2023 CVEs (page 2)
Page 2 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-54364 | Medium | 6.1 | 2026-04-09 | Joomla HikaShop 4.7.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating… |
CVE-2023-54363 | Medium | 6.1 | 2026-04-09 | Joomla Solidres 2.13.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulatin… |
CVE-2023-54362 | Medium | 6.1 | 2026-04-09 | Joomla VirtueMart Shopping-Cart 4.0.12 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by manipulatin… |
CVE-2023-54361 | Medium | 6.1 | 2026-04-09 | Joomla iProperty Real Estate 4.1.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by manipulating th… |
CVE-2023-54360 | Medium | 6.1 | 2026-04-09 | Joomla JLex Review 6.0.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by manipulating the review_i… |
CVE-2023-54359 | High | 8.2 | 2026-04-09 | WordPress adivaha Travel Plugin 2.3 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database querie… |
CVE-2023-54358 | Medium | 6.1 | 2026-04-09 | WordPress adivaha Travel Plugin 2.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts b… |
CVE-2023-46945 | Critical | 9.1 | 2026-04-08 | QD 20230821 is vulnerable to Server-side request forgery (SSRF) via a crafted request |
CVE-2023-7343 | High | 7.8 | 2026-04-02 | Hirschmann Industrial HiVision versions 05.0.00 through 08.3.01 prior to 08.3.02 contain an arbitrary code execution vulnerability triggered when an administra… |
CVE-2023-7342 | High | 8.8 | 2026-04-02 | HiSecOS web server versions 03.4.00 prior to 04.1.00 contains a privilege escalation vulnerability that allows authenticated users with operator or auditor rol… |
CVE-2023-7340 | Low | 3.5 | 2026-03-27 | Wazuh authd contains a heap-buffer overflow vulnerability that allows attackers to cause memory corruption and malformed heap data by sending specially crafted… |
CVE-2023-7339 | Medium | 6.5 | 2026-03-27 | Stack-based buffer overflow vulnerability in Softing Industrial Automation GmbH gateways allows overflow buffers. This issue affects pnGate: through 1.30 epGat… |
CVE-2023-7338 | High | 7.5 | 2026-03-26 | Ruckus Unleashed contains a remote code execution vulnerability in the web-based management interface that allows authenticated remote attackers to execute arb… |
CVE-2023-40693 | Medium | 5.4 | 2026-03-13 | IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, and 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1 are vulnerable to… |
CVE-2023-43010 | High | 8.8 | 2026-03-12 | The issue was addressed with improved memory handling. This issue is fixed in iOS 17.2 and iPadOS 17.2, macOS Sonoma 14.2, Safari 17.2, iOS 16.7.15 and iPadOS… |
CVE-2023-27573 | Critical | 9.0 | 2026-03-11 | netbox-docker before 2.5.0 has a superuser account with default credentials (admin password for the admin account, and 0123456789abcdef0123456789abcdef01234567… |
CVE-2023-7337 | High | 7.5 | 2026-03-04 | The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL Injection via the 'js-support-ticket-token-tkstatus' cookie… |
CVE-2023-31044 | Low | 2.0 | 2026-03-03 | An issue was discovered in Nokia Impact before Mobile 23_FP1. In Impact DM 19.11 onwards, a remote authenticated user, using the Add Campaign functionality, ca… |
CVE-2023-31364 | | 2026-02-26 | Improper handling of direct memory writes in the input-output memory management unit could allow a malicious guest virtual machine (VM) to flood a host with wr… | |
CVE-2023-38005 | Medium | 4.3 | 2026-02-17 | IBM Cloud Pak System 2.3.3.6, 2.3.3.7, 2.3.4.0, 2.3.4.1, and 2.3.5.0 could allow an authenticated user to perform unauthorized tasks due to improper access con… |
CVE-2023-38265 | Medium | 5.3 | 2026-02-17 | IBM Cloud Pak System 2.3.3.6, 2.3.3.7, 2.3.4.0, 2.3.4.1, and 2.3.5.0 could disclose folder location information to an unauthenticated attacker that could aid i… |
CVE-2023-31323 | | 2026-02-12 | Type confusion in the AMD Secure Processor (ASP) could allow an attacker to pass a malformed argument to the External Global Memory Interconnect Trusted Agent… | |
CVE-2023-20601 | | 2026-02-12 | Improper input validation within RAS TA Driver can allow a local attacker to access out-of-bounds memory, potentially resulting in a denial-of-service conditio… | |
CVE-2023-31313 | High | 7.2 | 2026-02-12 | An unintended proxy or intermediary in the AMD power management firmware (PMFW) could allow a privileged attacker to send malformed messages to the system mana… |
