2023 CVEs (page 240)
Page 240 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-20704 | Medium | 5.5 | 2023-05-15 | In apu, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution priv… |
CVE-2023-20703 | Medium | 5.5 | 2023-05-15 | In apu, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution priv… |
CVE-2023-20701 | Medium | 6.7 | 2023-05-15 | In widevine, there is a possible out of bounds write due to a logic error. This could lead to local escalation of privilege with System execution privileges ne… |
CVE-2023-20700 | Medium | 6.7 | 2023-05-15 | In widevine, there is a possible out of bounds write due to a logic error. This could lead to local escalation of privilege with System execution privileges ne… |
CVE-2023-20699 | Medium | 6.7 | 2023-05-15 | In adsp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileg… |
CVE-2023-20698 | Medium | 4.4 | 2023-05-15 | In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution priv… |
CVE-2023-20697 | Medium | 4.4 | 2023-05-15 | In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution priv… |
CVE-2023-20696 | Medium | 6.7 | 2023-05-15 | In preloader, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution pri… |
CVE-2023-20695 | Medium | 6.7 | 2023-05-15 | In preloader, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution pri… |
CVE-2023-20694 | Medium | 6.7 | 2023-05-15 | In preloader, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution pri… |
CVE-2023-20673 | Medium | 6.7 | 2023-05-15 | In vcu, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2023-1729 | Medium | 6.5 | 2023-05-15 | A flaw was found in LibRaw. A heap-buffer-overflow in raw2image_ex() caused by a maliciously crafted file may lead to an application crash. |
CVE-2023-32309 | High | 7.5 | 2023-05-15 | PyMdown Extensions is a set of extensions for the `Python-Markdown` markdown project. In affected versions an arbitrary file read is possible when using includ… |
CVE-2023-32308 | High | 8.2 | 2023-05-15 | anuko timetracker is an open source time tracking system. Boolean-based blind SQL injection vulnerability existed in Time Tracker invoices.php in versions prio… |
CVE-2023-32068 | Medium | 4.7 | 2023-05-15 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 14.10.4 it's possible to exploit… |
CVE-2023-31145 | Medium | 4.3 | 2023-05-15 | Collabora Online is a collaborative online office suite based on LibreOffice technology. This vulnerability report describes a reflected XSS vulnerability with… |
CVE-2023-32314 | Critical | 9.8 | 2023-05-15 | vm2 is a sandbox that can run untrusted code with Node's built-in modules. A sandbox escape vulnerability exists in vm2 for versions up to and including 3.9.17… |
CVE-2023-32313 | Medium | 5.3 | 2023-05-15 | vm2 is a sandbox that can run untrusted code with Node's built-in modules. In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to… |
CVE-2023-30245 | Critical | 9.8 | 2023-05-15 | SQL injection vulnerability found in Judging Management System v.1.0 allows a remote attacker to execute arbitrary code via the crit_id parameter of the edit_c… |
CVE-2023-32787 | High | 7.5 | 2023-05-15 | The OPC UA Legacy Java Stack before 6f176f2 enables an attacker to block OPC UA server applications via uncontrolled resource consumption so that they can no l… |
CVE-2023-31631 | High | 7.5 | 2023-05-15 | An issue in the sqlo_preds_contradiction component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL s… |
CVE-2023-31630 | High | 7.5 | 2023-05-15 | An issue in the sqlo_query_spec component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2023-31629 | High | 7.5 | 2023-05-15 | An issue in the sqlo_union_scope component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statement… |
CVE-2023-31628 | High | 7.5 | 2023-05-15 | An issue in the stricmp component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2023-31627 | High | 7.5 | 2023-05-15 | An issue in the strhash component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2023-31626 | High | 7.5 | 2023-05-15 | An issue in the gpf_notice component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2023-31625 | High | 7.5 | 2023-05-15 | An issue in the psiginfo component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2023-31624 | High | 7.5 | 2023-05-15 | An issue in the sinv_check_exp component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2023-31623 | High | 7.5 | 2023-05-15 | An issue in the mp_box_copy component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2023-31622 | High | 7.5 | 2023-05-15 | An issue in the sqlc_make_policy_trig component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL stat… |
CVE-2023-31621 | High | 7.5 | 2023-05-15 | An issue in the kc_var_col component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2023-31620 | High | 7.5 | 2023-05-15 | An issue in the dv_compare component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2023-31619 | High | 7.5 | 2023-05-15 | An issue in the sch_name_to_object component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL stateme… |
CVE-2023-31618 | High | 7.5 | 2023-05-15 | An issue in the sqlc_union_dt_wrap component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL stateme… |
