2023 CVEs (page 80)
Page 80 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-7036 | Medium | 4.7 | 2023-12-21 | A vulnerability was found in automad up to 1.10.9. It has been classified as problematic. This affects the function upload of the file FileCollectionController… |
CVE-2023-51052 | Critical | 9.8 | 2023-12-21 | S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_formauth parameter at /admin/ajax.php. |
CVE-2023-51051 | Critical | 9.8 | 2023-12-21 | S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_textauth parameter at /admin/ajax.php. |
CVE-2023-51050 | Critical | 9.8 | 2023-12-21 | S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_productauth parameter at /admin/ajax.php. |
CVE-2023-51049 | Critical | 9.8 | 2023-12-21 | S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_bbsauth parameter at /admin/ajax.php. |
CVE-2023-51048 | Critical | 9.8 | 2023-12-21 | S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_newsauth parameter at /admin/ajax.php. |
CVE-2023-4256 | Medium | 5.5 | 2023-12-21 | Within tcpreplay's tcprewrite, a double free vulnerability has been identified in the tcpedit_dlt_cleanup() function within plugins/dlt_plugins.c. This vulnera… |
CVE-2023-4255 | Medium | 5.5 | 2023-12-21 | An out-of-bounds write issue has been discovered in the backspace handling of the checkType() function in etc.c within the W3M application. This vulnerability… |
CVE-2023-45119 | High | 8.8 | 2023-12-21 | Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'n' parameter of the /update.php?q=quiz resource does… |
CVE-2023-45118 | High | 8.8 | 2023-12-21 | Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'fdid' parameter of the /update.php resource does not… |
CVE-2023-45117 | High | 8.8 | 2023-12-21 | Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'eid' parameter of the /update.php?q=rmquiz resource … |
CVE-2023-45116 | High | 8.8 | 2023-12-21 | Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'demail' parameter of the /update.php resource does n… |
CVE-2023-45115 | High | 8.8 | 2023-12-21 | Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'ch' parameter of the /update.php?q=addqns resource d… |
CVE-2023-7047 | Medium | 4.4 | 2023-12-21 | Inadequate validation of permissions when employing remote tools and macros via the context menu within Devolutions Remote Desktop Manager versions 2023.3.31… |
CVE-2023-7035 | Low | 2.4 | 2023-12-21 | A vulnerability was found in automad up to 1.10.9 and classified as problematic. Affected by this issue is some unknown functionality of the file packages\stan… |
CVE-2023-51442 | High | 8.6 | 2023-12-21 | Navidrome is an open source web-based music collection server and streamer. A security vulnerability has been identified in navidrome's subsonic endpoint, allo… |
CVE-2023-50828 | Medium | 5.9 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Vongries Ultimate Dashboard – Custom WordPress Dash… |
CVE-2023-50827 | Medium | 5.9 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Accredible Accredible Certificates & Open Badges allows S… |
CVE-2023-50826 | Medium | 5.9 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Freshlight Lab Menu Image, Icons made easy allows Stored… |
CVE-2023-50825 | Medium | 6.5 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Terrier Tenacity iframe Shortcode allows Stored XSS.This… |
CVE-2023-50824 | Medium | 6.5 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brian Batt Insert or Embed Articulate Content into WordPr… |
CVE-2023-50823 | Medium | 6.5 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wipeout Media CSS & JavaScript Toolbox allows Stored XSS… |
CVE-2023-50822 | Medium | 6.5 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Currency.Wiki Currency Converter Widget – Exchange Rates… |
CVE-2023-50724 | Medium | 6.3 | 2023-12-21 | Resque (pronounced like "rescue") is a Redis-backed library for creating background jobs, placing those jobs on multiple queues, and processing them later. res… |
CVE-2023-50377 | Medium | 5.9 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AB-WP Simple Counter allows Stored XSS.This issue affects… |
CVE-2023-48116 | Medium | 5.4 | 2023-12-21 | SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS via a crafted description of a Calendar appointment. |
