2023 CVEs (page 268)
Page 268 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-26777 | Medium | 6.1 | 2023-04-04 | Cross Site Scripting vulnerability found in : louislam Uptime Kuma v.1.19.6 and before allows a remote attacker to execute arbitrary commands via the descripti… |
CVE-2023-26776 | Medium | 6.1 | 2023-04-04 | Cross Site Scripting vulnerability found in Monitorr v.1.7.6 allows a remote attacker to execute arbitrary code via the title parameter of the post_receiver-se… |
CVE-2023-26775 | High | 7.8 | 2023-04-04 | File Upload vulnerability found in Monitorr v.1.7.6 allows a remote attacker t oexecute arbitrary code via a crafted file upload to the assets/php/upload.php e… |
CVE-2023-26750 | Critical | 9.8 | 2023-04-04 | SQL injection vulnerability found in Yii Framework Yii 2 Framework before v.2.0.47 allows the a remote attacker to execute arbitrary code via the runAction fun… |
CVE-2023-26733 | High | 7.8 | 2023-04-04 | Buffer Overflow vulnerability found in tinyTIFF v.3.0 allows a local attacker to cause a denial of service via the TinyTiffReader_readNextFrame function in tin… |
CVE-2023-26437 | Low | 3.4 | 2023-04-04 | Denial of service vulnerability in PowerDNS Recursor allows authoritative servers to be marked unavailable.This issue affects Recursor: through 4.6.5, through… |
CVE-2023-29000 | Medium | 5.4 | 2023-04-04 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.7.0, by trusting that the… |
CVE-2023-28999 | Medium | 6.9 | 2023-04-04 | Nextcloud is an open-source productivity platform. In Nextcloud Desktop client 3.0.0 until 3.8.0, Nextcloud Android app 3.13.0 until 3.25.0, and Nextcloud iOS… |
CVE-2023-28998 | Medium | 6.7 | 2023-04-04 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.6.5, a malicious server a… |
CVE-2023-28997 | Medium | 6.7 | 2023-04-04 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.6.5, a malicious server a… |
CVE-2023-28848 | Medium | 4.8 | 2023-04-04 | user_oidc is the OIDC connect user backend for Nextcloud, an open source collaboration platform. A vulnerability in versions 1.0.0 until 1.3.0 effectively allo… |
CVE-2023-26866 | Critical | 9.8 | 2023-04-04 | GreenPacket OH736's WR-1200 Indoor Unit, OT-235 with firmware versions M-IDU-1.6.0.3_V1.1 and MH-46360-2.0.3-R5-GP respectively are vulnerable to remote comman… |
CVE-2023-25356 | High | 8.8 | 2023-04-04 | CoreDial sipXcom up to and including 21.04 is vulnerable to Improper Neutralization of Argument Delimiters in a Command. XMPP users are able to inject arbitrar… |
CVE-2023-25355 | High | 8.8 | 2023-04-04 | CoreDial sipXcom up to and including 21.04 is vulnerable to Insecure Permissions. A user who has the ability to run commands as the `daemon` user on a sipXcom… |
CVE-2023-25305 | High | 7.1 | 2023-04-04 | PolyMC Launcher <= 1.4.3 is vulnerable to Directory Traversal. A mrpack file can be maliciously crafted to create arbitrary files outside of the installation d… |
CVE-2023-25303 | High | 7.1 | 2023-04-04 | ATLauncher <= 3.4.26.0 is vulnerable to Directory Traversal. A mrpack file can be maliciously crafted to create arbitrary files outside of the installation dir… |
CVE-2023-23977 | Medium | 6.5 | 2023-04-04 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Team Heateor WordPress Social Comments Plugin for Vkontakte Comments and Disqus Comment… |
CVE-2023-23870 | Medium | 5.9 | 2023-04-04 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in wpdevart Responsive Vertical Icon Menu plugin <= 1.5.8 versions. |
CVE-2023-23878 | Medium | 5.9 | 2023-04-04 | Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in flippercode WordPress Plugin for Google Maps – WP MAPS plugin <= 4.3.9 versions. |
