4 | 2023-07-25 | DataEase is an open source data visualization analysis tool. Prior to version 1.18.9, the DataEase panel and dataset have a stored cross-site scripting vulnera… |
CVE-2023-34798 | Critical | 9.8 | 2023-07-25 | An arbitrary file upload vulnerability in eoffice before v9.5 allows attackers to execute arbitrary code via uploading a crafted file. |
CVE-2023-39130 | Medium | 5.5 | 2023-07-25 | GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a heap buffer overflow via the function pe_as16() at /gdb/coff-pe-read.c. |
CVE-2023-39129 | Medium | 5.5 | 2023-07-25 | GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a heap use after free via the function add_pe_exported_sym() at /gdb/coff-pe-read.c. |
CVE-2023-39128 | Medium | 5.5 | 2023-07-25 | GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a stack overflow via the function ada_decode at /gdb/ada-lang.c. |
CVE-2023-36826 | High | 7.7 | 2023-07-25 | Sentry is an error tracking and performance monitoring platform. Starting in version 8.21.0 and prior to version 23.5.2, an authenticated user can download a d… |
CVE-2023-36806 | Medium | 6.5 | 2023-07-25 | Contao is an open source content management system. Starting in version 4.0.0 and prior to versions 4.9.42, 4.13.28, and 5.1.10, it is possible for untrusted b… |
CVE-2023-35982 | Critical | 9.8 | 2023-07-25 | There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted… |
CVE-2023-35981 | Critical | 9.8 | 2023-07-25 | There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted… |
CVE-2023-35980 | Critical | 9.8 | 2023-07-25 | There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted… |
CVE-2023-35944 | High | 8.2 | 2023-07-25 | Envoy is an open source edge and service proxy designed for cloud-native applications. Envoy allows mixed-case schemes in HTTP/2, however, some internal scheme… |
CVE-2023-35943 | Medium | 6.3 | 2023-07-25 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, the CORS… |
CVE-2023-35942 | Medium | 6.5 | 2023-07-25 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, gRPC acc… |
CVE-2023-35941 | High | 8.6 | 2023-07-25 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, a malici… |
CVE-2023-35929 | Medium | 5.4 | 2023-07-25 | Tuleap is a free and open source suite to improve management of software development and collaboration. Prior to version 14.10.99.4 of Tuleap Community Edition… |
CVE-2023-34235 | High | 8.6 | 2023-07-25 | Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the `t(number)` pre… |
CVE-2023-2626 | High | 7.5 | 2023-07-25 | There exists an authentication bypass vulnerability in OpenThread border router devices and implementations. This issue allows unauthenticated nodes to craft r… |
CVE-2023-3773 | Medium | 5.5 | 2023-07-25 | A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privile… |
CVE-2023-3772 | Medium | 5.5 | 2023-07-25 | A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privile… |
CVE-2023-38435 | Medium | 6.1 | 2023-07-25 | An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Apache Felix Healthcheck Webconsole Plugin ve… |
CVE-2023-39175 | Medium | 4.6 | 2023-07-25 | In JetBrains TeamCity before 2023.05.2 reflected XSS via GitHub integration was possible |
CVE-2023-39174 | Medium | 4.3 | 2023-07-25 | In JetBrains TeamCity before 2023.05.2 a ReDoS attack was possible via integration with issue trackers |
CVE-2023-39173 | Medium | 5.4 | 2023-07-25 | In JetBrains TeamCity before 2023.05.2 a token with limited permissions could be used to gain full account access |
CVE-2023-37895 | Critical | 9.8 | 2023-07-25 | Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to (including) 2… |
CVE-2023-34093 | Medium | 4.8 | 2023-07-25 | Strapi is an open-source headless content management system. Prior to version 4.10.8, anyone (Strapi developers, users, plugins) can make every attribute of a… |
CVE-2023-3548 | High | 8.3 | 2023-07-25 | An unauthorized user could gain account access to IQ Wifi 6 versions prior to 2.0.2 by conducting a brute force authentication attack. |
CVE-2023-36503 | Medium | 6.5 | 2023-07-25 | Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Max Foundry WordPress Button Plugin MaxButtons plugin <= 9.5.3 versions. |
