2023 CVEs (page 231)
Page 231 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-31548 | Medium | 5.4 | 2023-05-31 | A stored Cross-site scripting (XSS) vulnerability in the FundRaiserEditor.php component of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts o… |
CVE-2023-26842 | Medium | 5.4 | 2023-05-31 | A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the OptionManager.php. |
CVE-2023-3009 | Medium | 5.4 | 2023-05-31 | Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9. |
CVE-2023-33736 | Medium | 5.4 | 2023-05-31 | A stored cross-site scripting (XSS) vulnerability in Dcat-Admin v2.1.3-beta allows attackers to execute arbitrary web scripts or HTML via a crafted payload inj… |
CVE-2023-33509 | Critical | 9.8 | 2023-05-31 | KramerAV VIA GO² < 4.0.1.1326 is vulnerable to SQL Injection. |
CVE-2023-33508 | Critical | 9.8 | 2023-05-31 | KramerAV VIA GO² < 4.0.1.1326 is vulnerable to unauthenticated file upload resulting in Remote Code Execution (RCE). |
CVE-2023-33507 | High | 7.5 | 2023-05-31 | KramerAV VIA GO² < 4.0.1.1326 is vulnerable to Unauthenticated arbitrary file read. |
CVE-2023-33487 | Critical | 9.8 | 2023-05-31 | TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contains a command insertion vulnerability in setDiagnosisCfg.This vulnerability allows an at… |
CVE-2023-33486 | Critical | 9.8 | 2023-05-31 | TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setOpModeCfg. This vulnerability allows an attac… |
CVE-2023-33485 | High | 8.8 | 2023-05-31 | TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contains a post-authentication buffer overflow via parameter sPort/ePort in the addEffect fun… |
CVE-2023-3008 | High | 7.3 | 2023-05-31 | A vulnerability classified as critical has been found in ningzichun Student Management System 1.0. This affects an unknown part of the file login.php. The mani… |
CVE-2023-3007 | Medium | 6.5 | 2023-05-31 | A vulnerability was found in ningzichun Student Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of t… |
CVE-2023-30285 | High | 7.5 | 2023-05-31 | An issue in Deviniti Issue Sync Synchronization v3.5.2 for Jira allows attackers to obtain the login credentials of a user via a crafted request sent to /rest/… |
CVE-2023-2909 | High | 8.5 | 2023-05-31 | EZ Sync service fails to adequately handle user input, allowing an attacker to navigate beyond the intended directory structure and delete files. Affected prod… |
CVE-2023-3005 | Low | 3.5 | 2023-05-31 | A vulnerability, which was classified as problematic, was found in SourceCodester Local Service Search Engine Management System 1.0. This affects an unknown pa… |
CVE-2023-3004 | Medium | 6.3 | 2023-05-31 | A vulnerability, which was classified as critical, has been found in SourceCodester Simple Chat System 1.0. Affected by this issue is some unknown functionalit… |
CVE-2023-3003 | Medium | 6.3 | 2023-05-31 | A vulnerability classified as critical was found in SourceCodester Train Station Ticketing System 1.0. Affected by this vulnerability is an unknown functionali… |
CVE-2023-2749 | High | 8.6 | 2023-05-31 | Download Center fails to properly validate the file path submitted by a user, An attacker can exploit this vulnerability to gain unauthorized access to sensiti… |
CVE-2023-2304 | Medium | 6.4 | 2023-05-31 | The Favorites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_favorites' shortcode in versions up to, and including, 2.3.2 due… |
CVE-2023-26131 | Medium | 5.4 | 2023-05-31 | All versions of the package github.com/xyproto/algernon/engine; all versions of the package github.com/xyproto/algernon/themes are vulnerable to Cross-site Scr… |
CVE-2023-25539 | High | 8.4 | 2023-05-31 | Dell NetWorker 19.6.1.2, contains an OS command injection Vulnerability in the NetWorker client. A remote unauthenticated attacker could potentially exploit t… |
CVE-2023-2836 | Medium | 4.4 | 2023-05-31 | The CRM Perks Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form settings in versions up to, and including, 1.1.1 due to insuffic… |
CVE-2023-2434 | Low | 3.8 | 2023-05-31 | The Nested Pages plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'reset' function in versions up to, a… |
CVE-2023-1661 | Medium | 6.4 | 2023-05-31 | The Display post meta, term meta, comment meta, and user meta plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post metadata in versions u… |
