2023 CVEs (page 87)
Page 87 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-29234 | Critical | 9.8 | 2023-12-15 | A deserialization vulnerability existed when decode a malicious package.This issue affects Apache Dubbo: from 3.1.0 through 3.1.10, from 3.2.0 through 3.2.4. … |
CVE-2023-6827 | High | 7.5 | 2023-12-15 | The Essential Real Estate plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'ajaxUploadFonts' functi… |
CVE-2023-6826 | High | 7.2 | 2023-12-15 | The E2Pdf plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'import_action' function in versions up… |
CVE-2023-48379 | Medium | 5.3 | 2023-12-15 | Softnext Mail SQR Expert is an email management platform, it has inadequate filtering for a specific URL parameter within a specific function. An unauthenticat… |
CVE-2023-48378 | High | 7.5 | 2023-12-15 | Softnext Mail SQR Expert has a path traversal vulnerability within its parameter in a specific URL. An unauthenticated remote attacker can exploit this vulnera… |
CVE-2023-48376 | Critical | 9.8 | 2023-12-15 | SmartStar Software CWS is a web-based integration platform, its file uploading function does not restrict upload of file with dangerous type. An unauthenticate… |
CVE-2023-48375 | High | 8.8 | 2023-12-15 | SmartStar Software CWS is a web-based integration platform, it has a vulnerability of missing authorization and users are able to access data or perform action… |
CVE-2023-48374 | Medium | 6.5 | 2023-12-15 | SmartStar Software CWS is a web-base integration platform, it has a vulnerability of using a hard-coded for a specific account with low privilege. An unauthent… |
CVE-2023-48373 | High | 7.5 | 2023-12-15 | ITPison OMICARD EDM has a path traversal vulnerability within its parameter “FileName” in a specific function. An unauthenticated remote attacker can exploit t… |
CVE-2023-48372 | Critical | 9.8 | 2023-12-15 | ITPison OMICARD EDM 's SMS-related function has insufficient validation for user input. An unauthenticated remote attacker can exploit this vulnerability to in… |
CVE-2023-48371 | Critical | 9.8 | 2023-12-15 | ITPison OMICARD EDM’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnera… |
CVE-2023-50715 | Medium | 4.3 | 2023-12-15 | Home Assistant is open source home automation software. Prior to version 2023.12.3, the login page discloses all active user accounts to any unauthenticated br… |
CVE-2023-6832 | Medium | 4.3 | 2023-12-15 | Business Logic Errors in GitHub repository microweber/microweber prior to 2.0. |
CVE-2023-6831 | High | 8.1 | 2023-12-15 | Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. |
CVE-2023-48050 | Critical | 9.8 | 2023-12-15 | SQL injection vulnerability in Cams Biometrics Zkteco, eSSL, Cams Biometrics Integration Module with HR Attendance (aka odoo-biometric-attendance) v. 13.0 thro… |
CVE-2023-42183 | Medium | 5.3 | 2023-12-15 | lockss-daemon (aka Classic LOCKSS Daemon) before 1.77.3 performs post-Unicode normalization, which may allow bypass of intended access restrictions, such as wh… |
CVE-2023-40954 | Critical | 9.8 | 2023-12-15 | A SQL injection vulnerability in Grzegorz Marczynski Dynamic Progress Bar (aka web_progress) v. 11.0 through 11.0.2, v12.0 through v12.0.2, v.13.0 through v13… |
CVE-2023-36878 | Medium | 4.3 | 2023-12-15 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability |
CVE-2023-48049 | Critical | 9.8 | 2023-12-15 | A SQL injection vulnerability in Cybrosys Techno Solutions Website Blog Search (aka website_search_blog) v. 13.0 through 13.0.1.0.1 allows a remote attacker to… |
CVE-2023-4489 | Medium | 6.4 | 2023-12-14 | The first S0 encryption key is generated with an uninitialized PRNG in Z/IP Gateway products running Silicon Labs Z/IP Gateway SDK v7.18.3 and earlier. This ma… |
CVE-2023-6707 | High | 8.8 | 2023-12-14 | Use after free in CSS in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chrom… |
CVE-2023-6706 | High | 8.8 | 2023-12-14 | Use after free in FedCM in Google Chrome prior to 120.0.6099.109 allowed a remote attacker who convinced a user to engage in specific UI interaction to potenti… |
CVE-2023-6705 | High | 8.8 | 2023-12-14 | Use after free in WebRTC in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2023-6704 | High | 8.8 | 2023-12-14 | Use after free in libavif in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted image file. (… |
CVE-2023-6703 | High | 8.8 | 2023-12-14 | Use after free in Blink in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2023-6702 | High | 8.8 | 2023-12-14 | Type confusion in V8 in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2023-6134 | Medium | 4.6 | 2023-12-14 | A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an att… |
CVE-2023-49347 | Medium | 6.0 | 2023-12-14 | Temporary data passed between application components by Budgie Extras Windows Previews could potentially be viewed or manipulated. The data is stored in a loca… |
CVE-2023-49346 | Medium | 6.0 | 2023-12-14 | Temporary data passed between application components by Budgie Extras WeatherShow applet could potentially be viewed or manipulated. The data is stored in a lo… |
CVE-2023-49345 | Medium | 6.0 | 2023-12-14 | Temporary data passed between application components by Budgie Extras Takeabreak applet could potentially be viewed or manipulated. The data is stored in a loc… |
