2023 CVEs (page 78)
Page 78 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-45741 | Medium | 6.8 | 2023-12-26 | VR-S1000 firmware Ver. 2.37 and earlier allows an attacker with access to the product's web management page to execute arbitrary OS commands. |
CVE-2023-45740 | Medium | 5.4 | 2023-12-26 | Stored cross-site scripting vulnerability when processing profile images exists in GROWI versions prior to v4.1.3. If this vulnerability is exploited, an arbit… |
CVE-2023-45737 | Medium | 5.4 | 2023-12-26 | Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page and the Markdown Settings (/admin/markdown) page of GROWI versions prior… |
CVE-2023-42436 | Medium | 5.4 | 2023-12-26 | Stored cross-site scripting vulnerability exists in the presentation feature of GROWI versions prior to v3.4.0. If this vulnerability is exploited, an arbitrar… |
CVE-2023-51654 | Medium | 5.5 | 2023-12-26 | Improper link resolution before file access ('Link Following') issue exists in iPrint&Scan Desktop for Windows versions 11.0.0 and earlier. A symlink attack by… |
CVE-2023-50297 | Medium | 6.1 | 2023-12-26 | Open redirect vulnerability in PowerCMS (6 Series, 5 Series, and 4 Series) allows a remote unauthenticated attacker to redirect users to arbitrary web sites vi… |
CVE-2023-49117 | Medium | 5.4 | 2023-12-26 | PowerCMS (6 Series, 5 Series, and 4 Series) contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may b… |
CVE-2023-28616 | High | 7.5 | 2023-12-26 | An issue was discovered in Stormshield Network Security (SNS) before 4.3.17, 4.4.x through 4.6.x before 4.6.4, and 4.7.x before 4.7.1. It affects user accounts… |
CVE-2023-27150 | Medium | 5.4 | 2023-12-26 | openCRX 5.2.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name field after creation of a Tracker in Manage Activity. |
CVE-2023-7111 | Medium | 6.3 | 2023-12-26 | A vulnerability, which was classified as critical, was found in code-projects Library Management System 2.0. Affected is an unknown function of the file index… |
CVE-2023-38321 | High | 7.5 | 2023-12-25 | OpenNDS, as used in Sierra Wireless ALEOS before 4.17.0.12 and other products, allows remote attackers to cause a denial of service (NULL pointer dereference… |
CVE-2023-49954 | Critical | 9.8 | 2023-12-25 | The CRM Integration in 3CX before 18.0.9.23 and 20 before 20.0.0.1494 allows SQL Injection via a first name, search string, or email address. |
CVE-2023-49944 | Medium | 6.7 | 2023-12-25 | The Challenge Response feature of BeyondTrust Privilege Management for Windows (PMfW) before 2023-07-14 allows local administrators to bypass this feature by d… |
CVE-2023-49226 | High | 7.2 | 2023-12-25 | An issue was discovered in Peplink Balance Two before 8.4.0. Command injection in the traceroute feature of the administration console allows users with admin… |
CVE-2023-48652 | Medium | 4.3 | 2023-12-25 | Concrete CMS 9 before 9.2.3 is vulnerable to Cross Site Request Forgery (CSRF) via /ccm/system/dialogs/logs/delete_all/submit. An attacker can force an admin u… |
CVE-2023-38826 | Medium | 6.1 | 2023-12-25 | A Cross Site Scripting (XSS) vulnerability exists in Follet Learning Solutions Destiny through 20.0_1U. via the handlewpesearchform.do. searchString. |
CVE-2023-36486 | High | 7.2 | 2023-12-25 | The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the a… |
CVE-2023-36485 | High | 7.2 | 2023-12-25 | The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the a… |
CVE-2023-31224 | Critical | 9.8 | 2023-12-25 | There is broken access control during authentication in Jamf Pro Server before 10.46.1. |
CVE-2023-47247 | Medium | 4.3 | 2023-12-25 | In SysAid On-Premise before 23.3.34, there is an edge case in which an end user is able to delete a Knowledge Base article, aka bug 15102. |
CVE-2023-47091 | High | 7.5 | 2023-12-25 | An issue was discovered in Stormshield Network Security (SNS) SNS 4.3.13 through 4.3.22 before 4.3.23, SNS 4.6.0 through 4.6.9 before 4.6.10, and SNS 4.7.0 thr… |
CVE-2023-37188 | High | 7.5 | 2023-12-25 | C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the function zfp_rate_decompress at zfp/blosc2-zfp.c. |
CVE-2023-37187 | High | 7.5 | 2023-12-25 | C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the zfp/blosc2-zfp.c zfp_acc_decompress. function. |
CVE-2023-37186 | High | 7.5 | 2023-12-25 | C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference in ndlz/ndlz8x8.c via a NULL pointer to memset. |
