2023 CVEs (page 228)
Page 228 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-3064 | High | 7.5 | 2023-06-05 | Anonymous user may get the list of existing users managed by the application, that could ease further attacks (see CVE-2023-3065 and 3066)This issue affects Mo… |
CVE-2023-3100 | Medium | 5.5 | 2023-06-05 | A vulnerability, which was classified as critical, has been found in IBOS 4.5.5. Affected by this issue is the function actionDel of the file ?r=dashboard/appr… |
CVE-2023-3099 | Medium | 4.4 | 2023-06-05 | A vulnerability classified as critical was found in KylinSoft youker-assistant on KylinOS. Affected by this vulnerability is the function delete_file in the li… |
CVE-2023-3098 | Medium | 4.4 | 2023-06-05 | A vulnerability classified as critical has been found in KylinSoft youker-assistant on KylinOS. Affected is the function restore_all_sound_file. The manipulati… |
CVE-2023-3097 | Medium | 5.3 | 2023-06-05 | A vulnerability was found in KylinSoft kylin-software-properties on KylinOS. It has been rated as critical. This issue affects the function setMainSource. The… |
CVE-2023-3096 | Medium | 5.3 | 2023-06-05 | A vulnerability was found in KylinSoft kylin-software-properties on KylinOS. It has been declared as critical. This vulnerability affects the function changedS… |
CVE-2023-34411 | High | 7.5 | 2023-06-05 | The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid <! token (such as <!DOCTYPEs/%<!A nesting) in an XML documen… |
CVE-2023-32217 | Critical | 9.0 | 2023-06-05 | IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p3, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p6, IdentityIQ 8.1 and all 8.1 patch levels prior t… |
CVE-2023-0636 | High | 7.2 | 2023-06-05 | Improper Input Validation vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQG103… |
CVE-2023-0635 | High | 7.8 | 2023-06-05 | Improper Privilege Management vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQ… |
CVE-2023-34410 | Medium | 5.3 | 2023-06-05 | An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2. Certificate validation for TLS does not always consider w… |
CVE-2023-34408 | Medium | 5.4 | 2023-06-05 | DokuWiki before 2023-04-04a allows XSS via RSS titles. |
CVE-2023-34407 | High | 7.5 | 2023-06-05 | OfflinePlayerService.exe in Harbinger Offline Player 4.0.6.0.2 allows directory traversal as LocalSystem via ..\ in a URL. |
CVE-2023-32334 | Low | 3.7 | 2023-06-05 | IBM Maximo Asset Management 7.6.1.2, 7.6.1.3 and IBM Maximo Application Suite 8.8.0 stores sensitive information in URL parameters. This may lead to informatio… |
CVE-2023-27861 | Medium | 5.9 | 2023-06-05 | IBM Maximo Application Suite - Manage Component 8.8.0 and 8.9.0 transmits sensitive information in cleartext that could be intercepted by an attacker using man… |
CVE-2023-0041 | Medium | 6.3 | 2023-06-05 | IBM Security Guardium 11.5 could allow a user to take over another user's session due to insufficient session expiration. IBM X-Force ID: 243657. |
CVE-2023-27285 | High | 8.4 | 2023-06-05 | IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5 is vulnerable to a buffer overflow, caused by improper bounds checking. An attacker could overflow a buffer… |
CVE-2023-22862 | Medium | 5.9 | 2023-06-05 | IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5 transmits authentication credentials, but it uses an insecure method that is susceptible to unauthorized in… |
CVE-2023-3095 | Medium | 6.5 | 2023-06-04 | Improper Access Control in GitHub repository nilsteampassnet/teampass prior to 3.0.9. |
CVE-2023-3094 | Medium | 6.3 | 2023-06-04 | A vulnerability classified as critical has been found in code-projects Agro-School Management System 1.0. Affected is the function doUpdateQuestion of the file… |
CVE-2023-3091 | High | 7.0 | 2023-06-04 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Captura up to 8.0.0. It has been declared as critical. This vulnerability affects unknown code in… |
CVE-2023-3086 | Critical | 9.0 | 2023-06-03 | Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9. |
CVE-2023-32582 | Medium | 5.9 | 2023-06-03 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kyle Maurer Don8 plugin <= 0.4 versions. |
CVE-2023-3085 | Low | 3.5 | 2023-06-03 | A vulnerability, which was classified as problematic, has been found in X-WRT luci up to 22.10_b202303061504. This issue affects the function run_action of the… |
CVE-2023-3084 | High | 8.1 | 2023-06-03 | Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9. |
CVE-2023-3083 | High | 8.7 | 2023-06-03 | Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9. |
CVE-2023-2416 | Medium | 5.4 | 2023-06-03 | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check o… |
CVE-2023-2415 | Medium | 5.4 | 2023-06-03 | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi… |
CVE-2023-2407 | Medium | 6.1 | 2023-06-03 | The Event Registration Calendar By vcita plugin, versions up to and including 3.10.0, and Online Payments – Get Paid with PayPal, Square & Stripe plugin, for W… |
CVE-2023-2406 | Medium | 6.4 | 2023-06-03 | The Event Registration Calendar By vcita plugin, versions up to and including 3.9.1, and Online Payments – Get Paid with PayPal, Square & Stripe plugin, for Wo… |
CVE-2023-2405 | Medium | 6.1 | 2023-06-03 | The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.0. This is due to m… |
