2023 CVEs (page 290)
Page 290 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-26326 | Critical | 9.8 | 2023-02-23 | The BuddyForms WordPress plugin, in versions prior to 2.7.8, was affected by an unauthenticated insecure deserialization issue. An unauthenticated attacker cou… |
CVE-2023-26325 | High | 8.8 | 2023-02-23 | The 'rx_export_review' action in the ReviewX WordPress Plugin, is affected by an authenticated SQL injection vulnerability in the 'filterValue' and 'selectedCo… |
CVE-2023-24317 | High | 8.1 | 2023-02-23 | Judging Management System 1.0 was discovered to contain an arbitrary file upload vulnerability via the component edit_organizer.php. |
CVE-2023-23920 | Medium | 4.2 | 2023-02-23 | An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load… |
CVE-2023-23919 | High | 7.5 | 2023-02-23 | A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after opera… |
CVE-2023-23918 | High | 7.5 | 2023-02-23 | A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (h… |
CVE-2023-23917 | High | 8.8 | 2023-02-23 | A prototype pollution vulnerability exists in Rocket.Chat server <5.2.0 that could allow an attacker to a RCE under the admin account. Any user can create thei… |
CVE-2023-23916 | Medium | 6.5 | 2023-02-23 | An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that… |
CVE-2023-23915 | Medium | 6.5 | 2023-02-23 | A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple… |
CVE-2023-23914 | Critical | 9.1 | 2023-02-23 | A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are request… |
CVE-2023-20089 | High | 7.4 | 2023-02-23 | A vulnerability in the Link Layer Discovery Protocol (LLDP) feature for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) Mod… |
CVE-2023-20050 | Medium | 4.4 | 2023-02-23 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2023-20016 | Medium | 6.3 | 2023-02-23 | A vulnerability in the backup configuration feature of Cisco UCS Manager Software and in the configuration export feature of Cisco FXOS Software could allow an… |
CVE-2023-20015 | Medium | 6.0 | 2023-02-23 | A vulnerability in the CLI of Cisco Firepower 4100 Series, Cisco Firepower 9300 Security Appliances, and Cisco UCS 6200, 6300, 6400, and 6500 Series Fabric Int… |
CVE-2023-20012 | Medium | 5.3 | 2023-02-23 | A vulnerability in the CLI console login authentication of Cisco Nexus 9300-FX3 Series Fabric Extender (FEX) when used in UCS Fabric Interconnect deployments c… |
CVE-2023-20011 | High | 8.8 | 2023-02-23 | A vulnerability in the web-based management interface of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Network Controller, formerly… |
CVE-2023-0597 | Medium | 5.5 | 2023-02-23 | A flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping of X86 CPU data to memory was found in the way user can guess location of exceptio… |
CVE-2023-0044 | Medium | 6.1 | 2023-02-23 | If the Quarkus Form Authentication session cookie Path attribute is set to `/` then a cross-site attack may be initiated which might lead to the Information Di… |
CVE-2023-22476 | Medium | 4.3 | 2023-02-23 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions prior to 2.25.6, due to insufficient access-level checks, any logged-in user allowed… |
CVE-2023-24415 | Medium | 5.4 | 2023-02-23 | Cross-Site Request Forgery (CSRF) vulnerability in QuantumCloud AI ChatBot plugin <= 4.2.8 versions. |
CVE-2023-24104 | Critical | 9.8 | 2023-02-23 | Ubiquiti Networks UniFi Dream Machine Pro v7.2.95 allows attackers to bypass domain restrictions via crafted packets. |
CVE-2023-0988 | Medium | 4.3 | 2023-02-23 | A vulnerability, which was classified as problematic, has been found in SourceCodester Online Pizza Ordering System 1.0. This issue affects some unknown proces… |
CVE-2023-0987 | Low | 3.5 | 2023-02-23 | A vulnerability classified as problematic was found in SourceCodester Online Pizza Ordering System 1.0. This vulnerability affects unknown code of the file ind… |
CVE-2023-0986 | Medium | 6.3 | 2023-02-23 | A vulnerability classified as critical has been found in SourceCodester Sales Tracker Management System 1.0. This affects an unknown part of the file admin/?pa… |
CVE-2023-24384 | Medium | 4.3 | 2023-02-23 | Cross-Site Request Forgery (CSRF) vulnerability in WpDevArt Organization chart <= 1.4.4 versions. |
CVE-2023-23659 | Medium | 4.3 | 2023-02-23 | Cross-Site Request Forgery (CSRF) vulnerability in MainWP Matomo Extension <= 4.0.4 versions. |
