2023 CVEs (page 247)
Page 247 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-0268 | Medium | 5.4 | 2023-05-08 | The Mega Addons For WPBakery Page Builder WordPress plugin before 4.3.0 does not validate and escape some of its shortcode attributes before outputting them ba… |
CVE-2023-0267 | Medium | 5.4 | 2023-05-08 | The Ultimate Carousel For WPBakery Page Builder WordPress plugin through 2.6 does not validate and escape some of its shortcode attributes before outputting th… |
CVE-2023-2575 | High | 8.8 | 2023-05-08 | Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by a Stack-based Buffer Overflow vulnerability, which can be triggered by authenticate… |
CVE-2023-2574 | High | 8.8 | 2023-05-08 | Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by an command injection vulnerability in the device name input field, which can be tri… |
CVE-2023-2573 | High | 8.8 | 2023-05-08 | Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by an command injection vulnerability in the NTP server input field, which can be trig… |
CVE-2023-28169 | Medium | 5.9 | 2023-05-08 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CoreFortress Easy Event calendar plugin <= 1.0 versions. |
CVE-2023-25452 | Medium | 5.9 | 2023-05-08 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Michael Pretty (prettyboymp) CMS Press plugin <= 0.2.3 versions. |
CVE-2023-25052 | Medium | 5.9 | 2023-05-08 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Teplitsa Yandex.News Feed by Teplitsa plugin <= 1.12.5 versions. |
CVE-2023-25754 | Critical | 9.8 | 2023-05-08 | Privilege Context Switching Error vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.6.0. |
CVE-2023-25021 | Medium | 5.9 | 2023-05-08 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in FareHarbor FareHarbor for WordPress plugin <= 3.6.6 versions. |
CVE-2023-23668 | Medium | 6.5 | 2023-05-08 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in GiveWP plugin <= 2.25.1 versions. |
CVE-2023-29247 | Medium | 5.4 | 2023-05-08 | Task instance details page in the UI is vulnerable to a stored XSS.This issue affects Apache Airflow: before 2.6.0. |
CVE-2023-31039 | Critical | 9.8 | 2023-05-08 | Security vulnerability in Apache bRPC <1.5.0 on all platforms allows attackers to execute arbitrary code via ServerOptions::pid_file. An attacker that can infl… |
CVE-2023-31038 | High | 8.8 | 2023-05-08 | SQL injection in Log4cxx when using the ODBC appender to send log messages to a database. No fields sent to the database were properly escaped for SQL injecti… |
CVE-2023-2534 | High | 7.6 | 2023-05-08 | Improper Authorization vulnerability in OTRS AG OTRS 8 (Websocket API backend) allows any as Agent authenticated attacker to track user behaviour and to gain l… |
CVE-2023-2566 | Medium | 4.8 | 2023-05-08 | Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.1. |
CVE-2023-30018 | Critical | 9.8 | 2023-05-08 | Judging Management System v1.0 is vulnerable to SQL Injection. via /php-jms/review_se_result.php?mainevent_id=. |
CVE-2023-30257 | High | 7.8 | 2023-05-08 | A buffer overflow in the component /proc/ftxxxx-debug of FiiO M6 Build Number v1.0.4 allows attackers to escalate privileges to root. |
CVE-2023-30185 | Critical | 9.8 | 2023-05-08 | CRMEB v4.4 to v4.6 was discovered to contain an arbitrary file upload vulnerability via the component \attachment\SystemAttachmentServices.php. |
CVE-2023-29944 | Critical | 9.8 | 2023-05-08 | Metersphere v1.20.20-lts-79d354a6 is vulnerable to Remote Command Execution. The system command reverse-shell can be executed at the custom code snippet functi… |
