2023 CVEs (page 79)
Page 79 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-51024 | Critical | 9.8 | 2023-12-22 | TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘tz’ parameter of the setNtpCfg interface of the cste… |
CVE-2023-51023 | Critical | 9.8 | 2023-12-22 | TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to arbitrary command execution in the ‘host_time’ parameter of the NTPSyncWithHost interface of the cste… |
CVE-2023-43088 | High | 7.2 | 2023-12-22 | Dell Client BIOS contains a pre-boot direct memory access (DMA) vulnerability. An authenticated attacker with physical access to the system may potentially ex… |
CVE-2023-39251 | Medium | 6.7 | 2023-12-22 | Dell BIOS contains an Improper Input Validation vulnerability. A local malicious user with high privileges could potentially exploit this vulnerability in ord… |
CVE-2023-51662 | Medium | 6.0 | 2023-12-22 | The Snowflake .NET driver provides an interface to the Microsoft .NET open source software framework for developing applications. Snowflake recently received a… |
CVE-2023-51649 | Low | 3.5 | 2023-12-22 | Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL da… |
CVE-2023-51448 | High | 8.8 | 2023-12-22 | Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability within the SNMP Notifica… |
CVE-2023-50259 | Medium | 5.3 | 2023-12-22 | Medusa is an automatic video library manager for TV shows. Versions prior to 1.0.19 are vulnerable to unauthenticated blind server-side request forgery (SSRF)… |
CVE-2023-50258 | Medium | 5.3 | 2023-12-22 | Medusa is an automatic video library manager for TV shows. Versions prior to 1.0.19 are vulnerable to unauthenticated blind server-side request forgery (SSRF)… |
CVE-2023-50254 | Critical | 9.3 | 2023-12-22 | Deepin Linux's default document reader `deepin-reader` software suffers from a serious vulnerability in versions prior to 6.0.7 due to a design flaw that leads… |
CVE-2023-50250 | Medium | 5.4 | 2023-12-22 | Cacti is an open source operational monitoring and fault management framework. A reflection cross-site scripting vulnerability was discovered in version 1.2.25… |
CVE-2023-49792 | Medium | 5.3 | 2023-12-22 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcl… |
CVE-2023-49791 | Medium | 5.4 | 2023-12-22 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcl… |
CVE-2023-49790 | Medium | 4.3 | 2023-12-22 | The Nextcloud iOS Files app allows users of iOS to interact with Nextcloud, a self-hosted productivity platform. Prior to version 4.9.2, the application can be… |
CVE-2023-49088 | Medium | 6.1 | 2023-12-22 | Cacti is an open source operational monitoring and fault management framework. The fix applied for CVE-2023-39515 in version 1.2.25 is incomplete as it enables… |
CVE-2023-49085 | High | 8.8 | 2023-12-22 | Cacti provides an operational monitoring and fault management framework. In versions 1.2.25 and prior, it is possible to execute arbitrary SQL code through the… |
CVE-2023-48704 | High | 7.0 | 2023-12-22 | ClickHouse is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow iss… |
CVE-2023-48670 | High | 7.3 | 2023-12-22 | Dell SupportAssist for Home PCs version 3.14.1 and prior versions contain a privilege escalation vulnerability in the installer. A local low privileged authen… |
CVE-2023-45957 | Medium | 5.4 | 2023-12-22 | A stored cross-site scripting (XSS) vulnerability in the component admin/AdminRequestSqlController.php of thirty bees before 1.5.0 allows attackers to execute… |
CVE-2023-45165 | Medium | 6.2 | 2023-12-22 | IBM AIX 7.2 and 7.3 could allow a non-privileged local user to exploit a vulnerability in the AIX SMB client to cause a denial of service. IBM X-Force ID: 26… |
CVE-2023-42465 | High | 7.0 | 2023-12-22 | Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because application logic sometimes is based on not equal… |
CVE-2023-42017 | High | 8.0 | 2023-12-22 | IBM Planning Analytics Local 2.0 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions. By sending a s… |
CVE-2023-51661 | High | 8.4 | 2023-12-22 | Wasmer is a WebAssembly runtime that enables containers to run anywhere: from Desktop to the Cloud, Edge and even the browser. Wasm programs can access the fil… |
CVE-2023-7076 | Low | 3.5 | 2023-12-22 | A vulnerability was found in slawkens MyAAC up to 0.8.13. It has been declared as problematic. This vulnerability affects unknown code of the file system/pages… |
CVE-2023-7075 | Low | 3.5 | 2023-12-22 | A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0 and classified as problematic. Affected by this issue is some unk… |
