2023 CVEs (page 53)
Page 53 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-25921 | High | 8.5 | 2024-02-29 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 allows the attacker to upload or transfer files of dangerous types that can be aut… |
CVE-2023-5617 | Medium | 5.3 | 2024-02-28 | Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.6, including 9.5.x and 8.3.x, display the version of Tomcat when a ser… |
CVE-2023-49338 | High | 7.5 | 2024-02-28 | Couchbase Server 7.1.x and 7.2.x before 7.2.4 does not require authentication for the /admin/stats and /admin/vitals endpoints on TCP port 8093 of localhost. |
CVE-2023-45873 | Medium | 6.5 | 2024-02-28 | An issue was discovered in Couchbase Server through 7.2.2. A data reader may cause a denial of service (application exist) because of the OOM killer. |
CVE-2023-45859 | High | 7.6 | 2024-02-28 | In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client operations don't ch… |
CVE-2023-25925 | High | 8.5 | 2024-02-28 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow a remote authenticated attacker to execute arbitrary commands on the sy… |
CVE-2023-25922 | Medium | 4.3 | 2024-02-28 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 allows the attacker to upload or transfer files of dangerous types that can be auto… |
CVE-2023-52048 | Medium | 4.7 | 2024-02-28 | RuoYi v4.7.8 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /system/notice/. |
CVE-2023-52047 | High | 8.8 | 2024-02-28 | Dedecms v5.7.112 was discovered to contain a Cross-Site Request Forgery (CSRF) in the file manager. |
CVE-2023-51692 | Medium | 4.3 | 2024-02-28 | Missing Authorization vulnerability in CusRev Customer Reviews for WooCommerce.This issue affects Customer Reviews for WooCommerce: from n/a through 5.38.1. |
CVE-2023-51533 | Medium | 5.4 | 2024-02-28 | Cross-Site Request Forgery (CSRF) vulnerability in Ecwid Ecommerce Ecwid Ecommerce Shopping Cart.This issue affects Ecwid Ecommerce Shopping Cart: from n/a thr… |
CVE-2023-52226 | Medium | 4.3 | 2024-02-28 | Cross-Site Request Forgery (CSRF) vulnerability in Advanced Flamingo.This issue affects Advanced Flamingo: from n/a through 1.0. |
CVE-2023-52223 | Medium | 5.4 | 2024-02-28 | Cross-Site Request Forgery (CSRF) vulnerability in MailerLite MailerLite – WooCommerce integration.This issue affects MailerLite – WooCommerce integration: fro… |
CVE-2023-51683 | Medium | 5.4 | 2024-02-28 | Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Easy PayPal & Stripe Buy Now Button.This issue affects Easy PayPal & Stripe Buy Now Button: f… |
CVE-2023-51681 | Medium | 6.5 | 2024-02-28 | Cross-Site Request Forgery (CSRF) vulnerability in Duplicator Duplicator – WordPress Migration & Backup Plugin.This issue affects Duplicator – WordPress Migrat… |
CVE-2023-6917 | Medium | 6.0 | 2024-02-28 | A vulnerability has been identified in the Performance Co-Pilot (PCP) package, stemming from the mixed privilege levels utilized by systemd services associated… |
CVE-2023-6922 | Medium | 4.3 | 2024-02-28 | The Under Construction / Maintenance Mode from Acurax plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2… |
CVE-2023-50737 | Critical | 9.1 | 2024-02-28 | The SE menu contains information used by Lexmark to diagnose device errors. A vulnerability in one of the SE menu routines can be leveraged by an attacker to e… |
CVE-2023-50736 | Critical | 9.0 | 2024-02-28 | A memory corruption vulnerability has been identified in PostScript interpreter in various Lexmark devices. The vulnerability can be leveraged by an attacker t… |
CVE-2023-50735 | Critical | 9.0 | 2024-02-28 | A heap corruption vulnerability has been identified in PostScript interpreter in various Lexmark devices. The vulnerability can be leveraged by an attacker to… |
CVE-2023-50734 | Critical | 9.0 | 2024-02-28 | A buffer overflow vulnerability has been identified in PostScript interpreter in various Lexmark devices. The vulnerability can be leveraged by an attacker to… |
CVE-2023-50303 | Medium | 6.1 | 2024-02-28 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2023-50380 | Medium | 6.5 | 2024-02-27 | XML External Entity injection in apache ambari versions <= 2.7.7, Users are recommended to upgrade to version 2.7.8, which fixes this issue. More Details: Oo… |
CVE-2023-48682 | Medium | 5.4 | 2024-02-27 | Stored cross-site scripting (XSS) vulnerability in unit name. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 37391. |
CVE-2023-48681 | Medium | 6.1 | 2024-02-27 | Self cross-site scripting (XSS) vulnerability in storage nodes search field. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) bef… |
