2023 CVEs (page 226)
Page 226 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-29345 | Medium | 6.1 | 2023-06-07 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability |
CVE-2023-3149 | Medium | 6.3 | 2023-06-07 | A vulnerability was found in SourceCodester Online Discussion Forum Site 1.0. It has been classified as critical. Affected is an unknown function of the file a… |
CVE-2023-3148 | Medium | 6.3 | 2023-06-07 | A vulnerability was found in SourceCodester Online Discussion Forum Site 1.0 and classified as critical. This issue affects some unknown processing of the file… |
CVE-2023-2589 | Medium | 5.9 | 2023-06-07 | An issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versio… |
CVE-2023-2485 | Medium | 4.4 | 2023-06-07 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all ver… |
CVE-2023-2199 | High | 7.5 | 2023-06-07 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 before 15.11.7, all ver… |
CVE-2023-2198 | High | 7.5 | 2023-06-07 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.7 before 15.10.8, all versions starting from 15.11 before 15.11.7, all vers… |
CVE-2023-2015 | Medium | 4.4 | 2023-06-07 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.8 before 15.10.8, all versions starting from 15.11 before 15.11.7, all ver… |
CVE-2023-2013 | Low | 2.6 | 2023-06-07 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 1.2 before 15.10.8, all versions starting from 15.11 before 15.11.7, all vers… |
CVE-2023-2001 | Medium | 4.3 | 2023-06-07 | An issue has been discovered in GitLab CE/EE affecting all versions before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from… |
CVE-2023-1825 | Low | 3.1 | 2023-06-07 | An issue has been discovered in GitLab EE affecting all versions starting from 15.7 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versio… |
CVE-2023-0508 | Low | 3.1 | 2023-06-07 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all ver… |
CVE-2023-0121 | Medium | 6.5 | 2023-06-07 | A denial of service issue was discovered in GitLab CE/EE affecting all versions starting from 13.2.4 before 15.10.8, all versions starting from 15.11 before 15… |
CVE-2023-3147 | Medium | 6.3 | 2023-06-07 | A vulnerability has been found in SourceCodester Online Discussion Forum Site 1.0 and classified as critical. This vulnerability affects unknown code of the fi… |
CVE-2023-3146 | Medium | 6.3 | 2023-06-07 | A vulnerability, which was classified as critical, was found in SourceCodester Online Discussion Forum Site 1.0. This affects an unknown part of the file admin… |
CVE-2023-2442 | High | 8.7 | 2023-06-07 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A specia… |
CVE-2023-3145 | Medium | 6.3 | 2023-06-07 | A vulnerability, which was classified as critical, has been found in SourceCodester Online Discussion Forum Site 1.0. Affected by this issue is some unknown fu… |
CVE-2023-3144 | Low | 3.5 | 2023-06-07 | A vulnerability classified as problematic was found in SourceCodester Online Discussion Forum Site 1.0. Affected by this vulnerability is an unknown functional… |
CVE-2023-3143 | Low | 3.5 | 2023-06-07 | A vulnerability classified as problematic has been found in SourceCodester Online Discussion Forum Site 1.0. Affected is an unknown function of the file admin\… |
CVE-2023-3142 | Medium | 5.4 | 2023-06-07 | Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 2.0. |
CVE-2023-33553 | Critical | 9.8 | 2023-06-07 | An issue in Planet Technologies WDRT-1800AX v1.01-CP21 allows attackers to bypass authentication and escalate privileges to root via manipulation of the LoginS… |
CVE-2023-2878 | Medium | 6.5 | 2023-06-07 | Kubernetes secrets-store-csi-driver in versions before 1.3.3 discloses service account tokens in logs. |
CVE-2023-20889 | High | 7.5 | 2023-06-07 | Aria Operations for Networks contains an information disclosure vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may… |
CVE-2023-20888 | High | 8.8 | 2023-06-07 | Aria Operations for Networks contains an authenticated deserialization vulnerability. A malicious actor with network access to VMware Aria Operations for Netwo… |
CVE-2023-20887 | Critical | 9.8 | 2023-06-07 | Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be ab… |
