2023 CVEs (page 223)
Page 223 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-27465 | Medium | 4.6 | 2023-06-13 | A vulnerability has been identified in SIMOTION C240 (All versions >= V5.4 < V5.5 SP1), SIMOTION C240 PN (All versions >= V5.4 < V5.5 SP1), SIMOTION D410-2 DP… |
CVE-2023-26210 | High | 7.8 | 2023-06-13 | Multiple improper neutralization of special elements used in an os command ('OS Command Injection') vulnerabilties [CWE-78] vulnerability in Fortinet allows a… |
CVE-2023-26207 | Low | 3.3 | 2023-06-13 | An insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4 and FortiProxy 7.0.0 through 7.0.10. 7.2.0 through 7… |
CVE-2023-26204 | Low | 3.7 | 2023-06-13 | A plaintext storage of a password vulnerability [CWE-256] in FortiSIEM 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions, 6.3 all versions… |
CVE-2023-25910 | Critical | 10.0 | 2023-06-13 | A vulnerability has been identified in SIMATIC PCS 7 (All versions < V9.1 SP2 UC04), SIMATIC S7-PM (All versions < V5.7 SP1 HF1), SIMATIC S7-PM (All versions <… |
CVE-2023-25609 | Medium | 4.3 | 2023-06-13 | A server-side request forgery (SSRF) vulnerability [CWE-918] in FortiManager and FortiAnalyzer GUI 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.8 through 6.4… |
CVE-2023-22639 | Medium | 6.7 | 2023-06-13 | A out-of-bounds write in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.10, FortiOS version 6.4.0 through 6.4.12, FortiOS all… |
CVE-2023-22633 | High | 7.5 | 2023-06-13 | An improper permissions, privileges, and access controls vulnerability [CWE-264] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and belo… |
CVE-2023-2729 | Medium | 5.9 | 2023-06-13 | Use of insufficiently random values vulnerability in User Management Functionality in Synology DiskStation Manager (DSM) before 7.2-64561 allows remote attacke… |
CVE-2023-2673 | Medium | 5.3 | 2023-06-13 | Improper Input Validation vulnerability in PHOENIX CONTACT FL/TC MGUARD Family in multiple versions may allow UDP packets to bypass the filter rules and access… |
CVE-2023-0142 | Medium | 6.5 | 2023-06-13 | Uncontrolled search path element vulnerability in Backup Management functionality in Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.0.1-42218-7 and… |
CVE-2023-2876 | Low | 3.1 | 2023-06-13 | Sensitive Cookie Without 'HttpOnly' Flag vulnerability in ABB REX640 PCL1 (firmware modules), ABB REX640 PCL2 (Firmware modules), ABB REX640 PCL3 (firmware mod… |
CVE-2023-33991 | High | 8.2 | 2023-06-13 | SAP UI5 Variant Management - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, UI_700 200, does not sufficiently encode user-controlled inpu… |
CVE-2023-33986 | Medium | 6.1 | 2023-06-13 | SAP CRM ABAP (Grantor Management) - versions 700, 701, 702, 712, 713, 714, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripti… |
CVE-2023-33985 | Medium | 6.1 | 2023-06-13 | SAP NetWeaver Enterprise Portal - version 7.50, does not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripti… |
CVE-2023-33984 | Medium | 6.4 | 2023-06-13 | SAP NetWeaver (Design Time Repository) - version 7.50, returns an unfavorable content type for some versioned files, which could allow an authorized attacker t… |
CVE-2023-32115 | Medium | 4.2 | 2023-06-13 | An attacker can exploit MDS COMPARE TOOL and use specially crafted inputs to read and modify database commands, resulting in the retrieval of additional inform… |
CVE-2023-32114 | Low | 2.7 | 2023-06-13 | SAP NetWeaver (Change and Transport System) - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an authenticated user with admin privilege… |
CVE-2023-2827 | High | 7.9 | 2023-06-13 | SAP Plant Connectivity - version 15.5 (PCo) or the Production Connector for SAP Digital Manufacturing - version 1.0, do not validate the signature of the JSON… |
CVE-2023-2563 | Medium | 4.3 | 2023-06-13 | The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.7. This is due to… |
CVE-2023-2351 | Medium | 6.5 | 2023-06-13 | The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'ajax_ad… |
CVE-2023-2278 | Critical | 9.8 | 2023-06-13 | The WP Directory Kit plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.1.9 via the 'wdk_public_action' function. T… |
CVE-2023-2277 | Medium | 6.1 | 2023-06-13 | The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.9. This is due to missing or incorr… |
