2023 CVEs (page 49)
Page 49 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-49983 | Medium | 6.8 | 2024-03-21 | A cross-site scripting (XSS) vulnerability in the component /management/class of School Fees Management System v1.0 allows attackers to execute arbitrary web s… |
CVE-2023-49982 | High | 8.8 | 2024-03-21 | Broken access control in the component /admin/management/users of School Fees Management System v1.0 allows attackers to escalate privileges and perform Admini… |
CVE-2023-49981 | High | 7.5 | 2024-03-21 | A directory listing vulnerability in School Fees Management System v1.0 allows attackers to list directories and sensitive files within the application without… |
CVE-2023-49980 | High | 7.5 | 2024-03-21 | A directory listing vulnerability in Best Student Result Management System v1.0 allows attackers to list directories and sensitive files within the application… |
CVE-2023-49979 | High | 7.5 | 2024-03-21 | A directory listing vulnerability in Customer Support System v1 allows attackers to list directories and sensitive files within the application without requiri… |
CVE-2023-49978 | High | 8.8 | 2024-03-21 | Incorrect access control in Customer Support System v1 allows non-administrator users to access administrative pages and execute actions reserved for administr… |
CVE-2023-38825 | Medium | 6.5 | 2024-03-21 | SQL injection vulnerability in Vanderbilt REDCap before v.13.8.0 allows a remote attacker to obtain sensitive information via the password reset mechanism in M… |
CVE-2023-35899 | High | 7.0 | 2024-03-21 | IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is potentially… |
CVE-2023-45177 | Medium | 5.3 | 2024-03-20 | IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS and 9.3 CD is vulnerable to a denial-of-service attack due to an error within the MQ clustering logic. IBM X-Force I… |
CVE-2023-51445 | Medium | 4.8 | 2024-03-20 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting (XSS) vulnerabil… |
CVE-2023-50967 | High | 7.5 | 2024-03-20 | latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value. |
CVE-2023-51444 | High | 7.2 | 2024-03-20 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. An arbitrary file upload vulnerability exists… |
CVE-2023-41877 | High | 7.2 | 2024-03-20 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A path traversal vulnerability in versions 2.2… |
CVE-2023-41038 | High | 7.5 | 2024-03-20 | Firebird is a relational database. Versions 4.0.0 through 4.0.3 and version 5.0 beta1 are vulnerable to a server crash when a user uses a specific form of SET… |
CVE-2023-35888 | Medium | 5.9 | 2024-03-20 | IBM Security Verify Governance 10.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Trans… |
CVE-2023-52229 | Medium | 6.5 | 2024-03-20 | Missing Authorization vulnerability in Save as PDF plugin by Pdfcrowd Word Replacer Pro.This issue affects Word Replacer Pro: from n/a through 1.0. |
CVE-2023-46841 | Medium | 6.5 | 2024-03-20 | Recent x86 CPUs offer functionality named Control-flow Enforcement Technology (CET). A sub-feature of this are Shadow Stacks (CET-SS). CET-SS is a hardware fe… |
CVE-2023-46840 | Medium | 4.1 | 2024-03-20 | Incorrect placement of a preprocessor directive in source code results in logic that doesn't operate as intended when support for HVM guests is compiled out of… |
CVE-2023-46839 | Medium | 5.3 | 2024-03-20 | PCI devices can make use of a functionality called phantom functions, that when enabled allows the device to generate requests using the IDs of functions that… |
CVE-2023-7246 | Medium | 5.4 | 2024-03-20 | The System Dashboard WordPress plugin before 2.8.10 does not sanitize and escape some parameters, which could allow administrators in multisite WordPress confi… |
