2023 CVEs (page 277)
Page 277 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-25595 | Medium | 5.5 | 2023-03-22 | A vulnerability exists in the ClearPass OnGuard Ubuntu agent that allows for an attacker with local Ubuntu instance access to potentially obtain sensitive inf… |
CVE-2023-25594 | Medium | 6.3 | 2023-03-22 | A vulnerability in the web-based management interface of ClearPass Policy Manager allows an attacker with read-only privileges to perform actions that change… |
CVE-2023-25593 | High | 7.1 | 2023-03-22 | Vulnerabilities within the web-based management interface of ClearPass Policy Manager could allow a remote attacker to conduct a reflected cross-site scripting… |
CVE-2023-25592 | High | 7.1 | 2023-03-22 | Vulnerabilities within the web-based management interface of ClearPass Policy Manager could allow a remote attacker to conduct a reflected cross-site scripting… |
CVE-2023-25591 | High | 7.6 | 2023-03-22 | A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sen… |
CVE-2023-25590 | High | 7.8 | 2023-03-22 | A vulnerability in the ClearPass OnGuard Linux agent could allow malicious users on a Linux instance to elevate their user privileges to those of a higher role… |
CVE-2023-25589 | Critical | 9.8 | 2023-03-22 | A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to create arbitrary users on t… |
CVE-2023-25069 | High | 8.8 | 2023-03-22 | TXOne StellarOne has an improper access control privilege escalation vulnerability in every version before V2.0.1160 that could allow a malicious, falsely auth… |
CVE-2023-1436 | Medium | 5.9 | 2023-03-22 | An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This lead… |
CVE-2023-1370 | High | 7.5 | 2023-03-22 | [Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the… |
CVE-2023-1168 | High | 7.2 | 2023-03-22 | An authenticated remote code execution vulnerability exists in the AOS-CX Network Analytics Engine. Successful exploitation of this vulnerability resul… |
CVE-2023-27857 | High | 7.5 | 2023-03-22 | In affected versions, a heap-based buffer over-read condition occurs when the message field indicates more data than is present in the message field in R… |
CVE-2023-28725 | Critical | 9.1 | 2023-03-22 | General Bytes Crypto Application Server (CAS) 20230120, as distributed with General Bytes BATM devices, allows remote attackers to execute arbitrary Java code… |
CVE-2023-27856 | High | 7.5 | 2023-03-22 | In affected versions, path traversal exists when processing a message of type 8 in Rockwell Automation's ThinManager ThinServer. An unauthenticated remo… |
CVE-2023-27855 | Critical | 9.8 | 2023-03-22 | In affected versions, a path traversal exists when processing a message in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker co… |
CVE-2023-24709 | High | 7.5 | 2023-03-21 | An issue found in Paradox Security Systems IPR512 allows attackers to cause a denial of service via the login.html and login.xml parameters. |
CVE-2023-26497 | High | 8.6 | 2023-03-21 | An issue was discovered in Samsung Baseband Modem Chipset for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, and Exynos Auto T5125. Memory corr… |
CVE-2023-1534 | High | 8.8 | 2023-03-21 | Out of bounds read in ANGLE in Google Chrome prior to 111.0.5563.110 allowed a remote attacker who had compromised the renderer process to potentially exploit… |
CVE-2023-1533 | High | 8.8 | 2023-03-21 | Use after free in WebProtect in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2023-1532 | High | 8.8 | 2023-03-21 | Out of bounds read in GPU Video in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2023-1531 | High | 8.8 | 2023-03-21 | Use after free in ANGLE in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2023-1530 | High | 8.8 | 2023-03-21 | Use after free in PDF in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chrom… |
CVE-2023-1529 | Critical | 9.8 | 2023-03-21 | Out of bounds memory access in WebHID in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a malicious… |
CVE-2023-1528 | High | 8.8 | 2023-03-21 | Use after free in Passwords in Google Chrome prior to 111.0.5563.110 allowed a remote attacker who had compromised the renderer process to potentially exploit… |
