2023 CVEs (page 298)
Page 298 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-0696 | High | 8.8 | 2023-02-07 | Type confusion in V8 in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2023-25194 | High | 8.8 | 2023-02-07 | A possible security vulnerability has been identified in Apache Kafka Connect API. This requires access to a Kafka Connect worker, and the ability to create/mo… |
CVE-2023-0732 | Low | 3.5 | 2023-02-07 | A vulnerability has been found in SourceCodester Online Eyewear Shop 1.0 and classified as problematic. Affected by this vulnerability is the function registra… |
CVE-2023-24814 | High | 8.8 | 2023-02-07 | TYPO3 is a free and open source Content Management Framework released under the GNU General Public License. In affected versions the TYPO3 core component `Gene… |
CVE-2023-24813 | Critical | 10.0 | 2023-02-07 | Dompdf is an HTML to PDF converter written in php. Due to the difference in the attribute parser of Dompdf and php-svg-lib, an attacker can still call arbitrar… |
CVE-2023-22735 | Medium | 4.4 | 2023-02-07 | Zulip is an open-source team collaboration tool. In versions of zulip prior to commit `2f6c5a8` but after commit `04cf68b` users could upload files with arbitr… |
CVE-2023-0707 | Medium | 5.5 | 2023-02-07 | A vulnerability was found in SourceCodester Medical Certificate Generator App 1.0. It has been rated as critical. Affected by this issue is the function delete… |
CVE-2023-23696 | High | 7.0 | 2023-02-07 | Dell Command Intel vPro Out of Band, versions prior to 4.3.1, contain an Improper Authorization vulnerability. A locally authenticated malicious users could p… |
CVE-2023-22643 | Medium | 6.3 | 2023-02-07 | An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in libzypp-plugin-appdata of SUSE Linux Enterprise… |
CVE-2023-0706 | Medium | 6.3 | 2023-02-07 | A vulnerability, which was classified as critical, has been found in SourceCodester Medical Certificate Generator App 1.0. Affected by this issue is some unkno… |
CVE-2023-24827 | Medium | 6.5 | 2023-02-07 | syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. A password disclosure flaw was fo… |
CVE-2023-24808 | Medium | 5.3 | 2023-02-07 | PDFio is a C library for reading and writing PDF files. In versions prior to 1.1.0 a denial of service (DOS) vulnerability exists in the pdfio parser. Crafted… |
CVE-2023-23849 | Medium | 6.1 | 2023-02-06 | Versions of Coverity Connect prior to 2022.12.0 are vulnerable to an unauthenticated Cross-Site Scripting vulnerability. Any web service hosted on the same sub… |
CVE-2023-0615 | Medium | 5.5 | 2023-02-06 | A memory leak flaw and potential divide by zero and Integer overflow was found in the Linux kernel V4L2 and vivid test code functionality. This issue occurs wh… |
CVE-2023-23333 | Critical | 9.8 | 2023-02-06 | There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassing internal restrictions through downloa… |
CVE-2023-25016 | High | 7.5 | 2023-02-06 | Couchbase Server before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2 exposes Sensitive Information to an Unauthorized Actor. |
CVE-2023-23943 | Medium | 5.0 | 2023-02-06 | Nextcloud mail is an email app for the nextcloud home server platform. In affected versions the SMTP, IMAP and Sieve host fields allowed to scan for internal s… |
CVE-2023-23942 | Medium | 5.4 | 2023-02-06 | The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer. Versions prior to 3.6.3 are missing sanitisation on qml… |
CVE-2023-23944 | Low | 2.0 | 2023-02-06 | Nextcloud mail is an email app for the nextcloud home server platform. In versions prior to 2.2.2 user's passwords were stored in cleartext in the database dur… |
CVE-2023-20619 | Medium | 6.7 | 2023-02-06 | In vcu, there is a possible memory corruption due to improper locking. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2023-20618 | Medium | 6.7 | 2023-02-06 | In vcu, there is a possible memory corruption due to improper locking. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2023-20616 | Medium | 6.7 | 2023-02-06 | In ion, there is a possible out of bounds read due to type confusion. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2023-20615 | Medium | 6.7 | 2023-02-06 | In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20614 | Medium | 6.7 | 2023-02-06 | In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20613 | Medium | 6.7 | 2023-02-06 | In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20612 | Medium | 6.7 | 2023-02-06 | In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20611 | Medium | 6.4 | 2023-02-06 | In gpu, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. U… |
