2023 CVEs (page 216)
Page 216 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-34241 | Medium | 5.3 | 2023-06-22 | OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Starting in version 2.0.0 and prior to ver… |
CVE-2023-34110 | Low | 2.7 | 2023-06-22 | Flask-AppBuilder is an application development framework, built on top of Flask. Prior to version 4.3.2, an authenticated malicious actor with Admin privileges… |
CVE-2023-28016 | Low | 3.1 | 2023-06-22 | Host Header Injection vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower allows attacker to supply invalid input to cause the OSD Ba… |
CVE-2023-28006 | High | 7.0 | 2023-06-22 | The OSD Bare Metal Server uses a cryptographic algorithm that is no longer considered sufficiently secure. |
CVE-2023-3114 | Medium | 5.0 | 2023-06-22 | Terraform Enterprise since v202207-1 did not properly implement authorization rules for agent pools, allowing the workspace to be targeted by unauthorized agen… |
CVE-2023-23343 | Low | 2.4 | 2023-06-22 | A clickjacking vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower allows attacker to use transparent or opaque layers to trick a use… |
CVE-2023-3128 | Critical | 9.4 | 2023-06-22 | Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads… |
CVE-2023-35133 | High | 7.5 | 2023-06-22 | An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3… |
CVE-2023-35132 | Medium | 6.3 | 2023-06-22 | A limited SQL injection risk was identified on the Mnet SSO access control page. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.1… |
CVE-2023-35131 | Medium | 6.1 | 2023-06-22 | Content on the groups page required additional sanitizing to prevent an XSS risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8 and 3.11 to… |
CVE-2023-34553 | Medium | 6.5 | 2023-06-22 | An issue was discovered in WAFU Keyless Smart Lock v1.0 allows attackers to unlock a device via code replay attack. |
CVE-2023-32320 | High | 8.7 | 2023-06-22 | Nextcloud Server is a data storage system for Nextcloud, a self-hosted productivity platform. When multiple requests are sent in parallel, all of them were exe… |
CVE-2023-30347 | Medium | 4.8 | 2023-06-22 | Cross Site Scripting (XSS) vulnerability in Neox Contact Center 2.3.9, via the serach_sms_api_name parameter to the SMA API search. |
CVE-2023-28094 | High | 8.1 | 2023-06-22 | Pega platform clients who are using versions 7.4 through 8.8.x and have upgraded from a version prior to 8.x may be utilizing default credentials. |
CVE-2023-36359 | High | 7.5 | 2023-06-22 | TP-Link TL-WR940N V4, TL-WR841N V8/V10, TL-WR940N V2/V3 and TL-WR941ND V5/V6 were discovered to contain a buffer overflow in the component /userRpm/QoSRuleList… |
CVE-2023-36358 | High | 7.7 | 2023-06-22 | TP-Link TL-WR940N V2/V3/V4, TL-WR941ND V5/V6, TL-WR743ND V1 and TL-WR841N V8 were discovered to contain a buffer overflow in the component /userRpm/AccessCtrlA… |
CVE-2023-36357 | High | 7.7 | 2023-06-22 | An issue in the /userRpm/LocalManageControlRpm component of TP-Link TL-WR940N V2/V4/V6, TL-WR841N V8/V10, and TL-WR941ND V5 allows attackers to cause a Denial… |
CVE-2023-36356 | High | 7.7 | 2023-06-22 | TP-Link TL-WR940N V2/V4/V6, TL-WR841N V8, TL-WR941ND V5, and TL-WR740N V1/V2 were discovered to contain a buffer read out-of-bounds via the component /userRpm/… |
CVE-2023-36355 | Critical | 9.9 | 2023-06-22 | TP-Link TL-WR940N V4 was discovered to contain a buffer overflow via the ipStart parameter at /userRpm/WanDynamicIpV6CfgRpm. This vulnerability allows attacker… |
CVE-2023-36354 | High | 7.5 | 2023-06-22 | TP-Link TL-WR940N V4, TL-WR841N V8/V10, TL-WR740N V1/V2, TL-WR940N V2/V3, and TL-WR941ND V5/V6 were discovered to contain a buffer overflow in the component /u… |
CVE-2023-32571 | Critical | 9.8 | 2023-06-22 | Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Sele… |
CVE-2023-2991 | Medium | 5.3 | 2023-06-22 | Fortra Globalscape EFT's administration server suffers from an information disclosure vulnerability where the serial number of the harddrive that Globalscape i… |
CVE-2023-2990 | High | 7.5 | 2023-06-22 | Fortra Globalscape EFT versions before 8.1.0.16 suffer from a denial of service vulnerability, where a compressed message that decompresses to itself can cause… |
