2023 CVEs (page 285)
Page 285 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-1238 | Medium | 5.4 | 2023-03-07 | Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6. |
CVE-2023-1237 | Medium | 5.4 | 2023-03-07 | Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6. |
CVE-2023-23554 | High | 8.8 | 2023-03-07 | Uncontrolled search path element vulnerability exists in pg_ivm versions prior to 1.5.1. When refreshing an IMMV, pg_ivm executes functions without specifying… |
CVE-2023-22847 | Medium | 4.3 | 2023-03-07 | Information disclosure vulnerability exists in pg_ivm versions prior to 1.5.1. An Incrementally Maintainable Materialized View (IMMV) created by pg_ivm may ref… |
CVE-2023-1212 | Medium | 4.8 | 2023-03-07 | Cross-site Scripting (XSS) - Stored in GitHub repository phpipam/phpipam prior to v1.5.2. |
CVE-2023-1211 | High | 7.2 | 2023-03-07 | SQL Injection in GitHub repository phpipam/phpipam prior to v1.5.2. |
CVE-2023-27891 | High | 7.5 | 2023-03-06 | rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. The fixed versions are 4.15.1, 4.16.1, and 4.17.1. |
CVE-2023-0330 | Medium | 5.3 | 2023-03-06 | A vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption bugs like stack overfl… |
CVE-2023-26601 | High | 7.5 | 2023-03-06 | Zoho ManageEngine ServiceDesk Plus through 14104, Asset Explorer through 6987, ServiceDesk Plus MSP before 14000, and Support Center Plus before 14000 allow De… |
CVE-2023-24217 | High | 8.8 | 2023-03-06 | AgileBio Electronic Lab Notebook v4.234 was discovered to contain a local file inclusion vulnerability. |
CVE-2023-26949 | Critical | 9.8 | 2023-03-06 | An arbitrary file upload vulnerability in the component /admin1/config/update of onekeyadmin v1.3.9 allows attackers to execute arbitrary code via a crafted PH… |
CVE-2023-24737 | Medium | 6.1 | 2023-03-06 | PMB v7.4.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the query parameter at /admin/convert/export_z3950.php. |
CVE-2023-24736 | Critical | 9.8 | 2023-03-06 | PMB v7.4.6 was discovered to contain a remote code execution (RCE) vulnerability via the component /sauvegarde/restaure_act.php. |
CVE-2023-24735 | Medium | 6.1 | 2023-03-06 | PMB v7.4.6 was discovered to contain an open redirect vulnerability via the component /opac_css/pmb.php. This vulnerability allows attackers to redirect victim… |
CVE-2023-24734 | Critical | 9.8 | 2023-03-06 | An arbitrary file upload vulnerability in the camera_upload.php component of PMB v7.4.6 allows attackers to execute arbitrary code via a crafted image file. |
CVE-2023-24733 | Medium | 6.1 | 2023-03-06 | PMB v7.4.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the query parameter at /admin/convert/export_z3950_new.php. |
CVE-2023-1161 | Medium | 6.3 | 2023-03-06 | ISO 15765 and ISO 10681 dissector crash in Wireshark 4.0.0 to 4.0.3 and 3.6.0 to 3.6.11 allows denial of service via packet injection or crafted capture file |
CVE-2023-0093 | High | 8.8 | 2023-03-06 | Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrowser. An outdated li… |
CVE-2023-26600 | Medium | 6.5 | 2023-03-06 | ManageEngine ServiceDesk Plus through 14104, ServiceDesk Plus MSP through 14000, Support Center Plus through 14000, and Asset Explorer through 6987 allow privi… |
CVE-2023-24776 | Critical | 9.8 | 2023-03-06 | Funadmin v3.2.0 was discovered to contain a remote code execution (RCE) vulnerability via the component \controller\Addon.php. |
CVE-2023-24763 | High | 8.8 | 2023-03-06 | In the module "Xen Forum" (xenforum) for PrestaShop, an authenticated user can perform SQL injection in versions up to 2.13.0. |
