2023 CVEs (page 248)
Page 248 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-21485 | Medium | 5.3 | 2023-05-04 | Improper export of android application components vulnerability in VideoPreviewActivity in Call Settings to SMR May-2023 Release 1 allows physical attackers to… |
CVE-2023-21484 | Medium | 5.1 | 2023-05-04 | Improper access control vulnerability in AppLock prior to SMR May-2023 Release 1 allows local attackers without proper permission to execute a privileged opera… |
CVE-2023-31284 | High | 7.8 | 2023-05-04 | illumos illumos-gate before 676abcb has a stack buffer overflow in /dev/net, leading to privilege escalation via a stat on a long file name in /dev/net. |
CVE-2023-30268 | Critical | 9.8 | 2023-05-04 | CLTPHP <=6.0 is vulnerable to Improper Input Validation. |
CVE-2023-30264 | Critical | 9.8 | 2023-05-04 | CLTPHP <=6.0 is vulnerable to Unrestricted Upload of File with Dangerous Type via application/admin/controller/Template.php:update. |
CVE-2023-30097 | Medium | 5.4 | 2023-05-04 | A stored cross-site scripting (XSS) vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbitrary web scripts or HTML via a crafted p… |
CVE-2023-30096 | Medium | 5.4 | 2023-05-04 | A stored cross-site scripting (XSS) vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbitrary web scripts or HTML via a crafted p… |
CVE-2023-30095 | Medium | 5.4 | 2023-05-04 | A stored cross-site scripting (XSS) vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbitrary web scripts or HTML via a crafted p… |
CVE-2023-30094 | Medium | 5.4 | 2023-05-04 | A stored cross-site scripting (XSS) vulnerability in TotalJS Flow v10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected… |
CVE-2023-25982 | Medium | 6.5 | 2023-05-04 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Eirudo Simple YouTube Responsive plugin <= 2.5 versions. |
CVE-2023-25977 | Medium | 5.9 | 2023-05-04 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in 9seeds.Com CPT – Speakers plugin <= 1.1 versions. |
CVE-2023-25961 | High | 7.1 | 2023-05-04 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Catch Themes Darcie theme <= 1.1.5 versions. |
CVE-2023-25458 | Medium | 5.9 | 2023-05-04 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in GMO Internet Group, Inc. TypeSquare Webfonts for ConoHa plugin <= 2.0.3 versions. |
CVE-2023-23059 | Critical | 9.8 | 2023-05-04 | An issue was discovered in GeoVision GV-Edge Recording Manager 2.2.3.0 for windows, which contains improper permissions within the default installation and all… |
CVE-2023-20126 | Critical | 9.8 | 2023-05-04 | A vulnerability in the web-based management interface of Cisco SPA112 2-Port Phone Adapters could allow an unauthenticated, remote attacker to execute arbitrar… |
CVE-2023-2524 | Medium | 6.3 | 2023-05-04 | A vulnerability classified as critical has been found in Control iD RHiD 23.3.19.0. This affects an unknown part of the file /v2/#/. The manipulation leads to… |
CVE-2023-30550 | Medium | 6.8 | 2023-05-04 | MeterSphere is an open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing, and performance testing. Th… |
CVE-2023-2523 | High | 7.3 | 2023-05-04 | A vulnerability was found in Weaver E-Office 9.5. It has been rated as critical. Affected by this issue is some unknown functionality of the file App/Ajax/ajax… |
CVE-2023-2522 | Medium | 4.7 | 2023-05-04 | A vulnerability was found in Chengdu VEC40G 3.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /send… |
CVE-2023-30203 | Critical | 9.8 | 2023-05-04 | Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the event_id parameter at /php-jms/result_sheet.php. |
CVE-2023-30184 | Medium | 5.4 | 2023-05-04 | A stored cross-site scripting (XSS) vulnerability in Typecho v1.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected in… |
CVE-2023-2521 | Low | 3.5 | 2023-05-04 | A vulnerability was found in NEXTU NEXT-7004N 3.0.1. It has been classified as problematic. Affected is an unknown function of the file /boafrm/formFilter of t… |
CVE-2023-2520 | High | 8.8 | 2023-05-04 | A vulnerability was found in Caton Prime 2.1.2.51.e8d7225049(202303031001) and classified as critical. This issue affects some unknown processing of the file c… |
CVE-2023-2519 | High | 7.3 | 2023-05-04 | A vulnerability has been found in Caton CTP Relay Server 1.2.9 and classified as critical. This vulnerability affects unknown code of the file /server/api/v1/l… |
