2023 CVEs (page 304)
Page 304 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-21841 | High | 7.5 | 2023-01-18 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1… |
CVE-2023-21840 | Medium | 4.9 | 2023-01-18 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected are 5.7.40 and prior. Easily exploitab… |
CVE-2023-21839 | High | 7.5 | 2023-01-18 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1… |
CVE-2023-21838 | High | 7.5 | 2023-01-18 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1… |
CVE-2023-21837 | High | 7.5 | 2023-01-18 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1… |
CVE-2023-21836 | Medium | 4.9 | 2023-01-18 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.31 and prior. Easily exploita… |
CVE-2023-21835 | Medium | 5.3 | 2023-01-18 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are O… |
CVE-2023-21834 | Medium | 4.3 | 2023-01-18 | Vulnerability in the Oracle Self-Service Human Resources product of Oracle E-Business Suite (component: Workflow, Approval, Work Force Management). Supported… |
CVE-2023-21832 | High | 8.8 | 2023-01-18 | Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Security). Supported versions that are affected are 5.9.0.0.0, 6.4.0… |
CVE-2023-21831 | Medium | 5.3 | 2023-01-18 | Vulnerability in the PeopleSoft Enterprise CS Academic Advisement product of Oracle PeopleSoft (component: Advising Notes). The supported version that is aff… |
CVE-2023-21830 | Medium | 5.3 | 2023-01-18 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization). Supported versions that are affec… |
CVE-2023-21829 | Medium | 6.3 | 2023-01-18 | Vulnerability in the Oracle Database RDBMS Security component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Easily exploit… |
CVE-2023-21828 | High | 8.1 | 2023-01-18 | Vulnerability in the Oracle Hospitality Reporting and Analytics product of Oracle Food and Beverage Applications (component: Reporting). The supported versio… |
CVE-2023-21827 | Medium | 4.3 | 2023-01-18 | Vulnerability in the Oracle Database Data Redaction component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Easily exploit… |
CVE-2023-21826 | High | 7.6 | 2023-01-18 | Vulnerability in the Oracle Hospitality Reporting and Analytics product of Oracle Food and Beverage Applications (component: Reporting). The supported versio… |
CVE-2023-21825 | Medium | 5.3 | 2023-01-18 | Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Supplier Management). Supported versions that are affected are 12… |
CVE-2023-21824 | Medium | 4.4 | 2023-01-18 | Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications Applications (component: Customer, Config, Pricing Ma… |
CVE-2023-22734 | Medium | 4.3 | 2023-01-17 | Shopware is an open source commerce platform based on Symfony Framework and Vue js. The newsletter double opt-in validation was not checked properly, and it wa… |
CVE-2023-22733 | Low | 2.7 | 2023-01-17 | Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions the log module would write out all kind of sent mails… |
CVE-2023-22732 | Low | 3.7 | 2023-01-17 | Shopware is an open source commerce platform based on Symfony Framework and Vue js. The Administration session expiration was set to one week, when an attacker… |
CVE-2023-22731 | Critical | 9.9 | 2023-01-17 | Shopware is an open source commerce platform based on Symfony Framework and Vue js. In a Twig environment **without the Sandbox extension**, it is possible to… |
CVE-2023-22730 | Medium | 5.3 | 2023-01-17 | Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions It was possible to put the same line item multiple tim… |
CVE-2023-23637 | High | 7.6 | 2023-01-17 | IMPatienT before 1.5.2 allows stored XSS via onmouseover in certain text fields within a PATCH /modify_onto request to the ontology builder. This may allow att… |
CVE-2023-22727 | Critical | 9.8 | 2023-01-17 | CakePHP is a development framework for PHP web apps. In affected versions the `Cake\Database\Query::limit()` and `Cake\Database\Query::offset()` methods are vu… |
