2023 CVEs (page 74)
Page 74 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-32881 | Medium | 4.4 | 2024-01-02 | In battery, there is a possible information disclosure due to an integer overflow. This could lead to local information disclosure with System execution privil… |
CVE-2023-32880 | Medium | 4.4 | 2024-01-02 | In battery, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with System execution pri… |
CVE-2023-32879 | Medium | 6.7 | 2024-01-02 | In battery, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privi… |
CVE-2023-32878 | Medium | 4.4 | 2024-01-02 | In battery, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with System execution pri… |
CVE-2023-32877 | Medium | 6.7 | 2024-01-02 | In battery, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privi… |
CVE-2023-32876 | Medium | 4.4 | 2024-01-02 | In keyInstall, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with System execution… |
CVE-2023-32875 | Medium | 4.4 | 2024-01-02 | In keyInstall, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with System execution… |
CVE-2023-32874 | Critical | 9.8 | 2024-01-02 | In Modem IMS Stack, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional executio… |
CVE-2023-32872 | Medium | 6.7 | 2024-01-02 | In keyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution pr… |
CVE-2023-32831 | Medium | 5.5 | 2024-01-02 | In wlan driver, there is a possible PIN crack due to use of insufficiently random values. This could lead to local information disclosure with no execution pri… |
CVE-2023-50096 | High | 7.5 | 2024-01-01 | STMicroelectronics STSAFE-A1xx middleware before 3.3.7 allows MCU code execution if an adversary has the ability to read from and write to the I2C bus. This is… |
CVE-2023-50094 | High | 8.8 | 2024-01-01 | reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/waf_detector/?u… |
CVE-2023-6485 | Medium | 5.4 | 2024-01-01 | The Html5 Video Player WordPress plugin before 2.5.19 does not sanitise and escape some of its player settings, which combined with missing capability checks a… |
CVE-2023-6421 | High | 7.5 | 2024-01-01 | The Download Manager WordPress plugin before 3.2.83 does not protect file download's passwords, leaking it upon receiving an invalid one. |
CVE-2023-6271 | High | 7.5 | 2024-01-01 | The Backup Migration WordPress plugin before 1.3.6 stores in-progress backups information in easy to find, publicly-accessible files, which may allow attackers… |
CVE-2023-6113 | High | 7.5 | 2024-01-01 | The WP STAGING WordPress Backup Plugin before 3.1.3 and WP STAGING Pro WordPress Backup Plugin before 5.1.3 do not prevent visitors from leaking key informatio… |
CVE-2023-6064 | High | 7.5 | 2024-01-01 | The PayHere Payment Gateway WordPress plugin before 2.2.12 automatically creates publicly-accessible log files containing sensitive information when transactio… |
CVE-2023-6037 | Medium | 4.8 | 2024-01-01 | The WP TripAdvisor Review Slider WordPress plugin before 11.9 does not sanitise and escape some of its settings, which could allow high privilege users such as… |
CVE-2023-6000 | Medium | 6.1 | 2024-01-01 | The Popup Builder WordPress plugin before 4.2.3 does not prevent simple visitors from updating existing popups, and injecting raw JavaScript in them, which cou… |
CVE-2023-5877 | Critical | 9.8 | 2024-01-01 | The affiliate-toolkit WordPress plugin before 3.4.3 lacks authorization and authentication for requests to it's affiliate-toolkit-starter/tools/atkp_imagerecei… |
CVE-2023-52133 | High | 8.5 | 2023-12-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WhileTrue Most And Least Read Posts Widget.This issue aff… |
CVE-2023-52132 | High | 7.6 | 2023-12-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jewel Theme WP Adminify.This issue affects WP Adminify: f… |
CVE-2023-52131 | High | 7.6 | 2023-12-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Zinc Page Generator.This issue affects Page Generator… |
CVE-2023-51547 | High | 7.6 | 2023-12-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPManageNinja LLC Fluent Support – WordPress Helpdesk and… |
CVE-2023-51503 | Medium | 5.9 | 2023-12-31 | Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affe… |
CVE-2023-51469 | Critical | 9.3 | 2023-12-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mestres do WP Checkout Mestres WP.This issue affects Chec… |
CVE-2023-51423 | Critical | 9.3 | 2023-12-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saleswonder Team Webinar Plugin: Create live/evergreen/au… |
