2023 CVEs (page 61)
Page 61 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-6258 | High | 8.1 | 2024-01-30 | A security vulnerability has been identified in the pkcs11-provider, which is associated with Public-Key Cryptography Standards (PKCS#11). If exploited success… |
CVE-2023-46231 | Medium | 6.8 | 2024-01-30 | In Splunk Add-on Builder versions below 4.1.4, the application writes user session tokens to its internal log files when you visit the Splunk Add-on Builder or… |
CVE-2023-46230 | High | 8.2 | 2024-01-30 | In Splunk Add-on Builder versions below 4.1.4, the app writes sensitive information to internal log files. |
CVE-2023-37518 | Medium | 6.4 | 2024-01-30 | HCL BigFix ServiceNow is vulnerable to arbitrary code injection. A malicious authorized attacker could inject arbitrary code and execute within the context of… |
CVE-2023-6943 | Critical | 9.8 | 2024-01-30 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5… |
CVE-2023-6942 | High | 7.5 | 2024-01-30 | Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5.92, GT Designer3 Version1(GOT1000) ver… |
CVE-2023-6374 | Medium | 5.9 | 2024-01-30 | Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 all serial numbers allows a remote unau… |
CVE-2023-36260 | High | 7.5 | 2024-01-30 | An issue was discovered in the Feed Me plugin 4.6.1 for Craft CMS. It allows remote attackers to cause a denial of service (DoS) via crafted strings to Feed-Me… |
CVE-2023-36259 | Medium | 5.4 | 2024-01-30 | Cross Site Scripting (XSS) vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during user creation. |
CVE-2023-7225 | Medium | 6.4 | 2024-01-30 | The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the width and height parameters in all versions up to, an… |
CVE-2023-5372 | High | 7.2 | 2024-01-30 | The post-authentication command injection vulnerability in Zyxel NAS326 firmware versions through V5.21(AAZF.15)C0 and NAS542 firmware versions through V5.21(A… |
CVE-2023-51982 | Critical | 9.8 | 2024-01-30 | CrateDB 5.5.1 is contains an authentication bypass vulnerability in the Admin UI component. After configuring password authentication and_ Local_ In the case o… |
CVE-2023-51843 | High | 8.2 | 2024-01-30 | react-dashboard 1.4.0 is vulnerable to Cross Site Scripting (XSS) as httpOnly is not set. |
CVE-2023-51837 | Critical | 9.8 | 2024-01-30 | Ylianst MeshCentral 1.1.16 is vulnerable to Missing SSL Certificate Validation. |
CVE-2023-51813 | Medium | 6.5 | 2024-01-30 | Cross Site Request Forgery (CSRF) vulnerability in Free Open-Source Inventory Management System v.1.0 allows a remote attacker to execute arbitrary code via th… |
CVE-2023-37571 | Medium | 6.1 | 2024-01-30 | Softing TH SCOPE through 3.70 allows XSS. |
CVE-2023-4554 | Medium | 4.9 | 2024-01-29 | Improper Restriction of XML External Entity Reference vulnerability in OpenText AppBuilder on Windows, Linux allows Server Side Request Forgery, Probe System F… |
CVE-2023-4553 | Medium | 5.3 | 2024-01-29 | Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files. AppBuilder configuration files are viewable by un… |
CVE-2023-4552 | Medium | 5.5 | 2024-01-29 | Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files. An authenticated AppBuilder user with the ability… |
CVE-2023-4551 | High | 7.2 | 2024-01-29 | Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows OS Command Injection. The AppBuilder's Scheduler functionality that fa… |
CVE-2023-4550 | High | 7.5 | 2024-01-29 | Improper Input Validation, Files or Directories Accessible to External Parties vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files… |
CVE-2023-49038 | High | 7.2 | 2024-01-29 | Command injection in the ping utility on Buffalo LS210D 1.78-0.03 allows a remote authenticated attacker to inject arbitrary commands onto the NAS as root. |
CVE-2023-51842 | High | 7.5 | 2024-01-29 | An algorithm-downgrade issue was discovered in Ylianst MeshCentral 1.1.16. |
CVE-2023-51840 | Critical | 9.8 | 2024-01-29 | DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key. |
CVE-2023-51839 | Critical | 9.1 | 2024-01-29 | DeviceFarmer stf v3.6.6 suffers from Use of a Broken or Risky Cryptographic Algorithm. |
