2023 CVEs (page 204)
Page 204 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-25487 | Medium | 4.3 | 2023-07-11 | Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade PixTypes plugin <= 1.4.14 versions. |
CVE-2023-25468 | Medium | 4.3 | 2023-07-11 | Cross-Site Request Forgery (CSRF) vulnerability in Reservation.Studio Reservation.Studio widget plugin <= 1.0.11 versions. |
CVE-2023-25051 | Medium | 4.3 | 2023-07-11 | Cross-Site Request Forgery (CSRF) vulnerability in Denishua Comment Reply Notification plugin <= 1.4 versions. |
CVE-2023-24421 | Medium | 5.4 | 2023-07-11 | Cross-Site Request Forgery (CSRF) vulnerability in WP Engine PHP Compatibility Checker plugin <= 1.5.2 versions. |
CVE-2023-23997 | Medium | 4.3 | 2023-07-11 | Cross-Site Request Forgery (CSRF) vulnerability in Dave Jesch Database Collation Fix plugin <= 1.2.7 versions. |
CVE-2023-23731 | Medium | 4.3 | 2023-07-11 | Cross-Site Request Forgery (CSRF) vulnerability in HasTheme WishSuite plugin <= 1.3.3 versions. |
CVE-2023-23704 | Medium | 4.3 | 2023-07-11 | Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Comments Ratings plugin <= 1.1.6 versions. |
CVE-2023-1936 | Low | 3.5 | 2023-07-11 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 before 15.11.10, all versions starting from 16.0 before 16.0.6, all vers… |
CVE-2023-23803 | Medium | 4.3 | 2023-07-11 | Cross-Site Request Forgery (CSRF) vulnerability in HasThemes JustTables plugin <= 1.4.9 versions. |
CVE-2023-23791 | Medium | 4.3 | 2023-07-11 | Cross-Site Request Forgery (CSRF) vulnerability in HasThemes HT Menu plugin <= 1.2.1 versions. |
CVE-2023-23792 | Medium | 4.3 | 2023-07-11 | Cross-Site Request Forgery (CSRF) vulnerability in HasThemes Swatchly plugin <= 1.2.0 versions. |
CVE-2023-36925 | High | 7.2 | 2023-07-11 | SAP Solution Manager (Diagnostics agent) - version 7.20, allows an unauthenticated attacker to blindly execute HTTP requests. On successful exploitation, the a… |
CVE-2023-36924 | Medium | 4.9 | 2023-07-11 | While using a specific function, SAP ERP Defense Forces and Public Security - versions 600, 603, 604, 605, 616, 617, 618, 802, 803, 804, 805, 806, 807, allows… |
CVE-2023-36922 | Critical | 9.1 | 2023-07-11 | Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary ope… |
CVE-2023-36921 | High | 7.2 | 2023-07-11 | SAP Solution Manager (Diagnostics agent) - version 7.20, allows an attacker to tamper with headers in a client request. This misleads SAP Diagnostics Agent to… |
CVE-2023-36919 | Medium | 5.3 | 2023-07-11 | In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the Referrer-Policy response header is not i… |
CVE-2023-36918 | Medium | 6.1 | 2023-07-11 | In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the X-Content-Type-Options response header i… |
CVE-2023-36917 | Medium | 5.9 | 2023-07-11 | SAP BusinessObjects Business Intelligence Platform - version 420, 430, allows an unauthorized attacker who had hijacked a user session, to be able to bypass th… |
CVE-2023-35874 | Medium | 6.0 | 2023-07-11 | SAP NetWeaver Application Server ABAP and ABAP Platform - version KRNL64NUC, 7.22, KRNL64NUC 7.22EXT, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KERNEL 7… |
CVE-2023-35873 | Medium | 6.5 | 2023-07-11 | The Runtime Workbench (RWB) of SAP NetWeaver Process Integration - version SAP_XITOOL 7.50, does not perform authentication checks for certain functionalities… |
CVE-2023-35872 | Medium | 6.5 | 2023-07-11 | The Message Display Tool (MDT) of SAP NetWeaver Process Integration - version SAP_XIAF 7.50, does not perform authentication checks for certain functionalities… |
CVE-2023-35871 | High | 7.7 | 2023-07-11 | The SAP Web Dispatcher - versions WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.85, WEBDISP 7.89, WEBDISP 7.91, WEBDISP 7.92, WEBDISP 7.93, KERNEL 7.53… |
CVE-2023-35870 | Medium | 6.3 | 2023-07-11 | When creating a journal entry template in SAP S/4HANA (Manage Journal Entry Template) - versions S4CORE 104, 105, 106, 107, an attacker could intercept the sav… |
CVE-2023-33992 | Medium | 4.5 | 2023-07-11 | The SAP BW BICS communication layer in SAP Business Warehouse and SAP BW/4HANA - version SAP_BW 730, SAP_BW 731, SAP_BW 740, SAP_BW 730, SAP_BW 750, DW4CORE 10… |
CVE-2023-33990 | High | 7.8 | 2023-07-11 | SAP SQL Anywhere - version 17.0, allows an attacker to prevent legitimate users from accessing the service by crashing the service. An attacker with low privil… |
