2023 CVEs (page 272)
Page 272 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-28596 | High | 7.8 | 2023-03-27 | Zoom Client for IT Admin macOS installers before version 5.13.5 contain a local privilege escalation vulnerability. A local low-privileged user could exploit t… |
CVE-2023-25908 | High | 7.8 | 2023-03-27 | Adobe Photoshop versions 23.5.3 (and earlier) and 24.1.1 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execu… |
CVE-2023-25878 | Medium | 5.5 | 2023-03-27 | Adobe Substance 3D Stager versions 2.0.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. A… |
CVE-2023-25877 | Medium | 5.5 | 2023-03-27 | Adobe Substance 3D Stager versions 2.0.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. A… |
CVE-2023-25876 | Medium | 5.5 | 2023-03-27 | Adobe Substance 3D Stager versions 2.0.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. A… |
CVE-2023-25875 | Medium | 5.5 | 2023-03-27 | Adobe Substance 3D Stager versions 2.0.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. A… |
CVE-2023-25874 | High | 7.8 | 2023-03-27 | Adobe Substance 3D Stager versions 2.0.0 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution… |
CVE-2023-25873 | High | 7.8 | 2023-03-27 | Adobe Substance 3D Stager versions 2.0.0 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a… |
CVE-2023-25872 | High | 7.8 | 2023-03-27 | Adobe Substance 3D Stager versions 2.0.0 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution… |
CVE-2023-25871 | High | 7.8 | 2023-03-27 | Adobe Substance 3D Stager versions 2.0.0 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the cont… |
CVE-2023-25870 | High | 7.8 | 2023-03-27 | Adobe Substance 3D Stager versions 2.0.0 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in th… |
CVE-2023-25869 | High | 7.8 | 2023-03-27 | Adobe Substance 3D Stager versions 2.0.0 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a… |
CVE-2023-25868 | High | 7.8 | 2023-03-27 | Adobe Substance 3D Stager versions 2.0.0 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution… |
CVE-2023-25867 | High | 7.8 | 2023-03-27 | Adobe Substance 3D Stager versions 2.0.0 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution… |
CVE-2023-25866 | High | 7.8 | 2023-03-27 | Adobe Substance 3D Stager versions 2.0.0 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in th… |
CVE-2023-25865 | High | 7.8 | 2023-03-27 | Adobe Substance 3D Stager versions 2.0.0 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution… |
CVE-2023-25864 | High | 7.8 | 2023-03-27 | Adobe Substance 3D Stager versions 2.0.0 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution… |
CVE-2023-25863 | High | 7.8 | 2023-03-27 | Adobe Substance 3D Stager versions 2.0.0 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a… |
CVE-2023-25817 | Low | 3.5 | 2023-03-27 | Nextcloud server is an open source, personal cloud implementation. In versions from 24.0.0 and before 24.0.9 a user could escalate their permissions to delete… |
CVE-2023-25263 | Medium | 5.5 | 2023-03-27 | In Stimulsoft Designer (Desktop) 2023.1.5, and 2023.1.4, once an attacker decompiles the Stimulsoft.report.dll the attacker is able to decrypt any connectionst… |
CVE-2023-25261 | Critical | 9.8 | 2023-03-27 | Certain Stimulsoft GmbH products are affected by: Remote Code Execution. This affects Stimulsoft Designer (Desktop) 2023.1.4 and Stimulsoft Designer (Web) 2023… |
CVE-2023-24366 | Medium | 6.5 | 2023-03-27 | An arbitrary file download vulnerability in rConfig v6.8.0 allows attackers to download sensitive files via a crafted HTTP request. |
CVE-2023-22251 | Medium | 4.3 | 2023-03-27 | Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an Incorrect Authorization vulnerability. A low-privileged authentica… |
CVE-2023-22250 | Medium | 5.3 | 2023-03-27 | Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Secur… |
CVE-2023-22249 | Medium | 4.8 | 2023-03-27 | Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abuse… |
CVE-2023-22247 | High | 7.5 | 2023-03-27 | Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an XML Injection vulnerability that could lead to arbitrary file syst… |
CVE-2023-1666 | Medium | 6.3 | 2023-03-27 | A vulnerability has been found in SourceCodester Automatic Question Paper Generator System 1.0 and classified as critical. This vulnerability affects unknown c… |
