2023 CVEs (page 24)
Page 24 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-28532 | Medium | 4.3 | 2024-12-09 | Missing Authorization vulnerability in wpdirectorykit.com Real Estate Directory allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2023-28417 | Medium | 5.4 | 2024-12-09 | Missing Authorization vulnerability in AlexaCRM Dynamics 365 Integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2023-28416 | Medium | 4.3 | 2024-12-09 | Missing Authorization vulnerability in Sparkle Themes Chankhe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chankh… |
CVE-2023-28168 | Low | 3.7 | 2024-12-09 | Missing Authorization vulnerability in Jerod Santo WordPress Console allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2023-28165 | Medium | 4.3 | 2024-12-09 | Missing Authorization vulnerability in Tech Banker Backup Bank: WordPress Backup Plugin allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2023-27626 | Medium | 5.3 | 2024-12-09 | Missing Authorization vulnerability in Aleksandar Urošević Stock Ticker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2023-27625 | Medium | 4.3 | 2024-12-09 | Missing Authorization vulnerability in Paul Ryley Site Reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site… |
CVE-2023-27454 | Medium | 5.4 | 2024-12-09 | Missing Authorization vulnerability in Apollo13Themes Rife Elementor Extensions & Templates allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2023-27449 | Medium | 6.3 | 2024-12-09 | Missing Authorization vulnerability in TotalSuite Total Poll Lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects To… |
CVE-2023-27428 | Medium | 5.4 | 2024-12-09 | Missing Authorization vulnerability in Damir Calusic WP users media allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2023-26522 | Medium | 6.5 | 2024-12-09 | Missing Authorization vulnerability in OneWebsite WP Repost allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Repos… |
CVE-2023-26520 | Medium | 5.3 | 2024-12-09 | Missing Authorization vulnerability in Max Chirkov Advanced Text Widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2023-25993 | Medium | 4.3 | 2024-12-09 | Missing Authorization vulnerability in WebberZone Top 10 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Top 10: fro… |
CVE-2023-25966 | Medium | 5.5 | 2024-12-09 | Missing Authorization vulnerability in Ninja Team Filebird allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Filebird… |
CVE-2023-25959 | Medium | 5.4 | 2024-12-09 | Missing Authorization vulnerability in Apollo13Themes Apollo13 Framework Extensions allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2023-25791 | Medium | 5.4 | 2024-12-09 | Missing Authorization vulnerability in Cadus Pro Fontiran allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fontiran… |
CVE-2023-25714 | High | 7.5 | 2024-12-09 | Missing Authorization vulnerability in Fullworks Quick Paypal Payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2023-25703 | Medium | 5.3 | 2024-12-09 | Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Meta slider and carousel with lightbox allows Exploiting Incorrectly Configured Acces… |
CVE-2023-25486 | Medium | 4.3 | 2024-12-09 | Missing Authorization vulnerability in Migrate Clone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clone: from n/a… |
CVE-2023-25469 | Medium | 5.4 | 2024-12-09 | Missing Authorization vulnerability in Magazine3 Easy Table of Contents allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2023-25455 | Medium | 5.3 | 2024-12-09 | Missing Authorization vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Exploiting Incorrectly Config… |
CVE-2023-25454 | Medium | 6.5 | 2024-12-09 | Missing Authorization vulnerability in Nate Reist Protected Posts Logout Button allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2023-25067 | Medium | 4.3 | 2024-12-09 | Missing Authorization vulnerability in Noah Hearle, Design Extreme We’re Open! allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2023-25060 | Medium | 5.3 | 2024-12-09 | Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Album and Image Gallery plus Lightbox allows Exploiting Incorrectly Configured Access… |
