2023 CVEs (page 295)
Page 295 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-0819 | High | 7.8 | 2023-02-13 | Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to v2.3.0-DEV. |
CVE-2023-0818 | Medium | 5.5 | 2023-02-13 | Off-by-one Error in GitHub repository gpac/gpac prior to v2.3.0-DEV. |
CVE-2023-0817 | High | 7.8 | 2023-02-13 | Buffer Over-read in GitHub repository gpac/gpac prior to v2.3.0-DEV. |
CVE-2023-25572 | Medium | 5.4 | 2023-02-13 | react-admin is a frontend framework for building browser applications on top of REST/GraphQL APIs. react-admin prior to versions 3.19.12 and 4.7.6, along with… |
CVE-2023-25241 | Medium | 6.1 | 2023-02-13 | bgERP v22.31 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Search parameter. |
CVE-2023-25240 | High | 8.8 | 2023-02-13 | An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code. |
CVE-2023-25162 | Medium | 5.3 | 2023-02-13 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to 24.0.8 and 23.0.12 and Nextcloud Ent… |
CVE-2023-25161 | Low | 3.7 | 2023-02-13 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to vers… |
CVE-2023-25160 | Medium | 4.1 | 2023-02-13 | Nextcloud Mail is an email app for the Nextcloud home server platform. Prior to versions 2.2.1, 1.14.5, 1.12.9, and 1.11.8, an attacker can access the mail box… |
CVE-2023-24648 | Medium | 6.1 | 2023-02-13 | Zstore v6.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /index.php. |
CVE-2023-24647 | High | 7.5 | 2023-02-13 | Food Ordering System v2.0 was discovered to contain a SQL injection vulnerability via the email parameter. |
CVE-2023-24646 | Critical | 9.8 | 2023-02-13 | An arbitrary file upload vulnerability in the component /fos/admin/ajax.php of Food Ordering System v2.0 allows attackers to execute arbitrary code via a craft… |
CVE-2023-24086 | Medium | 6.1 | 2023-02-13 | SLIMS v9.5.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /customs/loan_by_class.php?reportView. |
CVE-2023-24084 | Critical | 9.8 | 2023-02-13 | ChiKoi v1.0 was discovered to contain a SQL injection vulnerability via the load_file function. |
CVE-2023-25719 | High | 8.8 | 2023-02-13 | ConnectWise Control before 22.9.10032 (formerly known as ScreenConnect) fails to validate user-supplied parameters such as the Bin/ConnectWiseControl.Client.ex… |
CVE-2023-25718 | Critical | 9.8 | 2023-02-13 | In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signed, additional instructions can be added without i… |
CVE-2023-25717 | Critical | 9.8 | 2023-02-13 | Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=adm… |
CVE-2023-24188 | Critical | 9.1 | 2023-02-13 | ureport v2.2.9 was discovered to contain a directory traversal vulnerability via the deletion function which allows for arbitrary files to be deleted. |
CVE-2023-24619 | Medium | 5.5 | 2023-02-13 | Redpanda before 22.3.12 discloses cleartext AWS credentials. The import functionality in the rpk binary logs an AWS Access Key ID and Secret in cleartext to st… |
CVE-2023-23553 | Medium | 4.5 | 2023-02-13 | Control By Web X-400 devices are vulnerable to a cross-site scripting attack, which could result in private and session information being transferred to the a… |
CVE-2023-23551 | Critical | 9.1 | 2023-02-13 | Control By Web X-600M devices run Lua scripts and are vulnerable to code injection, which could allow an attacker to remotely execute arbitrary code. |
CVE-2023-22854 | High | 7.5 | 2023-02-13 | The ccmweb component of Mitel MiContact Center Business server 9.2.2.0 through 9.4.1.0 could allow an unauthenticated attacker to download arbitrary files, due… |
CVE-2023-25159 | Low | 2.3 | 2023-02-13 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Office is a document collaboration app for the s… |
CVE-2023-24804 | Medium | 5.0 | 2023-02-13 | The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Prior to version 3.0, the app has an incomplete fix for a path tra… |
CVE-2023-23948 | Medium | 6.2 | 2023-02-13 | The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Version 2.21.1 of the ownCloud Android app is vulnerable to SQL in… |
CVE-2023-0810 | Medium | 5.4 | 2023-02-13 | Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.11. |
