2023 CVEs (page 196)
Page 196 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-22010 | Low | 2.2 | 2023-07-18 | Vulnerability in Oracle Essbase (component: Security and Provisioning). The supported version that is affected is 21.4.3.0.0. Difficult to exploit vulnerabil… |
CVE-2023-22009 | Medium | 4.3 | 2023-07-18 | Vulnerability in the Oracle Self-Service Human Resources product of Oracle E-Business Suite (component: Workforce Management). Supported versions that are aff… |
CVE-2023-22008 | Medium | 4.9 | 2023-07-18 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.33 and prior. Easily exploitable v… |
CVE-2023-22007 | Medium | 4.9 | 2023-07-18 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 5.7.41 and prior and 8.0… |
CVE-2023-22006 | Low | 3.1 | 2023-07-18 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Networking). Supported ve… |
CVE-2023-22005 | Medium | 4.4 | 2023-07-18 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.33 and prior. Difficu… |
CVE-2023-22004 | Medium | 4.3 | 2023-07-18 | Vulnerability in the Oracle Applications Technology product of Oracle E-Business Suite (component: Reports Configuration). Supported versions that are affecte… |
CVE-2023-21994 | Medium | 6.5 | 2023-07-18 | Vulnerability in the Oracle Mobile Security Suite product of Oracle Fusion Middleware (component: Android Mobile Authenticator App). Supported versions that a… |
CVE-2023-21983 | Medium | 5.6 | 2023-07-18 | Vulnerability in the Application Express Administration product of Oracle Application Express (component: None). Supported versions that are affected are Appl… |
CVE-2023-21975 | Critical | 9.0 | 2023-07-18 | Vulnerability in the Application Express Customers Plugin product of Oracle Application Express (component: User Account). Supported versions that are affecte… |
CVE-2023-21974 | Critical | 9.0 | 2023-07-18 | Vulnerability in the Application Express Team Calendar Plugin product of Oracle Application Express (component: User Account). Supported versions that are aff… |
CVE-2023-21961 | Medium | 6.0 | 2023-07-18 | Vulnerability in the Oracle Hyperion Essbase Administration Services product of Oracle Essbase (component: EAS Administration and EAS Console). The supported… |
CVE-2023-21950 | Medium | 4.9 | 2023-07-18 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.27 and prior. Easily… |
CVE-2023-21949 | Low | 3.7 | 2023-07-18 | Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 19.3-19.19 and 21.3-21.10. Diff… |
CVE-2023-37143 | Medium | 5.5 | 2023-07-18 | ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function BackwardPass::IsEmptyLoopAfterMemOp(). |
CVE-2023-37142 | Medium | 5.5 | 2023-07-18 | ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::EntryPointInfo::HasInlinees(). |
CVE-2023-37141 | Medium | 5.5 | 2023-07-18 | ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::ProfilingHelpers::ProfiledNewScArray(). |
CVE-2023-37140 | Medium | 5.5 | 2023-07-18 | ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::DiagScopeVariablesWalker::GetChildrenCount(). |
CVE-2023-37139 | Medium | 5.5 | 2023-07-18 | ChakraCore branch master cbb9b was discovered to contain a stack overflow vulnerability via the function Js::ScopeSlots::IsDebuggerScopeSlotArray(). |
CVE-2023-2913 | High | 7.5 | 2023-07-18 | An executable used in Rockwell Automation ThinManager ThinServer can be configured to enable an API feature in the HTTPS Server Settings. This feature is disa… |
CVE-2023-28023 | Medium | 4.9 | 2023-07-18 | A cross site request forgery vulnerability in the BigFix WebUI Software Distribution interface site version 44 and before allows an NMO attacker to access file… |
CVE-2023-37788 | High | 7.5 | 2023-07-18 | goproxy v1.1 was discovered to contain an issue which can lead to a Denial of service (DoS) via unspecified vectors. |
CVE-2023-37758 | High | 7.5 | 2023-07-18 | D-LINK DIR-815 v1.01 was discovered to contain a buffer overflow via the component /web/captcha.cgi. |
CVE-2023-37481 | Low | 2.7 | 2023-07-18 | Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vulnerable to a type of… |
CVE-2023-37480 | Low | 2.7 | 2023-07-18 | Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vulnerable to a type of… |
