2023 CVEs (page 254)
Page 254 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-25451 | Medium | 5.9 | 2023-04-23 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPChill CPO Content Types plugin <= 1.1.0 versions. |
CVE-2023-23832 | Medium | 6.5 | 2023-04-23 | Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in TC Ultimate WP Query Search Filter plugin <= 1.0.10 versions. |
CVE-2023-23827 | Medium | 6.5 | 2023-04-23 | Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Google Maps v3 Shortcode plugin <= 1.2.1 versions. |
CVE-2023-23817 | Medium | 6.5 | 2023-04-23 | Auth. (contrinbutor+) Cross-Site Scripting (XSS) vulnerability in WebArea | Vera Nedvyzhenko Simple PDF Viewer plugin <= 1.9 versions. |
CVE-2023-23816 | Medium | 5.9 | 2023-04-23 | Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Twardes Sitemap Index plugin <= 1.2.3 versions. |
CVE-2023-23806 | Medium | 5.9 | 2023-04-23 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Davinder Singh Custom Settings plugin <= 1.0 versions. |
CVE-2023-23717 | Medium | 6.5 | 2023-04-23 | Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in George Gecewicz Portfolio Slideshow plugin <= 1.13.0 versions. |
CVE-2023-24404 | High | 7.1 | 2023-04-23 | Reflected Cross-Site Scripting (XSS) vulnerability in VryaSage Marketing Performance plugin <= 2.0.0 versions. |
CVE-2023-24386 | Medium | 5.9 | 2023-04-23 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Karishma Arora AI Contact Us Form plugin <= 1.0 versions. |
CVE-2023-22718 | High | 7.1 | 2023-04-23 | Reflected Cross-Site Scripting (XSS) vulnerability in Jason Lau User Meta Manager plugin <= 3.4.9 versions. |
CVE-2023-22698 | Medium | 6.5 | 2023-04-23 | Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Jason Bobich Theme Blvd Responsive Google Maps plugin <= 1.0.2 versions. |
CVE-2023-1875 | Medium | 5.4 | 2023-04-22 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-2245 | Medium | 6.3 | 2023-04-22 | A vulnerability was found in hansunCMS 1.4.3. It has been declared as critical. This vulnerability affects unknown code of the file /ueditor/net/controller.ash… |
CVE-2023-2244 | Medium | 6.3 | 2023-04-22 | A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been classified as critical. This affects an unknown part of the file /admin/orders… |
CVE-2023-2243 | Medium | 6.3 | 2023-04-22 | A vulnerability was found in SourceCodester Complaint Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of… |
CVE-2023-2239 | Medium | 6.5 | 2023-04-22 | Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository microweber/microweber prior to 1.3.4. |
CVE-2023-2242 | Medium | 6.3 | 2023-04-22 | A vulnerability has been found in SourceCodester Online Computer and Laptop Store 1.0 and classified as critical. Affected by this vulnerability is an unknown… |
CVE-2023-2241 | Medium | 5.3 | 2023-04-22 | A vulnerability, which was classified as critical, was found in PoDoFo 0.10.0. Affected is the function readXRefStreamEntry of the file PdfXRefStreamParserObje… |
CVE-2023-25514 | Medium | 5.3 | 2023-04-22 | NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in cuobjdump, where an attacker may cause an out-of-bounds read by tricking a user into runn… |
CVE-2023-25513 | Medium | 5.3 | 2023-04-22 | NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in cuobjdump, where an attacker may cause an out-of-bounds read by tricking a user into runn… |
CVE-2023-25512 | Medium | 5.3 | 2023-04-22 | NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in cuobjdump, where an attacker may cause an out-of-bounds memory read by running cuobjdump… |
CVE-2023-25511 | Low | 3.3 | 2023-04-22 | NVIDIA CUDA Toolkit for Linux and Windows contains a vulnerability in cuobjdump, where a division-by-zero error may enable a user to cause a crash, which may l… |
CVE-2023-25510 | Low | 3.3 | 2023-04-22 | NVIDIA CUDA Toolkit SDK for Linux and Windows contains a NULL pointer dereference in cuobjdump, where a local user running the tool against a malformed binary… |
CVE-2023-25509 | Medium | 6.0 | 2023-04-22 | NVIDIA DGX-1 SBIOS contains a vulnerability in Bds, which may lead to code execution, denial of service, and escalation of privileges. |
CVE-2023-25508 | Medium | 6.7 | 2023-04-22 | NVIDIA DGX-1 BMC contains a vulnerability in the IPMI handler, where an attacker with the appropriate level of authorization can upload and download arbitrary… |
