2023 CVEs (page 83)
Page 83 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-49760 | Medium | 5.4 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Giannopoulos Kostas WPsoonOnlinePage.This issue affects WPsoonOnlinePage: from n/a through 1.9. |
CVE-2023-49759 | Medium | 5.4 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team WooDiscuz – WooCommerce Comments.This issue affects WooDiscuz – WooCommerce Comments: from n/a… |
CVE-2023-49163 | Medium | 5.4 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Michael Winkler teachPress.This issue affects teachPress: from n/a through 9.0.5. |
CVE-2023-49155 | Medium | 4.3 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Button Generator – easily Button Builder.This issue affects Button Generator – easily Button Bui… |
CVE-2023-49153 | Medium | 4.3 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Saiful Islam Add to Cart Text Changer and Customize Button, Add Custom Icon.This issue affects Add to Cart T… |
CVE-2023-47558 | High | 7.6 | 2023-12-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mahlamusa Who Hit The Page – Hit Counter allows SQL Injec… |
CVE-2023-47530 | High | 7.6 | 2023-12-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPVibes Redirect 404 Error Page to Homepage or Custom Pag… |
CVE-2023-47506 | High | 7.6 | 2023-12-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Master slider Master Slider Pro allows SQL Injection.This… |
CVE-2023-34168 | High | 7.6 | 2023-12-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alex Raven WP Report Post allows SQL Injection.This issue… |
CVE-2023-33331 | High | 8.5 | 2023-12-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce Product Vendors allows SQL Injection.This iss… |
CVE-2023-6355 | Medium | 6.8 | 2023-12-18 | Incorrect selection of fuse values in the Controller 7000 platform allows an attacker to bypass some protection mechanisms to enable local debug. This issue… |
CVE-2023-49148 | Medium | 5.4 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Kulwant Nagi Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates.This issue affects Affil… |
CVE-2023-48781 | Medium | 4.3 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Marketing Rapel MkRapel Regiones y Ciudades de Chile para WC.This issue affects MkRapel Regiones y Ciudades… |
CVE-2023-48778 | Medium | 5.4 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Product Size Chart For WooCommerce.This issue affects Product Size Chart For WooCommerce: from n/… |
CVE-2023-48773 | Medium | 5.4 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in WP Doctor WooCommerce Login Redirect.This issue affects WooCommerce Login Redirect: from n/a through 2.2.4. |
CVE-2023-48772 | Medium | 5.4 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Arul Prasad J Prevent Landscape Rotation.This issue affects Prevent Landscape Rotation: from n/a through 2.0. |
CVE-2023-48769 | Medium | 4.3 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Blue Coral Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back… |
CVE-2023-48768 | Medium | 4.3 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in CodeAstrology Team Quantity Plus Minus Button for WooCommerce by CodeAstrology.This issue affects Quantity P… |
CVE-2023-46686 | Medium | 5.5 | 2023-12-18 | A reliance on untrusted inputs in a security decision could be exploited by a privileged user to configure the Gallagher Command Centre Diagnostics Service to… |
CVE-2023-41967 | Low | 2.4 | 2023-12-18 | Sensitive information uncleared after debug/power state transition in the Controller 6000 could be abused by an attacker with knowledge of the Controller's de… |
CVE-2023-24590 | High | 7.5 | 2023-12-18 | A format string issue in the Controller 6000's optional diagnostic web interface can be used to write/read from memory, and in some instances crash the Cont… |
CVE-2023-23584 | Medium | 4.3 | 2023-12-18 | An observable response discrepancy in the Gallagher Command Centre RESTAPI allows an insufficiently-privileged user to infer the presence of items that would… |
CVE-2023-23576 | Medium | 4.3 | 2023-12-18 | Incorrect behavior order in the Command Centre Server could allow privileged users to gain physical access to the site for longer than intended after a networ… |
