2023 CVEs (page 81)
Page 81 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-41796 | Medium | 5.3 | 2023-12-20 | Authorization Bypass Through User-Controlled Key vulnerability in WP Sunshine Sunshine Photo Cart: Free Client Galleries for Photographers.This issue affects S… |
CVE-2023-40555 | High | 8.3 | 2023-12-20 | Deserialization of Untrusted Data vulnerability in UX-themes Flatsome | Multi-Purpose Responsive WooCommerce Theme.This issue affects Flatsome | Multi-Purpose… |
CVE-2023-38519 | High | 7.6 | 2023-12-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MainWP MainWP Dashboard – WordPress Manager for Multiple… |
CVE-2023-38513 | Medium | 5.4 | 2023-12-20 | Authorization Bypass Through User-Controlled Key vulnerability in Jordy Meow Photo Engine (Media Organizer & Lightroom).This issue affects Photo Engine (Media… |
CVE-2023-37871 | High | 8.2 | 2023-12-20 | Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce GoCardless.This issue affects GoCardless: from n/a through 2.5.6. |
CVE-2023-6562 | High | 7.5 | 2023-12-20 | JPX Fragment List (flst) box vulnerability in Kakadu 7.9 allows an attacker to exfiltrate local and remote files reachable by a server if the server allows the… |
CVE-2023-6912 | High | 7.5 | 2023-12-20 | Lack of protection against brute force attacks in M-Files Server before 23.12.13205.0 allows an attacker unlimited authentication attempts, potentially comprom… |
CVE-2023-6910 | Medium | 6.5 | 2023-12-20 | A vulnerable API method in M-Files Server before 23.12.13195.0 allows for uncontrolled resource consumption. Authenticated attacker can exhaust server storage… |
CVE-2023-6769 | Medium | 6.5 | 2023-12-20 | Stored XSS vulnerability in Amazing Little Poll, affecting versions 1.3 and 1.4. This vulnerability allows a remote attacker to store a malicious JavaScript pa… |
CVE-2023-6768 | Critical | 9.4 | 2023-12-20 | Authentication bypass vulnerability in Amazing Little Poll affecting versions 1.3 and 1.4. This vulnerability could allow an unauthenticated user to access the… |
CVE-2023-50628 | Critical | 9.8 | 2023-12-20 | Buffer Overflow vulnerability in libming version 0.4.8, allows attackers to execute arbitrary code and obtain sensitive information via parser.c component. |
CVE-2023-50044 | Critical | 9.8 | 2023-12-20 | Cesanta MJS 2.20.0 has a getprop_builtin_foreign out-of-bounds read if a Built-in API name occurs in a substring of an input string. |
CVE-2023-37544 | High | 7.5 | 2023-12-20 | Improper Authentication vulnerability in Apache Pulsar WebSocket Proxy allows an attacker to connect to the /pingpong endpoint without authentication. This is… |
CVE-2023-0011 | High | 7.6 | 2023-12-20 | A flaw in the input validation in TOBY-L2 allows a user to execute arbitrary operating system commands using specifically crafted AT commands. This vulnerabili… |
CVE-2023-6977 | High | 7.5 | 2023-12-20 | This vulnerability enables malicious users to read sensitive files on the server. |
CVE-2023-6976 | High | 8.8 | 2023-12-20 | This vulnerability is capable of writing arbitrary files into arbitrary locations on the remote filesystem in the context of the server process. |
CVE-2023-6975 | Critical | 9.8 | 2023-12-20 | A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information. |
CVE-2023-6974 | Critical | 9.8 | 2023-12-20 | A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it could be abuse to get a remote code execut… |
CVE-2023-47707 | Medium | 5.4 | 2023-12-20 | IBM Security Guardium Key Lifecycle Manager 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in th… |
CVE-2023-47705 | Medium | 4.3 | 2023-12-20 | IBM Security Guardium Key Lifecycle Manager 4.3 could allow an authenticated user to manipulate username data due to improper input validation. IBM X-Force ID… |
CVE-2023-47703 | Medium | 5.3 | 2023-12-20 | IBM Security Guardium Key Lifecycle Manager 4.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is return… |
CVE-2023-47702 | Medium | 4.3 | 2023-12-20 | IBM Security Guardium Key Lifecycle Manager 4.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted… |
