2023 CVEs (page 49)
Page 49 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-52159 | High | 7.5 | 2024-03-18 | A stack-based buffer overflow vulnerability in gross 0.9.3 through 1.x before 1.0.4 allows remote attackers to trigger a denial of service (grossd daemon crash… |
CVE-2023-40747 | High | 7.5 | 2024-03-18 | Directory traversal vulnerability exists in A.K.I Software's PMailServer/PMailServer2 products' CGIs included in Internal Simple Webserver. If this vulnerabili… |
CVE-2023-40160 | Low | 3.7 | 2024-03-18 | Directory traversal vulnerability exists in Mailing List Search CGI (pmmls.exe) included in A.K.I Software's PMailServer/PMailServer2 products. If this vulnera… |
CVE-2023-39933 | Medium | 4.3 | 2024-03-18 | Insufficient verification vulnerability exists in Broadcast Mail CGI (pmc.exe) included in A.K.I Software's PMailServer/PMailServer2 products. If this vulnerab… |
CVE-2023-39223 | Medium | 5.4 | 2024-03-18 | Stored cross-site scripting vulnerability exists in CGIs included in A.K.I Software's PMailServer/PMailServer2 products. If this vulnerability is exploited, an… |
CVE-2023-36483 | Medium | 6.5 | 2024-03-16 | Authorization bypass can be achieved by session ID prediction in MASmobile Classic Android version 1.16.18 and earlier and MASmobile Classic iOS version 1.7… |
CVE-2023-6525 | Medium | 5.5 | 2024-03-16 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the progress bar element attributes in all versions up t… |
CVE-2023-51487 | Medium | 5.4 | 2024-03-16 | Cross-Site Request Forgery (CSRF) vulnerability in ARI Soft ARI Stream Quiz.This issue affects ARI Stream Quiz: from n/a through 1.2.32. |
CVE-2023-51486 | Medium | 5.4 | 2024-03-16 | Cross-Site Request Forgery (CSRF) vulnerability in RedNao WooCommerce PDF Invoice Builder.This issue affects WooCommerce PDF Invoice Builder: from n/a through… |
CVE-2023-51474 | High | 8.8 | 2024-03-16 | Cross-Site Request Forgery (CSRF) vulnerability in Pixelemu TerraClassifieds.This issue affects TerraClassifieds: from n/a through 2.0.3. |
CVE-2023-51521 | Medium | 5.4 | 2024-03-16 | Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.1.18. |
CVE-2023-51512 | Medium | 4.3 | 2024-03-16 | Cross Site Request Forgery (CSRF) vulnerability in WBW Product Table by WBW.This issue affects Product Table by WBW: from n/a through 1.8.6. |
CVE-2023-51510 | Medium | 4.3 | 2024-03-16 | Cross-Site Request Forgery (CSRF) vulnerability in Atlas Gondal Export Media URLs.This issue affects Export Media URLs: from n/a through 1.0. |
CVE-2023-51491 | Medium | 5.4 | 2024-03-16 | Cross-Site Request Forgery (CSRF) vulnerability in Averta Depicter Slider.This issue affects Depicter Slider: from n/a through 2.0.6. |
CVE-2023-51489 | Medium | 5.4 | 2024-03-16 | Cross-Site Request Forgery (CSRF) vulnerability in Automattic, Inc. Crowdsignal Dashboard – Polls, Surveys & more.This issue affects Crowdsignal Dashboard – Po… |
CVE-2023-51407 | Medium | 4.3 | 2024-03-16 | Cross-Site Request Forgery (CSRF) vulnerability in Rocket Elements Split Test For Elementor.This issue affects Split Test For Elementor: from n/a through 1.6.9. |
CVE-2023-7248 | Medium | 5.0 | 2024-03-15 | Certain functionality in OpenText Vertica Management console might be prone to bypass via crafted requests. The vulnerability would affect one of Vertica’s… |
CVE-2023-7060 | High | 8.6 | 2024-03-15 | Zephyr OS IP packet handling does not properly drop IP packets arriving on an external interface with a source address equal to 127.0.01 or the destination add… |
CVE-2023-51699 | Medium | 4.0 | 2024-03-15 | Fluid is an open source Kubernetes-native Distributed Dataset Orchestrator and Accelerator for data-intensive applications. An OS command injection vulnerabili… |
CVE-2023-7017 | Critical | 9.8 | 2024-03-15 | Sciener locks' firmware update mechanism do not authenticate or validate firmware updates if passed to the lock through the Bluetooth Low Energy service. A cha… |
CVE-2023-7009 | High | 8.2 | 2024-03-15 | Some Sciener-based locks support plaintext message processing over Bluetooth Low Energy, allowing unencrypted malicious commands to be passed to the lock. Thes… |
CVE-2023-7007 | High | 8.2 | 2024-03-15 | Sciener server does not validate connection requests from the GatewayG2, allowing an impersonation attack that provides the attacker the unlockKey field. |
CVE-2023-7006 | Critical | 9.1 | 2024-03-15 | The unlockKey character in a lock using Sciener firmware can be brute forced through repeated challenge requests, compromising the locks integrity. |
