2023 CVEs (page 299)
Page 299 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-25015 | Medium | 6.5 | 2023-02-02 | Clockwork Web before 0.1.2, when Rails before 5.2 is used, allows CSRF. |
CVE-2023-25014 | High | 8.6 | 2023-02-02 | An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in the InvitationContr… |
CVE-2023-25013 | High | 8.6 | 2023-02-02 | An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in the InvitationContr… |
CVE-2023-25012 | Medium | 4.6 | 2023-02-02 | The Linux kernel through 6.1.9 has a Use-After-Free in bigben_remove in drivers/hid/hid-bigbenff.c via a crafted USB device because the LED controllers remain… |
CVE-2023-0599 | Medium | 6.1 | 2023-02-01 | Rapid7 Metasploit Pro versions 4.21.2 and lower suffer from a stored cross site scripting vulnerability, due to a lack of JavaScript request string sanitizatio… |
CVE-2023-23751 | Medium | 4.3 | 2023-02-01 | An issue was discovered in Joomla! 4.0.0 through 4.2.4. A missing ACL check allows non super-admin users to access com_actionlogs. |
CVE-2023-23750 | Medium | 6.3 | 2023-02-01 | An issue was discovered in Joomla! 4.0.0 through 4.2.6. A missing token check causes a CSRF vulnerability in the handling of post-installation messages. |
CVE-2023-23078 | Medium | 6.1 | 2023-02-01 | Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via the comment field when changing the credentials in the Assets. |
CVE-2023-23077 | Medium | 6.1 | 2023-02-01 | Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 13 via the comment field when adding a new status comment. |
CVE-2023-23076 | Critical | 9.8 | 2023-02-01 | OS Command injection vulnerability in Support Center Plus 11 via Executor in Action when creating new schedules. |
CVE-2023-23075 | Medium | 6.1 | 2023-02-01 | Cross Site Scripting (XSS) vulnerability in Zoho Asset Explorer 6.9 via the credential name when creating a new Assets Workstation. |
CVE-2023-23074 | Medium | 6.1 | 2023-02-01 | Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via embedding videos in the language component. |
CVE-2023-23073 | Medium | 6.1 | 2023-02-01 | Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via PO in the purchase component. |
CVE-2023-0619 | Medium | 6.5 | 2023-02-01 | The Kraken.io Image Optimizer plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up t… |
CVE-2023-23969 | High | 7.5 | 2023-02-01 | In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsi… |
CVE-2023-23469 | Medium | 4.0 | 2023-02-01 | IBM ICP4A - Automation Decision Services 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 al… |
CVE-2023-22501 | Critical | 9.1 | 2023-02-01 | An authentication vulnerability was discovered in Jira Service Management Server and Data Center which allows an attacker to impersonate another user and gain… |
CVE-2023-23555 | High | 7.5 | 2023-02-01 | On BIG-IP Virtual Edition versions 15.1x beginning in 15.1.4 to before 15.1.8 and 14.1.x beginning in 14.1.5 to before 14.1.5.3, and BIG-IP SPK beginning in 1… |
CVE-2023-23552 | High | 7.5 | 2023-02-01 | On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.0 before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a BIG-IP Advanced WA… |
CVE-2023-22842 | High | 7.5 | 2023-02-01 | On BIG-IP versions 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a SIP profile is configured on a Me… |
CVE-2023-22839 | High | 7.5 | 2023-02-01 | On BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all version of 13.1.x, when a DNS profil… |
CVE-2023-22664 | High | 7.5 | 2023-02-01 | On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, and BIG-IP SPK starting in version 1.6.0, when a client-side HTTP/2 profile and the HTTP… |
CVE-2023-22657 | High | 7.0 | 2023-02-01 | On F5OS-A beginning in version 1.2.0 to before 1.3.0 and F5OS-C beginning in version 1.3.0 to before 1.5.0, processing F5OS tenant file names may allow for com… |
CVE-2023-22422 | High | 7.5 | 2023-02-01 | On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, when a HTTP profile with the non-default Enforcement options of Enforce HTTP Compliance a… |
CVE-2023-22418 | Medium | 6.1 | 2023-02-01 | On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.7, 14.1.x before 14.1.5.3, and all versions of 13.1.x, an open redirect vulnerab… |
CVE-2023-22374 | High | 8.5 | 2023-02-01 | A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or, potentially execute arb… |
