2023 CVEs (page 206)
Page 206 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-37066 | Medium | 4.8 | 2023-07-07 | Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the skills wheel. |
CVE-2023-37065 | Medium | 4.8 | 2023-07-07 | Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the session category management section. |
CVE-2023-37064 | Medium | 4.8 | 2023-07-07 | Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the extra fields management section. |
CVE-2023-37063 | Medium | 4.8 | 2023-07-07 | Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the careers & promotions management section. |
CVE-2023-37062 | Medium | 4.8 | 2023-07-07 | Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the course categories' definition. |
CVE-2023-37061 | Medium | 4.8 | 2023-07-07 | Chamilo 1.11.x up to 1.11.20 allows users with an admin privilege account to insert XSS in the languages management section. |
CVE-2023-27845 | Critical | 9.8 | 2023-07-07 | SQL injection vulnerability found in PrestaShop lekerawen_ocs before v.1.4.1 allow a remote attacker to gain privileges via the KerawenHelper::setCartOperation… |
CVE-2023-3542 | Low | 3.5 | 2023-07-07 | A vulnerability was found in ThinuTech ThinuCMS 1.5 and classified as problematic. Affected by this issue is some unknown functionality of the file /contact.ph… |
CVE-2023-3541 | Low | 3.5 | 2023-07-07 | A vulnerability has been found in ThinuTech ThinuCMS 1.5 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2023-36201 | High | 7.5 | 2023-07-07 | An issue in JerryscriptProject jerryscript v.3.0.0 allows an attacker to obtain sensitive information via a crafted script to the arrays. |
CVE-2023-33664 | High | 8.8 | 2023-07-07 | ai-dev aicombinationsonfly before v0.3.1 was discovered to contain a SQL injection vulnerability via the component /includes/ajax.php. |
CVE-2023-29998 | Medium | 5.4 | 2023-07-07 | A Cross-site scripting (XSS) vulnerability in the content editor in Gis3W g3w-suite 3.5 allows remote authenticated users to inject arbitrary web script or HTM… |
CVE-2023-25201 | High | 8.8 | 2023-07-07 | Cross Site Request Forgery (CSRF) vulnerability in MultiTech Conduit AP MTCAP2-L4E1 MTCAP2-L4E1-868-042A v.6.0.0 allows a remote attacker to execute arbitrary… |
CVE-2023-3540 | Low | 3.5 | 2023-07-07 | A vulnerability, which was classified as problematic, was found in SimplePHPscripts NewsLetter Script PHP 2.4. Affected is an unknown function of the file /pre… |
CVE-2023-3539 | Low | 3.5 | 2023-07-07 | A vulnerability, which was classified as problematic, has been found in SimplePHPscripts Simple Forum PHP 2.7. This issue affects some unknown processing of th… |
CVE-2023-3538 | Low | 3.5 | 2023-07-07 | A vulnerability classified as problematic was found in SimplePHPscripts Photo Gallery PHP 2.0. This vulnerability affects unknown code of the file /preview.php… |
CVE-2023-3537 | Low | 3.5 | 2023-07-07 | A vulnerability classified as problematic has been found in SimplePHPscripts News Script PHP Pro 2.4. This affects an unknown part of the file /preview.php of… |
CVE-2023-37149 | Critical | 9.8 | 2023-07-07 | TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the FileName parameter in the setUploadSetting function. |
CVE-2023-37148 | Critical | 9.8 | 2023-07-07 | TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the ussd parameter in the setUssd function. |
CVE-2023-37146 | Critical | 9.8 | 2023-07-07 | TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function. |
CVE-2023-37145 | Critical | 9.8 | 2023-07-07 | TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the hostname parameter in the setOpModeCfg function. |
CVE-2023-37144 | Critical | 9.8 | 2023-07-07 | Tenda AC10 v15.03.06.26 was discovered to contain a command injection vulnerability via the mac parameter in the function formWriteFacMac. |
CVE-2023-3536 | Low | 3.5 | 2023-07-07 | A vulnerability was found in SimplePHPscripts Funeral Script PHP 3.1. It has been rated as problematic. Affected by this issue is some unknown functionality of… |
CVE-2023-3535 | Low | 3.5 | 2023-07-07 | A vulnerability was found in SimplePHPscripts FAQ Script PHP 2.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionali… |
