2023 CVEs (page 82)
Page 82 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-38126 | High | 7.2 | 2023-12-19 | Softing edgeAggregator Restore Configuration Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arb… |
CVE-2023-50466 | High | 8.8 | 2023-12-19 | An authenticated command injection vulnerability in Weintek cMT2078X easyweb Web Version v2.1.3, OS v20220215 allows attackers to execute arbitrary code or acc… |
CVE-2023-49812 | Medium | 5.3 | 2023-12-19 | Authorization Bypass Through User-Controlled Key vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus.This issue affects WP Photo Album Plus: fro… |
CVE-2023-49764 | High | 7.6 | 2023-12-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Younes JFR. Advanced Database Cleaner.This issue affects… |
CVE-2023-49750 | Critical | 9.3 | 2023-12-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spoonthemes Couponis - Affiliate & Submitting Coupons Wor… |
CVE-2023-48764 | High | 7.6 | 2023-12-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GuardGiant Brute Force Protection WordPress Brute Force P… |
CVE-2023-48741 | High | 7.6 | 2023-12-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in QuantumCloud AI ChatBot.This issue affects AI ChatBot: fr… |
CVE-2023-48738 | Critical | 9.3 | 2023-12-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Porto Theme Porto Theme - Functionality.This issue affect… |
CVE-2023-48327 | High | 7.6 | 2023-12-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WC Vendors WC Vendors – WooCommerce Multi-Vendor, WooComm… |
CVE-2023-37982 | Medium | 4.7 | 2023-12-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms.T… |
CVE-2023-35883 | Medium | 4.7 | 2023-12-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Magazine3 Core Web Vitals & PageSpeed Booster.This issue affects Core Web Vitals & PageSpe… |
CVE-2023-45105 | Medium | 4.7 | 2023-12-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in SERVIT Software Solutions affiliate-toolkit – WordPress Affiliate Plugin.This issue affect… |
CVE-2023-43826 | High | 7.5 | 2023-12-19 | Apache Guacamole 1.5.3 and older do not consistently ensure that values received from a VNC server will not result in integer overflow. If a user connects to a… |
CVE-2023-41648 | Medium | 4.7 | 2023-12-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Swapnil V. Patil Login and Logout Redirect.This issue affects Login and Logout Redirect: f… |
CVE-2023-40602 | Medium | 4.7 | 2023-12-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Doofinder Doofinder WP & WooCommerce Search.This issue affects Doofinder WP & WooCommerce… |
CVE-2023-38481 | Medium | 4.7 | 2023-12-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for WooCommerce and Zoho CRM, Books, Invoice, Inventory, Bigin.This… |
CVE-2023-38478 | Medium | 4.7 | 2023-12-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for WooCommerce and QuickBooks.This issue affects Integration for Wo… |
CVE-2023-34382 | Medium | 4.4 | 2023-12-19 | Deserialization of Untrusted Data vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This is… |
CVE-2023-34027 | High | 8.3 | 2023-12-19 | Deserialization of Untrusted Data vulnerability in Rajnish Arora Recently Viewed Products.This issue affects Recently Viewed Products: from n/a through 1.0.0. |
CVE-2023-49706 | Medium | 6.8 | 2023-12-19 | Defective request context handling in Self Service in LinOTP 3.x before 3.2.5 allows remote unauthenticated attackers to escalate privileges, thereby allowing… |
CVE-2023-50272 | High | 7.5 | 2023-12-19 | A potential security vulnerability has been identified in HPE Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 6 (iLO 6). The vulnerability could be r… |
CVE-2023-46804 | High | 7.5 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS). |
CVE-2023-46803 | High | 7.5 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS). |
CVE-2023-46266 | Critical | 9.1 | 2023-12-19 | An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. |
CVE-2023-46265 | Critical | 9.8 | 2023-12-19 | An unauthenticated could abuse a XXE vulnerability in the Smart Device Server to leak data or perform a Server-Side Request Forgery (SSRF). |
CVE-2023-46264 | Critical | 9.8 | 2023-12-19 | An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove… |
CVE-2023-46263 | Critical | 9.8 | 2023-12-19 | An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remote… |
CVE-2023-46262 | High | 7.5 | 2023-12-19 | An unauthenticated attacked could send a specifically crafted web request causing a Server-Side Request Forgery (SSRF) in Ivanti Avalanche Remote Control serve… |
CVE-2023-46261 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46260 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46259 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46258 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46257 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46225 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46224 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46223 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46222 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46221 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46220 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46217 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46216 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-44991 | Medium | 6.5 | 2023-12-19 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jordy Meow Media File Renamer: Rename Files (Manual, Auto & AI).This issue affects… |
