2023 CVEs (page 217)
Page 217 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-27631 | Medium | 6.5 | 2023-06-22 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in mmrs151 Daily Prayer Time plugin <= 2023.05.04 versions. |
CVE-2023-27629 | Medium | 6.5 | 2023-06-22 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Paul Ryley Site Reviews plugin <= 6.5.1 versions. |
CVE-2023-27612 | Medium | 6.5 | 2023-06-22 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Paul Ryley Site Reviews plugin <= 6.5.1 versions. |
CVE-2023-27413 | Medium | 6.5 | 2023-06-22 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Shazzad Hossain Khan W4 Post List plugin <= 2.4.4 versions. |
CVE-2023-32449 | High | 7.2 | 2023-06-22 | Dell PowerStore versions prior to 3.5 contain an improper verification of cryptographic signature vulnerability. An attacker can trick a high privileged user… |
CVE-2023-26115 | Medium | 5.3 | 2023-06-22 | All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within… |
CVE-2023-33842 | Medium | 6.2 | 2023-06-22 | IBM SPSS Modeler on Windows 17.0, 18.0, 18.2.2, 18.3, 18.4, and 18.5 requires the end user to have access to the server SSL key which could allow a local user… |
CVE-2023-28956 | High | 8.4 | 2023-06-22 | IBM Spectrum Protect Backup-Archive Client 8.1.0.0 through 8.1.17.2 may allow a local user to escalate their privileges due to improper access controls. |
CVE-2023-33405 | Medium | 6.1 | 2023-06-21 | Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect. |
CVE-2023-24261 | High | 7.2 | 2023-06-21 | A vulnerability in GL.iNET GL-E750 Mudi before firmware v3.216 allows authenticated attackers to execute arbitrary code via a crafted POST request. |
CVE-2023-3110 | Critical | 9.6 | 2023-06-21 | Description: A vulnerability in SiLabs Unify Gateway 1.3.1 and earlier allows an unauthenticated attacker within Z-Wave range to overflow a stack buffer, leadi… |
CVE-2023-33591 | Medium | 6.1 | 2023-06-21 | User Registration & Login and User Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/search-… |
CVE-2023-33289 | High | 7.5 | 2023-06-21 | The urlnorm crate through 0.1.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to lib.rs. NOTE: the Supplier disputes this, tak… |
CVE-2023-25435 | Medium | 5.5 | 2023-06-21 | libtiff 4.5.0 is vulnerable to Buffer Overflow via extractContigSamplesShifted8bits() at /libtiff/tools/tiffcrop.c:3753. |
CVE-2023-0972 | Critical | 9.6 | 2023-06-21 | Description: A vulnerability in SiLabs Z/IP Gateway 7.18.01 and earlier allows an unauthenticated attacker within Z-Wave range to overflow a stack buffer, lead… |
CVE-2023-0971 | Critical | 9.6 | 2023-06-21 | A logic error in SiLabs Z/IP Gateway SDK 7.18.02 and earlier allows authentication to be bypassed, remote administration of Z-Wave controllers, and S0/S2 encry… |
CVE-2023-0970 | High | 7.1 | 2023-06-21 | Multiple buffer overflow vulnerabilities in SiLabs Z/IP Gateway SDK version 7.18.01 and earlier allow an attacker with invasive physical access to a Z-Wave con… |
CVE-2023-0969 | Low | 3.5 | 2023-06-21 | A vulnerability in SiLabs Z/IP Gateway 7.18.01 and earlier allows an authenticated attacker within Z-Wave range to manipulate an array pointer to disclose the… |
CVE-2023-2911 | High | 7.5 | 2023-06-21 | If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable yes;` and `stale-answer-client-timeout 0;`, a sequen… |
CVE-2023-2829 | High | 7.5 | 2023-06-21 | A `named` instance configured to run as a DNSSEC-validating recursive resolver with the Aggressive Use of DNSSEC-Validated Cache (RFC 8198) option (`synth-from… |
CVE-2023-2828 | High | 7.5 | 2023-06-21 | Every `named` instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to author… |
CVE-2023-0026 | High | 7.5 | 2023-06-21 | An Improper Input Validation vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, ne… |
CVE-2023-33725 | Medium | 6.1 | 2023-06-21 | Broadleaf 5.x and 6.x (including 5.2.25-GA and 6.2.6-GA) was discovered to contain a cross-site scripting (XSS) vulnerability via a customer signup with a craf… |
CVE-2023-27243 | High | 7.5 | 2023-06-21 | An access control issue in Makves DCAP v3.0.0.122 allows unauthenticated attackers to obtain cleartext credentials via a crafted web request to the product API. |