CVE-2023-48115 | Medium | 5.4 | 2023-12-21 | SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored DOM XSS because an XSS protection mechanism is skipped when messageHTML and messagePlainTe… |
CVE-2023-48114 | Medium | 5.4 | 2023-12-21 | SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS by using image/svg+xml and an uploaded SVG document. This occurs because the applicati… |
CVE-2023-47527 | Medium | 5.9 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sajjad Hossain Sagor WP Edit Username allows Stored XSS.T… |
CVE-2023-47525 | Medium | 5.9 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A WP Life Event Monster – Event Management, Tickets Booki… |
CVE-2023-22674 | Medium | 5.4 | 2023-12-21 | Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in Hal Gatewood Dashicons + Custom Post Types.This issue affects Dashicons + Custom Post… |
CVE-2023-6145 | Critical | 9.8 | 2023-12-21 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in İstanbul Soft Informatics and Consultancy Limited Company… |
CVE-2023-6122 | Medium | 6.1 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in İstanbul Soft Informatics and Consultancy Limited Company… |
CVE-2023-49162 | Medium | 5.3 | 2023-12-21 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in BigCommerce BigCommerce For WordPress.This issue affects BigCommerce For WordPress… |
CVE-2023-48288 | High | 7.5 | 2023-12-21 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HM Plugin WordPress Job Board and Recruitment Plugin – JobWP.This issue affects Wor… |
CVE-2023-2487 | Medium | 5.9 | 2023-12-21 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Smackcoders Export All Posts, Products, Orders, Refunds & Users.This issue affects… |
CVE-2023-28421 | Medium | 5.3 | 2023-12-21 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Winwar Media WordPress Email Marketing Plugin – WP Email Capture.This issue affects… |
CVE-2023-49826 | High | 8.1 | 2023-12-21 | Deserialization of Untrusted Data vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme.This issue affects Soledad… |
CVE-2023-49778 | Critical | 10.0 | 2023-12-21 | Deserialization of Untrusted Data vulnerability in Hakan Demiray Sayfa Sayac.This issue affects Sayfa Sayac: from n/a through 2.6. |
CVE-2023-49762 | Medium | 5.3 | 2023-12-21 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in AppMySite AppMySite – Create an app with the Best Mobile App Builder.This issue aff… |
CVE-2023-32242 | Critical | 9.8 | 2023-12-21 | Deserialization of Untrusted Data vulnerability in xtemos WoodMart - Multipurpose WooCommerce Theme.This issue affects WoodMart - Multipurpose WooCommerce Them… |
CVE-2023-5594 | High | 7.5 | 2023-12-21 | Improper validation of the server’s certificate chain in secure traffic scanning feature considered intermediate certificate signed using the MD5 or SHA1 algor… |
CVE-2023-51656 | Critical | 9.8 | 2023-12-21 | Deserialization of Untrusted Data vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 0.13.0 through 0.13.4. Users are recommended to upgrade… |
CVE-2023-50481 | High | 7.5 | 2023-12-21 | An issue was discovered in blinksocks version 3.3.8, allows remote attackers to obtain sensitive information via weak encryption algorithms in the component /p… |
CVE-2023-50477 | Critical | 9.8 | 2023-12-21 | An issue was discovered in nos client version 0.6.6, allows remote attackers to escalate privileges via getRPCEndpoint.js. |
CVE-2023-50475 | Critical | 9.1 | 2023-12-21 | An issue was discovered in bcoin-org bcoin version 2.2.0, allows remote attackers to obtain sensitive information via weak hashing algorithms in the component… |
CVE-2023-50473 | Medium | 5.4 | 2023-12-21 | Cross-Site Scripting (XSS) vulnerability in bill-ahmed qbit-matUI version 1.16.4, allows remote attackers to obtain sensitive information via fixed session ide… |
CVE-2023-5989 | Medium | 6.1 | 2023-12-21 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uyumsoft Information System and Technologies' LioXERP… |
CVE-2023-5988 | Medium | 6.1 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uyumsoft Information System and Technologies LioXERP allo… |
CVE-2023-51655 | Medium | 6.3 | 2023-12-21 | In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin repository specified in the project con… |
CVE-2023-50783 | Medium | 6.5 | 2023-12-21 | Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a varia… |
CVE-2023-49920 | Medium | 6.5 | 2023-12-21 | Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. As a result… |