CVE-2023-48680 | Medium | 5.5 | 2024-02-27 | Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Cyber Protect 16 (macOS, Windo… |
CVE-2023-48679 | Medium | 5.4 | 2024-02-27 | Stored cross-site scripting (XSS) vulnerability due to missing origin validation in postMessage. The following products are affected: Acronis Cyber Protect 16… |
CVE-2023-48678 | Medium | 5.5 | 2024-02-27 | Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before buil… |
CVE-2023-51747 | High | 7.1 | 2024-02-27 | Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling. A lenient behaviour in line delimiter handling might create a difference of in… |
CVE-2023-7016 | High | 7.8 | 2024-02-27 | A flaw in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to execute code at a SYSTEM level via local access. |
CVE-2023-5993 | High | 7.8 | 2024-02-27 | A flaw in the Windows Installer in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to escalate their privilege level via l… |
CVE-2023-7203 | Medium | 6.1 | 2024-02-27 | The Smart Forms WordPress plugin before 2.6.87 does not have authorisation in various AJAX actions, which could allow users with a role as low as subscriber to… |
CVE-2023-7202 | Medium | 6.1 | 2024-02-27 | The Fatal Error Notify WordPress plugin before 1.5.3 does not have authorisation and CSRF checks in its test_error AJAX action, allowing any authenticated user… |
CVE-2023-7198 | Medium | 4.3 | 2024-02-27 | The WP Dashboard Notes WordPress plugin before 1.0.11 is vulnerable to Insecure Direct Object References (IDOR) in post_id= parameter. Authenticated users are… |
CVE-2023-7167 | Medium | 6.1 | 2024-02-27 | The Persian Fonts WordPress plugin through 1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfo… |
CVE-2023-7165 | High | 7.5 | 2024-02-27 | The JetBackup WordPress plugin before 2.0.9.9 doesn't use index files to prevent public directory listing of sensitive directories in certain configurations, w… |
CVE-2023-7115 | Medium | 4.8 | 2024-02-27 | The Page Builder: Pagelayer WordPress plugin before 1.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as adm… |
CVE-2023-6585 | High | 7.5 | 2024-02-27 | The WP JobSearch WordPress plugin before 2.3.4 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files su… |
CVE-2023-6584 | High | 7.5 | 2024-02-27 | The WP JobSearch WordPress plugin before 2.3.4 does not prevent attackers from logging-in as any users with the only knowledge of that user's email address. |
CVE-2023-51518 | Critical | 9.8 | 2024-02-27 | Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data. Given a dese… |
CVE-2023-50379 | High | 8.8 | 2024-02-27 | Malicious code injection in Apache Ambari in prior to 2.7.8. Users are recommended to upgrade to version 2.7.8, which fixes this issue. Impact: A Cluster Oper… |
CVE-2023-7033 | Medium | 5.3 | 2024-02-27 | Insufficient Resource Pool vulnerability in Ethernet function of Mitsubishi Electric Corporation MELSEC iQ-R series CPU module, MELSEC iQ-L series CPU module… |
CVE-2023-41506 | Critical | 9.8 | 2024-02-27 | An arbitrary file upload vulnerability in the Update/Edit Student's Profile Picture function of Student Enrollment In PHP v1.0 allows attackers to execute arbi… |
CVE-2023-36237 | High | 8.8 | 2024-02-26 | Cross Site Request Forgery vulnerability in Bagisto before v.1.5.1 allows an attacker to execute arbitrary code via a crafted HTML script. |
CVE-2023-52474 | High | 7.8 | 2024-02-26 | In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA requests hfi1 user SDMA re… |
CVE-2023-5775 | Low | 2.2 | 2024-02-26 | The BackWPup plugin for WordPress is vulnerable to Plaintext Storage of Backup Destination Password in all versions up to, and including, 4.0.2. This is due to… |
CVE-2023-52473 | Medium | 5.5 | 2024-02-26 | In the Linux kernel, the following vulnerability has been resolved: thermal: core: Fix NULL pointer dereference in zone registration error path If device_reg… |
CVE-2023-52472 | Medium | 5.5 | 2024-02-26 | In the Linux kernel, the following vulnerability has been resolved: crypto: rsa - add a check for allocation failure Static checkers insist that the mpi_allo… |
CVE-2023-52471 | Medium | 5.5 | 2024-02-26 | In the Linux kernel, the following vulnerability has been resolved: ice: Fix some null pointer dereference issues in ice_ptp.c devm_kasprintf() returns a poi… |
CVE-2023-52470 | Medium | 5.5 | 2024-02-26 | In the Linux kernel, the following vulnerability has been resolved: drm/radeon: check the alloc_workqueue return value in radeon_crtc_init() check the alloc_… |
CVE-2023-52469 | High | 7.8 | 2024-02-26 | In the Linux kernel, the following vulnerability has been resolved: drivers/amd/pm: fix a use-after-free in kv_parse_power_table When ps allocated by kzalloc… |