CVE-2023-2987 | Critical | 9.8 | 2023-05-31 | The Wordapp plugin for WordPress is vulnerable to authorization bypass due to an use of insufficiently unique cryptographic signature on the 'wa_pdx_op_config_… |
CVE-2023-2549 | High | 8.8 | 2023-05-31 | The Feather Login Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions starting from 1.0.7 up to, and including, 1.1.1. This is du… |
CVE-2023-2547 | Medium | 5.4 | 2023-05-31 | The Feather Login Page plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'deleteUser' function in versio… |
CVE-2023-2545 | High | 8.1 | 2023-05-31 | The Feather Login Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getListOfUsers' function in… |
CVE-2023-2436 | Medium | 4.4 | 2023-05-31 | The Blog-in-Blog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'blog_in_blog' shortcode in versions up to, and including, 2.0.0 due… |
CVE-2023-2435 | High | 7.2 | 2023-05-31 | The Blog-in-Blog plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.0.0 via a shortcode attribute. This allows edit… |
CVE-2023-30197 | High | 7.5 | 2023-05-31 | Incorrect Access Control in the module "My inventory" (myinventory) <= 1.6.6 from Webbax for PrestaShop, allows a guest to download personal information withou… |
CVE-2023-2999 | Medium | 6.1 | 2023-05-31 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.14. |
CVE-2023-2998 | Medium | 6.1 | 2023-05-31 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.14. |
CVE-2023-23562 | Medium | 4.3 | 2023-05-31 | Stormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control that allows an authenticated user can update global parameters. |
CVE-2023-2612 | Medium | 4.4 | 2023-05-31 | Jean-Baptiste Cayrou discovered that the shiftfs file system in the Ubuntu Linux kernel contained a race condition when handling inode locking in some situatio… |
CVE-2023-29745 | High | 7.1 | 2023-05-31 | An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service attack by manipulating the database. |
CVE-2023-29742 | High | 7.8 | 2023-05-31 | An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a code execution attack by manipulating the database. |
CVE-2023-28353 | High | 8.8 | 2023-05-31 | An issue was discovered in Faronics Insight 10.0.19045 on Windows. An unauthenticated attacker is able to upload any type of file to any location on the Teache… |
CVE-2023-28352 | High | 7.4 | 2023-05-31 | An issue was discovered in Faronics Insight 10.0.19045 on Windows. By abusing the Insight UDP broadcast discovery system, an attacker-controlled artificial Stu… |
CVE-2023-28351 | Low | 3.3 | 2023-05-31 | An issue was discovered in Faronics Insight 10.0.19045 on Windows. Every keystroke made by any user on a computer with the Student application installed is log… |
CVE-2023-28350 | Medium | 6.1 | 2023-05-31 | An issue was discovered in Faronics Insight 10.0.19045 on Windows. Attacker-supplied input is not validated/sanitized before being rendered in both the Teacher… |
CVE-2023-28349 | High | 8.8 | 2023-05-31 | An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for an attacker to create a crafted program that functions similarly to the T… |
CVE-2023-28348 | High | 7.4 | 2023-05-31 | An issue was discovered in Faronics Insight 10.0.19045 on Windows. A suitably positioned attacker could perform a man-in-the-middle attack on either a connecte… |
CVE-2023-28347 | Critical | 9.6 | 2023-05-31 | An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for an attacker to create a proof-of-concept script that functions similarly… |
CVE-2023-28346 | High | 7.3 | 2023-05-31 | An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for a remote attacker to communicate with the private API endpoints exposed a… |
CVE-2023-28345 | Medium | 4.6 | 2023-05-31 | An issue was discovered in Faronics Insight 10.0.19045 on Windows. The Insight Teacher Console application exposes the teacher's Console password in cleartext… |
CVE-2023-28344 | High | 7.1 | 2023-05-31 | An issue was discovered in Faronics Insight 10.0.19045 on Windows. The Insight Teacher Console application allows unauthenticated attackers to view constantly… |
CVE-2023-2952 | Medium | 5.3 | 2023-05-30 | XRA dissector infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file |
CVE-2023-29743 | High | 7.5 | 2023-05-30 | An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service attack by manipulating the database. |
CVE-2023-29741 | Critical | 9.8 | 2023-05-30 | An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause an escalation of privileges attack by manipulating the database. |
