2023 CVEs (page 29)
Page 29 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-24531 | Critical | 9.8 | 2024-07-02 | Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a… |
CVE-2023-51778 | Medium | 5.5 | 2024-07-02 | Out-of-Bounds Write vulnerability in Jungo WinDriver before 12.1.0 allows local attackers to cause a Windows blue screen error and Denial of Service (DoS). |
CVE-2023-51777 | Medium | 5.5 | 2024-07-02 | Denial of Service (DoS) vulnerability in Jungo WinDriver before 12.1.0 allows local attackers to cause a Windows blue screen error. |
CVE-2023-51776 | High | 7.8 | 2024-07-02 | Improper privilege management in Jungo WinDriver before 12.1.0 allows local attackers to escalate privileges and execute arbitrary code. |
CVE-2023-41928 | Medium | 5.3 | 2024-07-02 | The device is observed to accept deprecated TLS protocols, increasing the risk of cryptographic weaknesses. |
CVE-2023-41927 | Medium | 5.3 | 2024-07-02 | The server supports at least one cipher suite which is on the NCSC-NL list of cipher suites to be phased out, increasing the risk of cryptographic weaknesses. |
CVE-2023-41926 | High | 8.8 | 2024-07-02 | The webserver utilizes basic authentication for its user login to the configuration interface. As encryption is disabled on port 80, it enables potential eaves… |
CVE-2023-41923 | High | 7.2 | 2024-07-02 | The user management section of the web application permits the creation of user accounts with excessively weak passwords, including single-character passwords. |
CVE-2023-41922 | High | 7.2 | 2024-07-02 | A 'Cross-site Scripting' (XSS) vulnerability, characterized by improper input neutralization during web page generation, has been discovered. This vulnerabilit… |
CVE-2023-41921 | Critical | 9.8 | 2024-07-02 | A vulnerability allows attackers to download source code or an executable from a remote location and execute the code without sufficiently verifying the origin… |
CVE-2023-41920 | Critical | 9.8 | 2024-07-02 | The vulnerability allows attackers access to the root account without having to authenticate. Specifically, if the device is configured with the IP address of… |
CVE-2023-41919 | Critical | 9.8 | 2024-07-02 | Hardcoded credentials are discovered within the application's source code, creating a potential security risk for unauthorized access. |
CVE-2023-41918 | Critical | 10.0 | 2024-07-02 | A vulnerability allows unauthorized access to functionality inadequately constrained by ACLs. Attackers may exploit this to unauthenticated execute commands po… |
CVE-2023-41917 | Critical | 10.0 | 2024-07-02 | Inadequate input validation exposes the system to potential remote code execution (RCE) risks. Attackers can exploit this vulnerability by appending shell comm… |
CVE-2023-43554 | High | 8.4 | 2024-07-01 | Memory corruption while processing IOCTL handler in FastRPC. |
CVE-2023-50964 | Medium | 5.4 | 2024-06-30 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2023-50953 | Medium | 5.4 | 2024-06-30 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. This… |
CVE-2023-50952 | Medium | 5.4 | 2024-06-30 | IBM InfoSphere Information Server 11.7 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized reque… |
CVE-2023-50954 | Medium | 4.3 | 2024-06-30 | IBM InfoSphere Information Server 11.7 returns sensitive information in URL information that could be used in further attacks against the system. IBM X-Force… |
CVE-2023-35022 | Low | 3.3 | 2024-06-30 | IBM InfoSphere Information Server 11.7 could allow a local user to update projects that they do not have the authorization to access. IBM X-Force ID: 258254. |
CVE-2023-4017 | Medium | 6.1 | 2024-06-29 | The Goya theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘attra-color’, 'attra-size', and 'product-cata' parameters in versions up… |
CVE-2023-47803 | Medium | 5.3 | 2024-06-28 | A vulnerability regarding improper limitation of a pathname to a restricted directory ('Path Traversal') is found in the Language Settings functionality. This… |
CVE-2023-47802 | High | 7.2 | 2024-06-28 | A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is found in the IP block functionality. Th… |
CVE-2023-52892 | High | 7.5 | 2024-06-27 | In phpseclib before 1.0.22, 2.x before 2.0.46, and 3.x before 3.0.33, some characters in Subject Alternative Name fields in TLS certificates are incorrectly al… |
