2023 CVEs (page 291)
Page 291 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-0933 | High | 8.8 | 2023-02-22 | Integer overflow in PDF in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chro… |
CVE-2023-0932 | High | 8.8 | 2023-02-22 | Use after free in WebRTC in Google Chrome on Windows prior to 110.0.5481.177 allowed a remote attacker who convinced the user to engage in specific UI interact… |
CVE-2023-0931 | High | 8.8 | 2023-02-22 | Use after free in Video in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2023-0930 | High | 8.8 | 2023-02-22 | Heap buffer overflow in Video in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2023-0929 | High | 8.8 | 2023-02-22 | Use after free in Vulkan in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2023-0928 | High | 8.8 | 2023-02-22 | Use after free in SwiftShader in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2023-0927 | High | 8.8 | 2023-02-22 | Use after free in Web Payments API in Google Chrome on Android prior to 110.0.5481.177 allowed a remote attacker who had compromised the renderer process to po… |
CVE-2023-25813 | Critical | 10.0 | 2023-02-22 | Sequelize is a Node.js ORM tool. In versions prior to 6.19.1 a SQL injection exploit exists related to replacements. Parameters which are passed through replac… |
CVE-2023-25579 | Medium | 6.0 | 2023-02-22 | Nextcloud server is a self hosted home cloud product. In affected versions the `OC\Files\Node\Folder::getFullPath()` function was validating and normalizing th… |
CVE-2023-25154 | High | 7.1 | 2023-02-22 | Misskey is an open source, decentralized social media platform. In versions prior to 13.5.0 the link to the instance to the sender that appears when viewing a… |
CVE-2023-0964 | Medium | 5.0 | 2023-02-22 | A vulnerability classified as critical has been found in SourceCodester Sales Tracker Management System 1.0. Affected is an unknown function of the file admin/… |
CVE-2023-0963 | High | 7.3 | 2023-02-22 | A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been rated as critical. This issue affects some unknown processing of the file Users… |
CVE-2023-0962 | Medium | 6.3 | 2023-02-22 | A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been declared as critical. This vulnerability affects unknown code of the file Maste… |
CVE-2023-0961 | Medium | 6.3 | 2023-02-22 | A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been classified as critical. This affects an unknown part of the file view_music_det… |
CVE-2023-0846 | Medium | 6.7 | 2023-02-22 | Unauthenticated, stored cross-site scripting in the display of alarm reduction keys in multiple versions of OpenNMS Horizon and Meridian could allow an attacke… |
CVE-2023-26214 | High | 7.3 | 2023-02-22 | The BusinessConnect UI component of TIBCO Software Inc.'s TIBCO BusinessConnect contains easily exploitable Reflected Cross Site Scripting (XSS) vulnerabilitie… |
CVE-2023-0960 | Medium | 4.7 | 2023-02-22 | A vulnerability was found in SeaCMS 11.6 and classified as problematic. Affected by this issue is some unknown functionality of the file /data/config.ftp.php o… |
CVE-2023-23040 | High | 7.5 | 2023-02-22 | TP-Link router TL-WR940N V6 3.19.1 Build 180119 uses a deprecated MD5 algorithm to hash the admin password used for basic authentication. |
CVE-2023-23039 | Medium | 5.7 | 2023-02-22 | An issue was discovered in the Linux kernel through 6.2.0-rc2. drivers/tty/vcc.c has a race condition and resultant use-after-free if a physically proximate at… |
CVE-2023-23063 | High | 7.5 | 2023-02-22 | Cellinx NVT v1.0.6.002b was discovered to contain a local file disclosure vulnerability via the component /cgi-bin/GetFileContent.cgi. |
CVE-2023-0949 | Medium | 4.8 | 2023-02-22 | Cross-site Scripting (XSS) - Reflected in GitHub repository modoboa/modoboa prior to 2.0.5. |
CVE-2023-26314 | High | 8.8 | 2023-02-22 | The mono package before 6.8.0.105+dfsg-3.3 for Debian allows arbitrary code execution because the application/x-ms-dos-executable MIME type is associated with… |
CVE-2023-24108 | Critical | 9.8 | 2023-02-22 | MvcTools 6d48cd6830fc1df1d8c9d61caa1805fd6a1b7737 was discovered to contain a code execution backdoor via the request package (requirements.txt). This vulnerab… |
CVE-2023-24107 | Critical | 9.8 | 2023-02-22 | hour_of_code_python_2015 commit 520929797b9ca43bb818b2e8f963fb2025459fa3 was discovered to contain a code execution backdoor via the request package (requireme… |