CVE-2023-2565 | Low | 3.5 | 2023-05-07 | A vulnerability has been found in SourceCodester Multi Language Hotel Management Software 1.0 and classified as problematic. This vulnerability affects unknown… |
CVE-2023-2564 | Critical | 10.0 | 2023-05-07 | OS Command Injection in GitHub repository sbs20/scanservjs prior to v2.27.0. |
CVE-2023-32290 | High | 7.5 | 2023-05-07 | The myMail app through 14.30 for iOS sends cleartext credentials in a situation where STARTTLS is expected by a server. |
CVE-2023-31047 | Critical | 9.8 | 2023-05-07 | In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. T… |
CVE-2023-24400 | Medium | 6.5 | 2023-05-07 | Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Hu-manity.Co Cookie Notice & Compliance for GDPR / CCPA plugin <= 2.4.6 versions. |
CVE-2023-25491 | Medium | 5.9 | 2023-05-06 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Samuel Marshall JCH Optimize plugin <= 3.2.2 versions. |
CVE-2023-2560 | Low | 3.5 | 2023-05-06 | A vulnerability was found in jja8 NewBingGoGo up to 2023.5.5.2. It has been rated as problematic. This issue affects some unknown processing. The manipulation… |
CVE-2023-26519 | Medium | 5.9 | 2023-05-06 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alex Benfica Publish to Schedule plugin <= 4.5.4 versions. |
CVE-2023-26517 | Medium | 5.9 | 2023-05-06 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jeff Starr Dashboard Widgets Suite plugin <= 3.2.1 versions. |
CVE-2023-24957 | Medium | 5.4 | 2023-05-06 | IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerab… |
CVE-2023-29963 | High | 7.2 | 2023-05-05 | S-CMS v5.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /admin/ajax.php. |
CVE-2023-29354 | Medium | 4.7 | 2023-05-05 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability |
CVE-2023-29350 | High | 7.5 | 2023-05-05 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2023-30065 | High | 8.8 | 2023-05-05 | MitraStar GPT-2741GNAC-N2 with firmware BR_g5.9_1.11(WVK.0)b32 was discovered to contain a remote code execution (RCE) vulnerability in the ping function. |
CVE-2023-2554 | High | 7.2 | 2023-05-05 | External Control of File Name or Path in GitHub repository unilogies/bumsys prior to 2.2.0. |
CVE-2023-2553 | Medium | 5.4 | 2023-05-05 | Cross-site Scripting (XSS) - Stored in GitHub repository unilogies/bumsys prior to 2.2.0. |
CVE-2023-2552 | High | 8.8 | 2023-05-05 | Cross-Site Request Forgery (CSRF) in GitHub repository unilogies/bumsys prior to 2.1.1. |
CVE-2023-2551 | High | 8.8 | 2023-05-05 | PHP Remote File Inclusion in GitHub repository unilogies/bumsys prior to 2.1.1. |
CVE-2023-2550 | Medium | 4.8 | 2023-05-05 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13. |
CVE-2023-2516 | Medium | 5.4 | 2023-05-05 | Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.7. |
CVE-2023-2427 | Medium | 4.8 | 2023-05-05 | Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.13. |
CVE-2023-32269 | Medium | 6.7 | 2023-05-05 | An issue was discovered in the Linux kernel before 6.1.11. In net/netrom/af_netrom.c, there is a use-after-free because accept is also allowed for a successful… |
CVE-2023-29659 | Medium | 6.5 | 2023-05-05 | A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the heif::Fraction::round() function in box.cc… |
CVE-2023-26285 | Medium | 5.9 | 2023-05-05 | IBM MQ 9.2 CD, 9.2 LTS, 9.3 CD, and 9.3 LTS could allow a remote attacker to cause a denial of service due to an error processing invalid data. IBM X-Force ID… |
