2023 CVEs (page 298)
Page 298 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-0147 | Medium | 5.4 | 2023-02-06 | The Flexible Captcha WordPress plugin through 4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post wher… |
CVE-2023-0146 | Medium | 5.4 | 2023-02-06 | The Naver Map WordPress plugin through 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the… |
CVE-2023-0144 | Medium | 5.4 | 2023-02-06 | The Event Manager and Tickets Selling Plugin for WooCommerce WordPress plugin before 3.8.0 does not validate and escape some of its post meta before outputting… |
CVE-2023-0143 | Medium | 5.4 | 2023-02-06 | The Send PDF for Contact Form 7 WordPress plugin before 0.9.9.2 does not validate and escape some of its shortcode attributes before outputting them back in th… |
CVE-2023-0096 | Medium | 5.4 | 2023-02-06 | The Happyforms WordPress plugin before 1.22.0 does not validate and escape some of its block options before outputting them back in a page/post where the block… |
CVE-2023-0095 | Medium | 5.4 | 2023-02-06 | The Page View Count WordPress plugin before 2.6.1 does not validate and escape some of its block options before outputting them back in a page/post where the b… |
CVE-2023-0082 | Medium | 5.4 | 2023-02-06 | The ExactMetrics WordPress plugin before 7.12.1 does not validate and escape some of its block options before outputting them back in a page/post where the blo… |
CVE-2023-0081 | Medium | 5.4 | 2023-02-06 | The MonsterInsights WordPress plugin before 8.12.1 does not validate and escape some of its block options before outputting them back in a page/post where the… |
CVE-2023-0072 | Medium | 5.4 | 2023-02-06 | The WC Vendors Marketplace WordPress plugin before 2.4.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/po… |
CVE-2023-0070 | Medium | 5.4 | 2023-02-06 | The ResponsiveVoice Text To Speech WordPress plugin before 1.7.7 does not validate and escape some of its shortcode attributes before outputting them back in a… |
CVE-2023-0062 | Medium | 5.4 | 2023-02-06 | The EAN for WooCommerce WordPress plugin before 4.4.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post… |
CVE-2023-0687 | Medium | 4.6 | 2023-02-06 | A vulnerability was found in GNU C Library 2.38. It has been declared as critical. This vulnerability affects the function __monstartup of the file gmon.c of t… |
CVE-2023-24276 | Critical | 9.8 | 2023-02-06 | TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the country parameter at setting/delStaticDhcpRules. |
CVE-2023-24202 | Critical | 9.8 | 2023-02-06 | Raffle Draw System v1.0 was discovered to contain a local file inclusion vulnerability via the page parameter in index.php. |
CVE-2023-24201 | Critical | 9.8 | 2023-02-06 | Raffle Draw System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at get_ticket.php. |
CVE-2023-24200 | Critical | 9.8 | 2023-02-06 | Raffle Draw System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at save_ticket.php. |
CVE-2023-24199 | Critical | 9.8 | 2023-02-06 | Raffle Draw System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at delete_ticket.php. |
CVE-2023-24198 | Critical | 9.8 | 2023-02-06 | Raffle Draw System v1.0 was discovered to contain multiple SQL injection vulnerabilities at save_winner.php via the ticket_id and draw parameters. |
CVE-2023-24197 | Medium | 6.1 | 2023-02-06 | Online Food Ordering System v2 was discovered to contain a SQL injection vulnerability via the id parameter at view_order.php. |
CVE-2023-24195 | Medium | 6.1 | 2023-02-06 | Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the page parameter in index.php. |
CVE-2023-24194 | Medium | 6.1 | 2023-02-06 | Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the page parameter in navbar.php. |
CVE-2023-24192 | Medium | 6.1 | 2023-02-06 | Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the redirect parameter in login.php. |
CVE-2023-24191 | Medium | 6.1 | 2023-02-06 | Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the redirect parameter in signup.php. |
CVE-2023-0679 | Medium | 5.0 | 2023-02-06 | A vulnerability was found in SourceCodester Canteen Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2023-22849 | Medium | 6.1 | 2023-02-04 | An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.4 and prior may all… |
CVE-2023-25193 | High | 7.5 | 2023-02-04 | hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base… |
