2023 CVEs (page 224)
Page 224 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-22582 | Critical | 9.0 | 2023-06-11 | The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting. |
CVE-2023-3192 | Medium | 5.4 | 2023-06-11 | Session Fixation in GitHub repository froxlor/froxlor prior to 2.1.0. |
CVE-2023-3191 | Medium | 5.4 | 2023-06-10 | Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9. |
CVE-2023-3190 | Medium | 4.6 | 2023-06-10 | Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.9. |
CVE-2023-26132 | High | 7.5 | 2023-06-10 | Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable i… |
CVE-2023-3188 | Medium | 6.5 | 2023-06-10 | Server-Side Request Forgery (SSRF) in GitHub repository owncast/owncast prior to 0.1.0. |
CVE-2023-3187 | Medium | 6.3 | 2023-06-09 | A vulnerability, which was classified as critical, has been found in PHPGurukul Teachers Record Management System 1.0. Affected by this issue is some unknown f… |
CVE-2023-29753 | Medium | 5.5 | 2023-06-09 | An issue found in Facemoji Emoji Keyboard v.2.9.1.2 for Android allows a local attacker to cause a denial of service via the SharedPreference files. |
CVE-2023-29751 | Medium | 5.5 | 2023-06-09 | An issue found in Yandex Navigator v.6.60 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SharedPreference fil… |
CVE-2023-26465 | Medium | 6.1 | 2023-06-09 | Pega Platform versions 7.2 to 8.8.1 are affected by an XSS issue. |
CVE-2023-3141 | High | 7.1 | 2023-06-09 | A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. This flaw allows a local attacker to crash… |
CVE-2023-34856 | Medium | 5.4 | 2023-06-09 | A Cross Site Scripting (XSS) vulnerability in D-Link DI-7500G-CI-19.05.29A allows attackers to execute arbitrary code via uploading a crafted HTML file to the… |
CVE-2023-32312 | Low | 3.7 | 2023-06-09 | UmbracoIdentityExtensions is an Umbraco add-on package that enables easy extensibility points for ASP.Net Identity integration. In affected versions client sec… |
CVE-2023-29767 | Medium | 5.5 | 2023-06-09 | An issue found in CrossX v.1.15.3 for Android allows a local attacker to cause a persistent denial of service via the database files. |
CVE-2023-29766 | High | 7.8 | 2023-06-09 | An issue found in CrossX v.1.15.3 for Android allows a local attacker to cause an escalation of Privileges via the database files. |
CVE-2023-29761 | Medium | 5.5 | 2023-06-09 | An issue found in Sleep v.20230303 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SharedPreference files. |
CVE-2023-29759 | Medium | 5.5 | 2023-06-09 | An issue found in FlightAware v.5.8.0 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the database files. |
CVE-2023-29758 | Medium | 5.5 | 2023-06-09 | An issue found in Blue Light Filter v.1.5.5 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SharedPreference f… |
CVE-2023-29757 | High | 7.8 | 2023-06-09 | An issue found in Blue Light Filter v.1.5.5 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the SharedPreference… |
CVE-2023-29756 | Medium | 5.5 | 2023-06-09 | An issue found in Twilight v.13.3 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SharedPreference files. |
CVE-2023-29755 | High | 7.8 | 2023-06-09 | An issue found in Twilight v.13.3 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the SharedPreference files. |
CVE-2023-29752 | High | 7.8 | 2023-06-09 | An issue found in Facemoji Emoji Keyboard v.2.9.1.2 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the component. |
CVE-2023-29749 | High | 7.8 | 2023-06-09 | An issue found in Yandex Navigator v.6.60 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the SharedPreference fi… |
CVE-2023-2455 | Medium | 5.4 | 2023-06-09 | Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific p… |
CVE-2023-2454 | High | 7.2 | 2023-06-09 | schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated dat… |
CVE-2023-29714 | Medium | 6.1 | 2023-06-09 | Cross Site Scripting vulnerability found in Vade Secure Gateway allows a remote attacker to execute arbitrary code via the username, password, and language coo… |
CVE-2023-29713 | Medium | 6.1 | 2023-06-09 | Cross Site Scripting vulnerability found in Vade Secure Gateway allows a remote attacker to execute arbitrary code via a crafted payload to the GET request aft… |
CVE-2023-27706 | High | 7.1 | 2023-06-09 | Bitwarden Windows desktop application versions prior to v2023.4.0 store biometric keys in Windows Credential Manager, accessible to other local unprivileged pr… |
CVE-2023-34245 | High | 8.1 | 2023-06-09 | @udecode/plate-link is the link handler for the udecode/plate rich-text editor plugin system for Slate & React. Affected versions of the link plugin and link U… |
CVE-2023-34100 | High | 7.3 | 2023-06-09 | Contiki-NG is an open-source, cross-platform operating system for IoT devices. When reading the TCP MSS option value from an incoming packet, the Contiki-NG OS… |
CVE-2023-33557 | High | 8.8 | 2023-06-09 | Fuel CMS v1.5.2 was discovered to contain a SQL injection vulnerability via the id parameter at /controllers/Blocks.php. |
CVE-2023-30262 | High | 8.8 | 2023-06-09 | An issue found in MIM software Inc MIM License Server and MIMpacs services v.6.9 thru v.7.0 fixed in v.7.0.10 allows a remote unauthenticated attacker to execu… |