CVE-2023-1262 | High | 8.2 | 2023-03-21 | Missing MAC layer security in Silicon Labs Wi-SUN Linux Border Router v1.5.2 and earlier allows malicious node to route malicious messages through network. |
CVE-2023-1261 | High | 8.2 | 2023-03-21 | Missing MAC layer security in Silicon Labs Wi-SUN SDK v1.5.0 and earlier allows malicious node to route malicious messages through network. |
CVE-2023-0391 | High | 8.1 | 2023-03-21 | MGT-COMMERCE CloudPanel ships with a static SSL certificate to encrypt communications to the administrative interface, shared across every installation of Clou… |
CVE-2023-27087 | High | 7.5 | 2023-03-21 | Permissions vulnerabiltiy found in Xuxueli xxl-job v2.2.0, v 2.3.0 and v.2.3.1 allows attacker to obtain sensitive information via the pageList parameter. |
CVE-2023-25134 | Medium | 6.7 | 2023-03-21 | McAfee Total Protection prior to 16.0.50 may allow an adversary (with full administrative access) to modify a McAfee specific Component Object Model (COM) in t… |
CVE-2023-25684 | Medium | 6.5 | 2023-03-21 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL… |
CVE-2023-1306 | High | 8.8 | 2023-03-21 | An authenticated attacker can leverage an exposed resource.db() accessor method to smuggle Python method calls via a Jinja template, which can lead to code exe… |
CVE-2023-1305 | High | 8.1 | 2023-03-21 | An authenticated attacker can leverage an exposed “box” object to read and write arbitrary files from disk, provided those files can be parsed as yaml or JSON… |
CVE-2023-1304 | High | 8.8 | 2023-03-21 | An authenticated attacker can leverage an exposed getattr() method via a Jinja template to smuggle OS commands and perform other actions that are normally expe… |
CVE-2023-27570 | Critical | 9.8 | 2023-03-21 | The eo_tags package before 1.4.19 for PrestaShop allows SQL injection via a crafted _ga cookie. |
CVE-2023-27569 | Critical | 9.8 | 2023-03-21 | The eo_tags package before 1.3.0 for PrestaShop allows SQL injection via an HTTP User-Agent or Referer header. |
CVE-2023-25923 | Low | 2.7 | 2023-03-21 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an attacker to upload files that could be used in a denial of service a… |
CVE-2023-25686 | Medium | 6.2 | 2023-03-21 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 stores user credentials in plain clear text which can be read by a local user. IBM… |
CVE-2023-27874 | Critical | 9.9 | 2023-03-21 | IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit… |
CVE-2023-27873 | Medium | 6.5 | 2023-03-21 | IBM Aspera Faspex 4.4.2 could allow a remote authenticated attacker to obtain sensitive credential information using specially crafted XML input. IBM X-Force… |
CVE-2023-27871 | High | 7.5 | 2023-03-21 | IBM Aspera Faspex 4.4.2 could allow a remote attacker to obtain sensitive credential information for an external user, using a specially crafted SQL query. IB… |
CVE-2023-27842 | High | 8.8 | 2023-03-21 | Insecure Permissions vulnerability found in Extplorer File manager eXtplorer v.2.1.15 allows a remote attacker to execute arbitrary code via the index.php comp… |
CVE-2023-25689 | Low | 2.7 | 2023-03-21 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1 , and 4.1.1 could allow a remote attacker to traverse directories on the system. An attacker c… |
CVE-2023-25687 | Medium | 4.3 | 2023-03-21 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to obtain sensitive information from log files… |
CVE-2023-27983 | Medium | 6.5 | 2023-03-21 | A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that could allow deletion of reports from the IGS… |
CVE-2023-27979 | Medium | 6.5 | 2023-03-21 | A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could allow the renaming of files in the IGSS project re… |
CVE-2023-27977 | Medium | 6.5 | 2023-03-21 | A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause access to delete files in the IGSS project r… |
CVE-2023-1314 | High | 7.5 | 2023-03-21 | A vulnerability has been discovered in cloudflared's installer (<= 2023.3.0) for Windows 32-bits devices that allows a local attacker with no administrative pe… |
CVE-2023-1154 | Medium | 6.1 | 2023-03-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pacsrapor allows Reflected XSS. This issue affects Pacsr… |
