2023 CVEs (page 79)
Page 79 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-7050 | Low | 3.5 | 2023-12-21 | A vulnerability has been found in PHPGurukul Online Notes Sharing System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functi… |
CVE-2023-37519 | High | 7.7 | 2023-12-21 | Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. This XSS vulnerability is in the Download Status Report, which is served by the BigFix Server… |
CVE-2023-27319 | Medium | 5.3 | 2023-12-21 | ONTAP Mediator versions prior to 1.7 are susceptible to a vulnerability that can allow an unauthenticated attacker to enumerate URLs via REST API. |
CVE-2023-6847 | High | 7.5 | 2023-12-21 | An improper authentication vulnerability was identified in GitHub Enterprise Server that allowed a bypass of Private Mode by using a specially crafted API requ… |
CVE-2023-6804 | Medium | 6.5 | 2023-12-21 | Improper privilege management allowed arbitrary workflows to be committed and run using an improperly scoped PAT. To exploit this, a workflow must have already… |
CVE-2023-6803 | Medium | 5.8 | 2023-12-21 | A race condition in GitHub Enterprise Server allows an outside collaborator to be added while a repository is being transferred. This vulnerability affected al… |
CVE-2023-6802 | High | 7.2 | 2023-12-21 | An insertion of sensitive information into the log file in the audit log in GitHub Enterprise Server was identified that could allow an attacker to gain access… |
CVE-2023-6746 | High | 8.1 | 2023-12-21 | An insertion of sensitive information into log file vulnerability was identified in the log files for a GitHub Enterprise Server back-end service that could pe… |
CVE-2023-6690 | Low | 3.9 | 2023-12-21 | A race condition in GitHub Enterprise Server allowed an existing admin to maintain permissions on transferred repositories by making a GraphQL mutation to alte… |
CVE-2023-51380 | Low | 2.7 | 2023-12-21 | An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed issue comments to be read with an improperly scoped token. Thi… |
CVE-2023-51379 | Medium | 4.9 | 2023-12-21 | An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed issue comments to be updated with an improperly scoped token… |
CVE-2023-48722 | Critical | 9.8 | 2023-12-21 | Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'class_name' parameter of the add_results.ph… |
CVE-2023-48720 | Critical | 9.8 | 2023-12-21 | Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'password' parameter of the login.php resour… |
CVE-2023-48718 | Critical | 9.8 | 2023-12-21 | Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'class_name' parameter of the add_students.p… |
CVE-2023-48716 | Critical | 9.8 | 2023-12-21 | Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'class_id' parameter of the add_classes.php… |
CVE-2023-48689 | Critical | 9.8 | 2023-12-21 | Railway Reservation System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'byname' parameter of the train.php resource does… |
CVE-2023-48687 | Critical | 9.8 | 2023-12-21 | Railway Reservation System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'from' parameter of the reservation.php resource d… |
CVE-2023-48685 | Critical | 9.8 | 2023-12-21 | Railway Reservation System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'psd' parameter of the login.php resource does not… |
CVE-2023-46649 | Medium | 6.3 | 2023-12-21 | A race condition in GitHub Enterprise Server was identified that could allow an attacker administrator access. To exploit this, an organization needs to be con… |
CVE-2023-46648 | High | 8.3 | 2023-12-21 | An insufficient entropy vulnerability was identified in GitHub Enterprise Server (GHES) that allowed an attacker to brute force a user invitation to the GHES M… |
CVE-2023-46647 | High | 8.0 | 2023-12-21 | Improper privilege management in all versions of GitHub Enterprise Server allows users with authorized access to the management console with an editor role to… |
CVE-2023-46646 | Medium | 5.3 | 2023-12-21 | Improper access control in all versions of GitHub Enterprise Server allows unauthorized users to view private repository names via the "Get a check run" API en… |
CVE-2023-46645 | Medium | 6.8 | 2023-12-21 | A path traversal vulnerability was identified in GitHub Enterprise Server that allowed arbitrary file reading when building a GitHub Pages site. To exploit thi… |