CVE-2023-38370 | High | 7.5 | 2024-06-27 | IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1, under certain configurations, could allow a user on the network to install malicious packages. I… |
CVE-2023-38368 | Medium | 5.5 | 2024-06-27 | IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could disclose sensitive information to a local user to do improper permission controls. IBM X-Fo… |
CVE-2023-30998 | High | 7.8 | 2024-06-27 | IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain root access due to improper access controls. IBM X-Force ID… |
CVE-2023-30997 | High | 7.8 | 2024-06-27 | IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain root access due to improper access controls. IBM X-Force ID… |
CVE-2023-42014 | Medium | 5.4 | 2024-06-27 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.2.0.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to… |
CVE-2023-42011 | Medium | 4.3 | 2024-06-27 | IBM Sterling B2B Integrator Standard Edition 6.1 and 6.2 does not restrict or incorrectly restricts frame objects or UI layers that belong to another applicati… |
CVE-2023-38371 | Medium | 5.9 | 2024-06-27 | IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly… |
CVE-2023-30430 | Medium | 5.5 | 2024-06-27 | IBM Security Verify Access 10.0.0 through 10.0.7.1 could allow a local user to obtain sensitive information from trace logs. IBM X-Force ID: 252183. |
CVE-2023-7270 | Medium | 5.3 | 2024-06-27 | An issue was discovered in SoftMaker Office 2024 / NX before revision 1214 and SoftMaker FreeOffice 2014 before revision 1215. FreeOffice 2021 is also affected… |
CVE-2023-26877 | Medium | 6.3 | 2024-06-26 | File upload vulnerability found in Softexpert Excellence Suite v.2.1 allows attackers to execute arbitrary code via a .php file upload to the form/efms_exec_ht… |
CVE-2023-37541 | Low | 3.5 | 2024-06-25 | HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios. |
CVE-2023-5038 | High | 7.5 | 2024-06-25 | badmonkey, a Security Researcher has found a flaw that allows for a unauthenticated DoS attack on the camera. An attacker runs a crafted URL, nobody can access… |
CVE-2023-6198 | Critical | 9.3 | 2024-06-25 | Use of Hard-coded Credentials vulnerability in Baicells Snap Router BaiCE_BMI on EP3011 (User Passwords modules) allows unauthorized access to the device. |
CVE-2023-50029 | Critical | 10.0 | 2024-06-24 | PHP Injection vulnerability in the module "M4 PDF Extensions" (m4pdf) up to version 3.3.2 from PrestaAddons for PrestaShop allows attackers to run arbitrary co… |
CVE-2023-45195 | Medium | 5.3 | 2024-06-24 | Adminer and AdminerEvo are vulnerable to SSRF via database connection fields. This could allow an unauthenticated remote attacker to enumerate or access system… |
CVE-2023-45196 | High | 7.5 | 2024-06-24 | Adminer and AdminerEvo allow an unauthenticated remote attacker to cause a denial of service by connecting to an attacker-controlled service that responds with… |
CVE-2023-49793 | Medium | 6.5 | 2024-06-24 | CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Zip files uploaded to the server endpoin… |
CVE-2023-45673 | High | 8.9 | 2024-06-21 | Joplin is a free, open source note taking and to-do application. A remote code execution (RCE) vulnerability in affected versions allows clicking on a link in… |
CVE-2023-39517 | High | 8.2 | 2024-06-21 | Joplin is a free, open source note taking and to-do application. A Cross site scripting (XSS) vulnerability in affected versions allows clicking on an untruste… |
CVE-2023-38506 | High | 8.2 | 2024-06-21 | Joplin is a free, open source note taking and to-do application. A Cross-site Scripting (XSS) vulnerability allows pasting untrusted data into the rich text ed… |
CVE-2023-37898 | High | 8.2 | 2024-06-21 | Joplin is a free, open source note taking and to-do application. A Cross-site Scripting (XSS) vulnerability allows an untrusted note opened in safe mode to exe… |
CVE-2023-38389 | Critical | 9.8 | 2024-06-21 | Incorrect Authorization vulnerability in Artbees JupiterX Core allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JupiterX Core… |
CVE-2023-45197 | Critical | 9.8 | 2024-06-21 | The file upload plugin in Adminer and AdminerEvo allows an attacker to upload a file with a table name of “..” to the root of the Adminer directory. The attack… |
CVE-2023-51375 | Medium | 4.3 | 2024-06-21 | Missing Authorization vulnerability in WPDeveloper EmbedPress.This issue affects EmbedPress: from n/a through 3.8.3. |
