2023 CVEs (page 65)
Page 65 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-4797 | High | 7.2 | 2024-01-16 | The Newsletters WordPress plugin before 4.9.3 does not properly escape user-controlled parameters when they are appended to SQL queries and shell commands, whi… |
CVE-2023-4757 | Medium | 5.4 | 2024-01-16 | The Staff / Employee Business Directory for Active Directory WordPress plugin before 1.2.3 does not sanitize and escape data returned from the LDAP server befo… |
CVE-2023-4703 | High | 7.5 | 2024-01-16 | The All in One B2B for WooCommerce WordPress plugin through 1.0.3 does not properly validate parameters when updating user details, allowing an unauthenticated… |
CVE-2023-4536 | High | 8.8 | 2024-01-16 | The My Account Page Editor WordPress plugin before 1.3.2 does not validate the profile picture to be uploaded, allowing any authenticated users, such as subscr… |
CVE-2023-45237 | Medium | 5.3 | 2024-01-16 | EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized a… |
CVE-2023-45236 | Medium | 5.8 | 2024-01-16 | EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized a… |
CVE-2023-45235 | High | 8.3 | 2024-01-16 | EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option from a DHCPv6 proxy Advertise message. This … |
CVE-2023-45234 | High | 8.3 | 2024-01-16 | EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers option from a DHCPv6 Advertise message. This vulnerabilit… |
CVE-2023-45233 | High | 7.5 | 2024-01-16 | EDK2's Network Package is susceptible to an infinite lop vulnerability when parsing a PadN option in the Destination Options header of IPv6. This vulnerabilit… |
CVE-2023-45232 | High | 7.5 | 2024-01-16 | EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in the Destination Options header of IPv6. This vulnerabi… |
CVE-2023-45231 | Medium | 6.5 | 2024-01-16 | EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing Neighbor Discovery Redirect message. This vulnerability can be… |
CVE-2023-45230 | High | 8.3 | 2024-01-16 | EDK2's Network Package is susceptible to a buffer overflow vulnerability via a long server ID option in DHCPv6 client. This vulnerability can be exploited by… |
CVE-2023-45229 | Medium | 6.5 | 2024-01-16 | EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or IA_TA option in a DHCPv6 Advertise message. This vu… |
CVE-2023-3771 | Medium | 6.1 | 2024-01-16 | The T1 WordPress theme through 19.0 is vulnerable to unauthenticated open redirect with which any attacker and redirect users to arbitrary websites. |
CVE-2023-3647 | Medium | 4.8 | 2024-01-16 | The IURNY by INDIGITALL WordPress plugin before 3.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2023-3372 | Medium | 5.4 | 2024-01-16 | The Lana Shortcodes WordPress plugin before 1.2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post wher… |
CVE-2023-3211 | Critical | 9.8 | 2024-01-16 | The WordPress Database Administrator WordPress plugin through 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an… |
CVE-2023-3178 | Medium | 4.3 | 2024-01-16 | The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users w… |
CVE-2023-37522 | Medium | 5.6 | 2024-01-16 | HCL BigFix Bare OSD Metal Server WebUI version 311.19 or lower has missing or insecure tags that could allow an attacker to execute a malicious script on the u… |
CVE-2023-37521 | Low | 2.3 | 2024-01-16 | HCL BigFix Bare OSD Metal Server WebUI version 311.19 or lower can sometimes include sensitive information in a query string which could allow an attacker to e… |
CVE-2023-2655 | High | 7.2 | 2024-01-16 | The Contact Form by WD WordPress plugin through 1.13.23 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL… |
CVE-2023-2252 | Low | 2.7 | 2024-01-16 | The Directorist WordPress plugin before 7.5.4 is vulnerable to Local File Inclusion as it does not validate the file parameter when importing CSV files. |
CVE-2023-1405 | High | 7.5 | 2024-01-16 | The Formidable Forms WordPress plugin before 6.2 unserializes user input, which could allow anonymous users to perform PHP Object Injection when a suitable gad… |
CVE-2023-0824 | Medium | 6.5 | 2024-01-16 | The User registration & user profile WordPress plugin through 2.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, whi… |
CVE-2023-0769 | Medium | 6.1 | 2024-01-16 | The hiWeb Migration Simple WordPress plugin through 2.0.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflec… |
CVE-2023-0479 | Medium | 6.1 | 2024-01-16 | The Print Invoice & Delivery Notes for WooCommerce WordPress plugin before 4.7.2 is vulnerable to reflected XSS by echoing a GET value in an admin note within… |