CVE-2023-1380 | High | 7.1 | 2023-03-27 | A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issu… |
CVE-2023-1079 | Medium | 6.8 | 2023-03-27 | A flaw was found in the Linux kernel. A use-after-free may be triggered in asus_kbd_backlight_set when plugging/disconnecting in a malicious USB device, which… |
CVE-2023-1078 | High | 7.8 | 2023-03-27 | A flaw was found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The rds_rm_zerocopy_callback() uses list_entry() on the head of a list causin… |
CVE-2023-1077 | High | 7.0 | 2023-03-27 | In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON condition, as the confused entry will not be NULL, but… |
CVE-2023-1076 | Medium | 5.5 | 2023-03-27 | A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initialization function. While… |
CVE-2023-1075 | Low | 3.3 | 2023-03-27 | A flaw was found in the Linux Kernel. The tls_is_tx_ready() incorrectly checks for list emptiness, potentially accessing a type confused entry to the list_head… |
CVE-2023-1074 | Medium | 5.5 | 2023-03-27 | A memory leak flaw was found in the Linux kernel's Stream Control Transmission Protocol. This issue may occur when a user starts a malicious networking service… |
CVE-2023-1073 | Medium | 6.6 | 2023-03-27 | A memory corruption flaw was found in the Linux kernel’s human interface device (HID) subsystem in how a user inserts a malicious USB device. This flaw allows… |
CVE-2023-0778 | Medium | 6.8 | 2023-03-27 | A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while… |
CVE-2023-0494 | High | 7.8 | 2023-03-27 | A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by ProcXkbSetDeviceInfo() and P… |
CVE-2023-0241 | Medium | 6.5 | 2023-03-27 | pgAdmin 4 versions prior to v6.19 contains a directory traversal vulnerability. A user of the product may change another user's settings or alter the database. |
CVE-2023-28655 | Medium | 5.4 | 2023-03-27 | A malicious user could leverage this vulnerability to escalate privileges or perform unauthorized actions in the context of the targeted privileged users. |
CVE-2023-28652 | Medium | 6.5 | 2023-03-27 | An authenticated malicious user could successfully upload a malicious image could lead to a denial-of-service condition. |
CVE-2023-28650 | Medium | 6.1 | 2023-03-27 | An unauthenticated remote attacker could provide a malicious link and trick an unsuspecting user into clicking on it. If clicked, the attacker could execute th… |
CVE-2023-27927 | Medium | 6.5 | 2023-03-27 | An authenticated malicious user could acquire the simple mail transfer protocol (SMTP) Password in cleartext format, despite it being protected and hidden behi… |
CVE-2023-25818 | Medium | 5.3 | 2023-03-27 | Nextcloud server is an open source, personal cloud implementation. In affected versions a malicious user could try to reset the password of another user and th… |
CVE-2023-25661 | Medium | 6.5 | 2023-03-27 | TensorFlow is an Open Source Machine Learning Framework. In versions prior to 2.11.1 a malicious invalid input crashes a tensorflow model (Check Failed) and ca… |
CVE-2023-22300 | Medium | 6.1 | 2023-03-27 | An unauthenticated remote attacker could force all authenticated users, such as administrative users, to perform unauthorized actions by viewing the logs. This… |
CVE-2023-27245 | Medium | 6.1 | 2023-03-27 | A cross-site scripting (XSS) vulnerability in File Management Project 1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inj… |
CVE-2023-27241 | Medium | 6.1 | 2023-03-27 | SourceCodester Water Billing System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the lastname text box under the Add Client mo… |
CVE-2023-25828 | High | 7.2 | 2023-03-27 | Pluck CMS is vulnerable to an authenticated remote code execution (RCE) vulnerability through its “albums” module. Albums are used to create collections of im… |
CVE-2023-27847 | Critical | 9.8 | 2023-03-27 | SQL injection vulnerability found in PrestaShop xipblog v.2.0.1 and before allow a remote attacker to gain privileges via the xipcategoryclass and xippostsclas… |
CVE-2023-1654 | High | 7.8 | 2023-03-27 | Denial of Service in GitHub repository gpac/gpac prior to 2.4.0. |
