2023 CVEs (page 60)
Page 60 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-51509 | High | 7.1 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss RegistrationMagic – Custom Registration Forms… |
CVE-2023-51506 | Medium | 5.5 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WPCS – WordPress Currency Switcher Professiona… |
CVE-2023-52118 | Medium | 6.5 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Event Manager WP User Profile Avatar allows Stored XSS… |
CVE-2023-51695 | Medium | 5.9 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPEverest Everest Forms – Build Contact Forms, Surveys, P… |
CVE-2023-51694 | Medium | 6.5 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Epiphyt Embed Privacy allows Stored XSS.This issue affect… |
CVE-2023-51693 | Medium | 6.5 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Icons allows Stored XSS.This issue affects Themif… |
CVE-2023-51691 | Medium | 5.9 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gVectors Team Comments – wpDiscuz allows Stored XSS.This… |
CVE-2023-51690 | Medium | 6.5 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Advanced iFrame allows Stored XSS.This issue affects Adva… |
CVE-2023-51689 | Medium | 6.5 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in naa986 Easy Video Player allows Stored XSS.This issue aff… |
CVE-2023-51685 | Medium | 5.9 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LJ Apps WP Review Slider allows Stored XSS.This issue aff… |
CVE-2023-51684 | Medium | 6.5 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Digital Downloads Easy Digital Downloads – Sell Digi… |
CVE-2023-51677 | Medium | 6.5 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magazine3 Schema & Structured Data for WP & AMP allows St… |
CVE-2023-51674 | Medium | 6.5 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AAM Advanced Access Manager – Restricted Content, Users &… |
CVE-2023-51669 | Medium | 6.5 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Artios Media Product Code for WooCommerce allows Stored X… |
CVE-2023-51666 | Medium | 6.5 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Related Post allows Stored XSS.This issue aff… |
CVE-2023-51548 | Medium | 5.9 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Neil Gee SlickNav Mobile Menu allows Stored XSS.This issu… |
CVE-2023-51540 | High | 7.1 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kunal Nagar Custom 404 Pro allows Stored XSS.This issue a… |
CVE-2023-51536 | Medium | 5.9 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks Forms – WordPress Form Builder allows… |
CVE-2023-51534 | Medium | 5.9 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brave Brave – Create Popup, Optins, Lead Generation, Surv… |
CVE-2023-51532 | Medium | 6.5 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Icegram Icegram Engage – WordPress Lead Generation, Popup… |
CVE-2023-52195 | Medium | 6.5 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Posts to Page Kerry James allows Stored XSS.This issue af… |
CVE-2023-52194 | Medium | 6.5 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Takayuki Miyauchi oEmbed Gist allows Stored XSS.This issu… |
CVE-2023-52193 | Medium | 6.5 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Live Composer Team Page Builder: Live Composer allows Sto… |
CVE-2023-52192 | Medium | 6.5 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Keap Keap Official Opt-in Forms allows Stored XSS.This is… |
CVE-2023-52191 | Medium | 6.5 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Torbjon Infogram – Add charts, maps and infographics allo… |
CVE-2023-52189 | Medium | 6.5 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jhayghost Ideal Interactive Map allows Stored XSS.This is… |
CVE-2023-52188 | Medium | 6.5 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Russell Jamieson Footer Putter allows Stored XSS.This iss… |
CVE-2023-52175 | Medium | 6.5 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Uno (miunosoft) Auto Amazon Links – Amazon Associ… |