CVE-2023-0389 | Medium | 4.8 | 2024-01-16 | The Calculated Fields Form WordPress plugin before 1.1.151 does not sanitise and escape some of its form settings, which could allow high privilege users such… |
CVE-2023-0376 | Medium | 5.4 | 2024-01-16 | The Qubely WordPress plugin before 1.8.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is e… |
CVE-2023-0224 | Critical | 9.8 | 2024-01-16 | The GiveWP WordPress plugin before 2.24.1 does not properly escape user input before it reaches SQL queries, which could let unauthenticated attackers perform… |
CVE-2023-0094 | Medium | 5.4 | 2024-01-16 | The UpQode Google Maps WordPress plugin through 1.0.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post… |
CVE-2023-0079 | Medium | 5.4 | 2024-01-16 | The Customer Reviews for WooCommerce WordPress plugin before 5.17.0 does not validate and escape some of its shortcode attributes before outputting them back i… |
CVE-2023-6395 | Medium | 6.7 | 2024-01-16 | The Mock software contains a vulnerability wherein an attacker could potentially exploit privilege escalation, enabling the execution of arbitrary code with ro… |
CVE-2023-52106 | Medium | 4.4 | 2024-01-16 | Vulnerability of permission verification for APIs in the DownloadProviderMain module. Impact: Successful exploitation of this vulnerability will affect integri… |
CVE-2023-52105 | High | 7.5 | 2024-01-16 | The nearby module has a privilege escalation vulnerability. Successful exploitation of this vulnerability may affect availability. |
CVE-2023-52104 | High | 7.5 | 2024-01-16 | Vulnerability of parameters being not verified in the WMS module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-52103 | Critical | 9.8 | 2024-01-16 | Buffer overflow vulnerability in the FLP module. Successful exploitation of this vulnerability may cause out-of-bounds read. |
CVE-2023-52102 | High | 7.5 | 2024-01-16 | Vulnerability of parameters being not verified in the WMS module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-52101 | Critical | 9.1 | 2024-01-16 | Component exposure vulnerability in the Wi-Fi module. Successful exploitation of this vulnerability may affect service availability and integrity. |
CVE-2023-52100 | High | 7.5 | 2024-01-16 | The Celia Keyboard module has a vulnerability in access control. Successful exploitation of this vulnerability may affect availability. |
CVE-2023-52099 | High | 7.5 | 2024-01-16 | Vulnerability of foreground service restrictions being bypassed in the NMS module. Successful exploitation of this vulnerability may affect service confidentia… |
CVE-2023-34063 | Critical | 9.9 | 2024-01-16 | Aria Automation contains a Missing Access Control vulnerability. An authenticated malicious actor may exploit this vulnerability leading to unauthorized acc… |
CVE-2023-52116 | High | 7.5 | 2024-01-16 | Permission management vulnerability in the multi-screen interaction module. Successful exploitation of this vulnerability may cause service exceptions of the d… |
CVE-2023-52115 | High | 7.5 | 2024-01-16 | The iaware module has a Use-After-Free (UAF) vulnerability. Successful exploitation of this vulnerability may affect the system functions. |
CVE-2023-52114 | High | 7.5 | 2024-01-16 | Data confidentiality vulnerability in the ScreenReader module. Successful exploitation of this vulnerability may affect service integrity. |
CVE-2023-52108 | High | 7.5 | 2024-01-16 | Vulnerability of process priorities being raised in the ActivityManagerService module. Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52107 | High | 7.5 | 2024-01-16 | Vulnerability of permissions being not strictly verified in the WMS module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-52098 | High | 7.5 | 2024-01-16 | Denial of Service (DoS) vulnerability in the DMS module. Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52113 | High | 7.5 | 2024-01-16 | launchAnyWhere vulnerability in the ActivityManagerService module. Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52112 | Medium | 5.3 | 2024-01-16 | Unauthorized file access vulnerability in the wallpaper service module. Successful exploitation of this vulnerability may cause features to perform abnormally. |
CVE-2023-52111 | High | 7.5 | 2024-01-16 | Authorization vulnerability in the BootLoader module. Successful exploitation of this vulnerability may affect service integrity. |
CVE-2023-52110 | High | 7.5 | 2024-01-16 | The sensor module has an out-of-bounds access vulnerability.Successful exploitation of this vulnerability may affect availability. |
