2023 CVEs (page 47)
Page 47 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-49234 | Medium | 6.3 | 2024-03-29 | An XML external entity (XXE) vulnerability was found in Stilog Visual Planning 8. It allows an authenticated attacker to access local server files and exfiltra… |
CVE-2023-49232 | Critical | 9.8 | 2024-03-29 | An authentication bypass vulnerability was found in Stilog Visual Planning 8. It allows an unauthenticated attacker to brute-force the password reset PINs of a… |
CVE-2023-49231 | Critical | 9.8 | 2024-03-29 | An authentication bypass vulnerability was found in Stilog Visual Planning 8. It allows an unauthenticated attacker to receive an administrative API token. |
CVE-2023-6191 | Critical | 9.8 | 2024-03-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Egehan Security WebPDKS allows SQL Injection. This issue… |
CVE-2023-6047 | Medium | 6.1 | 2024-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Algoritim E-commerce Software allows Reflected XSS. This… |
CVE-2023-52629 | High | 8.4 | 2024-03-29 | In the Linux kernel, the following vulnerability has been resolved: sh: push-switch: Reorder cleanup operations to avoid use-after-free bug The original code… |
CVE-2023-50969 | Critical | 9.8 | 2024-03-28 | Thales Imperva SecureSphere WAF 14.7.0.40 allows remote attackers to bypass WAF rules via a crafted POST request, a different vulnerability than CVE-2021-45468. |
CVE-2023-33528 | Medium | 6.1 | 2024-03-28 | halo v1.6.0 is vulnerable to Cross Site Scripting (XSS). |
CVE-2023-25341 | Medium | 6.5 | 2024-03-28 | A Directory Traversal vulnerability in ladle dev server 2.5.1 and earlier allows an attacker on the same network to read files accessible to the user via GET r… |
CVE-2023-42974 | High | 7.0 | 2024-03-28 | A race condition was addressed with improved state handling. This issue is fixed in macOS Monterey 12.7.2, macOS Ventura 13.6.3, iOS 17.2 and iPadOS 17.2, iOS… |
CVE-2023-42962 | High | 7.5 | 2024-03-28 | This issue was addressed with improved checks This issue is fixed in iOS 17.2 and iPadOS 17.2, iOS 16.7.3 and iPadOS 16.7.3. A remote attacker may be able to c… |
CVE-2023-42956 | Medium | 6.5 | 2024-03-28 | The issue was addressed with improved memory handling. This issue is fixed in Safari 17.2, iOS 17.2 and iPadOS 17.2, macOS Sonoma 14.2. Processing web content… |
CVE-2023-42950 | High | 8.8 | 2024-03-28 | A use after free issue was addressed with improved memory management. This issue is fixed in Safari 17.2, iOS 17.2 and iPadOS 17.2, tvOS 17.2, watchOS 10.2, ma… |
CVE-2023-42947 | High | 8.6 | 2024-03-28 | A path handling issue was addressed with improved validation. This issue is fixed in macOS Monterey 12.7.2, macOS Ventura 13.6.3, iOS 17.2 and iPadOS 17.2, tvO… |
CVE-2023-42936 | Medium | 5.5 | 2024-03-28 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Monterey 12.7.2, macOS Ventura 13.6.3, iOS 17.2 and iPa… |
CVE-2023-42931 | High | 7.8 | 2024-03-28 | The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.6.3, macOS Sonoma 14.2, macOS Monterey 12.7.2. A process may gain admin p… |
CVE-2023-42930 | Medium | 5.5 | 2024-03-28 | This issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.6.3, macOS Sonoma 14.2, macOS Monterey 12.7.2. An app may be able to mod… |
CVE-2023-42913 | High | 8.8 | 2024-03-28 | This issue was addressed through improved state management. This issue is fixed in macOS Sonoma 14.2. Remote Login sessions may be able to obtain full disk acc… |
CVE-2023-42896 | Medium | 5.5 | 2024-03-28 | An issue was addressed with improved handling of temporary files. This issue is fixed in macOS Monterey 12.7.2, macOS Ventura 13.6.3, iOS 17.2 and iPadOS 17.2… |
CVE-2023-42893 | Medium | 5.5 | 2024-03-28 | A permissions issue was addressed by removing vulnerable code and adding additional checks. This issue is fixed in macOS Monterey 12.7.2, macOS Ventura 13.6.3… |
CVE-2023-42892 | High | 7.8 | 2024-03-28 | A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.6.3, macOS Sonoma 14.2, macOS Monterey 12.7.2. A… |
CVE-2023-40390 | Medium | 5.5 | 2024-03-28 | A privacy issue was addressed by moving sensitive data to a protected location. This issue is fixed in macOS Sonoma 14.2. An app may be able to access user-sen… |
CVE-2023-45715 | Low | 3.5 | 2024-03-28 | The console may experience a service interruption when processing file names with invalid characters. |
