2023 CVEs (page 74)
Page 74 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-52266 | High | 7.5 | 2023-12-31 | ehttp 1.0.6 before 17405b9 has an epoll_socket.cpp read_func use-after-free. An attacker can make many connections over a short time to trigger this. |
CVE-2023-52265 | Medium | 5.4 | 2023-12-30 | IDURAR (aka idurar-erp-crm) through 2.0.1 allows stored XSS via a PATCH request with a crafted JSON email template in the /api/email/update data. |
CVE-2023-52264 | Medium | 6.1 | 2023-12-30 | The beesblog (aka Bees Blog) component before 1.6.2 for thirty bees allows Reflected XSS because controllers/front/post.php sharing_url is mishandled. |
CVE-2023-6998 | High | 7.7 | 2023-12-30 | Improper privilege management vulnerability in CoolKit Technology eWeLink on Android and iOS allows application lockscreen bypass.This issue affects eWeLink be… |
CVE-2023-52263 | Medium | 6.1 | 2023-12-30 | Brave Browser before 1.59.40 does not properly restrict the schema for WebUI factory and redirect. This is related to browser/brave_content_browser_client.cc a… |
CVE-2023-52262 | Critical | 9.8 | 2023-12-30 | outdoorbits little-backup-box (aka Little Backup Box) before f39f91c allows remote attackers to execute arbitrary code because the PHP extract function is used… |
CVE-2023-7181 | Medium | 4.7 | 2023-12-30 | A vulnerability was found in Muyun DedeBIZ up to 6.2.12 and classified as critical. Affected by this issue is some unknown functionality of the component Add A… |
CVE-2023-7180 | Medium | 5.5 | 2023-12-30 | A vulnerability has been found in Tongda OA 2017 up to 11.9 and classified as critical. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2023-7179 | Medium | 4.7 | 2023-12-30 | A vulnerability, which was classified as critical, was found in Campcodes Online College Library System 1.0. Affected is an unknown function of the file /admin… |
CVE-2023-7178 | Medium | 4.7 | 2023-12-30 | A vulnerability, which was classified as critical, has been found in Campcodes Online College Library System 1.0. This issue affects some unknown processing of… |
CVE-2023-50651 | Critical | 9.8 | 2023-12-30 | TOTOLINK X6000R v9.4.0cu.852_B20230719 was discovered to contain a remote command execution (RCE) vulnerability via the component /cgi-bin/cstecgi.cgi. |
CVE-2023-50589 | Critical | 9.8 | 2023-12-30 | Grupo Embras GEOSIAP ERP v2.2.167.02 was discovered to contain a SQL injection vulnerability via the codLogin parameter on the login page. |
CVE-2023-50110 | High | 7.5 | 2023-12-30 | TestLink through 1.9.20 allows type juggling for authentication bypass because === is not used. |
CVE-2023-49299 | High | 8.8 | 2023-12-30 | Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the ser… |
CVE-2023-7177 | Medium | 4.7 | 2023-12-30 | A vulnerability classified as critical was found in Campcodes Online College Library System 1.0. This vulnerability affects unknown code of the file /admin/boo… |
CVE-2023-7176 | Medium | 4.7 | 2023-12-30 | A vulnerability classified as critical has been found in Campcodes Online College Library System 1.0. This affects an unknown part of the file /admin/return_ad… |
CVE-2023-51136 | Critical | 9.8 | 2023-12-30 | TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formRebootSchedule. |
CVE-2023-51135 | Critical | 9.8 | 2023-12-30 | TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formPasswordSetup. |
CVE-2023-51133 | Critical | 9.8 | 2023-12-30 | TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formRoute. |
CVE-2023-50578 | Critical | 9.8 | 2023-12-30 | Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the categoryType parameter at /content/list.do. |
CVE-2023-50550 | Medium | 5.4 | 2023-12-30 | layui up to v2.74 was discovered to contain a cross-site scripting (XSS) vulnerability via the data-content parameter. |
CVE-2023-7175 | Medium | 4.7 | 2023-12-30 | A vulnerability was found in Campcodes Online College Library System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality o… |
CVE-2023-7173 | Medium | 4.3 | 2023-12-30 | A vulnerability, which was classified as problematic, was found in PHPGurukul Hospital Management System 1.0. This affects an unknown part of the file registra… |
CVE-2023-7172 | High | 7.3 | 2023-12-30 | A vulnerability, which was classified as critical, has been found in PHPGurukul Hospital Management System 1.0. Affected by this issue is some unknown function… |
