2023 CVEs (page 233)
Page 233 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-33211 | Medium | 5.9 | 2023-05-28 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in André Bräkling WP-Matomo Integration (WP-Piwik) plugin <= 1.0.27 versions. |
CVE-2023-32800 | High | 7.1 | 2023-05-28 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in One Rank Math SEO PRO plugin <= 3.0.35 versions. |
CVE-2023-28785 | Medium | 6.5 | 2023-05-28 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Yoast Yoast SEO: Local plugin <= 14.9 versions. |
CVE-2023-33931 | Medium | 4.3 | 2023-05-28 | Cross-Site Request Forgery (CSRF) vulnerability in Ciprian Popescu YouTube Playlist Player plugin <= 4.6.4 versions. |
CVE-2023-33328 | Medium | 5.9 | 2023-05-28 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PluginOps MailChimp Subscribe Form plugin <= 4.0.9.1 versions. |
CVE-2023-33326 | High | 7.1 | 2023-05-28 | Unauth. Reflected (XSS) Cross-Site Scripting (XSS) vulnerability in EventPrime plugin <= 2.8.6 versions. |
CVE-2023-33315 | Medium | 5.4 | 2023-05-28 | Cross-Site Request Forgery (CSRF) vulnerability in Stephen Darlington, Wandle Software Limited Smart App Banner plugin <= 1.1.2 versions. |
CVE-2023-33314 | Medium | 6.5 | 2023-05-28 | Cross-Site Request Forgery (CSRF) vulnerability in realmag777 BEAR plugin <= 1.1.3.1 versions. |
CVE-2023-33309 | High | 7.1 | 2023-05-28 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Awesome Motive Duplicator Pro plugin <= 4.5.11 versions. |
CVE-2023-33212 | Medium | 4.3 | 2023-05-28 | Cross-Site Request Forgery (CSRF) vulnerability in Crocoblock JetFormBuilder — Dynamic Blocks Form Builder plugin <= 3.0.6 versions. |
CVE-2023-32958 | Medium | 5.9 | 2023-05-28 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Nose Graze Novelist plugin <= 1.2.0 versions. |
CVE-2023-33216 | Medium | 5.9 | 2023-05-28 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gVectors Team WooDiscuz – WooCommerce Comments woodiscuz-woocommerce-comments allows Stored X… |
CVE-2023-2951 | Medium | 6.3 | 2023-05-28 | A vulnerability classified as critical has been found in code-projects Bus Dispatch and Information System 1.0. Affected is an unknown function of the file del… |
CVE-2023-2950 | High | 8.1 | 2023-05-28 | Improper Authorization in GitHub repository openemr/openemr prior to 7.0.1. |
CVE-2023-2949 | Medium | 6.1 | 2023-05-28 | Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.1. |
CVE-2023-2948 | Medium | 6.1 | 2023-05-28 | Cross-site Scripting (XSS) - Generic in GitHub repository openemr/openemr prior to 7.0.1. |
CVE-2023-2947 | Medium | 4.8 | 2023-05-27 | Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.1. |
CVE-2023-2946 | High | 8.1 | 2023-05-27 | Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1. |
CVE-2023-2945 | Medium | 5.4 | 2023-05-27 | Missing Authorization in GitHub repository openemr/openemr prior to 7.0.1. |
CVE-2023-2944 | Medium | 5.4 | 2023-05-27 | Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1. |
CVE-2023-2943 | High | 8.8 | 2023-05-27 | Code Injection in GitHub repository openemr/openemr prior to 7.0.1. |
CVE-2023-2942 | High | 8.1 | 2023-05-27 | Improper Input Validation in GitHub repository openemr/openemr prior to 7.0.1. |
CVE-2023-32695 | High | 7.3 | 2023-05-27 | socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet… |
CVE-2023-2928 | Medium | 6.3 | 2023-05-27 | A vulnerability was found in DedeCMS up to 5.7.106. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file up… |
CVE-2023-2927 | Medium | 6.3 | 2023-05-27 | A vulnerability was found in JIZHICMS 2.4.5. It has been classified as critical. Affected is the function index of the file TemplateController.php. The manipul… |
CVE-2023-2926 | Medium | 5.4 | 2023-05-27 | A vulnerability was found in SeaCMS 11.6 and classified as problematic. This issue affects some unknown processing of the file member.php of the component Pict… |
