2023 CVEs (page 281)
Page 281 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-23401 | High | 7.8 | 2023-03-14 | Windows Media Remote Code Execution Vulnerability |
CVE-2023-23400 | High | 7.2 | 2023-03-14 | Windows DNS Server Remote Code Execution Vulnerability |
CVE-2023-23399 | High | 7.8 | 2023-03-14 | Microsoft Excel Remote Code Execution Vulnerability |
CVE-2023-23398 | High | 7.1 | 2023-03-14 | Microsoft Excel Spoofing Vulnerability |
CVE-2023-23397 | Critical | 9.8 | 2023-03-14 | Microsoft Outlook Elevation of Privilege Vulnerability |
CVE-2023-23396 | Medium | 6.5 | 2023-03-14 | Microsoft Excel Denial of Service Vulnerability |
CVE-2023-23395 | Low | 3.1 | 2023-03-14 | Microsoft SharePoint Server Spoofing Vulnerability |
CVE-2023-23394 | Medium | 5.5 | 2023-03-14 | Client Server Run-Time Subsystem (CSRSS) Information Disclosure Vulnerability |
CVE-2023-23393 | High | 7.0 | 2023-03-14 | Windows BrokerInfrastructure Service Elevation of Privilege Vulnerability |
CVE-2023-23392 | Critical | 9.8 | 2023-03-14 | HTTP Protocol Stack Remote Code Execution Vulnerability |
CVE-2023-23391 | Medium | 5.5 | 2023-03-14 | Office for Android Spoofing Vulnerability |
CVE-2023-23389 | Medium | 6.3 | 2023-03-14 | Microsoft Defender Elevation of Privilege Vulnerability |
CVE-2023-23388 | High | 8.8 | 2023-03-14 | Windows Bluetooth Driver Elevation of Privilege Vulnerability |
CVE-2023-23385 | High | 7.0 | 2023-03-14 | Windows Point-to-Point Protocol over Ethernet (PPPoE) Elevation of Privilege Vulnerability |
CVE-2023-23383 | High | 8.2 | 2023-03-14 | Service Fabric Explorer Spoofing Vulnerability |
CVE-2023-21708 | Critical | 9.8 | 2023-03-14 | Remote Procedure Call Runtime Remote Code Execution Vulnerability |
CVE-2023-27070 | Medium | 5.4 | 2023-03-14 | A stored cross-site scripting (XSS) vulnerability in TotalJS OpenPlatform commit b80b09d allows attackers to execute arbitrary web scripts or HTML via a crafte… |
CVE-2023-27069 | Medium | 5.4 | 2023-03-14 | A stored cross-site scripting (XSS) vulnerability in TotalJS OpenPlatform commit b80b09d allows attackers to execute arbitrary web scripts or HTML via a crafte… |
CVE-2023-27074 | Critical | 9.8 | 2023-03-14 | BP Monitoring Management System v1.0 was discovered to contain a SQL injection vulnerability via the emailid parameter in the login page. |
CVE-2023-27073 | Medium | 6.5 | 2023-03-14 | A Cross-Site Request Forgery (CSRF) in Online Food Ordering System v1.0 allows attackers to change user details and credentials via a crafted POST request. |
CVE-2023-1398 | Medium | 6.3 | 2023-03-14 | A vulnerability classified as critical was found in XiaoBingBy TeaCMS 2.0. Affected by this vulnerability is an unknown functionality of the file /admin/upload… |
CVE-2023-1397 | Low | 3.5 | 2023-03-14 | A vulnerability classified as problematic has been found in SourceCodester Online Student Management System 1.0. Affected is an unknown function of the file pr… |
CVE-2023-1396 | Low | 3.5 | 2023-03-14 | A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been rated as problematic. This issue affects some unknown pro… |
CVE-2023-1395 | Low | 3.5 | 2023-03-14 | A vulnerability was found in SourceCodester Yoga Class Registration System 1.0. It has been declared as problematic. This vulnerability affects the function qu… |
CVE-2023-1394 | Medium | 6.3 | 2023-03-14 | A vulnerability was found in SourceCodester Online Graduate Tracer System 1.0. It has been classified as critical. This affects the function mysqli_query of th… |
CVE-2023-1392 | Medium | 6.3 | 2023-03-14 | A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. Affected by this vulnerability is the function sa… |
CVE-2023-1391 | Medium | 4.7 | 2023-03-14 | A vulnerability, which was classified as problematic, was found in SourceCodester Online Tours & Travels Management System 1.0. Affected is an unknown function… |
CVE-2023-1299 | High | 7.4 | 2023-03-14 | HashiCorp Nomad and Nomad Enterprise 1.5.0 allow a job submitter to escalate to management-level privileges using workload identity and task API. Fixed in 1.5… |
CVE-2023-1296 | Low | 2.7 | 2023-03-14 | HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.5.0 did not correctly enforce deny policies applied to a workload’s variables. Fixed in 1.4.6 and 1.5.1. |