CVE-2023-33498 | High | 8.8 | 2023-06-07 | alist <=3.16.3 is vulnerable to Incorrect Access Control. Low privilege accounts can upload any file. |
CVE-2023-3140 | Medium | 4.3 | 2023-06-07 | Missing HTTP headers (X-Frame-Options, Content-Security-Policy) in KNIME Business Hub before 1.4.0 has left users vulnerable to click jacking. Clickjacking i… |
CVE-2023-30576 | Medium | 6.8 | 2023-06-07 | Apache Guacamole 0.9.10 through 1.5.1 may continue to reference a freed RDP audio input buffer. Depending on timing, this may allow an attacker to execute arbi… |
CVE-2023-30575 | Medium | 6.5 | 2023-06-07 | Apache Guacamole 1.5.1 and older may incorrectly calculate the lengths of instruction elements sent during the Guacamole protocol handshake, potentially allowi… |
CVE-2023-2541 | Medium | 5.3 | 2023-06-07 | The Web Frontend of KNIME Business Hub before 1.4.0 allows an unauthenticated remote attacker to access internals about the application such as versions, host… |
CVE-2023-1388 | Medium | 6.3 | 2023-06-07 | A heap-based overflow vulnerability in TA prior to version 5.7.9 allows a remote user to alter the page heap in the macmnsvc process memory block, resulting i… |
CVE-2023-0976 | Medium | 6.3 | 2023-06-07 | A command Injection Vulnerability in TA for mac-OS prior to version 5.7.9 allows local users to place an arbitrary file into the /Library/Trellix/Agent/bin/ f… |
CVE-2023-2187 | Medium | 5.3 | 2023-06-07 | On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticated attacker can send broadcast events to any user via the WebMonitor.An unauthe… |
CVE-2023-2186 | High | 8.2 | 2023-06-07 | On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticated attacker can send a specially crafted broadcast message including format str… |
CVE-2023-33538 | High | 8.8 | 2023-06-07 | TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/WlanNetwo… |
CVE-2023-33537 | High | 8.1 | 2023-06-07 | TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a buffer overflow via the component /userRpm/FixMapCfgRpm. |
CVE-2023-33536 | High | 8.1 | 2023-06-07 | TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a buffer overflow via the component /userRpm/WlanMacFilterRpm. |
CVE-2023-0668 | Medium | 6.5 | 2023-06-07 | Due to failure in validating the length provided by an attacker-crafted IEEE-C37.118 packet, Wireshark version 4.0.5 and prior, by default, is susceptible to a… |
CVE-2023-0667 | Medium | 6.5 | 2023-06-07 | Due to failure in validating the length provided by an attacker-crafted MSMMS packet, Wireshark version 4.0.5 and prior, in an unusual configuration, is suscep… |
CVE-2023-0666 | Medium | 6.5 | 2023-06-07 | Due to failure in validating the length provided by an attacker-crafted RTPS packet, Wireshark version 4.0.5 and prior, by default, is susceptible to a heap-ba… |
CVE-2023-3126 | Medium | 4.3 | 2023-06-07 | The B2BKing plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'b2bkingdownloadpricelist' function in v… |
CVE-2023-3125 | Medium | 6.5 | 2023-06-07 | The B2BKing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'b2bking_save_price_import' functi… |
CVE-2023-3124 | High | 8.8 | 2023-06-07 | The Elementor Pro plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the update_page_option function in… |
CVE-2023-33604 | Critical | 9.1 | 2023-06-07 | Imperial CMS v7.5 was discovered to contain an arbitrary file deletion vulnerability via the DelspReFile function in /sp/ListSp.php. This vulnerability is expl… |
CVE-2023-33601 | High | 8.8 | 2023-06-07 | An arbitrary file upload vulnerability in /admin.php?c=upload of phpok v6.4.100 allows attackers to execute arbitrary code via a crafted PHP file. |
CVE-2023-33782 | High | 8.8 | 2023-06-07 | D-Link DIR-842V2 v1.0.3 was discovered to contain a command injection vulnerability via the iperf3 diagnostics function. |
CVE-2023-33781 | High | 8.8 | 2023-06-07 | An issue in D-Link DIR-842V2 v1.0.3 allows attackers to execute arbitrary commands via importing a crafted file. |
CVE-2023-30400 | Critical | 9.8 | 2023-06-07 | An issue was discovered in Anyka Microelectronics AK3918EV300 MCU v18. A command injection vulnerability in the network configuration script within the MCU's o… |
