2023 CVEs (page 82)
Page 82 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-6873 | High | 8.8 | 2023-12-19 | Memory safety bugs present in Firefox 120. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could h… |
CVE-2023-6872 | Medium | 6.5 | 2023-12-19 | Browser tab titles were being leaked by GNOME to system logs. This could potentially expose the browsing habits of users running in a private tab. This vulnera… |
CVE-2023-6871 | Medium | 4.3 | 2023-12-19 | Under certain conditions, Firefox did not display a warning when a user attempted to navigate to a new protocol handler. This vulnerability affects Firefox < 1… |
CVE-2023-6870 | Medium | 4.3 | 2023-12-19 | Applications which spawn a Toast notification in a background thread may have obscured fullscreen notifications displayed by Firefox. *This issue only affects… |
CVE-2023-6869 | Medium | 6.5 | 2023-12-19 | A `<dialog>` element could have been manipulated to paint content outside of a sandboxed iframe. This could allow untrusted content to display under the gui… |
CVE-2023-6868 | Medium | 4.3 | 2023-12-19 | In some instances, the user-agent would allow push requests which lacked a valid VAPID even though the push manager subscription defined one. This could allow… |
CVE-2023-6867 | Medium | 6.1 | 2023-12-19 | The timing of a button click causing a popup to disappear was approximately the same length as the anti-clickjacking delay on permission prompts. It was possib… |
CVE-2023-6866 | High | 8.8 | 2023-12-19 | TypedArrays can be fallible and lacked proper exception handling. This could lead to abuse in other APIs which expect TypedArrays to always succeed. This vulne… |
CVE-2023-6865 | Medium | 6.5 | 2023-12-19 | `EncryptingOutputStream` was susceptible to exposing uninitialized data. This issue could only be abused in order to write data to a local disk which may have… |
CVE-2023-6864 | High | 8.8 | 2023-12-19 | Memory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. Some of these bugs showed evidence of memory corruption and we presume tha… |
CVE-2023-6863 | High | 8.8 | 2023-12-19 | The `ShutdownObserver()` was susceptible to potentially undefined behavior due to its reliance on a dynamic type that lacked a virtual destructor. This vulnera… |
CVE-2023-6862 | High | 8.8 | 2023-12-19 | A use-after-free was identified in the `nsDNSService::Init`. This issue appears to manifest rarely during start-up. This vulnerability affects Firefox ESR < 1… |
CVE-2023-6861 | High | 8.8 | 2023-12-19 | The `nsWindow::PickerOpen(void)` method was susceptible to a heap buffer overflow when running in headless mode. This vulnerability affects Firefox ESR < 115.6… |
CVE-2023-6860 | Medium | 6.5 | 2023-12-19 | The `VideoBridge` allowed any content process to use textures produced by remote decoders. This could be abused to escape the sandbox. This vulnerability affe… |
CVE-2023-6859 | High | 8.8 | 2023-12-19 | A use-after-free condition affected TLS socket creation when under memory pressure. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Fi… |
CVE-2023-6858 | High | 8.8 | 2023-12-19 | Firefox was susceptible to a heap buffer overflow in `nsTextFragment` due to insufficient OOM handling. This vulnerability affects Firefox ESR < 115.6, Thunder… |
CVE-2023-6857 | Medium | 5.3 | 2023-12-19 | When resolving a symlink, a race may occur where the buffer passed to `readlink` may actually be smaller than necessary. *This bug only affects Firefox on Uni… |
CVE-2023-6856 | High | 8.8 | 2023-12-19 | The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow an att… |
CVE-2023-6135 | Medium | 4.3 | 2023-12-19 | Multiple NSS NIST curves were susceptible to a side-channel attack known as "Minerva". This attack could potentially allow an attacker to recover the private k… |
CVE-2023-50762 | Medium | 4.3 | 2023-12-19 | When processing a PGP/MIME payload that contains digitally signed text, the first paragraph of the text was never shown to the user. This is because the text w… |
CVE-2023-50761 | Medium | 4.3 | 2023-12-19 | The signature of a digitally signed S/MIME email message may optionally specify the signature creation date and time. If present, Thunderbird did not compare t… |
CVE-2023-6730 | High | 8.8 | 2023-12-19 | Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36. |
CVE-2023-6945 | Low | 2.4 | 2023-12-19 | A vulnerability has been found in SourceCodester Online Student Management System 1.0 and classified as problematic. Affected by this vulnerability is an unkno… |