CVE-2023-31324 | High | 7.8 | 2026-02-11 | A Time-of-check time-of-use (TOCTOU) race condition in the AMD Secure Processor (ASP) could allow an attacker to modify External Global Memory Interconnect Tru… |
CVE-2023-20548 | High | 7.8 | 2026-02-11 | A Time-of-check time-of-use (TOCTOU) race condition in the AMD Secure Processor (ASP) could allow an attacker to corrupt memory resulting in loss of integrity… |
CVE-2023-20514 | | 2026-02-11 | Improper handling of parameters in the AMD Secure Processor (ASP) could allow a privileged attacker to pass an arbitrary memory value to functions in the trust… | |
CVE-2023-38281 | Medium | 5.3 | 2026-02-04 | IBM Cloud Pak System does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a… |
CVE-2023-38017 | Medium | 5.3 | 2026-02-04 | IBM Cloud Pak System is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the… |
CVE-2023-38010 | Medium | 5.3 | 2026-02-04 | IBM Cloud Pak System displays sensitive information in user messages that could aid in further attacks against the system. |
CVE-2023-54343 | Medium | 6.4 | 2026-02-01 | QWE DL 2.0.1 mobile web application contains a persistent input validation vulnerability allowing remote attackers to inject malicious script code through path… |
CVE-2023-37525 | Medium | 5.3 | 2026-01-28 | A sensitive information disclosure in HCL BigFix Compliance allows a remote attacker to access files under the WEB-INF directory, which may contain Java class… |
CVE-2023-7335 | | 2026-01-22 | EduSoho versions prior to 22.4.7 contain an arbitrary file read vulnerability in the classroom-course-statistics export functionality. A remote, unauthenticate… | |
CVE-2023-7334 | Critical | 9.8 | 2026-01-15 | Changjetong T+ versions up to and including 16.x contain a .NET deserialization vulnerability in an AjaxPro endpoint that can lead to remote code execution. A… |
CVE-2023-54341 | Medium | 6.1 | 2026-01-13 | Webgrind 1.1 and before contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts via the file… |
CVE-2023-54340 | High | 8.2 | 2026-01-13 | WorkOrder CMS 0.1.0 contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login by manipulating username and password paramete… |
CVE-2023-54339 | Critical | 9.8 | 2026-01-13 | Webgrind 1.1 contains a remote command execution vulnerability that allows unauthenticated attackers to inject OS commands via the dataFile parameter in index… |
CVE-2023-54338 | High | 8.4 | 2026-01-13 | Tftpd32 SE 4.60 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated privileges. Att… |
CVE-2023-54337 | Critical | 9.1 | 2026-01-13 | Sysax Multi Server 6.95 contains a denial of service vulnerability in the administrative password field that allows attackers to crash the application. Attacke… |
CVE-2023-54336 | High | 8.4 | 2026-01-13 | Mediconta 3.7.27 contains an unquoted service path vulnerability in the servermedicontservice that allows local users to potentially execute code with elevated… |
CVE-2023-54335 | Critical | 9.8 | 2026-01-13 | eXtplorer 2.1.14 contains an authentication bypass vulnerability that allows attackers to login without a password by manipulating the login request. Attackers… |
CVE-2023-54334 | Critical | 9.8 | 2026-01-13 | Explorer32++ 1.3.5.531 contains a buffer overflow vulnerability in Structured Exception Handler (SEH) records that allows attackers to execute arbitrary code… |
CVE-2023-54333 | High | 8.2 | 2026-01-13 | Social-Share-Buttons 2.2.3 contains a critical SQL injection vulnerability in the project_id parameter that allows attackers to manipulate database queries. At… |
CVE-2023-54332 | Medium | 6.1 | 2026-01-13 | Jetpack 11.4 contains a cross-site scripting vulnerability in the contact form module that allows attackers to inject malicious scripts through the post_id par… |
CVE-2023-54331 | High | 7.8 | 2026-01-13 | Outline 1.6.0 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated system privileges… |
CVE-2023-54330 | Critical | 9.8 | 2026-01-13 | Inbit Messenger versions 4.6.0 to 4.9.0 contain a remote stack-based buffer overflow vulnerability that allows unauthenticated attackers to execute arbitrary c… |
CVE-2023-54329 | Critical | 9.8 | 2026-01-13 | Inbit Messenger 4.6.0 - 4.9.0 contains a remote command execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by exploiti… |