CVE-2023-27472 | High | 8.2 | 2023-03-06 | quickentity-editor-next is an open source, system local, video game asset editor. In affected versions HTML tags in entity names are not sanitised (XSS vulner… |
CVE-2023-26054 | Medium | 6.5 | 2023-03-06 | BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In affected versions when the user sends… |
CVE-2023-23939 | Low | 3.9 | 2023-03-06 | Azure/setup-kubectl is a GitHub Action for installing Kubectl. This vulnerability only impacts versions before version 3. An insecure temporary creation of a f… |
CVE-2023-25169 | Low | 3.1 | 2023-03-06 | discourse-yearly-review is a discourse plugin which publishes an automated Year in Review topic. In affected versions a user present in a yearly review topic t… |
CVE-2023-22481 | Medium | 4.0 | 2023-03-06 | FreshRSS is a self-hosted RSS feed aggregator. When using the greader API, the provided password is logged in clear in `users/_/log_api.txt` in the case where… |
CVE-2023-27474 | High | 8.0 | 2023-03-06 | Directus is a real-time API and App dashboard for managing SQL database content. Instances relying on an allow-listed reset URL are vulnerable to an HTML injec… |
CVE-2023-25304 | High | 7.8 | 2023-03-06 | An issue in Prism Launcher up to v6.1 allows attackers to perform a directory traversal via importing a crafted .mrpack file. |
CVE-2023-24789 | High | 8.8 | 2023-03-06 | jeecg-boot v3.4.4 was discovered to contain an authenticated SQL injection vulnerability via the building block report component. |
CVE-2023-1200 | Low | 3.5 | 2023-03-06 | A vulnerability was found in ehuacui bbs. It has been declared as problematic. This vulnerability affects unknown code. The manipulation of the argument userna… |
CVE-2023-1197 | Medium | 4.8 | 2023-03-06 | Cross-site Scripting (XSS) - Stored in GitHub repository uvdesk/community-skeleton prior to 1.1.0. |
CVE-2023-0979 | Critical | 9.8 | 2023-03-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MedData MedDataPACS allows SQL Injection. This issue aff… |
CVE-2023-0377 | Medium | 5.4 | 2023-03-06 | The Scriptless Social Sharing WordPress plugin before 3.2.2 does not validate and escape some of its block options before outputting them back in a page/post w… |
CVE-2023-0328 | Medium | 4.3 | 2023-03-06 | The WPCode WordPress plugin before 2.0.7 does not have adequate privilege checks in place for several AJAX actions, only checking the nonce. This may lead to a… |
CVE-2023-0212 | Medium | 5.4 | 2023-03-06 | The Advanced Recent Posts WordPress plugin through 0.6.14 does not validate and escape some of its shortcode attributes before outputting them back in a page/p… |
CVE-2023-0165 | Medium | 5.4 | 2023-03-06 | The Cost Calculator WordPress plugin through 1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where… |
CVE-2023-0078 | Medium | 5.4 | 2023-03-06 | The Resume Builder WordPress plugin through 3.1.1 does not sanitize and escape some parameters related to Resume, which could allow users with a role as low as… |
CVE-2023-0076 | Medium | 5.4 | 2023-03-06 | The Download Attachments WordPress plugin before 1.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post w… |
CVE-2023-0069 | Medium | 5.4 | 2023-03-06 | The WPaudio MP3 Player WordPress plugin through 4.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post… |
CVE-2023-0068 | Medium | 5.4 | 2023-03-06 | The Product GTIN (EAN, UPC, ISBN) for WooCommerce WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputtin… |
CVE-2023-0065 | Medium | 5.4 | 2023-03-06 | The i2 Pros & Cons WordPress plugin through 1.3.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post wher… |
