2023 CVEs (page 258)
Page 258 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-28966 | High | 7.8 | 2023-04-17 | An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS Evolved allows a low-privileged local attacker with shell access to modify existing… |
CVE-2023-28965 | Medium | 6.5 | 2023-04-17 | An Improper Check or Handling of Exceptional Conditions within the storm control feature of Juniper Networks Junos OS allows an attacker sending a high rate of… |
CVE-2023-28964 | High | 7.5 | 2023-04-17 | An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved all… |
CVE-2023-28963 | Medium | 5.3 | 2023-04-17 | An Improper Authentication vulnerability in cert-mgmt.php, used by the J-Web component of Juniper Networks Junos OS allows an unauthenticated, network-based at… |
CVE-2023-28962 | Medium | 5.3 | 2023-04-17 | An Improper Authentication vulnerability in upload-file.php, used by the J-Web component of Juniper Networks Junos OS allows an unauthenticated, network-based… |
CVE-2023-28961 | Medium | 5.8 | 2023-04-17 | An Improper Handling of Unexpected Data Type vulnerability in IPv6 firewall filter processing of Juniper Networks Junos OS on the ACX Series devices will preve… |
CVE-2023-28960 | High | 8.2 | 2023-04-17 | An Incorrect Permission Assignment for Critical Resource vulnerability in Juniper Networks Junos OS Evolved allows a local, authenticated low-privileged attack… |
CVE-2023-28959 | Medium | 6.5 | 2023-04-17 | An Improper Check or Handling of Exceptional Conditions vulnerability in packet processing of Juniper Networks Junos OS on QFX10002 allows an unauthenticated… |
CVE-2023-24504 | High | 7.5 | 2023-04-17 | Electra Central AC unit – Adjacent attacker may cause the unit to connect to unauthorized update server. |
CVE-2023-24503 | High | 7.5 | 2023-04-17 | Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW. |
CVE-2023-24502 | High | 7.5 | 2023-04-17 | Electra Central AC unit – The unit opens an AP with an easily calculated password. |
CVE-2023-24501 | Critical | 9.8 | 2023-04-17 | Electra Central AC unit – Hardcoded Credentials in unspecified code used by the unit. |
CVE-2023-24500 | High | 7.5 | 2023-04-17 | Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW. |
CVE-2023-1697 | Medium | 6.5 | 2023-04-17 | An Improper Handling of Missing Values vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows an adjacent, unauthenticated att… |
CVE-2023-30548 | Medium | 4.3 | 2023-04-17 | gatsby-plugin-sharp is a plugin for the gatsby framework which exposes functions built on the Sharp image processing library. The gatsby-plugin-sharp plugin pr… |
CVE-2023-27911 | High | 7.8 | 2023-04-17 | A user may be tricked into opening a malicious FBX file that may exploit a heap buffer overflow vulnerability in Autodesk® FBX® SDK 2020 or prior which may lea… |
CVE-2023-27910 | High | 7.8 | 2023-04-17 | A user may be tricked into opening a malicious FBX file that may exploit a stack buffer overflow vulnerability in Autodesk® FBX® SDK 2020 or prior which may le… |
CVE-2023-27909 | High | 7.8 | 2023-04-17 | An Out-Of-Bounds Write Vulnerability in Autodesk® FBX® SDK version 2020 or prior may lead to code execution through maliciously crafted FBX files or informatio… |
CVE-2023-27907 | High | 7.8 | 2023-04-17 | A malicious actor may convince a victim to open a malicious USD file that may trigger an out-of-bounds write vulnerability which may result in code execution. |
CVE-2023-27906 | High | 7.8 | 2023-04-17 | A malicious actor may convince a victim to open a malicious USD file that may trigger an out-of-bounds read vulnerability which may result in code execution. |
CVE-2023-25010 | High | 7.8 | 2023-04-17 | A malicious actor may convince a victim to open a malicious USD file that may trigger an uninitialized variable which may result in code execution. |
CVE-2023-30769 | Critical | 9.1 | 2023-04-17 | Vulnerability discovered is related to the peer-to-peer (p2p) communications, attackers can craft consensus messages, send it to individual nodes and take them… |
CVE-2023-2130 | Medium | 6.3 | 2023-04-17 | A vulnerability classified as critical has been found in SourceCodester Purchase Order Management System 1.0. Affected is an unknown function of the file /admi… |
CVE-2023-29004 | Medium | 6.5 | 2023-04-17 | hap-wi/roxy-wi is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A Path Traversal vulnerability was found in the current version o… |
