2023 CVEs (page 241)
Page 241 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-2694 | Medium | 6.3 | 2023-05-14 | A vulnerability was found in SourceCodester Online Exam System 1.0. It has been classified as critical. This affects an unknown part of the file /dosen/data of… |
CVE-2023-2693 | Medium | 6.3 | 2023-05-14 | A vulnerability was found in SourceCodester Online Exam System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2023-2692 | Low | 3.5 | 2023-05-14 | A vulnerability has been found in SourceCodester ICT Laboratory Management System 1.0 and classified as problematic. Affected by this vulnerability is an unkno… |
CVE-2023-2691 | Low | 3.5 | 2023-05-14 | A vulnerability, which was classified as problematic, was found in SourceCodester Personnel Property Equipment System 1.0. Affected is an unknown function of t… |
CVE-2023-2690 | Medium | 6.3 | 2023-05-14 | A vulnerability, which was classified as critical, has been found in SourceCodester Personnel Property Equipment System 1.0. This issue affects some unknown pr… |
CVE-2023-2689 | Medium | 6.3 | 2023-05-14 | A vulnerability classified as critical was found in SourceCodester Billing Management System 1.0. This vulnerability affects unknown code of the file editprodu… |
CVE-2023-32303 | Medium | 5.2 | 2023-05-12 | Planet is software that provides satellite data. The secret file stores the user's Planet API authentication information. It should only be accessible by the u… |
CVE-2023-2181 | Medium | 6.3 | 2023-05-12 | An issue has been discovered in GitLab affecting all versions before 15.9.8, 15.10.0 before 15.10.7, and 15.11.0 before 15.11.3. A malicious developer could us… |
CVE-2023-2088 | Medium | 6.5 | 2023-05-12 | A flaw was found in OpenStack due to an inconsistency between Cinder and Nova. This issue can be triggered intentionally or by accident. A remote, authenticate… |
CVE-2023-25009 | High | 7.8 | 2023-05-12 | A malicious actor may convince a user to open a malicious USD file that may trigger an out-of-bounds write vulnerability which could result in code execution. |
CVE-2023-25008 | High | 7.8 | 2023-05-12 | A malicious actor may convince a user to open a malicious USD file that may trigger an out-of-bounds read vulnerability which could result in code execution. |
CVE-2023-25007 | High | 7.8 | 2023-05-12 | A malicious actor may convince a user to open a malicious USD file that may trigger an uninitialized pointer which could result in code execution. |
CVE-2023-25006 | High | 7.8 | 2023-05-12 | A malicious actor may convince a user to open a malicious USD file that may trigger a use-after-free vulnerability which could result in code execution. |
CVE-2023-25005 | High | 7.8 | 2023-05-12 | A maliciously crafted DLL file can be forced to read beyond allocated boundaries in Autodesk InfraWorks 2023, and 2021 when parsing the DLL files could lead to… |
CVE-2023-20880 | Medium | 6.7 | 2023-05-12 | VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privileges… |
CVE-2023-20879 | Medium | 6.7 | 2023-05-12 | VMware Aria Operations contains a Local privilege escalation vulnerability. A malicious actor with administrative privileges in the Aria Operations application… |
CVE-2023-20878 | High | 7.2 | 2023-05-12 | VMware Aria Operations contains a deserialization vulnerability. A malicious actor with administrative privileges can execute arbitrary commands and disrupt th… |
CVE-2023-20877 | High | 8.8 | 2023-05-12 | VMware Aria Operations contains a privilege escalation vulnerability. An authenticated malicious user with ReadOnly privileges can perform code execution leadi… |
CVE-2023-1096 | Critical | 9.8 | 2023-05-12 | SnapCenter versions 4.7 prior to 4.7P2 and 4.8 prior to 4.8P1 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to gain ac… |
CVE-2023-32306 | High | 8.8 | 2023-05-12 | Time Tracker is an open source time tracking system. A time-based blind injection vulnerability existed in Time Tracker reports in versions prior to 1.22.13.57… |
CVE-2023-32305 | High | 8.8 | 2023-05-12 | aiven-extras is a PostgreSQL extension. Versions prior to 1.1.9 contain a privilege escalation vulnerability, allowing elevation to superuser inside PostgreSQL… |
CVE-2023-30247 | Critical | 9.8 | 2023-05-12 | File Upload vulnerability found in Oretnom23 Storage Unit Rental Management System v.1.0 allows a remote attacker to execute arbitrary code via the update_sett… |
CVE-2023-27863 | Medium | 4.4 | 2023-05-12 | IBM Spectrum Protect Plus Server 10.1.13, under specific configurations, could allow an elevated user to obtain SMB credentials that may be used to access vSna… |