CVE-2023-27432 | High | 7.1 | 2023-06-21 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WpSimpleTools Manage Upload Limit plugin <= 1.0.4 versions. |
CVE-2023-27429 | Medium | 5.9 | 2023-06-21 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Automattic - Jetpack CRM team Jetpack CRM plugin <= 5.4.4 versions. |
CVE-2023-27414 | High | 7.1 | 2023-06-21 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Popup Box Team Popup box plugin <= 3.4.4 versions. |
CVE-2023-33584 | Critical | 9.8 | 2023-06-21 | Sourcecodester Enrollment System Project V1.0 is vulnerable to SQL Injection (SQLI) attacks, which allow an attacker to manipulate the SQL queries executed by… |
CVE-2023-27450 | High | 7.1 | 2023-06-21 | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Teplitsa of social technologies Leyka plugin <= 3.29.2 versions. |
CVE-2023-27443 | Medium | 6.5 | 2023-06-21 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Grant Kimball Simple Vimeo Shortcode plugin <= 2.9.1 versions. |
CVE-2023-27439 | Medium | 5.9 | 2023-06-21 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gl_SPICE New Adman plugin <= 1.6.8 versions. |
CVE-2023-34981 | High | 7.5 | 2023-06-21 | A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP S… |
CVE-2023-34340 | Critical | 9.8 | 2023-06-21 | Improper Authentication vulnerability in Apache Software Foundation Apache Accumulo. This issue affects Apache Accumulo: 2.1.0. Accumulo 2.1.0 contains a defe… |
CVE-2023-3339 | Medium | 6.3 | 2023-06-21 | A vulnerability has been found in code-projects Agro-School Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown func… |
CVE-2023-34563 | Critical | 9.8 | 2023-06-20 | netgear R6250 Firmware Version 1.0.4.48 is vulnerable to Buffer Overflow after authentication. |
CVE-2023-3220 | Medium | 5.5 | 2023-06-20 | An issue was discovered in the Linux kernel through 6.1-rc8. dpu_crtc_atomic_check in drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c lacks check of the return value… |
CVE-2023-35885 | Critical | 9.8 | 2023-06-20 | CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication. |
CVE-2023-35166 | Critical | 9.9 | 2023-06-20 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute any wiki content with the rig… |
CVE-2023-33869 | Medium | 6.3 | 2023-06-20 | Enphase Envoy versions D7.0.88 is vulnerable to a command injection exploit that may allow an attacker to execute root commands. |
CVE-2023-32274 | High | 8.6 | 2023-06-20 | Enphase Installer Toolkit versions 3.27.0 has hard coded credentials embedded in binary code in the Android application. An attacker can exploit this and… |
CVE-2023-2400 | Low | 2.7 | 2023-06-20 | Improper deletion of resource in the user management feature in Devolutions Server 2023.1.8 and earlier allows an administrator to view users vaults of delete… |
CVE-2023-3340 | Medium | 6.3 | 2023-06-20 | A vulnerability was found in SourceCodester Online School Fees System 1.0 and classified as critical. Affected by this issue is some unknown functionality of t… |
CVE-2023-34600 | Critical | 9.8 | 2023-06-20 | Adiscon LogAnalyzer v4.1.13 and before is vulnerable to SQL Injection. |
CVE-2023-34541 | Critical | 9.8 | 2023-06-20 | Langchain 0.0.171 is vulnerable to Arbitrary code execution in load_prompt. |
CVE-2023-2533 | High | 8.4 | 2023-06-20 | A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF, which, under specific conditions, could potentially enable an attacker… |
CVE-2023-35095 | Medium | 5.9 | 2023-06-20 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Flothemes Flo Forms – Easy Drag & Drop Form Builder plugin <= 1.0.40 versions. |
CVE-2023-34597 | Medium | 6.5 | 2023-06-20 | A vulnerability in Fibaro Motion Sensor firmware v3.4 allows attackers to cause a Denial of Service (DoS) via a crafted Z-Wave message. |
CVE-2023-34596 | Medium | 6.5 | 2023-06-20 | A vulnerability in Aeotec WallMote Switch firmware v2.3 allows attackers to cause a Denial of Service (DoS) via a crafted Z-Wave message. |
CVE-2023-33495 | Medium | 6.1 | 2023-06-20 | Craft CMS through 4.4.9 is vulnerable to HTML Injection. |
CVE-2023-3337 | High | 7.3 | 2023-06-20 | A vulnerability was found in PuneethReddyHC Online Shopping System Advanced 1.0. It has been declared as critical. Affected by this vulnerability is an unknown… |