CVE-2023-51939 | High | 8.8 | 2024-02-01 | An issue in the cp_bbs_sig function in relic/src/cp/relic_cp_bbs.c of Relic relic-toolkit 0.6.0 allows a remote attacker to obtain sensitive information and es… |
CVE-2023-7069 | Medium | 6.4 | 2024-02-01 | The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and i… |
CVE-2023-28807 | Medium | 5.1 | 2024-01-31 | In Zscaler Internet Access (ZIA) a mismatch between Connect Host and Client Hello's Server Name Indication (SNI) enables attackers to evade network security co… |
CVE-2023-5390 | Medium | 5.3 | 2024-01-31 | An attacker could potentially exploit this vulnerability, leading to files being read from the Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC. T… |
CVE-2023-50166 | Medium | 6.1 | 2024-01-31 | Pega Platform from 8.5.4 to 8.8.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter. |
CVE-2023-50165 | High | 8.5 | 2024-01-31 | Pega Platform versions 8.2.1 to Infinity 23.1.0 are affected by an Generated PDF issue that could expose file contents. |
CVE-2023-47116 | Medium | 5.3 | 2024-01-31 | Label Studio is a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.11.0 and was tested on version 1.8… |
CVE-2023-6780 | Medium | 5.3 | 2024-01-31 | An integer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue… |
CVE-2023-6779 | High | 8.2 | 2024-01-31 | An off-by-one heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog f… |
CVE-2023-6246 | High | 8.4 | 2024-01-31 | A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. Th… |
CVE-2023-5992 | Medium | 5.6 | 2024-01-31 | A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the potentia… |
CVE-2023-7043 | Low | 3.3 | 2024-01-31 | Unquoted service path in ESET products allows to drop a prepared program to a specific location and run on boot with the NT AUTHORITY\NetworkService permis… |
CVE-2023-50357 | Medium | 5.4 | 2024-01-31 | A cross site scripting vulnerability in the AREAL SAS Websrv1 ASP website allows a remote low-privileged attacker to gain escalated privileges of other non-adm… |
CVE-2023-50356 | Medium | 6.5 | 2024-01-31 | SSL connections to some LDAP servers are vulnerable to a man-in-the-middle attack due to improper certificate validation in AREAL Topkapi Vision (Server). This… |
CVE-2023-44313 | High | 7.6 | 2024-01-31 | Server-Side Request Forgery (SSRF) vulnerability in Apache ServiceComb Service-Center. Attackers can obtain sensitive server information through specially craf… |
CVE-2023-44312 | Medium | 5.8 | 2024-01-31 | Exposure of Sensitive Information to an Unauthorized Actor in Apache ServiceComb Service-Center.This issue affects Apache ServiceComb Service-Center before… |
CVE-2023-31505 | High | 7.2 | 2024-01-31 | An arbitrary file upload vulnerability in Schlix CMS v2.2.8-1, allows remote authenticated attackers to execute arbitrary code and obtain sensitive information… |
CVE-2023-2439 | Medium | 6.4 | 2024-01-31 | The UserPro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userpro' shortcode in versions up to, and including, 5.1.5 due to insuff… |
CVE-2023-5389 | Critical | 9.1 | 2024-01-30 | An attacker could potentially exploit this vulnerability, leading to the ability to modify files on Honeywell Experion ControlEdge VirtualUOC and ControlEdge… |
CVE-2023-6258 | High | 8.1 | 2024-01-30 | A security vulnerability has been identified in the pkcs11-provider, which is associated with Public-Key Cryptography Standards (PKCS#11). If exploited success… |
CVE-2023-46231 | Medium | 6.8 | 2024-01-30 | In Splunk Add-on Builder versions below 4.1.4, the application writes user session tokens to its internal log files when you visit the Splunk Add-on Builder or… |
CVE-2023-46230 | High | 8.2 | 2024-01-30 | In Splunk Add-on Builder versions below 4.1.4, the app writes sensitive information to internal log files. |
CVE-2023-37518 | Medium | 6.4 | 2024-01-30 | HCL BigFix ServiceNow is vulnerable to arbitrary code injection. A malicious authorized attacker could inject arbitrary code and execute within the context of… |