CVE-2023-25048 | Medium | 5.3 | 2024-12-09 | Missing Authorization vulnerability in Fantastic Plugins Fantastic Content Protector Free allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2023-25037 | Medium | 4.3 | 2024-12-09 | Missing Authorization vulnerability in CodePeople Booking Calendar Contact Form allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2023-25035 | Medium | 6.5 | 2024-12-09 | Missing Authorization vulnerability in Fullworks Quick Contact Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2023-25026 | Medium | 4.3 | 2024-12-09 | Missing Authorization vulnerability in PayPal PayPal Brasil para WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2023-24407 | Medium | 5.0 | 2024-12-09 | Missing Authorization vulnerability in WpDevArt Booking calendar, Appointment Booking System allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2023-24375 | Low | 3.5 | 2024-12-09 | Missing Authorization vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Exploiting Incorrectly Config… |
CVE-2023-23986 | Medium | 5.4 | 2024-12-09 | Missing Authorization vulnerability in Noah Hearle, Design Extreme Reviews and Rating – Google My Business allows Exploiting Incorrectly Configured Access Cont… |
CVE-2023-23975 | Medium | 5.3 | 2024-12-09 | Missing Authorization vulnerability in Fullworks Quick Event Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2023-23895 | Medium | 4.7 | 2024-12-09 | Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2023-23893 | Medium | 5.3 | 2024-12-09 | Missing Authorization vulnerability in Igor Benic Simple Giveaways allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects S… |
CVE-2023-23887 | Medium | 5.3 | 2024-12-09 | Missing Authorization vulnerability in Shaon Easy Google Analytics for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2023-23886 | Medium | 5.4 | 2024-12-09 | Missing Authorization vulnerability in mg12 WP-RecentComments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Rec… |
CVE-2023-23868 | Medium | 5.4 | 2024-12-09 | Missing Authorization vulnerability in WPFactory Cost of Goods for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2023-23834 | Medium | 4.3 | 2024-12-09 | Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spec… |
CVE-2023-23825 | Low | 3.1 | 2024-12-09 | Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spec… |
CVE-2023-23823 | Medium | 4.3 | 2024-12-09 | Missing Authorization vulnerability in Clever Widgets Enhanced Text Widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2023-23814 | Low | 3.8 | 2024-12-09 | Missing Authorization vulnerability in CodePeople CP Multi View Event Calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2023-23726 | Medium | 5.4 | 2024-12-09 | Cross-Site Request Forgery (CSRF) vulnerability in Tickera.com Tickera allows Cross Site Request Forgery.This issue affects Tickera: from n/a through 3.5.1.0. |
CVE-2023-23725 | Medium | 4.3 | 2024-12-09 | Missing Authorization vulnerability in Chris Baldelomar Shortcodes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects S… |
CVE-2023-23716 | Medium | 4.3 | 2024-12-09 | Missing Authorization vulnerability in Zendesk Zendesk Support for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2023-23715 | Medium | 5.2 | 2024-12-09 | Missing Authorization vulnerability in JobBoardWP JobBoardWP – Job Board Listings and Submissions allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2023-22708 | Medium | 4.3 | 2024-12-09 | Missing Authorization vulnerability in Karim Salman Kraken.io Image Optimizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2023-22701 | High | 7.5 | 2024-12-09 | Missing Authorization vulnerability in Shopfiles Ltd Ebook Store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ebo… |
CVE-2023-50913 | Critical | 9.1 | 2024-12-05 | Oxide control plane software before 5 allows SSRF. |
CVE-2023-48010 | Critical | 9.8 | 2024-12-05 | STMicroelectronics SPC58 is vulnerable to Missing Protection Mechanism for Alternate Hardware Interface. Code running as Supervisor on the SPC58 PowerPC microc… |
CVE-2023-6978 | Medium | 6.1 | 2024-12-04 | The WP Job Manager – Company Profiles plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'company' parameter in all versions up to, a… |
