2023 CVEs (page 243)
Page 243 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-31153 | Medium | 4.3 | 2023-05-10 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Auto… |
CVE-2023-31152 | Medium | 4.0 | 2023-05-10 | An Authentication Bypass Using an Alternate Path or Channel vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC)… |
CVE-2023-31151 | Medium | 4.7 | 2023-05-10 | An Improper Certificate Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could a… |
CVE-2023-31150 | High | 8.0 | 2023-05-10 | A Storing Passwords in a Recoverable Format vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) database syste… |
CVE-2023-31149 | Critical | 9.1 | 2023-05-10 | An Improper Input Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a… |
CVE-2023-31148 | Critical | 9.1 | 2023-05-10 | An Improper Input Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a… |
CVE-2023-30194 | Critical | 9.8 | 2023-05-10 | Prestashop posstaticfooter <= 1.0.0 is vulnerable to SQL Injection via posstaticfooter::getPosCurrentHook(). |
CVE-2023-2310 | Medium | 6.8 | 2023-05-10 | A Channel Accessible by Non-Endpoint vulnerability in the Schweitzer Engineering Laboratories SEL Real-Time Automation Controller (RTAC) could allow a remote a… |
CVE-2023-32076 | Medium | 5.5 | 2023-05-10 | in-toto is a framework to protect supply chain integrity. The in-toto configuration is read from various directories and allows users to configure the behavior… |
CVE-2023-32070 | Critical | 9.0 | 2023-05-10 | XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous attributes/attribute values. This allowed cros… |
CVE-2023-0008 | Medium | 4.4 | 2023-05-10 | A file disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface to exp… |
CVE-2023-0007 | Medium | 6.5 | 2023-05-10 | A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software on Panorama appliances enables an authenticated read-write administrator to st… |
CVE-2023-31568 | High | 8.8 | 2023-05-10 | Podofo v0.10.0 was discovered to contain a heap buffer overflow via the component PoDoFo::PdfEncryptRC4::PdfEncryptRC4. |
CVE-2023-31567 | High | 8.8 | 2023-05-10 | Podofo v0.10.0 was discovered to contain a heap buffer overflow via the component PoDoFo::PdfEncryptAESV3::PdfEncryptAESV3. |
CVE-2023-31566 | High | 8.8 | 2023-05-10 | Podofo v0.10.0 was discovered to contain a heap-use-after-free via the component PoDoFo::PdfEncrypt::IsMetadataEncrypted(). |
CVE-2023-31556 | Medium | 6.5 | 2023-05-10 | podofoinfo 0.10.0 was discovered to contain a segmentation violation via the function PoDoFo::PdfDictionary::findKeyParent. |
CVE-2023-31555 | Medium | 6.5 | 2023-05-10 | podofoinfo 0.10.0 was discovered to contain a segmentation violation via the function PoDoFo::PdfObject::DelayedLoad. |
CVE-2023-30356 | High | 7.5 | 2023-05-10 | Missing Support for an Integrity Check in Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 allows attackers to update the device with crafted firmwa… |
CVE-2023-30354 | Critical | 9.8 | 2023-05-10 | Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 does not defend against physical access to U-Boot via the UART: the Wi-Fi password is shown, and th… |
CVE-2023-30353 | Critical | 9.8 | 2023-05-10 | Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 allows unauthenticated remote code execution via an XML document. |
CVE-2023-30352 | Critical | 9.8 | 2023-05-10 | Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 was discovered to contain a hard-coded default password for the RTSP feed. |
CVE-2023-30351 | High | 7.5 | 2023-05-10 | Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 was discovered to contain a hard-coded default password for root which is stored using weak encrypt… |
CVE-2023-2630 | Medium | 4.8 | 2023-05-10 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21. |
CVE-2023-2629 | High | 7.8 | 2023-05-10 | Improper Neutralization of Formula Elements in a CSV File in GitHub repository pimcore/customer-data-framework prior to 3.3.9. |
CVE-2023-31910 | High | 7.8 | 2023-05-10 | Jerryscript 3.0 (commit 05dbbd1) was discovered to contain a heap-buffer-overflow via the component parser_parse_function_statement at /jerry-core/parser/js/js… |
CVE-2023-31908 | High | 7.8 | 2023-05-10 | Jerryscript 3.0 (commit 05dbbd1) was discovered to contain a heap-buffer-overflow via the component ecma_builtin_typedarray_prototype_sort. |