CVE-2023-0064 | Medium | 5.4 | 2023-03-06 | The eVision Responsive Column Layout Shortcodes WordPress plugin through 2.3 does not validate and escape some of its shortcode attributes before outputting th… |
CVE-2023-0063 | Medium | 5.4 | 2023-03-06 | The WordPress Shortcodes WordPress plugin through 1.6.36 does not validate and escape some of its shortcode attributes before outputting them back in a page/po… |
CVE-2023-1191 | Medium | 4.7 | 2023-03-06 | A vulnerability classified as problematic has been found in fastcms. This affects an unknown part of the file admin/TemplateController.java of the component ZI… |
CVE-2023-1190 | Medium | 4.8 | 2023-03-06 | A vulnerability was found in xiaozhuai imageinfo up to 3.0.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the fil… |
CVE-2023-1189 | Low | 3.3 | 2023-03-06 | A vulnerability was found in WiseCleaner Wise Folder Hider 4.4.3.202. It has been declared as problematic. Affected by this vulnerability is the function 0x222… |
CVE-2023-1188 | Low | 3.3 | 2023-03-06 | A vulnerability was found in FabulaTech Webcam for Remote Desktop 2.8.42. It has been classified as problematic. Affected is the function 0x222018 in the libra… |
CVE-2023-1187 | Low | 3.3 | 2023-03-06 | A vulnerability was found in FabulaTech Webcam for Remote Desktop 2.8.42 and classified as problematic. This issue affects some unknown processing in the libra… |
CVE-2023-1186 | Low | 3.3 | 2023-03-06 | A vulnerability has been found in FabulaTech Webcam for Remote Desktop 2.8.42 and classified as problematic. This vulnerability affects the function 0x222010/0… |
CVE-2023-1185 | Medium | 4.7 | 2023-03-06 | A vulnerability, which was classified as problematic, was found in ECshop up to 4.1.8. This affects an unknown part of the component New Product Handler. The m… |
CVE-2023-1184 | Medium | 4.7 | 2023-03-06 | A vulnerability, which was classified as problematic, has been found in ECshop up to 4.1.8. Affected by this issue is some unknown functionality of the file ad… |
CVE-2023-0839 | Critical | 9.8 | 2023-03-06 | Improper Protection for Outbound Error Messages and Alert Signals vulnerability in ProMIS Process Co. InSCADA allows Account Footprinting. This issue affects… |
CVE-2023-22858 | Medium | 5.3 | 2023-03-06 | An Improper Access Control vulnerability in BlogEngine.NET 3.3.8.0, allows unauthenticated visitors to access the files of unpublished blogs. |
CVE-2023-22857 | High | 8.5 | 2023-03-06 | A stored Cross-site Scripting (XSS) vulnerability in BlogEngine.NET 3.3.8.0, allows injection of arbitrary JavaScript in the security context of a blog visitor… |
CVE-2023-22856 | High | 8.5 | 2023-03-06 | A stored Cross-site Scripting (XSS) vulnerability in BlogEngine.NET 3.3.8.0, allows injection of arbitrary JavaScript in the security context of a blog visitor… |
CVE-2023-26111 | High | 7.5 | 2023-03-06 | All versions of the package @nubosoftware/node-static; all versions of the package node-static are vulnerable to Directory Traversal due to improper file path… |
CVE-2023-26108 | Low | 3.7 | 2023-03-06 | Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerability is possible… |
CVE-2023-26107 | Medium | 6.9 | 2023-03-06 | All versions of the package sketchsvg are vulnerable to Arbitrary Code Injection when invoking shell.exec without sanitization nor parametrization while concat… |
CVE-2023-26106 | High | 7.5 | 2023-03-06 | All versions of the package dot-lens are vulnerable to Prototype Pollution via the set() function in index.js file. |
CVE-2023-25077 | Medium | 5.4 | 2023-03-06 | Cross-site scripting vulnerability in Authentication Key Settings of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0 allows a remote au… |