CVE-2023-1153 | Critical | 9.8 | 2023-03-21 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pacsrapor allows SQL Injection, Command Line Execution th… |
CVE-2023-27984 | High | 7.8 | 2023-03-21 | A CWE-20: Improper Input Validation vulnerability exists in Custom Reports that could cause a macro to be executed, potentially leading to remote code executio… |
CVE-2023-1545 | High | 7.5 | 2023-03-21 | SQL Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23. |
CVE-2023-27981 | High | 7.8 | 2023-03-21 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Custom Reports that could cause a remote code execution when a vi… |
CVE-2023-27978 | High | 7.8 | 2023-03-21 | A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data, potenti… |
CVE-2023-1462 | High | 8.8 | 2023-03-21 | Authorization Bypass Through User-Controlled Key vulnerability in Vadi Corporate Information Systems DigiKent allows Authentication Bypass, Authentication Abus… |
CVE-2023-27982 | High | 8.8 | 2023-03-21 | A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause manipulation of dashboard files in the IGSS… |
CVE-2023-27980 | High | 8.8 | 2023-03-21 | A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that could allow the creation of a malicious repo… |
CVE-2023-1543 | High | 8.8 | 2023-03-21 | Insufficient Session Expiration in GitHub repository answerdev/answer prior to 1.0.6. |
CVE-2023-1542 | Medium | 5.4 | 2023-03-21 | Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6. |
CVE-2023-1541 | Low | 3.8 | 2023-03-21 | Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6. |
CVE-2023-1540 | Medium | 5.3 | 2023-03-21 | Observable Response Discrepancy in GitHub repository answerdev/answer prior to 1.0.6. |
CVE-2023-1539 | Medium | 5.3 | 2023-03-21 | Improper Restriction of Excessive Authentication Attempts in GitHub repository answerdev/answer prior to 1.0.6. |
CVE-2023-1538 | Medium | 5.3 | 2023-03-21 | Observable Timing Discrepancy in GitHub repository answerdev/answer prior to 1.0.6. |
CVE-2023-1537 | Critical | 9.8 | 2023-03-21 | Authentication Bypass by Capture-replay in GitHub repository answerdev/answer prior to 1.0.6. |
CVE-2023-1536 | Medium | 5.4 | 2023-03-21 | Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7. |
CVE-2023-1535 | Medium | 5.4 | 2023-03-21 | Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7. |
CVE-2023-1527 | Medium | 5.4 | 2023-03-21 | Cross-site Scripting (XSS) - Generic in GitHub repository tsolucio/corebos prior to 8.0. |
CVE-2023-28425 | Medium | 5.5 | 2023-03-20 | Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to… |
CVE-2023-27578 | Critical | 9.1 | 2023-03-20 | Galaxy is an open-source platform for data analysis. All supported versions of Galaxy are affected prior to 22.01, 22.05, and 23.0 are affected by an insuffici… |
CVE-2023-0681 | Medium | 4.3 | 2023-03-20 | Rapid7 InsightVM versions 6.6.178 and lower suffers from an open redirect vulnerability, whereby an attacker has the ability to redirect the user to a site of… |
CVE-2023-27586 | Critical | 9.9 | 2023-03-20 | CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files… |
CVE-2023-22288 | Medium | 4.1 | 2023-03-20 | HTML Email Injection in Tribe29 Checkmk <=2.1.0p23; <=2.0.0p34, and all versions of Checkmk 1.6.0 allows an authenticated attacker to inject malicious HTML int… |
CVE-2023-1517 | Medium | 4.8 | 2023-03-20 | Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.19. |
CVE-2023-0940 | High | 8.8 | 2023-03-20 | The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not implement proper authorization. This allows… |
CVE-2023-0937 | Medium | 6.1 | 2023-03-20 | The VK All in One Expansion Unit WordPress plugin before 9.87.1.0 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribu… |
CVE-2023-0911 | Medium | 6.5 | 2023-03-20 | The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not validate the user meta to be retrieved via the user shortcode, al… |
CVE-2023-0890 | Medium | 6.5 | 2023-03-20 | The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not ensure that posts to be displayed via some shortcodes are already… |