CVE-2023-2458 | High | 8.8 | 2023-05-12 | Use after free in ChromeOS Camera in Google Chrome on ChromeOS prior to 113.0.5672.114 allowed a remote attacker who convinced a user to engage in specific UI… |
CVE-2023-2457 | High | 8.8 | 2023-05-12 | Out of bounds write in ChromeOS Audio Server in Google Chrome on ChromeOS prior to 113.0.5672.114 allowed a remote attacker to potentially exploit heap corrupt… |
CVE-2023-25927 | Medium | 6.5 | 2023-05-12 | IBM Security Verify Access 10.0.0, 10.0.1, 10.0.2, 10.0.3, 10.0.4, and 10.0.5 could allow an attacker to crash the webseald process using specially crafted HTT… |
CVE-2023-31983 | Critical | 9.8 | 2023-05-12 | A Command Injection vulnerability in Edimax Wireless Router N300 Firmware BR-6428NS_v4 allows attacker to execute arbitrary code via the mp function in /bin/we… |
CVE-2023-28414 | Medium | 5.9 | 2023-05-12 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in ApexChat plugin <= 1.3.1 versions. |
CVE-2023-25958 | Medium | 5.9 | 2023-05-12 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Justin Saad Simple Tooltips plugin <= 2.1.4 versions. |
CVE-2023-25460 | Medium | 5.9 | 2023-05-12 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CodeSolz Easy Ad Manager plugin <= 1.0.0 versions. |
CVE-2023-25428 | High | 7.8 | 2023-05-12 | A DLL Hijacking issue discovered in Soft-o Free Password Manager 1.1.20 allows attackers to create arbitrary DLLs leading to code execution. |
CVE-2023-23810 | Medium | 5.9 | 2023-05-12 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SnapOrbital Panorama plugin <= 1.5 versions. |
CVE-2023-22685 | Medium | 5.9 | 2023-05-12 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Tips and Tricks HQ, Ruhul Amin Category Specific RSS feed Subscription plugin <= v2.2 version… |
CVE-2023-31199 | High | 7.7 | 2023-05-12 | Improper access control in the Intel(R) Solid State Drive Toolbox(TM) before version 3.4.5 may allow a privileged user to potentially enable escalation of priv… |
CVE-2023-31197 | Medium | 6.7 | 2023-05-12 | Uncontrolled search path in the Intel(R) Trace Analyzer and Collector before version 2020 update 3 may allow an authenticated user to potentially enable escala… |
CVE-2023-30768 | High | 7.7 | 2023-05-12 | Improper access control in the Intel(R) Server Board S2600WTT belonging to the Intel(R) Server Board S2600WT Family with the BIOS version 0016 may allow a priv… |
CVE-2023-30763 | High | 7.2 | 2023-05-12 | Heap-based overflow in Intel(R) SoC Watch based software before version 2021.1 may allow a privileged user to potentially enable escalation of privilege via lo… |
CVE-2023-29242 | Medium | 6.7 | 2023-05-12 | Improper access control for Intel(R) oneAPI Toolkits before version 2021.1 Beta 10 may allow an authenticated user to potentially enable escalation of privileg… |
CVE-2023-23867 | Medium | 6.5 | 2023-05-12 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Gautam Thapar Button Builder – Buttons X plugin <= 0.8.6 versions. |
CVE-2023-32081 | Medium | 6.5 | 2023-05-12 | Vert.x STOMP is a vert.x implementation of the STOMP specification that provides a STOMP server and client. From versions 3.1.0 until 3.9.16 and 4.0.0 until 4… |
CVE-2023-32073 | High | 8.8 | 2023-05-12 | WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulnerability exists at `plugin/CloneSite/cloneClient.json.php` w… |
CVE-2023-31922 | High | 7.5 | 2023-05-12 | QuickJS commit 2788d71 was discovered to contain a stack-overflow via the component js_proxy_isArray at quickjs.c. |
CVE-2023-31921 | Medium | 5.5 | 2023-05-12 | Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the ecma_big_uint_div_mod at jerry-core/ecma/operations/ecma-big-uint.c. |
CVE-2023-31920 | Medium | 5.5 | 2023-05-12 | Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the vm_loop at jerry-core/vm/vm.c. |
CVE-2023-31919 | Medium | 5.5 | 2023-05-12 | Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the jcontext_raise_exception at jerry-core/jcontext/jcontext.c. |
CVE-2023-31918 | Medium | 5.5 | 2023-05-12 | Jerryscript 3.0 (commit 1a2c047) was discovered to contain an Assertion Failure via the parser_parse_function_arguments at jerry-core/parser/js/js-parser.c. |
CVE-2023-31916 | Medium | 5.5 | 2023-05-12 | Jerryscript 3.0 (commit 1a2c047) was discovered to contain an Assertion Failure via the jmem_heap_finalize at jerry-core/jmem/jmem-heap.c. |
CVE-2023-31914 | Medium | 5.5 | 2023-05-12 | Jerryscript 3.0 (commit 05dbbd1) was discovered to contain out-of-memory issue in malloc. |
