2023 CVEs (page 53)
Page 53 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-51529 | Medium | 4.3 | 2024-02-29 | Cross-Site Request Forgery (CSRF) vulnerability in HasThemes HT Mega – Absolute Addons For Elementor.This issue affects HT Mega – Absolute Addons For Elementor… |
CVE-2023-51528 | Medium | 4.3 | 2024-02-29 | Cross-Site Request Forgery (CSRF) vulnerability in Senol Sahin AI Power: Complete AI Pack – Powered by GPT-4.This issue affects AI Power: Complete AI Pack – Po… |
CVE-2023-51802 | Medium | 6.1 | 2024-02-29 | Cross Site Scripting (XSS) vulnerability in the Simple Student Attendance System v.1.0 allows a remote attacker to execute arbitrary code via a crafted payload… |
CVE-2023-51801 | Critical | 9.8 | 2024-02-29 | SQL Injection vulnerability in the Simple Student Attendance System v.1.0 allows a remote attacker to execute arbitrary code via a crafted payload to the id pa… |
CVE-2023-51800 | Medium | 5.4 | 2024-02-29 | Cross Site Scripting (XSS) vulnerability in School Fees Management System v.1.0 allows a remote attacker to execute arbitrary code via a crafted payload to the… |
CVE-2023-38367 | Medium | 6.5 | 2024-02-29 | IBM Cloud Pak Foundational Services Identity Provider (idP) API (IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 2… |
CVE-2023-27545 | Medium | 4.0 | 2024-02-29 | IBM Watson CloudPak for Data Data Stores information disclosure 4.6.0 allows web pages to be stored locally which can be read by another user on the system. I… |
CVE-2023-7207 | Medium | 4.9 | 2024-02-29 | Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE-2015-1197 patches which had caused a regression in --no-absol… |
CVE-2023-7110 | High | 7.3 | 2024-02-29 | A vulnerability, which was classified as critical, has been found in code-projects Library Management System 2.0. This issue affects some unknown processing of… |
CVE-2023-7109 | High | 7.3 | 2024-02-29 | A vulnerability classified as critical was found in code-projects Library Management System 2.0. This vulnerability affects unknown code of the file /admin/log… |
CVE-2023-7108 | Medium | 4.3 | 2024-02-29 | A vulnerability classified as problematic has been found in code-projects E-Commerce Website 1.0. This affects an unknown part of the file user_signup.php. The… |
CVE-2023-7107 | High | 7.3 | 2024-02-29 | A vulnerability was found in code-projects E-Commerce Website 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the f… |
CVE-2023-7106 | Medium | 6.3 | 2024-02-29 | A vulnerability was found in code-projects E-Commerce Website 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2023-7105 | Medium | 4.7 | 2024-02-29 | A vulnerability was found in code-projects E-Commerce Website 1.0. It has been classified as critical. Affected is an unknown function of the file index_search… |
CVE-2023-6923 | Medium | 6.1 | 2024-02-29 | The Matomo Analytics – Ethical Stats. Powerful Insights. plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the idsite parameter in all v… |
CVE-2023-6881 | High | 7.3 | 2024-02-29 | Possible buffer overflow in is_mount_point |
CVE-2023-6806 | Medium | 6.4 | 2024-02-29 | The Starbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Job Settings user profile fields in all versions up to, and including, 3… |
CVE-2023-6565 | Medium | 5.9 | 2024-02-29 | The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.12.3 via the multi-call back… |
CVE-2023-6247 | Medium | 6.5 | 2024-02-29 | The PKCS#7 parser in OpenVPN 3 Core Library versions through 3.8.3 did not properly validate the parsed data, which would result in the application crashing. |