CVE-2023-25507 | High | 7.2 | 2023-04-22 | NVIDIA DGX-1 BMC contains a vulnerability in the SPX REST API, where an attacker with the appropriate level of authorization can inject arbitrary shell command… |
CVE-2023-25506 | High | 7.5 | 2023-04-22 | NVIDIA DGX-1 contains a vulnerability in Ofbd in AMI SBIOS, where a preconditioned heap can allow a user with elevated privileges to cause an access beyond the… |
CVE-2023-25505 | High | 7.8 | 2023-04-22 | NVIDIA DGX-1 BMC contains a vulnerability in the IPMI handler of the AMI MegaRAC BMC , where an attacker with the appropriate level of authorization can cause… |
CVE-2023-0209 | High | 8.2 | 2023-04-22 | NVIDIA DGX-1 SBIOS contains a vulnerability in the Uncore PEI module, where authentication of the code executed by SSA is missing, which may lead to arbitrary… |
CVE-2023-0207 | High | 7.5 | 2023-04-22 | NVIDIA DGX-2 SBIOS contains a vulnerability where an attacker may modify the ServerSetup NVRAM variable at runtime by executing privileged code. A successful e… |
CVE-2023-0206 | High | 7.5 | 2023-04-22 | NVIDIA DGX A100 SBIOS contains a vulnerability where an attacker may modify arbitrary memory of SMRAM by exploiting the NVME SMM API. A successful exploit of t… |
CVE-2023-0205 | Medium | 5.0 | 2023-04-22 | NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware, where an unprivileged user can exploit insufficient granularity of… |
CVE-2023-0204 | Medium | 6.5 | 2023-04-22 | NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware, where an unprivileged user can cause improper handling of exceptio… |
CVE-2023-0203 | Medium | 5.0 | 2023-04-22 | NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware, where an unprivileged user can exploit insufficient granularity of… |
CVE-2023-0202 | High | 7.5 | 2023-04-22 | NVIDIA DGX A100 SBIOS contains a vulnerability where an attacker may modify arbitrary memory of SMRAM by exploiting the GenericSio and LegacySmmSredir SMM APIs… |
CVE-2023-0201 | Medium | 6.7 | 2023-04-22 | NVIDIA DGX-2 SBIOS contains a vulnerability in Bds, where a user with high privileges can cause a write beyond the bounds of an indexable resource, which may l… |
CVE-2023-0200 | High | 7.5 | 2023-04-22 | NVIDIA DGX-2 contains a vulnerability in OFBD where a user with high privileges and a pre-conditioned heap can cause an access beyond a buffers end, which may… |
CVE-2023-0199 | Medium | 6.1 | 2023-04-22 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer handler, where an out-of-bounds write can lead to denial of s… |
CVE-2023-0190 | Medium | 5.5 | 2023-04-22 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where a NULL pointer dereference may lead to denial of service. |
CVE-2023-0184 | High | 8.8 | 2023-04-22 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer handler which may lead to denial of service, escalation of pr… |
CVE-2023-2240 | High | 8.8 | 2023-04-22 | Improper Privilege Management in GitHub repository microweber/microweber prior to 1.3.4. |
CVE-2023-29020 | Medium | 6.5 | 2023-04-21 | @fastify/passport is a port of passport authentication library for the Fastify ecosystem. The CSRF (Cross-Site Request Forger) protection enforced by the `@fas… |
CVE-2023-29019 | High | 8.1 | 2023-04-21 | @fastify/passport is a port of passport authentication library for the Fastify ecosystem. Applications using `@fastify/passport` in affected versions for user… |
CVE-2023-2118 | Medium | 5.4 | 2023-04-21 | Insufficient access control in support ticket feature in Devolutions Server 2023.1.5.0 and below allows an authenticated attacker to send support tickets and d… |
CVE-2023-30621 | Critical | 9.8 | 2023-04-21 | Gipsy is a multi-purpose discord bot which aim to be as modular and user-friendly as possible. In versions prior to 1.3 users can run command on the host machi… |
CVE-2023-30620 | High | 7.5 | 2023-04-21 | mindsdb is a Machine Learning platform to help developers build AI solutions. In affected versions an unsafe extraction is being performed using `tarfile.extra… |
CVE-2023-30618 | Low | 3.2 | 2023-04-21 | Kitchen-Terraform provides a set of Test Kitchen plugins which enable the use of Test Kitchen to converge a Terraform configuration and verify the resulting in… |
CVE-2023-29924 | Critical | 9.8 | 2023-04-21 | PowerJob V4.3.1 is vulnerable to Incorrect Access Control that allows for remote code execution. |
