2023 CVEs (page 297)
Page 297 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-23475 | Medium | 4.6 | 2023-02-08 | IBM Infosphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2023-0690 | Medium | 5.0 | 2023-02-08 | HashiCorp Boundary from 0.10.0 through 0.11.2 contain an issue where when using a PKI-based worker with a Key Management Service (KMS) defined in the configura… |
CVE-2023-0003 | Medium | 6.5 | 2023-02-08 | A file disclosure vulnerability in the Palo Alto Networks Cortex XSOAR server software enables an authenticated user with access to the web interface to read l… |
CVE-2023-0002 | Medium | 5.5 | 2023-02-08 | A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to execute privileged cytool commands t… |
CVE-2023-0001 | Medium | 6.0 | 2023-02-08 | An information exposure vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local system administrator to disclose the admin p… |
CVE-2023-0748 | Medium | 6.4 | 2023-02-08 | Open Redirect in GitHub repository btcpayserver/btcpayserver prior to 1.7.6. |
CVE-2023-0747 | Medium | 5.5 | 2023-02-08 | Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.6. |
CVE-2023-0744 | Critical | 9.8 | 2023-02-08 | Improper Access Control in GitHub repository answerdev/answer prior to 1.0.4. |
CVE-2023-0743 | Critical | 9.0 | 2023-02-08 | Cross-site Scripting (XSS) - Generic in GitHub repository answerdev/answer prior to 1.0.4. |
CVE-2023-0742 | Critical | 9.0 | 2023-02-08 | Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.4. |
CVE-2023-0741 | Critical | 9.0 | 2023-02-08 | Cross-site Scripting (XSS) - DOM in GitHub repository answerdev/answer prior to 1.0.4. |
CVE-2023-0740 | Critical | 9.0 | 2023-02-08 | Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.4. |
CVE-2023-0739 | Medium | 6.8 | 2023-02-08 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitHub repository answerdev/answer prior to 1.0.4. |
CVE-2023-0726 | Medium | 5.4 | 2023-02-08 | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorr… |
CVE-2023-0725 | Medium | 5.4 | 2023-02-08 | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorr… |
CVE-2023-0724 | Medium | 5.4 | 2023-02-08 | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorr… |
CVE-2023-0722 | Medium | 5.4 | 2023-02-08 | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorr… |
CVE-2023-0720 | Medium | 5.4 | 2023-02-08 | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_folder_order function in versi… |
CVE-2023-0717 | Medium | 5.4 | 2023-02-08 | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_delete_folder function in versions… |
CVE-2023-0716 | Medium | 5.4 | 2023-02-08 | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_edit_folder function in versions up… |
CVE-2023-0715 | Medium | 5.4 | 2023-02-08 | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_clone_folder function in versions u… |
CVE-2023-0711 | Medium | 5.4 | 2023-02-08 | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_state function in versions up… |
CVE-2023-0685 | Medium | 5.4 | 2023-02-08 | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorr… |
CVE-2023-0684 | Medium | 5.4 | 2023-02-08 | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_unassign_folders function in versio… |
CVE-2023-24828 | High | 8.1 | 2023-02-08 | Onedev is a self-hosted Git Server with CI/CD and Kanban. In versions prior to 7.9.12 the algorithm used to generate access token and password reset keys was n… |
CVE-2023-0718 | Medium | 5.4 | 2023-02-08 | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_folder function in versions up… |
CVE-2023-23026 | Medium | 6.1 | 2023-02-07 | Cross site scripting (XSS) vulnerability in sourcecodester oretnom23 sales management system 1.0, allows attackers to execute arbitrary code via the product_na… |
CVE-2023-23011 | Medium | 6.1 | 2023-02-07 | Cross Site Scripting (XSS) vulnerability in InvoicePlane 1.6 via filter_product input to file modal_product_lookups.php. |
CVE-2023-0736 | Medium | 5.4 | 2023-02-07 | Cross-site Scripting (XSS) - Stored in GitHub repository wallabag/wallabag prior to 2.5.4. |
CVE-2023-0735 | Medium | 6.5 | 2023-02-07 | Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.5.4. |
CVE-2023-0731 | Medium | 6.4 | 2023-02-07 | The Interactive Geo Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the action content parameter in versions up to, and including, 1… |
CVE-2023-0730 | Medium | 5.4 | 2023-02-07 | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorr… |
CVE-2023-0727 | Medium | 5.4 | 2023-02-07 | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorr… |
CVE-2023-0723 | Medium | 5.4 | 2023-02-07 | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorr… |
CVE-2023-0719 | Medium | 5.4 | 2023-02-07 | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_sort_order function in version… |
CVE-2023-0712 | Medium | 5.4 | 2023-02-07 | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_move_object function in versions up… |
CVE-2023-0728 | Medium | 5.4 | 2023-02-07 | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorr… |
CVE-2023-0713 | Medium | 5.4 | 2023-02-07 | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_add_folder function in versions up… |