CVE-2023-29996 | High | 7.5 | 2023-05-04 | In NanoMQ v0.15.0-0, segment fault with Null Pointer Dereference occurs in the process of decoding subinfo_decode and unsubinfo_decode. |
CVE-2023-29995 | High | 7.5 | 2023-05-04 | In NanoMQ v0.15.0-0, a Heap overflow occurs in copyn_utf8_str function of mqtt_parser.c |
CVE-2023-29994 | High | 7.5 | 2023-05-04 | In NanoMQ v0.15.0-0, Heap overflow occurs in read_byte function of mqtt_code.c. |
CVE-2023-30619 | Medium | 5.4 | 2023-05-04 | Tuleap Open ALM is a Libre and Open Source tool for end to end traceability of application and system developments. The title of an artifact is not properly es… |
CVE-2023-29827 | Critical | 9.8 | 2023-05-04 | ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration se… |
CVE-2023-26012 | Medium | 5.9 | 2023-05-04 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Denzel Chia | Phire Design Custom Login Page plugin <= 2.0 versions. |
CVE-2023-26010 | Medium | 5.9 | 2023-05-04 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPMobile.App plugin <= 11.18 versions. |
CVE-2023-24958 | High | 8.8 | 2023-05-04 | A vulnerability in the IBM TS7700 Management Interface 8.51.2.12, 8.52.200.111, 8.52.102.13, and 8.53.0.63 could allow an authenticated user to submit a specia… |
CVE-2023-23470 | Medium | 6.4 | 2023-05-04 | IBM i 7.2, 7.3, 7.4, and 7.5 could allow an authenticated privileged administrator to gain elevated privileges in non-default configurations, as a result of im… |
CVE-2023-26016 | Medium | 5.9 | 2023-05-04 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Tauhidul Alam Simple Portfolio Gallery plugin <= 0.1 versions. |
CVE-2023-25962 | Medium | 5.9 | 2023-05-04 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Biplob Adhikari Accordion – Multiple Accordion or FAQs Builder plugin <= 2.3.0 versions. |
CVE-2023-22651 | Critical | 9.9 | 2023-05-04 | Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation. A failure in the update logic of Rancher's admission Webhook may lead… |
CVE-2023-25934 | Medium | 5.9 | 2023-05-04 | DELL ECS prior to 3.8.0.2 contains an improper verification of cryptographic signature vulnerability. A network attacker with an ability to intercept the requ… |
CVE-2023-26125 | Medium | 5.6 | 2023-05-04 | Versions of the package github.com/gin-gonic/gin before 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a specially crafted re… |
CVE-2023-30331 | Critical | 9.8 | 2023-05-04 | An issue in the render function of beetl v3.15.0 allows attackers to execute server-side template injection (SSTI) via a crafted payload. |
CVE-2023-30077 | Critical | 9.8 | 2023-05-04 | Judging Management System v1.0 by oretnom23 was discovered to vulnerable to SQL injection via /php-jms/review_result.php?mainevent_id=, mainevent_id. |
CVE-2023-29842 | High | 8.8 | 2023-05-04 | ChurchCRM 4.5.4 endpoint /EditEventTypes.php is vulnerable to Blind SQL Injection (Time-based) via the EN_tyid POST parameter. |
CVE-2023-31099 | High | 8.8 | 2023-05-04 | Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote code execution via probe servers. |
CVE-2023-27568 | High | 8.8 | 2023-05-04 | SQL injection vulnerability inSpryker Commerce OS 0.9 that allows for access to sensitive data via customer/order?orderSearchForm[searchText]= |
CVE-2023-27075 | Medium | 5.4 | 2023-05-04 | A cross-site scripting vulnerability (XSS) in the component microbin/src/pasta.rs of Microbin v1.2.0 allows attackers to execute arbitrary web scripts or HTML… |
CVE-2023-25438 | High | 7.8 | 2023-05-04 | An issue was discovered in Genomedics MilleGP5 5.9.2, allows remote attackers to execute arbitrary code and gain escalated privileges via modifying specific fi… |
CVE-2023-2182 | Medium | 6.8 | 2023-05-03 | An issue has been discovered in GitLab EE affecting all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Under cer… |
CVE-2023-27999 | High | 7.8 | 2023-05-03 | An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC 7.2.0, 7.1.0 through 7.1.1 may allow an authenticated a… |
CVE-2023-27993 | Medium | 6.0 | 2023-05-03 | A relative path traversal [CWE-23] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a privileged attacker to delete arbitrary directories from the un… |
CVE-2023-26203 | Medium | 6.7 | 2023-05-03 | A use of hard-coded credentials vulnerability [CWE-798] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8… |
