2023 CVEs (page 63)
Page 63 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-51948 | High | 7.5 | 2024-01-19 | A Site-wide directory listing vulnerability in /fm in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to list the files hosted by the web appli… |
CVE-2023-51947 | Critical | 9.1 | 2024-01-19 | Improper access control on nasSvr.php in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to read and modify different types of data without aut… |
CVE-2023-51946 | Medium | 6.1 | 2024-01-19 | Multiple reflected cross-site scripting (XSS) vulnerabilities in nasSvr.php in actidata actiNAS-SL-2U-8 3.2.03-SP1 allow remote attackers to inject arbitrary w… |
CVE-2023-50030 | Critical | 9.8 | 2024-01-19 | In the module "Jms Setting" (jmssetting) from Joommasters for PrestaShop, a guest can perform SQL injection in versions <= 1.1.0. The method `JmsSetting::getSe… |
CVE-2023-50028 | Critical | 9.8 | 2024-01-19 | In the module "Sliding cart block" (blockslidingcart) up to version 2.3.8 from PrestashopModules.eu for PrestaShop, a guest can perform SQL injection. |
CVE-2023-46351 | Critical | 9.8 | 2024-01-19 | In the module mib < 1.6.1 from MyPresta.eu for PrestaShop, a guest can perform SQL injection. The methods `mib::getManufacturersByCategory()` has sensitive SQL… |
CVE-2023-43985 | Critical | 9.8 | 2024-01-19 | SunnyToo stblogsearch up to v1.0.0 was discovered to contain a SQL injection vulnerability via the StBlogSearchClass::prepareSearch component. |
CVE-2023-27168 | Critical | 9.8 | 2024-01-19 | An arbitrary file upload vulnerability in Xpand IT Write-back Manager v2.3.1 allows attackers to execute arbitrary code via a crafted jsp file. |
CVE-2023-5716 | Critical | 9.8 | 2024-01-19 | ASUS Armoury Crate has a vulnerability in arbitrary file write and allows remote attackers to access or modify arbitrary files by sending specific HTTP request… |
CVE-2023-50963 | Medium | 6.5 | 2024-01-19 | IBM Storage Defender - Data Protect 1.0.0 through 1.4.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. Th… |
CVE-2023-47718 | Medium | 4.3 | 2024-01-19 | IBM Maximo Asset Management 7.6.1.3 and Manage Component 8.10 through 8.11 is vulnerable to cross-site request forgery which could allow an attacker to execute… |
CVE-2023-32337 | Medium | 5.4 | 2024-01-19 | IBM Maximo Spatial Asset Management 8.10 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized req… |
CVE-2023-40683 | High | 8.8 | 2024-01-19 | IBM OpenPages with Watson 8.3 and 9.0 could allow remote attacker to bypass security restrictions, caused by insufficient authorization checks. By authenticati… |
CVE-2023-38738 | Medium | 6.8 | 2024-01-19 | IBM OpenPages with Watson 8.3 and 9.0 could provide weaker than expected security in a OpenPages environment using Native authentication. If OpenPages is usin… |
CVE-2023-35020 | Medium | 5.4 | 2024-01-19 | IBM Sterling Control Center 6.3.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request c… |
CVE-2023-5131 | High | 8.2 | 2024-01-18 | A heap buffer-overflow exists in Delta Electronics ISPSoft. An anonymous attacker can exploit this vulnerability by enticing a user to open a specially crafted… |
CVE-2023-5130 | High | 8.2 | 2024-01-18 | A buffer overflow vulnerability exists in Delta Electronics WPLSoft. An anonymous attacker can exploit this vulnerability by enticing a user to open a speciall… |
CVE-2023-50614 | High | 7.5 | 2024-01-18 | An issue discovereed in EBYTE E880-IR01-V1.1 allows an attacker to obtain sensitive information via crafted POST request to /cgi-bin/luci. |
CVE-2023-43824 | High | 8.8 | 2024-01-18 | A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wTitleTextLen field of a DPS file. A remote, una… |
CVE-2023-43823 | High | 8.8 | 2024-01-18 | A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wTTitleLen field of a DPS file. A remote, unauth… |
CVE-2023-43822 | High | 8.8 | 2024-01-18 | A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wLogTitlesTimeLen field of a DPS file. A remote… |