CVE-2023-2989 | Critical | 9.1 | 2023-06-22 | Fortra Globalscape EFT versions before 8.1.0.16 suffer from an out of bounds memory read in their administration server, which can allow an attacker to crash t… |
CVE-2023-28800 | High | 8.1 | 2023-06-22 | When using local accounts for administration, the redirect url parameter was not encoded correctly, allowing for an XSS attack providing admin login. |
CVE-2023-28799 | High | 8.2 | 2023-06-22 | A URL parameter during login flow was vulnerable to injection. An attacker could insert a malicious domain in this parameter, which would redirect the user aft… |
CVE-2023-27083 | High | 7.2 | 2023-06-22 | An issue discovered in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev5 allows remote attackers to run arbitrary code via manage file functionality. |
CVE-2023-36243 | High | 7.8 | 2023-06-22 | FLVMeta v1.2.1 was discovered to contain a buffer overflow via the xml_on_metadata_tag_only function at dump_xml.c. |
CVE-2023-36239 | High | 8.8 | 2023-06-22 | libming listswf 0.4.7 was discovered to contain a buffer overflow in the parseSWF_DEFINEFONTINFO() function at parser.c. |
CVE-2023-34923 | High | 8.1 | 2023-06-22 | XML Signature Wrapping (XSW) in SAML-based Single Sign-on feature in TOPdesk v12.10.12 allows bad actors with credentials to authenticate with the Identity Pro… |
CVE-2023-34796 | Medium | 6.1 | 2023-06-22 | Cross site scripting (XSS) vulnerabiliy in dmarcts-report-viewer dashboard versions 1.1 and thru commit 8a1d882b4c481a05e296e9b38a7961e912146a0f, allows unauth… |
CVE-2023-3326 | Critical | 9.8 | 2023-06-22 | pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Ce… |
CVE-2023-3256 | High | 8.8 | 2023-06-22 | Advantech R-SeeNet versions 2.4.22 allows low-level users to access and load the content of local files. |
CVE-2023-2611 | Critical | 9.8 | 2023-06-22 | Advantech R-SeeNet versions 2.4.22 is installed with a hidden root-level user that is not available in the users list. This hidden user has a password that… |
CVE-2023-36097 | Critical | 9.8 | 2023-06-22 | funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install. |
CVE-2023-36093 | Medium | 5.4 | 2023-06-22 | There is a storage type cross site scripting (XSS) vulnerability in the filing number of the Basic Information tab on the backend management page of EyouCMS v1… |
CVE-2023-34170 | Medium | 5.9 | 2023-06-22 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP Overnight Quick/Bulk Order Form for WooCommerce plugin <= 3.5.7 versions. |
CVE-2023-34028 | Medium | 4.3 | 2023-06-22 | Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin <= 1.0.7 versions. |
CVE-2023-36371 | High | 7.5 | 2023-06-22 | An issue in the GDKfree component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2023-36370 | High | 7.5 | 2023-06-22 | An issue in the gc_col component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2023-36369 | High | 7.5 | 2023-06-22 | An issue in the list_append component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2023-36368 | High | 7.5 | 2023-06-22 | An issue in the cs_bind_ubat component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2023-36367 | High | 7.5 | 2023-06-22 | An issue in the BLOBcmp component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2023-36366 | High | 7.5 | 2023-06-22 | An issue in the log_create_delta component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause Denial of Service (DoS) via crafted SQL statement… |
CVE-2023-36365 | High | 7.5 | 2023-06-22 | An issue in the sql_trans_copy_key component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL state… |
CVE-2023-36364 | High | 7.5 | 2023-06-22 | An issue in the rel_deps component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2023-36363 | High | 7.5 | 2023-06-22 | An issue in the __nss_database_lookup component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL st… |
CVE-2023-36362 | High | 7.5 | 2023-06-22 | An issue in the rel_sequences component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2023-35926 | High | 8.0 | 2023-06-22 | Backstage is an open platform for building developer portals. The Backstage scaffolder-backend plugin uses a templating library that requires sandbox, as it by… |
