2023 CVEs (page 72)
Page 72 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-52145 | Medium | 4.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Republish Old Posts.This issue affects Republish Old Posts: from n/a through 1.21. |
CVE-2023-52136 | Medium | 4.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds – A Tweets Widget or X Feed Widget.This issue affects Custom Twitter Feed… |
CVE-2023-52130 | Medium | 4.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager.This issue affects Affiliates Manager: from n/a through 2.9.31. |
CVE-2023-52129 | Medium | 6.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in Michael Winkler teachPress.This issue affects teachPress: from n/a through 9.0.4. |
CVE-2023-52128 | Medium | 4.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in WhiteWP White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard.This issue affects Whi… |
CVE-2023-52127 | Medium | 4.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in WPClever WPC Product Bundles for WooCommerce.This issue affects WPC Product Bundles for WooCommerce: from n/… |
CVE-2023-52123 | Medium | 4.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in WPChill Strong Testimonials.This issue affects Strong Testimonials: from n/a through 3.1.10. |
CVE-2023-50027 | Critical | 9.8 | 2024-01-05 | SQL Injection vulnerability in Buy Addons baproductzoommagnifier module for PrestaShop versions 1.0.16 and before, allows remote attackers to escalate privileg… |
CVE-2023-52184 | Medium | 4.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in WP Job Portal WP Job Portal – A Complete Job Board.This issue affects WP Job Portal – A Complete Job Board… |
CVE-2023-52178 | Medium | 6.5 | 2024-01-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MojofyWP WP Affiliate Disclosure allows Stored XSS.This i… |
CVE-2023-52150 | High | 8.8 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in Ovation S.R.L. Dynamic Content for Elementor.This issue affects Dynamic Content for Elementor: from n/a befo… |
CVE-2023-51502 | High | 7.5 | 2024-01-05 | Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Stripe Payment Gateway.This issue affects WooCommerce Stripe Payment… |
CVE-2023-51277 | Critical | 9.8 | 2024-01-05 | nbviewer-app (aka Jupyter Notebook Viewer) before 0.1.6 has the get-task-allow entitlement for release builds. |
CVE-2023-52323 | Medium | 5.9 | 2024-01-05 | PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack. |
CVE-2023-6493 | Medium | 4.3 | 2024-01-05 | The Depicter Slider – Responsive Image Slider, Video Slider & Post Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up t… |
CVE-2023-41782 | Low | 3.9 | 2024-01-05 | There is a DLL hijacking vulnerability in ZTE ZXCLOUD iRAI, an attacker could place a fake DLL file in a specific directory and successfully exploit this vuln… |
CVE-2023-51812 | Critical | 9.8 | 2024-01-04 | Tenda AX3 v16.03.12.11 was discovered to contain a remote code execution (RCE) vulnerability via the list parameter at /goform/SetNetControlList. |
CVE-2023-51154 | Critical | 9.8 | 2024-01-04 | Jizhicms v2.5 was discovered to contain an arbitrary file download vulnerability via the component /admin/c/PluginsController.php. |
CVE-2023-6270 | High | 7.0 | 2024-01-04 | A flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on `struct net_device`… |
CVE-2023-6551 | Medium | 5.4 | 2024-01-04 | As a simple library, class.upload.php does not perform an in-depth check on uploaded files, allowing a stored XSS vulnerability when the default configuration… |
CVE-2023-50867 | Critical | 9.8 | 2024-01-04 | Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the signupAction.php resource does not… |
CVE-2023-50866 | Critical | 9.8 | 2024-01-04 | Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the loginAction.php resource does not… |
CVE-2023-50865 | Critical | 9.8 | 2024-01-04 | Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'city' parameter of the hotelSearch.php resource does not vali… |
CVE-2023-50864 | Critical | 9.8 | 2024-01-04 | Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'hotelId' parameter of the hotelDetails.php resource does not… |
CVE-2023-50863 | Critical | 9.8 | 2024-01-04 | Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'hotelIDHidden' parameter of the generateReceipt.php resource… |
