2023 CVEs (page 48)
Page 48 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-52228 | Medium | 6.5 | 2024-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mark Kinchin Beds24 Online Booking allows Stored XSS.This… |
CVE-2023-49815 | Critical | 10.0 | 2024-03-27 | Unrestricted Upload of File with Dangerous Type vulnerability in WappPress Team WappPress.This issue affects WappPress: from n/a through 5.0.3. |
CVE-2023-46052 | High | 7.1 | 2024-03-27 | Sane 1.2.1 heap bounds overwrite in init_options() from backend/test.c via a long init_mode string in a configuration file. NOTE: this is disputed because ther… |
CVE-2023-46051 | Low | 3.3 | 2024-03-27 | TeX Live 944e257 allows a NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c. NOTE: this is disputed because it should be categorized as a usability… |
CVE-2023-46049 | Medium | 5.3 | 2024-03-27 | LLVM 15.0.0 has a NULL pointer dereference in the parseOneMetadata() function via a crafted pdflatex.fmt file (or perhaps a crafted .o file) to llvm-lto. NOTE… |
CVE-2023-39306 | High | 7.1 | 2024-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Fusion Builder allows Reflected XSS.This issu… |
CVE-2023-31854 | | 2024-03-27 | std::bad_alloc is mishandled in Precomp 0.4.8. NOTE: this is disputed because it should be categorized as a usability problem. | |
CVE-2023-31634 | Critical | 9.8 | 2024-03-27 | In TeslaMate before 1.27.2, there is unauthorized access to port 4000 for remote viewing and operation of user data. After accessing the IP address for the Tes… |
CVE-2023-29134 | High | 8.6 | 2024-03-27 | An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. There is mishandling of backticks to smartSplit. |
CVE-2023-46048 | Medium | 6.2 | 2024-03-27 | Tex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. NOTE: this is disputed because it should be categorized as a usability probl… |
CVE-2023-46047 | High | 7.3 | 2024-03-27 | An issue in Sane 1.2.1 allows a local attacker to execute arbitrary code via a crafted file to the sanei_configure_attach() function. NOTE: this is disputed be… |
CVE-2023-46046 | Medium | 5.5 | 2024-03-27 | An issue in MiniZinc before 2.8.0 allows a NULL pointer dereference via ti_expr in a crafted .mzn file. NOTE: this is disputed because there is no common libmi… |
CVE-2023-45935 | Medium | 4.2 | 2024-03-27 | Qt 6 through 6.6 was discovered to contain a NULL pointer dereference via the function QXcbConnection::initializeAllAtoms(). NOTE: this is disputed because it… |
CVE-2023-45925 | | 2024-03-27 | GNU Midnight Commander 4.8.29-146-g299d9a2fb was discovered to contain a NULL pointer dereference via the function x_error_handler() at tty/x11conn.c. NOTE: th… | |
CVE-2023-45924 | Critical | 9.8 | 2024-03-27 | libglxproto.c in OpenGL libglvnd bb06db5a was discovered to contain a segmentation violation via the function glXGetDrawableScreen(). NOTE: this is disputed be… |
CVE-2023-45922 | Medium | 4.3 | 2024-03-27 | glx_pbuffer.c in Mesa 23.0.4 was discovered to contain a segmentation violation when calling __glXGetDrawableAttribute(). NOTE: this is disputed because there… |
CVE-2023-45920 | Medium | 4.2 | 2024-03-27 | Xfig v3.2.8 was discovered to contain a NULL pointer dereference when calling XGetWMHints(). NOTE: this is disputed because it is not expected that an X applic… |
CVE-2023-45919 | Medium | 5.3 | 2024-03-27 | Mesa 23.0.4 was discovered to contain a buffer over-read in glXQueryServerString(). NOTE: this is disputed because there are no common situations in which user… |
CVE-2023-45931 | High | 7.5 | 2024-03-27 | Mesa 23.0.4 was discovered to contain a NULL pointer dereference in check_xshm() for the has_error state. NOTE: this is disputed because there is no scenario i… |
CVE-2023-45929 | Critical | 9.1 | 2024-03-27 | S-Lang 2.3.2 was discovered to contain a segmentation fault via the function fixup_tgetstr(). |
CVE-2023-45927 | Critical | 9.1 | 2024-03-27 | S-Lang 2.3.2 was discovered to contain an arithmetic exception via the function tt_sprintf(). |
CVE-2023-45913 | Medium | 6.2 | 2024-03-27 | Mesa v23.0.4 was discovered to contain a NULL pointer dereference via the function dri2GetGlxDrawableFromXDrawableId(). This vulnerability is triggered when th… |
CVE-2023-40290 | High | 8.3 | 2024-03-27 | An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue that affects Internet Explorer 11 o… |
CVE-2023-40289 | High | 7.2 | 2024-03-27 | A command injection issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker can exploit this to elevate privileges from a… |
