2023 CVEs (page 304)
Page 304 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-0313 | Medium | 5.4 | 2023-01-15 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2023-0312 | Medium | 6.1 | 2023-01-15 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2023-0311 | Critical | 9.8 | 2023-01-15 | Improper Authentication in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2023-0310 | Medium | 5.4 | 2023-01-15 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2023-0309 | Medium | 5.4 | 2023-01-15 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2023-0308 | Medium | 5.4 | 2023-01-15 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2023-0307 | Critical | 9.8 | 2023-01-15 | Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2023-0306 | Medium | 5.4 | 2023-01-15 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2023-0305 | Medium | 6.3 | 2023-01-15 | A vulnerability classified as critical was found in SourceCodester Online Food Ordering System. This vulnerability affects unknown code of the file admin_class… |
CVE-2023-0304 | Medium | 6.3 | 2023-01-15 | A vulnerability classified as critical has been found in SourceCodester Online Food Ordering System. This affects an unknown part of the file admin_class.php o… |
CVE-2023-0303 | Medium | 6.3 | 2023-01-15 | A vulnerability was found in SourceCodester Online Food Ordering System. It has been rated as critical. Affected by this issue is some unknown functionality of… |
CVE-2023-23595 | High | 7.5 | 2023-01-15 | BlueCat Device Registration Portal 2.2 allows XXE attacks that exfiltrate single-line files. A single-line file might contain credentials, such as "machine exa… |
CVE-2023-23590 | High | 7.5 | 2023-01-15 | Mercedes-Benz XENTRY Retail Data Storage 7.8.1 allows remote attackers to cause a denial of service (device restart) via an unauthenticated API request. The at… |
CVE-2023-0302 | High | 7.8 | 2023-01-15 | Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository radareorg/radare2 prior to 5.8.2. |
CVE-2023-0301 | Medium | 5.4 | 2023-01-14 | Cross-site Scripting (XSS) - Stored in GitHub repository alfio-event/alf.io prior to Alf.io 2.0-M4-2301. |
CVE-2023-0300 | Medium | 5.4 | 2023-01-14 | Cross-site Scripting (XSS) - Reflected in GitHub repository alfio-event/alf.io prior to 2.0-M4-2301. |
CVE-2023-0299 | Critical | 9.8 | 2023-01-14 | Improper Input Validation in GitHub repository publify/publify prior to 9.2.10. |
CVE-2023-22602 | High | 7.5 | 2023-01-14 | When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication… |
CVE-2023-0298 | Medium | 6.5 | 2023-01-14 | Incorrect Authorization in GitHub repository firefly-iii/firefly-iii prior to 5.8.0. |
CVE-2023-0297 | Critical | 9.8 | 2023-01-14 | Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31. |
CVE-2023-22851 | High | 7.2 | 2023-01-14 | Tiki before 24.2 allows lib/importer/tikiimporter_blog_wordpress.php PHP Object Injection by an admin because of an unserialize call. |
CVE-2023-22850 | High | 8.8 | 2023-01-14 | Tiki before 24.1, when the Spreadsheets feature is enabled, allows lib/sheet/grid.php PHP Object Injection because of an unserialize call. |
CVE-2023-22497 | Medium | 6.5 | 2023-01-14 | Netdata is an open source option for real-time infrastructure monitoring and troubleshooting. Each Netdata Agent has an automatically generated MACHINE GUID. I… |
CVE-2023-23589 | Medium | 6.5 | 2023-01-14 | The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not the safe SOCKS4a protocol, aka TROVE-2022… |
CVE-2023-22853 | High | 8.8 | 2023-01-14 | Tiki before 24.1, when feature_create_webhelp is enabled, allows lib/structures/structlib.php PHP Object Injection because of an eval. |
CVE-2023-22852 | Medium | 6.5 | 2023-01-14 | Tiki through 25.0 allows CSRF attacks that are related to tiki-importer.php and tiki-import_sheet.php. |
CVE-2023-22496 | High | 8.1 | 2023-01-14 | Netdata is an open source option for real-time infrastructure monitoring and troubleshooting. An attacker with the ability to establish a streaming connection… |
