2023 CVEs (page 300)
Page 300 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-22322 | Medium | 5.5 | 2023-01-30 | Improper restriction of XML external entity reference (XXE) vulnerability exists in OMRON CX-Motion Pro 1.4.6.013 and earlier. If a user opens a specially craf… |
CVE-2023-24623 | High | 7.5 | 2023-01-30 | Paranoidhttp before 0.3.0 allows SSRF because [::] is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses. |
CVE-2023-24622 | Medium | 5.3 | 2023-01-30 | isInList in the safeurl-python package before 1.2 for Python has an insufficiently restrictive regular expression for external domains, leading to SSRF. |
CVE-2023-24612 | Critical | 9.8 | 2023-01-30 | The PdfBook extension through 2.0.5 before b07b6a64 for MediaWiki allows command injection via an option. |
CVE-2023-0572 | Medium | 5.3 | 2023-01-29 | Unchecked Error Condition in GitHub repository froxlor/froxlor prior to 2.0.10. |
CVE-2023-24065 | Medium | 5.4 | 2023-01-29 | NOSH 4a5cfdb allows stored XSS via the create user page. For example, a first name (of a physician, assistant, or billing user) can have a JavaScript payload t… |
CVE-2023-0566 | Medium | 6.2 | 2023-01-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in froxlor/froxlor prior to 2.0.10. |
CVE-2023-0565 | Medium | 5.5 | 2023-01-29 | Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.10. |
CVE-2023-0571 | Low | 3.5 | 2023-01-29 | A vulnerability has been found in SourceCodester Canteen Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the fi… |
CVE-2023-0570 | Medium | 6.3 | 2023-01-29 | A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. This affects an unknown part of th… |
CVE-2023-0569 | Medium | 6.5 | 2023-01-29 | Weak Password Requirements in GitHub repository publify/publify prior to 9.2.10. |
CVE-2023-0564 | Medium | 5.4 | 2023-01-29 | Weak Password Requirements in GitHub repository froxlor/froxlor prior to 2.0.10. |
CVE-2023-0563 | Low | 3.5 | 2023-01-28 | A vulnerability classified as problematic has been found in PHPGurukul Bank Locker Management System 1.0. This affects an unknown part of the file add-locker-f… |
CVE-2023-0562 | High | 7.3 | 2023-01-28 | A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2023-0561 | Medium | 6.3 | 2023-01-28 | A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. Affected is an unknown function of… |
CVE-2023-0560 | Medium | 4.7 | 2023-01-28 | A vulnerability, which was classified as critical, has been found in SourceCodester Online Tours & Travels Management System 1.0. This issue affects some unkno… |
CVE-2023-23629 | Medium | 6.3 | 2023-01-28 | Metabase is an open source data analytics platform. Affected versions are subject to Improper Privilege Management. As intended, recipients of dashboards subsc… |
CVE-2023-23628 | Medium | 5.7 | 2023-01-28 | Metabase is an open source data analytics platform. Affected versions are subject to Exposure of Sensitive Information to an Unauthorized Actor. Sandboxed user… |
CVE-2023-23627 | Medium | 6.1 | 2023-01-28 | Sanitize is an allowlist-based HTML and CSS sanitizer. Versions 5.0.0 and later, prior to 6.0.1, are vulnerable to Cross-site Scripting. When Sanitize is confi… |
CVE-2023-23624 | Medium | 4.3 | 2023-01-28 | Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and version 3.1.0.beta2 on the `beta` and `tests-passed` branche… |
CVE-2023-23621 | High | 8.6 | 2023-01-28 | Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and version 3.1.0.beta2 on the `beta` and `tests-passed` branche… |
CVE-2023-23620 | Medium | 5.3 | 2023-01-28 | Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches, the c… |
CVE-2023-23617 | Medium | 4.9 | 2023-01-28 | OpenMage LTS is an e-commerce platform. Versions prior to 19.4.22 and 20.0.19 contain an infinite loop in malicious code filter in certain conditions. Versions… |
CVE-2023-23616 | Low | 3.5 | 2023-01-28 | Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches, when… |
CVE-2023-22737 | Medium | 6.5 | 2023-01-28 | wire-server provides back end services for Wire, a team communication and collaboration platform. Prior to version 2022-12-09, every member of a Conversation c… |
CVE-2023-0558 | High | 8.2 | 2023-01-27 | The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to an unsecure token check that is susceptible to type juggling in versions up… |
CVE-2023-0557 | High | 7.5 | 2023-01-27 | The ContentStudio plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.5. This could allow unauthenticate… |
CVE-2023-0556 | Critical | 9.8 | 2023-01-27 | The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions in versions up to, and incl… |
CVE-2023-0555 | High | 8.1 | 2023-01-27 | The Quick Restaurant Menu plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, a… |
CVE-2023-0554 | High | 8.1 | 2023-01-27 | The Quick Restaurant Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.2. This is due to missing or i… |
CVE-2023-0553 | Medium | 4.4 | 2023-01-27 | The Quick Restaurant Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 2.0.2… |
CVE-2023-0550 | High | 8.1 | 2023-01-27 | The Quick Restaurant Menu plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. This is due to the fa… |
