2023 CVEs (page 194)
Page 194 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-38187 | Medium | 6.5 | 2023-07-21 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2023-38173 | Medium | 4.3 | 2023-07-21 | Microsoft Edge for Android Spoofing Vulnerability |
CVE-2023-35392 | Medium | 4.7 | 2023-07-21 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2023-26301 | Critical | 9.8 | 2023-07-21 | Certain HP LaserJet Pro print products are potentially vulnerable to an Elevation of Privilege and/or Information Disclosure related to a lack of authenticatio… |
CVE-2023-3102 | Medium | 5.3 | 2023-07-21 | A sensitive information leak issue has been discovered in GitLab EE affecting all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 be… |
CVE-2023-37742 | Medium | 6.1 | 2023-07-21 | WebBoss.io CMS before v3.7.0.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability. |
CVE-2023-3822 | Medium | 6.1 | 2023-07-21 | Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.6.4. |
CVE-2023-3821 | Medium | 5.4 | 2023-07-21 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.6.4. |
CVE-2023-3820 | High | 7.2 | 2023-07-21 | SQL Injection in GitHub repository pimcore/pimcore prior to 10.6.4. |
CVE-2023-3819 | Medium | 6.5 | 2023-07-21 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pimcore/pimcore prior to 10.6.4. |
CVE-2023-38646 | Critical | 9.8 | 2023-07-21 | Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privi… |
CVE-2023-3484 | High | 8.0 | 2023-07-21 | An issue has been discovered in GitLab EE affecting all versions starting from 12.8 before 15.11.11, all versions starting from 16.0 before 16.0.7, all version… |
CVE-2023-35087 | Critical | 9.8 | 2023-07-21 | It is identified a format string vulnerability in ASUS RT-AX56U V2 & RT-AC86U. This vulnerability is caused by lacking validation for a specific value when ca… |
CVE-2023-35086 | High | 7.2 | 2023-07-21 | It is identified a format string vulnerability in ASUS RT-AX56U V2 & RT-AC86U. This vulnerability is caused by directly using input as a format string when ca… |
CVE-2023-28730 | High | 7.8 | 2023-07-21 | A memory corruption vulnerability Panasonic Control FPWIN Pro versions 7.6.0.3 and all previous versions may allow arbitrary code execution when opening specia… |
CVE-2023-28729 | High | 7.8 | 2023-07-21 | A type confusion vulnerability in Panasonic Control FPWIN Pro versions 7.6.0.3 and all previous versions may allow arbitrary code execution when opening specia… |
CVE-2023-28728 | High | 7.8 | 2023-07-21 | A stack-based buffer overflow in Panasonic Control FPWIN Pro versions 7.6.0.3 and all previous versions may allow arbitrary code execution when opening special… |
CVE-2023-32478 | Critical | 9.0 | 2023-07-21 | Dell PowerStore versions prior to 3.5.0.1 contain an insertion of sensitive information into log file vulnerability. A high privileged malicious user could po… |
CVE-2023-3815 | Low | 3.5 | 2023-07-21 | A vulnerability, which was classified as problematic, has been found in y_project RuoYi up to 4.7.7. Affected by this issue is the function uploadFilesPath of… |
CVE-2023-3811 | Medium | 6.3 | 2023-07-21 | A vulnerability was found in Hospital Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file patientprofi… |
CVE-2023-37292 | Critical | 9.8 | 2023-07-21 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in HGiga iSherlock 4.5 (iSherlock-user modules), HGiga… |
CVE-2023-3810 | Medium | 6.3 | 2023-07-21 | A vulnerability was found in Hospital Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file patientappoi… |
CVE-2023-3809 | Medium | 6.3 | 2023-07-21 | A vulnerability was found in Hospital Management System 1.0. It has been classified as critical. This affects an unknown part of the file patient.php. The mani… |
CVE-2023-37291 | High | 8.6 | 2023-07-21 | Galaxy Software Services Vitals ESP is vulnerable to using a hard-coded encryption key. An unauthenticated remote attacker can generate a valid token parameter… |
CVE-2023-25837 | High | 8.4 | 2023-07-21 | There is a Cross‑Site Scripting (XSS) vulnerability in Esri ArcGIS Enterprise Sites versions 10.9 and below that may allow a remote, authenticated attacker to… |
CVE-2023-25836 | Medium | 5.4 | 2023-07-21 | There is a Cross-site Scripting vulnerability in Esri Portal for ArcGIS Sites in versions 10.9 and below that may allow a remote, authenticated attacker to cre… |
CVE-2023-3813 | High | 7.5 | 2023-07-21 | The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file downloads in versions up to, and including, 4.6.6. This makes it possible for unauthent… |
