2023 CVEs (page 88)
Page 88 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-48085 | Critical | 9.8 | 2023-12-14 | Nagios XI before version 5.11.3 was discovered to contain a remote code execution (RCE) vulnerability via the component command_test.php. |
CVE-2023-48084 | Critical | 9.8 | 2023-12-14 | Nagios XI before version 5.11.3 was discovered to contain a SQL injection vulnerability via the bulk modification tool. |
CVE-2023-25651 | Medium | 4.3 | 2023-12-14 | There is a SQL injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of SMS interface parameter, an authenticated… |
CVE-2023-25650 | Medium | 6.5 | 2023-12-14 | There is an arbitrary file download vulnerability in ZXCLOUD iRAI. Since the backend does not escape special strings or restrict paths, an attacker with user… |
CVE-2023-25648 | Medium | 6.5 | 2023-12-14 | There is a weak folder permission vulnerability in ZTE's ZXCLOUD iRAI product. Due to weak folder permission, an attacker with ordinary user privileges could… |
CVE-2023-44709 | Critical | 9.8 | 2023-12-14 | PlutoSVG commit 336c02997277a1888e6ccbbbe674551a0582e5c4 and before was discovered to contain an integer overflow via the component plutosvg_load_from_memory. |
CVE-2023-6407 | Medium | 5.3 | 2023-12-14 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause arbitrary file deletion upon se… |
CVE-2023-5630 | Medium | 6.5 | 2023-12-14 | A CWE-494: Download of Code Without Integrity Check vulnerability exists that could allow a privileged user to install an untrusted firmware. |
CVE-2023-5629 | High | 8.2 | 2023-12-14 | A CWE-601:URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability exists that could cause disclosure of information through phishing attempts over H… |
CVE-2023-49938 | High | 8.2 | 2023-12-14 | An issue was discovered in SchedMD Slurm 22.05.x and 23.02.x. There is Incorrect Access Control: an attacker can modified their extended group list that is use… |
CVE-2023-49937 | Critical | 9.8 | 2023-12-14 | An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. Because of a double free, attackers can cause a denial of service or possibly execute a… |
CVE-2023-49936 | High | 7.5 | 2023-12-14 | An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. A NULL pointer dereference leads to denial of service. The fixed versions are 22.05.11… |
CVE-2023-49935 | High | 8.8 | 2023-12-14 | An issue was discovered in SchedMD Slurm 23.02.x and 23.11.x. There is Incorrect Access Control because of a slurmd Message Integrity Bypass. An attacker can r… |
CVE-2023-49934 | Critical | 9.8 | 2023-12-14 | An issue was discovered in SchedMD Slurm 23.11.x. There is SQL Injection against the SlurmDBD database. The fixed version is 23.11.1. |
CVE-2023-49933 | High | 7.5 | 2023-12-14 | An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. There is Improper Enforcement of Message Integrity During Transmission in a Communicati… |
CVE-2023-45184 | Medium | 6.2 | 2023-12-14 | IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 could allow an attacker to obtain a decryption key due to improper authority chec… |
CVE-2023-41720 | High | 7.8 | 2023-12-14 | A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker with a foothold on an Ivanti Connect Secure (ICS) appliance can… |
CVE-2023-41719 | High | 7.2 | 2023-12-14 | A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker impersonating an administrator may craft a specific web request… |
CVE-2023-43042 | High | 7.5 | 2023-12-14 | IBM SAN Volume Controller, IBM Storwize, IBM FlashSystem and IBM Storage Virtualize 8.3 products use default passwords for a privileged user. IBM X-Force ID… |
CVE-2023-31546 | Critical | 9.6 | 2023-12-14 | Cross Site Scripting (XSS) vulnerability in DedeBIZ v6.0.3 allows attackers to run arbitrary code via the search feature. |
CVE-2023-41618 | Medium | 6.1 | 2023-12-14 | Emlog Pro v2.1.14 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /admin/article.php?active_savedraft. |
CVE-2023-40921 | Critical | 9.8 | 2023-12-14 | SQL Injection vulnerability in functions/point_list.php in Common Services soliberte before v4.3.03 allows attackers to obtain sensitive information via the la… |
CVE-2023-21751 | Medium | 6.5 | 2023-12-14 | Azure DevOps Server Spoofing Vulnerability |
CVE-2023-49646 | Medium | 6.4 | 2023-12-13 | Improper authentication in some Zoom clients before version 5.16.5 may allow an authenticated user to conduct a denial of service via network access. |
CVE-2023-45174 | High | 8.4 | 2023-12-13 | IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a privileged local user to exploit a vulnerability in the qdaemon command to escalate privileges or cause a denial o… |