CVE-2023-7004 | Medium | 6.5 | 2024-03-15 | The TTLock App does not employ proper verification procedures to ensure that it is communicating with the expected device, allowing for connection to a device… |
CVE-2023-7003 | Medium | 6.8 | 2024-03-15 | The AES key utilized in the pairing process between a lock using Sciener firmware and a wireless keypad is not unique, and can be reused to compromise other lo… |
CVE-2023-6960 | High | 7.5 | 2024-03-15 | TTLock App virtual keys and settings are only deleted client side, and if preserved, can access the lock after intended deletion. |
CVE-2023-47699 | Medium | 6.1 | 2024-03-15 | IBM Sterling Secure Proxy 6.0.3 and 6.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2023-47147 | Medium | 5.9 | 2024-03-15 | IBM Sterling Secure Proxy 6.0.3 and 6.1.0 could allow an attacker to overwrite a log message under specific conditions. IBM X-Force ID: 270598. |
CVE-2023-46181 | Medium | 4.0 | 2024-03-15 | IBM Sterling Secure Proxy 6.0.3 and 6.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 269686. |
CVE-2023-51522 | Medium | 4.3 | 2024-03-15 | Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Paid Member Subscriptions.This issue affects Paid Member Subscriptions: from n/a through 2.10.4. |
CVE-2023-51369 | Medium | 4.3 | 2024-03-15 | Cross-Site Request Forgery (CSRF) vulnerability in SysBasics Customize My Account for WooCommerce.This issue affects Customize My Account for WooCommerce: from… |
CVE-2023-50898 | Medium | 5.4 | 2024-03-15 | Missing Authorization vulnerability in sirv.Com Sirv.This issue affects Sirv: from n/a through 7.1.2. |
CVE-2023-50886 | Medium | 4.3 | 2024-03-15 | Cross-Site Request Forgery (CSRF), Incorrect Authorization vulnerability in wpWax Legal Pages.This issue affects Legal Pages: from n/a through 1.3.7. |
CVE-2023-47162 | Medium | 6.1 | 2024-03-15 | IBM Sterling Secure Proxy 6.0.3 and 6.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2023-46182 | Medium | 5.4 | 2024-03-15 | IBM Sterling Secure Proxy 6.0.3 and 6.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2023-46179 | Medium | 4.3 | 2024-03-15 | IBM Sterling Secure Proxy 6.0.3 and 6.1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie… |
CVE-2023-51525 | Medium | 4.3 | 2024-03-15 | Cross-Site Request Forgery (CSRF) vulnerability in Veribo, Roland Murg WP Simple Booking Calendar.This issue affects WP Simple Booking Calendar: from n/a throu… |
CVE-2023-50861 | Medium | 4.3 | 2024-03-15 | Cross-Site Request Forgery (CSRF) vulnerability in realmag777 HUSKY – Products Filter for WooCommerce (formerly WOOF).This issue affects HUSKY – Products Filte… |
CVE-2023-6725 | Medium | 5.5 | 2024-03-15 | An access-control flaw was found in the OpenStack Designate component where private configuration information including access keys to BIND were improperly mad… |
CVE-2023-50677 | High | 8.8 | 2024-03-14 | An issue in NETGEAR-DGND4000 v.1.1.00.15_1.00.15 allows a remote attacker to escalate privileges via the next_file parameter to the /setup.cgi component. |
CVE-2023-42286 | Critical | 9.8 | 2024-03-14 | There is a PHP file inclusion vulnerability in the template configuration of eyoucms v1.6.4, allowing attackers to execute code or system commands through a ca… |
CVE-2023-42938 | High | 7.8 | 2024-03-14 | A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.13.1 for Windows. A local attacker may be able to elevate their privileges. |
CVE-2023-43490 | Medium | 5.3 | 2024-03-14 | Incorrect calculation in microcode keying mechanism for some Intel(R) Xeon(R) D Processors with Intel(R) SGX may allow a privileged user to potentially enable… |
CVE-2023-39368 | Medium | 6.5 | 2024-03-14 | Protection mechanism failure of bus lock regulator for some Intel(R) Processors may allow an unauthenticated user to potentially enable denial of service via n… |
CVE-2023-38575 | Medium | 5.5 | 2024-03-14 | Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information… |
CVE-2023-35191 | Medium | 6.8 | 2024-03-14 | Uncontrolled resource consumption for some Intel(R) SPS firmware versions may allow a privileged user to potentially enable denial of service via network acces… |
CVE-2023-32666 | High | 7.2 | 2024-03-14 | On-chip debug and test interface with improper access control in some 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or Intel(R) TDX may al… |
CVE-2023-32633 | Medium | 6.7 | 2024-03-14 | Improper input validation in the Intel(R) CSME installer software before version 2328.5.5.0 may allow an authenticated user to potentially enable escalation of… |
