2023 CVEs (page 84)
Page 84 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-6899 | Medium | 4.3 | 2023-12-17 | A vulnerability classified as problematic was found in rmountjoy92 DashMachine 0.5-4. Affected by this vulnerability is an unknown functionality of the file /s… |
CVE-2023-6898 | Medium | 5.5 | 2023-12-17 | A vulnerability classified as critical has been found in SourceCodester Best Courier Management System 1.0. Affected is an unknown function of the file manage_… |
CVE-2023-49834 | Medium | 5.4 | 2023-12-17 | Cross-Site Request Forgery (CSRF) vulnerability in realmag777 FOX – Currency Switcher Professional for WooCommerce.This issue affects FOX – Currency Switcher P… |
CVE-2023-49824 | Medium | 5.4 | 2023-12-17 | Cross-Site Request Forgery (CSRF) vulnerability in PixelYourSite Product Catalog Feed by PixelYourSite.This issue affects Product Catalog Feed by PixelYourSite… |
CVE-2023-49816 | Medium | 4.3 | 2023-12-17 | Cross-Site Request Forgery (CSRF) vulnerability in Innovative Solutions Fix My Feed RSS Repair.This issue affects Fix My Feed RSS Repair: from n/a through 1.4. |
CVE-2023-6896 | Low | 3.5 | 2023-12-17 | A vulnerability was found in SourceCodester Simple Image Stack Website 1.0. It has been rated as problematic. This issue affects some unknown processing. The m… |
CVE-2023-49775 | Medium | 4.3 | 2023-12-17 | Cross-Site Request Forgery (CSRF) vulnerability in Denis Kobozev CSV Importer.This issue affects CSV Importer: from n/a through 0.3.8. |
CVE-2023-49769 | Medium | 4.3 | 2023-12-17 | Cross-Site Request Forgery (CSRF) vulnerability in SoftLab Integrate Google Drive.This issue affects Integrate Google Drive: from n/a through 1.3.4. |
CVE-2023-49751 | Medium | 4.3 | 2023-12-17 | Cross-Site Request Forgery (CSRF) vulnerability in Ciprian Popescu Block for Font Awesome.This issue affects Block for Font Awesome: from n/a through 1.4.0. |
CVE-2023-24380 | Medium | 4.3 | 2023-12-17 | Cross-Site Request Forgery (CSRF) vulnerability in Webbjocke Simple Wp Sitemap.This issue affects Simple Wp Sitemap: from n/a through 1.2.1. |
CVE-2023-6895 | Medium | 6.3 | 2023-12-17 | A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK). It has been declared as critical. This vulnerability affects u… |
CVE-2023-6894 | Medium | 4.3 | 2023-12-17 | A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK). It has been classified as problematic. This affects an unknown… |
CVE-2023-6893 | Medium | 4.3 | 2023-12-17 | A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK) and classified as problematic. Affected by this issue is some u… |
CVE-2023-6891 | Medium | 5.3 | 2023-12-17 | A vulnerability has been found in PeaZip 9.4.0 and classified as problematic. Affected by this vulnerability is an unknown functionality in the library dragdro… |
CVE-2023-50965 | Critical | 9.8 | 2023-12-17 | In MicroHttpServer (aka Micro HTTP Server) through 4398570, _ReadStaticFiles in lib/middleware.c allows a stack-based buffer overflow and potentially remote co… |
CVE-2023-6888 | Medium | 6.3 | 2023-12-17 | A vulnerability classified as critical was found in PHZ76 RtspServer 1.0.0. This vulnerability affects the function ParseRequestLine of the file RtspMesaage.cp… |
CVE-2023-6887 | Medium | 6.3 | 2023-12-17 | A vulnerability classified as critical has been found in saysky ForestBlog up to 20220630. This affects an unknown part of the file /admin/upload/img of the co… |
CVE-2023-6886 | Medium | 4.7 | 2023-12-17 | A vulnerability was found in xnx3 wangmarket 6.1. It has been rated as critical. Affected by this issue is some unknown functionality of the component Role Man… |
CVE-2023-6885 | Medium | 5.5 | 2023-12-16 | A vulnerability was found in Tongda OA 2017 up to 11.10. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the fi… |
CVE-2023-50784 | High | 7.5 | 2023-12-16 | A buffer overflow in websockets in UnrealIRCd 6.1.0 through 6.1.3 before 6.1.4 allows an unauthenticated remote attacker to crash the server by sending an over… |
CVE-2023-6559 | High | 7.5 | 2023-12-16 | The MW WP Form plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 5.0.3. This is due to the plugin not properl… |
CVE-2023-6853 | Medium | 6.3 | 2023-12-16 | A vulnerability classified as critical was found in kalcaddle KodExplorer up to 4.51.03. Affected by this vulnerability is the function index of the file plugi… |