CVE-2023-50862 | Critical | 9.8 | 2024-01-04 | Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'hotelIDHidden' parameter of the booking.php resource does not… |
CVE-2023-50760 | High | 8.8 | 2024-01-04 | Online Notice Board System v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'f' parameter of user/update_profile_pic.php page, allowing an au… |
CVE-2023-3726 | Medium | 6.9 | 2024-01-04 | OCSInventory allow stored email template with special characters that lead to a Stored cross-site Scripting. |
CVE-2023-50753 | Critical | 9.8 | 2024-01-04 | Online Notice Board System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'dd' parameter of the user/update_profile.php reso… |
CVE-2023-50752 | Critical | 9.8 | 2024-01-04 | Online Notice Board System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'e' parameter of the login.php resource does not v… |
CVE-2023-50743 | Critical | 9.8 | 2024-01-04 | Online Notice Board System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'dd' parameter of the registration.php resource do… |
CVE-2023-49666 | Critical | 9.8 | 2024-01-04 | Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'custmer_details' parameter of the submit_material_list.php… |
CVE-2023-49665 | Critical | 9.8 | 2024-01-04 | Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'quantity[]' parameter of the submit_delivery_list.php resou… |
CVE-2023-49658 | Critical | 9.8 | 2024-01-04 | Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'bank_details' parameter of the party_submit.php resource do… |
CVE-2023-49639 | Critical | 9.8 | 2024-01-04 | Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'customer_details' parameter of the buyer_invoice_submit.php… |
CVE-2023-49633 | Critical | 9.8 | 2024-01-04 | Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'buyer_address' parameter of the buyer_detail_submit.php res… |
CVE-2023-49625 | Critical | 9.8 | 2024-01-04 | Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the partylist_edit_submit.php resource doe… |
CVE-2023-49624 | Critical | 9.8 | 2024-01-04 | Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'cancelid' parameter of the material_bill.php resource does… |
CVE-2023-49622 | Critical | 9.8 | 2024-01-04 | Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'itemnameid' parameter of the material_bill.php?action=itemR… |
CVE-2023-6992 | Medium | 4.0 | 2024-01-04 | Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c). The iss… |
CVE-2023-7044 | Medium | 6.4 | 2024-01-04 | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2023-6944 | Medium | 5.7 | 2024-01-04 | A flaw was found in the Red Hat Developer Hub (RHDH). The catalog-import function leaks GitLab access tokens on the frontend when the base64 encoded GitLab tok… |
CVE-2023-50630 | Medium | 6.1 | 2024-01-04 | Cross Site Scripting (XSS) vulnerability in xiweicheng TMS v.2.28.0 allows a remote attacker to execute arbitrary code via a crafted script to the click here f… |
CVE-2023-50082 | High | 7.5 | 2024-01-04 | Aoyun Technology pbootcms V3.1.2 is vulnerable to Incorrect Access Control, allows remote attackers to gain sensitive information via session leakage allows a… |
CVE-2023-41784 | Medium | 6.6 | 2024-01-04 | Permissions and Access Control Vulnerability in ZTE Red Magic 8 Pro |
CVE-2023-52322 | Medium | 6.1 | 2024-01-04 | ecrire/public/assembler.php in SPIP before 4.1.13 and 4.2.x before 4.2.7 allows XSS because input from _request() is not restricted to safe characters such as… |
CVE-2023-29962 | Medium | 6.5 | 2024-01-04 | S-CMS v5.0 was discovered to contain an arbitrary file read vulnerability. |
CVE-2023-6738 | Medium | 5.4 | 2024-01-04 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pagelayer_header_code'… |
CVE-2023-6733 | Medium | 6.5 | 2024-01-04 | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.8 via the wpmem… |
CVE-2023-6498 | Medium | 4.4 | 2024-01-04 | The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and includi… |
CVE-2023-5138 | Medium | 6.8 | 2024-01-03 | Glitch detection is not enabled by default for the CortexM33 core in Silicon Labs secure vault high parts EFx32xG2xB, except EFR32xG21B. |
