2023 CVEs (page 302)
Page 302 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-24042 | High | 7.5 | 2023-01-21 | A race condition in LightFTP through 2.2 allows an attacker to achieve path traversal via a malformed FTP request. A handler thread can use an overwritten cont… |
CVE-2023-24040 | High | 7.1 | 2023-01-21 | dtprintinfo in Common Desktop Environment 1.6 has a bug in the parser of lpstat (an invoked external command) during listing of the names of available printers… |
CVE-2023-24039 | High | 7.8 | 2023-01-21 | A stack-based buffer overflow in ParseColors in libXm in Common Desktop Environment 1.6 can be exploited by local low-privileged users via the dtprintinfo setu… |
CVE-2023-24038 | High | 7.5 | 2023-01-21 | The HTML-StripScripts module through 1.06 for Perl allows _hss_attval_style ReDoS because of catastrophic backtracking for HTML content with certain style attr… |
CVE-2023-22742 | Medium | 5.3 | 2023-01-20 | libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2 backend, libgit2 does not perform certi… |
CVE-2023-24028 | Critical | 9.8 | 2023-01-20 | In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function. |
CVE-2023-24027 | Medium | 6.1 | 2023-01-20 | In MISP 2.4.167, app/webroot/js/action_table.js allows XSS via a network history name. |
CVE-2023-24026 | Medium | 6.1 | 2023-01-20 | In MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview payload. |
CVE-2023-22726 | High | 8.0 | 2023-01-20 | act is a project which allows for local running of github actions. The artifact server that stores artifacts from Github Action runs does not sanitize path inp… |
CVE-2023-0052 | Critical | 9.8 | 2023-01-20 | SAUTER Controls Nova 200–220 Series with firmware version 3.3-006 and prior and BACnetstac version 4.2.1 and prior allows the execution of commands without cre… |
CVE-2023-24025 | High | 7.5 | 2023-01-20 | CRYSTALS-DILITHIUM (in Post-Quantum Cryptography Selected Algorithms 2022) in PQClean d03da30 may allow universal forgeries of digital signatures via a templat… |
CVE-2023-23607 | Critical | 9.8 | 2023-01-20 | erohtar/Dasherr is a dashboard for self-hosted services. In affected versions unrestricted file upload allows any unauthenticated user to execute arbitrary cod… |
CVE-2023-24021 | High | 7.5 | 2023-01-20 | Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web A… |
CVE-2023-23492 | High | 8.8 | 2023-01-20 | The Login with Phone Number WordPress Plugin, version < 1.4.2, is affected by an authenticated SQL injection vulnerability in the 'ID' parameter of its 'lwp_fo… |
CVE-2023-23491 | Medium | 6.1 | 2023-01-20 | The Quick Event Manager WordPress Plugin, version < 9.7.5, is affected by a reflected cross-site scripting vulnerability in the 'category' parameter of its 'qe… |
CVE-2023-23490 | High | 8.8 | 2023-01-20 | The Survey Maker WordPress Plugin, version < 3.1.2, is affected by an authenticated SQL injection vulnerability in the 'surveys_ids' parameter of its 'ays_surv… |
CVE-2023-23145 | High | 7.8 | 2023-01-20 | GPAC version 2.2-rev0-gab012bbfb-master was discovered to contain a memory leak in lsr_read_rare_full function. |
CVE-2023-23144 | Medium | 5.5 | 2023-01-20 | Integer overflow vulnerability in function Q_DecCoordOnUnitSphere file bifs/unquantize.c in GPAC version 2.2-rev0-gab012bbfb-master. |
CVE-2023-23143 | High | 7.8 | 2023-01-20 | Buffer overflow vulnerability in function avc_parse_slice in file media_tools/av_parsers.c. GPAC version 2.3-DEV-rev1-g4669ba229-master. |
CVE-2023-23024 | Medium | 6.1 | 2023-01-20 | Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/book. This vulnerability allows at… |
CVE-2023-23015 | Medium | 6.1 | 2023-01-20 | Cross Site Scripting (XSS) vulnerability in Kalkun 0.8.0 via username input in file User_model.php. |
CVE-2023-23014 | Medium | 6.1 | 2023-01-20 | Cross Site Scripting (XSS) vulnerability in InventorySystem thru commit e08fbbe17902146313501ed0b5feba81d58f455c (on Apr 23, 2021) via edit_store_name and edit… |
CVE-2023-23012 | Medium | 6.1 | 2023-01-20 | Cross Site Scripting (XSS) vulnerability in craigrodway classroombookings 2.6.4 allows attackers to execute arbitrary code or other unspecified impacts via the… |