CVE-2023-40288 | High | 8.3 | 2024-03-27 | An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue. |
CVE-2023-40287 | High | 8.3 | 2024-03-27 | An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue. |
CVE-2023-40286 | High | 8.3 | 2024-03-27 | An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue. |
CVE-2023-40285 | Medium | 6.5 | 2024-03-27 | An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue. |
CVE-2023-40284 | High | 8.3 | 2024-03-27 | An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue. |
CVE-2023-39804 | Medium | 6.2 | 2024-03-27 | In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c. |
CVE-2023-50702 | High | 8.8 | 2024-03-26 | Sikka SSCWindowsService 5 2023-09-14 executes a program as LocalSystem but allows full control by low-privileged users (and low-privileged users have write acc… |
CVE-2023-51147 | High | 8.0 | 2024-03-26 | Buffer Overflow vulnerability in TRENDnet Trendnet AC1200 TEW-821DAP with firmware version 3.00b06 allows an attacker to execute arbitrary code via the adm_mod… |
CVE-2023-51146 | High | 8.0 | 2024-03-26 | Buffer Overflow vulnerability in TRENDnet AC1200 TEW-821DAP with firmware version 3.00b06 allows an attacker to execute arbitrary code via the adm_add_user act… |
CVE-2023-51148 | High | 8.0 | 2024-03-26 | An issue in TRENDnet Trendnet AC1200 Dual Band PoE Indoor Wireless Access Point TEW-821DAP v.3.00b06 allows an attacker to execute arbitrary code via the 'mycl… |
CVE-2023-48777 | Critical | 9.9 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in Elementor.Com Elementor Website Builder.This issue affects Elementor Website Builder: from 3.3… |
CVE-2023-48275 | High | 8.0 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in Trustindex.Io Widgets for Google Reviews.This issue affects Widgets for Google Reviews: from n… |
CVE-2023-47873 | Critical | 9.1 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in WEN Solutions WP Child Theme Generator.This issue affects WP Child Theme Generator: from n/a t… |
CVE-2023-47846 | Critical | 9.1 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in Terry Lin WP Githuber MD.This issue affects WP Githuber MD: from n/a through 1.16.2. |
CVE-2023-47842 | Critical | 9.1 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in Zachary Segal CataBlog.This issue affects CataBlog: from n/a through 1.7.0. |
CVE-2023-39307 | High | 8.5 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1. |
CVE-2023-38388 | Critical | 9.0 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in Artbees JupiterX Core.This issue affects JupiterX Core: from n/a through 3.3.5. |
CVE-2023-29386 | Critical | 9.1 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in Julien Crego Manager for Icomoon.This issue affects Manager for Icomoon: from n/a through 2.0. |
CVE-2023-28787 | Critical | 9.3 | 2024-03-26 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Quiz And Survey Master.This issue affects Qui… |
CVE-2023-28687 | High | 7.1 | 2024-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in perfectwpthemes Glaze Blog Lite, themebeez Fascinate, the… |
CVE-2023-6091 | High | 7.2 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in mndpsingh287 Theme Editor.This issue affects Theme Editor: from n/a through 2.7.1. |
CVE-2023-27630 | Medium | 5.3 | 2024-03-26 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PeepSo Community by PeepSo.This issue affects Community by PeepSo: from n/a through… |
CVE-2023-27459 | High | 7.4 | 2024-03-26 | Deserialization of Untrusted Data vulnerability in WPEverest User Registration.This issue affects User Registration: from n/a through 2.3.2.1. |
CVE-2023-27440 | High | 7.2 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in OnTheGoSystems Types.This issue affects Types: from n/a through 3.4.17. |
CVE-2023-25965 | Medium | 5.9 | 2024-03-26 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in mbbhatti Upload Resume.This issue affects Upload Resume: from n/a through 1.2.0. |
CVE-2023-23656 | Critical | 10.0 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in MainWP MainWP File Uploader Extension.This issue affects MainWP File Uploader Extension: from… |
CVE-2023-52627 | Medium | 5.5 | 2024-03-26 | In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad7091r: Allow users to configure device events AD7091R-5 devices are supported… |
CVE-2023-52626 | High | 7.1 | 2024-03-26 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context Indirectio… |
