2023 CVEs (page 57)
Page 57 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-6036 | Critical | 9.8 | 2024-02-12 | The Web3 WordPress plugin before 3.0.0 is vulnerable to an authentication bypass due to incorrect authentication checking in the login flow in functions 'handl… |
CVE-2023-6681 | Medium | 5.3 | 2024-02-12 | A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service (DoS) attack and possible password brute-force and dictionary… |
CVE-2023-46615 | Medium | 5.4 | 2024-02-12 | Deserialization of Untrusted Data vulnerability in Kalli Dan. KD Coming Soon.This issue affects KD Coming Soon: from n/a through 1.7. |
CVE-2023-41708 | Medium | 5.4 | 2024-02-12 | References to the "app loader" functionality could contain redirects to unexpected locations. Attackers could forge app references that bypass existing safegua… |
CVE-2023-41707 | Medium | 6.5 | 2024-02-12 | Processing of user-defined mail search expressions is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the… |
CVE-2023-41706 | Medium | 6.5 | 2024-02-12 | Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached. Availability of OX Ap… |
CVE-2023-41705 | Medium | 6.5 | 2024-02-12 | Processing of user-defined DAV user-agent strings is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the… |
CVE-2023-41704 | High | 7.1 | 2024-02-12 | Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine. Malicious script code could be inject… |
CVE-2023-41703 | Medium | 6.1 | 2024-02-12 | User ID references at mentions in document comments were not correctly sanitized. Script code could be injected to a users session when working with a maliciou… |
CVE-2023-51403 | Medium | 6.5 | 2024-02-12 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nicdark Restaurant Reservations allows Stored XSS.This is… |
CVE-2023-51370 | Medium | 5.9 | 2024-02-12 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NinjaTeam WP Chat App allows Stored XSS.This issue affect… |
CVE-2023-50875 | Medium | 6.5 | 2024-02-12 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Sensei LMS – Online Courses, Quizzes, & Learni… |
CVE-2023-47526 | Medium | 5.9 | 2024-02-12 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chart Builder Team Chartify – WordPress Chart Plugin allo… |
CVE-2023-52429 | Medium | 5.5 | 2024-02-12 | dm_table_create in drivers/md/dm-table.c in the Linux kernel through 6.7.4 can attempt to (in alloc_targets) allocate more than INT_MAX bytes, and crash, becau… |
CVE-2023-52428 | High | 7.5 | 2024-02-11 | In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration c… |
CVE-2023-52427 | High | 7.5 | 2024-02-11 | In OpenDDS through 3.27, there is a segmentation fault for a DataWriter with a large value of resource_limits.max_samples. NOTE: the vendor's position is that… |
CVE-2023-50957 | High | 8.0 | 2024-02-10 | IBM Storage Defender - Resiliency Service 2.0 could allow a privileged user to perform unauthorized actions after obtaining encrypted data from clear text key… |
CVE-2023-51493 | Medium | 6.5 | 2024-02-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Howard Ehrenberg Custom Post Carousels with Owl allows St… |
CVE-2023-51492 | Medium | 6.5 | 2024-02-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If So Plugin If-So Dynamic Content Personalization allows… |
CVE-2023-51488 | High | 7.1 | 2024-02-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic, Inc. Crowdsignal Dashboard – Polls, Surveys &… |
CVE-2023-51485 | Medium | 6.5 | 2024-02-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Hosting Pay with Vipps and MobilePay for WooCommerce a… |
CVE-2023-51480 | Medium | 6.5 | 2024-02-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 Active Products Tables for WooCommerce. Profes… |
CVE-2023-51415 | Medium | 6.5 | 2024-02-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform… |
CVE-2023-51404 | Medium | 6.5 | 2024-02-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MyAgilePrivacy My Agile Privacy – The only GDPR solution… |
CVE-2023-45698 | Medium | 4.8 | 2024-02-10 | Sametime is impacted by lack of clickjacking protection in Outlook add-in. The application is not implementing appropriate protections in order to protect user… |
CVE-2023-45696 | Medium | 4.0 | 2024-02-10 | Sametime is impacted by sensitive fields with autocomplete enabled in the Legacy web chat client. By default, this allows user entered data to be stored by the… |