CVE-2023-32282 | High | 7.2 | 2024-03-14 | Race condition in BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2023-28746 | Medium | 6.5 | 2024-03-14 | Information exposure through microarchitectural state after transient execution from some register files for some Intel(R) Atom(R) Processors may allow an auth… |
CVE-2023-28389 | Medium | 6.7 | 2024-03-14 | Incorrect default permissions in some Intel(R) CSME installer software before version 2328.5.5.0 may allow an authenticated user to potentially enable escalati… |
CVE-2023-27502 | Low | 3.3 | 2024-03-14 | Insertion of sensitive information into log file for some Intel(R) Local Manageability Service software before version 2316.5.1.2 may allow an authenticated us… |
CVE-2023-22655 | Medium | 6.1 | 2024-03-14 | Protection mechanism failure in some 3rd and 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or Intel(R) TDX may allow a privileged user to… |
CVE-2023-50168 | High | 7.7 | 2024-03-14 | Pega Platform from 6.x to 8.8.4 is affected by an XXE issue with PDF Generation. |
CVE-2023-38536 | Medium | 6.4 | 2024-03-13 | HTML injection in OpenText™ Exceed Turbo X affecting version 12.5.1. The vulnerability could result in Cross site scripting. |
CVE-2023-38535 | Medium | 4.7 | 2024-03-13 | Use of Hard-coded Cryptographic Key vulnerability in OpenText™ Exceed Turbo X affecting versions 12.5.1 and 12.5.2. The vulnerability could compromise the cryp… |
CVE-2023-38534 | High | 8.6 | 2024-03-13 | Improper authentication vulnerability in OpenText™ Exceed Turbo X affecting versions 12.5.0 and 12.5.1. The vulnerability could allow disclosure of restricted… |
CVE-2023-50726 | Medium | 6.4 | 2024-03-13 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. "Local sync" is an Argo CD feature that allows developers to temporarily override an… |
CVE-2023-41505 | Critical | 9.8 | 2024-03-13 | An arbitrary file upload vulnerability in the Add Student's Profile Picture function of Student Enrollment In PHP v1.0 allows attackers to execute arbitrary co… |
CVE-2023-41504 | High | 8.8 | 2024-03-13 | SQL Injection vulnerability in Student Enrollment In PHP 1.0 allows attackers to run arbitrary code via the Student Search function. |
CVE-2023-36238 | Medium | 6.5 | 2024-03-13 | Insecure Direct Object Reference (IDOR) in Bagisto v.1.5.1 allows an attacker to obtain sensitive information via the invoice ID parameter. |
CVE-2023-7015 | Medium | 6.1 | 2024-03-13 | The File Manager Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tb' parameter in all versions up to, and including, 8.3.4 du… |
CVE-2023-6969 | Medium | 4.3 | 2024-03-13 | The User Shortcodes Plus plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.2 via the user_meta s… |
CVE-2023-6957 | Medium | 4.9 | 2024-03-13 | The Fluent Forms plugin for WordPress by Fluent Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5… |
CVE-2023-6954 | Medium | 6.4 | 2024-03-13 | The Download Manager Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including… |
CVE-2023-6880 | Medium | 6.4 | 2024-03-13 | The Visual Composer Website Builder, Landing Page Builder, Custom Theme Builder, Maintenance Mode & Coming Soon Pages plugin for WordPress is vulnerable to Sto… |
CVE-2023-6825 | Critical | 9.9 | 2024-03-13 | The File Manager and File Manager Pro plugins for WordPress are vulnerable to Directory Traversal in versions up to, and including version 7.2.1 (free version)… |
CVE-2023-6809 | Medium | 6.4 | 2024-03-13 | The Custom fields shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cf shortcode in all versions up to, and includin… |
CVE-2023-6785 | Medium | 5.3 | 2024-03-13 | The Download Manager plugin for WordPress is vulnerable to unauthorized file download of files added via the plugin in all versions up to, and including, 3.2.8… |
CVE-2023-5663 | High | 8.8 | 2024-03-13 | The News Announcement Scroll plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.0.0 due to insu… |
CVE-2023-52608 | Medium | 4.7 | 2024-03-13 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Check mailbox/SMT channel for consistency On reception of a completio… |
CVE-2023-43043 | Medium | 5.1 | 2024-03-13 | IBM Maximo Application Suite - Maximo Mobile for EAM 8.10 and 8.11 could disclose sensitive information to a local user. IBM X-Force ID: 266875. |
CVE-2023-38723 | Medium | 6.4 | 2024-03-13 | IBM Maximo Application Suite 7.6.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the We… |