CVE-2023-3808 | Medium | 6.3 | 2023-07-21 | A vulnerability was found in Hospital Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file patien… |
CVE-2023-3807 | Medium | 6.3 | 2023-07-21 | A vulnerability has been found in Campcodes Beauty Salon Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functio… |
CVE-2023-3806 | Medium | 6.3 | 2023-07-21 | A vulnerability, which was classified as critical, was found in SourceCodester House Rental and Property Listing System 1.0. Affected is an unknown function of… |
CVE-2023-3805 | High | 7.3 | 2023-07-21 | A vulnerability, which was classified as critical, has been found in Xiamen Four Letter Video Surveillance Management System up to 20230712. This issue affects… |
CVE-2023-38632 | Critical | 9.8 | 2023-07-21 | async-sockets-cpp through 0.3.1 has a stack-based buffer overflow in tcpsocket.hpp when processing malformed TCP packets. |
CVE-2023-3804 | Medium | 5.5 | 2023-07-21 | A vulnerability classified as problematic was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This vulnerability affects unknown code… |
CVE-2023-3803 | Low | 2.6 | 2023-07-21 | A vulnerability classified as problematic has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This affects an unknown part of the… |
CVE-2023-32625 | Medium | 4.3 | 2023-07-21 | Cross-site request forgery (CSRF) vulnerability in TS Webfonts for SAKURA 3.1.2 and earlier allows a remote unauthenticated attacker to hijack the authenticati… |
CVE-2023-32624 | Medium | 6.1 | 2023-07-21 | Cross-site scripting vulnerability in TS Webfonts for SAKURA 3.1.0 and earlier allows a remote unauthenticated attacker to inject an arbitrary script. |
CVE-2023-3802 | Medium | 5.5 | 2023-07-21 | A vulnerability was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. It has been rated as problematic. Affected by this issue is some u… |
CVE-2023-3801 | Medium | 5.5 | 2023-07-21 | A vulnerability was found in IBOS OA 4.5.5. It has been declared as critical. Affected by this vulnerability is the function actionEdit of the file ?r=official… |
CVE-2023-25835 | High | 8.4 | 2023-07-21 | There is a stored Cross‑Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS Sites versions 11.1 and below that may allow a remote, authenticated attac… |
CVE-2023-3800 | Low | 3.9 | 2023-07-20 | A vulnerability was found in EasyAdmin8 2.0.2.2. It has been classified as problematic. Affected is an unknown function of the file /admin/index/index.html#/ad… |
CVE-2023-3799 | Medium | 6.3 | 2023-07-20 | A vulnerability was found in IBOS OA 4.5.5 and classified as critical. This issue affects some unknown processing of the file ?r=article/category/del of the co… |
CVE-2023-3798 | Medium | 5.5 | 2023-07-20 | A vulnerability has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0 and classified as critical. This vulnerability affects unknown… |
CVE-2023-3797 | Medium | 5.5 | 2023-07-20 | A vulnerability, which was classified as critical, was found in Gen Technology Four Mountain Torrent Disaster Prevention and Control of Monitoring and Early Wa… |
CVE-2023-37645 | Medium | 5.3 | 2023-07-20 | eyoucms v1.6.3 was discovered to contain an information disclosure vulnerability via the component /custom_model_path/recruit.filelist.txt. |
CVE-2023-3796 | Medium | 4.3 | 2023-07-20 | A vulnerability, which was classified as problematic, has been found in Bug Finder Foody Friend 1.0. Affected by this issue is some unknown functionality of th… |
CVE-2023-3795 | Medium | 5.5 | 2023-07-20 | A vulnerability classified as critical was found in Bug Finder ChainCity Real Estate Investment Platform 1.0. Affected by this vulnerability is an unknown func… |
CVE-2023-3794 | Low | 3.5 | 2023-07-20 | A vulnerability classified as problematic has been found in Bug Finder ChainCity Real Estate Investment Platform 1.0. Affected is an unknown function of the fi… |
CVE-2023-3793 | Medium | 5.5 | 2023-07-20 | A vulnerability was found in Weaver e-cology. It has been rated as critical. This issue affects some unknown processing of the file filelFileDownloadForOutDoc… |
CVE-2023-37650 | High | 8.8 | 2023-07-20 | A Cross-Site Request Forgery (CSRF) in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands. |
CVE-2023-37649 | High | 7.5 | 2023-07-20 | Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data. |
CVE-2023-34625 | High | 8.1 | 2023-07-20 | ShowMojo MojoBox Digital Lockbox 1.4 is vulnerable to Authentication Bypass. The implementation of the lock opening mechanism via Bluetooth Low Energy (BLE) is… |