CVE-2023-6852 | Medium | 6.3 | 2023-12-16 | A vulnerability classified as critical has been found in kalcaddle KodExplorer up to 4.51.03. Affected is an unknown function of the file plugins/webodf/app.ph… |
CVE-2023-6851 | Medium | 6.3 | 2023-12-16 | A vulnerability was found in kalcaddle KodExplorer up to 4.51.03. It has been rated as critical. This issue affects the function unzipList of the file plugins/… |
CVE-2023-6890 | Medium | 5.4 | 2023-12-16 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.17. |
CVE-2023-6889 | Medium | 5.4 | 2023-12-16 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.17. |
CVE-2023-6850 | Medium | 6.3 | 2023-12-16 | A vulnerability was found in kalcaddle KodExplorer up to 4.51.03. It has been declared as critical. This vulnerability affects unknown code of the file /index… |
CVE-2023-6849 | High | 7.3 | 2023-12-16 | A vulnerability was found in kalcaddle kodbox up to 1.48. It has been rated as critical. Affected by this issue is the function cover of the file plugins/fileT… |
CVE-2023-6848 | High | 7.3 | 2023-12-16 | A vulnerability was found in kalcaddle kodbox up to 1.48. It has been declared as critical. Affected by this vulnerability is the function check of the file pl… |
CVE-2023-39340 | High | 7.5 | 2023-12-16 | A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker can send a specific request which may lead to Denial of Service… |
CVE-2023-28022 | Low | 3.5 | 2023-12-15 | HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, cau… |
CVE-2023-27317 | Medium | 4.3 | 2023-12-15 | ONTAP 9 versions 9.12.1P8, 9.13.1P4, and 9.13.1P5 are susceptible to a vulnerability which will cause all SAS-attached FIPS 140-2 drives to become unlocked a… |
CVE-2023-50728 | Medium | 5.4 | 2023-12-15 | octokit/webhooks is a GitHub webhook events toolset for Node.js. Starting in 9.26.0 and prior to 9.26.3, 10.9.2, 11.1.2, and 12.0.4, there is a problem caused… |
CVE-2023-50469 | Critical | 9.8 | 2023-12-15 | Shenzhen Libituo Technology Co., Ltd LBT-T300-T310 v2.2.2.6 was discovered to contain a buffer overflow via the ApCliEncrypType parameter at /apply.cgi. |
CVE-2023-50266 | Medium | 5.3 | 2023-12-15 | Bazarr manages and downloads subtitles. In version 1.2.4, the proxy method in bazarr/bazarr/app/ui.py does not validate the user-controlled protocol and url va… |
CVE-2023-50265 | High | 7.5 | 2023-12-15 | Bazarr manages and downloads subtitles. Prior to 1.3.1, the /api/swaggerui/static endpoint in bazarr/app/ui.py does not validate the user-controlled filename v… |
CVE-2023-50264 | High | 7.5 | 2023-12-15 | Bazarr manages and downloads subtitles. Prior to 1.3.1, Bazarr contains an arbitrary file read in /system/backup/download/ endpoint in bazarr/app/ui.py does no… |
CVE-2023-4020 | Critical | 9.0 | 2023-12-15 | An unvalidated input in a library function responsible for communicating between secure and non-secure memory in Silicon Labs TrustZone implementation allows r… |
CVE-2023-50723 | Critical | 9.9 | 2023-12-15 | XWiki Platform is a generic wiki platform. Starting in 2.3 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, anyone who can edit an arbitrary wiki page in… |
CVE-2023-50722 | Critical | 9.6 | 2023-12-15 | XWiki Platform is a generic wiki platform. Starting in 2.3 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, there is a reflected XSS or also direct remot… |
CVE-2023-50721 | Critical | 9.9 | 2023-12-15 | XWiki Platform is a generic wiki platform. Starting in 4.5-rc-1 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the search administration interface does… |
CVE-2023-50720 | Medium | 5.3 | 2023-12-15 | XWiki Platform is a generic wiki platform. Prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the email addresses of u… |
CVE-2023-50719 | High | 7.5 | 2023-12-15 | XWiki Platform is a generic wiki platform. Starting in 7.2-milestone-2 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki di… |
CVE-2023-50918 | Critical | 9.8 | 2023-12-15 | app/Controller/AuditLogsController.php in MISP before 2.4.182 mishandles ACLs for audit logs. |
CVE-2023-50917 | Critical | 9.8 | 2023-12-15 | MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mail… |
CVE-2023-50089 | Critical | 9.8 | 2023-12-15 | A Command Injection vulnerability exists in NETGEAR WNR2000v4 version 1.0.0.70. When using HTTP for SOAP authentication, command execution occurs during the pr… |