CVE-2023-7193 | Medium | 4.6 | 2023-12-31 | A vulnerability was found in MTab Bookmark up to 1.2.6 and classified as critical. This issue affects some unknown processing of the file public/install.php of… |
CVE-2023-52185 | Medium | 5.3 | 2023-12-31 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Everestthemes Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning… |
CVE-2023-52134 | High | 7.6 | 2023-12-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eyal Fitoussi GEO my WordPress.This issue affects GEO my… |
CVE-2023-7191 | Medium | 5.5 | 2023-12-31 | A vulnerability, which was classified as critical, was found in S-CMS up to 2.0_build20220529-20231006. This affects an unknown part of the file member/reg.php… |
CVE-2023-7190 | Medium | 5.5 | 2023-12-31 | A vulnerability, which was classified as critical, has been found in S-CMS up to 2.0_build20220529-20231006. Affected by this issue is some unknown functionali… |
CVE-2023-7189 | Medium | 5.5 | 2023-12-31 | A vulnerability classified as critical was found in S-CMS up to 2.0_build20220529-20231006. Affected by this vulnerability is an unknown functionality of the f… |
CVE-2023-7188 | Medium | 5.0 | 2023-12-31 | A vulnerability classified as critical has been found in Shipping 100 Fahuo100 up to 1.1. Affected is an unknown function of the file member/login.php. The man… |
CVE-2023-7187 | Medium | 5.5 | 2023-12-31 | A vulnerability was found in Totolink N350RT 9.3.5u.6139_B20201216. It has been rated as critical. This issue affects some unknown processing of the file /cgi-… |
CVE-2023-7186 | Medium | 5.5 | 2023-12-31 | A vulnerability was found in 7-card Fakabao up to 1.0_build20230805. It has been declared as critical. This vulnerability affects unknown code of the file memb… |
CVE-2023-7185 | Medium | 5.5 | 2023-12-31 | A vulnerability was found in 7-card Fakabao up to 1.0_build20230805. It has been classified as critical. This affects an unknown part of the file shop/wxpay_no… |
CVE-2023-7184 | Medium | 5.5 | 2023-12-31 | A vulnerability was found in 7-card Fakabao up to 1.0_build20230805 and classified as critical. Affected by this issue is some unknown functionality of the fil… |
CVE-2023-7183 | Medium | 5.5 | 2023-12-31 | A vulnerability has been found in 7-card Fakabao up to 1.0_build20230805 and classified as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2023-52180 | High | 7.6 | 2023-12-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Really Simple Plugins Recipe Maker For Your Food Blog fro… |
CVE-2023-49777 | Critical | 9.1 | 2023-12-31 | Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Product Add-Ons.This issue affects YITH WooCommerce Product Add-Ons: from n/a through… |
CVE-2023-6094 | Medium | 5.3 | 2023-12-31 | A vulnerability has been identified in OnCell G3150A-LTE Series firmware versions v1.3 and prior. The vulnerability results from lack of protection for sensiti… |
CVE-2023-6093 | Medium | 5.3 | 2023-12-31 | A clickjacking vulnerability has been identified in OnCell G3150A-LTE Series firmware versions v1.3 and prior. This vulnerability is caused by incorrectly res… |
CVE-2023-52182 | Critical | 9.9 | 2023-12-31 | Deserialization of Untrusted Data vulnerability in ARI Soft ARI Stream Quiz – WordPress Quizzes Builder.This issue affects ARI Stream Quiz – WordPress Quizzes… |
CVE-2023-52181 | Critical | 10.0 | 2023-12-31 | Deserialization of Untrusted Data vulnerability in Presslabs Theme per user.This issue affects Theme per user: from n/a through 1.0.1. |
CVE-2023-39157 | Critical | 9.0 | 2023-12-31 | Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: f… |
CVE-2023-7130 | Medium | 6.3 | 2023-12-31 | A vulnerability has been found in code-projects College Notes Gallery 2.0 and classified as critical. Affected by this vulnerability is an unknown functionalit… |
CVE-2023-52286 | High | 7.5 | 2023-12-31 | Tencent tdsqlpcloud through 1.8.5 allows unauthenticated remote attackers to discover database credentials via an index.php/api/install/get_db_info request, a… |
CVE-2023-52284 | Medium | 5.5 | 2023-12-31 | Bytecode Alliance wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) before 1.3.0 can have an "double free or corruption" error for a valid WebAssembly… |
CVE-2023-52277 | High | 7.8 | 2023-12-31 | Royal RoyalTSX before 6.0.2.1 allows attackers to cause a denial of service (Heap Memory Corruption and application crash) or possibly have unspecified other i… |
