2023 CVEs (page 238)
Page 238 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-20167 | Medium | 6.0 | 2023-05-18 | Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to perform path traversal attacks on the underlying oper… |
CVE-2023-20166 | Medium | 6.0 | 2023-05-18 | Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to perform path traversal attacks on the underlying oper… |
CVE-2023-20164 | Medium | 6.5 | 2023-05-18 | Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to perform command injection attacks on the underlying o… |
CVE-2023-20163 | Medium | 6.5 | 2023-05-18 | Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to perform command injection attacks on the underlying o… |
CVE-2023-20162 | High | 8.6 | 2023-05-18 | Multiple vulnerabilities in the web-based user interface of certain Cisco Small Business Series Switches could allow an unauthenticated, remote attacker to cau… |
CVE-2023-20161 | High | 8.6 | 2023-05-18 | Multiple vulnerabilities in the web-based user interface of certain Cisco Small Business Series Switches could allow an unauthenticated, remote attacker to cau… |
CVE-2023-20160 | High | 8.6 | 2023-05-18 | Multiple vulnerabilities in the web-based user interface of certain Cisco Small Business Series Switches could allow an unauthenticated, remote attacker to cau… |
CVE-2023-20159 | High | 8.6 | 2023-05-18 | Multiple vulnerabilities in the web-based user interface of certain Cisco Small Business Series Switches could allow an unauthenticated, remote attacker to cau… |
CVE-2023-20158 | High | 8.6 | 2023-05-18 | Multiple vulnerabilities in the web-based user interface of certain Cisco Small Business Series Switches could allow an unauthenticated, remote attacker to cau… |
CVE-2023-20157 | High | 8.6 | 2023-05-18 | Multiple vulnerabilities in the web-based user interface of certain Cisco Small Business Series Switches could allow an unauthenticated, remote attacker to cau… |
CVE-2023-20156 | High | 8.6 | 2023-05-18 | Multiple vulnerabilities in the web-based user interface of certain Cisco Small Business Series Switches could allow an unauthenticated, remote attacker to cau… |
CVE-2023-20110 | Medium | 6.5 | 2023-05-18 | A vulnerability in the web-based management interface of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to co… |
CVE-2023-20106 | Medium | 5.4 | 2023-05-18 | Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to delete or read arbitrary files on the underlying oper… |
CVE-2023-20087 | Medium | 4.9 | 2023-05-18 | Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to downloa… |
CVE-2023-20077 | Medium | 4.9 | 2023-05-18 | Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to downloa… |
CVE-2023-20024 | High | 8.6 | 2023-05-18 | Multiple vulnerabilities in the web-based user interface of certain Cisco Small Business Series Switches could allow an unauthenticated, remote attacker to cau… |
CVE-2023-20003 | Medium | 4.7 | 2023-05-18 | A vulnerability in the social login configuration option for the guest users of Cisco Business Wireless Access Points (APs) could allow an unauthenticated, adj… |
CVE-2023-31729 | Critical | 9.8 | 2023-05-18 | TOTOLINK A3300R v17.0.0cu.557 is vulnerable to Command Injection via /cgi-bin/cstecgi.cgi. |
CVE-2023-29857 | Medium | 5.3 | 2023-05-18 | An issue in Teslamate v1.27.1 allows attackers to obtain sensitive information via directly accessing the teslamate link. |
CVE-2023-30124 | Medium | 5.4 | 2023-05-18 | LavaLite v9.0.0 is vulnerable to Cross Site Scripting (XSS). |