CVE-2023-44983 | Medium | 5.3 | 2023-12-19 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Aruba.It Aruba HiSpeed Cache.This issue affects Aruba HiSpeed Cache: from n/a throu… |
CVE-2023-41727 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-37390 | High | 8.3 | 2023-12-19 | Deserialization of Untrusted Data vulnerability in Themesflat Themesflat Addons For Elementor.This issue affects Themesflat Addons For Elementor: from n/a thro… |
CVE-2023-25715 | Medium | 5.4 | 2023-12-19 | Missing Authorization vulnerability in GamiPress GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress.This issue… |
CVE-2023-6913 | High | 8.1 | 2023-12-19 | A session hijacking vulnerability has been detected in the Imou Life application affecting version 6.7.0. This vulnerability could allow an attacker to hijack… |
CVE-2023-6711 | Medium | 5.9 | 2023-12-19 | Vulnerability exists in SCI IEC 60870-5-104 and HCI IEC 60870-5-104 that affects the RTU500 series product versions listed below. Specially crafted messages se… |
CVE-2023-6280 | High | 7.2 | 2023-12-19 | An XXE (XML External Entity) vulnerability has been detected in 52North WPS affecting versions prior to 4.0.0-beta.11. This vulnerability allows the use of ext… |
CVE-2023-43870 | High | 8.1 | 2023-12-19 | When installing the Net2 software a root certificate is installed into the trusted store. A potential hacker could access the installer batch file or reverse e… |
CVE-2023-1514 | High | 7.4 | 2023-12-19 | A vulnerability exists in the component RTU500 Scripting interface. When a client connects to a server using TLS, the server presents a certificate. This certi… |
CVE-2023-6932 | High | 7.8 | 2023-12-19 | A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve local privilege escalation. A race condition can be expl… |
CVE-2023-6931 | High | 7.8 | 2023-12-19 | A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation. A… |
CVE-2023-6873 | High | 8.8 | 2023-12-19 | Memory safety bugs present in Firefox 120. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could h… |
CVE-2023-6872 | Medium | 6.5 | 2023-12-19 | Browser tab titles were being leaked by GNOME to system logs. This could potentially expose the browsing habits of users running in a private tab. This vulnera… |
CVE-2023-6871 | Medium | 4.3 | 2023-12-19 | Under certain conditions, Firefox did not display a warning when a user attempted to navigate to a new protocol handler. This vulnerability affects Firefox < 1… |
CVE-2023-6870 | Medium | 4.3 | 2023-12-19 | Applications which spawn a Toast notification in a background thread may have obscured fullscreen notifications displayed by Firefox. *This issue only affects… |
CVE-2023-6869 | Medium | 6.5 | 2023-12-19 | A `<dialog>` element could have been manipulated to paint content outside of a sandboxed iframe. This could allow untrusted content to display under the gui… |
CVE-2023-6868 | Medium | 4.3 | 2023-12-19 | In some instances, the user-agent would allow push requests which lacked a valid VAPID even though the push manager subscription defined one. This could allow… |
CVE-2023-6867 | Medium | 6.1 | 2023-12-19 | The timing of a button click causing a popup to disappear was approximately the same length as the anti-clickjacking delay on permission prompts. It was possib… |
CVE-2023-6866 | High | 8.8 | 2023-12-19 | TypedArrays can be fallible and lacked proper exception handling. This could lead to abuse in other APIs which expect TypedArrays to always succeed. This vulne… |
CVE-2023-6865 | Medium | 6.5 | 2023-12-19 | `EncryptingOutputStream` was susceptible to exposing uninitialized data. This issue could only be abused in order to write data to a local disk which may have… |
CVE-2023-6864 | High | 8.8 | 2023-12-19 | Memory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. Some of these bugs showed evidence of memory corruption and we presume tha… |
CVE-2023-6863 | High | 8.8 | 2023-12-19 | The `ShutdownObserver()` was susceptible to potentially undefined behavior due to its reliance on a dynamic type that lacked a virtual destructor. This vulnera… |
CVE-2023-6862 | High | 8.8 | 2023-12-19 | A use-after-free was identified in the `nsDNSService::Init`. This issue appears to manifest rarely during start-up. This vulnerability affects Firefox ESR < 1… |
CVE-2023-6861 | High | 8.8 | 2023-12-19 | The `nsWindow::PickerOpen(void)` method was susceptible to a heap buffer overflow when running in headless mode. This vulnerability affects Firefox ESR < 115.6… |
CVE-2023-6860 | Medium | 6.5 | 2023-12-19 | The `VideoBridge` allowed any content process to use textures produced by remote decoders. This could be abused to escape the sandbox. This vulnerability affe… |
CVE-2023-6859 | High | 8.8 | 2023-12-19 | A use-after-free condition affected TLS socket creation when under memory pressure. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Fi… |
CVE-2023-6858 | High | 8.8 | 2023-12-19 | Firefox was susceptible to a heap buffer overflow in `nsTextFragment` due to insufficient OOM handling. This vulnerability affects Firefox ESR < 115.6, Thunder… |
