2023 CVEs (page 236)
Page 236 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-27514 | High | 8.8 | 2023-05-23 | OS command injection vulnerability in the download page of SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10 and SV-CPT-MC310F versions prior to Ver.8… |
CVE-2023-27512 | High | 7.2 | 2023-05-23 | Use of hard-coded credentials exists in SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10, and SV-CPT-MC310F versions prior to Ver.8.10, which may allo… |
CVE-2023-27507 | Critical | 9.8 | 2023-05-23 | MicroEngine Mailform version 1.1.0 to 1.1.8 contains a path traversal vulnerability. If the product's file upload function and server save option are enabled… |
CVE-2023-27397 | Critical | 9.8 | 2023-05-23 | Unrestricted upload of file with dangerous type exists in MicroEngine Mailform version 1.1.0 to 1.1.8. If the product's file upload function and server save op… |
CVE-2023-27388 | Critical | 9.8 | 2023-05-23 | Improper authentication vulnerability in T&D Corporation and ESPEC MIC CORP. data logger products allows a remote unauthenticated attacker to login to the prod… |
CVE-2023-27387 | High | 8.8 | 2023-05-23 | Cross-site request forgery (CSRF) in T&D Corporation and ESPEC MIC CORP. data logger products allows a remote unauthenticated attacker to conduct an arbitrary… |
CVE-2023-27384 | Medium | 4.3 | 2023-05-23 | Operation restriction bypass vulnerability in MultiReport of Cybozu Garoon 5.15.0 allows a remote authenticated attacker to alter the data of MultiReport. |
CVE-2023-27304 | Medium | 4.3 | 2023-05-23 | Operation restriction bypass vulnerability in Message and Bulletin of Cybozu Garoon 4.6.0 to 5.9.2 allows a remote authenticated attacker to alter the data of… |
CVE-2023-26595 | Medium | 6.5 | 2023-05-23 | Denial-of-service (DoS) vulnerability in Message of Cybozu Garoon 4.10.0 to 5.9.2 allows a remote authenticated attacker to cause a denial of service condition. |
CVE-2023-25953 | Critical | 9.8 | 2023-05-23 | Code injection vulnerability in Drive Explorer for macOS versions 3.5.4 and earlier allows an attacker who can login to the client where the affected product i… |
CVE-2023-25946 | High | 8.8 | 2023-05-23 | Authentication bypass vulnerability in Qrio Lock (Q-SL2) firmware version 2.0.9 and earlier allows a network-adjacent attacker to analyze the product's communi… |
CVE-2023-23545 | Medium | 5.3 | 2023-05-23 | Missing authentication for critical function exists in T&D Corporation and ESPEC MIC CORP. data logger products, which may allow a remote unauthenticated attac… |
CVE-2023-22654 | Medium | 5.4 | 2023-05-23 | Client-side enforcement of server-side security issue exists in T&D Corporation and ESPEC MIC CORP. data logger products, which may lead to an arbitrary script… |
CVE-2023-31996 | High | 8.8 | 2023-05-23 | Hanwha IP Camera ANE-L7012R 1.41.01 is vulnerable to Command Injection due to improper sanitization of special characters for the NAS storage test function. |
CVE-2023-31995 | Medium | 5.4 | 2023-05-23 | Hanwha IP Camera ANE-L7012R 1.41.01 is vulnerable to Cross Site Scripting (XSS). |
CVE-2023-31994 | Medium | 5.3 | 2023-05-23 | Certain Hanwha products are vulnerable to Denial of Service (DoS). ck vector is: When an empty UDP packet is sent to the listening service, the service thread… |
CVE-2023-31826 | High | 7.8 | 2023-05-23 | Skyscreamer Open Source Nevado JMS v1.3.2 does not perform security checks when receiving messages. This allows attackers to execute arbitrary commands via sup… |
CVE-2023-31814 | Critical | 9.8 | 2023-05-23 | D-Link DIR-300 firmware <=REVA1.06 and <=REVB2.06 is vulnerable to File inclusion via /model/__lang_msg.php. |