CVE-2023-36502 | High | 7.1 | 2023-07-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cththemes Balkon plugin <= 1.3.2 versions. |
CVE-2023-36501 | High | 7.1 | 2023-07-25 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Michael Winkler teachPress plugin <= 9.0.2 versions. |
CVE-2023-36385 | High | 7.1 | 2023-07-25 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wpxpo PostX – Gutenberg Post Grid Blocks plugin <= 2.9.9 versions. |
CVE-2023-34369 | Medium | 5.9 | 2023-07-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in GrandSlambert Login Configurator plugin <= 2.1 versions. |
CVE-2023-34017 | High | 7.1 | 2023-07-25 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in FiveStarPlugins Five Star Restaurant Reservations plugin <= 2.6.7 versions. |
CVE-2023-3637 | Medium | 4.3 | 2023-07-25 | An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for a… |
CVE-2023-3486 | High | 8.2 | 2023-07-25 | An authentication bypass exists in PaperCut NG versions 22.0.12 and prior that could allow a remote, unauthenticated attacker to upload arbitrary files to the… |
CVE-2023-35043 | High | 7.1 | 2023-07-25 | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Neha Goel Recent Posts Slider plugin <= 1.1 versions. |
CVE-2023-33925 | High | 7.1 | 2023-07-25 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in PluginForage WooCommerce Product Categories Selection Widget plugin <= 2.0 versions. |
CVE-2023-23833 | Medium | 6.5 | 2023-07-25 | Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Steven Henty Drop Shadow Boxes plugin <= 1.7.10 versions. |
CVE-2023-2850 | Medium | 4.7 | 2023-07-25 | NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vulnerability allows… |
CVE-2023-3897 | Medium | 4.8 | 2023-07-25 | Username enumeration is possible through Bypassing CAPTCHA in On-premise SureMDM Solution on Windows deployment allows attacker to enumerate local user informa… |
CVE-2023-3890 | Low | 3.5 | 2023-07-25 | A vulnerability classified as problematic has been found in Campcodes Beauty Salon Management System 1.0. This affects an unknown part of the file /admin/edit-… |
CVE-2023-3888 | Low | 3.5 | 2023-07-25 | A vulnerability was found in Campcodes Beauty Salon Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionali… |
CVE-2023-3887 | Low | 3.5 | 2023-07-25 | A vulnerability was found in Campcodes Beauty Salon Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown fu… |
CVE-2023-3886 | Low | 3.5 | 2023-07-25 | A vulnerability was found in Campcodes Beauty Salon Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file /… |
CVE-2023-35088 | Critical | 9.8 | 2023-07-25 | Improper Neutralization of Special Elements Used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache InLong.This issue affec… |
CVE-2023-34434 | High | 7.5 | 2023-07-25 | Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. The a… |
CVE-2023-34189 | Medium | 6.5 | 2023-07-25 | Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. The… |
CVE-2023-21406 | High | 7.1 | 2023-07-25 | Ariel Harush and Roy Hodir from OTORIO have found a flaw in the AXIS A1001 when communicating over OSDP. A heap-based buffer overflow was found in the pacsiod… |
CVE-2023-21405 | Medium | 6.5 | 2023-07-25 | Knud from Fraktal.fi has found a flaw in some Axis Network Door Controllers and Axis Network Intercoms when communicating over OSDP, highlighting that the OSDP… |
CVE-2023-3885 | Low | 3.5 | 2023-07-25 | A vulnerability was found in Campcodes Beauty Salon Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file… |
CVE-2023-35078 | Critical | 9.8 | 2023-07-25 | An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without prop… |
CVE-2023-35067 | High | 7.5 | 2023-07-25 | Plaintext Storage of a Password vulnerability in Infodrom Software E-Invoice Approval System allows Read Sensitive Strings Within an Executable. This issue af… |
CVE-2023-35066 | Critical | 9.8 | 2023-07-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Infodrom Software E-Invoice Approval System allows SQL In… |
CVE-2023-3884 | Low | 3.5 | 2023-07-25 | A vulnerability has been found in Campcodes Beauty Salon Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the fi… |