CVE-2023-29712 | Medium | 6.1 | 2023-06-09 | Cross Site Scripting vulnerability found in Vade Secure Gateway allows a remote attacker to execute arbitrary code via a crafted payload to the X-Rewrite-URL p… |
CVE-2023-2121 | Medium | 4.3 | 2023-06-09 | Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-… |
CVE-2023-3184 | Low | 2.4 | 2023-06-09 | A vulnerability was found in SourceCodester Sales Tracker Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown funct… |
CVE-2023-3183 | Low | 3.5 | 2023-06-09 | A vulnerability was found in SourceCodester Performance Indicator System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown… |
CVE-2023-2286 | Medium | 4.3 | 2023-06-09 | The WP Activity Log for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. This is due to missing or incorrect nonc… |
CVE-2023-2285 | Medium | 4.3 | 2023-06-09 | The WP Activity Log Premium plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. This is due to missing or… |
CVE-2023-2284 | Medium | 4.3 | 2023-06-09 | The WP Activity Log Premium plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_switch_db fun… |
CVE-2023-2261 | Medium | 4.3 | 2023-06-09 | The WP Activity Log plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the handle_ajax_call function in versions u… |
CVE-2023-32732 | Medium | 5.3 | 2023-06-09 | gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for `-bin… |
CVE-2023-32731 | High | 7.4 | 2023-06-09 | When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be ski… |
CVE-2023-1428 | High | 7.5 | 2023-06-09 | There exists an vulnerability causing an abort() to be called in gRPC. The following headers cause gRPC's C++ implementation to abort() when called via http2… |
CVE-2023-0342 | Low | 3.1 | 2023-06-09 | MongoDB Ops Manager Diagnostics Archive may not redact sensitive PEM key file password app settings. Archives do not include the PEM files themselves. This iss… |
CVE-2023-34364 | Critical | 9.8 | 2023-06-09 | A buffer overflow was discovered in Progress DataDirect Connect for ODBC before 08.02.2770 for Oracle. An overly large value for certain options of a connectio… |
CVE-2023-34363 | Medium | 5.9 | 2023-06-09 | An issue was discovered in Progress DataDirect Connect for ODBC before 08.02.2770 for Oracle. When using Oracle Advanced Security (OAS) encryption, if an error… |
CVE-2023-2897 | Low | 3.7 | 2023-06-09 | The Brizy Page Builder plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.4.18. This is due to an implicit trust of… |
CVE-2023-2896 | Medium | 4.3 | 2023-06-09 | The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect n… |
CVE-2023-2895 | Medium | 4.3 | 2023-06-09 | The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect n… |
CVE-2023-2894 | Medium | 4.3 | 2023-06-09 | The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect n… |
CVE-2023-2893 | Medium | 4.3 | 2023-06-09 | The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect n… |
CVE-2023-2892 | Medium | 6.5 | 2023-06-09 | The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect n… |
CVE-2023-3177 | Medium | 6.3 | 2023-06-09 | A vulnerability has been found in SourceCodester Lost and Found Information System 1.0 and classified as critical. Affected by this vulnerability is an unknown… |
CVE-2023-3176 | Medium | 6.3 | 2023-06-09 | A vulnerability, which was classified as critical, was found in SourceCodester Lost and Found Information System 1.0. Affected is an unknown function of the fi… |
CVE-2023-2891 | Medium | 6.5 | 2023-06-09 | The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect n… |
CVE-2023-2767 | Medium | 4.4 | 2023-06-09 | The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Stored Cross-Site Scripting via admin settings in versions up t… |
CVE-2023-2764 | Medium | 4.3 | 2023-06-09 | The Draw Attention plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_set_featured_image fun… |
CVE-2023-2688 | Medium | 4.9 | 2023-06-09 | The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Path Traversal in versions up to, and including, 4.19.1 via the… |
CVE-2023-2607 | High | 7.2 | 2023-06-09 | The Multiple Page Generator Plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in versions up to, and includin… |
CVE-2023-2604 | Medium | 6.1 | 2023-06-09 | The Team Circle Image Slider With Lightbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘search_term’ parameter in versions up… |
CVE-2023-2599 | Low | 3.1 | 2023-06-09 | The Active Directory Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to time-based SQL Injection via the orderby and order… |
CVE-2023-2584 | Medium | 4.4 | 2023-06-09 | The PixelYourSite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 9.3.6 (9.6.1 in the Pr… |
CVE-2023-2558 | Medium | 6.4 | 2023-06-09 | The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcs_current_currency sh… |
CVE-2023-2557 | Medium | 4.3 | 2023-06-09 | The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o… |
CVE-2023-2556 | Medium | 4.3 | 2023-06-09 | The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o… |
CVE-2023-2555 | Medium | 4.3 | 2023-06-09 | The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o… |
CVE-2023-2526 | Medium | 5.4 | 2023-06-09 | The Easy Google Maps plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.11.7. This is due to missing or incor… |
