2023 CVEs (page 67)
Page 67 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-4960 | Medium | 6.4 | 2024-01-11 | The WCFM Marketplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wcfm_stores' shortcode in versions up to, and including, 3.6.2 due… |
CVE-2023-4372 | Medium | 6.4 | 2024-01-11 | The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'esi' shortcode in versions up to, and including, 5.6 due to insu… |
CVE-2023-4248 | Medium | 5.4 | 2024-01-11 | The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce… |
CVE-2023-4247 | Medium | 5.4 | 2024-01-11 | The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce… |
CVE-2023-4246 | Medium | 4.3 | 2024-01-11 | The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce… |
CVE-2023-37644 | Medium | 5.5 | 2024-01-11 | SWFTools 0.9.2 772e55a allows attackers to trigger a large memory-allocation attempt via a crafted document, as demonstrated by pdf2swf. This occurs in png_rea… |
CVE-2023-6883 | Medium | 4.3 | 2024-01-11 | The Easy Social Feed plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in al… |
CVE-2023-6699 | Critical | 9.1 | 2024-01-11 | The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.10.33 via the… |
CVE-2023-6520 | Medium | 4.3 | 2024-01-11 | The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5… |
CVE-2023-6506 | Medium | 4.3 | 2024-01-11 | The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includin… |
CVE-2023-6446 | Medium | 4.4 | 2024-01-11 | The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.40 du… |
CVE-2023-6223 | Medium | 4.3 | 2024-01-11 | The LearnPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.5.7 via the /wp-json/lp/v1/prof… |
CVE-2023-6630 | Medium | 4.3 | 2024-01-11 | The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0… |
CVE-2023-5448 | High | 8.8 | 2024-01-11 | The WP Register Profile With Shortcode plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.9. This is due to… |
CVE-2023-52274 | Medium | 6.1 | 2024-01-11 | member/index/register.html in YzmCMS 6.5 through 7.0 allows XSS via the Referer HTTP header. |
CVE-2023-51073 | High | 8.1 | 2024-01-11 | An issue in Buffalo LS210D v.1.78-0.03 allows a remote attacker to execute arbitrary code via the Firmware Update Script at /etc/init.d/update_notifications.sh. |
CVE-2023-45171 | Medium | 6.2 | 2024-01-11 | IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the kernel to cause a denial of service. IBM X-Force ID… |
CVE-2023-45169 | Medium | 6.2 | 2024-01-11 | IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the pmsvcs kernel extension to cause a denial of service… |
CVE-2023-38267 | Medium | 6.2 | 2024-01-11 | IBM Security Access Manager Appliance (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) could all… |
CVE-2023-31003 | High | 8.4 | 2024-01-11 | IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) could all… |
CVE-2023-31001 | Medium | 5.1 | 2024-01-11 | IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) temporari… |
CVE-2023-45175 | Medium | 6.2 | 2024-01-11 | IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the TCP/IP kernel extension to cause a denial of service… |
CVE-2023-45173 | Medium | 6.2 | 2024-01-11 | IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the NFS kernel extension to cause a denial of service. IB… |
CVE-2023-51123 | Critical | 9.8 | 2024-01-10 | An issue discovered in D-Link dir815 v.1.01SSb08.bin allows a remote attacker to execute arbitrary code via a crafted POST request to the service parameter in… |
CVE-2023-49295 | Medium | 6.4 | 2024-01-10 | quic-go is an implementation of the QUIC protocol (RFC 9000, RFC 9001, RFC 9002) in Go. An attacker can cause its peer to run out of memory sending a large num… |
CVE-2023-42941 | Medium | 4.8 | 2024-01-10 | The issue was addressed with improved checks. This issue is fixed in iOS 17.2 and iPadOS 17.2. An attacker in a privileged network position may be able to perf… |
CVE-2023-42934 | Medium | 4.2 | 2024-01-10 | An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14, iOS 17 and iPadOS 17. An app with root p… |
