2023 CVEs (page 44)

Page 44 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.

All CVEs published in 2023 — newest first (page 44 of 307)
CVESeverityScorePublishedSummary
CVE-2023-47504Medium6.52024-04-24Improper Authentication vulnerability in Elementor Elementor Website Builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects…
CVE-2023-32127Medium5.32024-04-24Missing Authorization vulnerability in Daniel Powney Multi Rating allows Functionality Misuse.This issue affects Multi Rating: from n/a through 5.0.6.
CVE-2023-31090Critical9.92024-04-24Unrestricted Upload of File with Dangerous Type vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows U…
CVE-2023-25790Medium5.32024-04-24Improper Authentication, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xtemos WoodMart allows Cross-Sit…
CVE-2023-25785Medium5.32024-04-24Missing Authorization vulnerability in Shoaib Saleem WP Post Rating allows Functionality Misuse.This issue affects WP Post Rating: from n/a through 2.5.
CVE-2023-23989Medium5.32024-04-24Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss RegistrationMagic.This issue affects Registrati…
CVE-2023-23985Low3.72024-04-24Missing Authorization vulnerability in Quiz Maker team Quiz Maker.This issue affects Quiz Maker: from n/a through 6.3.9.4.
CVE-2023-23976High7.52024-04-24Incorrect Default Permissions vulnerability in Metagauss RegistrationMagic allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects R…
CVE-2023-7253Medium6.12024-04-24The Import WP WordPress plugin before 2.13.1 does not prevent users with the administrator role from pinging conducting SSRF attacks, which may be a problem i…
CVE-2023-47731Medium5.42024-04-23IBM QRadar Suite Software 1.10.12.0 through 1.10.19.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 is vulnerable to stored cross-site scripting. T…
CVE-2023-48184Low3.92024-04-23QuickJS before 7414e5f has a quickjs.h JS_FreeValueRT use-after-free because of incorrect garbage collection of async functions with closures.
CVE-2023-48183High7.52024-04-23QuickJS before c4cdd61 has a build_for_in_iterator NULL pointer dereference because of an erroneous lexical scope of "this" with eval.
CVE-2023-6833Medium4.42024-04-23Insertion of Sensitive Information into Log File vulnerability in Hitachi Ops Center Administrator allows local users to gain sensitive information.This issue…
CVE-2023-38302Medium4.32024-04-22A certain software build for the Sharp Rouvo V device (SHARP/VZW_STTM21VAPP/STTM21VAPP:12/SP1A.210812.016/1KN0_0_530:user/release-keys) leaks the Wi-Fi MAC add…
CVE-2023-38301Low3.42024-04-22An issue was discovered in a third-party component related to vendor.gsm.serial, shipped on devices from multiple device manufacturers. Various software builds…
CVE-2023-38300Medium6.22024-04-22A certain software build for the Orbic Maui device (Orbic/RC545L/RC545L:10/ORB545L_V1.4.2_BVZPP/230106:user/release-keys) leaks the IMEI and the ICCID to syste…
CVE-2023-38299Medium5.52024-04-22Various software builds for the AT&T Calypso, Nokia C100, Nokia C200, and BLU View 3 devices leak the device IMEI to a system property that can be accessed by…
CVE-2023-38298High8.82024-04-22Various software builds for the following TCL devices (30Z, A3X, 20XE, 10L) leak the device IMEI to a system property that can be accessed by any local app on…
CVE-2023-38297High8.42024-04-22An issue was discovered in a third-party com.factory.mmigroup component, shipped on devices from multiple device manufacturers. Certain software builds for var…
CVE-2023-38296High8.02024-04-22Various software builds for the following TCL 30Z and TCL A3X devices leak the ICCID to a system property that can be accessed by any local app on the device w…
CVE-2023-38295High7.82024-04-22Certain software builds for the TCL 30Z and TCL 10 Android devices contain a vulnerable, pre-installed app that relies on a missing permission that provides no…
CVE-2023-38294Medium6.12024-04-22Certain software builds for the Itel Vision 3 Turbo Android device contain a vulnerable pre-installed app with a package name of com.transsion.autotest.factory…
CVE-2023-38293High7.32024-04-22Certain software builds for the Nokia C200 and Nokia C100 Android devices contain a vulnerable, pre-installed app with a package name of com.tracfone.tfstatus…
CVE-2023-38292High8.72024-04-22Certain software builds for the TCL 20XE Android device contain a vulnerable, pre-installed app with a package name of com.tct.gcs.hiddenmenuproxy (versionCode…
CVE-2023-38291High7.12024-04-22An issue was discovered in a third-party component related to ro.boot.wifimacaddr, shipped on devices from multiple device manufacturers. Various software buil…
CVE-2023-38290High7.82024-04-22Certain software builds for the BLU View 2 and Sharp Rouvo V Android devices contain a vulnerable pre-installed app with a package name of com.evenwell.fqc (ve…
CVE-2023-7252Medium5.32024-04-22The Tickera WordPress plugin before 3.5.2.5 does not prevent users from leaking other users' tickets.