CVE-2023-52944 | Medium | 4.3 | 2024-12-04 | Incorrect authorization vulnerability in ActionRule webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authentic… |
CVE-2023-52943 | Medium | 4.3 | 2024-12-04 | Incorrect authorization vulnerability in Alert.Setting webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authen… |
CVE-2023-52922 | High | 7.8 | 2024-11-28 | In the Linux kernel, the following vulnerability has been resolved: can: bcm: Fix UAF in bcm_proc_show() BUG: KASAN: slab-use-after-free in bcm_proc_show+0x9… |
CVE-2023-29001 | High | 7.5 | 2024-11-27 | Contiki-NG is an open-source, cross-platform operating system for IoT devices. The Contiki-NG operating system processes source routing headers (SRH) in its tw… |
CVE-2023-2142 | Medium | 6.1 | 2024-11-26 | In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality. If there are two… |
CVE-2023-1521 | High | 7.8 | 2024-11-26 | On Linux the sccache client can execute arbitrary code with the privileges of a local sccache server, by preloading the code in a shared library passed to LD_P… |
CVE-2023-0163 | High | 8.4 | 2024-11-26 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Mozilla Convict. This allows an attacker to inject… |
CVE-2023-45181 | Medium | 6.1 | 2024-11-25 | IBM Jazz Foundation 7.0.2 and below are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI th… |
CVE-2023-26280 | Medium | 5.3 | 2024-11-25 | IBM Jazz Foundation 7.0.2 and 7.0.3 could allow a user to change their dashboard using a specially crafted HTTP request due to improper access control. |
CVE-2023-7299 | Medium | 6.3 | 2024-11-23 | A vulnerability was found in DataGear up to 4.60. It has been declared as critical. This vulnerability affects unknown code of the file /dataSet/resolveSql. Th… |
CVE-2023-52335 | High | 7.5 | 2024-11-22 | Advantech iView ConfigurationServlet SQL Injection Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive infor… |
CVE-2023-52334 | Medium | 6.5 | 2024-11-22 | Allegra downloadAttachmentGlobal Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive inf… |
CVE-2023-52333 | High | 7.3 | 2024-11-22 | Allegra saveFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected inst… |
CVE-2023-52332 | High | 7.5 | 2024-11-22 | Allegra serveMathJaxLibraries Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive inform… |
CVE-2023-51648 | Medium | 6.5 | 2024-11-22 | Allegra getFileContentAsString Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive infor… |
CVE-2023-51647 | Medium | 4.7 | 2024-11-22 | Allegra saveInlineEdit Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affecte… |
CVE-2023-51646 | Medium | 4.7 | 2024-11-22 | Allegra uploadSimpleFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affec… |
CVE-2023-51645 | Medium | 4.7 | 2024-11-22 | Allegra unzipFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected ins… |
CVE-2023-51644 | High | 7.3 | 2024-11-22 | Allegra SiteConfigAction Improper Access Control Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2023-51643 | Medium | 4.7 | 2024-11-22 | Allegra uploadFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected in… |
CVE-2023-51642 | Medium | 6.3 | 2024-11-22 | Allegra loadFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary c… |
CVE-2023-51641 | Medium | 6.3 | 2024-11-22 | Allegra renderFieldMatch Deserialization of Unstrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar… |
CVE-2023-51640 | Medium | 4.7 | 2024-11-22 | Allegra extarctZippedFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affe… |
CVE-2023-51639 | Critical | 9.8 | 2024-11-22 | Allegra downloadExportedChart Directory Traversal Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on a… |
CVE-2023-51638 | Critical | 9.8 | 2024-11-22 | Allegra Hard-coded Credentials Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installatio… |
CVE-2023-51635 | High | 8.8 | 2024-11-22 | NETGEAR RAX30 fing_dil Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitra… |
CVE-2023-51634 | High | 7.5 | 2024-11-22 | NETGEAR RAX30 Improper Certificate Validation Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to compromise the integ… |
CVE-2023-39470 | High | 7.2 | 2024-11-22 | PaperCut NG print.script.sandboxed Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitr… |
