2023 CVEs (page 63)
Page 63 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-6626 | Medium | 4.8 | 2024-01-22 | The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not sanitise and escape some of its settings, which could allow high privilege users such… |
CVE-2023-6625 | Medium | 4.3 | 2024-01-22 | The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not have a CSRF check in place when deleting inquiries, which could allow attackers to mak… |
CVE-2023-6456 | Medium | 4.8 | 2024-01-22 | The WP Review Slider WordPress plugin before 13.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2023-6447 | Medium | 5.3 | 2024-01-22 | The EventPrime WordPress plugin before 3.3.6 lacks authentication and authorization, allowing unauthenticated visitors to access private and password protected… |
CVE-2023-6384 | Medium | 4.3 | 2024-01-22 | The WP User Profile Avatar WordPress plugin before 1.0.1 does not properly check for authorisation, allowing authors to delete and update arbitrary avatar |
CVE-2023-6290 | Medium | 4.8 | 2024-01-22 | The SEOPress WordPress plugin before 7.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cro… |
CVE-2023-47747 | Medium | 5.3 | 2024-01-22 | IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.1, 10.5, and 11.1 could allow an authenticated user with CONNECT privileges to cause a den… |
CVE-2023-47158 | Medium | 5.3 | 2024-01-22 | IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1 and 11.5 could allow an authenticated user with CONNECT privileges to cause a… |
CVE-2023-47152 | Medium | 5.9 | 2024-01-22 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to an insecure cryptographic algorithm and to information disclosure in st… |
CVE-2023-27859 | Medium | 6.5 | 2024-01-22 | IBM Db2 10.1, 10.5, and 11.1 could allow a remote user to execute arbitrary code caused by installing like named jar files across multiple databases. A user c… |
CVE-2023-50308 | Medium | 6.5 | 2024-01-22 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 under certain circumstances could allow an authenticated user to the database to cause a… |
CVE-2023-48118 | Critical | 9.8 | 2024-01-22 | SQL Injection vulnerability in Quest Analytics LLC IQCRM v.2023.9.5 allows a remote attacker to execute arbitrary code via a crafted request to the Common.svc… |
CVE-2023-47746 | Medium | 5.3 | 2024-01-22 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 could allow an authenticated user with CONNECT privileges to cause a den… |
CVE-2023-45193 | Medium | 5.9 | 2024-01-22 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 federated server is vulnerable to a denial of service when a specially crafted cursor is… |
CVE-2023-44395 | Medium | 4.9 | 2024-01-22 | Autolab is a course management service that enables instructors to offer autograded programming assignments to their students over the Web. Path traversal vuln… |
CVE-2023-52354 | High | 7.5 | 2024-01-22 | chasquid before 1.13 allows SMTP smuggling because LF-terminated lines are accepted. |
CVE-2023-47352 | High | 8.8 | 2024-01-22 | Technicolor TC8715D devices have predictable default WPA2 security passwords. An attacker who scans for SSID and BSSID values may be able to predict these pass… |
CVE-2023-52353 | High | 7.5 | 2024-01-21 | An issue was discovered in Mbed TLS through 3.5.1. In mbedtls_ssl_session_reset, the maximum negotiable TLS version is mishandled. For example, if the last con… |
CVE-2023-6531 | High | 7.0 | 2024-01-21 | A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()… |
CVE-2023-7063 | High | 7.2 | 2024-01-20 | The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission parameters in all versions up to, and including, 1.8.5.3… |
CVE-2023-46447 | Medium | 4.3 | 2024-01-20 | The POPS! Rebel application 5.0 for Android, in POPS! Rebel Bluetooth Glucose Monitoring System, sends unencrypted glucose measurements over BLE. |
CVE-2023-51925 | Critical | 9.8 | 2024-01-20 | An arbitrary file upload vulnerability in the nccloud.web.arcp.taskmonitor.action.ArcpUploadAction.doAction() method of YonBIP v3_23.05 allows attackers to exe… |
CVE-2023-51924 | Critical | 9.8 | 2024-01-20 | An arbitrary file upload vulnerability in the uap.framework.rc.itf.IResourceManager interface of YonBIP v3_23.05 allows attackers to execute arbitrary code via… |
CVE-2023-51906 | Critical | 9.8 | 2024-01-20 | An issue in yonyou YonBIP v3_23.05 allows a remote attacker to execute arbitrary code via a crafted script to the ServiceDispatcherServlet uap.framework.rc.itf… |
