2023 CVEs (page 282)
Page 282 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-0066 | Medium | 5.4 | 2023-03-13 | The Companion Sitemap Generator WordPress plugin through 4.5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a… |
CVE-2023-0037 | Critical | 9.8 | 2023-03-13 | The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statemen… |
CVE-2023-27093 | Medium | 6.1 | 2023-03-13 | Cross Site Scripting vulnerability found in My-Blog allows attackers to cause a denial of service via the Post function. |
CVE-2023-26076 | High | 7.6 | 2023-03-13 | An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 1280, Exynos 2200, Exynos Modem 5123, Exynos Modem 5300, and Exynos Aut… |
CVE-2023-25973 | Medium | 5.4 | 2023-03-13 | Cross-Site Request Forgery (CSRF) vulnerability in Lucian Apostol Auto Affiliate Links plugin <= 6.3.0.2 versions. |
CVE-2023-23711 | Medium | 4.3 | 2023-03-13 | Cross-Site Request Forgery (CSRF) vulnerability in A2 Hosting A2 Optimized WP plugin <= 3.0.4 versions. |
CVE-2023-22700 | Medium | 4.3 | 2023-03-13 | Cross-Site Request Forgery (CSRF) vulnerability in PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Manager plugin <= 9.3.0 versions. |
CVE-2023-27065 | High | 7.5 | 2023-03-13 | Tenda V15V1.0 V15.11.0.14(1521_3190_1058) was discovered to contain a buffer overflow vulnerability via the picName parameter in the formDelWewifiPi function… |
CVE-2023-27064 | High | 7.5 | 2023-03-13 | Tenda V15V1.0 V15.11.0.14(1521_3190_1058) was discovered to contain a buffer overflow vulnerability via the index parameter in the formDelDnsForward function… |
CVE-2023-27063 | Critical | 9.8 | 2023-03-13 | Tenda V15V1.0 V15.11.0.14(1521_3190_1058) was discovered to contain a buffer overflow vulnerability via the DNSDomainName parameter in the formModifyDnsForward… |
CVE-2023-27062 | High | 7.5 | 2023-03-13 | Tenda V15V1.0 was discovered to contain a buffer overflow vulnerability via the gotoUrl parameter in the formPortalAuth function. This vulnerability allows att… |
CVE-2023-27061 | Critical | 9.8 | 2023-03-13 | Tenda V15V1.0 V15.11.0.14(1521_3190_1058) was discovered to contain a buffer overflow vulnerability via the wifiFilterListRemark parameter in the modifyWifiFil… |
CVE-2023-26073 | High | 7.6 | 2023-03-13 | An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 850, Exynos 980, Exynos 1080, Exynos 1280, Exynos 2200, Exynos Modem 51… |
CVE-2023-25991 | Medium | 5.4 | 2023-03-13 | Cross-Site Request Forgery (CSRF) vulnerability in RegistrationMagic plugin <= 5.1.9.2 versions. |
CVE-2023-24762 | Critical | 9.8 | 2023-03-13 | OS Command injection vulnerability in D-Link DIR-867 DIR_867_FW1.30B07 allows attackers to execute arbitrary commands via a crafted LocalIPAddress parameter fo… |
CVE-2023-0978 | Medium | 6.4 | 2023-03-13 | A command injection vulnerability in Trellix Intelligent Sandbox CLI for version 5.2 and earlier, allows a local user to inject and execute arbitrary operatin… |
CVE-2023-26074 | High | 7.6 | 2023-03-13 | An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 850, Exynos 980, Exynos 1080, Exynos 1280, Exynos 2200, Exynos Modem 51… |
CVE-2023-24579 | Medium | 5.5 | 2023-03-13 | McAfee Total Protection prior to 16.0.51 allows attackers to trick a victim into uninstalling the application via the command prompt. |
CVE-2023-24578 | Medium | 5.5 | 2023-03-13 | McAfee Total Protection prior to 16.0.49 allows attackers to elevate user privileges due to DLL sideloading. This could enable a user with lower privileges to… |
CVE-2023-24577 | Medium | 5.5 | 2023-03-13 | McAfee Total Protection prior to 16.0.50 allows attackers to elevate user privileges due to Improper Link Resolution via registry keys. This could enable a use… |
CVE-2023-1374 | Medium | 4.4 | 2023-03-13 | The Solidres plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'currency_name' parameter in versions up to, and including, 0.9.4 due to… |
CVE-2023-1372 | High | 7.2 | 2023-03-13 | The WH Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters such as wh_homepage, wh_text_short, wh_text_full… |
CVE-2023-26072 | High | 7.6 | 2023-03-13 | An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 850, Exynos 980, Exynos 1080, Exynos 1280, Exynos 2200, Exynos Modem 51… |
