2023 CVEs (page 213)
Page 213 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-2580 | Medium | 4.8 | 2023-06-27 | The AI Engine WordPress plugin before 1.6.83 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform… |
CVE-2023-2482 | High | 7.2 | 2023-06-27 | The Responsive CSS EDITOR WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL i… |
CVE-2023-2326 | Medium | 6.5 | 2023-06-27 | The Gravity Forms Google Sheet Connector WordPress plugin before 1.3.5, gsheetconnector-gravityforms-pro WordPress plugin through 1.3.5 does not have CSRF chec… |
CVE-2023-2178 | Medium | 4.8 | 2023-06-27 | The Aajoda Testimonials WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2023-2068 | Critical | 9.8 | 2023-06-27 | The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortc… |
CVE-2023-2032 | Critical | 9.8 | 2023-06-27 | The Custom 404 Pro WordPress plugin before 3.8.1 does not properly sanitize database inputs, leading to multiple SQL Injection vulnerabilities. |
CVE-2023-1891 | Medium | 6.1 | 2023-06-27 | The Accordion & FAQ WordPress plugin before 1.9.9 does not escape various generated URLs, before outputting them in attributes when some notices are displayed… |
CVE-2023-1166 | Medium | 4.8 | 2023-06-27 | The USM-Premium WordPress plugin before 16.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform… |
CVE-2023-0873 | Medium | 4.8 | 2023-06-27 | The Kanban Boards for WordPress plugin before 2.5.21 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2023-0588 | Medium | 6.1 | 2023-06-27 | The Catalyst Connect Zoho CRM Client Portal WordPress plugin before 2.1.0 does not sanitize and escape a parameter before outputting it back in the page, leadi… |
CVE-2023-35798 | Medium | 4.3 | 2023-06-27 | Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.This vulner… |
CVE-2023-34395 | High | 7.8 | 2023-06-27 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Software Foundation Apache Airflow ODBC Provider. In… |
CVE-2023-3423 | High | 8.8 | 2023-06-27 | Weak Password Requirements in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v 1.2.0. |
CVE-2023-3412 | Medium | 6.4 | 2023-06-27 | The Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, an… |
CVE-2023-3411 | Medium | 6.1 | 2023-06-27 | The Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and… |
CVE-2023-3132 | Medium | 5.9 | 2023-06-27 | The MainWP Child plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.4.1.1 due to insufficient controls on… |
CVE-2023-3371 | Medium | 5.3 | 2023-06-27 | The EmbedPress plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'lock_content_form_handler' and 'dis… |
CVE-2023-22834 | Low | 2.7 | 2023-06-27 | The Contour Service was not checking that users had permission to create an analysis for a given dataset. This could allow an attacker to clutter up Compass fo… |
CVE-2023-30945 | Critical | 9.8 | 2023-06-26 | Multiple Services such as VHS(Video History Server) and VCD(Video Clip Distributor) and Clips2 were discovered to be vulnerable to an unauthenticated arbitrary… |
CVE-2023-35695 | High | 7.5 | 2023-06-26 | A remote attacker could leverage a vulnerability in Trend Micro Mobile Security (Enterprise) 9.8 SP5 to download a particular log file which may contain sensit… |
CVE-2023-35164 | Medium | 6.3 | 2023-06-26 | DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. In affected versions a missing authorization… |
CVE-2023-34148 | High | 7.8 | 2023-06-26 | An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate privi… |
CVE-2023-34147 | High | 7.8 | 2023-06-26 | An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate privi… |
CVE-2023-34146 | High | 7.8 | 2023-06-26 | An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate privi… |
CVE-2023-34145 | High | 7.8 | 2023-06-26 | An untrusted search path vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate their priv… |
CVE-2023-34144 | High | 7.8 | 2023-06-26 | An untrusted search path vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate their priv… |
CVE-2023-32605 | Medium | 5.4 | 2023-06-26 | Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site scripting (XSS) attacks due to user inpu… |