CVE-2023-41097 | Medium | 4.6 | 2023-12-21 | An Observable Timing Discrepancy, Covert Timing Channel vulnerability in Silabs GSDK on ARM potentially allows Padding Oracle Crypto Attack on CBC PKCS7.This i… |
CVE-2023-7042 | Medium | 4.4 | 2023-12-21 | A null pointer dereference vulnerability was found in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() in drivers/net/wireless/ath/ath10k/wmi-tlv.c in the Linux kerne… |
CVE-2023-7041 | Medium | 5.4 | 2023-12-21 | A vulnerability, which was classified as critical, has been found in codelyfe Stupid Simple CMS up to 1.2.4. Affected by this issue is some unknown functionali… |
CVE-2023-7040 | Medium | 4.3 | 2023-12-21 | A vulnerability classified as problematic was found in codelyfe Stupid Simple CMS up to 1.2.4. Affected by this vulnerability is an unknown functionality of th… |
CVE-2023-6546 | High | 7.0 | 2023-12-21 | A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two threads execute the GSMIOC_SETCONF ioctl on the same… |
CVE-2023-50732 | High | 8.3 | 2023-12-21 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute a Velocity script without scr… |
CVE-2023-7039 | Medium | 6.3 | 2023-12-21 | A vulnerability classified as critical has been found in Byzoro S210 up to 20231210. Affected is an unknown function of the file /importexport.php. The manipul… |
CVE-2023-50834 | Medium | 6.5 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in August Infotech WooCommerce Menu Extension allows Stored… |
CVE-2023-49765 | Medium | 4.3 | 2023-12-21 | Authorization Bypass Through User-Controlled Key vulnerability in Blaz K. Rate my Post – WP Rating System.This issue affects Rate my Post – WP Rating System: f… |
CVE-2023-47191 | Medium | 6.5 | 2023-12-21 | Authorization Bypass Through User-Controlled Key vulnerability in KaineLabs Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin fo… |
CVE-2023-44482 | High | 8.8 | 2023-12-21 | Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'setsickleave' parameter of the admin/setleaves… |
CVE-2023-44481 | High | 8.8 | 2023-12-21 | Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'setearnleave' parameter of the admin/setleaves… |
CVE-2023-32799 | Medium | 6.5 | 2023-12-21 | Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Shipping Multiple Addresses.This issue affects Shipping Multiple Addresses: from… |
CVE-2023-32747 | Medium | 5.4 | 2023-12-21 | Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Bookings.This issue affects WooCommerce Bookings: from n/a through 1… |
CVE-2023-7038 | Medium | 4.3 | 2023-12-21 | A vulnerability was found in automad up to 1.10.9. It has been rated as problematic. This issue affects some unknown processing of the file /dashboard?controll… |
CVE-2023-50833 | Medium | 6.5 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExtendThemes Colibri Page Builder allows Stored XSS.This… |
CVE-2023-50832 | Medium | 5.9 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mondula GmbH Multi Step Form allows Stored XSS.This issue… |
CVE-2023-50831 | Medium | 6.5 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY – Multi Currency for WooCommerce allows… |
CVE-2023-50830 | Medium | 5.9 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Seosbg Seos Contact Form allows Stored XSS.This issue aff… |
CVE-2023-50829 | Medium | 5.9 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aerin Loan Repayment Calculator and Application Form allo… |
CVE-2023-7037 | Medium | 6.3 | 2023-12-21 | A vulnerability was found in automad up to 1.10.9. It has been declared as critical. This vulnerability affects the function import of the file FileController… |
CVE-2023-45121 | High | 8.8 | 2023-12-21 | Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'desc' parameter of the /update.php?q=addquiz resourc… |
CVE-2023-45120 | High | 8.8 | 2023-12-21 | Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'qid' parameter of the /update.php?q=quiz&step=2 reso… |
CVE-2023-40058 | Medium | 6.5 | 2023-12-21 | Sensitive data was added to our public-facing knowledgebase that, if exploited, could be used to access components of Access Rights Manager (ARM) if the threat… |
CVE-2023-7036 | Medium | 4.7 | 2023-12-21 | A vulnerability was found in automad up to 1.10.9. It has been classified as problematic. This affects the function upload of the file FileCollectionController… |