CVE-2023-51835 | Medium | 6.8 | 2024-02-29 | An issue in TRENDnet TEW-822DRE v.1.03B02 allows a local attacker to execute arbitrary code via the parameters ipv4_ping in the /boafrm/formSystemCheck. |
CVE-2023-51779 | High | 7.0 | 2024-02-29 | bt_sock_recvmsg in net/bluetooth/af_bluetooth.c in the Linux kernel through 6.6.8 has a use-after-free because of a bt_sock_ioctl race condition. |
CVE-2023-51775 | Medium | 6.5 | 2024-02-29 | The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value. |
CVE-2023-51774 | High | 8.4 | 2024-02-29 | The json-jwt (aka JSON::JWT) gem 1.16.3 for Ruby sometimes allows bypass of identity checks via a sign/encryption confusion attack. For example, JWE can someti… |
CVE-2023-51773 | Critical | 9.1 | 2024-02-29 | BACnet Stack before 1.3.2 has a decode function APDU buffer over-read in bacapp_decode_application_data in bacapp.c. |
CVE-2023-50658 | High | 7.5 | 2024-02-29 | The jose2go component before 1.6.0 for Go allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value. |
CVE-2023-50437 | High | 8.6 | 2024-02-29 | An issue was discovered in Couchbase Server before 7.2.x before 7.2.4. otpCookie is shown with full admin on pools/default/serverGroups and engageCluster2. |
CVE-2023-50436 | Medium | 5.3 | 2024-02-29 | An issue was discovered in Couchbase Server before 7.2.4. ns_server admin credentials are leaked in encoded form in the diag.log file. The earliest affected ve… |
CVE-2023-49932 | Medium | 5.4 | 2024-02-29 | An issue was discovered in Couchbase Server before 7.2.4. An attacker can bypass SQL++ N1QL cURL host restrictions. |
CVE-2023-49931 | Critical | 9.8 | 2024-02-29 | An issue was discovered in Couchbase Server before 7.2.4. SQL++ cURL calls to /diag/eval are not sufficiently restricted. |
CVE-2023-49930 | Critical | 9.8 | 2024-02-29 | An issue was discovered in Couchbase Server before 7.2.4. cURL calls to /diag/eval are not sufficiently restricted. |
CVE-2023-49337 | Low | 2.4 | 2024-02-29 | Concrete CMS before 9.2.3 allows Stored XSS on the Admin Dashboard via /dashboard/system/basics/name. (8.5 and earlier are unaffected.) |
CVE-2023-48653 | Medium | 4.3 | 2024-02-29 | Concrete CMS before 8.5.14 and 9 before 9.2.3 allows Cross Site Request Forgery (CSRF) via ccm/calendar/dialogs/event/delete/submit. An attacker can force an a… |
CVE-2023-48651 | Medium | 4.3 | 2024-02-29 | Concrete CMS 9 before 9.2.3 is vulnerable to Cross Site Request Forgery (CSRF) at /ccm/system/dialogs/file/delete/1/submit. |
CVE-2023-48650 | Medium | 4.8 | 2024-02-29 | Concrete CMS before 8.5.14 and 9 before 9.2.3 is vulnerable to an admin adding a stored XSS payload via the Layout Preset name. |
CVE-2023-47634 | Low | 3.1 | 2024-02-29 | Decidim is a participatory democracy framework. Starting in version 0.10.0 and prior to versions 0.26.9, 0.27.5, and 0.28.0, a race condition in the endorsemen… |
CVE-2023-45874 | Medium | 4.3 | 2024-02-29 | An issue was discovered in Couchbase Server through 7.2.2. A data reader may cause a denial of service (outage of reader threads). |
CVE-2023-44347 | Medium | 5.5 | 2024-02-29 | Adobe InDesign versions ID18.5 (and earlier) and ID17.4.2 (and earlier) are affected by a NULL Pointer Dereference vulnerability. An unauthenticated attacker c… |
CVE-2023-44346 | Medium | 5.5 | 2024-02-29 | Adobe InDesign versions ID18.5 (and earlier) and ID17.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of se… |
CVE-2023-44345 | Medium | 5.5 | 2024-02-29 | Adobe InDesign versions ID18.5 (and earlier) and ID17.4.2 (and earlier) are affected by a Improper Input Validation vulnerability. An unauthenticated attacker… |
