2023 CVEs (page 252)
Page 252 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-29268 | Critical | 9.8 | 2023-04-26 | The Splus Server component of TIBCO Software Inc.'s TIBCO Spotfire Statistics Services contains a vulnerability that allows an unauthenticated remote attacker… |
CVE-2023-30212 | Medium | 6.1 | 2023-04-26 | OURPHP <= 7.2.0 is vulnerale to Cross Site Scripting (XSS) via /client/manage/ourphp_out.php. |
CVE-2023-2307 | Medium | 4.7 | 2023-04-26 | Cross-Site Request Forgery (CSRF) in GitHub repository builderio/qwik prior to 0.104.0. |
CVE-2023-30211 | Critical | 9.8 | 2023-04-26 | OURPHP <= 7.2.0 is vulnerable to SQL Injection. |
CVE-2023-30210 | Medium | 6.1 | 2023-04-26 | OURPHP <= 7.2.0 is vulnerable to Cross Site Scripting (XSS) via ourphp_tz.php. |
CVE-2023-22729 | Medium | 5.4 | 2023-04-26 | Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Prior to version 4.12.15, an attacker can… |
CVE-2023-30269 | High | 8.1 | 2023-04-26 | CLTPHP <=6.0 is vulnerable to Improper Input Validation via application/admin/controller/Template.php. |
CVE-2023-30267 | Medium | 6.1 | 2023-04-26 | CLTPHP <=6.0 is vulnerable to Cross Site Scripting (XSS) via application/home/controller/Changyan.php. |
CVE-2023-30266 | High | 8.8 | 2023-04-26 | CLTPHP <=6.0 is vulnerable to Unrestricted Upload of File with Dangerous Type. |
CVE-2023-30265 | Medium | 6.5 | 2023-04-26 | CLTPHP <=6.0 is vulnerable to Directory Traversal. |
CVE-2023-30112 | High | 7.5 | 2023-04-26 | Medicine Tracker System in PHP 1.0.0 is vulnerable to SQL Injection. |
CVE-2023-22728 | Medium | 4.3 | 2023-04-26 | Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Prior to version 4.12.15, the GridField p… |
CVE-2023-1387 | Medium | 4.2 | 2023-04-26 | Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the… |
CVE-2023-29257 | High | 7.2 | 2023-04-26 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to remote code execution as a database administrator of on… |
CVE-2023-24796 | Critical | 9.8 | 2023-04-26 | Password vulnerability found in Vinga WR-AC1200 81.102.1.4370 and before allows a remote attacker to execute arbitrary code via the password parameter at the /… |
CVE-2023-26286 | High | 8.4 | 2023-04-26 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX runtime services library to execute arbitrary… |
CVE-2023-2273 | Medium | 5.8 | 2023-04-26 | Rapid7 Insight Agent token handler versions 3.2.6 and below, suffer from a Directory Traversal vulnerability whereby unsanitized input from a CLI argument flow… |
CVE-2023-2294 | Low | 3.5 | 2023-04-26 | A vulnerability was found in UCMS 1.6.0. It has been classified as problematic. This affects an unknown part of the file saddpost.php of the component Column C… |
CVE-2023-30404 | Critical | 9.8 | 2023-04-26 | Aigital Wireless-N Repeater Mini_Router v0.131229 was discovered to contain a remote code execution (RCE) vulnerability via the sysCmd parameter in the formSys… |
CVE-2023-30111 | Medium | 6.1 | 2023-04-26 | Medicine Tracker System in PHP 1.0.0 is vulnerable to Cross Site Scripting (XSS). |
CVE-2023-30106 | Medium | 6.1 | 2023-04-26 | Sourcecodester Medicine Tracker System in PHP 1.0.0 is vulnerable to Cross Site Scripting (XSS) via page=about. |
CVE-2023-27843 | Critical | 9.8 | 2023-04-26 | SQL injection vulnerability found in PrestaShop askforaquote v.5.4.2 and before allow a remote attacker to gain privileges via the QuotesProduct::deleteProduct… |
CVE-2023-26735 | High | 7.5 | 2023-04-26 | blackbox_exporter v0.23.0 was discovered to contain an access control issue in its probe interface. This vulnerability allows attackers to detect intranet port… |
CVE-2023-26560 | Medium | 6.5 | 2023-04-26 | Northern.tech CFEngine Enterprise before 3.21.1 allows a subset of authenticated users to leverage the Scheduled Reports feature to read arbitrary files and po… |
CVE-2023-31223 | High | 8.7 | 2023-04-25 | Dradis before 4.8.0 allows persistent XSS by authenticated author users, related to avatars. |
CVE-2023-0045 | Medium | 4.7 | 2023-04-25 | The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ib_prctl_set function updates the Thread Informatio… |