CVE-2023-24180 | Medium | 6.5 | 2023-03-14 | Libelfin v0.3 was discovered to contain an integer overflow in the load function at elf/mmap_loader.cc. This vulnerability allows attackers to cause a Denial o… |
CVE-2023-27463 | High | 8.8 | 2023-03-14 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.3). The audit log form of affected applications is vulnerable to SQL injection. Th… |
CVE-2023-27462 | Low | 3.1 | 2023-03-14 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.3). The client query handler of the affected application fails to check for proper… |
CVE-2023-27406 | High | 7.8 | 2023-03-14 | A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application is vulnerable to stack-based buffer wh… |
CVE-2023-27405 | High | 7.8 | 2023-03-14 | A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected applications contain an out of bounds read past th… |
CVE-2023-27404 | High | 7.8 | 2023-03-14 | A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application is vulnerable to stack-based buffer wh… |
CVE-2023-27403 | High | 7.8 | 2023-03-14 | A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains a memory corruption vulnerabi… |
CVE-2023-27402 | High | 7.8 | 2023-03-14 | A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected applications contain an out of bounds read past th… |
CVE-2023-27401 | High | 7.8 | 2023-03-14 | A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected applications contain an out of bounds read past th… |
CVE-2023-27400 | High | 7.8 | 2023-03-14 | A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past t… |
CVE-2023-27399 | High | 7.8 | 2023-03-14 | A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past t… |
CVE-2023-27398 | High | 7.8 | 2023-03-14 | A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past t… |
CVE-2023-27310 | Medium | 6.6 | 2023-03-14 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.2). The client query handler of the affected application fails to check for proper… |
CVE-2023-27309 | Medium | 5.0 | 2023-03-14 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.2). The client query handler of the affected application fails to check for proper… |
CVE-2023-25957 | Critical | 9.1 | 2023-03-14 | A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 < V1.17.3), Mendix SAML (Mendix 8 compatible) (All versions >… |
CVE-2023-27896 | Medium | 6.5 | 2023-03-14 | In SAP BusinessObjects Business Intelligence Platform - version 420, 430, an attacker can control a malicious BOE server, forcing the application server to con… |
CVE-2023-27895 | Medium | 6.1 | 2023-03-14 | SAP Authenticator for Android - version 1.3.0, allows the screen to be captured, if an authorized attacker installs a malicious app on the mobile device. The a… |
CVE-2023-27894 | Medium | 5.0 | 2023-03-14 | SAP BusinessObjects Business Intelligence Platform (Web Services) - versions 420, 430, allows an attacker to inject arbitrary values as CMS parameters to perfo… |
CVE-2023-27893 | High | 8.8 | 2023-03-14 | An attacker authenticated as a user with a non-administrative role and a common remote execution authorization in SAP Solution Manager and ABAP managed systems… |
CVE-2023-27501 | High | 8.7 | 2023-03-14 | SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker to exploit insu… |
CVE-2023-27500 | Critical | 9.6 | 2023-03-14 | An attacker with non-administrative authorizations can exploit a directory traversal flaw in program SAPRSBRO to over-write system files. In this attack, no da… |
CVE-2023-27498 | High | 7.2 | 2023-03-14 | SAP Host Agent (SAPOSCOL) - version 7.22, allows an unauthenticated attacker with network access to a server port assigned to the SAP Start Service to submit a… |
CVE-2023-27271 | Medium | 6.5 | 2023-03-14 | In SAP BusinessObjects Business Intelligence Platform (Web Services) - versions 420, 430, an attacker can control a malicious BOE server, forcing the applicati… |
CVE-2023-27270 | Medium | 6.5 | 2023-03-14 | SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulne… |
CVE-2023-27269 | Critical | 9.6 | 2023-03-14 | SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker… |
CVE-2023-27268 | Medium | 5.3 | 2023-03-14 | SAP NetWeaver AS Java (Object Analyzing Service) - version 7.50, does not perform necessary authorization checks, allowing an unauthenticated attacker to attac… |