CVE-2023-23821 | Medium | 5.9 | 2023-04-04 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Marcin Pietrzak Interactive Polish Map plugin <= 1.2 versions. |
CVE-2023-23686 | Medium | 6.5 | 2023-04-04 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Brett Shumaker Simple Staff List plugin <= 2.2.2 versions. |
CVE-2023-23685 | Medium | 6.5 | 2023-04-04 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in RadiusTheme Portfolio – WordPress Portfolio plugin <= 2.8.10 versions. |
CVE-2023-25942 | Medium | 6.5 | 2023-04-04 | Dell PowerScale OneFS versions 8.2.x-9.4.x contain an uncontrolled resource consumption vulnerability. A malicious network user with low privileges could pote… |
CVE-2023-25941 | High | 7.8 | 2023-04-04 | Dell PowerScale OneFS versions 8.2.x-9.5.0.x contain an elevation of privilege vulnerability. A low-privileged local attacker could potentially exploit this v… |
CVE-2023-25940 | Medium | 6.7 | 2023-04-04 | Dell PowerScale OneFS version 9.5.0.0 contains improper link resolution before file access vulnerability in isi_gather_info. A high privileged local attacker… |
CVE-2023-1827 | Medium | 6.3 | 2023-04-04 | A vulnerability has been found in SourceCodester Centralized Covid Vaccination Records System 1.0 and classified as critical. This vulnerability affects unknow… |
CVE-2023-1671 | Critical | 9.8 | 2023-04-04 | A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code. |
CVE-2023-1826 | Medium | 6.3 | 2023-04-04 | A vulnerability, which was classified as critical, was found in SourceCodester Online Computer and Laptop Store 1.0. This affects an unknown part of the file p… |
CVE-2023-1728 | Critical | 9.8 | 2023-04-04 | Unrestricted Upload of File with Dangerous Type vulnerability in Fernus Informatics LMS allows OS Command Injection, Server Side Include (SSI) Injection. This… |
CVE-2023-1768 | Low | 3.7 | 2023-04-04 | Inappropriate error handling in Tribe29 Checkmk <= 2.1.0p25, <= 2.0.0p34, <= 2.2.0b3 (beta), and all versions of Checkmk 1.6.0 causes the symmetric encryption… |
CVE-2023-26976 | High | 7.5 | 2023-04-04 | Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the ssid parameter in the form_fast_setting_wifi_set function. |
CVE-2023-26855 | High | 7.5 | 2023-04-04 | The hashing algorithm of ChurchCRM v4.5.3 utilizes a non-random salt value which allows attackers to use precomputed hash tables or dictionary attacks to crack… |
CVE-2023-1579 | High | 7.8 | 2023-04-03 | Heap based buffer overflow in binutils-gdb/bfd/libbfd.c in bfd_getl64. |
CVE-2023-0922 | Medium | 5.9 | 2023-04-03 | The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset passwords over a signed-only connection. |
CVE-2023-0614 | Medium | 6.5 | 2023-04-03 | The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attacker may be able to… |
CVE-2023-0225 | Medium | 4.3 | 2023-04-03 | A flaw was found in Samba. An incomplete access check on dnsHostName allows authenticated but otherwise unprivileged users to delete this attribute from any ob… |
CVE-2023-26916 | Medium | 5.3 | 2023-04-03 | libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lys_parse_mem at lys_parse_mem.c. |
CVE-2023-24724 | Medium | 5.4 | 2023-04-03 | A stored cross site scripting (XSS) vulnerability was discovered in the user management module of the SAS 9.4 Admin Console, due to insufficient validation and… |
CVE-2023-1611 | Medium | 6.3 | 2023-04-03 | A use-after-free flaw was found in btrfs_search_slot in fs/btrfs/ctree.c in btrfs in the Linux Kernel.This flaw allows an attacker to crash the system and poss… |
CVE-2023-29218 | High | 7.5 | 2023-04-03 | The Twitter Recommendation Algorithm through ec83d01 allows attackers to cause a denial of service (reduction of reputation score) by arranging for multiple Tw… |