CVE-2023-20870 | Medium | 6.0 | 2023-04-25 | VMware Workstation and Fusion contain an out-of-bounds read vulnerability that exists in the functionality for sharing host Bluetooth devices with the virtual… |
CVE-2023-20869 | High | 8.2 | 2023-04-25 | VMware Workstation (17.x) and VMware Fusion (13.x) contain a stack-based buffer-overflow vulnerability that exists in the functionality for sharing host Blueto… |
CVE-2023-30609 | Medium | 5.4 | 2023-04-25 | matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tag… |
CVE-2023-30549 | High | 7.1 | 2023-04-25 | Apptainer is an open source container platform for Linux. There is an ext4 use-after-free flaw that is exploitable through versions of Apptainer < 1.1.0 and in… |
CVE-2023-2293 | Low | 2.4 | 2023-04-25 | A vulnerability was found in SourceCodester Purchase Order Management System 1.0. It has been classified as problematic. This affects an unknown part of the fi… |
CVE-2023-2269 | Medium | 4.4 | 2023-04-25 | A denial of service problem was found, due to a possible recursive locking scenario, resulting in a deadlock in table_clear in drivers/md/dm-ioctl.c in the Lin… |
CVE-2023-29012 | High | 7.2 | 2023-04-25 | Git for Windows is the Windows port of Git. Prior to version 2.40.1, any user of Git CMD who starts the command in an untrusted directory is impacted by an Unc… |
CVE-2023-29011 | High | 7.5 | 2023-04-25 | Git for Windows, the Windows port of Git, ships with an executable called `connect.exe`, which implements a SOCKS5 proxy that can be used to connect e.g. to SS… |
CVE-2023-29007 | High | 7.0 | 2023-04-25 | Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially cra… |
CVE-2023-24512 | High | 8.8 | 2023-04-25 | On affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests could craft a request allowing it to update arbitrar… |
CVE-2023-23839 | Medium | 6.5 | 2023-04-25 | The SolarWinds Platform was susceptible to the Exposure of Sensitive Information Vulnerability. This vulnerability allows users to access Orion.WebCommunityStr… |
CVE-2023-20872 | High | 8.8 | 2023-04-25 | VMware Workstation and Fusion contain an out-of-bounds read/write vulnerability in SCSI CD/DVD device emulation. |
CVE-2023-20871 | High | 7.8 | 2023-04-25 | VMware Fusion contains a local privilege escalation vulnerability. A malicious actor with read/write access to the host operating system can elevate privileges… |
CVE-2023-28084 | Medium | 5.5 | 2023-04-25 | HPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokens |
CVE-2023-25815 | Low | 3.3 | 2023-04-25 | In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to localize messages a… |
CVE-2023-25652 | High | 7.5 | 2023-04-25 | Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding spec… |
CVE-2023-25461 | Medium | 5.9 | 2023-04-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in namithjawahar Wp-Insert plugin <= 2.5.0 versions. |
CVE-2023-24005 | Medium | 5.9 | 2023-04-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Winwar Media Inline Tweet Sharer – Twitter Sharing Plugin plugin <= 2.5.3 versions. |
CVE-2023-23995 | Medium | 5.9 | 2023-04-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Tim Reeves & David Stöckl TinyMCE Custom Styles plugin <= 1.1.2 versions. |
CVE-2023-23889 | Medium | 6.5 | 2023-04-25 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Paypal Payments plugin <= 5.7.25 versions. |
CVE-2023-23866 | Medium | 6.5 | 2023-04-25 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Carlos Moreira Interactive Geo Maps plugin <= 1.5.8 versions. |
CVE-2023-23710 | Medium | 5.9 | 2023-04-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <=… |
CVE-2023-30839 | Critical | 9.9 | 2023-04-25 | PrestaShop is an Open Source e-commerce web application. Versions prior to 8.0.4 and 1.7.8.9 contain a SQL filtering vulnerability. A BO user can write, update… |
CVE-2023-30838 | High | 8.5 | 2023-04-25 | PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, the `ValidateCore::isCleanHTML()` method of Prestashop misses hij… |