CVE-2023-35854 | Critical | 9.8 | 2023-06-20 | Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity… |
CVE-2023-1999 | Medium | 5.3 | 2023-06-20 | There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best… |
CVE-2023-35098 | High | 7.1 | 2023-06-20 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in John Brien WordPress NextGen GalleryView plugin <= 0.5.5 versions. |
CVE-2023-35097 | High | 7.1 | 2023-06-20 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Internet Marketing Dojo WP Affiliate Links plugin <= 0.1.1 versions. |
CVE-2023-1862 | High | 7.3 | 2023-06-20 | Cloudflare WARP client for Windows (up to v2023.3.381.0) allowed a malicious actor to remotely access the warp-svc.exe binary due to an insufficient access con… |
CVE-2023-35882 | Medium | 6.5 | 2023-06-20 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Team Heateor Super Socializer plugin <= 7.13.52 versions. |
CVE-2023-35878 | Medium | 5.9 | 2023-06-20 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Vadym K. Extra User Details plugin <= 0.5 versions. |
CVE-2023-26436 | High | 7.1 | 2023-06-20 | Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during deserialization. Acce… |
CVE-2023-26435 | Medium | 5.0 | 2023-06-20 | It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT documents. Attackers could discover restri… |
CVE-2023-26434 | Medium | 4.3 | 2023-06-20 | When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue POP3 serv… |
CVE-2023-26433 | Medium | 4.3 | 2023-06-20 | When adding an external mail account, processing of IMAP "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue IMAP serv… |
CVE-2023-26432 | Medium | 4.3 | 2023-06-20 | When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue SMTP serv… |
CVE-2023-26431 | Medium | 5.0 | 2023-06-20 | IPv4-mapped IPv6 addresses did not get recognized as "local" by the code and a connection attempt is made. Attackers with access to user accounts could use thi… |
CVE-2023-26429 | Low | 3.5 | 2023-06-20 | Control characters were not removed when exporting user feedback content. This allowed attackers to include unexpected content via user feedback and potentiall… |
CVE-2023-26428 | Medium | 6.5 | 2023-06-20 | Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same context. Signatures of other users could b… |
CVE-2023-26427 | Low | 3.2 | 2023-06-20 | Default permissions for a properties file were too permissive. Local system users could read potentially sensitive information. We updated the default permissi… |
CVE-2023-35884 | High | 7.1 | 2023-06-20 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in EventPrime plugin <= 3.0.5 versions. |
CVE-2023-3325 | High | 8.1 | 2023-06-20 | The CMS Commander plugin for WordPress is vulnerable to authorization bypass due to the use of an insufficiently unique cryptographic signature on the 'cmsc_ad… |
CVE-2023-3320 | Medium | 6.1 | 2023-06-20 | The WP Sticky Social plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This is due to missing nonce va… |
CVE-2023-3315 | Medium | 4.3 | 2023-06-19 | Missing permission checks in Jenkins Team Concert Plugin 2.4.1 and earlier allow attackers with Overall/Read permission to check for the existence of an attack… |
CVE-2023-32659 | Medium | 6.5 | 2023-06-19 | SUBNET PowerSYSTEM Center versions 2020 U10 and prior contain a cross-site scripting vulnerability that may allow an attacker to inject malicious code into re… |
CVE-2023-29158 | Medium | 6.1 | 2023-06-19 | SUBNET PowerSYSTEM Center versions 2020 U10 and prior are vulnerable to replay attacks which may result in a denial-of-service condition or a loss of data i… |
CVE-2023-3312 | High | 7.5 | 2023-06-19 | A vulnerability was found in drivers/cpufreq/qcom-cpufreq-hw.c in cpufreq subsystem in the Linux Kernel. This flaw, during device unbind will lead to double re… |
CVE-2023-3022 | Medium | 5.5 | 2023-06-19 | A flaw was found in the IPv6 module of the Linux kernel. The arg.result was not used consistently in fib6_rule_lookup, sometimes holding rt6_info and other tim… |
CVE-2023-35843 | High | 7.5 | 2023-06-19 | NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on the server by manip… |