CVE-2023-22495 | Critical | 9.8 | 2023-01-14 | Izanami is a shared configuration service well-suited for micro-service architecture implementation. Attackers can bypass the authentication in this applicatio… |
CVE-2023-22480 | High | 7.3 | 2023-01-14 | KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters. In KubeOperator v… |
CVE-2023-22478 | High | 7.3 | 2023-01-14 | KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1… |
CVE-2023-22471 | Low | 3.5 | 2023-01-14 | Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Broken access control allows… |
CVE-2023-22470 | Low | 3.5 | 2023-01-14 | Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. A database error ca… |
CVE-2023-21599 | Medium | 5.5 | 2023-01-13 | Adobe InCopy versions 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive mem… |
CVE-2023-21598 | Medium | 5.5 | 2023-01-13 | Adobe InCopy versions 18.0 (and earlier), 17.4 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory… |
CVE-2023-21597 | High | 7.8 | 2023-01-13 | Adobe InCopy versions 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution… |
CVE-2023-21596 | High | 7.8 | 2023-01-13 | Adobe InCopy versions 18.0 (and earlier), 17.4 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code exe… |
CVE-2023-21595 | High | 7.8 | 2023-01-13 | Adobe InCopy versions 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution… |
CVE-2023-21594 | High | 7.8 | 2023-01-13 | Adobe InCopy versions 18.0 (and earlier), 17.4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code exe… |
CVE-2023-21592 | Medium | 5.5 | 2023-01-13 | Adobe InDesign version 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive me… |
CVE-2023-21591 | Medium | 5.5 | 2023-01-13 | Adobe InDesign version 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive me… |
CVE-2023-21590 | High | 7.8 | 2023-01-13 | Adobe InDesign version 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code executio… |
CVE-2023-21589 | High | 7.8 | 2023-01-13 | Adobe InDesign version 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code executio… |
CVE-2023-21588 | High | 7.8 | 2023-01-13 | Adobe InDesign version 18.0 (and earlier), 17.4 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code ex… |
CVE-2023-21587 | High | 7.8 | 2023-01-13 | Adobe InDesign version 18.0 (and earlier), 17.4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code ex… |
CVE-2023-0295 | Medium | 5.5 | 2023-01-13 | The Launchpad plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of its settings parameters in versions up to, and including, 1.0.13… |
CVE-2023-0294 | High | 8.8 | 2023-01-13 | The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.1. This is due to… |
CVE-2023-0293 | Medium | 4.3 | 2023-01-13 | The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in vers… |
CVE-2023-22491 | High | 8.1 | 2023-01-13 | Gatsby is a free and open source framework based on React that helps developers build websites and apps. The gatsby-transformer-remark plugin prior to versions… |
CVE-2023-22489 | Low | 3.5 | 2023-01-13 | Flarum is a discussion platform for websites. If the first post of a discussion is permanently deleted but the discussion stays visible, any actor who can view… |
CVE-2023-0289 | Medium | 5.4 | 2023-01-13 | Cross-site Scripting (XSS) - Stored in GitHub repository craigk5n/webcalendar prior to master. |
CVE-2023-0288 | High | 7.8 | 2023-01-13 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. |
CVE-2023-0221 | Medium | 4.4 | 2023-01-13 | Product security bypass vulnerability in ACC prior to version 8.3.4 allows a locally logged-in attacker with administrator privileges to bypass the execution c… |
CVE-2023-22493 | High | 8.8 | 2023-01-13 | RSSHub is an open source RSS feed generator. RSSHub is vulnerable to Server-Side Request Forgery (SSRF) attacks. This vulnerability allows an attacker to send… |
CVE-2023-0287 | Low | 3.5 | 2023-01-13 | A vulnerability was found in ityouknow favorites-web. It has been rated as problematic. Affected by this issue is some unknown functionality of the component C… |
CVE-2023-0283 | Medium | 6.3 | 2023-01-13 | A vulnerability classified as critical has been found in SourceCodester Online Flight Booking Management System. This affects an unknown part of the file revie… |
