2023 CVEs (page 296)
Page 296 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-0075 | Medium | 5.4 | 2023-02-13 | The Amazon JS WordPress plugin through 0.10 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the… |
CVE-2023-0061 | Medium | 5.4 | 2023-02-13 | The Judge.me Product Reviews for WooCommerce WordPress plugin before 1.3.21 does not validate and escape some of its shortcode attributes before outputting the… |
CVE-2023-0060 | Medium | 5.4 | 2023-02-13 | The Responsive Gallery Grid WordPress plugin before 2.3.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/p… |
CVE-2023-0034 | Medium | 5.4 | 2023-02-13 | The JetWidgets For Elementor WordPress plugin before 1.0.14 does not validate and escape some of its shortcode attributes before outputting them back in a page… |
CVE-2023-0808 | Low | 3.9 | 2023-02-13 | A vulnerability was found in Deye/Revolt/Bosswerk Inverter MW3_15U_5406_1.47/MW3_15U_5406_1.471. It has been rated as problematic. This issue affects some unkn… |
CVE-2023-24572 | Medium | 4.7 | 2023-02-13 | Dell Command | Integration Suite for System Center, versions before 6.4.0 contain an arbitrary folder delete vulnerability during uninstallation. A locally au… |
CVE-2023-23697 | Medium | 4.7 | 2023-02-13 | Dell Command | Intel vPro Out of Band, versions before 4.4.0, contain an arbitrary folder delete vulnerability during uninstallation. A locally authenticated m… |
CVE-2023-25727 | Medium | 5.4 | 2023-02-13 | In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-and-drop interface. |
CVE-2023-22367 | Medium | 5.9 | 2023-02-13 | Ichiran App for iOS versions prior to 3.1.0 and Ichiran App for Android versions prior to 3.1.0 improperly verify server certificates, which may allow a remote… |
CVE-2023-22362 | High | 7.5 | 2023-02-13 | SUSHIRO App for Android outputs sensitive information to the log file, which may result in an attacker obtaining a credential information from the log file. Af… |
CVE-2023-22360 | High | 7.8 | 2023-02-13 | Use-after free vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier due to lack of error handling process even when an error was de… |
CVE-2023-22353 | High | 7.8 | 2023-02-13 | Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verified when processing c… |
CVE-2023-22350 | High | 7.8 | 2023-02-13 | Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verified when processing p… |
CVE-2023-22349 | High | 7.8 | 2023-02-13 | Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verified when processing s… |
CVE-2023-22347 | High | 7.8 | 2023-02-13 | Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verified when processing f… |
CVE-2023-22346 | High | 7.8 | 2023-02-13 | Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verified when processing t… |
CVE-2023-22345 | High | 7.8 | 2023-02-13 | Out-of-bound write vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier due to lack of error handling process when out of specifica… |
CVE-2023-0794 | High | 8.3 | 2023-02-12 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11. |
CVE-2023-0793 | High | 7.1 | 2023-02-12 | Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.11. |
CVE-2023-0792 | Medium | 6.5 | 2023-02-12 | Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11. |
CVE-2023-0791 | High | 8.3 | 2023-02-12 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11. |
CVE-2023-0790 | High | 7.6 | 2023-02-12 | Uncaught Exception in GitHub repository thorsten/phpmyfaq prior to 3.1.11. |
CVE-2023-0789 | High | 8.1 | 2023-02-12 | Command Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11. |
CVE-2023-0788 | High | 8.1 | 2023-02-12 | Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11. |
CVE-2023-0787 | High | 8.1 | 2023-02-12 | Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11. |
CVE-2023-0786 | High | 8.4 | 2023-02-12 | Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11. |
CVE-2023-0785 | Low | 3.7 | 2023-02-12 | A vulnerability classified as problematic was found in SourceCodester Best Online News Portal 1.0. Affected by this vulnerability is an unknown functionality o… |
CVE-2023-0784 | High | 7.3 | 2023-02-12 | A vulnerability classified as critical has been found in SourceCodester Best Online News Portal 1.0. Affected is an unknown function of the component Login Pag… |