CVE-2023-37308 | Medium | 5.4 | 2023-07-07 | Zoho ManageEngine ADAudit Plus before 7100 allows XSS via the username field. |
CVE-2023-34197 | Medium | 5.4 | 2023-07-07 | Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before 14300, and SupportCenter Plus before 14300 have a privilege escalation vulnerabili… |
CVE-2023-3534 | Medium | 6.3 | 2023-07-07 | A vulnerability was found in SourceCodester Shopping Website 1.0. It has been classified as critical. Affected is an unknown function of the file check_availab… |
CVE-2023-33008 | Medium | 5.3 | 2023-07-07 | Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache Johnzon. A malicious attacker can craft up some JSON input that uses lar… |
CVE-2023-32183 | High | 7.8 | 2023-07-07 | Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed hawk2 package allows users with access to the hacluster to escalate to root This issue a… |
CVE-2023-3532 | Medium | 5.4 | 2023-07-07 | Cross-site Scripting (XSS) - Stored in GitHub repository outline/outline prior to 0.70.1. |
CVE-2023-35890 | Medium | 5.1 | 2023-07-07 | IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security, caused by the improper encoding in a local configuration file. IBM X… |
CVE-2023-37192 | High | 7.5 | 2023-07-07 | Memory management and protection issues in Bitcoin Core v22 allows attackers to modify the stored sending address within the app's memory, potentially allowing… |
CVE-2023-35765 | Medium | 6.5 | 2023-07-07 | PiiGAB M-Bus stores credentials in a plaintext file, which could allow a low-level user to gain admin credentials. |
CVE-2023-35120 | High | 8.8 | 2023-07-07 | PiiGAB M-Bus is vulnerable to cross-site request forgery. An attacker who wants to execute a certain command could send a phishing mail to the owner of the de… |
CVE-2023-34995 | High | 7.5 | 2023-07-07 | There are no requirements for setting a complex password for PiiGAB M-Bus, which could contribute to a successful brute force attack if the pass… |
CVE-2023-34433 | High | 7.5 | 2023-07-07 | PiiGAB M-Bus stores passwords using a weak hash algorithm. |
CVE-2023-32652 | High | 8.0 | 2023-07-07 | PiiGAB M-Bus does not validate identification strings before processing, which could make it vulnerable to cross-site scripting attacks. |
CVE-2023-36859 | High | 8.8 | 2023-07-06 | PiiGAB M-Bus SoftwarePack 900S does not correctly sanitize user input, which could allow an attacker to inject arbitrary commands. |
CVE-2023-36829 | Medium | 6.8 | 2023-07-06 | Sentry is an error tracking and performance monitoring platform. Starting in version 23.6.0 and prior to version 23.6.2, the Sentry API incorrectly returns the… |
CVE-2023-35987 | Critical | 9.8 | 2023-07-06 | PiiGAB M-Bus contains hard-coded credentials which it uses for authentication. |
CVE-2023-33868 | Medium | 5.9 | 2023-07-06 | The number of login attempts is not limited. This could allow an attacker to perform a brute force on HTTP basic authentication. |
CVE-2023-31277 | High | 7.5 | 2023-07-06 | PiiGAB M-Bus transmits credentials in plaintext format. |
CVE-2023-20899 | High | 7.5 | 2023-07-06 | VMware SD-WAN (Edge) contains a bypass authentication vulnerability. An unauthenticated attacker can download the Diagnostic bundle of the application under VM… |
CVE-2023-29824 | Critical | 9.8 | 2023-07-06 | A use-after-free issue was discovered in Py_FindObjects() function in SciPy versions prior to 1.8.0. NOTE: the vendor and discoverer indicate that this is not… |
CVE-2023-3531 | Medium | 5.4 | 2023-07-06 | Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.10. |
CVE-2023-36462 | Medium | 5.4 | 2023-07-06 | Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 2.6.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacke… |
CVE-2023-35934 | Medium | 6.1 | 2023-07-06 | yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak co… |
CVE-2023-30195 | High | 7.5 | 2023-07-06 | In the module "Detailed Order" (lgdetailedorder) in version up to 1.1.20 from Linea Grafica for PrestaShop, a guest can download personal informations without… |
CVE-2023-3529 | Medium | 5.3 | 2023-07-06 | A vulnerability classified as problematic has been found in Rotem Dynamics Rotem CRM up to 20230729. This affects an unknown part of the file /LandingPages/api… |