CVE-2023-32674 | Critical | 9.8 | 2023-06-12 | Certain versions of HP PC Hardware Diagnostics Windows are potentially vulnerable to buffer overflow. |
CVE-2023-32673 | Critical | 9.8 | 2023-06-12 | Certain versions of HP PC Hardware Diagnostics Windows, HP Image Assistant, and HP Thunderbolt Dock G2 Firmware are potentially vulnerable to elevation of priv… |
CVE-2023-26298 | High | 8.8 | 2023-06-12 | Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges. |
CVE-2023-26297 | High | 8.8 | 2023-06-12 | Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges. |
CVE-2023-26296 | High | 8.8 | 2023-06-12 | Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges. |
CVE-2023-26295 | Critical | 9.8 | 2023-06-12 | Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges. |
CVE-2023-26294 | High | 7.8 | 2023-06-12 | Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges. |
CVE-2023-3159 | Medium | 6.7 | 2023-06-12 | A use after free issue was discovered in driver/firewire in outbound_phy_packet_callback in the Linux Kernel. In this flaw a local attacker with special privil… |
CVE-2023-32221 | High | 8.8 | 2023-06-12 | EaseUS Todo Backup version 20220111.390 - An omission during installation may allow a local attacker to perform privilege escalation. |
CVE-2023-32220 | High | 8.2 | 2023-06-12 | Milesight NCR/camera version 71.8.0.6-r5 allows authentication bypass through an unspecified method. |
CVE-2023-32219 | Medium | 6.5 | 2023-06-12 | A Mazda model (2015-2016) can be unlocked via an unspecified method. |
CVE-2023-27716 | Critical | 9.8 | 2023-06-12 | An issue was discovered in freakchicken kafkaUI-lite 1.2.11 allows attackers on the same network to gain escalated privileges for the nodes running on it. |
CVE-2023-3161 | Medium | 5.5 | 2023-06-12 | A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and font->height greater than 32 to fbcon_set_font, since t… |
CVE-2023-34942 | High | 7.5 | 2023-06-12 | Asus RT-N10LX Router v2.0.0.39 was discovered to contain a stack overflow via the mac parameter at /start-apply.html. NOTE: This vulnerability only affects pro… |
CVE-2023-34941 | Medium | 5.4 | 2023-06-12 | A stored cross-site scripting (XSS) vulnerability in the urlFilterList function of Asus RT-N10LX Router v2.0.0.39 allows attackers to execute arbitrary web scr… |
CVE-2023-34940 | High | 7.5 | 2023-06-12 | Asus RT-N10LX Router v2.0.0.39 was discovered to contain a stack overflow via the url parameter at /start-apply.html. NOTE: This vulnerability only affects pro… |
CVE-2023-33626 | Critical | 9.8 | 2023-06-12 | D-Link DIR-600 Hardware Version B5, Firmware Version 2.18 was discovered to contain a stack overflow via the gena.cgi binary. |
CVE-2023-33625 | Critical | 9.8 | 2023-06-12 | D-Link DIR-600 Hardware Version B5, Firmware Version 2.18 was discovered to contain a command injection vulnerability via the ST parameter in the lxmldbc_syste… |
CVE-2023-28478 | High | 8.8 | 2023-06-12 | TP-Link EC-70 devices through 2.3.4 Build 20220902 rel.69498 have a Buffer Overflow. |
CVE-2023-1899 | Critical | 9.4 | 2023-06-12 | Atlas Copco Power Focus 6000 web server is not a secure connection by default, which could allow an attacker to gain sensitive information by monitoring networ… |
CVE-2023-1898 | Critical | 9.4 | 2023-06-12 | Atlas Copco Power Focus 6000 web server uses a small amount of session ID numbers. An attacker could enter a session ID number to retrieve data for an active u… |
CVE-2023-1897 | Critical | 9.4 | 2023-06-12 | Atlas Copco Power Focus 6000 web server does not sanitize the login information stored by the authenticated user’s browser, which could allow an attacker with… |
CVE-2023-34343 | High | 7.2 | 2023-06-12 | AMI BMC contains a vulnerability in the SPX REST API, where an attacker with the required privileges can inject arbitrary shell commands, which may lead to cod… |
CVE-2023-34342 | Medium | 6.0 | 2023-06-12 | AMI BMC contains a vulnerability in the IPMI handler, where an attacker can upload and download arbitrary files under certain circumstances, which may lead to… |
CVE-2023-34336 | High | 8.1 | 2023-06-12 | AMI BMC contains a vulnerability in the IPMI handler, where an attacker with the required privileges can cause a buffer overflow, which may lead to code execut… |
CVE-2023-34335 | High | 7.7 | 2023-06-12 | AMI BMC contains a vulnerability in the IPMI handler, where an unauthenticated host is allowed to write to a host SPI flash, bypassing secure boot protections… |