CVE-2023-23010 | Medium | 6.1 | 2023-01-20 | Cross Site Scripting (XSS) vulnerability in Ecommerce-CodeIgniter-Bootstrap thru commit d5904379ca55014c5df34c67deda982c73dc7fe5 (on Dec 27, 2022), allows atta… |
CVE-2023-22458 | Medium | 5.5 | 2023-01-20 | Redis is an in-memory database that persists on disk. Authenticated users can issue a `HRANDFIELD` or `ZRANDMEMBER` command with specially crafted arguments to… |
CVE-2023-0101 | High | 8.8 | 2023-01-20 | A privilege escalation vulnerability was identified in Nessus versions 8.10.1 through 8.15.8 and 10.0.0 through 10.4.1. An authenticated attacker could potenti… |
CVE-2023-23489 | Critical | 9.8 | 2023-01-20 | The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection vulnerability in the 's' parameter of… |
CVE-2023-23488 | Critical | 9.8 | 2023-01-20 | The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the 'code' parameter of the '/pmpr… |
CVE-2023-22912 | Medium | 5.3 | 2023-01-20 | An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. CheckUser TokenManager insecurely uses AES-C… |
CVE-2023-22910 | Medium | 5.4 | 2023-01-20 | An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. There is XSS in Wikibase date formatting via… |
CVE-2023-22964 | Critical | 9.1 | 2023-01-20 | Zoho ManageEngine ServiceDesk Plus MSP before 10611, and 13x before 13004, is vulnerable to authentication bypass when LDAP authentication is enabled. |
CVE-2023-23691 | High | 8.1 | 2023-01-20 | Dell EMC PV ME5, versions ME5.1.0.0.0 and ME5.1.0.1.0, contains a Client-side desync Vulnerability. An unauthenticated attacker could potentially exploit this… |
CVE-2023-23596 | High | 8.8 | 2023-01-20 | jc21 NGINX Proxy Manager through 2.9.19 allows OS command injection. When creating an access list, the backend builds an htpasswd file with crafted username an… |
CVE-2023-20058 | Medium | 6.1 | 2023-01-20 | A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a reflect… |
CVE-2023-20057 | Unrated | | 2023-01-20 | A vulnerability in the URL filtering mechanism of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attack… |
CVE-2023-20047 | Medium | 6.5 | 2023-01-20 | A vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco Webex Room Phone and Cisco Webex Share devices could allow an unauthenticated, adj… |
CVE-2023-20045 | Medium | 4.9 | 2023-01-20 | A vulnerability in the web-based management interface of Cisco Small Business RV160 and RV260 Series VPN Routers could allow an authenticated, remote attacker… |
CVE-2023-20044 | Medium | 6.7 | 2023-01-20 | A vulnerability in Cisco CX Cloud Agent of could allow an authenticated, local attacker to elevate their privileges. This vulnerability is due to insecure f… |
CVE-2023-20043 | Medium | 6.7 | 2023-01-20 | A vulnerability in Cisco CX Cloud Agent of could allow an authenticated, local attacker to elevate their privileges. This vulnerability is due to insecure f… |
CVE-2023-20040 | Medium | 5.5 | 2023-01-20 | A vulnerability in the NETCONF service of Cisco Network Services Orchestrator (NSO) could allow an authenticated, remote attacker to cause a denial of service… |
CVE-2023-20038 | High | 8.8 | 2023-01-20 | A vulnerability in the monitoring application of Cisco Industrial Network Director could allow an authenticated, local attacker to access a static secret key u… |
CVE-2023-20037 | Medium | 5.4 | 2023-01-20 | A vulnerability in Cisco Industrial Network Director could allow an authenticated, remote attacker to conduct stored cross-site scripting (XSS) attacks. The… |
CVE-2023-20026 | Medium | 6.5 | 2023-01-20 | A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320 and RV325 Routers could allow an authenticated… |
CVE-2023-20025 | Critical | 9.0 | 2023-01-20 | A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, and RV082 Routers could allow an unauthenticated, remote at… |
CVE-2023-20020 | High | 8.6 | 2023-01-20 | A vulnerability in the Device Management Servlet application of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform c… |
CVE-2023-20019 | Medium | 6.1 | 2023-01-20 | A vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform, Cisco BroadWorks Application Server, and Cisco BroadWo… |
