2023 CVEs (page 86)
Page 86 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-48466 | Medium | 5.4 | 2023-12-15 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2023-48465 | Medium | 5.4 | 2023-12-15 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2023-48464 | Medium | 5.4 | 2023-12-15 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2023-48463 | Medium | 5.4 | 2023-12-15 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2023-48462 | Medium | 5.4 | 2023-12-15 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2023-48461 | Medium | 5.4 | 2023-12-15 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2023-48460 | Medium | 5.4 | 2023-12-15 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2023-48459 | Medium | 5.4 | 2023-12-15 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2023-48458 | Medium | 5.4 | 2023-12-15 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2023-48457 | Medium | 5.4 | 2023-12-15 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2023-48456 | Medium | 5.4 | 2023-12-15 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2023-48455 | Medium | 5.4 | 2023-12-15 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2023-48454 | Medium | 5.4 | 2023-12-15 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2023-48453 | Medium | 5.4 | 2023-12-15 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2023-48452 | Medium | 5.4 | 2023-12-15 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2023-48451 | Medium | 5.4 | 2023-12-15 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2023-48450 | Medium | 5.4 | 2023-12-15 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2023-48449 | Medium | 5.4 | 2023-12-15 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2023-48448 | Medium | 5.4 | 2023-12-15 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2023-48447 | Medium | 5.4 | 2023-12-15 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2023-48446 | Medium | 5.4 | 2023-12-15 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2023-48445 | Medium | 5.4 | 2023-12-15 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2023-48444 | Medium | 5.4 | 2023-12-15 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged… |
CVE-2023-48443 | Medium | 5.4 | 2023-12-15 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2023-48442 | Medium | 5.4 | 2023-12-15 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged… |
CVE-2023-48441 | Medium | 5.3 | 2023-12-15 | Adobe Experience Manager versions 6.5.18 and earlier are affected by an Improper Access Control vulnerability. An attacker could leverage this vulnerability to… |
CVE-2023-48440 | Medium | 5.4 | 2023-12-15 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged… |
CVE-2023-47065 | Medium | 5.4 | 2023-12-15 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2023-47064 | Medium | 5.4 | 2023-12-15 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged… |
CVE-2023-33217 | High | 7.5 | 2023-12-15 | By abusing a design flaw in the firmware upgrade mechanism of the impacted terminal it's possible to cause a permanent denial of service for the terminal. th… |
CVE-2023-6838 | Medium | 6.1 | 2023-12-15 | Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint. This can be performed in both authenticated and unaut… |
CVE-2023-6837 | High | 8.5 | 2023-12-15 | Multiple WSO2 products have been identified as vulnerable to perform user impersonatoin using JIT provisioning. In order for this vulnerability to have any imp… |
CVE-2023-6836 | Medium | 4.6 | 2023-12-15 | Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML p… |
CVE-2023-6835 | Medium | 4.3 | 2023-12-15 | Multiple WSO2 products have been identified as vulnerable due to lack of server-side input validation in the Forum feature, API rating could be manipulated. |
CVE-2023-48395 | Medium | 6.5 | 2023-12-15 | Kaifa Technology WebITR is an online attendance system, it has insufficient validation for user input within a special function. A remote attacker with regular… |
CVE-2023-48394 | High | 8.8 | 2023-12-15 | Kaifa Technology WebITR is an online attendance system, its file uploading function does not restrict upload of file with dangerous type. A remote attacker wit… |
CVE-2023-48393 | Medium | 4.3 | 2023-12-15 | Kaifa Technology WebITR is an online attendance system. A remote attacker with regular user privilege can obtain partial sensitive system information from erro… |
CVE-2023-48392 | Critical | 9.8 | 2023-12-15 | Kaifa Technology WebITR is an online attendance system, it has a vulnerability in using hard-coded encryption key. An unauthenticated remote attacker can gener… |
CVE-2023-48390 | Critical | 9.8 | 2023-12-15 | Multisuns EasyLog web+ has a code injection vulnerability. An unauthenticated remote attacker can exploit this vulnerability to inject code and access the sys… |
CVE-2023-48389 | High | 7.5 | 2023-12-15 | Multisuns EasyLog web+ has a path traversal vulnerability within its parameter in a specific URL. An unauthenticated remote attacker can exploit this vulnerabi… |