CVE-2023-3883 | Low | 3.5 | 2023-07-25 | A vulnerability, which was classified as problematic, was found in Campcodes Beauty Salon Management System 1.0. This affects an unknown part of the file /admi… |
CVE-2023-3046 | Critical | 9.8 | 2023-07-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Biltay Technology Scienta allows SQL Injection. This iss… |
CVE-2023-32637 | Critical | 9.8 | 2023-07-25 | GBrowse accepts files with any formats uploaded and places them in the area accessible through unauthenticated web requests. Therefore, anyone who can upload f… |
CVE-2023-3882 | Medium | 6.3 | 2023-07-25 | A vulnerability, which was classified as critical, has been found in Campcodes Beauty Salon Management System 1.0. Affected by this issue is some unknown funct… |
CVE-2023-3881 | Medium | 6.3 | 2023-07-25 | A vulnerability classified as critical was found in Campcodes Beauty Salon Management System 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2023-3880 | Medium | 6.3 | 2023-07-25 | A vulnerability classified as critical has been found in Campcodes Beauty Salon Management System 1.0. Affected is an unknown function of the file /admin/del_s… |
CVE-2023-3879 | Medium | 6.3 | 2023-07-25 | A vulnerability was found in Campcodes Beauty Salon Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the fil… |
CVE-2023-38745 | Medium | 6.3 | 2023-07-25 | Pandoc before 3.1.6 allows arbitrary file write: this can be triggered by providing a crafted image element in the input when generating files via the --extrac… |
CVE-2023-32639 | Medium | 5.5 | 2023-07-25 | Applicant Programme Ver.7.06 and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files… |
CVE-2023-3878 | Medium | 6.3 | 2023-07-25 | A vulnerability was found in Campcodes Beauty Salon Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the fil… |
CVE-2023-3877 | Medium | 6.3 | 2023-07-25 | A vulnerability was found in Campcodes Beauty Salon Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/… |
CVE-2023-3876 | Medium | 6.3 | 2023-07-25 | A vulnerability was found in Campcodes Beauty Salon Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of t… |
CVE-2023-3875 | Medium | 6.3 | 2023-07-25 | A vulnerability has been found in Campcodes Beauty Salon Management System 0.1.0 and classified as critical. Affected by this vulnerability is an unknown funct… |
CVE-2023-23568 | Medium | 4.3 | 2023-07-25 | Improper privilege validation in Command Centre Server allows authenticated unprivileged operators to modify and view Personal Data Fields. This issue affect… |
CVE-2023-3874 | Medium | 6.3 | 2023-07-25 | A vulnerability, which was classified as critical, was found in Campcodes Beauty Salon Management System 1.0. Affected is an unknown function of the file /admi… |
CVE-2023-37361 | Low | 2.7 | 2023-07-25 | REDCap 12.0.26 LTS and 12.3.2 Standard allows SQL Injection via scheduling, repeatforms, purpose, app_title, or randomization. |
CVE-2023-33777 | Medium | 5.3 | 2023-07-25 | An issue in /functions/fbaorder.php of Prestashop amazon before v5.2.24 allows attackers to execute a directory traversal attack. |
CVE-2023-32232 | Critical | 9.9 | 2023-07-25 | An issue was discovered in Vasion PrinterLogic Client for Windows before 25.0.0.836. During client installation and repair, a PrinterLogic binary is called by… |
CVE-2023-32231 | Critical | 9.9 | 2023-07-25 | An issue was discovered in Vasion PrinterLogic Client for Windows before 25.0.0.818. During installation, binaries gets executed out of a subfolder in C:\Windo… |
CVE-2023-3873 | High | 7.3 | 2023-07-25 | A vulnerability, which was classified as critical, has been found in Campcodes Beauty Salon Management System 1.0. This issue affects some unknown processing o… |
CVE-2023-25074 | High | 7.1 | 2023-07-25 | Improper privilege validation in Command Centre Server allows authenticated unprivileged operators to modify and view Competencies. This issue affects C… |
CVE-2023-22363 | Medium | 6.5 | 2023-07-25 | A stack-based buffer overflow in the Command Centre Server allows an attacker to cause a denial of service attack via assigning cardholders to an Access Group… |