CVE-2023-1400 | Medium | 4.8 | 2023-03-27 | The Modern Events Calendar Lite WordPress plugin before 6.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as… |
CVE-2023-1399 | High | 7.8 | 2023-03-27 | N6854A Geolocation Server versions 2.4.2 are vulnerable to untrusted data deserialization, which may allow a malicious actor to escalate privileges in the aff… |
CVE-2023-1093 | Medium | 6.5 | 2023-03-27 | The OAuth Single Sign On WordPress plugin before 6.24.2 does not have CSRF checks when discarding Identify providers (IdP), which could allow attackers to make… |
CVE-2023-1092 | Medium | 6.5 | 2023-03-27 | The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPr… |
CVE-2023-1089 | Medium | 4.3 | 2023-03-27 | The Coupon Zen WordPress plugin before 1.0.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate ar… |
CVE-2023-1088 | Medium | 4.3 | 2023-03-27 | The WP Plugin Manager WordPress plugin before 1.1.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins acti… |
CVE-2023-1087 | Medium | 4.3 | 2023-03-27 | The WC Sales Notification WordPress plugin before 1.2.3 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins… |
CVE-2023-1086 | Medium | 4.3 | 2023-03-27 | The Preview Link Generator WordPress plugin before 1.0.4 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins… |
CVE-2023-1069 | Medium | 5.4 | 2023-03-27 | The Complianz WordPress plugin before 6.4.2, Complianz Premium WordPress plugin before 6.4.2 do not validate and escape some of its shortcode attributes before… |
CVE-2023-1025 | Medium | 4.8 | 2023-03-27 | The Simple File List WordPress plugin before 6.0.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2023-0955 | High | 8.8 | 2023-03-27 | The WP Statistics WordPress plugin before 14.0 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By default… |
CVE-2023-0823 | Medium | 5.4 | 2023-03-27 | The Cookie Notice & Compliance for GDPR / CCPA WordPress plugin before 2.4.7 does not validate and escape some of its shortcode attributes before outputting th… |
CVE-2023-0816 | Medium | 6.5 | 2023-03-27 | The Formidable Forms WordPress plugin before 6.1 uses several potentially untrusted headers to determine the IP address of the client, leading to IP Address sp… |
CVE-2023-0660 | Medium | 5.4 | 2023-03-27 | The Smart Slider 3 WordPress plugin before 3.5.1.14 does not properly validate and escape some of its shortcode attributes before outputting them back in a pag… |
CVE-2023-0589 | Medium | 5.4 | 2023-03-27 | The WP Image Carousel WordPress plugin through 1.0.2 does not sanitise and escape some parameters, which could allow users with a role as low as contributor to… |
CVE-2023-0505 | Medium | 4.3 | 2023-03-27 | The Ever Compare WordPress plugin through 1.2.3 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate… |
CVE-2023-0504 | Medium | 4.3 | 2023-03-27 | The HT Politic WordPress plugin before 2.3.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate ar… |
CVE-2023-0503 | Medium | 4.3 | 2023-03-27 | The Free WooCommerce Theme 99fy Extension WordPress plugin before 1.2.8 does not have CSRF check when activating plugins, which could allow attackers to make l… |
CVE-2023-0502 | Medium | 6.5 | 2023-03-27 | The WP News WordPress plugin through 1.1.9 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbi… |
CVE-2023-0501 | Medium | 6.5 | 2023-03-27 | The WP Insurance WordPress plugin before 2.1.4 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate… |
CVE-2023-0500 | Medium | 6.5 | 2023-03-27 | The WP Film Studio WordPress plugin before 1.3.5 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activat… |
CVE-2023-0499 | Medium | 4.3 | 2023-03-27 | The QuickSwish WordPress plugin before 1.1.0 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate ar… |
CVE-2023-0498 | Medium | 4.3 | 2023-03-27 | The WP Education WordPress plugin before 1.2.7 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate… |
CVE-2023-0497 | Medium | 4.3 | 2023-03-27 | The HT Portfolio WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate… |
CVE-2023-0496 | Medium | 4.3 | 2023-03-27 | The HT Event WordPress plugin before 1.4.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbi… |