CVE-2023-6943 | Critical | 9.8 | 2024-01-30 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5… |
CVE-2023-6942 | High | 7.5 | 2024-01-30 | Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5.92, GT Designer3 Version1(GOT1000) ver… |
CVE-2023-6374 | Medium | 5.9 | 2024-01-30 | Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 all serial numbers allows a remote unau… |
CVE-2023-36260 | High | 7.5 | 2024-01-30 | An issue was discovered in the Feed Me plugin 4.6.1 for Craft CMS. It allows remote attackers to cause a denial of service (DoS) via crafted strings to Feed-Me… |
CVE-2023-36259 | Medium | 5.4 | 2024-01-30 | Cross Site Scripting (XSS) vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during user creation. |
CVE-2023-7225 | Medium | 6.4 | 2024-01-30 | The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the width and height parameters in all versions up to, an… |
CVE-2023-5372 | High | 7.2 | 2024-01-30 | The post-authentication command injection vulnerability in Zyxel NAS326 firmware versions through V5.21(AAZF.15)C0 and NAS542 firmware versions through V5.21(A… |
CVE-2023-51982 | Critical | 9.8 | 2024-01-30 | CrateDB 5.5.1 is contains an authentication bypass vulnerability in the Admin UI component. After configuring password authentication and_ Local_ In the case o… |
CVE-2023-51843 | High | 8.2 | 2024-01-30 | react-dashboard 1.4.0 is vulnerable to Cross Site Scripting (XSS) as httpOnly is not set. |
CVE-2023-51837 | Critical | 9.8 | 2024-01-30 | Ylianst MeshCentral 1.1.16 is vulnerable to Missing SSL Certificate Validation. |
CVE-2023-51813 | Medium | 6.5 | 2024-01-30 | Cross Site Request Forgery (CSRF) vulnerability in Free Open-Source Inventory Management System v.1.0 allows a remote attacker to execute arbitrary code via th… |
CVE-2023-37571 | Medium | 6.1 | 2024-01-30 | Softing TH SCOPE through 3.70 allows XSS. |
CVE-2023-4554 | Medium | 4.9 | 2024-01-29 | Improper Restriction of XML External Entity Reference vulnerability in OpenText AppBuilder on Windows, Linux allows Server Side Request Forgery, Probe System F… |
CVE-2023-4553 | Medium | 5.3 | 2024-01-29 | Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files. AppBuilder configuration files are viewable by un… |
CVE-2023-4552 | Medium | 5.5 | 2024-01-29 | Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files. An authenticated AppBuilder user with the ability… |
CVE-2023-4551 | High | 7.2 | 2024-01-29 | Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows OS Command Injection. The AppBuilder's Scheduler functionality that fa… |
CVE-2023-4550 | High | 7.5 | 2024-01-29 | Improper Input Validation, Files or Directories Accessible to External Parties vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files… |
CVE-2023-49038 | High | 7.2 | 2024-01-29 | Command injection in the ping utility on Buffalo LS210D 1.78-0.03 allows a remote authenticated attacker to inject arbitrary commands onto the NAS as root. |
CVE-2023-51842 | High | 7.5 | 2024-01-29 | An algorithm-downgrade issue was discovered in Ylianst MeshCentral 1.1.16. |
CVE-2023-51840 | Critical | 9.8 | 2024-01-29 | DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key. |
CVE-2023-51839 | Critical | 9.1 | 2024-01-29 | DeviceFarmer stf v3.6.6 suffers from Use of a Broken or Risky Cryptographic Algorithm. |
CVE-2023-30970 | Medium | 6.5 | 2024-01-29 | Gotham Table service and Forward App were found to be vulnerable to a Path traversal issue allowing an authenticated user to read arbitrary files on the file s… |
CVE-2023-22836 | Low | 3.5 | 2024-01-29 | In cases where a multi-tenant stack user is operating Foundry’s Linter service, and the user changes a group name from the default value, the renamed value may… |
CVE-2023-40551 | Medium | 5.1 | 2024-01-29 | A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system'… |
CVE-2023-40550 | Medium | 5.5 | 2024-01-29 | An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phas… |
