2023 CVEs (page 71)
Page 71 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-50609 | Medium | 6.1 | 2024-01-06 | Cross Site Scripting (XSS) vulnerability in AVA teaching video application service platform version 3.1, allows remote attackers to execute arbitrary code via… |
CVE-2023-39853 | Medium | 6.5 | 2024-01-06 | SQL Injection vulnerability in Dzzoffice version 2.01, allows remote attackers to obtain sensitive information via the doobj and doevent parameters in the Netw… |
CVE-2023-50612 | High | 7.8 | 2024-01-06 | Insecure Permissions vulnerability in fit2cloud Cloud Explorer Lite version 1.4.1, allow local attackers to escalate privileges and obtain sensitive informatio… |
CVE-2023-47560 | High | 7.4 | 2024-01-05 | An OS command injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to execute commands… |
CVE-2023-47559 | Medium | 5.5 | 2024-01-05 | A cross-site scripting (XSS) vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to inject malic… |
CVE-2023-47219 | Low | 3.5 | 2024-01-05 | A SQL injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to inject malicious code via… |
CVE-2023-46837 | Low | 3.3 | 2024-01-05 | Arm provides multiple helpers to clean & invalidate the cache for a given region. This is, for instance, used when allocating guest memory to ensure any write… |
CVE-2023-46836 | Medium | 4.7 | 2024-01-05 | The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative Return Stack Overflow) are not IRQ-safe. It was believed that the mitigations always op… |
CVE-2023-46835 | Medium | 5.5 | 2024-01-05 | The current setup of the quarantine page tables assumes that the quarantine domain (dom_io) has been initialized with an address width of DEFAULT_DOMAIN_ADDRES… |
CVE-2023-45044 | Low | 3.8 | 2024-01-05 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2023-45043 | Low | 3.8 | 2024-01-05 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2023-45042 | Low | 3.8 | 2024-01-05 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2023-45041 | Low | 3.8 | 2024-01-05 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2023-45040 | Low | 3.8 | 2024-01-05 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2023-45039 | Low | 3.8 | 2024-01-05 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2023-41289 | Medium | 6.3 | 2024-01-05 | An OS command injection vulnerability has been reported to affect QcalAgent. If exploited, the vulnerability could allow authenticated users to execute command… |
CVE-2023-41288 | High | 8.8 | 2024-01-05 | An OS command injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow users to execute commands via a ne… |
CVE-2023-41287 | Medium | 4.3 | 2024-01-05 | A SQL injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow users to inject malicious code via a netwo… |
CVE-2023-39296 | High | 7.5 | 2024-01-05 | A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to ov… |
CVE-2023-39294 | Medium | 6.6 | 2024-01-05 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… |
CVE-2023-34328 | Medium | 5.5 | 2024-01-05 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] AMD CPUs since ~2014 have ex… |
CVE-2023-34327 | Medium | 5.5 | 2024-01-05 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] AMD CPUs since ~2014 have ex… |
CVE-2023-34326 | High | 7.8 | 2024-01-05 | The caching invalidation guidelines from the AMD-Vi specification (48882—Rev 3.07-PUB—Oct 2022) is incorrect on some hardware, as devices will malfunction (see… |
CVE-2023-34325 | High | 7.8 | 2024-01-05 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] libfsimage contains parsing… |
CVE-2023-34324 | Medium | 4.9 | 2024-01-05 | Closing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is being performed in parallel to an unrelated Xen consol… |
CVE-2023-34323 | Medium | 5.5 | 2024-01-05 | When a transaction is committed, C Xenstored will first check the quota is correct before attempting to commit any nodes. It would be possible that accounting… |
CVE-2023-34322 | High | 7.8 | 2024-01-05 | For migration as well as to work around kernels unaware of L1TF (see XSA-273), PV guests may be run in shadow paging mode. Since Xen itself needs to be mapped… |
