2023 CVEs (page 270)
Page 270 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-24472 | High | 7.5 | 2023-03-30 | A denial of service vulnerability exists in the FitsOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.7.1. A specially crafted ImageOutput… |
CVE-2023-22845 | High | 7.5 | 2023-03-30 | An out-of-bounds read vulnerability exists in the TGAInput::decode_pixel() functionality of OpenImageIO Project OpenImageIO v2.4.7.1. A specially crafted targa… |
CVE-2023-25076 | Critical | 9.8 | 2023-03-30 | A buffer overflow vulnerability exists in the handling of wildcard backend hosts of SNIProxy 0.6.0-2 and the master branch (commit: 822bb80df9b7b345cc9eba55df7… |
CVE-2023-1725 | Critical | 9.8 | 2023-03-30 | Server-Side Request Forgery (SSRF) vulnerability in Infoline Project Management System allows Server Side Request Forgery. This issue affects Project Manageme… |
CVE-2023-28733 | High | 7.2 | 2023-03-30 | AnyMailing Joomla Plugin is vulnerable to stored cross site scripting (XSS) in templates and emails of AcyMailing, exploitable without authentication when acce… |
CVE-2023-28732 | Medium | 6.5 | 2023-03-30 | Missing access control in AnyMailing Joomla Plugin allows to list and access files containing sensitive information from the plugin itself and access to system… |
CVE-2023-28731 | Critical | 9.8 | 2023-03-30 | AnyMailing Joomla Plugin is vulnerable to unauthenticated remote code execution, when being granted access to the campaign's creation on front-office due to un… |
CVE-2023-25040 | Medium | 6.5 | 2023-03-30 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Vova Anokhin WordPress Shortcodes Plugin — Shortcodes Ultimate plugin <= 5.12.6 version… |
CVE-2023-24399 | Medium | 5.5 | 2023-03-30 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in OceanWP Ocean Extra plugin <= 2.1.2 versions. |
CVE-2023-23681 | Medium | 6.5 | 2023-03-30 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Labib Ahmed Image Hover Effects For WPBakery Page Builder plugin <= 4.0 versions. |
CVE-2023-23677 | Low | 3.8 | 2023-03-30 | Reflected Cross-Site Scripting (XSS) vulnerability in GTmetrix GTmetrix for WordPress plugin <= 0.4.5 versions. |
CVE-2023-23675 | Medium | 5.9 | 2023-03-30 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Catchsquare WP Smart Preloader plugin <= 1.15 versions. |
CVE-2023-23670 | Medium | 6.5 | 2023-03-30 | Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Team Heateor Fancy Comments WordPress plugin <= 1.2.10 versions. |
CVE-2023-28935 | High | 8.8 | 2023-03-30 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation… |
CVE-2023-1712 | Critical | 9.8 | 2023-03-30 | Use of Hard-coded, Security-relevant Constants in GitHub repository deepset-ai/haystack prior to 0.1.30. |
CVE-2023-1699 | Medium | 4.3 | 2023-03-30 | Rapid7 Nexpose versions 6.6.186 and below suffer from a forced browsing vulnerability. This vulnerability allows an attacker to manipulate URLs to forcefully… |
CVE-2023-1014 | High | 7.5 | 2023-03-30 | Improper Protection for Outbound Error Messages and Alert Signals vulnerability in Virames Vira-Investing allows Account Footprinting. This issue affects Vira… |
CVE-2023-1013 | Medium | 6.1 | 2023-03-30 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Virames Vira-Investing allows Cross-Site Scripting (XSS). This… |
CVE-2023-26118 | Medium | 5.3 | 2023-03-30 | Versions of the package angular from 1.4.9 are vulnerable to Regular Expression Denial of Service (ReDoS) via the <input type="url"> element due to the usage o… |
CVE-2023-26117 | Medium | 5.3 | 2023-03-30 | Versions of the package angular from 1.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to the usage of an inse… |
CVE-2023-26116 | Medium | 5.3 | 2023-03-30 | Versions of the package angular from 1.2.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility function due to the u… |
CVE-2023-25000 | Medium | 5.0 | 2023-03-30 | HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access… |
CVE-2023-0665 | Medium | 6.5 | 2023-03-30 | HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial… |
CVE-2023-0620 | Medium | 6.5 | 2023-03-30 | HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 are vulnerable to an SQL injection attack when configuring the Microsoft SQL (MSSQL) Databas… |