CVE-2023-6680 | High | 7.4 | 2023-12-15 | An improper certificate validation issue in Smartcard authentication in GitLab EE affecting all versions from 11.6 prior to 16.4.4, 16.5 prior to 16.5.4, and 1… |
CVE-2023-6051 | Medium | 5.7 | 2023-12-15 | An issue has been discovered in GitLab CE/EE affecting all versions before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16… |
CVE-2023-5512 | Medium | 4.8 | 2023-12-15 | An issue has been discovered in GitLab CE/EE affecting all versions from 16.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starti… |
CVE-2023-5310 | Medium | 5.7 | 2023-12-15 | A denial of service vulnerability exists in all Silicon Labs Z-Wave controller and endpoint devices running Z-Wave SDK v7.20.3 (Gecko SDK v4.3.3) and earlier… |
CVE-2023-5061 | Medium | 4.3 | 2023-12-15 | An issue has been discovered in GitLab affecting all versions starting from 9.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions star… |
CVE-2023-49829 | Medium | 5.9 | 2023-12-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS – eLearning and online course solution… |
CVE-2023-49823 | Medium | 6.5 | 2023-12-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldThemes Bold Page Builder allows Stored XSS.This issue… |
CVE-2023-49767 | Medium | 5.9 | 2023-12-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Biteship Biteship: Plugin Ongkos Kirim Kurir Instant, Reg… |
CVE-2023-49749 | Medium | 4.3 | 2023-12-15 | Cross-Site Request Forgery (CSRF) vulnerability in SureTriggers SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything!.This issue affects… |
CVE-2023-49747 | Medium | 5.9 | 2023-12-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebFactory Ltd Guest Author allows Stored XSS.This issue… |
CVE-2023-49744 | Medium | 5.4 | 2023-12-15 | Cross-Site Request Forgery (CSRF) vulnerability in Gift Up Gift Up Gift Cards for WordPress and WooCommerce.This issue affects Gift Up Gift Cards for WordPress… |
CVE-2023-49197 | Medium | 4.3 | 2023-12-15 | Cross-Site Request Forgery (CSRF) vulnerability in Apasionados, Apasionados del Marketing, NetConsulting DoFollow Case by Case.This issue affects DoFollow Case… |
CVE-2023-49191 | Medium | 5.9 | 2023-12-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Supsystic GDPR Cookie Consent by Supsystic allows Stored… |
CVE-2023-49190 | Medium | 5.9 | 2023-12-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chandra Shekhar Sahu Site Offline Or Coming Soon Or Maint… |
CVE-2023-49189 | Medium | 5.9 | 2023-12-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Getsocial, S.A. Social Share Buttons & Analytics Plugin –… |
CVE-2023-49159 | High | 7.2 | 2023-12-15 | Server-Side Request Forgery (SSRF) vulnerability in Elegant Digital Solutions CommentLuv.This issue affects CommentLuv: from n/a through 3.0.4. |
CVE-2023-3904 | Medium | 4.3 | 2023-12-15 | An issue has been discovered in GitLab EE affecting all versions starting before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting f… |
CVE-2023-3511 | Low | 2.0 | 2023-12-15 | An issue has been discovered in GitLab EE affecting all versions starting from 8.17 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions… |
CVE-2023-49188 | Medium | 5.9 | 2023-12-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZealousWeb Track Geolocation Of Users Using Contact Form… |
CVE-2023-49187 | High | 7.1 | 2023-12-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spoonthemes Adifier - Classified Ads WordPress Theme allo… |
CVE-2023-49185 | High | 7.1 | 2023-12-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Doofinder Doofinder WP & WooCommerce Search allows Reflec… |
CVE-2023-49184 | Medium | 5.9 | 2023-12-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Parallax Slider Block allows Stored XSS.This… |
CVE-2023-49183 | High | 7.1 | 2023-12-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NextScripts NextScripts: Social Networks Auto-Poster allo… |
CVE-2023-49182 | High | 7.1 | 2023-12-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fabio Marzocca List all posts by Authors, nested Categori… |
CVE-2023-49181 | Medium | 5.9 | 2023-12-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Event Manager WP Event Manager – Events Calendar, Regi… |
CVE-2023-49180 | Medium | 5.9 | 2023-12-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ternstyle LLC Automatic Youtube Video Posts Plugin allows… |