CVE-2023-49344 | Medium | 6.0 | 2023-12-14 | Temporary data passed between application components by Budgie Extras Window Shuffler applet could potentially be viewed or manipulated. The data is stored in… |
CVE-2023-49343 | Medium | 6.0 | 2023-12-14 | Temporary data passed between application components by Budgie Extras Dropby applet could potentially be viewed or manipulated. The data is stored in a locatio… |
CVE-2023-49342 | Medium | 6.0 | 2023-12-14 | Temporary data passed between application components by Budgie Extras Clockworks applet could potentially be viewed or manipulated. The data is stored in a loc… |
CVE-2023-0248 | High | 7.5 | 2023-12-14 | An attacker with physical access to the Kantech Gen1 ioSmart card reader with firmware version prior to 1.07.02 in certain circumstances can recover the reader… |
CVE-2023-50472 | High | 7.5 | 2023-12-14 | cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c. |
CVE-2023-50471 | High | 7.5 | 2023-12-14 | cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c. |
CVE-2023-49786 | High | 7.5 | 2023-12-14 | Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1; as well as certified-aster… |
CVE-2023-49294 | Medium | 4.9 | 2023-12-14 | Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-aster… |
CVE-2023-45894 | Critical | 10.0 | 2023-12-14 | The Remote Application Server in Parallels RAS before 19.2.23975 does not segment virtualized applications from the server, which allows a remote attacker to a… |
CVE-2023-37457 | High | 7.5 | 2023-12-14 | Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk versions 18.20.0 and prior, 20.5.0 and prior, and 21.0.0; as well as ceri… |
CVE-2023-50713 | Medium | 6.5 | 2023-12-14 | Speckle Server provides server, frontend, 3D viewer, and other JavaScript utilities for the Speckle 3D data platform. A vulnerability in versions prior to 2.17… |
CVE-2023-50017 | High | 8.8 | 2023-12-14 | Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/database/backup |
CVE-2023-4694 | High | 7.5 | 2023-12-14 | Certain HP OfficeJet Pro printers are potentially vulnerable to a Denial of Service when sending a SOAP message to the service on TCP port 3911 that contains a… |
CVE-2023-41151 | High | 7.5 | 2023-12-14 | An uncaught exception issue discovered in Softing OPC UA C++ SDK before 6.30 for Windows operating system may cause the application to crash when the server wa… |
CVE-2023-6563 | High | 7.7 | 2023-12-14 | An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens (> 500… |
CVE-2023-50710 | Medium | 4.2 | 2023-12-14 | Hono is a web framework written in TypeScript. Prior to version 3.11.7, clients may override named path parameter values from previous requests if the applicat… |
CVE-2023-50269 | High | 8.6 | 2023-12-14 | Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 th… |
CVE-2023-49157 | Medium | 5.9 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andreas Münch Multiple Post Passwords allows Stored XSS.T… |
CVE-2023-49152 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Labs64 Credit Tracker allows Stored XSS.This issue affect… |
CVE-2023-49151 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simple Calendar Simple Calendar – Google Calendar Plugin… |
CVE-2023-5769 | Medium | 5.4 | 2023-12-14 | A vulnerability exists in the webserver that affects the RTU500 series product versions listed below. A malicious actor could perform cross-site scripting o… |
CVE-2023-49860 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs WP Project Manager – Task, team, and project manag… |
CVE-2023-49842 | Medium | 5.9 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpexpertsio Rocket Maintenance Mode & Coming Soon Page al… |
CVE-2023-49150 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CurrencyRate.Today Crypto Converter Widget allows Stored… |
CVE-2023-49149 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CurrencyRate.Today Currency Converter Calculator allows S… |
CVE-2023-48780 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EnigmaWeb WP Catalogue allows Stored XSS.This issue affec… |
CVE-2023-48771 | High | 7.1 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bruno "Aesqe" Babic File Gallery allows Reflected XSS.Thi… |
CVE-2023-48770 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nima Saberi Aparat allows Stored XSS.This issue affects A… |
CVE-2023-48767 | High | 7.1 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Raghu Goriya MyTube PlayList allows Reflected XSS.This is… |
CVE-2023-48756 | High | 7.1 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor allows Reflected XSS.T… |
CVE-2023-48671 | High | 7.5 | 2023-12-14 | Dell vApp Manager, versions prior to 9.2.4.x contain an information disclosure vulnerability. A remote attacker could potentially exploit this vulnerability l… |
CVE-2023-47261 | Critical | 9.8 | 2023-12-14 | Dokmee ECM 7.4.6 allows remote code execution because the response to a GettingStarted/SaveSQLConnectionAsync /#/gettingstarted request contains a connection s… |
CVE-2023-42801 | High | 7.6 | 2023-12-14 | Moonlight-common-c contains the core GameStream client code shared between Moonlight clients. Moonlight-common-c is vulnerable to buffer overflow starting in c… |
CVE-2023-42800 | High | 8.8 | 2023-12-14 | Moonlight-common-c contains the core GameStream client code shared between Moonlight clients. Moonlight-common-c is vulnerable to buffer overflow starting in c… |