CVE-2023-45706 | Low | 2.0 | 2024-03-28 | An administrative user of WebReports may perform a Cross Site Scripting (XSS) and/or Man in the Middle (MITM) exploit through SAML configuration. |
CVE-2023-45705 | Low | 3.5 | 2024-03-28 | An administrative user of WebReports may perform a Server Side Request Forgery (SSRF) exploit through SMTP configuration options. |
CVE-2023-6437 | Critical | 9.8 | 2024-03-28 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TP-Link TP-Link EX20v AX1800, Tp-Link Archer C5v AC… |
CVE-2023-6371 | High | 8.7 | 2024-03-28 | An issue has been discovered in GitLab CE/EE affecting all versions before 16.8.5, all versions starting from 16.9 before 16.9.3, all versions starting from 16… |
CVE-2023-52628 | High | 7.8 | 2024-03-28 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: exthdr: fix 4-byte stack OOB write If priv->len is a multiple of 4… |
CVE-2023-52234 | Medium | 6.5 | 2024-03-28 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Booster Booster Elite for WooCommerce.This issue affects Booster Elite for WooComme… |
CVE-2023-52231 | Medium | 6.5 | 2024-03-28 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Booster Booster Plus for WooCommerce.This issue affects Booster Plus for WooCommerc… |
CVE-2023-50374 | Medium | 5.5 | 2024-03-28 | Server-Side Request Forgery (SSRF) vulnerability in NiteoThemes CMP – Coming Soon & Maintenance.This issue affects CMP – Coming Soon & Maintenance: from n/a th… |
CVE-2023-39309 | High | 8.5 | 2024-03-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThemeFusion Fusion Builder.This issue affects Fusion Buil… |
CVE-2023-23649 | High | 8.1 | 2024-03-28 | Deserialization of Untrusted Data vulnerability in MainWP MainWP Links Manager Extension.This issue affects MainWP Links Manager Extension: from n/a through 2… |
CVE-2023-39313 | High | 7.7 | 2024-03-28 | Server-Side Request Forgery (SSRF) vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1. |
CVE-2023-36679 | High | 7.1 | 2024-03-28 | Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Spectra.This issue affects Spectra: from n/a through 2.6.6. |
CVE-2023-34370 | High | 7.1 | 2024-03-28 | Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Starter Templates — Elementor, WordPress & Beaver Builder Templates, Brainstorm Force Prem… |
CVE-2023-47438 | Medium | 6.5 | 2024-03-27 | SQL Injection vulnerability in Reportico Till 8.1.0 allows attackers to obtain sensitive information or other system information via the project parameter. |
CVE-2023-0582 | High | 8.1 | 2024-03-27 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ForgeRock Access Management allows Authorization Bypass. This… |
CVE-2023-44999 | Medium | 5.4 | 2024-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Stripe Payment Gateway.This issue affects WooCommerce Stripe Payment Gateway: from n… |
CVE-2023-39311 | High | 7.1 | 2024-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Fusion Builder.This issue affects Fusion Builder: from n/a through 3.11.1. |
CVE-2023-34020 | Medium | 4.7 | 2024-03-27 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash.This issue affects Uncanny Toolkit for LearnDash… |
CVE-2023-6400 | High | 7.4 | 2024-03-27 | Incorrect Authorization vulnerability in OpenText™ ZENworks Configuration Management (ZCM) allows Unauthorized Use of Device Resources.This issue affects ZENwo… |
CVE-2023-6153 | Critical | 9.8 | 2024-03-27 | Authentication Bypass by Primary Weakness vulnerability in TeoSOFT Software TeoBASE allows Authentication Bypass. This issue affects TeoBASE: through 20240327… |
CVE-2023-50961 | Medium | 4.8 | 2024-03-27 | IBM QRadar SIEM 7.5 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2023-6173 | Critical | 9.8 | 2024-03-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeoSOFT Software TeoBASE allows SQL Injection. This issu… |
CVE-2023-43768 | High | 7.5 | 2024-03-27 | An issue was discovered in Couchbase Server 6.6.x through 7.2.0, before 7.1.5 and 7.2.1. Unauthenticated users may cause memcached to run out of memory via lar… |
CVE-2023-25364 | Medium | 6.1 | 2024-03-27 | Opswat Metadefender Core before 5.2.1 does not properly defend against potential HTML injection and XSS attacks. |
CVE-2023-52228 | Medium | 6.5 | 2024-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mark Kinchin Beds24 Online Booking allows Stored XSS.This… |