CVE-2023-47024 | High | 8.8 | 2024-01-20 | Cross-Site Request Forgery (CSRF) in NCR Terminal Handler v.1.5.1 leads to a one-click account takeover. This is achieved by exploiting multiple vulnerabilitie… |
CVE-2023-51928 | Critical | 9.8 | 2024-01-20 | An arbitrary file upload vulnerability in the nccloud.web.arcp.taskmonitor.action.ArcpUploadAction.doAction() method of YonBIP v3_23.05 allows attackers to exe… |
CVE-2023-51927 | Critical | 9.8 | 2024-01-20 | YonBIP v3_23.05 was discovered to contain a SQL injection vulnerability via the com.yonyou.hrcloud.attend.web.AttendScriptController.runScript() method. |
CVE-2023-51926 | High | 7.5 | 2024-01-20 | YonBIP v3_23.05 was discovered to contain an arbitrary file read vulnerability via the nc.bs.framework.comn.serv.CommonServletDispatcher component. |
CVE-2023-51892 | Critical | 9.8 | 2024-01-20 | An issue in weaver e-cology v.10.0.2310.01 allows a remote attacker to execute arbitrary code via a crafted script to the FrameworkShellController component. |
CVE-2023-49329 | High | 7.2 | 2024-01-19 | Anomali Match before 4.6.2 allows OS Command Injection. An authenticated admin user can inject and execute operating system commands. This arises from improper… |
CVE-2023-6450 | Medium | 5.5 | 2024-01-19 | An incorrect permissions vulnerability was reported in the Lenovo App Store app that could allow an attacker to use system resources, resulting in a denial of… |
CVE-2023-6044 | Medium | 6.3 | 2024-01-19 | A privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local attacker with physical access to impersonate Lenovo Vantage Servic… |
CVE-2023-6043 | High | 7.8 | 2024-01-19 | A privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local attacker to bypass integrity checks and execute arbitrary code wit… |
CVE-2023-5081 | Low | 3.3 | 2024-01-19 | An information disclosure vulnerability was reported in the Lenovo Tab M8 HD that could allow a local application to gather a non-resettable device identifier. |
CVE-2023-5080 | Medium | 6.8 | 2024-01-19 | A privilege escalation vulnerability was reported in some Lenovo tablet products that could allow local applications access to device identifiers and system co… |
CVE-2023-50694 | Critical | 9.8 | 2024-01-19 | An issue in dom96 HTTPbeast v.0.4.1 and before allows a remote attacker to send a malicious crafted request due to insufficient parsing in the parser.nim compo… |
CVE-2023-50693 | Critical | 9.8 | 2024-01-19 | An issue in Jester v.0.6.0 and before allows a remote attacker to send a malicious crafted request. |
CVE-2023-50447 | High | 8.1 | 2024-01-19 | Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which wa… |
CVE-2023-47035 | High | 7.5 | 2024-01-19 | RPTC 0x3b08c was discovered to not conduct status checks on the parameter tradingOpen. This vulnerability can allow attackers to conduct unauthorized transfer… |
CVE-2023-42766 | High | 7.5 | 2024-01-19 | Improper input validation in some Intel NUC 8 Compute Element BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local… |
CVE-2023-42429 | High | 7.5 | 2024-01-19 | Improper buffer restrictions in some Intel NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2023-38587 | High | 7.5 | 2024-01-19 | Improper input validation in some Intel NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2023-38541 | Medium | 6.7 | 2024-01-19 | Insecure inherited permissions in some Intel HID Event Filter drivers for Windows 10 for some Intel NUC laptop software installers before version 2.2.2.1 may a… |
CVE-2023-33295 | Medium | 6.5 | 2024-01-19 | Cohesity DataProtect prior to 6.8.1_u5 or 7.1 was discovered to have a incorrect access control vulnerability due to a lack of TLS Certificate Validation. |
CVE-2023-32544 | High | 7.3 | 2024-01-19 | Improper access control in some Intel HotKey Services for Windows 10 for Intel NUC P14E Laptop Element software installers before version 1.1.45 may allow an a… |
CVE-2023-32272 | High | 7.9 | 2024-01-19 | Uncontrolled search path in some Intel NUC Pro Software Suite Configuration Tool software installers before version 3.0.0.6 may allow an authenticated user to… |
CVE-2023-29495 | High | 7.5 | 2024-01-19 | Improper input validation for some Intel NUC BIOS firmware before version IN0048 may allow a privileged user to potentially enable escalation of privilege via… |
CVE-2023-29244 | Medium | 6.7 | 2024-01-19 | Incorrect default permissions in some Intel Integrated Sensor Hub (ISH) driver for Windows 10 for Intel NUC P14E Laptop Element software installers before vers… |