CVE-2023-34461 | Medium | 4.6 | 2023-06-19 | PyBB is an open source bulletin board. A manual code review of the PyBB bulletin board server has revealed that a vulnerability could have been exploited in wh… |
CVE-2023-34167 | Medium | 5.3 | 2023-06-19 | Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-party apps to hide app icons on the deskto… |
CVE-2023-34166 | High | 7.5 | 2023-06-19 | Vulnerability of system restart triggered by abnormal callbacks passed to APIs.Successful exploitation of this vulnerability may cause the system to restart. |
CVE-2023-34163 | High | 7.5 | 2023-06-19 | Permission control vulnerability in the window management module.Successful exploitation of this vulnerability may cause features to perform abnormally. |
CVE-2023-34162 | High | 7.5 | 2023-06-19 | Version update determination vulnerability in the user profile module.Successful exploitation of this vulnerability may cause repeated HMS Core updates and cau… |
CVE-2023-34161 | High | 7.5 | 2023-06-19 | nappropriate authorization vulnerability in the SettingsProvider module.Successful exploitation of this vulnerability may cause features to perform abnormally. |
CVE-2023-34160 | Medium | 5.3 | 2023-06-19 | Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-party apps to hide app icons on the deskto… |
CVE-2023-34159 | Critical | 9.8 | 2023-06-19 | Improper permission control vulnerability in the Notepad app.Successful exploitation of the vulnerability may lead to privilege escalation, which affects avail… |
CVE-2023-34158 | Medium | 5.3 | 2023-06-19 | Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-party apps to hide app icons on the deskto… |
CVE-2023-34156 | Medium | 5.3 | 2023-06-19 | Vulnerability of services denied by early fingerprint APIs on HarmonyOS products.Successful exploitation of this vulnerability may cause services to be denied. |
CVE-2023-34155 | High | 7.5 | 2023-06-19 | Vulnerability of unauthorized calling on HUAWEI phones and tablets.Successful exploitation of this vulnerability may affect availability. |
CVE-2023-31411 | Critical | 9.8 | 2023-06-19 | A remote unprivileged attacker can modify and access configuration settings on the EventCam App due to the absence of API authentication. The lack of authentic… |
CVE-2023-31410 | Critical | 9.8 | 2023-06-19 | A remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to the absence of Transport Layer Security (TLS) in the SICK Eve… |
CVE-2023-35779 | Medium | 5.9 | 2023-06-19 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Seed Webs Seed Fonts plugin <= 2.3.1 versions. |
CVE-2023-35776 | Medium | 6.5 | 2023-06-19 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Beplus Sermon'e – Sermons Online plugin <= 1.0.0 versions. |
CVE-2023-35775 | High | 7.1 | 2023-06-19 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Backup Solutions WP Backup Manager plugin <= 1.13.1 versions. |
CVE-2023-35772 | High | 7.1 | 2023-06-19 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Alain Gonzalez Google Map Shortcode plugin <= 3.1.2 versions. |
CVE-2023-3318 | Low | 3.5 | 2023-06-19 | A vulnerability was found in SourceCodester Resort Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown fun… |
CVE-2023-34373 | Medium | 5.4 | 2023-06-19 | Cross-Site Request Forgery (CSRF) vulnerability in Dylan James Zephyr Project Manager plugin <= 3.3.93 versions. |
CVE-2023-33213 | Medium | 5.9 | 2023-06-19 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gVectors Display Custom Fields – wpView plugin <= 1.3.0 versions. |
CVE-2023-2907 | Critical | 9.8 | 2023-06-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Marksoft allows SQL Injection. This issue affects Markso… |
CVE-2023-3316 | Medium | 5.9 | 2023-06-19 | A NULL pointer dereference in TIFFClose() is caused by a failure to open an output file (non-existent path or a path that requires permissions like /dev/null)… |
CVE-2023-27992 | Critical | 9.8 | 2023-06-19 | The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21… |
CVE-2023-34417 | Critical | 9.8 | 2023-06-19 | Memory safety bugs present in Firefox 113. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could h… |
CVE-2023-34416 | Critical | 9.8 | 2023-06-19 | Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume t… |