CVE-2023-49815 | Critical | 10.0 | 2024-03-27 | Unrestricted Upload of File with Dangerous Type vulnerability in WappPress Team WappPress.This issue affects WappPress: from n/a through 5.0.3. |
CVE-2023-46052 | High | 7.1 | 2024-03-27 | Sane 1.2.1 heap bounds overwrite in init_options() from backend/test.c via a long init_mode string in a configuration file. NOTE: this is disputed because ther… |
CVE-2023-46051 | Low | 3.3 | 2024-03-27 | TeX Live 944e257 allows a NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c. NOTE: this is disputed because it should be categorized as a usability… |
CVE-2023-46049 | Medium | 5.3 | 2024-03-27 | LLVM 15.0.0 has a NULL pointer dereference in the parseOneMetadata() function via a crafted pdflatex.fmt file (or perhaps a crafted .o file) to llvm-lto. NOTE… |
CVE-2023-39306 | High | 7.1 | 2024-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Fusion Builder allows Reflected XSS.This issu… |
CVE-2023-31854 | | 2024-03-27 | std::bad_alloc is mishandled in Precomp 0.4.8. NOTE: this is disputed because it should be categorized as a usability problem. | |
CVE-2023-31634 | Critical | 9.8 | 2024-03-27 | In TeslaMate before 1.27.2, there is unauthorized access to port 4000 for remote viewing and operation of user data. After accessing the IP address for the Tes… |
CVE-2023-29134 | High | 8.6 | 2024-03-27 | An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. There is mishandling of backticks to smartSplit. |
CVE-2023-46048 | Medium | 6.2 | 2024-03-27 | Tex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. NOTE: this is disputed because it should be categorized as a usability probl… |
CVE-2023-46047 | High | 7.3 | 2024-03-27 | An issue in Sane 1.2.1 allows a local attacker to execute arbitrary code via a crafted file to the sanei_configure_attach() function. NOTE: this is disputed be… |
CVE-2023-46046 | Medium | 5.5 | 2024-03-27 | An issue in MiniZinc before 2.8.0 allows a NULL pointer dereference via ti_expr in a crafted .mzn file. NOTE: this is disputed because there is no common libmi… |
CVE-2023-45935 | Medium | 4.2 | 2024-03-27 | Qt 6 through 6.6 was discovered to contain a NULL pointer dereference via the function QXcbConnection::initializeAllAtoms(). NOTE: this is disputed because it… |
CVE-2023-45925 | | 2024-03-27 | GNU Midnight Commander 4.8.29-146-g299d9a2fb was discovered to contain a NULL pointer dereference via the function x_error_handler() at tty/x11conn.c. NOTE: th… | |
CVE-2023-45924 | Critical | 9.8 | 2024-03-27 | libglxproto.c in OpenGL libglvnd bb06db5a was discovered to contain a segmentation violation via the function glXGetDrawableScreen(). NOTE: this is disputed be… |
CVE-2023-45922 | Medium | 4.3 | 2024-03-27 | glx_pbuffer.c in Mesa 23.0.4 was discovered to contain a segmentation violation when calling __glXGetDrawableAttribute(). NOTE: this is disputed because there… |
CVE-2023-45920 | Medium | 4.2 | 2024-03-27 | Xfig v3.2.8 was discovered to contain a NULL pointer dereference when calling XGetWMHints(). NOTE: this is disputed because it is not expected that an X applic… |
CVE-2023-45919 | Medium | 5.3 | 2024-03-27 | Mesa 23.0.4 was discovered to contain a buffer over-read in glXQueryServerString(). NOTE: this is disputed because there are no common situations in which user… |
CVE-2023-45931 | High | 7.5 | 2024-03-27 | Mesa 23.0.4 was discovered to contain a NULL pointer dereference in check_xshm() for the has_error state. NOTE: this is disputed because there is no scenario i… |
CVE-2023-45929 | Critical | 9.1 | 2024-03-27 | S-Lang 2.3.2 was discovered to contain a segmentation fault via the function fixup_tgetstr(). |
CVE-2023-45927 | Critical | 9.1 | 2024-03-27 | S-Lang 2.3.2 was discovered to contain an arithmetic exception via the function tt_sprintf(). |
CVE-2023-45913 | Medium | 6.2 | 2024-03-27 | Mesa v23.0.4 was discovered to contain a NULL pointer dereference via the function dri2GetGlxDrawableFromXDrawableId(). This vulnerability is triggered when th… |
CVE-2023-40290 | High | 8.3 | 2024-03-27 | An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue that affects Internet Explorer 11 o… |
CVE-2023-40289 | High | 7.2 | 2024-03-27 | A command injection issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker can exploit this to elevate privileges from a… |
CVE-2023-40288 | High | 8.3 | 2024-03-27 | An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue. |
CVE-2023-40287 | High | 8.3 | 2024-03-27 | An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue. |