CVE-2023-26557 | High | 7.5 | 2023-04-21 | io.finnet tss-lib before 2.0.0 can leak the lambda value of a private key via a timing side-channel attack because it relies on Go big.Int, which is not consta… |
CVE-2023-26556 | Critical | 9.1 | 2023-04-21 | io.finnet tss-lib before 2.0.0 can leak a secret key via a timing side-channel attack because it relies on the scalar-multiplication implementation in Go crypt… |
CVE-2023-30798 | High | 7.5 | 2023-04-21 | There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number o… |
CVE-2023-2141 | High | 8.5 | 2023-04-21 | An unsafe .NET object deserialization in DELMIA Apriso Release 2017 through Release 2022 could lead to post-authentication remote code execution. |
CVE-2023-2140 | High | 7.5 | 2023-04-21 | A Server-Side Request Forgery vulnerability in DELMIA Apriso Release 2017 through Release 2022 could allow an unauthenticated attacker to issue requests to… |
CVE-2023-2139 | Medium | 5.4 | 2023-04-21 | A reflected Cross-site Scripting (XSS) Vulnerability in DELMIA Apriso Release 2017 through Release 2022 allows an attacker to execute arbitrary script code. |
CVE-2023-2231 | Critical | 9.8 | 2023-04-21 | A vulnerability, which was classified as critical, was found in MAXTECH MAX-G866ac 0.4.1_TBRO_20160314. This affects an unknown part of the component Remote Ma… |
CVE-2023-29917 | Medium | 4.9 | 2023-04-21 | H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via go parameter at /goform/aspForm. |
CVE-2023-29916 | Medium | 4.9 | 2023-04-21 | H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the UpdateWanParams interface at /goform/aspForm. |
CVE-2023-29915 | Medium | 4.9 | 2023-04-21 | H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via CMD parameter at /goform/aspForm. |
CVE-2023-29914 | Medium | 4.9 | 2023-04-21 | H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the DeltriggerList interface at /goform/aspForm. |
CVE-2023-29913 | Medium | 4.9 | 2023-04-21 | H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the SetAPWifiorLedInfoById interface at /goform/aspForm. |
CVE-2023-29912 | Medium | 4.9 | 2023-04-21 | H3C Magic R200 R200V100R004 was discovered to contain a stack overflow via the DelvsList interface at /goform/aspForm. |
CVE-2023-29911 | Medium | 4.9 | 2023-04-21 | H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the AddMacList interface at /goform/aspForm. |
CVE-2023-29910 | Medium | 4.9 | 2023-04-21 | H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the UpdateMacClone interface at /goform/aspForm. |
CVE-2023-29909 | Medium | 4.9 | 2023-04-21 | H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the AddWlanMacList interface at /goform/aspForm. |
CVE-2023-29908 | Medium | 4.9 | 2023-04-21 | H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the SetMobileAPInfoById interface at /goform/aspForm. |
CVE-2023-29907 | Medium | 4.9 | 2023-04-21 | H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the Edit_BasicSSID_5G interface at /goform/aspForm. |
CVE-2023-29906 | Medium | 4.9 | 2023-04-21 | H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the Edit_BasicSSID interface at /goform/aspForm. |
CVE-2023-29905 | Medium | 4.9 | 2023-04-21 | H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the UpdateSnat interface at /goform/aspForm. |
CVE-2023-26876 | High | 8.8 | 2023-04-21 | SQL injection vulnerability found in Piwigo v.13.5.0 and before allows a remote attacker to execute arbitrary code via the filter_user_id parameter to the admi… |
CVE-2023-1998 | Medium | 5.6 | 2023-04-21 | The Linux kernel allows userspace processes to enable mitigations by calling prctl with PR_SET_SPECULATION_CTRL which disables the speculation feature as well… |
CVE-2023-29575 | Medium | 5.5 | 2023-04-21 | Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp42aac component. |
CVE-2023-2228 | Medium | 6.8 | 2023-04-21 | Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.1.0. |
CVE-2023-2227 | Critical | 9.1 | 2023-04-21 | Improper Authorization in GitHub repository modoboa/modoboa prior to 2.1.0. |
CVE-2023-2226 | Low | 3.3 | 2023-04-21 | Due to insufficient validation in the PE and OLE parsers in Rapid7's Velociraptor versions earlier than 0.6.8 allows attacker to crash Velociraptor during pars… |
CVE-2023-2220 | Low | 3.5 | 2023-04-21 | A vulnerability was found in Dream Technology mica up to 3.0.5. It has been classified as problematic. Affected is an unknown function of the component Form Ob… |