CVE-2023-0281 | Medium | 6.3 | 2023-01-13 | A vulnerability was found in SourceCodester Online Flight Booking Management System. It has been rated as critical. Affected by this issue is some unknown func… |
CVE-2023-0105 | Medium | 6.5 | 2023-01-13 | A flaw was found in Keycloak. This flaw allows impersonation and lockout due to the email trust not being handled correctly in Keycloak. An attacker can shadow… |
CVE-2023-0091 | Low | 3.8 | 2023-01-13 | A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. This flaw allows an attacker… |
CVE-2023-23566 | Critical | 9.8 | 2023-01-13 | A 2-Step Verification problem in Axigen 10.3.3.52 allows an attacker to access a mailbox by bypassing 2-Step Verification when they try to add an account to an… |
CVE-2023-23559 | High | 7.8 | 2023-01-13 | In rndis_query_oid in drivers/net/wireless/rndis_wlan.c in the Linux kernel through 6.1.5, there is an integer overflow in an addition. |
CVE-2023-22417 | High | 7.5 | 2023-01-13 | A Missing Release of Memory after Effective Lifetime vulnerability in the Flow Processing Daemon (flowd) of Juniper Networks Junos OS allows a network-based, u… |
CVE-2023-22416 | High | 7.5 | 2023-01-13 | A Buffer Overflow vulnerability in SIP ALG of Juniper Networks Junos OS allows a network-based, unauthenticated attacker to cause a Denial of Service (DoS). On… |
CVE-2023-22415 | High | 7.5 | 2023-01-13 | An Out-of-Bounds Write vulnerability in the H.323 ALG of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause Denial of Service… |
CVE-2023-22414 | Medium | 6.5 | 2023-01-13 | A Missing Release of Memory after Effective Lifetime vulnerability in Flexible PIC Concentrator (FPC) of Juniper Networks Junos OS allows an adjacent, unauthen… |
CVE-2023-22413 | High | 7.5 | 2023-01-13 | An Improper Check or Handling of Exceptional Conditions vulnerability in the IPsec library of Juniper Networks Junos OS allows a network-based, unauthenticated… |
CVE-2023-22412 | High | 7.5 | 2023-01-13 | An Improper Locking vulnerability in the SIP ALG of Juniper Networks Junos OS on MX Series with MS-MPC or MS-MIC card and SRX Series allows an unauthenticated… |
CVE-2023-22411 | High | 7.5 | 2023-01-13 | An Out-of-Bounds Write vulnerability in Flow Processing Daemon (flowd) of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause… |
CVE-2023-22410 | High | 7.5 | 2023-01-13 | A Missing Release of Memory after Effective Lifetime vulnerability in the Juniper Networks Junos OS on MX Series platforms with MPC10/MPC11 line cards, allows… |
CVE-2023-22409 | Medium | 5.5 | 2023-01-13 | An Unchecked Input for Loop Condition vulnerability in a NAT library of Juniper Networks Junos OS allows a local authenticated attacker with low privileges to… |
CVE-2023-22408 | High | 7.5 | 2023-01-13 | An Improper Validation of Array Index vulnerability in the SIP ALG of Juniper Networks Junos OS on SRX 5000 Series allows a network-based, unauthenticated atta… |
CVE-2023-22407 | Medium | 6.5 | 2023-01-13 | An Incomplete Cleanup vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated… |
CVE-2023-22406 | Medium | 6.5 | 2023-01-13 | A Missing Release of Memory after Effective Lifetime vulnerability in the kernel of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthen… |
CVE-2023-22405 | Medium | 6.5 | 2023-01-13 | An Improper Preservation of Consistency Between Independent Representations of Shared State vulnerability in the Packet Forwarding Engine (PFE) of Juniper Netw… |
CVE-2023-22404 | Medium | 6.5 | 2023-01-13 | An Out-of-bounds Write vulnerability in the Internet Key Exchange Protocol daemon (iked) of Juniper Networks Junos OS on SRX series and MX with SPC3 allows an… |
CVE-2023-22403 | High | 7.5 | 2023-01-13 | An Allocation of Resources Without Limits or Throttling vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows a network-base… |
CVE-2023-22402 | Medium | 5.9 | 2023-01-13 | A Use After Free vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Servic… |
CVE-2023-22401 | High | 7.5 | 2023-01-13 | An Improper Validation of Array Index vulnerability in the Advanced Forwarding Toolkit Manager daemon (aftmand) of Juniper Networks Junos OS and Junos OS Evolv… |