CVE-2023-52884 | Medium | 4.4 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: Input: cyapa - add missing input core locking to suspend/resume functions Grab input->mut… |
CVE-2023-3352 | Medium | 4.3 | 2024-06-21 | The Smush plugin for WordPress is vulnerable to unauthorized deletion of the resmush list due to a missing capability check on the delete_resmush_list() functi… |
CVE-2023-49113 | High | 7.8 | 2024-06-20 | The Kiuwan Local Analyzer (KLA) Java scanning application contains several hard-coded secrets in plain text format. In some cases, this can potentially compr… |
CVE-2023-49112 | Medium | 6.5 | 2024-06-20 | Kiuwan provides an API endpoint /saas/rest/v1/info/application to get information about any application, providing only its name via the "application" param… |
CVE-2023-49111 | Medium | 6.5 | 2024-06-20 | For Kiuwan installations with SSO (single sign-on) enabled, an unauthenticated reflected cross-site scripting attack can be performed on the login page "logi… |
CVE-2023-49110 | High | 7.2 | 2024-06-20 | When the Kiuwan Local Analyzer uploads the scan results to the Kiuwan SAST web application (either on-premises or cloud/SaaS solution), the transmitted data … |
CVE-2023-52883 | High | 7.5 | 2024-06-20 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix possible null pointer dereference abo->tbo.resource may be NULL in amdgpu… |
CVE-2023-25646 | High | 7.1 | 2024-06-20 | There is an unauthorized access vulnerability in ZTE H388X. If H388X is caused by brute-force serial port cracking,attackers with common user permissions can u… |
CVE-2023-3204 | Medium | 6.5 | 2024-06-20 | The Materialis theme for WordPress is vulnerable to limited arbitrary options updates in versions up to, and including, 1.1.24. This is due to missing authoriz… |
CVE-2023-39312 | Critical | 9.1 | 2024-06-19 | Missing Authorization vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1. |
CVE-2023-38394 | Medium | 5.4 | 2024-06-19 | Missing Authorization vulnerability in Artbees JupiterX Core.This issue affects JupiterX Core: from 3.0.0 through 3.3.0. |
CVE-2023-38393 | High | 7.6 | 2024-06-19 | Missing Authorization vulnerability in Saturday Drive Ninja Forms.This issue affects Ninja Forms: from n/a through 3.6.25. |
CVE-2023-36516 | High | 7.6 | 2024-06-19 | Missing Authorization vulnerability in ThimPress LearnPress.This issue affects LearnPress: from n/a through 4.2.3. |
CVE-2023-36515 | High | 7.3 | 2024-06-19 | Missing Authorization vulnerability in ThimPress LearnPress.This issue affects LearnPress: from n/a through 4.2.3. |
CVE-2023-25697 | Medium | 5.4 | 2024-06-19 | Cross-Site Request Forgery (CSRF) vulnerability in GamiPress.This issue affects GamiPress: from n/a through 2.5.6. |
CVE-2023-39310 | Medium | 5.4 | 2024-06-19 | Missing Authorization vulnerability in ThemeFusion Fusion Builder.This issue affects Fusion Builder: from n/a through 3.11.1. |
CVE-2023-37872 | Medium | 6.5 | 2024-06-19 | Missing Authorization vulnerability in Woo WooCommerce Ship to Multiple Addresses.This issue affects WooCommerce Ship to Multiple Addresses: from n/a through 3… |
CVE-2023-37869 | Medium | 6.5 | 2024-06-19 | Missing Authorization vulnerability in Premium Addons Premium Addons PRO.This issue affects Premium Addons PRO: from n/a through 2.9.0. |
CVE-2023-36684 | High | 7.1 | 2024-06-19 | Missing Authorization vulnerability in Brainstorm Force Convert Pro.This issue affects Convert Pro: from n/a through 1.7.5. |
CVE-2023-36683 | Medium | 6.5 | 2024-06-19 | Missing Authorization vulnerability in WP SCHEMA PRO Schema Pro.This issue affects Schema Pro: from n/a through 2.7.8. |
CVE-2023-36676 | Medium | 5.4 | 2024-06-19 | Missing Authorization vulnerability in Brainstorm Force Spectra.This issue affects Spectra: from n/a through 2.6.6. |
CVE-2023-41805 | Medium | 6.5 | 2024-06-19 | Missing Authorization vulnerability in Brainstorm Force Premium Starter Templates, Brainstorm Force Starter Templates astra-sites.This issue affects Premium St… |
CVE-2023-39998 | High | 8.2 | 2024-06-19 | Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 27.1.1. |
CVE-2023-39993 | Medium | 4.3 | 2024-06-19 | Missing Authorization vulnerability in Wpmet Elements kit Elementor addons.This issue affects Elements kit Elementor addons: from n/a through 2.9.0. |
CVE-2023-39990 | Medium | 5.4 | 2024-06-19 | Missing Authorization vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 1.2.3. |