CVE-2023-49736 | Medium | 6.5 | 2023-12-19 | A where_in JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow for SQL injection in Apache Superset.This… |
CVE-2023-49734 | High | 7.7 | 2023-12-19 | An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts al… |
CVE-2023-49489 | Medium | 6.1 | 2023-12-19 | Reflective Cross Site Scripting (XSS) vulnerability in KodExplorer version 4.51, allows attackers to obtain sensitive information and escalate privileges via t… |
CVE-2023-49006 | Medium | 6.5 | 2023-12-19 | Cross Site Request Forgery (CSRF) vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the… |
CVE-2023-46104 | Medium | 6.5 | 2023-12-19 | Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vu… |
CVE-2023-50376 | High | 7.1 | 2023-12-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in smp7, wp.Insider Simple Membership allows Reflected XSS.T… |
CVE-2023-5432 | Medium | 6.4 | 2023-12-19 | The Jquery news ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'jquery-news-ticker' shortcode in versions up to, and including, 3… |
CVE-2023-5413 | Medium | 6.4 | 2023-12-19 | The Image horizontal reel scroll slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'ihrss-gallery' shortcode in versions up to, a… |
CVE-2023-42015 | Medium | 4.3 | 2023-12-19 | IBM UrbanCode Deploy (UCD) 7.1 through 7.1.2.14, 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 is vulnerable to HTML injection. This vulnerability may allow a u… |
CVE-2023-6940 | High | 8.8 | 2023-12-19 | with only one user interaction(download a malicious config), attackers can gain full command execution on the victim system. |
CVE-2023-6488 | Medium | 5.4 | 2023-12-19 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_button', 'su_members', an… |
CVE-2023-6315 | High | 7.8 | 2023-12-19 | Out-of-bouds read vulnerability in FPWin Pro version 7.7.0.0 and all previous versions may allow attackers to execute arbitrary code via a specially crafted pr… |
CVE-2023-6314 | High | 7.8 | 2023-12-19 | Stack-based buffer overflow in FPWin Pro version 7.7.0.0 and all previous versions may allow attackers to execute arbitrary code via a specially crafted projec… |
CVE-2023-44982 | Medium | 5.3 | 2023-12-19 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jordy Meow Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina).This is… |
CVE-2023-6918 | Low | 3.7 | 2023-12-19 | A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return valu… |
CVE-2023-49819 | High | 7.5 | 2023-12-19 | Deserialization of Untrusted Data vulnerability in Gordon Böhme, Antonio Leutsch Structured Content (JSON-LD) #wpsc.This issue affects Structured Content (JSON… |
CVE-2023-48751 | Medium | 4.3 | 2023-12-19 | Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database allows Accessing Functionality No… |
CVE-2023-47754 | Medium | 4.3 | 2023-12-19 | Missing Authorization vulnerability in Clever plugins Delete Duplicate Posts allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects… |
CVE-2023-46212 | Medium | 6.3 | 2023-12-19 | Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in TienCOP WP EXtra allows Accessing Functionality Not Properly Constrained by ACLs, Cro… |
CVE-2023-46154 | Medium | 6.6 | 2023-12-19 | Deserialization of Untrusted Data vulnerability in E2Pdf.Com E2Pdf – Export To Pdf Tool for WordPress.This issue affects E2Pdf – Export To Pdf Tool for WordPre… |
CVE-2023-6927 | Medium | 4.6 | 2023-12-18 | A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode "… |
CVE-2023-49821 | Medium | 5.4 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in LiveChat LiveChat – WP live chat plugin for WordPress.This issue affects LiveChat – WP live chat plugin for… |
CVE-2023-49763 | Medium | 4.3 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Creatomatic Ltd CSprite.This issue affects CSprite: from n/a through 1.1. |
CVE-2023-49761 | Medium | 5.4 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Gravity Master Product Enquiry for WooCommerce.This issue affects Product Enquiry for WooCommerce: from n/a… |
CVE-2023-49760 | Medium | 5.4 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Giannopoulos Kostas WPsoonOnlinePage.This issue affects WPsoonOnlinePage: from n/a through 1.9. |
CVE-2023-49759 | Medium | 5.4 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team WooDiscuz – WooCommerce Comments.This issue affects WooDiscuz – WooCommerce Comments: from n/a… |