CVE-2023-34321 | Low | 3.3 | 2024-01-05 | Arm provides multiple helpers to clean & invalidate the cache for a given region. This is, for instance, used when allocating guest memory to ensure any write… |
CVE-2023-52126 | Medium | 5.3 | 2024-01-05 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Suman Bhattarai Send Users Email.This issue affects Send Users Email: from n/a thro… |
CVE-2023-52125 | Medium | 6.5 | 2024-01-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly iframe allows Stored XSS.This issue affects ifr… |
CVE-2023-52124 | Medium | 6.5 | 2024-01-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShapedPlugin LLC WP Tabs – Responsive Tabs Plugin for Wor… |
CVE-2023-52151 | Medium | 5.3 | 2024-01-05 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Uncanny Automator, Uncanny Owl Uncanny Automator – Automate everything with the #1… |
CVE-2023-52148 | Medium | 5.3 | 2024-01-05 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager.This issue affects Affiliates Manager… |
CVE-2023-52146 | Medium | 5.3 | 2024-01-05 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Aaron J 404 Solution.This issue affects 404 Solution: from n/a through 2.33.0. |
CVE-2023-52143 | High | 7.5 | 2024-01-05 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Naa986 WP Stripe Checkout.This issue affects WP Stripe Checkout: from n/a through 1… |
CVE-2023-52122 | Medium | 4.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Job Board.This issue affects Simple Job Board: from n/a through 2.10.6. |
CVE-2023-52121 | Medium | 5.4 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in NitroPack Inc. NitroPack – Cache & Speed Optimization for Core Web Vitals, Defer CSS & JavaScript, Lazy load… |
CVE-2023-52120 | Medium | 5.4 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in Basix NEX-Forms – Ultimate Form Builder – Contact forms and much more.This issue affects NEX-Forms – Ultimat… |
CVE-2023-52119 | Medium | 4.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in Icegram Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building.This… |
CVE-2023-51678 | Medium | 4.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in Doofinder Doofinder WP & WooCommerce Search.This issue affects Doofinder WP & WooCommerce Search: from n/a t… |
CVE-2023-51673 | Medium | 5.4 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in Designful Stylish Price List – Price Table Builder & QR Code Restaurant Menu.This issue affects Stylish Pric… |
CVE-2023-51668 | Medium | 4.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in WP Zone Inline Image Upload for BBPress.This issue affects Inline Image Upload for BBPress: from n/a through… |
CVE-2023-51539 | Medium | 5.4 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in Apollo13Themes Apollo13 Framework Extensions.This issue affects Apollo13 Framework Extensions: from n/a thro… |
CVE-2023-51538 | Medium | 4.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in Awesome Support Team Awesome Support – WordPress HelpDesk & Support Plugin.This issue affects Awesome Suppor… |
CVE-2023-51535 | Medium | 4.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in СleanTalk - Anti-Spam Protection Spam protection, Anti-Spam, FireWall by CleanTalk.This issue affects Spam p… |
CVE-2023-50991 | High | 7.5 | 2024-01-05 | Buffer Overflow vulnerability in Tenda i29 versions 1.0 V1.0.0.5 and 1.0 V1.0.0.2, allows remote attackers to cause a denial of service (DoS) via the pingIp pa… |
CVE-2023-52149 | Medium | 5.4 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Floating Button.This issue affects Floating Button: from n/a through 6.0. |
CVE-2023-52145 | Medium | 4.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Republish Old Posts.This issue affects Republish Old Posts: from n/a through 1.21. |
CVE-2023-52136 | Medium | 4.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds – A Tweets Widget or X Feed Widget.This issue affects Custom Twitter Feed… |
CVE-2023-52130 | Medium | 4.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager.This issue affects Affiliates Manager: from n/a through 2.9.31. |