CVE-2023-37477 | High | 7.2 | 2023-07-18 | 1Panel is an open source Linux server operation and maintenance management panel. An OS command injection vulnerability exists in 1Panel firewall functionality… |
CVE-2023-36670 | Critical | 9.8 | 2023-07-18 | A remotely exploitable command injection vulnerability was found on the Kratos NGC-IDU 9.1.0.4. An attacker can execute arbitrary Linux commands as root by sen… |
CVE-2023-30383 | High | 7.5 | 2023-07-18 | TP-LINK Archer C50v2 Archer C50(US)_V2_160801, TP-LINK Archer C20v1 Archer_C20_V1_150707, and TP-LINK Archer C2v1 Archer_C2_US__V1_170228 were discovered to co… |
CVE-2023-30153 | Critical | 9.8 | 2023-07-18 | An SQL injection vulnerability in the Payplug (payplug) module for PrestaShop, in versions 3.6.0, 3.6.1, 3.6.2, 3.6.3, 3.7.0 and 3.7.1, allows remote attackers… |
CVE-2023-28021 | Medium | 5.9 | 2023-07-18 | The BigFix WebUI uses weak cipher suites. |
CVE-2023-28020 | Medium | 4.7 | 2023-07-18 | URL redirection in Login page in HCL BigFix WebUI allows malicious user to redirect the client browser to an external site via redirect URL response header. |
CVE-2023-38257 | High | 7.5 | 2023-07-18 | Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to an insecure direct object reference vulnerability that could allow an unauthenticated user to vie… |
CVE-2023-36669 | Critical | 9.8 | 2023-07-18 | Missing Authentication for a Critical Function within the Kratos NGC Indoor Unit (IDU) before 11.4 allows remote attackers to obtain arbitrary control of the I… |
CVE-2023-35763 | Medium | 5.5 | 2023-07-18 | Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to a cryptographic vulnerability that could allow an unauthenticated user to decrypt encrypted passw… |
CVE-2023-35189 | Critical | 10.0 | 2023-07-18 | Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to a remote code execution vulnerability that could allow an unauthenticated user to upload a mali… |
CVE-2023-34330 | High | 8.2 | 2023-07-18 | AMI SPx contains a vulnerability in the BMC where a user may inject code which could be executed via a Dynamic Redfish Extension interface. A successful exploi… |
CVE-2023-34329 | Critical | 9.1 | 2023-07-18 | AMI MegaRAC SPx12 contains a vulnerability in BMC where a User may cause an authentication bypass by spoofing the HTTP header. A successful exploit of this vul… |
CVE-2023-33871 | High | 7.5 | 2023-07-18 | Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to a directory traversal vulnerability that could allow an unauthenticated user to directly access a… |
CVE-2023-33329 | Medium | 5.9 | 2023-07-18 | Auth. (admin+) Reflected Cross-Site Scripting (XSS) vulnerability in Hijiri Custom Post Type Generator plugin <= 2.4.2 versions. |
CVE-2023-33312 | High | 7.1 | 2023-07-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wppal Easy Captcha plugin <= 1.0 versions. |
CVE-2023-28019 | Medium | 5.5 | 2023-07-18 | Insufficient validation in Bigfix WebUI API App site version < 14 allows an authenticated WebUI user to issue SQL queries via an unparameterized SQL query. |
CVE-2023-37259 | Medium | 6.1 | 2023-07-18 | matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. The Export Chat feature includes certain attacker-controlled ele… |
CVE-2023-33231 | Medium | 6.1 | 2023-07-18 | XSS attack was possible in DPA 2023.2 due to insufficient input validation |
CVE-2023-0160 | Medium | 4.7 | 2023-07-18 | A deadlock flaw was found in the Linux kernel’s BPF subsystem. This flaw allows a local user to potentially crash the system. |
CVE-2023-34035 | High | 7.3 | 2023-07-18 | Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the appl… |
CVE-2023-33265 | High | 8.8 | 2023-07-18 | In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing authenticated users t… |
CVE-2023-2263 | High | 7.5 | 2023-07-18 | The Rockwell Automation Kinetix 5700 DC Bus Power Supply Series A is vulnerable to CIP fuzzing. The new ENIP connections cannot be established if impacted by… |
CVE-2023-36384 | High | 7.1 | 2023-07-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CodePeople Booking Calendar Contact Form plugin <= 1.2.40 versions. |
CVE-2023-36383 | Medium | 5.9 | 2023-07-18 | Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 3.9.5 ver… |
CVE-2023-31441 | Medium | 5.5 | 2023-07-18 | In NATO Communications and Information Agency anet (aka Advisor Network) through 3.3.0, an attacker can provide a crafted JSON file to sanitizeJson and cause a… |