CVE-2023-52257 | Medium | 6.1 | 2023-12-30 | LogoBee 0.2 allows updates.php?id= XSS. |
CVE-2023-52252 | Critical | 9.8 | 2023-12-30 | Unified Remote 3.13.0 allows remote attackers to execute arbitrary Lua code because of a wildcarded Access-Control-Allow-Origin for the Remote upload endpoint. |
CVE-2023-41544 | Critical | 9.8 | 2023-12-30 | SSTI injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to execute arbitrary code via crafted HTTP request to the /jmreport/loadTable… |
CVE-2023-38023 | Medium | 5.5 | 2023-12-30 | An issue was discovered in SCONE Confidential Computing Platform before 5.8.0 for Intel SGX. Lack of pointer-alignment logic in __scone_dispatch and other entr… |
CVE-2023-38022 | Medium | 5.5 | 2023-12-30 | An issue was discovered in Fortanix EnclaveOS Confidential Computing Manager (CCM) Platform before 3.29 for Intel SGX. Insufficient pointer validation allows a… |
CVE-2023-38021 | Medium | 5.5 | 2023-12-30 | An issue was discovered in Fortanix EnclaveOS Confidential Computing Manager (CCM) Platform before 3.32 for Intel SGX. Lack of pointer-alignment validation log… |
CVE-2023-41543 | Critical | 9.8 | 2023-12-30 | SQL injection vulnerability in jeecg-boot v3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the component /sys/replic… |
CVE-2023-41542 | Critical | 9.8 | 2023-12-30 | SQL injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the jmreport/qures… |
CVE-2023-50559 | Medium | 5.5 | 2023-12-30 | An issue was discovered in XiangShan v2.1, allows local attackers to obtain sensitive information via the L1D cache. |
CVE-2023-52240 | Medium | 6.1 | 2023-12-29 | The Kantega SAML SSO OIDC Kerberos Single Sign-on apps before 6.20.0 for Atlassian products allow XSS if SAML POST Binding is enabled. This affects 4.4.2 throu… |
CVE-2023-50071 | High | 8.8 | 2023-12-29 | Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer_support/ajax.php?action=save_department via id or name. |
CVE-2023-50070 | High | 8.8 | 2023-12-29 | Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer_support/ajax.php?action=save_ticket via department_id, custo… |
CVE-2023-50069 | Medium | 6.1 | 2023-12-29 | WireMock with GUI versions 3.2.0.0 through 3.0.4.0 are vulnerable to stored cross-site scripting (SXSS) through the recording feature. An attacker can host a m… |
CVE-2023-50035 | Critical | 9.8 | 2023-12-29 | PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection on the Users login panel because of "password" parameter is directly used in the SQL query without any… |
CVE-2023-7171 | Low | 2.4 | 2023-12-29 | A vulnerability was found in Novel-Plus up to 4.2.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the fil… |
CVE-2023-52139 | Critical | 9.0 | 2023-12-29 | Misskey is an open source, decentralized social media platform. Third-party applications may be able to access some endpoints or Websocket APIs that are incorr… |
CVE-2023-52137 | High | 7.7 | 2023-12-29 | The [`tj-actions/verify-changed-files`](https://github.com/tj-actions/verify-changed-files) action allows for command injection in changed filenames, allowing… |
CVE-2023-51663 | Medium | 5.3 | 2023-12-29 | Hail is an open-source, general-purpose, Python-based data analysis tool with additional data types and methods for working with genomic data. Hail relies on O… |
CVE-2023-51688 | Medium | 5.3 | 2023-12-29 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress.This issue affects eCommer… |
CVE-2023-51687 | Medium | 5.3 | 2023-12-29 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode Product Catalog Simple.This issue affects Product Catalog Simple: from n/… |
CVE-2023-51527 | Medium | 5.3 | 2023-12-29 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Senol Sahin AI Power: Complete AI Pack – Powered by GPT-4.This issue affects AI Pow… |
CVE-2023-51517 | Medium | 4.1 | 2023-12-29 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CodePeople Calculated Fields Form.This issue affects Calculated Fields Form: from n/a thro… |
CVE-2023-50572 | Medium | 5.5 | 2023-12-29 | An issue in the component GroovyEngine.execute of jline-groovy v3.24.1 allows attackers to cause an OOM (OutofMemory) error. |
CVE-2023-50571 | High | 7.8 | 2023-12-29 | easy-rules-mvel v4.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component MVELRule. |