CVE-2023-42799 | High | 8.8 | 2023-12-14 | Moonlight-common-c contains the core GameStream client code shared between Moonlight clients. Moonlight-common-c is vulnerable to buffer overflow starting in c… |
CVE-2023-6595 | High | 7.5 | 2023-12-14 | In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated att… |
CVE-2023-6368 | Medium | 5.9 | 2023-12-14 | In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated att… |
CVE-2023-6367 | High | 7.6 | 2023-12-14 | In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to cra… |
CVE-2023-6366 | High | 7.6 | 2023-12-14 | In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to cra… |
CVE-2023-6365 | High | 7.6 | 2023-12-14 | In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to cra… |
CVE-2023-6364 | High | 7.6 | 2023-12-14 | In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to craf… |
CVE-2023-50137 | Medium | 5.4 | 2023-12-14 | JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) in the site management office. |
CVE-2023-50102 | Medium | 5.4 | 2023-12-14 | JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS). |
CVE-2023-50101 | Medium | 5.4 | 2023-12-14 | JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via Label management editing. |
CVE-2023-50100 | Medium | 5.4 | 2023-12-14 | JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via carousel image editing. |
CVE-2023-49841 | Medium | 5.9 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FancyThemes Optin Forms – Simple List Building Plugin for… |
CVE-2023-49820 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gordon Böhme, Antonio Leutsch Structured Content (JSON-LD… |
CVE-2023-49813 | High | 7.1 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus allows… |
CVE-2023-49771 | High | 7.1 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Peter Raschendorfer Smart External Link Click Monitor [Li… |
CVE-2023-49770 | Medium | 5.9 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Peter Raschendorfer Smart External Link Click Monitor [Li… |
CVE-2023-49766 | High | 7.1 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Ultimate Addons for Contact Form 7 allows Stored… |
CVE-2023-49195 | Medium | 5.9 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kyle Phillips Nested Pages allows Stored XSS.This issue a… |
CVE-2023-49173 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10to8 Sign In Scheduling Online Appointment Booking Syste… |
CVE-2023-49172 | High | 7.1 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BrainCert BrainCert – HTML5 Virtual Classroom allows Refl… |
CVE-2023-49171 | High | 7.1 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TheInnovs Innovs HR – Complete Human Resource Management… |
CVE-2023-48668 | High | 8.2 | 2023-12-14 | Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 on DDMC contain an OS command injection vulnerability in an admin op… |
CVE-2023-48667 | High | 7.2 | 2023-12-14 | Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injection vulnerability in administrator CLI… |
CVE-2023-48665 | High | 7.2 | 2023-12-14 | Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability. A remote malicious user with high privileges could potentially exploit… |
CVE-2023-48664 | High | 7.2 | 2023-12-14 | Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability. A remote malicious user with high privileges could potentially exploit… |
CVE-2023-48663 | High | 7.2 | 2023-12-14 | Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability. A remote malicious user with high privileges could potentially exploit… |
CVE-2023-48662 | High | 7.2 | 2023-12-14 | Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability. A remote malicious user with high privileges could potentially exploit… |
CVE-2023-48661 | Medium | 4.9 | 2023-12-14 | Dell vApp Manager, versions prior to 9.2.4.x contain an arbitrary file read vulnerability. A remote malicious user with high privileges could potentially expl… |
CVE-2023-48660 | High | 7.5 | 2023-12-14 | Dell vApp Manger, versions prior to 9.2.4.x contain an arbitrary file read vulnerability. A remote attacker could potentially exploit this vulnerability to re… |
CVE-2023-44286 | High | 8.8 | 2023-12-14 | Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain a DOM-based Cross-Site Scripting vulnerability. A remote un… |
CVE-2023-44285 | High | 7.8 | 2023-12-14 | Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an improper access control vulnerability. A local malicious… |
CVE-2023-44284 | Medium | 4.3 | 2023-12-14 | Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an SQL Injection vulnerability. A remote low privileged att… |
CVE-2023-44279 | Medium | 6.7 | 2023-12-14 | Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injection vulnerability in administrator CLI… |
CVE-2023-44278 | Medium | 6.7 | 2023-12-14 | Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain a path traversal vulnerability. A local high privileged at… |
CVE-2023-50566 | Medium | 5.4 | 2023-12-14 | A stored cross-site scripting (XSS) vulnerability in EyouCMS-V1.6.5-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in… |
CVE-2023-50565 | Medium | 5.4 | 2023-12-14 | A cross-site scripting (XSS) vulnerability in the component /logs/dopost.html in RPCMS v3.5.5 allows attackers to execute arbitrary web scripts or HTML via a c… |