CVE-2023-22358 | High | 7.8 | 2023-02-01 | In versions beginning with 7.2.2 to before 7.2.3.1, a DLL hijacking vulnerability exists in the BIG-IP Edge Client Windows Installer. Note: Software versions… |
CVE-2023-22341 | High | 7.5 | 2023-02-01 | On version 14.1.x before 14.1.5.3, and all versions of 13.1.x, when the BIG-IP APM system is configured with all the following elements, undisclosed requests m… |
CVE-2023-22340 | High | 7.5 | 2023-02-01 | On BIG-IP versions 16.1.x before 16.1.3.3, 15.1.x before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a SIP profile is configured on a Mess… |
CVE-2023-22326 | Medium | 4.9 | 2023-02-01 | In BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, and all versions… |
CVE-2023-22323 | High | 7.5 | 2023-02-01 | In BIP-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when OCSP authen… |
CVE-2023-22302 | Medium | 5.9 | 2023-02-01 | In BIG-IP versions 17.0.x before 17.0.0.2, and 16.1.x beginning in 16.1.2.2 to before 16.1.3.3, when an HTTP profile is configured on a virtual server and cond… |
CVE-2023-22283 | Medium | 6.5 | 2023-02-01 | On versions beginning in 7.1.5 to before 7.2.3.1, a DLL hijacking vulnerability exists in the BIG-IP Edge Client for Windows. User interaction and administrati… |
CVE-2023-22281 | High | 7.5 | 2023-02-01 | On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a BIG-IP AFM NAT pol… |
CVE-2023-0618 | High | 7.5 | 2023-02-01 | A vulnerability was found in TRENDnet TEW-652BRP 3.04B01. It has been declared as critical. This vulnerability affects unknown code of the file cfg_op.ccp of t… |
CVE-2023-0617 | High | 7.5 | 2023-02-01 | A vulnerability was found in TRENDNet TEW-811DRU 1.0.10.0. It has been classified as critical. This affects an unknown part of the file /wireless/guestnetwork… |
CVE-2023-23136 | Medium | 6.5 | 2023-02-01 | lmxcms v1.41 was discovered to contain an arbitrary file deletion vulnerability via BackdbAction.class.php. |
CVE-2023-23135 | High | 7.2 | 2023-02-01 | An arbitrary file upload vulnerability in Ftdms v3.1.6 allows attackers to execute arbitrary code via uploading a crafted JPG file. |
CVE-2023-24997 | Critical | 9.8 | 2023-02-01 | Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users a… |
CVE-2023-24610 | High | 8.8 | 2023-02-01 | NOSH 4a5cfdb allows remote authenticated users to execute PHP arbitrary code via the "practice logo" upload feature. The client-side checks can be bypassed. Th… |
CVE-2023-23132 | High | 7.5 | 2023-02-01 | Selfwealth iOS mobile App 3.3.1 is vulnerable to Sensitive key disclosure. The application reveals hardcoded API keys. |
CVE-2023-23131 | High | 7.5 | 2023-02-01 | Selfwealth iOS mobile App 3.3.1 is vulnerable to Insecure App Transport Security (ATS) Settings. |
CVE-2023-23130 | Medium | 5.9 | 2023-02-01 | Connectwise Automate 2022.11 is vulnerable to Cleartext authentication. Authentication is being done via HTTP (cleartext) with SSL disabled. OTE: the vendor's… |
CVE-2023-23128 | Medium | 6.1 | 2023-02-01 | Connectwise Control 22.8.10013.8329 is vulnerable to Cross Origin Resource Sharing (CORS). The vendor's position is that two endpoints have Access-Control-Allo… |
CVE-2023-23127 | Medium | 5.3 | 2023-02-01 | In Connectwise Control 22.8.10013.8329, the login page does not implement HSTS headers therefore not enforcing HTTPS. NOTE: the vendor's position is that, by d… |
CVE-2023-23126 | Medium | 6.1 | 2023-02-01 | Connectwise Automate 2022.11 is vulnerable to Clickjacking. The login screen can be iframed and used to manipulate users to perform unintended actions. NOTE: t… |
CVE-2023-22575 | High | 8.7 | 2023-02-01 | Dell PowerScale OneFS 9.0.0.x - 9.4.0.x contain an insertion of sensitive information into log file vulnerability in celog. A low privileges user could potenti… |
CVE-2023-22574 | High | 8.1 | 2023-02-01 | Dell PowerScale OneFS 9.0.0.x - 9.4.0.x contain an insertion of sensitive information into log file vulnerability in platform API of IPMI module. A low-privil… |
CVE-2023-22573 | High | 7.9 | 2023-02-01 | Dell PowerScale OneFS 9.0.0.x-9.4.0.x contain an insertion of sensitive information into log file vulnerability in cloudpool. A low privileged local attacker c… |
CVE-2023-0613 | High | 7.5 | 2023-02-01 | A vulnerability has been found in TRENDnet TEW-811DRU 1.0.10.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the fi… |