CVE-2023-43821 | High | 8.8 | 2024-01-18 | A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wLogTitlesActionLen field of a DPS file. A remot… |
CVE-2023-43820 | High | 8.8 | 2024-01-18 | A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wLogTitlesPrevValueLen field of a DPS file. A re… |
CVE-2023-43819 | High | 8.8 | 2024-01-18 | A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the InitialMacroLen field of a DPS file. A remote, u… |
CVE-2023-43818 | High | 8.8 | 2024-01-18 | A buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft. A remote, unauthenticated attacker can exploit this vulnerability by enticin… |
CVE-2023-43817 | High | 7.5 | 2024-01-18 | A buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft version 2 when parsing the wMailContentLen field of a DPS file. An anonymous… |
CVE-2023-43816 | Medium | 6.3 | 2024-01-18 | A buffer overflow vulnerability exists in Delta Electronics Delta Industrial Automation DOPSoft version 2 when parsing the wKPFStringLen field of a DPS file. A… |
CVE-2023-43815 | High | 7.1 | 2024-01-18 | A buffer overflow vulnerability exists in Delta Electronics Delta Industrial Automation DOPSoft version 2 when parsing the wScreenDESCTextLen field of a DPS fi… |
CVE-2023-51258 | Medium | 5.5 | 2024-01-18 | A memory leak issue discovered in YASM v.1.3.0 allows a local attacker to cause a denial of service via the new_Token function in the modules/preprocs/nasm/nas… |
CVE-2023-51217 | High | 8.8 | 2024-01-18 | An issue discovered in TenghuTOS TWS-200 firmware version:V4.0-201809201424 allows a remote attacker to execute arbitrary code via crafted command on the ping… |
CVE-2023-49943 | Medium | 5.4 | 2024-01-18 | Zoho ManageEngine ServiceDesk Plus MSP before 14504 allows stored XSS (by a low-privileged technician) via a task's name in a time sheet. |
CVE-2023-34348 | High | 7.5 | 2024-01-18 | AVEVA PI Server versions 2023 and 2018 SP3 P05 and prior contain a vulnerability that could allow an unauthenticated user to remotely crash the PI Message Sub… |
CVE-2023-31274 | Medium | 5.3 | 2024-01-18 | AVEVA PI Server versions 2023 and 2018 SP3 P05 and prior contain a vulnerability that could allow an unauthenticated user to cause the PI Message Subsystem of… |
CVE-2023-28901 | Medium | 5.3 | 2024-01-18 | The Skoda Automotive cloud contains a Broken Access Control vulnerability, allowing remote attackers to obtain recent trip data, vehicle mileage, fuel consumpt… |
CVE-2023-28900 | Medium | 5.3 | 2024-01-18 | The Skoda Automotive cloud contains a Broken Access Control vulnerability, allowing to obtain nicknames and other user identifiers of Skoda Connect service use… |
CVE-2023-7153 | Medium | 6.1 | 2024-01-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Macroturk Software and Internet Technologies Macro-Bel al… |
CVE-2023-40052 | High | 7.5 | 2024-01-18 | This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to… |
CVE-2023-40051 | Critical | 9.1 | 2024-01-18 | This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12… |
CVE-2023-5806 | Critical | 9.8 | 2024-01-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mergen Software Quality Management System allows SQL Inje… |
CVE-2023-51464 | Medium | 5.4 | 2024-01-18 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged… |
CVE-2023-51463 | Medium | 5.4 | 2024-01-18 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2023-6970 | Medium | 6.1 | 2024-01-18 | The WP Recipe Maker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘Referer' header in all versions up to, and including, 9.1.0 d… |
CVE-2023-6958 | Medium | 6.4 | 2024-01-18 | The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 9.1.0… |
CVE-2023-6816 | Critical | 9.8 | 2024-01-18 | A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbit… |
CVE-2023-48359 | Medium | 4.4 | 2024-01-18 | In autotest driver, there is a possible out of bounds write due to improper input validation. This could lead to local denial of service with System execution… |
CVE-2023-48358 | Medium | 4.4 | 2024-01-18 | In drm driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileg… |