CVE-2023-50570 | Medium | 5.5 | 2023-12-29 | An issue in the component IPAddressBitsDivision of IPAddress v5.1.0 leads to an infinite loop. This is disputed because an infinite loop occurs only for cases… |
CVE-2023-4675 | Critical | 9.8 | 2023-12-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GM Information Technologies MDO allows SQL Injection. Th… |
CVE-2023-4674 | Critical | 9.8 | 2023-12-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yaztek Software Technologies and Computer Systems E-Comme… |
CVE-2023-4541 | Critical | 9.8 | 2023-12-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ween Software Admin Panel allows SQL Injection. This iss… |
CVE-2023-47804 | High | 8.8 | 2023-12-29 | Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can… |
CVE-2023-51675 | Medium | 4.7 | 2023-12-29 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and Mor… |
CVE-2023-51475 | Critical | 10.0 | 2023-12-29 | Unrestricted Upload of File with Dangerous Type vulnerability in IOSS WP MLM SOFTWARE PLUGIN.This issue affects WP MLM SOFTWARE PLUGIN: from n/a through 4.0. |
CVE-2023-51473 | Critical | 10.0 | 2023-12-29 | Unrestricted Upload of File with Dangerous Type vulnerability in Pixelemu TerraClassifieds – Simple Classifieds Plugin.This issue affects TerraClassifieds – Si… |
CVE-2023-51468 | Critical | 10.0 | 2023-12-29 | Unrestricted Upload of File with Dangerous Type vulnerability in Jacques Malgrange Rencontre – Dating Site.This issue affects Rencontre – Dating Site: from n/a… |
CVE-2023-51421 | Critical | 9.9 | 2023-12-29 | Unrestricted Upload of File with Dangerous Type vulnerability in Soft8Soft LLC Verge3D Publishing and E-Commerce.This issue affects Verge3D Publishing and E-Co… |
CVE-2023-51419 | Critical | 10.0 | 2023-12-29 | Unrestricted Upload of File with Dangerous Type vulnerability in Bertha.Ai BERTHA AI. Your AI co-pilot for WordPress and Chrome.This issue affects BERTHA AI. Y… |
CVE-2023-51417 | Critical | 9.9 | 2023-12-29 | Unrestricted Upload of File with Dangerous Type vulnerability in Joris van Montfort JVM Gutenberg Rich Text Icons.This issue affects JVM Gutenberg Rich Text Ic… |
CVE-2023-51412 | Critical | 9.0 | 2023-12-29 | Unrestricted Upload of File with Dangerous Type vulnerability in Piotnet Piotnet Forms.This issue affects Piotnet Forms: from n/a through 1.0.25. |
CVE-2023-51411 | Critical | 10.0 | 2023-12-29 | Unrestricted Upload of File with Dangerous Type vulnerability in Shabti Kaplan Frontend Admin by DynamiApps.This issue affects Frontend Admin by DynamiApps: fr… |
CVE-2023-51410 | Critical | 9.9 | 2023-12-29 | Unrestricted Upload of File with Dangerous Type vulnerability in WPVibes WP Mail Log.This issue affects WP Mail Log: from n/a through 1.1.2. |
CVE-2023-7114 | High | 7.1 | 2023-12-29 | Mattermost version 2.10.0 and earlier fails to sanitize deeplink paths, which allows an attacker to perform CSRF attacks against the server. |
CVE-2023-7113 | Low | 3.7 | 2023-12-29 | Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client. |
CVE-2023-51676 | Medium | 4.9 | 2023-12-29 | Server-Side Request Forgery (SSRF) vulnerability in Leevio Happy Addons for Elementor.This issue affects Happy Addons for Elementor: from n/a through 3.9.1.1. |
CVE-2023-51545 | Critical | 9.6 | 2023-12-29 | Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in ThemeHigh Job Manager & Career – Manage job board listings, and recruitme… |
CVE-2023-51505 | Critical | 10.0 | 2023-12-29 | Deserialization of Untrusted Data vulnerability in realmag777 Active Products Tables for WooCommerce. Professional products tables for WooCommerce store.This i… |
CVE-2023-51470 | Critical | 9.9 | 2023-12-29 | Deserialization of Untrusted Data vulnerability in Jacques Malgrange Rencontre – Dating Site.This issue affects Rencontre – Dating Site: from n/a through 3.11… |
CVE-2023-51422 | Critical | 9.9 | 2023-12-29 | Deserialization of Untrusted Data vulnerability in Saleswonder Team Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings |… |
CVE-2023-51414 | Critical | 9.6 | 2023-12-29 | Deserialization of Untrusted Data vulnerability in EnvialoSimple EnvíaloSimple: Email Marketing y Newsletters.This issue affects EnvíaloSimple: Email Marketing… |