CVE-2023-34409 | Critical | 9.8 | 2023-06-06 | In Percona Monitoring and Management (PMM) server 2.x before 2.37.1, the authenticate function in auth_server.go does not properly formalize and sanitize URL p… |
CVE-2023-33684 | Medium | 5.7 | 2023-06-06 | Weak session management in DB Elettronica Telecomunicazioni SpA SFT DAB 600/C Firmware: 1.9.3 Bios firmware: 7.1 (Apr 19 2021) Gui: 2.46 FPGA: 169.55 uc: 6.15… |
CVE-2023-33569 | High | 7.2 | 2023-06-06 | Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via ip/eval/ajax.php?action=update_user. |
CVE-2023-33477 | Medium | 6.5 | 2023-06-06 | In Harmonic NSG 9000-6G devices, an authenticated remote user can obtain source code by directly requesting a special path. |
CVE-2023-2961 | Low | 3.3 | 2023-06-06 | A segmentation fault flaw was found in the Advancecomp package. This may lead to decreased availability. |
CVE-2023-2603 | High | 7.8 | 2023-06-06 | A vulnerability was found in libcap. This issue occurs in the _libcap_strdup() function and can lead to an integer overflow if the input string is close to 4Gi… |
CVE-2023-2602 | Low | 3.3 | 2023-06-06 | A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an… |
CVE-2023-2253 | Medium | 6.5 | 2023-06-06 | A flaw was found in the `/v2/_catalog` endpoint in distribution/distribution, which accepts a parameter to control the maximum number of records returned (quer… |
CVE-2023-2157 | Medium | 5.5 | 2023-06-06 | A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing. |
CVE-2023-29632 | Critical | 9.8 | 2023-06-06 | PrestaShop jmspagebuilder 3.x is vulnerable to SQL Injection via ajax_jmspagebuilder.php. |
CVE-2023-1621 | Medium | 6.5 | 2023-06-06 | An issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.5, all versions starting from 15.11 before 15.11.1. A maliciou… |
CVE-2023-33977 | High | 8.1 | 2023-06-06 | Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS allows users to upload attachments to test plans, test case… |
CVE-2023-33959 | High | 8.3 | 2023-06-06 | notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry can cause users to verify the wrong ar… |
CVE-2023-33958 | Medium | 5.4 | 2023-06-06 | notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures… |
CVE-2023-33957 | Low | 2.6 | 2023-06-06 | notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures… |
CVE-2023-33653 | High | 8.8 | 2023-06-06 | Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /Applications/Con… |
CVE-2023-33652 | High | 8.8 | 2023-06-06 | Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /sitecore/shell/I… |
CVE-2023-33651 | High | 7.5 | 2023-06-06 | An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0… |
CVE-2023-32683 | Low | 3.5 | 2023-06-06 | Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. A discovered oEmbed or image URL can bypass the `url_preview_url_blacklis… |
CVE-2023-32682 | Medium | 5.4 | 2023-06-06 | Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactivated user to login w… |
CVE-2023-2801 | High | 7.5 | 2023-06-06 | Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sources using mixed queri… |
CVE-2023-2183 | Medium | 4.1 | 2023-06-06 | Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having… |
CVE-2023-22833 | High | 7.6 | 2023-06-06 | Palantir Foundry deployments running Lime2 versions between 2.519.0 and 2.532.0 were vulnerable a bug that allowed authenticated users within a Foundry organiz… |
CVE-2023-34104 | High | 7.5 | 2023-06-06 | fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not escaped or sanitized. S… |
CVE-2023-33747 | High | 7.8 | 2023-06-06 | CloudPanel v2.2.2 allows attackers to execute a path traversal. |
CVE-2023-33613 | Medium | 5.5 | 2023-06-06 | axTLS v2.1.5 was discovered to contain a heap buffer overflow in the bi_import function in axtls-code/crypto/bigint.c. This vulnerability allows attackers to c… |
CVE-2023-27126 | Medium | 4.6 | 2023-06-06 | The AES Key-IV pair used by the TP-Link TAPO C200 camera V3 (EU) on firmware version 1.1.22 Build 220725 is reused across all cameras. An attacker with physica… |