CVE-2023-0678 | Medium | 5.3 | 2023-02-04 | Missing Authorization in GitHub repository phpipam/phpipam prior to v1.5.1. |
CVE-2023-0677 | Medium | 6.1 | 2023-02-04 | Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to v1.5.1. |
CVE-2023-0676 | Medium | 6.1 | 2023-02-04 | Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to 1.5.1. |
CVE-2023-0675 | Medium | 6.3 | 2023-02-04 | A vulnerability, which was classified as critical, was found in Calendar Event Management System 2.3.0. This affects an unknown part. The manipulation of the a… |
CVE-2023-0674 | Medium | 4.3 | 2023-02-04 | A vulnerability, which was classified as problematic, has been found in XXL-JOB 2.3.1. Affected by this issue is some unknown functionality of the file /user/u… |
CVE-2023-0673 | Medium | 5.0 | 2023-02-04 | A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. Affected by this vulnerability is an unknown functionality of the f… |
CVE-2023-0671 | High | 8.8 | 2023-02-04 | Code Injection in GitHub repository froxlor/froxlor prior to 2.0.10. |
CVE-2023-23615 | Medium | 5.3 | 2023-02-03 | Discourse is an open source discussion platform. The embeddable comments can be exploited to create new topics as any user but without any clear title or conte… |
CVE-2023-23082 | Medium | 4.6 | 2023-02-03 | A heap buffer overflow vulnerability in Kodi Home Theater Software up to 19.5 allows attackers to cause a denial of service due to an improper length of the va… |
CVE-2023-22746 | High | 8.6 | 2023-02-03 | CKAN is an open-source DMS (data management system) for powering data hubs and data portals. When creating a new container based on one of the Docker images li… |
CVE-2023-24029 | High | 7.2 | 2023-02-03 | In Progress WS_FTP Server before 8.8, it is possible for a host administrator to elevate their privileges via the administrative interface due to insufficient… |
CVE-2023-23941 | High | 7.5 | 2023-02-03 | SwagPayPal is a PayPal integration for shopware/platform. If JavaScript-based PayPal checkout methods are used (PayPal Plus, Smart Payment Buttons, SEPA, Pay L… |
CVE-2023-23932 | Medium | 5.3 | 2023-02-03 | OpenDDS is an open source C++ implementation of the Object Management Group (OMG) Data Distribution Service (DDS). OpenDDS applications that are exposed to unt… |
CVE-2023-0663 | High | 7.3 | 2023-02-03 | A vulnerability was found in Calendar Event Management System 2.3.0. It has been rated as critical. This issue affects some unknown processing of the component… |
CVE-2023-23940 | Medium | 6.4 | 2023-02-03 | OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup. `is_valid_eth_sig… |
CVE-2023-23937 | High | 8.2 | 2023-02-03 | Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce. The upload functionality for updating user pro… |
CVE-2023-23933 | Medium | 4.3 | 2023-02-03 | OpenSearch Anomaly Detection identifies atypical data and receives automatic notifications. There is an issue with the application of document and field level… |
CVE-2023-23925 | High | 8.6 | 2023-02-03 | Switcher Client is a JavaScript SDK to work with Switcher API which is cloud-based Feature Flag. Unsanitized input flows into Strategy match operation (EXIST)… |
CVE-2023-22474 | High | 8.7 | 2023-02-03 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server uses the request header `x-forwarded-for`… |
CVE-2023-24576 | High | 7.5 | 2023-02-03 | EMC NetWorker may potentially be vulnerable to an unauthenticated remote code execution vulnerability in the NetWorker Client execution service (nsrexecd) i… |
CVE-2023-23477 | High | 8.1 | 2023-02-03 | IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequenc… |
CVE-2023-20854 | High | 8.4 | 2023-02-03 | VMware Workstation contains an arbitrary file deletion vulnerability. A malicious actor with local user privileges on the victim's machine may exploit this vul… |
CVE-2023-23088 | Critical | 9.8 | 2023-02-03 | Buffer OverFlow Vulnerability in Barenboim json-parser master and v1.1.0 fixed in v1.1.1 allows an attacker to execute arbitrary code via the json_value_parse… |
CVE-2023-23087 | Critical | 9.8 | 2023-02-03 | An issue was found in MojoJson v1.2.3 allows attackers to execute arbitary code via the destroy function. |
CVE-2023-23086 | Critical | 9.8 | 2023-02-03 | Buffer OverFlow Vulnerability in MojoJson v1.2.3 allows an attacker to execute arbitrary code via the SkipString function. |
