2023 CVEs (page 83)
Page 83 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-6817 | High | 7.8 | 2023-12-18 | A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The function nft_p… |
CVE-2023-6778 | Medium | 5.4 | 2023-12-18 | Cross-site Scripting (XSS) - Stored in GitHub repository allegroai/clearml-server prior to 1.13.0. |
CVE-2023-49853 | Medium | 5.4 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. PayTR Taksit Tablosu – WooCommerce.This issue affects PayTR Tak… |
CVE-2023-49844 | Medium | 4.3 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Kevin Ohashi WPPerformanceTester.This issue affects WPPerformanceTester: from n/a through 2.0.0. |
CVE-2023-49843 | Medium | 5.4 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in QuanticEdge First Order Discount Woocommerce.This issue affects First Order Discount Woocommerce: from n/a t… |
CVE-2023-49840 | Medium | 4.3 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Palscode Multi Currency For WooCommerce.This issue affects Multi Currency For WooCommerce: from n/a through… |
CVE-2023-46177 | Medium | 6.5 | 2023-12-18 | IBM MQ Appliance 9.3 LTS and 9.3 CD could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL reques… |
CVE-2023-6228 | Low | 3.3 | 2023-12-18 | An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on processing may cause a heap-based buffer overflow lead… |
CVE-2023-5384 | High | 7.2 | 2023-12-18 | A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with connection pooling… |
CVE-2023-5236 | Medium | 4.4 | 2023-12-18 | A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions coul… |
CVE-2023-5115 | Medium | 6.3 | 2023-12-18 | An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim… |
CVE-2023-5056 | Medium | 6.8 | 2023-12-18 | A flaw was found in the Skupper operator, which may permit a certain configuration to create a service account that would allow an authenticated attacker in th… |
CVE-2023-4320 | High | 7.6 | 2023-12-18 | An arithmetic overflow flaw was found in Satellite when creating a new personal access token. This flaw allows an attacker who uses this arithmetic overflow to… |
CVE-2023-47038 | High | 7.0 | 2023-12-18 | A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker c… |
CVE-2023-3629 | Medium | 4.3 | 2023-12-18 | A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could a… |
CVE-2023-3628 | Medium | 6.5 | 2023-12-18 | A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated… |
CVE-2023-3430 | High | 7.5 | 2023-12-18 | A vulnerability was found in OpenImageIO, where a heap buffer overflow exists in the src/gif.imageio/gifinput.cpp file. This flaw allows a remote attacker to p… |
CVE-2023-39509 | High | 7.2 | 2023-12-18 | A command injection vulnerability exists in Bosch IP cameras that allows an authenticated user with administrative rights to run arbitrary commands on the OS o… |
CVE-2023-35867 | Medium | 5.9 | 2023-12-18 | An improper handling of a malformed API answer packets to API clients in Bosch BT software products can allow an unauthenticated attacker to cause a Denial of… |
CVE-2023-32230 | High | 7.5 | 2023-12-18 | An improper handling of a malformed API request to an API server in Bosch BT software products can allow an unauthenticated attacker to cause a Denial of Servi… |
CVE-2023-28053 | Medium | 5.3 | 2023-12-18 | Dell NetWorker Virtual Edition versions 19.8 and below contain the use of deprecated cryptographic algorithms in the SSH component. A remote unauthenticated a… |
CVE-2023-50372 | Medium | 4.3 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Hiroaki Miyashita Custom Post Type Page Template.This issue affects Custom Post Type Page Template: from n/a… |
CVE-2023-49855 | Medium | 6.5 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in BinaryCarpenter Menu Bar Cart Icon For WooCommerce By Binary Carpenter.This issue affects Menu Bar Cart Icon… |
CVE-2023-49854 | Medium | 5.4 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in Tribe Interactive Caddy – Smart Side Cart for WooCommerce.This issue affects Caddy – Smart Side Cart for Woo… |
CVE-2023-32728 | Medium | 4.6 | 2023-12-18 | The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote… |
CVE-2023-32727 | Medium | 6.8 | 2023-12-18 | An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execute arbitrary code o… |
CVE-2023-32726 | Low | 3.9 | 2023-12-18 | The vulnerability is caused by improper check for check if RDLENGTH does not overflow the buffer in response from DNS server. |
