2023 CVEs (page 307)
Page 307 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-0014 | Critical | 9.0 | 2023-01-10 | SAP NetWeaver ABAP Server and ABAP Platform - versions SAP_BASIS 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, KERNEL 7.22, 7… |
CVE-2023-0013 | Medium | 6.1 | 2023-01-10 | The ABAP Keyword Documentation of SAP NetWeaver Application Server - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, for ABAP and ABAP Platform… |
CVE-2023-0012 | Medium | 6.4 | 2023-01-10 | In SAP Host Agent (Windows) - versions 7.21, 7.22, an attacker who gains local membership to SAP_LocalAdmin could be able to replace executables with a malicio… |
CVE-2023-22899 | Medium | 5.9 | 2023-01-10 | Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive. |
CVE-2023-22898 | Medium | 6.5 | 2023-01-10 | workers/extractor.py in Pandora (aka pandora-analysis/pandora) 1.3.0 allows a denial of service when an attacker submits a deeply nested ZIP archive (aka ZIP b… |
CVE-2023-22895 | High | 7.5 | 2023-01-10 | The bzip2 crate before 0.4.4 for Rust allow attackers to cause a denial of service via a large file that triggers an integer overflow in mem.rs. NOTE: this is… |
CVE-2023-0125 | Low | 2.4 | 2023-01-09 | A vulnerability was found in Control iD Gerencia Web 1.30. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of t… |
CVE-2023-22477 | Medium | 5.3 | 2023-01-09 | Mercurius is a GraphQL adapter for Fastify. Any users of Mercurius until version 10.5.0 are subjected to a denial of service attack by sending a malformed pack… |
CVE-2023-22473 | Low | 2.1 | 2023-01-09 | Talk-Android enables users to have video & audio calls through Nextcloud on Android. Due to passcode bypass, an attacker is able to access the user's Nextcloud… |
CVE-2023-22472 | Medium | 5.3 | 2023-01-09 | Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. It is possible to make a user… |
CVE-2023-0036 | Medium | 6.5 | 2023-01-09 | platform_callback_stub in misc subsystem within OpenHarmony-v3.0.5 and prior versions has an authentication bypass vulnerability which allows an "SA relay atta… |
CVE-2023-0035 | Medium | 6.5 | 2023-01-09 | softbus_client_stub in communication subsystem within OpenHarmony-v3.0.5 and prior versions has an authentication bypass vulnerability which allows an "SA rela… |
CVE-2023-0114 | Low | 3.3 | 2023-01-07 | A vulnerability was found in Netis Netcore Router. It has been rated as problematic. Affected by this issue is some unknown functionality of the file param.fil… |
CVE-2023-0113 | Medium | 5.3 | 2023-01-07 | A vulnerability was found in Netis Netcore Router up to 2.2.6. It has been declared as problematic. Affected by this vulnerability is an unknown functionality… |
CVE-2023-0112 | Medium | 5.4 | 2023-01-07 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0. |
CVE-2023-0111 | Medium | 5.4 | 2023-01-07 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0. |
CVE-2023-0110 | Medium | 5.4 | 2023-01-07 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0. |
CVE-2023-0108 | Medium | 5.4 | 2023-01-07 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0. |
CVE-2023-0107 | Medium | 5.4 | 2023-01-07 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0. |
CVE-2023-0106 | Medium | 5.4 | 2023-01-07 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0. |
CVE-2023-22475 | Medium | 6.3 | 2023-01-06 | Canarytokens is an open source tool which helps track activity and actions on your network. A Cross-Site Scripting vulnerability was identified in the history… |
CVE-2023-22671 | Critical | 9.8 | 2023-01-06 | Ghidra/RuntimeScripts/Linux/support/launch.sh in NSA Ghidra through 10.2.2 passes user-provided input into eval, leading to command injection when calling anal… |
CVE-2023-22455 | Medium | 6.8 | 2023-01-05 | Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` bra… |
CVE-2023-22454 | High | 8.0 | 2023-01-05 | Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` bra… |
CVE-2023-22453 | Medium | 5.3 | 2023-01-05 | Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` bra… |
CVE-2023-0088 | High | 8.8 | 2023-01-05 | The Swifty Page Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.1. This is due to missing or inc… |
CVE-2023-0087 | Medium | 5.5 | 2023-01-05 | The Swifty Page Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘spm_plugin_options_page_tree_max_width’ parameter in version… |