CVE-2023-2282 | Medium | 6.5 | 2023-04-25 | Improper access control in the Web Login listener in Devolutions Remote Desktop Manager 2023.1.22 and earlier on Windows allows an authenticated user to bypass… |
CVE-2023-28090 | Medium | 5.5 | 2023-04-25 | An HPE OneView appliance dump may expose SNMPv3 read credentials |
CVE-2023-28089 | High | 7.1 | 2023-04-25 | An HPE OneView appliance dump may expose FTP credentials for c7000 Interconnect Modules |
CVE-2023-28088 | High | 7.8 | 2023-04-25 | An HPE OneView appliance dump may expose SAN switch administrative credentials |
CVE-2023-28087 | Medium | 5.5 | 2023-04-25 | An HPE OneView appliance dump may expose OneView user accounts |
CVE-2023-28086 | Medium | 5.5 | 2023-04-25 | An HPE OneView appliance dump may expose proxy credential settings |
CVE-2023-25793 | Medium | 5.9 | 2023-04-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in George Pattihis Link Juice Keeper plugin <= 2.0.2 versions. |
CVE-2023-25485 | Medium | 5.9 | 2023-04-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Bernhard Kux JSON Content Importer plugin <= 1.3.15 versions. |
CVE-2023-30545 | High | 7.7 | 2023-04-25 | PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, it is possible for a user with access to the SQL Manager (Advance… |
CVE-2023-30177 | Medium | 6.1 | 2023-04-25 | CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS). An attacker can inject javascript code into Volume Name. |
CVE-2023-29200 | Medium | 4.3 | 2023-04-25 | Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary system files in the file m… |
CVE-2023-23838 | Medium | 6.5 | 2023-04-25 | Directory traversal and file enumeration vulnerability which allowed users to enumerate to different folders of the server. |
CVE-2023-23837 | High | 7.5 | 2023-04-25 | No exception handling vulnerability which revealed sensitive or excessive information to users. |
CVE-2023-28847 | Low | 3.1 | 2023-04-25 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server 24.0.0 prior to 24.0.11 and 25.0.0 prior t… |
CVE-2023-25484 | Medium | 5.9 | 2023-04-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Oliver Schlöbe Simple Yearly Archive plugin <= 2.1.8 versions. |
CVE-2023-30402 | Medium | 5.5 | 2023-04-25 | YASM v1.3.0 was discovered to contain a heap overflow via the function handle_dot_label at /nasm/nasm-token.re. Note: This has been disputed by third parties w… |
CVE-2023-29552 | High | 7.5 | 2023-04-25 | The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use s… |
CVE-2023-25314 | Medium | 6.1 | 2023-04-25 | Cross Site Scripting (XSS) vulnerability in World Wide Broadcast Network AVideo before 12.4, allows attackers to gain sensitive information via the success par… |
CVE-2023-25313 | Critical | 9.8 | 2023-04-25 | OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the video link field to t… |
CVE-2023-27105 | Critical | 9.8 | 2023-04-25 | A vulnerability in the Wi-Fi file transfer module of Shanling M5S Portable Music Player with Shanling MTouch OS v4.3 and Shanling M2X Portable Music Player wit… |
CVE-2023-2281 | Low | 3.1 | 2023-04-25 | When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients. This allows the clients to see the name, d… |
CVE-2023-29779 | High | 7.5 | 2023-04-25 | Sengled Dimmer Switch V0.0.9 contains a denial of service (DOS) vulnerability, which allows a remote attacker to send malicious Zigbee messages to a vulnerable… |
CVE-2023-30417 | Medium | 5.4 | 2023-04-25 | A cross-site scripting (XSS) vulnerability in Pear-Admin-Boot up to v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inje… |
CVE-2023-26843 | Medium | 5.4 | 2023-04-25 | A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the NoteEditor.php. |
CVE-2023-26841 | Medium | 6.5 | 2023-04-25 | A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to change any user's password except for the user that is currently logg… |
CVE-2023-26840 | Medium | 5.3 | 2023-04-25 | A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to set a person to a user and set that user to be an Administrator. |
CVE-2023-26839 | Medium | 4.3 | 2023-04-25 | A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to edit information for existing people on the site. |