CVE-2023-28509 | High | 7.5 | 2023-03-29 | Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 use weak encryption for packet… |
CVE-2023-28508 | High | 8.8 | 2023-03-29 | Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a heap-based overf… |
CVE-2023-28507 | Critical | 9.8 | 2023-03-29 | Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a memory-exhaustio… |
CVE-2023-28506 | High | 8.8 | 2023-03-29 | Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a stack-based buff… |
CVE-2023-28505 | High | 8.8 | 2023-03-29 | Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a buffer overflow… |
CVE-2023-28504 | Critical | 9.8 | 2023-03-29 | Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a stack-based buff… |
CVE-2023-28503 | Critical | 9.8 | 2023-03-29 | Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from an authentication… |
CVE-2023-28502 | Critical | 9.8 | 2023-03-29 | Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a stack-based buff… |
CVE-2023-1652 | High | 7.1 | 2023-03-29 | A use-after-free flaw was found in nfsd4_ssc_setup_dul in fs/nfsd/nfs4proc.c in the NFS filesystem in the Linux Kernel. This issue could allow a local attacker… |
CVE-2023-0836 | High | 7.5 | 2023-03-29 | An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7… |
CVE-2023-28501 | Critical | 9.8 | 2023-03-29 | Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a heap-based buffe… |
CVE-2023-22705 | High | 7.1 | 2023-03-29 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Collne Inc. Welcart e-Commerce plugin <= 2.8.10 versions. |
CVE-2023-1656 | High | 7.5 | 2023-03-29 | Cleartext Transmission of Sensitive Information vulnerability in ForgeRock Inc. OpenIDM and Java Remote Connector Server (RCS) LDAP Connector on Windows, MacOS… |
CVE-2023-0664 | High | 7.8 | 2023-03-29 | A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent's Windows installer via… |
CVE-2023-28642 | Medium | 6.1 | 2023-03-29 | runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the c… |
CVE-2023-27489 | High | 7.6 | 2023-03-29 | Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS accepts SVG files uploaded by users which could potentially… |
CVE-2023-25809 | Medium | 5.0 | 2023-03-29 | runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes `/sys/fs/… |
CVE-2023-26984 | High | 8.1 | 2023-03-29 | An issue in the password reset function of Peppermint v0.2.4 allows attackers to access the emails and passwords of the Tickets page via a crafted request. |
CVE-2023-27167 | Medium | 6.5 | 2023-03-29 | Suprema BioStar 2 v2.8.16 was discovered to contain a SQL injection vulnerability via the values parameter at /users/absence?search_month=1. |
CVE-2023-26968 | Critical | 9.8 | 2023-03-29 | In Atrocore 1.5.25, the Create Import Feed option with glyphicon-glyphicon-paperclip function is vulnerable to Unauthenticated File upload. |
CVE-2023-26292 | Medium | 6.1 | 2023-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Cloud Security Gateway (CSG) Portal on Web Clo… |
CVE-2023-26291 | Medium | 6.1 | 2023-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Cloud Security Gateway (CSG) Portal on Web Clo… |
CVE-2023-26290 | Medium | 6.1 | 2023-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Cloud Security Gateway (CSG) Portal on Web Clo… |
CVE-2023-1550 | Medium | 5.5 | 2023-03-29 | Insertion of Sensitive Information into log file vulnerability in NGINX Agent. NGINX Agent version 2.0 before 2.23.3 inserts sensitive information into a log f… |
CVE-2023-1704 | Medium | 5.4 | 2023-03-29 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.20. |
CVE-2023-1703 | Medium | 5.4 | 2023-03-29 | Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20. |
CVE-2023-1702 | Medium | 5.4 | 2023-03-29 | Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20. |
CVE-2023-1701 | Medium | 5.4 | 2023-03-29 | Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.20. |
CVE-2023-28892 | High | 7.8 | 2023-03-29 | Malwarebytes AdwCleaner 8.4.0 runs as Administrator and performs an insecure file delete operation on C:\AdwCleaner\Logs\AdwCleaner_Debug.log in which the targ… |
CVE-2023-26982 | Medium | 5.4 | 2023-03-29 | Trudesk v1.2.6 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Tags parameter under the Create Ticket function. |
CVE-2023-1680 | Medium | 4.3 | 2023-03-29 | A vulnerability, which was classified as problematic, has been found in Xunrui CMS 4.61. This issue affects some unknown processing of the file /dayrui/My/View… |