CVE-2023-47706 | Medium | 6.6 | 2023-12-20 | IBM Security Guardium Key Lifecycle Manager 4.3 could allow an authenticated user to upload files of a dangerous file type. IBM X-Force ID: 271341. |
CVE-2023-47704 | Medium | 4.0 | 2023-12-20 | IBM Security Guardium Key Lifecycle Manager 4.3 contains plain text hard-coded credentials or other secrets in source code repository. IBM X-Force ID: 271220. |
CVE-2023-27172 | Critical | 9.1 | 2023-12-20 | Xpand IT Write-back Manager v2.3.1 uses weak secret keys to sign JWT tokens. This allows attackers to easily obtain the secret key used to sign JWT tokens via… |
CVE-2023-6689 | High | 8.2 | 2023-12-20 | A successful CSRF attack could force the user to perform state changing requests on the application. If the victim is an administrative account, a CSRF at… |
CVE-2023-50707 | Critical | 9.6 | 2023-12-20 | Through the exploitation of active user sessions, an attacker could send custom requests to cause a denial-of-service condition on the device. |
CVE-2023-50706 | Medium | 4.1 | 2023-12-20 | A user without administrator permissions with access to the UC500 windows system could perform a memory dump of the running processes and extract… |
CVE-2023-50705 | Medium | 5.3 | 2023-12-20 | An attacker could create malicious requests to obtain sensitive information about the web server. |
CVE-2023-50704 | Medium | 4.3 | 2023-12-20 | An attacker could construct a URL within the application that causes a redirection to an arbitrary external domain and could be leveraged to facilitate ph… |
CVE-2023-50703 | Medium | 6.3 | 2023-12-20 | An attacker with network access could perform a man-in-the-middle (MitM) attack and capture sensitive information to gain unauthorized access to the applicati… |
CVE-2023-47161 | Medium | 5.3 | 2023-12-20 | IBM UrbanCode Deploy (UCD) 7.1 through 7.1.2.14, 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 may mishandle input validation of an uploaded archive file leadin… |
CVE-2023-45887 | Critical | 9.8 | 2023-12-20 | DS Wireless Communication (DWC) with DWC_VERSION_3 and DWC_VERSION_11 allows remote attackers to execute arbitrary code on a game-playing client's machine via… |
CVE-2023-42013 | Medium | 5.3 | 2023-12-20 | IBM UrbanCode Deploy (UCD) 7.1 through 7.1.2.14, 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 could allow a remote attacker to obtain sensitive information whe… |
CVE-2023-42012 | Medium | 6.2 | 2023-12-20 | An IBM UrbanCode Deploy Agent 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 installed as a Windows service in a non-standard location could be subject to a deni… |
CVE-2023-6930 | Critical | 9.4 | 2023-12-19 | EuroTel ETL3100 versions v01c01 and v01x37 suffer from an unauthenticated configuration and log download vulnerability. This enables the attacker to d… |
CVE-2023-6929 | High | 7.5 | 2023-12-19 | EuroTel ETL3100 versions v01c01 and v01x37 are vulnerable to insecure direct object references that occur when the application provides direct access to o… |
CVE-2023-6928 | Critical | 9.8 | 2023-12-19 | EuroTel ETL3100 versions v01c01 and v01x37 does not limit the number of attempts to guess administrative credentials in remote password attacks to gain full c… |
CVE-2023-49147 | High | 7.8 | 2023-12-19 | An issue was discovered in PDF24 Creator 11.14.0. The configuration of the msi installer file was found to produce a visible cmd.exe window when using the repa… |
CVE-2023-45172 | Medium | 6.2 | 2023-12-19 | IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in AIX windows to cause a denial of service. IBM X-Force ID… |
CVE-2023-50835 | Medium | 5.4 | 2023-12-19 | Cross-Site Request Forgery (CSRF) vulnerability in Praveen Goswami Advanced Category Template.This issue affects Advanced Category Template: from n/a through 0… |
CVE-2023-49164 | Medium | 5.4 | 2023-12-19 | Cross-Site Request Forgery (CSRF) vulnerability in OceanWP Ocean Extra.This issue affects Ocean Extra: from n/a through 2.2.2. |
CVE-2023-49004 | Critical | 9.8 | 2023-12-19 | An issue in D-Link DIR-850L v.B1_FW223WWb01 allows a remote attacker to execute arbitrary code via a crafted script to the en parameter. |
