2023 CVEs (page 45)
Page 45 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-48709 | High | 8.0 | 2024-04-15 | iTop is an IT service management platform. When exporting data from backoffice or portal in CSV or Excel files, users' inputs may include malicious formulas t… |
CVE-2023-47626 | High | 8.8 | 2024-04-15 | iTop is an IT service management platform. When displaying/editing the user's personal tokens, XSS attacks are possible. This vulnerability is fixed in 3.1.1. |
CVE-2023-47622 | High | 8.8 | 2024-04-15 | iTop is an IT service management platform. When dashlet are refreshed, XSS attacks are possible. This vulnerability is fixed in 3.0.4 and 3.1.1. |
CVE-2023-47123 | High | 8.7 | 2024-04-15 | iTop is an IT service management platform. By filling malicious code in an object friendlyname / complementary name, an XSS attack can be performed when this… |
CVE-2023-45808 | Medium | 4.1 | 2024-04-15 | iTop is an IT service management platform. When creating or updating an object, extkey values aren't checked to be in the current user silo. In other words, b… |
CVE-2023-44396 | Medium | 6.8 | 2024-04-15 | iTop is an IT service management platform. Dashlet edits ajax endpoints can be used to produce XSS. Fixed in iTop 2.7.10, 3.0.4, and 3.1.1. |
CVE-2023-43790 | Medium | 5.7 | 2024-04-15 | iTop is an IT service management platform. By manipulating HTTP queries, a user can inject malicious content in the fields used for the object friendlyname va… |
CVE-2023-38511 | Medium | 5.0 | 2024-04-15 | iTop is an IT service management platform. Dashboard editor : can load multiple files and URL, and full path disclosure on dashboard config file. This vulnera… |
CVE-2023-52144 | Medium | 5.5 | 2024-04-15 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RexTheme Product Feed Manager.This issue affects Product Feed M… |
CVE-2023-7201 | Medium | 6.5 | 2024-04-15 | The Everest Backup WordPress plugin before 2.2.5 does not properly validate backup files to be uploaded, allowing high privilege users such as admin to upload… |
CVE-2023-6067 | Medium | 5.4 | 2024-04-15 | The WP User Profile Avatar WordPress plugin through 1.0.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/p… |
CVE-2023-6494 | Medium | 4.4 | 2024-04-13 | The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and includ… |
CVE-2023-52211 | Medium | 5.3 | 2024-04-12 | Missing Authorization vulnerability in Automattic WP Job Manager.This issue affects WP Job Manager: from n/a through 2.0.0. |
CVE-2023-51515 | High | 8.8 | 2024-04-12 | Missing Authorization vulnerability in Undsgn Uncode Core allows Privilege Escalation.This issue affects Uncode Core: from n/a through 2.8.8. |
CVE-2023-51499 | Medium | 4.3 | 2024-04-12 | Missing Authorization vulnerability in WooCommerce WooCommerce Shipping Per Product.This issue affects WooCommerce Shipping Per Product: from n/a through 2.5.4. |
CVE-2023-51409 | Critical | 10.0 | 2024-04-12 | Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a… |
CVE-2023-47714 | Medium | 4.8 | 2024-04-12 | IBM Sterling File Gateway 6.0.0.0 through 6.0.3.9, 6.1.0.0 through 6.1.2.3, and 6.2.0.0 is vulnerable to cross-site scripting. This vulnerability allows users… |
CVE-2023-49528 | High | 8.0 | 2024-04-12 | Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of service (DoS) via t… |
CVE-2023-44856 | Medium | 6.1 | 2024-04-12 | Cross Site Scripting (XSS) vulnerability in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafted script to the rst… |
CVE-2023-44855 | Medium | 6.5 | 2024-04-12 | Cross Site Scripting (XSS) vulnerability in Cobham SAILOR VSAT Ku v.164B019 allows a remote attacker to execute arbitrary code via a crafted script to the rdia… |
CVE-2023-44857 | High | 8.1 | 2024-04-12 | An issue in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafted script to the sub_21D24 function in the acu_web c… |
CVE-2023-44854 | Medium | 6.1 | 2024-04-12 | Cross Site Scripting (XSS) vulnerability in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafted script to the c_s… |
CVE-2023-44853 | Medium | 4.8 | 2024-04-12 | \An issue was discovered in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafted script to the sub_219C4 function… |