CVE-2023-26461 | Medium | 6.8 | 2023-03-14 | SAP NetWeaver allows (SAP Enterprise Portal) - version 7.50, allows an authenticated attacker with sufficient privileges to access the XML parser which can sub… |
CVE-2023-26460 | Medium | 5.3 | 2023-03-14 | Cache Management Service in SAP NetWeaver Application Server for Java - version 7.50, does not perform any authentication checks for functionalities that requi… |
CVE-2023-26459 | High | 7.4 | 2023-03-14 | Due to improper input controls In SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791… |
CVE-2023-26457 | Medium | 6.1 | 2023-03-14 | SAP Content Server - version 7.53, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful… |
CVE-2023-25618 | Medium | 6.5 | 2023-03-14 | SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulne… |
CVE-2023-25617 | Critical | 9.0 | 2023-03-14 | SAP Business Object (Adaptive Job Server) - versions 420, 430, allows remote execution of arbitrary commands on Unix, when program objects execution is enabled… |
CVE-2023-25616 | Critical | 9.9 | 2023-03-14 | In some scenario, SAP Business Objects Business Intelligence Platform (CMC) - versions 420, 430, Program Object execution can lead to code injection vulnerabil… |
CVE-2023-25615 | Medium | 6.8 | 2023-03-14 | Due to insufficient input sanitization, SAP ABAP - versions 751, 753, 753, 754, 756, 757, 791, allows an authenticated high privileged user to alter the curren… |
CVE-2023-24526 | Medium | 5.3 | 2023-03-14 | SAP NetWeaver Application Server Java for Classload Service - version 7.50, does not perform any authentication checks for functionalities that require user id… |
CVE-2023-23857 | Critical | 9.9 | 2023-03-14 | Due to missing authentication check, SAP NetWeaver AS for Java - version 7.50, allows an unauthenticated attacker to attach to an open interface and make use o… |
CVE-2023-0021 | Medium | 6.1 | 2023-03-14 | Due to insufficient encoding of user input, SAP NetWeaver - versions 700, 701, 702, 731, 740, 750, allows an unauthenticated attacker to inject code that may e… |
CVE-2023-24279 | Medium | 6.1 | 2023-03-14 | A cross-site scripting (XSS) vulnerability in Open Networking Foundation ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbitrary web scripts o… |
CVE-2023-27587 | High | 7.4 | 2023-03-13 | ReadtoMyShoe, a web app that lets users upload articles and listen to them later, generates an error message containing sensitive information prior to commit 8… |
CVE-2023-27582 | Critical | 9.1 | 2023-03-13 | maddy is a composable, all-in-one mail server. Starting with version 0.2.0 and prior to version 0.6.3, maddy allows a full authentication bypass if SASL author… |
CVE-2023-27052 | Critical | 9.8 | 2023-03-13 | E-Commerce System v1.0 ws discovered to contain a SQL injection vulnerability via the id parameter at /admin/delete_user.php. |
CVE-2023-27583 | Critical | 9.8 | 2023-03-13 | PanIndex is a network disk directory index. In Panindex prior to version 3.1.3, a hard-coded JWT key `PanIndex` is used. An attacker can use the hard-coded JW… |
CVE-2023-27581 | High | 8.8 | 2023-03-13 | github-slug-action is a GitHub Action to expose slug value of GitHub environment variables inside of one's GitHub workflow. Starting in version 4.0.0` and prio… |
CVE-2023-0354 | Critical | 9.1 | 2023-03-13 | The Akuvox E11 web server can be accessed without any user authentication, and this could allow an attacker to access sensitive information, as well as create… |
CVE-2023-0353 | High | 7.2 | 2023-03-13 | Akuvox E11 uses a weak encryption algorithm for stored passwords and uses a hard-coded password for decryption which could allow the encrypted passwords to be… |
CVE-2023-0352 | Critical | 9.1 | 2023-03-13 | The Akuvox E11 password recovery webpage can be accessed without authentication, and an attacker could download the device key file. An attacker could then use… |
CVE-2023-0351 | High | 8.8 | 2023-03-13 | The Akuvox E11 web server backend library allows command injection in the device phone-book contacts functionality. This could allow an attacker to upload file… |
CVE-2023-0350 | Medium | 6.5 | 2023-03-13 | Akuvox E11 does not ensure that a file extension is associated with the file provided. This could allow an attacker to upload a file to the device by changing… |