CVE-2023-52275 | Low | 2.1 | 2023-12-31 | Gallery3d on Tecno Camon X CA7 devices allows attackers to view hidden images by navigating to data/com.android.gallery3d/.privatealbum/.encryptfiles and guess… |
CVE-2023-52269 | Medium | 4.8 | 2023-12-31 | MDaemon SecurityGateway through 9.0.3 allows XSS via a crafted Message Content Filtering rule. This might allow domain administrators to conduct attacks agains… |
CVE-2023-52267 | High | 7.5 | 2023-12-31 | ehttp 1.0.6 before 17405b9 has a simple_log.cpp _log out-of-bounds-read during error logging for long strings. |
CVE-2023-52266 | High | 7.5 | 2023-12-31 | ehttp 1.0.6 before 17405b9 has an epoll_socket.cpp read_func use-after-free. An attacker can make many connections over a short time to trigger this. |
CVE-2023-52265 | Medium | 5.4 | 2023-12-30 | IDURAR (aka idurar-erp-crm) through 2.0.1 allows stored XSS via a PATCH request with a crafted JSON email template in the /api/email/update data. |
CVE-2023-52264 | Medium | 6.1 | 2023-12-30 | The beesblog (aka Bees Blog) component before 1.6.2 for thirty bees allows Reflected XSS because controllers/front/post.php sharing_url is mishandled. |
CVE-2023-6998 | High | 7.7 | 2023-12-30 | Improper privilege management vulnerability in CoolKit Technology eWeLink on Android and iOS allows application lockscreen bypass.This issue affects eWeLink be… |
CVE-2023-52263 | Medium | 6.1 | 2023-12-30 | Brave Browser before 1.59.40 does not properly restrict the schema for WebUI factory and redirect. This is related to browser/brave_content_browser_client.cc a… |
CVE-2023-52262 | Critical | 9.8 | 2023-12-30 | outdoorbits little-backup-box (aka Little Backup Box) before f39f91c allows remote attackers to execute arbitrary code because the PHP extract function is used… |
CVE-2023-7181 | Medium | 4.7 | 2023-12-30 | A vulnerability was found in Muyun DedeBIZ up to 6.2.12 and classified as critical. Affected by this issue is some unknown functionality of the component Add A… |
CVE-2023-7180 | Medium | 5.5 | 2023-12-30 | A vulnerability has been found in Tongda OA 2017 up to 11.9 and classified as critical. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2023-7179 | Medium | 4.7 | 2023-12-30 | A vulnerability, which was classified as critical, was found in Campcodes Online College Library System 1.0. Affected is an unknown function of the file /admin… |
CVE-2023-7178 | Medium | 4.7 | 2023-12-30 | A vulnerability, which was classified as critical, has been found in Campcodes Online College Library System 1.0. This issue affects some unknown processing of… |
CVE-2023-50651 | Critical | 9.8 | 2023-12-30 | TOTOLINK X6000R v9.4.0cu.852_B20230719 was discovered to contain a remote command execution (RCE) vulnerability via the component /cgi-bin/cstecgi.cgi. |
CVE-2023-50589 | Critical | 9.8 | 2023-12-30 | Grupo Embras GEOSIAP ERP v2.2.167.02 was discovered to contain a SQL injection vulnerability via the codLogin parameter on the login page. |
CVE-2023-50110 | High | 7.5 | 2023-12-30 | TestLink through 1.9.20 allows type juggling for authentication bypass because === is not used. |
CVE-2023-49299 | High | 8.8 | 2023-12-30 | Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the ser… |
CVE-2023-7177 | Medium | 4.7 | 2023-12-30 | A vulnerability classified as critical was found in Campcodes Online College Library System 1.0. This vulnerability affects unknown code of the file /admin/boo… |
CVE-2023-7176 | Medium | 4.7 | 2023-12-30 | A vulnerability classified as critical has been found in Campcodes Online College Library System 1.0. This affects an unknown part of the file /admin/return_ad… |
CVE-2023-51136 | Critical | 9.8 | 2023-12-30 | TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formRebootSchedule. |
CVE-2023-51135 | Critical | 9.8 | 2023-12-30 | TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formPasswordSetup. |
CVE-2023-51133 | Critical | 9.8 | 2023-12-30 | TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formRoute. |
CVE-2023-50578 | Critical | 9.8 | 2023-12-30 | Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the categoryType parameter at /content/list.do. |
CVE-2023-50550 | Medium | 5.4 | 2023-12-30 | layui up to v2.74 was discovered to contain a cross-site scripting (XSS) vulnerability via the data-content parameter. |
CVE-2023-7175 | Medium | 4.7 | 2023-12-30 | A vulnerability was found in Campcodes Online College Library System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality o… |
