2023 CVEs (page 232)
Page 232 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-33975 | Critical | 9.8 | 2023-05-30 | RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. In version 2023.01 and… |
CVE-2023-33656 | Medium | 5.5 | 2023-05-30 | A memory leak vulnerability exists in NanoMQ 0.17.2. The vulnerability is located in the file message.c. An attacker could exploit this vulnerability to cause… |
CVE-2023-32689 | Medium | 6.3 | 2023-05-30 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 5.4.4 and 6.1.1 are vulnerable to a p… |
CVE-2023-32684 | Low | 2.7 | 2023-05-30 | Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to version 0.16.0, a virtual machine instance with a malicious disk ima… |
CVE-2023-2968 | High | 7.5 | 2023-05-30 | A remote attacker can trigger a denial of service in the socket.remoteAddress variable, by sending a crafted HTTP request. Usage of the undefined variable rais… |
CVE-2023-33974 | High | 7.5 | 2023-05-30 | RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. In versions 2023.01 and… |
CVE-2023-33973 | High | 7.5 | 2023-05-30 | RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. In versions 2023.01 and… |
CVE-2023-29737 | Medium | 5.5 | 2023-05-30 | An issue found in Wave Animated Keyboard Emoji v.1.70.7 for Android allows a local attacker to cause a denial of service via the database files. |
CVE-2023-24826 | Medium | 5.9 | 2023-05-30 | RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.0… |
CVE-2023-23755 | High | 7.5 | 2023-05-30 | An issue was discovered in Joomla! 4.2.0 through 4.3.1. The lack of rate limiting allowed brute force attacks against MFA methods. |
CVE-2023-23754 | Medium | 6.1 | 2023-05-30 | An issue was discovered in Joomla! 4.2.0 through 4.3.1. Lack of input validation caused an open redirect and XSS issue within the new mfa selection screen. |
CVE-2023-32448 | Medium | 5.5 | 2023-05-30 | PowerPath for Windows, versions 7.0, 7.1 & 7.2 contains License Key Stored in Cleartext vulnerability. A local user with access to the installation directory… |
CVE-2023-28080 | Medium | 6.7 | 2023-05-30 | PowerPath for Windows, versions 7.0, 7.1 & 7.2 contains DLL Hijacking Vulnerabilities. A regular user (non-admin) can exploit these issues to potentially esca… |
CVE-2023-28079 | High | 7.0 | 2023-05-30 | PowerPath for Windows, versions 7.0, 7.1 & 7.2 contains Insecure File and Folder Permissions vulnerability. A regular user (non-admin) can exploit the weak fo… |
CVE-2023-24825 | High | 7.5 | 2023-05-30 | RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.0… |
CVE-2023-24817 | High | 7.5 | 2023-05-30 | RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.0… |
CVE-2023-24568 | Medium | 5.0 | 2023-05-30 | Dell NetWorker, contains an Improper Validation of Certificate with Host Mismatch vulnerability in Rabbitmq port which could disallow replacing CA signed cert… |
CVE-2023-20884 | Medium | 6.1 | 2023-05-30 | VMware Workspace ONE Access and VMware Identity Manager contain an insecure redirect vulnerability. An unauthenticated malicious actor may be able to redirect… |
CVE-2023-2984 | High | 8.8 | 2023-05-30 | Path Traversal: '\..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22. |
CVE-2023-2983 | High | 8.8 | 2023-05-30 | Privilege Defined With Unsafe Actions in GitHub repository pimcore/pimcore prior to 10.5.23. |
CVE-2023-2981 | Low | 3.5 | 2023-05-30 | A vulnerability, which was classified as problematic, has been found in Abstrium Pydio Cells 4.2.0. This issue affects some unknown processing of the component… |
CVE-2023-2980 | Medium | 6.3 | 2023-05-30 | A vulnerability classified as critical was found in Abstrium Pydio Cells 4.2.0. This vulnerability affects unknown code of the component User Creation Handler… |
CVE-2023-2979 | Medium | 4.7 | 2023-05-30 | A vulnerability classified as critical has been found in Abstrium Pydio Cells 4.2.0. This affects an unknown part of the component User Creation Handler. The m… |
CVE-2023-2978 | Medium | 4.6 | 2023-05-30 | A vulnerability was found in Abstrium Pydio Cells 4.2.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the componen… |
CVE-2023-2650 | Medium | 6.5 | 2023-05-30 | Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_… |
CVE-2023-30196 | High | 7.5 | 2023-05-30 | Prestashop salesbooster <= 1.10.4 is vulnerable to Incorrect Access Control via modules/salesbooster/downloads/download.php. |