CVE-2023-52468 | High | 7.8 | 2024-02-26 | In the Linux kernel, the following vulnerability has been resolved: class: fix use-after-free in class_register() The lock_class_key is still registered and… |
CVE-2023-52467 | Medium | 5.5 | 2024-02-26 | In the Linux kernel, the following vulnerability has been resolved: mfd: syscon: Fix null pointer dereference in of_syscon_register() kasprintf() returns a p… |
CVE-2023-52465 | Medium | 5.5 | 2024-02-26 | In the Linux kernel, the following vulnerability has been resolved: power: supply: Fix null pointer dereference in smb2_probe devm_kasprintf and devm_kzalloc… |
CVE-2023-49960 | High | 7.5 | 2024-02-26 | In Indo-Sol PROFINET-INspektor NT through 2.4.0, a path traversal vulnerability in the httpuploadd service of the firmware allows remote attackers to write to… |
CVE-2023-49959 | Critical | 9.8 | 2024-02-26 | In Indo-Sol PROFINET-INspektor NT through 2.4.0, a command injection vulnerability in the gedtupdater service of the firmware allows remote attackers to execut… |
CVE-2023-49114 | Medium | 6.7 | 2024-02-26 | A DLL hijacking vulnerability was identified in the Qognify VMS Client Viewer version 7.1 or higher, which allows local users to execute arbitrary code and obt… |
CVE-2023-43051 | Medium | 5.4 | 2024-02-26 | IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in th… |
CVE-2023-38359 | Medium | 6.1 | 2024-02-26 | IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in th… |
CVE-2023-32344 | Medium | 4.3 | 2024-02-26 | IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to form action hijacking where it is possible to modify the form action to reference an arbitrary… |
CVE-2023-30996 | Medium | 5.3 | 2024-02-26 | IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 could be vulnerable to information leakage due to unverified sources in messages sent between Windows objects o… |
CVE-2023-51394 | Medium | 5.3 | 2024-02-23 | High traffic environments may result in NULL Pointer Dereference vulnerability in Silicon Labs's Ember ZNet SDK before v7.4.0, causing a system crash. |
CVE-2023-51393 | Medium | 5.3 | 2024-02-23 | Due to an allocation of resources without limits, an uncontrolled resource consumption vulnerability exists in Silicon Labs Ember ZNet SDK prior to v7.4.0.0 (d… |
CVE-2023-51392 | Medium | 6.2 | 2024-02-23 | Ember ZNet between v7.2.0 and v7.4.0 used software AES-CCM instead of integrated hardware cryptographic accelerators, potentially increasing risk of electromag… |
CVE-2023-52464 | High | 7.8 | 2024-02-23 | In the Linux kernel, the following vulnerability has been resolved: EDAC/thunderx: Fix possible out-of-bounds string access Enabling -Wstringop-overflow glob… |
CVE-2023-52463 | Medium | 5.5 | 2024-02-23 | In the Linux kernel, the following vulnerability has been resolved: efivarfs: force RO when remounting if SetVariable is not supported If SetVariable at runt… |
CVE-2023-52462 | Medium | 5.5 | 2024-02-23 | In the Linux kernel, the following vulnerability has been resolved: bpf: fix check for attempt to corrupt spilled pointer When register is spilled onto a sta… |
CVE-2023-52461 | High | 7.8 | 2024-02-23 | In the Linux kernel, the following vulnerability has been resolved: drm/sched: Fix bounds limiting when given a malformed entity If we're given a malformed e… |
CVE-2023-52460 | Medium | 5.5 | 2024-02-23 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL pointer dereference at hibernate During hibernate sequence the… |
CVE-2023-52459 | Medium | 5.5 | 2024-02-23 | In the Linux kernel, the following vulnerability has been resolved: media: v4l: async: Fix duplicated list deletion The list deletion call dropped here is al… |
CVE-2023-52458 | Medium | 5.5 | 2024-02-23 | In the Linux kernel, the following vulnerability has been resolved: block: add check that partition length needs to be aligned with block size Before calling… |
CVE-2023-52457 | High | 7.8 | 2024-02-23 | In the Linux kernel, the following vulnerability has been resolved: serial: 8250: omap: Don't skip resource freeing if pm_runtime_resume_and_get() failed Ret… |
CVE-2023-52456 | Medium | 5.5 | 2024-02-23 | In the Linux kernel, the following vulnerability has been resolved: serial: imx: fix tx statemachine deadlock When using the serial port as RS485 port, the t… |
CVE-2023-52455 | High | 7.8 | 2024-02-23 | In the Linux kernel, the following vulnerability has been resolved: iommu: Don't reserve 0-length IOVA region When the bootloader/firmware doesn't setup the… |
CVE-2023-52454 | High | 7.5 | 2024-02-23 | In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length If the host sends… |
