2023 CVEs (page 295)
Page 295 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-24556 | High | 7.8 | 2023-02-14 | A vulnerability has been identified in Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2023 (All versions < V223.0Update2). The affected applicatio… |
CVE-2023-24555 | High | 7.8 | 2023-02-14 | A vulnerability has been identified in Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2023 (All versions < V223.0Update2). The affected applicatio… |
CVE-2023-24554 | High | 7.8 | 2023-02-14 | A vulnerability has been identified in Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2023 (All versions < V223.0Update2). The affected applicatio… |
CVE-2023-24553 | High | 7.8 | 2023-02-14 | A vulnerability has been identified in Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2023 (All versions < V223.0Update2). The affected applicatio… |
CVE-2023-24552 | High | 7.8 | 2023-02-14 | A vulnerability has been identified in Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2023 (All versions < V223.0Update2). The affected applicatio… |
CVE-2023-24551 | High | 7.8 | 2023-02-14 | A vulnerability has been identified in Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2023 (All versions < V223.0Update2). The affected applicatio… |
CVE-2023-24550 | High | 7.8 | 2023-02-14 | A vulnerability has been identified in Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2023 (All versions < V223.0Update2). The affected applicatio… |
CVE-2023-24549 | High | 7.8 | 2023-02-14 | A vulnerability has been identified in Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2023 (All versions < V223.0Update2). The affected applicatio… |
CVE-2023-24482 | Critical | 10.0 | 2023-02-14 | A vulnerability has been identified in COMOS V10.2 (All versions), COMOS V10.3.3.1 (All versions < V10.3.3.1.45), COMOS V10.3.3.2 (All versions < V10.3.3.2.33)… |
CVE-2023-23835 | Medium | 5.9 | 2023-02-14 | A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.34), Mendix Applications using Mendix 8 (All versions < V8.18.2… |
CVE-2023-25758 | Medium | 4.2 | 2023-02-14 | Onekey Touch devices through 4.0.0 and Onekey Mini devices through 2.10.0 allow man-in-the-middle attackers to obtain the seed phase. The man-in-the-middle acc… |
CVE-2023-25066 | Medium | 4.3 | 2023-02-14 | Cross-Site Request Forgery (CSRF) vulnerability in FolioVision FV Flowplayer Video Player plugin <= 7.5.30.7212 versions. |
CVE-2023-25614 | Medium | 6.1 | 2023-02-14 | SAP NetWeaver AS ABAP (BSP Framework) application - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allow an unauthenticated attacker… |
CVE-2023-24530 | High | 8.4 | 2023-02-14 | SAP BusinessObjects Business Intelligence Platform (CMC) - versions 420, 430, allows an authenticated admin user to upload malicious code that can be executed… |
CVE-2023-24529 | Medium | 6.1 | 2023-02-14 | Due to lack of proper input validation, BSP application (CRM_BSP_FRAME) - versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75D, 75E, 75F, 75G, 75H, allow… |
CVE-2023-24528 | Medium | 6.5 | 2023-02-14 | SAP Fiori apps for Travel Management in SAP ERP (My Travel Requests) - version 600, allows an authenticated attacker to exploit a certain misconfigured applic… |
CVE-2023-24525 | Medium | 4.3 | 2023-02-14 | SAP CRM WebClient UI - versions WEBCUIF 748, 800, 801, S4FND 102, 103, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (… |
CVE-2023-24524 | Medium | 6.5 | 2023-02-14 | SAP S/4 HANA Map Treasury Correspondence Format Data does not perform necessary authorization check for an authenticated user, resulting in escalation of privi… |
CVE-2023-24523 | High | 8.8 | 2023-02-14 | An attacker authenticated as a non-admin user with local access to a server port assigned to the SAP Host Agent (Start Service) - versions 7.21, 7.22, can subm… |
CVE-2023-24522 | Medium | 6.1 | 2023-02-14 | Due to insufficient input sanitization, SAP NetWeaver AS ABAP (Business Server Pages) - versions 700, 701, 702, 731, 740, allows an unauthenticated user to alt… |
CVE-2023-24521 | Medium | 6.1 | 2023-02-14 | Due to insufficient input sanitization, SAP NetWeaver AS ABAP (BSP Framework) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allow… |
CVE-2023-23860 | Medium | 6.1 | 2023-02-14 | SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, allows an unauthenticated attacker to craft a lin… |
CVE-2023-23859 | Medium | 6.1 | 2023-02-14 | SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, allows an unauthenticated attacker to craft a mal… |