CVE-2023-20610 | Medium | 6.4 | 2023-02-06 | In display drm, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20609 | Medium | 4.4 | 2023-02-06 | In ccu, there is a possible out of bounds read due to a logic error. This could lead to local information disclosure with System execution privileges needed. U… |
CVE-2023-20608 | Medium | 6.4 | 2023-02-06 | In display drm, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges n… |
CVE-2023-20607 | Medium | 6.4 | 2023-02-06 | In ccu, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2023-20606 | Medium | 4.4 | 2023-02-06 | In apusys, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileg… |
CVE-2023-20605 | Medium | 4.4 | 2023-02-06 | In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution priv… |
CVE-2023-20604 | Medium | 6.7 | 2023-02-06 | In ged, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20602 | Medium | 6.7 | 2023-02-06 | In ged, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges n… |
CVE-2023-0686 | Medium | 5.0 | 2023-02-06 | A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been classified as critical. This affects the function update_cart of the file /oew… |
CVE-2023-0669 | High | 7.2 | 2023-02-06 | Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserial… |
CVE-2023-0282 | Medium | 5.4 | 2023-02-06 | The YourChannel WordPress plugin before 1.2.2 does not sanitize and escape some parameters, which could allow users with a role as low as Subscriber to perform… |
CVE-2023-0252 | Medium | 5.4 | 2023-02-06 | The Contextual Related Posts WordPress plugin before 3.3.1 does not validate and escape some of its block options before outputting them back in a page/post wh… |
CVE-2023-0236 | Medium | 6.1 | 2023-02-06 | The Tutor LMS WordPress plugin before 2.0.10 does not sanitise and escape the reset_key and user_id parameters before outputting then back in attributes, leadi… |
CVE-2023-0234 | High | 8.8 | 2023-02-06 | The SiteGround Security WordPress plugin before 1.3.1 does not properly sanitize user input before using it in an SQL query, leading to an authenticated SQL in… |
CVE-2023-0178 | Medium | 5.4 | 2023-02-06 | The Annual Archive WordPress plugin before 1.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where… |
CVE-2023-0176 | Medium | 5.4 | 2023-02-06 | The Giveaways and Contests by RafflePress WordPress plugin before 1.11.3 does not validate and escape some of its shortcode attributes before outputting them b… |
CVE-2023-0174 | Medium | 5.4 | 2023-02-06 | The WP VR WordPress plugin before 8.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shor… |
CVE-2023-0173 | Medium | 5.4 | 2023-02-06 | The Drag & Drop Sales Funnel Builder for WordPress plugin before 2.6.9 does not validate and escape some of its shortcode attributes before outputting them bac… |
CVE-2023-0171 | Medium | 5.4 | 2023-02-06 | The jQuery T(-) Countdown Widget WordPress plugin before 2.3.24 does not validate and escape some of its shortcode attributes before outputting them back in a… |
CVE-2023-0170 | Medium | 5.4 | 2023-02-06 | The Html5 Audio Player WordPress plugin before 2.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post… |
CVE-2023-0154 | Medium | 5.4 | 2023-02-06 | The GamiPress WordPress plugin before 1.0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the… |
CVE-2023-0153 | Medium | 5.4 | 2023-02-06 | The Vimeo Video Autoplay Automute WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a p… |
CVE-2023-0150 | Medium | 5.4 | 2023-02-06 | The Cloak Front End Email WordPress plugin before 1.9.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/pos… |
CVE-2023-0149 | Medium | 5.4 | 2023-02-06 | The WordPrezi WordPress plugin before 0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the sh… |