CVE-2023-31907 | High | 7.8 | 2023-05-10 | Jerryscript 3.0.0 was discovered to contain a heap-buffer-overflow via the component scanner_literal_is_created at /jerry-core/parser/js/js-scanner-util.c. |
CVE-2023-31906 | High | 7.8 | 2023-05-10 | Jerryscript 3.0.0(commit 1a2c047) was discovered to contain a heap-buffer-overflow via the component lexer_compare_identifier_to_chars at /jerry-core/parser/js… |
CVE-2023-31471 | Critical | 9.8 | 2023-05-10 | An issue was discovered on GL.iNet devices before 3.216. Through the software installation feature, it is possible to install arbitrary software, such as a rev… |
CVE-2023-29930 | High | 8.8 | 2023-05-10 | An issue was found in Genesys CIC Polycom phone provisioning TFTP Server all version allows a remote attacker to execute arbitrary code via the login crednetia… |
CVE-2023-27564 | High | 7.5 | 2023-05-10 | The n8n package 0.218.0 for Node.js allows Information Disclosure. |
CVE-2023-27563 | High | 8.8 | 2023-05-10 | The n8n package 0.218.0 for Node.js allows Escalation of Privileges. |
CVE-2023-27562 | Medium | 6.5 | 2023-05-10 | The n8n package 0.218.0 for Node.js allows Directory Traversal. |
CVE-2023-28411 | Medium | 6.3 | 2023-05-10 | Double free in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable information disclosure via local access. |
CVE-2023-28410 | High | 8.8 | 2023-05-10 | Improper restriction of operations within the bounds of a memory buffer in some Intel(R) i915 Graphics drivers for linux before kernel version 6.2.10 may allow… |
CVE-2023-27386 | Medium | 6.7 | 2023-05-10 | Uncontrolled search path in some Intel(R) Pathfinder for RISC-V software may allow an authenticated user to potentially enable escalation of privilege via loca… |
CVE-2023-27382 | Medium | 6.7 | 2023-05-10 | Incorrect default permissions in the Audio Service for some Intel(R) NUC P14E Laptop Element software for Windows 10 before version 1.0.0.156 may allow an auth… |
CVE-2023-27298 | High | 8.8 | 2023-05-10 | Uncontrolled search path in the WULT software maintained by Intel(R) before version 1.0.0 (commit id 592300b) may allow an unauthenticated user to potentially… |
CVE-2023-25776 | Medium | 6.3 | 2023-05-10 | Improper input validation in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable information disclosure via local… |
CVE-2023-25772 | Medium | 5.0 | 2023-05-10 | Improper input validation in the Intel(R) Retail Edge Mobile Android application before version 3.0.301126-RELEASE may allow an authenticated user to potential… |
CVE-2023-25771 | Medium | 5.8 | 2023-05-10 | Improper access control for some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable denial of service via local access. |
CVE-2023-25568 | High | 8.2 | 2023-05-10 | Boxo, formerly known as go-libipfs, is a library for building IPFS applications and implementations. In versions 0.4.0 and 0.5.0, if an attacker is able alloca… |
CVE-2023-25545 | High | 8.2 | 2023-05-10 | Improper buffer restrictions in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable escalation of privilege via l… |
CVE-2023-25179 | Medium | 5.0 | 2023-05-10 | Uncontrolled resource consumption in the Intel(R) Unite(R) android application before Release 17 may allow an authenticated user to potentially enable denial o… |
CVE-2023-25175 | Medium | 6.1 | 2023-05-10 | Improper input validation in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable information disclosure via local… |
CVE-2023-24475 | Medium | 6.0 | 2023-05-10 | Out of bounds read in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable information disclosure via local access. |
CVE-2023-23910 | Low | 3.9 | 2023-05-10 | Out-of-bounds write for some Intel(R) Trace Analyzer and Collector software before version 2021.8.0 published Dec 2022 may allow an authenticated user to poten… |
CVE-2023-23909 | Low | 2.8 | 2023-05-10 | Out-of-bounds read for some Intel(R) Trace Analyzer and Collector software before version 2021.8.0 published Dec 2022 may allow an authenticated user to potent… |
CVE-2023-23580 | Medium | 4.8 | 2023-05-10 | Stack-based buffer overflow for some Intel(R) Trace Analyzer and Collector software before version 2021.8.0 published Dec 2022 may allow an authenticated user… |
CVE-2023-23573 | Medium | 4.4 | 2023-05-10 | Improper access control in the Intel(R) Unite(R) android application before Release 17 may allow a privileged user to potentially enable information disclosure… |
