2023 CVEs (page 225)
Page 225 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-1403 | Medium | 6.4 | 2023-06-09 | The Weaver Xtreme Theme for WordPress is vulnerable to stored Cross-Site Scripting due to insufficient escaping of the profile display name in versions up to… |
CVE-2023-1375 | Medium | 4.3 | 2023-06-09 | The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized cache deletion in versions up to, and including, 1.1.2 due to a missing capability chec… |
CVE-2023-1169 | Medium | 4.3 | 2023-06-09 | The OoohBoi Steroids for Elementor plugin for WordPress is vulnerable to missing authorization due to a missing capability check on the 'file_uploader_callback… |
CVE-2023-1016 | Medium | 6.6 | 2023-06-09 | The Intuitive Custom Post Order plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.1.4.1, due to insufficient escaping on… |
CVE-2023-0993 | Medium | 4.3 | 2023-06-09 | The Shield Security plugin for WordPress is vulnerable to Missing Authorization on the 'theme-plugin-file' AJAX action in versions up to, and including, 17.0.1… |
CVE-2023-0992 | High | 7.2 | 2023-06-09 | The Shield Security plugin for WordPress is vulnerable to stored Cross-Site Scripting in versions up to, and including, 17.0.17 via the 'User-Agent' header. Th… |
CVE-2023-0832 | Medium | 4.3 | 2023-06-09 | The Under Construction plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.96. This is due to missing or incor… |
CVE-2023-0831 | Medium | 4.3 | 2023-06-09 | The Under Construction plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.96. This is due to missing or incor… |
CVE-2023-0729 | Medium | 5.4 | 2023-06-09 | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorr… |
CVE-2023-0721 | High | 8.3 | 2023-06-09 | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to CSV injection in versions up to, and including, 3.3.0. This allows unauthentic… |
CVE-2023-0710 | Medium | 4.9 | 2023-06-09 | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'fname' attribute of the 'mf_thankyou' shortcode to… |
CVE-2023-0709 | Medium | 5.4 | 2023-06-09 | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf_last_name' shortcode to echo unescaped form sub… |
CVE-2023-0708 | Medium | 5.4 | 2023-06-09 | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf_first_name' shortcode to echo unescaped form su… |
CVE-2023-0695 | Medium | 5.4 | 2023-06-09 | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf' shortcode to echo unescaped form submissions i… |
CVE-2023-0694 | Medium | 6.5 | 2023-06-09 | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf' shortcode in versions up to, and including, 3.3.1… |
CVE-2023-0693 | Medium | 6.5 | 2023-06-09 | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_transaction_id' shortcode in versions up to, and i… |
CVE-2023-0692 | Medium | 4.3 | 2023-06-09 | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_payment_status' shortcode in versions up to, and i… |
CVE-2023-0691 | Medium | 4.3 | 2023-06-09 | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_last_name' shortcode in versions up to, and includ… |
CVE-2023-0688 | Medium | 6.5 | 2023-06-09 | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_thankyou' shortcode in versions up to, and includi… |
CVE-2023-0292 | Medium | 5.4 | 2023-06-09 | The Quiz And Survey Master plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.0.8. This is due to missing non… |
CVE-2023-0291 | High | 7.2 | 2023-06-09 | The Quiz And Survey Master for WordPress is vulnerable to authorization bypass due to a missing capability check on the function associated with the qsm_remove… |
CVE-2023-3173 | Critical | 9.8 | 2023-06-09 | Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20. |
CVE-2023-3172 | High | 7.2 | 2023-06-09 | Path Traversal in GitHub repository froxlor/froxlor prior to 2.0.20. |
CVE-2023-34112 | Medium | 4.3 | 2023-06-09 | JavaCPP Presets is a project providing Java distributions of native C++ libraries. All the actions in the `bytedeco/javacpp-presets` use the `github.event.head… |
CVE-2023-34243 | Medium | 5.8 | 2023-06-08 | TGstation is a toolset to manage production BYOND servers. In affected versions if a Windows user was registered in tgstation-server (TGS), an attacker could d… |
CVE-2023-34233 | High | 8.8 | 2023-06-08 | The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations… |