CVE-2023-42933 | High | 7.8 | 2024-01-10 | This issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. An app may be able to gain elevated privileges. |
CVE-2023-42929 | Medium | 5.5 | 2024-01-10 | The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. An app may be able to access protected user data. |
CVE-2023-42876 | High | 7.1 | 2024-01-10 | The issue was addressed with improved bounds checks. This issue is fixed in macOS Sonoma 14. Processing a file may lead to a denial-of-service or potentially d… |
CVE-2023-42872 | Medium | 5.5 | 2024-01-10 | The issue was addressed with additional permissions checks. This issue is fixed in macOS Sonoma 14, iOS 17 and iPadOS 17. An app may be able to access sensitiv… |
CVE-2023-42871 | High | 7.8 | 2024-01-10 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14, iOS 17 and iPadOS 17. An app may be able to execute arbitrary co… |
CVE-2023-42870 | High | 7.8 | 2024-01-10 | A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Sonoma 14, iOS 17 and iPadOS 17. An app may be able to execu… |
CVE-2023-42869 | High | 7.5 | 2024-01-10 | Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Ventura 13.4, iOS 16.5 and iPadOS 16.5. Multiple… |
CVE-2023-42866 | High | 8.8 | 2024-01-10 | The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, tvOS 16.6, Safari 16.6, watchOS 9.6… |
CVE-2023-42865 | Medium | 6.5 | 2024-01-10 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3, tvOS 16.4, iOS 16.4 and iPadOS 16.4, watchOS 9.4… |
CVE-2023-42862 | Medium | 6.5 | 2024-01-10 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3, tvOS 16.4, iOS 16.4 and iPadOS 16.4, watchOS 9.4… |
CVE-2023-42833 | High | 8.8 | 2024-01-10 | A correctness issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14, Safari 17, iOS 17 and iPadOS 17. Processing web content may lea… |
CVE-2023-42832 | High | 7.0 | 2024-01-10 | A race condition was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.7.9, macOS Monterey 12.6.8, macOS Ventura 13.5. An app may… |
CVE-2023-42831 | Medium | 5.5 | 2024-01-10 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS 15.7.8, macOS Monterey 12.6.8, mac… |
CVE-2023-42830 | Low | 3.3 | 2024-01-10 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4. An app… |
CVE-2023-42829 | Medium | 5.5 | 2024-01-10 | The issue was addressed with additional restrictions on the observability of app states. This issue is fixed in macOS Big Sur 11.7.9, macOS Monterey 12.6.8, ma… |
CVE-2023-42828 | High | 7.8 | 2024-01-10 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Ventura 13.5. An app may be able to gain root privileges. |
CVE-2023-42826 | High | 7.8 | 2024-01-10 | The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing a file may lead to arbitrary code execution. |
CVE-2023-41994 | Medium | 5.5 | 2024-01-10 | A logic issue was addressed with improved checks This issue is fixed in macOS Sonoma 14. A camera extension may be able to access the camera view from apps oth… |
CVE-2023-41987 | Medium | 5.5 | 2024-01-10 | This issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. An app may be able to access sensitive user data. |
CVE-2023-41974 | High | 7.8 | 2024-01-10 | A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 17 and iPadOS 17, iOS 15.8.7 and iPadOS 15.8.7. An app may be… |
CVE-2023-41075 | High | 7.8 | 2024-01-10 | A type confusion issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.7.5, macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, iOS 15.7… |
CVE-2023-41069 | Medium | 5.5 | 2024-01-10 | This issue was addressed by improving Face ID anti-spoofing models. This issue is fixed in iOS 17 and iPadOS 17. A 3D model constructed to look like the enroll… |
CVE-2023-41060 | High | 8.8 | 2024-01-10 | A type confusion issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14, iOS 17 and iPadOS 17. A remote user may be able to cause ker… |
