2023 CVEs (page 77)
Page 77 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-50874 | Medium | 6.5 | 2023-12-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Darren Cooney WordPress Infinite Scroll – Ajax Load More… |
CVE-2023-4672 | Medium | 6.1 | 2023-12-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Talent Software ECOP allows Reflected XSS. This issue af… |
CVE-2023-4671 | Critical | 9.8 | 2023-12-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Talent Software ECOP allows Command Line Execution throug… |
CVE-2023-45702 | Medium | 6.2 | 2023-12-28 | An HCL UrbanCode Deploy Agent installed as a Windows service in a non-standard location could be subject to a denial of service attack by local accounts.. |
CVE-2023-50038 | High | 8.8 | 2023-12-28 | There is an arbitrary file upload vulnerability in the background of textpattern cms v4.8.8, which leads to the loss of server permissions. |
CVE-2023-45701 | Medium | 4.3 | 2023-12-28 | HCL Launch could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information c… |
CVE-2023-50692 | High | 8.8 | 2023-12-28 | File Upload vulnerability in JIZHICMS v.2.5, allows remote attacker to execute arbitrary code via a crafted file uploaded and downloaded to the download_url pa… |
CVE-2023-49469 | Medium | 6.1 | 2023-12-28 | Reflected Cross Site Scripting (XSS) vulnerability in Shaarli v0.12.2, allows remote attackers to execute arbitrary code via search tag function. |
CVE-2023-46989 | High | 7.8 | 2023-12-28 | SQL Injection vulnerability in the Innovadeluxe Quick Order module for PrestaShop before v.1.4.0, allows local attackers to execute arbitrary code via the getP… |
CVE-2023-50445 | High | 7.8 | 2023-12-28 | Shell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.6, MT6000 v4.5.0, MT1300 v4.3.7, MT300N-V2 v4.3.7… |
CVE-2023-51010 | Medium | 5.3 | 2023-12-28 | An issue in the export component AdSdkH5Activity of com.sdjictec.qdmetro v4.2.2 allows attackers to open a crafted URL without any filtering or checking. |
CVE-2023-51006 | High | 7.5 | 2023-12-28 | An issue in the openFile method of Chinese Perpetual Calendar v9.0.0 allows attackers to read any file via unspecified vectors. |
CVE-2023-49230 | High | 8.8 | 2023-12-28 | An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in captive portals allows attackers to modify the portals' configura… |
CVE-2023-49229 | Medium | 4.3 | 2023-12-28 | An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in the administration web service allows read-only, unprivileged use… |
CVE-2023-49228 | Medium | 6.4 | 2023-12-28 | An issue was discovered in Peplink Balance Two before 8.4.0. Console port authentication uses hard-coded credentials, which allows an attacker with physical ac… |
CVE-2023-7124 | Medium | 4.3 | 2023-12-28 | A vulnerability, which was classified as problematic, was found in code-projects E-Commerce Site 1.0. Affected is an unknown function of the file search.php. T… |
CVE-2023-34829 | Medium | 6.5 | 2023-12-28 | Incorrect access control in TP-Link Tapo before v3.1.315 allows attackers to access user credentials in plaintext. |
CVE-2023-7123 | Medium | 6.3 | 2023-12-28 | A vulnerability, which was classified as critical, has been found in SourceCodester Medicine Tracking System 1.0. This issue affects some unknown processing of… |
CVE-2023-6879 | Critical | 9.0 | 2023-12-27 | Increasing the resolution of video frames, while performing a multi-threaded encode, can result in a heap overflow in av1_loop_restoration_dealloc(). |
CVE-2023-49003 | Medium | 5.3 | 2023-12-27 | An issue in simplemobiletools Simple Dialer 5.18.1 allows an attacker to bypass intended access restrictions via interaction with com.simplemobiletools.dialer… |
CVE-2023-49002 | High | 7.5 | 2023-12-27 | An issue in Xenom Technologies (sinous) Phone Dialer-voice Call Dialer v.1.2.5 allows an attacker to bypass intended access restrictions via interaction with c… |
CVE-2023-49001 | Critical | 9.8 | 2023-12-27 | An issue in Indi Browser (aka kvbrowser) v.12.11.23 allows an attacker to bypass intended access restrictions via interaction with the com.example.gurry.kvbrow… |
CVE-2023-49000 | Critical | 9.8 | 2023-12-27 | An issue in ArtistScope ArtisBrowser v.34.1.5 and before allows an attacker to bypass intended access restrictions via interaction with the com.artis.browser.I… |