CVE-2023-2404 | Medium | 6.4 | 2023-06-03 | The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and includi… |
CVE-2023-2303 | Medium | 6.1 | 2023-06-03 | The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.10.5. This i… |
CVE-2023-2302 | Medium | 6.4 | 2023-06-03 | The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, an… |
CVE-2023-2301 | Medium | 6.1 | 2023-06-03 | The Contact Form Builder by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.10.3. This is due to mis… |
CVE-2023-2300 | Medium | 6.4 | 2023-06-03 | The Contact Form Builder by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including… |
CVE-2023-2299 | Medium | 5.3 | 2023-06-03 | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized medication of data via the /wp-json/vcita-wo… |
CVE-2023-2298 | High | 7.2 | 2023-06-03 | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'business_id' paramet… |
CVE-2023-0584 | Medium | 4.3 | 2023-06-03 | The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'update_options' function in versions up to, and including, 1.57.0.5. T… |
CVE-2023-0583 | Medium | 4.3 | 2023-06-03 | The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'update_vk_blocks_options' function in versions up to, and including, 1… |
CVE-2023-33143 | High | 7.5 | 2023-06-03 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2023-3055 | Medium | 6.1 | 2023-06-03 | The Page Builder by AZEXO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.27.133. This is due to missing o… |
CVE-2023-3053 | Medium | 5.4 | 2023-06-03 | The Page Builder by AZEXO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'azh_add_post' funct… |
CVE-2023-3052 | Medium | 6.3 | 2023-06-03 | The Page Builder by AZEXO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.27.133. This is due to missing o… |
CVE-2023-3051 | Medium | 6.4 | 2023-06-03 | The Page Builder by AZEXO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'azh_post' shortcode in versions up to, and including, 1.27.133… |
CVE-2023-2781 | High | 8.1 | 2023-06-03 | The User Email Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass via authenticate_user_by_email in versions up to, and i… |
CVE-2023-3044 | Low | 3.3 | 2023-06-02 | An excessively large PDF page size (found in fuzz testing, unlikely in normal PDF files) can result in a divide-by-zero in Xpdf's text extraction code. Thi… |
CVE-2023-2816 | High | 8.7 | 2023-06-02 | Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy inst… |
CVE-2023-1297 | Medium | 4.9 | 2023-06-02 | Consul and Consul Enterprise's cluster peering implementation contained a flaw whereby a peer cluster with service of the same name as a local service could co… |
CVE-2023-33763 | Medium | 6.1 | 2023-06-02 | eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /scheduler/ind… |
CVE-2023-33762 | Critical | 9.8 | 2023-06-02 | eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a SQL injection vulnerability via the Activity parameter. |
CVE-2023-33761 | Medium | 6.1 | 2023-06-02 | eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /view/cb/forma… |
CVE-2023-33675 | Critical | 9.8 | 2023-06-02 | Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the time parameter in the get_parentControl_list_Info function. |
CVE-2023-33673 | Critical | 9.8 | 2023-06-02 | Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the firewallEn parameter in the formSetFirewallCfg function. |
CVE-2023-33672 | High | 7.5 | 2023-06-02 | Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the shareSpeed parameter in the fromSetWifiGusetBasic function. |
CVE-2023-33671 | Critical | 9.8 | 2023-06-02 | Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the deviceId parameter in the saveParentControlInfo function. |
CVE-2023-33670 | Critical | 9.8 | 2023-06-02 | Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the time parameter in the sub_4a79ec function. |
CVE-2023-33669 | Critical | 9.8 | 2023-06-02 | Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the timeZone parameter in the sub_44db3c function. |
CVE-2023-3073 | Medium | 5.4 | 2023-06-02 | Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8 via evvtgendoc. |
CVE-2023-3075 | Medium | 6.5 | 2023-06-02 | Cross-Site Request Forgery (CSRF) in GitHub repository tsolucio/corebos prior to 8. |
CVE-2023-3074 | Medium | 5.4 | 2023-06-02 | Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8. |
CVE-2023-3071 | Medium | 5.4 | 2023-06-02 | Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8. |
CVE-2023-3070 | Medium | 5.4 | 2023-06-02 | Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8. |
CVE-2023-3069 | Critical | 9.8 | 2023-06-02 | Unverified Password Change in GitHub repository tsolucio/corebos prior to 8. |
CVE-2023-32215 | High | 8.8 | 2023-06-02 | Mozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian Hengst, Andrew McCreight and the Mozilla Fuzzing Team repor… |
CVE-2023-32213 | High | 8.8 | 2023-06-02 | When reading a file, an uninitialized value could have been used as read limit. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird… |
CVE-2023-32212 | Medium | 4.3 | 2023-06-02 | An attacker could have positioned a `datalist` element to obscure the address bar. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderb… |
CVE-2023-32211 | Medium | 6.5 | 2023-06-02 | A type checking bug would have led to invalid code being compiled. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. |
