2023 CVEs (page 266)
Page 266 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-23998 | Medium | 5.9 | 2023-04-06 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in E4J s.R.L. VikRentCar Car Rental Management System plugin <= 1.3.0 versions. |
CVE-2023-23996 | Medium | 5.9 | 2023-04-06 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team ProfilePress plugin <= 4.5.3 versions. |
CVE-2023-23980 | Medium | 5.9 | 2023-04-06 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in MailOptin Popup Builder Team MailOptin plugin <= 1.2.54.0 versions. |
CVE-2023-28046 | Medium | 6.6 | 2023-04-06 | Dell Display Manager, versions 2.1.0 and prior, contains an arbitrary file or folder deletion vulnerability during uninstallation A local low privilege attack… |
CVE-2023-25542 | High | 7.0 | 2023-04-06 | Dell Trusted Device Agent, versions prior to 5.3.0, contain(s) an improper installation permissions vulnerability. An unauthenticated local attacker could pot… |
CVE-2023-23987 | Medium | 5.9 | 2023-04-06 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPEverest User Registration plugin <= 2.3.0 versions. |
CVE-2023-23979 | High | 7.1 | 2023-04-06 | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Event Manager plugin <= 9.7.4 versions. |
CVE-2023-23972 | Medium | 5.9 | 2023-04-06 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Smplug-in Social Like Box and Page by WpDevArt plugin <= 0.8.39 versions. |
CVE-2023-23971 | Medium | 5.9 | 2023-04-06 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CodePeople WP Time Slots Booking Form plugin <= 1.1.81 versions. |
CVE-2023-29421 | High | 8.8 | 2023-04-06 | An issue was discovered in libbzip3.a in bzip3 before 1.2.3. There is an out-of-bounds write in bz3_decode_block. |
CVE-2023-29420 | Medium | 6.5 | 2023-04-06 | An issue was discovered in libbzip3.a in bzip3 before 1.2.3. There is a crash caused by an invalid memmove in bz3_decode_block. |
CVE-2023-29419 | Medium | 6.5 | 2023-04-06 | An issue was discovered in libbzip3.a in bzip3 before 1.2.3. There is a bz3_decode_block out-of-bounds read. |
CVE-2023-29418 | Medium | 6.5 | 2023-04-06 | An issue was discovered in libbzip3.a in bzip3 before 1.2.3. There is an xwrite out-of-bounds read. |
CVE-2023-29417 | Medium | 6.5 | 2023-04-06 | An issue was discovered in libbzip3.a in bzip3 1.2.2. There is a bz3_decompress out-of-bounds read in certain situations where buffers passed to bzip3 do not c… |
CVE-2023-29416 | Medium | 6.5 | 2023-04-06 | An issue was discovered in libbzip3.a in bzip3 before 1.3.0. A bz3_decode_block out-of-bounds write can occur with a crafted archive because bzip3 does not fol… |
CVE-2023-29415 | Medium | 6.5 | 2023-04-06 | An issue was discovered in libbzip3.a in bzip3 before 1.3.0. A denial of service (process hang) can occur with a crafted archive because bzip3 does not follow… |
CVE-2023-23982 | Medium | 5.9 | 2023-04-06 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPGear.Pro WPFrom Email plugin <= 1.8.8 versions. |
CVE-2023-23981 | Medium | 5.9 | 2023-04-06 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in QuantumCloud Conversational Forms for ChatBot plugin <= 1.1.6 versions. |
CVE-2023-23815 | Medium | 6.5 | 2023-04-06 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Alan Jackson Multi-column Tag Map plugin <= 17.0.24 versions. |
CVE-2023-1787 | Medium | 4.3 | 2023-04-05 | An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. A search timeo… |
CVE-2023-1710 | Medium | 5.3 | 2023-04-05 | A sensitive information disclosure vulnerability in GitLab affecting all versions from 15.0 prior to 15.8.5, 15.9 prior to 15.9.4 and 15.10 prior to 15.10.1 al… |
CVE-2023-1708 | Medium | 5.7 | 2023-04-05 | An issue was identified in GitLab CE/EE affecting all versions from 1.0 prior to 15.8.5, 15.9 prior to 15.9.4, and 15.10 prior to 15.10.1 where non-printable c… |