CVE-2023-45170 | High | 8.4 | 2023-12-13 | IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the piobe command to escalate privileges or cause a denial… |
CVE-2023-45166 | High | 8.4 | 2023-12-13 | IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the piodmgrsu command to obtain elevated privileges. IBM… |
CVE-2023-43586 | High | 7.3 | 2023-12-13 | Path traversal in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows may allow an authenticated user to conduct an escalat… |
CVE-2023-43585 | High | 7.1 | 2023-12-13 | Improper access control in Zoom Mobile App for iOS and Zoom SDKs for iOS before version 5.16.5 may allow an authenticated user to conduct a disclosure of infor… |
CVE-2023-43583 | Medium | 4.9 | 2023-12-13 | Cryptographic issues Zoom Mobile App for Android, Zoom Mobile App for iOS, and Zoom SDKs for Android and iOS before version 5.16.0 may allow a privileged user… |
CVE-2023-41621 | Medium | 6.1 | 2023-12-13 | A Cross Site Scripting (XSS) vulnerability was discovered in Emlog Pro v2.1.14 via the component /admin/store.php. |
CVE-2023-50709 | Medium | 6.5 | 2023-12-13 | Cube is a semantic layer for building data applications. Prior to version 0.34.34, it is possible to make the entire Cube API unavailable by submitting a speci… |
CVE-2023-47623 | Medium | 6.1 | 2023-12-13 | Scrypted is a home video integration and automation platform. In versions 0.55.0 and prior, a reflected cross-site scripting vulnerability exists in the login… |
CVE-2023-47620 | Medium | 6.1 | 2023-12-13 | Scrypted is a home video integration and automation platform. In versions 0.55.0 and prior, a reflected cross-site scripting vulnerability exists in the plugin… |
CVE-2023-6775 | Low | 3.5 | 2023-12-13 | A vulnerability was found in CodeAstro POS and Inventory Management System 1.0. It has been classified as problematic. This affects an unknown part of the file… |
CVE-2023-50443 | Medium | 4.6 | 2023-12-13 | Encrypted disks created by PRIMX CRYHOD for Windows before Q.2020.4 (ANSSI qualification submission) or CRYHOD for Windows before 2023.5 can be modified by an… |
CVE-2023-50442 | Medium | 5.5 | 2023-12-13 | Encrypted folders created by PRIMX ZONECENTRAL through 2023.5 can be modified by a local attacker (with appropriate privileges) so that specific file types are… |
CVE-2023-50440 | Medium | 5.5 | 2023-12-13 | ZED containers produced by PRIMX ZED! for Windows before Q.2020.3 (ANSSI qualification submission); ZED! for Windows before Q.2021.2 (ANSSI qualification submi… |
CVE-2023-50439 | Medium | 5.3 | 2023-12-13 | ZED containers produced by PRIMX ZED! for Windows before Q.2020.3 (ANSSI qualification submission), ZED! for Windows before Q.2021.2 (ANSSI qualification submi… |
CVE-2023-50268 | Medium | 6.2 | 2023-12-13 | jq is a command-line JSON processor. Version 1.7 is vulnerable to stack-based buffer overflow in builds using decNumber. Version 1.7.1 contains a patch for thi… |
CVE-2023-50262 | Medium | 5.3 | 2023-12-13 | Dompdf is an HTML to PDF converter for PHP. When parsing SVG images Dompdf performs an initial validation to ensure that paths within the SVG are allowed. One… |
CVE-2023-50248 | Medium | 4.5 | 2023-12-13 | CKAN is an open-source data management system for powering data hubs and data portals. Starting in version 2.0.0 and prior to versions 2.9.10 and 2.10.3, when… |
CVE-2023-50246 | Medium | 6.2 | 2023-12-13 | jq is a command-line JSON processor. Version 1.7 is vulnerable to heap-based buffer overflow. Version 1.7.1 contains a patch for this issue. |
CVE-2023-49878 | Medium | 4.3 | 2023-12-13 | IBM System Storage Virtualization Engine TS7700 3957-VEC, 3948-VED and 3957-VEC could allow a remote attacker to obtain sensitive information when a detailed t… |
CVE-2023-49877 | Medium | 4.3 | 2023-12-13 | IBM System Storage Virtualization Engine TS7700 3957-VEC, 3948-VED and 3957-VEC could allow a remote authenticated user to obtain sensitive information, caused… |
CVE-2023-48702 | High | 7.2 | 2023-12-13 | Jellyfin is a system for managing and streaming media. Prior to version 10.8.13, the `/System/MediaEncoder/Path` endpoint executes an arbitrary file using `Pro… |
CVE-2023-47624 | High | 7.5 | 2023-12-13 | Audiobookshelf is a self-hosted audiobook and podcast server. In versions 2.4.3 and prior, any user (regardless of their permissions) may be able to read files… |
CVE-2023-47619 | High | 8.1 | 2023-12-13 | Audiobookshelf is a self-hosted audiobook and podcast server. In versions 2.4.3 and prior, users with the update permission are able to read arbitrary files, d… |
