2023 CVEs (page 81)
Page 81 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-31215 | Critical | 9.9 | 2023-12-20 | Unrestricted Upload of File with Dangerous Type vulnerability in AmaderCode Lab Dropshipping & Affiliation with Amazon.This issue affects Dropshipping & Affili… |
CVE-2023-29384 | Critical | 10.0 | 2023-12-20 | Unrestricted Upload of File with Dangerous Type vulnerability in HM Plugin WordPress Job Board and Recruitment Plugin – JobWP.This issue affects WordPress Job… |
CVE-2023-29102 | Critical | 9.1 | 2023-12-20 | Unrestricted Upload of File with Dangerous Type vulnerability in Olive Themes Olive One Click Demo Import.This issue affects Olive One Click Demo Import: from… |
CVE-2023-28170 | Critical | 9.1 | 2023-12-20 | Unrestricted Upload of File with Dangerous Type vulnerability in Themely Theme Demo Import.This issue affects Theme Demo Import: from n/a through 1.1.1. |
CVE-2023-49752 | Critical | 9.3 | 2023-12-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spoon themes Adifier - Classified Ads WordPress Theme.Thi… |
CVE-2023-49269 | Medium | 5.4 | 2023-12-20 | Hotel Management v1.0 is vulnerable to multiple authenticated Reflected Cross-Site Scripting vulnerabilities. The 'adults' parameter of the reservation.php res… |
CVE-2023-49166 | High | 7.6 | 2023-12-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Magic Logix MSync.This issue affects MSync: from n/a thro… |
CVE-2023-49161 | High | 7.6 | 2023-12-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Guelben Bravo Translate.This issue affects Bravo Translat… |
CVE-2023-29432 | High | 8.2 | 2023-12-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Favethemes Houzez - Real Estate WordPress Theme.This issu… |
CVE-2023-29096 | High | 8.5 | 2023-12-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BestWebSoft Contact Form to DB by BestWebSoft – Messages… |
CVE-2023-28788 | High | 7.1 | 2023-12-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Page Visit Counter Advanced Page Visit Counter – Most Wan… |
CVE-2023-28491 | Medium | 6.7 | 2023-12-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Slideshow Gallery LITE.This issue affects Slide… |
CVE-2023-26525 | High | 7.1 | 2023-12-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace S… |
CVE-2023-7018 | High | 7.8 | 2023-12-20 | Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36. |
CVE-2023-47118 | High | 7.0 | 2023-12-20 | ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow is… |
CVE-2023-30872 | High | 7.6 | 2023-12-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BannerSky BSK Forms Blacklist.This issue affects BSK Form… |
CVE-2023-30750 | High | 8.5 | 2023-12-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CreativeMindsSolutions CM Popup Plugin for WordPress.This… |
CVE-2023-30495 | High | 8.5 | 2023-12-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Ultimate Addons for Contact Form 7.This issue af… |
CVE-2023-5011 | High | 8.8 | 2023-12-20 | Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'coursename' parameter of the marks.php resource doe… |
CVE-2023-5010 | High | 8.8 | 2023-12-20 | Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'coursecode' parameter of the marks.php resource doe… |
CVE-2023-5007 | High | 8.8 | 2023-12-20 | Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'id' parameter of the marks.php resource does not va… |
CVE-2023-49825 | High | 8.5 | 2023-12-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & Woo… |
CVE-2023-49776 | Critical | 9.3 | 2023-12-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hakan Demiray Sayfa Sayac.This issue affects Sayfa Sayac… |
CVE-2023-49773 | Critical | 10.0 | 2023-12-20 | Deserialization of Untrusted Data vulnerability in Tim Brattberg BCorp Shortcodes.This issue affects BCorp Shortcodes: from n/a through 0.23. |
CVE-2023-49772 | Critical | 10.0 | 2023-12-20 | Deserialization of Untrusted Data vulnerability in Phpbits Creative Studio Genesis Simple Love.This issue affects Genesis Simple Love: from n/a through 2.0. |
CVE-2023-3742 | Medium | 6.8 | 2023-12-20 | Insufficient policy enforcement in ADB in Google Chrome on ChromeOS prior to 114.0.5735.90 allowed a local attacker to bypass device policy restrictions via ph… |