CVE-2023-32604 | Medium | 5.4 | 2023-06-26 | Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site scripting (XSS) attacks due to user inpu… |
CVE-2023-32557 | Critical | 9.8 | 2023-06-26 | A path traversal vulnerability in the Trend Micro Apex One and Apex One as a Service could allow an unauthenticated attacker to upload an arbitrary file to the… |
CVE-2023-32556 | Medium | 5.5 | 2023-06-26 | A link following vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to disclose sensitive information. P… |
CVE-2023-32555 | High | 7.0 | 2023-06-26 | A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on af… |
CVE-2023-32554 | High | 7.0 | 2023-06-26 | A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on af… |
CVE-2023-32553 | Medium | 5.3 | 2023-06-26 | An Improper access control vulnerability in Trend Micro Apex One and Apex One as a Service could allow an unauthenticated user under certain circumstances to d… |
CVE-2023-32552 | Medium | 5.3 | 2023-06-26 | An Improper access control vulnerability in Trend Micro Apex One and Apex One as a Service could allow an unauthenticated user under certain circumstances to d… |
CVE-2023-32537 | Medium | 5.4 | 2023-06-26 | Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site scripting (XSS) attacks due to user inpu… |
CVE-2023-32536 | Medium | 5.4 | 2023-06-26 | Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site scripting (XSS) attacks due to user inpu… |
CVE-2023-32535 | Medium | 6.1 | 2023-06-26 | Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve r… |
CVE-2023-32534 | Medium | 6.1 | 2023-06-26 | Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve r… |
CVE-2023-32533 | Medium | 6.1 | 2023-06-26 | Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve r… |
CVE-2023-32532 | Medium | 6.1 | 2023-06-26 | Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve r… |
CVE-2023-32531 | Medium | 6.1 | 2023-06-26 | Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve r… |
CVE-2023-32530 | High | 8.8 | 2023-06-26 | Vulnerable modules of Trend Micro Apex Central (on-premise) contain vulnerabilities which would allow authenticated users to perform a SQL injection that could… |
CVE-2023-32529 | High | 8.8 | 2023-06-26 | Vulnerable modules of Trend Micro Apex Central (on-premise) contain vulnerabilities which would allow authenticated users to perform a SQL injection that could… |
CVE-2023-32528 | High | 8.8 | 2023-06-26 | Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains vulnerable .php files that could allow a remote attacker to execute arbitrary code on affected instal… |
CVE-2023-32527 | High | 8.8 | 2023-06-26 | Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains vulnerable .php files that could allow a remote attacker to execute arbitrary code on affected instal… |
CVE-2023-32526 | Medium | 6.5 | 2023-06-26 | Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains widget vulnerabilities that could allow a remote attacker to create arbitrary files on affected insta… |
CVE-2023-32525 | Medium | 6.5 | 2023-06-26 | Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains widget vulnerabilities that could allow a remote attacker to create arbitrary files on affected insta… |
CVE-2023-32524 | High | 8.8 | 2023-06-26 | Affected versions of Trend Micro Mobile Security (Enterprise) 9.8 SP5 contain some widgets that would allow a remote user to bypass authentication and potentia… |
CVE-2023-32523 | High | 8.8 | 2023-06-26 | Affected versions of Trend Micro Mobile Security (Enterprise) 9.8 SP5 contain some widgets that would allow a remote user to bypass authentication and potentia… |
CVE-2023-32522 | High | 8.1 | 2023-06-26 | A path traversal exists in a specific dll of Trend Micro Mobile Security (Enterprise) 9.8 SP5 which could allow an authenticated remote attacker to delete arbi… |
CVE-2023-32521 | Critical | 9.1 | 2023-06-26 | A path traversal exists in a specific service dll of Trend Micro Mobile Security (Enterprise) 9.8 SP5 which could allow an unauthenticated remote attacker to d… |
CVE-2023-30902 | Medium | 5.5 | 2023-06-26 | A privilege escalation vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to unintentionally delete privile… |
