2023 CVEs (page 234)
Page 234 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-25058 | Medium | 4.3 | 2023-05-26 | Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force Schema – All In One Schema Rich Snippets plugin <= 1.6.5 versions. |
CVE-2023-25034 | Medium | 4.3 | 2023-05-26 | Cross-Site Request Forgery (CSRF) vulnerability in BoLiQuan WP Clean Up plugin <= 1.2.3 versions. |
CVE-2023-32323 | Medium | 5.0 | 2023-05-26 | Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X with permission to… |
CVE-2023-25470 | Medium | 4.3 | 2023-05-26 | Cross-Site Request Forgery (CSRF) vulnerability in Anton Skorobogatov Rus-To-Lat plugin <= 0.3 versions. |
CVE-2023-25029 | Medium | 4.3 | 2023-05-26 | Cross-Site Request Forgery (CSRF) vulnerability in utahta WP Social Bookmarking Light plugin <= 2.0.7 versions. |
CVE-2023-25038 | Medium | 4.3 | 2023-05-26 | Cross-Site Request Forgery (CSRF) vulnerability in 984.Ru For the visually impaired plugin <= 0.58 versions. |
CVE-2023-24008 | Medium | 4.3 | 2023-05-26 | Cross-Site Request Forgery (CSRF) vulnerability in yonifre Maspik – Spam Blacklist plugin <= 0.7.8 versions. |
CVE-2023-22693 | Medium | 4.3 | 2023-05-26 | Cross-Site Request Forgery (CSRF) vulnerability in conlabzgmbh WP Google Tag Manager plugin <= 1.1 versions. |
CVE-2023-25976 | Medium | 4.3 | 2023-05-26 | Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for Contact Form 7 and Zoho CRM, Bigin plugin <= 1.2.2 versions. |
CVE-2023-25971 | Medium | 4.3 | 2023-05-26 | Cross-Site Request Forgery (CSRF) vulnerability in FixBD Educare plugin <= 1.4.1 versions. |
CVE-2023-25781 | Medium | 5.9 | 2023-05-26 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Sebastian Krysmanski Upload File Type Settings plugin <= 1.1 versions. |
CVE-2023-24007 | Medium | 4.3 | 2023-05-26 | Cross-Site Request Forgery (CSRF) vulnerability in TheOnlineHero - Tom Skroza Admin Block Country plugin <= 7.1.4 versions. |
CVE-2023-23714 | Medium | 4.3 | 2023-05-26 | Cross-Site Request Forgery (CSRF) vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash plugin <= 3.6.4.1 versions. |
CVE-2023-28382 | High | 8.1 | 2023-05-26 | Directory traversal vulnerability in ESS REC Agent Server Edition series allows an authenticated attacker to view or alter an arbitrary file on the server. Aff… |
CVE-2023-32074 | High | 8.0 | 2023-05-25 | user_oidc app is an OpenID Connect user backend for Nextcloud. Authentication can be broken/bypassed in user_oidc app. It is recommended that the Nextcloud use… |
CVE-2023-32067 | High | 7.5 | 2023-05-25 | c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP… |
CVE-2023-2903 | Medium | 4.3 | 2023-05-25 | A vulnerability classified as problematic has been found in NFine Rapid Development Platform 20230511. This affects an unknown part of the file /SystemManage/R… |
CVE-2023-31147 | Medium | 5.9 | 2023-05-25 | c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS que… |
CVE-2023-31130 | Medium | 4.1 | 2023-05-25 | c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular "0::00:00:00/2"… |
CVE-2023-31124 | Low | 3.7 | 2023-05-25 | c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when c… |
CVE-2023-2902 | Medium | 4.3 | 2023-05-25 | A vulnerability was found in NFine Rapid Development Platform 20230511. It has been rated as problematic. Affected by this issue is some unknown functionality… |
CVE-2023-2901 | Medium | 4.3 | 2023-05-25 | A vulnerability was found in NFine Rapid Development Platform 20230511. It has been declared as problematic. Affected by this vulnerability is an unknown funct… |