CVE-2023-31741 | High | 7.2 | 2023-05-23 | There is a command injection vulnerability in the Linksys E2000 router with firmware version 1.0.06. If an attacker gains web management privileges, they can i… |
CVE-2023-31740 | High | 7.2 | 2023-05-23 | There is a command injection vulnerability in the Linksys E2000 router with firmware version 1.0.06. If an attacker gains web management privileges, they can i… |
CVE-2023-31708 | Medium | 4.3 | 2023-05-23 | A Cross-Site Request Forgery (CSRF) in EyouCMS v1.6.2 allows attackers to execute arbitrary commands via a supplying a crafted HTML file to the Upload software… |
CVE-2023-31670 | High | 7.5 | 2023-05-23 | An issue in wasm2c 1.0.32, wasm2wat 1.0.32, wasm-decompile 1.0.32, and wasm-validate 1.0.32 allows attackers to cause a Denial of Service (DoS) via running a c… |
CVE-2023-31664 | Medium | 6.1 | 2023-05-23 | A reflected cross-site scripting (XSS) vulnerability in /authenticationendpoint/login.do of WSO2 API Manager before 4.2.0 allows attackers to execute arbitrary… |
CVE-2023-29919 | Critical | 9.1 | 2023-05-23 | SolarView Compact <= 6.0 is vulnerable to Insecure Permissions. Any file on the server can be read or modified because texteditor.php is not restricted. |
CVE-2023-27068 | Critical | 9.8 | 2023-05-23 | Deserialization of Untrusted Data in Sitecore Experience Platform through 10.2 allows remote attackers to run arbitrary code via ValidationResult.aspx. |
CVE-2023-25440 | Medium | 5.4 | 2023-05-23 | Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to execute arbitrary code in first/second nam… |
CVE-2023-2505 | High | 7.7 | 2023-05-22 | The affected products have a CSRF vulnerability that could allow an attacker to execute code and upload malicious files. |
CVE-2023-2504 | High | 8.4 | 2023-05-22 | Files present on firmware images could allow an attacker to gain unauthorized access as a root user using hard-coded credentials. |
CVE-2023-31816 | Medium | 6.1 | 2023-05-22 | IT Sourcecode Content Management System Project In PHP and MySQL With Source Code 1.0.0 is vulnerable to Cross Site Scripting (XSS) via /ecodesource/search_lis… |
CVE-2023-25183 | High | 8.3 | 2023-05-22 | In Snap One OvrC Pro versions prior to 7.2, when logged into the superuser account, a new functionality appears that could all… |
CVE-2023-31689 | Critical | 9.8 | 2023-05-22 | In Wcms 0.3.2, an attacker can send a crafted request from a vulnerable web application backend server /wcms/wex/html.php via the finish parameter and the text… |
CVE-2023-31245 | High | 7.1 | 2023-05-22 | Devices using Snap One OvrC cloud are sent to a web address when accessing a web management interface using a HTTP connection. Attacke… |
CVE-2023-31241 | High | 8.6 | 2023-05-22 | Snap One OvrC cloud servers contain a route an attacker can use to bypass requirements and claim devices outright. |
CVE-2023-31240 | High | 8.3 | 2023-05-22 | Snap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network and remotely. OvrC cloud contains a hi… |
CVE-2023-31193 | High | 7.5 | 2023-05-22 | Snap One OvrC Pro versions prior to 7.3 use HTTP connections when downloading a program from their servers. Because they do not use HTTPS, OvrC Pr… |
CVE-2023-29838 | High | 7.8 | 2023-05-22 | Insecure Permission vulnerability found in Botkind/Siber Systems SyncApp v.19.0.3.0 allows a local attacker toe escalate privileges via the SyncService.exe fil… |
CVE-2023-28649 | High | 8.6 | 2023-05-22 | The Hub in the Snap One OvrC cloud platform is a device used to centralize and manage nested devices connected to it. A vulnerability exists in which an attack… |