CVE-2023-31913 | Medium | 5.5 | 2023-05-12 | Jerryscript 3.0 *commit 1a2c047) was discovered to contain an Assertion Failure via the component parser_parse_class at jerry-core/parser/js/js-parser-expr.c. |
CVE-2023-27823 | Critical | 9.8 | 2023-05-12 | An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid credentials. |
CVE-2023-1934 | Critical | 9.8 | 2023-05-12 | The PnPSCADA system, a product of SDG Technologies CC, is afflicted by a critical unauthenticated error-based PostgreSQL Injection vulnerability. Present withi… |
CVE-2023-2682 | Medium | 6.3 | 2023-05-12 | A vulnerability was found in Caton Live up to 2023-04-26 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/ping.cgi o… |
CVE-2023-23444 | High | 7.5 | 2023-05-12 | Missing Authentication for Critical Function in SICK Flexi Classic and Flexi Soft Gateways with Partnumbers 1042193, 1042964, 1044078, 1044072, 1044073, 104407… |
CVE-2023-31985 | Critical | 9.8 | 2023-05-12 | A Command Injection vulnerability in Edimax Wireless Router N300 Firmware BR-6428NS_v4 allows attacker to execute arbitrary code via the formAccept function in… |
CVE-2023-30246 | Critical | 9.8 | 2023-05-12 | SQL injection vulnerability found in Judging Management System v.1.0 allows a remote attacker to execute arbitrary code via the contestant_id parameter. |
CVE-2023-30130 | High | 8.8 | 2023-05-12 | An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter. |
CVE-2023-2512 | Medium | 6.5 | 2023-05-12 | Prior to version v1.20230419.0, the FormData API implementation was subject to an integer overflow. If a FormData instance contained more than 2^31 elements, t… |
CVE-2023-29983 | Medium | 5.4 | 2023-05-12 | Cross Site Scripting vulnerability found in Maximilian Vogt cmaps v.8.0 allows a remote attacker to execute arbitrary code via the auditlog tab in the admin pa… |
CVE-2023-29820 | Medium | 5.5 | 2023-05-12 | An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to access sensitive information via the EXE… |
CVE-2023-29819 | Medium | 5.5 | 2023-05-12 | An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to bypass protections via a crafted payload. |
CVE-2023-29818 | Medium | 5.5 | 2023-05-12 | An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to bypass protections via the default allow… |
CVE-2023-29657 | High | 8.8 | 2023-05-12 | eXtplorer 2.1.15 is vulnerable to Insecure Permissions. File upload in file manager allows uploading zip file containing php pages with arbitrary code executio… |
CVE-2023-27238 | Critical | 9.8 | 2023-05-12 | LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning. |
CVE-2023-27237 | Medium | 6.1 | 2023-05-12 | LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack. |
CVE-2023-23169 | Medium | 6.5 | 2023-05-12 | Synapsoft pdfocus 1.17 is vulnerable to local file inclusion and server-side request forgery Directory Traversal. |
CVE-2023-2678 | Low | 3.5 | 2023-05-12 | A vulnerability has been found in SourceCodester File Tracker Manager System 1.0 and classified as problematic. This vulnerability affects unknown code of the… |
CVE-2023-2677 | Medium | 6.3 | 2023-05-12 | A vulnerability, which was classified as critical, was found in SourceCodester Covid-19 Contact Tracing System 1.0. This affects an unknown part of the file ad… |
CVE-2023-2676 | Medium | 5.5 | 2023-05-12 | A vulnerability, which was classified as critical, has been found in H3C R160 V1004004. Affected by this issue is some unknown functionality of the file /goFor… |
CVE-2023-2672 | Medium | 6.3 | 2023-05-12 | A vulnerability classified as critical has been found in SourceCodester Lost and Found Information System 1.0. Affected is an unknown function of the file item… |
CVE-2023-2671 | Low | 3.5 | 2023-05-12 | A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been rated as problematic. This issue affects some unknown processing… |
CVE-2023-2515 | Medium | 4.7 | 2023-05-12 | Mattermost fails to restrict a user with permissions to edit other users and to create personal access tokens from elevating their privileges to system admin |
CVE-2023-2514 | Medium | 6.7 | 2023-05-12 | Mattermost Sever fails to redact the DB username and password before emitting an application log during server initialization. |
CVE-2023-32243 | Critical | 9.8 | 2023-05-12 | Improper Authentication vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation. This issue affects Essential Addons for Elemen… |
CVE-2023-2674 | Medium | 4.3 | 2023-05-12 | Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1. |
