2023 CVEs (page 267)
Page 267 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-20073 | Medium | 5.3 | 2023-04-05 | A vulnerability in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an unauthenticated, re… |
CVE-2023-20068 | Medium | 6.1 | 2023-04-05 | A vulnerability in the web-based management interface of Cisco Prime Infrastructure Software could allow an unauthenticated, remote attacker to conduct a refle… |
CVE-2023-20030 | Medium | 6.0 | 2023-04-05 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access sensitive… |
CVE-2023-20023 | Medium | 6.0 | 2023-04-05 | Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow an authenticated, local attacker to perform command injectio… |
CVE-2023-20022 | Medium | 6.0 | 2023-04-05 | Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow an authenticated, local attacker to perform command injectio… |
CVE-2023-1788 | Critical | 9.8 | 2023-04-05 | Insufficient Session Expiration in GitHub repository firefly-iii/firefly-iii prior to 6. |
CVE-2023-1758 | Medium | 5.4 | 2023-04-05 | Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1757 | Medium | 5.4 | 2023-04-05 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1756 | Medium | 4.7 | 2023-04-05 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1412 | High | 7.0 | 2023-04-05 | An unprivileged (non-admin) user can exploit an Improper Access Control vulnerability in the Cloudflare WARP Client for Windows (<= 2022.12.582.0) to perform p… |
CVE-2023-28632 | High | 8.1 | 2023-04-05 | GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, an authenticated user can modify ema… |
CVE-2023-20021 | Medium | 6.0 | 2023-04-05 | Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow an authenticated, local attacker to perform command injectio… |
CVE-2023-26857 | High | 7.2 | 2023-04-05 | An arbitrary file upload vulnerability in /admin/ajax.php?action=save_uploads of Dynamic Transaction Queuing System v1.0 allows attackers to execute arbitrary… |
CVE-2023-26856 | High | 7.2 | 2023-04-05 | Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/ajax.php?action=login. |
CVE-2023-25330 | Critical | 9.8 | 2023-04-05 | A SQL injection vulnerability in Mybatis plus below 3.5.3.1 allows remote attackers to execute arbitrary SQL commands via the tenant ID valuer. NOTE: the vendo… |
CVE-2023-1871 | Medium | 5.4 | 2023-04-05 | The YourChannel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.4. This is due to missing or incorrect n… |
CVE-2023-1870 | Medium | 4.3 | 2023-04-05 | The YourChannel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.4. This is due to missing or incorrect n… |
CVE-2023-1869 | Medium | 5.5 | 2023-04-05 | The YourChannel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.2.5 due to insufficie… |
CVE-2023-1868 | Medium | 6.5 | 2023-04-05 | The YourChannel plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check when clearing the plugin cache via the yrc_cl… |
CVE-2023-1867 | Medium | 5.4 | 2023-04-05 | The YourChannel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.4. This is due to missing or incorrect n… |
CVE-2023-1866 | Medium | 5.4 | 2023-04-05 | The YourChannel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.4. This is due to missing or incorrect n… |
CVE-2023-1865 | Medium | 6.5 | 2023-04-05 | The YourChannel plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check when resetting plugin settings via the yrc_n… |
CVE-2023-26789 | Medium | 6.1 | 2023-04-05 | Veritas NetBackUp OpsCenter Version 9.1.0.1 is vulnerable to Reflected Cross-site scripting (XSS). The Web App fails to adequately sanitize special characters… |
CVE-2023-1860 | Low | 3.5 | 2023-04-05 | A vulnerability was found in Keysight IXIA Hawkeye 3.3.16.28. It has been declared as problematic. This vulnerability affects unknown code of the file /license… |
CVE-2023-1858 | Medium | 4.3 | 2023-04-05 | A vulnerability was found in SourceCodester Earnings and Expense Tracker App 1.0. It has been classified as problematic. This affects an unknown part of the fi… |
CVE-2023-28069 | Medium | 6.1 | 2023-04-05 | Dell Streaming Data Platform prior to 1.4 contains Open Redirect vulnerability. A remote unauthenticated attacker can phish the legitimate user to redirect to… |
CVE-2023-26536 | Medium | 6.5 | 2023-04-05 | Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Jonk @ Follow me Darling Sp*tify Play Button for WordPress plugin <= 2.05 versions. |