CVE-2023-34111 | High | 8.1 | 2023-06-06 | The `Release PR Merged` workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerability which allows for arbitrary code exec… |
CVE-2023-32203 | High | 7.8 | 2023-06-06 | Horner Automation Cscape lacks proper validation of user-supplied data when parsing project files (e.g., HMI). This could lead to an out-of-bounds write at CSc… |
CVE-2023-31606 | High | 7.5 | 2023-06-06 | A Regular Expression Denial of Service (ReDoS) issue was discovered in the sanitize_html function of redcloth gem v4.0.0. This vulnerability allows attackers t… |
CVE-2023-31278 | High | 7.8 | 2023-06-06 | Horner Automation Cscape lacks proper validation of user-supplied data when parsing project files (e.g., HMI). This could lead to an out-of-bounds read. An att… |
CVE-2023-31244 | High | 7.8 | 2023-06-06 | The affected product does not properly validate user-supplied data. If a user opens a maliciously formed CSP file, then an attacker could ex… |
CVE-2023-2132 | High | 7.5 | 2023-06-06 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all ver… |
CVE-2023-29503 | High | 7.8 | 2023-06-06 | The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP). This could lead to a stack-based buffer o… |
CVE-2023-28653 | High | 7.8 | 2023-06-06 | The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP). This could lead to a use-after-… |
CVE-2023-27916 | High | 7.8 | 2023-06-06 | The affected application lacks proper validation of user-supplied data when parsing font files (e.g., FNT). This could lead to an out-of-bounds… |
CVE-2023-0921 | Medium | 4.3 | 2023-06-06 | A lack of length validation in GitLab CE/EE affecting all versions from 8.3 before 15.10.8, 15.11 before 15.11.7, and 16.0 before 16.0.2 allows an authenticate… |
CVE-2023-32551 | Medium | 6.1 | 2023-06-06 | Landscape allowed URLs which caused open redirection. |
CVE-2023-32550 | Critical | 9.3 | 2023-06-06 | Landscape's server-status page exposed sensitive system information. This data leak included GET requests which contain information to attack and leak further… |
CVE-2023-32549 | Medium | 6.8 | 2023-06-06 | Landscape cryptographic keys were insecurely generated with a weak pseudo-random generator. |
CVE-2023-32539 | High | 7.8 | 2023-06-06 | Horner Automation Cscape lacks proper validation of user-supplied data when parsing project files (e.g., HMI). This could lead to an out-of-bounds write at CSc… |
CVE-2023-32289 | High | 7.8 | 2023-06-06 | The affected application lacks proper validation of user-supplied data when parsing project files (e.g.., CSP). This could lead to an out-of-bounds… |
CVE-2023-32281 | High | 7.8 | 2023-06-06 | The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP). This could lead to an out-of-bounds rea… |
CVE-2023-32545 | High | 7.8 | 2023-06-06 | The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP). This could lead to an out-of-bounds… |
CVE-2023-30948 | Medium | 6.5 | 2023-06-06 | A security defect in Foundry's Comments functionality resulted in the retrieval of attachments to comments not being gated by additional authorization checks… |
CVE-2023-33533 | High | 8.8 | 2023-06-06 | Netgear D6220 with Firmware Version 1.0.0.80, D8500 with Firmware Version 1.0.3.60, R6700 with Firmware Version 1.0.2.26, and R6900 with Firmware Version 1.0.2… |
CVE-2023-33532 | Critical | 9.8 | 2023-06-06 | There is a command injection vulnerability in the Netgear R6250 router with Firmware Version 1.0.4.48. If an attacker gains web management privileges, they can… |
CVE-2023-33457 | High | 8.8 | 2023-06-06 | In Sogou Workflow v0.10.6, memcpy a negtive size in URIParser::parse , may cause buffer-overflow and crash. |
CVE-2023-31569 | Critical | 9.8 | 2023-06-06 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection via the setWanCfg function. |
CVE-2023-33530 | High | 8.8 | 2023-06-06 | There is a command injection vulnerability in the Tenda G103 Gigabit GPON Terminal with firmware version V1.0.0.5. If an attacker gains web management privileg… |
CVE-2023-20752 | Medium | 6.7 | 2023-06-06 | In keymange, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution priv… |
CVE-2023-20751 | Medium | 6.7 | 2023-06-06 | In keymange, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution priv… |