CVE-2023-28854 | High | 8.0 | 2023-04-03 | nophp is a PHP web framework. Prior to version 0.0.1, nophp is vulnerable to shell command injection on httpd user. A patch was made available at commit e5409a… |
CVE-2023-28851 | Medium | 6.1 | 2023-04-03 | Silverstripe Form Capture provides a method to capture simple silverstripe forms and an admin interface for users. Starting in version 0.2.0 and prior to versi… |
CVE-2023-28850 | Medium | 6.1 | 2023-04-03 | Pimcore Perspective Editor provides an editor for Pimcore that allows users to add/remove/edit custom views and perspectives. This vulnerability has the potent… |
CVE-2023-28837 | Medium | 4.9 | 2023-04-03 | Wagtail is an open source content management system built on Django. Prior to versions 4.1.4 and 4.2.2, a memory exhaustion bug exists in Wagtail's handling of… |
CVE-2023-28836 | Medium | 6.4 | 2023-04-03 | Wagtail is an open source content management system built on Django. Starting in version 1.5 and prior to versions 4.1.4 and 4.2.2, a stored cross-site scripti… |
CVE-2023-28834 | Low | 3.5 | 2023-04-03 | Nextcloud Server is an open source personal cloud server. Nextcloud Server 24.0.0 until 24.0.6 and 25.0.0 until 25.0.4, as well as Nextcloud Enterprise Server… |
CVE-2023-0977 | Medium | 6.7 | 2023-04-03 | A heap-based overflow vulnerability in Trellix Agent (Windows and Linux) version 5.7.8 and earlier, allows a remote user to alter the page heap in the macmnsv… |
CVE-2023-0975 | High | 8.2 | 2023-04-03 | A vulnerability exists in Trellix Agent for Windows version 5.7.8 and earlier, that allows local users, during install/upgrade workflow, to replace one of the… |
CVE-2023-1377 | Medium | 6.1 | 2023-04-03 | The Solidres WordPress plugin through 0.9.4 does not sanitise and escape numerous parameter before outputting them back in pages, leading to Reflected Cross-Si… |
CVE-2023-1330 | Medium | 6.5 | 2023-04-03 | The Redirection WordPress plugin before 1.1.4 does not add nonce verification in place when adding the redirect, which could allow attackers to add redirects v… |
CVE-2023-1124 | High | 7.2 | 2023-04-03 | The Shopping Cart & eCommerce Store WordPress plugin before 5.4.3 does not validate HTTP requests, allowing authenticated users with admin privileges to perfor… |
CVE-2023-0820 | High | 8.8 | 2023-04-03 | The User Role by BestWebSoft WordPress plugin before 1.6.7 does not protect against CSRF in requests to update role capabilities, leading to arbitrary privileg… |
CVE-2023-0399 | Medium | 5.4 | 2023-04-03 | The Image Over Image For WPBakery Page Builder WordPress plugin before 3.0 does not validate and escape some of its shortcode attributes before outputting them… |
CVE-2023-28625 | High | 7.5 | 2023-04-03 | mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. I… |
CVE-2023-1766 | Medium | 6.1 | 2023-04-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Akbim Computer Panon allows Reflected XSS. This issue af… |
CVE-2023-1765 | Critical | 9.8 | 2023-04-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Akbim Computer Panon allows SQL Injection. This issue af… |
CVE-2023-26529 | Medium | 5.9 | 2023-04-03 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in DupeOff.Com DupeOff plugin <= 1.6 versions. |
CVE-2023-26269 | High | 7.8 | 2023-04-03 | Apache James server version 3.7.3 and earlier provides a JMX management service without authentication by default. This allows privilege escalation by a malic… |
CVE-2023-26119 | Critical | 9.8 | 2023-04-03 | Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the att… |
CVE-2023-26112 | Low | 3.7 | 2023-04-03 | All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\((.*)\). **Note:**… |