CVE-2023-25283 | High | 7.5 | 2023-03-13 | A stack overflow vulnerability in D-Link DIR820LA1_FW106B02 allows attackers to cause a denial of service via the reserveDHCP_HostName_1.1.1.0 parameter to lan… |
CVE-2023-24033 | High | 7.5 | 2023-03-13 | The Samsung Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, and Exynos Auto T512 baseband modem chipsets do not properly check format types spec… |
CVE-2023-0629 | High | 7.1 | 2023-03-13 | Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions by setting the Docker host to docker.raw.soc… |
CVE-2023-0628 | Medium | 6.1 | 2023-03-13 | Docker Desktop before 4.17.0 allows an attacker to execute an arbitrary command inside a Dev Environments container during initialization by tricking a user to… |
CVE-2023-1369 | Medium | 5.0 | 2023-03-13 | A vulnerability was found in TG Soft Vir.IT eXplorer 9.4.86.0. It has been rated as problematic. This issue affects the function 0x82730088 in the library VIRA… |
CVE-2023-1368 | High | 7.3 | 2023-03-13 | A vulnerability was found in XHCMS 1.0. It has been declared as critical. This vulnerability affects unknown code of the file login.php of the component POST P… |
CVE-2023-1367 | Low | 3.8 | 2023-03-13 | Code Injection in GitHub repository alextselegidis/easyappointments prior to 1.5.0. |
CVE-2023-1366 | Medium | 6.3 | 2023-03-13 | A vulnerability was found in SourceCodester Yoga Class Registration System 1.0. It has been classified as critical. This affects the function query of the file… |
CVE-2023-0888 | Medium | 4.9 | 2023-03-13 | An improper neutralization of directives in dynamically evaluated code vulnerability in the WiFi Battery embedded web server in versions L90/U70 and L92/U92 ca… |
CVE-2023-1365 | High | 7.3 | 2023-03-13 | A vulnerability was found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. Affected by this issue is some unknown functionality o… |
CVE-2023-1364 | Medium | 6.3 | 2023-03-13 | A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. Affected by this vulnerability is an unknown func… |
CVE-2023-1363 | Low | 3.5 | 2023-03-13 | A vulnerability, which was classified as problematic, was found in SourceCodester Computer Parts Sales and Inventory System 1.0. Affected is an unknown functio… |
CVE-2023-1362 | Medium | 6.1 | 2023-03-13 | Improper Restriction of Rendered UI Layers or Frames in GitHub repository unilogies/bumsys prior to v2.0.2. |
CVE-2023-1361 | Medium | 6.5 | 2023-03-13 | SQL Injection in GitHub repository unilogies/bumsys prior to v2.0.2. |
CVE-2023-28154 | Critical | 9.8 | 2023-03-13 | Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a proper… |
CVE-2023-1360 | Medium | 4.7 | 2023-03-12 | A vulnerability was found in SourceCodester Employee Payslip Generator with Sending Mail 1.2.0 and classified as critical. This issue affects some unknown proc… |
CVE-2023-1359 | Low | 2.4 | 2023-03-12 | A vulnerability has been found in SourceCodester Gadget Works Online Ordering System 1.0 and classified as problematic. This vulnerability affects unknown code… |
CVE-2023-1358 | Medium | 6.3 | 2023-03-12 | A vulnerability, which was classified as critical, was found in SourceCodester Gadget Works Online Ordering System 1.0. This affects an unknown part of the fil… |
CVE-2023-1357 | High | 7.3 | 2023-03-12 | A vulnerability, which was classified as critical, has been found in SourceCodester Simple Bakery Shop Management System 1.0. Affected by this issue is some un… |
CVE-2023-1355 | Medium | 5.5 | 2023-03-11 | NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1402. |
CVE-2023-1354 | Low | 3.5 | 2023-03-11 | A vulnerability has been found in SourceCodester Design and Implementation of Covid-19 Directory on Vaccination System 1.0 and classified as problematic. Affec… |
CVE-2023-1353 | Low | 3.5 | 2023-03-11 | A vulnerability, which was classified as problematic, was found in SourceCodester Design and Implementation of Covid-19 Directory on Vaccination System 1.0. Af… |
CVE-2023-1352 | Medium | 5.6 | 2023-03-11 | A vulnerability, which was classified as critical, has been found in SourceCodester Design and Implementation of Covid-19 Directory on Vaccination System 1.0… |
CVE-2023-1351 | Medium | 6.3 | 2023-03-11 | A vulnerability classified as critical has been found in SourceCodester Computer Parts Sales and Inventory System 1.0. This affects an unknown part of the file… |
