2023 CVEs (page 300)
Page 300 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-0613 | High | 7.5 | 2023-02-01 | A vulnerability has been found in TRENDnet TEW-811DRU 1.0.10.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the fi… |
CVE-2023-0612 | High | 7.5 | 2023-02-01 | A vulnerability, which was classified as critical, was found in TRENDnet TEW-811DRU 1.0.10.0. Affected is an unknown function of the file /wireless/basic.asp o… |
CVE-2023-0611 | High | 8.8 | 2023-02-01 | A vulnerability, which was classified as critical, has been found in TRENDnet TEW-652BRP 3.04B01. This issue affects some unknown processing of the file get_se… |
CVE-2023-23692 | High | 8.8 | 2023-02-01 | Dell EMC prior to version DDOS 7.9 contain(s) an OS command injection Vulnerability. An authenticated non admin attacker could potentially exploit this vulner… |
CVE-2023-22572 | High | 7.8 | 2023-02-01 | Dell PowerScale OneFS 9.1.0.x-9.4.0.x contain an insertion of sensitive information into log file vulnerability in change password api. A low privilege local… |
CVE-2023-0610 | Medium | 4.3 | 2023-02-01 | Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3. |
CVE-2023-0609 | Medium | 4.3 | 2023-02-01 | Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3. |
CVE-2023-24977 | High | 7.5 | 2023-02-01 | Out-of-bounds Read vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users are advised to u… |
CVE-2023-0608 | Medium | 5.4 | 2023-02-01 | Cross-site Scripting (XSS) - DOM in GitHub repository microweber/microweber prior to 1.3.2. |
CVE-2023-0607 | Medium | 4.8 | 2023-02-01 | Cross-site Scripting (XSS) - Stored in GitHub repository projectsend/projectsend prior to r1606. |
CVE-2023-23846 | High | 7.5 | 2023-02-01 | Due to insufficient length validation in the Open5GS GTP library versions prior to versions 2.4.13 and 2.5.7, when parsing extension headers in GPRS tunneling… |
CVE-2023-20856 | High | 8.8 | 2023-02-01 | VMware vRealize Operations (vROps) contains a CSRF bypass vulnerability. A malicious user could execute actions on the vROps platform on behalf of the authenti… |
CVE-2023-0587 | Critical | 9.1 | 2023-02-01 | A file upload vulnerability in exists in Trend Micro Apex One server build 11110. Using a malformed Content-Length header in an HTTP PUT message sent to URL /o… |
CVE-2023-0524 | High | 8.8 | 2023-02-01 | As part of our Security Development Lifecycle, a potential privilege escalation issue was identified internally. This could allow a malicious actor with suffic… |
CVE-2023-0454 | High | 8.1 | 2023-02-01 | OrangeScrum version 2.0.11 allows an authenticated external attacker to delete arbitrary local files from the server. This is possible because the application… |
CVE-2023-23928 | Medium | 5.9 | 2023-02-01 | reason-jose is a JOSE implementation in ReasonML and OCaml.`Jose.Jws.validate` does not check HS256 signatures. This allows tampering of JWS header and payload… |
CVE-2023-23630 | High | 8.6 | 2023-02-01 | Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has b… |
CVE-2023-0606 | Medium | 6.1 | 2023-02-01 | Cross-site Scripting (XSS) - Reflected in GitHub repository ampache/ampache prior to 5.5.7. |
CVE-2023-24956 | High | 8.8 | 2023-02-01 | Forget Heart Message Box v1.1 was discovered to contain a SQL injection vulnerability via the name parameter at /cha.php. |
CVE-2023-24241 | Critical | 9.8 | 2023-02-01 | Forget Heart Message Box v1.1 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/loginpost.php. |
CVE-2023-23924 | Critical | 10.0 | 2023-02-01 | Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing `<image>` tags with uppercase letters. This ma… |
CVE-2023-0341 | High | 7.8 | 2023-02-01 | A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and po… |
CVE-2023-22611 | High | 7.5 | 2023-01-31 | A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause information disclosure when specific messages are s… |
CVE-2023-22610 | Critical | 9.1 | 2023-01-31 | A CWE-863: Incorrect Authorization vulnerability exists that could cause Denial of Service against the Geo SCADA server when specific messages are sent to the… |