CVE-2023-0405 | Medium | 4.3 | 2023-02-13 | The GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training WordPress plugin before 1.4.38 does not perform any kin… |
CVE-2023-0379 | Medium | 5.4 | 2023-02-13 | The Spotlight Social Feeds WordPress plugin before 1.4.3 does not validate and escape some of its block options before outputting them back in a page/post wher… |
CVE-2023-0373 | Medium | 5.4 | 2023-02-13 | The Lightweight Accordion WordPress plugin before 1.5.15 does not validate and escape some of its block options before outputting them back in a page/post wher… |
CVE-2023-0362 | Medium | 5.4 | 2023-02-13 | Themify Portfolio Post WordPress plugin before 1.2.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post w… |
CVE-2023-0360 | Medium | 5.4 | 2023-02-13 | The Location Weather WordPress plugin before 1.3.4 does not validate and escape some of its block options before outputting them back in a page/post where the… |
CVE-2023-0333 | Medium | 5.4 | 2023-02-13 | The TemplatesNext ToolKit WordPress plugin before 3.2.9 does not validate some of its shortcode attributes before using them to generate an HTML tag, which cou… |
CVE-2023-0275 | Medium | 5.4 | 2023-02-13 | The Easy Accept Payments for PayPal WordPress plugin before 4.9.10 does not validate and escape some of its shortcode attributes before outputting them back in… |
CVE-2023-0270 | Medium | 5.4 | 2023-02-13 | The YaMaps for WordPress Plugin WordPress plugin before 0.6.26 does not validate and escape some of its shortcode attributes before outputting them back in a p… |
CVE-2023-0263 | High | 8.8 | 2023-02-13 | The WP Yelp Review Slider WordPress plugin before 7.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL in… |
CVE-2023-0262 | High | 8.8 | 2023-02-13 | The WP Airbnb Review Slider WordPress plugin before 3.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL… |
CVE-2023-0261 | High | 8.8 | 2023-02-13 | The WP TripAdvisor Review Slider WordPress plugin before 10.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to… |
CVE-2023-0260 | High | 8.8 | 2023-02-13 | The WP Review Slider WordPress plugin before 12.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL inject… |
CVE-2023-0259 | High | 8.8 | 2023-02-13 | The WP Google Review Slider WordPress plugin before 11.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL… |
CVE-2023-0255 | High | 8.8 | 2023-02-13 | The Enable Media Replace WordPress plugin before 4.0.2 does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP… |
CVE-2023-0220 | High | 8.8 | 2023-02-13 | The Pinpoint Booking System WordPress plugin before 2.9.9.2.9 does not validate and escape one of its shortcode attributes before using it in a SQL statement… |
CVE-2023-0177 | Medium | 5.4 | 2023-02-13 | The Social Like Box and Page by WpDevArt WordPress plugin before 0.8.41 does not validate and escape some of its shortcode attributes before outputting them ba… |
CVE-2023-0169 | Medium | 5.4 | 2023-02-13 | The Zoho Forms WordPress plugin before 3.0.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the… |
CVE-2023-0166 | Medium | 5.4 | 2023-02-13 | The Product Slider for WooCommerce by PickPlugins WordPress plugin before 1.13.42 does not validate and escape some of its shortcode attributes before outputti… |
CVE-2023-0159 | High | 7.5 | 2023-02-13 | The Extensive VC Addons for WPBakery page builder WordPress plugin before 1.9.1 does not validate a parameter passed to the php extract function when loading t… |
CVE-2023-0151 | Medium | 5.4 | 2023-02-13 | The uTubeVideo Gallery WordPress plugin before 2.0.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post w… |
CVE-2023-0099 | Medium | 6.1 | 2023-02-13 | The Simple URLs WordPress plugin before 115 does not sanitise and escape some parameters before outputting them back in some pages, leading to Reflected Cross-… |
CVE-2023-0098 | High | 8.8 | 2023-02-13 | The Simple URLs WordPress plugin before 115 does not escape some parameters before using them in various SQL statements used by AJAX actions available by any a… |
CVE-2023-0080 | High | 8.8 | 2023-02-13 | The Customer Reviews for WooCommerce WordPress plugin before 5.16.0 does not validate one of its shortcode attribute, which could allow users with a contributo… |