CVE-2023-0349 | High | 7.5 | 2023-03-13 | The Akuvox E11 libvoice library provides unauthenticated access to the camera capture for image and video. This could allow an attacker to view and record imag… |
CVE-2023-0348 | High | 7.5 | 2023-03-13 | Akuvox E11 allows direct SIP calls. No access control is enforced by the SIP servers, which could allow an attacker to contact any device within Akuvox to call… |
CVE-2023-0347 | High | 7.5 | 2023-03-13 | The Akuvox E11 Media Access Control (MAC) address, a primary identifier, combined with the Akuvox E11 IP address, could allow an attacker to identify the devic… |
CVE-2023-0346 | High | 7.5 | 2023-03-13 | Akuvox E11 cloud login is performed through an unencrypted HTTP connection. An attacker could gain access to the Akuvox cloud and device if the MAC address of… |
CVE-2023-0345 | Critical | 9.8 | 2023-03-13 | The Akuvox E11 secure shell (SSH) server is enabled by default and can be accessed by the root user. This password cannot be changed by the user. |
CVE-2023-25803 | High | 7.5 | 2023-03-13 | Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.3.5.0 have a directory traversal vulnerability that… |
CVE-2023-25802 | High | 7.5 | 2023-03-13 | Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.3.6.0 don't correctly neutralize `dir/../filename`… |
CVE-2023-25207 | Critical | 9.8 | 2023-03-13 | PrestaShop dpdfrance <6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.php. |
CVE-2023-0355 | Medium | 6.5 | 2023-03-13 | Akuvox E11 uses a hard-coded cryptographic key, which could allow an attacker to decrypt sensitive information. |
CVE-2023-27010 | High | 7.8 | 2023-03-13 | Wondershare Dr.Fone v12.9.6 was discovered to contain weak permissions for the service WsDrvInst. This vulnerability allows attackers to escalate privileges vi… |
CVE-2023-25279 | Critical | 9.8 | 2023-03-13 | OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload. |
CVE-2023-27580 | High | 7.5 | 2023-03-13 | CodeIgniter Shield provides authentication and authorization for the CodeIgniter 4 PHP framework. An improper implementation was found in the password storage… |
CVE-2023-1378 | Medium | 6.3 | 2023-03-13 | A vulnerability classified as critical was found in SourceCodester Friendly Island Pizza Website and Ordering System 1.0. This vulnerability affects unknown co… |
CVE-2023-0973 | Low | 2.2 | 2023-03-13 | STEPTools v18SP1 ifcmesh library (v18.1) is affected due to a null pointer dereference, which could allow an attacker to deny application usage when reading a… |
CVE-2023-25170 | Medium | 5.0 | 2023-03-13 | PrestaShop is an open source e-commerce web application that, prior to version 8.0.1, is vulnerable to cross-site request forgery (CSRF). When authenticating u… |
CVE-2023-0844 | Medium | 4.8 | 2023-03-13 | The Namaste! LMS WordPress plugin before 2.6 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform… |
CVE-2023-0772 | Medium | 6.5 | 2023-03-13 | The Popup Builder by OptinMonster WordPress plugin before 2.12.2 does not ensure that the campaign to be loaded via some shortcodes is actually a campaign, all… |
CVE-2023-0749 | Medium | 6.5 | 2023-03-13 | The Ocean Extra WordPress plugin before 2.1.3 does not ensure that the template to be loaded via a shortcode is actually a template, allowing any authenticated… |
CVE-2023-0538 | Medium | 5.4 | 2023-03-13 | The Campaign URL Builder WordPress plugin before 1.8.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post… |
CVE-2023-0477 | High | 8.8 | 2023-03-13 | The Auto Featured Image (Auto Post Thumbnail) WordPress plugin before 3.9.16 includes an AJAX endpoint that allows any user with at least Author privileges to… |
CVE-2023-0219 | Medium | 5.4 | 2023-03-13 | The FluentSMTP WordPress plugin before 2.2.3 does not sanitize or escape email content, making it vulnerable to stored cross-site scripting attacks (XSS) when… |
CVE-2023-0172 | Medium | 5.4 | 2023-03-13 | The Juicer WordPress plugin before 1.11 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shor… |
CVE-2023-0073 | Medium | 5.4 | 2023-03-13 | The Client Logo Carousel WordPress plugin through 3.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/pos… |