2023 CVEs (page 251)

Page 251 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.

All CVEs published in 2023 — newest first (page 251 of 307)
CVESeverityScorePublishedSummary
CVE-2023-2360High7.52023-04-28Sensitive information disclosure due to CORS misconfiguration. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.2.0-135.
CVE-2023-30467High7.52023-04-28This vulnerability exists in Milesight 4K/H.265 Series NVR models (MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC), due to improper au…
CVE-2023-30466Critical9.82023-04-28This vulnerability exists in Milesight 4K/H.265 Series NVR models (MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC), due to a weak pass…
CVE-2023-2364Medium4.32023-04-28A vulnerability, which was classified as problematic, was found in SourceCodester Resort Reservation System 1.0. Affected is an unknown function of the file re…
CVE-2023-2363Medium6.32023-04-28A vulnerability, which was classified as critical, has been found in SourceCodester Resort Reservation System 1.0. This issue affects some unknown processing o…
CVE-2023-2361Medium5.42023-04-28Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
CVE-2023-28882High7.52023-04-28Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness) because some inputs cause a segfault in t…
CVE-2023-28528High8.42023-04-28IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout command to execute arbitrary commands…
CVE-2023-31436High7.82023-04-28qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQ_MIN_LMAX.
CVE-2023-27557Medium5.92023-04-28IBM Counter Fraud Management for Safer Payments 6.1.0.00 through 6.1.1.02, 6.2.0.00 through 6.2.2.02, 6.3.0.00 through 6.3.1.02, 6.4.0.00 through 6.4.2.01, and…
CVE-2023-27556Medium6.52023-04-28IBM Counter Fraud Management for Safer Payments 6.1.0.00, 6.2.0.00, 6.3.0.00 through 6.3.1.03, 6.4.0.00 through 6.4.2.02 and 6.5.0.00 does not properly allocat…
CVE-2023-2356High7.52023-04-28Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1.
CVE-2023-29169High8.82023-04-27mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands.
CVE-2023-29150High8.82023-04-27mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands.
CVE-2023-28716High8.82023-04-27mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands.
CVE-2023-28400High8.82023-04-27mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands.
CVE-2023-28384High8.82023-04-27mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands.
CVE-2023-30380High7.52023-04-27An issue in the component /dialog/select_media.php of DedeCMS v5.7.107 allows attackers to execute a directory traversal.
CVE-2023-1967Critical9.82023-04-27Keysight N8844A Data Analytics Web Service deserializes untrusted data without sufficiently verifying the resulting data will be valid.
CVE-2023-29489Medium5.32023-04-27An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669. The fixed versions are…
CVE-2023-29471Medium5.52023-04-27Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is confi…
CVE-2023-25437High8.82023-04-27An issue was discovered in vTech VCS754 version 1.1.1.A before 1.1.1.H, allows attackers to gain escalated privileges and gain sensitive information due to cle…
CVE-2023-29950Medium5.52023-04-27swfrender v0.9.2 was discovered to contain a heap buffer overflow in the function enumerateUsedIDs_fillstyle at modules/swftools.c
CVE-2023-2355High7.82023-04-27Local privilege escalation due to a DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy (Windows) before build 3900.
