2023 CVEs (page 289)
Page 289 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-27265 | Low | 2.7 | 2023-02-27 | Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the "Regenerate Invite Id" API endpoint, allowing an attacker with team… |
CVE-2023-27264 | High | 7.1 | 2023-02-27 | A missing permissions check in Mattermost Playbooks in Mattermost allows an attacker to modify a playbook via the /plugins/playbooks/api/v0/playbooks/[playbook… |
CVE-2023-27263 | Medium | 4.3 | 2023-02-27 | A missing permissions check in the /plugins/playbooks/api/v0/runs API in Mattermost allows an attacker to list and view playbooks belonging to a team they are… |
CVE-2023-26042 | Medium | 6.1 | 2023-02-27 | Part-DB is an open source inventory management system for your electronic components. User input was found not being properly escaped, which allowed malicious… |
CVE-2023-22860 | Medium | 5.4 | 2023-02-27 | IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vul… |
CVE-2023-23109 | High | 7.5 | 2023-02-27 | In crasm 1.8-3, invalid input validation, specific files passed to the command line application, can lead to a divide by zero fault in the function opdiv. |
CVE-2023-23108 | High | 7.5 | 2023-02-27 | In crasm 1.8-3, invalid input validation, specific files passed to the command line application, can lead to a NULL pointer dereference in the function Xasc. |
CVE-2023-23080 | Critical | 9.8 | 2023-02-27 | Certain Tenda products are vulnerable to command injection. This affects Tenda CP7 Tenda CP7<=V11.10.00.2211041403 and Tenda CP3 v.10 Tenda CP3 v.10<=V20220906… |
CVE-2023-1068 | Medium | 4.3 | 2023-02-27 | The Download Read More Excerpt Link plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.0. This is due to mi… |
CVE-2023-1067 | Medium | 5.4 | 2023-02-27 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18. |
CVE-2023-24206 | Critical | 9.8 | 2023-02-27 | Davinci v0.3.0-rc was discovered to contain a SQL injection vulnerability via the copyDisplay function. |
CVE-2023-1063 | Medium | 6.3 | 2023-02-27 | A vulnerability has been found in SourceCodester Doctors Appointment System 1.0 and classified as critical. Affected by this vulnerability is an unknown functi… |
CVE-2023-1062 | Medium | 6.3 | 2023-02-27 | A vulnerability, which was classified as critical, was found in SourceCodester Doctors Appointment System 1.0. Affected is an unknown function of the file /adm… |
CVE-2023-1061 | Medium | 6.3 | 2023-02-27 | A vulnerability, which was classified as critical, has been found in SourceCodester Doctors Appointment System 1.0. This issue affects some unknown processing… |
CVE-2023-1059 | Medium | 6.3 | 2023-02-27 | A vulnerability classified as critical was found in SourceCodester Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/d… |
CVE-2023-1058 | High | 7.3 | 2023-02-27 | A vulnerability classified as critical has been found in SourceCodester Doctors Appointment System 1.0. This affects an unknown part of the file create-account… |
CVE-2023-1057 | Medium | 5.5 | 2023-02-27 | A vulnerability was found in SourceCodester Doctors Appointment System 1.0. It has been rated as critical. Affected by this issue is the function edoc of the f… |
CVE-2023-1056 | Medium | 6.3 | 2023-02-27 | A vulnerability was found in SourceCodester Doctors Appointment System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown func… |
CVE-2023-1054 | Medium | 4.7 | 2023-02-27 | A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/?pag… |
CVE-2023-1053 | Medium | 4.7 | 2023-02-27 | A vulnerability was found in SourceCodester Music Gallery Site 1.0 and classified as critical. This issue affects some unknown processing of the file view_cate… |
CVE-2023-22636 | High | 7.0 | 2023-02-27 | An unauthorized configuration download vulnerability in FortiWeb 6.3.6 through 6.3.21, 6.4.0 through 6.4.2 and 7.0.0 through 7.0.4 may allow a local attacker t… |
CVE-2023-26257 | High | 7.5 | 2023-02-27 | An issue was discovered in the Connected Vehicle Systems Alliance (COVESA; formerly GENIVI) dlt-daemon through 2.18.8. Dynamic memory is not released after it… |
CVE-2023-26609 | High | 7.2 | 2023-02-27 | ABUS TVIP 20000-21150 devices allows remote attackers to execute arbitrary code via shell metacharacters in the /cgi-bin/mft/wireless_mft ap field. |
CVE-2023-26607 | High | 7.1 | 2023-02-26 | In the Linux kernel 6.0.8, there is an out-of-bounds read in ntfs_attr_find in fs/ntfs/attrib.c. |