CVE-2023-22400 | High | 7.5 | 2023-01-13 | An Uncontrolled Resource Consumption vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos OS Evolved allows an unauthenticated, n… |
CVE-2023-22399 | High | 7.5 | 2023-01-13 | When sFlow is enabled and it monitors a packet forwarded via ECMP, a buffer management vulnerability in the dcpfe process of Juniper Networks Junos OS on QFX10… |
CVE-2023-22398 | Medium | 5.3 | 2023-01-13 | An Access of Uninitialized Pointer vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a locally authen… |
CVE-2023-22397 | Medium | 6.1 | 2023-01-13 | An Allocation of Resources Without Limits or Throttling weakness in the memory management of the Packet Forwarding Engine (PFE) on Juniper Networks Junos OS Ev… |
CVE-2023-22396 | High | 7.5 | 2023-01-13 | An Uncontrolled Resource Consumption vulnerability in TCP processing on the Routing Engine (RE) of Juniper Networks Junos OS allows an unauthenticated network-… |
CVE-2023-22395 | Medium | 6.5 | 2023-01-13 | A Missing Release of Memory after Effective Lifetime vulnerability in the kernel of Juniper Networks Junos OS allows an unauthenticated, adjacent attacker to c… |
CVE-2023-22394 | High | 7.5 | 2023-01-13 | An Improper Handling of Unexpected Data Type vulnerability in the handling of SIP calls in Juniper Networks Junos OS on SRX Series and MX Series platforms allo… |
CVE-2023-22393 | High | 7.5 | 2023-01-13 | An Improper Check for Unusual or Exceptional Conditions vulnerability in BGP route processing of Juniper Networks Junos OS and Junos OS Evolved allows an attac… |
CVE-2023-22391 | High | 7.5 | 2023-01-13 | A vulnerability in class-of-service (CoS) queue management in Juniper Networks Junos OS on the ACX2K Series devices allows an unauthenticated network-based att… |
CVE-2023-22601 | Critical | 10.0 | 2023-01-12 | InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-330: Us… |
CVE-2023-22600 | Critical | 10.0 | 2023-01-12 | InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-284: Im… |
CVE-2023-22599 | High | 7.0 | 2023-01-12 | InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-760: Us… |
CVE-2023-22598 | High | 7.2 | 2023-01-12 | InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-78: Im… |
CVE-2023-22597 | Medium | 6.5 | 2023-01-12 | InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-319: Cl… |
CVE-2023-0258 | Low | 2.4 | 2023-01-12 | A vulnerability was found in SourceCodester Online Food Ordering System 2.0. It has been rated as problematic. Affected by this issue is some unknown functiona… |
CVE-2023-0257 | Medium | 4.7 | 2023-01-12 | A vulnerability was found in SourceCodester Online Food Ordering System 2.0. It has been declared as critical. Affected by this vulnerability is an unknown fun… |
CVE-2023-0256 | Medium | 6.3 | 2023-01-12 | A vulnerability was found in SourceCodester Online Food Ordering System 2.0. It has been classified as critical. Affected is an unknown function of the file /f… |
CVE-2023-22488 | Medium | 6.8 | 2023-01-12 | Flarum is a forum software for building communities. Using the notifications feature, one can read restricted/private content and bypass access checks that wou… |
CVE-2023-23457 | Medium | 5.3 | 2023-01-12 | A Segmentation fault was found in UPX in PackLinuxElf64::invert_pt_dynamic() in p_lx_elf.cpp. An attacker with a crafted input file allows invalid memory addre… |
CVE-2023-23456 | Medium | 5.3 | 2023-01-12 | A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in p_tmt.cpp file. The flow allows an attacker to cause a denial of service (abort)… |
CVE-2023-0254 | High | 7.2 | 2023-01-12 | The Simple Membership WP user Import plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in versions up to, and including, 1.7 due… |
CVE-2023-0247 | High | 7.8 | 2023-01-12 | Uncontrolled Search Path Element in GitHub repository bits-and-blooms/bloom prior to 3.3.1. |
CVE-2023-0246 | Low | 3.5 | 2023-01-12 | A vulnerability, which was classified as problematic, was found in earclink ESPCMS P8.21120101. Affected is an unknown function of the component Content Handle… |