CVE-2023-35916 | High | 7.5 | 2023-12-20 | Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affe… |
CVE-2023-35915 | High | 7.6 | 2023-12-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Automattic WooPayments – Fully Integrated Solution Built… |
CVE-2023-35914 | High | 7.5 | 2023-12-20 | Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Woo Subscriptions.This issue affects Woo Subscriptions: from n/a through 5.1.2. |
CVE-2023-33330 | High | 8.5 | 2023-12-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce AutomateWoo.This issue affects AutomateWoo: f… |
CVE-2023-33209 | High | 8.5 | 2023-12-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CrawlSpider SEO Change Monitor – Track Website Changes.Th… |
CVE-2023-32743 | High | 7.6 | 2023-12-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce AutomateWoo.This issue affects AutomateWoo: f… |
CVE-2023-32128 | Medium | 5.5 | 2023-12-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Adastra Crypto Cryptocurrency Payment & Donation Box – Ac… |
CVE-2023-31092 | Medium | 5.5 | 2023-12-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Foxskav Easy Bet.This issue affects Easy Bet: from n/a th… |
CVE-2023-47852 | High | 8.5 | 2023-12-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper Link Whisper Free.This issue affects Link Wh… |
CVE-2023-40010 | Critical | 9.3 | 2023-12-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in realmag777 HUSKY – Products Filter for WooCommerce Profes… |
CVE-2023-36520 | Medium | 5.4 | 2023-12-20 | Authorization Bypass Through User-Controlled Key vulnerability in MarketingFire Editorial Calendar.This issue affects Editorial Calendar: from n/a through 3.7… |
CVE-2023-35895 | Medium | 6.3 | 2023-12-20 | IBM Informix JDBC Driver 4.10 and 4.50 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API… |
CVE-2023-35876 | High | 8.1 | 2023-12-20 | Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Square.This issue affects WooCommerce Square: from n/a through 3.8.1. |
CVE-2023-32590 | Critical | 9.3 | 2023-12-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Daniel Söderström / Sidney van de Stouwe Subscribe to Cat… |
CVE-2023-28782 | High | 8.3 | 2023-12-20 | Deserialization of Untrusted Data vulnerability in Rocketgenius Inc. Gravity Forms.This issue affects Gravity Forms: from n/a through 2.7.3. |
CVE-2023-6784 | Medium | 4.7 | 2023-12-20 | A malicious user could potentially use the Sitefinity system for the distribution of phishing emails. |
CVE-2023-51462 | Medium | 5.4 | 2023-12-20 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2023-51461 | Medium | 5.4 | 2023-12-20 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged… |
CVE-2023-51460 | Medium | 5.4 | 2023-12-20 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged… |
CVE-2023-51459 | Medium | 5.4 | 2023-12-20 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2023-51458 | Medium | 5.4 | 2023-12-20 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged… |
CVE-2023-51457 | Medium | 5.4 | 2023-12-20 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged… |
CVE-2023-50249 | High | 7.5 | 2023-12-20 | Sentry-Javascript is official Sentry SDKs for JavaScript. A ReDoS (Regular expression Denial of Service) vulnerability has been identified in Sentry's Astro SD… |
CVE-2023-47507 | High | 7.1 | 2023-12-20 | Deserialization of Untrusted Data vulnerability in Master Slider Master Slider Pro.This issue affects Master Slider Pro: from n/a through 3.6.5. |
CVE-2023-47236 | High | 7.6 | 2023-12-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Avirtum iPages Flipbook For WordPress.This issue affects… |
CVE-2023-46311 | Low | 2.7 | 2023-12-20 | Authorization Bypass Through User-Controlled Key vulnerability in gVectors Team Comments – wpDiscuz.This issue affects Comments – wpDiscuz: from n/a through 7… |
CVE-2023-46147 | High | 7.4 | 2023-12-20 | Deserialization of Untrusted Data vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5. |
CVE-2023-41796 | Medium | 5.3 | 2023-12-20 | Authorization Bypass Through User-Controlled Key vulnerability in WP Sunshine Sunshine Photo Cart: Free Client Galleries for Photographers.This issue affects S… |
CVE-2023-40555 | High | 8.3 | 2023-12-20 | Deserialization of Untrusted Data vulnerability in UX-themes Flatsome | Multi-Purpose Responsive WooCommerce Theme.This issue affects Flatsome | Multi-Purpose… |