CVE-2023-49391 | High | 7.5 | 2023-12-22 | An issue was discovered in free5GC version 3.3.0, allows remote attackers to execute arbitrary code and cause a denial of service (DoS) on AMF component via cr… |
CVE-2023-49356 | High | 7.5 | 2023-12-22 | A stack buffer overflow vulnerability in MP3Gain v1.6.2 allows an attacker to cause a denial of service via the WriteMP3GainAPETag function at apetag.c:592. |
CVE-2023-43741 | High | 7.0 | 2023-12-22 | A time-of-check-time-of-use race condition vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to… |
CVE-2023-43116 | High | 7.8 | 2023-12-22 | A symbolic link following vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to change ownership… |
CVE-2023-7059 | Low | 3.5 | 2023-12-22 | A vulnerability was found in SourceCodester School Visitor Log e-Book 1.0. It has been rated as problematic. Affected by this issue is some unknown functionali… |
CVE-2023-7058 | Medium | 6.3 | 2023-12-22 | A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been declared as critical. Affected by this vulnerability is an unknow… |
CVE-2023-7057 | Low | 3.5 | 2023-12-22 | A vulnerability, which was classified as problematic, has been found in code-projects Faculty Management System 1.0. Affected by this issue is some unknown fun… |
CVE-2023-24609 | High | 7.5 | 2023-12-22 | Matrix SSL 4.x through 4.6.0 and Rambus TLS Toolkit have a length-subtraction integer overflow for Client Hello Pre-Shared Key extension parsing in the TLS 1.3… |
CVE-2023-7056 | Low | 2.4 | 2023-12-22 | A vulnerability classified as problematic was found in code-projects Faculty Management System 1.0. Affected by this vulnerability is an unknown functionality… |
CVE-2023-7055 | Medium | 4.3 | 2023-12-22 | A vulnerability classified as problematic has been found in PHPGurukul Online Notes Sharing System 1.0. Affected is an unknown function of the file /user/profi… |
CVE-2023-51713 | High | 7.5 | 2023-12-22 | make_ftp_cmd in main.c in ProFTPD before 1.3.8a has a one-byte out-of-bounds read, and daemon crash, because of mishandling of quote/backslash semantics. |
CVE-2023-7054 | Medium | 5.5 | 2023-12-22 | A vulnerability was found in PHPGurukul Online Notes Sharing System 1.0. It has been rated as problematic. This issue affects some unknown processing of the fi… |
CVE-2023-7053 | Low | 3.1 | 2023-12-22 | A vulnerability was found in PHPGurukul Online Notes Sharing System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the fi… |
CVE-2023-51708 | High | 8.6 | 2023-12-22 | Bentley eB System Management Console applications within Assetwise Integrity Information Server allow an unauthenticated user to view configuration options via… |
CVE-2023-51707 | Critical | 9.8 | 2023-12-22 | MotionPro in Array ArrayOS AG before 9.4.0.505 on AG and vxAG allows remote command execution via crafted packets. AG and vxAG 9.3.0.259.x are unaffected. |
CVE-2023-51704 | Medium | 6.1 | 2023-12-22 | An issue was discovered in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. In includes/logging/RightsLogFormatter.php… |
CVE-2023-7052 | Medium | 4.3 | 2023-12-22 | A vulnerability was found in PHPGurukul Online Notes Sharing System 1.0. It has been classified as problematic. This affects an unknown part of the file /user/… |
CVE-2023-49689 | Critical | 9.8 | 2023-12-22 | Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'JobId' parameter of the Employer/DeleteJob.php resource does not… |
CVE-2023-49688 | Critical | 9.8 | 2023-12-22 | Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'txtUser' parameter of the login.php resource does not validate th… |
CVE-2023-49086 | Medium | 5.4 | 2023-12-22 | Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). A vulnerability in versions prior to 1… |
CVE-2023-48308 | Low | 3.5 | 2023-12-22 | Nextcloud/Cloud is a calendar app for Nextcloud. An attacker can gain access to stacktrace and internal paths of the server when generating an exception while… |
CVE-2023-7024 | High | 8.8 | 2023-12-21 | Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pag… |
CVE-2023-49681 | Critical | 9.8 | 2023-12-21 | Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'cmbQual' parameter of the Employer/InsertWalkin.php resource does… |
CVE-2023-49677 | Critical | 9.8 | 2023-12-21 | Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'cmbQual' parameter of the Employer/InsertJob.php resource does no… |
