2023 CVEs (page 77)
Page 77 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-6155 | Medium | 5.3 | 2023-12-26 | The Quiz Maker WordPress plugin before 6.4.9.5 does not adequately authorize the `ays_quiz_author_user_search` AJAX action, allowing an unauthenticated attacke… |
CVE-2023-6114 | High | 7.5 | 2023-12-26 | The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the `backups-dup-lite/tmp` directory… |
CVE-2023-5991 | Critical | 9.8 | 2023-12-26 | The Hotel Booking Lite WordPress plugin before 4.8.5 does not validate file paths provided via user input, as well as does not have proper CSRF and authorisati… |
CVE-2023-5980 | Medium | 4.8 | 2023-12-26 | The BSK Forms Blacklist WordPress plugin before 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2023-5939 | High | 7.2 | 2023-12-26 | The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 loads the contents of the import file in an unsafe manner, leading to remote c… |
CVE-2023-5931 | High | 8.8 | 2023-12-26 | The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 does not validate files to be uploaded, which could allow attackers with a low… |
CVE-2023-5674 | High | 8.8 | 2023-12-26 | The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection… |
CVE-2023-5673 | High | 8.8 | 2023-12-26 | The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file extensions uploading files to attach to emails, allowing attackers to upload PHP… |
CVE-2023-5672 | Medium | 6.5 | 2023-12-26 | The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file path parameters when attaching files to emails, leading to local file inclusion… |
CVE-2023-5645 | High | 8.8 | 2023-12-26 | The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection… |
CVE-2023-5644 | High | 7.6 | 2023-12-26 | The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete… |
CVE-2023-5203 | High | 7.5 | 2023-12-26 | The WP Sessions Time Monitoring Full Automatic WordPress plugin before 1.0.9 does not sanitize the request URL or query parameters before using them in an SQL… |
CVE-2023-52086 | High | 8.1 | 2023-12-26 | resumable.php (aka PHP backend for resumable.js) 0.1.4 before 3c6dbf5 allows arbitrary file upload anywhere in the filesystem via ../ in multipart/form-data co… |
CVE-2023-51102 | Critical | 9.8 | 2023-12-26 | Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a stack overflow via the function formWifiMacFilterSet. |
CVE-2023-51101 | Critical | 9.8 | 2023-12-26 | Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a stack overflow via the function formSetUplinkInfo. |
CVE-2023-51100 | Critical | 9.8 | 2023-12-26 | Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a command injection vulnerability via the function formGetDiagnoseInfo . |
CVE-2023-51099 | Critical | 9.8 | 2023-12-26 | Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a command injection vulnerability via the function formexeCommand . |
CVE-2023-51098 | Critical | 9.8 | 2023-12-26 | Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a command injection vulnerability via the function formSetDiagnoseInfo . |
CVE-2023-51097 | Critical | 9.8 | 2023-12-26 | Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a stack overflow via the function formSetAutoPing. |
CVE-2023-51094 | Critical | 9.8 | 2023-12-26 | Tenda M3 V1.0.0.12(4856) was discovered to contain a Command Execution vulnerability via the function TendaTelnet. |
CVE-2023-51093 | Critical | 9.8 | 2023-12-26 | Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function fromSetLocalVlanInfo. |
CVE-2023-51092 | Critical | 9.8 | 2023-12-26 | Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function upgrade. |
CVE-2023-51091 | Critical | 9.8 | 2023-12-26 | Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function R7WebsSecurityHandler. |
CVE-2023-51090 | Critical | 9.8 | 2023-12-26 | Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function formGetWeiXinConfig. |
CVE-2023-51095 | Critical | 9.8 | 2023-12-26 | Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function formDelWlRfPolicy. |
CVE-2023-51467 | Critical | 9.8 | 2023-12-26 | The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code |
CVE-2023-51107 | High | 7.5 | 2023-12-26 | A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF 1.23.4 in functon compute_color() of jquant2.c. NOTE: this is dispute… |