CVE-2023-0869 | Medium | 5.8 | 2023-02-23 | Cross-site scripting in outage/list.htm in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The… |
CVE-2023-0868 | Medium | 6.7 | 2023-02-23 | Reflected cross-site scripting in graph results in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to steal session cookies. U… |
CVE-2023-0867 | Medium | 6.7 | 2023-02-23 | Multiple stored and reflected cross-site scripting vulnerabilities in webapp jsp pages in multiple versions of OpenNMS Meridian and Horizon could allow an atta… |
CVE-2023-0815 | Medium | 6.8 | 2023-02-23 | Potential Insertion of Sensitive Information into Jetty Log Files in multiple versions of OpenNMS Meridian and Horizon could allow disclosure of usernames and… |
CVE-2023-0982 | Medium | 6.3 | 2023-02-23 | A vulnerability was found in SourceCodester Yoga Class Registration System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown… |
CVE-2023-0981 | Medium | 6.3 | 2023-02-23 | A vulnerability was found in SourceCodester Yoga Class Registration System 1.0. It has been classified as critical. Affected is an unknown function of the comp… |
CVE-2023-0980 | Medium | 6.3 | 2023-02-23 | A vulnerability was found in SourceCodester Yoga Class Registration System 1.0 and classified as critical. This issue affects some unknown processing of the fi… |
CVE-2023-25621 | Medium | 6.5 | 2023-02-23 | Privilege Escalation vulnerability in Apache Software Foundation Apache Sling. Any content author is able to create i18n dictionaries in the repository in a lo… |
CVE-2023-0939 | Critical | 9.8 | 2023-02-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NTN Information Technologies Online Services Software all… |
CVE-2023-26462 | High | 8.1 | 2023-02-23 | ThingsBoard 3.4.1 could allow a remote attacker to gain elevated privileges because hard-coded service credentials (usable for privilege escalation) are stored… |
CVE-2023-26303 | Low | 3.3 | 2023-02-23 | Denial of service could be caused to markdown-it-py, before v2.2.0, if an attacker was allowed to force null assertions with specially crafted input. |
CVE-2023-26302 | Low | 3.3 | 2023-02-22 | Denial of service could be caused to the command line interface of markdown-it-py, before v2.2.0, if an attacker was allowed to use invalid UTF-8 characters as… |
CVE-2023-24114 | Critical | 9.8 | 2023-02-22 | typecho 1.1/17.10.30 was discovered to contain a remote code execution (RCE) vulnerability via install.php. |
CVE-2023-22974 | High | 7.5 | 2023-02-22 | A Path Traversal in setup.php in OpenEMR < 7.0.0 allows remote unauthenticated users to read arbitrary files by controlling a connection to an attacker-control… |
CVE-2023-22973 | High | 8.8 | 2023-02-22 | A Local File Inclusion (LFI) vulnerability in interface/forms/LBF/new.php in OpenEMR < 7.0.0 allows remote authenticated users to execute code via the formname… |
CVE-2023-22972 | Medium | 5.4 | 2023-02-22 | A Reflected Cross-site scripting (XSS) vulnerability in interface/forms/eye_mag/php/eye_mag_functions.php in OpenEMR < 7.0.0 allows remote authenticated users… |
CVE-2023-0104 | Critical | 9.3 | 2023-02-22 | The listed versions for Weintek EasyBuilder Pro are vulnerable to a ZipSlip attack caused by decompiling a malicious project file. This may allow an attacker… |
CVE-2023-24812 | High | 8.8 | 2023-02-22 | Misskey is an open source, decentralized social media platform. In versions prior to 13.3.3 SQL injection is possible due to insufficient parameter validation… |
CVE-2023-24811 | High | 7.1 | 2023-02-22 | Misskey is an open source, decentralized social media platform. In versions prior to 13.3.2 the URL preview function is subject to a cross site scripting vulne… |
CVE-2023-24810 | High | 7.1 | 2023-02-22 | Misskey is an open source, decentralized social media platform. Due to insufficient validation of the redirect URL during `miauth` authentication in Misskey, a… |
CVE-2023-24093 | Critical | 9.8 | 2023-02-22 | An access control issue in H3C A210-G A210-GV100R005 allows attackers to authenticate without a password. |
CVE-2023-0966 | Low | 2.4 | 2023-02-22 | A vulnerability classified as problematic was found in SourceCodester Online Eyewear Shop 1.0. Affected by this vulnerability is an unknown functionality of th… |
CVE-2023-0941 | High | 8.8 | 2023-02-22 | Use after free in Prompts in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (C… |
CVE-2023-0933 | High | 8.8 | 2023-02-22 | Integer overflow in PDF in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chro… |