CVE-2023-51052 | Critical | 9.8 | 2023-12-21 | S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_formauth parameter at /admin/ajax.php. |
CVE-2023-51051 | Critical | 9.8 | 2023-12-21 | S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_textauth parameter at /admin/ajax.php. |
CVE-2023-51050 | Critical | 9.8 | 2023-12-21 | S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_productauth parameter at /admin/ajax.php. |
CVE-2023-51049 | Critical | 9.8 | 2023-12-21 | S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_bbsauth parameter at /admin/ajax.php. |
CVE-2023-51048 | Critical | 9.8 | 2023-12-21 | S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_newsauth parameter at /admin/ajax.php. |
CVE-2023-4256 | Medium | 5.5 | 2023-12-21 | Within tcpreplay's tcprewrite, a double free vulnerability has been identified in the tcpedit_dlt_cleanup() function within plugins/dlt_plugins.c. This vulnera… |
CVE-2023-4255 | Medium | 5.5 | 2023-12-21 | An out-of-bounds write issue has been discovered in the backspace handling of the checkType() function in etc.c within the W3M application. This vulnerability… |
CVE-2023-45119 | High | 8.8 | 2023-12-21 | Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'n' parameter of the /update.php?q=quiz resource does… |
CVE-2023-45118 | High | 8.8 | 2023-12-21 | Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'fdid' parameter of the /update.php resource does not… |
CVE-2023-45117 | High | 8.8 | 2023-12-21 | Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'eid' parameter of the /update.php?q=rmquiz resource … |
CVE-2023-45116 | High | 8.8 | 2023-12-21 | Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'demail' parameter of the /update.php resource does n… |
CVE-2023-45115 | High | 8.8 | 2023-12-21 | Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'ch' parameter of the /update.php?q=addqns resource d… |
CVE-2023-7047 | Medium | 4.4 | 2023-12-21 | Inadequate validation of permissions when employing remote tools and macros via the context menu within Devolutions Remote Desktop Manager versions 2023.3.31… |
CVE-2023-7035 | Low | 2.4 | 2023-12-21 | A vulnerability was found in automad up to 1.10.9 and classified as problematic. Affected by this issue is some unknown functionality of the file packages\stan… |
CVE-2023-51442 | High | 8.6 | 2023-12-21 | Navidrome is an open source web-based music collection server and streamer. A security vulnerability has been identified in navidrome's subsonic endpoint, allo… |
CVE-2023-50828 | Medium | 5.9 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Vongries Ultimate Dashboard – Custom WordPress Dash… |
CVE-2023-50827 | Medium | 5.9 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Accredible Accredible Certificates & Open Badges allows S… |
CVE-2023-50826 | Medium | 5.9 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Freshlight Lab Menu Image, Icons made easy allows Stored… |
CVE-2023-50825 | Medium | 6.5 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Terrier Tenacity iframe Shortcode allows Stored XSS.This… |
CVE-2023-50824 | Medium | 6.5 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brian Batt Insert or Embed Articulate Content into WordPr… |
CVE-2023-50823 | Medium | 6.5 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wipeout Media CSS & JavaScript Toolbox allows Stored XSS… |
CVE-2023-50822 | Medium | 6.5 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Currency.Wiki Currency Converter Widget – Exchange Rates… |
CVE-2023-50724 | Medium | 6.3 | 2023-12-21 | Resque (pronounced like "rescue") is a Redis-backed library for creating background jobs, placing those jobs on multiple queues, and processing them later. res… |
CVE-2023-50377 | Medium | 5.9 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AB-WP Simple Counter allows Stored XSS.This issue affects… |
CVE-2023-48116 | Medium | 5.4 | 2023-12-21 | SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS via a crafted description of a Calendar appointment. |
CVE-2023-48115 | Medium | 5.4 | 2023-12-21 | SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored DOM XSS because an XSS protection mechanism is skipped when messageHTML and messagePlainTe… |
