2023 CVEs (page 250)
Page 250 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-2426 | Medium | 5.5 | 2023-04-29 | Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. |
CVE-2023-30441 | High | 7.5 | 2023-04-29 | IBM Runtime Environment, Java Technology Edition IBMJCEPlus and JSSE 8.0.7.0 through 8.0.7.11 components could expose sensitive information using a combination… |
CVE-2023-2425 | Low | 2.4 | 2023-04-29 | A vulnerability was found in SourceCodester Simple Student Information System 1.0. It has been classified as problematic. This affects an unknown part of the f… |
CVE-2023-2424 | Medium | 6.3 | 2023-04-29 | A vulnerability was found in DedeCMS 5.7.106 and classified as critical. Affected by this issue is the function UpDateMemberModCache of the file uploads/dede/c… |
CVE-2023-30792 | Medium | 6.1 | 2023-04-29 | Anchor tag hrefs in Lexical prior to v0.10.0 would render javascript: URLs, allowing for cross-site scripting on link clicks in cases where input was being par… |
CVE-2023-2421 | Low | 3.5 | 2023-04-29 | A vulnerability classified as problematic has been found in Control iD RHiD 23.3.19.0. Affected is an unknown function of the file /v2/#/add/department. The ma… |
CVE-2023-2420 | Medium | 6.3 | 2023-04-29 | A vulnerability was found in MLECMS 3.0. It has been rated as critical. This issue affects the function get_url in the library /upload/inc/lib/admin of the fil… |
CVE-2023-2419 | Medium | 4.7 | 2023-04-29 | A vulnerability was found in Zhong Bang CRMEB 4.6.0. It has been declared as critical. This vulnerability affects the function videoUpload of the file \crmeb\a… |
CVE-2023-2418 | Low | 3.1 | 2023-04-29 | A vulnerability was found in Konga 2.8.3 on Kong. It has been classified as problematic. This affects an unknown part of the component Login API. The manipulat… |
CVE-2023-2417 | Medium | 5.3 | 2023-04-29 | A vulnerability was found in ks-soft Advanced Host Monitor up to 12.56 and classified as problematic. Affected by this issue is some unknown functionality of t… |
CVE-2023-31486 | High | 8.1 | 2023-04-29 | HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to… |
CVE-2023-31485 | Medium | 5.9 | 2023-04-29 | GitLab::API::v4 through 0.26 does not verify TLS certificates when connecting to a GitLab server, enabling machine-in-the-middle attacks. |
CVE-2023-31484 | High | 8.1 | 2023-04-29 | CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. |
CVE-2023-2413 | Medium | 6.3 | 2023-04-29 | A vulnerability was found in SourceCodester AC Repair and Services System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown f… |
CVE-2023-2412 | Medium | 6.3 | 2023-04-29 | A vulnerability was found in SourceCodester AC Repair and Services System 1.0. It has been classified as critical. Affected is an unknown function of the file… |
CVE-2023-31483 | High | 7.5 | 2023-04-28 | tar/TarFileReader.cpp in Cauldron cbang before bastet-v8.1.17 has a directory traversal during extraction that allows the attacker to create or write to files… |
CVE-2023-2411 | Medium | 6.3 | 2023-04-28 | A vulnerability was found in SourceCodester AC Repair and Services System 1.0 and classified as critical. This issue affects some unknown processing of the fil… |
CVE-2023-2410 | Medium | 6.3 | 2023-04-28 | A vulnerability has been found in SourceCodester AC Repair and Services System 1.0 and classified as critical. This vulnerability affects unknown code of the f… |
CVE-2023-2409 | Medium | 6.3 | 2023-04-28 | A vulnerability, which was classified as critical, was found in SourceCodester AC Repair and Services System 1.0. This affects an unknown part of the file /adm… |
CVE-2023-2408 | Medium | 6.3 | 2023-04-28 | A vulnerability, which was classified as critical, has been found in SourceCodester AC Repair and Services System 1.0. Affected by this issue is some unknown f… |
CVE-2023-2397 | Low | 2.4 | 2023-04-28 | A vulnerability, which was classified as problematic, has been found in SourceCodester Simple Mobile Comparison Website 1.0. This issue affects some unknown pr… |
CVE-2023-2396 | Medium | 4.3 | 2023-04-28 | A vulnerability classified as problematic was found in Netgear SRX5308 up to 4.3.5-3. This vulnerability affects unknown code of the component Web Management I… |
CVE-2023-2395 | Medium | 4.3 | 2023-04-28 | A vulnerability classified as problematic has been found in Netgear SRX5308 up to 4.3.5-3. This affects an unknown part of the component Web Management Interfa… |
CVE-2023-29056 | Medium | 5.3 | 2023-04-28 | A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC. To be vulnerable, XCC must be configured to u… |