CVE-2023-0947 | Critical | 9.8 | 2023-02-22 | Path Traversal in GitHub repository flatpressblog/flatpress prior to 1.3. |
CVE-2023-20858 | High | 7.2 | 2023-02-22 | VMware Carbon Black App Control 8.7.x prior to 8.7.8, 8.8.x prior to 8.8.6, and 8.9.x.prior to 8.9.4 contain an injection vulnerability. A malicious actor with… |
CVE-2023-20855 | High | 8.8 | 2023-02-22 | VMware vRealize Orchestrator contains an XML External Entity (XXE) vulnerability. A malicious actor, with non-administrative access to vRealize Orchestrator, m… |
CVE-2023-24081 | Medium | 5.4 | 2023-02-21 | Multiple stored cross-site scripting (XSS) vulnerabilities in Redrock Software TutorTrac before v4.2.170210 allows attackers to execute arbitrary web scripts o… |
CVE-2023-24080 | Critical | 9.8 | 2023-02-21 | A lack of rate limiting on the password reset endpoint of Chamberlain myQ v5.222.0.32277 (on iOS) allows attackers to compromise user accounts via a bruteforce… |
CVE-2023-25157 | Critical | 9.8 | 2023-02-21 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter… |
CVE-2023-24320 | Critical | 9.8 | 2023-02-21 | An access control issue in Axcora POS #0~gitf77ec09 allows unauthenticated attackers to execute arbitrary commands via unspecified vectors. |
CVE-2023-25812 | Medium | 6.5 | 2023-02-21 | Minio is a Multi-Cloud Object Storage framework. Affected versions do not correctly honor a `Deny` policy on ByPassGoverance. Ideally, minio should return "Acc… |
CVE-2023-25811 | Medium | 6.3 | 2023-02-21 | Uptime Kuma is a self-hosted monitoring tool. In versions prior to 1.20.0 the Uptime Kuma `name` parameter allows a persistent XSS attack. Users are advised to… |
CVE-2023-25810 | Medium | 6.3 | 2023-02-21 | Uptime Kuma is a self-hosted monitoring tool. In versions prior to 1.20.0 the Uptime Kuma status page allows a persistent XSS attack. Users are advised to upgr… |
CVE-2023-25657 | High | 7.5 | 2023-02-21 | Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions earlier than 1.5.7 are impacted by a remote code executio… |
CVE-2023-25158 | Critical | 9.8 | 2023-02-21 | GeoTools is an open source Java library that provides tools for geospatial data. GeoTools includes support for OGC Filter expression language parsing, encoding… |
CVE-2023-0946 | Medium | 6.3 | 2023-02-21 | A vulnerability has been found in SourceCodester Best POS Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functi… |
CVE-2023-0945 | Low | 3.5 | 2023-02-21 | A vulnerability, which was classified as problematic, was found in SourceCodester Best POS Management System 1.0. Affected is an unknown function of the file i… |
CVE-2023-0943 | Medium | 4.7 | 2023-02-21 | A vulnerability, which was classified as problematic, has been found in SourceCodester Best POS Management System 1.0. This issue affects the function save_set… |
CVE-2023-0942 | Medium | 6.1 | 2023-02-21 | The Japanized For WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to, and including, 2… |
CVE-2023-23009 | Medium | 6.5 | 2023-02-21 | Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via crafted TS payload with an incorrect selector length. |
CVE-2023-22984 | Medium | 6.1 | 2023-02-21 | A Vulnerability was discovered in Axis 207W network camera. There is a reflected XSS vulnerability in the web administration portal, which allows an attacker t… |
CVE-2023-22920 | Critical | 9.8 | 2023-02-21 | A security misconfiguration vulnerability exists in the Zyxel LTE3316-M604 firmware version V2.00(ABMP.6)C0 due to a factory default misconfiguration intended… |
CVE-2023-24184 | Critical | 9.8 | 2023-02-21 | TOTOLink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability. |
CVE-2023-0934 | Medium | 5.4 | 2023-02-21 | Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.5. |
CVE-2023-25928 | Medium | 4.6 | 2023-02-21 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2023-0938 | Medium | 6.3 | 2023-02-21 | A vulnerability classified as critical has been found in SourceCodester Music Gallery Site 1.0. This affects an unknown part of the file music_list.php of the… |
CVE-2023-0936 | Medium | 6.5 | 2023-02-21 | A vulnerability was found in TP-Link Archer C50 V2_160801. It has been rated as problematic. Affected by this issue is some unknown functionality of the compon… |
CVE-2023-0935 | Medium | 6.3 | 2023-02-21 | A vulnerability was found in DolphinPHP up to 1.5.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file c… |