CVE-2023-48357 | Medium | 4.4 | 2024-01-18 | In vsp driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileg… |
CVE-2023-48356 | Medium | 4.4 | 2024-01-18 | In jpg driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileg… |
CVE-2023-48355 | Medium | 4.4 | 2024-01-18 | In jpg driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileg… |
CVE-2023-48354 | Medium | 5.5 | 2024-01-18 | In telephone service, there is a possible improper input validation. This could lead to local information disclosure with no additional execution privileges ne… |
CVE-2023-48353 | Medium | 4.4 | 2024-01-18 | In vsp driver, there is a possible use after free due to a logic error. This could lead to local denial of service with System execution privileges needed |
CVE-2023-48352 | Medium | 5.5 | 2024-01-18 | In phasecheckserver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execu… |
CVE-2023-48351 | Medium | 5.5 | 2024-01-18 | In video decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional executio… |
CVE-2023-48350 | Medium | 5.5 | 2024-01-18 | In video decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional executio… |
CVE-2023-48349 | Medium | 5.5 | 2024-01-18 | In video decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional executio… |
CVE-2023-48348 | Medium | 5.5 | 2024-01-18 | In video decoder, there is a possible out of bounds write due to improper input validation. This could lead to local denial of service with no additional execu… |
CVE-2023-48347 | Medium | 5.5 | 2024-01-18 | In video decoder, there is a possible out of bounds read due to improper input validation. This could lead to local denial of service with no additional execut… |
CVE-2023-48346 | Medium | 5.5 | 2024-01-18 | In video decoder, there is a possible improper input validation. This could lead to local denial of service with no additional execution privileges needed |
CVE-2023-48345 | Medium | 5.5 | 2024-01-18 | In video decoder, there is a possible out of bounds read due to improper input validation. This could lead to local denial of service with no additional execut… |
CVE-2023-48344 | Medium | 5.5 | 2024-01-18 | In video decoder, there is a possible out of bounds read due to improper input validation. This could lead to local denial of service with no additional execut… |
CVE-2023-48343 | Medium | 5.5 | 2024-01-18 | In video decoder, there is a possible out of bounds write due to improper input validation. This could lead to local denial of service with no additional execu… |
CVE-2023-48342 | Medium | 4.4 | 2024-01-18 | In media service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privi… |
CVE-2023-48341 | Medium | 5.5 | 2024-01-18 | In video decoder, there is a possible out of bounds read due to improper input validation. This could lead to local denial of service with no additional execut… |
CVE-2023-48340 | Medium | 5.5 | 2024-01-18 | In video decoder, there is a possible out of bounds write due to improper input validation. This could lead to local denial of service with no additional execu… |
CVE-2023-48339 | Medium | 4.4 | 2024-01-18 | In jpg driver, there is a possible missing permission check. This could lead to local information disclosure with System execution privileges needed |
CVE-2023-6184 | Medium | 5.0 | 2024-01-18 | Cross SiteScripting vulnerability in Citrix Session Recording allows attacker to perform Cross Site Scripting |
CVE-2023-6340 | Medium | 5.5 | 2024-01-18 | SonicWall Capture Client version 3.7.10, NetExtender client version 10.2.337 and earlier versions are installed with sfpmonitor.sys driver. The driver has bee… |
CVE-2023-6549 | High | 8.2 | 2024-01-17 | Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated Denial of Service and Out… |
CVE-2023-5914 | Medium | 5.4 | 2024-01-17 | Cross-site scripting (XSS) |
CVE-2023-6548 | Medium | 5.5 | 2024-01-17 | Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with mana… |
CVE-2023-48858 | Medium | 6.1 | 2024-01-17 | A Cross-site scripting (XSS) vulnerability in login page php code in Armex ABO.CMS 5.9 allows remote attackers to inject arbitrary web script or HTML via the l… |