CVE-2023-49179 | Medium | 6.5 | 2023-12-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in N.O.U.S. Open Useful and Simple Event post allows Stored… |
CVE-2023-49178 | High | 7.1 | 2023-12-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mr. Hdwplayer HDW Player Plugin (Video Player & Video Gal… |
CVE-2023-49177 | High | 7.1 | 2023-12-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gilles Dumas which template file allows Reflected XSS.Thi… |
CVE-2023-49176 | High | 7.1 | 2023-12-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeRevolution WP Pocket URLs allows Reflected XSS.This i… |
CVE-2023-49175 | Medium | 5.9 | 2023-12-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreativo Pro KP Fastest Tawk.To Chat allows Stored XSS.Th… |
CVE-2023-49174 | Medium | 5.9 | 2023-12-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dFactory Responsive Lightbox & Gallery allows Stored XSS… |
CVE-2023-49170 | High | 7.1 | 2023-12-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in captainform Forms by CaptainForm – Form Builder for WordP… |
CVE-2023-49169 | Medium | 6.5 | 2023-12-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in datafeedr.Com Ads by datafeedr.Com allows Stored XSS.This… |
CVE-2023-50871 | Medium | 4.3 | 2023-12-15 | In JetBrains YouTrack before 2023.3.22268 authorization check for inline comments inside thread replies was missed |
CVE-2023-50870 | Medium | 4.3 | 2023-12-15 | In JetBrains TeamCity before 2023.11.1 a CSRF on login was possible |
CVE-2023-49165 | Medium | 5.9 | 2023-12-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Real Big Plugins Client Dash allows Stored XSS.This issue… |
CVE-2023-49160 | Medium | 6.5 | 2023-12-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in formzu Inc. Formzu WP allows Stored XSS.This issue affect… |
CVE-2023-48765 | Medium | 6.5 | 2023-12-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Till Krüss Email Address Encoder allows Stored XSS.This i… |
CVE-2023-46116 | Critical | 9.3 | 2023-12-15 | Tutanota (Tuta Mail) is an encrypted email provider. Tutanota allows users to open links in emails in external applications. Prior to version 3.118.12, it corr… |
CVE-2023-49898 | High | 7.2 | 2023-12-15 | In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation parameters of Maven. all… |
CVE-2023-30867 | Medium | 4.9 | 2023-12-15 | In the Streampark platform, when users log in to the system and use certain features, some pages provide a name-based fuzzy search, such as job names, role nam… |
CVE-2023-33222 | Medium | 6.8 | 2023-12-15 | When handling contactless cards, usage of a specific function to get additional information from the card which doesn't check the boundary on the dat… |
CVE-2023-33221 | Medium | 6.8 | 2023-12-15 | When reading DesFire keys, the function that reads the card isn't properly checking the boundaries when copying internally the data received. This al… |
CVE-2023-33220 | Critical | 9.1 | 2023-12-15 | During the retrofit validation process, the firmware doesn't properly check the boundaries while copying some attributes to check. This allows a stack-… |
CVE-2023-33219 | Critical | 9.1 | 2023-12-15 | The handler of the retrofit validation command doesn't properly check the boundaries when performing certain validation operations. This allows a stack-b… |
CVE-2023-33218 | Critical | 9.1 | 2023-12-15 | The Parameter Zone Read and Parameter Zone Write command handlers allow performing a Stack buffer overflow. This could potentially lead to a Remote Code ex… |
CVE-2023-6839 | Medium | 5.3 | 2023-12-15 | Due to improper error handling, a REST API resource could expose a server side error containing an internal WSO2 specific package name in the HTTP response. |
CVE-2023-6553 | Critical | 9.8 | 2023-12-15 | The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php… |
CVE-2023-48624 | Medium | 5.4 | 2023-12-15 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged… |
CVE-2023-48623 | Medium | 5.4 | 2023-12-15 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2023-48622 | Medium | 5.4 | 2023-12-15 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged… |
CVE-2023-48621 | Medium | 5.4 | 2023-12-15 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2023-48620 | Medium | 5.4 | 2023-12-15 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged… |