CVE-2023-1857 | Low | 2.4 | 2023-04-05 | A vulnerability was found in SourceCodester Online Computer and Laptop Store 1.0 and classified as problematic. Affected by this issue is some unknown function… |
CVE-2023-1856 | Medium | 6.3 | 2023-04-05 | A vulnerability has been found in SourceCodester Air Cargo Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown funct… |
CVE-2023-1854 | Medium | 4.7 | 2023-04-05 | A vulnerability, which was classified as problematic, was found in SourceCodester Online Graduate Tracer System 1.0. Affected is an unknown function of the fil… |
CVE-2023-1853 | Low | 3.5 | 2023-04-05 | A vulnerability, which was classified as problematic, has been found in SourceCodester Online Payroll System 1.0. This issue affects some unknown processing of… |
CVE-2023-1852 | Low | 3.5 | 2023-04-05 | A vulnerability classified as problematic was found in SourceCodester Online Payroll System 1.0. This vulnerability affects unknown code of the file /admin/ded… |
CVE-2023-1851 | Low | 3.5 | 2023-04-05 | A vulnerability classified as problematic has been found in SourceCodester Online Payroll System 1.0. This affects an unknown part of the file /admin/employee_… |
CVE-2023-1850 | Medium | 6.3 | 2023-04-05 | A vulnerability was found in SourceCodester Online Payroll System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of t… |
CVE-2023-1849 | Medium | 6.3 | 2023-04-05 | A vulnerability was found in SourceCodester Online Payroll System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functiona… |
CVE-2023-1848 | Medium | 6.3 | 2023-04-05 | A vulnerability was found in SourceCodester Online Payroll System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/a… |
CVE-2023-1847 | Medium | 6.3 | 2023-04-05 | A vulnerability was found in SourceCodester Online Payroll System 1.0 and classified as critical. This issue affects some unknown processing of the file attend… |
CVE-2023-1846 | Medium | 6.3 | 2023-04-05 | A vulnerability has been found in SourceCodester Online Payroll System 1.0 and classified as critical. This vulnerability affects unknown code of the file /adm… |
CVE-2023-1845 | Medium | 6.3 | 2023-04-05 | A vulnerability, which was classified as critical, was found in SourceCodester Online Payroll System 1.0. This affects an unknown part of the file /admin/emplo… |
CVE-2023-0382 | Medium | 6.5 | 2023-04-05 | User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption. |
CVE-2023-29374 | Critical | 9.8 | 2023-04-05 | In LangChain through 0.0.131, the LLMMathChain chain allows prompt injection attacks that can execute arbitrary code via the Python exec method. |
CVE-2023-29323 | High | 7.8 | 2023-04-04 | ascii_load_sockaddr in smtpd in OpenBSD before 7.1 errata 024 and 7.2 before errata 020, and OpenSMTPD Portable before 7.0.0-portable commit f748277, can abort… |
CVE-2023-0835 | High | 8.2 | 2023-04-04 | markdown-pdf version 11.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate th… |
CVE-2023-0738 | Medium | 6.1 | 2023-04-04 | OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the application returns… |
CVE-2023-0486 | Medium | 6.1 | 2023-04-04 | VitalPBX version 3.2.3-8 allows an unauthenticated external attacker to obtain the instance's administrator account via a malicious link. This is possible beca… |
CVE-2023-0480 | High | 8.8 | 2023-04-04 | VitalPBX version 3.2.3-8 allows an unauthenticated external attacker to obtain the instance administrator's account. This is possible because the application i… |
CVE-2023-0357 | Medium | 6.1 | 2023-04-04 | Helpy version 2.8.0 allows an unauthenticated remote attacker to exploit an XSS stored in the application. This is possible because the application does not co… |
CVE-2023-29003 | High | 8.8 | 2023-04-04 | SvelteKit is a web development framework. The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a `+server.j… |
CVE-2023-28853 | High | 7.7 | 2023-04-04 | Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Starting in version 2.5.0… |
CVE-2023-28842 | Medium | 6.8 | 2023-04-04 | Moby) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream pr… |
CVE-2023-28841 | Medium | 6.8 | 2023-04-04 | Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream pro… |