CVE-2023-52129 | Medium | 6.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in Michael Winkler teachPress.This issue affects teachPress: from n/a through 9.0.4. |
CVE-2023-52128 | Medium | 4.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in WhiteWP White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard.This issue affects Whi… |
CVE-2023-52127 | Medium | 4.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in WPClever WPC Product Bundles for WooCommerce.This issue affects WPC Product Bundles for WooCommerce: from n/… |
CVE-2023-52123 | Medium | 4.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in WPChill Strong Testimonials.This issue affects Strong Testimonials: from n/a through 3.1.10. |
CVE-2023-50027 | Critical | 9.8 | 2024-01-05 | SQL Injection vulnerability in Buy Addons baproductzoommagnifier module for PrestaShop versions 1.0.16 and before, allows remote attackers to escalate privileg… |
CVE-2023-52184 | Medium | 4.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in WP Job Portal WP Job Portal – A Complete Job Board.This issue affects WP Job Portal – A Complete Job Board… |
CVE-2023-52178 | Medium | 6.5 | 2024-01-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MojofyWP WP Affiliate Disclosure allows Stored XSS.This i… |
CVE-2023-52150 | High | 8.8 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in Ovation S.R.L. Dynamic Content for Elementor.This issue affects Dynamic Content for Elementor: from n/a befo… |
CVE-2023-51502 | High | 7.5 | 2024-01-05 | Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Stripe Payment Gateway.This issue affects WooCommerce Stripe Payment… |
CVE-2023-51277 | Critical | 9.8 | 2024-01-05 | nbviewer-app (aka Jupyter Notebook Viewer) before 0.1.6 has the get-task-allow entitlement for release builds. |
CVE-2023-52323 | Medium | 5.9 | 2024-01-05 | PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack. |
CVE-2023-6493 | Medium | 4.3 | 2024-01-05 | The Depicter Slider – Responsive Image Slider, Video Slider & Post Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up t… |
CVE-2023-41782 | Low | 3.9 | 2024-01-05 | There is a DLL hijacking vulnerability in ZTE ZXCLOUD iRAI, an attacker could place a fake DLL file in a specific directory and successfully exploit this vuln… |
CVE-2023-51812 | Critical | 9.8 | 2024-01-04 | Tenda AX3 v16.03.12.11 was discovered to contain a remote code execution (RCE) vulnerability via the list parameter at /goform/SetNetControlList. |
CVE-2023-51154 | Critical | 9.8 | 2024-01-04 | Jizhicms v2.5 was discovered to contain an arbitrary file download vulnerability via the component /admin/c/PluginsController.php. |
CVE-2023-6270 | High | 7.0 | 2024-01-04 | A flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on `struct net_device`… |
CVE-2023-6551 | Medium | 5.4 | 2024-01-04 | As a simple library, class.upload.php does not perform an in-depth check on uploaded files, allowing a stored XSS vulnerability when the default configuration… |
CVE-2023-50867 | Critical | 9.8 | 2024-01-04 | Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the signupAction.php resource does not… |
CVE-2023-50866 | Critical | 9.8 | 2024-01-04 | Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the loginAction.php resource does not… |
CVE-2023-50865 | Critical | 9.8 | 2024-01-04 | Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'city' parameter of the hotelSearch.php resource does not vali… |
CVE-2023-50864 | Critical | 9.8 | 2024-01-04 | Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'hotelId' parameter of the hotelDetails.php resource does not… |
CVE-2023-50863 | Critical | 9.8 | 2024-01-04 | Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'hotelIDHidden' parameter of the generateReceipt.php resource… |
CVE-2023-50862 | Critical | 9.8 | 2024-01-04 | Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'hotelIDHidden' parameter of the booking.php resource does not… |
CVE-2023-50760 | High | 8.8 | 2024-01-04 | Online Notice Board System v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'f' parameter of user/update_profile_pic.php page, allowing an au… |