CVE-2023-29985 | Critical | 9.8 | 2023-05-18 | Sourcecodester Student Study Center Desk Management System v1.0 admin\reports\index.php#date_from has a SQL Injection vulnerability. |
CVE-2023-2319 | Critical | 9.8 | 2023-05-17 | It was discovered that an update for PCS package in RHBA-2023:2151 erratum released as part of Red Hat Enterprise Linux 9.2 failed to include the fix for the W… |
CVE-2023-2295 | High | 7.5 | 2023-05-17 | A vulnerability was found in the libreswan library. This security issue occurs when an IKEv1 Aggressive Mode packet is received with only unacceptable crypto a… |
CVE-2023-1859 | Medium | 4.7 | 2023-05-17 | A use-after-free flaw was found in xen_9pfs_front_removet in net/9p/trans_xen.c in Xen transport for 9pfs in the Linux Kernel. This flaw could allow a local at… |
CVE-2023-2731 | Medium | 5.5 | 2023-05-17 | A NULL pointer dereference flaw was found in Libtiff's LZWDecode() function in the libtiff/tif_lzw.c file. This flaw allows a local attacker to craft specific… |
CVE-2023-2491 | High | 7.8 | 2023-05-17 | A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the "org-babel-execute:latex" function in ob-latex.el can result i… |
CVE-2023-2203 | High | 8.8 | 2023-05-17 | A flaw was found in the WebKitGTK package. An improper input validation issue may lead to a use-after-free vulnerability. This flaw allows attackers with netwo… |
CVE-2023-1972 | Medium | 6.5 | 2023-05-17 | A potential heap based buffer overflow was found in _bfd_elf_slurp_version_tables() in bfd/elf.c. This may lead to loss of availability. |
CVE-2023-2780 | Critical | 9.8 | 2023-05-17 | Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1. |
CVE-2023-32767 | High | 7.5 | 2023-05-17 | The web interface of Symcon IP-Symcon before 6.3 (i.e., before 2023-05-12) allows a remote attacker to read sensitive files via .. directory-traversal sequence… |
CVE-2023-30191 | Critical | 9.8 | 2023-05-17 | PrestaShop cdesigner < 3.1.9 is vulnerable to SQL Injection via CdesignerTraitementModuleFrontController::initContent(). |
CVE-2023-2776 | Medium | 6.3 | 2023-05-17 | A vulnerability was found in code-projects Simple Photo Gallery 1.0. It has been declared as critical. This vulnerability affects unknown code. The manipulatio… |
CVE-2023-2775 | Medium | 6.3 | 2023-05-17 | A vulnerability was found in code-projects Bus Dispatch and Information System 1.0. It has been classified as critical. This affects an unknown part of the fil… |
CVE-2023-2774 | Medium | 6.3 | 2023-05-17 | A vulnerability was found in code-projects Bus Dispatch and Information System 1.0 and classified as critical. Affected by this issue is some unknown functiona… |
CVE-2023-29837 | Medium | 6.1 | 2023-05-17 | Cross Site Scripting vulnerability found in Exelysis Unified Communication Solution (EUCS) v.1.0 allows a remote attacker to gain privileges via the URL path o… |
CVE-2023-27233 | High | 8.8 | 2023-05-17 | Piwigo before 13.6.0 was discovered to contain a SQL injection vulnerability via the order[0][dir] parameter at user_list_backend.php. |
CVE-2023-2773 | Medium | 6.3 | 2023-05-17 | A vulnerability has been found in code-projects Bus Dispatch and Information System 1.0 and classified as critical. Affected by this vulnerability is an unknow… |
CVE-2023-2772 | Medium | 6.3 | 2023-05-17 | A vulnerability, which was classified as critical, was found in SourceCodester Budget and Expense Tracker System 1.0. Affected is an unknown function of the fi… |
CVE-2023-2771 | Medium | 6.3 | 2023-05-17 | A vulnerability, which was classified as critical, has been found in SourceCodester Online Exam System 1.0. This issue affects some unknown processing of the f… |