CVE-2023-1417 | Medium | 4.3 | 2023-04-05 | An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possibl… |
CVE-2023-1167 | Medium | 5.3 | 2023-04-05 | Improper authorization in Gitlab EE affecting all versions from 12.3.0 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from… |
CVE-2023-1071 | Low | 3.1 | 2023-04-05 | An issue has been discovered in GitLab affecting all versions from 15.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting fro… |
CVE-2023-0838 | Medium | 5.5 | 2023-04-05 | An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. A maintainer could mo… |
CVE-2023-0450 | Low | 3.7 | 2023-04-05 | An issue has been discovered in GitLab affecting all versions starting from 8.1 to 15.8.5, and from 15.9 to 15.9.4, and from 15.10 to 15.10.1. It was possible… |
CVE-2023-24747 | Medium | 5.4 | 2023-04-05 | Jfinal CMS v5.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /system/dict/list. |
CVE-2023-24720 | Critical | 9.8 | 2023-04-05 | An arbitrary file upload vulnerability in readium-js v0.32.0 allows attackers to execute arbitrary code via uploading a crafted EPUB file. |
CVE-2023-1855 | Medium | 6.3 | 2023-04-05 | A use-after-free flaw was found in xgene_hwmon_remove in drivers/hwmon/xgene-hwmon.c in the Hardware Monitoring Linux Kernel Driver (xgene-hwmon). This flaw co… |
CVE-2023-1782 | Critical | 9.9 | 2023-04-05 | HashiCorp Nomad and Nomad Enterprise versions 1.5.0 up to 1.5.2 allow unauthenticated users to bypass intended ACL authorizations for clusters where mTLS is no… |
CVE-2023-1733 | Medium | 5.8 | 2023-04-05 | A denial of service condition exists in the Prometheus server bundled with GitLab affecting all versions from 11.10 to 15.8.5, 15.9 to 15.9.4 and 15.10 to 15.1… |
CVE-2023-1582 | Medium | 4.7 | 2023-04-05 | A race problem was found in fs/proc/task_mmu.c in the memory management sub-component in the Linux kernel. This issue may allow a local attacker with user priv… |
CVE-2023-1098 | Medium | 5.8 | 2023-04-05 | An information disclosure vulnerability has been discovered in GitLab EE/CE affecting all versions starting from 11.5 before 15.8.5, all versions starting from… |
CVE-2023-0967 | Medium | 6.5 | 2023-04-05 | Bhima version 1.27.0 allows an attacker authenticated with normal user permissions to view sensitive data of other application users and data that should only… |
CVE-2023-0959 | Medium | 6.5 | 2023-04-05 | Bhima version 1.27.0 allows a remote attacker to update the privileges of any account registered in the application via a malicious link sent to an administrat… |
CVE-2023-0944 | Medium | 4.3 | 2023-04-05 | Bhima version 1.27.0 allows an authenticated attacker with regular user permissions to update arbitrary user session data such as username, email and password… |
CVE-2023-0842 | Medium | 5.3 | 2023-04-05 | xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly valida… |
CVE-2023-0523 | Medium | 5.4 | 2023-04-05 | An issue has been discovered in GitLab affecting all versions starting from 15.6 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. An XSS was possib… |
CVE-2023-0319 | Medium | 5.8 | 2023-04-05 | An issue has been discovered in GitLab affecting all versions starting from 13.6 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions sta… |
CVE-2023-28342 | High | 7.5 | 2023-04-05 | Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a Denial-of-Service attack via the Mobile App Authentication API. |
CVE-2023-20153 | Medium | 6.0 | 2023-04-05 | Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow an authenticated, local attacker to perform command injectio… |
CVE-2023-20151 | Medium | 6.1 | 2023-04-05 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an una… |
CVE-2023-20150 | Medium | 6.1 | 2023-04-05 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an una… |
CVE-2023-20149 | Medium | 6.1 | 2023-04-05 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an una… |