CVE-2023-23570 | Medium | 5.4 | 2023-12-18 | Client-Side enforcement of Server-Side security for the Command Centre server could be bypassed and lead to invalid configuration with undefined behavior. T… |
CVE-2023-22439 | Low | 3.1 | 2023-12-18 | Improper input validation of a large HTTP request in the Controller 6000 and Controller 7000 optional diagnostic web interface (Port 80) can be used to perfor… |
CVE-2023-40691 | Medium | 4.9 | 2023-12-18 | IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 may re… |
CVE-2023-6295 | High | 7.2 | 2023-12-18 | The SiteOrigin Widgets Bundle WordPress plugin before 1.51.0 does not validate user input before using it to generate paths passed to include function/s, allow… |
CVE-2023-6289 | Medium | 4.3 | 2023-12-18 | The Swift Performance Lite WordPress plugin before 2.3.6.15 does not prevent users from exporting the plugin's settings, which may include sensitive informatio… |
CVE-2023-6272 | Critical | 9.8 | 2023-12-18 | The Theme My Login 2FA WordPress plugin before 1.2 does not rate limit 2FA validation attempts, which may allow an attacker to brute-force all possibilities, w… |
CVE-2023-6222 | High | 7.2 | 2023-12-18 | IThe Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 does not validate user input used in a path, which could allow users with an admin role to per… |
CVE-2023-6203 | High | 7.5 | 2023-12-18 | The Events Calendar WordPress plugin before 6.2.8.1 discloses the content of password protected posts to unauthenticated users via a crafted request |
CVE-2023-6077 | Medium | 6.5 | 2023-12-18 | The Slider WordPress plugin before 3.5.12 does not ensure that posts to be accessed via an AJAX action are slides and can be viewed by the user making the requ… |
CVE-2023-6065 | Medium | 5.3 | 2023-12-18 | The Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 doesn't restrict access to detailed scan logs, which allows a malicious actor to discover local… |
CVE-2023-5949 | High | 7.5 | 2023-12-18 | The SmartCrawl WordPress plugin before 3.8.3 does not prevent unauthorised users from accessing password-protected posts' content. |
CVE-2023-5886 | High | 8.8 | 2023-12-18 | The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enoug… |
CVE-2023-5882 | High | 8.8 | 2023-12-18 | The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enoug… |
CVE-2023-5348 | Medium | 6.1 | 2023-12-18 | The Product Catalog Mode For WooCommerce WordPress plugin before 5.0.3 does not properly authorize settings updates or escape settings values, leading to store… |
CVE-2023-5005 | Medium | 4.8 | 2023-12-18 | The Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro WordPress plugin before 2.0 does not… |
CVE-2023-4724 | High | 7.2 | 2023-12-18 | The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not validate and sanitise the `wp_… |
CVE-2023-4311 | High | 8.8 | 2023-12-18 | The Vrm 360 3D Model Viewer WordPress plugin through 1.2.1 is vulnerable to arbitrary file upload due to insufficient checks in a plugin shortcode. |
CVE-2023-47741 | Medium | 5.3 | 2023-12-18 | IBM i 7.3, 7.4, 7.5, IBM i Db2 Mirror for i 7.4 and 7.5 web browser clients may leave clear-text passwords in browser memory that can be viewed using common b… |
CVE-2023-51385 | Medium | 6.5 | 2023-12-18 | In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansio… |
CVE-2023-51384 | Medium | 5.5 | 2023-12-18 | In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of… |
CVE-2023-6691 | High | 7.8 | 2023-12-18 | Cambium ePMP Force 300-25 version 4.7.0.1 is vulnerable to a code injection vulnerability that could allow an attacker to perform remote code execution and ga… |
CVE-2023-48766 | Medium | 4.3 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in SVGator SVGator – Add Animated SVG Easily.This issue affects SVGator – Add Animated SVG Easily: from n/a thr… |
CVE-2023-48762 | Medium | 6.3 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.13. |
CVE-2023-46617 | Medium | 5.4 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in AdFoxly AdFoxly – Ad Manager, AdSense Ads & Ads.Txt.This issue affects AdFoxly – Ad Manager, AdSense Ads & A… |
CVE-2023-48795 | Medium | 5.9 | 2023-12-18 | The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks… |
CVE-2023-48755 | Medium | 4.3 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Michael Winkler teachPress.This issue affects teachPress: from n/a through 9.0.4. |