CVE-2023-54328 | Medium | 6.5 | 2026-01-13 | AimOne Video Converter 2.04 Build 103 contains a buffer overflow vulnerability in its registration form that causes application crashes. Attackers can generate… |
CVE-2023-53985 | Medium | 6.1 | 2026-01-13 | Zstore, now referred to as Zippy CRM, 6.5.4 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts through u… |
CVE-2023-53984 | High | 8.4 | 2026-01-13 | Clevo HotKey Clipboard 2.1.0.6 contains an unquoted service path vulnerability in the HKClipSvc service that allows local non-privileged users to potentially e… |
CVE-2023-36331 | High | 8.2 | 2026-01-12 | Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the q… |
CVE-2023-7333 | Medium | 5.3 | 2026-01-07 | A weakness has been identified in bluelabsio records-mover up to 1.5.4. The affected element is an unknown function of the component Table Object Handler. This… |
CVE-2023-52212 | Medium | 5.4 | 2026-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in Automattic WP Job Manager allows Cross Site Request Forgery.This issue affects WP Job Manager: from n/a thro… |
CVE-2023-51513 | Medium | 6.5 | 2026-01-05 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in INTINITUM FORM Geo Controller allows DOM-Based XSS… |
CVE-2023-50897 | Critical | 9.1 | 2026-01-05 | Unrestricted Upload of File with Dangerous Type vulnerability in Meow Apps Media File Renamer allows Using Malicious Files.This issue affects Media File Rename… |
CVE-2023-49186 | High | 7.1 | 2026-01-05 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in KlbTheme Machic Core allows DOM-Based XSS.This iss… |
CVE-2023-7332 | | 2025-12-31 | PocketMine-MP versions prior to 4.18.1 contain an improper input validation vulnerability in inventory transaction handling. A remote attacker with a valid pla… | |
CVE-2023-7331 | Medium | 4.7 | 2025-12-31 | A vulnerability was detected in PKrystian Full-Stack-Bank up to bf73a0179e3ff07c0d7dc35297cea0be0e5b1317. This vulnerability affects unknown code of the compon… |
CVE-2023-54327 | Critical | 9.8 | 2025-12-30 | Tinycontrol LAN Controller 1.58a contains an authentication bypass vulnerability that allows unauthenticated attackers to change admin passwords through a craf… |
CVE-2023-54163 | High | 7.5 | 2025-12-30 | NLB mKlik Macedonia 3.3.12 contains a SQL injection vulnerability in international transfer parameters that allows attackers to manipulate database queries. At… |
CVE-2023-53983 | Critical | 9.8 | 2025-12-30 | Anevia Flamingo XL/XS 3.6.20 contains a critical vulnerability with weak default administrative credentials that can be easily guessed. Attackers can leverage… |
CVE-2023-54326 | High | 7.8 | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: misc: pci_endpoint_test: Free IRQs before removing the device In pci_endpoint_test_remove… |
CVE-2023-54325 | High | 7.1 | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix out-of-bounds read When preparing an AER-CTR request, the driver copies… |
CVE-2023-54324 | | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: dm: fix a race condition in retrieve_deps There's a race condition in the multipath targe… | |
CVE-2023-54323 | | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: cxl/pmem: Fix nvdimm registration races A loop of the form: while true; do modprobe… | |
CVE-2023-54322 | | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: arm64: set __exception_irq_entry with __irq_entry as a default filter_irq_stacks() is sup… | |
CVE-2023-54321 | Medium | 5.5 | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: driver core: fix potential null-ptr-deref in device_add() I got the following null-ptr-de… |
CVE-2023-54320 | | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd: pmc: Fix memory leak in amd_pmc_stb_debugfs_open_v2() Function amd_pmc_… | |
CVE-2023-54319 | | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: pinctrl: at91-pio4: check return value of devm_kasprintf() devm_kasprintf() returns a poi… | |
CVE-2023-54318 | High | 8.8 | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_add Whil… |
CVE-2023-54317 | High | 7.8 | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: dm flakey: don't corrupt the zero page When we need to zero some range on a block device… |
CVE-2023-54316 | | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: refscale: Fix uninitalized use of wait_queue_head_t Running the refscale test occasionall… | |