CVE-2023-20148 | Medium | 6.1 | 2023-04-05 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an una… |
CVE-2023-20147 | Medium | 6.1 | 2023-04-05 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an una… |
CVE-2023-20146 | Medium | 6.1 | 2023-04-05 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an una… |
CVE-2023-20145 | Medium | 6.1 | 2023-04-05 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an una… |
CVE-2023-20144 | Medium | 6.1 | 2023-04-05 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an una… |
CVE-2023-20143 | Medium | 6.1 | 2023-04-05 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an una… |
CVE-2023-20142 | Medium | 6.1 | 2023-04-05 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an una… |
CVE-2023-20141 | Medium | 6.1 | 2023-04-05 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an una… |
CVE-2023-20140 | Medium | 6.1 | 2023-04-05 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an una… |
CVE-2023-20139 | Medium | 6.1 | 2023-04-05 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an una… |
CVE-2023-20138 | Medium | 6.1 | 2023-04-05 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an una… |
CVE-2023-20137 | Medium | 6.1 | 2023-04-05 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an una… |
CVE-2023-20123 | Medium | 6.3 | 2023-04-05 | A vulnerability in the offline access mode of Cisco Duo Two-Factor Authentication for macOS and Duo Authentication for Windows Logon and RDP could allow an una… |
CVE-2023-20122 | Medium | 6.0 | 2023-04-05 | Multiple vulnerabilities in the restricted shell of Cisco Evolved Programmable Network Manager (EPNM), Cisco Identity Services Engine (ISE), and Cisco Prime In… |
CVE-2023-20121 | Medium | 6.0 | 2023-04-05 | Multiple vulnerabilities in the restricted shell of Cisco Evolved Programmable Network Manager (EPNM), Cisco Identity Services Engine (ISE), and Cisco Prime In… |
CVE-2023-20117 | High | 7.2 | 2023-04-05 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticate… |
CVE-2023-20103 | Medium | 4.9 | 2023-04-05 | A vulnerability in Cisco Secure Network Analytics could allow an authenticated, remote attacker to execute arbitrary code as a root user on an affected device… |
CVE-2023-20102 | High | 8.8 | 2023-04-05 | A vulnerability in the web-based management interface of Cisco Secure Network Analytics could allow an authenticated, remote attacker to execute arbitrary code… |
CVE-2023-20096 | Medium | 5.4 | 2023-04-05 | A vulnerability in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an authenticated, remote attacker to pe… |
CVE-2023-1838 | High | 7.1 | 2023-04-05 | A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c in virtio network subcomponent in the Linux kernel due to a double fget. This f… |
CVE-2023-1522 | High | 8.8 | 2023-04-05 | SQL Injection in the Hardware Inventory report of Security Center 5.11.2. |
CVE-2023-0670 | High | 7.2 | 2023-04-05 | Ulearn version a5a7ca20de859051ea0470542844980a66dfc05d allows an attacker with administrator permissions to obtain remote code execution on the server through… |
CVE-2023-29006 | High | 8.8 | 2023-04-05 | The Order GLPI plugin allows users to manage order management within GLPI. Starting with version 1.8.0 and prior to versions 2.7.7 and 2.10.1, an authenticated… |
CVE-2023-28855 | Medium | 6.5 | 2023-04-05 | Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to versions 1.13.1 and 1.20.4, lack of access control check allows an… |
CVE-2023-28852 | Medium | 4.8 | 2023-04-05 | GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to versions 9.5.13 and 10.0.7, a user with dashboard administratio… |
CVE-2023-28849 | Critical | 10.0 | 2023-04-05 | GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.7, GLPI inventory endpoint can be used to drive a… |
CVE-2023-28838 | Critical | 9.6 | 2023-04-05 | GLPI is a free asset and IT management software package. Starting in version 0.50 and prior to versions 9.5.13 and 10.0.7, a SQL Injection vulnerability allow… |