CVE-2023-49084 | High | 8.0 | 2023-12-21 | Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). While using the detected SQL Injection… |
CVE-2023-48298 | Medium | 5.9 | 2023-12-21 | ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. This vulnerability is an… |
CVE-2023-37520 | High | 7.7 | 2023-12-21 | Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified in BigFix Server version 9.5.12.68, allowing for potential data exfiltration. This X… |
CVE-2023-7051 | Medium | 4.3 | 2023-12-21 | A vulnerability was found in PHPGurukul Online Notes Sharing System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of… |
CVE-2023-7050 | Low | 3.5 | 2023-12-21 | A vulnerability has been found in PHPGurukul Online Notes Sharing System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functi… |
CVE-2023-37519 | High | 7.7 | 2023-12-21 | Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. This XSS vulnerability is in the Download Status Report, which is served by the BigFix Server… |
CVE-2023-27319 | Medium | 5.3 | 2023-12-21 | ONTAP Mediator versions prior to 1.7 are susceptible to a vulnerability that can allow an unauthenticated attacker to enumerate URLs via REST API. |
CVE-2023-6847 | High | 7.5 | 2023-12-21 | An improper authentication vulnerability was identified in GitHub Enterprise Server that allowed a bypass of Private Mode by using a specially crafted API requ… |
CVE-2023-6804 | Medium | 6.5 | 2023-12-21 | Improper privilege management allowed arbitrary workflows to be committed and run using an improperly scoped PAT. To exploit this, a workflow must have already… |
CVE-2023-6803 | Medium | 5.8 | 2023-12-21 | A race condition in GitHub Enterprise Server allows an outside collaborator to be added while a repository is being transferred. This vulnerability affected al… |
CVE-2023-6802 | High | 7.2 | 2023-12-21 | An insertion of sensitive information into the log file in the audit log in GitHub Enterprise Server was identified that could allow an attacker to gain access… |
CVE-2023-6746 | High | 8.1 | 2023-12-21 | An insertion of sensitive information into log file vulnerability was identified in the log files for a GitHub Enterprise Server back-end service that could pe… |
CVE-2023-6690 | Low | 3.9 | 2023-12-21 | A race condition in GitHub Enterprise Server allowed an existing admin to maintain permissions on transferred repositories by making a GraphQL mutation to alte… |
CVE-2023-51380 | Low | 2.7 | 2023-12-21 | An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed issue comments to be read with an improperly scoped token. Thi… |
CVE-2023-51379 | Medium | 4.9 | 2023-12-21 | An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed issue comments to be updated with an improperly scoped token… |
CVE-2023-48722 | Critical | 9.8 | 2023-12-21 | Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'class_name' parameter of the add_results.ph… |
CVE-2023-48720 | Critical | 9.8 | 2023-12-21 | Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'password' parameter of the login.php resour… |
CVE-2023-48718 | Critical | 9.8 | 2023-12-21 | Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'class_name' parameter of the add_students.p… |
CVE-2023-48716 | Critical | 9.8 | 2023-12-21 | Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'class_id' parameter of the add_classes.php… |
CVE-2023-48689 | Critical | 9.8 | 2023-12-21 | Railway Reservation System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'byname' parameter of the train.php resource does… |
CVE-2023-48687 | Critical | 9.8 | 2023-12-21 | Railway Reservation System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'from' parameter of the reservation.php resource d… |
CVE-2023-48685 | Critical | 9.8 | 2023-12-21 | Railway Reservation System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'psd' parameter of the login.php resource does not… |
CVE-2023-46649 | Medium | 6.3 | 2023-12-21 | A race condition in GitHub Enterprise Server was identified that could allow an attacker administrator access. To exploit this, an organization needs to be con… |
CVE-2023-46648 | High | 8.3 | 2023-12-21 | An insufficient entropy vulnerability was identified in GitHub Enterprise Server (GHES) that allowed an attacker to brute force a user invitation to the GHES M… |
CVE-2023-46647 | High | 8.0 | 2023-12-21 | Improper privilege management in all versions of GitHub Enterprise Server allows users with authorized access to the management console with an editor role to… |