CVE-2023-44344 | Medium | 5.5 | 2024-02-29 | Adobe InDesign versions ID18.5 (and earlier) and ID17.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of se… |
CVE-2023-44343 | Medium | 5.5 | 2024-02-29 | Adobe InDesign versions ID18.5 (and earlier) and ID17.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of se… |
CVE-2023-44342 | Medium | 5.5 | 2024-02-29 | Adobe InDesign versions ID18.5 (and earlier) and ID17.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of se… |
CVE-2023-44341 | Medium | 5.5 | 2024-02-29 | Adobe InDesign versions ID18.5 (and earlier) and ID17.4.2 (and earlier) are affected by a NULL Pointer Dereference vulnerability. An unauthenticated attacker c… |
CVE-2023-43769 | Medium | 6.3 | 2024-02-29 | An issue was discovered in Couchbase Server through 7.1.4 before 7.1.5 and before 7.2.1. There are Unauthenticated RMI Service Ports Exposed in Analytics. |
CVE-2023-41165 | Medium | 4.8 | 2024-02-29 | An issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.38 before 3.7.39, 3.10.0 through 3.11.26 before 3.11.27, 4.0 through 4.3.21 bef… |
CVE-2023-38372 | Medium | 5.9 | 2024-02-29 | An unauthorized attacker who has obtained an IBM Watson IoT Platform 1.0 security authentication token can use it to impersonate an authorized platform user… |
CVE-2023-37531 | Low | 3.3 | 2024-02-29 | A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript c… |
CVE-2023-37530 | Low | 3.0 | 2024-02-29 | A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript c… |
CVE-2023-37529 | Low | 3.0 | 2024-02-29 | A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript c… |
CVE-2023-37495 | Medium | 5.9 | 2024-02-29 | Internet passwords stored in Person documents in the Domino® Directory created using the "Add Person" action on the People & Groups tab in the Domino® Administ… |
CVE-2023-34198 | High | 7.3 | 2024-02-29 | In Stormshield Network Security (SNS) 1.0.0 through 3.7.36 before 3.7.37, 3.8.0 through 3.11.24 before 3.11.25, 4.0.0 through 4.3.18 before 4.3.19, 4.4.0 throu… |
CVE-2023-27151 | Medium | 6.1 | 2024-02-29 | openCRX 5.2.0 was discovered to contain an HTML injection vulnerability for Search Criteria-Activity Number (in the Saved Search Activity) via the Name, Descri… |
CVE-2023-25926 | Medium | 5.5 | 2024-02-29 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML… |
CVE-2023-25921 | High | 8.5 | 2024-02-29 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 allows the attacker to upload or transfer files of dangerous types that can be aut… |
CVE-2023-5617 | Medium | 5.3 | 2024-02-28 | Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.6, including 9.5.x and 8.3.x, display the version of Tomcat when a ser… |
CVE-2023-49338 | High | 7.5 | 2024-02-28 | Couchbase Server 7.1.x and 7.2.x before 7.2.4 does not require authentication for the /admin/stats and /admin/vitals endpoints on TCP port 8093 of localhost. |
CVE-2023-45873 | Medium | 6.5 | 2024-02-28 | An issue was discovered in Couchbase Server through 7.2.2. A data reader may cause a denial of service (application exist) because of the OOM killer. |
CVE-2023-45859 | High | 7.6 | 2024-02-28 | In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client operations don't ch… |
CVE-2023-25925 | High | 8.5 | 2024-02-28 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow a remote authenticated attacker to execute arbitrary commands on the sy… |
CVE-2023-25922 | Medium | 4.3 | 2024-02-28 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 allows the attacker to upload or transfer files of dangerous types that can be auto… |