CVE-2023-28840 | High | 7.5 | 2023-04-04 | Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream pro… |
CVE-2023-1823 | Medium | 6.5 | 2023-04-04 | Inappropriate implementation in FedCM in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to bypass navigation restrictions via a crafted HTML pa… |
CVE-2023-1822 | Medium | 6.5 | 2023-04-04 | Incorrect security UI in Navigation in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chro… |
CVE-2023-1821 | Medium | 6.5 | 2023-04-04 | Inappropriate implementation in WebShare in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to potentially hide the contents of the Omnibox (URL… |
CVE-2023-1820 | High | 8.8 | 2023-04-04 | Heap buffer overflow in Browser History in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who convinced a user to engage in specific UI interac… |
CVE-2023-1819 | Medium | 6.5 | 2023-04-04 | Out of bounds read in Accessibility in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to perform an out of bounds memory read via a crafted HTM… |
CVE-2023-1818 | High | 8.8 | 2023-04-04 | Use after free in Vulkan in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2023-1817 | Medium | 6.5 | 2023-04-04 | Insufficient policy enforcement in Intents in Google Chrome on Android prior to 112.0.5615.49 allowed a remote attacker to bypass navigation restrictions via a… |
CVE-2023-1816 | Medium | 6.5 | 2023-04-04 | Incorrect security UI in Picture In Picture in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to potentially perform navigation spoofing via a… |
CVE-2023-1815 | High | 8.8 | 2023-04-04 | Use after free in Networking APIs in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who convinced a user to engage in specific UI interaction t… |
CVE-2023-1814 | Medium | 6.5 | 2023-04-04 | Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to bypass download checking via a… |
CVE-2023-1813 | Medium | 6.5 | 2023-04-04 | Inappropriate implementation in Extensions in Google Chrome prior to 112.0.5615.49 allowed an attacker who convinced a user to install a malicious extension to… |
CVE-2023-1812 | High | 8.8 | 2023-04-04 | Out of bounds memory access in DOM Bindings in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to perform out of bounds memory access via a craf… |
CVE-2023-1811 | High | 8.8 | 2023-04-04 | Use after free in Frames in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who convinced a user to engage in specific UI interaction to potenti… |
CVE-2023-1810 | High | 8.8 | 2023-04-04 | Heap buffer overflow in Visuals in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who had compromised the renderer process to potentially explo… |
CVE-2023-0325 | Medium | 6.1 | 2023-04-04 | Uvdesk version 1.1.1 allows an unauthenticated remote attacker to exploit a stored XSS in the application. This is possible because the application does not co… |
CVE-2023-0265 | High | 8.8 | 2023-04-04 | Uvdesk version 1.1.1 allows an authenticated remote attacker to execute commands on the server. This is possible because the application does not properly vali… |
CVE-2023-27496 | Medium | 6.5 | 2023-04-04 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the OAuth… |
CVE-2023-27493 | High | 8.1 | 2023-04-04 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy does… |
CVE-2023-1840 | Medium | 4.4 | 2023-04-04 | The Sp*tify Play Button for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2… |
CVE-2023-27492 | Medium | 4.8 | 2023-04-04 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the Lua fi… |
CVE-2023-27491 | Medium | 5.4 | 2023-04-04 | Envoy is an open source edge and service proxy designed for cloud-native applications. Compliant HTTP/1 service should reject malformed request lines. Prior to… |
CVE-2023-27488 | Medium | 5.4 | 2023-04-04 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, escalation… |
CVE-2023-27091 | High | 7.2 | 2023-04-04 | An unauthorized access issue found in XiaoBingby TeaCMS 2.3.3 allows attackers to escalate privileges via the id and keywords parameter(s). |
CVE-2023-27089 | High | 8.2 | 2023-04-04 | Cross Site Scripting vulnerability found in Ehuacui BBS allows attackers to cause a denial of service via a crafted payload in the login parameter. |
CVE-2023-1752 | High | 8.1 | 2023-04-04 | The listed versions of Nexx Smart Home devices could allow any user to register an already registered alarm or associated device with only the device’s MAC add… |