CVE-2023-48291 | Medium | 4.3 | 2023-12-21 | Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a re… |
CVE-2023-47265 | Medium | 5.4 | 2023-12-21 | Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author to add an unbounded and not-sanitized javascript in the pa… |
CVE-2023-2585 | Low | 3.5 | 2023-12-21 | Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof… |
CVE-2023-7026 | Medium | 4.3 | 2023-12-21 | A vulnerability was found in Lightxun IPTV Gateway up to 20231208. It has been rated as problematic. This issue affects some unknown processing of the file /ZH… |
CVE-2023-7025 | High | 7.8 | 2023-12-21 | A vulnerability was found in KylinSoft hedron-domain-hook up to 3.8.0.12-0k0.5. It has been declared as critical. This vulnerability affects the function init_… |
CVE-2023-7023 | Medium | 6.3 | 2023-12-21 | A vulnerability was found in Tongda OA 2017 up to 11.9. It has been rated as critical. Affected by this issue is some unknown functionality of the file general… |
CVE-2023-7022 | Medium | 6.3 | 2023-12-21 | A vulnerability was found in Tongda OA 2017 up to 11.9. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the fil… |
CVE-2023-7021 | Medium | 6.3 | 2023-12-21 | A vulnerability was found in Tongda OA 2017 up to 11.9. It has been classified as critical. Affected is an unknown function of the file general/vehicle/checkup… |
CVE-2023-7020 | Medium | 6.3 | 2023-12-21 | A vulnerability was found in Tongda OA 2017 up to 11.9 and classified as critical. This issue affects some unknown processing of the file general/wiki/cp/ct/vi… |
CVE-2023-45700 | Medium | 4.3 | 2023-12-21 | HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive inf… |
CVE-2023-29487 | Critical | 9.1 | 2023-12-21 | An issue was discovered in Heimdal Thor agent versions 3.4.2 and before on Windows and 2.6.9 and before on macOS, allows attackers to cause a denial of service… |
CVE-2023-29486 | Critical | 9.8 | 2023-12-21 | An issue was discovered in Heimdal Thor agent versions 3.4.2 and before 3.7.0 on Windows, allows attackers to bypass USB access restrictions, execute arbitrary… |
CVE-2023-29485 | Critical | 9.8 | 2023-12-21 | An issue was discovered in Heimdal Thor agent versions 3.4.2 and before on Windows and 2.6.9 and before on macOS, allows attackers to bypass network filtering… |
CVE-2023-28025 | Medium | 6.6 | 2023-12-21 | Due to this vulnerability, the Master operator could potentially incorporate an SVG tag into HTML, leading to an alert pop-up displaying a cookie. To mitigate… |
CVE-2023-51390 | Medium | 6.5 | 2023-12-21 | journalpump is a daemon that takes log messages from journald and pumps them to a given output. A logging vulnerability was found in journalpump which logs out… |
CVE-2023-49032 | Critical | 9.8 | 2023-12-21 | An issue in LTB Self Service Password before v.1.5.4 allows a remote attacker to execute arbitrary code and obtain sensitive information via hijack of the SMS… |
CVE-2023-47093 | Medium | 6.5 | 2023-12-21 | An issue was discovered in Stormshield Network Security (SNS) 4.0.0 through 4.3.21, 4.4.0 through 4.6.8, and 4.7.0. Sending a crafted ICMP packet may lead to a… |
CVE-2023-46131 | Medium | 6.5 | 2023-12-21 | Grails is a framework used to build web applications with the Groovy programming language. A specially crafted web request can lead to a JVM crash or denial of… |
CVE-2023-45703 | Medium | 5.3 | 2023-12-21 | HCL Launch may mishandle input validation of an uploaded archive file leading to a denial of service due to resource exhaustion. |
CVE-2023-41166 | Medium | 5.3 | 2023-12-21 | An issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.39, 3.11.0 through 3.11.27, 4.3.0 through 4.3.22, 4.6.0 through 4.6.9, and 4.7… |
CVE-2023-50993 | Critical | 9.8 | 2023-12-20 | Ruijie WS6008 v1.x v2.x AC_RGOS11.9(6)W3B2_G2C6-01_10221911 and WS6108 v1.x AC_RGOS11.9(6)W3B2_G2C6-01_10221911 was discovered to contain a command injection v… |
CVE-2023-50992 | Critical | 9.8 | 2023-12-20 | Tenda i29 v1.0 V1.0.0.5 was discovered to contain a stack overflow via the ip parameter in the setPing function. |
CVE-2023-50990 | Critical | 9.8 | 2023-12-20 | Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the rebootTime parameter in the sysScheduleRebootSet function. |