CVE-2023-25496 | High | 7.8 | 2023-04-28 | A privilege escalation vulnerability was reported in Lenovo Drivers Management Lenovo Driver Manager that could allow a local user to execute code with elevate… |
CVE-2023-25495 | Medium | 4.9 | 2023-04-28 | A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password used by XCC to authenticate to an extern… |
CVE-2023-24269 | High | 8.8 | 2023-04-28 | An arbitrary file upload vulnerability in the plugin upload function of Textpattern v4.8.8 allows attackers to execute arbitrary code via a crafted Zip file. |
CVE-2023-31470 | Critical | 9.8 | 2023-04-28 | SmartDNS through 41 before 56d0332 allows an out-of-bounds write because of a stack-based buffer overflow in the _dns_encode_domain function in the dns.c file… |
CVE-2023-31444 | High | 7.5 | 2023-04-28 | In Talend Studio before 7.3.1-R2022-10 and 8.x before 8.0.1-R2022-09, microservices allow unauthenticated access to the Jolokia endpoint of the microservice. T… |
CVE-2023-30858 | Medium | 5.3 | 2023-04-28 | The Denosaurs emoji package provides emojis for dinosaurs. Starting in version 0.1.0 and prior to version 0.3.0, the reTrimSpace regex has 2nd degree polynomia… |
CVE-2023-30857 | Low | 3.7 | 2023-04-28 | @aedart/support is the support package for Ion, a monorepo for JavaScript/TypeScript packages. Prior to version `0.6.1`, there is a possible prototype pollutio… |
CVE-2023-30405 | Medium | 5.4 | 2023-04-28 | A cross-site scripting (XSS) vulnerability in Aigital Wireless-N Repeater Mini_Router v0.131229 allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2023-2394 | Low | 2.4 | 2023-04-28 | A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been rated as problematic. Affected by this issue is some unknown functionality of the compo… |
CVE-2023-2393 | Low | 2.4 | 2023-04-28 | A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of… |
CVE-2023-2392 | Low | 2.4 | 2023-04-28 | A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been classified as problematic. Affected is an unknown function of the file scgi-bin/platfor… |
CVE-2023-2391 | Low | 2.4 | 2023-04-28 | A vulnerability was found in Netgear SRX5308 up to 4.3.5-3 and classified as problematic. This issue affects some unknown processing of the file scgi-bin/platf… |
CVE-2023-29058 | Medium | 6.4 | 2023-04-28 | A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message through the XCC CL… |
CVE-2023-29057 | High | 7.3 | 2023-04-28 | A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to a privilege escalat… |
CVE-2023-2390 | Low | 2.4 | 2023-04-28 | A vulnerability has been found in Netgear SRX5308 up to 4.3.5-3 and classified as problematic. This vulnerability affects unknown code of the file scgi-bin/pla… |
CVE-2023-2389 | Low | 2.4 | 2023-04-28 | A vulnerability, which was classified as problematic, was found in Netgear SRX5308 up to 4.3.5-3. This affects an unknown part of the file scgi-bin/platform.cg… |
CVE-2023-2388 | Low | 2.4 | 2023-04-28 | A vulnerability, which was classified as problematic, has been found in Netgear SRX5308 up to 4.3.5-3. Affected by this issue is some unknown functionality of… |
CVE-2023-26813 | Critical | 9.8 | 2023-04-28 | SQL injection vulnerability in com.xnx3.wangmarket.plugin.dataDictionary.controller.DataDictionaryPluginController.java in wangmarket CMS 4.10 allows remote at… |
CVE-2023-26782 | Medium | 6.5 | 2023-04-28 | An issue discovered in mccms 2.6.1 allows remote attackers to cause a denial of service via Backend management interface ->System Configuration->Cache Configur… |
CVE-2023-26781 | Critical | 9.8 | 2023-04-28 | SQL injection vulnerability in mccms 2.6 allows remote attackers to run arbitrary SQL commands via Author Center ->Reader Comments ->Search. |
CVE-2023-30454 | Medium | 6.1 | 2023-04-28 | An issue was discovered in ebankIT before 7. Document Object Model based XSS exists within the /Security/Transactions/Transactions.aspx endpoint. Users can sup… |
CVE-2023-2387 | Low | 2.4 | 2023-04-28 | A vulnerability classified as problematic was found in Netgear SRX5308 up to 4.3.5-3. Affected by this vulnerability is an unknown functionality of the file sc… |
CVE-2023-2386 | Low | 2.4 | 2023-04-28 | A vulnerability classified as problematic has been found in Netgear SRX5308 up to 4.3.5-3. Affected is an unknown function of the file scgi-bin/platform.cgi?pa… |
CVE-2023-26022 | Medium | 5.9 | 2023-04-28 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server may crash when an Out of Memory occurs usi… |
CVE-2023-26021 | High | 7.5 | 2023-04-28 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to a denial of service as the server may crash when compiling a s… |