CVE-2023-1350 | Medium | 6.3 | 2023-03-11 | A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is the function update_job_run of the file src/update.c of the comp… |
CVE-2023-1349 | Low | 3.5 | 2023-03-11 | A vulnerability, which was classified as problematic, has been found in Hsycms 3.1. Affected by this issue is some unknown functionality of the file controller… |
CVE-2023-24999 | Medium | 4.4 | 2023-03-11 | HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle destroy endpoint to destroy the secret ID o… |
CVE-2023-27532 | High | 7.5 | 2023-03-10 | Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gainin… |
CVE-2023-27530 | High | 7.5 | 2023-03-10 | A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to… |
CVE-2023-23911 | High | 7.5 | 2023-03-10 | An improper access control vulnerability exists prior to v6 that could allow an attacker to break the E2E encryption of a chat room by a user changing the grou… |
CVE-2023-23328 | High | 8.8 | 2023-03-10 | A File Upload vulnerability exists in AvantFAX 3.3.7. An authenticated user can bypass PHP file type validation in FileUpload.php by uploading a specially craf… |
CVE-2023-23327 | Medium | 4.9 | 2023-03-10 | An Information Disclosure vulnerability exists in AvantFAX 3.3.7. Backups of the AvantFAX sent/received faxes, and database backups are stored using the curren… |
CVE-2023-23326 | Medium | 5.4 | 2023-03-10 | A Stored Cross-Site Scripting (XSS) vulnerability exists in AvantFAX 3.3.7. An authenticated low privilege user can inject arbitrary Javascript into their e-ma… |
CVE-2023-27905 | Critical | 9.6 | 2023-03-10 | Jenkins update-center2 3.13 and 3.14 renders the required Jenkins core version on plugin download index pages without sanitization, resulting in a stored cross… |
CVE-2023-27904 | Medium | 5.3 | 2023-03-10 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier prints an error stack trace on agent-related pages when agent connections are broken, potentially revealing… |
CVE-2023-27903 | Medium | 4.4 | 2023-03-10 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created f… |
CVE-2023-27902 | Medium | 4.3 | 2023-03-10 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier shows temporary directories related to job workspaces, which allows attackers with Item/Workspace permission… |
CVE-2023-27901 | High | 7.5 | 2023-03-10 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introdu… |
CVE-2023-27900 | High | 7.5 | 2023-03-10 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introdu… |
CVE-2023-27899 | High | 7.0 | 2023-03-10 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created f… |
CVE-2023-27898 | Critical | 9.6 | 2023-03-10 | Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when renderi… |
CVE-2023-27577 | Medium | 6.6 | 2023-03-10 | flarum is a forum software package for building communities. In versions prior to 1.7.0 an admin account which has already been compromised by an attacker may… |
CVE-2023-25148 | High | 7.8 | 2023-03-10 | A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to exploit the vulnerability by changing a specific file int… |
CVE-2023-25147 | Medium | 6.7 | 2023-03-10 | An issue in the Trend Micro Apex One agent could allow an attacker who has previously acquired administrative rights via other means to bypass the protection b… |
CVE-2023-25146 | High | 7.8 | 2023-03-10 | A security agent link following vulnerability in the Trend Micro Apex One agent could allow a local attacker to quarantine a file, delete the original folder a… |
CVE-2023-25145 | High | 7.8 | 2023-03-10 | A link following vulnerability in the scanning function of Trend Micro Apex One agent could allow a local attacker to escalate privileges on affected installat… |
CVE-2023-25144 | High | 7.8 | 2023-03-10 | An improper access control vulnerability in the Trend Micro Apex One agent could allow a local attacker to gain elevated privileges and create arbitrary direct… |
CVE-2023-25143 | Critical | 9.8 | 2023-03-10 | An uncontrolled search path element vulnerability in the Trend Micro Apex One Server installer could allow an attacker to achieve a remote code execution state… |
CVE-2023-24975 | Medium | 5.4 | 2023-03-10 | IBM Spectrum Symphony 7.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to… |
CVE-2023-1246 | High | 7.5 | 2023-03-10 | Files or Directories Accessible to External Parties vulnerability in Saysis Starcities allows Collect Data from Common Resource Locations. This issue affects… |