CVE-2023-24163 | Critical | 9.8 | 2023-01-31 | SQL Inection vulnerability in Dromara hutool before 5.8.21 allows attacker to execute arbitrary code via the aviator template engine. |
CVE-2023-24162 | Critical | 9.8 | 2023-01-31 | Deserialization vulnerability in Dromara Hutool v5.8.11 allows attacker to execute arbitrary code via the XmlUtil.readObjectFromXml parameter. |
CVE-2023-24829 | High | 8.8 | 2023-01-31 | Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component from 0.13.0 before 0.13.3… |
CVE-2023-0593 | Medium | 5.5 | 2023-01-31 | A path traversal vulnerability affects yaffshiv YAFFS filesystem extractor. By crafting a malicious YAFFS file, an attacker could force yaffshiv to write outsi… |
CVE-2023-0592 | Medium | 5.5 | 2023-01-31 | A path traversal vulnerability affects jefferson's JFFS2 filesystem extractor. By crafting malicious JFFS2 files, attackers could force jefferson to write outs… |
CVE-2023-0591 | Medium | 5.5 | 2023-01-31 | ubireader_extract_files is vulnerable to path traversal when run against specifically crafted UBIFS files, allowing the attacker to overwrite files outside of… |
CVE-2023-22900 | Critical | 9.8 | 2023-01-31 | Efence login function has insufficient validation for user input. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL com… |
CVE-2023-23582 | Medium | 5.3 | 2023-01-30 | Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior are vulnerable to a heap-based buffer overflow, which could allow an attacker to execute arbitrary c… |
CVE-2023-22389 | Medium | 5.7 | 2023-01-30 | Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior store passwords in a plaintext file when the device configuration is exported via Save/Restore–>Back… |
CVE-2023-24020 | High | 7.5 | 2023-01-30 | Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior could bypass the brute force protection, allowing multiple attempts to force a login. |
CVE-2023-22315 | Medium | 6.7 | 2023-01-30 | Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior use a proprietary local area network (LAN) protocol that does not verify updates to the device. An a… |
CVE-2023-0097 | Medium | 5.4 | 2023-01-30 | The Post Grid, Post Carousel, & List Category Posts WordPress plugin before 2.4.19 does not validate and escape some of its block options before outputting the… |
CVE-2023-0074 | Medium | 5.4 | 2023-01-30 | The WP Social Widget WordPress plugin before 2.2.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post whe… |
CVE-2023-0071 | Medium | 5.4 | 2023-01-30 | The WP Tabs WordPress plugin before 2.1.17 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the s… |
CVE-2023-0033 | Medium | 5.4 | 2023-01-30 | The PDF Viewer WordPress plugin before 1.0.0 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contri… |
CVE-2023-24830 | High | 7.5 | 2023-01-30 | Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects iotdb-web-workbench component: from 0.13.0 before 0.13.3. |
CVE-2023-0512 | High | 7.8 | 2023-01-30 | Divide By Zero in GitHub repository vim/vim prior to 9.0.1247. |
CVE-2023-0581 | Medium | 5.3 | 2023-01-30 | The PrivateContent plugin for WordPress is vulnerable to protection mechanism bypass due to the use of client side validation in versions up to, and including… |
CVE-2023-0266 | High | 7.9 | 2023-01-30 | A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a u… |
CVE-2023-0240 | High | 7.8 | 2023-01-30 | There is a logic error in io_uring's implementation which can be used to trigger a use-after-free vulnerability leading to privilege escalation. In the io_pre… |
CVE-2023-0474 | High | 8.8 | 2023-01-30 | Use after free in GuestView in Google Chrome prior to 109.0.5414.119 allowed an attacker who convinced a user to install a malicious extension to potentially e… |
CVE-2023-0473 | High | 8.8 | 2023-01-30 | Type Confusion in ServiceWorker API in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTM… |
CVE-2023-0472 | High | 8.8 | 2023-01-30 | Use after free in WebRTC in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2023-0471 | High | 8.8 | 2023-01-30 | Use after free in WebTransport in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pag… |
CVE-2023-22333 | Medium | 6.1 | 2023-01-30 | Cross-site scripting vulnerability in EasyMail 2.00.130 and earlier allows a remote unauthenticated attacker to inject an arbitrary script. |
