2023 CVEs (page 210)
Page 210 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-1206 | Medium | 5.7 | 2023-06-30 | A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a user makes a new kind of SYN flood attack… |
CVE-2023-35947 | Medium | 6.9 | 2023-06-30 | Gradle is a build tool with a focus on build automation and support for multi-language development. In affected versions when unpacking Tar archives, Gradle di… |
CVE-2023-35946 | Medium | 6.9 | 2023-06-30 | Gradle is a build tool with a focus on build automation and support for multi-language development. When Gradle writes a dependency into its dependency cache… |
CVE-2023-29147 | Medium | 5.5 | 2023-06-30 | In Malwarebytes EDR 1.0.11 for Linux, it is possible to bypass the detection layers that depend on inode identifiers, because an identifier may be reused when… |
CVE-2023-31543 | Critical | 9.8 | 2023-06-30 | A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository se… |
CVE-2023-29145 | High | 7.8 | 2023-06-30 | The Malwarebytes EDR 1.0.11 for Linux driver doesn't properly ensure whitelisting of executable libraries loaded by executable files, allowing arbitrary code e… |
CVE-2023-27469 | High | 7.1 | 2023-06-30 | Malwarebytes Anti-Exploit 4.4.0.220 is vulnerable to arbitrary file deletion and denial of service via an ALPC message in which FullFileNamePath lacks a '\0' c… |
CVE-2023-37365 | Medium | 6.5 | 2023-06-30 | Hnswlib 0.7.0 has a double free in init_index when the M argument is a large integer. |
CVE-2023-36810 | Medium | 6.2 | 2023-06-30 | pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability ca… |
CVE-2023-36807 | Medium | 6.2 | 2023-06-30 | pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In version 2.10.5 an attacker who uses thi… |
CVE-2023-36477 | Critical | 9.0 | 2023-06-30 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights can edit all pages in the `C… |
CVE-2023-3485 | Low | 3.0 | 2023-06-30 | Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other… |
CVE-2023-37360 | Medium | 5.9 | 2023-06-30 | pacparser_find_proxy in Pacparser before 1.4.2 allows JavaScript injection, and possibly privilege escalation, when the attacker controls the URL (which may be… |
CVE-2023-37307 | Medium | 5.4 | 2023-06-30 | In MISP before 2.4.172, title_for_layout is not properly sanitized in Correlations, CorrelationExclusions, and Layouts. |
CVE-2023-37306 | High | 7.5 | 2023-06-30 | MISP 2.4.172 mishandles different certificate file extensions in server sync. An attacker can obtain sensitive information because of the nature of the error m… |
CVE-2023-37305 | Medium | 5.3 | 2023-06-30 | An issue was discovered in the ProofreadPage (aka Proofread Page) extension for MediaWiki through 1.39.3. In includes/Page/PageContentHandler.php and includes/… |
CVE-2023-37304 | Medium | 5.4 | 2023-06-30 | An issue was discovered in the DoubleWiki extension for MediaWiki through 1.39.3. includes/DoubleWiki.php allows XSS via the column alignment feature. |
CVE-2023-37303 | Critical | 9.8 | 2023-06-30 | An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In certain situations, an attempt to block a user fails after a temporary brow… |
CVE-2023-37302 | Medium | 6.1 | 2023-06-30 | An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3. There is XSS via a crafted badge title attribute. This is also related to… |
CVE-2023-37301 | Medium | 5.3 | 2023-06-30 | An issue was discovered in SubmitEntityAction in Wikibase in MediaWiki through 1.39.3. Because it doesn't use EditEntity for undo and restore, the intended int… |
CVE-2023-37300 | Medium | 5.3 | 2023-06-30 | An issue was discovered in the CheckUserLog API in the CheckUser extension for MediaWiki through 1.39.3. There is incorrect access control for visibility of hi… |
CVE-2023-35178 | High | 8.8 | 2023-06-30 | Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow when performing a GET request to scan jobs. |
CVE-2023-35177 | High | 8.8 | 2023-06-30 | Certain HP LaserJet Pro print products are potentially vulnerable to a stack-based buffer overflow related to the compact font format parser. |
CVE-2023-35176 | High | 8.8 | 2023-06-30 | Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow and/or Denial of Service when using the backup & restore feature through t… |
CVE-2023-35175 | Critical | 9.8 | 2023-06-30 | Certain HP LaserJet Pro print products are potentially vulnerable to Potential Remote Code Execution and/or Elevation of Privilege via Server-Side Request Forg… |