CVE-2023-2804 | Medium | 6.5 | 2023-05-25 | A heap-based buffer overflow issue was discovered in libjpeg-turbo in h2v2_merged_upsample_internal() function of jdmrgext.c file. The vulnerability can only b… |
CVE-2023-2900 | Low | 3.7 | 2023-05-25 | A vulnerability was found in NFine Rapid Development Platform 20230511. It has been classified as problematic. Affected is an unknown function of the file /Log… |
CVE-2023-33280 | Critical | 9.8 | 2023-05-25 | In the Store Commander scquickaccounting module for PrestaShop through 3.7.3, multiple sensitive SQL calls can be executed with a trivial HTTP request and expl… |
CVE-2023-33279 | Critical | 9.8 | 2023-05-25 | In the Store Commander scfixmyprestashop module through 2023-05-09 for PrestaShop, sensitive SQL calls can be executed with a trivial HTTP request and exploite… |
CVE-2023-33278 | Critical | 9.8 | 2023-05-25 | In the Store Commander scexportcustomers module for PrestaShop through 3.6.1, sensitive SQL calls can be executed with a trivial HTTP request and exploited to… |
CVE-2023-33263 | High | 7.5 | 2023-05-25 | In WFTPD 3.25, usernames and password hashes are stored in an openly viewable wftpd.ini configuration file within the WFTPD directory. NOTE: this is a product… |
CVE-2023-2255 | Medium | 5.3 | 2023-05-25 | Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to… |
CVE-2023-25439 | Medium | 6.1 | 2023-05-25 | Stored Cross Site Scripting (XSS) vulnerability in Square Pig FusionInvoice 2023-1.0, allows attackers to execute arbitrary code via the description or content… |
CVE-2023-0950 | High | 7.8 | 2023-05-25 | Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation LibreOffice allows an attacker to craft a spreadsheet… |
CVE-2023-26216 | Critical | 9.1 | 2023-05-25 | The server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an exploitable vulnerability that allows an attacker to upload files to a directory ac… |
CVE-2023-26215 | High | 7.7 | 2023-05-25 | The server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains a vulnerability that allows an attacker with low-privileged application access to rea… |
CVE-2023-30851 | Low | 2.6 | 2023-05-25 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to… |
CVE-2023-30615 | Medium | 6.3 | 2023-05-25 | Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. A stored Cross-Site Scripting (XSS) vu… |
CVE-2023-33751 | Medium | 5.4 | 2023-05-25 | A stored cross-site scripting (XSS) vulnerability in mipjz v5.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into… |
CVE-2023-33750 | Medium | 5.4 | 2023-05-25 | A stored cross-site scripting (XSS) vulnerability in mipjz v5.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into… |
CVE-2023-32694 | Medium | 4.8 | 2023-05-25 | Saleor Core is a composable, headless commerce API. Saleor's `validate_hmac_signature` function is vulnerable to timing attacks. Malicious users could abuse th… |
CVE-2023-33356 | Medium | 5.4 | 2023-05-25 | IceCMS v1.0.0 is vulnerable to Cross Site Scripting (XSS). |
CVE-2023-33355 | High | 7.5 | 2023-05-25 | IceCMS v1.0.0 has Insecure Permissions. There is unauthorized access to the API, resulting in the disclosure of sensitive information. |
CVE-2023-2851 | Critical | 9.8 | 2023-05-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AGT Tech Ceppatron allows Command Line Execution through… |
CVE-2023-2798 | High | 7.5 | 2023-05-25 | Those using HtmlUnit to browse untrusted webpages may be vulnerable to Denial of service attacks (DoS). If HtmlUnit is running on user supplied web pages, an a… |
