2023 CVEs (page 290)
Page 290 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-26037 | High | 8.9 | 2023-02-25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33… |
CVE-2023-26036 | High | 8.1 | 2023-02-25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33… |
CVE-2023-26035 | High | 7.2 | 2023-02-25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33… |
CVE-2023-1034 | High | 8.8 | 2023-02-25 | Path Traversal: '\..\filename' in GitHub repository salesagility/suitecrm prior to 7.12.9. |
CVE-2023-26034 | Critical | 9.6 | 2023-02-25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33… |
CVE-2023-26032 | High | 8.9 | 2023-02-25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33… |
CVE-2023-25825 | High | 7.7 | 2023-02-25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33… |
CVE-2023-1033 | High | 8.8 | 2023-02-25 | Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.11. |
CVE-2023-26033 | High | 7.5 | 2023-02-25 | Gentoo soko is the code that powers packages.gentoo.org. Versions prior to 1.0.1 are vulnerable to SQL Injection, leading to a Denial of Service. If the user s… |
CVE-2023-25821 | Medium | 5.7 | 2023-02-25 | Nextcloud is an Open Source private cloud software. Versions 24.0.4 and above, prior to 24.0.7, and 25.0.0 and above, prior to 25.0.1, contain Improper Access… |
CVE-2023-25816 | Medium | 4.3 | 2023-02-25 | Nextcloud is an Open Source private cloud software. Versions 25.0.0 and above, prior to 25.0.3, are subject to Uncontrolled Resource Consumption. A user can co… |
CVE-2023-24189 | Critical | 9.8 | 2023-02-24 | An XML External Entity (XXE) vulnerability in urule v2.1.7 allows attackers to execute arbitrary code via uploading a crafted XML file to /urule/common/saveFil… |
CVE-2023-1030 | Low | 3.5 | 2023-02-24 | A vulnerability has been found in SourceCodester/code-projects Online Boat Reservation System 1.0 and classified as problematic. Affected by this vulnerability… |
CVE-2023-1029 | Medium | 4.3 | 2023-02-24 | The WP Meta SEO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.3. This is due to missing or incorrect n… |
CVE-2023-0481 | Low | 3.3 | 2023-02-24 | In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile() is used in the FileBodyHandler class which creates temp files with insecure p… |
CVE-2023-23205 | Medium | 5.5 | 2023-02-24 | An issue was discovered in lib60870 v2.3.2. There is a memory leak in lib60870/lib60870-C/examples/multi_client_server/multi_client_server.c. |
CVE-2023-0586 | Medium | 6.4 | 2023-02-24 | The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 4.2.9 due t… |
CVE-2023-0585 | Medium | 4.4 | 2023-02-24 | The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 4.2.9 due t… |
CVE-2023-25956 | High | 7.5 | 2023-02-24 | Generation of Error Message Containing Sensitive Information vulnerability in the Apache Airflow AWS Provider. This issue affects Apache Airflow AWS Provider… |
CVE-2023-25696 | Critical | 9.8 | 2023-02-24 | Improper Input Validation vulnerability in the Apache Airflow Hive Provider. This issue affects Apache Airflow Hive Provider versions before 5.1.3. |
CVE-2023-25693 | Critical | 9.8 | 2023-02-24 | Improper Input Validation vulnerability in the Apache Airflow Sqoop Provider. This issue affects Apache Airflow Sqoop Provider versions before 3.1.1. |
CVE-2023-25692 | High | 7.5 | 2023-02-24 | Improper Input Validation vulnerability in the Apache Airflow Google Provider. This issue affects Apache Airflow Google Provider versions before 8.10.0. |
CVE-2023-25691 | Critical | 9.8 | 2023-02-24 | Improper Input Validation vulnerability in the Apache Airflow Google Provider. This issue affects Apache Airflow Google Provider versions before 8.10.0. |
CVE-2023-1010 | Medium | 5.3 | 2023-02-24 | A vulnerability classified as critical was found in vox2png 1.0. Affected by this vulnerability is an unknown functionality of the file vox2png.c. The manipula… |
CVE-2023-1009 | Medium | 6.5 | 2023-02-24 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5. Affected is the function sub_1DF14… |
CVE-2023-1008 | Medium | 5.5 | 2023-02-24 | A vulnerability was found in Twister Antivirus 8.17. It has been rated as problematic. This issue affects the function 0x801120E4 in the library filmfd.sys of… |
CVE-2023-1007 | Medium | 5.3 | 2023-02-24 | A vulnerability was found in Twister Antivirus 8.17. It has been declared as critical. This vulnerability affects the function 0x801120E4 in the library filmfd… |