CVE-2023-20018 | High | 8.6 | 2023-01-20 | A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote attacker to bypass a… |
CVE-2023-20010 | High | 8.1 | 2023-01-20 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Man… |
CVE-2023-20008 | Medium | 4.4 | 2023-01-20 | A vulnerability in the CLI of Cisco TelePresence CE and RoomOS Software could allow an authenticated, local attacker to overwrite arbitrary files on the local… |
CVE-2023-20007 | Medium | 4.7 | 2023-01-20 | A vulnerability in the web-based management interface of Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an auth… |
CVE-2023-20002 | Medium | 4.4 | 2023-01-20 | A vulnerability in Cisco TelePresence CE and RoomOS Software could allow an authenticated, local attacker to bypass access controls and conduct an SSRF attack… |
CVE-2023-22373 | Medium | 5.4 | 2023-01-20 | Cross-site scripting vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote authenticated attacker to inject an arbitrary script and… |
CVE-2023-22339 | High | 7.5 | 2023-01-20 | Improper access control vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote unauthenticated attacker to bypass access restriction… |
CVE-2023-22334 | Medium | 5.3 | 2023-01-20 | Use of password hash instead of password for authentication vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote authenticated att… |
CVE-2023-22331 | High | 7.5 | 2023-01-20 | Use of default credentials vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote unauthenticated attacker to alter user credentials… |
CVE-2023-0410 | Medium | 6.1 | 2023-01-20 | Cross-site Scripting (XSS) - Generic in GitHub repository builderio/qwik prior to 0.1.0-beta5. |
CVE-2023-22745 | Medium | 6.4 | 2023-01-19 | tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In versions prio… |
CVE-2023-22741 | Critical | 9.8 | 2023-01-19 | Sofia-SIP is an open-source SIP User-Agent library, compliant with the IETF RFC3261 specification. In affected versions Sofia-SIP **lacks both message length a… |
CVE-2023-0126 | High | 7.5 | 2023-01-19 | Pre-authentication path traversal vulnerability in SMA1000 firmware version 12.4.2, which allows an unauthenticated attacker to access arbitrary files and dire… |
CVE-2023-0406 | Medium | 4.3 | 2023-01-19 | Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4. |
CVE-2023-0404 | Medium | 5.4 | 2023-01-19 | The Events Made Easy plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions related to AJAX actions… |
CVE-2023-0403 | Medium | 5.4 | 2023-01-19 | The Social Warfare plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3.1. This is due to missing or incorrec… |
CVE-2023-0402 | Medium | 5.4 | 2023-01-19 | The Social Warfare plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several AJAX actions in versions up to, and… |
CVE-2023-23690 | High | 7.0 | 2023-01-19 | Cloud Mobility for Dell EMC Storage, versions 1.3.0.X and below contains an Improper Check for Certificate Revocation vulnerability. A threat actor does not n… |
CVE-2023-0398 | Medium | 6.5 | 2023-01-19 | Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4. |
CVE-2023-0397 | Critical | 9.6 | 2023-01-19 | A malicious / defect bluetooth controller can cause a Denial of Service due to unchecked input in le_read_buffer_size_complete. |
CVE-2023-0290 | Medium | 4.3 | 2023-01-18 | Rapid7 Velociraptor did not properly sanitize the client ID parameter to the CreateCollection API, allowing a directory traversal in where the collection task… |
CVE-2023-0164 | High | 8.8 | 2023-01-18 | OrangeScrum version 2.0.11 allows an authenticated external attacker to execute arbitrary commands on the server. This is possible because the application inje… |
CVE-2023-0242 | High | 8.8 | 2023-01-18 | Rapid7 Velociraptor allows users to be created with different privileges on the server. Administrators are generally allowed to run any command on the server i… |
CVE-2023-22863 | Medium | 5.9 | 2023-01-18 | IBM Robotic Process Automation 20.12.0 through 21.0.2 defaults to HTTP in some RPA commands when the prefix is not explicitly specified in the URL. This could… |