CVE-2023-24390 | Medium | 5.9 | 2023-07-18 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WeSecur Security plugin <= 1.2.1 versions. |
CVE-2023-32965 | High | 7.1 | 2023-07-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CRUDLab Jazz Popups plugin <= 1.8.7 versions. |
CVE-2023-30906 | High | 7.5 | 2023-07-18 | The vulnerability could be locally exploited to allow escalation of privilege. |
CVE-2023-37973 | Medium | 5.4 | 2023-07-18 | Cross-Site Request Forgery (CSRF) vulnerability in David Pokorny Replace Word plugin <= 2.1 versions. |
CVE-2023-37892 | Medium | 4.3 | 2023-07-18 | Cross-Site Request Forgery (CSRF) vulnerability in Kemal YAZICI - PluginPress Shortcode IMDB plugin <= 6.0.8 versions. |
CVE-2023-37889 | Medium | 4.3 | 2023-07-18 | Cross-Site Request Forgery (CSRF) vulnerability in WPAdmin WPAdmin AWS CDN plugin <= 2.0.13 versions. |
CVE-2023-37387 | Medium | 5.4 | 2023-07-18 | Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme Classified Listing plugin <= 2.4.5 versions. |
CVE-2023-37386 | Medium | 5.4 | 2023-07-18 | Cross-Site Request Forgery (CSRF) vulnerability in Media Library Helper plugin <= 1.2.0 versions. |
CVE-2023-25036 | Medium | 4.3 | 2023-07-18 | Cross-Site Request Forgery (CSRF) vulnerability in akhlesh-nagar, a.Ankit Social Media Icons Widget plugin <= 1.6 versions. |
CVE-2023-23660 | High | 8.5 | 2023-07-18 | Auth. (subscriber+) SQL Injection (SQLi) vulnerability in MainWP MainWP Maintenance Extension plugin <= 4.1.1 versions. |
CVE-2023-3743 | High | 7.5 | 2023-07-18 | Ap Page Builder, in versions lower than 1.7.8.2, could allow a remote attacker to send a specially crafted SQL query to the product_one_img parameter to retrie… |
CVE-2023-25482 | Medium | 4.3 | 2023-07-18 | Cross-Site Request Forgery (CSRF) vulnerability in Mike Martel WP Tiles plugin <= 1.1.2 versions. |
CVE-2023-25475 | Medium | 4.3 | 2023-07-18 | Cross-Site Request Forgery (CSRF) vulnerability in Vladimir Prelovac Smart YouTube PRO plugin <= 4.3 versions. |
CVE-2023-25473 | Medium | 5.4 | 2023-07-18 | Cross-Site Request Forgery (CSRF) vulnerability in Miro Mannino Flickr Justified Gallery plugin <= 3.5 versions. |
CVE-2023-2433 | Medium | 6.4 | 2023-07-18 | The YARPP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'className' parameter in versions up to, and including, 5.30.3 due to insuffici… |
CVE-2023-3714 | High | 7.5 | 2023-07-18 | The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'edit_group' handler in versio… |
CVE-2023-3713 | High | 8.8 | 2023-07-18 | The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'profile_magic_check_smtp_conn… |
CVE-2023-3709 | Medium | 5.3 | 2023-07-18 | The Royal Elementor Addons plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 1.3.70 due to the plugin… |
CVE-2023-3708 | Medium | 6.1 | 2023-07-18 | Several themes for WordPress by DeoThemes are vulnerable to Reflected Cross-Site Scripting via breadcrumbs in various versions due to insufficient input saniti… |
CVE-2023-3459 | High | 7.2 | 2023-07-18 | The Export and Import Users and Customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'hf_… |
CVE-2023-3403 | Medium | 5.4 | 2023-07-18 | The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pm_upload_csv' function in ve… |
CVE-2023-38434 | High | 7.5 | 2023-07-18 | xHTTP 72f812d has a double free in close_connection in xhttp.c via a malformed HTTP request method. |
CVE-2023-34143 | Medium | 5.6 | 2023-07-18 | Improper Validation of Certificate with Host Mismatch vulnerability in Hitachi Device Manager on Windows, Linux (Device Manager Server, Device Manager Agent, H… |
CVE-2023-34142 | Critical | 9.0 | 2023-07-18 | Cleartext Transmission of Sensitive Information vulnerability in Hitachi Device Manager on Windows, Linux (Device Manager Server, Device Manager Agent, Host Da… |
CVE-2023-31998 | High | 7.5 | 2023-07-18 | A heap overflow vulnerability found in EdgeRouters and Aircubes allows a malicious actor to interrupt UPnP service to said devices. |
CVE-2023-38432 | Critical | 9.1 | 2023-07-18 | An issue was discovered in the Linux kernel before 6.3.10. fs/smb/server/smb2misc.c in ksmbd does not validate the relationship between the command payload siz… |