CVE-2023-27525 | Low | 3.1 | 2023-04-17 | An authenticated user with Gamma role authorization could have access to metadata information using non trivial methods in Apache Superset up to and including… |
CVE-2023-25504 | Medium | 4.9 | 2023-04-17 | A malicious actor who has been authenticated and granted specific permissions in Apache Superset may use the import dataset feature in order to conduct Server-… |
CVE-2023-29665 | Critical | 9.8 | 2023-04-17 | D-Link DIR823G_V1.0.2B05 was discovered to contain a stack overflow via the NewPassword parameters in SetPasswdSettings. |
CVE-2023-27705 | High | 7.5 | 2023-04-17 | APNG_Optimizer v1.4 was discovered to contain a buffer overflow via the component /apngopt/ubuntu.png. |
CVE-2023-1831 | High | 7.2 | 2023-04-17 | Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logg… |
CVE-2023-27755 | High | 8.8 | 2023-04-17 | go-bbs v1 was discovered to contain an arbitrary file download vulnerability via the component /api/v1/download. |
CVE-2023-1873 | Critical | 9.8 | 2023-04-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Faturamatik Bircard allows SQL Injection. This issue aff… |
CVE-2023-27844 | Critical | 9.8 | 2023-04-17 | SQL injection vulnerability found in PrestaShopleurlrewrite v.1.0 and before allow a remote attacker to gain privileges via the Dispatcher::getController compo… |
CVE-2023-27733 | High | 7.2 | 2023-04-17 | DedeCMS v5.7.106 was discovered to contain a SQL injection vulnerability via the component /dede/sys_sql_query.php. |
CVE-2023-1473 | Medium | 6.1 | 2023-04-17 | The Slider, Gallery, and Carousel by MetaSlider WordPress plugin 3.29.0 does not sanitise and escape a parameter before outputting it back in the page, leading… |
CVE-2023-1427 | Medium | 4.9 | 2023-04-17 | - The Photo Gallery by 10Web WordPress plugin before 1.8.15 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege user… |
CVE-2023-1413 | Medium | 6.1 | 2023-04-17 | The WP VR WordPress plugin before 8.2.9 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site… |
CVE-2023-1373 | Medium | 6.1 | 2023-04-17 | The W4 Post List WordPress plugin before 2.4.6 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting |
CVE-2023-1371 | Medium | 6.5 | 2023-04-17 | The W4 Post List WordPress plugin before 2.4.6 does not ensure that password protected posts can be accessed before displaying their content, which could allow… |
CVE-2023-1331 | Medium | 6.5 | 2023-04-17 | The Redirection WordPress plugin before 1.1.5 does not have CSRF checks in the uninstall action, which could allow attackers to make logged in admins delete al… |
CVE-2023-1325 | Medium | 5.4 | 2023-04-17 | The Easy Forms for Mailchimp WordPress plugin before 6.8.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/… |
CVE-2023-1282 | Medium | 6.1 | 2023-04-17 | The Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard WordPress plugin before 2.11.1 and Drag and Drop Multiple File Upload PRO - Contact Form 7… |
CVE-2023-1274 | Medium | 6.5 | 2023-04-17 | The Pricing Tables For WPBakery Page Builder (formerly Visual Composer) WordPress plugin before 3.0 does not validate some shortcode attributes before using th… |
CVE-2023-0889 | Medium | 6.5 | 2023-04-17 | Themeflection Numbers WordPress plugin before 2.0.1 does not have authorisation and CSRF check in an AJAX action, and does not ensure that the options to be up… |
CVE-2023-0765 | High | 8.8 | 2023-04-17 | The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not properly escape values used in SQL queries, leading to an Blind SQL Injection vulnerability… |
CVE-2023-0764 | Medium | 5.4 | 2023-04-17 | The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not perform proper sanitization of gallery information, leading to a Stored Cross-Site Scription… |
CVE-2023-0374 | Medium | 5.4 | 2023-04-17 | The W4 Post List WordPress plugin before 2.4.6 does not validate and escape some of its block options before outputting them back in a page/post where the bloc… |
CVE-2023-0367 | Medium | 5.4 | 2023-04-17 | The Pricing Tables For WPBakery Page Builder (formerly Visual Composer) WordPress plugin before 3.0 does not validate and escape some of its shortcode attribut… |
CVE-2023-0277 | High | 7.2 | 2023-04-17 | The WC Fields Factory WordPress plugin through 4.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL inj… |
CVE-2023-1723 | Critical | 9.8 | 2023-04-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Veragroup Mobile Assistant allows SQL Injection. This is… |