CVE-2023-0549 | Low | 3.5 | 2023-01-27 | A vulnerability, which was classified as problematic, has been found in YAFNET up to 3.1.10. This issue affects some unknown processing of the file /forum/Post… |
CVE-2023-22242 | High | 7.8 | 2023-01-27 | Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an out-of-bounds write vuln… |
CVE-2023-22241 | High | 7.8 | 2023-01-27 | Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an out-of-bounds write vuln… |
CVE-2023-22240 | High | 7.8 | 2023-01-27 | Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an out-of-bounds write vuln… |
CVE-2023-0534 | Medium | 4.7 | 2023-01-27 | A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. This affects an unknown part of th… |
CVE-2023-0533 | Medium | 4.7 | 2023-01-27 | A vulnerability, which was classified as critical, has been found in SourceCodester Online Tours & Travels Management System 1.0. Affected by this issue is som… |
CVE-2023-0532 | Medium | 4.7 | 2023-01-27 | A vulnerability classified as critical was found in SourceCodester Online Tours & Travels Management System 1.0. Affected by this vulnerability is an unknown f… |
CVE-2023-0531 | Medium | 4.7 | 2023-01-27 | A vulnerability classified as critical has been found in SourceCodester Online Tours & Travels Management System 1.0. Affected is an unknown function of the fi… |
CVE-2023-0530 | Medium | 4.7 | 2023-01-27 | A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been rated as critical. This issue affects some unknown proces… |
CVE-2023-0529 | Medium | 4.7 | 2023-01-27 | A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been declared as critical. This vulnerability affects unknown… |
CVE-2023-0528 | Medium | 4.7 | 2023-01-27 | A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been classified as critical. This affects an unknown part of t… |
CVE-2023-0527 | Low | 3.5 | 2023-01-27 | A vulnerability was found in PHPGurukul Online Security Guards Hiring System 1.0 and classified as problematic. Affected by this issue is some unknown function… |
CVE-2023-24060 | Medium | 5.0 | 2023-01-27 | Haven 5d15944 allows Server-Side Request Forgery (SSRF) via the feed[url]= Feeds functionality. Authenticated users with the ability to create new RSS Feeds or… |
CVE-2023-22740 | Medium | 4.3 | 2023-01-27 | Discourse is an open source platform for community discussion. Versions prior to 3.1.0.beta1 (beta) (tests-passed) are vulnerable to Allocation of Resources W… |
CVE-2023-0519 | Medium | 5.4 | 2023-01-26 | Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4. |
CVE-2023-0493 | Medium | 5.3 | 2023-01-26 | Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5. |
CVE-2023-0509 | High | 7.4 | 2023-01-26 | Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44. |
CVE-2023-0488 | Medium | 5.4 | 2023-01-26 | Cross-site Scripting (XSS) - Stored in GitHub repository pyload/pyload prior to 0.5.0b3.dev42. |
CVE-2023-0470 | Medium | 5.4 | 2023-01-26 | Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4. |
CVE-2023-0455 | High | 8.8 | 2023-01-26 | Unrestricted Upload of File with Dangerous Type in GitHub repository unilogies/bumsys prior to v1.0.3-beta. |
CVE-2023-24508 | High | 8.1 | 2023-01-26 | Baicells Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB and Nova 246 devices with firmware through RTS/RTD 3.6.6 are vulnerable to remote shell code exploitat… |
CVE-2023-24495 | Medium | 6.5 | 2023-01-26 | A Server Side Request Forgery (SSRF) vulnerability exists in Tenable.sc due to improper validation of session & user-accessible input data. A privileged, authe… |
CVE-2023-24494 | Medium | 5.4 | 2023-01-26 | A stored cross-site scripting (XSS) vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authe… |
CVE-2023-24493 | Medium | 5.7 | 2023-01-26 | A formula injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated attacke… |
CVE-2023-24459 | Medium | 6.5 | 2023-01-26 | A missing permission check in Jenkins BearyChat Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL. |
CVE-2023-24458 | High | 8.8 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins BearyChat Plugin 3.0.2 and earlier allows attackers to connect to an attacker-specified URL. |
CVE-2023-24457 | Medium | 6.5 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins Keycloak Authentication Plugin 2.3.0 and earlier allows attackers to trick users into logging in t… |
CVE-2023-24456 | Critical | 9.8 | 2023-01-26 | Jenkins Keycloak Authentication Plugin 2.3.0 and earlier does not invalidate the previous session on login. |
CVE-2023-24455 | Medium | 4.3 | 2023-01-26 | Jenkins visualexpert Plugin 1.3 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers with Item/Configur… |
CVE-2023-24454 | Medium | 5.5 | 2023-01-26 | Jenkins TestQuality Updater Plugin 1.3 and earlier stores the TestQuality Updater password unencrypted in its global configuration file on the Jenkins controll… |
CVE-2023-24453 | Medium | 6.5 | 2023-01-26 | A missing check in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL usi… |
CVE-2023-24452 | High | 8.8 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers to connect to an attacker-specified UR… |