CVE-2023-22499 | High | 7.5 | 2023-01-17 | Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Multi-threaded programs were able to spoof interactive permission prompt by… |
CVE-2023-0296 | Medium | 5.3 | 2023-01-17 | The Birthday attack against 64-bit block ciphers flaw (CVE-2016-2183) was reported for the health checks port (9979) on etcd grpc-proxy component. Even though… |
CVE-2023-0122 | High | 7.5 | 2023-01-17 | A NULL pointer dereference vulnerability in the Linux kernel NVMe functionality, in nvmet_setup_auth(), allows an attacker to perform a Pre-Auth Denial of Serv… |
CVE-2023-23749 | High | 7.5 | 2023-01-17 | The 'LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login' extension is vulnerable to LDAP Injection since is not properly sanitizing th… |
CVE-2023-22624 | High | 7.5 | 2023-01-17 | Zoho ManageEngine Exchange Reporter Plus before 5708 allows attackers to conduct XXE attacks. |
CVE-2023-22875 | High | 8.4 | 2023-01-17 | IBM QRadar SIEM 7.4 and 7.5copies certificate key files used for SSL/TLS in the QRadar web user interface to managed hosts in the deployment that do not requi… |
CVE-2023-0158 | High | 7.5 | 2023-01-17 | NLnet Labs Krill supports direct access to the RRDP repository content through its built-in web server at the "/rrdp" endpoint. Prior to 0.12.1 a direct query… |
CVE-2023-0338 | Medium | 6.1 | 2023-01-17 | Cross-site Scripting (XSS) - Reflected in GitHub repository lirantal/daloradius prior to master-branch. |
CVE-2023-0337 | Medium | 6.1 | 2023-01-17 | Cross-site Scripting (XSS) - Reflected in GitHub repository lirantal/daloradius prior to master-branch. |
CVE-2023-22366 | High | 7.8 | 2023-01-17 | CX-Motion-MCH v2.32 and earlier contains an access of uninitialized pointer vulnerability. Having a user to open a specially crafted project file may lead to i… |
CVE-2023-22357 | Critical | 9.8 | 2023-01-17 | Active debug code exists in OMRON CP1L-EL20DR-D all versions, which may lead to a command that is not specified in FINS protocol being executed without authent… |
CVE-2023-22316 | Medium | 6.5 | 2023-01-17 | Hidden functionality vulnerability in PIX-RT100 versions RT100_TEQ_2.1.1_EQ101 and RT100_TEQ_2.1.2_EQ101 allows a network-adjacent attacker to access the produ… |
CVE-2023-22304 | High | 8.0 | 2023-01-17 | OS command injection vulnerability in PIX-RT100 versions RT100_TEQ_2.1.1_EQ101 and RT100_TEQ_2.1.2_EQ101 allows a network-adjacent attacker who can access prod… |
CVE-2023-22303 | Critical | 9.8 | 2023-01-17 | TP-Link SG105PE firmware prior to 'TL-SG105PE(UN) 1.0_1.0.0 Build 20221208' contains an authentication bypass vulnerability. Under the certain conditions, an a… |
CVE-2023-22298 | Medium | 6.1 | 2023-01-17 | Open redirect vulnerability in pgAdmin 4 versions prior to v6.14 allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and condu… |
CVE-2023-22296 | Medium | 6.1 | 2023-01-17 | Reflected cross-site scripting vulnerability in MAHO-PBX NetDevancer series MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer… |
CVE-2023-22286 | High | 8.1 | 2023-01-17 | Cross-site request forgery (CSRF) vulnerability in MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver… |
CVE-2023-22280 | High | 7.2 | 2023-01-17 | MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver.1.11.00, and MAHO-PBX NetDevancer MobileGate Home/… |
CVE-2023-22279 | Critical | 9.8 | 2023-01-17 | MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver.1.11.00, and MAHO-PBX NetDevancer MobileGate Home/… |
CVE-2023-22278 | Medium | 5.3 | 2023-01-17 | m-FILTER prior to Ver.5.70R01 (Ver.5 Series) and m-FILTER prior to Ver.4.87R04 (Ver.4 Series) allows a remote unauthenticated attacker to bypass authentication… |
CVE-2023-0332 | High | 7.3 | 2023-01-17 | A vulnerability was found in SourceCodester Online Food Ordering System 2.0. It has been classified as critical. Affected is an unknown function of the file ad… |
