2023 CVEs (page 197)
Page 197 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-34138 | High | 8.0 | 2023-07-17 | A command injection vulnerability in the hotspot management feature of the Zyxel ATP series firmware versions 4.60 through 5.36 Patch 2, USG FLEX series firmwa… |
CVE-2023-33012 | High | 8.8 | 2023-07-17 | A command injection vulnerability in the configuration parser of the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware ver… |
CVE-2023-33011 | High | 8.8 | 2023-07-17 | A format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2… |
CVE-2023-37475 | High | 7.5 | 2023-07-17 | Hamba avro is a go lang encoder/decoder implementation of the avro codec specification. In affected versions a well-crafted string passed to avro's `github.com… |
CVE-2023-34669 | High | 7.5 | 2023-07-17 | TOTOLINK CP300+ V5.2cu.7594 contains a Denial of Service vulnerability in function RebootSystem of the file lib/cste_modules/system which can reboot the system. |
CVE-2023-28767 | High | 8.8 | 2023-07-17 | The configuration parser fails to sanitize user-controlled input in the Zyxel ATP series firmware versions 5.10 through 5.36, USG FLEX series firmware versions… |
CVE-2023-3615 | High | 8.1 | 2023-07-17 | Mattermost iOS app fails to properly validate the server certificate while initializing the TLS connection allowing a network attacker to intercept the WebSock… |
CVE-2023-3614 | Medium | 4.3 | 2023-07-17 | Mattermost fails to properly validate a gif image file, allowing an attacker to consume a significant amount of server resources, making the server unresponsiv… |
CVE-2023-3613 | Low | 3.5 | 2023-07-17 | Mattermost WelcomeBot plugin fails to to validate the membership status when inviting or adding users to channels allowing guest accounts to be added or invite… |
CVE-2023-3593 | Medium | 4.3 | 2023-07-17 | Mattermost fails to properly validate markdown, allowing an attacker to crash the server via a specially crafted markdown input. |
CVE-2023-3591 | Medium | 4.8 | 2023-07-17 | Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created. |
CVE-2023-3590 | Low | 3.1 | 2023-07-17 | Mattermost fails to delete card attachments in Boards, allowing an attacker to access deleted attachments. |
CVE-2023-3587 | Low | 2.7 | 2023-07-17 | Mattermost fails to properly show information in the UI, allowing a system admin to modify a board state allowing any user with a valid sharing link to join th… |
CVE-2023-3586 | Medium | 4.2 | 2023-07-17 | Mattermost fails to disable public Boards after the "Enable Publicly-Shared Boards" configuration option is disabled, resulting in previously-shared public Boa… |
CVE-2023-3585 | Medium | 4.3 | 2023-07-17 | Mattermost Boards fail to properly validate a board link, allowing an attacker to crash a channel by posting a specially crafted boards link. |
CVE-2023-3584 | Low | 3.1 | 2023-07-17 | Mattermost fails to properly check the authorization of POST /api/v4/teams when passing a team override scheme ID in the request, allowing an authenticated att… |
CVE-2023-3582 | Medium | 4.3 | 2023-07-17 | Mattermost fails to verify channel membership when linking a board to a channel allowing a low-privileged authenticated user to link a Board to a private chann… |
CVE-2023-3581 | Medium | 6.2 | 2023-07-17 | Mattermost fails to properly validate the origin of a websocket connection allowing a MITM attacker on Mattermost to access the websocket APIs. |
CVE-2023-3577 | Low | 3.5 | 2023-07-17 | Mattermost fails to properly restrict requests to localhost/intranet during the interactive dialog, which could allow an attacker to perform a limited blind SS… |