CVE-2023-38431 | Critical | 9.1 | 2023-07-18 | An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/connection.c in ksmbd does not validate the relationship between the NetBIOS header's l… |
CVE-2023-38430 | Critical | 9.1 | 2023-07-18 | An issue was discovered in the Linux kernel before 6.3.9. ksmbd does not validate the SMB request protocol ID, leading to an out-of-bounds read. |
CVE-2023-38429 | Critical | 9.8 | 2023-07-18 | An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/connection.c in ksmbd has an off-by-one error in memory allocation (because of ksmbd_smb2_ch… |
CVE-2023-38428 | Critical | 9.1 | 2023-07-18 | An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/smb2pdu.c in ksmbd does not properly check the UserName value because it does not consider t… |
CVE-2023-38427 | Critical | 9.8 | 2023-07-18 | An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/smb2pdu.c in ksmbd has an integer underflow and out-of-bounds read in deassemble_neg_co… |
CVE-2023-38426 | Critical | 9.1 | 2023-07-18 | An issue was discovered in the Linux kernel before 6.3.4. ksmbd has an out-of-bounds read in smb2_find_context_vals when create_context's name_len is larger th… |
CVE-2023-37479 | Medium | 5.3 | 2023-07-17 | Open Enclave is a hardware-agnostic open source library for developing applications that utilize Hardware-based Trusted Execution Environments, also known as E… |
CVE-2023-3724 | Critical | 9.1 | 2023-07-17 | If a TLS 1.3 client gets neither a PSK (pre shared key) extension nor a KSE (key share extension) when connecting to a malicious server, a default predictable… |
CVE-2023-38409 | Medium | 5.5 | 2023-07-17 | An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before 6.2.12. Because an assignment occurs only for the firs… |
CVE-2023-37476 | Medium | 5.5 | 2023-07-17 | OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code exe… |
CVE-2023-38405 | High | 7.5 | 2023-07-17 | On Crestron 3-Series Control Systems before 1.8001.0187, crafting and sending a specific BACnet packet can cause a crash. |
CVE-2023-38404 | High | 7.2 | 2023-07-17 | The XPRTLD web application in Veritas InfoScale Operations Manager (VIOM) before 8.0.0.410 allows an authenticated attacker to upload all types of files to the… |
CVE-2023-38403 | High | 7.5 | 2023-07-17 | iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field. |
CVE-2023-37266 | Critical | 9.8 | 2023-07-17 | CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and… |
CVE-2023-37265 | Critical | 9.8 | 2023-07-17 | CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification an unauthenticated attackers can execute arbitrary commands as `root`… |
CVE-2023-37781 | Medium | 6.5 | 2023-07-17 | An issue in the emqx_sn plugin of EMQX v4.3.8 allows attackers to execute a directory traversal via uploading a crafted .txt file. |
CVE-2023-37770 | Medium | 5.5 | 2023-07-17 | faust commit ee39a19 was discovered to contain a stack overflow via the component boxppShared::print() at /boxes/ppbox.cpp. |
CVE-2023-37769 | Medium | 6.5 | 2023-07-17 | stress-test master commit e4c878 was discovered to contain a FPE vulnerability via the component combine_inner at /pixman-combine-float.c. |
CVE-2023-37461 | Medium | 5.6 | 2023-07-17 | Metersphere is an opensource testing framework. Files uploaded to Metersphere may define a `belongType` value with a relative path like `../../../../` which ma… |
CVE-2023-28864 | Medium | 5.5 | 2023-07-17 | Progress Chef Infra Server before 15.7 allows a local attacker to exploit a /var/opt/opscode/local-mode-cache/backup world-readable temporary backup path to ac… |
CVE-2023-37791 | Critical | 9.8 | 2023-07-17 | D-Link DIR-619L v2.04(TW) was discovered to contain a stack overflow via the curTime parameter at /goform/formLogin. |
CVE-2023-34141 | High | 8.0 | 2023-07-17 | A command injection vulnerability in the access point (AP) management feature of the Zyxel ATP series firmware versions 5.00 through 5.36 Patch 2, USG FLEX ser… |
CVE-2023-34140 | Medium | 6.5 | 2023-07-17 | A buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.36 Patch 2, USG FLEX series firmware versions 4.50 through 5.36 Patch… |
CVE-2023-34139 | High | 8.8 | 2023-07-17 | A command injection vulnerability in the Free Time WiFi hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.36 Patch 2 and VPN series… |