CVE-2023-49163 | Medium | 5.4 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Michael Winkler teachPress.This issue affects teachPress: from n/a through 9.0.5. |
CVE-2023-49155 | Medium | 4.3 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Button Generator – easily Button Builder.This issue affects Button Generator – easily Button Bui… |
CVE-2023-49153 | Medium | 4.3 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Saiful Islam Add to Cart Text Changer and Customize Button, Add Custom Icon.This issue affects Add to Cart T… |
CVE-2023-47558 | High | 7.6 | 2023-12-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mahlamusa Who Hit The Page – Hit Counter allows SQL Injec… |
CVE-2023-47530 | High | 7.6 | 2023-12-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPVibes Redirect 404 Error Page to Homepage or Custom Pag… |
CVE-2023-47506 | High | 7.6 | 2023-12-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Master slider Master Slider Pro allows SQL Injection.This… |
CVE-2023-34168 | High | 7.6 | 2023-12-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alex Raven WP Report Post allows SQL Injection.This issue… |
CVE-2023-33331 | High | 8.5 | 2023-12-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce Product Vendors allows SQL Injection.This iss… |
CVE-2023-6355 | Medium | 6.8 | 2023-12-18 | Incorrect selection of fuse values in the Controller 7000 platform allows an attacker to bypass some protection mechanisms to enable local debug. This issue… |
CVE-2023-49148 | Medium | 5.4 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Kulwant Nagi Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates.This issue affects Affil… |
CVE-2023-48781 | Medium | 4.3 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Marketing Rapel MkRapel Regiones y Ciudades de Chile para WC.This issue affects MkRapel Regiones y Ciudades… |
CVE-2023-48778 | Medium | 5.4 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Product Size Chart For WooCommerce.This issue affects Product Size Chart For WooCommerce: from n/… |
CVE-2023-48773 | Medium | 5.4 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in WP Doctor WooCommerce Login Redirect.This issue affects WooCommerce Login Redirect: from n/a through 2.2.4. |
CVE-2023-48772 | Medium | 5.4 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Arul Prasad J Prevent Landscape Rotation.This issue affects Prevent Landscape Rotation: from n/a through 2.0. |
CVE-2023-48769 | Medium | 4.3 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Blue Coral Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back… |
CVE-2023-48768 | Medium | 4.3 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in CodeAstrology Team Quantity Plus Minus Button for WooCommerce by CodeAstrology.This issue affects Quantity P… |
CVE-2023-46686 | Medium | 5.5 | 2023-12-18 | A reliance on untrusted inputs in a security decision could be exploited by a privileged user to configure the Gallagher Command Centre Diagnostics Service to… |
CVE-2023-41967 | Low | 2.4 | 2023-12-18 | Sensitive information uncleared after debug/power state transition in the Controller 6000 could be abused by an attacker with knowledge of the Controller's de… |
CVE-2023-24590 | High | 7.5 | 2023-12-18 | A format string issue in the Controller 6000's optional diagnostic web interface can be used to write/read from memory, and in some instances crash the Cont… |
CVE-2023-23584 | Medium | 4.3 | 2023-12-18 | An observable response discrepancy in the Gallagher Command Centre RESTAPI allows an insufficiently-privileged user to infer the presence of items that would… |
CVE-2023-23576 | Medium | 4.3 | 2023-12-18 | Incorrect behavior order in the Command Centre Server could allow privileged users to gain physical access to the site for longer than intended after a networ… |
CVE-2023-23570 | Medium | 5.4 | 2023-12-18 | Client-Side enforcement of Server-Side security for the Command Centre server could be bypassed and lead to invalid configuration with undefined behavior. T… |
CVE-2023-22439 | Low | 3.1 | 2023-12-18 | Improper input validation of a large HTTP request in the Controller 6000 and Controller 7000 optional diagnostic web interface (Port 80) can be used to perfor… |
CVE-2023-40691 | Medium | 4.9 | 2023-12-18 | IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 may re… |
CVE-2023-6295 | High | 7.2 | 2023-12-18 | The SiteOrigin Widgets Bundle WordPress plugin before 1.51.0 does not validate user input before using it to generate paths passed to include function/s, allow… |