CVE-2023-48388 | Critical | 9.8 | 2023-12-15 | Multisuns EasyLog web+ has a vulnerability of using hard-coded credentials. An remote attacker can exploit this vulnerability to access the system to perform a… |
CVE-2023-48387 | High | 8.8 | 2023-12-15 | TAIWAN-CA(TWCA) JCICSecurityTool fails to check the source website and access locations when executing multiple Registry-related functions. In the scenario wh… |
CVE-2023-48384 | Critical | 9.8 | 2023-12-15 | ArmorX Global Technology Corporation ArmorX Spam has insufficient validation for user input within a special function. An unauthenticated remote attacker can e… |
CVE-2023-48382 | Medium | 6.5 | 2023-12-15 | Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion (LFI) vulnerability in a mail deliver-related URL. An unauthenticated r… |
CVE-2023-48381 | Medium | 6.5 | 2023-12-15 | Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion (LFI) vulnerability in a special URL. An unauthenticated remote attacke… |
CVE-2023-48380 | High | 7.4 | 2023-12-15 | Softnext Mail SQR Expert is an email management platform, it has insufficient filtering for a special character within a spcific function. A remote attacker au… |
CVE-2023-46279 | Critical | 9.8 | 2023-12-15 | Deserialization of Untrusted Data vulnerability in Apache Dubbo.This issue only affects Apache Dubbo 3.1.5. Users are recommended to upgrade to the latest ver… |
CVE-2023-29234 | Critical | 9.8 | 2023-12-15 | A deserialization vulnerability existed when decode a malicious package.This issue affects Apache Dubbo: from 3.1.0 through 3.1.10, from 3.2.0 through 3.2.4. … |
CVE-2023-6827 | High | 7.5 | 2023-12-15 | The Essential Real Estate plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'ajaxUploadFonts' functi… |
CVE-2023-6826 | High | 7.2 | 2023-12-15 | The E2Pdf plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'import_action' function in versions up… |
CVE-2023-48379 | Medium | 5.3 | 2023-12-15 | Softnext Mail SQR Expert is an email management platform, it has inadequate filtering for a specific URL parameter within a specific function. An unauthenticat… |
CVE-2023-48378 | High | 7.5 | 2023-12-15 | Softnext Mail SQR Expert has a path traversal vulnerability within its parameter in a specific URL. An unauthenticated remote attacker can exploit this vulnera… |
CVE-2023-48376 | Critical | 9.8 | 2023-12-15 | SmartStar Software CWS is a web-based integration platform, its file uploading function does not restrict upload of file with dangerous type. An unauthenticate… |
CVE-2023-48375 | High | 8.8 | 2023-12-15 | SmartStar Software CWS is a web-based integration platform, it has a vulnerability of missing authorization and users are able to access data or perform action… |
CVE-2023-48374 | Medium | 6.5 | 2023-12-15 | SmartStar Software CWS is a web-base integration platform, it has a vulnerability of using a hard-coded for a specific account with low privilege. An unauthent… |
CVE-2023-48373 | High | 7.5 | 2023-12-15 | ITPison OMICARD EDM has a path traversal vulnerability within its parameter “FileName” in a specific function. An unauthenticated remote attacker can exploit t… |
CVE-2023-48372 | Critical | 9.8 | 2023-12-15 | ITPison OMICARD EDM 's SMS-related function has insufficient validation for user input. An unauthenticated remote attacker can exploit this vulnerability to in… |
CVE-2023-48371 | Critical | 9.8 | 2023-12-15 | ITPison OMICARD EDM’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnera… |
CVE-2023-50715 | Medium | 4.3 | 2023-12-15 | Home Assistant is open source home automation software. Prior to version 2023.12.3, the login page discloses all active user accounts to any unauthenticated br… |
CVE-2023-6832 | Medium | 4.3 | 2023-12-15 | Business Logic Errors in GitHub repository microweber/microweber prior to 2.0. |
CVE-2023-6831 | High | 8.1 | 2023-12-15 | Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. |
CVE-2023-48050 | Critical | 9.8 | 2023-12-15 | SQL injection vulnerability in Cams Biometrics Zkteco, eSSL, Cams Biometrics Integration Module with HR Attendance (aka odoo-biometric-attendance) v. 13.0 thro… |
CVE-2023-42183 | Medium | 5.3 | 2023-12-15 | lockss-daemon (aka Classic LOCKSS Daemon) before 1.77.3 performs post-Unicode normalization, which may allow bypass of intended access restrictions, such as wh… |
CVE-2023-40954 | Critical | 9.8 | 2023-12-15 | A SQL injection vulnerability in Grzegorz Marczynski Dynamic Progress Bar (aka web_progress) v. 11.0 through 11.0.2, v12.0 through v12.0.2, v.13.0 through v13… |
CVE-2023-36878 | Medium | 4.3 | 2023-12-15 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability |
CVE-2023-48049 | Critical | 9.8 | 2023-12-15 | A SQL injection vulnerability in Cybrosys Techno Solutions Website Blog Search (aka website_search_blog) v. 13.0 through 13.0.1.0.1 allows a remote attacker to… |
CVE-2023-4489 | Medium | 6.4 | 2023-12-14 | The first S0 encryption key is generated with an uninitialized PRNG in Z/IP Gateway products running Silicon Labs Z/IP Gateway SDK v7.18.3 and earlier. This ma… |
CVE-2023-6707 | High | 8.8 | 2023-12-14 | Use after free in CSS in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chrom… |