CVE-2023-35174 | High | 8.6 | 2023-06-22 | Livebook is a web application for writing interactive and collaborative code notebooks. On Windows, it is possible to open a `livebook://` link from a browser… |
CVE-2023-34927 | Medium | 6.5 | 2023-06-22 | Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint /api/set-password. This vulnerability allows attackers… |
CVE-2023-34368 | Medium | 5.9 | 2023-06-22 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kanban for WordPress Kanban Boards for WordPress plugin <= 2.5.20 versions. |
CVE-2023-34006 | Medium | 5.9 | 2023-06-22 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Marco Milesi Telegram Bot & Channel plugin <= 3.6.2 versions. |
CVE-2023-33997 | High | 7.1 | 2023-06-22 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Robin Wilson bbp style pack plugin <= 5.5.5 versions. |
CVE-2023-33323 | Medium | 5.9 | 2023-06-22 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Repute InfoSystems ARMember plugin <= 4.0.2 versions. |
CVE-2023-32960 | High | 7.1 | 2023-06-22 | Cross-Site Request Forgery (CSRF) vulnerability in UpdraftPlus.Com, DavidAnderson UpdraftPlus WordPress Backup Plugin <= 1.23.3 versions leads to sitewide Cros… |
CVE-2023-32239 | Medium | 5.4 | 2023-06-22 | Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in xtemos WoodMart theme <= 7.2.1 versions. |
CVE-2023-28774 | Medium | 5.9 | 2023-06-22 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Grade Us, Inc. Review Stream plugin <= 1.6.5 versions. |
CVE-2023-28418 | Medium | 5.4 | 2023-06-22 | Auth. (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Yudlee themes Mediciti Lite theme <= 1.3.0 versions. |
CVE-2023-25500 | Low | 3.5 | 2023-06-22 | Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0… |
CVE-2023-25499 | Medium | 5.7 | 2023-06-22 | When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 th… |
CVE-2023-20896 | Medium | 5.9 | 2023-06-22 | The VMware vCenter Server contains an out-of-bounds read vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to v… |
CVE-2023-35918 | High | 7.1 | 2023-06-22 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Bulk Stock Management plugin <= 2.2.33 versions. |
CVE-2023-35917 | Medium | 4.3 | 2023-06-22 | Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce PayPal Payments plugin <= 2.0.4 versions. |
CVE-2023-35093 | Medium | 6.5 | 2023-06-22 | Broken Access Control vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.0.8 versions allows any l… |
CVE-2023-34939 | Critical | 9.8 | 2023-06-22 | Onlyoffice Community Server before v12.5.2 was discovered to contain a remote code execution (RCE) vulnerability via the component UploadProgress.ashx. |
CVE-2023-31868 | Medium | 5.4 | 2023-06-22 | Sage X3 version 12.14.0.50-0 is vulnerable to Cross Site Scripting (XSS). Some parts of the Web application are dynamically built using user's inputs. Yet, tho… |
CVE-2023-31867 | High | 7.2 | 2023-06-22 | Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection. |
CVE-2023-30500 | Medium | 5.8 | 2023-06-22 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPForms WPForms Lite (wpforms-lite), WPForms WPForms Pro (wpforms) plugins <= 1.8.1.2 versions. |
CVE-2023-29711 | Critical | 9.8 | 2023-06-22 | An incorrect access control issue was discovered in Interlink PSG-5124 version 1.0.4, allows attackers to execute arbitrary code via crafted GET request. |
CVE-2023-28784 | High | 7.1 | 2023-06-22 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Contest Gallery plugin <= 21.1.2 versions. |
CVE-2023-28778 | Medium | 5.9 | 2023-06-22 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in BestWebSoft Pagination plugin <= 1.2.2 versions. |
CVE-2023-28776 | High | 7.1 | 2023-06-22 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Continuous Image Carousel With Lightbox plugin <= 1.0.15 versions. |
CVE-2023-28750 | High | 7.1 | 2023-06-22 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ignazio Scimone Albo Pretorio On line plugin <= 4.6 versions. |