CVE-2023-32725 | Critical | 9.6 | 2023-12-18 | The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be use… |
CVE-2023-6911 | Medium | 4.8 | 2023-12-18 | Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an… |
CVE-2023-41314 | High | 8.2 | 2023-12-18 | The api /api/snapshot and /api/get_log_file would allow unauthenticated access. It could allow a DoS attack or get arbitrary files from FE node. Please upgrade… |
CVE-2023-6483 | Critical | 9.1 | 2023-12-18 | The vulnerability exists in ADiTaaS (Allied Digital Integrated Tool-as-a-Service) version 5.1 due to an improper authentication vulnerability in the ADiTaaS ba… |
CVE-2023-6909 | High | 7.5 | 2023-12-18 | Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. |
CVE-2023-6908 | Low | 3.1 | 2023-12-18 | A vulnerability, which was classified as problematic, was found in DFIRKuiper Kuiper 2.3.4. This affects the function unzip_file of the file kuiper/app/control… |
CVE-2023-6907 | Medium | 5.4 | 2023-12-18 | A vulnerability has been found in codelyfe Stupid Simple CMS up to 1.2.4 and classified as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2023-6906 | Critical | 9.8 | 2023-12-18 | A vulnerability, which was classified as critical, was found in Totolink A7100RU 7.4cu.2313_B20191024. Affected is the function main of the file /cgi-bin/cstec… |
CVE-2023-50981 | High | 7.5 | 2023-12-18 | ModularSquareRoot in Crypto++ (aka cryptopp) through 8.9.0 allows attackers to cause a denial of service (infinite loop) via crafted DER public-key data associ… |
CVE-2023-50980 | High | 7.5 | 2023-12-18 | gf2n.cpp in Crypto++ (aka cryptopp) through 8.9.0 allows attackers to cause a denial of service (application crash) via DER public-key data for an F(2^m) curve… |
CVE-2023-50979 | Medium | 5.9 | 2023-12-18 | Crypto++ (aka cryptopp) through 8.9.0 has a Marvin side channel during decryption with PKCS#1 v1.5 padding. |
CVE-2023-6905 | Medium | 4.3 | 2023-12-18 | A vulnerability, which was classified as problematic, has been found in Jahastech NxFilter 4.3.2.5. This issue affects some unknown processing of the file user… |
CVE-2023-50976 | Critical | 9.8 | 2023-12-18 | Redpanda before 23.1.21 and 23.2.x before 23.2.18 has missing authorization checks in the Transactions API. |
CVE-2023-6904 | Medium | 4.3 | 2023-12-17 | A vulnerability classified as problematic was found in Jahastech NxFilter 4.3.2.5. This vulnerability affects unknown code of the file /config,admin.jsp. The m… |
CVE-2023-6903 | High | 7.3 | 2023-12-17 | A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3.1. This affects an unknown part of the file /admin/s… |
CVE-2023-3907 | Medium | 4.9 | 2023-12-17 | A privilege escalation vulnerability in GitLab EE affecting all versions from 16.0 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows a pro… |
CVE-2023-6902 | Medium | 5.5 | 2023-12-17 | A vulnerability has been found in codelyfe Stupid Simple CMS up to 1.2.4 and classified as critical. This vulnerability affects unknown code of the file /file-… |
CVE-2023-50271 | High | 7.2 | 2023-12-17 | A potential security vulnerability has been identified with HP-UX System Management Homepage (SMH). This vulnerability could be exploited locally or remotely… |
CVE-2023-6901 | High | 7.3 | 2023-12-17 | A vulnerability, which was classified as critical, was found in codelyfe Stupid Simple CMS up to 1.2.3. This affects an unknown part of the file /terminal/hand… |
CVE-2023-6900 | Medium | 4.6 | 2023-12-17 | A vulnerability, which was classified as critical, has been found in rmountjoy92 DashMachine 0.5-4. Affected by this issue is some unknown functionality of the… |
CVE-2023-6899 | Medium | 4.3 | 2023-12-17 | A vulnerability classified as problematic was found in rmountjoy92 DashMachine 0.5-4. Affected by this vulnerability is an unknown functionality of the file /s… |
CVE-2023-6898 | Medium | 5.5 | 2023-12-17 | A vulnerability classified as critical has been found in SourceCodester Best Courier Management System 1.0. Affected is an unknown function of the file manage_… |
CVE-2023-49834 | Medium | 5.4 | 2023-12-17 | Cross-Site Request Forgery (CSRF) vulnerability in realmag777 FOX – Currency Switcher Professional for WooCommerce.This issue affects FOX – Currency Switcher P… |
CVE-2023-49824 | Medium | 5.4 | 2023-12-17 | Cross-Site Request Forgery (CSRF) vulnerability in PixelYourSite Product Catalog Feed by PixelYourSite.This issue affects Product Catalog Feed by PixelYourSite… |