CVE-2023-46918 | Medium | 4.6 | 2023-12-27 | Phlox com.phlox.simpleserver.plus (aka Simple HTTP Server PLUS) 1.8.1-plus has an Android manifest file that contains an entry with the android:allowBackup att… |
CVE-2023-51084 | Critical | 9.8 | 2023-12-27 | hyavijava v6.0.07.1 was discovered to contain a stack overflow via the ResultConverter.convert2Xml method. |
CVE-2023-51080 | High | 7.5 | 2023-12-27 | The NumberUtil.toBigDecimal method in hutool-core v5.8.23 was discovered to contain a stack overflow. |
CVE-2023-51079 | Medium | 5.3 | 2023-12-27 | A long execution time can occur in the ParseTools.subCompileExpression method in MVEL 2.5.0.Final because of many Java class lookups. NOTE: the vendor disputes… |
CVE-2023-51075 | High | 7.5 | 2023-12-27 | hutool-core v5.8.23 was discovered to contain an infinite loop in the StrSplitter.splitByRegex function. This vulnerability allows attackers to cause a Denial… |
CVE-2023-51074 | Medium | 5.3 | 2023-12-27 | json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method. |
CVE-2023-47883 | Critical | 9.8 | 2023-12-27 | The com.altamirano.fabricio.tvbrowser TV browser application through 4.5.1 for Android is vulnerable to JavaScript code execution via an explicit intent due to… |
CVE-2023-47882 | High | 7.1 | 2023-12-27 | The Kami Vision YI IoT com.yunyi.smartcamera application through 4.1.9_20231127 for Android allows a remote attacker to execute arbitrary JavaScript code via a… |
CVE-2023-46919 | Medium | 6.3 | 2023-12-27 | Phlox com.phlox.simpleserver (aka Simple HTTP Server) 1.8 and com.phlox.simpleserver.plus (aka Simple HTTP Server PLUS) 1.8.1-plus have a hardcoded aKySWb2jjrr… |
CVE-2023-43955 | Critical | 9.8 | 2023-12-27 | The com.phlox.tvwebbrowser TV Bro application through 2.0.0 for Android mishandles external intents through WebView. This allows attackers to execute arbitrary… |
CVE-2023-43481 | Critical | 9.8 | 2023-12-27 | An issue in Shenzhen TCL Browser TV Web BrowseHere (aka com.tcl.browser) 6.65.022_dab24cc6_231221_gp allows a remote attacker to execute arbitrary JavaScript c… |
CVE-2023-52075 | High | 7.5 | 2023-12-27 | ReVanced API proxies requests needed to feed the ReVanced Manager and website with data. Up to and including commit 71f81f7f20cd26fd707335bca9838fa3e7df20d2, R… |
CVE-2023-40038 | High | 8.8 | 2023-12-27 | Arris DG860A and DG1670A devices have predictable default WPA2 PSKs that could lead to unauthorized remote access. (They use the first 6 characters of the SSID… |
CVE-2023-52077 | High | 8.9 | 2023-12-27 | Nexkey is a lightweight fork of Misskey v12 optimized for small to medium size servers. Prior to 12.23Q4.5, Nexkey allows external apps using tokens issued by… |
CVE-2023-51700 | Medium | 6.4 | 2023-12-27 | Unofficial Mobile BankID Integration for WordPress lets users employ Mobile BankID to authenticate themselves on your WordPress site. Prior to 1.0.1, WP-Mobile… |
CVE-2023-51697 | Medium | 4.3 | 2023-12-27 | Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.7.0, Audiobookshelf is vulnerable to unauthenticated blind server-side request (SSRF)… |
CVE-2023-51665 | Medium | 4.3 | 2023-12-27 | Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.7.0, Audiobookshelf is vulnerable to unauthenticated blind server-side request (SSRF)… |
CVE-2023-51664 | High | 7.3 | 2023-12-27 | tj-actions/changed-files is a Github action to retrieve all files and directories. Prior to 41.0.0, the `tj-actions/changed-files` workflow allows for command… |
CVE-2023-51443 | High | 7.5 | 2023-12-27 | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on… |
CVE-2023-50255 | Critical | 9.3 | 2023-12-27 | Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be… |
CVE-2023-7116 | Medium | 6.3 | 2023-12-27 | A vulnerability, which was classified as critical, has been found in WeiYe-Jing datax-web 2.1.2. Affected by this issue is some unknown functionality of the fi… |
CVE-2023-4641 | Medium | 4.7 | 2023-12-27 | A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-uti… |
CVE-2023-3171 | High | 7.5 | 2023-12-27 | A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed… |
CVE-2023-6190 | Critical | 9.8 | 2023-12-27 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in İzmir Katip Çelebi University University Information Management… |
CVE-2023-52096 | High | 7.5 | 2023-12-26 | SteVe Community ocpp-jaxb before 0.0.8 generates invalid timestamps such as ones with month 00 in certain situations (such as when an application receives a St… |