CVE-2023-28743 | High | 7.5 | 2024-01-19 | Improper input validation for some Intel NUC BIOS firmware before version QN0073 may allow a privileged user to potentially enable escalation of privilege via… |
CVE-2023-28738 | High | 7.5 | 2024-01-19 | Improper input validation for some Intel NUC BIOS firmware before version JY0070 may allow a privileged user to potentially enable escalation of privilege via… |
CVE-2023-28722 | Medium | 6.7 | 2024-01-19 | Improper buffer restrictions for some Intel NUC BIOS firmware before version IN0048 may allow a privileged user to potentially enable escalation of privilege v… |
CVE-2023-47034 | High | 7.5 | 2024-01-19 | A vulnerability in UniswapFrontRunBot 0xdB94c allows attackers to cause financial losses via unspecified vectors. |
CVE-2023-47033 | High | 7.5 | 2024-01-19 | MultiSigWallet 0xF0C99 was discovered to contain a reentrancy vulnerability via the function executeTransaction. |
CVE-2023-51948 | High | 7.5 | 2024-01-19 | A Site-wide directory listing vulnerability in /fm in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to list the files hosted by the web appli… |
CVE-2023-51947 | Critical | 9.1 | 2024-01-19 | Improper access control on nasSvr.php in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to read and modify different types of data without aut… |
CVE-2023-51946 | Medium | 6.1 | 2024-01-19 | Multiple reflected cross-site scripting (XSS) vulnerabilities in nasSvr.php in actidata actiNAS-SL-2U-8 3.2.03-SP1 allow remote attackers to inject arbitrary w… |
CVE-2023-50030 | Critical | 9.8 | 2024-01-19 | In the module "Jms Setting" (jmssetting) from Joommasters for PrestaShop, a guest can perform SQL injection in versions <= 1.1.0. The method `JmsSetting::getSe… |
CVE-2023-50028 | Critical | 9.8 | 2024-01-19 | In the module "Sliding cart block" (blockslidingcart) up to version 2.3.8 from PrestashopModules.eu for PrestaShop, a guest can perform SQL injection. |
CVE-2023-46351 | Critical | 9.8 | 2024-01-19 | In the module mib < 1.6.1 from MyPresta.eu for PrestaShop, a guest can perform SQL injection. The methods `mib::getManufacturersByCategory()` has sensitive SQL… |
CVE-2023-43985 | Critical | 9.8 | 2024-01-19 | SunnyToo stblogsearch up to v1.0.0 was discovered to contain a SQL injection vulnerability via the StBlogSearchClass::prepareSearch component. |
CVE-2023-27168 | Critical | 9.8 | 2024-01-19 | An arbitrary file upload vulnerability in Xpand IT Write-back Manager v2.3.1 allows attackers to execute arbitrary code via a crafted jsp file. |
CVE-2023-5716 | Critical | 9.8 | 2024-01-19 | ASUS Armoury Crate has a vulnerability in arbitrary file write and allows remote attackers to access or modify arbitrary files by sending specific HTTP request… |
CVE-2023-50963 | Medium | 6.5 | 2024-01-19 | IBM Storage Defender - Data Protect 1.0.0 through 1.4.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. Th… |
CVE-2023-47718 | Medium | 4.3 | 2024-01-19 | IBM Maximo Asset Management 7.6.1.3 and Manage Component 8.10 through 8.11 is vulnerable to cross-site request forgery which could allow an attacker to execute… |
CVE-2023-32337 | Medium | 5.4 | 2024-01-19 | IBM Maximo Spatial Asset Management 8.10 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized req… |
CVE-2023-40683 | High | 8.8 | 2024-01-19 | IBM OpenPages with Watson 8.3 and 9.0 could allow remote attacker to bypass security restrictions, caused by insufficient authorization checks. By authenticati… |
CVE-2023-38738 | Medium | 6.8 | 2024-01-19 | IBM OpenPages with Watson 8.3 and 9.0 could provide weaker than expected security in a OpenPages environment using Native authentication. If OpenPages is usin… |
CVE-2023-35020 | Medium | 5.4 | 2024-01-19 | IBM Sterling Control Center 6.3.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request c… |
CVE-2023-5131 | High | 8.2 | 2024-01-18 | A heap buffer-overflow exists in Delta Electronics ISPSoft. An anonymous attacker can exploit this vulnerability by enticing a user to open a specially crafted… |
CVE-2023-5130 | High | 8.2 | 2024-01-18 | A buffer overflow vulnerability exists in Delta Electronics WPLSoft. An anonymous attacker can exploit this vulnerability by enticing a user to open a speciall… |
CVE-2023-50614 | High | 7.5 | 2024-01-18 | An issue discovereed in EBYTE E880-IR01-V1.1 allows an attacker to obtain sensitive information via crafted POST request to /cgi-bin/luci. |
CVE-2023-43824 | High | 8.8 | 2024-01-18 | A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wTitleTextLen field of a DPS file. A remote, una… |