CVE-2023-0075 | Medium | 5.4 | 2023-02-13 | The Amazon JS WordPress plugin through 0.10 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the… |
CVE-2023-0061 | Medium | 5.4 | 2023-02-13 | The Judge.me Product Reviews for WooCommerce WordPress plugin before 1.3.21 does not validate and escape some of its shortcode attributes before outputting the… |
CVE-2023-0060 | Medium | 5.4 | 2023-02-13 | The Responsive Gallery Grid WordPress plugin before 2.3.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/p… |
CVE-2023-0034 | Medium | 5.4 | 2023-02-13 | The JetWidgets For Elementor WordPress plugin before 1.0.14 does not validate and escape some of its shortcode attributes before outputting them back in a page… |
CVE-2023-0808 | Low | 3.9 | 2023-02-13 | A vulnerability was found in Deye/Revolt/Bosswerk Inverter MW3_15U_5406_1.47/MW3_15U_5406_1.471. It has been rated as problematic. This issue affects some unkn… |
CVE-2023-24572 | Medium | 4.7 | 2023-02-13 | Dell Command | Integration Suite for System Center, versions before 6.4.0 contain an arbitrary folder delete vulnerability during uninstallation. A locally au… |
CVE-2023-23697 | Medium | 4.7 | 2023-02-13 | Dell Command | Intel vPro Out of Band, versions before 4.4.0, contain an arbitrary folder delete vulnerability during uninstallation. A locally authenticated m… |
CVE-2023-25727 | Medium | 5.4 | 2023-02-13 | In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-and-drop interface. |
CVE-2023-22367 | Medium | 5.9 | 2023-02-13 | Ichiran App for iOS versions prior to 3.1.0 and Ichiran App for Android versions prior to 3.1.0 improperly verify server certificates, which may allow a remote… |
CVE-2023-22362 | High | 7.5 | 2023-02-13 | SUSHIRO App for Android outputs sensitive information to the log file, which may result in an attacker obtaining a credential information from the log file. Af… |
CVE-2023-22360 | High | 7.8 | 2023-02-13 | Use-after free vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier due to lack of error handling process even when an error was de… |
CVE-2023-22353 | High | 7.8 | 2023-02-13 | Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verified when processing c… |
CVE-2023-22350 | High | 7.8 | 2023-02-13 | Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verified when processing p… |
CVE-2023-22349 | High | 7.8 | 2023-02-13 | Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verified when processing s… |
CVE-2023-22347 | High | 7.8 | 2023-02-13 | Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verified when processing f… |
CVE-2023-22346 | High | 7.8 | 2023-02-13 | Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verified when processing t… |
CVE-2023-22345 | High | 7.8 | 2023-02-13 | Out-of-bound write vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier due to lack of error handling process when out of specifica… |
CVE-2023-0794 | High | 8.3 | 2023-02-12 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11. |
CVE-2023-0793 | High | 7.1 | 2023-02-12 | Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.11. |
CVE-2023-0792 | Medium | 6.5 | 2023-02-12 | Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11. |
CVE-2023-0791 | High | 8.3 | 2023-02-12 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11. |
CVE-2023-0790 | High | 7.6 | 2023-02-12 | Uncaught Exception in GitHub repository thorsten/phpmyfaq prior to 3.1.11. |
CVE-2023-0789 | High | 8.1 | 2023-02-12 | Command Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11. |
CVE-2023-0788 | High | 8.1 | 2023-02-12 | Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11. |
CVE-2023-0787 | High | 8.1 | 2023-02-12 | Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11. |
CVE-2023-0786 | High | 8.4 | 2023-02-12 | Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11. |
CVE-2023-0785 | Low | 3.7 | 2023-02-12 | A vulnerability classified as problematic was found in SourceCodester Best Online News Portal 1.0. Affected by this vulnerability is an unknown functionality o… |
CVE-2023-0784 | High | 7.3 | 2023-02-12 | A vulnerability classified as critical has been found in SourceCodester Best Online News Portal 1.0. Affected is an unknown function of the component Login Pag… |