CVE-2023-37185 | High | 7.5 | 2023-12-25 | C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the function zfp_prec_decompress at zfp/blosc2-zfp.c. |
CVE-2023-31297 | Medium | 4.8 | 2023-12-25 | An issue was discovered in SESAMI planfocus CPTO (Cash Point & Transport Optimizer) 6.3.8.6 718. There is XSS via the Name field when modifying a client. |
CVE-2023-28872 | High | 8.8 | 2023-12-25 | Support Assistant in NCP Secure Enterprise Client before 13.10 allows attackers to execute DLL files with SYSTEM privileges by creating a symbolic link from a… |
CVE-2023-51772 | High | 8.8 | 2023-12-25 | One Identity Password Manager before 5.13.1 allows Kiosk Escape. This product enables users to reset their Active Directory passwords on the login screen of a… |
CVE-2023-49328 | High | 7.2 | 2023-12-25 | On a Wolters Kluwer B.POINT 23.70.00 server running Linux on premises, during the authentication phase, a validated system user can achieve remote code executi… |
CVE-2023-48654 | Critical | 9.8 | 2023-12-25 | One Identity Password Manager before 5.13.1 allows Kiosk Escape. This product enables users to reset their Active Directory passwords on the login screen of a… |
CVE-2023-40236 | Medium | 5.3 | 2023-12-25 | In Pexip VMR self-service portal before 3, the same SSH host key is used across different customers' installations, which allows authentication bypass. |
CVE-2023-37225 | Medium | 6.1 | 2023-12-25 | Pexip Infinity before 32 allows Webapp1 XSS via preconfigured links. |
CVE-2023-31455 | High | 7.5 | 2023-12-25 | Pexip Infinity before 31.2 has Improper Input Validation for RTCP, allowing remote attackers to trigger an abort. |
CVE-2023-31289 | High | 7.5 | 2023-12-25 | Pexip Infinity before 31.2 has Improper Input Validation for signalling, allowing remote attackers to trigger an abort. |
CVE-2023-51771 | Critical | 9.8 | 2023-12-25 | In MicroHttpServer (aka Micro HTTP Server) through a8ab029, _ParseHeader in lib/server.c allows a one-byte recv buffer overflow via a long URI. |
CVE-2023-30451 | Medium | 4.9 | 2023-12-25 | In TYPO3 11.5.24, the filelist component allows attackers (who have access to the administrator panel) to read arbitrary files via directory traversal in the b… |
CVE-2023-7100 | Medium | 6.3 | 2023-12-25 | A vulnerability, which was classified as critical, was found in PHPGurukul Restaurant Table Booking System 1.0. Affected is an unknown function of the file /ad… |
CVE-2023-7099 | Medium | 6.3 | 2023-12-25 | A vulnerability, which was classified as critical, has been found in PHPGurukul Nipah Virus Testing Management System 1.0. This issue affects some unknown proc… |
CVE-2023-49880 | High | 7.5 | 2023-12-25 | In the Message Entry and Repair (MER) facility of IBM Financial Transaction Manager for SWIFT Services 3.2.4 the sending address and the message type of FIN me… |
CVE-2023-43064 | High | 7.0 | 2023-12-25 | Facsimile Support for IBM i 7.2, 7.3, 7.4, and 7.5 could allow a local user to gain elevated privileges due to an unqualified library call. A malicious actor… |
CVE-2023-7098 | Low | 3.1 | 2023-12-25 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in icret EasyImages 2.8.3. This vulnerability affects unknown code of the f… |
CVE-2023-7097 | Medium | 6.3 | 2023-12-25 | A vulnerability classified as critical has been found in code-projects Water Billing System 1.0. This affects an unknown part of the file /addbill.php. The man… |
CVE-2023-7096 | Medium | 4.7 | 2023-12-25 | A flaw has been found in code-projects Faculty Management System 1.0. The affected element is an unknown function of the file /admin/php/crud.php. This manipul… |
CVE-2023-7095 | Critical | 9.8 | 2023-12-25 | A vulnerability, which was classified as critical, has been found in Totolink A7100RU 7.4cu.2313_B20191024. Affected by this issue is the function main of the… |
CVE-2023-7094 | Medium | 5.3 | 2023-12-25 | A vulnerability classified as problematic was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected by this vulnerability is an unknown function… |
CVE-2023-7093 | Medium | 5.3 | 2023-12-25 | A vulnerability classified as critical has been found in KylinSoft kylin-system-updater up to 2.0.5.16-0k2.33. Affected is an unknown function of the file /usr… |