CVE-2023-28286Medium6.12023-04-27Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
CVE-2023-28261Medium5.72023-04-27Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2023-27860Medium5.32023-04-27IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 could disclose sensitive information in an error message. This information could be used in further attacks ag…
CVE-2023-21712High8.12023-04-27Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
CVE-2023-2335Medium6.52023-04-27 Plaintext Password in Registry vulnerability in 42gears surelock windows surelockwinsetupv2.40.0.Exe on Windows (Registery modules) allows Retrieve Admin…
CVE-2023-2158Critical9.82023-04-27Code Dx versions prior to 2023.4.2 are vulnerable to user impersonation attack where a malicious actor is able to gain access to another user's account by craf…
CVE-2023-30852Medium4.42023-04-27Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the `/admin/misc/script-proxy` API endpoint that is accessible by…
CVE-2023-30850High8.82023-04-27Pimcore is an open source data and experience management platform. Prior to version 10.5.21, a SQL Injection vulnerability exists in the admin translations API…
CVE-2023-30624Low3.92023-04-27Wasmtime is a standalone runtime for WebAssembly. Prior to versions 6.0.2, 7.0.1, and 8.0.1, Wasmtime's implementation of managing per-instance state, such as…
CVE-2023-30849High8.82023-04-27Pimcore is an open source data and experience management platform. Prior to version 10.5.21, A SQL injection vulnerability exists in the translation export API…
CVE-2023-30848High8.82023-04-27Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the admin search find API has a SQL injection vulnerability. Users…
CVE-2023-2350Low3.52023-04-27A vulnerability classified as problematic was found in SourceCodester Service Provider Management System 1.0. Affected by this vulnerability is an unknown func…
CVE-2023-2349Low3.52023-04-27A vulnerability classified as problematic has been found in SourceCodester Service Provider Management System 1.0. Affected is an unknown function of the file…
CVE-2023-30847High8.22023-04-27H2O is an HTTP server. In versions 2.3.0-beta2 and prior, when the reverse proxy handler tries to processes a certain type of invalid HTTP request, it tries to…
CVE-2023-30338Medium5.42023-04-27Multiple stored cross-site scripting (XSS) vulnerabilities in Emlog Pro v2.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload…
CVE-2023-2348Medium6.32023-04-27A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been rated as critical. This issue affects some unknown processing o…
CVE-2023-2347Medium6.32023-04-27A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been declared as critical. This vulnerability affects unknown code o…
CVE-2023-2346Medium6.32023-04-27A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been classified as critical. This affects an unknown part of the fil…
CVE-2023-2345Medium6.32023-04-27A vulnerability was found in SourceCodester Service Provider Management System 1.0 and classified as critical. Affected by this issue is some unknown functiona…
CVE-2023-30349Critical9.82023-04-27JFinal CMS v5.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the ActionEnter function.
CVE-2023-2344Medium6.32023-04-27A vulnerability has been found in SourceCodester Service Provider Management System 1.0 and classified as critical. Affected by this vulnerability is an unknow…
CVE-2023-2343Medium5.42023-04-27Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21.
CVE-2023-2342Medium5.42023-04-27Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.
CVE-2023-2341Medium6.12023-04-27Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.
CVE-2023-24966Medium6.12023-04-27IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the W…
CVE-2023-30444High7.12023-04-27IBM Watson Machine Learning on Cloud Pak for Data 4.0 and 4.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to…
CVE-2023-2340Medium5.42023-04-27Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
CVE-2023-29255High7.52023-04-27IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as it may trap when compiling a var…
CVE-2023-2339Medium5.42023-04-27Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.
CVE-2023-2338High8.82023-04-27SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.21.
CVE-2023-2336Medium6.52023-04-27Path Traversal in GitHub repository pimcore/pimcore prior to 10.5.21.
CVE-2023-2331High7.82023-04-27Unquoted service Path or Element vulnerability in 42Gears Surelock Windows SureLock Service (NixService.Exe) on Windows application will allows to insert arbit…
CVE-2023-2328Medium5.42023-04-27Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.
CVE-2023-2327Medium5.42023-04-27Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
CVE-2023-1778Critical10.02023-04-27This vulnerability exists in GajShield Data Security Firewall firmware versions prior to v4.28 (except v4.21) due to insecure default credentials which allows…
CVE-2023-2323Medium5.42023-04-27Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
CVE-2023-2322Medium5.42023-04-27Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
CVE-2023-28770High7.52023-04-27The sensitive information exposure vulnerability in the CGI “Export_Log” and the binary “zcmd” in Zyxel DX5401-B0 firmware versions prior to V5.17(ABYO.1)C0 co…
CVE-2023-28769Critical9.82023-04-27The buffer overflow vulnerability in the library “libclinkc.so” of the web server “zhttpd” in Zyxel DX5401-B0 firmware versions prior to V5.17(ABYO.1)C0 could…
CVE-2023-31290Medium5.92023-04-27Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 32 bits, as exploite…