CVE-2023-40529 | Low | 2.4 | 2024-01-10 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 17 and iPadOS 17. A person with physical access to a devi… |
CVE-2023-40439 | Low | 3.3 | 2024-01-10 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. An app… |
CVE-2023-40438 | Medium | 5.5 | 2024-01-10 | An issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sonoma 14, iOS 16.7 and iPadOS 16.7. An app may be able to acces… |
CVE-2023-40437 | Medium | 5.5 | 2024-01-10 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. An app… |
CVE-2023-40433 | Medium | 5.5 | 2024-01-10 | A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3. An app may bypass Gatekeeper checks. |
CVE-2023-40430 | Medium | 5.5 | 2024-01-10 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. An app may be able to access removable volumes without user consent. |
CVE-2023-40414 | Critical | 9.8 | 2024-01-10 | A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 10, iOS 17 and iPadOS 17, tvOS 17, macOS Sonoma 14, Safari… |
CVE-2023-40411 | Medium | 5.5 | 2024-01-10 | This issue was addressed with improved data protection. This issue is fixed in macOS Sonoma 14. An app may be able to access user-sensitive data. |
CVE-2023-40394 | Low | 3.3 | 2024-01-10 | The issue was addressed with improved validation of environment variables. This issue is fixed in iOS 16.6 and iPadOS 16.6. An app may be able to access sensit… |
CVE-2023-40393 | High | 7.5 | 2024-01-10 | An authentication issue was addressed with improved state management. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. Photos in the Hidden Photos… |
CVE-2023-40385 | Medium | 6.5 | 2024-01-10 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14, Safari 17, iOS 17 and iPadOS 17. A remote attacker may be abl… |
CVE-2023-40383 | Low | 3.3 | 2024-01-10 | A path handling issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.3. An app may be able to access user-sensitive data. |
CVE-2023-38612 | Low | 3.3 | 2024-01-10 | The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, iOS 17 and iPadOS 17, macOS Sonoma 14, macO… |
CVE-2023-38610 | High | 7.1 | 2024-01-10 | A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14, iOS 17 and iPadOS 17. An app may be able to ca… |
CVE-2023-38607 | Medium | 5.5 | 2024-01-10 | The issue was addressed with improved handling of caches. This issue is fixed in macOS Sonoma 14. An app may be able to modify Printer settings. |
CVE-2023-32436 | High | 7.1 | 2024-01-10 | The issue was addressed with improved bounds checks. This issue is fixed in macOS Ventura 13.3. An app may be able to cause unexpected system termination or wr… |
CVE-2023-32424 | Medium | 5.5 | 2024-01-10 | The issue was addressed with improved memory handling. This issue is fixed in iOS 16.4 and iPadOS 16.4, watchOS 9.4. An attacker that has already achieved kern… |
CVE-2023-32401 | High | 7.8 | 2024-01-10 | A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Monterey 12.6.6, macOS Big Sur 11.7.7, macOS Ventura 13.4. Parsing… |
CVE-2023-32383 | High | 7.8 | 2024-01-10 | This issue was addressed by forcing hardened runtime on the affected binaries at the system level. This issue is fixed in macOS Monterey 12.6.6, macOS Big Sur… |
CVE-2023-32378 | High | 7.8 | 2024-01-10 | A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.3, macOS Big Sur 11.7.5, macOS Monterey 12.6.4. A… |
CVE-2023-32366 | High | 7.8 | 2024-01-10 | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.7.5, macOS Ventura 13.3, iOS 16.4 and iPadOS… |
CVE-2023-28197 | Low | 3.3 | 2024-01-10 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Ventura 13.3, macOS Big Sur 11.7.5, macOS Monterey 12.6.4. An… |
CVE-2023-28185 | Medium | 5.5 | 2024-01-10 | An integer overflow was addressed through improved input validation. This issue is fixed in tvOS 16.4, macOS Big Sur 11.7.5, iOS 16.4 and iPadOS 16.4, watchOS… |
CVE-2023-52064 | Critical | 9.8 | 2024-01-10 | Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the $keywords parameter at /core/admin/copyfrom.php. |