CVE-2023-52625 | Medium | 5.5 | 2024-03-26 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Refactor DMCUB enter/exit idle interface [Why] We can hang in place tryi… |
CVE-2023-52624 | High | 7.8 | 2024-03-26 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Wake DMCUB before executing GPINT commands [Why] DMCUB can be in idle wh… |
CVE-2023-52623 | High | 7.8 | 2024-03-26 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix a suspicious RCU usage warning I received the following warning while running… |
CVE-2023-52622 | Medium | 5.5 | 2024-03-26 | In the Linux kernel, the following vulnerability has been resolved: ext4: avoid online resizing failures due to oversized flex bg When we online resize an ex… |
CVE-2023-52621 | High | 7.8 | 2024-03-26 | In the Linux kernel, the following vulnerability has been resolved: bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers These three bpf_map_… |
CVE-2023-44989 | High | 7.5 | 2024-03-26 | Insertion of Sensitive Information into Log File vulnerability in GSheetConnector CF7 Google Sheets Connector.This issue affects CF7 Google Sheets Connector: f… |
CVE-2023-50895 | High | 7.2 | 2024-03-26 | In Janitza GridVis through 9.0.66, exposed dangerous methods in the de.janitza.pasw.project.server.ServerDatabaseProject project load functionality allow remot… |
CVE-2023-50894 | High | 8.8 | 2024-03-26 | In Janitza GridVis through 9.0.66, use of hard-coded credentials in the de.janitza.pasw.feature.impl.activators.PasswordEncryption password encryption function… |
CVE-2023-41973 | High | 7.3 | 2024-03-26 | ZSATray passes the previousInstallerName as a config parameter to TrayManager, and TrayManager constructs the path and appends previousInstallerName to get the… |
CVE-2023-41972 | High | 7.3 | 2024-03-26 | In some rare cases, there is a password type validation missing in Revert Password check and for some features it could be disabled. Fixed Version: Win ZApp 4… |
CVE-2023-41969 | High | 7.3 | 2024-03-26 | An arbitrary file deletion in ZSATrayManager where it protects the temporary encrypted ZApp issue reporting file from the unprivileged end user access and modi… |
CVE-2023-47150 | High | 7.5 | 2024-03-26 | IBM Common Cryptographic Architecture (CCA) 7.0.0 through 7.5.36 could allow a remote user to cause a denial of service due to incorrect data handling for cert… |
CVE-2023-33855 | Low | 3.7 | 2024-03-26 | Under certain conditions, RSA operations performed by IBM Common Cryptographic Architecture (CCA) 7.0.0 through 7.5.36 may exhibit non-constant-time behavior… |
CVE-2023-52214 | Medium | 4.3 | 2024-03-26 | Missing Authorization vulnerability in voidCoders Void Contact Form 7 Widget For Elementor Page Builder.This issue affects Void Contact Form 7 Widget For Eleme… |
CVE-2023-7251 | Medium | 6.5 | 2024-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr User Submitted Posts allows Stored XSS.This is… |
CVE-2023-49838 | Medium | 4.3 | 2024-03-26 | Cross-Site Request Forgery (CSRF) vulnerability in KlbTheme Clotya theme, KlbTheme Cosmetsy theme, KlbTheme Furnob theme, KlbTheme Bacola theme, KlbTheme Partd… |
CVE-2023-45771 | High | 7.1 | 2024-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Contact Form With Captcha allows Reflected XSS.This issue… |
CVE-2023-33322 | High | 7.1 | 2024-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Etoile Web Design Front End Users allows Reflected XSS.Th… |
CVE-2023-32237 | Medium | 5.4 | 2024-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem (Elementor), CodexThemes TheGem (WPBak… |
CVE-2023-23991 | High | 7.6 | 2024-03-26 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPdevelop / Oplugins Booking Calendar allows SQL Injectio… |
CVE-2023-6175 | High | 7.8 | 2024-03-26 | NetScreen file parser crash in Wireshark 4.0.0 to 4.0.10 and 3.6.0 to 3.6.18 allows denial of service via crafted capture file |
CVE-2023-51416 | Medium | 6.5 | 2024-03-26 | Cross-Site Request Forgery (CSRF) vulnerability in EnvialoSimple EnvíaloSimple.This issue affects EnvíaloSimple: from n/a through 2.2. |
CVE-2023-49839 | High | 7.1 | 2024-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KlbTheme Cosmetsy theme (core plugin), KlbTheme Partdo th… |
CVE-2023-7232 | Medium | 5.3 | 2024-03-26 | The Backup and Restore WordPress WordPress plugin through 1.45 does not protect some log files containing sensitive information such as site configuration etc… |