CVE-2023-0612 | High | 7.5 | 2023-02-01 | A vulnerability, which was classified as critical, was found in TRENDnet TEW-811DRU 1.0.10.0. Affected is an unknown function of the file /wireless/basic.asp o… |
CVE-2023-0611 | High | 8.8 | 2023-02-01 | A vulnerability, which was classified as critical, has been found in TRENDnet TEW-652BRP 3.04B01. This issue affects some unknown processing of the file get_se… |
CVE-2023-23692 | High | 8.8 | 2023-02-01 | Dell EMC prior to version DDOS 7.9 contain(s) an OS command injection Vulnerability. An authenticated non admin attacker could potentially exploit this vulner… |
CVE-2023-22572 | High | 7.8 | 2023-02-01 | Dell PowerScale OneFS 9.1.0.x-9.4.0.x contain an insertion of sensitive information into log file vulnerability in change password api. A low privilege local… |
CVE-2023-0610 | Medium | 4.3 | 2023-02-01 | Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3. |
CVE-2023-0609 | Medium | 4.3 | 2023-02-01 | Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3. |
CVE-2023-24977 | High | 7.5 | 2023-02-01 | Out-of-bounds Read vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users are advised to u… |
CVE-2023-0608 | Medium | 5.4 | 2023-02-01 | Cross-site Scripting (XSS) - DOM in GitHub repository microweber/microweber prior to 1.3.2. |
CVE-2023-0607 | Medium | 4.8 | 2023-02-01 | Cross-site Scripting (XSS) - Stored in GitHub repository projectsend/projectsend prior to r1606. |
CVE-2023-23846 | High | 7.5 | 2023-02-01 | Due to insufficient length validation in the Open5GS GTP library versions prior to versions 2.4.13 and 2.5.7, when parsing extension headers in GPRS tunneling… |
CVE-2023-20856 | High | 8.8 | 2023-02-01 | VMware vRealize Operations (vROps) contains a CSRF bypass vulnerability. A malicious user could execute actions on the vROps platform on behalf of the authenti… |
CVE-2023-0587 | Critical | 9.1 | 2023-02-01 | A file upload vulnerability in exists in Trend Micro Apex One server build 11110. Using a malformed Content-Length header in an HTTP PUT message sent to URL /o… |
CVE-2023-0524 | High | 8.8 | 2023-02-01 | As part of our Security Development Lifecycle, a potential privilege escalation issue was identified internally. This could allow a malicious actor with suffic… |
CVE-2023-0454 | High | 8.1 | 2023-02-01 | OrangeScrum version 2.0.11 allows an authenticated external attacker to delete arbitrary local files from the server. This is possible because the application… |
CVE-2023-23928 | Medium | 5.9 | 2023-02-01 | reason-jose is a JOSE implementation in ReasonML and OCaml.`Jose.Jws.validate` does not check HS256 signatures. This allows tampering of JWS header and payload… |
CVE-2023-23630 | High | 8.6 | 2023-02-01 | Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has b… |
CVE-2023-0606 | Medium | 6.1 | 2023-02-01 | Cross-site Scripting (XSS) - Reflected in GitHub repository ampache/ampache prior to 5.5.7. |
CVE-2023-24956 | High | 8.8 | 2023-02-01 | Forget Heart Message Box v1.1 was discovered to contain a SQL injection vulnerability via the name parameter at /cha.php. |
CVE-2023-24241 | Critical | 9.8 | 2023-02-01 | Forget Heart Message Box v1.1 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/loginpost.php. |
CVE-2023-23924 | Critical | 10.0 | 2023-02-01 | Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing `<image>` tags with uppercase letters. This ma… |
CVE-2023-0341 | High | 7.8 | 2023-02-01 | A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and po… |
CVE-2023-22611 | High | 7.5 | 2023-01-31 | A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause information disclosure when specific messages are s… |
CVE-2023-22610 | Critical | 9.1 | 2023-01-31 | A CWE-863: Incorrect Authorization vulnerability exists that could cause Denial of Service against the Geo SCADA server when specific messages are sent to the… |
CVE-2023-24163 | Critical | 9.8 | 2023-01-31 | SQL Inection vulnerability in Dromara hutool before 5.8.21 allows attacker to execute arbitrary code via the aviator template engine. |
CVE-2023-24162 | Critical | 9.8 | 2023-01-31 | Deserialization vulnerability in Dromara Hutool v5.8.11 allows attacker to execute arbitrary code via the XmlUtil.readObjectFromXml parameter. |