CVE-2023-50256 | High | 7.5 | 2024-01-03 | Froxlor is open source server administration software. Prior to version 2.1.2, it was possible to submit the registration form with the essential fields, such… |
CVE-2023-6540 | Medium | 6.5 | 2024-01-03 | A vulnerability was reported in the Lenovo Browser Mobile and Lenovo Browser HD Apps for Android that could allow an attacker to craft a payload that could res… |
CVE-2023-6338 | High | 7.8 | 2024-01-03 | Uncontrolled search path vulnerabilities were reported in the Lenovo Universal Device Client (UDC) that could allow an attacker with local access to execute co… |
CVE-2023-49442 | Critical | 9.8 | 2024-01-03 | Deserialization of Untrusted Data in jeecgFormDemoController in JEECG 4.0 and earlier allows attackers to run arbitrary code via crafted POST request. |
CVE-2023-5881 | High | 8.2 | 2024-01-03 | Unauthenticated access permitted to web interface page The Genie Company Aladdin Connect (Retrofit-Kit Model ALDCM) "Garage Door Control Module Setup" and modi… |
CVE-2023-5880 | High | 8.8 | 2024-01-03 | When the Genie Company Aladdin Connect garage door opener (Retrofit-Kit Model ALDCM) is placed into configuration mode the web servers “Garage Door Control Mod… |
CVE-2023-5879 | Medium | 6.8 | 2024-01-03 | Users’ product account authentication data was stored in clear text in The Genie Company Aladdin Connect Mobile Application Version 5.65 Build 2075 (and below)… |
CVE-2023-50090 | Critical | 9.8 | 2024-01-03 | Arbitrary File Write vulnerability in the saveReportFile method of ureport2 2.2.9 and before allows attackers to write arbitrary files and run arbitrary comman… |
CVE-2023-46929 | High | 7.5 | 2024-01-03 | An issue discovered in GPAC 2.3-DEV-rev605-gfc9e29089-master in MP4Box in gf_avc_change_vui /afltest/gpac/src/media_tools/av_parsers.c:6872:55 allows attackers… |
CVE-2023-6004 | Medium | 4.8 | 2024-01-03 | A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow… |
CVE-2023-50253 | Critical | 9.6 | 2024-01-03 | Laf is a cloud development platform. In the Laf version design, the log uses communication with k8s to quickly retrieve logs from the container without the nee… |
CVE-2023-46742 | Medium | 4.8 | 2024-01-03 | CubeFS is an open-source cloud-native file storage system. CubeFS prior to version 3.3.1 was found to leak users secret keys and access keys in the logs in mul… |
CVE-2023-46741 | Medium | 4.8 | 2024-01-03 | CubeFS is an open-source cloud-native file storage system. A vulnerability was found in CubeFS prior to version 3.3.1 that could allow users to read sensitive… |
CVE-2023-46740 | Medium | 6.5 | 2024-01-03 | CubeFS is an open-source cloud-native file storage system. Prior to version 3.3.1, CubeFS used an insecure random string generator to generate user-specific, s… |
CVE-2023-46739 | Medium | 6.5 | 2024-01-03 | CubeFS is an open-source cloud-native file storage system. A vulnerability was found during in the CubeFS master component in versions prior to 3.3.1 that coul… |
CVE-2023-46738 | Medium | 6.5 | 2024-01-03 | CubeFS is an open-source cloud-native file storage system. A security vulnerability was found in CubeFS HandlerNode in versions prior to 3.3.1 that could allow… |
CVE-2023-30617 | Medium | 6.5 | 2024-01-03 | Kruise provides automated management of large-scale applications on Kubernetes. Starting in version 0.8.0 and prior to versions 1.3.1, 1.4.1, and 1.5.2, an att… |
CVE-2023-45559 | High | 8.2 | 2024-01-03 | An issue in Tamaki_hamanoki Line v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token. |
CVE-2023-50093 | Medium | 6.1 | 2024-01-03 | APIIDA API Gateway Manager for Broadcom Layer7 v2023.2.2 is vulnerable to Host Header Injection. |
CVE-2023-37607 | High | 7.5 | 2024-01-03 | Directory Traversal in Automatic Systems SOC FL9600 FirstLane V06 lego_T04E00 allows a remote attacker to obtain sensitive information via csvServer.php?file=… |
CVE-2023-50092 | Medium | 6.1 | 2024-01-03 | APIIDA API Gateway Manager for Broadcom Layer7 v2023.2 is vulnerable to Cross Site Scripting (XSS). |
CVE-2023-39655 | Critical | 9.6 | 2024-01-03 | A host header injection vulnerability exists in the NPM package @perfood/couch-auth versions <= 0.20.0. By sending a specially crafted host header in the forgo… |
CVE-2023-37608 | High | 7.5 | 2024-01-03 | An issue in Automatic Systems SOC FL9600 FirstLane V06 lego_T04E00 allows a remote attacker to obtain sensitive information because there is an automaticsystem… |