CVE-2023-1203 | Medium | 6.5 | 2023-03-10 | Improper removal of sensitive data in the entry edit feature of Hub Business submodule in Devolutions Remote Desktop Manager PowerShell Module 2022.3.1.5 and e… |
CVE-2023-1201 | Medium | 6.5 | 2023-03-10 | Improper access control in the secure messages feature in Devolutions Server 2022.3.12 and below allows an authenticated attacker that possesses the message UU… |
CVE-2023-1198 | Critical | 9.8 | 2023-03-10 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saysis Starcities allows SQL Injection. This issue affec… |
CVE-2023-0193 | Medium | 4.4 | 2023-03-10 | NVIDIA CUDA Toolkit SDK contains a vulnerability in cuobjdump, where a local user running the tool against a malicious binary may cause an out-of-bounds read… |
CVE-2023-1346 | Medium | 4.3 | 2023-03-10 | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to… |
CVE-2023-1345 | Medium | 4.3 | 2023-03-10 | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to… |
CVE-2023-1344 | Medium | 4.3 | 2023-03-10 | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to… |
CVE-2023-1343 | Medium | 4.3 | 2023-03-10 | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to… |
CVE-2023-1342 | Medium | 4.3 | 2023-03-10 | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to… |
CVE-2023-1341 | Medium | 4.3 | 2023-03-10 | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to… |
CVE-2023-1340 | Medium | 4.3 | 2023-03-10 | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to… |
CVE-2023-1339 | Medium | 4.3 | 2023-03-10 | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized settings update due to a missing capability check on the uucss_update… |
CVE-2023-1338 | Medium | 4.3 | 2023-03-10 | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized cache modification due to a missing capability check on the attach_ru… |
CVE-2023-1337 | Medium | 4.3 | 2023-03-10 | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the clear_uucss_logs f… |
CVE-2023-1336 | Medium | 4.3 | 2023-03-10 | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized settings update due to a missing capability check on the ajax_deactiv… |
CVE-2023-1335 | Medium | 4.3 | 2023-03-10 | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the ucss_… |
CVE-2023-1334 | Medium | 4.3 | 2023-03-10 | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized cache modification due to a missing capability check on the queue_pos… |
CVE-2023-1333 | Medium | 4.3 | 2023-03-10 | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the clear_page_cach… |
CVE-2023-27853 | Critical | 9.8 | 2023-03-10 | NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a format string vulnerability in a SOAP service that could allow an attacker to execute arbitrary c… |
CVE-2023-27852 | Critical | 9.8 | 2023-03-10 | NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a buffer overflow vulnerability in various CGI mechanisms that could allow an attacker to execute a… |
CVE-2023-27851 | High | 8.8 | 2023-03-10 | NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a file sharing mechanism that unintentionally allows users with upload permissions to execute arbit… |
CVE-2023-27850 | Medium | 6.8 | 2023-03-10 | NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a file sharing mechanism that allows users with access to this feature to access arbitrary files on… |
CVE-2023-1205 | High | 8.8 | 2023-03-10 | NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 is vulnerable to cross-site request forgery attacks on all endpoints due to improperly implemented CSRF prot… |
CVE-2023-26075 | High | 7.6 | 2023-03-10 | An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 850, Exynos 980, Exynos 1080, Exynos 1280, Exynos 2200, Exynos Modem 51… |
CVE-2023-1328 | Medium | 4.7 | 2023-03-10 | A vulnerability was found in Guizhou 115cms 4.2. It has been classified as problematic. Affected is an unknown function of the file /admin/content/index. The m… |
CVE-2023-27164 | Medium | 4.8 | 2023-03-10 | An arbitrary file upload vulnerability in Halo up to v1.6.1 allows attackers to execute arbitrary code via a crafted .md file. |
CVE-2023-27161 | High | 7.5 | 2023-03-10 | Jellyfin up to v10.7.7 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /Repositories. This vulnerability allows attackers to a… |