CVE-2023-51378 | Medium | 5.4 | 2023-12-29 | Cross-Site Request Forgery (CSRF) vulnerability in Rise Themes Rise Blocks – A Complete Gutenberg Page Builder.This issue affects Rise Blocks – A Complete Gute… |
CVE-2023-51358 | Medium | 5.4 | 2023-12-29 | Cross-Site Request Forgery (CSRF) vulnerability in Bright Plugins Block IPs for Gravity Forms.This issue affects Block IPs for Gravity Forms: from n/a through… |
CVE-2023-51354 | Medium | 4.3 | 2023-12-29 | Cross-Site Request Forgery (CSRF) vulnerability in WebbaPlugins Appointment & Event Booking Calendar Plugin – Webba Booking.This issue affects Appointment & Ev… |
CVE-2023-50902 | Medium | 4.3 | 2023-12-29 | Cross-Site Request Forgery (CSRF) vulnerability in WPExpertsio New User Approve.This issue affects New User Approve: from n/a through 2.5.1. |
CVE-2023-50878 | Medium | 5.4 | 2023-12-29 | Cross-Site Request Forgery (CSRF) vulnerability in InspireUI MStore API.This issue affects MStore API: from n/a through 4.10.1. |
CVE-2023-7080 | High | 8.5 | 2023-12-29 | The V8 inspector intentionally allows arbitrary code execution within the Workers sandbox for debugging. wrangler dev would previously start an inspector serve… |
CVE-2023-7079 | Medium | 6.4 | 2023-12-29 | Sending specially crafted HTTP requests and inspector messages to Wrangler's dev server could result in any file on the user's computer being accessible over t… |
CVE-2023-7078 | High | 7.5 | 2023-12-29 | Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare wa… |
CVE-2023-51402 | Medium | 4.3 | 2023-12-29 | Cross-Site Request Forgery (CSRF) vulnerability in Brain Storm Force Ultimate Addons for WPBakery Page Builder.This issue affects Ultimate Addons for WPBakery… |
CVE-2023-50893 | High | 7.1 | 2023-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UpSolution Impreza – WordPress Website and WooCommerce Bu… |
CVE-2023-50892 | High | 7.1 | 2023-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem - Creative Multi-Purpose & WooCommerce… |
CVE-2023-50891 | Medium | 6.5 | 2023-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zoho Forms Form plugin for WordPress – Zoho Forms allows… |
CVE-2023-50889 | Medium | 6.5 | 2023-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Beaver Builder Team Beaver Builder – WordPress Page B… |
CVE-2023-50881 | Medium | 6.5 | 2023-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AAM Advanced Access Manager – Restricted Content, Users &… |
CVE-2023-50880 | Medium | 6.5 | 2023-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The BuddyPress Community BuddyPress allows Stored XSS.Thi… |
CVE-2023-50879 | Medium | 6.5 | 2023-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress.Com Editing Toolkit allows Stored XS… |
CVE-2023-50837 | High | 7.6 | 2023-12-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WebFactory Ltd Login Lockdown – Protect Login Form.This i… |
CVE-2023-44089 | Medium | 6.1 | 2023-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). It… |
CVE-2023-44088 | Medium | 5.9 | 2023-12-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection. Arbitrary SQL qu… |
CVE-2023-41815 | High | 7.5 | 2023-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Mal… |
CVE-2023-41814 | Low | 3.7 | 2023-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Thr… |
CVE-2023-41813 | Low | 3.0 | 2023-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). All… |
CVE-2023-52135 | High | 7.6 | 2023-12-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WS Form WS Form LITE – Drag & Drop Contact Form Builder f… |
CVE-2023-51541 | Medium | 6.5 | 2023-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aleksandar Urošević Stock Ticker allows Stored XSS.This i… |
CVE-2023-51399 | Medium | 6.5 | 2023-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Back Button Widget allows Stored XSS.This issue… |
CVE-2023-51397 | Medium | 6.5 | 2023-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force WP Remote Site Search allows Stored XSS… |
CVE-2023-51396 | Medium | 6.5 | 2023-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brizy.Io Brizy – Page Builder allows Stored XSS.This issu… |
CVE-2023-51374 | Medium | 5.9 | 2023-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZeroBounce ZeroBounce Email Verification & Validation all… |
CVE-2023-51373 | High | 7.1 | 2023-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ian Kennerley Google Photos Gallery with Shortcodes allow… |