CVE-2023-0595 | Medium | 5.3 | 2023-02-24 | A CWE-117: Improper Output Neutralization for Logs vulnerability exists that could cause the misinterpretation of log files when malicious packets are sent to… |
CVE-2023-1006 | Low | 3.5 | 2023-02-24 | A vulnerability was found in SourceCodester Medical Certificate Generator App 1.0. It has been classified as problematic. This affects an unknown part of the c… |
CVE-2023-1005 | Medium | 5.3 | 2023-02-24 | A vulnerability was found in JP1016 Markdown-Electron and classified as critical. Affected by this issue is some unknown functionality. The manipulation leads… |
CVE-2023-1004 | Medium | 5.3 | 2023-02-24 | A vulnerability has been found in MarkText up to 0.17.1 on Windows and classified as critical. Affected by this vulnerability is an unknown functionality of th… |
CVE-2023-1002 | Medium | 4.3 | 2023-02-24 | A vulnerability, which was classified as problematic, has been found in MuYuCMS 2.2. This issue affects some unknown processing of the file index.php. The mani… |
CVE-2023-0999 | Medium | 4.3 | 2023-02-24 | A vulnerability classified as problematic was found in SourceCodester Sales Tracker Management System 1.0. This vulnerability affects unknown code of the file… |
CVE-2023-0998 | Medium | 6.5 | 2023-02-24 | A vulnerability classified as critical has been found in SourceCodester Alphaware Simple E-Commerce System 1.0. This affects an unknown part of the file /alpha… |
CVE-2023-0997 | High | 7.3 | 2023-02-24 | A vulnerability was found in SourceCodester Moosikay E-Commerce System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2023-22427 | Medium | 4.8 | 2023-02-24 | Stored cross-site scripting vulnerability in Theme switching function of SHIRASAGI v1.16.2 and earlier versions allows a remote attacker with an administrative… |
CVE-2023-22425 | Medium | 5.4 | 2023-02-24 | Stored cross-site scripting vulnerability in Schedule function of SHIRASAGI v1.16.2 and earlier versions allows a remote authenticated attacker to inject an ar… |
CVE-2023-26102 | High | 7.5 | 2023-02-24 | All versions of the package rangy are vulnerable to Prototype Pollution when using the extend() function in file rangy-core.js.The function uses recursive merg… |
CVE-2023-0996 | High | 7.8 | 2023-02-24 | There is a vulnerability in the strided image data parsing code in the emscripten wrapper for libheif. An attacker could exploit this through a crafted image… |
CVE-2023-0995 | Medium | 5.4 | 2023-02-24 | Cross-site Scripting (XSS) - Stored in GitHub repository unilogies/bumsys prior to v2.0.1. |
CVE-2023-0994 | High | 7.5 | 2023-02-24 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository francoisjacquet/rosariosis prior to 10.8.2. |
CVE-2023-26468 | Critical | 9.1 | 2023-02-24 | Cerebrate 1.12 does not properly consider organisation_id during creation of API keys. |
CVE-2023-24212 | Critical | 9.8 | 2023-02-23 | Tenda AX3 V16.03.12.11 was discovered to contain a stack overflow via the timeType function at /goform/SetSysTimeCfg. |
CVE-2023-23296 | Medium | 6.5 | 2023-02-23 | Korenix JetWave 4200 Series 1.3.0 and JetWave 3200 Series 1.6.0 are vulnerable to Denial of Service via /goform/formDefault. |
CVE-2023-23295 | High | 8.8 | 2023-02-23 | Korenix Jetwave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection via /goform/formSysCmd. An attacker an modify the sysCmd pa… |
CVE-2023-23294 | High | 8.8 | 2023-02-23 | Korenix JetWave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection. An attacker can modify the file_name parameter to execute… |
CVE-2023-25824 | High | 7.5 | 2023-02-23 | Mod_gnutls is a TLS module for Apache HTTPD based on GnuTLS. Versions from 0.9.0 to 0.12.0 (including) did not properly fail blocking read operations on TLS co… |
CVE-2023-25823 | Medium | 5.4 | 2023-02-23 | Gradio is an open-source Python library to build machine learning and data science demos and web applications. Versions prior to 3.13.1 contain Use of Hard-cod… |
CVE-2023-24205 | Critical | 9.8 | 2023-02-23 | Clash for Windows v0.20.12 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via overwriting the configuration file (cfw… |
CVE-2023-0755 | Critical | 9.8 | 2023-02-23 | The affected products are vulnerable to an improper validation of array index, which could allow an attacker to crash the server and remotely execute arbitrar… |