CVE-2023-0932 | High | 8.8 | 2023-02-22 | Use after free in WebRTC in Google Chrome on Windows prior to 110.0.5481.177 allowed a remote attacker who convinced the user to engage in specific UI interact… |
CVE-2023-0931 | High | 8.8 | 2023-02-22 | Use after free in Video in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2023-0930 | High | 8.8 | 2023-02-22 | Heap buffer overflow in Video in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2023-0929 | High | 8.8 | 2023-02-22 | Use after free in Vulkan in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2023-0928 | High | 8.8 | 2023-02-22 | Use after free in SwiftShader in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2023-0927 | High | 8.8 | 2023-02-22 | Use after free in Web Payments API in Google Chrome on Android prior to 110.0.5481.177 allowed a remote attacker who had compromised the renderer process to po… |
CVE-2023-25813 | Critical | 10.0 | 2023-02-22 | Sequelize is a Node.js ORM tool. In versions prior to 6.19.1 a SQL injection exploit exists related to replacements. Parameters which are passed through replac… |
CVE-2023-25579 | Medium | 6.0 | 2023-02-22 | Nextcloud server is a self hosted home cloud product. In affected versions the `OC\Files\Node\Folder::getFullPath()` function was validating and normalizing th… |
CVE-2023-25154 | High | 7.1 | 2023-02-22 | Misskey is an open source, decentralized social media platform. In versions prior to 13.5.0 the link to the instance to the sender that appears when viewing a… |
CVE-2023-0964 | Medium | 5.0 | 2023-02-22 | A vulnerability classified as critical has been found in SourceCodester Sales Tracker Management System 1.0. Affected is an unknown function of the file admin/… |
CVE-2023-0963 | High | 7.3 | 2023-02-22 | A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been rated as critical. This issue affects some unknown processing of the file Users… |
CVE-2023-0962 | Medium | 6.3 | 2023-02-22 | A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been declared as critical. This vulnerability affects unknown code of the file Maste… |
CVE-2023-0961 | Medium | 6.3 | 2023-02-22 | A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been classified as critical. This affects an unknown part of the file view_music_det… |
CVE-2023-0846 | Medium | 6.7 | 2023-02-22 | Unauthenticated, stored cross-site scripting in the display of alarm reduction keys in multiple versions of OpenNMS Horizon and Meridian could allow an attacke… |
CVE-2023-26214 | High | 7.3 | 2023-02-22 | The BusinessConnect UI component of TIBCO Software Inc.'s TIBCO BusinessConnect contains easily exploitable Reflected Cross Site Scripting (XSS) vulnerabilitie… |
CVE-2023-0960 | Medium | 4.7 | 2023-02-22 | A vulnerability was found in SeaCMS 11.6 and classified as problematic. Affected by this issue is some unknown functionality of the file /data/config.ftp.php o… |
CVE-2023-23040 | High | 7.5 | 2023-02-22 | TP-Link router TL-WR940N V6 3.19.1 Build 180119 uses a deprecated MD5 algorithm to hash the admin password used for basic authentication. |
CVE-2023-23039 | Medium | 5.7 | 2023-02-22 | An issue was discovered in the Linux kernel through 6.2.0-rc2. drivers/tty/vcc.c has a race condition and resultant use-after-free if a physically proximate at… |
CVE-2023-23063 | High | 7.5 | 2023-02-22 | Cellinx NVT v1.0.6.002b was discovered to contain a local file disclosure vulnerability via the component /cgi-bin/GetFileContent.cgi. |
CVE-2023-0949 | Medium | 4.8 | 2023-02-22 | Cross-site Scripting (XSS) - Reflected in GitHub repository modoboa/modoboa prior to 2.0.5. |
CVE-2023-26314 | High | 8.8 | 2023-02-22 | The mono package before 6.8.0.105+dfsg-3.3 for Debian allows arbitrary code execution because the application/x-ms-dos-executable MIME type is associated with… |
CVE-2023-24108 | Critical | 9.8 | 2023-02-22 | MvcTools 6d48cd6830fc1df1d8c9d61caa1805fd6a1b7737 was discovered to contain a code execution backdoor via the request package (requirements.txt). This vulnerab… |
CVE-2023-24107 | Critical | 9.8 | 2023-02-22 | hour_of_code_python_2015 commit 520929797b9ca43bb818b2e8f963fb2025459fa3 was discovered to contain a code execution backdoor via the request package (requireme… |
CVE-2023-0947 | Critical | 9.8 | 2023-02-22 | Path Traversal in GitHub repository flatpressblog/flatpress prior to 1.3. |
CVE-2023-20858 | High | 7.2 | 2023-02-22 | VMware Carbon Black App Control 8.7.x prior to 8.7.8, 8.8.x prior to 8.8.6, and 8.9.x.prior to 8.9.4 contain an injection vulnerability. A malicious actor with… |