CVE-2023-6774 | Medium | 4.3 | 2023-12-13 | A vulnerability was found in CodeAstro POS and Inventory Management System 1.0 and classified as problematic. Affected by this issue is some unknown functional… |
CVE-2023-6773 | Medium | 4.3 | 2023-12-13 | A vulnerability has been found in CodeAstro POS and Inventory Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown… |
CVE-2023-50444 | High | 7.5 | 2023-12-13 | By default, .ZED containers produced by PRIMX ZED! for Windows before Q.2020.3 (ANSSI qualification submission); ZED! for Windows before Q.2021.2 (ANSSI qualif… |
CVE-2023-50441 | Medium | 5.5 | 2023-12-13 | Encrypted folders created by PRIMX ZONECENTRAL for Windows before Q.2021.2 (ANSSI qualification submission) or ZONECENTRAL for Windows before 2023.5 can be mod… |
CVE-2023-49296 | Medium | 6.3 | 2023-12-13 | The Arduino Create Agent allows users to use the Arduino Create applications to upload code to any USB connected Arduino board directly from the browser. A vul… |
CVE-2023-46247 | High | 7.5 | 2023-12-13 | Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Contracts containing large arrays might underallocate the number of slots t… |
CVE-2023-6795 | Medium | 5.5 | 2023-12-13 | An OS command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to disrupt system processes and potentially… |
CVE-2023-6794 | Medium | 5.5 | 2023-12-13 | An arbitrary file upload vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface… |
CVE-2023-6793 | Low | 2.7 | 2023-12-13 | An improper privilege management vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to revoke active XML API… |
CVE-2023-6792 | Medium | 5.5 | 2023-12-13 | An OS command injection vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated API user to disrupt system processes and po… |
CVE-2023-6791 | Medium | 4.9 | 2023-12-13 | A credential disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to obtain the plaintext credential… |
CVE-2023-6790 | High | 8.8 | 2023-12-13 | A DOM-Based cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to execute a JavaScript payload in the con… |
CVE-2023-6789 | Medium | 4.3 | 2023-12-13 | A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a JavaScri… |
CVE-2023-6772 | Medium | 4.7 | 2023-12-13 | A vulnerability, which was classified as critical, was found in OTCMS 7.01. Affected is an unknown function of the file /admin/ind_backstage.php. The manipulat… |
CVE-2023-6771 | Medium | 5.5 | 2023-12-13 | A vulnerability, which was classified as critical, has been found in SourceCodester Simple Student Attendance System 1.0. This issue affects the function save_… |
CVE-2023-46727 | High | 8.6 | 2023-12-13 | GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, GLPI inventory endpoint can be used to drive… |
CVE-2023-46726 | High | 7.2 | 2023-12-13 | GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, on PHP 7.4 only, the LDAP server configuratio… |
CVE-2023-43813 | Medium | 6.5 | 2023-12-13 | GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, the saved search feature can be used to perfo… |
CVE-2023-6767 | Medium | 4.3 | 2023-12-13 | A vulnerability, which was classified as problematic, was found in SourceCodester Wedding Guest e-Book 1.0. This affects an unknown part of the file /endpoint/… |
CVE-2023-6766 | Medium | 4.3 | 2023-12-13 | A vulnerability classified as problematic has been found in PHPGurukul Teacher Subject Allocation Management System 1.0. Affected is an unknown function of the… |
CVE-2023-6765 | Medium | 5.5 | 2023-12-13 | A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been rated as critical. This issue affects the function prepar… |
CVE-2023-50779 | Medium | 4.3 | 2023-12-13 | Missing permission checks in Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier allow attackers with Overall/Read permission to connect to an attacker-specifie… |
CVE-2023-50778 | High | 8.8 | 2023-12-13 | A cross-site request forgery (CSRF) vulnerability in Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier allows attackers to connect to an attacker-specified UR… |
CVE-2023-50777 | Medium | 4.3 | 2023-12-13 | Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier does not mask PaaSLane authentication tokens displayed on the job configuration form, increasing the potenti… |
CVE-2023-50776 | Medium | 4.3 | 2023-12-13 | Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier stores PaaSLane authentication tokens unencrypted in job config.xml files on the Jenkins controller where th… |
CVE-2023-50775 | Medium | 4.3 | 2023-12-13 | A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to copy jobs. |