CVE-2023-44852 | High | 8.2 | 2024-04-12 | Cross Site Scripting (XSS) vulnerability in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafted script to the c_s… |
CVE-2023-50307 | Medium | 5.4 | 2024-04-12 | IBM Sterling B2B Integrator 6.0.0.0 through 6.0.3.9, 6.1.0.0 through 6.1.2.3, and 6.2.0.0 is vulnerable to cross-site scripting. This vulnerability allows user… |
CVE-2023-45186 | Medium | 4.8 | 2024-04-12 | IBM Sterling B2B Integrator 6.0.0.0 through 6.0.3.9, 6.1.0.0 through 6.1.2.3, and 6.2.0.0 is vulnerable to cross-site scripting. This vulnerability allows a pr… |
CVE-2023-6678 | Medium | 4.3 | 2024-04-12 | An issue has been discovered in GitLab EE affecting all versions before 16.8.6, all versions starting from 16.9 before 16.9.4, all versions starting from 16.10… |
CVE-2023-6489 | Medium | 4.3 | 2024-04-12 | A denial of service vulnerability was identified in GitLab CE/EE, versions 16.7.7 prior to 16.8.6, 16.9 prior to 16.9.4 and 16.10 prior to 16.10.2 which allows… |
CVE-2023-48865 | Medium | 6.5 | 2024-04-11 | An issue discovered in Reportico Till 8.1.0 allows attackers to obtain sensitive information via execute_mode parameter of the URL. |
CVE-2023-5394 | High | 7.4 | 2024-04-11 | Server receiving a malformed message that where the GCL message hostname may be too large which may cause a stack overflow; resulting in possible remote code e… |
CVE-2023-5393 | High | 7.4 | 2024-04-11 | Server receiving a malformed message that causes a disconnect to a hostname may causing a stack overflow resulting in possible remote code execution. Honeywell… |
CVE-2023-5392 | High | 7.5 | 2024-04-11 | C300 information leak due to an analysis feature which allows extracting more memory over the network than required by the function. Honeywell recommends updat… |
CVE-2023-50949 | Medium | 5.9 | 2024-04-11 | IBM QRadar SIEM 7.5 could allow an unauthorized user to perform unauthorized actions due to improper certificate validation. IBM X-Force ID: 275706. |
CVE-2023-29483 | High | 7.0 | 2024-04-11 | eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet f… |
CVE-2023-32295 | Medium | 6.3 | 2024-04-11 | Missing Authorization vulnerability in Alex Tselegidis Easy!Appointments.This issue affects Easy!Appointments: from n/a through 1.3.3. |
CVE-2023-32228 | Medium | 4.6 | 2024-04-11 | A firmware bug which may lead to misinterpretation of data in the AMC2-4WCF and AMC2-2WCF allowing an adversary to grant access to the last authorized user. |
CVE-2023-6257 | Medium | 4.3 | 2024-04-11 | The Inline Related Posts WordPress plugin before 3.6.0 is missing authorization in an AJAX action to ensure that users are allowed to see the content of the po… |
CVE-2023-6811 | High | 7.2 | 2024-04-11 | The Language Translate Widget for WordPress – ConveyThis plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api_key’ parameter in all v… |
CVE-2023-51672 | High | 7.5 | 2024-04-11 | Missing Authorization vulnerability in FunnelKit FunnelKit Checkout.This issue affects FunnelKit Checkout: from n/a through 3.10.3. |
CVE-2023-51142 | High | 7.5 | 2024-04-11 | An issue in ZKTeco BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive information. |
CVE-2023-51141 | Medium | 6.5 | 2024-04-11 | An issue in ZKTeko BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive information via the Authentication & Authorization component |
CVE-2023-27607 | Medium | 5.4 | 2024-04-11 | Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce.This issue affects Points and Rewards for WooCommerce: from n/a through 1.5… |
CVE-2023-52070 | High | 8.4 | 2024-04-10 | JFreeChart v1.5.4 was discovered to be vulnerable to ArrayIndexOutOfBounds via the 'setSeriesNeedle(int index, int type)' method. NOTE: this is disputed by mul… |
CVE-2023-6916 | High | 7.2 | 2024-04-10 | Audit records for OpenAPI requests may include sensitive information. This could lead to unauthorized accesses and privilege escalation. |
CVE-2023-2794 | High | 8.1 | 2024-04-10 | A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_deliver() function during the SMS decoding. I… |
CVE-2023-6385 | Medium | 4.3 | 2024-04-10 | The WordPress Ping Optimizer WordPress plugin through 2.35.1.3.0 does not have CSRF checks in some places, which could allow attackers to make logged in users… |