CVE-2023-31617 | High | 7.5 | 2023-05-15 | An issue in the dk_set_delete component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2023-31616 | High | 7.5 | 2023-05-15 | An issue in the bif_mod component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2023-31615 | High | 7.5 | 2023-05-15 | An issue in the chash_array component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2023-31614 | High | 7.5 | 2023-05-15 | An issue in the mp_box_deserialize_string function in openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) after running a S… |
CVE-2023-31613 | High | 7.5 | 2023-05-15 | An issue in the __nss_database_lookup component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL stat… |
CVE-2023-31612 | High | 7.5 | 2023-05-15 | An issue in the dfe_qexp_list component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2023-31611 | High | 7.5 | 2023-05-15 | An issue in the __libc_longjmp component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2023-31610 | High | 7.5 | 2023-05-15 | An issue in the _IO_default_xsputn component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL stateme… |
CVE-2023-31609 | High | 7.5 | 2023-05-15 | An issue in the dfe_unit_col_loci component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statemen… |
CVE-2023-31608 | High | 7.5 | 2023-05-15 | An issue in the artm_div_int component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2023-31607 | High | 7.5 | 2023-05-15 | An issue in the __libc_malloc component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2023-29861 | Critical | 9.8 | 2023-05-15 | An issue found in FLIR-DVTEL version not specified allows a remote attacker to execute arbitrary code via a crafted request to the management page of the devic… |
CVE-2023-31845 | High | 7.2 | 2023-05-15 | Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/manage_class.php?id=. |
CVE-2023-31844 | High | 7.2 | 2023-05-15 | Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/manage_subject.php?id=. |
CVE-2023-31843 | High | 7.2 | 2023-05-15 | Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/view_faculty.php?id=. |
CVE-2023-31842 | High | 7.2 | 2023-05-15 | Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/index.php?page=edit_faculty&id=. |
CVE-2023-2180 | High | 7.5 | 2023-05-15 | The KIWIZ Invoices Certification & PDF System WordPress plugin through 2.1.3 does not validate the path of files to be downloaded, which could allow unauthenti… |
CVE-2023-2179 | Medium | 6.5 | 2023-05-15 | The WooCommerce Order Status Change Notifier WordPress plugin through 1.1.0 does not have authorisation and CSRF when updating status orders via an AJAX action… |
CVE-2023-2009 | Medium | 4.8 | 2023-05-15 | Plugin does not sanitize and escape the URL field in the Pretty Url WordPress plugin through 1.5.4 settings, which could allow high-privilege users to perform… |
CVE-2023-29862 | Critical | 9.8 | 2023-05-15 | An issue found in Agasio-Camera device version not specified allows a remote attacker to execute arbitrary code via the check and authLevel parameters. |
CVE-2023-23682 | Medium | 5.9 | 2023-05-15 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Snap Creek Software EZP Maintenance Mode plugin <= 1.0.1 versions. |
CVE-2023-1915 | Medium | 6.1 | 2023-05-15 | The Thumbnail carousel slider WordPress plugin before 1.1.10 does not sanitise and escape some parameters before outputting them back in pages, leading to Refl… |
CVE-2023-1890 | Medium | 6.1 | 2023-05-15 | The Tablesome WordPress plugin before 1.0.9 does not escape various generated URLs, before outputting them in attributes when some notices are displayed, leadi… |
CVE-2023-1839 | Medium | 4.8 | 2023-05-15 | The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.6 does not sanitize and escape some of its setting fields, which could allow high-priv… |
CVE-2023-1835 | Medium | 6.1 | 2023-05-15 | The Ninja Forms Contact Form WordPress plugin before 3.6.22 does not properly escape user input before outputting it back in an admin page, leading to a Reflec… |
CVE-2023-1596 | Medium | 6.1 | 2023-05-15 | The tagDiv Composer WordPress plugin before 4.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Si… |
CVE-2023-1549 | High | 7.2 | 2023-05-15 | The Ad Inserter WordPress plugin before 2.7.27 unserializes user input provided via the settings, which could allow high privilege users such as admin to perfo… |
CVE-2023-1207 | High | 7.2 | 2023-05-15 | This HTTP Headers WordPress plugin before 1.18.8 has an import functionality which executes arbitrary SQL on the server, leading to an SQL Injection vulnerabil… |
CVE-2023-1019 | Medium | 5.4 | 2023-05-15 | The Help Desk WP WordPress plugin through 1.2.0 does not sanitise and escape some parameters, which could allow users with a role as low as Editor to perform C… |
CVE-2023-0892 | Medium | 4.8 | 2023-05-15 | The BizLibrary WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2023-0812 | High | 7.5 | 2023-05-15 | The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.1 does not have proper authorization or nonce values for some POST requests, le… |
CVE-2023-0763 | Medium | 4.3 | 2023-05-15 | The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting Holidays, which could allow attackers to… |
CVE-2023-0762 | Medium | 4.3 | 2023-05-15 | The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting designations, which could allow attacker… |