CVE-2023-34840 | Medium | 6.1 | 2023-06-30 | angular-ui-notification v0.1.0, v0.2.0, and v0.3.6 was discovered to contain a cross-site scripting (XSS) vulnerability. |
CVE-2023-26299 | High | 7.0 | 2023-06-30 | A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (system BIOS), which migh… |
CVE-2023-37299 | Medium | 6.1 | 2023-06-30 | Joplin before 2.11.5 allows XSS via an AREA element of an image map. |
CVE-2023-37298 | Medium | 6.1 | 2023-06-30 | Joplin before 2.11.5 allows XSS via a USE element in an SVG document. |
CVE-2023-33276 | Medium | 6.1 | 2023-06-30 | The web interface of Gira Giersiepen Gira KNX/IP-Router 3.1.3683.0 and 3.3.8.0 responds with a "404 - Not Found" status code if a path is accessed that does no… |
CVE-2023-3478 | Medium | 4.7 | 2023-06-30 | A vulnerability classified as critical was found in IBOS OA 4.5.5. Affected by this vulnerability is the function actionEdit of the file ?r=dashboard/roleadmin… |
CVE-2023-3479 | Medium | 6.1 | 2023-06-30 | Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.7.8. |
CVE-2023-3477 | Low | 3.5 | 2023-06-30 | A vulnerability was found in RocketSoft Rocket LMS 1.7. It has been declared as problematic. This vulnerability affects unknown code of the file /contact/store… |
CVE-2023-3476 | Low | 3.5 | 2023-06-30 | A vulnerability was found in SimplePHPscripts GuestBook Script 2.2. It has been classified as problematic. This affects an unknown part of the file preview.php… |
CVE-2023-3475 | Low | 3.5 | 2023-06-30 | A vulnerability was found in SimplePHPscripts Event Script 2.1 and classified as problematic. Affected by this issue is some unknown functionality of the file… |
CVE-2023-3474 | Low | 3.5 | 2023-06-30 | A vulnerability has been found in SimplePHPscripts Simple Blog 3.2 and classified as problematic. Affected by this vulnerability is an unknown functionality of… |
CVE-2023-3473 | Medium | 4.7 | 2023-06-30 | A vulnerability, which was classified as critical, was found in Campcodes Retro Cellphone Online Store 1.0. Affected is an unknown function of the file /admin/… |
CVE-2023-28387 | Medium | 5.5 | 2023-06-30 | "NewsPicks" App for Android versions 10.4.5 and earlier and "NewsPicks" App for iOS versions 10.4.2 and earlier use hard-coded credentials, which may allow a l… |
CVE-2023-32622 | High | 7.2 | 2023-06-30 | Improper neutralization of special elements in WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to execute OS… |
CVE-2023-32621 | High | 7.2 | 2023-06-30 | WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to upload arbitrary files and execute OS commands with the r… |
CVE-2023-32620 | Medium | 6.5 | 2023-06-30 | Improper authentication vulnerability in WL-WN531AX2 firmware versions prior to 2023526 allows a network-adjacent attacker to obtain a password for the wireles… |
CVE-2023-32613 | High | 8.1 | 2023-06-30 | Exposure of resource to wrong sphere issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow a network-adjacent attacker to use functio… |
CVE-2023-32612 | High | 7.2 | 2023-06-30 | Client-side enforcement of server-side security issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow an attacker with an administrat… |
CVE-2023-2846 | High | 7.5 | 2023-06-30 | Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series main modules allows a remote unauthenticated attack… |
CVE-2023-26135 | High | 7.3 | 2023-06-30 | All versions of the package flatnest are vulnerable to Prototype Pollution via the nest() function in the flatnest/nest.js file. |
CVE-2023-36539 | Medium | 5.3 | 2023-06-30 | Exposure of information intended to be encrypted by some Zoom clients may lead to disclosure of sensitive information. |
CVE-2023-32608 | Medium | 6.5 | 2023-06-30 | Directory traversal vulnerability in Pleasanter (Community Edition and Enterprise Edition) 1.3.39.2 and earlier versions allows a remote authenticated attacker… |
CVE-2023-32607 | Medium | 5.4 | 2023-06-30 | Stored cross-site scripting vulnerability in Pleasanter (Community Edition and Enterprise Edition) 1.3.39.2 and earlier versions allows a remote authenticated… |
CVE-2023-3249 | Critical | 9.8 | 2023-06-30 | The Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.6.0. This is… |
CVE-2023-3063 | High | 8.8 | 2023-06-30 | The SP Project & Document Manager plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 4.67. This is due t… |
CVE-2023-36347 | High | 7.5 | 2023-06-30 | A broken authentication mechanism in the endpoint excel.php of POS Codekop v2.0 allows unauthenticated attackers to download selling data. |