CVE-2023-24451 | Medium | 4.3 | 2023-01-26 | A missing permission check in Jenkins Cisco Spark Notifier Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs… |
CVE-2023-24450 | Medium | 6.5 | 2023-01-26 | Jenkins view-cloner Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users wit… |
CVE-2023-24449 | Medium | 4.3 | 2023-01-26 | Jenkins PWauth Security Realm Plugin 0.4 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers with Over… |
CVE-2023-24448 | Medium | 6.5 | 2023-01-26 | A missing permission check in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specifie… |
CVE-2023-24447 | High | 8.8 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers to connect to an attacker-specified AMQP… |
CVE-2023-24446 | High | 8.8 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins OpenID Plugin 2.4 and earlier allows attackers to trick users into logging in to the attacker's ac… |
CVE-2023-24445 | Medium | 6.1 | 2023-01-26 | Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins. |
CVE-2023-24444 | Critical | 9.8 | 2023-01-26 | Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login. |
CVE-2023-24443 | Critical | 9.8 | 2023-01-26 | Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-24442 | Medium | 5.5 | 2023-01-26 | Jenkins GitHub Pull Request Coverage Status Plugin 2.2.0 and earlier stores the GitHub Personal Access Token, Sonar access token and Sonar password unencrypted… |
CVE-2023-24441 | Critical | 9.8 | 2023-01-26 | Jenkins MSTest Plugin 1.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-24440 | Medium | 5.5 | 2023-01-26 | Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier transmits the private key in plain text as part of the global Jenkins configuration form… |
CVE-2023-24439 | Medium | 5.5 | 2023-01-26 | Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier stores the private keys unencrypted in its global configuration file on the Jenkins contro… |
CVE-2023-24438 | Medium | 6.5 | 2023-01-26 | A missing permission check in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers with Overall/Read permission to connect to… |
CVE-2023-24437 | High | 8.8 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers to connect to an att… |
CVE-2023-24436 | Medium | 4.3 | 2023-01-26 | A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to enumerate credenti… |
CVE-2023-24435 | Medium | 6.5 | 2023-01-26 | A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to connect to an atta… |
CVE-2023-24434 | High | 8.8 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers to connect to an attacker-s… |
CVE-2023-24433 | Medium | 6.5 | 2023-01-26 | Missing permission checks in Jenkins Orka by MacStadium Plugin 1.31 and earlier allow attackers with Overall/Read permission to connect to an attacker-specifie… |
CVE-2023-24432 | High | 8.8 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins Orka by MacStadium Plugin 1.31 and earlier allows attackers to connect to an attacker-specified HT… |
CVE-2023-24431 | Medium | 4.3 | 2023-01-26 | A missing permission check in Jenkins Orka by MacStadium Plugin 1.31 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of… |
CVE-2023-24430 | Critical | 9.8 | 2023-01-26 | Jenkins Semantic Versioning Plugin 1.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-24429 | Critical | 9.8 | 2023-01-26 | Jenkins Semantic Versioning Plugin 1.14 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about t… |
CVE-2023-24428 | Medium | 5.7 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket OAuth Plugin 0.12 and earlier allows attackers to trick users into logging in to the att… |
CVE-2023-24427 | Critical | 9.8 | 2023-01-26 | Jenkins Bitbucket OAuth Plugin 0.12 and earlier does not invalidate the previous session on login. |
CVE-2023-24426 | High | 8.8 | 2023-01-26 | Jenkins Azure AD Plugin 303.va_91ef20ee49f and earlier does not invalidate the previous session on login. |
CVE-2023-24425 | Medium | 6.5 | 2023-01-26 | Jenkins Kubernetes Credentials Provider Plugin 1.208.v128ee9800c04 and earlier does not set the appropriate context for Kubernetes credentials lookup, allowing… |
CVE-2023-24424 | High | 8.8 | 2023-01-26 | Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login. |
CVE-2023-24423 | Medium | 6.5 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins Gerrit Trigger Plugin 2.38.0 and earlier allows attackers to rebuild previous builds triggered by… |
CVE-2023-24422 | High | 8.8 | 2023-01-26 | A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission t… |
CVE-2023-24170 | Critical | 9.8 | 2023-01-26 | Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/fromSetWirelessRepeat. |
CVE-2023-24169 | Critical | 9.8 | 2023-01-26 | Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/FUN_0007343c. |
CVE-2023-24167 | Critical | 9.8 | 2023-01-26 | Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/add_white_node. |
CVE-2023-24166 | Critical | 9.8 | 2023-01-26 | Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/formWifiBasicSet. |
CVE-2023-24165 | Critical | 9.8 | 2023-01-26 | Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/initIpAddrInfo. |
CVE-2023-24164 | Critical | 9.8 | 2023-01-26 | Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/FUN_000c2318. |