CVE-2023-52109 | High | 7.5 | 2024-01-16 | Vulnerability of trust relationships being inaccurate in distributed scenarios. Successful exploitation of this vulnerability may affect service confidentialit… |
CVE-2023-4566 | High | 7.5 | 2024-01-16 | Vulnerability of trust relationships being inaccurate in distributed scenarios. Successful exploitation of this vulnerability may affect service confidentialit… |
CVE-2023-44117 | High | 7.5 | 2024-01-16 | Vulnerability of trust relationships being inaccurate in distributed scenarios. Successful exploitation of this vulnerability may affect service confidentialit… |
CVE-2023-44112 | High | 7.5 | 2024-01-16 | Out-of-bounds access vulnerability in the device authentication module. Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2023-22527 | Critical | 9.8 | 2024-01-16 | A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected inst… |
CVE-2023-22526 | High | 8.8 | 2024-01-16 | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 7.19.0 of Confluence Data Center. This RCE (Remote Code Execution) vu… |
CVE-2023-51282 | High | 7.5 | 2024-01-16 | An issue in mingSoft MCMS v.5.2.4 allows a a remote attacker to obtain sensitive information via a crafted script to the password parameter. |
CVE-2023-51257 | High | 7.8 | 2024-01-16 | An invalid memory write issue in Jasper-Software Jasper v.4.1.1 and before allows a local attacker to execute arbitrary code. |
CVE-2023-51059 | High | 8.8 | 2024-01-16 | An issue in MOKO TECHNOLOGY LTD MOKOSmart MKGW1 BLE Gateway v.1.1.1 and before allows a remote attacker to escalate privileges via the session management compo… |
CVE-2023-43449 | High | 8.8 | 2024-01-16 | An issue in HummerRisk HummerRisk v.1.10 thru 1.4.1 allows an authenticated attacker to execute arbitrary code via a crafted request to the service/LicenseServ… |
CVE-2023-6457 | Medium | 6.6 | 2024-01-16 | Incorrect Default Permissions vulnerability in Hitachi Tuning Manager on Windows (Hitachi Tuning Manager server component) allows local users to read and write… |
CVE-2023-51810 | High | 7.5 | 2024-01-16 | SQL injection vulnerability in StackIdeas EasyDiscuss v.5.0.5 and fixed in v.5.0.10 allows a remote attacker to obtain sensitive information via a crafted requ… |
CVE-2023-49107 | Medium | 5.3 | 2024-01-16 | Generation of Error Message Containing Sensitive Information vulnerability in Hitachi Device Manager on Windows, Linux (Device Manager Agent modules).This issu… |
CVE-2023-49106 | Medium | 4.6 | 2024-01-16 | Missing Password Field Masking vulnerability in Hitachi Device Manager on Windows, Linux (Device Manager Agent component).This issue affects Hitachi Device Man… |
CVE-2023-48104 | Medium | 6.1 | 2024-01-16 | Alinto SOGo before 5.9.1 is vulnerable to HTML Injection. |
CVE-2023-47460 | High | 8.8 | 2024-01-16 | SQL injection vulnerability in Knovos Discovery v.22.67.0 allows a remote attacker to execute arbitrary code via the /DiscoveryProcess/Service/Admin.svc/getGri… |
CVE-2023-47459 | Medium | 6.5 | 2024-01-16 | An issue in Knovos Discovery v.22.67.0 allows a remote attacker to obtain sensitive information via the /DiscoveryReview/Service/CaseManagement.svc/GetProductS… |
CVE-2023-41619 | Medium | 6.1 | 2024-01-16 | Emlog Pro v2.1.14 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/article.php?action=write. |
CVE-2023-7206 | High | 7.8 | 2024-01-15 | In Horner Automation Cscape versions 9.90 SP10 and prior, local attackers are able to exploit this vulnerability if a user opens a malicious CSP file, which w… |
CVE-2023-6991 | High | 8.8 | 2024-01-15 | The JSM file_get_contents() Shortcode WordPress plugin before 2.7.1 does not validate one of its shortcode's parameters before making a request to it, which co… |
CVE-2023-6941 | Medium | 4.8 | 2024-01-15 | The Keap Official Opt-in Forms WordPress plugin through 1.0.11 does not sanitise and escape some of its settings, which could allow high privilege users such a… |
CVE-2023-6843 | Medium | 4.3 | 2024-01-15 | The easy.jobs- Best Recruitment Plugin for Job Board Listing, Manager, Career Page for Elementor & Gutenberg WordPress plugin before 2.4.7 does not properly se… |
CVE-2023-6623 | Critical | 9.8 | 2024-01-15 | The Essential Blocks WordPress plugin before 4.4.3 does not prevent unauthenticated attackers from overwriting local variables when rendering templates over th… |
CVE-2023-6620 | High | 7.2 | 2024-01-15 | The POST SMTP Mailer WordPress plugin before 2.8.7 does not properly sanitise and escape several parameters before using them in SQL statements, leading to a S… |