CVE-2023-2017 | High | 8.8 | 2023-04-17 | Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), affecting both shopware/core and shopware/platform GitHub rep… |
CVE-2023-30771 | Critical | 9.8 | 2023-04-17 | Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component on 0.13.3. iotdb-web-work… |
CVE-2023-22946 | Medium | 6.4 | 2023-04-17 | In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute… |
CVE-2023-1109 | High | 8.8 | 2023-04-17 | In Phoenix Contacts ENERGY AXC PU Web service an authenticated restricted user of the web frontend can access, read, write and create files throughout the file… |
CVE-2023-30770 | High | 7.1 | 2023-04-17 | A stack-based buffer overflow vulnerability was found in the ASUSTOR Data Master (ADM) due to the lack of data size validation. An attacker can exploit this vu… |
CVE-2023-24831 | Critical | 9.8 | 2023-04-17 | Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects Apache IoTDB Grafana Connector: from 0.13.0 through 0.13.3… |
CVE-2023-2109 | Medium | 6.1 | 2023-04-17 | Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.14.0. |
CVE-2023-22687 | Low | 3.7 | 2023-04-16 | Insecure Storage of Sensitive Information vulnerability in Jose Mortellaro Freesoul Deactivate Plugins – Plugin manager and cleanup plugin <= 1.9.4.0 versions. |
CVE-2023-30542 | Medium | 6.8 | 2023-04-16 | OpenZeppelin Contracts is a library for secure smart contract development. The proposal creation entrypoint (`propose`) in `GovernorCompatibilityBravo` allows… |
CVE-2023-30537 | Critical | 9.9 | 2023-04-16 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with the right to add an object on a page can… |
CVE-2023-30474 | Medium | 4.3 | 2023-04-16 | Cross-Site Request Forgery (CSRF) vulnerability in Kilian Evang Ultimate Noindex Nofollow Tool II plugin <= 1.3 versions. |
CVE-2023-2108 | Medium | 6.3 | 2023-04-16 | A vulnerability has been found in SourceCodester Judging Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functio… |
CVE-2023-29511 | Critical | 9.9 | 2023-04-16 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights on a page (e.g., it's own us… |
CVE-2023-29509 | Critical | 9.9 | 2023-04-16 | XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents can execute… |
CVE-2023-29508 | High | 8.9 | 2023-04-16 | XWiki Commons are technical libraries common to several other top level XWiki projects. A user without script rights can introduce a stored XSS by using the Li… |
CVE-2023-27610 | Medium | 5.5 | 2023-04-16 | Auth. (admin+) SQL Injection (SQLi) vulnerability in TransbankDevelopers Transbank Webpay REST plugin <= 1.6.6 versions. |
CVE-2023-29507 | Critical | 9.1 | 2023-04-16 | XWiki Commons are technical libraries common to several other top level XWiki projects. The Document script API returns directly a DocumentAuthors allowing to… |
CVE-2023-29506 | Medium | 5.4 | 2023-04-16 | XWiki Commons are technical libraries common to several other top level XWiki projects. It was possible to inject some code using the URL of authenticated endp… |
CVE-2023-29214 | Critical | 9.9 | 2023-04-16 | XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary Groovy, Python or Veloc… |
CVE-2023-29212 | Critical | 9.9 | 2023-04-16 | XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary Groovy, Python or Veloc… |
CVE-2023-29211 | Critical | 9.9 | 2023-04-16 | XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights `WikiManager.DeleteWiki` can execute arbitrar… |
CVE-2023-30772 | Medium | 6.4 | 2023-04-16 | The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/power/supply/da9150-charger.c if a physically proximate attacker unp… |
CVE-2023-29210 | Critical | 9.9 | 2023-04-15 | XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents including th… |
CVE-2023-29209 | Critical | 9.9 | 2023-04-15 | XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents including th… |
CVE-2023-29208 | High | 7.5 | 2023-04-15 | XWiki Commons are technical libraries common to several other top level XWiki projects. Rights added to a document are not taken into account for viewing it on… |
CVE-2023-29207 | High | 8.9 | 2023-04-15 | XWiki Commons are technical libraries common to several other top level XWiki projects. The Livetable Macro wasn't properly sanitizing column names, thus allo… |
CVE-2023-29206 | Critical | 9.0 | 2023-04-15 | XWiki Commons are technical libraries common to several other top level XWiki projects. There was no check in the author of a JavaScript xobject or StyleSheet… |