CVE-2023-0754 | Critical | 9.8 | 2023-02-23 | The affected products are vulnerable to an integer overflow or wraparound, which could allow an attacker to crash the server and remotely execute arbitrary c… |
CVE-2023-26326 | Critical | 9.8 | 2023-02-23 | The BuddyForms WordPress plugin, in versions prior to 2.7.8, was affected by an unauthenticated insecure deserialization issue. An unauthenticated attacker cou… |
CVE-2023-26325 | High | 8.8 | 2023-02-23 | The 'rx_export_review' action in the ReviewX WordPress Plugin, is affected by an authenticated SQL injection vulnerability in the 'filterValue' and 'selectedCo… |
CVE-2023-24317 | High | 8.1 | 2023-02-23 | Judging Management System 1.0 was discovered to contain an arbitrary file upload vulnerability via the component edit_organizer.php. |
CVE-2023-23920 | Medium | 4.2 | 2023-02-23 | An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load… |
CVE-2023-23919 | High | 7.5 | 2023-02-23 | A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after opera… |
CVE-2023-23918 | High | 7.5 | 2023-02-23 | A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (h… |
CVE-2023-23917 | High | 8.8 | 2023-02-23 | A prototype pollution vulnerability exists in Rocket.Chat server <5.2.0 that could allow an attacker to a RCE under the admin account. Any user can create thei… |
CVE-2023-23916 | Medium | 6.5 | 2023-02-23 | An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that… |
CVE-2023-23915 | Medium | 6.5 | 2023-02-23 | A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple… |
CVE-2023-23914 | Critical | 9.1 | 2023-02-23 | A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are request… |
CVE-2023-20089 | High | 7.4 | 2023-02-23 | A vulnerability in the Link Layer Discovery Protocol (LLDP) feature for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) Mod… |
CVE-2023-20050 | Medium | 4.4 | 2023-02-23 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2023-20016 | Medium | 6.3 | 2023-02-23 | A vulnerability in the backup configuration feature of Cisco UCS Manager Software and in the configuration export feature of Cisco FXOS Software could allow an… |
CVE-2023-20015 | Medium | 6.0 | 2023-02-23 | A vulnerability in the CLI of Cisco Firepower 4100 Series, Cisco Firepower 9300 Security Appliances, and Cisco UCS 6200, 6300, 6400, and 6500 Series Fabric Int… |
CVE-2023-20012 | Medium | 5.3 | 2023-02-23 | A vulnerability in the CLI console login authentication of Cisco Nexus 9300-FX3 Series Fabric Extender (FEX) when used in UCS Fabric Interconnect deployments c… |
CVE-2023-20011 | High | 8.8 | 2023-02-23 | A vulnerability in the web-based management interface of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Network Controller, formerly… |
CVE-2023-0597 | Medium | 5.5 | 2023-02-23 | A flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping of X86 CPU data to memory was found in the way user can guess location of exceptio… |
CVE-2023-0044 | Medium | 6.1 | 2023-02-23 | If the Quarkus Form Authentication session cookie Path attribute is set to `/` then a cross-site attack may be initiated which might lead to the Information Di… |
CVE-2023-22476 | Medium | 4.3 | 2023-02-23 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions prior to 2.25.6, due to insufficient access-level checks, any logged-in user allowed… |
CVE-2023-24415 | Medium | 5.4 | 2023-02-23 | Cross-Site Request Forgery (CSRF) vulnerability in QuantumCloud AI ChatBot plugin <= 4.2.8 versions. |
CVE-2023-24104 | Critical | 9.8 | 2023-02-23 | Ubiquiti Networks UniFi Dream Machine Pro v7.2.95 allows attackers to bypass domain restrictions via crafted packets. |
CVE-2023-0988 | Medium | 4.3 | 2023-02-23 | A vulnerability, which was classified as problematic, has been found in SourceCodester Online Pizza Ordering System 1.0. This issue affects some unknown proces… |
CVE-2023-0987 | Low | 3.5 | 2023-02-23 | A vulnerability classified as problematic was found in SourceCodester Online Pizza Ordering System 1.0. This vulnerability affects unknown code of the file ind… |
CVE-2023-0986 | Medium | 6.3 | 2023-02-23 | A vulnerability classified as critical has been found in SourceCodester Sales Tracker Management System 1.0. This affects an unknown part of the file admin/?pa… |
CVE-2023-24384 | Medium | 4.3 | 2023-02-23 | Cross-Site Request Forgery (CSRF) vulnerability in WpDevArt Organization chart <= 1.4.4 versions. |
CVE-2023-23659 | Medium | 4.3 | 2023-02-23 | Cross-Site Request Forgery (CSRF) vulnerability in MainWP Matomo Extension <= 4.0.4 versions. |