CVE-2023-0659 | Medium | 5.3 | 2023-02-03 | A vulnerability was found in BDCOM 1704-WGL 2.0.6314. It has been classified as critical. This affects an unknown part of the file /param.file.tgz of the compo… |
CVE-2023-22975 | Medium | 6.1 | 2023-02-03 | A cross-site scripting (XSS) vulnerability in JFinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into t… |
CVE-2023-24157 | Critical | 9.8 | 2023-02-03 | A command injection vulnerability in the serverIp parameter in the function updateWifiInfo of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary comman… |
CVE-2023-24156 | Critical | 9.8 | 2023-02-03 | A command injection vulnerability in the ip parameter in the function recvSlaveUpgstatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands… |
CVE-2023-24155 | Critical | 9.8 | 2023-02-03 | TOTOLINK T8 V4.1.5cu was discovered to contain a hard code password for the telnet service which is stored in the component /web_cste/cgi-bin/product.ini. |
CVE-2023-24154 | Critical | 9.8 | 2023-02-03 | TOTOLINK T8 V4.1.5cu was discovered to contain a command injection vulnerability via the slaveIpList parameter in the function setUpgradeFW. |
CVE-2023-24153 | Critical | 9.8 | 2023-02-03 | A command injection vulnerability in the version parameter in the function recvSlaveCloudCheckStatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitr… |
CVE-2023-24152 | Critical | 9.8 | 2023-02-03 | A command injection vulnerability in the serverIp parameter in the function meshSlaveUpdate of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary comma… |
CVE-2023-24151 | Critical | 9.8 | 2023-02-03 | A command injection vulnerability in the ip parameter in the function recvSlaveCloudCheckStatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary c… |
CVE-2023-24150 | Critical | 9.8 | 2023-02-03 | A command injection vulnerability in the serverIp parameter in the function meshSlaveDlfw of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary command… |
CVE-2023-24149 | Critical | 9.8 | 2023-02-03 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a hard code password for root which is stored in the component /etc/shadow. |
CVE-2023-24148 | Critical | 9.8 | 2023-02-03 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the FileName parameter in the setUploadUserData function. |
CVE-2023-24147 | High | 7.5 | 2023-02-03 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a hard code password for the telnet service which is stored in the component /etc/config/product.ini. |
CVE-2023-24146 | Critical | 9.8 | 2023-02-03 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the minute parameter in the setRebootScheCfg function. |
CVE-2023-24145 | Critical | 9.8 | 2023-02-03 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the plugin_version parameter in the setUnloadUserData function. |
CVE-2023-24144 | Critical | 9.8 | 2023-02-03 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the hour parameter in the setRebootScheCfg function. |
CVE-2023-24143 | Critical | 9.8 | 2023-02-03 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagTracertHop parameter in the setNetworkDiag function. |
CVE-2023-24142 | Critical | 9.8 | 2023-02-03 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingSize parameter in the setNetworkDiag function. |
CVE-2023-24141 | Critical | 9.8 | 2023-02-03 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingTimeOut parameter in the setNetworkDiag function. |
CVE-2023-24140 | Critical | 9.8 | 2023-02-03 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingNum parameter in the setNetworkDiag function. |
CVE-2023-24139 | Critical | 9.8 | 2023-02-03 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagHost parameter in the setNetworkDiag function. |
CVE-2023-24138 | Critical | 9.8 | 2023-02-03 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the host_time parameter in the NTPSyncWithHost function. |
CVE-2023-25139 | Critical | 9.8 | 2023-02-03 | sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct buffer size. This is unrelated to CWE-6… |
CVE-2023-25136 | Medium | 6.5 | 2023-02-03 | OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be l… |
CVE-2023-25135 | Critical | 9.8 | 2023-02-03 | vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This o… |
CVE-2023-0124 | High | 7.8 | 2023-02-03 | Delta Electronics DOPSoft versions 4.00.16.22 and prior are vulnerable to an out-of-bounds write, which could allow an attacker to remotely execute arbitrary c… |