CVE-2023-37985 | Medium | 4.3 | 2023-07-17 | Cross-Site Request Forgery (CSRF) vulnerability in FiveStarPlugins Restaurant Menu and Food Ordering plugin <= 2.4.6 versions. |
CVE-2023-37974 | Medium | 5.4 | 2023-07-17 | Cross-Site Request Forgery (CSRF) vulnerability in Justin Klein WP Social AutoConnect plugin <= 4.6.1 versions. |
CVE-2023-36656 | Medium | 5.4 | 2023-07-17 | Cross Site Scripting (XSS) vulnerability in Jaegertracing Jaeger UI before v.1.31.0 allows a remote attacker to execute arbitrary code via the KeyValuesTable c… |
CVE-2023-35818 | Medium | 6.8 | 2023-07-17 | An issue was discovered on Espressif ESP32 3.0 (ESP32_rev300 ROM) devices. An EMFI attack on ECO3 provides the attacker with a capability to influence the PC v… |
CVE-2023-37968 | Medium | 5.4 | 2023-07-17 | Cross-Site Request Forgery (CSRF) vulnerability in Faboba Falang multilanguage for WordPress plugin <= 1.3.39 versions. |
CVE-2023-36514 | Medium | 6.5 | 2023-07-17 | Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Shipping Multiple Addresses plugin <= 3.8.5 versions. |
CVE-2023-36513 | Medium | 5.4 | 2023-07-17 | Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce AutomateWoo plugin <= 5.7.5 versions. |
CVE-2023-36511 | Medium | 4.3 | 2023-07-17 | Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Order Barcodes plugin <= 1.6.4 versions. |
CVE-2023-34005 | Medium | 6.5 | 2023-07-17 | Cross-Site Request Forgery (CSRF) vulnerability in Etoile Web Design Front End Users plugin <= 3.2.24 versions. |
CVE-2023-31853 | Medium | 6.1 | 2023-07-17 | Cudy LT400 1.13.4 is vulnerable Cross Site Scripting (XSS) in /cgi-bin/luci/admin/network/bandwidth via the icon parameter. |
CVE-2023-31851 | Medium | 6.1 | 2023-07-17 | Cudy LT400 1.13.4 is has a cross-site scripting (XSS) vulnerability in /cgi-bin/luci/admin/network/wireless/status via the iface parameter. |
CVE-2023-2958 | Critical | 9.8 | 2023-07-17 | Authorization Bypass Through User-Controlled Key vulnerability in Origin Software ATS Pro allows Authentication Abuse, Authentication Bypass. This issue affec… |
CVE-2023-3376 | Critical | 9.8 | 2023-07-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Digital Strategy Zekiweb allows SQL Injection. This issu… |
CVE-2023-3245 | Medium | 4.8 | 2023-07-17 | The Floating Chat Widget WordPress plugin before 3.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2023-3186 | Critical | 9.8 | 2023-07-17 | The Popup by Supsystic WordPress plugin before 1.10.19 has a prototype pollution vulnerability that could allow an attacker to inject arbitrary properties into… |
CVE-2023-3182 | Medium | 6.1 | 2023-07-17 | The Membership WordPress plugin before 3.2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2023-3179 | High | 8.8 | 2023-07-17 | The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users w… |
CVE-2023-3041 | Medium | 6.1 | 2023-07-17 | The Autochat Automatic Conversation WordPress plugin through 1.1.7 does not sanitise and escape user input before outputting it back on the page, leading to a… |
CVE-2023-35880 | Medium | 5.4 | 2023-07-17 | Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Brands plugin <= 1.6.49 versions. |
CVE-2023-35096 | Medium | 6.5 | 2023-07-17 | Cross-Site Request Forgery (CSRF) vulnerability in myCred plugin <= 2.5 versions. |
CVE-2023-35089 | Medium | 4.3 | 2023-07-17 | Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Recipe Maker For Your Food Blog from Zip Recipes plugin <= 8.0.7 versions. |
CVE-2023-35038 | Medium | 5.4 | 2023-07-17 | Cross-Site Request Forgery (CSRF) vulnerability in wpexperts.Io WP PDF Generator plugin <= 1.2.2 versions. |