CVE-2023-50347 | Low | 3.7 | 2024-04-10 | HCL DRYiCE MyXalytics is impacted by an insecure SQL interface vulnerability, potentially giving an attacker the ability to execute custom SQL queries. A malic… |
CVE-2023-6236 | High | 7.3 | 2024-04-10 | A flaw was found in Red Hat Enterprise Application Platform 8. When an OIDC app that serves multiple tenants attempts to access the second tenant, it should pr… |
CVE-2023-40148 | Medium | 6.5 | 2024-04-10 | Server-side request forgery (SSRF) in PingFederate allows unauthenticated http requests to attack network resources and consume server-side resources via forge… |
CVE-2023-7046 | High | 7.5 | 2024-04-09 | The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score plugin for WordPress is vulnerable to Sensitive Information… |
CVE-2023-6999 | High | 8.8 | 2024-04-09 | The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Remote Code Exxecution via shortcode in all versions up to, and including, 3.0… |
CVE-2023-6993 | Medium | 6.4 | 2024-04-09 | The Custom post types, Custom Fields & more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode and custom post meta i… |
CVE-2023-6967 | High | 8.8 | 2024-04-09 | The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to SQL Injection via shortcode in all versions up to, and including, 3.0.10 (with… |
CVE-2023-6965 | Medium | 4.3 | 2024-04-09 | The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0.10 (with the e… |
CVE-2023-6964 | High | 8.5 | 2024-04-09 | The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and inc… |
CVE-2023-6799 | Medium | 5.9 | 2024-04-09 | The WP Reset – Most Advanced WordPress Reset Tool plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2… |
CVE-2023-6777 | Medium | 5.3 | 2024-04-09 | The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 9.0.34 due… |
CVE-2023-6695 | Medium | 6.5 | 2024-04-09 | The Beaver Themer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.9 via the 'wpbb' shortcode. Th… |
CVE-2023-6694 | Medium | 6.4 | 2024-04-09 | The Beaver Themer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.4.9 d… |
CVE-2023-6486 | Medium | 6.4 | 2024-04-09 | The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS metabox in all versions up to and… |
CVE-2023-49913 | High | 7.2 | 2024-04-09 | A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point… |
CVE-2023-49912 | High | 7.2 | 2024-04-09 | A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point… |
CVE-2023-49911 | High | 7.2 | 2024-04-09 | A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point… |
CVE-2023-49910 | High | 7.2 | 2024-04-09 | A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point… |
CVE-2023-49909 | High | 7.2 | 2024-04-09 | A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point… |
CVE-2023-49908 | High | 7.2 | 2024-04-09 | A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point… |
CVE-2023-49907 | High | 7.2 | 2024-04-09 | A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point… |
CVE-2023-49906 | High | 7.2 | 2024-04-09 | A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point… |
CVE-2023-49134 | High | 8.1 | 2024-04-09 | A command execution vulnerability exists in the tddpd enable_test_mode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0… |
CVE-2023-49133 | High | 8.1 | 2024-04-09 | A command execution vulnerability exists in the tddpd enable_test_mode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0… |
CVE-2023-49074 | High | 7.4 | 2024-04-09 | A denial of service vulnerability exists in the TDDP functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A… |
CVE-2023-48784 | Medium | 6.7 | 2024-04-09 | A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.1 and below, version 7.2.7 and below, 7.0 all versions, 6.4 all ver… |
CVE-2023-48724 | High | 7.5 | 2024-04-09 | A memory corruption vulnerability exists in the web interface functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20… |
CVE-2023-47542 | Medium | 6.7 | 2024-04-09 | A improper neutralization of special elements used in a template engine [CWE-1336] in FortiManager versions 7.4.1 and below, versions 7.2.4 and below, and 7.0… |
CVE-2023-47541 | Medium | 6.7 | 2024-04-09 | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, FortiSandbox 4.2… |
CVE-2023-47540 | Medium | 6.7 | 2024-04-09 | An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, Forti… |