CVE-2023-50774 | High | 8.1 | 2023-12-13 | A cross-site request forgery (CSRF) vulnerability in Jenkins HTMLResource Plugin 1.02 and earlier allows attackers to delete arbitrary files on the Jenkins con… |
CVE-2023-50773 | Medium | 4.3 | 2023-12-13 | Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job configuration form, increasing the potential for attackers… |
CVE-2023-50772 | Medium | 4.3 | 2023-12-13 | Jenkins Dingding JSON Pusher Plugin 2.0 and earlier stores access tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed… |
CVE-2023-50771 | Medium | 6.1 | 2023-12-13 | Jenkins OpenId Connect Authentication Plugin 2.6 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowin… |
CVE-2023-50770 | Medium | 6.7 | 2023-12-13 | Jenkins OpenId Connect Authentication Plugin 2.6 and earlier stores a password of a local user account used as an anti-lockout feature in a recoverable format… |
CVE-2023-50769 | Medium | 4.3 | 2023-12-13 | Missing permission checks in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allow attackers with Overall/Read permission to connect to an attacker-specifi… |
CVE-2023-50768 | High | 8.8 | 2023-12-13 | A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allows attackers to connect to an attacker-specified H… |
CVE-2023-50767 | Medium | 5.4 | 2023-12-13 | Missing permission checks in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allow attackers with Overall/Read permission to send an HTTP request to an att… |
CVE-2023-50766 | High | 8.8 | 2023-12-13 | A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allows attackers to send an HTTP request to an attacke… |
CVE-2023-50765 | Medium | 4.3 | 2023-12-13 | A missing permission check in Jenkins Scriptler Plugin 342.v6a_89fd40f466 and earlier allows attackers with Overall/Read permission to read the contents of a G… |
CVE-2023-50764 | High | 8.1 | 2023-12-13 | Jenkins Scriptler Plugin 342.v6a_89fd40f466 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing attackers with Scriptler/Co… |
CVE-2023-49363 | Critical | 9.8 | 2023-12-13 | Rockoa <2.3.3 is vulnerable to SQL Injection. The problem exists in the indexAction method in reimpAction.php. |
CVE-2023-6762 | Medium | 5.4 | 2023-12-13 | A vulnerability, which was classified as critical, was found in Thecosy IceCMS 2.0.1. Affected is an unknown function of the file /article/DelectArticleById/ o… |
CVE-2023-6761 | Medium | 4.3 | 2023-12-13 | A vulnerability, which was classified as problematic, has been found in Thecosy IceCMS up to 2.0.1. This issue affects some unknown processing of the component… |
CVE-2023-6760 | Medium | 6.3 | 2023-12-13 | A vulnerability classified as critical was found in Thecosy IceCMS up to 2.0.1. This vulnerability affects unknown code. The manipulation leads to manage user… |
CVE-2023-6759 | Medium | 5.3 | 2023-12-13 | A vulnerability classified as problematic has been found in Thecosy IceCMS 2.0.1. This affects an unknown part of the file /WebResource/resource of the compone… |
CVE-2023-6758 | Medium | 5.3 | 2023-12-13 | A vulnerability was found in Thecosy IceCMS 2.0.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file /adplanet/Pl… |
CVE-2023-6757 | Medium | 5.3 | 2023-12-13 | A vulnerability was found in Thecosy IceCMS 2.0.1. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2023-6756 | Medium | 5.3 | 2023-12-13 | A vulnerability was found in Thecosy IceCMS 2.0.1. It has been classified as problematic. Affected is an unknown function of the file /login of the component C… |
CVE-2023-48639 | High | 7.8 | 2023-12-13 | Adobe Substance 3D Designer versions 13.0.0 (and earlier) and 13.1.0 (and earlier) are affected by an out-of-bounds write vulnerability that could result in ar… |
CVE-2023-48638 | Medium | 5.5 | 2023-12-13 | Adobe Substance 3D Designer versions 13.0.0 (and earlier) and 13.1.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to discl… |
CVE-2023-48637 | Medium | 5.5 | 2023-12-13 | Adobe Substance 3D Designer versions 13.0.0 (and earlier) and 13.1.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to discl… |
CVE-2023-48636 | Medium | 5.5 | 2023-12-13 | Adobe Substance 3D Designer versions 13.0.0 (and earlier) and 13.1.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to discl… |
CVE-2023-48635 | Medium | 5.5 | 2023-12-13 | Adobe After Effects versions 24.0.3 (and earlier) and 23.6.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of… |
CVE-2023-48634 | High | 7.8 | 2023-12-13 | Adobe After Effects versions 24.0.3 (and earlier) and 23.6.0 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbi… |
CVE-2023-48633 | High | 7.8 | 2023-12-13 | Adobe After Effects versions 24.0.3 (and earlier) and 23.6.0 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code e… |