CVE-2023-33989 | High | 8.7 | 2023-07-11 | An attacker with non-administrative authorizations in SAP NetWeaver (BI CONT ADD ON) - versions 707, 737, 747, 757, can exploit a directory traversal flaw to o… |
CVE-2023-33988 | Medium | 6.1 | 2023-07-11 | In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the Content-Security-Policy and X-XSS-Protec… |
CVE-2023-33987 | High | 8.6 | 2023-07-11 | An unauthenticated attacker in SAP Web Dispatcher - versions WEBDISP 7.49, WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.81, WEBDISP 7.85, WEBDISP 7.88… |
CVE-2023-31405 | Medium | 5.3 | 2023-07-11 | SAP NetWeaver AS for Java - versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50, allows an unauthenticated attacker to craft a request over the network wh… |
CVE-2023-2079 | High | 7.1 | 2023-07-11 | The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the reciev… |
CVE-2023-2078 | High | 7.3 | 2023-07-11 | The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on th… |
CVE-2023-37190 | Medium | 4.8 | 2023-07-11 | A stored cross-site scripting (XSS) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows attackers to execute arbitrary web scripts or HTML via a crafted payl… |
CVE-2023-37189 | Medium | 4.8 | 2023-07-11 | A stored cross site scripting (XSS) vulnerability in index.php?menu=billing_rates of Issabel PBX version 4 allows attackers to execute arbitrary web scripts or… |
CVE-2023-37191 | Medium | 4.8 | 2023-07-11 | A stored cross-site scripting (XSS) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows attackers to execute arbitrary web scripts or HTML via a crafted payl… |
CVE-2023-3608 | Medium | 4.7 | 2023-07-10 | A vulnerability was found in Ruijie BCR810W 2.5.10. It has been rated as critical. This issue affects some unknown processing of the component Tracert Page. Th… |
CVE-2023-30963 | Medium | 5.4 | 2023-07-10 | A security defect was discovered in Foundry Frontend which enabled users to perform Stored XSS attacks in Slate if Foundry's CSP were to be bypassed. This defe… |
CVE-2023-30960 | Medium | 4.3 | 2023-07-10 | A security defect was discovered in Foundry job-tracker that enabled users to query metadata related to builds on resources they did not have access to. This d… |
CVE-2023-30956 | Medium | 5.3 | 2023-07-10 | A security defect was identified in Foundry Comments that enabled a user to discover the contents of an attachment submitted to another comment if they knew th… |
CVE-2023-24490 | Medium | 6.3 | 2023-07-10 | Users with only access to launch VDA applications can launch an unauthorized desktop |
CVE-2023-24489 | Critical | 9.8 | 2023-07-10 | A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to… |
CVE-2023-3607 | Medium | 5.5 | 2023-07-10 | A vulnerability was found in kodbox 1.26. It has been declared as critical. This vulnerability affects the function Execute of the file webconsole.php.txt of t… |
CVE-2023-3606 | Medium | 6.3 | 2023-07-10 | A vulnerability was found in TamronOS up to 20230703. It has been classified as critical. This affects an unknown part of the file /api/ping. The manipulation… |
CVE-2023-34432 | High | 7.8 | 2023-07-10 | A heap buffer overflow vulnerability was found in sox, in the lsx_readbuf function at sox/src/formats_i.c:98:16. This flaw can lead to a denial of service, cod… |
CVE-2023-24488 | Medium | 6.1 | 2023-07-10 | Cross site scripting vulnerability in Citrix ADC and Citrix Gateway in allows and attacker to perform cross site scripting |
CVE-2023-24487 | Medium | 6.3 | 2023-07-10 | Arbitrary file read in Citrix ADC and Citrix Gateway |
CVE-2023-24486 | Medium | 5.5 | 2023-07-10 | A vulnerability has been identified in Citrix Workspace app for Linux that, if exploited, may result in a malicious local user being able to gain access to the… |
CVE-2023-22835 | High | 7.7 | 2023-07-10 | A security defect was identified that enabled a user of Foundry Issues to perform a Denial of Service attack by submitting malformed data in an Issue that caus… |
CVE-2023-3605 | Medium | 6.5 | 2023-07-10 | A vulnerability was found in PHPGurukul Online Shopping Portal 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionalit… |
CVE-2023-34316 | Medium | 6.5 | 2023-07-10 | An attacker could bypass the latest Delta Electronics InfraSuite Device Master (versions prior to 1.0.7) patch, which could allow an attacker to retrieve file… |
CVE-2023-30765 | High | 8.8 | 2023-07-10 | Delta Electronics InfraSuite Device Master versions prior to 1.0.7 contain improper access controls that could allow an attacker to alter privilege management… |