CVE-2023-48114 | Medium | 5.4 | 2023-12-21 | SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS by using image/svg+xml and an uploaded SVG document. This occurs because the applicati… |
CVE-2023-47527 | Medium | 5.9 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sajjad Hossain Sagor WP Edit Username allows Stored XSS.T… |
CVE-2023-47525 | Medium | 5.9 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A WP Life Event Monster – Event Management, Tickets Booki… |
CVE-2023-22674 | Medium | 5.4 | 2023-12-21 | Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in Hal Gatewood Dashicons + Custom Post Types.This issue affects Dashicons + Custom Post… |
CVE-2023-6145 | Critical | 9.8 | 2023-12-21 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in İstanbul Soft Informatics and Consultancy Limited Company… |
CVE-2023-6122 | Medium | 6.1 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in İstanbul Soft Informatics and Consultancy Limited Company… |
CVE-2023-49162 | Medium | 5.3 | 2023-12-21 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in BigCommerce BigCommerce For WordPress.This issue affects BigCommerce For WordPress… |
CVE-2023-48288 | High | 7.5 | 2023-12-21 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HM Plugin WordPress Job Board and Recruitment Plugin – JobWP.This issue affects Wor… |
CVE-2023-2487 | Medium | 5.9 | 2023-12-21 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Smackcoders Export All Posts, Products, Orders, Refunds & Users.This issue affects… |
CVE-2023-28421 | Medium | 5.3 | 2023-12-21 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Winwar Media WordPress Email Marketing Plugin – WP Email Capture.This issue affects… |
CVE-2023-49826 | High | 8.1 | 2023-12-21 | Deserialization of Untrusted Data vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme.This issue affects Soledad… |
CVE-2023-49778 | Critical | 10.0 | 2023-12-21 | Deserialization of Untrusted Data vulnerability in Hakan Demiray Sayfa Sayac.This issue affects Sayfa Sayac: from n/a through 2.6. |
CVE-2023-49762 | Medium | 5.3 | 2023-12-21 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in AppMySite AppMySite – Create an app with the Best Mobile App Builder.This issue aff… |
CVE-2023-32242 | Critical | 9.8 | 2023-12-21 | Deserialization of Untrusted Data vulnerability in xtemos WoodMart - Multipurpose WooCommerce Theme.This issue affects WoodMart - Multipurpose WooCommerce Them… |
CVE-2023-5594 | High | 7.5 | 2023-12-21 | Improper validation of the server’s certificate chain in secure traffic scanning feature considered intermediate certificate signed using the MD5 or SHA1 algor… |
CVE-2023-51656 | Critical | 9.8 | 2023-12-21 | Deserialization of Untrusted Data vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 0.13.0 through 0.13.4. Users are recommended to upgrade… |
CVE-2023-50481 | High | 7.5 | 2023-12-21 | An issue was discovered in blinksocks version 3.3.8, allows remote attackers to obtain sensitive information via weak encryption algorithms in the component /p… |
CVE-2023-50477 | Critical | 9.8 | 2023-12-21 | An issue was discovered in nos client version 0.6.6, allows remote attackers to escalate privileges via getRPCEndpoint.js. |
CVE-2023-50475 | Critical | 9.1 | 2023-12-21 | An issue was discovered in bcoin-org bcoin version 2.2.0, allows remote attackers to obtain sensitive information via weak hashing algorithms in the component… |
CVE-2023-50473 | Medium | 5.4 | 2023-12-21 | Cross-Site Scripting (XSS) vulnerability in bill-ahmed qbit-matUI version 1.16.4, allows remote attackers to obtain sensitive information via fixed session ide… |
CVE-2023-5989 | Medium | 6.1 | 2023-12-21 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uyumsoft Information System and Technologies' LioXERP… |
CVE-2023-5988 | Medium | 6.1 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uyumsoft Information System and Technologies LioXERP allo… |
CVE-2023-51655 | Medium | 6.3 | 2023-12-21 | In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin repository specified in the project con… |
CVE-2023-50783 | Medium | 6.5 | 2023-12-21 | Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a varia… |
CVE-2023-49920 | Medium | 6.5 | 2023-12-21 | Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. As a result… |
CVE-2023-48291 | Medium | 4.3 | 2023-12-21 | Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a re… |