CVE-2023-51127 | High | 7.5 | 2024-01-10 | FLIR AX8 thermal sensor cameras up to and including 1.46.16 are vulnerable to Directory Traversal due to improper access restriction. This vulnerability allows… |
CVE-2023-51126 | Critical | 9.8 | 2024-01-10 | Command injection vulnerability in /usr/www/res.php in FLIR AX8 up to 1.46.16 allows attackers to run arbitrary commands via the value parameter. NOTE: The ven… |
CVE-2023-29447 | Medium | 5.7 | 2024-01-10 | An insufficiently protected credentials vulnerability in KEPServerEX could allow an adversary to capture user credentials as the web server uses basic authenti… |
CVE-2023-29446 | Medium | 4.7 | 2024-01-10 | An improper input validation vulnerability has been discovered that could allow an adversary to inject a UNC path via a malicious project file. This allows an… |
CVE-2023-29445 | High | 7.8 | 2024-01-10 | An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges… |
CVE-2023-31488 | Critical | 9.8 | 2024-01-10 | Hyland Perceptive Filters releases before 2023-12-08 (e.g., 11.4.0.2647), as used in Cisco IronPort Email Security Appliance Software, Cisco Secure Email Gatew… |
CVE-2023-50916 | High | 7.2 | 2024-01-10 | Kyocera Device Manager before 3.1.1213.0 allows NTLM credential exposure during UNC path authentication via a crafted change from a local path to a UNC path. I… |
CVE-2023-48783 | Medium | 5.4 | 2024-01-10 | An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] affecting PortiPortal version 7.2.1 and below, version 7.0.6 and below, version 6.0… |
CVE-2023-46712 | High | 7.2 | 2024-01-10 | A improper access control in Fortinet FortiPortal version 7.0.0 through 7.0.6, Fortinet FortiPortal version 7.2.0 through 7.2.1 allows attacker to escalate its… |
CVE-2023-44250 | High | 8.8 | 2024-01-10 | An improper privilege management vulnerability [CWE-269] in a Fortinet FortiOS HA cluster version 7.4.0 through 7.4.1 and 7.2.5 and in a FortiProxy HA cluster… |
CVE-2023-37934 | Medium | 4.3 | 2024-01-10 | An allocation of resources without limits or throttling vulnerability [CWE-770] in FortiPAM 1.0 all versions allows an authenticated attacker to perform a deni… |
CVE-2023-37932 | Medium | 6.5 | 2024-01-10 | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability [CWE-22] in FortiVoiceEntreprise version 7.0.0 and before 6.4.7… |
CVE-2023-29444 | Medium | 6.3 | 2024-01-10 | An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges… |
CVE-2023-51970 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function formSetIptv. |
CVE-2023-51969 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function getIptvInfo. |
CVE-2023-51968 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function getIptvInfo. |
CVE-2023-51967 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function getIptvInfo. |
CVE-2023-51962 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function setIptvInfo. |
CVE-2023-50172 | Medium | 5.3 | 2024-01-10 | A recovery notification bypass vulnerability exists in the userRecoverPass.php captcha validation functionality of WWBN AVideo dev master commit 15fed957fb. A… |
CVE-2023-49864 | Medium | 6.5 | 2024-01-10 | An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb… |
CVE-2023-49863 | Medium | 6.5 | 2024-01-10 | An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb… |
CVE-2023-49862 | Medium | 6.5 | 2024-01-10 | An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb… |
CVE-2023-49810 | High | 7.3 | 2024-01-10 | A login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafte… |
CVE-2023-49738 | High | 7.5 | 2024-01-10 | An information disclosure vulnerability exists in the image404Raw.php functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP reque… |
CVE-2023-49715 | Medium | 4.3 | 2024-01-10 | A unrestricted php file upload vulnerability exists in the import.json.php temporary copy functionality of WWBN AVideo dev master commit 15fed957fb. A speciall… |
CVE-2023-49599 | Critical | 9.8 | 2024-01-10 | An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted series of HT… |