CVE-2023-31135 | Low | 3.3 | 2023-05-17 | Dgraph is an open source distributed GraphQL database. Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. The first 12 b… |
CVE-2023-2770 | Medium | 6.3 | 2023-05-17 | A vulnerability classified as critical was found in SourceCodester Online Exam System 1.0. This vulnerability affects unknown code of the file /kelasdosen/data… |
CVE-2023-2769 | Medium | 6.3 | 2023-05-17 | A vulnerability classified as critical has been found in SourceCodester Service Provider Management System 1.0. This affects an unknown part of the file /class… |
CVE-2023-26044 | Medium | 5.3 | 2023-05-17 | react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. Previous versions of ReactPHP's HTTP server component contain a p… |
CVE-2023-24805 | High | 8.8 | 2023-05-17 | cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. If you use… |
CVE-2023-2768 | Low | 3.5 | 2023-05-17 | A vulnerability was found in Sucms 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file admin_ads.php?action… |
CVE-2023-2766 | Medium | 5.3 | 2023-05-17 | A vulnerability was found in Weaver OA 9.5 and classified as problematic. This issue affects some unknown processing of the file /building/backmgr/urlpage/mobi… |
CVE-2023-2765 | Medium | 4.3 | 2023-05-17 | A vulnerability has been found in Weaver OA up to 9.5 and classified as problematic. This vulnerability affects unknown code of the file /E-mobile/App/System/F… |
CVE-2023-22348 | Medium | 4.3 | 2023-05-17 | Improper Authorization in RestAPI in Checkmk GmbH's Checkmk versions <2.1.0p28 and <2.2.0b8 allows remote authenticated users to read arbitrary host_configs. |
CVE-2023-31725 | Medium | 5.5 | 2023-05-17 | yasm 1.3.0.55.g101bc was discovered to contain a heap-use-after-free via the function expand_mmac_params at yasm/modules/preprocs/nasm/nasm-pp.c. |
CVE-2023-31724 | High | 7.8 | 2023-05-17 | yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the function do_directive at /nasm/nasm-pp.c. |
CVE-2023-31723 | Medium | 5.5 | 2023-05-17 | yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the function expand_mmac_params at /nasm/nasm-pp.c. |
CVE-2023-31722 | High | 7.8 | 2023-05-17 | There exists a heap buffer overflow in nasm 2.16.02rc1 (GitHub commit: b952891). |
CVE-2023-31701 | High | 8.8 | 2023-05-17 | TP-Link TL-WPA4530 KIT V2 (EU)_170406 and V2 (EU)_161115 is vulnerable to Command Injection via _httpRpmPlcDeviceRemove. |
CVE-2023-31700 | High | 8.8 | 2023-05-17 | TP-Link TL-WPA4530 KIT V2 (EU)_170406 and V2 (EU)_161115 is vulnerable to Command Injection via _httpRpmPlcDeviceAdd. |
CVE-2023-31904 | High | 7.5 | 2023-05-17 | savysoda Wifi HD Wireless Disk Drive 11 is vulnerable to Local File Inclusion. |
CVE-2023-31903 | Critical | 9.8 | 2023-05-17 | GuppY CMS 6.00.10 is vulnerable to Unrestricted File Upload which allows remote attackers to execute arbitrary code by uploading a php file. |
CVE-2023-31902 | Critical | 9.8 | 2023-05-17 | RPA Technology Mobile Mouse 3.6.0.4 is vulnerable to Remote Code Execution (RCE). |
CVE-2023-31703 | Critical | 9.0 | 2023-05-17 | Cross Site Scripting (XSS) in the edit user form in Microworld Technologies eScan management console 14.0.1400.2281 allows remote attacker to inject arbitrary… |
CVE-2023-31702 | High | 7.2 | 2023-05-17 | SQL injection in the View User Profile in MicroWorld eScan Management Console 14.0.1400.2281 allows remote attacker to dump entire database and gain windows XP… |
CVE-2023-31699 | Medium | 4.8 | 2023-05-17 | ChurchCRM v4.5.4 is vulnerable to Reflected Cross-Site Scripting (XSS) via image file. |