CVE-2023-0327 | Low | 3.5 | 2023-01-16 | A vulnerability was found in saemorris TheRadSystem. It has been classified as problematic. Affected is an unknown function of the file users.php. The manipula… |
CVE-2023-0324 | High | 7.3 | 2023-01-16 | A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0 and classified as critical. Affected by this issue is some unknown fun… |
CVE-2023-0323 | Medium | 5.4 | 2023-01-16 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.14. |
CVE-2023-0316 | Medium | 5.5 | 2023-01-16 | Path Traversal: '\..\filename' in GitHub repository froxlor/froxlor prior to 2.0.0. |
CVE-2023-0315 | High | 8.8 | 2023-01-16 | Command Injection in GitHub repository froxlor/froxlor prior to 2.0.8. |
CVE-2023-0314 | Medium | 6.1 | 2023-01-15 | Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2023-0313 | Medium | 5.4 | 2023-01-15 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2023-0312 | Medium | 6.1 | 2023-01-15 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2023-0311 | Critical | 9.8 | 2023-01-15 | Improper Authentication in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2023-0310 | Medium | 5.4 | 2023-01-15 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2023-0309 | Medium | 5.4 | 2023-01-15 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2023-0308 | Medium | 5.4 | 2023-01-15 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2023-0307 | Critical | 9.8 | 2023-01-15 | Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2023-0306 | Medium | 5.4 | 2023-01-15 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2023-0305 | Medium | 6.3 | 2023-01-15 | A vulnerability classified as critical was found in SourceCodester Online Food Ordering System. This vulnerability affects unknown code of the file admin_class… |
CVE-2023-0304 | Medium | 6.3 | 2023-01-15 | A vulnerability classified as critical has been found in SourceCodester Online Food Ordering System. This affects an unknown part of the file admin_class.php o… |
CVE-2023-0303 | Medium | 6.3 | 2023-01-15 | A vulnerability was found in SourceCodester Online Food Ordering System. It has been rated as critical. Affected by this issue is some unknown functionality of… |
CVE-2023-23595 | High | 7.5 | 2023-01-15 | BlueCat Device Registration Portal 2.2 allows XXE attacks that exfiltrate single-line files. A single-line file might contain credentials, such as "machine exa… |
CVE-2023-23590 | High | 7.5 | 2023-01-15 | Mercedes-Benz XENTRY Retail Data Storage 7.8.1 allows remote attackers to cause a denial of service (device restart) via an unauthenticated API request. The at… |
CVE-2023-0302 | High | 7.8 | 2023-01-15 | Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository radareorg/radare2 prior to 5.8.2. |
CVE-2023-0301 | Medium | 5.4 | 2023-01-14 | Cross-site Scripting (XSS) - Stored in GitHub repository alfio-event/alf.io prior to Alf.io 2.0-M4-2301. |
CVE-2023-0300 | Medium | 5.4 | 2023-01-14 | Cross-site Scripting (XSS) - Reflected in GitHub repository alfio-event/alf.io prior to 2.0-M4-2301. |
CVE-2023-0299 | Critical | 9.8 | 2023-01-14 | Improper Input Validation in GitHub repository publify/publify prior to 9.2.10. |
CVE-2023-22602 | High | 7.5 | 2023-01-14 | When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication… |
CVE-2023-0298 | Medium | 6.5 | 2023-01-14 | Incorrect Authorization in GitHub repository firefly-iii/firefly-iii prior to 5.8.0. |
CVE-2023-0297 | Critical | 9.8 | 2023-01-14 | Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31. |
CVE-2023-22851 | High | 7.2 | 2023-01-14 | Tiki before 24.2 allows lib/importer/tikiimporter_blog_wordpress.php PHP Object Injection by an admin because of an unserialize call. |
CVE-2023-22850 | High | 8.8 | 2023-01-14 | Tiki before 24.1, when the Spreadsheets feature is enabled, allows lib/sheet/grid.php PHP Object Injection because of an unserialize call. |
CVE-2023-22497 | Medium | 6.5 | 2023-01-14 | Netdata is an open source option for real-time infrastructure monitoring and troubleshooting. Each Netdata Agent has an automatically generated MACHINE GUID. I… |