CVE-2023-20076 | High | 7.2 | 2023-02-12 | A vulnerability in the Cisco IOx application hosting environment could allow an authenticated, remote attacker to execute arbitrary commands as root on the und… |
CVE-2023-0661 | Medium | 6.5 | 2023-02-12 | Improper access control in Devolutions Server allows an authenticated user to access unauthorized sensitive data. |
CVE-2023-0783 | Medium | 4.7 | 2023-02-11 | A vulnerability was found in EcShop 4.1.5. It has been classified as critical. This affects an unknown part of the file /ecshop/admin/template.php of the compo… |
CVE-2023-0782 | High | 7.2 | 2023-02-11 | A vulnerability was found in Tenda AC23 16.03.07.45 and classified as critical. Affected by this issue is the function formSetSysToolDDNS/formGetSysToolDDNS of… |
CVE-2023-0127 | High | 7.8 | 2023-02-11 | A command injection vulnerability in the firmware_update command, in the device's restricted telnet interface, allows an authenticated attacker to execute arbi… |
CVE-2023-0781 | Medium | 6.3 | 2023-02-11 | A vulnerability was found in SourceCodester Canteen Management System 1.0. It has been declared as critical. This vulnerability affects the function query of t… |
CVE-2023-0780 | Medium | 5.4 | 2023-02-11 | Improper Restriction of Rendered UI Layers or Frames in GitHub repository cockpit-hq/cockpit prior to 2.3.9-dev. |
CVE-2023-25562 | Medium | 6.9 | 2023-02-11 | DataHub is an open-source metadata platform. In versions of DataHub prior to 0.8.45 Session cookies are only cleared on new sign-in events and not on logout ev… |
CVE-2023-25561 | Medium | 5.7 | 2023-02-11 | DataHub is an open-source metadata platform. In the event a system is using Java Authentication and Authorization Service (JAAS) authentication and that system… |
CVE-2023-25560 | High | 8.2 | 2023-02-11 | DataHub is an open-source metadata platform. The AuthServiceClient which is responsible for creation of new accounts, verifying credentials, resetting them or… |
CVE-2023-25559 | High | 8.2 | 2023-02-11 | DataHub is an open-source metadata platform. When not using authentication for the metadata service, which is the default configuration, the Metadata service (… |
CVE-2023-25558 | High | 7.5 | 2023-02-11 | DataHub is an open-source metadata platform. When the DataHub frontend is configured to authenticate via SSO, it will leverage the pac4j library. The processin… |
CVE-2023-25557 | High | 7.5 | 2023-02-11 | DataHub is an open-source metadata platform. The DataHub frontend acts as a proxy able to forward any REST or GraphQL requests to the backend. The goal of this… |
CVE-2023-0776 | High | 8.1 | 2023-02-11 | Baicells Nova 436Q, Nova 430E, Nova 430I, and Neutrino 430 LTE TDD eNodeB devices with firmware through QRTB 2.12.7 are vulnerable to remote shell code exploit… |
CVE-2023-24816 | Medium | 4.5 | 2023-02-10 | IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming la… |
CVE-2023-23163 | Critical | 9.8 | 2023-02-10 | Art Gallery Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter. |
CVE-2023-23162 | Critical | 9.8 | 2023-02-10 | Art Gallery Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the cid parameter at product.php. |
CVE-2023-23161 | Medium | 6.1 | 2023-02-10 | A reflected cross-site scripting (XSS) vulnerability in Art Gallery Management System Project v1.0 allows attackers to execute arbitrary web scripts or HTML vi… |
CVE-2023-0777 | Critical | 9.8 | 2023-02-10 | Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4. |
CVE-2023-24234 | Medium | 4.8 | 2023-02-10 | A stored cross-site scripting (XSS) vulnerability in the component php-inventory-management-system/brand.php of Inventory Management System v1 allows attackers… |
CVE-2023-24233 | Medium | 4.8 | 2023-02-10 | A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/orders.php?o=add of Inventory Management System v1 allows a… |
CVE-2023-24232 | Medium | 4.8 | 2023-02-10 | A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/product.php of Inventory Management System v1 allows attack… |
CVE-2023-24231 | Medium | 4.8 | 2023-02-10 | A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/categories.php of Inventory Management System v1 allows att… |