CVE-2023-30970 | Medium | 6.5 | 2024-01-29 | Gotham Table service and Forward App were found to be vulnerable to a Path traversal issue allowing an authenticated user to read arbitrary files on the file s… |
CVE-2023-22836 | Low | 3.5 | 2024-01-29 | In cases where a multi-tenant stack user is operating Foundry’s Linter service, and the user changes a group name from the default value, the renamed value may… |
CVE-2023-40551 | Medium | 5.1 | 2024-01-29 | A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system'… |
CVE-2023-40550 | Medium | 5.5 | 2024-01-29 | An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phas… |
CVE-2023-40549 | Medium | 6.2 | 2024-01-29 | An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to lo… |
CVE-2023-40546 | Medium | 6.2 | 2024-01-29 | A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message… |
CVE-2023-1705 | High | 8.4 | 2024-01-29 | Missing Authorization vulnerability in Forcepoint F|One SmartEdge Agent on Windows (bgAutoinstaller service modules) allows Privilege Escalation, Functionality… |
CVE-2023-7204 | High | 7.5 | 2024-01-29 | The WP STAGING WordPress Backup plugin before 3.2.0 allows access to cache files during the cloning process which provides |
CVE-2023-7200 | Medium | 6.1 | 2024-01-29 | The EventON WordPress plugin before 4.4.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scr… |
CVE-2023-7199 | Medium | 5.3 | 2024-01-29 | The Relevanssi WordPress plugin before 4.22.0, Relevanssi Premium WordPress plugin before 2.25.0 allows any unauthenticated user to read draft and private post… |
CVE-2023-7089 | Medium | 5.4 | 2024-01-29 | The Easy SVG Allow WordPress plugin through 1.0 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a maliciou… |
CVE-2023-7074 | High | 8.8 | 2024-01-29 | The WP SOCIAL BOOKMARK MENU WordPress plugin through 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a lo… |
CVE-2023-6946 | High | 8.8 | 2024-01-29 | The Autotitle for WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in… |
CVE-2023-6633 | Medium | 4.3 | 2024-01-29 | The Site Notes WordPress plugin through 2.0.0 does not have CSRF checks in some of its functionalities, which could allow attackers to make logged in users per… |
CVE-2023-6530 | Medium | 5.4 | 2024-01-29 | The TJ Shortcodes WordPress plugin through 0.1.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where… |
CVE-2023-6503 | Medium | 5.4 | 2024-01-29 | The WP Plugin Lister WordPress plugin through 2.1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow… |
CVE-2023-6391 | High | 8.8 | 2024-01-29 | The Custom User CSS WordPress plugin through 0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in… |
CVE-2023-6390 | High | 8.8 | 2024-01-29 | The WordPress Users WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in… |
CVE-2023-6389 | Medium | 6.1 | 2024-01-29 | The WordPress Toolbar WordPress plugin through 2.2.6 redirects to any URL via the "wptbto" parameter. This makes it possible for unauthenticated attackers to r… |
CVE-2023-6279 | High | 7.1 | 2024-01-29 | The Woostify Sites Library WordPress plugin before 1.4.8 does not have authorisation in an AJAX action, allowing any authenticated users, such as subscriber to… |
CVE-2023-6278 | Medium | 6.1 | 2024-01-29 | The Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo WordPress plugin before 2.2.25 does not sanitise and escape the biteship_error and biteship_mes… |
CVE-2023-6165 | Medium | 4.8 | 2024-01-29 | The Restrict Usernames Emails Characters WordPress plugin before 3.1.4 does not sanitise and escape some of its settings, which could allow high privilege user… |
CVE-2023-5956 | Medium | 4.8 | 2024-01-29 | The Wp-Adv-Quiz WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfo… |
CVE-2023-5943 | Medium | 4.8 | 2024-01-29 | The Wp-Adv-Quiz WordPress plugin before 1.0.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2023-5124 | Medium | 4.8 | 2024-01-29 | The Page Builder: Pagelayer WordPress plugin before 1.8.0 doesn't prevent attackers with administrator privileges from inserting malicious JavaScript inside a… |
CVE-2023-40548 | High | 7.4 | 2024-01-29 | A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the P… |