CVE-2023-2925 | Low | 2.4 | 2023-05-27 | A vulnerability, which was classified as problematic, was found in Webkul krayin crm 1.2.4. This affects an unknown part of the file /admin/contacts/organizati… |
CVE-2023-2924 | Medium | 4.7 | 2023-05-27 | A vulnerability, which was classified as critical, has been found in Supcon SimField up to 1.80.00.00. Affected by this issue is some unknown functionality of… |
CVE-2023-2923 | Medium | 6.3 | 2023-05-27 | A vulnerability classified as critical was found in Tenda AC6 US_AC6V1.0BR_V15.03.05.19. Affected by this vulnerability is the function fromDhcpListClient. The… |
CVE-2023-2922 | Low | 3.5 | 2023-05-27 | A vulnerability classified as problematic has been found in SourceCodester Comment System 1.0. Affected is an unknown function of the file index.php of the com… |
CVE-2023-33184 | Low | 3.5 | 2023-05-27 | Nextcloud Mail is a mail app in Nextcloud. A blind SSRF attack allowed to send GET requests to services running in the same web server. It is recommended that… |
CVE-2023-26129 | High | 8.4 | 2023-05-27 | All versions of the package bwm-ng are vulnerable to Command Injection due to improper input sanitization in the 'check' function in the bwm-ng.js file. **No… |
CVE-2023-26128 | High | 8.4 | 2023-05-27 | All versions of the package keep-module-latest are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employ… |
CVE-2023-26127 | High | 7.8 | 2023-05-27 | All versions of the package n158 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports' function. **Note:** To execut… |
CVE-2023-33195 | Medium | 5.0 | 2023-05-27 | Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6. |
CVE-2023-33192 | High | 7.5 | 2023-05-27 | ntpd-rs is an NTP implementation written in Rust. ntpd-rs does not validate the length of NTS cookies in received NTP packets to the server. An attacker can cr… |
CVE-2023-33188 | Medium | 6.3 | 2023-05-27 | Omni-notes is an open source note-taking application for Android. The Omni-notes Android app had an insufficient path validation vulnerability when displaying… |
CVE-2023-32688 | Medium | 4.9 | 2023-05-27 | parse-server-push-adapter is the official Push Notification adapter for Parse Server. The Parse Server Push Adapter can crash Parse Server due to an invalid pu… |
CVE-2023-32686 | High | 8.1 | 2023-05-27 | Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS allows users to upload attachments to test plans, test case… |
CVE-2023-32325 | Medium | 5.4 | 2023-05-27 | PostHog-js is a library to interface with the PostHog analytics tool. Versions prior to 1.57.2 have the potential for cross-site scripting. Problem has been pa… |
CVE-2023-33199 | Medium | 5.3 | 2023-05-26 | Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed proposed entry of… |
CVE-2023-32676 | Medium | 6.7 | 2023-05-26 | Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was found in the Install assessment functiona… |
CVE-2023-32321 | Critical | 9.8 | 2023-05-26 | CKAN is an open-source data management system for powering data hubs and data portals. Multiple vulnerabilities have been discovered in Ckan which may lead to… |
CVE-2023-32319 | High | 8.1 | 2023-05-26 | Nextcloud server is an open source personal cloud implementation. Missing brute-force protection on the WebDAV endpoints via the basic auth header allowed to b… |
CVE-2023-32317 | Medium | 6.7 | 2023-05-26 | Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was found in the MOSS cheat checker functiona… |
CVE-2023-32316 | High | 7.1 | 2023-05-26 | CloudExplorer Lite is an open source cloud management tool. In affected versions users can add themselves to any organization in CloudExplorer Lite. This is du… |
CVE-2023-32315 | High | 8.6 | 2023-05-26 | Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerabl… |
CVE-2023-32311 | High | 7.1 | 2023-05-26 | CloudExplorer Lite is an open source cloud management platform. In CloudExplorer Lite prior to version 1.1.0 users organization/workspace permissions are not p… |