CVE-2023-1968 | Critical | 10.0 | 2023-04-28 | Instruments with Illumina Universal Copy Service v2.x are vulnerable due to binding to an unrestricted IP address. An unauthenticated malicious actor could us… |
CVE-2023-1966 | High | 7.4 | 2023-04-28 | Instruments with Illumina Universal Copy Service v1.x and v2.x contain an unnecessary privileges vulnerability. An unauthenticated malicious actor could upload… |
CVE-2023-30455 | High | 7.5 | 2023-04-28 | An issue was discovered in ebankIT before 7. A Denial-of-Service attack is possible through the GET parameter EStatementsIds located on the /Controls/Generic/E… |
CVE-2023-2385 | Low | 2.4 | 2023-04-28 | A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been rated as problematic. This issue affects some unknown processing of the file scgi-bin/p… |
CVE-2023-2384 | Low | 2.4 | 2023-04-28 | A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been declared as problematic. This vulnerability affects unknown code of the file scgi-bin/p… |
CVE-2023-2383 | Low | 2.4 | 2023-04-28 | A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been classified as problematic. This affects an unknown part of the file scgi-bin/platform.c… |
CVE-2023-29334 | Medium | 4.3 | 2023-04-28 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2023-27864 | Medium | 5.4 | 2023-04-28 | IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would b… |
CVE-2023-27555 | Medium | 5.1 | 2023-04-28 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 is vulnerable to a denial of service when attempting to use ACR client affinity for unfe… |
CVE-2023-25930 | Medium | 5.9 | 2023-04-28 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.1, 11.1, and 11.5 is vulnerable to a denial of service. Under rare conditions, setting a… |
CVE-2023-2382 | Low | 2.4 | 2023-04-28 | A vulnerability was found in Netgear SRX5308 up to 4.3.5-3 and classified as problematic. Affected by this issue is some unknown functionality of the file scgi… |
CVE-2023-2381 | Low | 2.4 | 2023-04-28 | A vulnerability has been found in Netgear SRX5308 up to 4.3.5-3 and classified as problematic. Affected by this vulnerability is an unknown functionality of th… |
CVE-2023-2380 | Medium | 6.5 | 2023-04-28 | A vulnerability, which was classified as problematic, was found in Netgear SRX5308 up to 4.3.5-3. Affected is an unknown function. The manipulation leads to de… |
CVE-2023-2379 | High | 7.5 | 2023-04-28 | A vulnerability classified as critical has been found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This affects an unknown part of the component Web Service… |
CVE-2023-27973 | Critical | 9.8 | 2023-04-28 | Certain HP LaserJet Pro print products are potentially vulnerable to Heap Overflow and/or Remote Code Execution. |
CVE-2023-1526 | Medium | 4.6 | 2023-04-28 | Certain DesignJet and PageWide XL TAA compliant models may have risk of potential information disclosure if the hard disk drive is physically removed from the… |
CVE-2023-30856 | High | 8.3 | 2023-04-28 | eDEX-UI is a science fiction terminal emulator. Versions 2.2.8 and prior are vulnerable to cross-site websocket hijacking. When running eDEX-UI and browsing th… |
CVE-2023-30854 | High | 8.8 | 2023-04-28 | AVideo is an open source video platform. Prior to version 12.4, an OS Command Injection vulnerability in an authenticated endpoint `/plugin/CloneSite/cloneClie… |
CVE-2023-30853 | High | 7.6 | 2023-04-28 | Gradle Build Action allows users to execute a Gradle Build in their GitHub Actions workflow. A vulnerability impacts GitHub workflows using the Gradle Build Ac… |
CVE-2023-2378 | High | 7.2 | 2023-04-28 | A flaw has been found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This affects an unknown function of the component Web Management Interface. This manipulat… |
CVE-2023-2377 | High | 7.2 | 2023-04-28 | A vulnerability was detected in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. The impacted element is an unknown function of the component Web Management Interfa… |
CVE-2023-2376 | High | 7.2 | 2023-04-28 | A security vulnerability has been detected in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. The affected element is an unknown function of the component Web Mana… |
CVE-2023-27972 | Critical | 9.8 | 2023-04-28 | Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow and/or Remote Code Execution. |
CVE-2023-27971 | Critical | 9.8 | 2023-04-28 | Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow and/or Elevation of Privilege. |
CVE-2023-2375 | High | 7.2 | 2023-04-28 | A weakness has been identified in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. Impacted is an unknown function of the component Web Management Interface. Execut… |