CVE-2023-23858 | Medium | 6.1 | 2023-02-14 | Due to insufficient input validation, SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, allows an u… |
CVE-2023-23856 | Medium | 4.3 | 2023-02-14 | In SAP BusinessObjects Business Intelligence (Web Intelligence user interface) - version 430, some calls return json with wrong content type in the header of t… |
CVE-2023-23855 | Medium | 6.5 | 2023-02-14 | SAP Solution Manager - version 720, allows an authenticated attacker to redirect users to a malicious site due to insufficient URL validation. A successful att… |
CVE-2023-23854 | Low | 3.8 | 2023-02-14 | SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, does not perform necessary authorization checks… |
CVE-2023-23853 | Medium | 6.1 | 2023-02-14 | An unauthenticated attacker in AP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757… |
CVE-2023-23852 | Medium | 6.1 | 2023-02-14 | SAP Solution Manager (System Monitoring) - version 720, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerabil… |
CVE-2023-23851 | Medium | 5.4 | 2023-02-14 | SAP Business Planning and Consolidation - versions 200, 300, allows an attacker with business authorization to upload any files (including web pages) without t… |
CVE-2023-0025 | Medium | 6.5 | 2023-02-14 | SAP Solution Manager (BSP Application) - version 720, allows an authenticated attacker to craft a malicious link, which when clicked by an unsuspecting user, c… |
CVE-2023-0024 | Medium | 6.5 | 2023-02-14 | SAP Solution Manager (BSP Application) - version 720, allows an authenticated attacker to craft a malicious link, which when clicked by an unsuspecting user, c… |
CVE-2023-0020 | High | 8.5 | 2023-02-14 | SAP BusinessObjects Business Intelligence platform - versions 420, 430, allows an authenticated attacker to access sensitive information which is otherwise res… |
CVE-2023-0019 | Medium | 6.5 | 2023-02-14 | In SAP GRC (Process Control) - versions GRCFND_A V1200, GRCFND_A V8100, GRCPINW V1100_700, GRCPINW V1100_731, GRCPINW V1200_750, remote-enabled function module… |
CVE-2023-22376 | Medium | 6.1 | 2023-02-14 | Reflected cross-site scripting vulnerability in Wired/Wireless LAN Pan/Tilt Network Camera CS-WMV02G all versions allows a remote unauthenticated attacker to i… |
CVE-2023-22375 | High | 8.8 | 2023-02-14 | Cross-site request forgery (CSRF) vulnerability in Wired/Wireless LAN Pan/Tilt Network Camera CS-WMV02G all versions allows a remote unauthenticated attacker t… |
CVE-2023-22370 | Medium | 5.2 | 2023-02-14 | Stored cross-site scripting vulnerability in Wired/Wireless LAN Pan/Tilt Network Camera CS-WMV02G all versions allows a network-adjacent authenticated attacker… |
CVE-2023-0655 | Medium | 5.3 | 2023-02-14 | SonicWall Email Security contains a vulnerability that could permit a remote unauthenticated attacker access to an error page that includes sensitive informati… |
CVE-2023-24187 | High | 7.8 | 2023-02-14 | An XML External Entity (XXE) vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code via uploading a crafted XML file to /ureport/designer/s… |
CVE-2023-0814 | Medium | 6.5 | 2023-02-14 | The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to sensitive information disclosure via the [user_meta] shortco… |
CVE-2023-0804 | Medium | 6.8 | 2023-02-13 | LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3609, allowing attackers to cause a denial-of-service via a crafted tiff file. For use… |
CVE-2023-0803 | Medium | 6.8 | 2023-02-13 | LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3516, allowing attackers to cause a denial-of-service via a crafted tiff file. For use… |
CVE-2023-0802 | Medium | 6.8 | 2023-02-13 | LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3724, allowing attackers to cause a denial-of-service via a crafted tiff file. For use… |
CVE-2023-0801 | Medium | 6.8 | 2023-02-13 | LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in libtiff/tif_unix.c:368, invoked by tools/tiffcrop.c:2903 and tools/tiffcrop.c:6778, allowing attackers… |
CVE-2023-0800 | Medium | 6.8 | 2023-02-13 | LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3502, allowing attackers to cause a denial-of-service via a crafted tiff file. For use… |
CVE-2023-0799 | Medium | 6.8 | 2023-02-13 | LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3701, allowing attackers to cause a denial-of-service via a crafted tiff file. For user… |
CVE-2023-0798 | Medium | 6.8 | 2023-02-13 | LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3400, allowing attackers to cause a denial-of-service via a crafted tiff file. For user… |