CVE-2023-2480 | High | 7.5 | 2023-05-25 | Missing access permissions checks in M-Files Client before 23.5.12598.0 (excluding 23.2 SR2 and newer) allows elevation of privilege via UI extension applicati… |
CVE-2023-22504 | Medium | 6.5 | 2023-05-25 | Affected versions of Atlassian Confluence Server allow remote attackers who have read permissions to a page, but not write permissions, to upload attachments v… |
CVE-2023-0459 | Medium | 6.5 | 2023-05-25 | Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec allowing a user to bypass the "access_ok" check and pass a… |
CVE-2023-2888 | Medium | 4.7 | 2023-05-25 | A vulnerability, which was classified as problematic, was found in PHPOK 6.4.100. This affects an unknown part of the file /admin.php?c=upload&f=zip&_noCache=0… |
CVE-2023-30484 | Medium | 4.3 | 2023-05-25 | Cross-Site Request Forgery (CSRF) vulnerability in uPress Enable Accessibility plugin <= 1.4 versions. |
CVE-2023-28370 | Medium | 6.1 | 2023-05-25 | Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and cond… |
CVE-2023-27529 | High | 7.8 | 2023-05-25 | Wacom Tablet Driver installer prior to 6.4.2-1 (for macOS) contains an improper link resolution before file access vulnerability. When a user is tricked to exe… |
CVE-2023-2887 | Critical | 9.8 | 2023-05-25 | Authentication Bypass by Spoofing vulnerability in CBOT Chatbot allows Authentication Bypass. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3… |
CVE-2023-2886 | Medium | 4.3 | 2023-05-25 | Missing Origin Validation in WebSockets vulnerability in CBOT Chatbot allows Content Spoofing Via Application API Manipulation. This issue affects Chatbot: be… |
CVE-2023-2885 | High | 8.1 | 2023-05-25 | Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in CBOT Chatbot allows Adversary in the Middle (AiTM). … |
CVE-2023-2884 | Critical | 9.8 | 2023-05-25 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG), Use of Insufficiently Random Values vulnerability in CBOT Chatbot allows Signature Spoofin… |
CVE-2023-2883 | High | 8.8 | 2023-05-25 | Authorization Bypass Through User-Controlled Key vulnerability in CBOT Chatbot allows Authentication Abuse, Authentication Bypass. This issue affects Chatbot… |
CVE-2023-2882 | Critical | 9.8 | 2023-05-25 | Generation of Incorrect Security Tokens vulnerability in CBOT Chatbot allows Token Impersonation, Privilege Abuse. This issue affects Chatbot: before Core: v4… |
CVE-2023-2881 | Medium | 4.9 | 2023-05-25 | Storing Passwords in a Recoverable Format in GitHub repository pimcore/customer-data-framework prior to 3.3.10. |
CVE-2023-2734 | Critical | 9.8 | 2023-05-25 | The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. This is due to insufficient verification on… |
CVE-2023-2733 | Critical | 9.8 | 2023-05-25 | The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.0. This is due to insufficient verification on… |
CVE-2023-2732 | Critical | 9.8 | 2023-05-25 | The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. This is due to insufficient verification on… |
CVE-2023-31861 | High | 7.5 | 2023-05-25 | ZLMediaKit 4.0 is vulnerable to Directory Traversal. |
CVE-2023-31594 | High | 7.5 | 2023-05-25 | IC Realtime ICIP-P2012T 2.420 is vulnerable to Incorrect Access Control via an exposed HTTP channel using VLC network. |
CVE-2023-2500 | High | 8.8 | 2023-05-25 | The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.3.19 via de… |
CVE-2023-33248 | High | 7.6 | 2023-05-24 | Amazon Alexa software version 8960323972 on Echo Dot 2nd generation and 3rd generation devices potentially allows attackers to deliver security-relevant comman… |