CVE-2023-34232 | High | 7.3 | 2023-06-08 | snowflake-connector-nodejs, a NodeJS driver for Snowflake, is vulnerable to command injection via single sign on (SSO) browser URL authentication in versions p… |
CVE-2023-34230 | High | 7.3 | 2023-06-08 | snowflake-connector-net, the Snowflake Connector for .NET, is vulnerable to command injection prior to version 2.0.18 via SSO URL authentication. In order to e… |
CVE-2023-32751 | Medium | 5.4 | 2023-06-08 | Pydio Cells through 4.1.2 allows XSS. Pydio Cells implements the download of files using presigned URLs which are generated using the Amazon AWS SDK for JavaSc… |
CVE-2023-32750 | Medium | 6.5 | 2023-06-08 | Pydio Cells through 4.1.2 allows SSRF. For longer running processes, Pydio Cells allows for the creation of jobs, which are run in the background. The job "rem… |
CVE-2023-29405 | Critical | 9.8 | 2023-06-08 | The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other c… |
CVE-2023-29404 | Critical | 9.8 | 2023-06-08 | The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other c… |
CVE-2023-29403 | High | 7.8 | 2023-06-08 | On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as… |
CVE-2023-29402 | Critical | 9.8 | 2023-06-08 | The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This… |
CVE-2023-29401 | Medium | 4.3 | 2023-06-08 | The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition heade… |
CVE-2023-24535 | High | 7.5 | 2023-06-08 | Parsing invalid messages can panic. Parsing a text-format message which contains a potential number consisting of a minus sign, one or more characters of white… |
CVE-2023-0954 | High | 8.3 | 2023-06-08 | A debug feature in Sensormatic Electronics Illustra Pro Gen 4 Dome and PTZ cameras allows a user to compromise credentials after a long period of sustained att… |
CVE-2023-34231 | High | 8.8 | 2023-06-08 | gosnowflake is th Snowflake Golang driver. Prior to version 1.6.19, a command injection vulnerability exists in the Snowflake Golang driver via single sign-on… |
CVE-2023-32749 | High | 8.8 | 2023-06-08 | Pydio Cells allows users by default to create so-called external users in order to share files with them. By modifying the HTTP request sent when creating such… |
CVE-2023-34962 | High | 8.1 | 2023-06-08 | Incorrect access control in Chamilo v1.11.x up to v1.11.18 allows a student to arbitrarily access and modify another student's personal notes. |
CVE-2023-34961 | Medium | 6.1 | 2023-06-08 | Chamilo v1.11.x up to v1.11.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the /feedback/comment field. |
CVE-2023-34959 | Medium | 5.3 | 2023-06-08 | An issue in Chamilo v1.11.* up to v1.11.18 allows attackers to execute a Server-Side Request Forgery (SSRF) and obtain information on the services running on t… |
CVE-2023-34958 | Medium | 4.3 | 2023-06-08 | Incorrect access control in Chamilo 1.11.* up to 1.11.18 allows a student subscribed to a given course to download documents belonging to another student if th… |
CVE-2023-34096 | Medium | 6.5 | 2023-06-08 | Thruk is a multibackend monitoring webinterface which currently supports Naemon, Icinga, Shinken and Nagios as backends. In versions 3.06 and prior, the file `… |
CVE-2023-3165 | Low | 3.5 | 2023-06-08 | A vulnerability was found in SourceCodester Life Insurance Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unk… |
CVE-2023-34571 | Medium | 6.7 | 2023-06-08 | Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter shareSpeed at /goform/WifiGuestSet. |
CVE-2023-34570 | Medium | 6.7 | 2023-06-08 | Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter devName at /goform/SetOnlineDevName. |
CVE-2023-34569 | Medium | 6.7 | 2023-06-08 | Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter list at /goform/SetNetControlList. |
CVE-2023-34568 | Medium | 6.7 | 2023-06-08 | Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter time at /goform/PowerSaveSet. |
CVE-2023-34567 | Medium | 6.7 | 2023-06-08 | Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter list at /goform/SetVirtualServerCfg. |
CVE-2023-34566 | Critical | 9.8 | 2023-06-08 | Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter time at /goform/saveParentControlInfo. |
CVE-2023-3163 | Low | 3.5 | 2023-06-08 | A vulnerability was found in y_project RuoYi up to 4.7.7. It has been classified as problematic. Affected is the function filterKeyword. The manipulation of th… |
CVE-2023-33443 | Critical | 9.8 | 2023-06-08 | Incorrect access control in the administrative functionalities of BES--6024PB-I50H1 VideoPlayTool v2.0.1.0 allow attackers to execute arbitrary administrative… |