CVE-2023-26606 | High | 7.8 | 2023-02-26 | In the Linux kernel 6.0.8, there is a use-after-free in ntfs_trim_fs in fs/ntfs3/bitmap.c. |
CVE-2023-26605 | High | 7.8 | 2023-02-26 | In the Linux kernel 6.0.8, there is a use-after-free in inode_cgwb_move_to_attached in fs/fs-writeback.c, related to __list_del_entry_valid. |
CVE-2023-26602 | Critical | 9.8 | 2023-02-26 | ASUS ASMB8 iKVM firmware through 1.14.51 allows remote attackers to execute arbitrary code by using SNMP to create extensions, as demonstrated by snmpset for N… |
CVE-2023-1048 | Medium | 5.3 | 2023-02-26 | A vulnerability, which was classified as critical, has been found in TechPowerUp Ryzen DRAM Calculator 1.2.0.5. This issue affects some unknown processing in t… |
CVE-2023-1047 | Medium | 5.3 | 2023-02-26 | A vulnerability classified as critical was found in TechPowerUp RealTemp 3.7.0.0. This vulnerability affects unknown code in the library WinRing0x64.sys. The m… |
CVE-2023-1046 | Medium | 6.3 | 2023-02-26 | A vulnerability classified as critical has been found in MuYuCMS 2.2. This affects an unknown part of the file /admin.php/update/getFile.html. The manipulation… |
CVE-2023-1045 | Low | 3.8 | 2023-02-26 | A vulnerability was found in MuYuCMS 2.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin.php/accesso… |
CVE-2023-1044 | Medium | 4.3 | 2023-02-26 | A vulnerability was found in MuYuCMS 2.2. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /editor/i… |
CVE-2023-1043 | Medium | 4.3 | 2023-02-26 | A vulnerability was found in MuYuCMS 2.2. It has been classified as problematic. Affected is an unknown function of the file /editor/index.php. The manipulatio… |
CVE-2023-1042 | Low | 3.5 | 2023-02-26 | A vulnerability has been found in SourceCodester Online Pet Shop We App 1.0 and classified as problematic. This vulnerability affects unknown code of the file… |
CVE-2023-1041 | Low | 3.5 | 2023-02-26 | A vulnerability, which was classified as problematic, was found in SourceCodester Simple Responsive Tourism Website 1.0. This affects an unknown part of the fi… |
CVE-2023-1040 | Medium | 6.3 | 2023-02-26 | A vulnerability, which was classified as critical, has been found in SourceCodester Online Graduate Tracer System 1.0. Affected by this issue is some unknown f… |
CVE-2023-1039 | High | 7.3 | 2023-02-26 | A vulnerability classified as critical was found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown function… |
CVE-2023-1038 | Medium | 6.3 | 2023-02-26 | A vulnerability classified as critical has been found in SourceCodester Online Reviewer Management System 1.0. Affected is an unknown function of the file /rev… |
CVE-2023-1037 | High | 7.3 | 2023-02-26 | A vulnerability was found in SourceCodester Dental Clinic Appointment Reservation System 1.0. It has been rated as critical. This issue affects some unknown pr… |
CVE-2023-1036 | Medium | 4.3 | 2023-02-26 | A vulnerability was found in SourceCodester Dental Clinic Appointment Reservation System 1.0. It has been declared as problematic. This vulnerability affects u… |
CVE-2023-26091 | Medium | 6.1 | 2023-02-26 | The frp_form_answers (aka Forms Export) extension before 3.1.2, and 4.x before 4.0.2, for TYPO3 allows XSS via saved emails. |
CVE-2023-26550 | Critical | 9.8 | 2023-02-25 | A SQL injection vulnerability in BMC Control-M before 9.0.20.214 allows attackers to execute arbitrary SQL commands via the memname JSON field. |
CVE-2023-1035 | Medium | 6.3 | 2023-02-25 | A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been classified as critical. Affected is an unknown function of the f… |
CVE-2023-26104 | High | 7.5 | 2023-02-25 | All versions of the package lite-web-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes control characters th… |
CVE-2023-26103 | Medium | 5.3 | 2023-02-25 | Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains… |
CVE-2023-26545 | Medium | 4.7 | 2023-02-25 | In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registering the sysctl table under a new locati… |
CVE-2023-26544 | High | 7.8 | 2023-02-25 | In the Linux kernel 6.0.8, there is a use-after-free in run_unpack in fs/ntfs3/run.c, related to a difference between NTFS sector size and media sector size. |
CVE-2023-26039 | High | 7.1 | 2023-02-25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33… |
CVE-2023-26038 | Medium | 5.4 | 2023-02-25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33… |
