2023 CVEs (page 205)
Page 205 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-3118 | Medium | 6.1 | 2023-07-10 | The Export All URLs WordPress plugin before 4.6 does not sanitise and escape a parameter before outputting them back in the page, leading to a Reflected Cross-… |
CVE-2023-3077 | Critical | 9.8 | 2023-07-10 | The MStore API WordPress plugin before 3.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a Blind SQL injection expl… |
CVE-2023-3076 | Critical | 9.8 | 2023-07-10 | The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API e… |
CVE-2023-3045 | Critical | 9.8 | 2023-07-10 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tise Technology Parking Web Report allows SQL Injection. … |
CVE-2023-37392 | Medium | 5.4 | 2023-07-10 | Cross-Site Request Forgery (CSRF) vulnerability in Deepak Anand WP Dummy Content Generator plugin <= 2.3.0 versions. |
CVE-2023-37153 | Medium | 6.1 | 2023-07-10 | KodExplorer 4.51 contains a Cross-Site Scripting (XSS) vulnerability in the Description box of the Light App creation feature. An attacker can exploit this vul… |
CVE-2023-37152 | Critical | 9.8 | 2023-07-10 | Projectworlds Online Art Gallery Project 1.0 allows unauthenticated users to perform arbitrary file uploads via the adminHome.php page. Note: This has been dis… |
CVE-2023-37150 | Medium | 6.1 | 2023-07-10 | Sourcecodester Online Pizza Ordering System v1.0 has a Cross-site scripting (XSS) vulnerability in "/admin/index.php?page=categories" Category item. |
CVE-2023-36691 | Medium | 5.4 | 2023-07-10 | Cross-Site Request Forgery (CSRF) vulnerability in Albert Peschar WebwinkelKeur plugin <= 3.24 versions. |
CVE-2023-36376 | Medium | 4.8 | 2023-07-10 | Cross-Site Scripting (XSS) vulnerability in Hostel Management System v.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inje… |
CVE-2023-35912 | Medium | 4.3 | 2023-07-10 | Cross-Site Request Forgery (CSRF) vulnerability in WP Zone Potent Donations for WooCommerce plugin <= 1.1.9 versions. |
CVE-2023-35887 | Medium | 5.0 | 2023-07-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA. In SFTP servers implemented using Apache M… |
CVE-2023-35699 | Medium | 5.3 | 2023-07-10 | Cleartext Storage on Disk in the SICK ICR890-4 could allow an unauthenticated attacker with local access to the device to disclose sensitive information by acc… |
CVE-2023-35698 | Medium | 5.3 | 2023-07-10 | Observable Response Discrepancy in the SICK ICR890-4 could allow a remote attacker to identify valid usernames for the FTP server from the response given durin… |
CVE-2023-35697 | Medium | 5.3 | 2023-07-10 | Improper Restriction of Excessive Authentication Attempts in the SICK ICR890-4 could allow a remote attacker to brute-force user credentials. |
CVE-2023-35696 | High | 7.5 | 2023-07-10 | Unauthenticated endpoints in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the device via HTTP reque… |
CVE-2023-34442 | Low | 3.3 | 2023-07-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Camel.This issue affects Apache Camel: from 3.X t… |
CVE-2023-32254 | Critical | 9.8 | 2023-07-10 | A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_TREE_DISCONNECT c… |
CVE-2023-32250 | Critical | 9.0 | 2023-07-10 | A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_SESSION_SETUP com… |
CVE-2023-30449 | High | 7.5 | 2023-07-10 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query. IBM… |
CVE-2023-30448 | Medium | 5.9 | 2023-07-10 | IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on cer… |
CVE-2023-30447 | Medium | 5.9 | 2023-07-10 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on cer… |
CVE-2023-30446 | Medium | 5.9 | 2023-07-10 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on cer… |
CVE-2023-30445 | High | 7.5 | 2023-07-10 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on cer… |
CVE-2023-30442 | Medium | 5.9 | 2023-07-10 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 federated server is vulnerable to a denial of service as the server may crash w… |
CVE-2023-30431 | High | 8.4 | 2023-07-10 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 db2set is vulnerable to a buffer overflow, caused by improper bounds che… |