CVE-2023-1575 | Medium | 5.5 | 2023-03-29 | The Mega Main Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versions up to, and including, 2.2… |
CVE-2023-1663 | Medium | 6.5 | 2023-03-29 | Coverity versions prior to 2023.3.2 are vulnerable to forced browsing, which exposes authenticated resources to unauthorized actors. The root cause of this vul… |
CVE-2023-28158 | Medium | 6.5 | 2023-03-29 | Privilege escalation via stored XSS using the file upload service to upload malicious content. The issue can be exploited only by authenticated users which can… |
CVE-2023-23861 | Medium | 5.4 | 2023-03-29 | Cross-Site Request Forgery (CSRF) vulnerability in German Mesky GMAce plugin <= 1.5.2 versions. |
CVE-2023-1690 | Low | 3.5 | 2023-03-29 | A vulnerability, which was classified as problematic, has been found in SourceCodester Earnings and Expense Tracker App 1.0. This issue affects some unknown pr… |
CVE-2023-1509 | High | 8.8 | 2023-03-29 | The GMAce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.2. This is due to missing nonce validation on… |
CVE-2023-0213 | High | 8.8 | 2023-03-29 | Elevation of privilege issue in M-Files Installer versions before 22.6 on Windows allows user to gain SYSTEM privileges via DLL hijacking. |
CVE-2023-1689 | Low | 3.5 | 2023-03-29 | A vulnerability classified as problematic was found in SourceCodester Earnings and Expense Tracker App 1.0. This vulnerability affects unknown code of the file… |
CVE-2023-1688 | Low | 3.5 | 2023-03-29 | A vulnerability classified as problematic has been found in SourceCodester Earnings and Expense Tracker App 1.0. This affects an unknown part of the file Maste… |
CVE-2023-1687 | Low | 3.5 | 2023-03-29 | A vulnerability classified as problematic has been found in SourceCodester Simple Task Allocation System 1.0. Affected is an unknown function of the file Login… |
CVE-2023-1686 | Low | 3.5 | 2023-03-29 | A vulnerability was found in SourceCodester Young Entrepreneur E-Negosyo System 1.0. It has been rated as problematic. This issue affects some unknown processi… |
CVE-2023-1685 | Medium | 6.3 | 2023-03-29 | A vulnerability was found in HadSky up to 7.11.8. It has been declared as critical. This vulnerability affects unknown code of the file /install/index.php of t… |
CVE-2023-23355 | Medium | 6.6 | 2023-03-29 | An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote authenticated… |
CVE-2023-1684 | Medium | 4.7 | 2023-03-29 | A vulnerability was found in HadSky 7.7.16. It has been classified as problematic. This affects an unknown part of the file upload/index.php?c=app&a=superadmin… |
CVE-2023-1683 | Medium | 4.3 | 2023-03-29 | A vulnerability was found in Xunrui CMS 4.61 and classified as problematic. Affected by this issue is some unknown functionality of the file /dayrui/Fcms/View/… |
CVE-2023-1682 | Medium | 4.3 | 2023-03-29 | A vulnerability has been found in Xunrui CMS 4.61 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /dayrui… |
CVE-2023-27232 | Critical | 9.8 | 2023-03-28 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wanStrategy parameter at /setting/setWanIeCfg. |
CVE-2023-1681 | Medium | 4.3 | 2023-03-28 | A vulnerability, which was classified as problematic, was found in Xunrui CMS 4.61. Affected is an unknown function of the file /config/myfield/test.php. The m… |
CVE-2023-27231 | Critical | 9.8 | 2023-03-28 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the downBw parameter at /setting/setWanIeCfg. |
CVE-2023-27229 | Critical | 9.8 | 2023-03-28 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the upBw parameter at /setting/setWanIeCfg. |
CVE-2023-1679 | Medium | 5.3 | 2023-03-28 | A vulnerability classified as critical was found in DriverGenius 9.70.0.346. This vulnerability affects the function 0x9C406104/0x9C40A108 in the library mydri… |
CVE-2023-1678 | Medium | 5.3 | 2023-03-28 | A vulnerability classified as critical has been found in DriverGenius 9.70.0.346. This affects the function 0x9C40A0D8/0x9C40A0DC/0x9C40A0E0 in the library myd… |
CVE-2023-1677 | Medium | 5.5 | 2023-03-28 | A vulnerability was found in DriverGenius 9.70.0.346. It has been rated as problematic. Affected by this issue is the function 0x9c40a0c8/0x9c40a0dc/0x9c40a0e0… |