CVE-2023-26037 | High | 8.9 | 2023-02-25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33… |
CVE-2023-26036 | High | 8.1 | 2023-02-25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33… |
CVE-2023-26035 | High | 7.2 | 2023-02-25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33… |
CVE-2023-1034 | High | 8.8 | 2023-02-25 | Path Traversal: '\..\filename' in GitHub repository salesagility/suitecrm prior to 7.12.9. |
CVE-2023-26034 | Critical | 9.6 | 2023-02-25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33… |
CVE-2023-26032 | High | 8.9 | 2023-02-25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33… |
CVE-2023-25825 | High | 7.7 | 2023-02-25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33… |
CVE-2023-1033 | High | 8.8 | 2023-02-25 | Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.11. |
CVE-2023-26033 | High | 7.5 | 2023-02-25 | Gentoo soko is the code that powers packages.gentoo.org. Versions prior to 1.0.1 are vulnerable to SQL Injection, leading to a Denial of Service. If the user s… |
CVE-2023-25821 | Medium | 5.7 | 2023-02-25 | Nextcloud is an Open Source private cloud software. Versions 24.0.4 and above, prior to 24.0.7, and 25.0.0 and above, prior to 25.0.1, contain Improper Access… |
CVE-2023-25816 | Medium | 4.3 | 2023-02-25 | Nextcloud is an Open Source private cloud software. Versions 25.0.0 and above, prior to 25.0.3, are subject to Uncontrolled Resource Consumption. A user can co… |
CVE-2023-24189 | Critical | 9.8 | 2023-02-24 | An XML External Entity (XXE) vulnerability in urule v2.1.7 allows attackers to execute arbitrary code via uploading a crafted XML file to /urule/common/saveFil… |
CVE-2023-1030 | Low | 3.5 | 2023-02-24 | A vulnerability has been found in SourceCodester/code-projects Online Boat Reservation System 1.0 and classified as problematic. Affected by this vulnerability… |
CVE-2023-1029 | Medium | 4.3 | 2023-02-24 | The WP Meta SEO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.3. This is due to missing or incorrect n… |
CVE-2023-0481 | Low | 3.3 | 2023-02-24 | In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile() is used in the FileBodyHandler class which creates temp files with insecure p… |
CVE-2023-23205 | Medium | 5.5 | 2023-02-24 | An issue was discovered in lib60870 v2.3.2. There is a memory leak in lib60870/lib60870-C/examples/multi_client_server/multi_client_server.c. |
CVE-2023-0586 | Medium | 6.4 | 2023-02-24 | The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 4.2.9 due t… |
CVE-2023-0585 | Medium | 4.4 | 2023-02-24 | The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 4.2.9 due t… |
CVE-2023-25956 | High | 7.5 | 2023-02-24 | Generation of Error Message Containing Sensitive Information vulnerability in the Apache Airflow AWS Provider. This issue affects Apache Airflow AWS Provider… |
CVE-2023-25696 | Critical | 9.8 | 2023-02-24 | Improper Input Validation vulnerability in the Apache Airflow Hive Provider. This issue affects Apache Airflow Hive Provider versions before 5.1.3. |
CVE-2023-25693 | Critical | 9.8 | 2023-02-24 | Improper Input Validation vulnerability in the Apache Airflow Sqoop Provider. This issue affects Apache Airflow Sqoop Provider versions before 3.1.1. |
CVE-2023-25692 | High | 7.5 | 2023-02-24 | Improper Input Validation vulnerability in the Apache Airflow Google Provider. This issue affects Apache Airflow Google Provider versions before 8.10.0. |
CVE-2023-25691 | Critical | 9.8 | 2023-02-24 | Improper Input Validation vulnerability in the Apache Airflow Google Provider. This issue affects Apache Airflow Google Provider versions before 8.10.0. |
CVE-2023-1010 | Medium | 5.3 | 2023-02-24 | A vulnerability classified as critical was found in vox2png 1.0. Affected by this vulnerability is an unknown functionality of the file vox2png.c. The manipula… |
CVE-2023-1009 | Medium | 6.5 | 2023-02-24 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5. Affected is the function sub_1DF14… |
CVE-2023-1008 | Medium | 5.5 | 2023-02-24 | A vulnerability was found in Twister Antivirus 8.17. It has been rated as problematic. This issue affects the function 0x801120E4 in the library filmfd.sys of… |
CVE-2023-1007 | Medium | 5.3 | 2023-02-24 | A vulnerability was found in Twister Antivirus 8.17. It has been declared as critical. This vulnerability affects the function 0x801120E4 in the library filmfd… |
CVE-2023-0595 | Medium | 5.3 | 2023-02-24 | A CWE-117: Improper Output Neutralization for Logs vulnerability exists that could cause the misinterpretation of log files when malicious packets are sent to… |