CVE-2023-0086 | Medium | 5.4 | 2023-01-05 | The JetWidgets for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.12. This is due to missing… |
CVE-2023-0077 | Medium | 6.5 | 2023-01-05 | Integer overflow or wraparound vulnerability in CGI component in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows remote attackers to… |
CVE-2023-22626 | High | 7.5 | 2023-01-05 | PgHero before 3.1.0 allows Information Disclosure via EXPLAIN because query results may be present in an error message. (Depending on database user privileges… |
CVE-2023-22622 | Medium | 5.3 | 2023-01-05 | WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes… |
CVE-2023-0057 | Medium | 6.1 | 2023-01-05 | Improper Restriction of Rendered UI Layers or Frames in GitHub repository pyload/pyload prior to 0.5.0b3.dev33. |
CVE-2023-22467 | High | 7.5 | 2023-01-04 | Luxon is a library for working with dates and times in JavaScript. On the 1.x branch prior to 1.38.1, the 2.x branch prior to 2.5.2, and the 3.x branch on 3.2… |
CVE-2023-22466 | Medium | 5.4 | 2023-01-04 | Tokio is a runtime for writing applications with Rust. Starting with version 1.7.0 and prior to versions 1.18.4, 1.20.3, and 1.23.1, when configuring a Windows… |
CVE-2023-0055 | Medium | 5.3 | 2023-01-04 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository pyload/pyload prior to 0.5.0b3.dev32. |
CVE-2023-0054 | High | 7.8 | 2023-01-04 | Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145. |
CVE-2023-0051 | High | 7.8 | 2023-01-04 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. |
CVE-2023-22465 | High | 7.5 | 2023-01-04 | Http4s is a Scala interface for HTTP services. Starting with version 0.1.0 and prior to versions 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38, the `User-Agent` and… |
CVE-2023-22464 | Medium | 5.4 | 2023-01-04 | ViewVC is a browser interface for CVS and Subversion version control repositories. Versions prior to 1.2.3 and 1.1.30 are vulnerable to cross-site scripting. T… |
CVE-2023-22463 | Critical | 9.8 | 2023-01-04 | KubePi is a k8s panel. The jwt authentication function of KubePi through version 1.6.2 uses hard-coded Jwtsigkeys, resulting in the same Jwtsigkeys for all onl… |
CVE-2023-0049 | High | 7.8 | 2023-01-04 | Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. |
CVE-2023-22461 | High | 7.6 | 2023-01-04 | The `sanitize-svg` package, a small SVG sanitizer to prevent cross-site scripting attacks, uses a deny-list-pattern to sanitize SVGs to prevent XSS. In doing s… |
CVE-2023-22460 | High | 7.5 | 2023-01-04 | go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JS… |
CVE-2023-22457 | Critical | 9.0 | 2023-01-04 | CKEditor Integration UI adds support for editing wiki pages using CKEditor. Prior to versions 1.64.3,t he `CKEditor.HTMLConverter` document lacked a protection… |
CVE-2023-0048 | High | 8.8 | 2023-01-04 | Code Injection in GitHub repository lirantal/daloradius prior to master-branch. |
CVE-2023-0046 | High | 7.2 | 2023-01-04 | Improper Restriction of Names for Files and Other Resources in GitHub repository lirantal/daloradius prior to master-branch. |
CVE-2023-22456 | Medium | 6.1 | 2023-01-03 | ViewVC, a browser interface for CVS and Subversion version control repositories, as a cross-site scripting vulnerability that affects versions prior to 1.2.2 a… |
CVE-2023-0038 | High | 7.2 | 2023-01-03 | The "Survey Maker – Best WordPress Survey Plugin" plugin for WordPress is vulnerable to Stored Cross-Site Scripting via survey answers in versions up to, and i… |
CVE-2023-22452 | Medium | 6.5 | 2023-01-02 | kenny2automate is a Discord bot. In the web interface for server settings, form elements were generated with Discord channel IDs as part of input names. Prior… |
CVE-2023-22451 | Medium | 6.5 | 2023-01-02 | Kiwi TCMS is an open source test management system. In version 11.6 and prior, when users register new accounts and/or change passwords, there is no validation… |
CVE-2023-22551 | High | 7.5 | 2023-01-01 | The FTP (aka "Implementation of a simple FTP client and server") project through 96c1a35 allows remote attackers to cause a denial of service (memory consumpti… |
CVE-2023-0029 | Medium | 5.3 | 2023-01-01 | A vulnerability was found in Multilaser RE708 RE1200R4GC-2T2R-V3_v3411b_MUL029B. It has been rated as problematic. This issue affects some unknown processing o… |
CVE-2023-0028 | Medium | 5.7 | 2023-01-01 | Cross-site Scripting (XSS) - Stored in GitHub repository linagora/twake prior to 2023.Q1.1200+. |