2023 CVEs (page 64)
Page 64 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-51727 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the SMTP Username parameter at… |
CVE-2023-51726 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the SMTP Server Name parameter… |
CVE-2023-51725 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Contact Email Address param… |
CVE-2023-51724 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the URL parameter at its web in… |
CVE-2023-51723 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Description parameter at it… |
CVE-2023-51722 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Time Server 3 parameter at… |
CVE-2023-51721 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Time Server 2 parameter at… |
CVE-2023-51720 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Time Server 1 parameter at… |
CVE-2023-51719 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Traceroute parameter at its… |
CVE-2023-52069 | Medium | 5.4 | 2024-01-17 | kodbox v1.49.04 was discovered to contain a cross-site scripting (XSS) vulnerability via the URL parameter. |
CVE-2023-46952 | Medium | 6.1 | 2024-01-17 | Cross Site Scripting vulnerability in ABO.CMS v.5.9.3 allows an attacker to execute arbitrary code via a crafted payload to the Referer header. |
CVE-2023-36235 | Medium | 6.5 | 2024-01-17 | An issue in webkul qloapps before v1.6.0 allows an attacker to obtain sensitive information via the id_order parameter. |
CVE-2023-25295 | Medium | 6.1 | 2024-01-17 | A Cross Site Scripting (XSS) vulnerability in evewa3ajax.php in GRUEN eVEWA3 Community 31 through 53 allows attackers to obtain escalated privileges via a craf… |
CVE-2023-49515 | Medium | 4.6 | 2024-01-17 | Insecure Permissiosn vulnerability in TP Link TC70 and C200 WIFI Camera v.3 firmware v.1.3.4 and fixed in v.1.3.11 allows a physically proximate attacker to ob… |
CVE-2023-51807 | Medium | 5.4 | 2024-01-16 | Cross Site Scripting vulnerability in OFCMS v.1.14 allows a remote attacker to obtain sensitive information via a crafted payload to the title addition compone… |
CVE-2023-52068 | Medium | 6.1 | 2024-01-16 | kodbox v1.43 was discovered to contain a cross-site scripting (XSS) vulnerability via the operation and login logs. |
CVE-2023-52042 | Critical | 9.8 | 2024-01-16 | An issue discovered in sub_4117F8 function in TOTOLINK X6000R V9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the 'lang' parameter. |
CVE-2023-39691 | Critical | 9.8 | 2024-01-16 | An issue discovered in kodbox through 1.43 allows attackers to arbitrarily add Administrator accounts via crafted GET request. |
CVE-2023-36236 | Medium | 4.8 | 2024-01-16 | Cross Site Scripting vulnerability in webkil Bagisto v.1.5.0 and before allows an attacker to execute arbitrary code via a crafted SVG file uplad. |
CVE-2023-21901 | High | 7.4 | 2024-01-16 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Infrastruct… |
CVE-2023-48926 | Medium | 5.3 | 2024-01-16 | An issue in 202 ecommerce Advanced Loyalty Program: Loyalty Points before v2.3.4 for PrestaShop allows unauthenticated attackers to arbitrarily change an order… |
CVE-2023-6336 | High | 7.2 | 2024-01-16 | Improper Link Resolution Before File Access ('Link Following') vulnerability in HYPR Workforce Access on MacOS allows User-Controlled Filename.This issue affec… |
CVE-2023-6335 | Medium | 6.4 | 2024-01-16 | Improper Link Resolution Before File Access ('Link Following') vulnerability in HYPR Workforce Access on Windows allows User-Controlled Filename.This issue aff… |
CVE-2023-6334 | Medium | 5.3 | 2024-01-16 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in HYPR Workforce Access on Windows allows Overflow Buffers.This issue af… |
CVE-2023-5097 | High | 7.0 | 2024-01-16 | Improper Input Validation vulnerability in HYPR Workforce Access on Windows allows Path Traversal.This issue affects Workforce Access: before 8.7. |
CVE-2023-7234 | Medium | 5.3 | 2024-01-16 | OPCUAServerToolkit will write a log message once an OPC UA client has successfully connected containing the client's self-defined description field. |
CVE-2023-52041 | Critical | 9.8 | 2024-01-16 | An issue discovered in TOTOLINK X6000R V9.4.0cu.852_B20230719 allows attackers to run arbitrary code via the sub_410118 function of the shttpd program. |