CVE-2023-2670 | Medium | 6.3 | 2023-05-12 | A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been declared as critical. This vulnerability affects unknown code of… |
CVE-2023-2669 | Medium | 6.3 | 2023-05-12 | A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been classified as critical. This affects an unknown part of the file… |
CVE-2023-29246 | High | 7.2 | 2023-05-12 | An attacker who has gained access to an admin account can perform RCE via null-byte injection Vendor: The Apache Software Foundation Versions Affected: Apach… |
CVE-2023-29032 | High | 8.1 | 2023-05-12 | An attacker that has gained access to certain private information can use this to act as other user. Vendor: The Apache Software Foundation Versions Affected… |
CVE-2023-28936 | Medium | 5.3 | 2023-05-12 | Attacker can access arbitrary recording/room Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0 |
CVE-2023-2668 | Medium | 6.3 | 2023-05-12 | A vulnerability was found in SourceCodester Lost and Found Information System 1.0 and classified as critical. Affected by this issue is the function manager_ca… |
CVE-2023-2667 | Low | 3.5 | 2023-05-12 | A vulnerability has been found in SourceCodester Lost and Found Information System 1.0 and classified as problematic. Affected by this vulnerability is an unkn… |
CVE-2023-28522 | Medium | 4.3 | 2023-05-12 | IBM API Connect V10 could allow an authenticated user to perform actions that they should not have access to. IBM X-Force ID: 250585. |
CVE-2023-28520 | Medium | 6.4 | 2023-05-12 | IBM Planning Analytics Local 2.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2023-30330 | Critical | 9.8 | 2023-05-12 | SoftExpert (SE) Excellence Suite 2.x versions before 2.1.3 is vulnerable to Local File Inclusion in the function /se/v42300/generic/gn_defaultframe/2.0/default… |
CVE-2023-2666 | High | 7.5 | 2023-05-12 | Allocation of Resources Without Limits or Throttling in GitHub repository froxlor/froxlor prior to 2.0.16. |
CVE-2023-2665 | High | 7.5 | 2023-05-12 | Storage of Sensitive Data in a Mechanism without Access Control in GitHub repository francoisjacquet/rosariosis prior to 11.0. |
CVE-2023-29809 | Critical | 9.8 | 2023-05-12 | SQL injection vulnerability found in Maximilian Vogt companymaps (cmaps) v.8.0 allows a remote attacker to execute arbitrary code via a crafted script in the r… |
CVE-2023-29808 | Medium | 6.1 | 2023-05-12 | Cross Site Scripting (XSS) vulnerability in vogtmh cmaps (companymaps) 8.0 allows attackers to execute arbitrary code. |
CVE-2023-29790 | High | 7.5 | 2023-05-12 | kodbox 1.2.x through 1.3.7 has a Sensitive Information Leakage issue. |
CVE-2023-30192 | Critical | 9.8 | 2023-05-12 | Prestashop possearchproducts 1.7 is vulnerable to SQL Injection via PosSearch::find(). |
CVE-2023-32059 | High | 7.5 | 2023-05-11 | Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, internal calls with default arguments are compiled incorr… |
CVE-2023-31531 | High | 8.8 | 2023-05-11 | Motorola CX2L Router 1.0.1 was discovered to contain a command injection vulnerability via the tomography_ping_number parameter. |
CVE-2023-31530 | High | 8.8 | 2023-05-11 | Motorola CX2L Router 1.0.1 was discovered to contain a command injection vulnerability via the smartqos_priority_devices parameter. |
CVE-2023-31529 | High | 8.8 | 2023-05-11 | Motorola CX2L Router 1.0.1 was discovered to contain a command injection vulnerability via the system_time_timezone parameter. |
CVE-2023-31528 | High | 8.8 | 2023-05-11 | Motorola CX2L Router 1.0.1 was discovered to contain a command injection vulnerability via the staticroute_list parameter. |
CVE-2023-31502 | High | 7.2 | 2023-05-11 | Altenergy Power Control Software C1.2.5 was discovered to contain a remote code execution (RCE) vulnerability via the component /models/management_model.php. |
CVE-2023-29286 | Medium | 5.5 | 2023-05-11 | Adobe Substance 3D Painter versions 8.3.0 (and earlier) is affected by an Access of Uninitialized Pointer vulnerability that could lead to disclosure of sensit… |
CVE-2023-29285 | High | 7.8 | 2023-05-11 | Adobe Substance 3D Painter versions 8.3.0 (and earlier) is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in th… |
CVE-2023-29284 | High | 7.8 | 2023-05-11 | Adobe Substance 3D Painter versions 8.3.0 (and earlier) is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code executio… |
CVE-2023-29283 | High | 7.8 | 2023-05-11 | Adobe Substance 3D Painter versions 8.3.0 (and earlier) is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution… |