CVE-2023-51785 | High | 7.5 | 2024-01-03 | Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.9.0, the attackers can make a arbitrary… |
CVE-2023-51784 | Critical | 9.8 | 2024-01-03 | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache InLong.This issue affects Apache InLong: from 1.5.0 through 1.9.0, which coul… |
CVE-2023-7068 | Medium | 4.3 | 2024-01-03 | The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthorized access of data due to a miss… |
CVE-2023-6984 | Medium | 5.3 | 2024-01-03 | The PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up… |
CVE-2023-6747 | Medium | 6.4 | 2024-01-03 | The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom attributes in all versions up t… |
CVE-2023-6621 | Medium | 6.1 | 2024-01-03 | The POST SMTP WordPress plugin before 2.8.7 does not sanitise and escape the msg parameter before outputting it back in the page, leading to a Reflected Cross-… |
CVE-2023-52314 | Critical | 9.6 | 2024-01-03 | PaddlePaddle before 2.6.0 has a command injection in convert_shape_compare. This resulted in the ability to execute arbitrary commands on the operating system… |
CVE-2023-52313 | Medium | 4.7 | 2024-01-03 | FPE in paddle.argmin and paddle.argmax in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service. |
CVE-2023-52312 | Medium | 4.7 | 2024-01-03 | Nullptr dereference in paddle.crop in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service. |
CVE-2023-52311 | Critical | 9.6 | 2024-01-03 | PaddlePaddle before 2.6.0 has a command injection in _wget_download. This resulted in the ability to execute arbitrary commands on the operating system. |
CVE-2023-52310 | Critical | 9.6 | 2024-01-03 | PaddlePaddle before 2.6.0 has a command injection in get_online_pass_interval. This resulted in the ability to execute arbitrary commands on the operating syst… |
CVE-2023-52309 | High | 8.2 | 2024-01-03 | Heap buffer overflow in paddle.repeat_interleave in PaddlePaddle before 2.6.0. This flaw can lead to a denial of service, information disclosure, or more damag… |
CVE-2023-52308 | Medium | 4.7 | 2024-01-03 | FPE in paddle.amin in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service. |
CVE-2023-52307 | High | 8.2 | 2024-01-03 | Stack overflow in paddle.linalg.lu_unpack in PaddlePaddle before 2.6.0. This flaw can lead to a denial of service, or even more damage. |
CVE-2023-52306 | Medium | 4.7 | 2024-01-03 | FPE in paddle.lerp in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service. |
CVE-2023-52305 | Medium | 4.7 | 2024-01-03 | FPE in paddle.topk in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service. |
CVE-2023-52304 | High | 8.2 | 2024-01-03 | Stack overflow in paddle.searchsorted in PaddlePaddle before 2.6.0. This flaw can lead to a denial of service, or even more damage. |
CVE-2023-52303 | Medium | 4.7 | 2024-01-03 | Nullptr in paddle.put_along_axis in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service. |
CVE-2023-52302 | Medium | 4.7 | 2024-01-03 | Nullptr in paddle.nextafter in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service. |
CVE-2023-50921 | Critical | 9.8 | 2024-01-03 | An issue was discovered on GL.iNet devices through 4.5.0. Attackers can invoke the add_user interface in the system module to gain root privileges. This affect… |
CVE-2023-38678 | Medium | 4.7 | 2024-01-03 | OOB access in paddle.mode in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service. |
CVE-2023-38677 | Medium | 4.7 | 2024-01-03 | FPE in paddle.linalg.eig in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service. |
CVE-2023-38676 | Medium | 4.7 | 2024-01-03 | Nullptr in paddle.dot in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service. |
CVE-2023-38675 | Medium | 4.7 | 2024-01-03 | FPE in paddle.linalg.matrix_rank in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service. |
CVE-2023-38674 | Medium | 4.7 | 2024-01-03 | FPE in paddle.nanmedian in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service. |
CVE-2023-50922 | High | 7.2 | 2024-01-03 | An issue was discovered on GL.iNet devices through 4.5.0. Attackers who are able to steal the AdminToken cookie can execute arbitrary code by uploading a cront… |