CVE-2023-2484 | High | 7.2 | 2023-06-09 | The Active Directory Integration plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in versions up to, and inc… |
CVE-2023-2452 | Medium | 4.4 | 2023-06-09 | The Advanced Woo Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.77 due to ins… |
CVE-2023-2450 | Medium | 4.4 | 2023-06-09 | The FiboSearch - AJAX Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and includ… |
CVE-2023-2414 | Medium | 5.4 | 2023-06-09 | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi… |
CVE-2023-2402 | Medium | 6.1 | 2023-06-09 | The Photo Gallery Slideshow & Masonry Tiled Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter in versi… |
CVE-2023-2305 | Medium | 6.4 | 2023-06-09 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdm_members', 'wpdm_login_form', 'wpdm_reg_form' shortcodes in… |
CVE-2023-2289 | Medium | 6.1 | 2023-06-09 | The wordpress vertical image slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘search_term’ parameter in versions up to, and… |
CVE-2023-2280 | Medium | 6.5 | 2023-06-09 | The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'ajax_pu… |
CVE-2023-2275 | Medium | 4.3 | 2023-06-09 | The WooCommerce Multivendor Marketplace – REST API plugin for WordPress is vulnerable to unauthorized access of data and addition of data due to a missing capa… |
CVE-2023-2249 | High | 8.8 | 2023-06-09 | The wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Request Forgery, and PHAR Deserialization in versions up to, and includi… |
CVE-2023-2237 | High | 8.8 | 2023-06-09 | The WP Replicate Post plugin for WordPress is vulnerable to SQL Injection via the post_id parameter in versions up to, and including, 4.0.2 due to insufficient… |
CVE-2023-2189 | Medium | 4.3 | 2023-06-09 | The Elementor Addons, Widgets and Enhancements – Stax plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check… |
CVE-2023-2184 | Medium | 6.1 | 2023-06-09 | The WP Responsive Tabs horizontal vertical and accordion Tabs plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term paramete… |
CVE-2023-2159 | Medium | 5.3 | 2023-06-09 | The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Maintenance Mode Bypass in versions up to, and including, 4.1.7. A correct cmp_bypass… |
CVE-2023-2087 | Medium | 4.3 | 2023-06-09 | The Essential Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.0.6. This is due to missing or incorr… |
CVE-2023-2086 | Medium | 4.3 | 2023-06-09 | The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the template_count function i… |
CVE-2023-2085 | Medium | 4.3 | 2023-06-09 | The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the templates function in ver… |
CVE-2023-2084 | Medium | 4.3 | 2023-06-09 | The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the get function in versions… |
CVE-2023-2083 | Medium | 4.3 | 2023-06-09 | The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the save function in versions… |
CVE-2023-2067 | Medium | 6.3 | 2023-06-09 | The Announcement & Notification Banner – Bulletin plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce validation on the 'bu… |
CVE-2023-2066 | Medium | 6.3 | 2023-06-09 | The Announcement & Notification Banner – Bulletin plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capabilit… |
CVE-2023-2031 | Medium | 5.4 | 2023-06-09 | The Locatoraid Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including… |
CVE-2023-1978 | Medium | 6.1 | 2023-06-09 | The ShiftController Employee Shift Scheduling plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the query string in versions up to, and… |
CVE-2023-1917 | Medium | 5.4 | 2023-06-09 | The PowerPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 10.0 due to in… |
CVE-2023-1910 | Medium | 4.3 | 2023-06-09 | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the get_remote… |
CVE-2023-1895 | High | 8.5 | 2023-06-09 | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Server Side Request Forgery via the get_remote_content REST API endpoint in versions up to… |
CVE-2023-1889 | Medium | 6.5 | 2023-06-09 | The Directorist plugin for WordPress is vulnerable to an Insecure Direct Object Reference in versions up to, and including, 7.5.4. This is due to improper vali… |
CVE-2023-1888 | High | 8.8 | 2023-06-09 | The Directorist plugin for WordPress is vulnerable to an arbitrary user password reset in versions up to, and including, 7.5.4. This is due to a lack of valida… |
CVE-2023-1843 | Medium | 6.5 | 2023-06-09 | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to unauthorized permalink structure update due to a missing capability check on t… |
CVE-2023-1807 | Medium | 4.3 | 2023-06-09 | The Elementor Addons, Widgets and Enhancements – Stax plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.3… |
CVE-2023-1615 | High | 8.8 | 2023-06-09 | The Ultimate Addons for Contact Form 7 plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in versions up to, and including, 3.1.23. Thi… |
CVE-2023-1430 | Medium | 6.5 | 2023-06-09 | The FluentCRM - Marketing Automation For WordPress plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 2… |
CVE-2023-1404 | Medium | 6.4 | 2023-06-09 | The Weaver Show Posts Plugin for WordPress is vulnerable to stored Cross-Site Scripting due to insufficient escaping of the profile display name in versions up… |