CVE-2023-31852 | Medium | 6.1 | 2023-07-17 | Cudy LT400 1.13.4 is vulnerable to Cross Site Scripting (XSS) in cgi-bin/luci/admin/network/wireless/config via the iface parameter. |
CVE-2023-31216 | Medium | 4.3 | 2023-07-17 | Cross-Site Request Forgery (CSRF) vulnerability in Ultimate Member plugin <= 2.6.0 versions. |
CVE-2023-2963 | Critical | 9.8 | 2023-07-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oliva Expertise Oliva Expertise EKS allows SQL Injection… |
CVE-2023-2960 | Medium | 6.1 | 2023-07-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Oliva Expertise Oliva Expertise EKS allows Cross-Site Scr… |
CVE-2023-2959 | High | 7.5 | 2023-07-17 | Authentication Bypass by Primary Weakness vulnerability in Oliva Expertise Oliva Expertise EKS allows Collect Data as Provided by Users. This issue affects Ol… |
CVE-2023-2701 | Medium | 6.1 | 2023-07-17 | The Gravity Forms WordPress plugin before 2.7.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting… |
CVE-2023-2636 | High | 8.8 | 2023-07-17 | The AN_GradeBook WordPress plugin through 5.0.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injectio… |
CVE-2023-2579 | Medium | 5.4 | 2023-07-17 | The InventoryPress WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow users with the role of author and above to… |
CVE-2023-2330 | High | 8.8 | 2023-07-17 | The Caldera Forms Google Sheets Connector WordPress plugin before 1.3 does not have CSRF check when updating its Access Code, which could allow attackers to ma… |
CVE-2023-2329 | High | 8.8 | 2023-07-17 | The WooCommerce Google Sheet Connector WordPress plugin before 1.3.6 does not have CSRF check when updating its Access Code, which could allow attackers to mak… |
CVE-2023-2143 | Medium | 5.4 | 2023-07-17 | The Enable SVG, WebP & ICO Upload WordPress plugin through 1.0.3 does not sanitize SVG file contents, leading to a Cross-Site Scripting vulnerability. |
CVE-2023-1893 | Medium | 6.1 | 2023-07-17 | The Login Configurator WordPress plugin through 2.1 does not properly escape a URL parameter before outputting it to the page, leading to a reflected cross-sit… |
CVE-2023-0439 | Medium | 5.4 | 2023-07-17 | The NEX-Forms WordPress plugin before 8.4.4 does not escape its form name, which could lead to Stored Cross-Site Scripting issues. By default only SuperAdmins… |
CVE-2023-2912 | Medium | 5.9 | 2023-07-17 | Use After Free vulnerability in Secomea SiteManager Embedded allows Obstruction. |
CVE-2023-27424 | Medium | 5.4 | 2023-07-17 | Cross-Site Request Forgery (CSRF) vulnerability in Korol Yuriy aka Shra Inactive User Deleter plugin <= 1.59 versions. |
CVE-2023-34036 | Medium | 5.3 | 2023-07-17 | Reactive web applications that use Spring HATEOAS to produce hypermedia-based responses might be exposed to malicious forwarded headers if they are not behind… |
CVE-2023-27606 | Medium | 5.4 | 2023-07-17 | Cross-Site Request Forgery (CSRF) vulnerability in Sajjad Hossain WP Reroute Email plugin <= 1.4.6 versions. |
CVE-2023-23719 | Medium | 5.4 | 2023-07-17 | Cross-Site Request Forgery (CSRF) vulnerability in Premmerce plugin <= 1.3.17 versions. |
CVE-2023-23646 | Medium | 4.3 | 2023-07-17 | Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Album Gallery – WordPress Gallery plugin <= 1.4.9 versions. |
CVE-2023-22672 | Medium | 4.3 | 2023-07-17 | Cross-Site Request Forgery (CSRF) vulnerability in Mr.Vibe vSlider Multi Image Slider for WordPress plugin <= 4.1.2 versions. |
CVE-2023-26512 | Critical | 9.8 | 2023-07-17 | CWE-502 Deserialization of Untrusted Data at the rabbitmq-connector plugin module in Apache EventMesh (incubating) V1.7.0\V1.8.0 on windows\linux\mac os e.g. p… |