CVE-2023-23569 | High | 7.8 | 2023-05-10 | Stack-based buffer overflow for some Intel(R) Trace Analyzer and Collector software before version 2021.8.0 published Dec 2022 may allow an authenticated user… |
CVE-2023-22661 | High | 8.2 | 2023-05-10 | Buffer overflow in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable escalation of privilege via local access. |
CVE-2023-22447 | Low | 2.0 | 2023-05-10 | Insertion of sensitive information into log file in the Open CAS software for Linux maintained by Intel before version 22.6.2 may allow a privileged user to po… |
CVE-2023-22443 | Medium | 6.0 | 2023-05-10 | Integer overflow in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable denial of service via local access. |
CVE-2023-22442 | High | 7.9 | 2023-05-10 | Out of bounds write in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable escalation of privilege via local acce… |
CVE-2023-22440 | Medium | 6.7 | 2023-05-10 | Incorrect default permissions in the Intel(R) SCS Add-on software installer for Microsoft SCCM all versions may allow an authenticated user to potentially enab… |
CVE-2023-22379 | Medium | 6.7 | 2023-05-10 | Improper input validation in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable information disclosure via local… |
CVE-2023-22355 | Medium | 6.7 | 2023-05-10 | Uncontrolled search path in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.0.251 may allow an authenticated user to potentia… |
CVE-2023-22312 | High | 7.2 | 2023-05-10 | Improper access control for some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2023-22297 | High | 8.2 | 2023-05-10 | Access of memory location after end of buffer in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable escalation o… |
CVE-2023-1732 | Medium | 5.3 | 2023-05-10 | When sampling randomness for a shared secret, the implementation of Kyber and FrodoKEM, did not check whether crypto/rand.Read() returns an error. In rare depl… |
CVE-2023-30746 | Medium | 5.9 | 2023-05-10 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Booqable Rental Software Booqable Rental plugin <= 2.4.15 versions. |
CVE-2023-29101 | High | 7.1 | 2023-05-10 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Muffingroup Betheme theme <= 26.7.5 versions. |
CVE-2023-27455 | High | 7.1 | 2023-05-10 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Maui Marketing Update Image Tag Alt Attribute plugin <= 2.4.5 versions. |
CVE-2023-27419 | High | 7.1 | 2023-05-10 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Everest themes Viable Blog theme <= 1.1.4 versions. |
CVE-2023-24406 | Medium | 5.9 | 2023-05-10 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Muneeb ur Rehman Simple PopUp plugin <= 1.8.6 versions. |
CVE-2023-23873 | Medium | 6.5 | 2023-05-10 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Flector BBSpoiler plugin <= 2.01 versions. |
CVE-2023-23794 | Medium | 5.9 | 2023-05-10 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alex Moss Semalt Blocker plugin <= 1.1.3 versions. |
CVE-2023-22696 | Medium | 6.5 | 2023-05-10 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Custom4Web Affiliate Links Lite plugin <= 2.5 versions. |
CVE-2023-28932 | Medium | 5.9 | 2023-05-10 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPMobile.App WPMobile.App — Android and iOS Mobile Application plugin <= 11.20 versions. |
CVE-2023-24418 | Medium | 5.9 | 2023-05-10 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Tiny carousel horizontal slider plus plugin <= 3.2 versions. |
CVE-2023-24392 | High | 7.1 | 2023-05-10 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Full Width Banner Slider Wp plugin <= 1.1.7 versions. |
CVE-2023-23812 | Medium | 5.9 | 2023-05-10 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Joost de Valk Enhanced WP Contact Form plugin <= 2.2.3 versions. |
CVE-2023-23789 | Medium | 5.9 | 2023-05-10 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Premmerce Premmerce Redirect Manager plugin <= 1.0.9 versions. |
CVE-2023-23788 | Medium | 5.9 | 2023-05-10 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Florin Arjocu Custom More Link Complete plugin <= 1.4.1 versions. |
CVE-2023-23786 | Medium | 5.9 | 2023-05-10 | Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Christof Servit affiliate-toolkit plugin <= 3.3.3 versions. |