CVE-2023-0148 | Medium | 5.4 | 2023-02-06 | The Gallery Factory Lite WordPress plugin through 2.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/pos… |
CVE-2023-0147 | Medium | 5.4 | 2023-02-06 | The Flexible Captcha WordPress plugin through 4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post wher… |
CVE-2023-0146 | Medium | 5.4 | 2023-02-06 | The Naver Map WordPress plugin through 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the… |
CVE-2023-0144 | Medium | 5.4 | 2023-02-06 | The Event Manager and Tickets Selling Plugin for WooCommerce WordPress plugin before 3.8.0 does not validate and escape some of its post meta before outputting… |
CVE-2023-0143 | Medium | 5.4 | 2023-02-06 | The Send PDF for Contact Form 7 WordPress plugin before 0.9.9.2 does not validate and escape some of its shortcode attributes before outputting them back in th… |
CVE-2023-0096 | Medium | 5.4 | 2023-02-06 | The Happyforms WordPress plugin before 1.22.0 does not validate and escape some of its block options before outputting them back in a page/post where the block… |
CVE-2023-0095 | Medium | 5.4 | 2023-02-06 | The Page View Count WordPress plugin before 2.6.1 does not validate and escape some of its block options before outputting them back in a page/post where the b… |
CVE-2023-0082 | Medium | 5.4 | 2023-02-06 | The ExactMetrics WordPress plugin before 7.12.1 does not validate and escape some of its block options before outputting them back in a page/post where the blo… |
CVE-2023-0081 | Medium | 5.4 | 2023-02-06 | The MonsterInsights WordPress plugin before 8.12.1 does not validate and escape some of its block options before outputting them back in a page/post where the… |
CVE-2023-0072 | Medium | 5.4 | 2023-02-06 | The WC Vendors Marketplace WordPress plugin before 2.4.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/po… |
CVE-2023-0070 | Medium | 5.4 | 2023-02-06 | The ResponsiveVoice Text To Speech WordPress plugin before 1.7.7 does not validate and escape some of its shortcode attributes before outputting them back in a… |
CVE-2023-0062 | Medium | 5.4 | 2023-02-06 | The EAN for WooCommerce WordPress plugin before 4.4.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post… |
CVE-2023-0687 | Medium | 4.6 | 2023-02-06 | A vulnerability was found in GNU C Library 2.38. It has been declared as critical. This vulnerability affects the function __monstartup of the file gmon.c of t… |
CVE-2023-24276 | Critical | 9.8 | 2023-02-06 | TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the country parameter at setting/delStaticDhcpRules. |
CVE-2023-24202 | Critical | 9.8 | 2023-02-06 | Raffle Draw System v1.0 was discovered to contain a local file inclusion vulnerability via the page parameter in index.php. |
CVE-2023-24201 | Critical | 9.8 | 2023-02-06 | Raffle Draw System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at get_ticket.php. |
CVE-2023-24200 | Critical | 9.8 | 2023-02-06 | Raffle Draw System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at save_ticket.php. |
CVE-2023-24199 | Critical | 9.8 | 2023-02-06 | Raffle Draw System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at delete_ticket.php. |
CVE-2023-24198 | Critical | 9.8 | 2023-02-06 | Raffle Draw System v1.0 was discovered to contain multiple SQL injection vulnerabilities at save_winner.php via the ticket_id and draw parameters. |
CVE-2023-24197 | Medium | 6.1 | 2023-02-06 | Online Food Ordering System v2 was discovered to contain a SQL injection vulnerability via the id parameter at view_order.php. |
CVE-2023-24195 | Medium | 6.1 | 2023-02-06 | Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the page parameter in index.php. |
CVE-2023-24194 | Medium | 6.1 | 2023-02-06 | Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the page parameter in navbar.php. |
CVE-2023-24192 | Medium | 6.1 | 2023-02-06 | Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the redirect parameter in login.php. |
CVE-2023-24191 | Medium | 6.1 | 2023-02-06 | Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the redirect parameter in signup.php. |