CVE-2023-54315 | | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: powerpc/powernv/sriov: perform null check on iov before dereferencing iov Currently point… | |
CVE-2023-54314 | | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: media: af9005: Fix null-ptr-deref in af9005_i2c_xfer In af9005_i2c_xfer, msg is controlle… | |
CVE-2023-54313 | | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: ovl: fix null pointer dereference in ovl_get_acl_rcu() Following process: P1… | |
CVE-2023-54312 | | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: samples/bpf: Fix buffer overflow in tcp_basertt Using sizeof(nv) or strlen(nv)+1 is corre… | |
CVE-2023-54311 | | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: ext4: fix deadlock when converting an inline directory in nojournal mode In no journal mo… | |
CVE-2023-54310 | High | 7.8 | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition mp… |
CVE-2023-54309 | | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: tpm: tpm_vtpm_proxy: fix a race condition in /dev/vtpmx creation /dev/vtpmx is made visib… | |
CVE-2023-54308 | High | 7.8 | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: ALSA: ymfpci: Create card with device-managed snd_devm_card_new() snd_card_ymfpci_remove(… |
CVE-2023-54307 | | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: ptp_qoriq: fix memory leak in probe() Smatch complains that: drivers/ptp/ptp_qoriq.c ptp_… | |
CVE-2023-54306 | High | 7.5 | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: net: tls: avoid hanging tasks on the tx_lock syzbot sent a hung task report and Eric expl… |
CVE-2023-54305 | | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: ext4: refuse to create ea block when umounted The ea block expansion need to access s_roo… | |
CVE-2023-54304 | | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: firmware: meson_sm: fix to avoid potential NULL pointer dereference of_match_device() may… | |
CVE-2023-54303 | High | 7.8 | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpf_perf_event_output The nesting protection in bpf_perf_event… |
CVE-2023-54302 | | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix data race on CQP completion stats CQP completion statistics is read locke… | |
CVE-2023-54301 | | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: serial: 8250_bcm7271: fix leak in `brcmuart_probe` Smatch reports: drivers/tty/serial/825… | |
CVE-2023-54300 | | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx For the reasons also de… | |
CVE-2023-54299 | | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: bus: verify partner exists in typec_altmode_attention Some usb hubs will nego… | |
CVE-2023-54298 | | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: thermal: intel: quark_dts: fix error pointer dereference If alloc_soc_dts() fails, then w… | |
CVE-2023-54297 | | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix memory leak after finding block group with super blocks At exclude_supe… | |
CVE-2023-54296 | | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration Fix a goof where… | |
CVE-2023-54295 | | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type spi_nor_set_erase_type()… | |
CVE-2023-54294 | | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix memleak of md thread In raid10_run(), if setup_conf() succeed and raid10_r… | |
CVE-2023-54293 | | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: bcache: fixup btree_cache_wait list damage We get a kernel crash about "list_add corrupti… | |
CVE-2023-54292 | Critical | 9.8 | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix data race on CQP request done KCSAN detects a data race on cqp_request->r… |
CVE-2023-54291 | | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: vduse: fix NULL pointer dereference vduse_vdpa_set_vq_affinity callback can be called wit… | |
CVE-2023-54289 | | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: scsi: qedf: Fix NULL dereference in error handling Smatch reported: drivers/scsi/qedf/qe… | |
CVE-2023-54288 | | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fortify the spinlock against deadlock by interrupt In the function ieee80… | |
CVE-2023-54287 | | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: tty: serial: imx: disable Ageing Timer interrupt request irq There maybe pending USR inte… |