CVE-2023-29205 | Critical | 9.9 | 2023-04-15 | XWiki Commons are technical libraries common to several other top level XWiki projects. The HTML macro does not systematically perform a proper neutralization… |
CVE-2023-29204 | Medium | 4.7 | 2023-04-15 | XWiki Commons are technical libraries common to several other top level XWiki projects. It is possible to bypass the existing security measures put in place to… |
CVE-2023-29203 | Low | 3.7 | 2023-04-15 | XWiki Commons are technical libraries common to several other top level XWiki projects. It's possible to list some users who are normally not viewable from sub… |
CVE-2023-29202 | Critical | 9.0 | 2023-04-15 | XWiki Commons are technical libraries common to several other top level XWiki projects. The RSS macro that is bundled in XWiki included the content of the feed… |
CVE-2023-29201 | Critical | 9.0 | 2023-04-15 | XWiki Commons are technical libraries common to several other top level XWiki projects. The "restricted" mode of the HTML cleaner in XWiki, introduced in versi… |
CVE-2023-2107 | Medium | 6.3 | 2023-04-15 | A vulnerability, which was classified as critical, was found in IBOS 4.5.5. Affected is an unknown function of the file file/personal/del&op=recycle. The manip… |
CVE-2023-2106 | Critical | 9.8 | 2023-04-15 | Weak Password Requirements in GitHub repository janeczku/calibre-web prior to 0.6.20. |
CVE-2023-2105 | High | 8.8 | 2023-04-15 | Session Fixation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. |
CVE-2023-2104 | Medium | 5.4 | 2023-04-15 | Improper Access Control in GitHub repository alextselegidis/easyappointments prior to 1.5.0. |
CVE-2023-2103 | Medium | 5.4 | 2023-04-15 | Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0. |
CVE-2023-2102 | Medium | 4.8 | 2023-04-15 | Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0. |
CVE-2023-2101 | Medium | 4.3 | 2023-04-15 | A vulnerability, which was classified as problematic, has been found in moxi624 Mogu Blog v2 up to 5.2. This issue affects the function uploadPictureByUrl of t… |
CVE-2023-2100 | Low | 3.5 | 2023-04-15 | A vulnerability classified as problematic was found in SourceCodester Vehicle Service Management System 1.0. This vulnerability affects unknown code of the fil… |
CVE-2023-2099 | Low | 3.5 | 2023-04-15 | A vulnerability classified as problematic has been found in SourceCodester Vehicle Service Management System 1.0. This affects an unknown part of the file /cla… |
CVE-2023-2098 | Low | 3.5 | 2023-04-15 | A vulnerability was found in SourceCodester Vehicle Service Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown fun… |
CVE-2023-2097 | Medium | 6.3 | 2023-04-15 | A vulnerability was found in SourceCodester Vehicle Service Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unkno… |
CVE-2023-2096 | Medium | 6.3 | 2023-04-15 | A vulnerability was found in SourceCodester Vehicle Service Management System 1.0. It has been classified as critical. Affected is an unknown function of the f… |
CVE-2023-2095 | Medium | 6.3 | 2023-04-15 | A vulnerability was found in SourceCodester Vehicle Service Management System 1.0 and classified as critical. This issue affects some unknown processing of the… |
CVE-2023-2094 | Medium | 6.3 | 2023-04-15 | A vulnerability has been found in SourceCodester Vehicle Service Management System 1.0 and classified as critical. This vulnerability affects unknown code of t… |
CVE-2023-2093 | Medium | 6.3 | 2023-04-15 | A vulnerability, which was classified as critical, was found in SourceCodester Vehicle Service Management System 1.0. This affects an unknown part of the file… |
CVE-2023-2092 | Medium | 6.3 | 2023-04-15 | A vulnerability, which was classified as critical, has been found in SourceCodester Vehicle Service Management System 1.0. Affected by this issue is some unkno… |
CVE-2023-2091 | High | 7.8 | 2023-04-15 | A vulnerability classified as critical was found in KylinSoft youker-assistant on KylinOS. Affected by this vulnerability is the function adjust_cpufreq_scalin… |
CVE-2023-2090 | Medium | 6.3 | 2023-04-15 | A vulnerability classified as critical has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. Affected is an unknown function of t… |
CVE-2023-2089 | Medium | 6.3 | 2023-04-15 | A vulnerability was found in SourceCodester Complaint Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the f… |