CVE-2023-39922 | Medium | 4.3 | 2024-06-19 | Missing Authorization vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1. |
CVE-2023-38386 | High | 7.6 | 2024-06-19 | Missing Authorization vulnerability in Saturday Drive Ninja Forms.This issue affects Ninja Forms: from n/a through 3.6.25. |
CVE-2023-37870 | High | 8.1 | 2024-06-19 | Missing Authorization vulnerability in Woo WooCommerce Warranty Requests.This issue affects WooCommerce Warranty Requests: from n/a through 2.1.9. |
CVE-2023-36512 | Medium | 6.5 | 2024-06-19 | Missing Authorization vulnerability in Woo AutomateWoo.This issue affects AutomateWoo: from n/a through 5.7.5. |
CVE-2023-35050 | Medium | 5.4 | 2024-06-19 | Missing Authorization vulnerability in Elementor Elementor Pro.This issue affects Elementor Pro: from n/a through 3.13.0. |
CVE-2023-35049 | High | 7.5 | 2024-06-19 | Missing Authorization vulnerability in WooCommerce WooCommerce Stripe Payment Gateway.This issue affects WooCommerce Stripe Payment Gateway: from n/a through 7… |
CVE-2023-47770 | High | 7.6 | 2024-06-19 | Missing Authorization vulnerability in Muffin Group Betheme.This issue affects Betheme: from n/a through 27.1.1. |
CVE-2023-47681 | Medium | 6.5 | 2024-06-19 | Missing Authorization vulnerability in QuadLayers WooCommerce Checkout Manager.This issue affects WooCommerce Checkout Manager: from n/a through 7.3.0. |
CVE-2023-46148 | High | 8.8 | 2024-06-19 | Missing Authorization vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5. |
CVE-2023-46146 | High | 8.3 | 2024-06-19 | Missing Authorization vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5. |
CVE-2023-45658 | High | 7.6 | 2024-06-19 | Missing Authorization vulnerability in POSIMYTH Nexter.This issue affects Nexter: from n/a through 2.0.3. |
CVE-2023-44151 | Medium | 5.4 | 2024-06-19 | Missing Authorization vulnerability in Brainstorm Force Pre-Publish Checklist.This issue affects Pre-Publish Checklist: from n/a through 1.1.1. |
CVE-2023-44148 | Medium | 5.4 | 2024-06-19 | Missing Authorization vulnerability in Brainstorm Force Astra Bulk Edit.This issue affects Astra Bulk Edit: from n/a through 1.2.7. |
CVE-2023-40608 | High | 8.2 | 2024-06-19 | Missing Authorization vulnerability in Paid Memberships Pro Paid Memberships Pro CCBill Gateway.This issue affects Paid Memberships Pro CCBill Gateway: from n/… |
CVE-2023-40004 | High | 7.3 | 2024-06-19 | Missing Authorization vulnerability in ServMask All-in-One WP Migration Box Extension, ServMask All-in-One WP Migration OneDrive Extension, ServMask All-in-One… |
CVE-2023-48761 | Medium | 6.3 | 2024-06-19 | Missing Authorization vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.13. |
CVE-2023-48760 | High | 8.2 | 2024-06-19 | Missing Authorization vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.13. |
CVE-2023-48759 | High | 7.5 | 2024-06-19 | Missing Authorization vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.13. |
CVE-2023-47788 | Medium | 4.3 | 2024-06-19 | Missing Authorization vulnerability in Automattic Jetpack.This issue affects Jetpack: from n/a before 12.7. |
CVE-2023-47783 | High | 8.3 | 2024-06-19 | Missing Authorization vulnerability in Thrive Themes Thrive Theme Builder.This issue affects Thrive Theme Builder: from n/a before 3.24.0. |
CVE-2023-47771 | High | 8.3 | 2024-06-19 | Missing Authorization vulnerability in ThemePunch OHG Essential Grid.This issue affects Essential Grid: from n/a through 3.0.18. |
CVE-2023-50900 | Medium | 4.3 | 2024-06-19 | Cross-Site Request Forgery (CSRF) vulnerability in Averta Master Slider.This issue affects Master Slider: from n/a through 3.9.10. |
CVE-2023-6495 | Medium | 4.4 | 2024-06-19 | The YARPP – Yet Another Related Posts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and inc… |
CVE-2023-6692 | Medium | 6.4 | 2024-06-19 | The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tab anchor metabox in all vers… |
CVE-2023-47726 | High | 7.1 | 2024-06-18 | IBM QRadar Suite Software 1.10.12.0 through 1.10.21.0 and IBM Cloud Pak for Security 1.10.12.0 through 1.10.21.0 could allow an authenticated user to execute c… |
CVE-2023-5527 | High | 7.4 | 2024-06-18 | The Business Directory Plugin plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 6.4.3 via the class-csv-exporter.php file… |
CVE-2023-37058 | Critical | 9.8 | 2024-06-17 | Insecure Permissions vulnerability in JLINK Unionman Technology Co. Ltd Jlink AX1800 v.1.0 allows a remote attacker to escalate privileges via a crafted comman… |