CVE-2023-32307 | High | 7.5 | 2023-05-26 | Sofia-SIP is an open-source SIP User-Agent library, compliant with the IETF RFC3261 specification. Referring to [GHSA-8599-x7rq-fr54](https://github.com/freesw… |
CVE-2023-31128 | High | 8.1 | 2023-05-26 | NextCloud Cookbook is a recipe library app. Prior to commit a46d9855 on the `master` branch and commit 489bb744 on the `main-0.9.x` branch, the `pull-checks.ym… |
CVE-2023-2898 | Medium | 4.7 | 2023-05-26 | There is a null-pointer-dereference flaw found in f2fs_write_end_io in fs/f2fs/data.c in the Linux kernel. This flaw allows a local privileged user to cause a… |
CVE-2023-27311 | Medium | 5.3 | 2023-05-26 | NetApp Blue XP Connector versions prior to 3.9.25 expose information via a directory listing. A new Connector architecture resolves this issue - obtaining the… |
CVE-2023-21516 | High | 7.5 | 2023-05-26 | XSS vulnerability from InstantPlay in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from Galaxy Store. |
CVE-2023-21515 | High | 7.5 | 2023-05-26 | InstantPlay which included vulnerable script which could execute javascript in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript AP… |
CVE-2023-21514 | High | 7.5 | 2023-05-26 | Improper scheme validation from InstantPlay Deeplink in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from G… |
CVE-2023-33196 | Medium | 5.5 | 2023-05-26 | Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4… |
CVE-2023-33194 | Low | 3.7 | 2023-05-26 | Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message… |
CVE-2023-33187 | Medium | 5.4 | 2023-05-26 | Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `… |
CVE-2023-33185 | Medium | 4.6 | 2023-05-26 | Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library export… |
CVE-2023-2879 | Medium | 6.3 | 2023-05-26 | GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file |
CVE-2023-2858 | Medium | 5.3 | 2023-05-26 | NetScaler file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file |
CVE-2023-2857 | Medium | 5.3 | 2023-05-26 | BLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file |
CVE-2023-2856 | Medium | 5.3 | 2023-05-26 | VMS TCPIPtrace file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file |
CVE-2023-2855 | Medium | 5.3 | 2023-05-26 | Candump log parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file |
CVE-2023-2854 | Medium | 5.3 | 2023-05-26 | BLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file |
CVE-2023-2825 | Critical | 10.0 | 2023-05-26 | An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a path traversal vulnerability to read ar… |
CVE-2023-28322 | Low | 3.7 | 2023-05-26 | An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNC… |
CVE-2023-28321 | Medium | 5.9 | 2023-05-26 | An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternativ… |
CVE-2023-28320 | Medium | 5.9 | 2023-05-26 | A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build tim… |
CVE-2023-28319 | High | 7.5 | 2023-05-26 | A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this… |
CVE-2023-33255 | Medium | 6.1 | 2023-05-26 | An issue was discovered in Papaya Viewer 1.0.1449. User-supplied input in form of DICOM or NIFTI images can be loaded into the Papaya web application without a… |
CVE-2023-33247 | High | 7.5 | 2023-05-26 | Talend Data Catalog remote harvesting server before 8.0-20230413 contains a /upgrade endpoint that allows an unauthenticated WAR file to be deployed on the ser… |
CVE-2023-33197 | Medium | 5.5 | 2023-05-26 | Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update Asset Index utility. This issue h… |
CVE-2023-32681 | Medium | 6.1 | 2023-05-26 | Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endp… |
CVE-2023-32318 | High | 7.2 | 2023-05-26 | Nextcloud server provides a home for data. A regression in the session handling between Nextcloud Server and the Nextcloud Text app prevented a correct destruc… |
CVE-2023-2283 | Medium | 6.5 | 2023-05-26 | A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memo… |