CVE-2023-0876 | Medium | 6.1 | 2023-03-20 | The WP Meta SEO WordPress plugin before 4.5.3 does not authorize several ajax actions, allowing low-privilege users to make updates to certain data and leading… |
CVE-2023-0875 | High | 8.8 | 2023-03-20 | The WP Meta SEO WordPress plugin before 4.5.3 does not properly sanitize and escape inputs into SQL queries, leading to a blind SQL Injection vulnerability tha… |
CVE-2023-0865 | High | 8.8 | 2023-03-20 | The WooCommerce Multiple Customer Addresses & Shipping WordPress plugin before 21.7 does not ensure that the address to add/update/retrieve/delete and duplicat… |
CVE-2023-0631 | High | 8.8 | 2023-03-20 | The Paid Memberships Pro WordPress plugin before 2.9.12 does not prevent subscribers from rendering shortcodes that concatenate attributes directly into an SQL… |
CVE-2023-0630 | High | 8.8 | 2023-03-20 | The Slimstat Analytics WordPress plugin before 4.9.3.3 does not prevent subscribers from rendering shortcodes that concatenates attributes directly into an SQL… |
CVE-2023-0370 | Medium | 5.4 | 2023-03-20 | The WPB Advanced FAQ WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post wh… |
CVE-2023-0369 | Medium | 5.4 | 2023-03-20 | The GoToWP WordPress plugin through 5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the sh… |
CVE-2023-0365 | Medium | 5.4 | 2023-03-20 | The React Webcam WordPress plugin through 1.2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where… |
CVE-2023-0364 | Medium | 5.4 | 2023-03-20 | The real.Kit WordPress plugin before 5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the s… |
CVE-2023-0340 | High | 8.8 | 2023-03-20 | The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate one of its shortcode attribute, which could allow users with a contributor role a… |
CVE-2023-0273 | Medium | 5.4 | 2023-03-20 | The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page… |
CVE-2023-0175 | Medium | 5.4 | 2023-03-20 | The Responsive Clients Logo Gallery Plugin for WordPress plugin through 1.1.9 does not validate and escape some of its shortcode attributes before outputting t… |
CVE-2023-0167 | Medium | 5.4 | 2023-03-20 | The GetResponse for WordPress plugin through 5.5.31 does not validate and escape some of its shortcode attributes before outputting them back in a page/post wh… |
CVE-2023-0145 | Medium | 5.4 | 2023-03-20 | The Saan World Clock WordPress plugin through 1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post wher… |
CVE-2023-28429 | Medium | 6.1 | 2023-03-20 | Pimcore is an open source data and experience management platform. Versions prior to 10.5.19 have an unsecured tooltip field in DataObject class definition. Th… |
CVE-2023-28428 | Medium | 6.2 | 2023-03-20 | PDFio is a C library for reading and writing PDF files. In versions 1.1.0 and prior, a denial of service vulnerability exists in the pdfio parser. Crafted pdf… |
CVE-2023-1515 | Medium | 5.4 | 2023-03-20 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19. |
CVE-2023-28424 | Critical | 9.1 | 2023-03-20 | Soko if the code that powers packages.gentoo.org. Prior to version 1.0.2, the two package search handlers, `Search` and `SearchFeed`, implemented in `pkg/app/h… |
CVE-2023-28118 | High | 7.5 | 2023-03-20 | kaml provides YAML support for kotlinx.serialization. Prior to version 0.53.0, applications that use kaml to parse untrusted input containing anchors and alias… |
CVE-2023-26513 | High | 7.5 | 2023-03-20 | Excessive Iteration vulnerability in Apache Software Foundation Apache Sling Resource Merger.This issue affects Apache Sling Resource Merger: from 1.2.0 before… |
CVE-2023-0320 | Medium | 5.4 | 2023-03-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Izmir Katip Celebi University UBYS allows Stored XSS. Th… |
CVE-2023-23721 | Medium | 4.3 | 2023-03-20 | Cross-Site Request Forgery (CSRF) vulnerability in David Gwyer Admin Log plugin <= 1.50 versions. |
CVE-2023-23718 | Medium | 5.9 | 2023-03-20 | Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Esstat17 Page Loading Effects plugin <= 2.0.0 versions. |
CVE-2023-22682 | High | 7.1 | 2023-03-20 | Reflected Cross-Site Scripting (XSS) vulnerability in Manuel Masia | Pixedelic.Com Camera slideshow plugin <= 1.4.0.1 versions. |