CVE-2023-47435Critical9.82024-04-19An issue in the verifyPassword function of hexo-theme-matery v2.0.0 allows attackers to bypass authentication and access password protected pages.
CVE-2023-51798High7.82024-04-19Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via a floating point exception (FPE) error at l…
CVE-2023-51797Medium6.72024-04-19Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/avf_showwaves.c:722:24 in s…
CVE-2023-51796Low3.62024-04-19Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/f_reverse.c:269:26 in areve…
CVE-2023-51795High8.02024-04-19Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/avf_showspectrum.c:1789:52…
CVE-2023-51793High7.82024-04-19Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavutil/imgutils.c:353:9 in image_cop…
CVE-2023-51792Low3.32024-04-19Buffer Overflow vulnerability in libde265 v1.0.12 allows a local attacker to cause a denial of service via the allocation size exceeding the maximum supported…
CVE-2023-51791High7.82024-04-19Buffer Overflow vulenrability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavcodec/jpegxl_parser.c in gen_alias…
CVE-2023-50010High7.82024-04-19FFmpeg v.n6.1-3-g466799d4f5 allows a buffer over-read at ff_gradfun_blur_line_movdqa_sse2, as demonstrated by a call to the set_encoder_id function in /fftools…
CVE-2023-50009High8.02024-04-19FFmpeg v.n6.1-3-g466799d4f5 allows a heap-based buffer overflow via the ff_gaussian_blur_8 function in libavfilter/edge_template.c:116:5 component.
CVE-2023-50008High7.82024-04-19FFmpeg v.n6.1-3-g466799d4f5 allows memory consumption when using the colorcorrect filter, in the av_malloc function in libavutil/mem.c:105:9 component.
CVE-2023-50007Medium4.02024-04-19FFmpeg v.n6.1-3-g466799d4f5 allows an attacker to trigger use of a parameter of negative size in the av_samples_set_silence function in thelibavutil/samplefmt…
CVE-2023-49963High8.82024-04-19DYMO LabelWriter Print Server through 2.366 contains a backdoor hard-coded password that could allow an attacker to take control.
CVE-2023-49502High8.82024-04-19Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the ff_bwdif_filter_intra_c function in the…
CVE-2023-49501High8.02024-04-19Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfi…
CVE-2023-37397Low3.62024-04-19IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain or modify sensitive information due to improper encryption of certain data. IBM X-For…
CVE-2023-27279Medium6.52024-04-19IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a user to cause a denial of service due to missing API rate limiting. IBM X-Force ID: 248533.
CVE-2023-37396Low2.52024-04-19IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain sensitive information due to improper encryption of certain data. IBM X-Force ID: 25…
CVE-2023-22869Medium5.52024-04-19IBM Aspera Faspex 5.0.0 through 5.0.7 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 244119.