CVE-2023-22838 | Medium | 5.4 | 2023-03-06 | Cross-site scripting vulnerability in Product List Screen and Product Detail Screen of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0… |
CVE-2023-22438 | Medium | 5.4 | 2023-03-06 | Cross-site scripting vulnerability in Contents Management of EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0), EC-CUB… |
CVE-2023-22432 | Medium | 6.1 | 2023-03-06 | Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirected to an arbitrary website by accessin… |
CVE-2023-22424 | High | 7.8 | 2023-03-06 | Use-after-free vulnerability exists in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6.9.0 and earlier. With the abnor… |
CVE-2023-22421 | High | 7.8 | 2023-03-06 | Out-of-bounds read vulnerability exists in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6.9.0 and earlier. The insuff… |
CVE-2023-22419 | High | 7.8 | 2023-03-06 | Out-of-bounds read vulnerability exists in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6.9.0 and earlier. When proce… |
CVE-2023-22344 | Critical | 9.8 | 2023-03-06 | Use of hard-coded credentials vulnerability in SS1 Ver.13.0.0.40 and earlier and Rakuraku PC Cloud Agent Ver.2.1.8 and earlier allows a remote attacker to obta… |
CVE-2023-22336 | Critical | 9.8 | 2023-03-06 | Path traversal vulnerability in SS1 Ver.13.0.0.40 and earlier and Rakuraku PC Cloud Agent Ver.2.1.8 and earlier allows a remote attacker to upload a specially… |
CVE-2023-22335 | High | 7.5 | 2023-03-06 | Improper access control vulnerability in SS1 Ver.13.0.0.40 and earlier and Rakuraku PC Cloud Agent Ver.2.1.8 and earlier allows a remote attacker to bypass acc… |
CVE-2023-27641 | Medium | 6.1 | 2023-03-05 | The REPORT (after z but before a) parameter in wa.exe in L-Soft LISTSERV 16.5 before 17 allows an attacker to conduct XSS attacks via a crafted URL. |
CVE-2023-27635 | High | 7.8 | 2023-03-05 | debmany in debian-goodies 0.88.1 allows attackers to execute arbitrary shell commands (because of an eval call) via a crafted .deb file. (The path is shown to… |
CVE-2023-26510 | Medium | 5.7 | 2023-03-05 | Ghost 5.35.0 allows authorization bypass: contributors can view draft posts of other users, which is arguably inconsistent with a security policy in which a co… |
CVE-2023-0734 | Medium | 5.3 | 2023-03-05 | Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.4. |
CVE-2023-1181 | Medium | 5.4 | 2023-03-05 | Cross-site Scripting (XSS) - Stored in GitHub repository icret/easyimages2.0 prior to 2.6.7. |
CVE-2023-1180 | Low | 3.5 | 2023-03-05 | A vulnerability has been found in SourceCodester Health Center Patient Record Management System 1.0 and classified as problematic. Affected by this vulnerabili… |
CVE-2023-1179 | Low | 3.5 | 2023-03-05 | A vulnerability, which was classified as problematic, was found in SourceCodester Computer Parts Sales and Inventory System 1.0. Affected is an unknown functio… |
CVE-2023-1175 | Medium | 6.6 | 2023-03-04 | Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378. |
CVE-2023-26481 | Critical | 9.1 | 2023-03-04 | authentik is an open-source Identity Provider. Due to an insufficient access check, a recovery flow link that is created by an admin (or sent via email by an a… |
CVE-2023-25819 | Medium | 5.3 | 2023-03-04 | Discourse is an open source platform for community discussion. Tags that are normally private are showing in metadata. This affects any site running the `tests… |
CVE-2023-26490 | High | 7.3 | 2023-03-04 | mailcow is a dockerized email package, with multiple containers linked in one bridged network. The Sync Job feature - which can be made available to standard u… |