CVE-2023-1158 | Medium | 4.3 | 2023-05-24 | Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x expose dashboard prompts to users who are not part of t… |
CVE-2023-33829 | Medium | 5.4 | 2023-05-24 | A stored cross-site scripting (XSS) vulnerability in Cloudogu GmbH SCM Manager v1.2 to v1.60 allows attackers to execute arbitrary web scripts or HTML via a cr… |
CVE-2023-31458 | Critical | 9.8 | 2023-05-24 | A vulnerability in the Edge Gateway component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthenticated attacker wit… |
CVE-2023-29721 | Critical | 9.8 | 2023-05-24 | SofaWiki <= 3.8.9 has a file upload vulnerability that leads to command execution. |
CVE-2023-25599 | High | 7.4 | 2023-05-24 | A vulnerability in the conferencing component of Mitel MiVoice Connect through 19.3 SP2, 22.24.1500.0 could allow an unauthenticated attacker to conduct a refl… |
CVE-2023-33800 | Medium | 5.4 | 2023-05-24 | A stored cross-site scripting (XSS) vulnerability in the Create Regions (/dcim/regions/) function of Netbox v3.5.1 allows attackers to execute arbitrary web sc… |
CVE-2023-33799 | Medium | 5.4 | 2023-05-24 | A stored cross-site scripting (XSS) vulnerability in the Create Contacts (/tenancy/contacts/) function of Netbox v3.5.1 allows attackers to execute arbitrary w… |
CVE-2023-33798 | Medium | 5.4 | 2023-05-24 | A stored cross-site scripting (XSS) vulnerability in the Create Rack (/dcim/rack/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts… |
CVE-2023-33797 | Medium | 5.4 | 2023-05-24 | A stored cross-site scripting (XSS) vulnerability in the Create Sites (/dcim/sites/) function of Netbox v3.5.1 allows attackers to execute arbitrary web script… |
CVE-2023-33796 | Critical | 9.1 | 2023-05-24 | A vulnerability in Netbox v3.5.1 allows unauthenticated attackers to execute queries against the GraphQL database, granting them access to sensitive data store… |
CVE-2023-33795 | Medium | 5.4 | 2023-05-24 | A stored cross-site scripting (XSS) vulnerability in the Create Contact Roles (/tenancy/contact-roles/) function of Netbox v3.5.1 allows attackers to execute a… |
CVE-2023-33794 | Medium | 5.4 | 2023-05-24 | A stored cross-site scripting (XSS) vulnerability in the Create Tenants (/tenancy/tenants/) function of Netbox v3.5.1 allows attackers to execute arbitrary web… |
CVE-2023-33793 | Medium | 5.4 | 2023-05-24 | A stored cross-site scripting (XSS) vulnerability in the Create Power Panels (/dcim/power-panels/) function of Netbox v3.5.1 allows attackers to execute arbitr… |
CVE-2023-33792 | Medium | 5.4 | 2023-05-24 | A stored cross-site scripting (XSS) vulnerability in the Create Site Groups (/dcim/site-groups/) function of Netbox v3.5.1 allows attackers to execute arbitrar… |
CVE-2023-33791 | Medium | 5.4 | 2023-05-24 | A stored cross-site scripting (XSS) vulnerability in the Create Provider Accounts (/circuits/provider-accounts/) function of Netbox v3.5.1 allows attackers to… |
CVE-2023-33790 | Medium | 5.4 | 2023-05-24 | A stored cross-site scripting (XSS) vulnerability in the Create Locations (/dcim/locations/) function of Netbox v3.5.1 allows attackers to execute arbitrary we… |
CVE-2023-33789 | Medium | 5.4 | 2023-05-24 | A stored cross-site scripting (XSS) vulnerability in the Create Contact Groups (/tenancy/contact-groups/) function of Netbox v3.5.1 allows attackers to execute… |
CVE-2023-33788 | Medium | 5.4 | 2023-05-24 | A stored cross-site scripting (XSS) vulnerability in the Create Providers (/circuits/providers/) function of Netbox v3.5.1 allows attackers to execute arbitrar… |
CVE-2023-33787 | Medium | 5.4 | 2023-05-24 | A stored cross-site scripting (XSS) vulnerability in the Create Tenant Groups (/tenancy/tenant-groups/) function of Netbox v3.5.1 allows attackers to execute a… |