CVE-2023-31753 | Critical | 9.8 | 2023-07-20 | SQL injection vulnerability in diskusi.php in eNdonesia 8.7, allows an attacker to execute arbitrary SQL commands via the "rid=" parameter. |
CVE-2023-30200 | High | 7.5 | 2023-07-20 | In the module “Image: WebP, Compress, Zoom, Lazy load, Alt & More” (ultimateimagetool) in versions up to 2.1.02 from Advanced Plugins for PrestaShop, a guest c… |
CVE-2023-3792 | Medium | 4.3 | 2023-07-20 | A vulnerability was found in Beijing Netcon NS-ASG 6.3. It has been classified as problematic. This affects an unknown part of the file /admin/test_status.php… |
CVE-2023-38617 | Medium | 6.1 | 2023-07-20 | Office Suite Premium Version v10.9.1.42602 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the filter parameter at /api?path… |
CVE-2023-38523 | Medium | 5.3 | 2023-07-20 | The web interface on multiple Samsung Harman AMX N-Series devices allows directory listing for the /tmp/ directory, without authentication, exposing sensitive… |
CVE-2023-37602 | Medium | 6.1 | 2023-07-20 | An arbitrary file upload vulnerability in the component /workplace#!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary code via uploading… |
CVE-2023-37601 | High | 7.5 | 2023-07-20 | Office Suite Premium v10.9.1.42602 was discovered to contain a local file inclusion (LFI) vulnerability via the component /etc/hosts. |
CVE-2023-37600 | Medium | 6.1 | 2023-07-20 | Office Suite Premium Version v10.9.1.42602 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the id parameter at /api?path=pro… |
CVE-2023-37165 | Critical | 9.8 | 2023-07-20 | Millhouse-Project v1.414 was discovered to contain a remote code execution (RCE) vulnerability via the component /add_post_sql.php. |
CVE-2023-37164 | Medium | 6.1 | 2023-07-20 | Diafan CMS v6.0 was discovered to contain a reflected cross-site scripting via the cat_id parameter at /shop/?module=shop&action=search. |
CVE-2023-3791 | Medium | 6.3 | 2023-07-20 | A vulnerability was found in IBOS OA 4.5.5 and classified as critical. Affected by this issue is the function actionExport of the file ?r=contact/default/expor… |
CVE-2023-38335 | Medium | 5.3 | 2023-07-20 | Omnis Studio 10.22.00 has incorrect access control. It advertises a feature for making Omnis libraries "always private" - this is supposed to be an irreversibl… |
CVE-2023-38334 | Medium | 6.5 | 2023-07-20 | Omnis Studio 10.22.00 has incorrect access control. It advertises an irreversible feature for locking classes within Omnis libraries: it should be no longer po… |
CVE-2023-37728 | Medium | 6.1 | 2023-07-20 | IceWarp v10.2.1 was discovered to contain cross-site scripting (XSS) vulnerability via the color parameter. |
CVE-2023-31462 | High | 8.8 | 2023-07-20 | An issue was discovered in SteelSeries GG 36.0.0. An attacker can change values in an unencrypted database that is writable for all users on the computer, in o… |
CVE-2023-31461 | High | 7.5 | 2023-07-20 | Attackers can exploit an open API listener on SteelSeries GG 36.0.0 to create a sub-application that will be executed automatically from a controlled location… |
CVE-2023-3790 | Low | 3.5 | 2023-07-20 | A vulnerability has been found in Boom CMS 8.0.7 and classified as problematic. Affected by this vulnerability is the function add of the component assets-mana… |
CVE-2023-37471 | Critical | 9.1 | 2023-07-20 | Open Access Management (OpenAM) is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services Se… |
CVE-2023-3789 | Low | 3.5 | 2023-07-20 | A vulnerability, which was classified as problematic, was found in PaulPrinting CMS 2018. Affected is an unknown function of the file /account/delivery of the… |
CVE-2023-3788 | Low | 3.5 | 2023-07-20 | A vulnerability, which was classified as problematic, has been found in ActiveITzone Active Super Shop CMS 2.5. This issue affects some unknown processing of t… |
CVE-2023-38203 | Critical | 9.8 | 2023-07-20 | Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerabilit… |
CVE-2023-3787 | Low | 3.5 | 2023-07-20 | A vulnerability classified as problematic was found in Codecanyon Tiva Events Calender 1.4. This vulnerability affects unknown code. The manipulation of the ar… |
CVE-2023-3347 | Medium | 5.9 | 2023-07-20 | A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required"… |
CVE-2023-34968 | Medium | 5.3 | 2023-07-20 | A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the server-side absolute path of shares, files, and dire… |