CVE-2023-49351 | Critical | 9.8 | 2024-01-16 | A stack-based buffer overflow vulnerability in /bin/webs binary in Edimax BR6478AC V2 firmware veraion v1.23 allows attackers to overwrite other values located… |
CVE-2023-37523 | Medium | 5.6 | 2024-01-16 | Missing or insecure tags in the HCL BigFix Bare OSD Metal Server WebUI version 311.19 or lower could allow an attacker to execute a malicious script on the use… |
CVE-2023-22514 | High | 7.8 | 2024-01-16 | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.14 of Sourcetree for Mac and Sourcetree for Windows. This RCE… |
CVE-2023-22512 | High | 7.5 | 2024-01-16 | This High severity DoS (Denial of Service) vulnerability was introduced in version 5.6.0 of Confluence Data Center and Server. With a CVSS Score of 7.5, this v… |
CVE-2023-4969 | Medium | 6.5 | 2024-01-16 | A GPU kernel can read sensitive data from another GPU kernel (even from another user or app) through an optimized GPU memory region called _local memory_ on va… |
CVE-2023-7154 | Medium | 4.8 | 2024-01-16 | The Hubbub Lite (formerly Grow Social) WordPress plugin before 1.32.0 does not sanitise and escape some of its settings, which could allow high privilege users… |
CVE-2023-7151 | Medium | 6.1 | 2024-01-16 | The Product Enquiry for WooCommerce WordPress plugin before 3.2 does not sanitise and escape the page parameter before outputting it back in an attribute, lead… |
CVE-2023-7125 | Medium | 4.3 | 2024-01-16 | The Community by PeepSo WordPress plugin before 6.3.1.2 does not have CSRF check when creating a user post (visible on their wall in their profile page), which… |
CVE-2023-7084 | Medium | 5.4 | 2024-01-16 | The Voting Record WordPress plugin through 2.0 is missing sanitisation as well as escaping, which could allow any authenticated users, such as subscriber to pe… |
CVE-2023-7083 | Medium | 5.4 | 2024-01-16 | The Voting Record WordPress plugin through 2.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow atta… |
CVE-2023-6824 | Medium | 6.5 | 2024-01-16 | The WP Customer Area WordPress plugin before 8.2.1 does not properly validates user capabilities in some of its AJAX actions, allowing any users to retrieve ot… |
CVE-2023-6741 | Medium | 4.3 | 2024-01-16 | The WP Customer Area WordPress plugin before 8.2.1 does not properly validate users capabilities in some of its AJAX actions, allowing malicious users to edit… |
CVE-2023-6732 | Medium | 4.8 | 2024-01-16 | The Ultimate Maps by Supsystic WordPress plugin before 1.2.16 does not sanitise and escape some of its settings, which could allow high privilege users such as… |
CVE-2023-6592 | Medium | 5.3 | 2024-01-16 | The FastDup WordPress plugin before 2.2 does not prevent directory listing in sensitive directories containing export files. |
CVE-2023-6373 | High | 8.8 | 2024-01-16 | The ArtPlacer Widget WordPress plugin before 2.20.7 does not sanitize and escape the "id" parameter before submitting the query, leading to a SQLI exploitable… |
CVE-2023-6292 | Medium | 4.3 | 2024-01-16 | The Ecwid Ecommerce Shopping Cart WordPress plugin before 6.12.5 does not have CSRF check in place when updating its settings, which could allow attackers to m… |
CVE-2023-6046 | Medium | 4.8 | 2024-01-16 | The EventON WordPress plugin before 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stor… |
CVE-2023-6005 | Medium | 4.8 | 2024-01-16 | The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 does not sanitize and escape some of its settings, which could allow high priv… |
CVE-2023-5922 | High | 7.5 | 2024-01-16 | The Royal Elementor Addons and Templates WordPress plugin before 1.3.81 does not ensure that users accessing posts via an AJAX action (and REST endpoint, curre… |
CVE-2023-5558 | Medium | 6.1 | 2024-01-16 | The LearnPress WordPress plugin before 4.2.5.5 does not sanitise and escape user input before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2023-4797 | High | 7.2 | 2024-01-16 | The Newsletters WordPress plugin before 4.9.3 does not properly escape user-controlled parameters when they are appended to SQL queries and shell commands, whi… |
CVE-2023-4757 | Medium | 5.4 | 2024-01-16 | The Staff / Employee Business Directory for Active Directory WordPress plugin before 1.2.3 does not sanitize and escape data returned from the LDAP server befo… |
CVE-2023-4703 | High | 7.5 | 2024-01-16 | The All in One B2B for WooCommerce WordPress plugin through 1.0.3 does not properly validate parameters when updating user details, allowing an unauthenticated… |