CVE-2023-0679 | Medium | 5.0 | 2023-02-06 | A vulnerability was found in SourceCodester Canteen Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2023-22849 | Medium | 6.1 | 2023-02-04 | An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.4 and prior may all… |
CVE-2023-25193 | High | 7.5 | 2023-02-04 | hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base… |
CVE-2023-0678 | Medium | 5.3 | 2023-02-04 | Missing Authorization in GitHub repository phpipam/phpipam prior to v1.5.1. |
CVE-2023-0677 | Medium | 6.1 | 2023-02-04 | Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to v1.5.1. |
CVE-2023-0676 | Medium | 6.1 | 2023-02-04 | Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to 1.5.1. |
CVE-2023-0675 | Medium | 6.3 | 2023-02-04 | A vulnerability, which was classified as critical, was found in Calendar Event Management System 2.3.0. This affects an unknown part. The manipulation of the a… |
CVE-2023-0674 | Medium | 4.3 | 2023-02-04 | A vulnerability, which was classified as problematic, has been found in XXL-JOB 2.3.1. Affected by this issue is some unknown functionality of the file /user/u… |
CVE-2023-0673 | Medium | 5.0 | 2023-02-04 | A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. Affected by this vulnerability is an unknown functionality of the f… |
CVE-2023-0671 | High | 8.8 | 2023-02-04 | Code Injection in GitHub repository froxlor/froxlor prior to 2.0.10. |
CVE-2023-23615 | Medium | 5.3 | 2023-02-03 | Discourse is an open source discussion platform. The embeddable comments can be exploited to create new topics as any user but without any clear title or conte… |
CVE-2023-23082 | Medium | 4.6 | 2023-02-03 | A heap buffer overflow vulnerability in Kodi Home Theater Software up to 19.5 allows attackers to cause a denial of service due to an improper length of the va… |
CVE-2023-22746 | High | 8.6 | 2023-02-03 | CKAN is an open-source DMS (data management system) for powering data hubs and data portals. When creating a new container based on one of the Docker images li… |
CVE-2023-24029 | High | 7.2 | 2023-02-03 | In Progress WS_FTP Server before 8.8, it is possible for a host administrator to elevate their privileges via the administrative interface due to insufficient… |
CVE-2023-23941 | High | 7.5 | 2023-02-03 | SwagPayPal is a PayPal integration for shopware/platform. If JavaScript-based PayPal checkout methods are used (PayPal Plus, Smart Payment Buttons, SEPA, Pay L… |
CVE-2023-23932 | Medium | 5.3 | 2023-02-03 | OpenDDS is an open source C++ implementation of the Object Management Group (OMG) Data Distribution Service (DDS). OpenDDS applications that are exposed to unt… |
CVE-2023-0663 | High | 7.3 | 2023-02-03 | A vulnerability was found in Calendar Event Management System 2.3.0. It has been rated as critical. This issue affects some unknown processing of the component… |
CVE-2023-23940 | Medium | 6.4 | 2023-02-03 | OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup. `is_valid_eth_sig… |
CVE-2023-23937 | High | 8.2 | 2023-02-03 | Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce. The upload functionality for updating user pro… |
CVE-2023-23933 | Medium | 4.3 | 2023-02-03 | OpenSearch Anomaly Detection identifies atypical data and receives automatic notifications. There is an issue with the application of document and field level… |
CVE-2023-23925 | High | 8.6 | 2023-02-03 | Switcher Client is a JavaScript SDK to work with Switcher API which is cloud-based Feature Flag. Unsanitized input flows into Strategy match operation (EXIST)… |
CVE-2023-22474 | High | 8.7 | 2023-02-03 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server uses the request header `x-forwarded-for`… |
CVE-2023-24576 | High | 7.5 | 2023-02-03 | EMC NetWorker may potentially be vulnerable to an unauthenticated remote code execution vulnerability in the NetWorker Client execution service (nsrexecd) i… |
CVE-2023-23477 | High | 8.1 | 2023-02-03 | IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequenc… |
CVE-2023-20854 | High | 8.4 | 2023-02-03 | VMware Workstation contains an arbitrary file deletion vulnerability. A malicious actor with local user privileges on the victim's machine may exploit this vul… |