CVE-2023-33234 | High | 7.2 | 2023-05-30 | Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection… |
CVE-2023-2973 | Low | 2.4 | 2023-05-30 | A vulnerability, which was classified as problematic, has been found in SourceCodester Students Online Internship Timesheet Syste 1.0. Affected by this issue i… |
CVE-2023-2972 | Critical | 9.8 | 2023-05-30 | Prototype Pollution in GitHub repository antfu/utils prior to 0.7.3. |
CVE-2023-30601 | High | 7.8 | 2023-05-30 | Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the user running Apache Cassandra This issue affects… |
CVE-2023-2518 | Medium | 6.1 | 2023-05-30 | The Easy Forms for Mailchimp WordPress plugin before 6.8.9 does not sanitise and escape a parameter before outputting it back in the page when the debug option… |
CVE-2023-2470 | Medium | 4.8 | 2023-05-30 | The Add to Feedly WordPress plugin through 1.2.11 does not sanitize and escape its settings, allowing high-privilege users such as admin to perform Cross-Site… |
CVE-2023-2296 | Medium | 6.1 | 2023-05-30 | The Loginizer WordPress plugin before 1.7.9 does not escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting whic… |
CVE-2023-2288 | High | 8.8 | 2023-05-30 | The Otter WordPress plugin before 2.2.6 does not sanitize some user-controlled file paths before performing file operations on them. This leads to a PHAR deser… |
CVE-2023-2287 | Medium | 4.3 | 2023-05-30 | The Orbit Fox by ThemeIsle WordPress plugin before 2.10.24 does not limit URLs which may be used for the stock photo import feature, allowing the user to speci… |
CVE-2023-2256 | Medium | 6.1 | 2023-05-30 | The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.7 does not sanitize and escape some URL parameters, leading to Reflected Cross-Site Sc… |
CVE-2023-2223 | Medium | 4.8 | 2023-05-30 | The Login rebuilder WordPress plugin before 2.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2023-2117 | Low | 2.7 | 2023-05-30 | The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the get_subdirs ajax action, allowing a high priv… |
CVE-2023-2113 | Medium | 4.8 | 2023-05-30 | The Autoptimize WordPress plugin before 3.1.7 does not sanitise and escape the settings imported from a previous export, allowing high privileged users (such a… |
CVE-2023-2111 | Medium | 4.9 | 2023-05-30 | The Fast & Effective Popups & Lead-Generation for WordPress plugin before 2.1.4 concatenates user input into an SQL query without escaping it first in the plug… |
CVE-2023-2023 | Medium | 6.1 | 2023-05-30 | The Custom 404 Pro WordPress plugin before 3.7.3 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting. |
CVE-2023-1938 | High | 8.8 | 2023-05-30 | The WP Fastest Cache WordPress plugin before 1.1.5 does not have CSRF check in an AJAX action, and does not validate user input before using it in the wp_remot… |
CVE-2023-1524 | Medium | 6.5 | 2023-05-30 | The Download Manager WordPress plugin before 3.2.71 does not adequately validate passwords for password-protected files. Upon validation, a master key is gener… |
CVE-2023-0766 | High | 8.8 | 2023-05-30 | The Newsletter Popup WordPress plugin through 1.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwante… |
CVE-2023-0733 | Medium | 6.1 | 2023-05-30 | The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow unauthenticated users to perform Stored… |
CVE-2023-0443 | Medium | 5.3 | 2023-05-30 | The AnyWhere Elementor WordPress plugin before 1.2.8 discloses a Freemius Secret Key which could be used by an attacker to purchase the pro subscription using… |
CVE-2023-0329 | High | 7.2 | 2023-05-30 | The Elementor Website Builder WordPress plugin before 3.12.2 does not properly sanitize and escape the Replace URL parameter in the Tools module before using i… |
CVE-2023-33955 | Medium | 4.3 | 2023-05-30 | Minio Console is the UI for MinIO Object Storage. Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename. This issue has been patc… |
CVE-2023-33191 | Medium | 4.6 | 2023-05-30 | Kyverno is a policy engine designed for Kubernetes. Kyverno seccomp control can be circumvented. Users of the podSecurity `validate.podSecurity` subrule in Kyv… |
CVE-2023-33193 | Critical | 9.1 | 2023-05-30 | Emby Server is a user-installable home media server which stores and organizes a user's media files of virtually any format and makes them available for viewin… |