CVE-2023-33786 | Medium | 5.4 | 2023-05-24 | A stored cross-site scripting (XSS) vulnerability in the Create Circuit Types (/circuits/circuit-types/) function of Netbox v3.5.1 allows attackers to execute… |
CVE-2023-33785 | Medium | 5.4 | 2023-05-24 | A stored cross-site scripting (XSS) vulnerability in the Create Rack Roles (/dcim/rack-roles/) function of Netbox v3.5.1 allows attackers to execute arbitrary… |
CVE-2023-31595 | High | 7.5 | 2023-05-24 | IC Realtime ICIP-P2012T 2.420 is vulnerable to Incorrect Access Control via unauthenticated port access. |
CVE-2023-31460 | High | 7.2 | 2023-05-24 | A vulnerability in the Connect Mobility Router component of MiVoice Connect versions 9.6.2208.101 and earlier could allow an authenticated attacker with intern… |
CVE-2023-31459 | High | 8.8 | 2023-05-24 | A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect versions 9.6.2208.101 and earlier could allow an unauthenticated attacker wit… |
CVE-2023-31457 | Critical | 9.8 | 2023-05-24 | A vulnerability in the Headquarters server component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthenticated attac… |
CVE-2023-25598 | Medium | 6.1 | 2023-05-24 | A vulnerability in the conferencing component of Mitel MiVoice Connect through 19.3 SP2 and 20.x, 21.x, and 22.x through 22.24.1500.0 could allow an unauthenti… |
CVE-2023-2875 | Medium | 5.5 | 2023-05-24 | A vulnerability, which was classified as problematic, was found in eScan Antivirus 22.0.1400.2443. Affected is the function 0x22E008u in the library PROCOBSRVE… |
CVE-2023-2874 | Medium | 5.5 | 2023-05-24 | A vulnerability, which was classified as problematic, has been found in Twister Antivirus 8. This issue affects the function 0x804f2158/0x804f2154/0x804f2150/0… |
CVE-2023-2868 | Critical | 9.4 | 2023-05-24 | A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0… |
CVE-2023-33983 | High | 7.4 | 2023-05-24 | The Introduction Client in Briar through 1.5.3 does not implement out-of-band verification for the public keys of introducees. An introducer can launch man-in-… |
CVE-2023-33982 | Medium | 5.9 | 2023-05-24 | Bramble Handshake Protocol (BHP) in Briar before 1.5.3 is not forward secure: eavesdroppers can decrypt network traffic between two accounts if they later comp… |
CVE-2023-33981 | Medium | 6.5 | 2023-05-24 | Briar before 1.4.22 allows attackers to spoof other users' messages in a blog, forum, or private group, but each spoofed message would need to be an exact dupl… |
CVE-2023-33980 | High | 7.5 | 2023-05-24 | Bramble Synchronisation Protocol (BSP) in Briar before 1.4.22 allows attackers to cause a denial of service (repeated application crashes) via a series of long… |
CVE-2023-2873 | Medium | 5.3 | 2023-05-24 | A vulnerability classified as critical was found in Twister Antivirus 8. This vulnerability affects the function 0x804f2143/0x804f217f/0x804f214b/0x80800043 in… |
CVE-2023-2872 | Medium | 5.5 | 2023-05-24 | A vulnerability classified as problematic has been found in FlexiHub 5.5.14691.0. This affects the function 0x220088 in the library fusbhub.sys of the componen… |
CVE-2023-2871 | Low | 3.3 | 2023-05-24 | A vulnerability was found in FabulaTech USB for Remote Desktop 6.1.0.0. It has been rated as problematic. Affected by this issue is the function 0x220448/0x220… |
CVE-2023-2870 | Low | 3.3 | 2023-05-24 | A vulnerability was found in EnTech Monitor Asset Manager 2.9. It has been declared as problematic. Affected by this vulnerability is the function 0x80002014 o… |