CVE-2023-24230 | Medium | 4.8 | 2023-02-10 | A stored cross-site scripting (XSS) vulnerability in the component /formwork/panel/dashboard of Formwork v1.12.1 allows attackers to execute arbitrary web scri… |
CVE-2023-24352 | Critical | 9.8 | 2023-02-10 | D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the webpage parameter at /goform/formWPS. |
CVE-2023-24351 | Critical | 9.8 | 2023-02-10 | D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the FILECODE parameter at /goform/formLogin. |
CVE-2023-24350 | Critical | 9.8 | 2023-02-10 | D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the config.smtp_email_subject parameter at /goform/formSetEmail. |
CVE-2023-24349 | Critical | 9.8 | 2023-02-10 | D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the curTime parameter at /goform/formSetRoute. |
CVE-2023-24348 | Critical | 9.8 | 2023-02-10 | D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the curTime parameter at /goform/formSetACLFilter. |
CVE-2023-24347 | High | 8.8 | 2023-02-10 | D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the webpage parameter at /goform/formSetWanDhcpplus. |
CVE-2023-24346 | High | 8.8 | 2023-02-10 | D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the wan_connected parameter at /goform/formEasySetupWizard3. |
CVE-2023-24345 | High | 8.8 | 2023-02-10 | D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the curTime parameter at /goform/formSetWanDhcpplus. |
CVE-2023-24344 | High | 8.8 | 2023-02-10 | D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the webpage parameter at /goform/formWlanGuestSetup. |
CVE-2023-24343 | High | 8.8 | 2023-02-10 | D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the curTime parameter at /goform/formSchedule. |
CVE-2023-24573 | Medium | 4.7 | 2023-02-10 | Dell Command | Monitor versions prior to 10.9 contain an arbitrary folder delete vulnerability during uninstallation. A locally authenticated malicious user m… |
CVE-2023-24569 | High | 7.8 | 2023-02-10 | Dell Alienware Command Center versions 5.5.37.0 and prior contain an Improper Input validation vulnerability. A local authenticated malicious user could poten… |
CVE-2023-23698 | Medium | 5.5 | 2023-02-10 | Dell Command | Update, Dell Update, and Alienware Update versions before 4.6.0 and 4.7.1 contain Insecure Operation on Windows Junction in the installer compo… |
CVE-2023-0774 | High | 7.3 | 2023-02-10 | A vulnerability has been found in SourceCodester Medical Certificate Generator App 1.0 and classified as critical. This vulnerability affects unknown code of t… |
CVE-2023-22832 | High | 7.5 | 2023-02-10 | The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configurations that include the… |
CVE-2023-23286 | Medium | 6.1 | 2023-02-10 | Cross Site Scripting (XSS) vulnerability in Provide server 14.4 allows attackers to execute arbitrary code through the server-log via username field from the l… |
CVE-2023-0771 | High | 8.8 | 2023-02-10 | SQL Injection in GitHub repository ampache/ampache prior to 5.5.7,develop. |
CVE-2023-24690 | Medium | 5.4 | 2023-02-09 | ChurchCRM 4.5.3 and below was discovered to contain a stored cross-site scripting (XSS) vulnerability at /api/public/register/family. |
CVE-2023-24686 | Medium | 4.8 | 2023-02-09 | An issue in the CSV Import function of ChurchCRM v4.5.3 and below allows attackers to execute arbitrary code via importing a crafted CSV file. |
CVE-2023-24685 | High | 7.2 | 2023-02-09 | ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the Event parameter under the Event Attendance reports module. |
CVE-2023-24684 | High | 7.2 | 2023-02-09 | ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the EID parameter at GetText.php. |
CVE-2023-23592 | High | 7.5 | 2023-02-09 | WALLIX Access Manager 3.x through 4.0.x allows a remote attacker to access sensitive information. |
CVE-2023-0770 | High | 7.8 | 2023-02-09 | Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.2. |
CVE-2023-23631 | Medium | 5.9 | 2023-02-09 | github.com/ipfs/go-unixfsnode is an ADL IPLD prime node that wraps go-codec-dagpb's implementation of protobuf to enable pathing. In versions priot to 1.5.2 tr… |