CVE-2023-50811 | Medium | 6.5 | 2024-03-19 | An issue discovered in SELESTA Visual Access Manager 4.38.6 allows attackers to modify the “computer” POST parameter related to the ID of a specific reception… |
CVE-2023-44092 | High | 7.6 | 2024-03-19 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Pandora FMS on all allows OS Command Injection. Thi… |
CVE-2023-44091 | High | 7.5 | 2024-03-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection. This ulnerabilit… |
CVE-2023-44090 | Medium | 6.8 | 2024-03-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows CVE-2008-5817. This vulnerabil… |
CVE-2023-42920 | High | 7.8 | 2024-03-19 | Claris International has fixed a dylib hijacking vulnerability in the FileMaker Pro.app and Claris Pro.app versions on macOS. |
CVE-2023-41793 | Medium | 6.7 | 2024-03-19 | : Path Traversal vulnerability in Pandora FMS on all allows Path Traversal. This vulnerability allowed changing directories and creating files and downloading… |
CVE-2023-6597 | High | 7.8 | 2024-03-19 | An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.T… |
CVE-2023-32260 | Medium | 6.5 | 2024-03-19 | Misinterpretation of Input vulnerability in OpenText™ Service Management Automation X (SMAX), OpenText™ Asset Management X (AMX), and OpenText™ Hybrid Cloud Ma… |
CVE-2023-32259 | Medium | 6.5 | 2024-03-19 | Insufficient Granularity of Access Control vulnerability in OpenText™ Service Management Automation X (SMAX), OpenText™ Asset Management X (AMX) allows Exploit… |
CVE-2023-50966 | Medium | 5.3 | 2024-03-19 | erlang-jose (aka JOSE for Erlang and Elixir) through 1.11.6 allow attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) va… |
CVE-2023-40279 | High | 7.5 | 2024-03-19 | An issue was discovered in OpenClinic GA 5.247.01. An attacker can perform a directory path traversal via the Page parameter in a GET request to main.do. |
CVE-2023-5388 | Medium | 6.5 | 2024-03-19 | NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the private data… |
CVE-2023-40278 | High | 7.5 | 2024-03-19 | An issue was discovered in OpenClinic GA 5.247.01. An Information Disclosure vulnerability has been identified in the printAppointmentPdf.jsp component of Open… |
CVE-2023-40280 | High | 7.5 | 2024-03-19 | An issue was discovered in OpenClinic GA 5.247.01. An attacker can perform a directory path traversal via the Page parameter in a GET request to popup.jsp. |
CVE-2023-40277 | Medium | 6.1 | 2024-03-19 | An issue was discovered in OpenClinic GA 5.247.01. A Reflected Cross-Site Scripting (XSS) vulnerability has been discovered in the login.jsp message parameter. |
CVE-2023-40276 | Critical | 9.1 | 2024-03-19 | An issue was discovered in OpenClinic GA 5.247.01. An Unauthenticated File Download vulnerability has been discovered in pharmacy/exportFile.jsp. |
CVE-2023-40275 | Critical | 9.1 | 2024-03-19 | An issue was discovered in OpenClinic GA 5.247.01. It allows retrieval of patient lists via queries such as findFirstname= to _common/search/searchByAjax/patie… |
CVE-2023-7236 | Medium | 4.7 | 2024-03-18 | The Backup Bolt WordPress plugin through 1.3.0 is vulnerable to Information Exposure via the unprotected access of debug logs. This makes it possible for unaut… |
CVE-2023-7085 | Medium | 5.4 | 2024-03-18 | The Scalable Vector Graphics (SVG) WordPress plugin through 3.4 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to u… |
CVE-2023-6821 | Medium | 6.5 | 2024-03-18 | The Error Log Viewer by BestWebSoft WordPress plugin before 1.1.3 is affected by a Directory Listing issue, allowing users to read and download PHP logs withou… |
CVE-2023-41334 | High | 8.4 | 2024-03-18 | Astropy is a project for astronomy in Python that fosters interoperability between Python astronomy packages. Version 5.3.2 of the Astropy core package is vuln… |
