2023 CVEs (page 45)

Page 45 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.

All CVEs published in 2023 — newest first (page 45 of 307)
CVESeverityScorePublishedSummary
CVE-2023-49275Medium6.52024-04-19Wazuh is a free and open source platform used for threat prevention, detection, and response. A NULL pointer dereference was detected during fuzzing of the ana…
CVE-2023-37400High7.82024-04-19IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to escalate their privileges due to insecure credential storage. IBM X-Force ID: 259677.
CVE-2023-3758High7.12024-04-18A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issue…
CVE-2023-6897Medium4.32024-04-18The EAN for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.9.2 via the the 'alg_wc_…
CVE-2023-6892Medium6.42024-04-18The EAN for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'alg_wc_ean_product_meta' shortcode in all versions…
CVE-2023-50885Medium6.82024-04-18Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AGILELOGIX Store Locator WordPress.This issue affects Store Loc…
CVE-2023-49768Medium6.52024-04-18Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FormAssembly / Drew Buschhorn WP-FormAssembly allows Stor…
CVE-2023-47843High7.62024-04-18Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Zachary Segal CataBlog.This issue affects CataBlog: from n/a th…
CVE-2023-3675Medium6.52024-04-18Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Secomea GateManager (Web GUI) allows Reading Data from System R…
CVE-2023-41864Medium4.32024-04-18Cross-Site Request Forgery (CSRF) vulnerability in Pepro Dev. Group PeproDev CF7 Database.This issue affects PeproDev CF7 Database: from n/a through 1.8.0.
CVE-2023-49742Critical9.92024-04-18Missing Authorization vulnerability in Support Genix.This issue affects Support Genix: from n/a through 1.2.3.
CVE-2023-4509Medium4.32024-04-18It is possible for an API key to be logged in clear text in the audit log file after an invalid login attempt.
CVE-2023-4235High8.12024-04-17A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_deliver_report() function during the SMS deco…
CVE-2023-4234High8.12024-04-17A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_submit_report() function during the SMS decod…
CVE-2023-4233High8.12024-04-17A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the sms_decode_address_field() function during the SMS P…
CVE-2023-4232High8.12024-04-17A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_status_report() function during the SMS decod…
CVE-2023-5407Medium5.92024-04-17Controller denial of service due to improper handling of a specially crafted message received by the controller. See Honeywell Security Notification for recom…
CVE-2023-5406Medium5.92024-04-17Server communication with a controller can lead to remote code execution using a specially crafted message from the controller. See Honeywell Security Notifica…
CVE-2023-5405Medium5.92024-04-17Server information leak for the CDA Server process memory can occur when an error is generated in response to a specially crafted message. See Honeywell Securi…
CVE-2023-5404High8.12024-04-17Server receiving a malformed message can cause a pointer to be overwritten which can result in a remote code execution or failure. See Honeywell Security Notif…
CVE-2023-5403High8.12024-04-17Server hostname translation to IP address manipulation which could lead to an attacker performing remote code execution or causing a failure. See Honeywell Se…
CVE-2023-5401High8.12024-04-17Server receiving a malformed message based on a using the specified key values can cause a stack overflow vulnerability which could lead to an attacker perform…
CVE-2023-5400High8.12024-04-17Server receiving a malformed message based on a using the specified key values can cause a heap overflow vulnerability which could lead to an attacker performi…
CVE-2023-5398Medium5.92024-04-17Server receiving a malformed message based on a list of IPs resulting in heap corruption causing a denial of service. See Honeywell Security Notification for r…
CVE-2023-5397High8.12024-04-17Server receiving a malformed message to create a new connection could lead to an attacker performing remote code execution or causing a failure. See Honeywell…
CVE-2023-5396High7.42024-04-17Server receiving a malformed message creates connection for a hostname that may cause a stack overflow resulting in possible remote code execution. See Honeywe…
CVE-2023-5395High8.12024-04-17Server receiving a malformed message that uses the hostname in an internal table may cause a stack overflow resulting in possible remote code execution. See Ho…
CVE-2023-52645Medium4.72024-04-17In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix race conditions with genpd If the power domains are registered fi…