CVE-2023-49816 | Medium | 4.3 | 2023-12-17 | Cross-Site Request Forgery (CSRF) vulnerability in Innovative Solutions Fix My Feed RSS Repair.This issue affects Fix My Feed RSS Repair: from n/a through 1.4. |
CVE-2023-6896 | Low | 3.5 | 2023-12-17 | A vulnerability was found in SourceCodester Simple Image Stack Website 1.0. It has been rated as problematic. This issue affects some unknown processing. The m… |
CVE-2023-49775 | Medium | 4.3 | 2023-12-17 | Cross-Site Request Forgery (CSRF) vulnerability in Denis Kobozev CSV Importer.This issue affects CSV Importer: from n/a through 0.3.8. |
CVE-2023-49769 | Medium | 4.3 | 2023-12-17 | Cross-Site Request Forgery (CSRF) vulnerability in SoftLab Integrate Google Drive.This issue affects Integrate Google Drive: from n/a through 1.3.4. |
CVE-2023-49751 | Medium | 4.3 | 2023-12-17 | Cross-Site Request Forgery (CSRF) vulnerability in Ciprian Popescu Block for Font Awesome.This issue affects Block for Font Awesome: from n/a through 1.4.0. |
CVE-2023-24380 | Medium | 4.3 | 2023-12-17 | Cross-Site Request Forgery (CSRF) vulnerability in Webbjocke Simple Wp Sitemap.This issue affects Simple Wp Sitemap: from n/a through 1.2.1. |
CVE-2023-6895 | Medium | 6.3 | 2023-12-17 | A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK). It has been declared as critical. This vulnerability affects u… |
CVE-2023-6894 | Medium | 4.3 | 2023-12-17 | A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK). It has been classified as problematic. This affects an unknown… |
CVE-2023-6893 | Medium | 4.3 | 2023-12-17 | A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK) and classified as problematic. Affected by this issue is some u… |
CVE-2023-6891 | Medium | 5.3 | 2023-12-17 | A vulnerability has been found in PeaZip 9.4.0 and classified as problematic. Affected by this vulnerability is an unknown functionality in the library dragdro… |
CVE-2023-50965 | Critical | 9.8 | 2023-12-17 | In MicroHttpServer (aka Micro HTTP Server) through 4398570, _ReadStaticFiles in lib/middleware.c allows a stack-based buffer overflow and potentially remote co… |
CVE-2023-6888 | Medium | 6.3 | 2023-12-17 | A vulnerability classified as critical was found in PHZ76 RtspServer 1.0.0. This vulnerability affects the function ParseRequestLine of the file RtspMesaage.cp… |
CVE-2023-6887 | Medium | 6.3 | 2023-12-17 | A vulnerability classified as critical has been found in saysky ForestBlog up to 20220630. This affects an unknown part of the file /admin/upload/img of the co… |
CVE-2023-6886 | Medium | 4.7 | 2023-12-17 | A vulnerability was found in xnx3 wangmarket 6.1. It has been rated as critical. Affected by this issue is some unknown functionality of the component Role Man… |
CVE-2023-6885 | Medium | 5.5 | 2023-12-16 | A vulnerability was found in Tongda OA 2017 up to 11.10. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the fi… |
CVE-2023-50784 | High | 7.5 | 2023-12-16 | A buffer overflow in websockets in UnrealIRCd 6.1.0 through 6.1.3 before 6.1.4 allows an unauthenticated remote attacker to crash the server by sending an over… |
CVE-2023-6559 | High | 7.5 | 2023-12-16 | The MW WP Form plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 5.0.3. This is due to the plugin not properl… |
CVE-2023-6853 | Medium | 6.3 | 2023-12-16 | A vulnerability classified as critical was found in kalcaddle KodExplorer up to 4.51.03. Affected by this vulnerability is the function index of the file plugi… |
CVE-2023-6852 | Medium | 6.3 | 2023-12-16 | A vulnerability classified as critical has been found in kalcaddle KodExplorer up to 4.51.03. Affected is an unknown function of the file plugins/webodf/app.ph… |
CVE-2023-6851 | Medium | 6.3 | 2023-12-16 | A vulnerability was found in kalcaddle KodExplorer up to 4.51.03. It has been rated as critical. This issue affects the function unzipList of the file plugins/… |
CVE-2023-6890 | Medium | 5.4 | 2023-12-16 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.17. |
CVE-2023-6889 | Medium | 5.4 | 2023-12-16 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.17. |
CVE-2023-6850 | Medium | 6.3 | 2023-12-16 | A vulnerability was found in kalcaddle KodExplorer up to 4.51.03. It has been declared as critical. This vulnerability affects unknown code of the file /index… |
CVE-2023-6849 | High | 7.3 | 2023-12-16 | A vulnerability was found in kalcaddle kodbox up to 1.48. It has been rated as critical. Affected by this issue is the function cover of the file plugins/fileT… |