CVE-2023-26267 | Medium | 6.5 | 2023-02-21 | php-saml-sp before 1.1.1 and 2.x before 2.1.1 allows reading arbitrary files as the webserver user because resolving XML external entities was silently enabled… |
CVE-2023-0559 | Medium | 5.4 | 2023-02-21 | The GS Portfolio for Envato WordPress plugin before 1.4.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/p… |
CVE-2023-0541 | Medium | 5.4 | 2023-02-21 | The GS Books Showcase WordPress plugin before 1.3.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post wh… |
CVE-2023-0540 | Medium | 5.4 | 2023-02-21 | The GS Filterable Portfolio WordPress plugin before 1.6.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/p… |
CVE-2023-0492 | Medium | 5.4 | 2023-02-21 | The GS Products Slider for WooCommerce WordPress plugin before 1.5.9 does not validate and escape some of its shortcode attributes before outputting them back… |
CVE-2023-0453 | Medium | 4.3 | 2023-02-21 | The WP Private Message WordPress plugin (bundled with the Superio theme as a required plugin) before 1.0.6 does not ensure that private messages to be accessed… |
CVE-2023-0442 | Medium | 6.1 | 2023-02-21 | The Loan Comparison WordPress plugin before 1.5.3 does not validate and escape some of its query parameters before outputting them back in a page/post via an e… |
CVE-2023-0429 | Medium | 4.8 | 2023-02-21 | The Watu Quiz WordPress plugin before 3.3.8.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2023-0428 | Medium | 6.1 | 2023-02-21 | The Watu Quiz WordPress plugin before 3.3.8.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2023-0419 | Medium | 5.4 | 2023-02-21 | The Shortcode for Font Awesome WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a pag… |
CVE-2023-0380 | Medium | 5.4 | 2023-02-21 | The Easy Digital Downloads WordPress plugin before 3.1.0.5 does not validate and escape some of its block options before outputting them back in a page/post wh… |
CVE-2023-0378 | Medium | 5.4 | 2023-02-21 | The Greenshift WordPress plugin before 5.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is… |
CVE-2023-0375 | Medium | 5.4 | 2023-02-21 | The Easy Affiliate Links WordPress plugin before 3.7.1 does not validate and escape some of its block options before outputting them back in a page/post where… |
CVE-2023-0372 | Medium | 5.4 | 2023-02-21 | The EmbedStories WordPress plugin before 0.7.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where t… |
CVE-2023-0371 | Medium | 5.4 | 2023-02-21 | The EmbedSocial WordPress plugin before 1.1.28 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where t… |
CVE-2023-0366 | Medium | 5.4 | 2023-02-21 | The Loan Comparison WordPress plugin before 1.5.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post wher… |
CVE-2023-0285 | Medium | 5.4 | 2023-02-21 | The Real Media Library WordPress plugin before 4.18.29 does not sanitise and escape the created folder names, which could allow users with the role of author a… |
CVE-2023-0271 | Medium | 5.4 | 2023-02-21 | The WP Font Awesome WordPress plugin before 1.7.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post wher… |
CVE-2023-0232 | Critical | 9.8 | 2023-02-21 | The ShopLentor WordPress plugin before 2.5.4 unserializes user input from cookies in order to track viewed products and user data, which could lead to PHP Obje… |
CVE-2023-0231 | Medium | 5.4 | 2023-02-21 | The ShopLentor WordPress plugin before 2.5.4 does not validate and escape some of its block options before outputting them back in a page/post where the block… |
CVE-2023-0067 | Medium | 5.4 | 2023-02-21 | The Timed Content WordPress plugin before 2.73 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where t… |
CVE-2023-0059 | Medium | 5.4 | 2023-02-21 | The Youzify WordPress plugin before 1.2.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the sh… |
CVE-2023-24575 | High | 7.8 | 2023-02-21 | Dell Multifunction Printer E525w Driver and Software Suite, versions prior to 1.047.2022, A05, contain a local privilege escalation vulnerability that could b… |
CVE-2023-26266 | High | 7.3 | 2023-02-21 | In AFL++ 4.05c, the CmpLog component uses the current working directory to resolve and execute unprefixed fuzzing targets, allowing code execution. |
CVE-2023-26265 | Medium | 5.3 | 2023-02-21 | The Borg theme before 1.1.19 for Backdrop CMS does not sufficiently sanitize path arguments that are passed in via a URL. The function borg_preprocess_page in… |