CVE-2023-46060High7.52024-04-17A Buffer Overflow vulnerability in Tenda AC500 v.2.0.1.9 allows a remote attacker to cause a denial of service via the port parameter at the goform/setVlanInfo…
CVE-2023-6805Medium6.42024-04-17The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind Server-Side Reques…
CVE-2023-45744High8.32024-04-17A data integrity vulnerability exists in the web interface /cgi-bin/upload_config.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially craft…
CVE-2023-45209Medium5.32024-04-17An information disclosure vulnerability exists in the web interface /cgi-bin/download_config.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU). A spec…
CVE-2023-43491Medium5.32024-04-17An information disclosure vulnerability exists in the web interface /cgi-bin/debug_dump.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially…
CVE-2023-40146Medium6.82024-04-17A privilege escalation vulnerability exists in the /bin/login functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted command line argument…
CVE-2023-39367Critical9.12024-04-17An OS command injection vulnerability exists in the web interface mac2name functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted HTTP req…
CVE-2023-52644Medium6.32024-04-17In the Linux kernel, the following vulnerability has been resolved: wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled When QoS is disabl…
CVE-2023-51500High7.72024-04-17Missing Authorization vulnerability in Undsgn Uncode Core.This issue affects Uncode Core: from n/a through 2.8.8.
CVE-2023-51418High7.72024-04-17Missing Authorization vulnerability in Joris van Montfort JVM rich text icons.This issue affects JVM rich text icons: from n/a through 1.2.6.
CVE-2023-52643Medium5.52024-04-17In the Linux kernel, the following vulnerability has been resolved: iio: core: fix memleak in iio_device_register_sysfs When iio_device_register_sysfs_group(…
CVE-2023-52642High7.82024-04-17In the Linux kernel, the following vulnerability has been resolved: media: rc: bpf attach/detach requires write permission Note that bpf attach/detach also r…
CVE-2023-44227High7.52024-04-17Missing Authorization vulnerability in Mitchell Bennis Simple File List.This issue affects Simple File List: from n/a through 6.1.9.
CVE-2023-36505Medium6.82024-04-17Improper Input Validation vulnerability in Saturday Drive Ninja Forms Contact Form.This issue affects Ninja Forms Contact Form : from n/a through 3.6.24.
CVE-2023-25043Medium4.32024-04-17Incorrect Authorization vulnerability in Supsystic Data Tables Generator.This issue affects Data Tables Generator: from n/a through 1.10.25.
CVE-2023-51391High7.52024-04-16A bug in Micrium OS Network HTTP Server permits an invalid pointer dereference during header processing - potentially allowing a device crash and Denial of Ser…
CVE-2023-45000High8.22024-04-16Missing Authorization vulnerability in LiteSpeed Technologies LiteSpeed Cache.This issue affects LiteSpeed Cache: from n/a through 5.7.
CVE-2023-40000High8.32024-04-16Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS…
CVE-2023-50872High7.52024-04-16The API in Accredible Credential.net December 6th, 2023 allows an Insecure Direct Object Reference attack that discloses partial information about certificates…
CVE-2023-33806High7.82024-04-15Insecure default configurations in Hikvision Interactive Tablet DS-D5B86RB/B V2.3.0 build220119, allows attackers to execute arbitrary commands.
CVE-2023-45503Medium5.32024-04-15SQL Injection vulnerability in Macrob7 Macs CMS 1.1.4f, allows remote attackers to execute arbitrary code, cause a denial of service (DoS), escalate privileges…
CVE-2023-4857High7.52024-04-15 An authentication bypass vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user to execute certain IPMI calls that could lead…
CVE-2023-4856High8.82024-04-15 A format string vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user to execute arbitrary commands on a specific API endpoi…
CVE-2023-4855High7.22024-04-15 A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user with elevated privileges to execute unauthorized c…
CVE-2023-48710Critical9.82024-04-15iTop is an IT service management platform. Files from the `env-production` folder can be retrieved even though they should have restricted access. Hopefully…
CVE-2023-48709High8.02024-04-15iTop is an IT service management platform. When exporting data from backoffice or portal in CSV or Excel files, users' inputs may include malicious formulas t…
CVE-2023-47626High8.82024-04-15iTop is an IT service management platform. When displaying/editing the user's personal tokens, XSS attacks are possible. This vulnerability is fixed in 3.1.1.