CVE-2023-22594 | Medium | 4.6 | 2023-01-18 | IBM Robotic Process Automation for Cloud Pak 20.12.0 through 21.0.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary J… |
CVE-2023-22592 | Medium | 4.0 | 2023-01-18 | IBM Robotic Process Automation for Cloud Pak 21.0.1 through 21.0.4 could allow a local user to perform unauthorized actions due to insufficient permission set… |
CVE-2023-21614 | Medium | 5.5 | 2023-01-18 | Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an out-of-bounds read vulne… |
CVE-2023-21613 | Medium | 5.5 | 2023-01-18 | Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an out-of-bounds read vulne… |
CVE-2023-21612 | High | 7.8 | 2023-01-18 | Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Creation of Temporary Fil… |
CVE-2023-21611 | High | 7.8 | 2023-01-18 | Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Creation of Temporary Fil… |
CVE-2023-21610 | High | 7.8 | 2023-01-18 | Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Stack-based Buffer Overfl… |
CVE-2023-21609 | High | 7.8 | 2023-01-18 | Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an out-of-bounds write vuln… |
CVE-2023-21608 | High | 7.8 | 2023-01-18 | Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Use After Free vulnerabil… |
CVE-2023-21607 | High | 7.8 | 2023-01-18 | Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an Improper Input Validatio… |
CVE-2023-21606 | High | 7.8 | 2023-01-18 | Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an out-of-bounds write vuln… |
CVE-2023-21605 | High | 7.8 | 2023-01-18 | Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Heap-based Buffer Overflo… |
CVE-2023-21604 | High | 7.8 | 2023-01-18 | Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Stack-based Buffer Overfl… |
CVE-2023-21585 | Medium | 5.5 | 2023-01-18 | Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an out-of-bounds read vulne… |
CVE-2023-21581 | Medium | 5.5 | 2023-01-18 | Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an out-of-bounds read vulne… |
CVE-2023-21579 | High | 7.8 | 2023-01-18 | Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an Integer Overflow or Wrap… |
CVE-2023-0040 | High | 7.5 | 2023-01-18 | Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the resul… |
CVE-2023-21603 | Medium | 5.5 | 2023-01-18 | Adobe Dimension version 3.4.6 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker… |
CVE-2023-21601 | Medium | 5.5 | 2023-01-18 | Adobe Dimension version 3.4.6 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could… |
CVE-2023-22809 | High | 7.8 | 2023-01-18 | In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and E… |
CVE-2023-0385 | Medium | 4.3 | 2023-01-18 | The Custom 404 Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.7.1. This is due to missing or incorrec… |
CVE-2023-0214 | Medium | 6.1 | 2023-01-18 | A cross-site scripting vulnerability in Skyhigh SWG in main releases 11.x prior to 11.2.6, 10.x prior to 10.2.17, and controlled release 12.x prior to 12.0.1 a… |
CVE-2023-0358 | High | 7.8 | 2023-01-18 | Use After Free in GitHub repository gpac/gpac prior to 2.3.0-DEV. |
CVE-2023-21860 | Medium | 6.3 | 2023-01-18 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: Internal Operations). Supported versions that are affected are 7.4.38 and prio… |
CVE-2023-21900 | Medium | 4.0 | 2023-01-18 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: NSSwitch). Supported versions that are affected are 10 and 11. Difficult to exploit… |
CVE-2023-21899 | Medium | 5.5 | 2023-01-18 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.42 and pr… |
CVE-2023-21898 | Medium | 5.5 | 2023-01-18 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.42 and pr… |
CVE-2023-21894 | High | 7.3 | 2023-01-18 | Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer issues). Suppo… |
CVE-2023-21893 | High | 7.5 | 2023-01-18 | Vulnerability in the Oracle Data Provider for .NET component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Difficult to ex… |
CVE-2023-21892 | Medium | 5.4 | 2023-01-18 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Visual Analyzer). Supported versions that… |