CVE-2023-30434 | Medium | 6.2 | 2023-05-05 | IBM Storage Scale (IBM Spectrum Scale 5.1.0.0 through 5.1.2.9, 5.1.3.0 through 5.1.6.1 and IBM Elastic Storage Systems 6.1.0.0 through 6.1.2.5, 6.1.3.0 through… |
CVE-2023-30054 | Critical | 9.8 | 2023-05-05 | TOTOLINK A7100RU V7.4cu.2313_B20191024 has a Command Injection vulnerability. An attacker can obtain a stable root shell through a specially constructed payloa… |
CVE-2023-30053 | Critical | 9.8 | 2023-05-05 | TOTOLINK A7100RU V7.4cu.2313_B20191024 is vulnerable to Command Injection. |
CVE-2023-29942 | Medium | 5.5 | 2023-05-05 | llvm-project commit a0138390 was discovered to contain a segmentation fault via the component mlir::Type::isa<mlir::LLVM::LLVMVoidType. |
CVE-2023-29941 | Medium | 5.5 | 2023-05-05 | llvm-project commit a0138390 was discovered to contain a segmentation fault via the component matchAndRewriteSortOp<mlir::sparse_tensor::SortOp>(mlir::sparse_t… |
CVE-2023-29939 | Medium | 5.5 | 2023-05-05 | llvm-project commit a0138390 was discovered to contain a segmentation fault via the component mlir::spirv::TargetEnv::TargetEnv(mlir::spirv::TargetEnvAttr). |
CVE-2023-29935 | Medium | 5.5 | 2023-05-05 | llvm-project commit a0138390 was discovered to contain an assertion failure at !replacements.count(op) && "operation was already replaced. |
CVE-2023-29934 | Medium | 5.5 | 2023-05-05 | llvm-project commit 6c01b5c was discovered to contain a segmentation fault via the component mlir::Type::getDialect(). |
CVE-2023-29933 | Medium | 5.5 | 2023-05-05 | llvm-project commit bd456297 was discovered to contain a segmentation fault via the component mlir::Block::getArgument. |
CVE-2023-29932 | Medium | 5.5 | 2023-05-05 | llvm-project commit fdbc55a5 was discovered to contain a segmentation fault via the component mlir::IROperand<mlir::OpOperand. |
CVE-2023-22874 | Medium | 5.5 | 2023-05-05 | IBM MQ Clients 9.2 CD, 9.3 CD, and 9.3 LTS are vulnerable to a denial of service attack when processing configuration files. IBM X-Force ID: 244216. |
CVE-2023-30243 | High | 7.5 | 2023-05-05 | Beijing Netcon NS-ASG Application Security Gateway v6.3 is vulnerable to SQL Injection via TunnelId that allows access to sensitive information. |
CVE-2023-30013 | Critical | 9.8 | 2023-05-05 | TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. This vulnerability all… |
CVE-2023-30242 | Critical | 9.8 | 2023-05-05 | NS-ASG v6.3 was discovered to contain a SQL injection vulnerability via the component /admin/add_ikev2.php. |
CVE-2023-28068 | High | 7.3 | 2023-05-05 | Dell Command Monitor, versions 10.9 and prior, contains an improper folder permission vulnerability. A local authenticated malicious user can potentially expl… |
CVE-2023-32235 | High | 7.5 | 2023-05-05 | Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This… |
CVE-2023-30090 | Critical | 9.8 | 2023-05-05 | Semcms Shop v4.2 was discovered to contain an arbitrary file uplaod vulnerability via the component SEMCMS_Upfile.php. This vulnerability allows attackers to e… |
CVE-2023-30135 | Critical | 9.8 | 2023-05-05 | Tenda AC18 v15.03.05.19(6318_)_cn was discovered to contain a command injection vulnerability via the deviceName parameter in the setUsbUnload function. |
CVE-2023-30122 | Critical | 9.8 | 2023-05-05 | An arbitrary file upload vulnerability in the component /admin/ajax.php?action=save_menu of Online Food Ordering System v2.0 allows attackers to execute arbitr… |
CVE-2023-2531 | Critical | 9.8 | 2023-05-05 | Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3. |