CVE-2023-2967 | Medium | 4.8 | 2023-07-10 | The TinyMCE Custom Styles WordPress plugin before 1.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2023-2964 | Medium | 5.4 | 2023-07-10 | The Simple Iframe WordPress plugin before 1.2.0 does not properly validate one of its WordPress block attribute's content, which may allow users whose role is… |
CVE-2023-2853 | Medium | 6.1 | 2023-07-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Softmed SelfPatron allows Reflected XSS. This issue affe… |
CVE-2023-2852 | Critical | 9.8 | 2023-07-10 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Softmed SelfPatron allows SQL Injection. This issue affe… |
CVE-2023-2796 | Medium | 5.3 | 2023-07-10 | The EventON WordPress plugin before 2.1.2 lacks authentication and authorization in its eventon_ics_download ajax action, allowing unauthenticated visitors to… |
CVE-2023-2709 | Medium | 4.8 | 2023-07-10 | The AN_GradeBook WordPress plugin through 5.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2023-2635 | Medium | 4.8 | 2023-07-10 | The Call Now Accessibility Button WordPress plugin before 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as… |
CVE-2023-2578 | Medium | 4.8 | 2023-07-10 | The Buy Me a Coffee WordPress plugin before 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2023-2529 | Medium | 5.4 | 2023-07-10 | The Enable SVG Uploads WordPress plugin through 2.1.5 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a ma… |
CVE-2023-2495 | Medium | 4.3 | 2023-07-10 | The Greeklish-permalink WordPress plugin through 3.3 does not implement correct authorization or nonce checks in the cyrtrans_ajax_old AJAX action, allowing un… |
CVE-2023-2493 | High | 7.2 | 2023-07-10 | The All In One Redirection WordPress plugin before 2.2.0 does not properly sanitise and escape multiple parameters before using them in an SQL statement, leadi… |
CVE-2023-2234 | Medium | 6.8 | 2023-07-10 | Union variant confusion allows any malicious BT controller to execute arbitrary code on the Zephyr host. |
CVE-2023-2046 | Critical | 9.8 | 2023-07-10 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yontem Informatics Vehicle Tracking System allows SQL Inj… |
CVE-2023-2029 | Medium | 4.8 | 2023-07-10 | The PrePost SEO WordPress plugin through 3.0 does not properly sanitize some of its settings, which could allow high-privilege users to perform Stored Cross-Si… |
CVE-2023-2028 | Medium | 4.8 | 2023-07-10 | The Call Now Accessibility Button WordPress plugin before 1.1 does not properly sanitize some of its settings, which could allow high-privilege users to perfor… |
CVE-2023-2026 | Medium | 4.8 | 2023-07-10 | The Image Protector WordPress plugin through 1.1 does not properly sanitize some of its settings, which could allow high-privilege users to perform Stored Cros… |
CVE-2023-29256 | Medium | 5.3 | 2023-07-10 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to an information disclosure due to improper privilege man… |
CVE-2023-29095 | High | 7.6 | 2023-07-10 | Auth. (admin+) SQL Injection (SQLi) vulnerability in David F. Carr RSVPMaker plugin < 10.5.5 versions. |
CVE-2023-28995 | Medium | 5.4 | 2023-07-10 | Cross-Site Request Forgery (CSRF) vulnerability in Keith Solomon Configurable Tag Cloud (CTC) plugin <= 5.2 versions. |
CVE-2023-28989 | Medium | 4.3 | 2023-07-10 | Cross-Site Request Forgery (CSRF) vulnerability in weDevs Happy Addons for Elementor plugin <= 3.8.2 versions. |
CVE-2023-28986 | Medium | 5.4 | 2023-07-10 | Cross-Site Request Forgery (CSRF) vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager plugin <= 2.9.20 versions. |
CVE-2023-28958 | High | 7.0 | 2023-07-10 | IBM Watson Knowledge Catalog on Cloud Pak for Data 4.0 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the sy… |
CVE-2023-28955 | Medium | 6.5 | 2023-07-10 | IBM Watson Knowledge Catalog on Cloud Pak for Data 4.0 could allow an authenticated user send a specially crafted request that could cause a denial of service… |
CVE-2023-28953 | Low | 3.1 | 2023-07-10 | IBM Cognos Analytics on Cloud Pak for Data 4.0 could allow an attacker to make system calls that might compromise the security of the containers due to misconf… |
CVE-2023-27869 | Medium | 6.3 | 2023-07-10 | IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code on the syste… |