CVE-2023-47622High8.82024-04-15iTop is an IT service management platform. When dashlet are refreshed, XSS attacks are possible. This vulnerability is fixed in 3.0.4 and 3.1.1.
CVE-2023-47123High8.72024-04-15iTop is an IT service management platform. By filling malicious code in an object friendlyname / complementary name, an XSS attack can be performed when this…
CVE-2023-45808Medium4.12024-04-15iTop is an IT service management platform. When creating or updating an object, extkey values aren't checked to be in the current user silo. In other words, b…
CVE-2023-44396Medium6.82024-04-15iTop is an IT service management platform. Dashlet edits ajax endpoints can be used to produce XSS. Fixed in iTop 2.7.10, 3.0.4, and 3.1.1.
CVE-2023-43790Medium5.72024-04-15iTop is an IT service management platform. By manipulating HTTP queries, a user can inject malicious content in the fields used for the object friendlyname va…
CVE-2023-38511Medium5.02024-04-15iTop is an IT service management platform. Dashboard editor : can load multiple files and URL, and full path disclosure on dashboard config file. This vulnera…
CVE-2023-52144Medium5.52024-04-15Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RexTheme Product Feed Manager.This issue affects Product Feed M…
CVE-2023-7201Medium6.52024-04-15The Everest Backup WordPress plugin before 2.2.5 does not properly validate backup files to be uploaded, allowing high privilege users such as admin to upload…
CVE-2023-6067Medium5.42024-04-15The WP User Profile Avatar WordPress plugin through 1.0.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/p…
CVE-2023-6494Medium4.42024-04-13The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and includ…
CVE-2023-52211Medium5.32024-04-12Missing Authorization vulnerability in Automattic WP Job Manager.This issue affects WP Job Manager: from n/a through 2.0.0.
CVE-2023-51515High8.82024-04-12Missing Authorization vulnerability in Undsgn Uncode Core allows Privilege Escalation.This issue affects Uncode Core: from n/a through 2.8.8.
CVE-2023-51499Medium4.32024-04-12Missing Authorization vulnerability in WooCommerce WooCommerce Shipping Per Product.This issue affects WooCommerce Shipping Per Product: from n/a through 2.5.4.
CVE-2023-51409Critical10.02024-04-12Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a…
CVE-2023-47714Medium4.82024-04-12IBM Sterling File Gateway 6.0.0.0 through 6.0.3.9, 6.1.0.0 through 6.1.2.3, and 6.2.0.0 is vulnerable to cross-site scripting. This vulnerability allows users…
CVE-2023-49528High8.02024-04-12Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of service (DoS) via t…
CVE-2023-44856Medium6.12024-04-12Cross Site Scripting (XSS) vulnerability in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafted script to the rst…
CVE-2023-44855Medium6.52024-04-12Cross Site Scripting (XSS) vulnerability in Cobham SAILOR VSAT Ku v.164B019 allows a remote attacker to execute arbitrary code via a crafted script to the rdia…
CVE-2023-44857High8.12024-04-12An issue in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafted script to the sub_21D24 function in the acu_web c…
CVE-2023-44854Medium6.12024-04-12Cross Site Scripting (XSS) vulnerability in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafted script to the c_s…
CVE-2023-44853Medium4.82024-04-12\An issue was discovered in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafted script to the sub_219C4 function…
CVE-2023-44852High8.22024-04-12Cross Site Scripting (XSS) vulnerability in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafted script to the c_s…
CVE-2023-50307Medium5.42024-04-12IBM Sterling B2B Integrator 6.0.0.0 through 6.0.3.9, 6.1.0.0 through 6.1.2.3, and 6.2.0.0 is vulnerable to cross-site scripting. This vulnerability allows user…
CVE-2023-45186Medium4.82024-04-12IBM Sterling B2B Integrator 6.0.0.0 through 6.0.3.9, 6.1.0.0 through 6.1.2.3, and 6.2.0.0 is vulnerable to cross-site scripting. This vulnerability allows a pr…
CVE-2023-6678Medium4.32024-04-12An issue has been discovered in GitLab EE affecting all versions before 16.8.6, all versions starting from 16.9 before 16.9.4, all versions starting from 16.10…
CVE-2023-6489Medium4.32024-04-12A denial of service vulnerability was identified in GitLab CE/EE, versions 16.7.7 prior to 16.8.6, 16.9 prior to 16.9.4 and 16.10 prior to 16.10.2 which allows…
CVE-2023-48865Medium6.52024-04-11An issue discovered in Reportico Till 8.1.0 allows attackers to obtain sensitive information via execute_mode parameter of the URL.