CVE-2023-28077 | Medium | 4.4 | 2024-02-10 | Dell BSAFE SSL-J, versions prior to 6.5, and versions 7.0 and 7.1 contain a debug message revealing unnecessary information vulnerability. This may lead to di… |
CVE-2023-6935 | Medium | 5.9 | 2024-02-09 | wolfSSL SP Math All RSA implementation is vulnerable to the Marvin Attack, new variation of a timing Bleichenbacher style attack, when built with the following… |
CVE-2023-45718 | Low | 3.9 | 2024-02-09 | Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. W… |
CVE-2023-45716 | Low | 1.7 | 2024-02-09 | Sametime is impacted by sensitive information passed in URL. |
CVE-2023-50349 | Medium | 5.9 | 2024-02-09 | Sametime is impacted by a Cross Site Request Forgery (CSRF) vulnerability. Some REST APIs in the Sametime Proxy application can allow an attacker to perform m… |
CVE-2023-50386 | High | 8.8 | 2024-02-09 | Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Functionality from Untrusted Control Sphe… |
CVE-2023-50298 | High | 7.5 | 2024-02-09 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 b… |
CVE-2023-50292 | High | 7.5 | 2024-02-09 | Incorrect Permission Assignment for Critical Resource, Improper Control of Dynamically-Managed Code Resources vulnerability in Apache Solr. This issue affects… |
CVE-2023-50291 | High | 7.5 | 2024-02-09 | Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of… |
CVE-2023-6677 | Critical | 9.8 | 2024-02-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oduyo Financial Technology Online Collection allows SQL I… |
CVE-2023-6724 | High | 8.8 | 2024-02-09 | Authorization Bypass Through User-Controlled Key vulnerability in Software Engineering Consultancy Machine Equipment Limited Company Hearing Tracking System al… |
CVE-2023-50026 | Critical | 9.8 | 2024-02-09 | SQL injection vulnerability in Presta Monster "Multi Accessories Pro" (hsmultiaccessoriespro) module for PrestaShop versions 5.1.1 and before, allows remote at… |
CVE-2023-46350 | Critical | 9.8 | 2024-02-09 | SQL injection vulnerability in InnovaDeluxe "Manufacturer or supplier alphabetical search" (idxrmanufacturer) module for PrestaShop versions 2.0.4 and before… |
CVE-2023-39683 | Medium | 6.1 | 2024-02-09 | Cross Site Scripting (XSS) vulnerability in EasyEmail v.4.12.2 and before allows a local attacker to execute arbitrary code via the user input parameter(s). NO… |
CVE-2023-31506 | Medium | 5.4 | 2024-02-09 | A cross-site scripting (XSS) vulnerability in Grav versions 1.7.44 and before, allows remote authenticated attackers to execute arbitrary web scripts or HTML v… |
CVE-2023-51761 | High | 8.3 | 2024-02-09 | In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could bypass authentication and acquire admin capabil… |
CVE-2023-49716 | Medium | 6.9 | 2024-02-09 | In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an authenticated user with network access could run arbitrary commands from a remote computer. |
CVE-2023-46687 | Critical | 9.8 | 2024-02-09 | In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could execute arbitrary commands in root context f… |
CVE-2023-43609 | Medium | 6.9 | 2024-02-09 | In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could obtain access to sensitive information or cause… |
CVE-2023-45191 | High | 7.5 | 2024-02-09 | IBM Engineering Lifecycle Optimization 7.0.2 and 7.0.3 uses an inadequate account lockout setting that could allow a remote attacker to brute force account cre… |
CVE-2023-45190 | Medium | 5.1 | 2024-02-09 | IBM Engineering Lifecycle Optimization 7.0.2 and 7.0.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. Thi… |
CVE-2023-45187 | Medium | 6.3 | 2024-02-09 | IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 does not invalidate session after logout which could allow an authenticated user to imperso… |
CVE-2023-42016 | Medium | 4.3 | 2024-02-09 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.3 does not set the secure attribute on authorization tokens or s… |
CVE-2023-32341 | Medium | 6.5 | 2024-02-09 | IBM Sterling B2B Integrator 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.3 could allow an authenticated user to cause a denial of service due to uncontrol… |
CVE-2023-51630 | Medium | 6.1 | 2024-02-08 | Paessler PRTG Network Monitor Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on… |
CVE-2023-47132 | Critical | 9.8 | 2024-02-08 | An issue discovered in N-able N-central before 2023.6 and earlier allows attackers to gain escalated privileges via API calls. |