CVE-2023-23589 | Medium | 6.5 | 2023-01-14 | The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not the safe SOCKS4a protocol, aka TROVE-2022… |
CVE-2023-22853 | High | 8.8 | 2023-01-14 | Tiki before 24.1, when feature_create_webhelp is enabled, allows lib/structures/structlib.php PHP Object Injection because of an eval. |
CVE-2023-22852 | Medium | 6.5 | 2023-01-14 | Tiki through 25.0 allows CSRF attacks that are related to tiki-importer.php and tiki-import_sheet.php. |
CVE-2023-22496 | High | 8.1 | 2023-01-14 | Netdata is an open source option for real-time infrastructure monitoring and troubleshooting. An attacker with the ability to establish a streaming connection… |
CVE-2023-22495 | Critical | 9.8 | 2023-01-14 | Izanami is a shared configuration service well-suited for micro-service architecture implementation. Attackers can bypass the authentication in this applicatio… |
CVE-2023-22480 | High | 7.3 | 2023-01-14 | KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters. In KubeOperator v… |
CVE-2023-22478 | High | 7.3 | 2023-01-14 | KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1… |
CVE-2023-22471 | Low | 3.5 | 2023-01-14 | Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Broken access control allows… |
CVE-2023-22470 | Low | 3.5 | 2023-01-14 | Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. A database error ca… |
CVE-2023-21599 | Medium | 5.5 | 2023-01-13 | Adobe InCopy versions 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive mem… |
CVE-2023-21598 | Medium | 5.5 | 2023-01-13 | Adobe InCopy versions 18.0 (and earlier), 17.4 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory… |
CVE-2023-21597 | High | 7.8 | 2023-01-13 | Adobe InCopy versions 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution… |
CVE-2023-21596 | High | 7.8 | 2023-01-13 | Adobe InCopy versions 18.0 (and earlier), 17.4 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code exe… |
CVE-2023-21595 | High | 7.8 | 2023-01-13 | Adobe InCopy versions 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution… |
CVE-2023-21594 | High | 7.8 | 2023-01-13 | Adobe InCopy versions 18.0 (and earlier), 17.4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code exe… |
CVE-2023-21592 | Medium | 5.5 | 2023-01-13 | Adobe InDesign version 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive me… |
CVE-2023-21591 | Medium | 5.5 | 2023-01-13 | Adobe InDesign version 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive me… |
CVE-2023-21590 | High | 7.8 | 2023-01-13 | Adobe InDesign version 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code executio… |
CVE-2023-21589 | High | 7.8 | 2023-01-13 | Adobe InDesign version 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code executio… |
CVE-2023-21588 | High | 7.8 | 2023-01-13 | Adobe InDesign version 18.0 (and earlier), 17.4 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code ex… |
CVE-2023-21587 | High | 7.8 | 2023-01-13 | Adobe InDesign version 18.0 (and earlier), 17.4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code ex… |
CVE-2023-0295 | Medium | 5.5 | 2023-01-13 | The Launchpad plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of its settings parameters in versions up to, and including, 1.0.13… |
CVE-2023-0294 | High | 8.8 | 2023-01-13 | The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.1. This is due to… |
CVE-2023-0293 | Medium | 4.3 | 2023-01-13 | The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in vers… |
CVE-2023-22491 | High | 8.1 | 2023-01-13 | Gatsby is a free and open source framework based on React that helps developers build websites and apps. The gatsby-transformer-remark plugin prior to versions… |
CVE-2023-22489 | Low | 3.5 | 2023-01-13 | Flarum is a discussion platform for websites. If the first post of a discussion is permanently deleted but the discussion stays visible, any actor who can view… |