CVE-2023-28412 | Medium | 5.3 | 2023-05-22 | When supplied with a random MAC address, Snap One OvrC cloud servers will return information about the device. The MAC address of devices can be enume… |
CVE-2023-28386 | High | 8.6 | 2023-05-22 | Snap One OvrC Pro devices versions 7.2 and prior do not validate firmware updates correctly. The device only calculates the MD5 hash of the firmware and does n… |
CVE-2023-31584 | Medium | 6.1 | 2023-05-22 | GitHub repository cu/silicon commit a9ef36 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the User Input field. |
CVE-2023-28467 | Medium | 6.1 | 2023-05-22 | In MyBB before 1.8.34, there is XSS in the User CP module via the user email field. |
CVE-2023-27067 | High | 7.5 | 2023-05-22 | Directory Traversal vulnerability in Sitecore Experience Platform through 10.2 allows remote attackers to download arbitrary files via crafted command to downl… |
CVE-2023-2840 | Critical | 9.8 | 2023-05-22 | NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.2.2. |
CVE-2023-2839 | High | 7.5 | 2023-05-22 | Divide By Zero in GitHub repository gpac/gpac prior to 2.2.2. |
CVE-2023-2838 | Critical | 9.1 | 2023-05-22 | Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2. |
CVE-2023-2837 | Medium | 5.5 | 2023-05-22 | Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.2.2. |
CVE-2023-31742 | High | 7.2 | 2023-05-22 | There is a command injection vulnerability in the Linksys WRT54GL router with firmware version 4.30.18.006. If an attacker gains web management privileges, the… |
CVE-2023-27066 | Medium | 6.5 | 2023-05-22 | Directory Traversal vulnerability in Site Core Experience Platform 10.2 and earlier allows authenticated remote attackers to download arbitrary files via Urlha… |
CVE-2023-33294 | Critical | 9.8 | 2023-05-22 | An issue was discovered in KaiOS 3.0 before 3.1. The /system/bin/tctweb_server binary exposes a local web server that responds to GET and POST requests on port… |
CVE-2023-33293 | Medium | 5.3 | 2023-05-22 | An issue was discovered in KaiOS 3.0 and 3.1. The binary /system/kaios/api-daemon exposes a local web server on *.localhost with subdomains for each installed… |
CVE-2023-32350 | High | 8.0 | 2023-05-22 | Versions 00.07.00 through 00.07.03 of Teltonika’s RUT router firmware contain an operating system (OS) command injection vulnerability in a Lua service. An at… |
CVE-2023-32349 | High | 8.0 | 2023-05-22 | Version 00.07.03.4 and prior of Teltonika’s RUT router firmware contain a packet dump utility that contains proper validation for filter parameters. However… |
CVE-2023-32348 | Medium | 5.8 | 2023-05-22 | Teltonika’s Remote Management System versions prior to 4.10.0 contain a virtual private network (VPN) hub feature for cross-device communication that uses Ope… |
CVE-2023-31103 | High | 7.5 | 2023-05-22 | Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Att… |
CVE-2023-31101 | Medium | 6.5 | 2023-05-22 | Insecure Default Initialization of Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.5.0 through 1.6… |
CVE-2023-31098 | Critical | 9.8 | 2023-05-22 | Weak Password Requirements vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.6.0. When users c… |
CVE-2023-31066 | Critical | 9.1 | 2023-05-22 | Files or Directories Accessible to External Parties vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 thro… |
CVE-2023-31065 | Critical | 9.1 | 2023-05-22 | Insufficient Session Expiration vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. An old… |