CVE-2023-6857 | Medium | 5.3 | 2023-12-19 | When resolving a symlink, a race may occur where the buffer passed to `readlink` may actually be smaller than necessary. *This bug only affects Firefox on Uni… |
CVE-2023-6856 | High | 8.8 | 2023-12-19 | The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow an att… |
CVE-2023-6135 | Medium | 4.3 | 2023-12-19 | Multiple NSS NIST curves were susceptible to a side-channel attack known as "Minerva". This attack could potentially allow an attacker to recover the private k… |
CVE-2023-50762 | Medium | 4.3 | 2023-12-19 | When processing a PGP/MIME payload that contains digitally signed text, the first paragraph of the text was never shown to the user. This is because the text w… |
CVE-2023-50761 | Medium | 4.3 | 2023-12-19 | The signature of a digitally signed S/MIME email message may optionally specify the signature creation date and time. If present, Thunderbird did not compare t… |
CVE-2023-6730 | High | 8.8 | 2023-12-19 | Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36. |
CVE-2023-6945 | Low | 2.4 | 2023-12-19 | A vulnerability has been found in SourceCodester Online Student Management System 1.0 and classified as problematic. Affected by this vulnerability is an unkno… |
CVE-2023-49736 | Medium | 6.5 | 2023-12-19 | A where_in JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow for SQL injection in Apache Superset.This… |
CVE-2023-49734 | High | 7.7 | 2023-12-19 | An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts al… |
CVE-2023-49489 | Medium | 6.1 | 2023-12-19 | Reflective Cross Site Scripting (XSS) vulnerability in KodExplorer version 4.51, allows attackers to obtain sensitive information and escalate privileges via t… |
CVE-2023-49006 | Medium | 6.5 | 2023-12-19 | Cross Site Request Forgery (CSRF) vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the… |
CVE-2023-46104 | Medium | 6.5 | 2023-12-19 | Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vu… |
CVE-2023-50376 | High | 7.1 | 2023-12-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in smp7, wp.Insider Simple Membership allows Reflected XSS.T… |
CVE-2023-5432 | Medium | 6.4 | 2023-12-19 | The Jquery news ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'jquery-news-ticker' shortcode in versions up to, and including, 3… |
CVE-2023-5413 | Medium | 6.4 | 2023-12-19 | The Image horizontal reel scroll slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'ihrss-gallery' shortcode in versions up to, a… |
CVE-2023-42015 | Medium | 4.3 | 2023-12-19 | IBM UrbanCode Deploy (UCD) 7.1 through 7.1.2.14, 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 is vulnerable to HTML injection. This vulnerability may allow a u… |
CVE-2023-6940 | High | 8.8 | 2023-12-19 | with only one user interaction(download a malicious config), attackers can gain full command execution on the victim system. |
CVE-2023-6488 | Medium | 5.4 | 2023-12-19 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_button', 'su_members', an… |
CVE-2023-6315 | High | 7.8 | 2023-12-19 | Out-of-bouds read vulnerability in FPWin Pro version 7.7.0.0 and all previous versions may allow attackers to execute arbitrary code via a specially crafted pr… |
CVE-2023-6314 | High | 7.8 | 2023-12-19 | Stack-based buffer overflow in FPWin Pro version 7.7.0.0 and all previous versions may allow attackers to execute arbitrary code via a specially crafted projec… |
CVE-2023-44982 | Medium | 5.3 | 2023-12-19 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jordy Meow Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina).This is… |
CVE-2023-6918 | Low | 3.7 | 2023-12-19 | A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return valu… |
CVE-2023-49819 | High | 7.5 | 2023-12-19 | Deserialization of Untrusted Data vulnerability in Gordon Böhme, Antonio Leutsch Structured Content (JSON-LD) #wpsc.This issue affects Structured Content (JSON… |
CVE-2023-48751 | Medium | 4.3 | 2023-12-19 | Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database allows Accessing Functionality No… |
CVE-2023-47754 | Medium | 4.3 | 2023-12-19 | Missing Authorization vulnerability in Clever plugins Delete Duplicate Posts allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects… |
CVE-2023-46212 | Medium | 6.3 | 2023-12-19 | Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in TienCOP WP EXtra allows Accessing Functionality Not Properly Constrained by ACLs, Cro… |
CVE-2023-46154 | Medium | 6.6 | 2023-12-19 | Deserialization of Untrusted Data vulnerability in E2Pdf.Com E2Pdf – Export To Pdf Tool for WordPress.This issue affects E2Pdf – Export To Pdf Tool for WordPre… |
CVE-2023-6927 | Medium | 4.6 | 2023-12-18 | A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode "… |
CVE-2023-49821 | Medium | 5.4 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in LiveChat LiveChat – WP live chat plugin for WordPress.This issue affects LiveChat – WP live chat plugin for… |
CVE-2023-49763 | Medium | 4.3 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Creatomatic Ltd CSprite.This issue affects CSprite: from n/a through 1.1. |
CVE-2023-49761 | Medium | 5.4 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Gravity Master Product Enquiry for WooCommerce.This issue affects Product Enquiry for WooCommerce: from n/a… |