CVE-2023-20855 | High | 8.8 | 2023-02-22 | VMware vRealize Orchestrator contains an XML External Entity (XXE) vulnerability. A malicious actor, with non-administrative access to vRealize Orchestrator, m… |
CVE-2023-24081 | Medium | 5.4 | 2023-02-21 | Multiple stored cross-site scripting (XSS) vulnerabilities in Redrock Software TutorTrac before v4.2.170210 allows attackers to execute arbitrary web scripts o… |
CVE-2023-24080 | Critical | 9.8 | 2023-02-21 | A lack of rate limiting on the password reset endpoint of Chamberlain myQ v5.222.0.32277 (on iOS) allows attackers to compromise user accounts via a bruteforce… |
CVE-2023-25157 | Critical | 9.8 | 2023-02-21 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter… |
CVE-2023-24320 | Critical | 9.8 | 2023-02-21 | An access control issue in Axcora POS #0~gitf77ec09 allows unauthenticated attackers to execute arbitrary commands via unspecified vectors. |
CVE-2023-25812 | Medium | 6.5 | 2023-02-21 | Minio is a Multi-Cloud Object Storage framework. Affected versions do not correctly honor a `Deny` policy on ByPassGoverance. Ideally, minio should return "Acc… |
CVE-2023-25811 | Medium | 6.3 | 2023-02-21 | Uptime Kuma is a self-hosted monitoring tool. In versions prior to 1.20.0 the Uptime Kuma `name` parameter allows a persistent XSS attack. Users are advised to… |
CVE-2023-25810 | Medium | 6.3 | 2023-02-21 | Uptime Kuma is a self-hosted monitoring tool. In versions prior to 1.20.0 the Uptime Kuma status page allows a persistent XSS attack. Users are advised to upgr… |
CVE-2023-25657 | High | 7.5 | 2023-02-21 | Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions earlier than 1.5.7 are impacted by a remote code executio… |
CVE-2023-25158 | Critical | 9.8 | 2023-02-21 | GeoTools is an open source Java library that provides tools for geospatial data. GeoTools includes support for OGC Filter expression language parsing, encoding… |
CVE-2023-0946 | Medium | 6.3 | 2023-02-21 | A vulnerability has been found in SourceCodester Best POS Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functi… |
CVE-2023-0945 | Low | 3.5 | 2023-02-21 | A vulnerability, which was classified as problematic, was found in SourceCodester Best POS Management System 1.0. Affected is an unknown function of the file i… |
CVE-2023-0943 | Medium | 4.7 | 2023-02-21 | A vulnerability, which was classified as problematic, has been found in SourceCodester Best POS Management System 1.0. This issue affects the function save_set… |
CVE-2023-0942 | Medium | 6.1 | 2023-02-21 | The Japanized For WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to, and including, 2… |
CVE-2023-23009 | Medium | 6.5 | 2023-02-21 | Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via crafted TS payload with an incorrect selector length. |
CVE-2023-22984 | Medium | 6.1 | 2023-02-21 | A Vulnerability was discovered in Axis 207W network camera. There is a reflected XSS vulnerability in the web administration portal, which allows an attacker t… |
CVE-2023-22920 | Critical | 9.8 | 2023-02-21 | A security misconfiguration vulnerability exists in the Zyxel LTE3316-M604 firmware version V2.00(ABMP.6)C0 due to a factory default misconfiguration intended… |
CVE-2023-24184 | Critical | 9.8 | 2023-02-21 | TOTOLink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability. |
CVE-2023-0934 | Medium | 5.4 | 2023-02-21 | Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.5. |
CVE-2023-25928 | Medium | 4.6 | 2023-02-21 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2023-0938 | Medium | 6.3 | 2023-02-21 | A vulnerability classified as critical has been found in SourceCodester Music Gallery Site 1.0. This affects an unknown part of the file music_list.php of the… |
CVE-2023-0936 | Medium | 6.5 | 2023-02-21 | A vulnerability was found in TP-Link Archer C50 V2_160801. It has been rated as problematic. Affected by this issue is some unknown functionality of the compon… |
CVE-2023-0935 | Medium | 6.3 | 2023-02-21 | A vulnerability was found in DolphinPHP up to 1.5.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file c… |
CVE-2023-26267 | Medium | 6.5 | 2023-02-21 | php-saml-sp before 1.1.1 and 2.x before 2.1.1 allows reading arbitrary files as the webserver user because resolving XML external entities was silently enabled… |
CVE-2023-0559 | Medium | 5.4 | 2023-02-21 | The GS Portfolio for Envato WordPress plugin before 1.4.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/p… |