CVE-2023-51106 | High | 7.5 | 2023-12-26 | A floating point exception (divide-by-zero) vulnerability was discovered in mupdf 1.23.4 in function pnm_binary_read_image() of load-pnm.c when fz_colorspace_n… |
CVE-2023-51105 | High | 7.5 | 2023-12-26 | A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF 1.23.4 in function bmp_decompress_rle4() of load-bmp.c. |
CVE-2023-51104 | High | 7.5 | 2023-12-26 | A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF 1.23.4 in function pnm_binary_read_image() of load-pnm.c when span eq… |
CVE-2023-51103 | High | 7.5 | 2023-12-26 | A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF 1.23.4 in the function fz_new_pixmap_from_float_data() of pixmap.c. |
CVE-2023-49949 | High | 8.1 | 2023-12-26 | Passwork before 6.2.0 allows remote authenticated users to bypass 2FA by sending all one million of the possible 6-digit codes. |
CVE-2023-50968 | High | 7.5 | 2023-12-26 | Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations. The same uri… |
CVE-2023-5180 | High | 7.8 | 2023-12-26 | An issue was discovered in Open Design Alliance Drawings SDK before 2024.12. A corrupted value of number of sectors used by the Fat structure in a crafted DGN… |
CVE-2023-51363 | Medium | 6.5 | 2023-12-26 | VR-S1000 firmware Ver. 2.37 and earlier allows a network-adjacent unauthenticated attacker who can access the product's web management page to obtain sensitive… |
CVE-2023-50339 | Medium | 5.4 | 2023-12-26 | Stored cross-site scripting vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.1.11. If this vulnerability is exploi… |
CVE-2023-50332 | Medium | 6.5 | 2023-12-26 | Improper authorization vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.0.6. If this vulnerability is exploited, a… |
CVE-2023-50294 | Medium | 6.5 | 2023-12-26 | The App Settings (/admin/app) page in GROWI versions prior to v6.0.6 stores sensitive information in cleartext form. As a result, the Secret access key for ext… |
CVE-2023-50175 | Medium | 5.4 | 2023-12-26 | Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page, the Markdown Settings (/admin/markdown) page, and the Customize (/admin… |
CVE-2023-49807 | Medium | 5.4 | 2023-12-26 | Stored cross-site scripting vulnerability when processing the MathJax exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrar… |
CVE-2023-49779 | Medium | 5.4 | 2023-12-26 | Stored cross-site scripting vulnerability exists in the anchor tag of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script m… |
CVE-2023-49598 | Medium | 5.4 | 2023-12-26 | Stored cross-site scripting vulnerability exists in the event handlers of the pre tags in GROWI versions prior to v6.0.0. If this vulnerability is exploited, a… |
CVE-2023-49119 | Medium | 5.4 | 2023-12-26 | Stored cross-site scripting vulnerability via the img tags exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script ma… |
CVE-2023-47215 | Medium | 5.4 | 2023-12-26 | Stored cross-site scripting vulnerability which is exploiting a behavior of the XSS Filter exists in GROWI versions prior to v6.0.0. If this vulnerability is e… |
CVE-2023-46711 | Medium | 4.6 | 2023-12-26 | VR-S1000 firmware Ver. 2.37 and earlier uses a hard-coded cryptographic key which may allow an attacker to analyze the password of a specific product user. |
CVE-2023-46699 | Medium | 4.3 | 2023-12-26 | Cross-site request forgery (CSRF) vulnerability exists in the User settings (/me) page of GROWI versions prior to v6.0.0. If a user views a malicious page whil… |
CVE-2023-46681 | High | 7.8 | 2023-12-26 | Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in VR-S1000 firmware Ver. 2.37 and earlier allows an authentic… |
CVE-2023-45741 | Medium | 6.8 | 2023-12-26 | VR-S1000 firmware Ver. 2.37 and earlier allows an attacker with access to the product's web management page to execute arbitrary OS commands. |
CVE-2023-45740 | Medium | 5.4 | 2023-12-26 | Stored cross-site scripting vulnerability when processing profile images exists in GROWI versions prior to v4.1.3. If this vulnerability is exploited, an arbit… |
CVE-2023-45737 | Medium | 5.4 | 2023-12-26 | Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page and the Markdown Settings (/admin/markdown) page of GROWI versions prior… |
CVE-2023-42436 | Medium | 5.4 | 2023-12-26 | Stored cross-site scripting vulnerability exists in the presentation feature of GROWI versions prior to v3.4.0. If this vulnerability is exploited, an arbitrar… |