CVE-2023-40549 | Medium | 6.2 | 2024-01-29 | An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to lo… |
CVE-2023-40546 | Medium | 6.2 | 2024-01-29 | A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message… |
CVE-2023-1705 | High | 8.4 | 2024-01-29 | Missing Authorization vulnerability in Forcepoint F|One SmartEdge Agent on Windows (bgAutoinstaller service modules) allows Privilege Escalation, Functionality… |
CVE-2023-7204 | High | 7.5 | 2024-01-29 | The WP STAGING WordPress Backup plugin before 3.2.0 allows access to cache files during the cloning process which provides |
CVE-2023-7200 | Medium | 6.1 | 2024-01-29 | The EventON WordPress plugin before 4.4.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scr… |
CVE-2023-7199 | Medium | 5.3 | 2024-01-29 | The Relevanssi WordPress plugin before 4.22.0, Relevanssi Premium WordPress plugin before 2.25.0 allows any unauthenticated user to read draft and private post… |
CVE-2023-7089 | Medium | 5.4 | 2024-01-29 | The Easy SVG Allow WordPress plugin through 1.0 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a maliciou… |
CVE-2023-7074 | High | 8.8 | 2024-01-29 | The WP SOCIAL BOOKMARK MENU WordPress plugin through 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a lo… |
CVE-2023-6946 | High | 8.8 | 2024-01-29 | The Autotitle for WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in… |
CVE-2023-6633 | Medium | 4.3 | 2024-01-29 | The Site Notes WordPress plugin through 2.0.0 does not have CSRF checks in some of its functionalities, which could allow attackers to make logged in users per… |
CVE-2023-6530 | Medium | 5.4 | 2024-01-29 | The TJ Shortcodes WordPress plugin through 0.1.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where… |
CVE-2023-6503 | Medium | 5.4 | 2024-01-29 | The WP Plugin Lister WordPress plugin through 2.1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow… |
CVE-2023-6391 | High | 8.8 | 2024-01-29 | The Custom User CSS WordPress plugin through 0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in… |
CVE-2023-6390 | High | 8.8 | 2024-01-29 | The WordPress Users WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in… |
CVE-2023-6389 | Medium | 6.1 | 2024-01-29 | The WordPress Toolbar WordPress plugin through 2.2.6 redirects to any URL via the "wptbto" parameter. This makes it possible for unauthenticated attackers to r… |
CVE-2023-6279 | High | 7.1 | 2024-01-29 | The Woostify Sites Library WordPress plugin before 1.4.8 does not have authorisation in an AJAX action, allowing any authenticated users, such as subscriber to… |
CVE-2023-6278 | Medium | 6.1 | 2024-01-29 | The Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo WordPress plugin before 2.2.25 does not sanitise and escape the biteship_error and biteship_mes… |
CVE-2023-6165 | Medium | 4.8 | 2024-01-29 | The Restrict Usernames Emails Characters WordPress plugin before 3.1.4 does not sanitise and escape some of its settings, which could allow high privilege user… |
CVE-2023-5956 | Medium | 4.8 | 2024-01-29 | The Wp-Adv-Quiz WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfo… |
CVE-2023-5943 | Medium | 4.8 | 2024-01-29 | The Wp-Adv-Quiz WordPress plugin before 1.0.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2023-5124 | Medium | 4.8 | 2024-01-29 | The Page Builder: Pagelayer WordPress plugin before 1.8.0 doesn't prevent attackers with administrator privileges from inserting malicious JavaScript inside a… |
CVE-2023-40548 | High | 7.4 | 2024-01-29 | A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the P… |
CVE-2023-29055 | High | 7.5 | 2024-01-29 | In Apache Kylin version 2.0.0 to 4.0.3, there is a Server Config web interface that displays the content of file 'kylin.properties', that may contain serversid… |
CVE-2023-5378 | High | 8.8 | 2024-01-29 | Improper Input Validation vulnerability in MegaBIP and already unsupported SmodBIP software allows for Stored XSS.This issue affects SmodBIP in all versions a… |