CVE-2023-5394High7.42024-04-11Server receiving a malformed message that where the GCL message hostname may be too large which may cause a stack overflow; resulting in possible remote code e…
CVE-2023-5393High7.42024-04-11Server receiving a malformed message that causes a disconnect to a hostname may causing a stack overflow resulting in possible remote code execution. Honeywell…
CVE-2023-5392High7.52024-04-11C300 information leak due to an analysis feature which allows extracting more memory over the network than required by the function. Honeywell recommends updat…
CVE-2023-50949Medium5.92024-04-11IBM QRadar SIEM 7.5 could allow an unauthorized user to perform unauthorized actions due to improper certificate validation. IBM X-Force ID: 275706.
CVE-2023-29483High7.02024-04-11eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet f…
CVE-2023-32295Medium6.32024-04-11Missing Authorization vulnerability in Alex Tselegidis Easy!Appointments.This issue affects Easy!Appointments: from n/a through 1.3.3.
CVE-2023-32228Medium4.62024-04-11A firmware bug which may lead to misinterpretation of data in the AMC2-4WCF and AMC2-2WCF allowing an adversary to grant access to the last authorized user.
CVE-2023-6257Medium4.32024-04-11The Inline Related Posts WordPress plugin before 3.6.0 is missing authorization in an AJAX action to ensure that users are allowed to see the content of the po…
CVE-2023-6811High7.22024-04-11The Language Translate Widget for WordPress – ConveyThis plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api_key’ parameter in all v…
CVE-2023-51672High7.52024-04-11Missing Authorization vulnerability in FunnelKit FunnelKit Checkout.This issue affects FunnelKit Checkout: from n/a through 3.10.3.
CVE-2023-51142High7.52024-04-11An issue in ZKTeco BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive information.
CVE-2023-51141Medium6.52024-04-11An issue in ZKTeko BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive information via the Authentication & Authorization component
CVE-2023-27607Medium5.42024-04-11Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce.This issue affects Points and Rewards for WooCommerce: from n/a through 1.5…
CVE-2023-52070High8.42024-04-10JFreeChart v1.5.4 was discovered to be vulnerable to ArrayIndexOutOfBounds via the 'setSeriesNeedle(int index, int type)' method. NOTE: this is disputed by mul…
CVE-2023-6916High7.22024-04-10Audit records for OpenAPI requests may include sensitive information. This could lead to unauthorized accesses and privilege escalation.
CVE-2023-2794High8.12024-04-10A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_deliver() function during the SMS decoding. I…
CVE-2023-6385Medium4.32024-04-10The WordPress Ping Optimizer WordPress plugin through 2.35.1.3.0 does not have CSRF checks in some places, which could allow attackers to make logged in users…
CVE-2023-50347Low3.72024-04-10HCL DRYiCE MyXalytics is impacted by an insecure SQL interface vulnerability, potentially giving an attacker the ability to execute custom SQL queries. A malic…