CVE-2023-4536 | High | 8.8 | 2024-01-16 | The My Account Page Editor WordPress plugin before 1.3.2 does not validate the profile picture to be uploaded, allowing any authenticated users, such as subscr… |
CVE-2023-45237 | Medium | 5.3 | 2024-01-16 | EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized a… |
CVE-2023-45236 | Medium | 5.8 | 2024-01-16 | EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized a… |
CVE-2023-45235 | High | 8.3 | 2024-01-16 | EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option from a DHCPv6 proxy Advertise message. This … |
CVE-2023-45234 | High | 8.3 | 2024-01-16 | EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers option from a DHCPv6 Advertise message. This vulnerabilit… |
CVE-2023-45233 | High | 7.5 | 2024-01-16 | EDK2's Network Package is susceptible to an infinite lop vulnerability when parsing a PadN option in the Destination Options header of IPv6. This vulnerabilit… |
CVE-2023-45232 | High | 7.5 | 2024-01-16 | EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in the Destination Options header of IPv6. This vulnerabi… |
CVE-2023-45231 | Medium | 6.5 | 2024-01-16 | EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing Neighbor Discovery Redirect message. This vulnerability can be… |
CVE-2023-45230 | High | 8.3 | 2024-01-16 | EDK2's Network Package is susceptible to a buffer overflow vulnerability via a long server ID option in DHCPv6 client. This vulnerability can be exploited by… |
CVE-2023-45229 | Medium | 6.5 | 2024-01-16 | EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or IA_TA option in a DHCPv6 Advertise message. This vu… |
CVE-2023-3771 | Medium | 6.1 | 2024-01-16 | The T1 WordPress theme through 19.0 is vulnerable to unauthenticated open redirect with which any attacker and redirect users to arbitrary websites. |
CVE-2023-3647 | Medium | 4.8 | 2024-01-16 | The IURNY by INDIGITALL WordPress plugin before 3.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2023-3372 | Medium | 5.4 | 2024-01-16 | The Lana Shortcodes WordPress plugin before 1.2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post wher… |
CVE-2023-3211 | Critical | 9.8 | 2024-01-16 | The WordPress Database Administrator WordPress plugin through 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an… |
CVE-2023-3178 | Medium | 4.3 | 2024-01-16 | The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users w… |
CVE-2023-37522 | Medium | 5.6 | 2024-01-16 | HCL BigFix Bare OSD Metal Server WebUI version 311.19 or lower has missing or insecure tags that could allow an attacker to execute a malicious script on the u… |
CVE-2023-37521 | Low | 2.3 | 2024-01-16 | HCL BigFix Bare OSD Metal Server WebUI version 311.19 or lower can sometimes include sensitive information in a query string which could allow an attacker to e… |
CVE-2023-2655 | High | 7.2 | 2024-01-16 | The Contact Form by WD WordPress plugin through 1.13.23 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL… |
CVE-2023-2252 | Low | 2.7 | 2024-01-16 | The Directorist WordPress plugin before 7.5.4 is vulnerable to Local File Inclusion as it does not validate the file parameter when importing CSV files. |
CVE-2023-1405 | High | 7.5 | 2024-01-16 | The Formidable Forms WordPress plugin before 6.2 unserializes user input, which could allow anonymous users to perform PHP Object Injection when a suitable gad… |
CVE-2023-0824 | Medium | 6.5 | 2024-01-16 | The User registration & user profile WordPress plugin through 2.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, whi… |
CVE-2023-0769 | Medium | 6.1 | 2024-01-16 | The hiWeb Migration Simple WordPress plugin through 2.0.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflec… |
CVE-2023-0479 | Medium | 6.1 | 2024-01-16 | The Print Invoice & Delivery Notes for WooCommerce WordPress plugin before 4.7.2 is vulnerable to reflected XSS by echoing a GET value in an admin note within… |
CVE-2023-0389 | Medium | 4.8 | 2024-01-16 | The Calculated Fields Form WordPress plugin before 1.1.151 does not sanitise and escape some of its form settings, which could allow high privilege users such… |
CVE-2023-0376 | Medium | 5.4 | 2024-01-16 | The Qubely WordPress plugin before 1.8.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is e… |
CVE-2023-0224 | Critical | 9.8 | 2024-01-16 | The GiveWP WordPress plugin before 2.24.1 does not properly escape user input before it reaches SQL queries, which could let unauthenticated attackers perform… |