CVE-2023-51654 | Medium | 5.5 | 2023-12-26 | Improper link resolution before file access ('Link Following') issue exists in iPrint&Scan Desktop for Windows versions 11.0.0 and earlier. A symlink attack by… |
CVE-2023-50297 | Medium | 6.1 | 2023-12-26 | Open redirect vulnerability in PowerCMS (6 Series, 5 Series, and 4 Series) allows a remote unauthenticated attacker to redirect users to arbitrary web sites vi… |
CVE-2023-49117 | Medium | 5.4 | 2023-12-26 | PowerCMS (6 Series, 5 Series, and 4 Series) contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may b… |
CVE-2023-28616 | High | 7.5 | 2023-12-26 | An issue was discovered in Stormshield Network Security (SNS) before 4.3.17, 4.4.x through 4.6.x before 4.6.4, and 4.7.x before 4.7.1. It affects user accounts… |
CVE-2023-27150 | Medium | 5.4 | 2023-12-26 | openCRX 5.2.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name field after creation of a Tracker in Manage Activity. |
CVE-2023-7111 | Medium | 6.3 | 2023-12-26 | A vulnerability, which was classified as critical, was found in code-projects Library Management System 2.0. Affected is an unknown function of the file index… |
CVE-2023-38321 | High | 7.5 | 2023-12-25 | OpenNDS, as used in Sierra Wireless ALEOS before 4.17.0.12 and other products, allows remote attackers to cause a denial of service (NULL pointer dereference… |
CVE-2023-49954 | Critical | 9.8 | 2023-12-25 | The CRM Integration in 3CX before 18.0.9.23 and 20 before 20.0.0.1494 allows SQL Injection via a first name, search string, or email address. |
CVE-2023-49944 | Medium | 6.7 | 2023-12-25 | The Challenge Response feature of BeyondTrust Privilege Management for Windows (PMfW) before 2023-07-14 allows local administrators to bypass this feature by d… |
CVE-2023-49226 | High | 7.2 | 2023-12-25 | An issue was discovered in Peplink Balance Two before 8.4.0. Command injection in the traceroute feature of the administration console allows users with admin… |
CVE-2023-48652 | Medium | 4.3 | 2023-12-25 | Concrete CMS 9 before 9.2.3 is vulnerable to Cross Site Request Forgery (CSRF) via /ccm/system/dialogs/logs/delete_all/submit. An attacker can force an admin u… |
CVE-2023-38826 | Medium | 6.1 | 2023-12-25 | A Cross Site Scripting (XSS) vulnerability exists in Follet Learning Solutions Destiny through 20.0_1U. via the handlewpesearchform.do. searchString. |
CVE-2023-36486 | High | 7.2 | 2023-12-25 | The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the a… |
CVE-2023-36485 | High | 7.2 | 2023-12-25 | The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the a… |
CVE-2023-31224 | Critical | 9.8 | 2023-12-25 | There is broken access control during authentication in Jamf Pro Server before 10.46.1. |
CVE-2023-47247 | Medium | 4.3 | 2023-12-25 | In SysAid On-Premise before 23.3.34, there is an edge case in which an end user is able to delete a Knowledge Base article, aka bug 15102. |
CVE-2023-47091 | High | 7.5 | 2023-12-25 | An issue was discovered in Stormshield Network Security (SNS) SNS 4.3.13 through 4.3.22 before 4.3.23, SNS 4.6.0 through 4.6.9 before 4.6.10, and SNS 4.7.0 thr… |
CVE-2023-37188 | High | 7.5 | 2023-12-25 | C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the function zfp_rate_decompress at zfp/blosc2-zfp.c. |
CVE-2023-37187 | High | 7.5 | 2023-12-25 | C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the zfp/blosc2-zfp.c zfp_acc_decompress. function. |
CVE-2023-37186 | High | 7.5 | 2023-12-25 | C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference in ndlz/ndlz8x8.c via a NULL pointer to memset. |
CVE-2023-37185 | High | 7.5 | 2023-12-25 | C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the function zfp_prec_decompress at zfp/blosc2-zfp.c. |
CVE-2023-31297 | Medium | 4.8 | 2023-12-25 | An issue was discovered in SESAMI planfocus CPTO (Cash Point & Transport Optimizer) 6.3.8.6 718. There is XSS via the Name field when modifying a client. |
CVE-2023-28872 | High | 8.8 | 2023-12-25 | Support Assistant in NCP Secure Enterprise Client before 13.10 allows attackers to execute DLL files with SYSTEM privileges by creating a symbolic link from a… |
CVE-2023-51772 | High | 8.8 | 2023-12-25 | One Identity Password Manager before 5.13.1 allows Kiosk Escape. This product enables users to reset their Active Directory passwords on the login screen of a… |