CVE-2023-28684 | Medium | 6.5 | 2023-04-02 | Jenkins remote-jobs-view-plugin Plugin 0.0.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-28683 | High | 8.2 | 2023-04-02 | Jenkins Phabricator Differential Plugin 2.1.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-28682 | High | 8.2 | 2023-04-02 | Jenkins Performance Publisher Plugin 8.09 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-28681 | High | 8.2 | 2023-04-02 | Jenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-28680 | High | 7.5 | 2023-04-02 | Jenkins Crap4J Plugin 0.9 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-28679 | Medium | 5.4 | 2023-04-02 | Jenkins Mashup Portlets Plugin 1.1.2 and earlier provides the "Generic JS Portlet" feature that lets a user populate a portlet using a custom JavaScript expres… |
CVE-2023-28678 | Medium | 5.4 | 2023-04-02 | Jenkins Cppcheck Plugin 1.26 and earlier does not escape file names from Cppcheck report files before showing them on the Jenkins UI, resulting in a stored cro… |
CVE-2023-28677 | Critical | 9.8 | 2023-04-02 | Jenkins Convert To Pipeline Plugin 1.0 and earlier uses basic string concatenation to convert Freestyle projects' Build Environment, Build Steps, and Post-buil… |
CVE-2023-28676 | High | 8.8 | 2023-04-02 | A cross-site request forgery (CSRF) vulnerability in Jenkins Convert To Pipeline Plugin 1.0 and earlier allows attackers to create a Pipeline based on a Freest… |
CVE-2023-28675 | Medium | 4.3 | 2023-04-02 | A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously configured Octoperf ser… |
CVE-2023-28674 | High | 8.8 | 2023-04-02 | A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously… |
CVE-2023-28673 | Medium | 4.3 | 2023-04-02 | A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers with Overall/Read permission to enumerate credenti… |
CVE-2023-28672 | Medium | 6.5 | 2023-04-02 | Jenkins OctoPerf Load Testing Plugin Plugin 4.5.1 and earlier does not perform a permission check in a connection test HTTP endpoint, allowing attackers with O… |
CVE-2023-28671 | Medium | 4.3 | 2023-04-02 | A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.0 and earlier allows attackers to connect to an attacker-s… |
CVE-2023-28670 | Medium | 5.4 | 2023-04-02 | Jenkins Pipeline Aggregator View Plugin 1.13 and earlier does not escape a variable representing the current view's URL in inline JavaScript, resulting in a st… |
CVE-2023-28669 | Medium | 5.4 | 2023-04-02 | Jenkins JaCoCo Plugin 3.3.2 and earlier does not escape class and method names shown on the UI, resulting in a stored cross-site scripting (XSS) vulnerability… |
CVE-2023-28668 | Critical | 9.8 | 2023-04-02 | Jenkins Role-based Authorization Strategy Plugin 587.v2872c41fa_e51 and earlier grants permissions even after they've been disabled. |
CVE-2023-27286 | High | 8.4 | 2023-04-02 | IBM Aspera Cargo 4.2.5 and IBM Aspera Connect 4.2.5 are vulnerable to a buffer overflow, caused by improper bounds checking. An attacker could overflow a buffe… |
CVE-2023-27284 | High | 8.4 | 2023-04-02 | IBM Aspera Cargo 4.2.5 and IBM Aspera Connect 4.2.5 are vulnerable to a buffer overflow, caused by improper bounds checking. An attacker could overflow a buffe… |
CVE-2023-26283 | Medium | 5.4 | 2023-04-02 | IBM WebSphere Application Server 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI th… |
CVE-2023-20559 | High | 8.8 | 2023-04-02 | Insufficient control flow management in AmdCpmGpioInitSmm may allow a privileged attacker to tamper with the SMM handler potentially leading to escalation o… |