CVE-2023-0869 | Medium | 5.8 | 2023-02-23 | Cross-site scripting in outage/list.htm in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The… |
CVE-2023-0868 | Medium | 6.7 | 2023-02-23 | Reflected cross-site scripting in graph results in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to steal session cookies. U… |
CVE-2023-0867 | Medium | 6.7 | 2023-02-23 | Multiple stored and reflected cross-site scripting vulnerabilities in webapp jsp pages in multiple versions of OpenNMS Meridian and Horizon could allow an atta… |
CVE-2023-0815 | Medium | 6.8 | 2023-02-23 | Potential Insertion of Sensitive Information into Jetty Log Files in multiple versions of OpenNMS Meridian and Horizon could allow disclosure of usernames and… |
CVE-2023-0982 | Medium | 6.3 | 2023-02-23 | A vulnerability was found in SourceCodester Yoga Class Registration System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown… |
CVE-2023-0981 | Medium | 6.3 | 2023-02-23 | A vulnerability was found in SourceCodester Yoga Class Registration System 1.0. It has been classified as critical. Affected is an unknown function of the comp… |
CVE-2023-0980 | Medium | 6.3 | 2023-02-23 | A vulnerability was found in SourceCodester Yoga Class Registration System 1.0 and classified as critical. This issue affects some unknown processing of the fi… |
CVE-2023-25621 | Medium | 6.5 | 2023-02-23 | Privilege Escalation vulnerability in Apache Software Foundation Apache Sling. Any content author is able to create i18n dictionaries in the repository in a lo… |
CVE-2023-0939 | Critical | 9.8 | 2023-02-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NTN Information Technologies Online Services Software all… |
CVE-2023-26462 | High | 8.1 | 2023-02-23 | ThingsBoard 3.4.1 could allow a remote attacker to gain elevated privileges because hard-coded service credentials (usable for privilege escalation) are stored… |
CVE-2023-26303 | Low | 3.3 | 2023-02-23 | Denial of service could be caused to markdown-it-py, before v2.2.0, if an attacker was allowed to force null assertions with specially crafted input. |
CVE-2023-26302 | Low | 3.3 | 2023-02-22 | Denial of service could be caused to the command line interface of markdown-it-py, before v2.2.0, if an attacker was allowed to use invalid UTF-8 characters as… |
CVE-2023-24114 | Critical | 9.8 | 2023-02-22 | typecho 1.1/17.10.30 was discovered to contain a remote code execution (RCE) vulnerability via install.php. |
CVE-2023-22974 | High | 7.5 | 2023-02-22 | A Path Traversal in setup.php in OpenEMR < 7.0.0 allows remote unauthenticated users to read arbitrary files by controlling a connection to an attacker-control… |
CVE-2023-22973 | High | 8.8 | 2023-02-22 | A Local File Inclusion (LFI) vulnerability in interface/forms/LBF/new.php in OpenEMR < 7.0.0 allows remote authenticated users to execute code via the formname… |
CVE-2023-22972 | Medium | 5.4 | 2023-02-22 | A Reflected Cross-site scripting (XSS) vulnerability in interface/forms/eye_mag/php/eye_mag_functions.php in OpenEMR < 7.0.0 allows remote authenticated users… |
CVE-2023-0104 | Critical | 9.3 | 2023-02-22 | The listed versions for Weintek EasyBuilder Pro are vulnerable to a ZipSlip attack caused by decompiling a malicious project file. This may allow an attacker… |
CVE-2023-24812 | High | 8.8 | 2023-02-22 | Misskey is an open source, decentralized social media platform. In versions prior to 13.3.3 SQL injection is possible due to insufficient parameter validation… |
CVE-2023-24811 | High | 7.1 | 2023-02-22 | Misskey is an open source, decentralized social media platform. In versions prior to 13.3.2 the URL preview function is subject to a cross site scripting vulne… |
CVE-2023-24810 | High | 7.1 | 2023-02-22 | Misskey is an open source, decentralized social media platform. Due to insufficient validation of the redirect URL during `miauth` authentication in Misskey, a… |
CVE-2023-24093 | Critical | 9.8 | 2023-02-22 | An access control issue in H3C A210-G A210-GV100R005 allows attackers to authenticate without a password. |
CVE-2023-0966 | Low | 2.4 | 2023-02-22 | A vulnerability classified as problematic was found in SourceCodester Online Eyewear Shop 1.0. Affected by this vulnerability is an unknown functionality of th… |
CVE-2023-0941 | High | 8.8 | 2023-02-22 | Use after free in Prompts in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (C… |