CVE-2023-1894 | Medium | 5.3 | 2023-05-04 | A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation. An issue related to specifically crafted cer… |
CVE-2023-30282 | High | 7.5 | 2023-05-04 | PrestaShop scexportcustomers <= 3.6.1 is vulnerable to Incorrect Access Control. Due to a lack of permissions' control, a guest can access exports from the mod… |
CVE-2023-30093 | Medium | 6.1 | 2023-05-04 | A cross-site scripting (XSS) vulnerability in Open Networking Foundation ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbitrary web scripts o… |
CVE-2023-31415 | High | 8.8 | 2023-05-04 | Kibana version 8.7.0 contains an arbitrary code execution flaw. An attacker with All privileges to the Uptime/Synthetics feature could send a request that will… |
CVE-2023-31414 | High | 8.8 | 2023-05-04 | Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. An attacker with write access to Kibana yaml or env configuration could add a spe… |
CVE-2023-31413 | Low | 3.3 | 2023-05-04 | Filebeat versions through 7.17.9 and 8.6.2 have a flaw in httpjson input that allows the http request Authorization or Proxy-Authorization header contents to b… |
CVE-2023-30399 | High | 8.1 | 2023-05-04 | Insecure permissions in the settings page of GARO Wallbox GLB/GTB/GTC before v189 allows attackers to redirect users to a crafted update package link via a man… |
CVE-2023-30328 | Critical | 9.8 | 2023-05-04 | An issue in the helper tool of Mailbutler GmbH Shimo VPN Client for macOS v5.0.4 allows attackers to bypass authentication via PID re-use. |
CVE-2023-30216 | Medium | 5.4 | 2023-05-04 | Insecure permissions in the updateUserInfo function of newbee-mall before commit 1f2c2dfy allows attackers to obtain user account information. |
CVE-2023-25289 | High | 7.5 | 2023-05-04 | Directory Traversal vulnerability in virtualreception Digital Receptie version win7sp1_rtm.101119-1850 6.1.7601.1.0.65792 in embedded web server, allows attack… |
CVE-2023-21511 | Medium | 4.4 | 2023-05-04 | Out-of-bounds Read vulnerability while processing CMD_COLDWALLET_BTC_SET_PRV_UTXO in bc_core trustlet from Samsung Blockchain Keystore prior to version 1.3.12… |
CVE-2023-21510 | Medium | 4.4 | 2023-05-04 | Out-of-bounds Read vulnerability while processing BC_TUI_CMD_UPDATE_SCREEN in bc_tui trustlet from Samsung Blockchain Keystore prior to version 1.3.12.1 allows… |
CVE-2023-21509 | Medium | 6.7 | 2023-05-04 | Out-of-bounds Write vulnerability while processing BC_TUI_CMD_UPDATE_SCREEN in bc_tui trustlet from Samsung Blockchain Keystore prior to version 1.3.12.1 allow… |
CVE-2023-21508 | Medium | 6.7 | 2023-05-04 | Out-of-bounds Write vulnerability while processing BC_TUI_CMD_SEND_RESOURCE_DATA command in bc_tui trustlet from Samsung Blockchain Keystore prior to version 1… |
CVE-2023-21507 | Medium | 4.4 | 2023-05-04 | Out-of-bounds Read vulnerability while processing BC_TUI_CMD_SEND_RESOURCE_DATA_ARRAY command in bc_tui trustlet from Samsung Blockchain Keystore prior to vers… |
CVE-2023-21506 | Medium | 6.7 | 2023-05-04 | Out-of-bounds Write vulnerability while processing BC_TUI_CMD_SEND_RESOURCE_DATA_ARRAY command in bc_tui trustlet from Samsung Blockchain Keystore prior to ver… |
CVE-2023-21505 | Medium | 4.0 | 2023-05-04 | Improper access control in Samsung Core Service prior to version 2.1.00.36 allows attacker to write arbitrary file in sandbox. |
CVE-2023-21504 | Medium | 5.6 | 2023-05-04 | Potential buffer overflow vulnerability in mm_Plmncoordination.c in Shannon baseband prior to SMR May-2023 Release 1 allows remote attackers to cause invalid m… |