CVE-2023-2374 | High | 7.2 | 2023-04-28 | A security flaw has been discovered in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This issue affects some unknown processing of the component Web Management I… |
CVE-2023-29815 | High | 8.8 | 2023-04-28 | mccms v2.6.3 is vulnerable to Cross Site Request Forgery (CSRF). |
CVE-2023-1477 | High | 7.2 | 2023-04-28 | Improper Authentication vulnerability in HYPR Keycloak Authenticator Extension allows Authentication Abuse.This issue affects HYPR Keycloak Authenticator Exten… |
CVE-2023-0834 | High | 7.0 | 2023-04-28 | Incorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on MacOS allows Privilege Escalation.This issue affects Workforce… |
CVE-2023-30125 | Medium | 6.1 | 2023-04-28 | EyouCms V1.6.1-UTF8-sp1 is vulnerable to Cross Site Scripting (XSS). |
CVE-2023-30123 | Medium | 5.4 | 2023-04-28 | wuzhicms v4.1.0 is vulnerable to Cross Site Scripting (XSS) in the Member Center, Account Settings. |
CVE-2023-2373 | High | 7.2 | 2023-04-28 | A vulnerability was identified in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This vulnerability affects unknown code of the component Web Management Interface… |
CVE-2023-2372 | Low | 2.4 | 2023-04-28 | A vulnerability, which was classified as problematic, has been found in SourceCodester Online DJ Management System 1.0. Affected by this issue is some unknown… |
CVE-2023-2371 | Medium | 6.3 | 2023-04-28 | A vulnerability classified as critical was found in SourceCodester Online DJ Management System 1.0. Affected by this vulnerability is an unknown functionality… |
CVE-2023-2370 | Medium | 6.3 | 2023-04-28 | A vulnerability classified as critical has been found in SourceCodester Online DJ Management System 1.0. Affected is an unknown function of the file admin/even… |
CVE-2023-28821 | Medium | 5.3 | 2023-04-28 | Concrete CMS (previously concrete5) before 9.1 did not have a rate limit for password resets. |
CVE-2023-28820 | Low | 2.0 | 2023-04-28 | Concrete CMS (previously concrete5) before 9.1 is vulnerable to stored XSS in RSS Displayer via the href attribute because the link element input was not sanit… |
CVE-2023-28819 | Low | 3.5 | 2023-04-28 | Concrete CMS (previously concrete5) versions 8.5.12 and below, 9.0.0 through 9.0.2 is vulnerable to Stored XSS in uploaded file and folder names. |
CVE-2023-28477 | Medium | 5.5 | 2023-04-28 | Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to stored XSS on API Integrations via the name parameter. |
CVE-2023-28476 | Medium | 5.4 | 2023-04-28 | Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Tags on uploaded files. |
CVE-2023-28475 | Medium | 6.1 | 2023-04-28 | Concrete CMS (previously concrete5) versions 8.5.12 and below, and versions 9.0 through 9.1.3 is vulnerable to Reflected XSS on the Reply form because msgID wa… |
CVE-2023-28474 | Medium | 5.4 | 2023-04-28 | Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Saved Presets on search. |
CVE-2023-28473 | Low | 3.3 | 2023-04-28 | Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to possible Auth bypass in the jobs section. |
CVE-2023-28472 | Medium | 5.3 | 2023-04-28 | Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 does not have Secure and HTTP only attributes set for ccmPoll cookies. |
CVE-2023-28471 | Medium | 5.4 | 2023-04-28 | Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS via a container name. |
CVE-2023-30024 | Medium | 6.6 | 2023-04-28 | The MagicJack device, a VoIP solution for internet phone calls, contains a hidden NAND flash memory partition allowing unauthorized read/write access. Attacker… |
CVE-2023-2369 | Medium | 4.7 | 2023-04-28 | A vulnerability was found in SourceCodester Faculty Evaluation System 1.0. It has been rated as critical. This issue affects some unknown processing of the fil… |
CVE-2023-2368 | Medium | 4.7 | 2023-04-28 | A vulnerability was found in SourceCodester Faculty Evaluation System 1.0. It has been declared as critical. This vulnerability affects unknown code of the fil… |
CVE-2023-2367 | Medium | 4.7 | 2023-04-28 | A vulnerability was found in SourceCodester Faculty Evaluation System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/… |
CVE-2023-2366 | Medium | 6.3 | 2023-04-28 | A vulnerability was found in SourceCodester Faculty Evaluation System 1.0 and classified as critical. Affected by this issue is some unknown functionality of t… |
CVE-2023-2365 | Medium | 6.3 | 2023-04-28 | A vulnerability has been found in SourceCodester Faculty Evaluation System 1.0 and classified as critical. Affected by this vulnerability is an unknown functio… |