CVE-2023-1006 | Low | 3.5 | 2023-02-24 | A vulnerability was found in SourceCodester Medical Certificate Generator App 1.0. It has been classified as problematic. This affects an unknown part of the c… |
CVE-2023-1005 | Medium | 5.3 | 2023-02-24 | A vulnerability was found in JP1016 Markdown-Electron and classified as critical. Affected by this issue is some unknown functionality. The manipulation leads… |
CVE-2023-1004 | Medium | 5.3 | 2023-02-24 | A vulnerability has been found in MarkText up to 0.17.1 on Windows and classified as critical. Affected by this vulnerability is an unknown functionality of th… |
CVE-2023-1002 | Medium | 4.3 | 2023-02-24 | A vulnerability, which was classified as problematic, has been found in MuYuCMS 2.2. This issue affects some unknown processing of the file index.php. The mani… |
CVE-2023-0999 | Medium | 4.3 | 2023-02-24 | A vulnerability classified as problematic was found in SourceCodester Sales Tracker Management System 1.0. This vulnerability affects unknown code of the file… |
CVE-2023-0998 | Medium | 6.5 | 2023-02-24 | A vulnerability classified as critical has been found in SourceCodester Alphaware Simple E-Commerce System 1.0. This affects an unknown part of the file /alpha… |
CVE-2023-0997 | High | 7.3 | 2023-02-24 | A vulnerability was found in SourceCodester Moosikay E-Commerce System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2023-22427 | Medium | 4.8 | 2023-02-24 | Stored cross-site scripting vulnerability in Theme switching function of SHIRASAGI v1.16.2 and earlier versions allows a remote attacker with an administrative… |
CVE-2023-22425 | Medium | 5.4 | 2023-02-24 | Stored cross-site scripting vulnerability in Schedule function of SHIRASAGI v1.16.2 and earlier versions allows a remote authenticated attacker to inject an ar… |
CVE-2023-26102 | High | 7.5 | 2023-02-24 | All versions of the package rangy are vulnerable to Prototype Pollution when using the extend() function in file rangy-core.js.The function uses recursive merg… |
CVE-2023-0996 | High | 7.8 | 2023-02-24 | There is a vulnerability in the strided image data parsing code in the emscripten wrapper for libheif. An attacker could exploit this through a crafted image… |
CVE-2023-0995 | Medium | 5.4 | 2023-02-24 | Cross-site Scripting (XSS) - Stored in GitHub repository unilogies/bumsys prior to v2.0.1. |
CVE-2023-0994 | High | 7.5 | 2023-02-24 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository francoisjacquet/rosariosis prior to 10.8.2. |
CVE-2023-26468 | Critical | 9.1 | 2023-02-24 | Cerebrate 1.12 does not properly consider organisation_id during creation of API keys. |
CVE-2023-24212 | Critical | 9.8 | 2023-02-23 | Tenda AX3 V16.03.12.11 was discovered to contain a stack overflow via the timeType function at /goform/SetSysTimeCfg. |
CVE-2023-23296 | Medium | 6.5 | 2023-02-23 | Korenix JetWave 4200 Series 1.3.0 and JetWave 3200 Series 1.6.0 are vulnerable to Denial of Service via /goform/formDefault. |
CVE-2023-23295 | High | 8.8 | 2023-02-23 | Korenix Jetwave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection via /goform/formSysCmd. An attacker an modify the sysCmd pa… |
CVE-2023-23294 | High | 8.8 | 2023-02-23 | Korenix JetWave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection. An attacker can modify the file_name parameter to execute… |
CVE-2023-25824 | High | 7.5 | 2023-02-23 | Mod_gnutls is a TLS module for Apache HTTPD based on GnuTLS. Versions from 0.9.0 to 0.12.0 (including) did not properly fail blocking read operations on TLS co… |
CVE-2023-25823 | Medium | 5.4 | 2023-02-23 | Gradio is an open-source Python library to build machine learning and data science demos and web applications. Versions prior to 3.13.1 contain Use of Hard-cod… |
CVE-2023-24205 | Critical | 9.8 | 2023-02-23 | Clash for Windows v0.20.12 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via overwriting the configuration file (cfw… |
CVE-2023-0755 | Critical | 9.8 | 2023-02-23 | The affected products are vulnerable to an improper validation of array index, which could allow an attacker to crash the server and remotely execute arbitrar… |
CVE-2023-0754 | Critical | 9.8 | 2023-02-23 | The affected products are vulnerable to an integer overflow or wraparound, which could allow an attacker to crash the server and remotely execute arbitrary c… |