CVE-2023-47430 | High | 7.5 | 2024-03-25 | Stack-buffer-overflow vulnerability in ReadyMedia (MiniDLNA) v1.3.3 allows attackers to cause a denial of service via via the SendContainer() function at tivo_… |
CVE-2023-48296 | Medium | 4.3 | 2024-03-25 | OroPlatform is a PHP Business Application Platform (BAP). Navigation history, most viewed and favorite navigation items are returned to storefront user in JSO… |
CVE-2023-45824 | Medium | 4.3 | 2024-03-25 | OroPlatform is a PHP Business Application Platform (BAP). A logged in user can access page state data of pinned pages of other users by pageId hash. This vuln… |
CVE-2023-27608 | Medium | 6.5 | 2024-03-25 | Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce.This issue affects Points and Rewards for WooCommerce: from n/a through 1.5… |
CVE-2023-25039 | Medium | 4.3 | 2024-03-25 | Missing Authorization vulnerability in CodePeople Google Maps CP.This issue affects Google Maps CP: from n/a through 1.0.43. |
CVE-2023-22699 | Medium | 5.4 | 2024-03-25 | Missing Authorization vulnerability in MainWP MainWP Wordfence Extension.This issue affects MainWP Wordfence Extension: from n/a through 4.0.7. |
CVE-2023-37886 | Medium | 5.4 | 2024-03-25 | Missing Authorization vulnerability in InspiryThemes RealHomes.This issue affects RealHomes: from n/a through 4.0.2. |
CVE-2023-37885 | Medium | 4.3 | 2024-03-25 | Missing Authorization vulnerability in InspiryThemes RealHomes.This issue affects RealHomes: from n/a through 4.0.2. |
CVE-2023-33923 | Medium | 4.3 | 2024-03-25 | Missing Authorization vulnerability in HashThemes Viral News, HashThemes Viral, HashThemes HashOne.This issue affects Viral News: from n/a through 1.4.5; Viral… |
CVE-2023-30480 | Medium | 4.3 | 2024-03-25 | Missing Authorization vulnerability in Sparkle WP Educenter.This issue affects Educenter: from n/a through 1.5.5. |
CVE-2023-5685 | High | 7.5 | 2024-03-22 | A flaw was found in XNIO. The XNIO NotifierState that can cause a Stack Overflow Exception when the chain of notifier states becomes problematically large can… |
CVE-2023-4063 | Medium | 5.3 | 2024-03-22 | Certain HP OfficeJet Pro printers are potentially vulnerable to a Denial of Service when using an improper eSCL URL GET request. |
CVE-2023-23349 | Low | 2.2 | 2024-03-22 | Kaspersky has fixed a security issue in Kaspersky Password Manager (KPM) for Windows that allowed a local user to recover the auto-filled credentials from a me… |
CVE-2023-41099 | High | 7.8 | 2024-03-22 | In the Windows installer in Atos Eviden CardOS API before 5.5.5.2811, Local Privilege Escalation can occur.(from a regular user to SYSTEM). |
CVE-2023-42954 | Medium | 4.9 | 2024-03-21 | A privilege escalation issue existed in FileMaker Server, potentially exposing sensitive information to front-end websites when signed in to the Admin Console… |
CVE-2023-49837 | Medium | 6.5 | 2024-03-21 | Uncontrolled Resource Consumption vulnerability in David Artiss Code Embed.This issue affects Code Embed: from n/a through 2.3.6. |
CVE-2023-47715 | Medium | 4.3 | 2024-03-21 | IBM Storage Protect Plus Server 10.1.0 through 10.1.16 could allow an authenticated user with read-only permissions to add or delete entries from an existing H… |
CVE-2023-52620 | High | 7.8 | 2024-03-21 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: disallow timeout for anonymous sets Never used from userspace, disa… |
CVE-2023-48903 | Medium | 6.1 | 2024-03-21 | Stored Cross-Site Scripting (XSS) vulnerability in tramyardg autoexpress 1.3.0, allows remote unauthenticated attackers to inject arbitrary web script or HTML… |
CVE-2023-48902 | Critical | 9.8 | 2024-03-21 | An issue was discovered in tramyardg autoexpress version 1.3.0, allows unauthenticated remote attackers to escalate privileges, update car data, delete vehicle… |
CVE-2023-48901 | Critical | 9.8 | 2024-03-21 | A SQL injection vulnerability in tramyardg Autoexpress version 1.3.0, allows remote unauthenticated attackers to execute arbitrary SQL commands via the paramet… |
CVE-2023-6500 | Medium | 6.4 | 2024-03-21 | The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortcode in all versions up to, and including… |
CVE-2023-49985 | Medium | 6.5 | 2024-03-21 | A cross-site scripting (XSS) vulnerability in the component /management/class of School Fees Management System v1.0 allows attackers to execute arbitrary web s… |
CVE-2023-49984 | Medium | 6.1 | 2024-03-21 | A cross-site scripting (XSS) vulnerability in the component /management/settings of School Fees Management System v1.0 allows attackers to execute arbitrary we… |