CVE-2023-33336 | Medium | 4.8 | 2023-06-30 | Reflected cross site scripting (XSS) vulnerability was discovered in Sophos Web Appliance v4.3.9.1 that allows for arbitrary code to be inputted via the double… |
CVE-2023-2834 | Critical | 9.8 | 2023-06-30 | The BookIt plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.3.7. This is due to insufficient verification on the… |
CVE-2023-3469 | Medium | 4.8 | 2023-06-30 | Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.2. |
CVE-2023-36146 | Medium | 5.4 | 2023-06-30 | A Stored Cross-Site Scripting (XSS) vulnerability was found in Multilaser RE 170 using firmware 2.2.6733. |
CVE-2023-36143 | High | 8.8 | 2023-06-30 | Maxprint Maxlink 1200G v3.4.11E has an OS command injection vulnerability in the "Diagnostic tool" functionality of the device. |
CVE-2023-3465 | Low | 3.5 | 2023-06-29 | A vulnerability was found in SimplePHPscripts Classified Ads Script 1.8. It has been declared as problematic. Affected by this vulnerability is an unknown func… |
CVE-2023-3464 | Low | 3.5 | 2023-06-29 | A vulnerability was found in SimplePHPscripts Classified Ads Script 1.8. It has been classified as problematic. Affected is an unknown function of the file /pr… |
CVE-2023-36607 | Medium | 5.3 | 2023-06-29 | The affected TBox RTUs are missing authorization for running some API commands. An attacker running these commands could reveal sensitive information such as s… |
CVE-2023-36470 | Critical | 9.9 | 2023-06-29 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By either creating a new or editing an existing docume… |
CVE-2023-36469 | Critical | 9.9 | 2023-06-29 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can edit their own user profile and notif… |
CVE-2023-36468 | Critical | 9.9 | 2023-06-29 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an XWiki installation is upgraded and that upgrad… |
CVE-2023-36471 | Critical | 9.0 | 2023-06-29 | Xwiki commons is the common modules used by other XWiki top level projects. The HTML sanitizer that is included in XWiki since version 14.6RC1 allowed form and… |
CVE-2023-35938 | Medium | 4.1 | 2023-06-29 | Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. When switching from a project visibility that allows re… |
CVE-2023-26966 | Medium | 5.5 | 2023-06-29 | libtiff 4.5.0 is vulnerable to Buffer Overflow in uv_encode() when libtiff reads a corrupted little-endian TIFF file and specifies the output to be big-endian. |
CVE-2023-25433 | Medium | 5.5 | 2023-06-29 | libtiff 4.5.0 is vulnerable to Buffer Overflow via /libtiff/tools/tiffcrop.c:8499. Incorrect updating of buffer size after rotateImage() in tiffcrop cause heap… |
CVE-2023-36484 | Medium | 6.1 | 2023-06-29 | ILIAS 7.21 and 8.0_beta1 through 8.2 is vulnerable to reflected Cross-Site Scripting (XSS). |
CVE-2023-33190 | Critical | 9.9 | 2023-06-29 | Sealos is an open source cloud operating system distribution based on the Kubernetes kernel. In versions of Sealos prior to 4.2.1-rc4 an improper configuration… |
CVE-2023-30955 | Medium | 4.3 | 2023-06-29 | A security defect was identified in Foundry workspace-server that enabled a user to bypass an authorization check and view settings related to 'Developer Mode'… |
CVE-2023-30946 | Low | 3.5 | 2023-06-29 | A security defect was identified in Foundry Issues. If a user was added to an issue on a resource that they did not have access to and consequently could not s… |
CVE-2023-36488 | Medium | 5.4 | 2023-06-29 | ILIAS 7.21 and 8.0_beta1 through 8.2 is vulnerable to stored Cross Site Scripting (XSS). |
CVE-2023-36487 | Critical | 9.8 | 2023-06-29 | The password reset function in ILIAS 7.0_beta1 through 7.20 and 8.0_beta1 through 8.1 allows remote attackers to take over the account. |
CVE-2023-34658 | Medium | 5.3 | 2023-06-29 | Telegram v9.6.3 on iOS allows attackers to hide critical information on the User Interface via calling the function SFSafariViewController. |
CVE-2023-26085 | High | 7.8 | 2023-06-29 | A possible out-of-bounds read and write (due to an improper length check of shared memory) was discovered in Arm NN Android-NN-Driver before 23.02. |
CVE-2023-37256 | Medium | 6.1 | 2023-06-29 | An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. It allows one to store javascript: URLs in URL fields, and automatically links the… |
CVE-2023-37255 | Medium | 6.1 | 2023-06-29 | An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In Special:CheckUser, a check of the "get edits" type is vulnerable to HTML in… |