CVE-2023-28174 | Medium | 5.9 | 2023-06-22 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in eLightUp eRocket plugin <= 1.2.4 versions. |
CVE-2023-27452 | Medium | 5.9 | 2023-06-22 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Wow-Company Button Generator – easily Button Builder plugin <= 2.3.3 versions. |
CVE-2023-26539 | Medium | 5.9 | 2023-06-22 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Max Chirkov Advanced Text Widget plugin <= 2.1.2 versions. |
CVE-2023-26534 | Medium | 5.9 | 2023-06-22 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in OneWebsite WP Repost plugin <= 0.1 versions. |
CVE-2023-23811 | Medium | 5.9 | 2023-06-22 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Neil Gee Smoothscroller plugin <= 1.0.0 versions. |
CVE-2023-23807 | Medium | 5.9 | 2023-06-22 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Qumos MojoPlug Slide Panel plugin <= 1.1.2 versions. |
CVE-2023-23795 | High | 7.1 | 2023-06-22 | Cross-Site Request Forgery (CSRF) vulnerability in Muneeb Form Builder plugin <= 1.9.9.0 versions. |
CVE-2023-20895 | High | 8.1 | 2023-06-22 | The VMware vCenter Server contains a memory corruption vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCe… |
CVE-2023-20894 | High | 8.1 | 2023-06-22 | The VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to… |
CVE-2023-20893 | High | 8.1 | 2023-06-22 | The VMware vCenter Server contains a use-after-free vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCente… |
CVE-2023-20892 | High | 8.1 | 2023-06-22 | The vCenter Server contains a heap overflow vulnerability due to the usage of uninitialized memory in the implementation of the DCERPC protocol. A malicious ac… |
CVE-2023-35090 | Medium | 6.5 | 2023-06-22 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plug… |
CVE-2023-34601 | Critical | 9.8 | 2023-06-22 | Jeesite before commit 10742d3 was discovered to contain a SQL injection vulnerability via the component ${businessTable} at /act/ActDao.xml. |
CVE-2023-33387 | Medium | 6.1 | 2023-06-22 | A reflected cross-site scripting (XSS) vulnerability in DATEV eG Personal-Management System Comfort/Comfort Plus v15.1.0 to v16.1.1 P4 allows attackers to stea… |
CVE-2023-31213 | Medium | 6.5 | 2023-06-22 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WPBakery Page Builder plugin <= 6.13.0 versions. |
CVE-2023-29931 | Critical | 9.8 | 2023-06-22 | laravel-s 3.7.35 is vulnerable to Local File Inclusion via /src/Illuminate/Laravel.php. |
CVE-2023-29709 | High | 7.5 | 2023-06-22 | An issue was discovered in /cgi-bin/login_rj.cgi in Wildix WSG24POE version 103SP7D190822, allows attackers to bypass authentication. |
CVE-2023-29708 | High | 7.5 | 2023-06-22 | An issue was discovered in /cgi-bin/adm.cgi in WavLink WavRouter version RPT70HA1.x, allows attackers to force a factory reset via crafted payload. |
CVE-2023-29707 | Medium | 4.8 | 2023-06-22 | Cross Site Scripting (XSS) vulnerability in GBCOM LAC WEB Control Center version lac-1.3.x, allows attackers to create an arbitrary device. |
CVE-2023-28695 | Medium | 5.9 | 2023-06-22 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Drew Phillips VigilanTor plugin <= 1.3.10 versions. |
CVE-2023-28534 | Medium | 6.5 | 2023-06-22 | Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in WP Job Portal WP Job Portal – A Complete Job Board plugin <= 2.0.0 versions. |
CVE-2023-28496 | Medium | 5.9 | 2023-06-22 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SMTP2GO – Email Made Easy plugin <= 1.4.2 versions. |
CVE-2023-28423 | Medium | 5.9 | 2023-06-22 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Prism Tech Studios Modern Footnotes plugin <= 1.4.15 versions. |
CVE-2023-28171 | Medium | 5.4 | 2023-06-22 | Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in WP Chill Brilliance theme <= 1.3.1 versions. |
CVE-2023-28166 | High | 7.1 | 2023-06-22 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Aakif Kadiwala Tags Cloud Manager plugin <= 1.0.0 versions. |
CVE-2023-27618 | Medium | 5.9 | 2023-06-22 | Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in AGILELOGIX Store Locator WordPress plugin <= 1.4.9 versions. |