CVE-2023-3700 | Medium | 6.3 | 2023-07-17 | Authorization Bypass Through User-Controlled Key in GitHub repository alextselegidis/easyappointments prior to 1.5.0. |
CVE-2023-2760 | High | 7.6 | 2023-07-17 | An SQL injection vulnerability exists in TapHome core HandleMessageUpdateDevicePropertiesRequest function before version 2023.2, allowing low privileged users… |
CVE-2023-2759 | High | 8.8 | 2023-07-17 | A hidden API exists in TapHome's core platform before version 2023.2 that allows an authenticated, low privileged user to change passwords of other users witho… |
CVE-2023-3696 | Critical | 9.8 | 2023-07-17 | Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4. |
CVE-2023-3695 | Medium | 6.3 | 2023-07-17 | A vulnerability classified as critical has been found in Campcodes Beauty Salon Management System 1.0. Affected is an unknown function of the file add-product… |
CVE-2023-35012 | Medium | 6.7 | 2023-07-17 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 with a Federated configuration is vulnerable to a stack-based buffer overflow, caused by… |
CVE-2023-3694 | Medium | 6.3 | 2023-07-17 | A vulnerability, which was classified as critical, has been found in SourceCodester/projectworlds House Rental and Property Listing 1.0. This issue affects som… |
CVE-2023-35901 | Low | 2.7 | 2023-07-17 | IBM Robotic Process Automation 21.0.0 through 21.0.7.6 and 23.0.0 through 23.0.6 is vulnerable to client side validation bypass which could allow invalid chang… |
CVE-2023-33857 | Medium | 5.3 | 2023-07-17 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain system information using a specially crafted query that could aid in further att… |
CVE-2023-30989 | High | 8.4 | 2023-07-16 | IBM Performance Tools for i 7.2, 7.3, 7.4, and 7.5 contains a local privilege escalation vulnerability. A malicious actor with command line access to the host… |
CVE-2023-30988 | High | 8.4 | 2023-07-16 | The IBM i 7.2, 7.3, 7.4, and 7.5 product Facsimile Support for i contains a local privilege escalation vulnerability. A malicious actor with command line acce… |
CVE-2023-3693 | High | 7.3 | 2023-07-16 | A vulnerability classified as critical was found in SourceCodester Life Insurance Management System 1.0. This vulnerability affects unknown code of the file lo… |
CVE-2023-3691 | Low | 3.5 | 2023-07-16 | A vulnerability, which was classified as problematic, was found in layui up to v2.8.0-rc.16. This affects an unknown part of the component HTML Attribute Handl… |
CVE-2023-38379 | High | 7.5 | 2023-07-16 | The web interface on the RIGOL MSO5000 digital oscilloscope with firmware 00.01.03.00.03 allows remote attackers to change the admin password via a zero-length… |
CVE-2023-38378 | Critical | 9.8 | 2023-07-16 | The web interface on the RIGOL MSO5000 digital oscilloscope with firmware 00.01.03.00.03 allows remote attackers to execute arbitrary code via shell metacharac… |
CVE-2023-3690 | Medium | 6.3 | 2023-07-16 | A vulnerability, which was classified as critical, has been found in Bylancer QuickOrder 6.3.7. Affected by this issue is some unknown functionality of the fil… |
CVE-2023-3689 | Medium | 6.3 | 2023-07-16 | A vulnerability classified as critical was found in Bylancer QuickQR 6.3.7. Affected by this vulnerability is an unknown functionality of the file /blog of the… |
CVE-2023-3688 | Medium | 6.3 | 2023-07-16 | A vulnerability classified as critical has been found in Bylancer QuickJob 6.1. Affected is an unknown function of the component GET Parameter Handler. The man… |