CVE-2023-26058 | Medium | 6.5 | 2023-04-25 | An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to a Performance Manager page. Input validation and a proper XML parser config… |
CVE-2023-26057 | Medium | 6.5 | 2023-04-25 | An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to the Configuration Dashboard page. Input validation and a proper XML parser… |
CVE-2023-25348 | High | 7.8 | 2023-04-25 | ChurchCRM 4.5.3 was discovered to contain a CSV injection vulnerability via the Last Name and First Name input fields when creating a new person. These vulnera… |
CVE-2023-25347 | Medium | 5.4 | 2023-04-25 | A stored cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3, allows remote attackers to inject arbitrary web script or HTML via input fields. These in… |
CVE-2023-25346 | Medium | 6.1 | 2023-04-25 | A reflected cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the id parameter of… |
CVE-2023-27619 | Medium | 5.4 | 2023-04-25 | Auth (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Macho Themes Regina Lite theme <= 2.0.7 versions. |
CVE-2023-26098 | High | 8.2 | 2023-04-25 | An issue was discovered in the Open Document feature in Telindus Apsal 3.14.2022.235 b. An attacker may upload a crafted file to execute arbitrary code. |
CVE-2023-25710 | Medium | 5.9 | 2023-04-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in DIGITALBLUE Click to Call or Chat Buttons plugin <= 1.4.0 versions. |
CVE-2023-25490 | Medium | 5.9 | 2023-04-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Eric Teubert Archivist – Custom Archive Templates plugin <= 1.7.4 versions. |
CVE-2023-25479 | Medium | 5.9 | 2023-04-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Podlove Podlove Subscribe button plugin <= 1.3.7 versions. |
CVE-2023-22665 | Medium | 5.4 | 2023-04-25 | There is insufficient checking of user queries in Apache Jena versions 4.7.0 and earlier, when invoking custom scripts. It allows a remote user to execute arbi… |
CVE-2023-28771 | Critical | 9.8 | 2023-04-25 | Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series… |
CVE-2023-2007 | High | 7.8 | 2023-04-24 | The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of proper locking when performing operations on an object. An at… |
CVE-2023-30629 | High | 7.5 | 2023-04-24 | Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.1 through 0.3.7, the Vyper compiler generates the wrong bytecode… |
CVE-2023-30628 | High | 8.8 | 2023-04-24 | Kiwi TCMS is an open source test management system. In kiwitcms/Kiwi v12.2 and prior and kiwitcms/enterprise v12.2 and prior, the `changelog.yml` workflow is v… |
CVE-2023-30623 | High | 8.8 | 2023-04-24 | `embano1/wip` is a GitHub Action written in Bash. Prior to version 2, the `embano1/wip` action uses the `github.event.pull_request.title` parameter in an inse… |
CVE-2023-30414 | Medium | 5.5 | 2023-04-24 | Jerryscript commit 1a2c047 was discovered to contain a stack overflow via the component vm_loop at /jerry-core/vm/vm.c. |
CVE-2023-30410 | Medium | 5.5 | 2023-04-24 | Jerryscript commit 1a2c047 was discovered to contain a stack overflow via the component ecma_op_function_construct at /operations/ecma-function-object.c. |
CVE-2023-30408 | Medium | 5.5 | 2023-04-24 | Jerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component build/bin/jerry. |
CVE-2023-30406 | Medium | 5.5 | 2023-04-24 | Jerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component ecma_find_named_property at /base/ecma-helpers.c. |
CVE-2023-30627 | Critical | 9.0 | 2023-04-24 | jellyfin-web is the web client for Jellyfin, a free-software media system. Starting in version 10.1.0 and prior to version 10.8.10, a stored cross-site scripti… |
CVE-2023-30626 | High | 8.8 | 2023-04-24 | Jellyfin is a free-software media system. Versions starting with 10.8.0 and prior to 10.8.10 and prior have a directory traversal vulnerability inside the `Cli… |
CVE-2023-2260 | High | 8.8 | 2023-04-24 | Authorization Bypass Through User-Controlled Key in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304. |