CVE-2023-26487 | Medium | 6.5 | 2023-03-04 | Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.`lassoAppend' function accepts 3 argu… |
CVE-2023-26486 | Medium | 6.5 | 2023-03-04 | Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. The Vega `scale` expression function… |
CVE-2023-23929 | High | 8.8 | 2023-03-04 | vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Currently, the refresh token is valid indefinitely. The refresh… |
CVE-2023-27290 | Critical | 9.1 | 2023-03-03 | Docker based datastores for IBM Instana (IBM Observability with Instana 239-0 through 239-2, 241-0 through 241-2, and 243-0) do not currently require authentic… |
CVE-2023-26779 | Critical | 9.8 | 2023-03-03 | CleverStupidDog yf-exam v 1.8.0 is vulnerable to Deserialization which can lead to remote code execution (RCE). |
CVE-2023-26491 | Medium | 5.4 | 2023-03-03 | RSSHub is an open source and extensible RSS feed generator. When the URL parameters contain certain special characters, it returns an error page that does not… |
CVE-2023-26483 | Medium | 5.3 | 2023-03-03 | gosaml2 is a Pure Go implementation of SAML 2.0. SAML Service Providers using this library for SAML authentication support are likely susceptible to Denial of… |
CVE-2023-26047 | Medium | 6.5 | 2023-03-03 | teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. In teler-waf prior to version v0.2.0 is vulnerabl… |
CVE-2023-25403 | High | 7.5 | 2023-03-03 | CleverStupidDog yf-exam v 1.8.0 is vulnerable to Authentication Bypass. The program uses a fixed JWT key, and the stored key uses username format characters. A… |
CVE-2023-25402 | High | 7.5 | 2023-03-03 | CleverStupidDog yf-exam 1.8.0 is vulnerable to File Upload. There is no restriction on the suffix of the uploaded file, resulting in any file upload. |
CVE-2023-1170 | Medium | 6.6 | 2023-03-03 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376. |
CVE-2023-27574 | Critical | 9.8 | 2023-03-03 | ShadowsocksX-NG 1.10.0 signs with com.apple.security.get-task-allow entitlements because of CODE_SIGNING_INJECT_BASE_ENTITLEMENTS. |
CVE-2023-27567 | High | 7.5 | 2023-03-03 | In OpenBSD 7.2, a TCP packet with destination port 0 that matches a pf divert-to rule can crash the kernel. |
CVE-2023-26492 | Medium | 5.0 | 2023-03-03 | Directus is a real-time API and App dashboard for managing SQL database content. Directus is vulnerable to Server-Side Request Forgery (SSRF) when importing a… |
CVE-2023-26488 | Medium | 6.5 | 2023-03-03 | OpenZeppelin Contracts is a library for secure smart contract development. The ERC721Consecutive contract designed for minting NFTs in batches does not update… |
CVE-2023-26213 | High | 7.2 | 2023-03-03 | On Barracuda CloudGen WAN Private Edge Gateway devices before 8 webui-sdwan-1089-8.3.1-174141891, an OS command injection vulnerability exists in /ajax/update_… |
CVE-2023-23927 | Medium | 6.1 | 2023-03-03 | Craft is a platform for creating digital experiences. When you insert a payload inside a label name or instruction of an entry type, an cross-site scripting (X… |
CVE-2023-23313 | Medium | 6.1 | 2023-03-03 | Certain Draytek products are vulnerable to Cross Site Scripting (XSS) via the wlogin.cgi script and user_login.cgi script of the router's web application manag… |
CVE-2023-0968 | Medium | 6.1 | 2023-03-03 | The Watu Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘dn’, 'email', 'points', and 'date' parameters in versions up to, an… |
CVE-2023-27566 | High | 7.8 | 2023-03-03 | Cubism Core in Live2D Cubism Editor 4.2.03 allows out-of-bounds write via a crafted Section Offset Table or Count Info Table in an MOC3 file. |