CVE-2023-3687 | Medium | 6.3 | 2023-07-16 | A vulnerability was found in Bylancer QuickVCard 2.1. It has been rated as critical. This issue affects some unknown processing of the file /blog of the compon… |
CVE-2023-3686 | Medium | 6.3 | 2023-07-16 | A vulnerability was found in Bylancer QuickAI OpenAI 3.8.1. It has been declared as critical. This vulnerability affects unknown code of the file /blog of the… |
CVE-2023-3685 | Low | 3.5 | 2023-07-16 | A vulnerability was found in Nesote Inout Search Engine AI Edition 1.1. It has been classified as problematic. This affects an unknown part of the file /index… |
CVE-2023-3684 | Low | 3.5 | 2023-07-16 | A vulnerability was found in LivelyWorks Articart 2.0.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /change… |
CVE-2023-3683 | Low | 3.5 | 2023-07-16 | A vulnerability has been found in LivelyWorks Articart 2.0.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the f… |
CVE-2023-3692 | High | 7.2 | 2023-07-16 | Unrestricted Upload of File with Dangerous Type in GitHub repository admidio/admidio prior to 4.2.10. |
CVE-2023-30791 | High | 7.1 | 2023-07-15 | Plane version 0.7.1-dev allows an attacker to change the avatar of his profile, which allows uploading files with HTML extension that interprets both HTML and… |
CVE-2023-2507 | Critical | 9.3 | 2023-07-15 | CleverTap Cordova Plugin version 2.6.2 allows a remote attacker to execute JavaScript code in any application that is opened via a specially constructed deepli… |
CVE-2023-2268 | High | 7.1 | 2023-07-15 | Plane version 0.7.1 allows an unauthenticated attacker to view all stored server files of all users. |
CVE-2023-3682 | Medium | 6.3 | 2023-07-15 | A vulnerability, which was classified as critical, was found in Nesote Inout Blockchain EasyPayments 1.0. Affected is an unknown function of the file /index.ph… |
CVE-2023-3681 | Low | 3.5 | 2023-07-15 | A vulnerability classified as problematic was found in Campcodes Retro Cellphone Online Store 1.0. This vulnerability affects unknown code of the file /admin/m… |
CVE-2023-3680 | Medium | 6.3 | 2023-07-15 | A vulnerability classified as critical has been found in SourceCodester Lost and Found Information System 1.0. This affects an unknown part of the file /classe… |
CVE-2023-3679 | Medium | 6.3 | 2023-07-15 | A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been rated as critical. Affected by this issue is some unknown functi… |
CVE-2023-3678 | Medium | 6.3 | 2023-07-15 | A vulnerability was found in SourceCodester AC Repair and Services System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown f… |
CVE-2023-38350 | Medium | 5.4 | 2023-07-15 | PNP4Nagios through 81ebfc5 has stored XSS in the AJAX controller via the basket API and filters. This affects 0.6.26. |
CVE-2023-38349 | High | 8.8 | 2023-07-15 | PNP4Nagios through 81ebfc5 lacks CSRF protection in the AJAX controller. This affects 0.6.26. |
CVE-2023-35802 | Critical | 9.8 | 2023-07-15 | IQ Engine before 10.6r1 on Extreme Network AP devices has a Buffer Overflow in the implementation of the CAPWAP protocol that may be exploited to obtain elevat… |
CVE-2023-37794 | Critical | 9.8 | 2023-07-14 | WAYOS FBM-291W 19.09.11V was discovered to contain a command injection vulnerability via the component /upgrade_filter.asp. |
CVE-2023-37793 | Critical | 9.8 | 2023-07-14 | WAYOS FBM-291W 19.09.11V was discovered to contain a buffer overflow via the component /upgrade_filter.asp. |
CVE-2023-38337 | High | 7.5 | 2023-07-14 | rswag before 2.10.1 allows remote attackers to read arbitrary JSON and YAML files via directory traversal, because rswag-api can expose a file that is not the… |