CVE-2023-49438 | Medium | 6.1 | 2023-12-26 | An open redirect vulnerability in the python package Flask-Security-Too <=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafte… |
CVE-2023-48003 | Medium | 6.1 | 2023-12-26 | An open redirect through HTML injection in user messages in Asp.Net Zero before 12.3.0 allows remote attackers to redirect targeted victims to any URL via the… |
CVE-2023-6268 | Medium | 6.1 | 2023-12-26 | The JSON Content Importer WordPress plugin before 1.5.4 does not sanitise and escape the tab parameter before outputting it back in the page, leading to a Refl… |
CVE-2023-6250 | High | 7.5 | 2023-12-26 | The BestWebSoft's Like & Share WordPress plugin before 2.74 discloses the content of password protected posts to unauthenticated users via a meta tag |
CVE-2023-6166 | Medium | 6.1 | 2023-12-26 | The Quiz Maker WordPress plugin before 6.4.9.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting |
CVE-2023-6155 | Medium | 5.3 | 2023-12-26 | The Quiz Maker WordPress plugin before 6.4.9.5 does not adequately authorize the `ays_quiz_author_user_search` AJAX action, allowing an unauthenticated attacke… |
CVE-2023-6114 | High | 7.5 | 2023-12-26 | The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the `backups-dup-lite/tmp` directory… |
CVE-2023-5991 | Critical | 9.8 | 2023-12-26 | The Hotel Booking Lite WordPress plugin before 4.8.5 does not validate file paths provided via user input, as well as does not have proper CSRF and authorisati… |
CVE-2023-5980 | Medium | 4.8 | 2023-12-26 | The BSK Forms Blacklist WordPress plugin before 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2023-5939 | High | 7.2 | 2023-12-26 | The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 loads the contents of the import file in an unsafe manner, leading to remote c… |
CVE-2023-5931 | High | 8.8 | 2023-12-26 | The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 does not validate files to be uploaded, which could allow attackers with a low… |
CVE-2023-5674 | High | 8.8 | 2023-12-26 | The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection… |
CVE-2023-5673 | High | 8.8 | 2023-12-26 | The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file extensions uploading files to attach to emails, allowing attackers to upload PHP… |
CVE-2023-5672 | Medium | 6.5 | 2023-12-26 | The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file path parameters when attaching files to emails, leading to local file inclusion… |
CVE-2023-5645 | High | 8.8 | 2023-12-26 | The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection… |
CVE-2023-5644 | High | 7.6 | 2023-12-26 | The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete… |
CVE-2023-5203 | High | 7.5 | 2023-12-26 | The WP Sessions Time Monitoring Full Automatic WordPress plugin before 1.0.9 does not sanitize the request URL or query parameters before using them in an SQL… |
CVE-2023-52086 | High | 8.1 | 2023-12-26 | resumable.php (aka PHP backend for resumable.js) 0.1.4 before 3c6dbf5 allows arbitrary file upload anywhere in the filesystem via ../ in multipart/form-data co… |
CVE-2023-51102 | Critical | 9.8 | 2023-12-26 | Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a stack overflow via the function formWifiMacFilterSet. |
CVE-2023-51101 | Critical | 9.8 | 2023-12-26 | Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a stack overflow via the function formSetUplinkInfo. |
CVE-2023-51100 | Critical | 9.8 | 2023-12-26 | Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a command injection vulnerability via the function formGetDiagnoseInfo . |
CVE-2023-51099 | Critical | 9.8 | 2023-12-26 | Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a command injection vulnerability via the function formexeCommand . |
CVE-2023-51098 | Critical | 9.8 | 2023-12-26 | Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a command injection vulnerability via the function formSetDiagnoseInfo . |
CVE-2023-51097 | Critical | 9.8 | 2023-12-26 | Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a stack overflow via the function formSetAutoPing. |
CVE-2023-51094 | Critical | 9.8 | 2023-12-26 | Tenda M3 V1.0.0.12(4856) was discovered to contain a Command Execution vulnerability via the function TendaTelnet. |
CVE-2023-51093 | Critical | 9.8 | 2023-12-26 | Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function fromSetLocalVlanInfo. |