CVE-2023-43823 | High | 8.8 | 2024-01-18 | A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wTTitleLen field of a DPS file. A remote, unauth… |
CVE-2023-43822 | High | 8.8 | 2024-01-18 | A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wLogTitlesTimeLen field of a DPS file. A remote… |
CVE-2023-43821 | High | 8.8 | 2024-01-18 | A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wLogTitlesActionLen field of a DPS file. A remot… |
CVE-2023-43820 | High | 8.8 | 2024-01-18 | A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wLogTitlesPrevValueLen field of a DPS file. A re… |
CVE-2023-43819 | High | 8.8 | 2024-01-18 | A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the InitialMacroLen field of a DPS file. A remote, u… |
CVE-2023-43818 | High | 8.8 | 2024-01-18 | A buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft. A remote, unauthenticated attacker can exploit this vulnerability by enticin… |
CVE-2023-43817 | High | 7.5 | 2024-01-18 | A buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft version 2 when parsing the wMailContentLen field of a DPS file. An anonymous… |
CVE-2023-43816 | Medium | 6.3 | 2024-01-18 | A buffer overflow vulnerability exists in Delta Electronics Delta Industrial Automation DOPSoft version 2 when parsing the wKPFStringLen field of a DPS file. A… |
CVE-2023-43815 | High | 7.1 | 2024-01-18 | A buffer overflow vulnerability exists in Delta Electronics Delta Industrial Automation DOPSoft version 2 when parsing the wScreenDESCTextLen field of a DPS fi… |
CVE-2023-51258 | Medium | 5.5 | 2024-01-18 | A memory leak issue discovered in YASM v.1.3.0 allows a local attacker to cause a denial of service via the new_Token function in the modules/preprocs/nasm/nas… |
CVE-2023-51217 | High | 8.8 | 2024-01-18 | An issue discovered in TenghuTOS TWS-200 firmware version:V4.0-201809201424 allows a remote attacker to execute arbitrary code via crafted command on the ping… |
CVE-2023-49943 | Medium | 5.4 | 2024-01-18 | Zoho ManageEngine ServiceDesk Plus MSP before 14504 allows stored XSS (by a low-privileged technician) via a task's name in a time sheet. |
CVE-2023-34348 | High | 7.5 | 2024-01-18 | AVEVA PI Server versions 2023 and 2018 SP3 P05 and prior contain a vulnerability that could allow an unauthenticated user to remotely crash the PI Message Sub… |
CVE-2023-31274 | Medium | 5.3 | 2024-01-18 | AVEVA PI Server versions 2023 and 2018 SP3 P05 and prior contain a vulnerability that could allow an unauthenticated user to cause the PI Message Subsystem of… |
CVE-2023-28901 | Medium | 5.3 | 2024-01-18 | The Skoda Automotive cloud contains a Broken Access Control vulnerability, allowing remote attackers to obtain recent trip data, vehicle mileage, fuel consumpt… |
CVE-2023-28900 | Medium | 5.3 | 2024-01-18 | The Skoda Automotive cloud contains a Broken Access Control vulnerability, allowing to obtain nicknames and other user identifiers of Skoda Connect service use… |
CVE-2023-7153 | Medium | 6.1 | 2024-01-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Macroturk Software and Internet Technologies Macro-Bel al… |
CVE-2023-40052 | High | 7.5 | 2024-01-18 | This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to… |
CVE-2023-40051 | Critical | 9.1 | 2024-01-18 | This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12… |
CVE-2023-5806 | Critical | 9.8 | 2024-01-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mergen Software Quality Management System allows SQL Inje… |
CVE-2023-51464 | Medium | 5.4 | 2024-01-18 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged… |
CVE-2023-51463 | Medium | 5.4 | 2024-01-18 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2023-6970 | Medium | 6.1 | 2024-01-18 | The WP Recipe Maker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘Referer' header in all versions up to, and including, 9.1.0 d… |
CVE-2023-6958 | Medium | 6.4 | 2024-01-18 | The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 9.1.0… |
CVE-2023-6816 | Critical | 9.8 | 2024-01-18 | A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbit… |
CVE-2023-48359 | Medium | 4.4 | 2024-01-18 | In autotest driver, there is a possible out of bounds write due to improper input validation. This could lead to local denial of service with System execution… |
CVE-2023-48358 | Medium | 4.4 | 2024-01-18 | In drm driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileg… |
CVE-2023-48357 | Medium | 4.4 | 2024-01-18 | In vsp driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileg… |