CVE-2023-52048 | Medium | 4.7 | 2024-02-28 | RuoYi v4.7.8 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /system/notice/. |
CVE-2023-52047 | High | 8.8 | 2024-02-28 | Dedecms v5.7.112 was discovered to contain a Cross-Site Request Forgery (CSRF) in the file manager. |
CVE-2023-51692 | Medium | 4.3 | 2024-02-28 | Missing Authorization vulnerability in CusRev Customer Reviews for WooCommerce.This issue affects Customer Reviews for WooCommerce: from n/a through 5.38.1. |
CVE-2023-51533 | Medium | 5.4 | 2024-02-28 | Cross-Site Request Forgery (CSRF) vulnerability in Ecwid Ecommerce Ecwid Ecommerce Shopping Cart.This issue affects Ecwid Ecommerce Shopping Cart: from n/a thr… |
CVE-2023-52226 | Medium | 4.3 | 2024-02-28 | Cross-Site Request Forgery (CSRF) vulnerability in Advanced Flamingo.This issue affects Advanced Flamingo: from n/a through 1.0. |
CVE-2023-52223 | Medium | 5.4 | 2024-02-28 | Cross-Site Request Forgery (CSRF) vulnerability in MailerLite MailerLite – WooCommerce integration.This issue affects MailerLite – WooCommerce integration: fro… |
CVE-2023-51683 | Medium | 5.4 | 2024-02-28 | Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Easy PayPal & Stripe Buy Now Button.This issue affects Easy PayPal & Stripe Buy Now Button: f… |
CVE-2023-51681 | Medium | 6.5 | 2024-02-28 | Cross-Site Request Forgery (CSRF) vulnerability in Duplicator Duplicator – WordPress Migration & Backup Plugin.This issue affects Duplicator – WordPress Migrat… |
CVE-2023-6917 | Medium | 6.0 | 2024-02-28 | A vulnerability has been identified in the Performance Co-Pilot (PCP) package, stemming from the mixed privilege levels utilized by systemd services associated… |
CVE-2023-6922 | Medium | 4.3 | 2024-02-28 | The Under Construction / Maintenance Mode from Acurax plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2… |
CVE-2023-50737 | Critical | 9.1 | 2024-02-28 | The SE menu contains information used by Lexmark to diagnose device errors. A vulnerability in one of the SE menu routines can be leveraged by an attacker to e… |
CVE-2023-50736 | Critical | 9.0 | 2024-02-28 | A memory corruption vulnerability has been identified in PostScript interpreter in various Lexmark devices. The vulnerability can be leveraged by an attacker t… |
CVE-2023-50735 | Critical | 9.0 | 2024-02-28 | A heap corruption vulnerability has been identified in PostScript interpreter in various Lexmark devices. The vulnerability can be leveraged by an attacker to… |
CVE-2023-50734 | Critical | 9.0 | 2024-02-28 | A buffer overflow vulnerability has been identified in PostScript interpreter in various Lexmark devices. The vulnerability can be leveraged by an attacker to… |
CVE-2023-50303 | Medium | 6.1 | 2024-02-28 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2023-50380 | Medium | 6.5 | 2024-02-27 | XML External Entity injection in apache ambari versions <= 2.7.7, Users are recommended to upgrade to version 2.7.8, which fixes this issue. More Details: Oo… |
CVE-2023-48682 | Medium | 5.4 | 2024-02-27 | Stored cross-site scripting (XSS) vulnerability in unit name. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 37391. |
CVE-2023-48681 | Medium | 6.1 | 2024-02-27 | Self cross-site scripting (XSS) vulnerability in storage nodes search field. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) bef… |
CVE-2023-48680 | Medium | 5.5 | 2024-02-27 | Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Cyber Protect 16 (macOS, Windo… |
CVE-2023-48679 | Medium | 5.4 | 2024-02-27 | Stored cross-site scripting (XSS) vulnerability due to missing origin validation in postMessage. The following products are affected: Acronis Cyber Protect 16… |