CVE-2023-7250 | Medium | 5.3 | 2024-03-18 | A flaw was found in iperf, a utility for testing network performance using TCP, UDP, and SCTP. A malicious or malfunctioning client can send less than the expe… |
CVE-2023-52619 | Medium | 5.5 | 2024-03-18 | In the Linux kernel, the following vulnerability has been resolved: pstore/ram: Fix crash when setting number of cpus to an odd number When the number of cpu… |
CVE-2023-52618 | Medium | 5.3 | 2024-03-18 | In the Linux kernel, the following vulnerability has been resolved: block/rnbd-srv: Check for unlikely string overflow Since "dev_search_path" can technicall… |
CVE-2023-52617 | Medium | 4.4 | 2024-03-18 | In the Linux kernel, the following vulnerability has been resolved: PCI: switchtec: Fix stdev_release() crash after surprise hot remove A PCI device hot remo… |
CVE-2023-52616 | High | 7.8 | 2024-03-18 | In the Linux kernel, the following vulnerability has been resolved: crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init When the mpi_ec_ctx struct… |
CVE-2023-52615 | Medium | 5.5 | 2024-03-18 | In the Linux kernel, the following vulnerability has been resolved: hwrng: core - Fix page fault dead lock on mmap-ed hwrng There is a dead-lock in the hwrng… |
CVE-2023-52614 | High | 7.8 | 2024-03-18 | In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: Fix buffer overflow in trans_stat_show Fix buffer overflow in trans_stat_sh… |
CVE-2023-52613 | Medium | 5.5 | 2024-03-18 | In the Linux kernel, the following vulnerability has been resolved: drivers/thermal/loongson2_thermal: Fix incorrect PTR_ERR() judgment PTR_ERR() returns -EN… |
CVE-2023-52612 | High | 7.8 | 2024-03-18 | In the Linux kernel, the following vulnerability has been resolved: crypto: scomp - fix req->dst buffer overflow The req->dst buffer size should be checked b… |
CVE-2023-52611 | Medium | 5.5 | 2024-03-18 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: sdio: Honor the host max_req_size in the RX path Lukas reports skb_over_pani… |
CVE-2023-52610 | High | 7.5 | 2024-03-18 | In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix skb leak and crash on ooo frags act_ct adds skb->users before defr… |
CVE-2023-52609 | Medium | 4.7 | 2024-03-18 | In the Linux kernel, the following vulnerability has been resolved: binder: fix race between mmput() and do_exit() Task A calls binder_update_page_range() to… |
CVE-2023-52159 | High | 7.5 | 2024-03-18 | A stack-based buffer overflow vulnerability in gross 0.9.3 through 1.x before 1.0.4 allows remote attackers to trigger a denial of service (grossd daemon crash… |
CVE-2023-40747 | High | 7.5 | 2024-03-18 | Directory traversal vulnerability exists in A.K.I Software's PMailServer/PMailServer2 products' CGIs included in Internal Simple Webserver. If this vulnerabili… |
CVE-2023-40160 | Low | 3.7 | 2024-03-18 | Directory traversal vulnerability exists in Mailing List Search CGI (pmmls.exe) included in A.K.I Software's PMailServer/PMailServer2 products. If this vulnera… |
CVE-2023-39933 | Medium | 4.3 | 2024-03-18 | Insufficient verification vulnerability exists in Broadcast Mail CGI (pmc.exe) included in A.K.I Software's PMailServer/PMailServer2 products. If this vulnerab… |
CVE-2023-39223 | Medium | 5.4 | 2024-03-18 | Stored cross-site scripting vulnerability exists in CGIs included in A.K.I Software's PMailServer/PMailServer2 products. If this vulnerability is exploited, an… |
CVE-2023-36483 | Medium | 6.5 | 2024-03-16 | Authorization bypass can be achieved by session ID prediction in MASmobile Classic Android version 1.16.18 and earlier and MASmobile Classic iOS version 1.7… |
CVE-2023-6525 | Medium | 5.5 | 2024-03-16 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the progress bar element attributes in all versions up t… |