CVE-2023-0797 | Medium | 6.8 | 2023-02-13 | LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in libtiff/tif_unix.c:368, invoked by tools/tiffcrop.c:2903 and tools/tiffcrop.c:6921, allowing attackers t… |
CVE-2023-0796 | Medium | 6.8 | 2023-02-13 | LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3592, allowing attackers to cause a denial-of-service via a crafted tiff file. For user… |
CVE-2023-0795 | Medium | 6.8 | 2023-02-13 | LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3488, allowing attackers to cause a denial-of-service via a crafted tiff file. For user… |
CVE-2023-0518 | Medium | 4.3 | 2023-02-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versio… |
CVE-2023-0819 | High | 7.8 | 2023-02-13 | Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to v2.3.0-DEV. |
CVE-2023-0818 | Medium | 5.5 | 2023-02-13 | Off-by-one Error in GitHub repository gpac/gpac prior to v2.3.0-DEV. |
CVE-2023-0817 | High | 7.8 | 2023-02-13 | Buffer Over-read in GitHub repository gpac/gpac prior to v2.3.0-DEV. |
CVE-2023-25572 | Medium | 5.4 | 2023-02-13 | react-admin is a frontend framework for building browser applications on top of REST/GraphQL APIs. react-admin prior to versions 3.19.12 and 4.7.6, along with… |
CVE-2023-25241 | Medium | 6.1 | 2023-02-13 | bgERP v22.31 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Search parameter. |
CVE-2023-25240 | High | 8.8 | 2023-02-13 | An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code. |
CVE-2023-25162 | Medium | 5.3 | 2023-02-13 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to 24.0.8 and 23.0.12 and Nextcloud Ent… |
CVE-2023-25161 | Low | 3.7 | 2023-02-13 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to vers… |
CVE-2023-25160 | Medium | 4.1 | 2023-02-13 | Nextcloud Mail is an email app for the Nextcloud home server platform. Prior to versions 2.2.1, 1.14.5, 1.12.9, and 1.11.8, an attacker can access the mail box… |
CVE-2023-24648 | Medium | 6.1 | 2023-02-13 | Zstore v6.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /index.php. |
CVE-2023-24647 | High | 7.5 | 2023-02-13 | Food Ordering System v2.0 was discovered to contain a SQL injection vulnerability via the email parameter. |
CVE-2023-24646 | Critical | 9.8 | 2023-02-13 | An arbitrary file upload vulnerability in the component /fos/admin/ajax.php of Food Ordering System v2.0 allows attackers to execute arbitrary code via a craft… |
CVE-2023-24086 | Medium | 6.1 | 2023-02-13 | SLIMS v9.5.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /customs/loan_by_class.php?reportView. |
CVE-2023-24084 | Critical | 9.8 | 2023-02-13 | ChiKoi v1.0 was discovered to contain a SQL injection vulnerability via the load_file function. |
CVE-2023-25719 | High | 8.8 | 2023-02-13 | ConnectWise Control before 22.9.10032 (formerly known as ScreenConnect) fails to validate user-supplied parameters such as the Bin/ConnectWiseControl.Client.ex… |
CVE-2023-25718 | Critical | 9.8 | 2023-02-13 | In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signed, additional instructions can be added without i… |
CVE-2023-25717 | Critical | 9.8 | 2023-02-13 | Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=adm… |
CVE-2023-24188 | Critical | 9.1 | 2023-02-13 | ureport v2.2.9 was discovered to contain a directory traversal vulnerability via the deletion function which allows for arbitrary files to be deleted. |
CVE-2023-24619 | Medium | 5.5 | 2023-02-13 | Redpanda before 22.3.12 discloses cleartext AWS credentials. The import functionality in the rpk binary logs an AWS Access Key ID and Secret in cleartext to st… |
CVE-2023-23553 | Medium | 4.5 | 2023-02-13 | Control By Web X-400 devices are vulnerable to a cross-site scripting attack, which could result in private and session information being transferred to the a… |
CVE-2023-23551 | Critical | 9.1 | 2023-02-13 | Control By Web X-600M devices run Lua scripts and are vulnerable to code injection, which could allow an attacker to remotely execute arbitrary code. |
CVE-2023-22854 | High | 7.5 | 2023-02-13 | The ccmweb component of Mitel MiContact Center Business server 9.2.2.0 through 9.4.1.0 could allow an unauthenticated attacker to download arbitrary files, due… |
CVE-2023-25159 | Low | 2.3 | 2023-02-13 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Office is a document collaboration app for the s… |
CVE-2023-24804 | Medium | 5.0 | 2023-02-13 | The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Prior to version 3.0, the app has an incomplete fix for a path tra… |