CVE-2023-7173 | Medium | 4.3 | 2023-12-30 | A vulnerability, which was classified as problematic, was found in PHPGurukul Hospital Management System 1.0. This affects an unknown part of the file registra… |
CVE-2023-7172 | High | 7.3 | 2023-12-30 | A vulnerability, which was classified as critical, has been found in PHPGurukul Hospital Management System 1.0. Affected by this issue is some unknown function… |
CVE-2023-52257 | Medium | 6.1 | 2023-12-30 | LogoBee 0.2 allows updates.php?id= XSS. |
CVE-2023-52252 | Critical | 9.8 | 2023-12-30 | Unified Remote 3.13.0 allows remote attackers to execute arbitrary Lua code because of a wildcarded Access-Control-Allow-Origin for the Remote upload endpoint. |
CVE-2023-41544 | Critical | 9.8 | 2023-12-30 | SSTI injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to execute arbitrary code via crafted HTTP request to the /jmreport/loadTable… |
CVE-2023-38023 | Medium | 5.5 | 2023-12-30 | An issue was discovered in SCONE Confidential Computing Platform before 5.8.0 for Intel SGX. Lack of pointer-alignment logic in __scone_dispatch and other entr… |
CVE-2023-38022 | Medium | 5.5 | 2023-12-30 | An issue was discovered in Fortanix EnclaveOS Confidential Computing Manager (CCM) Platform before 3.29 for Intel SGX. Insufficient pointer validation allows a… |
CVE-2023-38021 | Medium | 5.5 | 2023-12-30 | An issue was discovered in Fortanix EnclaveOS Confidential Computing Manager (CCM) Platform before 3.32 for Intel SGX. Lack of pointer-alignment validation log… |
CVE-2023-41543 | Critical | 9.8 | 2023-12-30 | SQL injection vulnerability in jeecg-boot v3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the component /sys/replic… |
CVE-2023-41542 | Critical | 9.8 | 2023-12-30 | SQL injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the jmreport/qures… |
CVE-2023-50559 | Medium | 5.5 | 2023-12-30 | An issue was discovered in XiangShan v2.1, allows local attackers to obtain sensitive information via the L1D cache. |
CVE-2023-52240 | Medium | 6.1 | 2023-12-29 | The Kantega SAML SSO OIDC Kerberos Single Sign-on apps before 6.20.0 for Atlassian products allow XSS if SAML POST Binding is enabled. This affects 4.4.2 throu… |
CVE-2023-50071 | High | 8.8 | 2023-12-29 | Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer_support/ajax.php?action=save_department via id or name. |
CVE-2023-50070 | High | 8.8 | 2023-12-29 | Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer_support/ajax.php?action=save_ticket via department_id, custo… |
CVE-2023-50069 | Medium | 6.1 | 2023-12-29 | WireMock with GUI versions 3.2.0.0 through 3.0.4.0 are vulnerable to stored cross-site scripting (SXSS) through the recording feature. An attacker can host a m… |
CVE-2023-50035 | Critical | 9.8 | 2023-12-29 | PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection on the Users login panel because of "password" parameter is directly used in the SQL query without any… |
CVE-2023-7171 | Low | 2.4 | 2023-12-29 | A vulnerability was found in Novel-Plus up to 4.2.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the fil… |
CVE-2023-52139 | Critical | 9.0 | 2023-12-29 | Misskey is an open source, decentralized social media platform. Third-party applications may be able to access some endpoints or Websocket APIs that are incorr… |
CVE-2023-52137 | High | 7.7 | 2023-12-29 | The [`tj-actions/verify-changed-files`](https://github.com/tj-actions/verify-changed-files) action allows for command injection in changed filenames, allowing… |
CVE-2023-51663 | Medium | 5.3 | 2023-12-29 | Hail is an open-source, general-purpose, Python-based data analysis tool with additional data types and methods for working with genomic data. Hail relies on O… |
CVE-2023-51688 | Medium | 5.3 | 2023-12-29 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress.This issue affects eCommer… |
CVE-2023-51687 | Medium | 5.3 | 2023-12-29 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode Product Catalog Simple.This issue affects Product Catalog Simple: from n/… |
CVE-2023-51527 | Medium | 5.3 | 2023-12-29 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Senol Sahin AI Power: Complete AI Pack – Powered by GPT-4.This issue affects AI Pow… |
CVE-2023-51517 | Medium | 4.1 | 2023-12-29 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CodePeople Calculated Fields Form.This issue affects Calculated Fields Form: from n/a thro… |
CVE-2023-50572 | Medium | 5.5 | 2023-12-29 | An issue in the component GroovyEngine.execute of jline-groovy v3.24.1 allows attackers to cause an OOM (OutofMemory) error. |