CVE-2023-6163 | Medium | 4.8 | 2024-01-15 | The WP Crowdfunding WordPress plugin before 2.1.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2023-6066 | Medium | 4.3 | 2024-01-15 | The WP Custom Widget area WordPress plugin through 1.2.5 does not properly apply capability and nonce checks on any of its AJAX action callback functions, whic… |
CVE-2023-6050 | Medium | 6.1 | 2024-01-15 | The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not sanitise and escape various parameters and generated URLs before outputting them back in… |
CVE-2023-6049 | Critical | 9.8 | 2024-01-15 | The Estatik Real Estate Plugin WordPress plugin before 4.1.1 unserializes user input via some of its cookies, which could allow unauthenticated users to perfor… |
CVE-2023-6048 | Medium | 6.5 | 2024-01-15 | The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not prevent user with low privileges on the site, like subscribers, from setting any of the s… |
CVE-2023-6029 | High | 7.5 | 2024-01-15 | The EazyDocs WordPress plugin before 2.3.6 does not have authorization and CSRF checks when handling documents and does not ensure that they are documents from… |
CVE-2023-5905 | High | 8.1 | 2024-01-15 | The DeMomentSomTres WordPress Export Posts With Images WordPress plugin through 20220825 does not check authorization of requests to export the blog data, allo… |
CVE-2023-50729 | High | 8.4 | 2024-01-15 | Traccar is an open source GPS tracking system. Prior to 5.11, Traccar is affected by an unrestricted file upload vulnerability in File feature allows attackers… |
CVE-2023-4925 | Medium | 4.8 | 2024-01-15 | The Easy Forms for Mailchimp WordPress plugin through 6.8.10 does not sanitise and escape some of its settings, which could allow high privilege users such as… |
CVE-2023-4818 | High | 7.6 | 2024-01-15 | PAX A920 device allows to downgrade bootloader due to a bug in its version check. The signature is correctly checked and only bootloader signed by PAX can be u… |
CVE-2023-42137 | High | 7.8 | 2024-01-15 | PAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow for command execution with high privileges by using malici… |
CVE-2023-42136 | High | 7.8 | 2024-01-15 | PAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow the execution of arbitrary commands with system account pr… |
CVE-2023-42135 | Medium | 6.8 | 2024-01-15 | PAX A920Pro/A50 devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow local code execution via parameter injection by bypassing the in… |
CVE-2023-42134 | Medium | 6.8 | 2024-01-15 | PAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.45_20230314 or earlier can allow the signed partition overwrite and subsequently local code… |
CVE-2023-5253 | Medium | 5.3 | 2024-01-15 | A missing authentication check in the WebSocket channel used for the Check Point IoT integration in Nozomi Networks Guardian and CMC, may allow an unauthentica… |
CVE-2023-4001 | Medium | 6.8 | 2024-01-15 | An authentication bypass flaw was found in GRUB due to the way that GRUB uses the UUID of a device to search for the configuration file that contains the passw… |
CVE-2023-46226 | Critical | 9.8 | 2024-01-15 | Remote Code Execution vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 1.0.0 through 1.2.2. Users are recommended to upgrade to version 1.3… |
CVE-2023-6915 | Medium | 6.2 | 2024-01-15 | A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel. This issue may allow an attacker using this library to cause a denia… |
CVE-2023-50290 | Medium | 6.5 | 2024-01-15 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr. The Solr Metrics API publishes all unprotected environment variables a… |
CVE-2023-46749 | Medium | 6.5 | 2024-01-15 | Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with pat… |
CVE-2023-48383 | High | 7.5 | 2024-01-15 | NetVision Information airPASS has a path traversal vulnerability within its parameter in a specific URL. An unauthenticated remote attacker can exploit thi… |
CVE-2023-52289 | High | 7.5 | 2024-01-13 | An issue was discovered in the flaskcode package through 0.0.8 for Python. An unauthenticated directory traversal, exploitable with a POST request to a /update… |
CVE-2023-52288 | High | 7.5 | 2024-01-13 | An issue was discovered in the flaskcode package through 0.0.8 for Python. An unauthenticated directory traversal, exploitable with a GET request to a /resourc… |
CVE-2023-51071 | Medium | 6.5 | 2024-01-13 | An access control issue in QStar Archive Solutions Release RELEASE_3-0 Build 7 Patch 0 allows unauthenticated attackers to arbitrarily disable the SMB service… |
CVE-2023-51070 | High | 7.5 | 2024-01-13 | An access control issue in QStar Archive Solutions Release RELEASE_3-0 Build 7 Patch 0 allows unauthenticated attackers to arbitrarily adjust sensitive SMB set… |