CVE-2023-0761 | Medium | 4.3 | 2023-05-15 | The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting Staff members, which could allow attacke… |
CVE-2023-0644 | Medium | 6.1 | 2023-05-15 | The Push Notifications for WordPress by PushAssist WordPress plugin through 3.0.8 does not sanitise and escape various parameters before outputting them back i… |
CVE-2023-0600 | Critical | 9.8 | 2023-05-15 | The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.9 does not escape user input which is concatenated to an SQL query, allowing unauthenti… |
CVE-2023-0520 | Medium | 5.4 | 2023-05-15 | The RapidExpCart WordPress plugin through 1.0 does not sanitize and escape the url parameter in the rapidexpcart endpoint before storing it and outputting it b… |
CVE-2023-0490 | Medium | 5.4 | 2023-05-15 | The f(x) TOC WordPress plugin through 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the… |
CVE-2023-0233 | Medium | 5.4 | 2023-05-15 | The ActiveCampaign WordPress plugin before 8.1.12 does not validate and escape some of its block options before outputting them back in a page/post where the b… |
CVE-2023-31986 | Critical | 9.8 | 2023-05-15 | A Command Injection vulnerability in Edimax Wireless Router N300 Firmware BR-6428NS_v4 allows attacker to execute arbitrary code via the setWAN function in /bi… |
CVE-2023-23688 | Medium | 6.5 | 2023-05-15 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Sumo Social Share Boost plugin <= 4.4 versions. |
CVE-2023-23683 | Medium | 5.9 | 2023-05-15 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ozan Canakli White Label Branding for Elementor Page Builder plugin <= 1.0.2 versions. |
CVE-2023-23674 | Medium | 5.9 | 2023-05-15 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in RVOLA WP Original Media Path plugin <= 2.4.0 versions. |
CVE-2023-23654 | Medium | 5.9 | 2023-05-15 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SparkPost plugin <= 3.2.5 versions. |
CVE-2023-22717 | Medium | 6.5 | 2023-05-15 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in nCrafts FormCraft plugin <= 1.2.6 versions. |
CVE-2023-22706 | High | 7.1 | 2023-05-15 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in PropertyHive plugin <= 1.5.48 versions. |
CVE-2023-31409 | Medium | 5.3 | 2023-05-15 | Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an remote… |
CVE-2023-31408 | Medium | 5.3 | 2023-05-15 | Cleartext Storage of Sensitive Information in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a… |
CVE-2023-23450 | Medium | 6.2 | 2023-05-15 | Use of Password Hash Instead of Password for Authentication in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524… |
CVE-2023-23449 | Medium | 5.3 | 2023-05-15 | Observable Response Discrepancy in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a remote att… |
CVE-2023-23448 | Medium | 5.3 | 2023-05-15 | Inclusion of Sensitive Information in Source Code in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 a… |
CVE-2023-23447 | High | 7.5 | 2023-05-15 | Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivi… |
CVE-2023-23446 | High | 7.5 | 2023-05-15 | Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remo… |
CVE-2023-23445 | High | 7.5 | 2023-05-15 | Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remo… |
CVE-2023-22703 | High | 7.1 | 2023-05-15 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Webcodin WCP Contact Form plugin <= 3.1.0 versions. |
CVE-2023-22690 | Medium | 5.9 | 2023-05-15 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Shopfiles Ltd Ebook Store plugin <= 5.775 versions. |
CVE-2023-22684 | Medium | 5.9 | 2023-05-15 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Subscribers.Com Subscribers plugin <= 1.5.3 versions. |
CVE-2023-22318 | High | 7.5 | 2023-05-15 | Denial of service in Webconf in Tribe29 Checkmk Appliance before 1.6.5. |
CVE-2023-1698 | Critical | 9.8 | 2023-05-15 | In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can resul… |
CVE-2023-32784 | High | 7.5 | 2023-05-15 | In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace is locked or no longer running. T… |
CVE-2023-32758 | High | 7.5 | 2023-05-15 | giturlparse (aka git-url-parse) through 1.2.2, as used in Semgrep 1.5.2 through 1.24.1, is vulnerable to ReDoS (Regular Expression Denial of Service) if parsin… |
CVE-2023-2699 | Medium | 6.3 | 2023-05-14 | A vulnerability, which was classified as critical, has been found in SourceCodester Lost and Found Information System 1.0. Affected by this issue is some unkno… |
CVE-2023-2698 | Medium | 6.3 | 2023-05-14 | A vulnerability classified as critical was found in SourceCodester Lost and Found Information System 1.0. Affected by this vulnerability is an unknown function… |
CVE-2023-2697 | Medium | 6.3 | 2023-05-14 | A vulnerability classified as critical has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file /jurusan/data of th… |
CVE-2023-2696 | Medium | 6.3 | 2023-05-14 | A vulnerability was found in SourceCodester Online Exam System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /matk… |
CVE-2023-2695 | Medium | 6.3 | 2023-05-14 | A vulnerability was found in SourceCodester Online Exam System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /kela… |