CVE-2023-20558 | High | 8.8 | 2023-04-02 | Insufficient control flow management in AmdCpmOemSmm may allow a privileged attacker to tamper with the SMM handler potentially leading to an escalation of pr… |
CVE-2023-1603 | Medium | 6.5 | 2023-04-02 | Permission bypass when importing or synchronizing entries in User vault in Devolutions Server 2022.3.13 and prior versions allows users with restricted righ… |
CVE-2023-1580 | High | 7.5 | 2023-04-02 | Uncontrolled resource consumption in the logging feature in Devolutions Gateway 2023.1.1 and earlier allows an attacker to cause a denial of service by filling… |
CVE-2023-1574 | Medium | 6.5 | 2023-04-02 | Information disclosure in the user creation feature of a MSSQL data source in Devolutions Remote Desktop Manager 2023.1.9 and below on Windows allows an attack… |
CVE-2023-1202 | Medium | 6.5 | 2023-04-02 | Permission bypass when importing or synchronizing entries in User vault in Devolutions Remote Desktop Manager 2023.1.9 and prior versions allows users with r… |
CVE-2023-1800 | High | 7.3 | 2023-04-02 | A vulnerability, which was classified as critical, has been found in sjqzhang go-fastdfs up to 1.4.3. Affected by this issue is the function upload of the file… |
CVE-2023-1799 | Low | 3.5 | 2023-04-02 | A vulnerability, which was classified as problematic, was found in EyouCMS up to 1.5.4. This affects an unknown part of the file login.php. The manipulation of… |
CVE-2023-1798 | Low | 3.5 | 2023-04-02 | A vulnerability, which was classified as problematic, has been found in EyouCMS up to 1.5.4. Affected by this issue is some unknown functionality of the file l… |
CVE-2023-1797 | Medium | 6.3 | 2023-04-02 | A vulnerability classified as critical was found in OTCMS 6.0.1. Affected by this vulnerability is an unknown functionality of the file sysCheckFile.php?mudi=s… |
CVE-2023-1796 | Low | 2.4 | 2023-04-02 | A vulnerability classified as problematic has been found in SourceCodester Employee Payslip Generator 1.0. Affected is an unknown function of the file /classes… |
CVE-2023-1795 | Low | 3.5 | 2023-04-02 | A vulnerability was found in SourceCodester Gadget Works Online Ordering System 1.0. It has been rated as problematic. This issue affects some unknown processi… |
CVE-2023-1794 | Low | 3.5 | 2023-04-02 | A vulnerability was found in SourceCodester Police Crime Record Management System 1.0. It has been declared as problematic. This vulnerability affects unknown… |
CVE-2023-1793 | Medium | 6.3 | 2023-04-02 | A vulnerability was found in SourceCodester Police Crime Record Management System 1.0. It has been classified as critical. This affects an unknown part of the… |
CVE-2023-1792 | Medium | 6.3 | 2023-04-02 | A vulnerability was found in SourceCodester Simple Mobile Comparison Website 1.0 and classified as critical. Affected by this issue is some unknown functionali… |
CVE-2023-1791 | Medium | 6.3 | 2023-04-02 | A vulnerability has been found in SourceCodester Simple Task Allocation System 1.0 and classified as critical. Affected by this vulnerability is an unknown fun… |
CVE-2023-27025 | High | 7.5 | 2023-04-02 | An arbitrary file download vulnerability in the background management module of RuoYi v4.7.6 and below allows attackers to download arbitrary files in the serv… |
CVE-2023-26822 | Critical | 9.8 | 2023-04-01 | D-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter at soapcgi.main. |
CVE-2023-1790 | Medium | 4.3 | 2023-04-01 | A vulnerability, which was classified as problematic, was found in SourceCodester Simple Task Allocation System 1.0. Affected is an unknown function of the fil… |
CVE-2023-0198 | Medium | 6.6 | 2023-04-01 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where improper restriction of operations within the bounds of a memory b… |