CVE-2023-29055 | High | 7.5 | 2024-01-29 | In Apache Kylin version 2.0.0 to 4.0.3, there is a Server Config web interface that displays the content of file 'kylin.properties', that may contain serversid… |
CVE-2023-5378 | High | 8.8 | 2024-01-29 | Improper Input Validation vulnerability in MegaBIP and already unsupported SmodBIP software allows for Stored XSS.This issue affects SmodBIP in all versions a… |
CVE-2023-46838 | High | 7.5 | 2024-01-29 | Transmit requests in Xen's virtual network protocol can consist of multiple parts. While not really useful, except for the initial part any of them may be of… |
CVE-2023-6200 | High | 7.5 | 2024-01-28 | A race condition was found in the Linux Kernel. Under certain conditions, an unauthenticated attacker from an adjacent network could send an ICMPv6 router adve… |
CVE-2023-48202 | Medium | 5.4 | 2024-01-27 | Cross-Site Scripting (XSS) vulnerability in Sunlight CMS 8.0.1 allows an authenticated low-privileged user to escalate privileges via a crafted SVG file in the… |
CVE-2023-48201 | Medium | 5.4 | 2024-01-27 | Cross Site Scripting (XSS) vulnerability in Sunlight CMS v.8.0.1, allows remote authenticated attackers to execute arbitrary code and escalate privileges via a… |
CVE-2023-6497 | Medium | 4.4 | 2024-01-27 | The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the automatic redirect URL setting in all versions up… |
CVE-2023-52389 | Critical | 9.8 | 2024-01-27 | UTF32Encoding.cpp in POCO has a Poco::UTF32Encoding integer overflow and resultant stack buffer overflow because Poco::UTF32Encoding::convert() and Poco::UTF32… |
CVE-2023-6482 | Medium | 5.2 | 2024-01-27 | Use of encryption key derived from static information in Synaptics Fingerprint Driver allows an attacker to set up a TLS session with the fingerprint sensor… |
CVE-2023-52187 | Medium | 5.3 | 2024-01-27 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Thomas Maier Image Source Control Lite – Show Image Credits and Captions.This issue… |
CVE-2023-29081 | Medium | 5.5 | 2024-01-26 | A vulnerability has been reported in Suite Setups built with versions prior to InstallShield 2023 R2. This vulnerability may allow locally authenticated users… |
CVE-2023-6291 | High | 7.1 | 2024-01-26 | A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may… |
CVE-2023-6919 | High | 7.5 | 2024-01-26 | Path Traversal: '/../filedir' vulnerability in Biges Safe Life Technologies Electronics Inc. VGuard allows Absolute Path Traversal. This issue affects VGuard… |
CVE-2023-48129 | Medium | 5.4 | 2024-01-26 | An issue in kimono-oldnew mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-48135 | Medium | 5.4 | 2024-01-26 | An issue in mimasaka_farm mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-48133 | Medium | 5.4 | 2024-01-26 | An issue in angel coffee mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-48132 | Medium | 5.4 | 2024-01-26 | An issue in kosei entertainment esportsstudioLegends mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the chann… |
CVE-2023-48131 | Medium | 5.4 | 2024-01-26 | An issue in CHIGASAKI BAKERY mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-48130 | Medium | 5.4 | 2024-01-26 | An issue in GINZA CAFE mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-48128 | Medium | 5.4 | 2024-01-26 | An issue in UNITED BOXING GYM mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-48127 | Medium | 5.4 | 2024-01-26 | An issue in myGAKUYA mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-48126 | Medium | 5.4 | 2024-01-26 | An issue in Luxe Beauty Clinic mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-38323 | Critical | 9.8 | 2024-01-26 | An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the status path script entry in the configuration file, allowing attackers that have dir… |
CVE-2023-38319 | Critical | 9.8 | 2024-01-26 | An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the FAS key entry in the configuration file, allowing attackers that have direct or indi… |
CVE-2023-38318 | Critical | 9.8 | 2024-01-26 | An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the gateway FQDN entry in the configuration file, allowing attackers that have direct or… |