CVE-2023-34334 | High | 7.2 | 2023-06-12 | AMI BMC contains a vulnerability in the SPX REST API, where an attacker with the required privileges can inject arbitrary shell commands, which may lead to cod… |
CVE-2023-2718 | Medium | 5.4 | 2023-06-12 | The Contact Form Email WordPress plugin before 1.3.38 does not escape submitted values before displaying them in the HTML, leading to a Stored XSS vulnerabilit… |
CVE-2023-2568 | Medium | 6.1 | 2023-06-12 | The Photo Gallery by Ays WordPress plugin before 5.1.7 does not escape some parameters before outputting it back in attributes, leading to Reflected Cross-Site… |
CVE-2023-2398 | Medium | 6.1 | 2023-06-12 | The Icegram Engage WordPress plugin before 3.1.12 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scri… |
CVE-2023-2362 | Medium | 6.1 | 2023-06-12 | The Float menu WordPress plugin before 5.0.2, Bubble Menu WordPress plugin before 3.0.4, Button Generator WordPress plugin before 2.3.5, Calculator Builder Wor… |
CVE-2023-1323 | Medium | 4.8 | 2023-06-12 | The Easy Forms for Mailchimp WordPress plugin before 6.8.9 does not sanitise and escape some of its from parameters, which could allow high privilege users suc… |
CVE-2023-0431 | Medium | 5.4 | 2023-06-12 | The File Away WordPress plugin through 3.9.9.0.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as co… |
CVE-2023-34345 | Medium | 6.5 | 2023-06-12 | AMI BMC contains a vulnerability in the SPX REST API, where an attacker with the required privileges can access arbitrary files, which may lead to information… |
CVE-2023-34344 | Medium | 5.3 | 2023-06-12 | AMI BMC contains a vulnerability in the IPMI handler, where an unauthorized attacker can use certain oracles to guess a valid username, which may lead to infor… |
CVE-2023-34341 | High | 7.2 | 2023-06-12 | AMI BMC contains a vulnerability in the SPX REST API, where an attacker with the required privileges can read and write to arbitrary locations within the memor… |
CVE-2023-34246 | Medium | 4.2 | 2023-06-12 | Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user con… |
CVE-2023-34105 | High | 7.5 | 2023-06-12 | SRS is a real-time video server supporting RTMP, WebRTC, HLS, HTTP-FLV, SRT, MPEG-DASH, and GB28181. Prior to versions 5.0.157, 5.0-b1, and 6.0.48, SRS's `api-… |
CVE-2023-30198 | High | 7.5 | 2023-06-12 | Prestashop winbizpayment <= 1.0.2 is vulnerable to Incorrect Access Control via modules/winbizpayment/downloads/download.php. |
CVE-2023-35054 | Medium | 4.6 | 2023-06-12 | In JetBrains YouTrack before 2023.1.10518 stored XSS in a Markdown-rendering engine was possible |
CVE-2023-35053 | High | 7.5 | 2023-06-12 | In JetBrains YouTrack before 2023.1.10518 a DoS attack was possible via Helpdesk forms |
CVE-2023-34468 | High | 8.8 | 2023-06-12 | The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configu… |
CVE-2023-34212 | Medium | 6.5 | 2023-06-12 | The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an auth… |
CVE-2023-34026 | High | 7.1 | 2023-06-12 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in BrokenCrust This Day In History plugin <= 3.10.1 versions. |
CVE-2023-29385 | High | 7.1 | 2023-06-12 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Kevon Adonis WP Abstracts plugin <= 2.6.2 versions. |
CVE-2023-28933 | Medium | 5.9 | 2023-06-12 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in StPeteDesign Call Now Accessibility Button plugin <= 1.1 versions. |
CVE-2023-3208 | Medium | 6.3 | 2023-06-12 | A vulnerability, which was classified as critical, has been found in RoadFlow Visual Process Engine .NET Core Mvc 2.13.3. Affected by this issue is some unknow… |
CVE-2023-3206 | Medium | 5.3 | 2023-06-12 | A vulnerability classified as problematic was found in Chengdu VEC40G 3.0. Affected by this vulnerability is an unknown functionality of the file /send_order.c… |
CVE-2023-35042 | Critical | 9.8 | 2023-06-12 | GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via java.lang.Runtime.getRuntime().exec in wps:LiteralData within a wps… |
CVE-2023-34581 | Critical | 9.8 | 2023-06-12 | Sourcecodester Service Provider Management System v1.0 is vulnerable to SQL Injection via the ID parameter in /php-spms/?page=services/view&id=2 |
CVE-2023-32961 | High | 7.1 | 2023-06-12 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Katie Seaborn Zotpress plugin <= 7.3.3 versions. |