CVE-2023-37254 | Medium | 6.1 | 2023-06-29 | An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. XSS can occur in Special:CargoQuery via a crafted page item when using the default… |
CVE-2023-37251 | Medium | 6.1 | 2023-06-29 | An issue was discovered in the GoogleAnalyticsMetrics extension for MediaWiki through 1.39.3. The googleanalyticstrackurl parser function does not properly esc… |
CVE-2023-35830 | Critical | 9.8 | 2023-06-29 | STW (aka Sensor-Technik Wiedemann) TCG-4 Connectivity Module DeploymentPackage_v3.03r0-Impala and DeploymentPackage_v3.04r2-Jellyfish and TCG-4lite Connectivit… |
CVE-2023-33277 | High | 7.5 | 2023-06-29 | The web interface of Gira Giersiepen Gira KNX/IP-Router 3.1.3683.0 and 3.3.8.0 allows a remote attacker to read sensitive files via directory-traversal sequenc… |
CVE-2023-31222 | Critical | 9.8 | 2023-06-29 | Deserialization of untrusted data in Microsoft Messaging Queuing Service in Medtronic's Paceart Optima versions 1.11 and earlier on Windows allows an unauthori… |
CVE-2023-26616 | Critical | 9.8 | 2023-06-29 | D-Link DIR-823G firmware version 1.02B05 has a buffer overflow vulnerability, which originates from the URL field in SetParentsControlInfo. |
CVE-2023-26613 | Critical | 9.8 | 2023-06-29 | An OS command injection vulnerability in D-Link DIR-823G firmware version 1.02B05 allows unauthorized attackers to execute arbitrary operating system commands… |
CVE-2023-26612 | Critical | 9.8 | 2023-06-29 | D-Link DIR-823G firmware version 1.02B05 has a buffer overflow vulnerability, which originates from the HostName field in SetParentsControlInfo. |
CVE-2023-34849 | Critical | 9.8 | 2023-06-29 | An unauthorized command injection vulnerability exists in the ActionLogin function of the webman.lua file in Ikuai router OS through 3.7.1. |
CVE-2023-34844 | Critical | 9.8 | 2023-06-29 | Play With Docker < 0.0.2 has an insecure CAP_SYS_ADMIN privileged mode causing the docker container to escape. |
CVE-2023-34656 | High | 8.8 | 2023-06-29 | An issue was discovered with the JSESSION IDs in Xiamen Si Xin Communication Technology Video management system 3.1 thru 4.1 allows attackers to gain escalated… |
CVE-2023-34599 | Medium | 6.1 | 2023-06-29 | Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to execute arbitrary Javascript code. |
CVE-2023-34598 | Critical | 9.8 | 2023-06-29 | Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to include the content of several files present in the installation folder in… |
CVE-2023-33466 | High | 8.8 | 2023-06-29 | Orthanc before 1.12.0 allows authenticated users with access to the Orthanc API to overwrite arbitrary files on the file system, and in specific deployment sce… |
CVE-2023-3458 | Medium | 6.3 | 2023-06-29 | A vulnerability was found in SourceCodester Shopping Website 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2023-3457 | Medium | 6.3 | 2023-06-29 | A vulnerability was found in SourceCodester Shopping Website 1.0. It has been classified as critical. Affected is an unknown function of the file index.php. Th… |
CVE-2023-34735 | Critical | 9.8 | 2023-06-29 | Property Cloud Platform Management Center 1.0 is vulnerable to error-based SQL injection. |
CVE-2023-34487 | Critical | 9.8 | 2023-06-29 | itsourcecode Online Hotel Management System Project In PHP v1.0.0 is vulnerable to SQL Injection. SQL injection points exist in the login password input box. T… |
CVE-2023-34486 | Medium | 6.1 | 2023-06-29 | itsourcecode Online Hotel Management System Project In PHP v1.0.0 is vulnerable to Cross Site Scripting (XSS). Remote code execution can be achieved by enterin… |
CVE-2023-36617 | Medium | 5.3 | 2023-06-29 | A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an inc… |
CVE-2023-22886 | High | 8.8 | 2023-06-29 | Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow JDBC Provider. Airflow JDBC Provider Connection’s [Connection URL] paramet… |
CVE-2023-3447 | High | 7.6 | 2023-06-29 | The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Injection in versions up to, and including, 4.1.5. This is due t… |
CVE-2023-34834 | Medium | 5.3 | 2023-06-29 | A Directory Browsing vulnerability in MCL-Net version 4.3.5.8788 webserver running on default port 5080, allows attackers to gain sensitive information about t… |
CVE-2023-34831 | Medium | 5.4 | 2023-06-29 | The "Submission Web Form" of Turnitin LTI tool/plugin version 1.3 is affected by HTML Injection attacks. The security issue affects the submission web form ("i… |