CVE-2023-31698 | Medium | 5.4 | 2023-05-17 | Bludit v3.14.1 is vulnerable to Stored Cross Site Scripting (XSS) via SVG file on site logo. NOTE: the product's security model is that users are trusted by th… |
CVE-2023-30438 | Critical | 9.3 | 2023-05-17 | An internally discovered vulnerability in PowerVM on IBM Power9 and Power10 systems could allow an attacker with privileged user access to a logical partition… |
CVE-2023-2679 | Medium | 4.1 | 2023-05-17 | Data leakage in Adobe connector in Snow Software SPE 9.27.0 on Windows allows privileged user to observe other users data. |
CVE-2023-2756 | High | 7.2 | 2023-05-17 | SQL Injection in GitHub repository pimcore/customer-data-framework prior to 3.3.10. |
CVE-2023-31208 | High | 8.3 | 2023-05-17 | Improper neutralization of livestatus command delimiters in the RestAPI in Checkmk < 2.0.0p36, < 2.1.0p28, and < 2.2.0b8 (beta) allows arbitrary livestatus com… |
CVE-2023-2745 | Medium | 5.4 | 2023-05-17 | WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers t… |
CVE-2023-2753 | Medium | 5.4 | 2023-05-17 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta. |
CVE-2023-2752 | Medium | 5.4 | 2023-05-17 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta. |
CVE-2023-0864 | High | 7.1 | 2023-05-17 | Cleartext Transmission of Sensitive Information vulnerability in ABB Terra AC wallbox (UL40/80A), ABB Terra AC wallbox (UL32A), ABB Terra AC wallbox (CE) (Terr… |
CVE-2023-0863 | High | 8.8 | 2023-05-17 | Improper Authentication vulnerability in ABB Terra AC wallbox (UL40/80A), ABB Terra AC wallbox (UL32A), ABB Terra AC wallbox (CE) (Terra AC MID), ABB Terra AC… |
CVE-2023-2509 | High | 7.1 | 2023-05-17 | A Cross-Site Scripting(XSS) vulnerability was found on ADM, LooksGood and SoundsGood Apps. An attacker can exploit this vulnerability to inject malicious scrip… |
CVE-2023-2706 | High | 8.1 | 2023-05-17 | The OTP Login Woocommerce & Gravity Forms plugin for WordPress is vulnerable to authentication bypass. This is due to the fact that when generating OTP codes f… |
CVE-2023-2608 | Low | 3.1 | 2023-05-17 | The Multiple Page Generator Plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to time-based SQL Injection via the orderby and order para… |
CVE-2023-31847 | Medium | 6.5 | 2023-05-17 | In davinci 0.3.0-rc after logging in, the user can connect to the mysql malicious server by controlling the data source to read arbitrary files on the client s… |
CVE-2023-1764 | Medium | 6.5 | 2023-05-17 | Canon IJ Network Tool/Ver.4.7.5 and earlier (supported OS: OS X 10.9.5-macOS 13),IJ Network Tool/Ver.4.7.3 and earlier (supported OS: OS X 10.7.5-OS X 10.8) al… |
CVE-2023-1763 | Medium | 6.5 | 2023-05-17 | Canon IJ Network Tool/Ver.4.7.5 and earlier (supported OS: OS X 10.9.5-macOS 13),IJ Network Tool/Ver.4.7.3 and earlier (supported OS: OS X 10.7.5-OS X 10.8) al… |
CVE-2023-31848 | High | 8.8 | 2023-05-17 | davinci 0.3.0-rc is vulnerable to Server-side request forgery (SSRF). |
CVE-2023-30452 | Medium | 5.4 | 2023-05-17 | The MoroSystems EasyMind - Mind Maps plugin before 2.15.0 for Confluence allows persistent XSS when saving a Mind Map with the hyperlink parameter. |
CVE-2023-2528 | Medium | 5.4 | 2023-05-17 | The Contact Form by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.24. This is due to missing… |
CVE-2023-25394 | High | 7.0 | 2023-05-17 | Videostream macOS app 0.5.0 and 0.4.3 has a Race Condition. The Updater privileged script attempts to update Videostream every 5 hours. |
CVE-2023-31679 | High | 7.5 | 2023-05-16 | Incorrect access control in Videogo v6.8.1 allows attackers to access images from other devices via modification of the Device Id parameter. |