CVE-2023-22640 | High | 7.5 | 2023-05-03 | A out-of-bounds write in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.10, FortiOS version 6.4.0 through 6.4.11, FortiOS vers… |
CVE-2023-22637 | Medium | 6.5 | 2023-05-03 | An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiNAC-F version 7.2.0, FortiNAC version 9… |
CVE-2023-1178 | Medium | 5.7 | 2023-05-03 | An issue has been discovered in GitLab CE/EE affecting all versions from 8.6 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions start… |
CVE-2023-0805 | Medium | 4.9 | 2023-05-03 | An issue has been discovered in GitLab EE affecting all versions starting from 15.2 before 15.9.6, all versions starting from 15.10 before 15.10.5, all version… |
CVE-2023-0756 | Medium | 4.8 | 2023-05-03 | An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11… |
CVE-2023-30205 | Medium | 4.8 | 2023-05-03 | A stored cross-site scripting (XSS) vulnerability in DouPHP v1.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into… |
CVE-2023-30204 | Critical | 9.8 | 2023-05-03 | Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the judge_id parameter at /php-jms/edit_judge.php. |
CVE-2023-2069 | Medium | 6.4 | 2023-05-03 | An issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8, all versions starting from 12.10 before 12.10.7, all versions s… |
CVE-2023-1965 | Medium | 6.8 | 2023-05-03 | An issue has been discovered in GitLab EE affecting all versions starting from 14.2 before 15.9.6, all versions starting from 15.10 before 15.10.5, all version… |
CVE-2023-1836 | Medium | 4.4 | 2023-05-03 | A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 15.9.6, all versions starting from 15.10 before 15.1… |
CVE-2023-1265 | Medium | 5.4 | 2023-05-03 | An issue has been discovered in GitLab affecting all versions starting from 11.9 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions s… |
CVE-2023-1204 | Medium | 4.3 | 2023-05-03 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all ver… |
CVE-2023-0485 | Medium | 6.5 | 2023-05-03 | An issue has been discovered in GitLab affecting all versions starting from 13.11 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions st… |
CVE-2023-0155 | Medium | 5.4 | 2023-05-03 | An issue has been discovered in GitLab CE/EE affecting all versions before 15.8.5, 15.9.4, 15.10.1. Open redirects was possible due to framing arbitrary conten… |
CVE-2023-30300 | Medium | 5.5 | 2023-05-03 | An issue in the component hang.wasm of WebAssembly 1.0 causes an infinite loop. |
CVE-2023-24744 | Medium | 6.1 | 2023-05-03 | Cross Site Scripting (XSS) vulnerability in Rediker Software AdminPlus 6.1.91.00 allows remote attackers to run arbitrary code via the onload function within t… |
CVE-2023-25827 | High | 8.2 | 2023-05-03 | Due to insufficient validation of parameters reflected in error messages by the legacy HTTP query API and the logging endpoint, it is possible to inject and e… |
CVE-2023-25826 | Critical | 9.8 | 2023-05-03 | Due to insufficient validation of parameters passed to the legacy HTTP query API, it is possible to inject crafted OS commands into multiple parameters and exe… |
CVE-2023-26017 | Medium | 5.9 | 2023-05-03 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in BlueGlass Jobs for WordPress plugin <= 2.5.10.2 versions. |
CVE-2023-25967 | Medium | 4.3 | 2023-05-03 | Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo plugin <= 6.0.2.0 versions. |
CVE-2023-23881 | Medium | 5.9 | 2023-05-03 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in GreenTreeLabs Circles Gallery plugin <= 1.0.10 versions. |
CVE-2023-23875 | Medium | 5.9 | 2023-05-03 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Himanshu Bing Site Verification plugin using Meta Tag plugin <= 1.0 versions. |
CVE-2023-23830 | High | 7.1 | 2023-05-03 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team ProfilePress plugin <= 4.5.4 versions. |
CVE-2023-29240 | Medium | 5.4 | 2023-05-03 | An authenticated attacker granted a Viewer or Auditor role on a BIG-IQ can upload arbitrary files using an undisclosed iControl REST endpoint. Note: Software… |
CVE-2023-29163 | High | 7.5 | 2023-05-03 | When UDP profile with idle timeout set to immediate or the value 0 is configured on a virtual server, undisclosed traffic can cause TMM to terminate. Note: S… |
CVE-2023-28742 | High | 7.2 | 2023-05-03 | When DNS is provisioned, an authenticated remote command execution vulnerability exists in DNS iQuery mesh. Note: Software versions which have reached En… |