CVE-2023-26101 | High | 7.5 | 2023-04-21 | In Progress Flowmon Packet Investigator before 12.1.0, a Flowmon user with access to Flowmon Packet Investigator could leverage a path-traversal vulnerability… |
CVE-2023-26100 | Medium | 6.1 | 2023-04-21 | In Progress Flowmon before 12.2.0, an application endpoint failed to sanitize user-supplied input. A threat actor could leverage a reflected XSS vulnerability… |
CVE-2023-2219 | Low | 3.5 | 2023-04-21 | A vulnerability was found in SourceCodester Task Reminder System 1.0 and classified as problematic. This issue affects some unknown processing of the file /cla… |
CVE-2023-2218 | Medium | 6.3 | 2023-04-21 | A vulnerability has been found in SourceCodester Task Reminder System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admi… |
CVE-2023-2217 | Medium | 6.3 | 2023-04-21 | A vulnerability, which was classified as critical, was found in SourceCodester Task Reminder System 1.0. This affects an unknown part of the file /admin/remind… |
CVE-2023-2216 | Low | 3.5 | 2023-04-21 | A vulnerability classified as problematic was found in Campcodes Coffee Shop POS System 1.0. Affected by this vulnerability is an unknown functionality of the… |
CVE-2023-2215 | Medium | 6.3 | 2023-04-21 | A vulnerability classified as critical has been found in Campcodes Coffee Shop POS System 1.0. Affected is an unknown function of the file /admin/user/manage_u… |
CVE-2023-2214 | Medium | 6.3 | 2023-04-21 | A vulnerability was found in Campcodes Coffee Shop POS System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin… |
CVE-2023-2213 | Medium | 6.3 | 2023-04-21 | A vulnerability was found in Campcodes Coffee Shop POS System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin… |
CVE-2023-2212 | Medium | 6.3 | 2023-04-21 | A vulnerability was found in Campcodes Coffee Shop POS System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/products… |
CVE-2023-2211 | Medium | 6.3 | 2023-04-21 | A vulnerability was found in Campcodes Coffee Shop POS System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2023-2210 | Medium | 6.3 | 2023-04-21 | A vulnerability has been found in Campcodes Coffee Shop POS System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality o… |
CVE-2023-2209 | Medium | 6.3 | 2023-04-21 | A vulnerability, which was classified as critical, was found in Campcodes Coffee Shop POS System 1.0. Affected is an unknown function of the file /admin/sales/… |
CVE-2023-2208 | Medium | 6.3 | 2023-04-21 | A vulnerability, which was classified as critical, has been found in Campcodes Retro Basketball Shoes Online Store 1.0. This issue affects some unknown process… |
CVE-2023-2207 | Medium | 6.3 | 2023-04-21 | A vulnerability classified as critical was found in Campcodes Retro Basketball Shoes Online Store 1.0. This vulnerability affects unknown code of the file cont… |
CVE-2023-2206 | Medium | 6.3 | 2023-04-21 | A vulnerability classified as critical has been found in Campcodes Retro Basketball Shoes Online Store 1.0. This affects an unknown part of the file contactus… |
CVE-2023-2205 | Medium | 6.3 | 2023-04-21 | A vulnerability was found in Campcodes Retro Basketball Shoes Online Store 1.0. It has been rated as critical. Affected by this issue is some unknown functiona… |
CVE-2023-2204 | Medium | 6.3 | 2023-04-21 | A vulnerability was found in Campcodes Retro Basketball Shoes Online Store 1.0. It has been declared as critical. Affected by this vulnerability is an unknown… |
CVE-2023-1892 | Critical | 9.6 | 2023-04-21 | Cross-site Scripting (XSS) - Reflected in GitHub repository sidekiq/sidekiq prior to 7.0.8. |
CVE-2023-2202 | Medium | 6.5 | 2023-04-21 | Improper Access Control in GitHub repository francoisjacquet/rosariosis prior to 10.9.3. |
CVE-2023-27355 | High | 8.8 | 2023-04-20 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sonos One Speaker 70.3-35220. Authentication is not… |
CVE-2023-27354 | Medium | 6.5 | 2023-04-20 | This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sonos One Speaker 70.3-35220. Authenticatio… |
CVE-2023-27353 | Medium | 6.5 | 2023-04-20 | This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sonos One Speaker 70.3-35220. Authenticatio… |
CVE-2023-27352 | High | 8.8 | 2023-04-20 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sonos One Speaker 70.3-35220. Authentication is not… |
CVE-2023-2194 | Medium | 6.7 | 2023-04-20 | An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The userspace "data->block[0]" variable was not capped to a num… |