CVE-2023-31287High7.82023-04-27An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. Password reset links are sent by email. A link contains a token that is used to reset…
CVE-2023-31286Medium5.32023-04-27An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. When a password reset request occurs, the server response leaks the existence of user…
CVE-2023-31285Medium6.12023-04-27An XSS issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. When users upload temporary files, some specific file endings are not allowed, bu…
CVE-2023-28697Critical9.82023-04-27Moxa MiiNePort E1 has a vulnerability of insufficient access control. An unauthenticated remote user can exploit this vulnerability to perform arbitrary system…
CVE-2023-24836High8.82023-04-27SUNNET CTMS has vulnerability of path traversal within its file uploading function. An authenticated remote attacker with general user privilege can exploit th…
CVE-2023-22901Medium4.92023-04-27ChangingTec MOTP system has a path traversal vulnerability. A remote attacker with administrator’s privilege can exploit this vulnerability to access arbitrary…
CVE-2023-20853Critical9.82023-04-27aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ asynchronized message process. An unauthenticated remote atta…
CVE-2023-20852Critical9.82023-04-27aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ interpreter. An unauthenticated remote attacker can exploit t…
CVE-2023-26246High7.82023-04-27An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppUpgrade binary file, which is used during…
CVE-2023-26245High7.82023-04-27An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppUpgrade binary file, which is used during…
CVE-2023-26244High7.82023-04-27An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppDMClient binary file, which is used durin…
CVE-2023-26243High7.82023-04-27An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The decryption binary used to decrypt firmware f…
CVE-2023-25292Medium6.12023-04-27Reflected Cross Site Scripting (XSS) in Intermesh BV Group-Office version 6.6.145, allows attackers to gain escalated privileges and gain sensitive information…
CVE-2023-2297Critical9.82023-04-27The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and includi…
CVE-2023-1786Medium5.52023-04-26Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escal…
CVE-2023-27107High8.82023-04-26Incorrect access control in the runReport function of MyQ Solution Print Server before 8.2 Patch 32 and Central Server before 8.2 Patch 22 allows users who do…
CVE-2023-30846Critical9.12023-04-26typed-rest-client is a library for Node Rest and Http Clients with typings for use with TypeScript. Users of the typed-rest-client library version 1.7.3 or low…
CVE-2023-30845High8.22023-04-26ESPv2 is a service proxy that provides API management capabilities using Google Service Infrastructure. ESPv2 2.20.0 through 2.42.0 contains an authentication…
CVE-2023-30843High7.42023-04-26Payload is a free and open source headless content management system. In versions prior to 1.7.0, if a user has access to documents that contain hidden fields…
CVE-2023-30363Critical9.82023-04-26vConsole v3.15.0 was discovered to contain a prototype pollution due to incorrect key and value resolution in setOptions in core.ts.
CVE-2023-2291High7.82023-04-26Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP) build 4309, ManageEngine Password Manager Pro, and ManageEngine…
CVE-2023-29443Medium4.92023-04-26Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow SDAdmi…
CVE-2023-29442Medium6.12023-04-26Zoho ManageEngine Applications Manager before 16400 allows proxy.html DOM XSS.
CVE-2023-30280Critical9.82023-04-26Buffer Overflow vulnerability found in Netgear R6900 v.1.0.2.26, R6700v3 v.1.0.4.128, R6700 v.1.0.0.26 allows a remote attacker to execute arbitrary code and c…
CVE-2023-29836Medium6.12023-04-26Cross Site Scripting vulnerability found in Exelysis Unified Communication Solutions (EUCS) v.1.0 allows a remote attacker to execute arbitrary code via the Us…
CVE-2023-29835High7.82023-04-26Insecure Permission vulnerability found in Wondershare Dr.Fone v.12.9.6 allows a remote attacker to escalate privileges via the service permission function.
CVE-2023-29596High7.82023-04-26Buffer Overflow vulnerability found in ByronKnoll Cmix v.19 allows an attacker to execute arbitrary code and cause a denial of service via the paq8 function.
CVE-2023-28009Medium6.52023-04-26HCL Workload Automation is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerabi…
CVE-2023-28008High7.12023-04-26HCL Workload Automation 9.4, 9.5, and 10.1 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could ex…
CVE-2023-27559Medium5.32023-04-26IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash when using…
CVE-2023-26567High8.12023-04-26Sangoma FreePBX 1805 through 2302 (when obtained as a ,.ISO file) places AMPDBUSER, AMPDBPASS, AMPMGRUSER, and AMPMGRPASS in the list of global variables. This…
CVE-2023-31250Medium6.52023-04-26The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they s…
CVE-2023-30841Medium6.02023-04-26Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Bare…
CVE-2023-30546Critical9.82023-04-26Contiki-NG is an operating system for Internet of Things devices. An off-by-one error can be triggered in the Antelope database management system in the Contik…
CVE-2023-26930Medium5.52023-04-26Buffer Overflow vulnerability found in XPDF v.4.04 allows an attacker to cause a Denial of Service via the PDFDoc malloc in the pdftotext.cc function. NOTE: Ve…
CVE-2023-0458Medium5.32023-04-26A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The resource argument value is controlled and is used in poi…