CVE-2023-7092 | Medium | 4.3 | 2023-12-24 | A vulnerability was found in Uniway UW-302VP 2.0. It has been rated as problematic. This issue affects some unknown processing of the file /boaform/wlan_basic_… |
CVE-2023-7102 | Critical | 9.8 | 2023-12-24 | Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected… |
CVE-2023-7101 | High | 7.8 | 2023-12-24 | Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE)… |
CVE-2023-7091 | Medium | 6.3 | 2023-12-24 | A vulnerability was found in Dreamer CMS 4.1.3. It has been declared as problematic. This vulnerability affects unknown code of the file /upload/uploadFile. Th… |
CVE-2023-51714 | Critical | 9.8 | 2023-12-24 | An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/… |
CVE-2023-51767 | High | 7.0 | 2023-12-24 | OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated… |
CVE-2023-51766 | Medium | 5.3 | 2023-12-24 | Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Remote attackers can use a published exploitation technique to inject e… |
CVE-2023-51765 | Medium | 5.3 | 2023-12-24 | sendmail through 8.17.2 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to inject e-mail messages… |
CVE-2023-51764 | Medium | 5.3 | 2023-12-24 | Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (o… |
CVE-2023-51763 | Critical | 9.8 | 2023-12-24 | csv_builder.rb in ActiveAdmin (aka Active Admin) before 3.2.0 allows CSV injection. |
CVE-2023-7090 | Medium | 6.6 | 2023-12-23 | A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore, it leads to privil… |
CVE-2023-49594 | Medium | 4.5 | 2023-12-23 | An information disclosure vulnerability exists in the challenge functionality of instipod DuoUniversalKeycloakAuthenticator 1.0.7 plugin. A specially crafted H… |
CVE-2023-7008 | Medium | 5.9 | 2023-12-23 | A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signatur… |
CVE-2023-6744 | Medium | 6.4 | 2023-12-23 | The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'et_pb_text' shortcode in all versions up to, and including, 4.23.1… |
CVE-2023-5962 | Medium | 6.5 | 2023-12-23 | A weak cryptographic algorithm vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior. This vulnerability can help an attac… |
CVE-2023-5961 | High | 8.8 | 2023-12-23 | A Cross-Site Request Forgery (CSRF) vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior. An attacker can exploit this vu… |
CVE-2023-7002 | High | 7.2 | 2023-12-23 | The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 1.3.9 via the 'url' parameter. This vuln… |
CVE-2023-6972 | Critical | 9.8 | 2023-12-23 | The Backup Migration plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.9 via the 'content-backups' and 'content-na… |
CVE-2023-6971 | High | 8.1 | 2023-12-23 | The Backup Migration plugin for WordPress is vulnerable to Remote File Inclusion in versions 1.0.8 to 1.3.9 via the 'content-dir' HTTP header. This makes it po… |
CVE-2023-51386 | High | 7.8 | 2023-12-22 | Sandbox Accounts for Events provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated… |
CVE-2023-51651 | Medium | 6.0 | 2023-12-22 | AWS SDK for PHP is the Amazon Web Services software development kit for PHP. Within the scope of requests to S3 object keys and/or prefixes containing a Unix d… |
CVE-2023-51650 | High | 7.5 | 2023-12-22 | Hertzbeat is an open source, real-time monitoring system. Prior to version 1.4.1, Spring Boot permission configuration issues caused unauthorized access vulner… |
CVE-2023-51451 | Medium | 4.3 | 2023-12-22 | Symbolicator is a service used in Sentry. Starting in Symbolicator version 0.3.3 and prior to version 21.12.1, an attacker could make Symbolicator send GET HTT… |
CVE-2023-51449 | Medium | 5.6 | 2023-12-22 | Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python… |
CVE-2023-51387 | High | 7.2 | 2023-12-22 | Hertzbeat is an open source, real-time monitoring system. Hertzbeat uses aviatorscript to evaluate alert expressions. The alert expressions are supposed to be… |
CVE-2023-50928 | High | 7.1 | 2023-12-22 | "Sandbox Accounts for Events" provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticate… |
CVE-2023-50924 | High | 7.3 | 2023-12-22 | Englesystem is a shift planning system for chaos events. Engelsystem prior to v3.4.1 performed insufficient validation of user supplied data for the DECT numbe… |
CVE-2023-50731 | Critical | 9.1 | 2023-12-22 | MindsDB is a SQL Server for artificial intelligence. Prior to version 23.11.4.1, the `put` method in `mindsdb/mindsdb/api/http/namespaces/file.py` does not val… |