CVE-2023-33657 | High | 7.5 | 2023-06-08 | A use-after-free vulnerability exists in NanoMQ 0.17.2. The vulnerability can be triggered by calling the function nni_mqtt_msg_get_publish_property() in the f… |
CVE-2023-33660 | High | 7.5 | 2023-06-08 | A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. The vulnerability can be triggered by calling the function copyn_str() in the file mqtt_parser.c… |
CVE-2023-33658 | High | 7.5 | 2023-06-08 | A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. The vulnerability can be triggered by calling the function nni_msg_get_pub_pid() in the file mess… |
CVE-2023-34969 | Medium | 6.5 | 2023-06-08 | D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedeskt… |
CVE-2023-2986 | Critical | 9.8 | 2023-06-08 | The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. This is due to in… |
CVE-2023-23482 | Medium | 5.4 | 2023-06-08 | IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim t… |
CVE-2023-23481 | Medium | 6.4 | 2023-06-08 | IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary Ja… |
CVE-2023-23480 | Medium | 5.4 | 2023-06-08 | IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScrip… |
CVE-2023-33847 | Low | 3.7 | 2023-06-08 | IBM TXSeries for Multiplatforms 8.1, 8.2, 9.1, CICS TX Standard, 11.1, CICS TX Advanced 10.1, and 11.1 does not set the secure attribute on authorization toke… |
CVE-2023-33846 | Medium | 5.4 | 2023-06-08 | IBM TXSeries for Multiplatforms 8.1, 8.2, 9.1, CICS TX Standard, 11.1, CICS TX Advanced 10.1, and 11.1 is vulnerable to cross-site scripting. This vulnerabilit… |
CVE-2023-34239 | High | 7.3 | 2023-06-08 | Gradio is an open-source Python library that is used to build machine learning and data science. Due to a lack of path filtering Gradio does not properly restr… |
CVE-2023-34238 | Medium | 4.3 | 2023-06-08 | Gatsby is a free and open source framework based on React. The Gatsby framework prior to versions 4.25.7 and 5.9.1 contain a Local File Inclusion vulnerability… |
CVE-2023-33849 | Low | 3.7 | 2023-06-07 | IBM TXSeries for Multiplatforms 8.1, 8.2, 9.1, CICS TX Standard, 11.1, CICS TX Advanced 10.1, and 11.1 could transmit sensitive information in query parameters… |
CVE-2023-31200 | Medium | 5.7 | 2023-06-07 | PTC Vuforia Studio does not require a token; this could allow an attacker with local access to perform a cross-site request forgery attack or a replay a… |
CVE-2023-2904 | High | 7.3 | 2023-06-07 | The External Visitor Manager portal of HID’s SAFE versions 5.8.0 through 5.11.3 are vulnerable to manipulation within web fields in the application programmabl… |
CVE-2023-29502 | Medium | 6.2 | 2023-06-07 | Before importing a project into Vuforia, a user could modify the “resourceDirectory” attribute in the appConfig.json file to be a different path. |
CVE-2023-29168 | Low | 3.7 | 2023-06-07 | The local Vuforia web application does not support HTTPS, and federated credentials are passed via basic authentication. |
CVE-2023-29152 | Medium | 6.2 | 2023-06-07 | By changing the filename parameter in the request, an attacker could delete any file with the permissions of the Vuforia server account. |
CVE-2023-27881 | High | 8.0 | 2023-06-07 | A user could use the “Upload Resource” functionality to upload files to any location on the disk. |
CVE-2023-24476 | Low | 1.8 | 2023-06-07 | An attacker with local access to the machine could record the traffic, which could allow them to resend requests without the server authenticating that the… |
CVE-2023-33848 | Medium | 4.9 | 2023-06-07 | IBM TXSeries for Multiplatforms 8.1, 8.2, 9.1, CICS TX Standard, 11.1, CICS TX Advanced 10.1, and 11.1 could allow a privileged user to obtain highly sensitive… |
CVE-2023-33556 | Critical | 9.8 | 2023-06-07 | TOTOLink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the staticGw parameter at /setting/setWanIeCfg. |
CVE-2023-33496 | Critical | 9.8 | 2023-06-07 | xxl-rpc v1.7.0 was discovered to contain a deserialization vulnerability via the component com.xxl.rpc.core.remoting.net.impl.netty.codec.NettyDecode#decode. |
CVE-2023-31116 | Critical | 9.8 | 2023-06-07 | An issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300. An incorrect default permission can cause unintended querying of RC… |
CVE-2023-31115 | High | 7.5 | 2023-06-07 | An issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300. Incorrect resource transfer between spheres can cause changes to th… |
