2023 CVEs (page 87)
Page 87 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-49150 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CurrencyRate.Today Crypto Converter Widget allows Stored… |
CVE-2023-49149 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CurrencyRate.Today Currency Converter Calculator allows S… |
CVE-2023-48780 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EnigmaWeb WP Catalogue allows Stored XSS.This issue affec… |
CVE-2023-48771 | High | 7.1 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bruno "Aesqe" Babic File Gallery allows Reflected XSS.Thi… |
CVE-2023-48770 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nima Saberi Aparat allows Stored XSS.This issue affects A… |
CVE-2023-48767 | High | 7.1 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Raghu Goriya MyTube PlayList allows Reflected XSS.This is… |
CVE-2023-48756 | High | 7.1 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor allows Reflected XSS.T… |
CVE-2023-48671 | High | 7.5 | 2023-12-14 | Dell vApp Manager, versions prior to 9.2.4.x contain an information disclosure vulnerability. A remote attacker could potentially exploit this vulnerability l… |
CVE-2023-47261 | Critical | 9.8 | 2023-12-14 | Dokmee ECM 7.4.6 allows remote code execution because the response to a GettingStarted/SaveSQLConnectionAsync /#/gettingstarted request contains a connection s… |
CVE-2023-42801 | High | 7.6 | 2023-12-14 | Moonlight-common-c contains the core GameStream client code shared between Moonlight clients. Moonlight-common-c is vulnerable to buffer overflow starting in c… |
CVE-2023-42800 | High | 8.8 | 2023-12-14 | Moonlight-common-c contains the core GameStream client code shared between Moonlight clients. Moonlight-common-c is vulnerable to buffer overflow starting in c… |
CVE-2023-42799 | High | 8.8 | 2023-12-14 | Moonlight-common-c contains the core GameStream client code shared between Moonlight clients. Moonlight-common-c is vulnerable to buffer overflow starting in c… |
CVE-2023-6595 | High | 7.5 | 2023-12-14 | In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated att… |
CVE-2023-6368 | Medium | 5.9 | 2023-12-14 | In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated att… |
CVE-2023-6367 | High | 7.6 | 2023-12-14 | In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to cra… |
CVE-2023-6366 | High | 7.6 | 2023-12-14 | In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to cra… |
CVE-2023-6365 | High | 7.6 | 2023-12-14 | In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to cra… |
CVE-2023-6364 | High | 7.6 | 2023-12-14 | In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to craf… |
CVE-2023-50137 | Medium | 5.4 | 2023-12-14 | JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) in the site management office. |
CVE-2023-50102 | Medium | 5.4 | 2023-12-14 | JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS). |
CVE-2023-50101 | Medium | 5.4 | 2023-12-14 | JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via Label management editing. |
CVE-2023-50100 | Medium | 5.4 | 2023-12-14 | JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via carousel image editing. |
CVE-2023-49841 | Medium | 5.9 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FancyThemes Optin Forms – Simple List Building Plugin for… |
CVE-2023-49820 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gordon Böhme, Antonio Leutsch Structured Content (JSON-LD… |
CVE-2023-49813 | High | 7.1 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus allows… |
CVE-2023-49771 | High | 7.1 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Peter Raschendorfer Smart External Link Click Monitor [Li… |
CVE-2023-49770 | Medium | 5.9 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Peter Raschendorfer Smart External Link Click Monitor [Li… |
CVE-2023-49766 | High | 7.1 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Ultimate Addons for Contact Form 7 allows Stored… |
CVE-2023-49195 | Medium | 5.9 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kyle Phillips Nested Pages allows Stored XSS.This issue a… |
CVE-2023-49173 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10to8 Sign In Scheduling Online Appointment Booking Syste… |
CVE-2023-49172 | High | 7.1 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BrainCert BrainCert – HTML5 Virtual Classroom allows Refl… |
CVE-2023-49171 | High | 7.1 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TheInnovs Innovs HR – Complete Human Resource Management… |
CVE-2023-48668 | High | 8.2 | 2023-12-14 | Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 on DDMC contain an OS command injection vulnerability in an admin op… |
CVE-2023-48667 | High | 7.2 | 2023-12-14 | Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injection vulnerability in administrator CLI… |