CVE-2023-47267 | Critical | 9.8 | 2023-12-19 | An issue discovered in TheGreenBow Windows Enterprise Certified VPN Client 6.52, Windows Standard VPN Client 6.87, and Windows Enterprise VPN Client 6.87 allow… |
CVE-2023-47146 | Medium | 4.9 | 2023-12-19 | IBM Qradar SIEM 7.5 could allow a privileged user to obtain sensitive domain information due to data being misidentified. IBM X-Force ID: 270372. |
CVE-2023-46624 | Medium | 4.7 | 2023-12-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Parcel Pro.This issue affects Parcel Pro: from n/a through 1.6.11. |
CVE-2023-42940 | Medium | 5.7 | 2023-12-19 | A session rendering issue was addressed with improved session tracking. This issue is fixed in macOS Sonoma 14.2.1. A user who shares their screen may unintent… |
CVE-2023-38126 | High | 7.2 | 2023-12-19 | Softing edgeAggregator Restore Configuration Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arb… |
CVE-2023-50466 | High | 8.8 | 2023-12-19 | An authenticated command injection vulnerability in Weintek cMT2078X easyweb Web Version v2.1.3, OS v20220215 allows attackers to execute arbitrary code or acc… |
CVE-2023-49812 | Medium | 5.3 | 2023-12-19 | Authorization Bypass Through User-Controlled Key vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus.This issue affects WP Photo Album Plus: fro… |
CVE-2023-49764 | High | 7.6 | 2023-12-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Younes JFR. Advanced Database Cleaner.This issue affects… |
CVE-2023-49750 | Critical | 9.3 | 2023-12-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spoonthemes Couponis - Affiliate & Submitting Coupons Wor… |
CVE-2023-48764 | High | 7.6 | 2023-12-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GuardGiant Brute Force Protection WordPress Brute Force P… |
CVE-2023-48741 | High | 7.6 | 2023-12-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in QuantumCloud AI ChatBot.This issue affects AI ChatBot: fr… |
CVE-2023-48738 | Critical | 9.3 | 2023-12-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Porto Theme Porto Theme - Functionality.This issue affect… |
CVE-2023-48327 | High | 7.6 | 2023-12-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WC Vendors WC Vendors – WooCommerce Multi-Vendor, WooComm… |
CVE-2023-37982 | Medium | 4.7 | 2023-12-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms.T… |
CVE-2023-35883 | Medium | 4.7 | 2023-12-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Magazine3 Core Web Vitals & PageSpeed Booster.This issue affects Core Web Vitals & PageSpe… |
CVE-2023-45105 | Medium | 4.7 | 2023-12-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in SERVIT Software Solutions affiliate-toolkit – WordPress Affiliate Plugin.This issue affect… |
CVE-2023-43826 | High | 7.5 | 2023-12-19 | Apache Guacamole 1.5.3 and older do not consistently ensure that values received from a VNC server will not result in integer overflow. If a user connects to a… |
CVE-2023-41648 | Medium | 4.7 | 2023-12-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Swapnil V. Patil Login and Logout Redirect.This issue affects Login and Logout Redirect: f… |
CVE-2023-40602 | Medium | 4.7 | 2023-12-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Doofinder Doofinder WP & WooCommerce Search.This issue affects Doofinder WP & WooCommerce… |
CVE-2023-38481 | Medium | 4.7 | 2023-12-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for WooCommerce and Zoho CRM, Books, Invoice, Inventory, Bigin.This… |
CVE-2023-38478 | Medium | 4.7 | 2023-12-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for WooCommerce and QuickBooks.This issue affects Integration for Wo… |
CVE-2023-34382 | Medium | 4.4 | 2023-12-19 | Deserialization of Untrusted Data vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This is… |
CVE-2023-34027 | High | 8.3 | 2023-12-19 | Deserialization of Untrusted Data vulnerability in Rajnish Arora Recently Viewed Products.This issue affects Recently Viewed Products: from n/a through 1.0.0. |