CVE-2023-36461 | High | 7.5 | 2023-07-06 | Mastodon is a free, open-source social network server based on ActivityPub. When performing outgoing HTTP queries, Mastodon sets a timeout on individual read o… |
CVE-2023-36460 | Critical | 9.9 | 2023-07-06 | Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 3.5.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, attackers… |
CVE-2023-36459 | Critical | 9.3 | 2023-07-06 | Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 1.3 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker… |
CVE-2023-36456 | High | 8.3 | 2023-07-06 | authentik is an open-source Identity Provider. Prior to versions 2023.4.3 and 2023.5.5, authentik does not verify the source of the X-Forwarded-For and X-Real-… |
CVE-2023-3528 | Medium | 6.3 | 2023-07-06 | A vulnerability was found in ThinuTech ThinuCMS 1.5. It has been rated as critical. Affected by this issue is some unknown functionality of the file /category… |
CVE-2023-1298 | Medium | 4.3 | 2023-07-06 | ServiceNow has released upgrades and patches that address a Reflected Cross-Site scripting (XSS) vulnerability that was identified in the ServiceNow Polaris La… |
CVE-2023-37454 | Medium | 5.5 | 2023-07-06 | An issue was discovered in the Linux kernel through 6.4.2. A crafted UDF filesystem image causes a use-after-free write operation in the udf_put_super and udf_… |
CVE-2023-37453 | Medium | 4.6 | 2023-07-06 | An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds and crash in read_descriptors in drivers/usb/core/sys… |
CVE-2023-37260 | High | 8.2 | 2023-07-06 | league/oauth2-server is an implementation of an OAuth 2.0 authorization server written in PHP. Starting in version 8.3.2 and prior to version 8.5.3, servers th… |
CVE-2023-36830 | Medium | 6.3 | 2023-07-06 | SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerab… |
CVE-2023-36823 | High | 7.1 | 2023-07-06 | Sanitize is an allowlist-based HTML and CSS sanitizer. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML and CSS through Sanitize… |
CVE-2023-34193 | High | 8.8 | 2023-07-06 | File Upload vulnerability in Zimbra ZCS 8.8.15 allows an authenticated privileged user to execute arbitrary code and obtain sensitive information via the Clien… |
CVE-2023-34192 | Critical | 9.0 | 2023-07-06 | Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoS… |
CVE-2023-30321 | Critical | 9.0 | 2023-07-06 | Cross Site Scripting (XSS) vulnerability in textMessage field in /src/chatbotapp/LoginServlet.java in wliang6 ChatEngine commit fded8e710ad59f816867ad47d7fc486… |
CVE-2023-30320 | Critical | 9.0 | 2023-07-06 | Cross Site Scripting (XSS) vulnerability in textMessage field in /src/chatbotapp/chatWindow.java in wliang6 ChatEngine commit fded8e710ad59f816867ad47d7fc4862f… |
CVE-2023-30319 | Critical | 9.6 | 2023-07-06 | Cross Site Scripting (XSS) vulnerability in username field in /src/chatbotapp/LoginServlet.java in wliang6 ChatEngine commit fded8e710ad59f816867ad47d7fc4862f6… |
CVE-2023-29382 | Critical | 9.8 | 2023-07-06 | An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows an attacker to execute arbitrary code via the sfdc_preauth.jsp component. |
CVE-2023-29381 | Critical | 9.8 | 2023-07-06 | An issue in Zimbra Collaboration (ZCS) v.8.8.15 and v.9.0 allows a remote attacker to escalate privileges and obtain sensitive information via the password and… |
CVE-2023-37136 | Medium | 5.4 | 2023-07-06 | A stored cross-site scripting (XSS) vulnerability in the Basic Website Information module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts o… |
CVE-2023-37135 | Medium | 5.4 | 2023-07-06 | A stored cross-site scripting (XSS) vulnerability in the Image Upload module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2023-37134 | Medium | 5.4 | 2023-07-06 | A stored cross-site scripting (XSS) vulnerability in the Basic Information module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML v… |
CVE-2023-37133 | Medium | 5.4 | 2023-07-06 | A stored cross-site scripting (XSS) vulnerability in the Column management module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML v… |
CVE-2023-37132 | Medium | 5.4 | 2023-07-06 | A stored cross-site scripting (XSS) vulnerability in the custom variables module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML vi… |