CVE-2023-51092 | Critical | 9.8 | 2023-12-26 | Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function upgrade. |
CVE-2023-51091 | Critical | 9.8 | 2023-12-26 | Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function R7WebsSecurityHandler. |
CVE-2023-51090 | Critical | 9.8 | 2023-12-26 | Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function formGetWeiXinConfig. |
CVE-2023-51095 | Critical | 9.8 | 2023-12-26 | Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function formDelWlRfPolicy. |
CVE-2023-51467 | Critical | 9.8 | 2023-12-26 | The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code |
CVE-2023-51107 | High | 7.5 | 2023-12-26 | A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF 1.23.4 in functon compute_color() of jquant2.c. NOTE: this is dispute… |
CVE-2023-51106 | High | 7.5 | 2023-12-26 | A floating point exception (divide-by-zero) vulnerability was discovered in mupdf 1.23.4 in function pnm_binary_read_image() of load-pnm.c when fz_colorspace_n… |
CVE-2023-51105 | High | 7.5 | 2023-12-26 | A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF 1.23.4 in function bmp_decompress_rle4() of load-bmp.c. |
CVE-2023-51104 | High | 7.5 | 2023-12-26 | A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF 1.23.4 in function pnm_binary_read_image() of load-pnm.c when span eq… |
CVE-2023-51103 | High | 7.5 | 2023-12-26 | A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF 1.23.4 in the function fz_new_pixmap_from_float_data() of pixmap.c. |
CVE-2023-49949 | High | 8.1 | 2023-12-26 | Passwork before 6.2.0 allows remote authenticated users to bypass 2FA by sending all one million of the possible 6-digit codes. |
CVE-2023-50968 | High | 7.5 | 2023-12-26 | Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations. The same uri… |
CVE-2023-5180 | High | 7.8 | 2023-12-26 | An issue was discovered in Open Design Alliance Drawings SDK before 2024.12. A corrupted value of number of sectors used by the Fat structure in a crafted DGN… |
CVE-2023-51363 | Medium | 6.5 | 2023-12-26 | VR-S1000 firmware Ver. 2.37 and earlier allows a network-adjacent unauthenticated attacker who can access the product's web management page to obtain sensitive… |
CVE-2023-50339 | Medium | 5.4 | 2023-12-26 | Stored cross-site scripting vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.1.11. If this vulnerability is exploi… |
CVE-2023-50332 | Medium | 6.5 | 2023-12-26 | Improper authorization vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.0.6. If this vulnerability is exploited, a… |
CVE-2023-50294 | Medium | 6.5 | 2023-12-26 | The App Settings (/admin/app) page in GROWI versions prior to v6.0.6 stores sensitive information in cleartext form. As a result, the Secret access key for ext… |
CVE-2023-50175 | Medium | 5.4 | 2023-12-26 | Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page, the Markdown Settings (/admin/markdown) page, and the Customize (/admin… |
CVE-2023-49807 | Medium | 5.4 | 2023-12-26 | Stored cross-site scripting vulnerability when processing the MathJax exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrar… |
CVE-2023-49779 | Medium | 5.4 | 2023-12-26 | Stored cross-site scripting vulnerability exists in the anchor tag of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script m… |
CVE-2023-49598 | Medium | 5.4 | 2023-12-26 | Stored cross-site scripting vulnerability exists in the event handlers of the pre tags in GROWI versions prior to v6.0.0. If this vulnerability is exploited, a… |
CVE-2023-49119 | Medium | 5.4 | 2023-12-26 | Stored cross-site scripting vulnerability via the img tags exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script ma… |
CVE-2023-47215 | Medium | 5.4 | 2023-12-26 | Stored cross-site scripting vulnerability which is exploiting a behavior of the XSS Filter exists in GROWI versions prior to v6.0.0. If this vulnerability is e… |
CVE-2023-46711 | Medium | 4.6 | 2023-12-26 | VR-S1000 firmware Ver. 2.37 and earlier uses a hard-coded cryptographic key which may allow an attacker to analyze the password of a specific product user. |
CVE-2023-46699 | Medium | 4.3 | 2023-12-26 | Cross-site request forgery (CSRF) vulnerability exists in the User settings (/me) page of GROWI versions prior to v6.0.0. If a user views a malicious page whil… |
CVE-2023-46681 | High | 7.8 | 2023-12-26 | Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in VR-S1000 firmware Ver. 2.37 and earlier allows an authentic… |