CVE-2023-31678 | Medium | 5.3 | 2023-05-16 | Incorrect access control in Videogo v6.8.1 allows attackers to bind shared devices after the connection has been ended. |
CVE-2023-31677 | High | 7.5 | 2023-05-16 | Insecure permissions in luowice 3.5.18 allow attackers to view information for other alarm devices via modification of the eseeid parameter. |
CVE-2023-31544 | Medium | 5.4 | 2023-05-16 | A stored cross-site scripting (XSS) vulnerability in alkacon-OpenCMS v11.0.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload… |
CVE-2023-30281 | Medium | 6.5 | 2023-05-16 | Insecure permissions vulnerability was discovered, due to a lack of permissions’s control in scquickaccounting before v3.7.3 from Store Commander for PrestaSho… |
CVE-2023-30189 | Critical | 9.8 | 2023-05-16 | Prestashop posstaticblocks <= 1.0.0 is vulnerable to SQL Injection via posstaticblocks::getPosCurrentHook(). |
CVE-2023-29927 | Medium | 4.3 | 2023-05-16 | Versions of Sage 300 through 2022 implement role-based access controls that are only enforced client-side. Low-privileged Sage users, particularly those on a w… |
CVE-2023-27742 | Critical | 9.8 | 2023-05-16 | IDURAR ERP/CRM v1 was discovered to contain a SQL injection vulnerability via the component /api/login. |
CVE-2023-30510 | Medium | 4.1 | 2023-05-16 | A vulnerability exists in the Aruba EdgeConnect Enterprise web management interface that allows remote authenticated users to issue arbitrary URL requests from… |
CVE-2023-30509 | Medium | 4.9 | 2023-05-16 | Multiple authenticated path traversal vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface. Successful exploitation of these vulner… |
CVE-2023-30508 | Medium | 4.9 | 2023-05-16 | Multiple authenticated path traversal vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface. Successful exploitation of these vulner… |
CVE-2023-30507 | Medium | 4.9 | 2023-05-16 | Multiple authenticated path traversal vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface. Successful exploitation of these vulner… |
CVE-2023-30506 | High | 7.2 | 2023-05-16 | Vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface that allow remote authenticated users to run arbitrary commands on the underly… |
CVE-2023-30505 | High | 7.2 | 2023-05-16 | Vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface that allow remote authenticated users to run arbitrary commands on the underly… |
CVE-2023-30504 | High | 7.2 | 2023-05-16 | Vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface that allow remote authenticated users to run arbitrary commands on the underly… |
CVE-2023-30503 | High | 7.2 | 2023-05-16 | Vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface that allow remote authenticated users to run arbitrary commands on the underly… |
CVE-2023-30502 | High | 7.2 | 2023-05-16 | Vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface that allow remote authenticated users to run arbitrary commands on the underly… |
CVE-2023-30501 | High | 7.2 | 2023-05-16 | Vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface that allow remote authenticated users to run arbitrary commands on the underly… |
CVE-2023-2726 | High | 8.8 | 2023-05-16 | Inappropriate implementation in WebApp Installs in Google Chrome prior to 113.0.5672.126 allowed an attacker who convinced a user to install a malicious web ap… |
CVE-2023-2725 | High | 8.8 | 2023-05-16 | Use after free in Guest View in Google Chrome prior to 113.0.5672.126 allowed an attacker who convinced a user to install a malicious extension to potentially… |