CVE-2023-50260High8.82024-04-19Wazuh is a free and open source platform used for threat prevention, detection, and response. A wrong validation in the `host_deny` script allows to write any…
CVE-2023-49275Medium6.52024-04-19Wazuh is a free and open source platform used for threat prevention, detection, and response. A NULL pointer dereference was detected during fuzzing of the ana…
CVE-2023-37400High7.82024-04-19IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to escalate their privileges due to insecure credential storage. IBM X-Force ID: 259677.
CVE-2023-3758High7.12024-04-18A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issue…
CVE-2023-6897Medium4.32024-04-18The EAN for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.9.2 via the the 'alg_wc_…
CVE-2023-6892Medium6.42024-04-18The EAN for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'alg_wc_ean_product_meta' shortcode in all versions…
CVE-2023-50885Medium6.82024-04-18Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AGILELOGIX Store Locator WordPress.This issue affects Store Loc…
CVE-2023-49768Medium6.52024-04-18Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FormAssembly / Drew Buschhorn WP-FormAssembly allows Stor…
CVE-2023-47843High7.62024-04-18Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Zachary Segal CataBlog.This issue affects CataBlog: from n/a th…
CVE-2023-3675Medium6.52024-04-18Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Secomea GateManager (Web GUI) allows Reading Data from System R…
CVE-2023-41864Medium4.32024-04-18Cross-Site Request Forgery (CSRF) vulnerability in Pepro Dev. Group PeproDev CF7 Database.This issue affects PeproDev CF7 Database: from n/a through 1.8.0.
CVE-2023-49742Critical9.92024-04-18Missing Authorization vulnerability in Support Genix.This issue affects Support Genix: from n/a through 1.2.3.
CVE-2023-4509Medium4.32024-04-18It is possible for an API key to be logged in clear text in the audit log file after an invalid login attempt.
CVE-2023-4235High8.12024-04-17A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_deliver_report() function during the SMS deco…
CVE-2023-4234High8.12024-04-17A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_submit_report() function during the SMS decod…
CVE-2023-4233High8.12024-04-17A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the sms_decode_address_field() function during the SMS P…
CVE-2023-4232High8.12024-04-17A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_status_report() function during the SMS decod…
CVE-2023-5407Medium5.92024-04-17Controller denial of service due to improper handling of a specially crafted message received by the controller. See Honeywell Security Notification for recom…
CVE-2023-5406Medium5.92024-04-17Server communication with a controller can lead to remote code execution using a specially crafted message from the controller. See Honeywell Security Notifica…
CVE-2023-5405Medium5.92024-04-17Server information leak for the CDA Server process memory can occur when an error is generated in response to a specially crafted message. See Honeywell Securi…
CVE-2023-5404High8.12024-04-17Server receiving a malformed message can cause a pointer to be overwritten which can result in a remote code execution or failure. See Honeywell Security Notif…
CVE-2023-5403High8.12024-04-17Server hostname translation to IP address manipulation which could lead to an attacker performing remote code execution or causing a failure. See Honeywell Se…
CVE-2023-5401High8.12024-04-17Server receiving a malformed message based on a using the specified key values can cause a stack overflow vulnerability which could lead to an attacker perform…
CVE-2023-5400High8.12024-04-17Server receiving a malformed message based on a using the specified key values can cause a heap overflow vulnerability which could lead to an attacker performi…
CVE-2023-5398Medium5.92024-04-17Server receiving a malformed message based on a list of IPs resulting in heap corruption causing a denial of service. See Honeywell Security Notification for r…
CVE-2023-5397High8.12024-04-17Server receiving a malformed message to create a new connection could lead to an attacker performing remote code execution or causing a failure. See Honeywell…
CVE-2023-5396High7.42024-04-17Server receiving a malformed message creates connection for a hostname that may cause a stack overflow resulting in possible remote code execution. See Honeywe…