CVE-2023-23931 | Medium | 4.8 | 2023-02-07 | cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept… |
CVE-2023-0705 | High | 7.5 | 2023-02-07 | Integer overflow in Core in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who had one a race condition to potentially exploit heap corruption… |
CVE-2023-0704 | Medium | 6.5 | 2023-02-07 | Insufficient policy enforcement in DevTools in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to bypass same origin policy and proxy settings v… |
CVE-2023-0703 | High | 8.8 | 2023-02-07 | Type confusion in DevTools in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who convinced a user to engage in specific UI interactions to pote… |
CVE-2023-0702 | High | 8.8 | 2023-02-07 | Type confusion in Data Transfer in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who convinced a user to engage in specific UI interactions to… |
CVE-2023-0701 | High | 8.8 | 2023-02-07 | Heap buffer overflow in WebUI in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who convinced a user to engage in specific UI interactions to p… |
CVE-2023-0700 | Medium | 6.5 | 2023-02-07 | Inappropriate implementation in Download in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially spoof the contents of the Omnibox (UR… |
CVE-2023-0699 | High | 8.8 | 2023-02-07 | Use after free in GPU in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page and brow… |
CVE-2023-0698 | High | 8.8 | 2023-02-07 | Out of bounds read in WebRTC in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page… |
CVE-2023-0697 | Medium | 6.5 | 2023-02-07 | Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 110.0.5481.77 allowed a remote attacker to spoof the contents of the secu… |
CVE-2023-0696 | High | 8.8 | 2023-02-07 | Type confusion in V8 in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2023-25194 | High | 8.8 | 2023-02-07 | A possible security vulnerability has been identified in Apache Kafka Connect API. This requires access to a Kafka Connect worker, and the ability to create/mo… |
CVE-2023-0732 | Low | 3.5 | 2023-02-07 | A vulnerability has been found in SourceCodester Online Eyewear Shop 1.0 and classified as problematic. Affected by this vulnerability is the function registra… |
CVE-2023-24814 | High | 8.8 | 2023-02-07 | TYPO3 is a free and open source Content Management Framework released under the GNU General Public License. In affected versions the TYPO3 core component `Gene… |
CVE-2023-24813 | Critical | 10.0 | 2023-02-07 | Dompdf is an HTML to PDF converter written in php. Due to the difference in the attribute parser of Dompdf and php-svg-lib, an attacker can still call arbitrar… |
CVE-2023-22735 | Medium | 4.4 | 2023-02-07 | Zulip is an open-source team collaboration tool. In versions of zulip prior to commit `2f6c5a8` but after commit `04cf68b` users could upload files with arbitr… |
CVE-2023-0707 | Medium | 5.5 | 2023-02-07 | A vulnerability was found in SourceCodester Medical Certificate Generator App 1.0. It has been rated as critical. Affected by this issue is the function delete… |
CVE-2023-23696 | High | 7.0 | 2023-02-07 | Dell Command Intel vPro Out of Band, versions prior to 4.3.1, contain an Improper Authorization vulnerability. A locally authenticated malicious users could p… |
CVE-2023-22643 | Medium | 6.3 | 2023-02-07 | An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in libzypp-plugin-appdata of SUSE Linux Enterprise… |
CVE-2023-0706 | Medium | 6.3 | 2023-02-07 | A vulnerability, which was classified as critical, has been found in SourceCodester Medical Certificate Generator App 1.0. Affected by this issue is some unkno… |
CVE-2023-24827 | Medium | 6.5 | 2023-02-07 | syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. A password disclosure flaw was fo… |
CVE-2023-24808 | Medium | 5.3 | 2023-02-07 | PDFio is a C library for reading and writing PDF files. In versions prior to 1.1.0 a denial of service (DOS) vulnerability exists in the pdfio parser. Crafted… |
CVE-2023-23849 | Medium | 6.1 | 2023-02-06 | Versions of Coverity Connect prior to 2022.12.0 are vulnerable to an unauthenticated Cross-Site Scripting vulnerability. Any web service hosted on the same sub… |
CVE-2023-0615 | Medium | 5.5 | 2023-02-06 | A memory leak flaw and potential divide by zero and Integer overflow was found in the Linux kernel V4L2 and vivid test code functionality. This issue occurs wh… |
CVE-2023-23333 | Critical | 9.8 | 2023-02-06 | There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassing internal restrictions through downloa… |
CVE-2023-25016 | High | 7.5 | 2023-02-06 | Couchbase Server before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2 exposes Sensitive Information to an Unauthorized Actor. |
CVE-2023-23943 | Medium | 5.0 | 2023-02-06 | Nextcloud mail is an email app for the nextcloud home server platform. In affected versions the SMTP, IMAP and Sieve host fields allowed to scan for internal s… |
CVE-2023-23942 | Medium | 5.4 | 2023-02-06 | The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer. Versions prior to 3.6.3 are missing sanitisation on qml… |