CVE-2023-34967 | Medium | 5.3 | 2023-07-20 | A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets, one encoded data structure is… |
CVE-2023-34966 | High | 7.5 | 2023-07-20 | An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets sent by the client, the core un… |
CVE-2023-32476 | Medium | 6.4 | 2023-07-20 | Dell Hybrid Client version 2.0 contains a Sensitive Data Exposure vulnerability. An unauthenticated malicious user on the device can access hard coded secrets… |
CVE-2023-32265 | High | 7.1 | 2023-07-20 | A potential security vulnerability has been identified in the Enterprise Server Common Web Administration (ESCWA) component used in Enterprise Server, Enterpr… |
CVE-2023-3786 | Medium | 4.3 | 2023-07-20 | A vulnerability classified as problematic has been found in Aures Komet up to 20230509. This affects an unknown part of the component Kiosk Mode. The manipulat… |
CVE-2023-32455 | Medium | 5.5 | 2023-07-20 | Dell Wyse ThinOS versions prior to 2208 (9.3.2102) contain a sensitive information disclosure vulnerability. An unauthenticated malicious user with local acce… |
CVE-2023-32447 | Medium | 5.5 | 2023-07-20 | Dell Wyse ThinOS versions prior to 2306 (9.4.2103) contain a sensitive information disclosure vulnerability. A malicious user with local access to the device… |
CVE-2023-32446 | Medium | 5.5 | 2023-07-20 | Dell Wyse ThinOS versions prior to 2303 (9.4.1141) contain a sensitive information disclosure vulnerability. An unauthenticated malicious user with local acce… |
CVE-2023-32483 | Medium | 4.4 | 2023-07-20 | Wyse Management Suite versions prior to 4.0 contain a sensitive information disclosure vulnerability. An authenticated malicious user having local access to t… |
CVE-2023-32482 | Medium | 4.9 | 2023-07-20 | Wyse Management Suite versions prior to 4.0 contain an improper authorization vulnerability. An authenticated malicious user with privileged access can push p… |
CVE-2023-32481 | Medium | 4.9 | 2023-07-20 | Wyse Management Suite versions prior to 4.0 contain a denial-of-service vulnerability. An authenticated malicious user can flood the configured SMTP server wi… |
CVE-2023-3785 | Low | 3.5 | 2023-07-20 | A vulnerability was found in PaulPrinting CMS 2018. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation of… |
CVE-2023-37290 | High | 7.5 | 2023-07-20 | InfoDoc Document On-line Submission and Approval System lacks sufficient restrictions on the available tags within its HTML to PDF conversion function, and al… |
CVE-2023-3784 | Low | 3.5 | 2023-07-20 | A vulnerability was found in Dooblou WiFi File Explorer 1.13.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality… |
CVE-2023-3783 | Low | 3.5 | 2023-07-20 | A vulnerability was found in Webile 1.0.1. It has been classified as problematic. Affected is an unknown function of the component HTTP POST Request Handler. T… |
CVE-2023-3779 | Medium | 5.3 | 2023-07-20 | The Essential Addons For Elementor plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 5.8.1 due to the… |
CVE-2023-38408 | Critical | 9.8 | 2023-07-20 | The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forward… |
CVE-2023-37289 | Critical | 9.8 | 2023-07-20 | It is identified a vulnerability of Unrestricted Upload of File with Dangerous Type in the file uploading function in InfoDoc Document On-line Submission and… |
CVE-2023-3300 | Medium | 5.3 | 2023-07-20 | HashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API can reveal names of available CSI plugins to unauthenticated users or users w… |
CVE-2023-3299 | Low | 3.4 | 2023-07-20 | HashiCorp Nomad Enterprise 1.2.11 up to 1.5.6, and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1… |
CVE-2023-3072 | Medium | 4.1 | 2023-07-20 | HashiCorp Nomad and Nomad Enterprise 0.7.0 up to 1.5.6 and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5… |
CVE-2023-37362 | High | 7.2 | 2023-07-19 | Weintek Weincloud v0.13.6 could allow an attacker to abuse the registration functionality to login with testing credentials to the official website. |
CVE-2023-36853 | High | 7.8 | 2023-07-19 | In Keysight Geolocation Server v2.4.2 and prior, a low privileged attacker could create a local ZIP file containing a malicious script in any location. T… |
CVE-2023-35134 | High | 7.4 | 2023-07-19 | Weintek Weincloud v0.13.6 could allow an attacker to reset a password with the corresponding account’s JWT token only. |
CVE-2023-34429 | High | 7.5 | 2023-07-19 | Weintek Weincloud v0.13.6 could allow an attacker to cause a denial-of-service condition for Weincloud by sending a forged JWT token. |