CVE-2023-32207 | High | 8.8 | 2023-06-02 | A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefo… |
CVE-2023-32206 | Medium | 6.5 | 2023-06-02 | An out-of-bound read could have led to a crash in the RLBox Expat driver. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102… |
CVE-2023-32205 | Medium | 4.3 | 2023-06-02 | In multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to potential user confusion and spoofing attac… |
CVE-2023-29551 | High | 8.8 | 2023-06-02 | Memory safety bugs present in Firefox 111. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could h… |
CVE-2023-29550 | High | 8.8 | 2023-06-02 | Memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort… |
CVE-2023-29549 | Medium | 6.5 | 2023-06-02 | Under certain circumstances, a call to the <code>bind</code> function may have resulted in the incorrect realm. This may have created a vulnerability relating… |
CVE-2023-29548 | Medium | 6.5 | 2023-06-02 | A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affects Firefox < 112, Focus for Android < 1… |
CVE-2023-29547 | Medium | 6.5 | 2023-06-02 | When a secure cookie existed in the Firefox cookie jar an insecure cookie for the same domain could have been created, when it should have silently failed. Thi… |
CVE-2023-29544 | Medium | 6.5 | 2023-06-02 | If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused memory corruption and a potentially exploi… |
CVE-2023-29543 | High | 8.8 | 2023-06-02 | An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object's debugger vector. This vulnerabil… |
CVE-2023-29541 | High | 8.8 | 2023-06-02 | Firefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be interpreted to run attacker-controlled commands. <br>*This bug… |
CVE-2023-29540 | Medium | 6.1 | 2023-06-02 | Using a redirect embedded into <code>sourceMappingUrls</code> could allow for navigation to external protocol links in sandboxed iframes without <code>allow-to… |
CVE-2023-29539 | High | 8.8 | 2023-06-02 | When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could… |
CVE-2023-29538 | Medium | 4.3 | 2023-06-02 | Under specific circumstances a WebExtension may have received a <code>jar:file:///</code> URI instead of a <code>moz-extension:///</code> URI during a load req… |
CVE-2023-29537 | High | 7.5 | 2023-06-02 | Multiple race conditions in the font initialization could have led to memory corruption and execution of attacker-controlled code. This vulnerability affects F… |
CVE-2023-29536 | High | 8.8 | 2023-06-02 | An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruptio… |
CVE-2023-29535 | Medium | 6.5 | 2023-06-02 | Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentia… |
CVE-2023-29533 | Medium | 4.3 | 2023-06-02 | A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscreen requests, <code>window.name</code> ass… |
CVE-2023-28177 | High | 8.8 | 2023-06-02 | Memory safety bugs present in Firefox 110. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could h… |
CVE-2023-28176 | High | 8.8 | 2023-06-02 | Memory safety bugs present in Firefox 110 and Firefox ESR 102.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort… |
CVE-2023-28164 | Medium | 6.5 | 2023-06-02 | Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website spoofing attacks. This vulnerability af… |
CVE-2023-28163 | Medium | 6.5 | 2023-06-02 | When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those… |
CVE-2023-28162 | High | 8.8 | 2023-06-02 | While implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type. This could have led to a potentially exploitable crash… |
CVE-2023-28161 | High | 8.8 | 2023-06-02 | If temporary "one-time" permissions, such as the ability to use the Camera, were granted to a document loaded using a file: URL, that permission persisted in t… |
CVE-2023-28160 | Medium | 6.5 | 2023-06-02 | When following a redirect to a publicly accessible web extension file, the URL may have been translated to the actual local path, leaking potentially sensitive… |
CVE-2023-28159 | Medium | 4.3 | 2023-06-02 | The fullscreen notification could have been hidden on Firefox for Android by using download popups, resulting in potential user confusion or spoofing attacks… |
CVE-2023-25752 | Medium | 6.5 | 2023-06-02 | When accessing throttled streams, the count of available bytes needed to be checked in the calling function to be within bounds. This may have lead future code… |
CVE-2023-25751 | Medium | 6.5 | 2023-06-02 | Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritten incorrectly. This could lead to a potentially… |
CVE-2023-25750 | Medium | 4.3 | 2023-06-02 | Under certain circumstances, a ServiceWorker's offline cache may have leaked to the file system when using private browsing mode. This vulnerability affects Fi… |
CVE-2023-25749 | Medium | 4.3 | 2023-06-02 | Android applications with unpatched vulnerabilities can be launched from a browser using Intents, exposing users to these vulnerabilities. Firefox will now con… |
CVE-2023-25748 | Medium | 4.3 | 2023-06-02 | By displaying a prompt with a long description, the fullscreen notification could have been hidden, resulting in potential user confusion or spoofing attacks… |
CVE-2023-25746 | High | 8.8 | 2023-06-02 | Memory safety bugs present in Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these c… |