CVE-2023-37131 | Medium | 6.5 | 2023-07-06 | A Cross-Site Request Forgery (CSRF) in the component /public/admin/profile/update.html of YznCMS v1.1.0 allows attackers to arbitrarily change the Administrato… |
CVE-2023-37125 | Medium | 5.4 | 2023-07-06 | A stored cross-site scripting (XSS) vulnerability in the Management Custom label module of SEACMS v12.1 allows attackers to execute arbitrary web scripts or HT… |
CVE-2023-37124 | Medium | 5.4 | 2023-07-06 | A stored cross-site scripting (XSS) vulnerability in the Site Setup module of SEACMS v12.1 allows attackers to execute arbitrary web scripts or HTML via a craf… |
CVE-2023-37122 | Medium | 5.4 | 2023-07-06 | A stored cross-site scripting (XSS) vulnerability in Bagecms v3.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected in… |
CVE-2023-36970 | Medium | 5.4 | 2023-07-06 | A Cross-site scripting (XSS) vulnerability in CMS Made Simple v2.2.17 allows remote attackers to inject arbitrary web script or HTML via the File Upload functi… |
CVE-2023-36969 | High | 8.8 | 2023-07-06 | CMS Made Simple v2.2.17 is vulnerable to Remote Command Execution via the File Upload Function. |
CVE-2023-35948 | Medium | 5.4 | 2023-07-06 | Novu provides an API for sending notifications through multiple channels. Versions prior to 0.16.0 contain an open redirect vulnerability in the "Sign In with… |
CVE-2023-30326 | Medium | 6.1 | 2023-07-06 | Cross Site Scripting (XSS) vulnerability in username field in /WebContent/WEB-INF/lib/chatbox.jsp in wliang6 ChatEngine commit fded8e710ad59f816867ad47d7fc4862… |
CVE-2023-30325 | High | 7.5 | 2023-07-06 | SQL Injection vulnerability in textMessage parameter in /src/chatbotapp/chatWindow.java in wliang6 ChatEngine v.1.0, allows attackers to gain sensitive informa… |
CVE-2023-30323 | High | 7.5 | 2023-07-06 | SQL Injection vulnerability in username field in /src/chatbotapp/chatWindow.java in Payatu ChatEngine v.1.0, allows attackers to gain sensitive information. |
CVE-2023-30322 | Medium | 5.4 | 2023-07-06 | Cross Site Scripting (XSS) vulnerability in username field in /src/chatbotapp/chatWindow.java in Payatu ChatEngine v.1.0, allows attackers to execute arbitrary… |
CVE-2023-25583 | High | 7.2 | 2023-07-06 | Two OS command injection vulnerabilities exist in the zebra vlan_name functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead… |
CVE-2023-25582 | High | 7.2 | 2023-07-06 | Two OS command injection vulnerabilities exist in the zebra vlan_name functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead… |
CVE-2023-25124 | High | 7.2 | 2023-07-06 | Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially c… |
CVE-2023-25123 | High | 7.2 | 2023-07-06 | Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially c… |
CVE-2023-25122 | High | 7.2 | 2023-07-06 | Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially c… |
CVE-2023-25121 | High | 7.2 | 2023-07-06 | Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially c… |
CVE-2023-25120 | High | 7.2 | 2023-07-06 | Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially c… |
CVE-2023-25119 | High | 7.2 | 2023-07-06 | Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially c… |
CVE-2023-25118 | High | 7.2 | 2023-07-06 | Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially c… |
CVE-2023-25117 | High | 7.2 | 2023-07-06 | Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially c… |
CVE-2023-25116 | High | 7.2 | 2023-07-06 | Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially c… |
CVE-2023-25115 | High | 7.2 | 2023-07-06 | Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially c… |
CVE-2023-25114 | High | 7.2 | 2023-07-06 | Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially c… |
CVE-2023-25113 | High | 7.2 | 2023-07-06 | Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially c… |
CVE-2023-25112 | High | 7.2 | 2023-07-06 | Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially c… |
CVE-2023-25111 | High | 7.2 | 2023-07-06 | Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially c… |
CVE-2023-25110 | High | 7.2 | 2023-07-06 | Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially c… |