CVE-2023-52453 | High | 7.1 | 2024-02-23 | In the Linux kernel, the following vulnerability has been resolved: hisi_acc_vfio_pci: Update migration data pointer correctly on saving/resume When the opti… |
CVE-2023-24416 | Medium | 6.8 | 2024-02-23 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Arne Franken All In One Favicon.This issue affects All In One F… |
CVE-2023-4826 | Medium | 6.1 | 2024-02-23 | The SocialDriver WordPress theme before version 2024 has a prototype pollution vulnerability that could allow an attacker to inject arbitrary properties result… |
CVE-2023-37540 | Low | 3.9 | 2024-02-23 | Sametime Connect desktop chat client includes, but does not use or require, the use of an Eclipse feature called Secure Storage. Using this Eclipse feature to… |
CVE-2023-52452 | High | 7.8 | 2024-02-22 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix accesses to uninit stack slots Privileged programs are supposed to be able to re… |
CVE-2023-52451 | High | 7.8 | 2024-02-22 | In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/memhp: Fix access beyond end of drmem array dlpar_memory_remove_by_index(… |
CVE-2023-52450 | Medium | 5.5 | 2024-02-22 | In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: Fix NULL pointer dereference issue in upi_fill_topology() Get logi… |
CVE-2023-52449 | Medium | 5.5 | 2024-02-22 | In the Linux kernel, the following vulnerability has been resolved: mtd: Fix gluebi NULL pointer dereference caused by ftl notifier If both ftl.ko and gluebi… |
CVE-2023-52448 | Medium | 5.5 | 2024-02-22 | In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump Syzkaller has reported a NULL… |
CVE-2023-52447 | High | 7.8 | 2024-02-22 | In the Linux kernel, the following vulnerability has been resolved: bpf: Defer the free of inner map when necessary When updating or deleting an inner map in… |
CVE-2023-52446 | High | 7.8 | 2024-02-22 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a race condition between btf_put() and map_free() When running `./test_progs -j`… |
CVE-2023-52445 | High | 7.8 | 2024-02-22 | In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix use after free on context disconnection Upon module load, a kthread i… |
CVE-2023-52444 | High | 7.8 | 2024-02-22 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid dirent corruption As Al reported in link[1]: f2fs_rename() ... if (o… |
CVE-2023-52443 | Medium | 5.5 | 2024-02-22 | In the Linux kernel, the following vulnerability has been resolved: apparmor: avoid crash when parsed profile name is empty When processing a packed profile… |
CVE-2023-52161 | High | 7.5 | 2024-02-22 | The Access Point functionality in eapol_auth_key_handle in eapol.c in iNet wireless daemon (IWD) before 2.14 allows attackers to gain unauthorized access to a… |
CVE-2023-52160 | Medium | 6.5 | 2024-02-22 | The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful attack, wpa_supplicant must be configured to not verif… |
CVE-2023-51653 | Critical | 9.8 | 2024-02-22 | Hertzbeat is a real-time monitoring system. In the implementation of `JmxCollectImpl.java`, `JMXConnectorFactory.connect` is vulnerable to JNDI injection. The… |
CVE-2023-51389 | Critical | 9.8 | 2024-02-22 | Hertzbeat is a real-time monitoring system. At the interface of `/define/yml`, SnakeYAML is used as a parser to parse yml content, but no security configuratio… |
CVE-2023-51388 | Critical | 9.8 | 2024-02-22 | Hertzbeat is a real-time monitoring system. In `CalculateAlarm.java`, `AviatorEvaluator` is used to directly execute the expression function, and no security p… |
CVE-2023-51450 | Medium | 5.6 | 2024-02-22 | baserCMS is a website development framework. Prior to version 5.0.9, there is an OS Command Injection vulnerability in the site search feature of baserCMS. Ver… |
CVE-2023-44379 | Medium | 6.1 | 2024-02-22 | baserCMS is a website development framework. Prior to version 5.0.9, there is a cross-site scripting vulnerability in the site search feature. Version 5.0.9 co… |
CVE-2023-3966 | High | 7.5 | 2024-02-22 | A flaw was found in Open vSwitch where multiple versions are vulnerable to crafted Geneve packets, which may result in a denial of service and invalid memory a… |
CVE-2023-29181 | High | 8.8 | 2024-02-22 | A use of externally-controlled format string in Fortinet FortiOS 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.14, 6.0.0 t… |
CVE-2023-29180 | High | 7.5 | 2024-02-22 | A null pointer dereference in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.14, 6.0.0 through 6.0… |
CVE-2023-29179 | Medium | 6.5 | 2024-02-22 | A null pointer dereference in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, Fortiproxy version 7.2.0 through 7.2.4… |