CVE-2023-40286 | High | 8.3 | 2024-03-27 | An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue. |
CVE-2023-40285 | Medium | 6.5 | 2024-03-27 | An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue. |
CVE-2023-40284 | High | 8.3 | 2024-03-27 | An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue. |
CVE-2023-39804 | Medium | 6.2 | 2024-03-27 | In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c. |
CVE-2023-50702 | High | 8.8 | 2024-03-26 | Sikka SSCWindowsService 5 2023-09-14 executes a program as LocalSystem but allows full control by low-privileged users (and low-privileged users have write acc… |
CVE-2023-51147 | High | 8.0 | 2024-03-26 | Buffer Overflow vulnerability in TRENDnet Trendnet AC1200 TEW-821DAP with firmware version 3.00b06 allows an attacker to execute arbitrary code via the adm_mod… |
CVE-2023-51146 | High | 8.0 | 2024-03-26 | Buffer Overflow vulnerability in TRENDnet AC1200 TEW-821DAP with firmware version 3.00b06 allows an attacker to execute arbitrary code via the adm_add_user act… |
CVE-2023-51148 | High | 8.0 | 2024-03-26 | An issue in TRENDnet Trendnet AC1200 Dual Band PoE Indoor Wireless Access Point TEW-821DAP v.3.00b06 allows an attacker to execute arbitrary code via the 'mycl… |
CVE-2023-48777 | Critical | 9.9 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in Elementor.Com Elementor Website Builder.This issue affects Elementor Website Builder: from 3.3… |
CVE-2023-48275 | High | 8.0 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in Trustindex.Io Widgets for Google Reviews.This issue affects Widgets for Google Reviews: from n… |
CVE-2023-47873 | Critical | 9.1 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in WEN Solutions WP Child Theme Generator.This issue affects WP Child Theme Generator: from n/a t… |
CVE-2023-47846 | Critical | 9.1 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in Terry Lin WP Githuber MD.This issue affects WP Githuber MD: from n/a through 1.16.2. |
CVE-2023-47842 | Critical | 9.1 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in Zachary Segal CataBlog.This issue affects CataBlog: from n/a through 1.7.0. |
CVE-2023-39307 | High | 8.5 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1. |
CVE-2023-38388 | Critical | 9.0 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in Artbees JupiterX Core.This issue affects JupiterX Core: from n/a through 3.3.5. |
CVE-2023-29386 | Critical | 9.1 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in Julien Crego Manager for Icomoon.This issue affects Manager for Icomoon: from n/a through 2.0. |
CVE-2023-28787 | Critical | 9.3 | 2024-03-26 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Quiz And Survey Master.This issue affects Qui… |
CVE-2023-28687 | High | 7.1 | 2024-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in perfectwpthemes Glaze Blog Lite, themebeez Fascinate, the… |
CVE-2023-6091 | High | 7.2 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in mndpsingh287 Theme Editor.This issue affects Theme Editor: from n/a through 2.7.1. |
CVE-2023-27630 | Medium | 5.3 | 2024-03-26 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PeepSo Community by PeepSo.This issue affects Community by PeepSo: from n/a through… |
CVE-2023-27459 | High | 7.4 | 2024-03-26 | Deserialization of Untrusted Data vulnerability in WPEverest User Registration.This issue affects User Registration: from n/a through 2.3.2.1. |
CVE-2023-27440 | High | 7.2 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in OnTheGoSystems Types.This issue affects Types: from n/a through 3.4.17. |
CVE-2023-25965 | Medium | 5.9 | 2024-03-26 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in mbbhatti Upload Resume.This issue affects Upload Resume: from n/a through 1.2.0. |
CVE-2023-23656 | Critical | 10.0 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in MainWP MainWP File Uploader Extension.This issue affects MainWP File Uploader Extension: from… |
CVE-2023-52627 | Medium | 5.5 | 2024-03-26 | In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad7091r: Allow users to configure device events AD7091R-5 devices are supported… |
CVE-2023-52626 | High | 7.1 | 2024-03-26 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context Indirectio… |
CVE-2023-52625 | Medium | 5.5 | 2024-03-26 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Refactor DMCUB enter/exit idle interface [Why] We can hang in place tryi… |