CVE-2023-6706 | High | 8.8 | 2023-12-14 | Use after free in FedCM in Google Chrome prior to 120.0.6099.109 allowed a remote attacker who convinced a user to engage in specific UI interaction to potenti… |
CVE-2023-6705 | High | 8.8 | 2023-12-14 | Use after free in WebRTC in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2023-6704 | High | 8.8 | 2023-12-14 | Use after free in libavif in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted image file. (… |
CVE-2023-6703 | High | 8.8 | 2023-12-14 | Use after free in Blink in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2023-6702 | High | 8.8 | 2023-12-14 | Type confusion in V8 in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2023-6134 | Medium | 4.6 | 2023-12-14 | A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an att… |
CVE-2023-49347 | Medium | 6.0 | 2023-12-14 | Temporary data passed between application components by Budgie Extras Windows Previews could potentially be viewed or manipulated. The data is stored in a loca… |
CVE-2023-49346 | Medium | 6.0 | 2023-12-14 | Temporary data passed between application components by Budgie Extras WeatherShow applet could potentially be viewed or manipulated. The data is stored in a lo… |
CVE-2023-49345 | Medium | 6.0 | 2023-12-14 | Temporary data passed between application components by Budgie Extras Takeabreak applet could potentially be viewed or manipulated. The data is stored in a loc… |
CVE-2023-49344 | Medium | 6.0 | 2023-12-14 | Temporary data passed between application components by Budgie Extras Window Shuffler applet could potentially be viewed or manipulated. The data is stored in… |
CVE-2023-49343 | Medium | 6.0 | 2023-12-14 | Temporary data passed between application components by Budgie Extras Dropby applet could potentially be viewed or manipulated. The data is stored in a locatio… |
CVE-2023-49342 | Medium | 6.0 | 2023-12-14 | Temporary data passed between application components by Budgie Extras Clockworks applet could potentially be viewed or manipulated. The data is stored in a loc… |
CVE-2023-0248 | High | 7.5 | 2023-12-14 | An attacker with physical access to the Kantech Gen1 ioSmart card reader with firmware version prior to 1.07.02 in certain circumstances can recover the reader… |
CVE-2023-50472 | High | 7.5 | 2023-12-14 | cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c. |
CVE-2023-50471 | High | 7.5 | 2023-12-14 | cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c. |
CVE-2023-49786 | High | 7.5 | 2023-12-14 | Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1; as well as certified-aster… |
CVE-2023-49294 | Medium | 4.9 | 2023-12-14 | Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-aster… |
CVE-2023-45894 | Critical | 10.0 | 2023-12-14 | The Remote Application Server in Parallels RAS before 19.2.23975 does not segment virtualized applications from the server, which allows a remote attacker to a… |
CVE-2023-37457 | High | 7.5 | 2023-12-14 | Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk versions 18.20.0 and prior, 20.5.0 and prior, and 21.0.0; as well as ceri… |
CVE-2023-50713 | Medium | 6.5 | 2023-12-14 | Speckle Server provides server, frontend, 3D viewer, and other JavaScript utilities for the Speckle 3D data platform. A vulnerability in versions prior to 2.17… |
CVE-2023-50017 | High | 8.8 | 2023-12-14 | Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/database/backup |
CVE-2023-4694 | High | 7.5 | 2023-12-14 | Certain HP OfficeJet Pro printers are potentially vulnerable to a Denial of Service when sending a SOAP message to the service on TCP port 3911 that contains a… |
CVE-2023-41151 | High | 7.5 | 2023-12-14 | An uncaught exception issue discovered in Softing OPC UA C++ SDK before 6.30 for Windows operating system may cause the application to crash when the server wa… |
CVE-2023-6563 | High | 7.7 | 2023-12-14 | An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens (> 500… |
CVE-2023-50710 | Medium | 4.2 | 2023-12-14 | Hono is a web framework written in TypeScript. Prior to version 3.11.7, clients may override named path parameter values from previous requests if the applicat… |
CVE-2023-50269 | High | 8.6 | 2023-12-14 | Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 th… |
CVE-2023-49157 | Medium | 5.9 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andreas Münch Multiple Post Passwords allows Stored XSS.T… |
CVE-2023-49152 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Labs64 Credit Tracker allows Stored XSS.This issue affect… |
CVE-2023-49151 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simple Calendar Simple Calendar – Google Calendar Plugin… |
CVE-2023-5769 | Medium | 5.4 | 2023-12-14 | A vulnerability exists in the webserver that affects the RTU500 series product versions listed below. A malicious actor could perform cross-site scripting o… |
CVE-2023-49860 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs WP Project Manager – Task, team, and project manag… |
CVE-2023-49842 | Medium | 5.9 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpexpertsio Rocket Maintenance Mode & Coming Soon Page al… |