CVE-2023-31114 | Critical | 9.1 | 2023-06-07 | An issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300. Incorrect resource transfer between spheres can cause unintended qu… |
CVE-2023-2866 | High | 7.3 | 2023-06-07 | If an attacker can trick an authenticated user into loading a maliciously crafted .zip file onto Advantech WebAccess version 8.4.5, a web shell could be used… |
CVE-2023-25177 | High | 7.8 | 2023-06-07 | Delta Electronics' CNCSoft-B DOPSoft versions 1.0.0.4 and prior are vulnerable to stack-based buffer overflow, which could allow an attacker to execute arbi… |
CVE-2023-24014 | High | 7.8 | 2023-06-07 | Delta Electronics' CNCSoft-B DOPSoft versions 1.0.0.4 and prior are vulnerable to heap-based buffer overflow, which could allow an attacker to execute arbitr… |
CVE-2023-1864 | Medium | 6.8 | 2023-06-07 | FANUC ROBOGUIDE-HandlingPRO Versions 9 Rev.ZD and prior is vulnerable to a path traversal, which could allow an attacker to remotely read files on the system… |
CVE-2023-1709 | High | 7.8 | 2023-06-07 | Datalogics Library APDFLThe v18.0.4PlusP1e and prior contains a stack-based buffer overflow due to documents containing corrupted fonts, which could allow an… |
CVE-2023-34237 | High | 8.1 | 2023-06-07 | SABnzbd is an open source automated Usenet download tool. A design flaw was discovered in SABnzbd that could allow remote code execution. Manipulating the Para… |
CVE-2023-33865 | High | 7.8 | 2023-06-07 | RenderDoc before 1.27 allows local privilege escalation via a symlink attack. It relies on the /tmp/RenderDoc directory regardless of ownership. |
CVE-2023-33864 | Critical | 9.8 | 2023-06-07 | StreamReader::ReadFromExternal in RenderDoc before 1.27 allows an Integer Overflow with a resultant Buffer Overflow. It uses uint32_t(m_BufferSize-m_InputSize)… |
CVE-2023-33863 | Critical | 9.8 | 2023-06-07 | SerialiseValue in RenderDoc before 1.27 allows an Integer Overflow with a resultant Buffer Overflow. 0xffffffff is sign-extended to 0xffffffffffffffff (SIZE_MA… |
CVE-2023-33595 | Medium | 5.5 | 2023-06-07 | CPython v3.12.0 alpha 7 was discovered to contain a heap use-after-free via the function ascii_decode at /Objects/unicodeobject.c. |
CVE-2023-33510 | High | 7.5 | 2023-06-07 | Jeecg P3 Biz Chat 1.0.5 allows remote attackers to read arbitrary files through specific parameters. |
CVE-2023-33284 | High | 8.8 | 2023-06-07 | Marval MSM through 14.19.0.12476 and 15.0 has a Remote Code Execution vulnerability. A remote attacker authenticated as any user is able to execute code in con… |
CVE-2023-33283 | Medium | 5.5 | 2023-06-07 | Marval MSM through 14.19.0.12476 uses a static encryption key for secrets. An attacker that gains access to encrypted secrets can decrypt them by using this ke… |
CVE-2023-33282 | Critical | 9.8 | 2023-06-07 | Marval MSM through 14.19.0.12476 and 15.0 has a System account with default credentials. A remote attacker is able to login and create a valid session. This ma… |
CVE-2023-2530 | Critical | 9.8 | 2023-06-07 | A privilege escalation allowing remote code execution was discovered in the orchestration service. |
CVE-2023-3152 | Medium | 6.3 | 2023-06-07 | A vulnerability classified as critical has been found in SourceCodester Online Discussion Forum Site 1.0. This affects an unknown part of the file admin\posts\… |
CVE-2023-3151 | Medium | 6.3 | 2023-06-07 | A vulnerability was found in SourceCodester Online Discussion Forum Site 1.0. It has been rated as critical. Affected by this issue is some unknown functionali… |
CVE-2023-3150 | Medium | 6.3 | 2023-06-07 | A vulnerability was found in SourceCodester Online Discussion Forum Site 1.0. It has been declared as critical. Affected by this vulnerability is an unknown fu… |
CVE-2023-34234 | Medium | 5.3 | 2023-06-07 | OpenZeppelin Contracts is a library for smart contract development. By frontrunning the creation of a proposal, an attacker can become the proposer and gain t… |
CVE-2023-34109 | Medium | 6.5 | 2023-06-07 | zxcvbn-ts is an open source password strength estimator written in typescript. This vulnerability affects users running on the nodeJS platform which are using… |
CVE-2023-34108 | High | 8.8 | 2023-06-07 | mailcow is a mail server suite based on Dovecot, Postfix and other open source software, that provides a modern web UI for user/server administration. A vulner… |