CVE-2023-23701 | Medium | 6.5 | 2023-05-10 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Andrew @ Geeenville Web Design Easy Sign Up plugin <= 3.4.1 versions. |
CVE-2023-22711 | Medium | 6.5 | 2023-05-10 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Agent Evolution IMPress Listings plugin <= 2.6.2 versions. |
CVE-2023-32573 | Medium | 6.5 | 2023-05-10 | In Qt before 5.15.14, 6.0.x through 6.2.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1, QtSvg QSvgFont m_unitsPerEm initialization is mishandled. |
CVE-2023-30777 | High | 7.1 | 2023-05-10 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Engine Advanced Custom Fields Pro, WP Engine Advanced Custom Fields plugins <= 6.1.5 versions. |
CVE-2023-2619 | Medium | 6.3 | 2023-05-10 | A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. This affects the function exec of… |
CVE-2023-2618 | Medium | 5.3 | 2023-05-10 | A vulnerability, which was classified as problematic, has been found in OpenCV wechat_qrcode Module up to 4.7.0. Affected by this issue is the function Decoded… |
CVE-2023-2617 | Medium | 5.3 | 2023-05-10 | A vulnerability classified as problematic was found in OpenCV wechat_qrcode Module up to 4.7.0. Affected by this vulnerability is the function DecodedBitStream… |
CVE-2023-2615 | Medium | 5.4 | 2023-05-10 | Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21. |
CVE-2023-2614 | Medium | 5.4 | 2023-05-10 | Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21. |
CVE-2023-27919 | Medium | 5.3 | 2023-05-10 | Authentication bypass vulnerability in NEXT ENGINE Integration Plugin (for EC-CUBE 2.0 series) all versions allows a remote unauthenticated attacker to alter t… |
CVE-2023-27918 | Medium | 6.1 | 2023-05-10 | Cross-site scripting vulnerability in Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76 allows a remote unauthenticated at… |
CVE-2023-27889 | High | 8.8 | 2023-05-10 | Cross-site request forgery (CSRF) vulnerability in LIQUID SPEECH BALLOON versions prior to 1.2 allows a remote unauthenticated attacker to hijack the authentic… |
CVE-2023-27888 | Medium | 5.4 | 2023-05-10 | Cross-site scripting vulnerability in Joruri Gw Ver 3.2.5 and earlier allows a remote authenticated attacker to inject an arbitrary script via Message Memo fun… |
CVE-2023-27527 | High | 7.5 | 2023-05-10 | Shinseiyo Sogo Soft (7.9A) and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files o… |
CVE-2023-27510 | High | 7.5 | 2023-05-10 | JB Inquiry form contains an exposure of private personal information to an unauthorized actor vulnerability, which may allow a remote unauthenticated attacker… |
CVE-2023-27385 | High | 7.8 | 2023-05-10 | Heap-based buffer overflow vulnerability exists in CX-Drive All models all versions. By having a user open a specially crafted SDD file, arbitrary code may be… |
CVE-2023-25184 | High | 7.5 | 2023-05-10 | Use of weak credentials exists in Seiko Solutions SkyBridge and SkySpider series, which may allow a remote unauthenticated attacker to decrypt password for the… |
CVE-2023-25072 | High | 7.5 | 2023-05-10 | Use of weak credentials exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier, which may allow a remote unauthenticated attacker to decrypt password… |
CVE-2023-25070 | Medium | 6.5 | 2023-05-10 | Cleartext transmission of sensitive information exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier. If the telnet connection is enabled, a remote… |
CVE-2023-24586 | Medium | 6.5 | 2023-05-10 | Cleartext storage of sensitive information exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier, which may allow a remote authenticated attacker to… |
CVE-2023-23906 | High | 7.5 | 2023-05-10 | Missing authentication for critical function exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier, which may allow a remote unauthenticated attacker… |
CVE-2023-23901 | Medium | 6.5 | 2023-05-10 | Improper following of a certificate's chain of trust exists in SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier, and SkyBridge BASIC MB-A130 firmware Ver… |
CVE-2023-23578 | High | 7.5 | 2023-05-10 | Improper access control vulnerability in SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier allows a remote unauthenticated attacker to connect to the produc… |
CVE-2023-22441 | High | 8.6 | 2023-05-10 | Missing authentication for critical function exists in Seiko Solutions SkyBridge series, which may allow a remote attacker to obtain or alter the setting infor… |