CVE-2023-28929 | High | 7.8 | 2023-06-26 | Trend Micro Security 2021, 2022, and 2023 (Consumer) are vulnerable to a DLL Hijacking vulnerability which could allow an attacker to use a specific executable… |
CVE-2023-3422 | High | 8.8 | 2023-06-26 | Use after free in Guest View in Google Chrome prior to 114.0.5735.198 allowed an attacker who convinced a user to install a malicious extension to potentially… |
CVE-2023-3421 | High | 8.8 | 2023-06-26 | Use after free in Media in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2023-3420 | High | 8.8 | 2023-06-26 | Type Confusion in V8 in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2023-35168 | Medium | 6.5 | 2023-06-26 | DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. Affected versions of DataEase has a privileg… |
CVE-2023-34924 | High | 7.5 | 2023-06-26 | H3C Magic B1STW B1STV100R012 was discovered to contain a stack overflow via the function SetAPInfoById. This vulnerability allows attackers to cause a Denial o… |
CVE-2023-34463 | High | 8.1 | 2023-06-26 | DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. In affected versions Unauthorized users can… |
CVE-2023-3113 | High | 8.2 | 2023-06-26 | An unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) server that could result in read-only acce… |
CVE-2023-35933 | Medium | 5.9 | 2023-06-26 | OPenFGA is an open source authorization/permission engine built for developers. OpenFGA versions v1.1.0 and prior are vulnerable to a DoS attack when Check and… |
CVE-2023-35930 | Low | 3.7 | 2023-06-26 | SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. Any user making a neg… |
CVE-2023-34422 | Medium | 6.5 | 2023-06-26 | A valid, authenticated LXCA user with elevated privileges may be able to delete folders in the LXCA filesystem through a specifically crafted web API call due… |
CVE-2023-34421 | Medium | 6.5 | 2023-06-26 | A valid, authenticated LXCA user with elevated privileges may be able to replace filesystem data through a specifically crafted web API call due to insufficien… |
CVE-2023-34420 | High | 7.2 | 2023-06-26 | A valid, authenticated LXCA user with elevated privileges may be able to execute command injections through crafted calls to a specific web API. |
CVE-2023-34418 | High | 8.1 | 2023-06-26 | A valid, authenticated LXCA user may be able to gain unauthorized access to events and other data stored in LXCA due to a SQL injection vulnerability in a spec… |
CVE-2023-33404 | Critical | 9.8 | 2023-06-26 | An Unrestricted Upload vulnerability, due to insufficient validation on UploadControlled.cs file, in BlogEngine.Net version 3.3.8.0 and earlier allows remote a… |
CVE-2023-33176 | Medium | 4.8 | 2023-06-26 | BigBlueButton is an open source virtual classroom designed to help teachers teach and learners learn. In affected versions are affected by a Server-Side Reques… |
CVE-2023-2993 | Medium | 5.4 | 2023-06-26 | A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of comm… |
CVE-2023-2992 | High | 7.5 | 2023-06-26 | An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under crafted conditions… |
CVE-2023-2290 | Medium | 6.4 | 2023-06-26 | A potential vulnerability in the LenovoFlashDeviceInterface SMI handler may allow an attacker with local access and elevated privileges to execute arbitrary co… |
CVE-2023-27082 | Medium | 4.8 | 2023-06-26 | Cross Site Scripting (XSS) vulnerability in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev4 allows remote attackers to run arbitrary code via upload of craf… |
CVE-2023-36252 | High | 8.8 | 2023-06-26 | An issue in Ateme Flamingo XL v.3.6.20 and XS v.3.6.5 allows a remote authenticated attacker to execute arbitrary code and cause a denial of service via a the… |
CVE-2023-2005 | Medium | 6.3 | 2023-06-26 | Vulnerability in Tenable Tenable.Io, Tenable Nessus, Tenable Security Center.This issue affects Tenable.Io: before Plugin Feed ID #202306261202 ; Nessus: befor… |
CVE-2023-33580 | Medium | 4.8 | 2023-06-26 | Phpgurukul Student Study Center Management System V1.0 is vulnerable to Cross Site Scripting (XSS) in the "Admin Name" field on Admin Profile page. |