CVE-2023-33189 | Critical | 10.0 | 2023-05-30 | Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue… |
CVE-2023-33186 | High | 8.2 | 2023-05-30 | Zulip is an open-source team collaboration tool with unique topic-based threading that combines the best of email and chat to make remote work productive and d… |
CVE-2023-33183 | Low | 2.6 | 2023-05-30 | Calendar app for Nextcloud easily sync events from various devices with your Nextcloud. Some internal paths of the website are disclosed when the SMTP server i… |
CVE-2023-2970 | Low | 3.5 | 2023-05-30 | A vulnerability classified as problematic was found in MindSpore 2.0.0-alpha/2.0.0-rc1. This vulnerability affects the function JsonHelper::UpdateArray of the… |
CVE-2023-33245 | High | 8.8 | 2023-05-30 | Minecraft through 1.19 and 1.20 pre-releases before 7 (Java) allow arbitrary file overwrite, and possibly code execution, via crafted world data that contains… |
CVE-2023-33198 | Medium | 6.1 | 2023-05-30 | tgstation-server is a production scale tool for BYOND server management. The DreamMaker API (DMAPI) chat channel cache can possibly be poisoned by a tgstation-… |
CVE-2023-33182 | Unrated | | 2023-05-30 | Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. The unsanitized SVG is converted to a JavaScript… |
CVE-2023-33175 | Critical | 9.1 | 2023-05-30 | ToUI is a Python package for creating user interfaces (websites and desktop apps) from HTML. ToUI is using Flask-Caching (SimpleCache) to store user variables… |
CVE-2023-32685 | Medium | 4.4 | 2023-05-30 | Kanboard is project management software that focuses on the Kanban methodology. Due to improper handling of elements under the `contentEditable` element, malic… |
CVE-2023-26130 | High | 7.5 | 2023-05-30 | Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the content-type header in… |
CVE-2023-34205 | Critical | 9.1 | 2023-05-30 | In Moov signedxml through 1.0.0, parsing the raw XML (as received) can result in different output than parsing the canonicalized XML. Thus, signature validatio… |
CVE-2023-34204 | Medium | 6.5 | 2023-05-30 | imapsync through 2.229 uses predictable paths under /tmp and /var/tmp in its default mode of operation. Both of these are typically world-writable, and thus (f… |
CVE-2023-32698 | High | 7.1 | 2023-05-30 | nFPM is an alternative to fpm. The file permissions on the checked-in files were not maintained. Hence, when nfpm packaged the files (without extra config for… |
CVE-2023-32692 | Critical | 9.8 | 2023-05-30 | CodeIgniter is a PHP full-stack web framework. This vulnerability allows attackers to execute arbitrary code when you use Validation Placeholders. The vulnerab… |
CVE-2023-32691 | Medium | 5.9 | 2023-05-30 | gost (GO Simple Tunnel) is a simple tunnel written in golang. Sensitive secrets such as passwords, token and API keys should be compared only using a constant-… |
CVE-2023-27988 | High | 7.2 | 2023-05-30 | The post-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.13)C0 could allow an authenticated attacker w… |
CVE-2023-32687 | High | 7.7 | 2023-05-29 | tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12.1, instance users with the list chat bots permiss… |
CVE-2023-32072 | Medium | 4.8 | 2023-05-29 | Tuleap is an open source tool for end to end traceability of application and system developments. Tuleap Community Edition prior to version 14.8.99.60 and Tule… |
CVE-2023-30253 | High | 8.8 | 2023-05-29 | Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instead of <?php in injected data. |
CVE-2023-30571 | Low | 3.9 | 2023-05-29 | Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the… |
CVE-2023-27613 | High | 7.1 | 2023-05-29 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in MonitorClick Forms Ada – Form Builder plugin <= 1.0 versions. |
CVE-2023-23699 | Medium | 6.5 | 2023-05-29 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Chris Reynolds Progress Bar plugin <= 2.2.1 versions. |
CVE-2023-2962 | Medium | 4.7 | 2023-05-29 | A vulnerability, which was classified as critical, has been found in SourceCodester Faculty Evaluation System 1.0. Affected by this issue is some unknown funct… |
CVE-2023-2808 | Medium | 4.3 | 2023-05-29 | Mattermost fails to normalize UTF confusable characters when determining if a preview should be generated for a hyperlink, allowing an attacker to trigger link… |