CVE-2023-23944 | Low | 2.0 | 2023-02-06 | Nextcloud mail is an email app for the nextcloud home server platform. In versions prior to 2.2.2 user's passwords were stored in cleartext in the database dur… |
CVE-2023-20619 | Medium | 6.7 | 2023-02-06 | In vcu, there is a possible memory corruption due to improper locking. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2023-20618 | Medium | 6.7 | 2023-02-06 | In vcu, there is a possible memory corruption due to improper locking. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2023-20616 | Medium | 6.7 | 2023-02-06 | In ion, there is a possible out of bounds read due to type confusion. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2023-20615 | Medium | 6.7 | 2023-02-06 | In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20614 | Medium | 6.7 | 2023-02-06 | In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20613 | Medium | 6.7 | 2023-02-06 | In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20612 | Medium | 6.7 | 2023-02-06 | In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20611 | Medium | 6.4 | 2023-02-06 | In gpu, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. U… |
CVE-2023-20610 | Medium | 6.4 | 2023-02-06 | In display drm, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20609 | Medium | 4.4 | 2023-02-06 | In ccu, there is a possible out of bounds read due to a logic error. This could lead to local information disclosure with System execution privileges needed. U… |
CVE-2023-20608 | Medium | 6.4 | 2023-02-06 | In display drm, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges n… |
CVE-2023-20607 | Medium | 6.4 | 2023-02-06 | In ccu, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2023-20606 | Medium | 4.4 | 2023-02-06 | In apusys, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileg… |
CVE-2023-20605 | Medium | 4.4 | 2023-02-06 | In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution priv… |
CVE-2023-20604 | Medium | 6.7 | 2023-02-06 | In ged, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20602 | Medium | 6.7 | 2023-02-06 | In ged, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges n… |
CVE-2023-0686 | Medium | 5.0 | 2023-02-06 | A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been classified as critical. This affects the function update_cart of the file /oew… |
CVE-2023-0669 | High | 7.2 | 2023-02-06 | Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserial… |
CVE-2023-0282 | Medium | 5.4 | 2023-02-06 | The YourChannel WordPress plugin before 1.2.2 does not sanitize and escape some parameters, which could allow users with a role as low as Subscriber to perform… |
CVE-2023-0252 | Medium | 5.4 | 2023-02-06 | The Contextual Related Posts WordPress plugin before 3.3.1 does not validate and escape some of its block options before outputting them back in a page/post wh… |
CVE-2023-0236 | Medium | 6.1 | 2023-02-06 | The Tutor LMS WordPress plugin before 2.0.10 does not sanitise and escape the reset_key and user_id parameters before outputting then back in attributes, leadi… |
CVE-2023-0234 | High | 8.8 | 2023-02-06 | The SiteGround Security WordPress plugin before 1.3.1 does not properly sanitize user input before using it in an SQL query, leading to an authenticated SQL in… |
CVE-2023-0178 | Medium | 5.4 | 2023-02-06 | The Annual Archive WordPress plugin before 1.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where… |
CVE-2023-0176 | Medium | 5.4 | 2023-02-06 | The Giveaways and Contests by RafflePress WordPress plugin before 1.11.3 does not validate and escape some of its shortcode attributes before outputting them b… |
CVE-2023-0174 | Medium | 5.4 | 2023-02-06 | The WP VR WordPress plugin before 8.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shor… |
CVE-2023-0173 | Medium | 5.4 | 2023-02-06 | The Drag & Drop Sales Funnel Builder for WordPress plugin before 2.6.9 does not validate and escape some of its shortcode attributes before outputting them bac… |
CVE-2023-0171 | Medium | 5.4 | 2023-02-06 | The jQuery T(-) Countdown Widget WordPress plugin before 2.3.24 does not validate and escape some of its shortcode attributes before outputting them back in a… |
CVE-2023-0170 | Medium | 5.4 | 2023-02-06 | The Html5 Audio Player WordPress plugin before 2.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post… |
CVE-2023-0154 | Medium | 5.4 | 2023-02-06 | The GamiPress WordPress plugin before 1.0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the… |
CVE-2023-0153 | Medium | 5.4 | 2023-02-06 | The Vimeo Video Autoplay Automute WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a p… |
CVE-2023-0150 | Medium | 5.4 | 2023-02-06 | The Cloak Front End Email WordPress plugin before 1.9.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/pos… |
CVE-2023-0149 | Medium | 5.4 | 2023-02-06 | The WordPrezi WordPress plugin before 0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the sh… |
CVE-2023-0148 | Medium | 5.4 | 2023-02-06 | The Gallery Factory Lite WordPress plugin through 2.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/pos… |