CVE-2023-0123 | High | 7.8 | 2023-02-03 | Delta Electronics DOPSoft versions 4.00.16.22 and prior are vulnerable to a stack-based buffer overflow, which could allow an attacker to remotely execute arbi… |
CVE-2023-24613 | Medium | 4.9 | 2023-02-03 | The user interface of Array Networks AG Series and vxAG through 9.4.0.470 could allow a remote attacker to use the gdb tool to overwrite the backend function c… |
CVE-2023-23636 | Medium | 5.4 | 2023-02-03 | In Jellyfin 10.8.x through 10.8.3, the name of a playlist is vulnerable to stored XSS. This allows an attacker to steal access tokens from the localStorage of… |
CVE-2023-23635 | Medium | 5.4 | 2023-02-03 | In Jellyfin 10.8.x through 10.8.3, the name of a collection is vulnerable to stored XSS. This allows an attacker to steal access tokens from the localStorage o… |
CVE-2023-0658 | Medium | 5.3 | 2023-02-03 | A vulnerability, which was classified as critical, was found in Multilaser RE057 and RE170 2.1/2.2. This affects an unknown part of the file /param.file.tgz of… |
CVE-2023-24574 | High | 7.5 | 2023-02-02 | Dell Enterprise SONiC OS, 3.5.3, 4.0.0, 4.0.1, 4.0.2, contains an "Uncontrolled Resource Consumption vulnerability" in authentication component. An unauthenti… |
CVE-2023-23120 | Medium | 5.9 | 2023-02-02 | The use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes TRENDnet TV-IP651WI Network Camera firmware version v1… |
CVE-2023-23119 | Medium | 5.9 | 2023-02-02 | The use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes Ubiquiti airFiber AF2X Radio firmware version 3.2.2 and… |
CVE-2023-0651 | Medium | 6.3 | 2023-02-02 | A vulnerability was found in FastCMS 0.1.0. It has been classified as critical. Affected is an unknown function of the component Template Management. The manip… |
CVE-2023-23110 | High | 7.4 | 2023-02-02 | An exploitable firmware modification vulnerability was discovered in certain Netgear products. The data integrity of the uploaded firmware image is ensured wit… |
CVE-2023-0650 | Low | 3.5 | 2023-02-02 | A vulnerability was found in YAFNET up to 3.1.11 and classified as problematic. This issue affects some unknown processing of the component Signature Handler… |
CVE-2023-0649 | Medium | 6.3 | 2023-02-02 | A vulnerability has been found in dst-admin 1.5.0 and classified as critical. This vulnerability affects unknown code of the file /home/sendBroadcast. The mani… |
CVE-2023-0648 | Medium | 6.3 | 2023-02-02 | A vulnerability, which was classified as critical, was found in dst-admin 1.5.0. This affects an unknown part of the file /home/masterConsole. The manipulation… |
CVE-2023-0647 | Medium | 6.3 | 2023-02-02 | A vulnerability, which was classified as critical, has been found in dst-admin 1.5.0. Affected by this issue is some unknown functionality of the file /home/ki… |
CVE-2023-0646 | Medium | 6.3 | 2023-02-02 | A vulnerability classified as critical was found in dst-admin 1.5.0. Affected by this vulnerability is an unknown functionality of the file /home/cavesConsole… |
CVE-2023-0643 | Medium | 6.1 | 2023-02-02 | Improper Handling of Additional Special Element in GitHub repository squidex/squidex prior to 7.4.0. |
CVE-2023-0642 | Medium | 6.5 | 2023-02-02 | Cross-Site Request Forgery (CSRF) in GitHub repository squidex/squidex prior to 7.4.0. |
CVE-2023-0641 | Low | 3.7 | 2023-02-02 | A vulnerability was found in PHPGurukul Employee Leaves Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknow… |
CVE-2023-0640 | High | 7.2 | 2023-02-02 | A vulnerability was found in TRENDnet TEW-652BRP 3.04b01. It has been classified as critical. Affected is an unknown function of the file ping.ccp of the compo… |
CVE-2023-0639 | Low | 2.4 | 2023-02-02 | A vulnerability was found in TRENDnet TEW-652BRP 3.04b01 and classified as problematic. This issue affects some unknown processing of the file get_set.ccp of t… |
CVE-2023-0638 | High | 7.2 | 2023-02-02 | A vulnerability has been found in TRENDnet TEW-811DRU 1.0.10.0 and classified as critical. This vulnerability affects unknown code of the component Web Interfa… |
CVE-2023-0637 | Medium | 6.5 | 2023-02-02 | A vulnerability, which was classified as critical, was found in TRENDnet TEW-811DRU 1.0.10.0. This affects an unknown part of the file wan.asp of the component… |
CVE-2023-0400 | Medium | 5.9 | 2023-02-02 | The protection bypass vulnerability in DLP for Windows 11.9.x is addressed in version 11.10.0. This allowed a local user to bypass DLP controls when uploading… |