CVE-2023-6289 | Medium | 4.3 | 2023-12-18 | The Swift Performance Lite WordPress plugin before 2.3.6.15 does not prevent users from exporting the plugin's settings, which may include sensitive informatio… |
CVE-2023-6272 | Critical | 9.8 | 2023-12-18 | The Theme My Login 2FA WordPress plugin before 1.2 does not rate limit 2FA validation attempts, which may allow an attacker to brute-force all possibilities, w… |
CVE-2023-6222 | High | 7.2 | 2023-12-18 | IThe Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 does not validate user input used in a path, which could allow users with an admin role to per… |
CVE-2023-6203 | High | 7.5 | 2023-12-18 | The Events Calendar WordPress plugin before 6.2.8.1 discloses the content of password protected posts to unauthenticated users via a crafted request |
CVE-2023-6077 | Medium | 6.5 | 2023-12-18 | The Slider WordPress plugin before 3.5.12 does not ensure that posts to be accessed via an AJAX action are slides and can be viewed by the user making the requ… |
CVE-2023-6065 | Medium | 5.3 | 2023-12-18 | The Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 doesn't restrict access to detailed scan logs, which allows a malicious actor to discover local… |
CVE-2023-5949 | High | 7.5 | 2023-12-18 | The SmartCrawl WordPress plugin before 3.8.3 does not prevent unauthorised users from accessing password-protected posts' content. |
CVE-2023-5886 | High | 8.8 | 2023-12-18 | The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enoug… |
CVE-2023-5882 | High | 8.8 | 2023-12-18 | The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enoug… |
CVE-2023-5348 | Medium | 6.1 | 2023-12-18 | The Product Catalog Mode For WooCommerce WordPress plugin before 5.0.3 does not properly authorize settings updates or escape settings values, leading to store… |
CVE-2023-5005 | Medium | 4.8 | 2023-12-18 | The Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro WordPress plugin before 2.0 does not… |
CVE-2023-4724 | High | 7.2 | 2023-12-18 | The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not validate and sanitise the `wp_… |
CVE-2023-4311 | High | 8.8 | 2023-12-18 | The Vrm 360 3D Model Viewer WordPress plugin through 1.2.1 is vulnerable to arbitrary file upload due to insufficient checks in a plugin shortcode. |
CVE-2023-47741 | Medium | 5.3 | 2023-12-18 | IBM i 7.3, 7.4, 7.5, IBM i Db2 Mirror for i 7.4 and 7.5 web browser clients may leave clear-text passwords in browser memory that can be viewed using common b… |
CVE-2023-51385 | Medium | 6.5 | 2023-12-18 | In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansio… |
CVE-2023-51384 | Medium | 5.5 | 2023-12-18 | In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of… |
CVE-2023-6691 | High | 7.8 | 2023-12-18 | Cambium ePMP Force 300-25 version 4.7.0.1 is vulnerable to a code injection vulnerability that could allow an attacker to perform remote code execution and ga… |
CVE-2023-48766 | Medium | 4.3 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in SVGator SVGator – Add Animated SVG Easily.This issue affects SVGator – Add Animated SVG Easily: from n/a thr… |
CVE-2023-48762 | Medium | 6.3 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.13. |
CVE-2023-46617 | Medium | 5.4 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in AdFoxly AdFoxly – Ad Manager, AdSense Ads & Ads.Txt.This issue affects AdFoxly – Ad Manager, AdSense Ads & A… |
CVE-2023-48795 | Medium | 5.9 | 2023-12-18 | The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks… |
CVE-2023-48755 | Medium | 4.3 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Michael Winkler teachPress.This issue affects teachPress: from n/a through 9.0.4. |
CVE-2023-47806 | Medium | 5.4 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Saint Systems Disable User Login.This issue affects Disable User Login: from n/a through 1.3.7. |
CVE-2023-47789 | Medium | 4.3 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Canada Post Shipping Method.This issue affects Canada Post Shipping Method: from n/a through 2.8… |
CVE-2023-47787 | Medium | 4.3 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Bookings.This issue affects WooCommerce Bookings: from n/a through 2.0.3. |
CVE-2023-33214 | Medium | 5.4 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Tagbox Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics.This issue affects Tagbox – UG… |