CVE-2023-2955 | Medium | 6.3 | 2023-05-29 | A vulnerability, which was classified as critical, was found in SourceCodester Students Online Internship Timesheet System 1.0. Affected is an unknown function… |
CVE-2023-2954 | Medium | 5.4 | 2023-05-29 | Cross-site Scripting (XSS) - Stored in GitHub repository liangliangyy/djangoblog prior to master. |
CVE-2023-24605 | Medium | 4.2 | 2023-05-29 | OX App Suite before backend 7.10.6-rev37 does not enforce 2FA for all endpoints, e.g., reading from a drive, reading contact data, and renaming tokens. |
CVE-2023-24604 | Medium | 4.3 | 2023-05-29 | OX App Suite before backend 7.10.6-rev37 does not check HTTP header lengths when downloading, e.g., potentially allowing a crafted iCal feed to provide an unli… |
CVE-2023-24603 | Medium | 6.5 | 2023-05-29 | OX App Suite before backend 7.10.6-rev37 does not check size limits when downloading, e.g., potentially allowing a crafted iCal feed to provide an unlimited am… |
CVE-2023-24602 | Medium | 6.1 | 2023-05-29 | OX App Suite before frontend 7.10.6-rev24 allows XSS via data to the Tumblr portal widget, such as a post title. |
CVE-2023-24601 | Medium | 6.1 | 2023-05-29 | OX App Suite before frontend 7.10.6-rev24 allows XSS via a non-app deeplink such as the jslob API's registry sub-tree. |
CVE-2023-24600 | Medium | 4.3 | 2023-05-29 | OX App Suite before backend 7.10.6-rev37 allows authenticated users to bypass access controls (for reading contacts) via a move to their own address book. |
CVE-2023-24599 | Medium | 4.3 | 2023-05-29 | OX App Suite before backend 7.10.6-rev37 allows authenticated users to change the appointments of arbitrary users via conflicting ID numbers, aka "ID confusion… |
CVE-2023-24598 | Medium | 4.3 | 2023-05-29 | OX App Suite before backend 7.10.6-rev37 has an information leak in the handling of distribution lists, e.g., partial disclosure of the private contacts of ano… |
CVE-2023-24597 | Medium | 5.3 | 2023-05-29 | OX App Suite before frontend 7.10.6-rev24 allows the loading (without user consent) of an e-mail message's remote resources during printing. |
CVE-2023-28153 | Medium | 6.4 | 2023-05-29 | An issue was discovered in the Kiddoware Kids Place Parental Control application before 3.8.50 for Android. The child can remove all restrictions temporarily w… |
CVE-2023-31874 | High | 8.8 | 2023-05-29 | Yank Note (YN) 3.52.1 allows execution of arbitrary code when a crafted file is opened, e.g., via nodeRequire('child_process'). |
CVE-2023-30570 | High | 7.5 | 2023-05-29 | pluto in Libreswan before 4.11 allows a denial of service (responder SPI mishandling and daemon crash) via unauthenticated IKEv1 Aggressive Mode packets. The e… |
CVE-2023-30350 | High | 8.8 | 2023-05-29 | FS S3900-24T4S devices allow authenticated attackers with guest access to escalate their privileges and reset the admin password. |
CVE-2023-29380 | High | 7.5 | 2023-05-29 | Warpinator before 1.6.0 allows remote file deletion via directory traversal in top_dir_basenames. |
CVE-2023-32763 | High | 7.5 | 2023-05-28 | An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. When a SVG file with an image inside it is rendered, a QT… |
CVE-2023-32762 | Medium | 5.3 | 2023-05-28 | An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt Network incorrectly parses the strict-transport-securi… |
CVE-2023-31873 | High | 7.8 | 2023-05-28 | Gin 0.7.4 allows execution of arbitrary code when a crafted file is opened, e.g., via require('child_process'). |
CVE-2023-33291 | High | 7.4 | 2023-05-28 | In ebankIT 6, the public endpoints /public/token/Email/generate and /public/token/SMS/generate allow generation of OTP messages to any e-mail address or phone… |
CVE-2023-33926 | High | 7.1 | 2023-05-28 | Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Easy Google Maps plugin <= 1.11.7 versions. |
CVE-2023-33332 | High | 7.1 | 2023-05-28 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Product Vendors plugin <= 2.1.76 versions. |
CVE-2023-33319 | High | 7.1 | 2023-05-28 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 versions. |
CVE-2023-33316 | Medium | 5.4 | 2023-05-28 | Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 versions. |
CVE-2023-33313 | Medium | 4.3 | 2023-05-28 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeinProgress WIP Custom Login plugin <= 1.2.9 versions. |
CVE-2023-33311 | Medium | 6.5 | 2023-05-28 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in CRM Perks Contact Form Entries plugin <= 1.3.0 versions. |