CVE-2023-3726 | Medium | 6.9 | 2024-01-04 | OCSInventory allow stored email template with special characters that lead to a Stored cross-site Scripting. |
CVE-2023-50753 | Critical | 9.8 | 2024-01-04 | Online Notice Board System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'dd' parameter of the user/update_profile.php reso… |
CVE-2023-50752 | Critical | 9.8 | 2024-01-04 | Online Notice Board System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'e' parameter of the login.php resource does not v… |
CVE-2023-50743 | Critical | 9.8 | 2024-01-04 | Online Notice Board System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'dd' parameter of the registration.php resource do… |
CVE-2023-49666 | Critical | 9.8 | 2024-01-04 | Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'custmer_details' parameter of the submit_material_list.php… |
CVE-2023-49665 | Critical | 9.8 | 2024-01-04 | Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'quantity[]' parameter of the submit_delivery_list.php resou… |
CVE-2023-49658 | Critical | 9.8 | 2024-01-04 | Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'bank_details' parameter of the party_submit.php resource do… |
CVE-2023-49639 | Critical | 9.8 | 2024-01-04 | Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'customer_details' parameter of the buyer_invoice_submit.php… |
CVE-2023-49633 | Critical | 9.8 | 2024-01-04 | Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'buyer_address' parameter of the buyer_detail_submit.php res… |
CVE-2023-49625 | Critical | 9.8 | 2024-01-04 | Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the partylist_edit_submit.php resource doe… |
CVE-2023-49624 | Critical | 9.8 | 2024-01-04 | Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'cancelid' parameter of the material_bill.php resource does… |
CVE-2023-49622 | Critical | 9.8 | 2024-01-04 | Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'itemnameid' parameter of the material_bill.php?action=itemR… |
CVE-2023-6992 | Medium | 4.0 | 2024-01-04 | Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c). The iss… |
CVE-2023-7044 | Medium | 6.4 | 2024-01-04 | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2023-6944 | Medium | 5.7 | 2024-01-04 | A flaw was found in the Red Hat Developer Hub (RHDH). The catalog-import function leaks GitLab access tokens on the frontend when the base64 encoded GitLab tok… |
CVE-2023-50630 | Medium | 6.1 | 2024-01-04 | Cross Site Scripting (XSS) vulnerability in xiweicheng TMS v.2.28.0 allows a remote attacker to execute arbitrary code via a crafted script to the click here f… |
CVE-2023-50082 | High | 7.5 | 2024-01-04 | Aoyun Technology pbootcms V3.1.2 is vulnerable to Incorrect Access Control, allows remote attackers to gain sensitive information via session leakage allows a… |
CVE-2023-41784 | Medium | 6.6 | 2024-01-04 | Permissions and Access Control Vulnerability in ZTE Red Magic 8 Pro |
CVE-2023-52322 | Medium | 6.1 | 2024-01-04 | ecrire/public/assembler.php in SPIP before 4.1.13 and 4.2.x before 4.2.7 allows XSS because input from _request() is not restricted to safe characters such as… |
CVE-2023-29962 | Medium | 6.5 | 2024-01-04 | S-CMS v5.0 was discovered to contain an arbitrary file read vulnerability. |
CVE-2023-6738 | Medium | 5.4 | 2024-01-04 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pagelayer_header_code'… |
CVE-2023-6733 | Medium | 6.5 | 2024-01-04 | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.8 via the wpmem… |
CVE-2023-6498 | Medium | 4.4 | 2024-01-04 | The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and includi… |
CVE-2023-5138 | Medium | 6.8 | 2024-01-03 | Glitch detection is not enabled by default for the CortexM33 core in Silicon Labs secure vault high parts EFx32xG2xB, except EFR32xG21B. |
CVE-2023-50256 | High | 7.5 | 2024-01-03 | Froxlor is open source server administration software. Prior to version 2.1.2, it was possible to submit the registration form with the essential fields, such… |
CVE-2023-6540 | Medium | 6.5 | 2024-01-03 | A vulnerability was reported in the Lenovo Browser Mobile and Lenovo Browser HD Apps for Android that could allow an attacker to craft a payload that could res… |