CVE-2023-49328 | High | 7.2 | 2023-12-25 | On a Wolters Kluwer B.POINT 23.70.00 server running Linux on premises, during the authentication phase, a validated system user can achieve remote code executi… |
CVE-2023-48654 | Critical | 9.8 | 2023-12-25 | One Identity Password Manager before 5.13.1 allows Kiosk Escape. This product enables users to reset their Active Directory passwords on the login screen of a… |
CVE-2023-40236 | Medium | 5.3 | 2023-12-25 | In Pexip VMR self-service portal before 3, the same SSH host key is used across different customers' installations, which allows authentication bypass. |
CVE-2023-37225 | Medium | 6.1 | 2023-12-25 | Pexip Infinity before 32 allows Webapp1 XSS via preconfigured links. |
CVE-2023-31455 | High | 7.5 | 2023-12-25 | Pexip Infinity before 31.2 has Improper Input Validation for RTCP, allowing remote attackers to trigger an abort. |
CVE-2023-31289 | High | 7.5 | 2023-12-25 | Pexip Infinity before 31.2 has Improper Input Validation for signalling, allowing remote attackers to trigger an abort. |
CVE-2023-51771 | Critical | 9.8 | 2023-12-25 | In MicroHttpServer (aka Micro HTTP Server) through a8ab029, _ParseHeader in lib/server.c allows a one-byte recv buffer overflow via a long URI. |
CVE-2023-30451 | Medium | 4.9 | 2023-12-25 | In TYPO3 11.5.24, the filelist component allows attackers (who have access to the administrator panel) to read arbitrary files via directory traversal in the b… |
CVE-2023-7100 | Medium | 6.3 | 2023-12-25 | A vulnerability, which was classified as critical, was found in PHPGurukul Restaurant Table Booking System 1.0. Affected is an unknown function of the file /ad… |
CVE-2023-7099 | Medium | 6.3 | 2023-12-25 | A vulnerability, which was classified as critical, has been found in PHPGurukul Nipah Virus Testing Management System 1.0. This issue affects some unknown proc… |
CVE-2023-49880 | High | 7.5 | 2023-12-25 | In the Message Entry and Repair (MER) facility of IBM Financial Transaction Manager for SWIFT Services 3.2.4 the sending address and the message type of FIN me… |
CVE-2023-43064 | High | 7.0 | 2023-12-25 | Facsimile Support for IBM i 7.2, 7.3, 7.4, and 7.5 could allow a local user to gain elevated privileges due to an unqualified library call. A malicious actor… |
CVE-2023-7098 | Low | 3.1 | 2023-12-25 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in icret EasyImages 2.8.3. This vulnerability affects unknown code of the f… |
CVE-2023-7097 | Medium | 6.3 | 2023-12-25 | A vulnerability classified as critical has been found in code-projects Water Billing System 1.0. This affects an unknown part of the file /addbill.php. The man… |
CVE-2023-7096 | Medium | 4.7 | 2023-12-25 | A flaw has been found in code-projects Faculty Management System 1.0. The affected element is an unknown function of the file /admin/php/crud.php. This manipul… |
CVE-2023-7095 | Critical | 9.8 | 2023-12-25 | A vulnerability, which was classified as critical, has been found in Totolink A7100RU 7.4cu.2313_B20191024. Affected by this issue is the function main of the… |
CVE-2023-7094 | Medium | 5.3 | 2023-12-25 | A vulnerability classified as problematic was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected by this vulnerability is an unknown function… |
CVE-2023-7093 | Medium | 5.3 | 2023-12-25 | A vulnerability classified as critical has been found in KylinSoft kylin-system-updater up to 2.0.5.16-0k2.33. Affected is an unknown function of the file /usr… |
CVE-2023-7092 | Medium | 4.3 | 2023-12-24 | A vulnerability was found in Uniway UW-302VP 2.0. It has been rated as problematic. This issue affects some unknown processing of the file /boaform/wlan_basic_… |
CVE-2023-7102 | Critical | 9.8 | 2023-12-24 | Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected… |
CVE-2023-7101 | High | 7.8 | 2023-12-24 | Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE)… |
CVE-2023-7091 | Medium | 6.3 | 2023-12-24 | A vulnerability was found in Dreamer CMS 4.1.3. It has been declared as problematic. This vulnerability affects unknown code of the file /upload/uploadFile. Th… |
CVE-2023-51714 | Critical | 9.8 | 2023-12-24 | An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/… |
CVE-2023-51767 | High | 7.0 | 2023-12-24 | OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated… |
CVE-2023-51766 | Medium | 5.3 | 2023-12-24 | Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Remote attackers can use a published exploitation technique to inject e… |