CVE-2023-34347 | Critical | 9.8 | 2023-07-10 | Delta Electronics InfraSuite Device Master versions prior to 1.0.7 contains classes that cannot be deserialized, which could allow an attack to remotely ex… |
CVE-2023-3599 | Medium | 6.3 | 2023-07-10 | A vulnerability was found in SourceCodester Best Fee Management System 1.0. It has been rated as critical. Affected by this issue is the function save_user of… |
CVE-2023-36940 | Medium | 4.8 | 2023-07-10 | Cross Site Scripting (XSS) vulnerability in PHPGurukul Online Fire Reporting System Using PHP and MySQL v.1.2 allows attackers to execute arbitrary code via a… |
CVE-2023-36939 | Medium | 6.1 | 2023-07-10 | Cross-Site Scripting (XSS) vulnerability in Hostel Management System v2.1 allows an attacker to execute arbitrary code via a crafted payload to the search book… |
CVE-2023-36936 | Medium | 6.1 | 2023-07-10 | Cross-Site Scripting (XSS) vulnerability in PHPGurukul Online Security Guards Hiring System using PHP and MySQL 1.0 allows attackers to execute arbitrary code… |
CVE-2023-34318 | High | 7.8 | 2023-07-10 | A heap buffer overflow vulnerability was found in sox, in the startread function at sox/src/hcom.c:160:41. This flaw can lead to a denial of service, code exec… |
CVE-2023-32627 | Medium | 6.2 | 2023-07-10 | A floating point exception vulnerability was found in sox, in the read_samples function at sox/src/voc.c:334:18. This flaw can lead to a denial of service. |
CVE-2023-26590 | Medium | 6.2 | 2023-07-10 | A floating point exception vulnerability was found in sox, in the lsx_aiffstartwrite function at sox/src/aiff.c:622:58. This flaw can lead to a denial of servi… |
CVE-2023-23348 | Medium | 5.1 | 2023-07-10 | HCL Launch could disclose sensitive information if a manual edit of a configuration file has been performed. |
CVE-2023-37712 | Critical | 9.8 | 2023-07-10 | Tenda AC1206 V15.03.06.23, F1202 V1.2.0.20(408), and FH1202 V1.2.0.20(408) were discovered to contain a stack overflow in the page parameter in the fromSetIpBi… |
CVE-2023-37711 | Critical | 9.8 | 2023-07-10 | Tenda AC1206 V15.03.06.23 and AC10 V15.03.06.47 were discovered to contain a stack overflow in the deviceId parameter in the saveParentControlInfo function. |
CVE-2023-37710 | Critical | 9.8 | 2023-07-10 | Tenda AC1206 V15.03.06.23 and AC10 V15.03.06.47 were discovered to contain a stack overflow in the wpapsk_crypto parameter in the fromSetWirelessRepeat functio… |
CVE-2023-37707 | Critical | 9.8 | 2023-07-10 | Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the page parameter in the fromVirtualSer function. |
CVE-2023-37706 | Critical | 9.8 | 2023-07-10 | Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the entrys parameter in the fromAddressNat function. |
CVE-2023-37705 | Critical | 9.8 | 2023-07-10 | Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the page parameter in the fromAddressNat function. |
CVE-2023-37704 | Critical | 9.8 | 2023-07-10 | Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the deviceId parameter in the formSetClientState function. |
CVE-2023-37703 | Critical | 9.8 | 2023-07-10 | Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the speed_dir parameter in the formSetSpeedWan function. |
CVE-2023-37702 | Critical | 9.8 | 2023-07-10 | Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the deviceId parameter in the formSetDeviceName function. |
CVE-2023-37701 | Critical | 9.8 | 2023-07-10 | Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the deviceId parameter in the addWifiMacFilter function. |
CVE-2023-37700 | Critical | 9.8 | 2023-07-10 | Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the ssid parameter in the form_fast_setting_wifi_set function. |
CVE-2023-37277 | Critical | 9.6 | 2023-07-10 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The REST API allows executing all actions via POST req… |
CVE-2023-36375 | Medium | 5.4 | 2023-07-10 | Cross Site Scripting vulnerability in Hostel Management System v2.1 allows an attacker to execute arbitrary code via a crafted payload to the Guardian name, Gu… |
CVE-2023-3580 | Medium | 4.3 | 2023-07-10 | Improper Handling of Additional Special Element in GitHub repository squidex/squidex prior to 7.4.0. |
CVE-2023-3579 | Medium | 4.3 | 2023-07-10 | A vulnerability, which was classified as problematic, has been found in HadSky 7.11.8. Affected by this issue is some unknown functionality of the component Us… |