CVE-2023-31064 | High | 7.5 | 2023-05-22 | Files or Directories Accessible to External Parties vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 thro… |
CVE-2023-31062 | Critical | 9.8 | 2023-05-22 | Improper Privilege Management Vulnerabilities in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. When the… |
CVE-2023-2588 | High | 8.8 | 2023-05-22 | Teltonika’s Remote Management System versions prior to 4.10.0 have a feature allowing users to access managed devices’ local secure shell (SSH)/web management… |
CVE-2023-2587 | High | 7.5 | 2023-05-22 | Teltonika’s Remote Management System versions prior to 4.10.0 contain a cross-site scripting (XSS) vulnerability in the main page of the web interface. An att… |
CVE-2023-2586 | Critical | 9.0 | 2023-05-22 | Teltonika’s Remote Management System versions 4.14.0 is vulnerable to an unauthorized attacker registering previously unregistered devices through the RMS pla… |
CVE-2023-32347 | High | 8.1 | 2023-05-22 | Teltonika’s Remote Management System versions prior to 4.10.0 use device serial numbers and MAC addresses to identify devices from the user perspective for de… |
CVE-2023-32346 | Medium | 5.3 | 2023-05-22 | Teltonika’s Remote Management System versions prior to 4.10.0 contain a function that allows users to claim their devices. This function returns information b… |
CVE-2023-31923 | High | 8.8 | 2023-05-22 | Suprema BioStar 2 before 2022 Q4, v2.9.1 has Insecure Permissions. A vulnerability in the web application allows an authenticated attacker with "User Operator"… |
CVE-2023-25448 | Medium | 5.4 | 2023-05-22 | Cross-Site Request Forgery (CSRF) vulnerability in Eric Teubert Archivist – Custom Archive Templates plugin <= 1.7.4 versions. |
CVE-2023-25447 | Medium | 4.3 | 2023-05-22 | Cross-Site Request Forgery (CSRF) vulnerability in Inkthemescom ColorWay theme <= 4.2.3 versions. |
CVE-2023-31454 | High | 7.5 | 2023-05-22 | Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 th… |
CVE-2023-31453 | High | 7.5 | 2023-05-22 | Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 th… |
CVE-2023-31206 | High | 7.5 | 2023-05-22 | Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Atta… |
CVE-2023-31779 | Medium | 5.4 | 2023-05-22 | Wekan v6.84 and earlier is vulnerable to Cross Site Scripting (XSS). An attacker with user privilege on kanban board can insert JavaScript code in in "Reaction… |
CVE-2023-31058 | High | 7.5 | 2023-05-22 | Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attacke… |
CVE-2023-2597 | High | 7.0 | 2023-05-22 | In Eclipse Openj9 before version 0.38.0, in the implementation of the shared cache (which is enabled by default in OpenJ9 builds) the size of a string is not p… |
CVE-2023-2832 | High | 7.2 | 2023-05-22 | SQL Injection in GitHub repository unilogies/bumsys prior to 2.2.0. |
CVE-2023-28709 | High | 7.5 | 2023-05-22 | The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTT… |
CVE-2023-25537 | Medium | 6.1 | 2023-05-22 | Dell PowerEdge 14G server BIOS versions prior to 2.18.1 and Dell Precision BIOS versions prior to 2.18.2, contain an Out of Bounds write vulnerability. A loca… |
CVE-2023-23797 | Medium | 5.4 | 2023-05-22 | Cross-Site Request Forgery (CSRF) vulnerability in SecondLineThemes Auto YouTube Importer plugin <= 1.0.3 versions. |
CVE-2023-23813 | Medium | 5.4 | 2023-05-22 | Cross-Site Request Forgery (CSRF) vulnerability in Joseph C Dolson My Calendar plugin <= 3.4.3 versions. |
CVE-2023-23712 | Medium | 5.4 | 2023-05-22 | Cross-Site Request Forgery (CSRF) vulnerability in User Meta Manager plugin <= 3.4.9 versions. |