CVE-2023-47806 | Medium | 5.4 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Saint Systems Disable User Login.This issue affects Disable User Login: from n/a through 1.3.7. |
CVE-2023-47789 | Medium | 4.3 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Canada Post Shipping Method.This issue affects Canada Post Shipping Method: from n/a through 2.8… |
CVE-2023-47787 | Medium | 4.3 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Bookings.This issue affects WooCommerce Bookings: from n/a through 2.0.3. |
CVE-2023-33214 | Medium | 5.4 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Tagbox Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics.This issue affects Tagbox – UG… |
CVE-2023-6817 | High | 7.8 | 2023-12-18 | A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The function nft_p… |
CVE-2023-6778 | Medium | 5.4 | 2023-12-18 | Cross-site Scripting (XSS) - Stored in GitHub repository allegroai/clearml-server prior to 1.13.0. |
CVE-2023-49853 | Medium | 5.4 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. PayTR Taksit Tablosu – WooCommerce.This issue affects PayTR Tak… |
CVE-2023-49844 | Medium | 4.3 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Kevin Ohashi WPPerformanceTester.This issue affects WPPerformanceTester: from n/a through 2.0.0. |
CVE-2023-49843 | Medium | 5.4 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in QuanticEdge First Order Discount Woocommerce.This issue affects First Order Discount Woocommerce: from n/a t… |
CVE-2023-49840 | Medium | 4.3 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Palscode Multi Currency For WooCommerce.This issue affects Multi Currency For WooCommerce: from n/a through… |
CVE-2023-46177 | Medium | 6.5 | 2023-12-18 | IBM MQ Appliance 9.3 LTS and 9.3 CD could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL reques… |
CVE-2023-6228 | Low | 3.3 | 2023-12-18 | An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on processing may cause a heap-based buffer overflow lead… |
CVE-2023-5384 | High | 7.2 | 2023-12-18 | A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with connection pooling… |
CVE-2023-5236 | Medium | 4.4 | 2023-12-18 | A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions coul… |
CVE-2023-5115 | Medium | 6.3 | 2023-12-18 | An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim… |
CVE-2023-5056 | Medium | 6.8 | 2023-12-18 | A flaw was found in the Skupper operator, which may permit a certain configuration to create a service account that would allow an authenticated attacker in th… |
CVE-2023-4320 | High | 7.6 | 2023-12-18 | An arithmetic overflow flaw was found in Satellite when creating a new personal access token. This flaw allows an attacker who uses this arithmetic overflow to… |
CVE-2023-47038 | High | 7.0 | 2023-12-18 | A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker c… |
CVE-2023-3629 | Medium | 4.3 | 2023-12-18 | A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could a… |
CVE-2023-3628 | Medium | 6.5 | 2023-12-18 | A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated… |
CVE-2023-3430 | High | 7.5 | 2023-12-18 | A vulnerability was found in OpenImageIO, where a heap buffer overflow exists in the src/gif.imageio/gifinput.cpp file. This flaw allows a remote attacker to p… |
CVE-2023-39509 | High | 7.2 | 2023-12-18 | A command injection vulnerability exists in Bosch IP cameras that allows an authenticated user with administrative rights to run arbitrary commands on the OS o… |
CVE-2023-35867 | Medium | 5.9 | 2023-12-18 | An improper handling of a malformed API answer packets to API clients in Bosch BT software products can allow an unauthenticated attacker to cause a Denial of… |
CVE-2023-32230 | High | 7.5 | 2023-12-18 | An improper handling of a malformed API request to an API server in Bosch BT software products can allow an unauthenticated attacker to cause a Denial of Servi… |
CVE-2023-28053 | Medium | 5.3 | 2023-12-18 | Dell NetWorker Virtual Edition versions 19.8 and below contain the use of deprecated cryptographic algorithms in the SSH component. A remote unauthenticated a… |
CVE-2023-50372 | Medium | 4.3 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Hiroaki Miyashita Custom Post Type Page Template.This issue affects Custom Post Type Page Template: from n/a… |