CVE-2023-23626 | Medium | 5.9 | 2023-02-09 | go-bitfield is a simple bitfield package for the go language aiming to be more performant that the standard library. When feeding untrusted user input into the… |
CVE-2023-23625 | Medium | 5.9 | 2023-02-09 | go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag. Trying to read malformed HAMT sharded directories can cause panics and vi… |
CVE-2023-24689 | Medium | 4.3 | 2023-02-09 | An issue in Mojoportal v2.7.0.0 and below allows an authenticated attacker to list all css files inside the root path of the webserver via manipulation of the… |
CVE-2023-24688 | Medium | 5.3 | 2023-02-09 | An issue in Mojoportal v2.7.0.0 allows an unauthenticated attacker to register a new user even if the Allow User Registrations feature is disabled. |
CVE-2023-24687 | Medium | 5.4 | 2023-02-09 | Mojoportal v2.7.0.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Company Info Settings component. This vulnerability allo… |
CVE-2023-24323 | High | 8.8 | 2023-02-09 | Mojoportal v2.7 was discovered to contain an authenticated XML external entity (XXE) injection vulnerability. |
CVE-2023-24322 | Medium | 6.1 | 2023-02-09 | A reflected cross-site scripting (XSS) vulnerability in the FileDialog.aspx component of mojoPortal v2.7.0.0 allows attackers to execute arbitrary web scripts… |
CVE-2023-23912 | High | 8.8 | 2023-02-09 | A vulnerability, found in EdgeRouters Version 2.0.9-hotfix.5 and earlier and UniFi Security Gateways (USG) Version 4.4.56 and earlier with their DHCPv6 prefix… |
CVE-2023-22799 | High | 7.5 | 2023-02-09 | A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regular expression engin… |
CVE-2023-22798 | Medium | 6.1 | 2023-02-09 | Prior to commit 51867e0d15a6d7f80d5b714fd0e9976b9c160bb0, https://github.com/brave/adblock-lists removed redirect interceptors on some websites like Facebook i… |
CVE-2023-22797 | Medium | 6.1 | 2023-02-09 | An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling redirect_to with untrusted user input. In… |
CVE-2023-22796 | High | 7.5 | 2023-02-09 | A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the… |
CVE-2023-22795 | High | 7.5 | 2023-02-09 | A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Mat… |
CVE-2023-22794 | High | 8.8 | 2023-02-09 | A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the `annot… |
CVE-2023-22792 | High | 7.5 | 2023-02-09 | A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1. Specially crafted cookies, in combination with a specially cr… |
CVE-2023-21451 | Medium | 6.7 | 2023-02-09 | A Stack-based overflow vulnerability in IpcRxEmbmsSessionList in SECRIL prior to Android S(12) allows attacker to cause memory corruptions. |
CVE-2023-21450 | Low | 2.3 | 2023-02-09 | Missing Authorization vulnerability in One Hand Operation + prior to version 6.1.21 allows multi-users to access owner's widget without authorization via g… |
CVE-2023-21448 | Medium | 5.7 | 2023-02-09 | Path traversal vulnerability in Samsung Cloud prior to version 5.3.0.32 allows attacker to access specific png file. |
CVE-2023-21447 | Medium | 4.0 | 2023-02-09 | Improper access control vulnerabilities in Samsung Cloud prior to version 5.3.0.32 allows local attackers to access information with Samsung Cloud's privil… |
CVE-2023-21446 | Medium | 6.2 | 2023-02-09 | Improper input validation in MyFiles prior to version 12.2.09 in Android R(11), 13.1.03.501 in Android S( 12) and 14.1.00.422 in Android T(13) allows local att… |
CVE-2023-21445 | Medium | 5.5 | 2023-02-09 | Improper access control vulnerability in MyFiles prior to versions 12.2.09 in Android R(11), 13.1.03.501 in Android S(12) and 14.1.00.422 in Android T(13) allo… |
CVE-2023-21444 | High | 7.5 | 2023-02-09 | Improper cryptographic implementation in Samsung Flow for PC 4.9.14.0 allows adjacent attackers to decrypt encrypted messages or inject commands. |
CVE-2023-21443 | High | 7.5 | 2023-02-09 | Improper cryptographic implementation in Samsung Flow for Android prior to version 4.9.04 allows adjacent attackers to decrypt encrypted messages or inject com… |
CVE-2023-21442 | Medium | 4.0 | 2023-02-09 | Improper access control vulnerability in Runestone application prior to version 2.9.09.003 in Android R(11) and 3.2.01.007 in Android S(12) allows local attack… |