CVE-2023-32118 | High | 7.1 | 2023-06-12 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPoperation SALERT – Fake Sales Notification WooCommerce plugin <= 1.2.1 versions. |
CVE-2023-31236 | Medium | 5.9 | 2023-06-12 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in unFocus Projects Scripts n Styles plugin <= 3.5.7 versions. |
CVE-2023-34494 | High | 7.5 | 2023-06-12 | NanoMQ 0.16.5 is vulnerable to heap-use-after-free in the nano_ctx_send function of nmq_mqtt.c. |
CVE-2023-34488 | High | 7.8 | 2023-06-12 | NanoMQ 0.17.5 has a one-byte heap-based buffer over-read in the conn_handler function of mqtt_parser.c when it processes malformed messages. |
CVE-2023-30753 | High | 7.1 | 2023-06-12 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Phan Chuong IP Metaboxes plugin <= 2.1.1. |
CVE-2023-30745 | Medium | 5.9 | 2023-06-12 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Phan Chuong IP Metaboxes plugin <= 2.1.1 versions. |
CVE-2023-23822 | Medium | 5.9 | 2023-06-12 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ludwig Media UTM Tracker plugin <= 1.3.1 versions. |
CVE-2023-23819 | Medium | 5.9 | 2023-06-12 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Rolands Umbrovskis itemprop WP for SERP/SEO Rich snippets plugin <= 3.5.201706131 versions. |
CVE-2023-34855 | Medium | 4.8 | 2023-06-12 | A Cross Site Scripting (XSS) vulnerability in Youxun Electronic Equipment (Shanghai) Co., Ltd AC Centralized Management Platform v1.02.040 allows attackers to… |
CVE-2023-33492 | Medium | 5.4 | 2023-06-12 | EyouCMS 1.6.2 is vulnerable to Cross Site Scripting (XSS). |
CVE-2023-33290 | High | 7.5 | 2023-06-12 | The git-url-parse crate through 0.4.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to normalize_url in lib.rs, a similar issu… |
CVE-2023-33253 | High | 8.8 | 2023-06-12 | LabCollector 6.0 though 6.15 allows remote code execution. An authenticated remote low-privileged user can upload an executable PHP file and execute system com… |
CVE-2023-23818 | Medium | 5.9 | 2023-06-12 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Aviplugins.Com WP Register Profile With Shortcode plugin <= 3.5.7 versions. |
CVE-2023-26133 | High | 8.2 | 2023-06-12 | All versions of the package progressbar.js are vulnerable to Prototype Pollution via the function extend() in the file utils.js. |
CVE-2023-35036 | Critical | 9.1 | 2023-06-12 | In Progress MOVEit Transfer before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022.1.6 (14.1.6), and 2023.0.2 (15.0.2), SQL injection vulnerabili… |
CVE-2023-35035 | High | 8.8 | 2023-06-12 | Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8, Assistant V10 R0, Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8, and Manager… |
CVE-2023-35034 | Critical | 9.8 | 2023-06-12 | Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8 and Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8 allow remote code execution… |
CVE-2023-35033 | High | 8.8 | 2023-06-12 | Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8, Assistant V10 R0, Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8, and Manager… |
CVE-2023-35032 | High | 8.8 | 2023-06-12 | Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8 and Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8 allow command injection by… |
CVE-2023-35031 | High | 8.8 | 2023-06-12 | Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8, Assistant V10 R0, Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8, and Manager… |
CVE-2023-25912 | Medium | 5.3 | 2023-06-11 | The webreport generation feature in the Danfoss AK-EM100 allows an unauthorized actor to generate a web report that discloses sensitive information such as the… |
CVE-2023-25911 | Critical | 9.9 | 2023-06-11 | The Danfoss AK-EM100 web applications allow for an authenticated user to perform OS command injection through the web application parameters. |
CVE-2023-22586 | High | 7.7 | 2023-06-11 | The Danfoss AK-EM100 web applications allow for Local File Inclusion in the file parameter. |
CVE-2023-22585 | Critical | 9.0 | 2023-06-11 | The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting in the title parameter. |
CVE-2023-22584 | High | 7.5 | 2023-06-11 | The Danfoss AK-EM100 stores login credentials in cleartext. |
CVE-2023-22583 | Critical | 10.0 | 2023-06-11 | The Danfoss AK-EM100 web forms allow for SQL injection in the login forms. |