CVE-2023-3578 | Medium | 5.5 | 2023-07-10 | A vulnerability classified as critical was found in DedeCMS 5.7.109. Affected by this vulnerability is an unknown functionality of the file co_do.php. The mani… |
CVE-2023-3574 | Medium | 6.5 | 2023-07-10 | Improper Authorization in GitHub repository pimcore/customer-data-framework prior to 3.4.1. |
CVE-2023-3568 | Medium | 6.3 | 2023-07-10 | Open Redirect in GitHub repository alextselegidis/easyappointments prior to 1.5.0. |
CVE-2023-3566 | Low | 3.5 | 2023-07-10 | A vulnerability was found in wallabag 2.5.4. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /confi… |
CVE-2023-3565 | Medium | 5.4 | 2023-07-10 | Cross-site Scripting (XSS) - Generic in GitHub repository nilsteampassnet/teampass prior to 3.0.10. |
CVE-2023-3564 | Low | 3.5 | 2023-07-10 | A vulnerability was found in GZ Scripts GZ Multi Hotel Booking System 1.8. It has been classified as problematic. Affected is an unknown function of the file /… |
CVE-2023-3563 | Low | 3.5 | 2023-07-10 | A vulnerability was found in GZ Scripts GZ E Learning Platform 1.8 and classified as problematic. This issue affects some unknown processing of the component U… |
CVE-2023-3562 | Low | 3.5 | 2023-07-10 | A vulnerability has been found in GZ Scripts PHP CRM Platform 1.8 and classified as problematic. This vulnerability affects unknown code of the file /index.php… |
CVE-2023-3561 | Low | 3.5 | 2023-07-10 | A vulnerability, which was classified as problematic, was found in GZ Scripts PHP GZ Hotel Booking Script 1.8. This affects an unknown part of the file /load.p… |
CVE-2023-3560 | Low | 3.5 | 2023-07-10 | A vulnerability, which was classified as problematic, has been found in GZ Scripts Ticket Booking Script 1.8. Affected by this issue is some unknown functional… |
CVE-2023-3559 | Low | 3.5 | 2023-07-10 | A vulnerability classified as problematic was found in GZ Scripts PHP GZ Appointment Scheduling Script 1.8. Affected by this vulnerability is an unknown functi… |
CVE-2023-3558 | Low | 3.5 | 2023-07-10 | A vulnerability classified as problematic has been found in GZ Scripts Event Booking Calendar 1.8. Affected is an unknown function of the file /load.php. The m… |
CVE-2023-3557 | Low | 3.5 | 2023-07-10 | A vulnerability was found in GZ Scripts Property Listing Script 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /… |
CVE-2023-3556 | Low | 3.5 | 2023-07-10 | A vulnerability was found in GZ Scripts Car Listing Script PHP 1.8. It has been declared as problematic. This vulnerability affects unknown code of the file /p… |
CVE-2023-3555 | Low | 3.5 | 2023-07-10 | A vulnerability was found in GZ Scripts PHP Vacation Rental Script 1.8. It has been classified as problematic. This affects an unknown part of the file /previe… |
CVE-2023-3554 | Low | 3.5 | 2023-07-10 | A vulnerability was found in GZ Scripts GZ Forum Script 1.8 and classified as problematic. Affected by this issue is some unknown functionality of the file /pr… |
CVE-2023-3273 | High | 7.5 | 2023-07-10 | Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to affect the availability of the device by changing settings of th… |
CVE-2023-3272 | High | 7.5 | 2023-07-10 | Cleartext Transmission of Sensitive Information in the SICK ICR890-4 could allow a remote attacker to gather sensitive information by intercepting network traf… |
CVE-2023-3271 | High | 8.2 | 2023-07-10 | Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to gather information about the system and download data via the RE… |
CVE-2023-3270 | High | 8.6 | 2023-07-10 | Exposure of Sensitive Information to an Unauthorized Actor in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive informatio… |
CVE-2023-3225 | Medium | 4.8 | 2023-07-10 | The Float menu WordPress plugin before 5.0.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2023-3219 | Medium | 5.3 | 2023-07-10 | The EventON WordPress plugin before 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid Event, allowing unau… |
CVE-2023-3209 | Low | 3.5 | 2023-07-10 | The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both. |
CVE-2023-3175 | Medium | 4.8 | 2023-07-10 | The AI ChatBot WordPress plugin before 4.6.1 does not adequately escape some settings, allowing high-privilege users such as admin to perform Cross-Site Script… |
CVE-2023-3131 | Medium | 4.3 | 2023-07-10 | The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both. |
CVE-2023-3129 | Medium | 4.8 | 2023-07-10 | The URL Shortify WordPress plugin before 1.7.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfo… |