CVE-2023-24829 | High | 8.8 | 2023-01-31 | Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component from 0.13.0 before 0.13.3… |
CVE-2023-0593 | Medium | 5.5 | 2023-01-31 | A path traversal vulnerability affects yaffshiv YAFFS filesystem extractor. By crafting a malicious YAFFS file, an attacker could force yaffshiv to write outsi… |
CVE-2023-0592 | Medium | 5.5 | 2023-01-31 | A path traversal vulnerability affects jefferson's JFFS2 filesystem extractor. By crafting malicious JFFS2 files, attackers could force jefferson to write outs… |
CVE-2023-0591 | Medium | 5.5 | 2023-01-31 | ubireader_extract_files is vulnerable to path traversal when run against specifically crafted UBIFS files, allowing the attacker to overwrite files outside of… |
CVE-2023-22900 | Critical | 9.8 | 2023-01-31 | Efence login function has insufficient validation for user input. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL com… |
CVE-2023-23582 | Medium | 5.3 | 2023-01-30 | Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior are vulnerable to a heap-based buffer overflow, which could allow an attacker to execute arbitrary c… |
CVE-2023-22389 | Medium | 5.7 | 2023-01-30 | Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior store passwords in a plaintext file when the device configuration is exported via Save/Restore–>Back… |
CVE-2023-24020 | High | 7.5 | 2023-01-30 | Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior could bypass the brute force protection, allowing multiple attempts to force a login. |
CVE-2023-22315 | Medium | 6.7 | 2023-01-30 | Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior use a proprietary local area network (LAN) protocol that does not verify updates to the device. An a… |
CVE-2023-0097 | Medium | 5.4 | 2023-01-30 | The Post Grid, Post Carousel, & List Category Posts WordPress plugin before 2.4.19 does not validate and escape some of its block options before outputting the… |
CVE-2023-0074 | Medium | 5.4 | 2023-01-30 | The WP Social Widget WordPress plugin before 2.2.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post whe… |
CVE-2023-0071 | Medium | 5.4 | 2023-01-30 | The WP Tabs WordPress plugin before 2.1.17 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the s… |
CVE-2023-0033 | Medium | 5.4 | 2023-01-30 | The PDF Viewer WordPress plugin before 1.0.0 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contri… |
CVE-2023-24830 | High | 7.5 | 2023-01-30 | Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects iotdb-web-workbench component: from 0.13.0 before 0.13.3. |
CVE-2023-0512 | High | 7.8 | 2023-01-30 | Divide By Zero in GitHub repository vim/vim prior to 9.0.1247. |
CVE-2023-0581 | Medium | 5.3 | 2023-01-30 | The PrivateContent plugin for WordPress is vulnerable to protection mechanism bypass due to the use of client side validation in versions up to, and including… |
CVE-2023-0266 | High | 7.9 | 2023-01-30 | A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a u… |
CVE-2023-0240 | High | 7.8 | 2023-01-30 | There is a logic error in io_uring's implementation which can be used to trigger a use-after-free vulnerability leading to privilege escalation. In the io_pre… |
CVE-2023-0474 | High | 8.8 | 2023-01-30 | Use after free in GuestView in Google Chrome prior to 109.0.5414.119 allowed an attacker who convinced a user to install a malicious extension to potentially e… |
CVE-2023-0473 | High | 8.8 | 2023-01-30 | Type Confusion in ServiceWorker API in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTM… |
CVE-2023-0472 | High | 8.8 | 2023-01-30 | Use after free in WebRTC in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2023-0471 | High | 8.8 | 2023-01-30 | Use after free in WebTransport in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pag… |
CVE-2023-22333 | Medium | 6.1 | 2023-01-30 | Cross-site scripting vulnerability in EasyMail 2.00.130 and earlier allows a remote unauthenticated attacker to inject an arbitrary script. |
CVE-2023-22332 | Medium | 6.5 | 2023-01-30 | Information disclosure vulnerability exists in Pgpool-II 4.4.0 to 4.4.1 (4.4 series), 4.3.0 to 4.3.4 (4.3 series), 4.2.0 to 4.2.11 (4.2 series), 4.1.0 to 4.1.1… |
CVE-2023-22324 | Medium | 6.5 | 2023-01-30 | SQL injection vulnerability in the CONPROSYS HMI System (CHS) Ver.3.5.0 and earlier allows a remote authenticated attacker to execute an arbitrary SQL command… |