CVE-2023-32335 | Low | 3.7 | 2024-03-13 | IBM Maximo Application Suite 8.10, 8.11 and IBM Maximo Asset Management 7.6.1.3 stores sensitive information in URL parameters. This may lead to information di… |
CVE-2023-28517 | Medium | 5.4 | 2024-03-13 | IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaS… |
CVE-2023-4839 | Medium | 4.4 | 2024-03-13 | The WP Go Maps for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 9.0.32 due to insufficient input… |
CVE-2023-7072 | High | 7.5 | 2024-03-12 | The Post Grid Combo – 36+ Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.68 vi… |
CVE-2023-43279 | Medium | 6.5 | 2024-03-12 | Null Pointer Dereference in mask_cidr6 component at cidr.c in Tcpreplay 4.4.4 allows attackers to crash the application via crafted tcprewrite command. |
CVE-2023-43292 | Medium | 6.1 | 2024-03-12 | Cross Site Scripting vulnerability in My Food Recipe Using PHP with Source Code v.1.0 allows a local attacker to execute arbitrary code via a crafted payload t… |
CVE-2023-42308 | Medium | 6.1 | 2024-03-12 | Cross Site Scripting (XSS) vulnerability in Manage Fastrack Subjects in Code-Projects Exam Form Submission 1.0 allows attackers to run arbitrary code via the "… |
CVE-2023-42307 | Medium | 6.1 | 2024-03-12 | Cross Site Scripting (XSS) vulnerability in Code-Projects Exam Form Submission 1.0 allows attackers to run arbitrary code via "Subject Name" and "Subject Code"… |
CVE-2023-5410 | High | 8.2 | 2024-03-12 | A potential security vulnerability has been reported in the system BIOS of certain HP PC products, which might allow memory tampering. HP is releasing mitigati… |
CVE-2023-30968 | Medium | 6.8 | 2024-03-12 | One of Gotham Gaia services was found to be vulnerable to a stored cross-site scripting (XSS) vulnerability that could have allowed an attacker to bypass CSP a… |
CVE-2023-48788 | Critical | 9.8 | 2024-03-12 | A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7… |
CVE-2023-47534 | Critical | 9.6 | 2024-03-12 | A improper neutralization of formula elements in a csv file in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.10, 6.4.0 through 6.4.9… |
CVE-2023-46717 | High | 7.5 | 2024-03-12 | An improper authentication vulnerability [CWE-287] in FortiOS versions 7.4.1 and below, versions 7.2.6 and below, and versions 7.0.12 and below when configured… |
CVE-2023-42790 | High | 8.1 | 2024-03-12 | A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4.0 t… |
CVE-2023-42789 | Critical | 9.8 | 2024-03-12 | A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4.0 through 6… |
CVE-2023-41842 | Medium | 6.7 | 2024-03-12 | A use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged attacker to execute unauthorized code or co… |
CVE-2023-36554 | High | 8.1 | 2024-03-12 | A improper access control in Fortinet FortiManager version 7.4.0, version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.10, version 6.4.0 through 6.4.13, 6.2… |
CVE-2023-45793 | Medium | 5.5 | 2024-03-12 | A vulnerability has been identified in Siveillance Control (All versions >= V2.8 < V3.1.1). The affected product does not properly check the list of access gro… |
CVE-2023-41313 | Critical | 9.8 | 2024-03-12 | The authentication method in Apache Doris versions before 2.0.0 was vulnerable to timing attacks. Users are recommended to upgrade to version 2.0.0 + or 1.2.8… |
CVE-2023-4731 | Medium | 4.3 | 2024-03-12 | The LadiApp plugn for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the init_endpoint() function hooked via 'init' in v… |
CVE-2023-4729 | Medium | 4.3 | 2024-03-12 | The LadiApp plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the publish_lp() function hooked via an AJAX actio… |
CVE-2023-4728 | Medium | 4.3 | 2024-03-12 | The LadiApp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the publish_lp() function hooked via a… |
CVE-2023-4629 | Medium | 4.3 | 2024-03-12 | The LadiApp plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the save_config() function in versions up to, and… |
CVE-2023-4628 | Medium | 4.3 | 2024-03-12 | The LadiApp plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the ladiflow_save_hook() function in versions up t… |
CVE-2023-4627 | Medium | 4.3 | 2024-03-12 | The LadiApp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_config() function in versions… |
CVE-2023-4626 | Medium | 4.3 | 2024-03-12 | The LadiApp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ladiflow_save_hook() function in v… |
CVE-2023-49453 | Medium | 6.1 | 2024-03-12 | Reflected cross-site scripting (XSS) vulnerability in Racktables v0.22.0 and before, allows local attackers to execute arbitrary code and obtain sensitive info… |