CVE-2023-49855 | Medium | 6.5 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in BinaryCarpenter Menu Bar Cart Icon For WooCommerce By Binary Carpenter.This issue affects Menu Bar Cart Icon… |
CVE-2023-49854 | Medium | 5.4 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Tribe Interactive Caddy – Smart Side Cart for WooCommerce.This issue affects Caddy – Smart Side Cart for Woo… |
CVE-2023-32728 | Medium | 4.6 | 2023-12-18 | The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote… |
CVE-2023-32727 | Medium | 6.8 | 2023-12-18 | An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execute arbitrary code o… |
CVE-2023-32726 | Low | 3.9 | 2023-12-18 | The vulnerability is caused by improper check for check if RDLENGTH does not overflow the buffer in response from DNS server. |
CVE-2023-32725 | Critical | 9.6 | 2023-12-18 | The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be use… |
CVE-2023-6911 | Medium | 4.8 | 2023-12-18 | Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an… |
CVE-2023-41314 | High | 8.2 | 2023-12-18 | The api /api/snapshot and /api/get_log_file would allow unauthenticated access. It could allow a DoS attack or get arbitrary files from FE node. Please upgrade… |
CVE-2023-6483 | Critical | 9.1 | 2023-12-18 | The vulnerability exists in ADiTaaS (Allied Digital Integrated Tool-as-a-Service) version 5.1 due to an improper authentication vulnerability in the ADiTaaS ba… |
CVE-2023-6909 | High | 7.5 | 2023-12-18 | Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. |
CVE-2023-6908 | Low | 3.1 | 2023-12-18 | A vulnerability, which was classified as problematic, was found in DFIRKuiper Kuiper 2.3.4. This affects the function unzip_file of the file kuiper/app/control… |
CVE-2023-6907 | Medium | 5.4 | 2023-12-18 | A vulnerability has been found in codelyfe Stupid Simple CMS up to 1.2.4 and classified as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2023-6906 | Critical | 9.8 | 2023-12-18 | A vulnerability, which was classified as critical, was found in Totolink A7100RU 7.4cu.2313_B20191024. Affected is the function main of the file /cgi-bin/cstec… |
CVE-2023-50981 | High | 7.5 | 2023-12-18 | ModularSquareRoot in Crypto++ (aka cryptopp) through 8.9.0 allows attackers to cause a denial of service (infinite loop) via crafted DER public-key data associ… |
CVE-2023-50980 | High | 7.5 | 2023-12-18 | gf2n.cpp in Crypto++ (aka cryptopp) through 8.9.0 allows attackers to cause a denial of service (application crash) via DER public-key data for an F(2^m) curve… |
CVE-2023-50979 | Medium | 5.9 | 2023-12-18 | Crypto++ (aka cryptopp) through 8.9.0 has a Marvin side channel during decryption with PKCS#1 v1.5 padding. |
CVE-2023-6905 | Medium | 4.3 | 2023-12-18 | A vulnerability, which was classified as problematic, has been found in Jahastech NxFilter 4.3.2.5. This issue affects some unknown processing of the file user… |
CVE-2023-50976 | Critical | 9.8 | 2023-12-18 | Redpanda before 23.1.21 and 23.2.x before 23.2.18 has missing authorization checks in the Transactions API. |
CVE-2023-6904 | Medium | 4.3 | 2023-12-17 | A vulnerability classified as problematic was found in Jahastech NxFilter 4.3.2.5. This vulnerability affects unknown code of the file /config,admin.jsp. The m… |
CVE-2023-6903 | High | 7.3 | 2023-12-17 | A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3.1. This affects an unknown part of the file /admin/s… |
CVE-2023-3907 | Medium | 4.9 | 2023-12-17 | A privilege escalation vulnerability in GitLab EE affecting all versions from 16.0 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows a pro… |
CVE-2023-6902 | Medium | 5.5 | 2023-12-17 | A vulnerability has been found in codelyfe Stupid Simple CMS up to 1.2.4 and classified as critical. This vulnerability affects unknown code of the file /file-… |
CVE-2023-50271 | High | 7.2 | 2023-12-17 | A potential security vulnerability has been identified with HP-UX System Management Homepage (SMH). This vulnerability could be exploited locally or remotely… |
CVE-2023-6901 | High | 7.3 | 2023-12-17 | A vulnerability, which was classified as critical, was found in codelyfe Stupid Simple CMS up to 1.2.3. This affects an unknown part of the file /terminal/hand… |
CVE-2023-6900 | Medium | 4.6 | 2023-12-17 | A vulnerability, which was classified as critical, has been found in rmountjoy92 DashMachine 0.5-4. Affected by this issue is some unknown functionality of the… |