CVE-2023-29740 | High | 7.5 | 2023-05-30 | An issue found in Alarm Clock for Heavy Sleepers v.5.3.2 for Android allows unauthorized apps to cause a denial of service attack by manipulating the database. |
CVE-2023-29739 | Critical | 9.8 | 2023-05-30 | An issue found in Alarm Clock for Heavy Sleepers v.5.3.2 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the comp… |
CVE-2023-29738 | High | 7.8 | 2023-05-30 | An issue found in Wave Animated Keyboard Emoji v.1.70.7 for Android allows a local attacker to cause code execution and escalation of Privileges via the databa… |
CVE-2023-29728 | Critical | 9.8 | 2023-05-30 | The Call Blocker application 6.6.3 for Android allows attackers to tamper with feature-related data, resulting in a severe elevation of privilege attack. |
CVE-2023-29727 | Critical | 9.8 | 2023-05-30 | The Call Blocker application 6.6.3 for Android allows unauthorized applications to use exposed components to delete data stored in its database that is related… |
CVE-2023-29726 | High | 7.5 | 2023-05-30 | The Call Blocker application 6.6.3 for Android incorrectly opens a key component that an attacker can use to inject large amounts of dirty data into the applic… |
CVE-2023-34153 | High | 7.8 | 2023-05-30 | A vulnerability was found in ImageMagick. This security flaw causes a shell command injection vulnerability via video:vsync or video:pixel-format options in VI… |
CVE-2023-34152 | Critical | 9.8 | 2023-05-30 | A vulnerability was found in ImageMagick. This security flaw cause a remote code execution vulnerability in OpenBlob with --enable-pipes configured. |
CVE-2023-34151 | Medium | 5.5 | 2023-05-30 | A vulnerability was found in ImageMagick. This security flaw ouccers as an undefined behaviors of casting double to size_t in svg, mvg and other coders (recurr… |
CVE-2023-33962 | Medium | 5.4 | 2023-05-30 | JStachio is a type-safe Java Mustache templating engine. Prior to version 1.0.1, JStachio fails to escape single quotes `'` in HTML, allowing an attacker to i… |
CVE-2023-33961 | High | 8.9 | 2023-05-30 | Leantime is a lean open source project management system. Starting in version 2.3.21, an authenticated user with commenting privileges can inject malicious Jav… |
CVE-2023-33741 | High | 7.5 | 2023-05-30 | Macrovideo v380pro v1.4.97 shares the device id and password when sharing the device. |
CVE-2023-33740 | High | 7.5 | 2023-05-30 | Incorrect access control in luowice v3.5.18 allows attackers to access cloud source code information via modification fo the Verify parameter in a warning mess… |
CVE-2023-33734 | Critical | 9.8 | 2023-05-30 | BlueCMS v1.6 was discovered to contain a SQL injection vulnerability via the keywords parameter at search.php. |
CVE-2023-32342 | High | 7.5 | 2023-05-30 | IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel in the RSA Decryption implementation. By sending… |
CVE-2023-2953 | High | 7.5 | 2023-05-30 | A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function. |
CVE-2023-2941 | Medium | 4.3 | 2023-05-30 | Inappropriate implementation in Extensions API in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install a malicious extensio… |
CVE-2023-2940 | Medium | 6.5 | 2023-05-30 | Inappropriate implementation in Downloads in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install a malicious extension to… |
CVE-2023-2939 | High | 7.8 | 2023-05-30 | Insufficient data validation in Installer in Google Chrome on Windows prior to 114.0.5735.90 allowed a local attacker to perform privilege escalation via craft… |
CVE-2023-2938 | Medium | 4.3 | 2023-05-30 | Inappropriate implementation in Picture In Picture in Google Chrome prior to 114.0.5735.90 allowed a remote attacker who had compromised the renderer process t… |
CVE-2023-2937 | Medium | 4.3 | 2023-05-30 | Inappropriate implementation in Picture In Picture in Google Chrome prior to 114.0.5735.90 allowed a remote attacker who had compromised the renderer process t… |
CVE-2023-2936 | High | 8.8 | 2023-05-30 | Type Confusion in V8 in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2023-2935 | High | 8.8 | 2023-05-30 | Type Confusion in V8 in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2023-2934 | High | 8.8 | 2023-05-30 | Out of bounds memory access in Mojo in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2023-2933 | High | 8.8 | 2023-05-30 | Use after free in PDF in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromiu… |