CVE-2023-22332 | Medium | 6.5 | 2023-01-30 | Information disclosure vulnerability exists in Pgpool-II 4.4.0 to 4.4.1 (4.4 series), 4.3.0 to 4.3.4 (4.3 series), 4.2.0 to 4.2.11 (4.2 series), 4.1.0 to 4.1.1… |
CVE-2023-22324 | Medium | 6.5 | 2023-01-30 | SQL injection vulnerability in the CONPROSYS HMI System (CHS) Ver.3.5.0 and earlier allows a remote authenticated attacker to execute an arbitrary SQL command… |
CVE-2023-22322 | Medium | 5.5 | 2023-01-30 | Improper restriction of XML external entity reference (XXE) vulnerability exists in OMRON CX-Motion Pro 1.4.6.013 and earlier. If a user opens a specially craf… |
CVE-2023-24623 | High | 7.5 | 2023-01-30 | Paranoidhttp before 0.3.0 allows SSRF because [::] is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses. |
CVE-2023-24622 | Medium | 5.3 | 2023-01-30 | isInList in the safeurl-python package before 1.2 for Python has an insufficiently restrictive regular expression for external domains, leading to SSRF. |
CVE-2023-24612 | Critical | 9.8 | 2023-01-30 | The PdfBook extension through 2.0.5 before b07b6a64 for MediaWiki allows command injection via an option. |
CVE-2023-0572 | Medium | 5.3 | 2023-01-29 | Unchecked Error Condition in GitHub repository froxlor/froxlor prior to 2.0.10. |
CVE-2023-24065 | Medium | 5.4 | 2023-01-29 | NOSH 4a5cfdb allows stored XSS via the create user page. For example, a first name (of a physician, assistant, or billing user) can have a JavaScript payload t… |
CVE-2023-0566 | Medium | 6.2 | 2023-01-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in froxlor/froxlor prior to 2.0.10. |
CVE-2023-0565 | Medium | 5.5 | 2023-01-29 | Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.10. |
CVE-2023-0571 | Low | 3.5 | 2023-01-29 | A vulnerability has been found in SourceCodester Canteen Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the fi… |
CVE-2023-0570 | Medium | 6.3 | 2023-01-29 | A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. This affects an unknown part of th… |
CVE-2023-0569 | Medium | 6.5 | 2023-01-29 | Weak Password Requirements in GitHub repository publify/publify prior to 9.2.10. |
CVE-2023-0564 | Medium | 5.4 | 2023-01-29 | Weak Password Requirements in GitHub repository froxlor/froxlor prior to 2.0.10. |
CVE-2023-0563 | Low | 3.5 | 2023-01-28 | A vulnerability classified as problematic has been found in PHPGurukul Bank Locker Management System 1.0. This affects an unknown part of the file add-locker-f… |
CVE-2023-0562 | High | 7.3 | 2023-01-28 | A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2023-0561 | Medium | 6.3 | 2023-01-28 | A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. Affected is an unknown function of… |
CVE-2023-0560 | Medium | 4.7 | 2023-01-28 | A vulnerability, which was classified as critical, has been found in SourceCodester Online Tours & Travels Management System 1.0. This issue affects some unkno… |
CVE-2023-23629 | Medium | 6.3 | 2023-01-28 | Metabase is an open source data analytics platform. Affected versions are subject to Improper Privilege Management. As intended, recipients of dashboards subsc… |
CVE-2023-23628 | Medium | 5.7 | 2023-01-28 | Metabase is an open source data analytics platform. Affected versions are subject to Exposure of Sensitive Information to an Unauthorized Actor. Sandboxed user… |
CVE-2023-23627 | Medium | 6.1 | 2023-01-28 | Sanitize is an allowlist-based HTML and CSS sanitizer. Versions 5.0.0 and later, prior to 6.0.1, are vulnerable to Cross-site Scripting. When Sanitize is confi… |
CVE-2023-23624 | Medium | 4.3 | 2023-01-28 | Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and version 3.1.0.beta2 on the `beta` and `tests-passed` branche… |
CVE-2023-23621 | High | 8.6 | 2023-01-28 | Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and version 3.1.0.beta2 on the `beta` and `tests-passed` branche… |
CVE-2023-23620 | Medium | 5.3 | 2023-01-28 | Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches, the c… |
CVE-2023-23617 | Medium | 4.9 | 2023-01-28 | OpenMage LTS is an e-commerce platform. Versions prior to 19.4.22 and 20.0.19 contain an infinite loop in malicious code filter in certain conditions. Versions… |