CVE-2023-47131 | High | 7.5 | 2024-02-08 | The N-able PassPortal extension before 3.29.2 for Chrome inserts sensitive information into a log file. |
CVE-2023-40264 | Medium | 4.3 | 2024-02-08 | An issue was discovered in Atos Unify OpenScape Voice Trace Manager V8 before V8 R0.9.11. It allows authenticated path traversal in the user interface. |
CVE-2023-40263 | High | 8.8 | 2024-02-08 | An issue was discovered in Atos Unify OpenScape Voice Trace Manager V8 before V8 R0.9.11. It allows authenticated command injection via ftp. |
CVE-2023-40262 | Medium | 6.1 | 2024-02-08 | An issue was discovered in Atos Unify OpenScape Voice Trace Manager V8 before V8 R0.9.11. It allows unauthenticated Stored Cross-Site Scripting (XSS) in the ad… |
CVE-2023-49101 | Medium | 6.1 | 2024-02-08 | WebAdmin in Axigen 10.3.x before 10.3.3.61, 10.4.x before 10.4.24, and 10.5.x before 10.5.10 allows XSS attacks against admins because of mishandling of viewin… |
CVE-2023-40266 | Critical | 9.8 | 2024-02-08 | An issue was discovered in Atos Unify OpenScape Xpressions WebAssistant V7 before V7R1 FR5 HF42 P911. It allows path traversal. |
CVE-2023-40265 | High | 8.8 | 2024-02-08 | An issue was discovered in Atos Unify OpenScape Xpressions WebAssistant V7 before V7R1 FR5 HF42 P911. It allows authenticated remote code execution via file up… |
CVE-2023-27001 | High | 8.8 | 2024-02-08 | An issue discovered in Egerie Risk Manager v4.0.5 allows attackers to bypass the signature mechanism and tamper with the values inside the JWT payload resultin… |
CVE-2023-25365 | High | 7.8 | 2024-02-08 | Cross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to execute arbitrary code via the file type .mp3 |
CVE-2023-50061 | Critical | 9.8 | 2024-02-08 | PrestaShop Op'art Easy Redirect >= 1.3.8 and <= 1.3.12 is vulnerable to SQL Injection via Oparteasyredirect::hookActionDispatcher(). |
CVE-2023-42282 | Critical | 9.8 | 2024-02-08 | The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPubli… |
CVE-2023-47020 | High | 8.8 | 2024-02-08 | Multiple Cross-Site Request Forgery (CSRF) chaining in NCR Terminal Handler v.1.5.1 allows privileges to be escalated by an attacker through a crafted request… |
CVE-2023-7169 | Medium | 6.0 | 2024-02-08 | Authentication Bypass by Spoofing vulnerability in Snow Software Snow Inventory Agent on Windows allows Signature Spoof.This issue affects Snow Inventory Agent… |
CVE-2023-6564 | Medium | 6.5 | 2024-02-08 | An issue has been discovered in GitLab EE Premium and Ultimate affecting versions 16.4.3, 16.5.3, and 16.6.1. In projects using subgroups to define who can pus… |
CVE-2023-6519 | High | 7.5 | 2024-02-08 | Exposure of Data Element to Wrong Session vulnerability in Mia Technology Inc. MİA-MED allows Read Sensitive Strings Within an Executable. This issue affects… |
CVE-2023-6518 | High | 7.5 | 2024-02-08 | Plaintext Storage of a Password vulnerability in Mia Technology Inc. MİA-MED allows Read Sensitive Strings Within an Executable. This issue affects MİA-MED: b… |
CVE-2023-6517 | High | 7.5 | 2024-02-08 | Exposure of Sensitive Information Due to Incompatible Policies vulnerability in Mia Technology Inc. MİA-MED allows Collect Data as Provided by Users. This iss… |
CVE-2023-6515 | High | 8.8 | 2024-02-08 | Authorization Bypass Through User-Controlled Key vulnerability in Mia Technology Inc. MİA-MED allows Authentication Abuse. This issue affects MİA-MED: before… |
CVE-2023-5665 | Medium | 6.4 | 2024-02-08 | The Payment Forms for Paystack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and includi… |
CVE-2023-47798 | Medium | 5.4 | 2024-02-08 | Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsupported versions do… |
CVE-2023-48974 | Critical | 9.6 | 2024-02-08 | Cross Site Scripting vulnerability in Axigen WebMail prior to 10.3.3.61 allows a remote attacker to escalate privileges via a crafted script to the serverName_… |
CVE-2023-6840 | Medium | 6.7 | 2024-02-07 | An issue has been discovered in GitLab EE affecting all versions from 16.4 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2 which allows a maint… |
CVE-2023-6736 | Medium | 6.5 | 2024-02-07 | An issue has been discovered in GitLab EE affecting all versions starting from 11.3 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions… |