CVE-2023-38519 | High | 7.6 | 2023-12-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MainWP MainWP Dashboard – WordPress Manager for Multiple… |
CVE-2023-38513 | Medium | 5.4 | 2023-12-20 | Authorization Bypass Through User-Controlled Key vulnerability in Jordy Meow Photo Engine (Media Organizer & Lightroom).This issue affects Photo Engine (Media… |
CVE-2023-37871 | High | 8.2 | 2023-12-20 | Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce GoCardless.This issue affects GoCardless: from n/a through 2.5.6. |
CVE-2023-6562 | High | 7.5 | 2023-12-20 | JPX Fragment List (flst) box vulnerability in Kakadu 7.9 allows an attacker to exfiltrate local and remote files reachable by a server if the server allows the… |
CVE-2023-6912 | High | 7.5 | 2023-12-20 | Lack of protection against brute force attacks in M-Files Server before 23.12.13205.0 allows an attacker unlimited authentication attempts, potentially comprom… |
CVE-2023-6910 | Medium | 6.5 | 2023-12-20 | A vulnerable API method in M-Files Server before 23.12.13195.0 allows for uncontrolled resource consumption. Authenticated attacker can exhaust server storage… |
CVE-2023-6769 | Medium | 6.5 | 2023-12-20 | Stored XSS vulnerability in Amazing Little Poll, affecting versions 1.3 and 1.4. This vulnerability allows a remote attacker to store a malicious JavaScript pa… |
CVE-2023-6768 | Critical | 9.4 | 2023-12-20 | Authentication bypass vulnerability in Amazing Little Poll affecting versions 1.3 and 1.4. This vulnerability could allow an unauthenticated user to access the… |
CVE-2023-50628 | Critical | 9.8 | 2023-12-20 | Buffer Overflow vulnerability in libming version 0.4.8, allows attackers to execute arbitrary code and obtain sensitive information via parser.c component. |
CVE-2023-50044 | Critical | 9.8 | 2023-12-20 | Cesanta MJS 2.20.0 has a getprop_builtin_foreign out-of-bounds read if a Built-in API name occurs in a substring of an input string. |
CVE-2023-37544 | High | 7.5 | 2023-12-20 | Improper Authentication vulnerability in Apache Pulsar WebSocket Proxy allows an attacker to connect to the /pingpong endpoint without authentication. This is… |
CVE-2023-0011 | High | 7.6 | 2023-12-20 | A flaw in the input validation in TOBY-L2 allows a user to execute arbitrary operating system commands using specifically crafted AT commands. This vulnerabili… |
CVE-2023-6977 | High | 7.5 | 2023-12-20 | This vulnerability enables malicious users to read sensitive files on the server. |
CVE-2023-6976 | High | 8.8 | 2023-12-20 | This vulnerability is capable of writing arbitrary files into arbitrary locations on the remote filesystem in the context of the server process. |
CVE-2023-6975 | Critical | 9.8 | 2023-12-20 | A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information. |
CVE-2023-6974 | Critical | 9.8 | 2023-12-20 | A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it could be abuse to get a remote code execut… |
CVE-2023-47707 | Medium | 5.4 | 2023-12-20 | IBM Security Guardium Key Lifecycle Manager 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in th… |
CVE-2023-47705 | Medium | 4.3 | 2023-12-20 | IBM Security Guardium Key Lifecycle Manager 4.3 could allow an authenticated user to manipulate username data due to improper input validation. IBM X-Force ID… |
CVE-2023-47703 | Medium | 5.3 | 2023-12-20 | IBM Security Guardium Key Lifecycle Manager 4.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is return… |
CVE-2023-47702 | Medium | 4.3 | 2023-12-20 | IBM Security Guardium Key Lifecycle Manager 4.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted… |
CVE-2023-47706 | Medium | 6.6 | 2023-12-20 | IBM Security Guardium Key Lifecycle Manager 4.3 could allow an authenticated user to upload files of a dangerous file type. IBM X-Force ID: 271341. |
CVE-2023-47704 | Medium | 4.0 | 2023-12-20 | IBM Security Guardium Key Lifecycle Manager 4.3 contains plain text hard-coded credentials or other secrets in source code repository. IBM X-Force ID: 271220. |
CVE-2023-27172 | Critical | 9.1 | 2023-12-20 | Xpand IT Write-back Manager v2.3.1 uses weak secret keys to sign JWT tokens. This allows attackers to easily obtain the secret key used to sign JWT tokens via… |