CVE-2023-23948 | Medium | 6.2 | 2023-02-13 | The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Version 2.21.1 of the ownCloud Android app is vulnerable to SQL in… |
CVE-2023-0810 | Medium | 5.4 | 2023-02-13 | Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.11. |
CVE-2023-0405 | Medium | 4.3 | 2023-02-13 | The GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training WordPress plugin before 1.4.38 does not perform any kin… |
CVE-2023-0379 | Medium | 5.4 | 2023-02-13 | The Spotlight Social Feeds WordPress plugin before 1.4.3 does not validate and escape some of its block options before outputting them back in a page/post wher… |
CVE-2023-0373 | Medium | 5.4 | 2023-02-13 | The Lightweight Accordion WordPress plugin before 1.5.15 does not validate and escape some of its block options before outputting them back in a page/post wher… |
CVE-2023-0362 | Medium | 5.4 | 2023-02-13 | Themify Portfolio Post WordPress plugin before 1.2.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post w… |
CVE-2023-0360 | Medium | 5.4 | 2023-02-13 | The Location Weather WordPress plugin before 1.3.4 does not validate and escape some of its block options before outputting them back in a page/post where the… |
CVE-2023-0333 | Medium | 5.4 | 2023-02-13 | The TemplatesNext ToolKit WordPress plugin before 3.2.9 does not validate some of its shortcode attributes before using them to generate an HTML tag, which cou… |
CVE-2023-0275 | Medium | 5.4 | 2023-02-13 | The Easy Accept Payments for PayPal WordPress plugin before 4.9.10 does not validate and escape some of its shortcode attributes before outputting them back in… |
CVE-2023-0270 | Medium | 5.4 | 2023-02-13 | The YaMaps for WordPress Plugin WordPress plugin before 0.6.26 does not validate and escape some of its shortcode attributes before outputting them back in a p… |
CVE-2023-0263 | High | 8.8 | 2023-02-13 | The WP Yelp Review Slider WordPress plugin before 7.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL in… |
CVE-2023-0262 | High | 8.8 | 2023-02-13 | The WP Airbnb Review Slider WordPress plugin before 3.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL… |
CVE-2023-0261 | High | 8.8 | 2023-02-13 | The WP TripAdvisor Review Slider WordPress plugin before 10.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to… |
CVE-2023-0260 | High | 8.8 | 2023-02-13 | The WP Review Slider WordPress plugin before 12.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL inject… |
CVE-2023-0259 | High | 8.8 | 2023-02-13 | The WP Google Review Slider WordPress plugin before 11.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL… |
CVE-2023-0255 | High | 8.8 | 2023-02-13 | The Enable Media Replace WordPress plugin before 4.0.2 does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP… |
CVE-2023-0220 | High | 8.8 | 2023-02-13 | The Pinpoint Booking System WordPress plugin before 2.9.9.2.9 does not validate and escape one of its shortcode attributes before using it in a SQL statement… |
CVE-2023-0177 | Medium | 5.4 | 2023-02-13 | The Social Like Box and Page by WpDevArt WordPress plugin before 0.8.41 does not validate and escape some of its shortcode attributes before outputting them ba… |
CVE-2023-0169 | Medium | 5.4 | 2023-02-13 | The Zoho Forms WordPress plugin before 3.0.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the… |
CVE-2023-0166 | Medium | 5.4 | 2023-02-13 | The Product Slider for WooCommerce by PickPlugins WordPress plugin before 1.13.42 does not validate and escape some of its shortcode attributes before outputti… |
CVE-2023-0159 | High | 7.5 | 2023-02-13 | The Extensive VC Addons for WPBakery page builder WordPress plugin before 1.9.1 does not validate a parameter passed to the php extract function when loading t… |
CVE-2023-0151 | Medium | 5.4 | 2023-02-13 | The uTubeVideo Gallery WordPress plugin before 2.0.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post w… |
CVE-2023-0099 | Medium | 6.1 | 2023-02-13 | The Simple URLs WordPress plugin before 115 does not sanitise and escape some parameters before outputting them back in some pages, leading to Reflected Cross-… |
CVE-2023-0098 | High | 8.8 | 2023-02-13 | The Simple URLs WordPress plugin before 115 does not escape some parameters before using them in various SQL statements used by AJAX actions available by any a… |
CVE-2023-0080 | High | 8.8 | 2023-02-13 | The Customer Reviews for WooCommerce WordPress plugin before 5.16.0 does not validate one of its shortcode attribute, which could allow users with a contributo… |