CVE-2023-27868 | Medium | 6.3 | 2023-07-10 | IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code on the syste… |
CVE-2023-27867 | Medium | 6.3 | 2023-07-10 | IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code via JNDI Inj… |
CVE-2023-27558 | High | 8.4 | 2023-07-10 | IBM Db2 on Windows 10.5, 11.1, and 11.5 may be vulnerable to a privilege escalation caused by at least one installed service using an unquoted service path… |
CVE-2023-27540 | Medium | 5.9 | 2023-07-10 | IBM Watson CP4D Data Stores 4.6.0 does not properly allocate resources without limits or throttling which could allow a remote attacker with information specif… |
CVE-2023-25478 | Medium | 4.3 | 2023-07-10 | Cross-Site Request Forgery (CSRF) vulnerability in Jason Rouet Weather Station plugin <= 3.8.12 versions. |
CVE-2023-24405 | Medium | 5.4 | 2023-07-10 | Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Contact Form 7 – PayPal & Stripe Add-on plugin <= 1.9.3 versions. |
CVE-2023-24395 | Medium | 5.4 | 2023-07-10 | Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Contact Form 7 Redirect & Thank You Page plugin <= 1.0.3 versions. |
CVE-2023-23993 | Medium | 5.4 | 2023-07-10 | Cross-Site Request Forgery (CSRF) vulnerability in LionScripts.Com LionScripts: IP Blocker Lite plugin <= 11.1.1 versions. |
CVE-2023-23897 | Medium | 4.3 | 2023-07-10 | Cross-Site Request Forgery (CSRF) vulnerability in Ozette Plugins Simple Mobile URL Redirect plugin <= 1.7.2 versions. |
CVE-2023-23869 | Medium | 4.3 | 2023-07-10 | Cross-Site Request Forgery (CSRF) vulnerability in Amit Agarwal Google XML Sitemap for Mobile plugin <= 1.6.1 versions. |
CVE-2023-23804 | Medium | 4.3 | 2023-07-10 | Cross-Site Request Forgery (CSRF) vulnerability in HasThemes HT Feed plugin <= 1.2.7 versions. |
CVE-2023-23787 | Medium | 4.3 | 2023-07-10 | Cross-Site Request Forgery (CSRF) vulnerability in Premmerce Premmerce Redirect Manager plugin <= 1.0.9 versions. |
CVE-2023-23487 | Medium | 4.3 | 2023-07-10 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to insufficient audit logging. IBM X-Force ID: 245918. |
CVE-2023-22695 | Medium | 4.3 | 2023-07-10 | Cross-Site Request Forgery (CSRF) vulnerability in Hiroaki Miyashita Custom Field Template plugin <= 2.5.8 versions. |
CVE-2023-22694 | Medium | 4.3 | 2023-07-10 | Cross-Site Request Forgery (CSRF) vulnerability in Arian Khosravi, Norik Davtian BigContact Contact Page plugin <= 1.5.8 versions. |
CVE-2023-22673 | Medium | 5.4 | 2023-07-10 | Cross-Site Request Forgery (CSRF) vulnerability in MageNet Website Monetization by MageNet plugin <= 1.0.29.1 versions. |
CVE-2023-1902 | Medium | 5.9 | 2023-07-10 | The bluetooth HCI host layer logic not clearing a global reference to a state pointer after handling connection events may allow a malicious HCI Controller to… |
CVE-2023-1901 | Medium | 5.9 | 2023-07-10 | The bluetooth HCI host layer logic not clearing a global reference to a semaphore after synchronously sending HCI commands may allow a malicious HCI Controller… |
CVE-2023-1780 | Medium | 6.1 | 2023-07-10 | The Companion Sitemap Generator WordPress plugin before 4.5.3 does not sanitise and escape some parameters before outputting them back in pages, leading to Ref… |
CVE-2023-1597 | High | 8.8 | 2023-07-10 | The tagDiv Cloud Library WordPress plugin before 2.7 does not have authorisation and CSRF in an AJAX action accessible to both unauthenticated and authenticate… |
CVE-2023-1208 | High | 7.2 | 2023-07-10 | This HTTP Headers WordPress plugin before 1.18.11 allows arbitrary data to be written to arbitrary files, leading to a Remote Code Execution vulnerability. |
CVE-2023-1183 | Medium | 5.0 | 2023-07-10 | A flaw was found in the Libreoffice package. An attacker can craft an odb containing a "database/script" file with a SCRIPT command where the contents of the f… |
CVE-2023-1119 | Medium | 6.1 | 2023-07-10 | The WP-Optimize WordPress plugin before 3.2.13, SrbTransLatin WordPress plugin before 2.4.1 use a third-party library that removes the escaping on some HTML ch… |
CVE-2023-0359 | Medium | 5.9 | 2023-07-10 | A missing nullptr-check in handle_ra_input can cause a nullptr-deref. |