CVE-2023-51487 | Medium | 5.4 | 2024-03-16 | Cross-Site Request Forgery (CSRF) vulnerability in ARI Soft ARI Stream Quiz.This issue affects ARI Stream Quiz: from n/a through 1.2.32. |
CVE-2023-51486 | Medium | 5.4 | 2024-03-16 | Cross-Site Request Forgery (CSRF) vulnerability in RedNao WooCommerce PDF Invoice Builder.This issue affects WooCommerce PDF Invoice Builder: from n/a through… |
CVE-2023-51474 | High | 8.8 | 2024-03-16 | Cross-Site Request Forgery (CSRF) vulnerability in Pixelemu TerraClassifieds.This issue affects TerraClassifieds: from n/a through 2.0.3. |
CVE-2023-51521 | Medium | 5.4 | 2024-03-16 | Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.1.18. |
CVE-2023-51512 | Medium | 4.3 | 2024-03-16 | Cross Site Request Forgery (CSRF) vulnerability in WBW Product Table by WBW.This issue affects Product Table by WBW: from n/a through 1.8.6. |
CVE-2023-51510 | Medium | 4.3 | 2024-03-16 | Cross-Site Request Forgery (CSRF) vulnerability in Atlas Gondal Export Media URLs.This issue affects Export Media URLs: from n/a through 1.0. |
CVE-2023-51491 | Medium | 5.4 | 2024-03-16 | Cross-Site Request Forgery (CSRF) vulnerability in Averta Depicter Slider.This issue affects Depicter Slider: from n/a through 2.0.6. |
CVE-2023-51489 | Medium | 5.4 | 2024-03-16 | Cross-Site Request Forgery (CSRF) vulnerability in Automattic, Inc. Crowdsignal Dashboard – Polls, Surveys & more.This issue affects Crowdsignal Dashboard – Po… |
CVE-2023-51407 | Medium | 4.3 | 2024-03-16 | Cross-Site Request Forgery (CSRF) vulnerability in Rocket Elements Split Test For Elementor.This issue affects Split Test For Elementor: from n/a through 1.6.9. |
CVE-2023-7248 | Medium | 5.0 | 2024-03-15 | Certain functionality in OpenText Vertica Management console might be prone to bypass via crafted requests. The vulnerability would affect one of Vertica’s… |
CVE-2023-7060 | High | 8.6 | 2024-03-15 | Zephyr OS IP packet handling does not properly drop IP packets arriving on an external interface with a source address equal to 127.0.01 or the destination add… |
CVE-2023-51699 | Medium | 4.0 | 2024-03-15 | Fluid is an open source Kubernetes-native Distributed Dataset Orchestrator and Accelerator for data-intensive applications. An OS command injection vulnerabili… |
CVE-2023-7017 | Critical | 9.8 | 2024-03-15 | Sciener locks' firmware update mechanism do not authenticate or validate firmware updates if passed to the lock through the Bluetooth Low Energy service. A cha… |
CVE-2023-7009 | High | 8.2 | 2024-03-15 | Some Sciener-based locks support plaintext message processing over Bluetooth Low Energy, allowing unencrypted malicious commands to be passed to the lock. Thes… |
CVE-2023-7007 | High | 8.2 | 2024-03-15 | Sciener server does not validate connection requests from the GatewayG2, allowing an impersonation attack that provides the attacker the unlockKey field. |
CVE-2023-7006 | Critical | 9.1 | 2024-03-15 | The unlockKey character in a lock using Sciener firmware can be brute forced through repeated challenge requests, compromising the locks integrity. |
CVE-2023-7004 | Medium | 6.5 | 2024-03-15 | The TTLock App does not employ proper verification procedures to ensure that it is communicating with the expected device, allowing for connection to a device… |
CVE-2023-7003 | Medium | 6.8 | 2024-03-15 | The AES key utilized in the pairing process between a lock using Sciener firmware and a wireless keypad is not unique, and can be reused to compromise other lo… |
CVE-2023-6960 | High | 7.5 | 2024-03-15 | TTLock App virtual keys and settings are only deleted client side, and if preserved, can access the lock after intended deletion. |