CVE-2023-28718 | High | 7.1 | 2023-03-28 | Osprey Pump Controller version 1.01 allows users to perform certain actions via HTTP requests without performing any checks to verify the requests. This may al… |
CVE-2023-28712 | High | 8.2 | 2023-03-28 | Osprey Pump Controller version 1.01 contains an unauthenticated command injection vulnerability that could allow system access with www-data permissions. |
CVE-2023-28654 | Critical | 9.8 | 2023-03-28 | Osprey Pump Controller version 1.01 has a hidden administrative account that has the hardcoded password that allows full access to the web management interface… |
CVE-2023-28648 | High | 7.5 | 2023-03-28 | Osprey Pump Controller version 1.01 inputs passed to a GET parameter are not properly sanitized before being returned to the user. This can be exploited to exe… |
CVE-2023-28637 | High | 8.0 | 2023-03-28 | DataEase is an open source data visualization analysis tool. In Dataease users are normally allowed to modify data and the data sources are expected to properl… |
CVE-2023-28631 | Medium | 5.3 | 2023-03-28 | comrak is a CommonMark + GFM compatible Markdown parser and renderer written in rust. A Comrak AST can be constructed manually by a program instead of parsing… |
CVE-2023-28626 | Medium | 5.3 | 2023-03-28 | comrak is a CommonMark + GFM compatible Markdown parser and renderer written in rust. A range of quadratic parsing issues are present in Comrak. These can be u… |
CVE-2023-28447 | High | 7.1 | 2023-03-28 | Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vulnerability to execu… |
CVE-2023-28427 | High | 8.2 | 2023-03-28 | matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can t… |
CVE-2023-28398 | Critical | 9.8 | 2023-03-28 | Osprey Pump Controller version 1.01 could allow an unauthenticated user to create an account and bypass authentication, thereby gaining unauthorized access to… |
CVE-2023-28375 | High | 7.5 | 2023-03-28 | Osprey Pump Controller version 1.01 is vulnerable to an unauthenticated file disclosure. Using a GET parameter, attackers can disclose arbitrary files on the a… |
CVE-2023-28103 | High | 8.2 | 2023-03-28 | matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. In certain configurations, data sent by remote servers containing special strings in key l… |
CVE-2023-27886 | Critical | 9.8 | 2023-03-28 | Osprey Pump Controller version 1.01 is vulnerable to an unauthenticated OS command injection vulnerability. This can be exploited to inject and execute arbitra… |
CVE-2023-27394 | Critical | 9.8 | 2023-03-28 | Osprey Pump Controller version 1.01 is vulnerable an unauthenticated OS command injection vulnerability. This can be exploited to inject and execute arbitrary… |
CVE-2023-24308 | High | 7.8 | 2023-03-28 | A potential memory vulnerability due to insufficient input validation in PDFXEditCore.x64.dll in PDF-XChange Editor version 9.3 by Tracker Software may allow a… |
CVE-2023-24304 | High | 7.8 | 2023-03-28 | Improper input validation in the PDF.dll plugin of IrfanView v4.60 allows attackers to execute arbitrary code via opening a crafted PDF file. |
CVE-2023-20903 | Medium | 4.3 | 2023-03-28 | This disclosure regards a vulnerability related to UAA refresh tokens and external identity providers.Assuming that an external identity provider is linked to… |
CVE-2023-1676 | High | 7.8 | 2023-03-28 | A vulnerability was found in DriverGenius 9.70.0.346. It has been declared as critical. Affected by this vulnerability is the function 0x9C402088 in the librar… |
CVE-2023-1675 | Medium | 6.3 | 2023-03-28 | A vulnerability was found in SourceCodester School Registration and Fee System 1.0. It has been classified as critical. Affected is an unknown function of the… |
CVE-2023-1674 | High | 7.3 | 2023-03-28 | A vulnerability was found in SourceCodester School Registration and Fee System 1.0 and classified as critical. This issue affects some unknown processing of th… |
CVE-2023-1518 | High | 7.8 | 2023-03-28 | CP Plus KVMS Pro versions 2.01.0.T.190521 and prior are vulnerable to sensitive credentials being leaked because they are insufficiently protected. |
CVE-2023-1516 | High | 7.9 | 2023-03-28 | RoboDK versions 5.5.3 and prior contain an insecure permission assignment to critical directories vulnerability, which could allow a local user to escalate p… |