CVE-2023-48678 | Medium | 5.5 | 2024-02-27 | Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before buil… |
CVE-2023-51747 | High | 7.1 | 2024-02-27 | Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling. A lenient behaviour in line delimiter handling might create a difference of in… |
CVE-2023-7016 | High | 7.8 | 2024-02-27 | A flaw in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to execute code at a SYSTEM level via local access. |
CVE-2023-5993 | High | 7.8 | 2024-02-27 | A flaw in the Windows Installer in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to escalate their privilege level via l… |
CVE-2023-7203 | Medium | 6.1 | 2024-02-27 | The Smart Forms WordPress plugin before 2.6.87 does not have authorisation in various AJAX actions, which could allow users with a role as low as subscriber to… |
CVE-2023-7202 | Medium | 6.1 | 2024-02-27 | The Fatal Error Notify WordPress plugin before 1.5.3 does not have authorisation and CSRF checks in its test_error AJAX action, allowing any authenticated user… |
CVE-2023-7198 | Medium | 4.3 | 2024-02-27 | The WP Dashboard Notes WordPress plugin before 1.0.11 is vulnerable to Insecure Direct Object References (IDOR) in post_id= parameter. Authenticated users are… |
CVE-2023-7167 | Medium | 6.1 | 2024-02-27 | The Persian Fonts WordPress plugin through 1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfo… |
CVE-2023-7165 | High | 7.5 | 2024-02-27 | The JetBackup WordPress plugin before 2.0.9.9 doesn't use index files to prevent public directory listing of sensitive directories in certain configurations, w… |
CVE-2023-7115 | Medium | 4.8 | 2024-02-27 | The Page Builder: Pagelayer WordPress plugin before 1.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as adm… |
CVE-2023-6585 | High | 7.5 | 2024-02-27 | The WP JobSearch WordPress plugin before 2.3.4 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files su… |
CVE-2023-6584 | High | 7.5 | 2024-02-27 | The WP JobSearch WordPress plugin before 2.3.4 does not prevent attackers from logging-in as any users with the only knowledge of that user's email address. |
CVE-2023-51518 | Critical | 9.8 | 2024-02-27 | Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data. Given a dese… |
CVE-2023-50379 | High | 8.8 | 2024-02-27 | Malicious code injection in Apache Ambari in prior to 2.7.8. Users are recommended to upgrade to version 2.7.8, which fixes this issue. Impact: A Cluster Oper… |
CVE-2023-7033 | Medium | 5.3 | 2024-02-27 | Insufficient Resource Pool vulnerability in Ethernet function of Mitsubishi Electric Corporation MELSEC iQ-R series CPU module, MELSEC iQ-L series CPU module… |
CVE-2023-41506 | Critical | 9.8 | 2024-02-27 | An arbitrary file upload vulnerability in the Update/Edit Student's Profile Picture function of Student Enrollment In PHP v1.0 allows attackers to execute arbi… |
CVE-2023-36237 | High | 8.8 | 2024-02-26 | Cross Site Request Forgery vulnerability in Bagisto before v.1.5.1 allows an attacker to execute arbitrary code via a crafted HTML script. |
CVE-2023-52474 | High | 7.8 | 2024-02-26 | In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA requests hfi1 user SDMA re… |
CVE-2023-5775 | Low | 2.2 | 2024-02-26 | The BackWPup plugin for WordPress is vulnerable to Plaintext Storage of Backup Destination Password in all versions up to, and including, 4.0.2. This is due to… |
CVE-2023-52473 | Medium | 5.5 | 2024-02-26 | In the Linux kernel, the following vulnerability has been resolved: thermal: core: Fix NULL pointer dereference in zone registration error path If device_reg… |