CVE-2023-48665 | High | 7.2 | 2023-12-14 | Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability. A remote malicious user with high privileges could potentially exploit… |
CVE-2023-48664 | High | 7.2 | 2023-12-14 | Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability. A remote malicious user with high privileges could potentially exploit… |
CVE-2023-48663 | High | 7.2 | 2023-12-14 | Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability. A remote malicious user with high privileges could potentially exploit… |
CVE-2023-48662 | High | 7.2 | 2023-12-14 | Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability. A remote malicious user with high privileges could potentially exploit… |
CVE-2023-48661 | Medium | 4.9 | 2023-12-14 | Dell vApp Manager, versions prior to 9.2.4.x contain an arbitrary file read vulnerability. A remote malicious user with high privileges could potentially expl… |
CVE-2023-48660 | High | 7.5 | 2023-12-14 | Dell vApp Manger, versions prior to 9.2.4.x contain an arbitrary file read vulnerability. A remote attacker could potentially exploit this vulnerability to re… |
CVE-2023-44286 | High | 8.8 | 2023-12-14 | Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain a DOM-based Cross-Site Scripting vulnerability. A remote un… |
CVE-2023-44285 | High | 7.8 | 2023-12-14 | Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an improper access control vulnerability. A local malicious… |
CVE-2023-44284 | Medium | 4.3 | 2023-12-14 | Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an SQL Injection vulnerability. A remote low privileged att… |
CVE-2023-44279 | Medium | 6.7 | 2023-12-14 | Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injection vulnerability in administrator CLI… |
CVE-2023-44278 | Medium | 6.7 | 2023-12-14 | Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain a path traversal vulnerability. A local high privileged at… |
CVE-2023-50566 | Medium | 5.4 | 2023-12-14 | A stored cross-site scripting (XSS) vulnerability in EyouCMS-V1.6.5-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in… |
CVE-2023-50565 | Medium | 5.4 | 2023-12-14 | A cross-site scripting (XSS) vulnerability in the component /logs/dopost.html in RPCMS v3.5.5 allows attackers to execute arbitrary web scripts or HTML via a c… |
CVE-2023-50564 | High | 8.8 | 2023-12-14 | An arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4.7.18 allows attackers to execute arbitrary code via uploading… |
CVE-2023-50563 | Critical | 9.8 | 2023-12-14 | Semcms v4.8 was discovered to contain a SQL injection vulnerability via the AID parameter at SEMCMS_Function.php. |
CVE-2023-50073 | Critical | 9.8 | 2023-12-14 | EmpireCMS v7.5 was discovered to contain a SQL injection vulnerability via the ftppassword parameter at SetEnews.php. |
CVE-2023-50011 | High | 7.2 | 2023-12-14 | PopojiCMS version 2.0.1 is vulnerable to remote command execution in the Meta Social field. |
CVE-2023-49833 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Spectra – WordPress Gutenberg Blocks all… |
CVE-2023-49828 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooPayments – Fully Integrated Solution Built… |
CVE-2023-49827 | High | 7.1 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & Woo… |
CVE-2023-49745 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar allows Stored XSS.This iss… |
CVE-2023-49743 | Medium | 5.9 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Dashboard Widgets Suite allows Stored XSS.This… |
CVE-2023-49740 | High | 7.1 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Seraphinite Solutions Seraphinite Accelerator allows Refl… |
CVE-2023-49739 | High | 7.1 | 2023-12-14 | Vulnerability in IdeaBox Creations PowerPack Pro for Elementor.This issue affects PowerPack Pro for Elementor: from n/a through 2.9.23. |
CVE-2023-49168 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordPlus Better Messages – Live Chat for WordPress, Buddy… |
CVE-2023-44277 | High | 7.8 | 2023-12-14 | Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injection vulnerability in the CLI. A local lo… |
CVE-2023-6572 | High | 8.1 | 2023-12-14 | Command Injection in GitHub repository gradio-app/gradio prior to main. |
CVE-2023-6545 | Medium | 4.7 | 2023-12-14 | The package authelia-bhf included in Beckhoffs TwinCAT/BSD is prone to an open redirect that allows a remote unprivileged attacker to redirect a user to anothe… |
CVE-2023-5592 | High | 7.5 | 2023-12-14 | Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attac… |
CVE-2023-50370 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Livemesh WPBakery Page Builder Addons by Livemesh allows… |
CVE-2023-50369 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alma Alma – Pay in installments or later for WooCommerce… |
CVE-2023-50368 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta Shortcodes and extra features for Phlox theme allo… |