CVE-2023-1751 | High | 7.5 | 2023-04-04 | The listed versions of Nexx Smart Home devices use a WebSocket server that does not validate if the bearer token in the Authorization header belongs to the dev… |
CVE-2023-1750 | High | 7.1 | 2023-04-04 | The listed versions of Nexx Smart Home devices lack proper access control when executing actions. An attacker with a valid NexxHome deviceId could retrieve dev… |
CVE-2023-1749 | Medium | 6.5 | 2023-04-04 | The listed versions of Nexx Smart Home devices lack proper access control when executing actions. An attacker with a valid NexxHome deviceId could send API req… |
CVE-2023-1748 | Critical | 9.3 | 2023-04-04 | The listed versions of Nexx Smart Home devices use hard-coded credentials. An attacker with unauthenticated access to the Nexx Home mobile application or the a… |
CVE-2023-28613 | Medium | 6.8 | 2023-04-04 | An issue was discovered in Samsung Exynos Mobile Processor and Baseband Modem Processor for Exynos 1280, Exynos 2200, and Exynos Modem 5300. An integer overflo… |
CVE-2023-27487 | High | 8.2 | 2023-04-04 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the client… |
CVE-2023-26974 | Medium | 5.5 | 2023-04-04 | Irfanview v4.62 allows a user-mode write access violation via a crafted JPEG 2000 file starting at JPEG2000+0x0000000000001bf0. |
CVE-2023-27771 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co.,Ltd Creative Centerr v.1.0.8 allows a remote attacker to execute arbitrary commands via the wondershareCC_setup_fu… |
CVE-2023-27770 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co.,Ltd Edraw-max v.12.0.4 allows a remote attacker to execute arbitrary commands via the edraw-max_setup_full5371.exe… |
CVE-2023-27769 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co.,Ltd PDF Reader v.1.0.1 allows a remote attacker to execute arbitrary commands via the pdfreader_setup_full13143.ex… |
CVE-2023-27768 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co.,Ltd PDFelement v9.1.1 allows a remote attacker to execute arbitrary commands via the pdfelement-pro_setup_full5239… |
CVE-2023-27767 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co.,Ltd Dr.Fone v.12.4.9 allows a remote attacker to execute arbitrary commands via the drfone_setup_full3360.exe file. |
CVE-2023-27766 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co.,Ltd Anireel 1.5.4 allows a remote attacker to execute arbitrary commands via the anireel_setup_full9589.exe file. |
CVE-2023-27765 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co.,Ltd Recoverit v.10.6.3 allows a remote attacker to execute arbitrary commands via the recoverit_setup_full4134.exe… |
CVE-2023-27764 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co.,Ltd Repairit v.3.5.4 allows a remote attacker to execute arbitrary commands via the repairit_setup_full5913.exe fi… |
CVE-2023-27763 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co.,Ltd MobileTrans v.4.0.2 allows a remote attacker to execute arbitrary commands via the mobiletrans_setup_full5793… |
CVE-2023-27762 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co., Ltd DemoCreator v.6.0.0 allows a remote attacker to execute arbitrary commands via the democreator_setup_full7743… |
CVE-2023-27761 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co., Ltd UniConverter v.14.0.0 allows a remote attacker to execute arbitrary commands via the uniconverter14_64bit_set… |
CVE-2023-27760 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co, Ltd Filmora v.12.0.9 allows a remote attacker to execute arbitrary commands via the filmora_setup_full846.exe. |
CVE-2023-27759 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co, Ltd Edrawmind v.10.0.6 allows a remote attacker to executea arbitrary commands via the WindowsCodescs.dll file. |
CVE-2023-27734 | Medium | 5.5 | 2023-04-04 | An issue found in Eteran edb-debugger v.1.3.0 allows a local attacker to causea denial of service via the collect_symbols function in plugins/BinaryInfo/symbol… |
CVE-2023-26991 | High | 7.8 | 2023-04-04 | SWFTools v0.9.2 was discovered to contain a stack-use-after-scope in the swf_ReadSWF2 function in lib/rfxswf.c. |
CVE-2023-26921 | Critical | 9.8 | 2023-04-04 | OS Command Injection vulnerability in quectel AG550QCN allows attackers to execute arbitrary commands via ql_atfwd. |