CVE-2023-24467 | High | 8.8 | 2024-11-22 | Possible Command Injection in iManager GET parameter has been discovered in OpenText™ iManager 3.2.6.0000. |
CVE-2023-24466 | High | 7.5 | 2024-11-22 | Possible XML External Entity Injection in iManager GET parameter has been discovered in OpenText™ iManager 3.2.6.0200. |
CVE-2023-27609 | Medium | 5.9 | 2024-11-19 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in NetTantra WP Roles at Registration allows Stored X… |
CVE-2023-21270 | High | 7.8 | 2024-11-19 | In restorePermissionState of PermissionManagerServiceImpl.java, there is a possible way for an app to keep permissions that should be revoked due to incorrect… |
CVE-2023-52921 | High | 7.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix possible UAF in amdgpu_cs_pass1() Since the gang_size check is outside of… |
CVE-2023-49952 | High | 7.5 | 2024-11-18 | Mastodon 4.1.x before 4.1.17 and 4.2.x before 4.2.9 allows a bypass of rate limiting via a crafted HTTP request header. |
CVE-2023-39180 | Medium | 4.0 | 2024-11-18 | A flaw was found within the handling of SMB2_READ commands in the kernel ksmbd module. The issue results from not releasing memory after its effective lifetime… |
CVE-2023-39179 | High | 7.5 | 2024-11-18 | A flaw was found within the handling of SMB2 read requests in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied da… |
CVE-2023-39176 | Medium | 5.8 | 2024-11-18 | A flaw was found within the parsing of SMB2 requests that have a transform header in the kernel ksmbd module. The issue results from the lack of proper validat… |
CVE-2023-43091 | Critical | 9.8 | 2024-11-17 | A flaw was found in GNOME Maps, which is vulnerable to a code injection attack via its service.json configuration file. If the configuration file is malicious… |
CVE-2023-6110 | Medium | 5.5 | 2024-11-17 | A flaw was found in OpenStack. When a user tries to delete a non-existing access rule in it's scope, it deletes other existing access rules which are not assoc… |
CVE-2023-4639 | High | 7.4 | 2024-11-17 | A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacke… |
CVE-2023-1419 | Medium | 5.9 | 2024-11-17 | A script injection vulnerability was found in the Debezium database connector, where it does not properly sanitize some parameters. This flaw allows an attacke… |
CVE-2023-0657 | Low | 3.4 | 2024-11-17 | A flaw was found in Keycloak. This issue occurs due to improperly enforcing token types when validating signatures locally. This could allow an authenticated a… |
CVE-2023-20094 | Medium | 4.3 | 2024-11-15 | A vulnerability in Cisco TelePresence CE and RoomOS could allow an unauthenticated, adjacent attacker to view sensitive information on an affected device. T… |
CVE-2023-20093 | Medium | 4.4 | 2024-11-15 | Three vulnerabilities in the CLI of Cisco TelePresence CE and RoomOS could allow an authenticated, local attacker to overwrite arbitrary files on the local fil… |
CVE-2023-20092 | Medium | 4.4 | 2024-11-15 | Three vulnerabilities in the CLI of Cisco TelePresence CE and RoomOS could allow an authenticated, local attacker to overwrite arbitrary files on the local fil… |
CVE-2023-20091 | Medium | 5.1 | 2024-11-15 | A vulnerability in the CLI of Cisco TelePresence CE and RoomOS could allow an authenticated, local attacker to overwrite arbitrary files on the local file syst… |
CVE-2023-20090 | Medium | 6.7 | 2024-11-15 | A vulnerability in Cisco TelePresence CE and RoomOS could allow an authenticated, local attacker to elevate privileges to root on an affected device. This v… |
CVE-2023-20060 | Medium | 6.1 | 2024-11-15 | A vulnerability in the web-based management interface of Cisco Prime Collaboration Deployment could allow an unauthenticated, remote attacker to conduct a cros… |
CVE-2023-20039 | Medium | 5.5 | 2024-11-15 | A vulnerability in Cisco IND could allow an authenticated, local attacker to read application data. This vulnerability is due to insufficient default file p… |
CVE-2023-20036 | Critical | 9.9 | 2024-11-15 | A vulnerability in the web UI of Cisco IND could allow an authenticated, remote attacker to execute arbitrary commands with administrative privileges on the un… |