CVE-2023-26253 | High | 7.5 | 2023-02-21 | In Gluster GlusterFS 11.0, there is an xlators/mount/fuse/src/fuse-bridge.c notify stack-based buffer over-read. |
CVE-2023-26249 | High | 7.5 | 2023-02-21 | Knot Resolver before 5.6.0 enables attackers to consume its resources, launching amplification attacks and potentially causing a denial of service. Specificall… |
CVE-2023-26242 | High | 7.8 | 2023-02-21 | afu_mmio_region_get_by_offset in drivers/fpga/dfl-afu-region.c in the Linux kernel through 6.1.12 has an integer overflow. |
CVE-2023-26235 | Medium | 6.1 | 2023-02-21 | JD-GUI 1.6.6 allows XSS via util/net/InterProcessCommunicationUtil.java. |
CVE-2023-26234 | Medium | 6.6 | 2023-02-21 | JD-GUI 1.6.6 allows deserialization via UIMainWindowPreferencesProvider.singleInstance. |
CVE-2023-23453 | Critical | 9.8 | 2023-02-20 | Missing Authentication for Critical Function in SICK FX0-GENT v3 Firmware Version V3.04 and V3.05 allows an unprivileged remote attacker to achieve arbitrary r… |
CVE-2023-23452 | Critical | 9.8 | 2023-02-20 | Missing Authentication for Critical Function in SICK FX0-GPNT v3 Firmware Version V3.04 and V3.05 allows an unprivileged remote attacker to achieve arbitrary r… |
CVE-2023-25805 | Critical | 9.8 | 2023-02-20 | versionn, software for changing version information across multiple files, has a command injection vulnerability in all versions prior to version 1.1.0. This i… |
CVE-2023-25656 | High | 7.5 | 2023-02-20 | notation-go is a collection of libraries for supporting Notation sign, verify, push, and pull of oci artifacts. Prior to version 1.0.0-rc.3, notation-go users… |
CVE-2023-25613 | Critical | 9.8 | 2023-02-20 | An LDAP Injection vulnerability exists in the LdapIdentityBackend of Apache Kerby before 2.0.3. |
CVE-2023-25570 | High | 7.5 | 2023-02-20 | Apollo is a configuration management system. Prior to version 2.1.0, there are potential security issues if users expose apollo-configservice to the internet… |
CVE-2023-25569 | Medium | 5.7 | 2023-02-20 | Apollo is a configuration management system. Prior to version 2.1.0, a low-privileged user can create a special web page. If an authenticated portal admin visi… |
CVE-2023-24998 | High | 7.5 | 2023-02-20 | Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS wi… |
CVE-2023-26093 | Critical | 9.8 | 2023-02-20 | Liima before 1.17.28 allows Hibernate query language (HQL) injection, related to colToSort in the deployment filter. |
CVE-2023-26092 | Critical | 9.8 | 2023-02-20 | Liima before 1.17.28 allows server-side template injection. |
CVE-2023-26081 | High | 7.5 | 2023-02-20 | In Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users into exfiltrating passwords, because autofill occurs in sandboxed contexts. |
CVE-2023-0919 | High | 8.1 | 2023-02-19 | Missing Authentication for Critical Function in GitHub repository kareadita/kavita prior to 0.7.0. |
CVE-2023-0918 | Medium | 6.3 | 2023-02-19 | A vulnerability has been found in codeprojects Pharmacy Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file a… |
CVE-2023-0917 | High | 7.3 | 2023-02-19 | A vulnerability, which was classified as critical, was found in SourceCodester Simple Customer Relationship Management System 1.0. This affects an unknown part… |
CVE-2023-0916 | Medium | 6.3 | 2023-02-19 | A vulnerability classified as critical was found in SourceCodester Auto Dealer Management System 1.0. Affected by this vulnerability is an unknown functionalit… |
CVE-2023-0915 | Medium | 6.3 | 2023-02-19 | A vulnerability classified as critical has been found in SourceCodester Auto Dealer Management System 1.0. Affected is an unknown function of the file /adms/ad… |
CVE-2023-0914 | Medium | 5.3 | 2023-02-19 | Improper Authorization in GitHub repository pixelfed/pixelfed prior to 0.11.4. |
CVE-2023-0913 | Medium | 4.7 | 2023-02-18 | A vulnerability classified as critical was found in SourceCodester Auto Dealer Management System 1.0. This vulnerability affects unknown code of the file /adms… |
CVE-2023-0912 | Medium | 4.7 | 2023-02-18 | A vulnerability classified as critical has been found in SourceCodester Auto Dealer Management System 1.0. This affects an unknown part of the file /adms/admin… |
CVE-2023-0910 | Medium | 6.3 | 2023-02-18 | A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unknown code of the fi… |
CVE-2023-0909 | Low | 3.3 | 2023-02-18 | A vulnerability, which was classified as problematic, was found in cxasm notepad-- 1.22. This affects an unknown part of the component Directory Comparison Han… |