CVE-2023-44077 | Critical | 9.8 | 2024-01-17 | Studio Network Solutions ShareBrowser before 7.0 on macOS mishandles signature verification, aka PMP-2636. |
CVE-2023-7031 | Medium | 5.7 | 2024-01-17 | Insecure Direct Object Reference vulnerabilities were discovered in the Avaya Aura Experience Portal Manager which may allow partial information disclosure to… |
CVE-2023-50950 | Low | 3.7 | 2024-01-17 | IBM QRadar SIEM 7.5 could disclose sensitive email information in responses from offense rules. IBM X-Force ID: 275709. |
CVE-2023-23896 | Medium | 5.4 | 2024-01-17 | Missing Authorization vulnerability in MyThemeShop URL Shortener by MyThemeShop.This issue affects URL Shortener by MyThemeShop: from n/a through 1.0.17. |
CVE-2023-23882 | Medium | 4.3 | 2024-01-17 | Missing Authorization vulnerability in Brainstorm Force Ultimate Addons for Beaver Builder – Lite.This issue affects Ultimate Addons for Beaver Builder – Lite… |
CVE-2023-20271 | Medium | 6.5 | 2024-01-17 | A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow an authen… |
CVE-2023-20260 | Medium | 6.0 | 2024-01-17 | A vulnerability in the application CLI of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager could allow an authenticated, local attacke… |
CVE-2023-20258 | Medium | 6.5 | 2024-01-17 | A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to execute arbitrary commands… |
CVE-2023-20257 | Medium | 4.8 | 2024-01-17 | A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to conduct cross-site scripti… |
CVE-2023-34379 | Medium | 5.4 | 2024-01-17 | Missing Authorization vulnerability in MagneticOne Cart2Cart: Magento to WooCommerce Migration.This issue affects Cart2Cart: Magento to WooCommerce Migration… |
CVE-2023-5041 | High | 8.8 | 2024-01-17 | The Track The Click WordPress plugin before 0.3.12 does not properly sanitize query parameters to the stats REST endpoint before using them in a database query… |
CVE-2023-5006 | Medium | 6.5 | 2024-01-17 | The WP Discord Invite WordPress plugin before 2.5.1 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to perform… |
CVE-2023-52285 | High | 7.5 | 2024-01-17 | ExamSys 9150244 allows SQL Injection via the /Support/action/Pages.php s_score2 parameter. |
CVE-2023-51743 | Medium | 6.5 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Set Upstream Channel ID (UC… |
CVE-2023-51742 | Medium | 6.5 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Add Downstream Frequency pa… |
CVE-2023-51741 | High | 7.5 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to transmission of authentication credentials in plaintext over the network. A remote… |
CVE-2023-51740 | High | 7.5 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to transmission of authentication credentials in plaintext over the network. A remote… |
CVE-2023-51739 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Device Name parameter at it… |
CVE-2023-51738 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Network Name (SSID) paramet… |
CVE-2023-51737 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Preshared Phrase parameter… |
CVE-2023-51736 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the L2TP/PPTP Username paramete… |
CVE-2023-51735 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Pre-shared key parameter at… |
CVE-2023-51734 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Identity parameter under Re… |
CVE-2023-51733 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Identity parameter under Lo… |
CVE-2023-51732 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the IPsec Tunnel Name parameter… |
CVE-2023-51731 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Hostname parameter at its w… |
CVE-2023-51730 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the DDNS Password parameter at… |
CVE-2023-51729 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the DDNS Username parameter at… |
CVE-2023-51728 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the SMTP Password parameter at… |