CVE-2023-2932 | High | 8.8 | 2023-05-30 | Use after free in PDF in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromiu… |
CVE-2023-2931 | High | 8.8 | 2023-05-30 | Use after free in PDF in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromiu… |
CVE-2023-2930 | High | 8.8 | 2023-05-30 | Use after free in Extensions in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install a malicious extension to potentially e… |
CVE-2023-2929 | High | 8.8 | 2023-05-30 | Out of bounds write in Swiftshader in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2023-33181 | Medium | 4.3 | 2023-05-30 | Xibo is a content management system (CMS). Starting in version 3.0.0 and prior to version 3.3.5, some API routes will print a stack trace when called with miss… |
CVE-2023-33180 | Medium | 6.5 | 2023-05-30 | Xibo is a content management system (CMS). An SQL injection vulnerability was discovered starting in version 3.2.0 and prior to version 3.3.2 in the `/display/… |
CVE-2023-33179 | Medium | 6.5 | 2023-05-30 | Xibo is a content management system (CMS). An SQL injection vulnerability was discovered starting in version 3.2.0 and prior to version 3.3.5 in the `nameFilte… |
CVE-2023-0779 | Medium | 6.7 | 2023-05-30 | At the most basic level, an invalid pointer can be input that crashes the device, but with more knowledge of the device’s memory layout, further exploitation i… |
CVE-2023-33178 | Medium | 6.5 | 2023-05-30 | Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the `/dataset/data/{id}` API route inside the CMS starting in versi… |
CVE-2023-33177 | High | 8.8 | 2023-05-30 | Xibo is a content management system (CMS). A path traversal vulnerability exists in the Xibo CMS whereby a specially crafted zip file can be uploaded to the CM… |
CVE-2023-32218 | Medium | 6.1 | 2023-05-30 | Avaya IX Workforce Engagement v15.2.7.1195 - CWE-601: URL Redirection to Untrusted Site ('Open Redirect') |
CVE-2023-31187 | Medium | 6.5 | 2023-05-30 | Avaya IX Workforce Engagement v15.2.7.1195 - CWE-522: Insufficiently Protected Credentials |
CVE-2023-31186 | Medium | 5.3 | 2023-05-30 | Avaya IX Workforce Engagement v15.2.7.1195 - User Enumeration - Observable Response Discrepancy |
CVE-2023-31185 | High | 7.5 | 2023-05-30 | ROZCOM server framework - Misconfiguration may allow information disclosure via an unspecified request. |
CVE-2023-31184 | Medium | 6.2 | 2023-05-30 | ROZCOM client CWE-798: Use of Hard-coded Credentials |
CVE-2023-29735 | Medium | 5.5 | 2023-05-30 | An issue found in edjing Mix v.7.09.01 for Android allows a local attacker to cause a denial of service via the database files. |
CVE-2023-29734 | Critical | 9.8 | 2023-05-30 | An issue found in edjing Mix v.7.09.01 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the database. |
CVE-2023-29733 | High | 7.8 | 2023-05-30 | The Lock Master app 2.2.4 for Android allows unauthorized apps to modify the values in its SharedPreference files. These files hold data that affects many app… |
CVE-2023-29732 | Critical | 9.8 | 2023-05-30 | SoLive 1.6.14 thru 1.6.20 for Android exists exposed component, the component provides the method to modify the SharedPreference file. The attacker can use the… |
CVE-2023-29731 | High | 7.5 | 2023-05-30 | SoLive 1.6.14 thru 1.6.20 for Android has an exposed component that provides a method to modify the SharedPreference file. An attacker can leverage this method… |
CVE-2023-23956 | Medium | 5.4 | 2023-05-30 | A user can supply malicious HTML and JavaScript code that will be executed in the client browser |
CVE-2023-23561 | Medium | 5.5 | 2023-05-30 | Stormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control: authenticated users can read sensitive information. |
CVE-2023-32699 | Medium | 6.5 | 2023-05-30 | MeterSphere is an open source continuous testing platform. Version 2.9.1 and prior are vulnerable to denial of service. The `checkUserPassword` method is used… |
CVE-2023-32696 | High | 8.8 | 2023-05-30 | CKAN is an open-source data management system for powering data hubs and data portals. Prior to versions 2.9.9 and 2.10.1, the `ckan` user (equivalent to www-d… |
CVE-2023-1711 | Medium | 4.0 | 2023-05-30 | A vulnerability exists in a FOXMAN-UN and UNEM logging component, it only affects systems that use remote authentication to the network elements. If exploited… |