CVE-2023-5395High8.12024-04-17Server receiving a malformed message that uses the hostname in an internal table may cause a stack overflow resulting in possible remote code execution. See Ho…
CVE-2023-52645Medium4.72024-04-17In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix race conditions with genpd If the power domains are registered fi…
CVE-2023-46060High7.52024-04-17A Buffer Overflow vulnerability in Tenda AC500 v.2.0.1.9 allows a remote attacker to cause a denial of service via the port parameter at the goform/setVlanInfo…
CVE-2023-6805Medium6.42024-04-17The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind Server-Side Reques…
CVE-2023-45744High8.32024-04-17A data integrity vulnerability exists in the web interface /cgi-bin/upload_config.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially craft…
CVE-2023-45209Medium5.32024-04-17An information disclosure vulnerability exists in the web interface /cgi-bin/download_config.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU). A spec…
CVE-2023-43491Medium5.32024-04-17An information disclosure vulnerability exists in the web interface /cgi-bin/debug_dump.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially…
CVE-2023-40146Medium6.82024-04-17A privilege escalation vulnerability exists in the /bin/login functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted command line argument…
CVE-2023-39367Critical9.12024-04-17An OS command injection vulnerability exists in the web interface mac2name functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted HTTP req…
CVE-2023-52644Medium6.32024-04-17In the Linux kernel, the following vulnerability has been resolved: wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled When QoS is disabl…
CVE-2023-51500High7.72024-04-17Missing Authorization vulnerability in Undsgn Uncode Core.This issue affects Uncode Core: from n/a through 2.8.8.
CVE-2023-51418High7.72024-04-17Missing Authorization vulnerability in Joris van Montfort JVM rich text icons.This issue affects JVM rich text icons: from n/a through 1.2.6.
CVE-2023-52643Medium5.52024-04-17In the Linux kernel, the following vulnerability has been resolved: iio: core: fix memleak in iio_device_register_sysfs When iio_device_register_sysfs_group(…
CVE-2023-52642High7.82024-04-17In the Linux kernel, the following vulnerability has been resolved: media: rc: bpf attach/detach requires write permission Note that bpf attach/detach also r…
CVE-2023-44227High7.52024-04-17Missing Authorization vulnerability in Mitchell Bennis Simple File List.This issue affects Simple File List: from n/a through 6.1.9.
CVE-2023-36505Medium6.82024-04-17Improper Input Validation vulnerability in Saturday Drive Ninja Forms Contact Form.This issue affects Ninja Forms Contact Form : from n/a through 3.6.24.
CVE-2023-25043Medium4.32024-04-17Incorrect Authorization vulnerability in Supsystic Data Tables Generator.This issue affects Data Tables Generator: from n/a through 1.10.25.
CVE-2023-51391High7.52024-04-16A bug in Micrium OS Network HTTP Server permits an invalid pointer dereference during header processing - potentially allowing a device crash and Denial of Ser…
CVE-2023-45000High8.22024-04-16Missing Authorization vulnerability in LiteSpeed Technologies LiteSpeed Cache.This issue affects LiteSpeed Cache: from n/a through 5.7.
CVE-2023-40000High8.32024-04-16Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS…
CVE-2023-50872High7.52024-04-16The API in Accredible Credential.net December 6th, 2023 allows an Insecure Direct Object Reference attack that discloses partial information about certificates…
CVE-2023-33806High7.82024-04-15Insecure default configurations in Hikvision Interactive Tablet DS-D5B86RB/B V2.3.0 build220119, allows attackers to execute arbitrary commands.
CVE-2023-45503Medium5.32024-04-15SQL Injection vulnerability in Macrob7 Macs CMS 1.1.4f, allows remote attackers to execute arbitrary code, cause a denial of service (DoS), escalate privileges…
CVE-2023-4857High7.52024-04-15 An authentication bypass vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user to execute certain IPMI calls that could lead…
CVE-2023-4856High8.82024-04-15 A format string vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user to execute arbitrary commands on a specific API endpoi…
CVE-2023-4855High7.22024-04-15 A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user with elevated privileges to execute unauthorized c…
CVE-2023-48710Critical9.82024-04-15iTop is an IT service management platform. Files from the `env-production` folder can be retrieved even though they should have restricted access. Hopefully…