CVE-2023-22970 | High | 7.8 | 2023-05-26 | Bottles before 51.0 mishandles YAML load, which allows remote code execution via a crafted file. |
CVE-2023-20868 | Medium | 6.1 | 2023-05-26 | NSX-T contains a reflected cross-site scripting vulnerability due to a lack of input validation. A remote attacker can inject HTML or JavaScript to redirect to… |
CVE-2023-1981 | Medium | 5.5 | 2023-05-26 | A vulnerability was found in the avahi library. This flaw allows an unprivileged user to make a dbus call, causing the avahi daemon to crash. |
CVE-2023-1667 | Medium | 6.5 | 2023-05-26 | A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cause a denial of serv… |
CVE-2023-1664 | Medium | 6.5 | 2023-05-26 | A flaw was found in Keycloak. This flaw depends on a non-default configuration "Revalidate Client Certificate" to be enabled and the reverse proxy is not valid… |
CVE-2023-33780 | Medium | 5.4 | 2023-05-26 | A stored cross-site scripting (XSS) vulnerability in TFDi Design smartCARS 3 v0.7.0 and below allows attackers to execute arbitrary web scripts or HTML via inj… |
CVE-2023-33779 | High | 8.8 | 2023-05-26 | A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crafted POST request… |
CVE-2023-31227 | High | 7.5 | 2023-05-26 | The hwPartsDFR module has a vulnerability in API calling verification. Successful exploitation of this vulnerability may affect device confidentiality. |
CVE-2023-31226 | High | 7.5 | 2023-05-26 | The SDK for the MediaPlaybackController module has improper permission verification. Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2023-31225 | Low | 3.3 | 2023-05-26 | The Gallery app has the risk of hijacking attacks. Successful exploitation of this vulnerability may cause download failures and affect product availability. |
CVE-2023-2817 | Medium | 5.4 | 2023-05-26 | A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11. HTML, including script tags can be injected into field… |
CVE-2023-2002 | Medium | 6.8 | 2023-05-26 | A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows… |
CVE-2023-20883 | High | 7.5 | 2023-05-26 | In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-servic… |
CVE-2023-20882 | Medium | 5.9 | 2023-05-26 | In Cloud foundry routing release versions from 0.262.0 and prior to 0.266.0,a bug in the gorouter process can lead to a denial of service of applications hoste… |
CVE-2023-0117 | Medium | 5.3 | 2023-05-26 | The online authentication provided by the hwKitAssistant lacks strict identity verification of applications. Successful exploitation of this vulnerability may… |
CVE-2023-0116 | High | 7.5 | 2023-05-26 | The reminder module lacks an authentication mechanism for broadcasts received. Successful exploitation of this vulnerability may affect availability. |
CVE-2023-33720 | Medium | 6.5 | 2023-05-26 | mp4v2 v2.1.2 was discovered to contain a memory leak via the class MP4BytesProperty. |
CVE-2023-33440 | High | 7.2 | 2023-05-26 | Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via /eval/ajax.php?action=save_user. |
CVE-2023-33439 | High | 7.2 | 2023-05-26 | Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/manage_task.php?id=. |
CVE-2023-33394 | Medium | 5.4 | 2023-05-26 | skycaiji v2.5.4 is vulnerable to Cross Site Scripting (XSS). Attackers can achieve backend XSS by deploying malicious JSON data. |
CVE-2023-32964 | Medium | 4.3 | 2023-05-26 | Cross-Site Request Forgery (CSRF) vulnerability in Made with Fuel Better Notifications for WP plugin <= 1.9.2 versions. |
CVE-2023-30145 | Critical | 9.8 | 2023-05-26 | Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter. |
CVE-2023-29098 | High | 7.1 | 2023-05-26 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ArtistScope CopySafe Web Protection plugin <= 3.13 versions. |
CVE-2023-25467 | Medium | 5.4 | 2023-05-26 | Cross-Site Request Forgery (CSRF) vulnerability in Daniel Mores, A. Huizinga Resize at Upload Plus plugin <= 1.3 versions. |