CVE-2023-46646 | Medium | 5.3 | 2023-12-21 | Improper access control in all versions of GitHub Enterprise Server allows unauthorized users to view private repository names via the "Get a check run" API en… |
CVE-2023-46645 | Medium | 6.8 | 2023-12-21 | A path traversal vulnerability was identified in GitHub Enterprise Server that allowed arbitrary file reading when building a GitHub Pages site. To exploit thi… |
CVE-2023-41097 | Medium | 4.6 | 2023-12-21 | An Observable Timing Discrepancy, Covert Timing Channel vulnerability in Silabs GSDK on ARM potentially allows Padding Oracle Crypto Attack on CBC PKCS7.This i… |
CVE-2023-7042 | Medium | 4.4 | 2023-12-21 | A null pointer dereference vulnerability was found in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() in drivers/net/wireless/ath/ath10k/wmi-tlv.c in the Linux kerne… |
CVE-2023-7041 | Medium | 5.4 | 2023-12-21 | A vulnerability, which was classified as critical, has been found in codelyfe Stupid Simple CMS up to 1.2.4. Affected by this issue is some unknown functionali… |
CVE-2023-7040 | Medium | 4.3 | 2023-12-21 | A vulnerability classified as problematic was found in codelyfe Stupid Simple CMS up to 1.2.4. Affected by this vulnerability is an unknown functionality of th… |
CVE-2023-6546 | High | 7.0 | 2023-12-21 | A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two threads execute the GSMIOC_SETCONF ioctl on the same… |
CVE-2023-50732 | High | 8.3 | 2023-12-21 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute a Velocity script without scr… |
CVE-2023-7039 | Medium | 6.3 | 2023-12-21 | A vulnerability classified as critical has been found in Byzoro S210 up to 20231210. Affected is an unknown function of the file /importexport.php. The manipul… |
CVE-2023-50834 | Medium | 6.5 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in August Infotech WooCommerce Menu Extension allows Stored… |
CVE-2023-49765 | Medium | 4.3 | 2023-12-21 | Authorization Bypass Through User-Controlled Key vulnerability in Blaz K. Rate my Post – WP Rating System.This issue affects Rate my Post – WP Rating System: f… |
CVE-2023-47191 | Medium | 6.5 | 2023-12-21 | Authorization Bypass Through User-Controlled Key vulnerability in KaineLabs Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin fo… |
CVE-2023-44482 | High | 8.8 | 2023-12-21 | Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'setsickleave' parameter of the admin/setleaves… |
CVE-2023-44481 | High | 8.8 | 2023-12-21 | Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'setearnleave' parameter of the admin/setleaves… |
CVE-2023-32799 | Medium | 6.5 | 2023-12-21 | Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Shipping Multiple Addresses.This issue affects Shipping Multiple Addresses: from… |
CVE-2023-32747 | Medium | 5.4 | 2023-12-21 | Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Bookings.This issue affects WooCommerce Bookings: from n/a through 1… |
CVE-2023-7038 | Medium | 4.3 | 2023-12-21 | A vulnerability was found in automad up to 1.10.9. It has been rated as problematic. This issue affects some unknown processing of the file /dashboard?controll… |
CVE-2023-50833 | Medium | 6.5 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExtendThemes Colibri Page Builder allows Stored XSS.This… |
CVE-2023-50832 | Medium | 5.9 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mondula GmbH Multi Step Form allows Stored XSS.This issue… |
CVE-2023-50831 | Medium | 6.5 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY – Multi Currency for WooCommerce allows… |
CVE-2023-50830 | Medium | 5.9 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Seosbg Seos Contact Form allows Stored XSS.This issue aff… |
CVE-2023-50829 | Medium | 5.9 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aerin Loan Repayment Calculator and Application Form allo… |
CVE-2023-7037 | Medium | 6.3 | 2023-12-21 | A vulnerability was found in automad up to 1.10.9. It has been declared as critical. This vulnerability affects the function import of the file FileController… |
CVE-2023-45121 | High | 8.8 | 2023-12-21 | Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'desc' parameter of the /update.php?q=addquiz resourc… |
CVE-2023-45120 | High | 8.8 | 2023-12-21 | Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'qid' parameter of the /update.php?q=quiz&step=2 reso… |
CVE-2023-40058 | Medium | 6.5 | 2023-12-21 | Sensitive data was added to our public-facing knowledgebase that, if exploited, could be used to access components of Access Rights Manager (ARM) if the threat… |