CVE-2023-6848 | High | 7.3 | 2023-12-16 | A vulnerability was found in kalcaddle kodbox up to 1.48. It has been declared as critical. Affected by this vulnerability is the function check of the file pl… |
CVE-2023-39340 | High | 7.5 | 2023-12-16 | A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker can send a specific request which may lead to Denial of Service… |
CVE-2023-28022 | Low | 3.5 | 2023-12-15 | HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, cau… |
CVE-2023-27317 | Medium | 4.3 | 2023-12-15 | ONTAP 9 versions 9.12.1P8, 9.13.1P4, and 9.13.1P5 are susceptible to a vulnerability which will cause all SAS-attached FIPS 140-2 drives to become unlocked a… |
CVE-2023-50728 | Medium | 5.4 | 2023-12-15 | octokit/webhooks is a GitHub webhook events toolset for Node.js. Starting in 9.26.0 and prior to 9.26.3, 10.9.2, 11.1.2, and 12.0.4, there is a problem caused… |
CVE-2023-50469 | Critical | 9.8 | 2023-12-15 | Shenzhen Libituo Technology Co., Ltd LBT-T300-T310 v2.2.2.6 was discovered to contain a buffer overflow via the ApCliEncrypType parameter at /apply.cgi. |
CVE-2023-50266 | Medium | 5.3 | 2023-12-15 | Bazarr manages and downloads subtitles. In version 1.2.4, the proxy method in bazarr/bazarr/app/ui.py does not validate the user-controlled protocol and url va… |
CVE-2023-50265 | High | 7.5 | 2023-12-15 | Bazarr manages and downloads subtitles. Prior to 1.3.1, the /api/swaggerui/static endpoint in bazarr/app/ui.py does not validate the user-controlled filename v… |
CVE-2023-50264 | High | 7.5 | 2023-12-15 | Bazarr manages and downloads subtitles. Prior to 1.3.1, Bazarr contains an arbitrary file read in /system/backup/download/ endpoint in bazarr/app/ui.py does no… |
CVE-2023-4020 | Critical | 9.0 | 2023-12-15 | An unvalidated input in a library function responsible for communicating between secure and non-secure memory in Silicon Labs TrustZone implementation allows r… |
CVE-2023-50723 | Critical | 9.9 | 2023-12-15 | XWiki Platform is a generic wiki platform. Starting in 2.3 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, anyone who can edit an arbitrary wiki page in… |
CVE-2023-50722 | Critical | 9.6 | 2023-12-15 | XWiki Platform is a generic wiki platform. Starting in 2.3 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, there is a reflected XSS or also direct remot… |
CVE-2023-50721 | Critical | 9.9 | 2023-12-15 | XWiki Platform is a generic wiki platform. Starting in 4.5-rc-1 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the search administration interface does… |
CVE-2023-50720 | Medium | 5.3 | 2023-12-15 | XWiki Platform is a generic wiki platform. Prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the email addresses of u… |
CVE-2023-50719 | High | 7.5 | 2023-12-15 | XWiki Platform is a generic wiki platform. Starting in 7.2-milestone-2 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki di… |
CVE-2023-50918 | Critical | 9.8 | 2023-12-15 | app/Controller/AuditLogsController.php in MISP before 2.4.182 mishandles ACLs for audit logs. |
CVE-2023-50917 | Critical | 9.8 | 2023-12-15 | MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mail… |
CVE-2023-50089 | Critical | 9.8 | 2023-12-15 | A Command Injection vulnerability exists in NETGEAR WNR2000v4 version 1.0.0.70. When using HTTP for SOAP authentication, command execution occurs during the pr… |
CVE-2023-6680 | High | 7.4 | 2023-12-15 | An improper certificate validation issue in Smartcard authentication in GitLab EE affecting all versions from 11.6 prior to 16.4.4, 16.5 prior to 16.5.4, and 1… |
CVE-2023-6051 | Medium | 5.7 | 2023-12-15 | An issue has been discovered in GitLab CE/EE affecting all versions before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16… |
CVE-2023-5512 | Medium | 4.8 | 2023-12-15 | An issue has been discovered in GitLab CE/EE affecting all versions from 16.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starti… |
CVE-2023-5310 | Medium | 5.7 | 2023-12-15 | A denial of service vulnerability exists in all Silicon Labs Z-Wave controller and endpoint devices running Z-Wave SDK v7.20.3 (Gecko SDK v4.3.3) and earlier… |
CVE-2023-5061 | Medium | 4.3 | 2023-12-15 | An issue has been discovered in GitLab affecting all versions starting from 9.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions star… |
CVE-2023-49829 | Medium | 5.9 | 2023-12-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS – eLearning and online course solution… |
CVE-2023-49823 | Medium | 6.5 | 2023-12-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldThemes Bold Page Builder allows Stored XSS.This issue… |