CVE-2023-50730 | High | 7.5 | 2023-12-22 | Grackle is a GraphQL server written in functional Scala, built on the Typelevel stack. The GraphQL specification requires that GraphQL fragments must not form… |
CVE-2023-50727 | Medium | 6.3 | 2023-12-22 | Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. Reflected XSS issue occurs when… |
CVE-2023-50725 | Medium | 6.3 | 2023-12-22 | Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. The following paths in resque-w… |
CVE-2023-50712 | Medium | 4.6 | 2023-12-22 | Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. A stored Cross-Site Scripting (XSS) vu… |
CVE-2023-51035 | Critical | 9.8 | 2023-12-22 | TOTOLINK EX1200L V9.3.5u.6146_B20201023 is vulnerable to arbitrary command execution on the cstecgi.cgi NTPSyncWithHost interface. |
CVE-2023-51034 | Critical | 9.8 | 2023-12-22 | TOTOlink EX1200L V9.3.5u.6146_B20201023 is vulnerable to arbitrary command execution via the cstecgi.cgi UploadFirmwareFile interface. |
CVE-2023-51033 | Critical | 9.8 | 2023-12-22 | TOTOlink EX1200L V9.3.5u.6146_B20201023 is vulnerable to arbitrary command execution via the cstecgi.cgi setOpModeCfg interface. |
CVE-2023-51022 | Critical | 9.8 | 2023-12-22 | TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘langFlag’ parameter of the setLanguageCfg interface… |
CVE-2023-51021 | Critical | 9.8 | 2023-12-22 | TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘merge’ parameter of the setRptWizardCfg interface of… |
CVE-2023-51020 | Critical | 9.8 | 2023-12-22 | TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘langType’ parameter of the setLanguageCfg interface… |
CVE-2023-51019 | Critical | 9.8 | 2023-12-22 | TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘key5g’ parameter of the setWiFiExtenderConfig interf… |
CVE-2023-51018 | Critical | 9.8 | 2023-12-22 | TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘opmode’ parameter of the setWiFiApConfig interface o… |
CVE-2023-51017 | Critical | 9.8 | 2023-12-22 | TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanIp parameter’ of the setLanConfig interface of the… |
CVE-2023-51016 | Critical | 9.8 | 2023-12-22 | TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the setRebootScheCfg interface of the cstecgi .cgi. |
CVE-2023-51015 | Critical | 9.8 | 2023-12-22 | TOTOLINX EX1800T v9.1.0cu.2112_B20220316 is vulnerable to arbitrary command execution in the ‘enable parameter’ of the setDmzCfg interface of the cstecgi .cgi |
CVE-2023-51014 | Critical | 9.8 | 2023-12-22 | TOTOLINK EX1800T V9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanSecDns parameter’ of the setLanConfig interface of… |
CVE-2023-51013 | Critical | 9.8 | 2023-12-22 | TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanNetmask parameter’ of the setLanConfig interface o… |
CVE-2023-51012 | Critical | 9.8 | 2023-12-22 | TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanGateway parameter’ of the setLanConfig interface o… |
CVE-2023-51011 | Critical | 9.8 | 2023-12-22 | TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanPriDns parameter’ of the setLanConfig interface of… |
CVE-2023-50714 | Medium | 6.8 | 2023-12-22 | yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2… |
CVE-2023-50708 | Medium | 6.1 | 2023-12-22 | yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2… |
CVE-2023-50147 | Critical | 9.8 | 2023-12-22 | There is an arbitrary command execution vulnerability in the setDiagnosisCfg function of the cstecgi .cgi of the TOTOlink A3700R router device in its firmware… |
CVE-2023-51028 | Critical | 9.8 | 2023-12-22 | TOTOLINK EX1800T 9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the apcliChannel parameter of the setWiFiExtenderConfig in… |
CVE-2023-51027 | Critical | 9.8 | 2023-12-22 | TOTOlink EX1800T V9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘apcliAuthMode’ parameter of the setWiFiExtenderConfi… |
CVE-2023-51026 | Critical | 9.8 | 2023-12-22 | TOTOlink EX1800T V9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘hour’ parameter of the setRebootScheCfg interface of… |
CVE-2023-51025 | Critical | 9.8 | 2023-12-22 | TOTOlink EX1800T V9.1.0cu.2112_B20220316 is vulnerable to an unauthorized arbitrary command execution in the ‘admuser’ parameter of the setPasswordCfg interfac… |