CVE-2023-37288 | Medium | 6.5 | 2023-07-10 | SmartBPM.NET component has a vulnerability of path traversal within its file download function. An unauthenticated remote attacker can exploit this vulnerabili… |
CVE-2023-37287 | Critical | 9.1 | 2023-07-10 | SmartBPM.NET has a vulnerability of using hard-coded authentication key. An unauthenticated remote attacker can exploit this vulnerability to access system wit… |
CVE-2023-37286 | Critical | 9.8 | 2023-07-10 | SmartSoft SmartBPM.NET has a vulnerability of using hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized paylo… |
CVE-2023-3553 | High | 7.5 | 2023-07-08 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository nilsteampassnet/teampass prior to 3.0.10. |
CVE-2023-3552 | Medium | 5.4 | 2023-07-08 | Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.10. |
CVE-2023-3551 | High | 7.2 | 2023-07-08 | Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.10. |
CVE-2023-32000 | Medium | 4.8 | 2023-07-08 | A Cross-Site Scripting (XSS) vulnerability found in UniFi Network (Version 7.3.83 and earlier) allows a malicious actor with Site Administrator credentials to… |
CVE-2023-37270 | High | 7.6 | 2023-07-07 | Piwigo is open source photo gallery software. Prior to version 13.8.0, there is a SQL Injection vulnerability in the login of the administrator screen. The SQL… |
CVE-2023-37269 | Low | 2.0 | 2023-07-07 | Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Users with the `backend.manage_branding` permission can uploa… |
CVE-2023-37262 | Critical | 9.6 | 2023-07-07 | CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to versions 1.20.1-1.106.0, 1.19.4-1.106.0, 1.19.2-1… |
CVE-2023-37261 | Critical | 9.6 | 2023-07-07 | OpenComputers is a Minecraft mod that adds programmable computers and robots to the game. This issue affects every version of OpenComputers with the Internet C… |
CVE-2023-37173 | Critical | 9.8 | 2023-07-07 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the command parameter in the setTracerouteCfg function. |
CVE-2023-37172 | Critical | 9.8 | 2023-07-07 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the ip parameter in the setDiagnosisCfg function. |
CVE-2023-37171 | Critical | 9.8 | 2023-07-07 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the admuser parameter in the setPasswordCfg function. |
CVE-2023-37170 | Critical | 9.8 | 2023-07-07 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the lang parameter in the se… |
CVE-2023-20180 | Medium | 4.3 | 2023-07-07 | A vulnerability in the web interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) att… |
CVE-2023-20133 | Medium | 5.4 | 2023-07-07 | A vulnerability in the web interface of Cisco Webex Meetings could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attac… |
CVE-2023-36994 | Critical | 9.8 | 2023-07-07 | In TravianZ 8.3.4 and 8.3.3, Incorrect Access Control in the installation script allows an attacker to overwrite the server configuration and inject PHP code. |
CVE-2023-36993 | Critical | 9.8 | 2023-07-07 | The cryptographically insecure random number generator being used in TravianZ 8.3.4 and 8.3.3 in the password reset function allows an attacker to guess the pa… |
CVE-2023-36992 | High | 7.2 | 2023-07-07 | PHP injection in TravianZ 8.3.4 and 8.3.3 in the config editor in the admin page allows remote attackers to execute PHP code. |
CVE-2023-36256 | Medium | 6.5 | 2023-07-07 | The Online Examination System Project 1.0 version is vulnerable to Cross-Site Request Forgery (CSRF) attacks. An attacker can craft a malicious link that, when… |
CVE-2023-3544 | Low | 3.5 | 2023-07-07 | A vulnerability was found in GZ Scripts Time Slot Booking Calendar PHP 1.8. It has been declared as problematic. This vulnerability affects unknown code of the… |
CVE-2023-3543 | Low | 3.5 | 2023-07-07 | A vulnerability was found in GZ Scripts Availability Booking Calendar PHP 1.8. It has been classified as problematic. This affects an unknown part of the file… |
CVE-2023-37264 | Low | 3.7 | 2023-07-07 | Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, wh… |
CVE-2023-37067 | Medium | 4.8 | 2023-07-07 | Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the classes/usergroups management section. |