CVE-2023-0094 | Medium | 5.4 | 2024-01-16 | The UpQode Google Maps WordPress plugin through 1.0.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post… |
CVE-2023-0079 | Medium | 5.4 | 2024-01-16 | The Customer Reviews for WooCommerce WordPress plugin before 5.17.0 does not validate and escape some of its shortcode attributes before outputting them back i… |
CVE-2023-6395 | Medium | 6.7 | 2024-01-16 | The Mock software contains a vulnerability wherein an attacker could potentially exploit privilege escalation, enabling the execution of arbitrary code with ro… |
CVE-2023-52106 | Medium | 4.4 | 2024-01-16 | Vulnerability of permission verification for APIs in the DownloadProviderMain module. Impact: Successful exploitation of this vulnerability will affect integri… |
CVE-2023-52105 | High | 7.5 | 2024-01-16 | The nearby module has a privilege escalation vulnerability. Successful exploitation of this vulnerability may affect availability. |
CVE-2023-52104 | High | 7.5 | 2024-01-16 | Vulnerability of parameters being not verified in the WMS module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-52103 | Critical | 9.8 | 2024-01-16 | Buffer overflow vulnerability in the FLP module. Successful exploitation of this vulnerability may cause out-of-bounds read. |
CVE-2023-52102 | High | 7.5 | 2024-01-16 | Vulnerability of parameters being not verified in the WMS module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-52101 | Critical | 9.1 | 2024-01-16 | Component exposure vulnerability in the Wi-Fi module. Successful exploitation of this vulnerability may affect service availability and integrity. |
CVE-2023-52100 | High | 7.5 | 2024-01-16 | The Celia Keyboard module has a vulnerability in access control. Successful exploitation of this vulnerability may affect availability. |
CVE-2023-52099 | High | 7.5 | 2024-01-16 | Vulnerability of foreground service restrictions being bypassed in the NMS module. Successful exploitation of this vulnerability may affect service confidentia… |
CVE-2023-34063 | Critical | 9.9 | 2024-01-16 | Aria Automation contains a Missing Access Control vulnerability. An authenticated malicious actor may exploit this vulnerability leading to unauthorized acc… |
CVE-2023-52116 | High | 7.5 | 2024-01-16 | Permission management vulnerability in the multi-screen interaction module. Successful exploitation of this vulnerability may cause service exceptions of the d… |
CVE-2023-52115 | High | 7.5 | 2024-01-16 | The iaware module has a Use-After-Free (UAF) vulnerability. Successful exploitation of this vulnerability may affect the system functions. |
CVE-2023-52114 | High | 7.5 | 2024-01-16 | Data confidentiality vulnerability in the ScreenReader module. Successful exploitation of this vulnerability may affect service integrity. |
CVE-2023-52108 | High | 7.5 | 2024-01-16 | Vulnerability of process priorities being raised in the ActivityManagerService module. Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52107 | High | 7.5 | 2024-01-16 | Vulnerability of permissions being not strictly verified in the WMS module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-52098 | High | 7.5 | 2024-01-16 | Denial of Service (DoS) vulnerability in the DMS module. Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52113 | High | 7.5 | 2024-01-16 | launchAnyWhere vulnerability in the ActivityManagerService module. Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52112 | Medium | 5.3 | 2024-01-16 | Unauthorized file access vulnerability in the wallpaper service module. Successful exploitation of this vulnerability may cause features to perform abnormally. |
CVE-2023-52111 | High | 7.5 | 2024-01-16 | Authorization vulnerability in the BootLoader module. Successful exploitation of this vulnerability may affect service integrity. |
CVE-2023-52110 | High | 7.5 | 2024-01-16 | The sensor module has an out-of-bounds access vulnerability.Successful exploitation of this vulnerability may affect availability. |
CVE-2023-52109 | High | 7.5 | 2024-01-16 | Vulnerability of trust relationships being inaccurate in distributed scenarios. Successful exploitation of this vulnerability may affect service confidentialit… |
CVE-2023-4566 | High | 7.5 | 2024-01-16 | Vulnerability of trust relationships being inaccurate in distributed scenarios. Successful exploitation of this vulnerability may affect service confidentialit… |