CVE-2023-29459 | Medium | 6.1 | 2023-06-26 | The laola.redbull application through 5.1.9-R for Android exposes the exported activity at.redbullsalzburg.android.AppMode.Default.Splash.SplashActivity, which… |
CVE-2023-28485 | Medium | 5.4 | 2023-06-26 | A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before 6.75 allows remote authenticated users to inject arbitrary web script… |
CVE-2023-36301 | High | 7.5 | 2023-06-26 | Talend Data Catalog before 8.0-20230221 contain a directory traversal vulnerability in HeaderImageServlet. |
CVE-2023-25307 | High | 7.8 | 2023-06-26 | nothub mrpack-install <= v0.16.2 is vulnerable to Directory Traversal. |
CVE-2023-25306 | High | 7.5 | 2023-06-26 | MultiMC Launcher <= 0.6.16 is vulnerable to Directory Traversal. |
CVE-2023-30261 | Critical | 9.8 | 2023-06-26 | Command Injection vulnerability in OpenWB 1.6 and 1.7 allows remote attackers to run arbitrary commands via crafted GET request. |
CVE-2023-29438 | Medium | 5.9 | 2023-06-26 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Eric Martin SimpleModal Contact Form (SMCF) plugin <= 1.2.9 versions. |
CVE-2023-29437 | Medium | 6.5 | 2023-06-26 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Steven A. Zahm Connections Business Directory plugin <= 10.4.36 versions. |
CVE-2023-36631 | High | 7.8 | 2023-06-26 | Lack of access control in wfc.exe in Malwarebytes Binisoft Windows Firewall Control 6.9.2.0 allows local unprivileged users to bypass Windows Firewall restrict… |
CVE-2023-29435 | Medium | 6.5 | 2023-06-26 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Zwaply Cryptocurrency All-in-One plugin <= 3.0.19 versions. |
CVE-2023-3398 | High | 7.5 | 2023-06-26 | Denial of Service in GitHub repository jgraph/drawio prior to 18.1.3. |
CVE-2023-29436 | Medium | 6.5 | 2023-06-26 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Flyn San IFrame Shortcode plugin <= 1.0.5 versions. |
CVE-2023-29434 | Medium | 5.9 | 2023-06-26 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in FancyThemes Optin Forms – Simple List Building Plugin for WordPress plugin <= 1.3.1 versions. |
CVE-2023-29430 | High | 7.1 | 2023-06-26 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CTHthemes TheRoof theme <= 1.0.3 versions. |
CVE-2023-29427 | High | 7.1 | 2023-06-26 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in TMS Booking for Appointments and Events Calendar – Amelia plugin <= 1.0.75 versions. |
CVE-2023-29424 | High | 7.1 | 2023-06-26 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Plainware ShiftController Employee Shift Scheduling plugin <= 4.9.23 versions. |
CVE-2023-29423 | Medium | 5.9 | 2023-06-26 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PI Websolution Cancel order request / Return order / Repeat Order / Reorder for WooCommerce p… |
CVE-2023-22359 | Medium | 4.3 | 2023-06-26 | User enumeration in Checkmk <=2.2.0p4 allows an authenticated attacker to enumerate usernames. |
CVE-2023-1620 | Medium | 4.9 | 2023-06-26 | Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a specifically crafted… |
CVE-2023-1619 | Medium | 4.9 | 2023-06-26 | Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a malformed packet. |
CVE-2023-1150 | High | 7.5 | 2023-06-26 | Uncontrolled resource consumption in Series WAGO 750-3x/-8x products may allow an unauthenticated remote attacker to DoS the MODBUS server with specially craft… |
CVE-2023-29093 | Medium | 5.9 | 2023-06-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PI Websolution Conditional cart fee plugin <= 1.0.96 vers… |
CVE-2023-28992 | High | 7.1 | 2023-06-26 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Elliot Sowersby, RelyWP Coupon Affiliates – WooCommerce Affiliate Plugin plugin <= 5.4.3 versions. |
CVE-2023-28991 | Medium | 5.9 | 2023-06-26 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PI Websolution Order date, Order pickup, Order date time, Pickup Location, delivery date for… |
CVE-2023-28988 | Medium | 5.9 | 2023-06-26 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PI Websolution Direct checkout, Add to cart redirect, Quick purchase button, Buy now button… |