CVE-2023-23616 | Low | 3.5 | 2023-01-28 | Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches, when… |
CVE-2023-22737 | Medium | 6.5 | 2023-01-28 | wire-server provides back end services for Wire, a team communication and collaboration platform. Prior to version 2022-12-09, every member of a Conversation c… |
CVE-2023-0558 | High | 8.2 | 2023-01-27 | The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to an unsecure token check that is susceptible to type juggling in versions up… |
CVE-2023-0557 | High | 7.5 | 2023-01-27 | The ContentStudio plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.5. This could allow unauthenticate… |
CVE-2023-0556 | Critical | 9.8 | 2023-01-27 | The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions in versions up to, and incl… |
CVE-2023-0555 | High | 8.1 | 2023-01-27 | The Quick Restaurant Menu plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, a… |
CVE-2023-0554 | High | 8.1 | 2023-01-27 | The Quick Restaurant Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.2. This is due to missing or i… |
CVE-2023-0553 | Medium | 4.4 | 2023-01-27 | The Quick Restaurant Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 2.0.2… |
CVE-2023-0550 | High | 8.1 | 2023-01-27 | The Quick Restaurant Menu plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. This is due to the fa… |
CVE-2023-0549 | Low | 3.5 | 2023-01-27 | A vulnerability, which was classified as problematic, has been found in YAFNET up to 3.1.10. This issue affects some unknown processing of the file /forum/Post… |
CVE-2023-22242 | High | 7.8 | 2023-01-27 | Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an out-of-bounds write vuln… |
CVE-2023-22241 | High | 7.8 | 2023-01-27 | Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an out-of-bounds write vuln… |
CVE-2023-22240 | High | 7.8 | 2023-01-27 | Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an out-of-bounds write vuln… |
CVE-2023-0534 | Medium | 4.7 | 2023-01-27 | A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. This affects an unknown part of th… |
CVE-2023-0533 | Medium | 4.7 | 2023-01-27 | A vulnerability, which was classified as critical, has been found in SourceCodester Online Tours & Travels Management System 1.0. Affected by this issue is som… |
CVE-2023-0532 | Medium | 4.7 | 2023-01-27 | A vulnerability classified as critical was found in SourceCodester Online Tours & Travels Management System 1.0. Affected by this vulnerability is an unknown f… |
CVE-2023-0531 | Medium | 4.7 | 2023-01-27 | A vulnerability classified as critical has been found in SourceCodester Online Tours & Travels Management System 1.0. Affected is an unknown function of the fi… |
CVE-2023-0530 | Medium | 4.7 | 2023-01-27 | A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been rated as critical. This issue affects some unknown proces… |
CVE-2023-0529 | Medium | 4.7 | 2023-01-27 | A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been declared as critical. This vulnerability affects unknown… |
CVE-2023-0528 | Medium | 4.7 | 2023-01-27 | A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been classified as critical. This affects an unknown part of t… |
CVE-2023-0527 | Low | 3.5 | 2023-01-27 | A vulnerability was found in PHPGurukul Online Security Guards Hiring System 1.0 and classified as problematic. Affected by this issue is some unknown function… |
CVE-2023-24060 | Medium | 5.0 | 2023-01-27 | Haven 5d15944 allows Server-Side Request Forgery (SSRF) via the feed[url]= Feeds functionality. Authenticated users with the ability to create new RSS Feeds or… |
CVE-2023-22740 | Medium | 4.3 | 2023-01-27 | Discourse is an open source platform for community discussion. Versions prior to 3.1.0.beta1 (beta) (tests-passed) are vulnerable to Allocation of Resources W… |
CVE-2023-0519 | Medium | 5.4 | 2023-01-26 | Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4. |
CVE-2023-0493 | Medium | 5.3 | 2023-01-26 | Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5. |
CVE-2023-0509 | High | 7.4 | 2023-01-26 | Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44. |