CVE-2023-21503 | Medium | 5.6 | 2023-05-04 | Potential buffer overflow vulnerability in mm_LteInterRatManagement.c in Shannon baseband prior to SMR May-2023 Release 1 allows remote attackers to cause inva… |
CVE-2023-21502 | Medium | 5.7 | 2023-05-04 | Improper input validation vulnerability in FactoryTest application prior to SMR May-2023 Release 1 allows local attackers to get privilege escalation via debug… |
CVE-2023-21501 | High | 8.2 | 2023-05-04 | Improper input validation vulnerability in mPOS fiserve trustlet prior to SMR May-2023 Release 1 allows local attackers to execute arbitrary code. |
CVE-2023-21500 | Medium | 6.0 | 2023-05-04 | Double free validation vulnerability in setPinPadImages in mPOS TUI trustlet prior to SMR May-2023 Release 1 allows local attackers to access the trustlet memo… |
CVE-2023-21499 | High | 8.2 | 2023-05-04 | Out-of-bounds write vulnerability in TA_Communication_mpos_encrypt_pin in mPOS TUI trustlet prior to SMR May-2023 Release 1 allows local attackers to execute a… |
CVE-2023-21498 | Medium | 6.0 | 2023-05-04 | Improper input validation vulnerability in setPartnerTAInfo in mPOS TUI trustlet prior to SMR May-2023 Release 1 allows local attackers to overwrite the trustl… |
CVE-2023-21497 | Medium | 4.4 | 2023-05-04 | Use of externally-controlled format string vulnerability in mPOS TUI trustlet prior to SMR May-2023 Release 1 allows local attackers to access the memory addre… |
CVE-2023-21496 | Medium | 6.1 | 2023-05-04 | Active Debug Code vulnerability in ActivityManagerService prior to SMR May-2023 Release 1 allows attacker to use debug function via setting debug level. |
CVE-2023-21495 | Medium | 4.0 | 2023-05-04 | Improper access control vulnerability in Knox Enrollment Service prior to SMR May-2023 Release 1 allow attacker install KSP app when device admin is set. |
CVE-2023-21494 | Medium | 5.6 | 2023-05-04 | Potential buffer overflow vulnerability in auth api in mm_Authentication.c in Shannon baseband prior to SMR May-2023 Release 1 allows remote attackers to cause… |
CVE-2023-21493 | Medium | 6.8 | 2023-05-04 | Improper access control vulnerability in SemShareFileProvider prior to SMR May-2023 Release 1 allows local attackers to access protected data. |
CVE-2023-21492 | Medium | 4.4 | 2023-05-04 | Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR. |
CVE-2023-21491 | High | 8.5 | 2023-05-04 | Improper access control vulnerability in ThemeManager prior to SMR May-2023 Release 1 allows local attackers to write arbitrary files with system privilege. |
CVE-2023-21490 | Medium | 4.7 | 2023-05-04 | Improper access control in GearManagerStub prior to SMR May-2023 Release 1 allows a local attacker to delete applications installed by watchmanager. |
CVE-2023-21489 | High | 7.1 | 2023-05-04 | Heap out-of-bounds write vulnerability in bootloader prior to SMR May-2023 Release 1 allows a physical attacker to execute arbitrary code. |
CVE-2023-21488 | Medium | 4.4 | 2023-05-04 | Improper access control vulnerablility in Tips prior to SMR May-2023 Release 1 allows local attackers to launch arbitrary activity in Tips. |
CVE-2023-21487 | Medium | 5.1 | 2023-05-04 | Improper access control vulnerability in Telephony framework prior to SMR May-2023 Release 1 allows local attackers to change a call setting. |
CVE-2023-21486 | Medium | 5.3 | 2023-05-04 | Improper export of android application components vulnerability in ImagePreviewActivity in Call Settings to SMR May-2023 Release 1 allows physical attackers to… |