CVE-2023-50989 | Critical | 9.8 | 2023-12-20 | Tenda i29 v1.0 V1.0.0.5 was discovered to contain a command injection vulnerability via the pingSet function. |
CVE-2023-50988 | Critical | 9.8 | 2023-12-20 | Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the bandwidth parameter in the wifiRadioSetIndoor function. |
CVE-2023-50987 | Critical | 9.8 | 2023-12-20 | Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the time parameter in the sysTimeInfoSet function. |
CVE-2023-50986 | Critical | 9.8 | 2023-12-20 | Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the time parameter in the sysLogin function. |
CVE-2023-50985 | Critical | 9.8 | 2023-12-20 | Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the lanGw parameter in the lanCfgSet function. |
CVE-2023-50984 | Critical | 9.8 | 2023-12-20 | Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the ip parameter in the spdtstConfigAndStart function. |
CVE-2023-50983 | Critical | 9.8 | 2023-12-20 | Tenda i29 v1.0 V1.0.0.5 was discovered to contain a command injection vulnerability via the sysScheduleRebootSet function. |
CVE-2023-50639 | Medium | 5.4 | 2023-12-20 | Cross Site Scripting (XSS) vulnerability in CuteHttpFileServer v.1.0 and v.2.0 allows attackers to obtain sensitive information via the file upload function in… |
CVE-2023-48434 | Critical | 9.8 | 2023-12-20 | Online Voting System Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the reg_action.php resou… |
CVE-2023-48433 | Critical | 9.8 | 2023-12-20 | Online Voting System Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the login_action.php res… |
CVE-2023-49272 | Medium | 5.4 | 2023-12-20 | Hotel Management v1.0 is vulnerable to multiple authenticated Reflected Cross-Site Scripting vulnerabilities. The 'children' parameter of the reservation.php r… |
CVE-2023-49271 | Medium | 5.4 | 2023-12-20 | Hotel Management v1.0 is vulnerable to multiple authenticated Reflected Cross-Site Scripting vulnerabilities. The 'check_out_date' parameter of the reservation… |
CVE-2023-49270 | Medium | 5.4 | 2023-12-20 | Hotel Management v1.0 is vulnerable to multiple authenticated Reflected Cross-Site Scripting vulnerabilities. The 'check_in_date' parameter of the reservation… |
CVE-2023-25970 | Critical | 9.8 | 2023-12-20 | Unrestricted Upload of File with Dangerous Type vulnerability in Zendrop Zendrop – Global Dropshipping.This issue affects Zendrop – Global Dropshipping: from n… |
CVE-2023-23970 | High | 8.8 | 2023-12-20 | Unrestricted Upload of File with Dangerous Type vulnerability in WooRockets Corsa.This issue affects Corsa: from n/a through 1.5. |
CVE-2023-49814 | Critical | 9.1 | 2023-12-20 | Unrestricted Upload of File with Dangerous Type vulnerability in Symbiostock symbiostock.This issue affects Symbiostock: from n/a through 6.0.0. |
CVE-2023-47990 | Critical | 9.8 | 2023-12-20 | SQL Injection vulnerability in components/table_manager/html/edit_admin_table.php in CuppaCMS V1.0 allows attackers to run arbitrary SQL commands via the table… |
CVE-2023-47784 | High | 8.4 | 2023-12-20 | Unrestricted Upload of File with Dangerous Type vulnerability in ThemePunch OHG Slider Revolution.This issue affects Slider Revolution: from n/a through 6.6.15. |
CVE-2023-46149 | Critical | 9.9 | 2023-12-20 | Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5. |
CVE-2023-45603 | Critical | 9.0 | 2023-12-20 | Unrestricted Upload of File with Dangerous Type vulnerability in Jeff Starr User Submitted Posts – Enable Users to Submit Posts from the Front End.This issue a… |
CVE-2023-40204 | Critical | 9.1 | 2023-12-20 | Unrestricted Upload of File with Dangerous Type vulnerability in Premio Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manage… |
CVE-2023-34385 | Critical | 9.9 | 2023-12-20 | Unrestricted Upload of File with Dangerous Type vulnerability in Akshay Menariya Export Import Menus.This issue affects Export Import Menus: from n/a through 1… |
CVE-2023-34007 | Critical | 9.9 | 2023-12-20 | Unrestricted Upload of File with Dangerous Type vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.8.3. |
CVE-2023-33318 | Critical | 9.9 | 2023-12-20 | Unrestricted Upload of File with Dangerous Type vulnerability in WooCommerce AutomateWoo.This issue affects AutomateWoo: from n/a through 4.9.40. |
CVE-2023-31231 | Critical | 9.9 | 2023-12-20 | Unrestricted Upload of File with Dangerous Type vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates).This iss… |