CVE-2023-28639 | Medium | 6.1 | 2023-04-05 | GLPI is a free asset and IT management software package. Starting in version 0.85 and prior to versions 9.5.13 and 10.0.7, a malicious link can be crafted by a… |
CVE-2023-28636 | Medium | 4.5 | 2023-04-05 | GLPI is a free asset and IT management software package. Starting in version 0.60 and prior to versions 9.5.13 and 10.0.7, a vulnerability allows an administra… |
CVE-2023-20152 | Medium | 6.0 | 2023-04-05 | Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow an authenticated, local attacker to perform command injectio… |
CVE-2023-20134 | Medium | 5.4 | 2023-04-05 | Multiple vulnerabilities in the web interface of Cisco Webex Meetings could allow an authenticated, remote attacker to conduct a stored cross-site scripting (X… |
CVE-2023-20132 | Medium | 5.4 | 2023-04-05 | Multiple vulnerabilities in the web interface of Cisco Webex Meetings could allow an authenticated, remote attacker to conduct a stored cross-site scripting (X… |
CVE-2023-20131 | Medium | 6.5 | 2023-04-05 | Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow… |
CVE-2023-20130 | Medium | 6.5 | 2023-04-05 | Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow… |
CVE-2023-20129 | Medium | 6.5 | 2023-04-05 | Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow… |
CVE-2023-20128 | High | 7.2 | 2023-04-05 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticate… |
CVE-2023-20127 | Medium | 6.5 | 2023-04-05 | Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow… |
CVE-2023-20124 | Medium | 6.5 | 2023-04-05 | A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticate… |
CVE-2023-28634 | High | 8.8 | 2023-04-05 | GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, a user who has the Technician profil… |
CVE-2023-20051 | Medium | 5.8 | 2023-04-05 | A vulnerability in the Vector Packet Processor (VPP) of Cisco Packet Data Network Gateway (PGW) could allow an unauthenticated, remote attacker to stop ICMP tr… |
CVE-2023-1887 | Medium | 4.3 | 2023-04-05 | Business Logic Errors in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1886 | High | 7.3 | 2023-04-05 | Authentication Bypass by Capture-replay in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1885 | Medium | 6.3 | 2023-04-05 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1884 | Medium | 6.1 | 2023-04-05 | Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1883 | Medium | 5.4 | 2023-04-05 | Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1882 | Medium | 5.4 | 2023-04-05 | Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1881 | Medium | 5.4 | 2023-04-05 | Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3. |
CVE-2023-1880 | Medium | 6.1 | 2023-04-05 | Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1879 | Medium | 5.4 | 2023-04-05 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1878 | Medium | 5.4 | 2023-04-05 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1877 | Critical | 9.8 | 2023-04-05 | Command Injection in GitHub repository microweber/microweber prior to 1.3.3. |
CVE-2023-29389 | Medium | 6.8 | 2023-04-05 | Toyota RAV4 2021 vehicles automatically trust messages from other ECUs on a CAN bus, which allows physically proximate attackers to drive a vehicle by accessin… |
CVE-2023-28633 | Low | 3.5 | 2023-04-05 | GLPI is a free asset and IT management software package. Starting in version 0.84 and prior to versions 9.5.13 and 10.0.7, usage of RSS feeds is subject to ser… |
CVE-2023-22660 | High | 7.0 | 2023-04-05 | A heap-based buffer overflow vulnerability exists in the way Ichitaro version 2022 1.0.1.57600 processes certain LayoutBox stream record types. A specially cra… |
CVE-2023-22291 | High | 7.0 | 2023-04-05 | An invalid free vulnerability exists in the Frame stream parser functionality of Ichitaro 2022 1.0.1.57600. A specially crafted document can lead to an attempt… |