CVE-2023-49847 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Twinpictures Annual Archive allows Stored XSS.This issue… |
CVE-2023-49846 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paul Bearne Author Avatars List/Block allows Stored XSS.T… |
CVE-2023-49836 | Medium | 5.9 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brontobytes Cookie Bar allows Stored XSS.This issue affec… |
CVE-2023-48676 | High | 7.1 | 2023-12-14 | Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows… |
CVE-2023-46144 | Medium | 6.5 | 2023-12-14 | A download of code without integrity check vulnerability in PLCnext products allows an remote attacker with low privileges to compromise integrity on the affec… |
CVE-2023-46143 | High | 7.5 | 2023-12-14 | Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all app… |
CVE-2023-46142 | High | 8.8 | 2023-12-14 | A incorrect permission assignment for critical resource vulnerability in PLCnext products allows an remote attacker with low privileges to gain full access on… |
CVE-2023-46141 | Critical | 9.8 | 2023-12-14 | Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated at… |
CVE-2023-45185 | High | 7.4 | 2023-12-14 | IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 could allow an attacker to execute remote code. Due to improper authority checks… |
CVE-2023-45182 | High | 7.4 | 2023-12-14 | IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 is vulnerable to having its key for an encrypted password decoded. By somehow ga… |
CVE-2023-0757 | Critical | 9.8 | 2023-12-14 | Incorrect Permission Assignment for Critical Resource vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated… |
CVE-2023-6571 | Medium | 6.1 | 2023-12-14 | Cross-site Scripting (XSS) - Reflected in kubeflow/kubeflow |
CVE-2023-6570 | Medium | 6.5 | 2023-12-14 | Server-Side Request Forgery (SSRF) in kubeflow/kubeflow |
CVE-2023-6569 | High | 8.2 | 2023-12-14 | External Control of File Name or Path in h2oai/h2o-3 |
CVE-2023-50371 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Page Visit Counter Advanced Page Visit Counter – Most Wan… |
CVE-2023-48631 | Medium | 5.3 | 2023-12-14 | @adobe/css-tools versions 4.3.1 and earlier are affected by an Improper Input Validation vulnerability that could result in a denial of service while attemptin… |
CVE-2023-49708 | Critical | 9.8 | 2023-12-14 | SQLi vulnerability in Starshop component for Joomla. |
CVE-2023-49707 | Critical | 9.8 | 2023-12-14 | SQLi vulnerability in S5 Register module for Joomla. |
CVE-2023-48925 | Critical | 9.8 | 2023-12-14 | SQL injection vulnerability in Buy Addons bavideotab before version 1.0.6, allows attackers to escalate privileges and obtain sensitive information via the com… |
CVE-2023-46750 | Medium | 6.1 | 2023-12-14 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro 1.13.0… |
CVE-2023-46348 | Critical | 9.8 | 2023-12-14 | SQL njection vulnerability in SunnyToo sturls before version 1.1.13, allows attackers to escalate privileges and obtain sensitive information via StUrls::hookA… |
CVE-2023-40659 | Medium | 6.1 | 2023-12-14 | A reflected XSS vulnerability was discovered in the Easy Quick Contact module for Joomla. |
CVE-2023-40658 | Medium | 6.1 | 2023-12-14 | A reflected XSS vulnerability was discovered in the Clicky Analytics Dashboard module for Joomla. |
CVE-2023-40657 | Medium | 6.1 | 2023-12-14 | A reflected XSS vulnerability was discovered in the Joomdoc component for Joomla. |
CVE-2023-40656 | Medium | 6.1 | 2023-12-14 | A reflected XSS vulnerability was discovered in the Quickform component for Joomla. |
CVE-2023-40655 | Medium | 6.1 | 2023-12-14 | A reflected XSS vulnerability was discovered in the Proforms Basic component for Joomla. |
CVE-2023-40630 | Critical | 9.8 | 2023-12-14 | Unauthenticated LFI/SSRF in JCDashboards component for Joomla. |
CVE-2023-40629 | Critical | 9.8 | 2023-12-14 | SQLi vulnerability in LMS Lite component for Joomla. |
CVE-2023-40628 | Medium | 6.1 | 2023-12-14 | A reflected XSS vulnerability was discovered in the Extplorer component for Joomla. |
CVE-2023-40627 | Medium | 6.1 | 2023-12-14 | A reflected XSS vulnerability was discovered in the LivingWord component for Joomla. |
CVE-2023-25644 | Medium | 6.5 | 2023-12-14 | There is a denial of service vulnerability in some ZTE mobile internet products. Due to insufficient validation of Web interface parameter, an attacker could… |
CVE-2023-25643 | High | 8.4 | 2023-12-14 | There is a command injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of multiple network parameters, an aut… |
CVE-2023-25642 | Medium | 5.9 | 2023-12-14 | There is a buffer overflow vulnerability in some ZTE mobile internet producsts. Due to insufficient validation of tcp port parameter, an authenticated attacke… |
CVE-2023-1904 | Medium | 4.2 | 2023-12-14 | In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of Octopus Server. |