CVE-2023-49706 | Medium | 6.8 | 2023-12-19 | Defective request context handling in Self Service in LinOTP 3.x before 3.2.5 allows remote unauthenticated attackers to escalate privileges, thereby allowing… |
CVE-2023-50272 | High | 7.5 | 2023-12-19 | A potential security vulnerability has been identified in HPE Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 6 (iLO 6). The vulnerability could be r… |
CVE-2023-46804 | High | 7.5 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS). |
CVE-2023-46803 | High | 7.5 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS). |
CVE-2023-46266 | Critical | 9.1 | 2023-12-19 | An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. |
CVE-2023-46265 | Critical | 9.8 | 2023-12-19 | An unauthenticated could abuse a XXE vulnerability in the Smart Device Server to leak data or perform a Server-Side Request Forgery (SSRF). |
CVE-2023-46264 | Critical | 9.8 | 2023-12-19 | An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove… |
CVE-2023-46263 | Critical | 9.8 | 2023-12-19 | An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remote… |
CVE-2023-46262 | High | 7.5 | 2023-12-19 | An unauthenticated attacked could send a specifically crafted web request causing a Server-Side Request Forgery (SSRF) in Ivanti Avalanche Remote Control serve… |
CVE-2023-46261 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46260 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46259 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46258 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46257 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46225 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46224 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46223 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46222 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46221 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46220 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46217 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46216 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-44991 | Medium | 6.5 | 2023-12-19 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jordy Meow Media File Renamer: Rename Files (Manual, Auto & AI).This issue affects… |
CVE-2023-44983 | Medium | 5.3 | 2023-12-19 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Aruba.It Aruba HiSpeed Cache.This issue affects Aruba HiSpeed Cache: from n/a throu… |
CVE-2023-41727 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-37390 | High | 8.3 | 2023-12-19 | Deserialization of Untrusted Data vulnerability in Themesflat Themesflat Addons For Elementor.This issue affects Themesflat Addons For Elementor: from n/a thro… |
CVE-2023-25715 | Medium | 5.4 | 2023-12-19 | Missing Authorization vulnerability in GamiPress GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress.This issue… |
CVE-2023-6913 | High | 8.1 | 2023-12-19 | A session hijacking vulnerability has been detected in the Imou Life application affecting version 6.7.0. This vulnerability could allow an attacker to hijack… |
CVE-2023-6711 | Medium | 5.9 | 2023-12-19 | Vulnerability exists in SCI IEC 60870-5-104 and HCI IEC 60870-5-104 that affects the RTU500 series product versions listed below. Specially crafted messages se… |
CVE-2023-6280 | High | 7.2 | 2023-12-19 | An XXE (XML External Entity) vulnerability has been detected in 52North WPS affecting versions prior to 4.0.0-beta.11. This vulnerability allows the use of ext… |
CVE-2023-43870 | High | 8.1 | 2023-12-19 | When installing the Net2 software a root certificate is installed into the trusted store. A potential hacker could access the installer batch file or reverse e… |
CVE-2023-1514 | High | 7.4 | 2023-12-19 | A vulnerability exists in the component RTU500 Scripting interface. When a client connects to a server using TLS, the server presents a certificate. This certi… |
CVE-2023-6932 | High | 7.8 | 2023-12-19 | A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve local privilege escalation. A race condition can be expl… |
CVE-2023-6931 | High | 7.8 | 2023-12-19 | A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation. A… |