CVE-2023-23680 | Medium | 5.4 | 2023-05-22 | Cross-Site Request Forgery (CSRF) vulnerability in Bob Goetz WP-TopBar plugin <= 5.36 versions. |
CVE-2023-22714 | Medium | 4.3 | 2023-05-22 | Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Coming Soon by Supsystic plugin <= 1.7.10 versions. |
CVE-2023-22709 | Medium | 4.3 | 2023-05-22 | Cross-Site Request Forgery (CSRF) vulnerability in Atif N SRS Simple Hits Counter plugin <= 1.1.0 versions. |
CVE-2023-22692 | Medium | 4.3 | 2023-05-22 | Cross-Site Request Forgery (CSRF) vulnerability in Jeroen Peters Name Directory plugin <= 1.27.1 versions. |
CVE-2023-22688 | Medium | 4.3 | 2023-05-22 | Cross-Site Request Forgery (CSRF) vulnerability in Abdul Ibad WP Tabs Slides plugin <= 2.0.3 versions. |
CVE-2023-33236 | Critical | 9.8 | 2023-05-22 | MXsecurity version 1.0 is vulnearble to hardcoded credential vulnerability. This vulnerability has been reported that can be exploited to craft arbitrary JWT t… |
CVE-2023-33235 | High | 7.2 | 2023-05-22 | MXsecurity version 1.0 is vulnearble to command injection vulnerability. This vulnerability has been reported in the SSH CLI program, which can be exploited by… |
CVE-2023-33297 | High | 7.5 | 2023-05-22 | Bitcoin Core before 24.1, when debug mode is not used, allows attackers to cause a denial of service (e.g., CPU consumption) because draining the inventory-to-… |
CVE-2023-33288 | Medium | 4.7 | 2023-05-22 | An issue was discovered in the Linux kernel before 6.2.9. A use-after-free was found in bq24190_remove in drivers/power/supply/bq24190_charger.c. It could allo… |
CVE-2023-33285 | Medium | 5.3 | 2023-05-22 | An issue was discovered in Qt 5.x before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. QDnsLookup has a buffer over-read via a crafted reply… |
CVE-2023-33281 | Medium | 6.5 | 2023-05-22 | The remote keyfob system on Nissan Sylphy Classic 2021 sends the same RF signal for each door-open request, which allows for a replay attack. NOTE: the vendor'… |
CVE-2023-33264 | Medium | 4.3 | 2023-05-22 | In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuration properly. This al… |
CVE-2023-32336 | High | 8.8 | 2023-05-22 | IBM InfoSphere Information Server 11.7 is affected by a remote code execution vulnerability due to insecure deserialization in an RMI service. IBM X-Force ID… |
CVE-2023-33254 | Medium | 6.5 | 2023-05-21 | There is an LDAP bind credentials exposure on KACE Systems Deployment and Remote Site appliances 9.0.146. The captured credentials may provide a higher privile… |
CVE-2023-33252 | High | 7.5 | 2023-05-21 | iden3 snarkjs through 0.6.11 allows double spending because there is no validation that the publicSignals length is less than the field modulus. |
CVE-2023-33251 | Medium | 4.7 | 2023-05-21 | When Akka HTTP before 10.5.2 accepts file uploads via the FileUploadDirectives.fileUploadAll directive, the temporary file it creates has too weak permissions… |
CVE-2023-33250 | Medium | 4.4 | 2023-05-21 | The Linux kernel 6.3 has a use-after-free in iopt_unmap_iova_range in drivers/iommu/iommufd/io_pagetable.c. |
CVE-2023-2826 | Low | 3.5 | 2023-05-21 | A vulnerability has been found in SourceCodester Class Scheduling System 1.0 and classified as problematic. This vulnerability affects unknown code of the file… |
CVE-2023-32589 | Medium | 4.3 | 2023-05-20 | Cross-Site Request Forgery (CSRF) vulnerability in PingOnline Dyslexiefont Free plugin <= 1.0.0 versions. |
CVE-2023-24414 | Medium | 4.3 | 2023-05-20 | Cross-Site Request Forgery (CSRF) vulnerability in RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.11 versions. |