CVE-2023-0495 | Medium | 4.3 | 2023-03-27 | The HT Slider For Elementor WordPress plugin before 1.4.0 does not have CSRF check when activating plugins, which could allow attackers to make logged in admin… |
CVE-2023-0491 | Medium | 5.4 | 2023-03-27 | The Schedulicity WordPress plugin through 2.21 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where t… |
CVE-2023-0484 | Medium | 4.3 | 2023-03-27 | The Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which c… |
CVE-2023-0467 | Medium | 4.3 | 2023-03-27 | The WP Dark Mode WordPress plugin before 4.0.8 does not properly sanitize the style parameter in shortcodes before using it to load a PHP template. This leads… |
CVE-2023-0441 | High | 8.1 | 2023-03-27 | The Gallery Blocks with Lightbox WordPress plugin before 3.0.8 has an AJAX endpoint that can be accessed by any authenticated users, such as subscriber. The ca… |
CVE-2023-0395 | Medium | 5.4 | 2023-03-27 | The menu shortcode WordPress plugin through 1.0 does not validate and escape some of its block options before outputting them back in a page/post where the blo… |
CVE-2023-0336 | Medium | 6.5 | 2023-03-27 | The OoohBoi Steroids for Elementor WordPress plugin before 2.1.5 has CSRF and broken access control vulnerabilities which leads user with role as low as subscr… |
CVE-2023-0335 | Medium | 6.5 | 2023-03-27 | The WP Shamsi WordPress plugin through 4.3.3 has CSRF and broken access control vulnerabilities which leads user with role as low as subscriber delete attachme… |
CVE-2023-0272 | Medium | 5.4 | 2023-03-27 | The NEX-Forms WordPress plugin before 8.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the… |
CVE-2023-27296 | High | 8.8 | 2023-03-27 | Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong. It could be triggered by authenticated users of InLong, you could… |
CVE-2023-22707 | Medium | 5.9 | 2023-03-27 | Auth. (author+) Cross-Site Scripting (XSS) vulnerability in Wpsoul Greenshift – animation and page builder blocks plugin <= 4.9.9 versions. |
CVE-2023-1655 | High | 7.8 | 2023-03-27 | Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.4.0. |
CVE-2023-1145 | High | 7.8 | 2023-03-27 | Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-DataCollect serv… |
CVE-2023-1144 | High | 8.8 | 2023-03-27 | Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contains an improper access control vulnerability in which an attacker can use the Device-Ga… |
CVE-2023-1143 | High | 8.8 | 2023-03-27 | In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use Lua scripts, which could allow an attacker to remotely execute arb… |
CVE-2023-1142 | High | 7.5 | 2023-03-27 | In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use URL decoding to retrieve system files, credentials, and bypass aut… |
CVE-2023-1141 | High | 8.8 | 2023-03-27 | Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a command injection vulnerability that could allow an attacker to inject arbitrary c… |
CVE-2023-1140 | Critical | 9.8 | 2023-03-27 | Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability that could allow an attacker to achieve unauthenticated remote code… |
CVE-2023-1139 | High | 8.8 | 2023-03-27 | Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-gateway service, which… |
CVE-2023-1138 | High | 7.5 | 2023-03-27 | Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain an improper access control vulnerability, which could allow an attacker to retrieve… |
CVE-2023-1137 | Medium | 6.5 | 2023-03-27 | Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which a low-level user could extract files and plaintext credenti… |
CVE-2023-1136 | Critical | 9.8 | 2023-03-27 | In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an unauthenticated attacker could generate a valid token, which would lead to authentica… |
CVE-2023-1135 | High | 7.8 | 2023-03-27 | In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could set incorrect directory permissions, which co… |
CVE-2023-1134 | High | 7.1 | 2023-03-27 | Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a path traversal vulnerability, which could allow an attacker to read local… |
CVE-2023-1133 | Critical | 9.8 | 2023-03-27 | Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which the Device-status service listens on port 10100/ UDP by def… |