CVE-2023-38317 | Critical | 9.8 | 2024-01-26 | An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the network interface name entry in the configuration file, allowing attackers that have… |
CVE-2023-6159 | Medium | 6.5 | 2024-01-26 | An issue has been discovered in GitLab CE/EE affecting all versions from 12.7 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 It was possible f… |
CVE-2023-5612 | Medium | 5.3 | 2024-01-26 | An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the user e… |
CVE-2023-5933 | Medium | 6.4 | 2024-01-26 | An issue has been discovered in GitLab CE/EE affecting all versions after 13.7 before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. Improper input sa… |
CVE-2023-51833 | High | 8.1 | 2024-01-25 | A command injection issue in TRENDnet TEW-411BRPplus v.2.07_eu that allows a local attacker to execute arbitrary code via the data1 parameter in the debug.cgi… |
CVE-2023-52251 | High | 8.8 | 2024-01-25 | An issue discovered in provectus kafka-ui 0.4.0 through 0.7.2 allows remote attackers to execute arbitrary code via the q parameter of /api/clusters/local/topi… |
CVE-2023-52046 | Medium | 4.8 | 2024-01-25 | Cross Site Scripting vulnerability (XSS) in webmin v.2.105 and earlier allows a remote attacker to execute arbitrary code via a crafted payload to the "Execute… |
CVE-2023-52356 | High | 7.5 | 2024-01-25 | A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a re… |
CVE-2023-52355 | High | 7.5 | 2024-01-25 | An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a rem… |
CVE-2023-41474 | Medium | 6.5 | 2024-01-25 | Directory Traversal vulnerability in Ivanti Avalanche 6.3.4.153 allows a remote authenticated attacker to obtain sensitive information via the javax.faces.reso… |
CVE-2023-7227 | Critical | 9.8 | 2024-01-25 | SystemK NVR 504/508/516 versions 2.3.5SK.30084998 and prior are vulnerable to a command injection vulnerability in the dynamic domain name system (DDNS) setti… |
CVE-2023-6267 | High | 8.6 | 2024-01-25 | A flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is being proc… |
CVE-2023-52076 | High | 8.5 | 2024-01-25 | Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists… |
CVE-2023-40547 | High | 8.3 | 2024-01-25 | A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allow… |
CVE-2023-3181 | High | 7.8 | 2024-01-25 | The C:\Program Files (x86)\Splashtop\Splashtop Software Updater\uninst.exe process creates a folder at C:\Windows\Temp~nsu.tmp and copies itself to it as Au_.e… |
CVE-2023-6282 | Medium | 5.4 | 2024-01-25 | IceHrm 23.0.0.OS does not sufficiently encode user-controlled input, which creates a Cross-Site Scripting (XSS) vulnerability via /icehrm/app/fileupload_page.p… |
CVE-2023-33760 | Medium | 5.3 | 2024-01-25 | SpliceCom Maximiser Soft PBX v1.5 and before was discovered to utilize a default SSL certificate. This issue can allow attackers to eavesdrop on communications… |
CVE-2023-33759 | Critical | 9.8 | 2024-01-25 | SpliceCom Maximiser Soft PBX v1.5 and before does not restrict excessive authentication attempts, allowing attackers to bypass authentication via a brute force… |
CVE-2023-33758 | Medium | 6.1 | 2024-01-25 | Splicecom Maximiser Soft PBX v1.5 and before was discovered to contain a cross-site scripting (XSS) vulnerability via the CLIENT_NAME and DEVICE_GUID fields in… |
CVE-2023-33757 | Medium | 5.9 | 2024-01-25 | A lack of SSL certificate validation in Splicecom iPCS (iOS App) v1.3.4, iPCS2 (iOS App) v2.8 and before, and iPCS (Android App) v1.8.5 and before allows attac… |
CVE-2023-50785 | Low | 2.7 | 2024-01-25 | Zoho ManageEngine ADAudit Plus before 7270 allows admin users to view names of arbitrary directories via path traversal. |
CVE-2023-24676 | High | 7.2 | 2024-01-24 | An issue found in ProcessWire 3.0.210 allows attackers to execute arbitrary code and install a reverse shell via the download_zip_url parameter when installing… |
CVE-2023-52040 | Critical | 9.8 | 2024-01-24 | An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_41284C function. |
CVE-2023-52039 | Critical | 9.8 | 2024-01-24 | An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_415AA4 function. |