CVE-2023-45590 | Critical | 9.6 | 2024-04-09 | An improper control of generation of code ('code injection') in Fortinet FortiClientLinux version 7.2.0, 7.0.6 through 7.0.10 and 7.0.3 through 7.0.4 allows at… |
CVE-2023-41677 | High | 7.5 | 2024-04-09 | A insufficiently protected credentials in Fortinet FortiProxy 7.4.0, 7.2.0 through 7.2.6, 7.0.0 through 7.0.12, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1… |
CVE-2023-6320 | Critical | 9.1 | 2024-04-09 | A command injection vulnerability exists in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint on webOS versions 5 and 6. A series of spe… |
CVE-2023-6319 | Critical | 9.1 | 2024-04-09 | A command injection vulnerability exists in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service on webOS version 4 through 7… |
CVE-2023-6318 | Critical | 9.1 | 2024-04-09 | A command injection vulnerability exists in the processAnalyticsReport method from the com.webos.service.cloudupload service on webOS version 5 through 7. A se… |
CVE-2023-6317 | High | 7.2 | 2024-04-09 | A prompt bypass exists in the secondscreen.gateway service running on webOS version 4 through 7. An attacker can create a privileged account without asking the… |
CVE-2023-50821 | Medium | 6.2 | 2024-04-09 | A vulnerability has been identified in SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC04), SIMATIC WinCC Runtime Professional V17 (All versions < V17 Update 8)… |
CVE-2023-1083 | Critical | 9.8 | 2024-04-09 | An unauthenticated remote attacker who is aware of a MQTT topic name can send and receive messages, including GET/SET configuration commands, reboot commands… |
CVE-2023-1082 | High | 8.8 | 2024-04-09 | An remote attacker with low privileges can perform a command injection which can lead to root access. |
CVE-2023-7164 | High | 7.5 | 2024-04-08 | The BackWPup WordPress plugin before 4.0.4 does not prevent Directory Listing in its temporary backup folder, allowing unauthenticated attackers to download ba… |
CVE-2023-52386 | High | 7.5 | 2024-04-08 | Out-of-bounds write vulnerability in the RSMC module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52385 | Medium | 6.2 | 2024-04-08 | Out-of-bounds write vulnerability in the RSMC module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52364 | Medium | 6.3 | 2024-04-08 | Vulnerability of input parameters being not strictly verified in the RSMC module. Impact: Successful exploitation of this vulnerability may cause out-of-bounds… |
CVE-2023-52554 | Medium | 6.5 | 2024-04-08 | Permission control vulnerability in the Bluetooth module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-52553 | High | 7.4 | 2024-04-08 | Race condition vulnerability in the Wi-Fi module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52552 | High | 7.5 | 2024-04-08 | Input verification vulnerability in the power module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52551 | Medium | 5.3 | 2024-04-08 | Vulnerability of data verification errors in the kernel module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-52550 | High | 7.5 | 2024-04-08 | Vulnerability of data verification errors in the kernel module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-52549 | High | 7.5 | 2024-04-08 | Vulnerability of data verification errors in the kernel module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-52546 | High | 7.5 | 2024-04-08 | Vulnerability of package name verification being bypassed in the Calendar app. Impact: Successful exploitation of this vulnerability may affect service confide… |
CVE-2023-52545 | High | 7.5 | 2024-04-08 | Vulnerability of undefined permissions in the Calendar app. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52544 | Medium | 4.3 | 2024-04-08 | Vulnerability of file path verification being bypassed in the email module. Impact: Successful exploitation of this vulnerability may affect service confidenti… |
CVE-2023-52543 | Medium | 6.2 | 2024-04-08 | Permission verification vulnerability in the system module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52542 | Medium | 6.5 | 2024-04-08 | Permission verification vulnerability in the system module. Impact: Successful exploitation of this vulnerability will affect availability. |