CVE-2023-6536 | Medium | 6.5 | 2024-02-07 | A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NV… |
CVE-2023-6535 | Medium | 6.5 | 2024-02-07 | A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NV… |
CVE-2023-6356 | Medium | 6.5 | 2024-02-07 | A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NV… |
CVE-2023-38995 | Critical | 9.8 | 2024-02-07 | An issue in SCHUHFRIED v.8.22.00 allows remote attacker to obtain the database password via crafted curl command. |
CVE-2023-47700 | Medium | 5.9 | 2024-02-07 | IBM SAN Volume Controller, IBM Storwize, IBM FlashSystem and IBM Storage Virtualize 8.6 products could allow a remote attacker to spoof a trusted system that w… |
CVE-2023-43017 | High | 8.2 | 2024-02-07 | IBM Security Verify Access 10.0.0.0 through 10.0.6.1 could allow a privileged user to install a configuration file that could allow remote access. IBM X-Force… |
CVE-2023-38369 | Medium | 6.2 | 2024-02-07 | IBM Security Access Manager Container 10.0.0.0 through 10.0.6.1 does not require that docker images should have strong passwords by default, which makes it eas… |
CVE-2023-32330 | High | 7.5 | 2024-02-07 | IBM Security Verify Access 10.0.0.0 through 10.0.6.1 uses insecure calls that could allow an attacker on the network to take control of the server. IBM X-Forc… |
CVE-2023-32328 | High | 7.5 | 2024-02-07 | IBM Security Verify Access 10.0.0.0 through 10.0.6.1 uses insecure protocols in some instances that could allow an attacker on the network to take control of t… |
CVE-2023-31002 | Medium | 5.1 | 2024-02-07 | IBM Security Access Manager Container 10.0.0.0 through 10.0.6.1 temporarily stores sensitive information in files that could be accessed by a local user. IBM… |
CVE-2023-39196 | Medium | 5.3 | 2024-02-07 | Improper Authentication vulnerability in Apache Ozone. The vulnerability allows an attacker to download metadata internal to the Storage Container Manager ser… |
CVE-2023-51437 | High | 7.4 | 2024-02-07 | Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge a SASL Role Token that will pass signa… |
CVE-2023-46914 | Critical | 9.8 | 2024-02-07 | SQL Injection vulnerability in RM bookingcalendar module for PrestaShop versions 2.7.9 and before, allows remote attackers to execute arbitrary code, escalate… |
CVE-2023-40355 | Medium | 5.4 | 2024-02-07 | Cross Site Scripting (XSS) vulnerability in Axigen versions 10.3.3.0 before 10.3.3.59, 10.4.0 before 10.4.19, and 10.5.0 before 10.5.5, allows authenticated at… |
CVE-2023-6388 | Medium | 5.0 | 2024-02-07 | Suite CRM version 7.14.2 allows making arbitrary HTTP requests through the vulnerable server. This is possible because the application is vulnerable to SSRF. |
CVE-2023-45735 | High | 8.0 | 2024-02-06 | A potential attacker with access to the Westermo Lynx device may be able to execute malicious code that could affect the correct functioning of the device… |
CVE-2023-45227 | Medium | 5.4 | 2024-02-06 | An attacker with access to the web application with vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting… |
CVE-2023-45222 | Medium | 5.4 | 2024-02-06 | An attacker with access to the web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting pay… |
CVE-2023-45213 | Medium | 6.6 | 2024-02-06 | A potential attacker with access to the Westermo Lynx device would be able to execute malicious code that could affect the correct functioning of the de… |
CVE-2023-42765 | Medium | 5.4 | 2024-02-06 | An attacker with access to the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "username… |
CVE-2023-40544 | Medium | 5.7 | 2024-02-06 | An attacker with access to the network where the affected devices are located could maliciously actions to obtain, via a sniffer, sensitive informat… |
CVE-2023-40143 | Medium | 5.4 | 2024-02-06 | An attacker with access to the Westermo Lynx web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site s… |
CVE-2023-38579 | High | 8.0 | 2024-02-06 | The cross-site request forgery token in the request may be predictable or easily guessable allowing attackers to craft a malicious request, which… |
CVE-2023-40545 | High | 8.8 | 2024-02-06 | Authentication bypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affected 11.3 versions via specially crafted requests. |
CVE-2023-47618 | High | 7.2 | 2024-02-06 | A post authentication command execution vulnerability exists in the web filtering functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322… |