CVE-2023-47699 | Medium | 6.1 | 2024-03-15 | IBM Sterling Secure Proxy 6.0.3 and 6.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2023-47147 | Medium | 5.9 | 2024-03-15 | IBM Sterling Secure Proxy 6.0.3 and 6.1.0 could allow an attacker to overwrite a log message under specific conditions. IBM X-Force ID: 270598. |
CVE-2023-46181 | Medium | 4.0 | 2024-03-15 | IBM Sterling Secure Proxy 6.0.3 and 6.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 269686. |
CVE-2023-51522 | Medium | 4.3 | 2024-03-15 | Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Paid Member Subscriptions.This issue affects Paid Member Subscriptions: from n/a through 2.10.4. |
CVE-2023-51369 | Medium | 4.3 | 2024-03-15 | Cross-Site Request Forgery (CSRF) vulnerability in SysBasics Customize My Account for WooCommerce.This issue affects Customize My Account for WooCommerce: from… |
CVE-2023-50898 | Medium | 5.4 | 2024-03-15 | Missing Authorization vulnerability in sirv.Com Sirv.This issue affects Sirv: from n/a through 7.1.2. |
CVE-2023-50886 | Medium | 4.3 | 2024-03-15 | Cross-Site Request Forgery (CSRF), Incorrect Authorization vulnerability in wpWax Legal Pages.This issue affects Legal Pages: from n/a through 1.3.7. |
CVE-2023-47162 | Medium | 6.1 | 2024-03-15 | IBM Sterling Secure Proxy 6.0.3 and 6.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2023-46182 | Medium | 5.4 | 2024-03-15 | IBM Sterling Secure Proxy 6.0.3 and 6.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2023-46179 | Medium | 4.3 | 2024-03-15 | IBM Sterling Secure Proxy 6.0.3 and 6.1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie… |
CVE-2023-51525 | Medium | 4.3 | 2024-03-15 | Cross-Site Request Forgery (CSRF) vulnerability in Veribo, Roland Murg WP Simple Booking Calendar.This issue affects WP Simple Booking Calendar: from n/a throu… |
CVE-2023-50861 | Medium | 4.3 | 2024-03-15 | Cross-Site Request Forgery (CSRF) vulnerability in realmag777 HUSKY – Products Filter for WooCommerce (formerly WOOF).This issue affects HUSKY – Products Filte… |
CVE-2023-6725 | Medium | 5.5 | 2024-03-15 | An access-control flaw was found in the OpenStack Designate component where private configuration information including access keys to BIND were improperly mad… |
CVE-2023-50677 | High | 8.8 | 2024-03-14 | An issue in NETGEAR-DGND4000 v.1.1.00.15_1.00.15 allows a remote attacker to escalate privileges via the next_file parameter to the /setup.cgi component. |
CVE-2023-42286 | Critical | 9.8 | 2024-03-14 | There is a PHP file inclusion vulnerability in the template configuration of eyoucms v1.6.4, allowing attackers to execute code or system commands through a ca… |
CVE-2023-42938 | High | 7.8 | 2024-03-14 | A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.13.1 for Windows. A local attacker may be able to elevate their privileges. |
CVE-2023-43490 | Medium | 5.3 | 2024-03-14 | Incorrect calculation in microcode keying mechanism for some Intel(R) Xeon(R) D Processors with Intel(R) SGX may allow a privileged user to potentially enable… |
CVE-2023-39368 | Medium | 6.5 | 2024-03-14 | Protection mechanism failure of bus lock regulator for some Intel(R) Processors may allow an unauthenticated user to potentially enable denial of service via n… |
CVE-2023-38575 | Medium | 5.5 | 2024-03-14 | Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information… |
CVE-2023-35191 | Medium | 6.8 | 2024-03-14 | Uncontrolled resource consumption for some Intel(R) SPS firmware versions may allow a privileged user to potentially enable denial of service via network acces… |
CVE-2023-32666 | High | 7.2 | 2024-03-14 | On-chip debug and test interface with improper access control in some 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or Intel(R) TDX may al… |