CVE-2023-20076 | High | 7.2 | 2023-02-12 | A vulnerability in the Cisco IOx application hosting environment could allow an authenticated, remote attacker to execute arbitrary commands as root on the und… |
CVE-2023-0661 | Medium | 6.5 | 2023-02-12 | Improper access control in Devolutions Server allows an authenticated user to access unauthorized sensitive data. |
CVE-2023-0783 | Medium | 4.7 | 2023-02-11 | A vulnerability was found in EcShop 4.1.5. It has been classified as critical. This affects an unknown part of the file /ecshop/admin/template.php of the compo… |
CVE-2023-0782 | High | 7.2 | 2023-02-11 | A vulnerability was found in Tenda AC23 16.03.07.45 and classified as critical. Affected by this issue is the function formSetSysToolDDNS/formGetSysToolDDNS of… |
CVE-2023-0127 | High | 7.8 | 2023-02-11 | A command injection vulnerability in the firmware_update command, in the device's restricted telnet interface, allows an authenticated attacker to execute arbi… |
CVE-2023-0781 | Medium | 6.3 | 2023-02-11 | A vulnerability was found in SourceCodester Canteen Management System 1.0. It has been declared as critical. This vulnerability affects the function query of t… |
CVE-2023-0780 | Medium | 5.4 | 2023-02-11 | Improper Restriction of Rendered UI Layers or Frames in GitHub repository cockpit-hq/cockpit prior to 2.3.9-dev. |
CVE-2023-25562 | Medium | 6.9 | 2023-02-11 | DataHub is an open-source metadata platform. In versions of DataHub prior to 0.8.45 Session cookies are only cleared on new sign-in events and not on logout ev… |
CVE-2023-25561 | Medium | 5.7 | 2023-02-11 | DataHub is an open-source metadata platform. In the event a system is using Java Authentication and Authorization Service (JAAS) authentication and that system… |
CVE-2023-25560 | High | 8.2 | 2023-02-11 | DataHub is an open-source metadata platform. The AuthServiceClient which is responsible for creation of new accounts, verifying credentials, resetting them or… |
CVE-2023-25559 | High | 8.2 | 2023-02-11 | DataHub is an open-source metadata platform. When not using authentication for the metadata service, which is the default configuration, the Metadata service (… |
CVE-2023-25558 | High | 7.5 | 2023-02-11 | DataHub is an open-source metadata platform. When the DataHub frontend is configured to authenticate via SSO, it will leverage the pac4j library. The processin… |
CVE-2023-25557 | High | 7.5 | 2023-02-11 | DataHub is an open-source metadata platform. The DataHub frontend acts as a proxy able to forward any REST or GraphQL requests to the backend. The goal of this… |
CVE-2023-0776 | High | 8.1 | 2023-02-11 | Baicells Nova 436Q, Nova 430E, Nova 430I, and Neutrino 430 LTE TDD eNodeB devices with firmware through QRTB 2.12.7 are vulnerable to remote shell code exploit… |
CVE-2023-24816 | Medium | 4.5 | 2023-02-10 | IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming la… |
CVE-2023-23163 | Critical | 9.8 | 2023-02-10 | Art Gallery Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter. |
CVE-2023-23162 | Critical | 9.8 | 2023-02-10 | Art Gallery Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the cid parameter at product.php. |
CVE-2023-23161 | Medium | 6.1 | 2023-02-10 | A reflected cross-site scripting (XSS) vulnerability in Art Gallery Management System Project v1.0 allows attackers to execute arbitrary web scripts or HTML vi… |
CVE-2023-0777 | Critical | 9.8 | 2023-02-10 | Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4. |
CVE-2023-24234 | Medium | 4.8 | 2023-02-10 | A stored cross-site scripting (XSS) vulnerability in the component php-inventory-management-system/brand.php of Inventory Management System v1 allows attackers… |
CVE-2023-24233 | Medium | 4.8 | 2023-02-10 | A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/orders.php?o=add of Inventory Management System v1 allows a… |
CVE-2023-24232 | Medium | 4.8 | 2023-02-10 | A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/product.php of Inventory Management System v1 allows attack… |
CVE-2023-24231 | Medium | 4.8 | 2023-02-10 | A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/categories.php of Inventory Management System v1 allows att… |