CVE-2023-6689 | High | 8.2 | 2023-12-20 | A successful CSRF attack could force the user to perform state changing requests on the application. If the victim is an administrative account, a CSRF at… |
CVE-2023-50707 | Critical | 9.6 | 2023-12-20 | Through the exploitation of active user sessions, an attacker could send custom requests to cause a denial-of-service condition on the device. |
CVE-2023-50706 | Medium | 4.1 | 2023-12-20 | A user without administrator permissions with access to the UC500 windows system could perform a memory dump of the running processes and extract… |
CVE-2023-50705 | Medium | 5.3 | 2023-12-20 | An attacker could create malicious requests to obtain sensitive information about the web server. |
CVE-2023-50704 | Medium | 4.3 | 2023-12-20 | An attacker could construct a URL within the application that causes a redirection to an arbitrary external domain and could be leveraged to facilitate ph… |
CVE-2023-50703 | Medium | 6.3 | 2023-12-20 | An attacker with network access could perform a man-in-the-middle (MitM) attack and capture sensitive information to gain unauthorized access to the applicati… |
CVE-2023-47161 | Medium | 5.3 | 2023-12-20 | IBM UrbanCode Deploy (UCD) 7.1 through 7.1.2.14, 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 may mishandle input validation of an uploaded archive file leadin… |
CVE-2023-45887 | Critical | 9.8 | 2023-12-20 | DS Wireless Communication (DWC) with DWC_VERSION_3 and DWC_VERSION_11 allows remote attackers to execute arbitrary code on a game-playing client's machine via… |
CVE-2023-42013 | Medium | 5.3 | 2023-12-20 | IBM UrbanCode Deploy (UCD) 7.1 through 7.1.2.14, 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 could allow a remote attacker to obtain sensitive information whe… |
CVE-2023-42012 | Medium | 6.2 | 2023-12-20 | An IBM UrbanCode Deploy Agent 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 installed as a Windows service in a non-standard location could be subject to a deni… |
CVE-2023-6930 | Critical | 9.4 | 2023-12-19 | EuroTel ETL3100 versions v01c01 and v01x37 suffer from an unauthenticated configuration and log download vulnerability. This enables the attacker to d… |
CVE-2023-6929 | High | 7.5 | 2023-12-19 | EuroTel ETL3100 versions v01c01 and v01x37 are vulnerable to insecure direct object references that occur when the application provides direct access to o… |
CVE-2023-6928 | Critical | 9.8 | 2023-12-19 | EuroTel ETL3100 versions v01c01 and v01x37 does not limit the number of attempts to guess administrative credentials in remote password attacks to gain full c… |
CVE-2023-49147 | High | 7.8 | 2023-12-19 | An issue was discovered in PDF24 Creator 11.14.0. The configuration of the msi installer file was found to produce a visible cmd.exe window when using the repa… |
CVE-2023-45172 | Medium | 6.2 | 2023-12-19 | IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in AIX windows to cause a denial of service. IBM X-Force ID… |
CVE-2023-50835 | Medium | 5.4 | 2023-12-19 | Cross-Site Request Forgery (CSRF) vulnerability in Praveen Goswami Advanced Category Template.This issue affects Advanced Category Template: from n/a through 0… |
CVE-2023-49164 | Medium | 5.4 | 2023-12-19 | Cross-Site Request Forgery (CSRF) vulnerability in OceanWP Ocean Extra.This issue affects Ocean Extra: from n/a through 2.2.2. |
CVE-2023-49004 | Critical | 9.8 | 2023-12-19 | An issue in D-Link DIR-850L v.B1_FW223WWb01 allows a remote attacker to execute arbitrary code via a crafted script to the en parameter. |
CVE-2023-47267 | Critical | 9.8 | 2023-12-19 | An issue discovered in TheGreenBow Windows Enterprise Certified VPN Client 6.52, Windows Standard VPN Client 6.87, and Windows Enterprise VPN Client 6.87 allow… |
CVE-2023-47146 | Medium | 4.9 | 2023-12-19 | IBM Qradar SIEM 7.5 could allow a privileged user to obtain sensitive domain information due to data being misidentified. IBM X-Force ID: 270372. |
CVE-2023-46624 | Medium | 4.7 | 2023-12-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Parcel Pro.This issue affects Parcel Pro: from n/a through 1.6.11. |
CVE-2023-42940 | Medium | 5.7 | 2023-12-19 | A session rendering issue was addressed with improved session tracking. This issue is fixed in macOS Sonoma 14.2.1. A user who shares their screen may unintent… |