CVE-2023-28724 | High | 7.1 | 2023-05-03 | NGINX Management Suite default file permissions are set such that an authenticated attacker may be able to modify sensitive files on NGINX Instance Manager and… |
CVE-2023-28656 | High | 8.1 | 2023-05-03 | NGINX Management Suite may allow an authenticated attacker to gain access to configuration objects outside of their assigned environment. Note: Software ver… |
CVE-2023-28406 | Medium | 4.3 | 2023-05-03 | A directory traversal vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which may allow an authenticated attacker to read files w… |
CVE-2023-27378 | High | 7.5 | 2023-05-03 | Multiple reflected cross-site scripting (XSS) vulnerabilities exist in undisclosed pages of the BIG-IP Configuration utility which allow an attacker to run Ja… |
CVE-2023-24594 | Medium | 5.3 | 2023-05-03 | When an SSL profile is configured on a Virtual Server, undisclosed traffic can cause an increase in CPU or SSL accelerator resource utilization. Note: Soft… |
CVE-2023-24461 | High | 7.4 | 2023-05-03 | An improper certificate validation vulnerability exists in the BIG-IP Edge Client for Windows and macOS and may allow an attacker to impersonate a BIG-IP APM… |
CVE-2023-23809 | Medium | 5.9 | 2023-05-03 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Moris Dov Stock market charts from finviz plugin <= 1.0.1 versions. |
CVE-2023-23808 | Medium | 5.9 | 2023-05-03 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Sergey Panasenko Sponsors Carousel plugin <= 4.02 versions. |
CVE-2023-23785 | Medium | 5.9 | 2023-05-03 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in DgCult Exquisite PayPal Donation plugin <= v2.0.0 versions. |
CVE-2023-22372 | Medium | 5.9 | 2023-05-03 | In the pre connection stage, an improper enforcement of message integrity vulnerability exists in BIG-IP Edge Client for Windows and Mac OS. Note: Software v… |
CVE-2023-25979 | Medium | 5.9 | 2023-05-03 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Video Gallery by Total-Soft Video Gallery plugin <= 1.7.6 versions. |
CVE-2023-23876 | Medium | 6.5 | 2023-05-03 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in TMS-Plugins wpDataTables plugin <= 2.1.49 versions. |
CVE-2023-23874 | Medium | 6.5 | 2023-05-03 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Metaphor Creations Ditty plugin <= 3.0.32 versions. |
CVE-2023-22683 | Medium | 5.9 | 2023-05-03 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Themis Solutions, Inc. Clio Grow plugin <= 1.0.0 versions. |
CVE-2023-23820 | Medium | 6.5 | 2023-05-03 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team ProfilePress plugin <= 4.5.4 versions. |
CVE-2023-23708 | Medium | 6.5 | 2023-05-03 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Themeisle Visualizer: Tables and Charts Manager for WordPress plugin <= 3.9.4 versions. |
CVE-2023-1385 | High | 7.1 | 2023-05-03 | Improper JPAKE implementation allows offline PIN brute-forcing due to the initialization of random values to a known value, which leads to unauthorized authent… |
CVE-2023-1384 | Medium | 4.3 | 2023-05-03 | The setMediaSource function on the amzn.thin.pl service does not sanitize the "source" parameter allowing for arbitrary javascript code to be run This issue a… |
CVE-2023-25798 | Medium | 6.5 | 2023-05-03 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Olevmedia Olevmedia Shortcodes plugin <= 1.1.9 versions. |
CVE-2023-25796 | Medium | 5.9 | 2023-05-03 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Include WP BaiDu Submit plugin <= 1.2.1 versions. |
CVE-2023-22713 | Medium | 6.5 | 2023-05-03 | Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress Download Manager Gutenberg Blocks by WordPress Download Manager plugin <= 2.1.8 vers… |
CVE-2023-1383 | Medium | 5.4 | 2023-05-03 | An Improper Enforcement of Behavioral Workflow vulnerability in the exchangeDeviceServices function on the amzn.dmgr service allowed an attacker to register se… |
CVE-2023-25797 | Medium | 5.9 | 2023-05-03 | Auth. Stored Cross-Site Scripting (XSS) vulnerability in Mr.Vibe vSlider Multi Image Slider for WordPress plugin <= 4.1.2 versions. |
CVE-2023-25792 | Medium | 5.9 | 2023-05-03 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in XiaoMac WP Open Social plugin <= 5.0 versions. |
CVE-2023-25789 | Medium | 5.9 | 2023-05-03 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Tapfiliate plugin <= 3.0.12 versions. |