2023 CVEs (page 88)
Page 88 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-50564 | High | 8.8 | 2023-12-14 | An arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4.7.18 allows attackers to execute arbitrary code via uploading… |
CVE-2023-50563 | Critical | 9.8 | 2023-12-14 | Semcms v4.8 was discovered to contain a SQL injection vulnerability via the AID parameter at SEMCMS_Function.php. |
CVE-2023-50073 | Critical | 9.8 | 2023-12-14 | EmpireCMS v7.5 was discovered to contain a SQL injection vulnerability via the ftppassword parameter at SetEnews.php. |
CVE-2023-50011 | High | 7.2 | 2023-12-14 | PopojiCMS version 2.0.1 is vulnerable to remote command execution in the Meta Social field. |
CVE-2023-49833 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Spectra – WordPress Gutenberg Blocks all… |
CVE-2023-49828 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooPayments – Fully Integrated Solution Built… |
CVE-2023-49827 | High | 7.1 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & Woo… |
CVE-2023-49745 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar allows Stored XSS.This iss… |
CVE-2023-49743 | Medium | 5.9 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Dashboard Widgets Suite allows Stored XSS.This… |
CVE-2023-49740 | High | 7.1 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Seraphinite Solutions Seraphinite Accelerator allows Refl… |
CVE-2023-49739 | High | 7.1 | 2023-12-14 | Vulnerability in IdeaBox Creations PowerPack Pro for Elementor.This issue affects PowerPack Pro for Elementor: from n/a through 2.9.23. |
CVE-2023-49168 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordPlus Better Messages – Live Chat for WordPress, Buddy… |
CVE-2023-44277 | High | 7.8 | 2023-12-14 | Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injection vulnerability in the CLI. A local lo… |
CVE-2023-6572 | High | 8.1 | 2023-12-14 | Command Injection in GitHub repository gradio-app/gradio prior to main. |
CVE-2023-6545 | Medium | 4.7 | 2023-12-14 | The package authelia-bhf included in Beckhoffs TwinCAT/BSD is prone to an open redirect that allows a remote unprivileged attacker to redirect a user to anothe… |
CVE-2023-5592 | High | 7.5 | 2023-12-14 | Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attac… |
CVE-2023-50370 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Livemesh WPBakery Page Builder Addons by Livemesh allows… |
CVE-2023-50369 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alma Alma – Pay in installments or later for WooCommerce… |
CVE-2023-50368 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta Shortcodes and extra features for Phlox theme allo… |
CVE-2023-49847 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Twinpictures Annual Archive allows Stored XSS.This issue… |
CVE-2023-49846 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paul Bearne Author Avatars List/Block allows Stored XSS.T… |
CVE-2023-49836 | Medium | 5.9 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brontobytes Cookie Bar allows Stored XSS.This issue affec… |
CVE-2023-48676 | High | 7.1 | 2023-12-14 | Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows… |
CVE-2023-46144 | Medium | 6.5 | 2023-12-14 | A download of code without integrity check vulnerability in PLCnext products allows an remote attacker with low privileges to compromise integrity on the affec… |
CVE-2023-46143 | High | 7.5 | 2023-12-14 | Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all app… |
CVE-2023-46142 | High | 8.8 | 2023-12-14 | A incorrect permission assignment for critical resource vulnerability in PLCnext products allows an remote attacker with low privileges to gain full access on… |
CVE-2023-46141 | Critical | 9.8 | 2023-12-14 | Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated at… |
CVE-2023-45185 | High | 7.4 | 2023-12-14 | IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 could allow an attacker to execute remote code. Due to improper authority checks… |
CVE-2023-45182 | High | 7.4 | 2023-12-14 | IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 is vulnerable to having its key for an encrypted password decoded. By somehow ga… |
CVE-2023-0757 | Critical | 9.8 | 2023-12-14 | Incorrect Permission Assignment for Critical Resource vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated… |
CVE-2023-6571 | Medium | 6.1 | 2023-12-14 | Cross-site Scripting (XSS) - Reflected in kubeflow/kubeflow |
CVE-2023-6570 | Medium | 6.5 | 2023-12-14 | Server-Side Request Forgery (SSRF) in kubeflow/kubeflow |
CVE-2023-6569 | High | 8.2 | 2023-12-14 | External Control of File Name or Path in h2oai/h2o-3 |
CVE-2023-50371 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Page Visit Counter Advanced Page Visit Counter – Most Wan… |
CVE-2023-48631 | Medium | 5.3 | 2023-12-14 | @adobe/css-tools versions 4.3.1 and earlier are affected by an Improper Input Validation vulnerability that could result in a denial of service while attemptin… |
CVE-2023-49708 | Critical | 9.8 | 2023-12-14 | SQLi vulnerability in Starshop component for Joomla. |
CVE-2023-49707 | Critical | 9.8 | 2023-12-14 | SQLi vulnerability in S5 Register module for Joomla. |
CVE-2023-48925 | Critical | 9.8 | 2023-12-14 | SQL injection vulnerability in Buy Addons bavideotab before version 1.0.6, allows attackers to escalate privileges and obtain sensitive information via the com… |
CVE-2023-46750 | Medium | 6.1 | 2023-12-14 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro 1.13.0… |
CVE-2023-46348 | Critical | 9.8 | 2023-12-14 | SQL njection vulnerability in SunnyToo sturls before version 1.1.13, allows attackers to escalate privileges and obtain sensitive information via StUrls::hookA… |
CVE-2023-40659 | Medium | 6.1 | 2023-12-14 | A reflected XSS vulnerability was discovered in the Easy Quick Contact module for Joomla. |
CVE-2023-40658 | Medium | 6.1 | 2023-12-14 | A reflected XSS vulnerability was discovered in the Clicky Analytics Dashboard module for Joomla. |
CVE-2023-40657 | Medium | 6.1 | 2023-12-14 | A reflected XSS vulnerability was discovered in the Joomdoc component for Joomla. |
CVE-2023-40656 | Medium | 6.1 | 2023-12-14 | A reflected XSS vulnerability was discovered in the Quickform component for Joomla. |
CVE-2023-40655 | Medium | 6.1 | 2023-12-14 | A reflected XSS vulnerability was discovered in the Proforms Basic component for Joomla. |
CVE-2023-40630 | Critical | 9.8 | 2023-12-14 | Unauthenticated LFI/SSRF in JCDashboards component for Joomla. |
CVE-2023-40629 | Critical | 9.8 | 2023-12-14 | SQLi vulnerability in LMS Lite component for Joomla. |
CVE-2023-40628 | Medium | 6.1 | 2023-12-14 | A reflected XSS vulnerability was discovered in the Extplorer component for Joomla. |
CVE-2023-40627 | Medium | 6.1 | 2023-12-14 | A reflected XSS vulnerability was discovered in the LivingWord component for Joomla. |
CVE-2023-25644 | Medium | 6.5 | 2023-12-14 | There is a denial of service vulnerability in some ZTE mobile internet products. Due to insufficient validation of Web interface parameter, an attacker could… |
CVE-2023-25643 | High | 8.4 | 2023-12-14 | There is a command injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of multiple network parameters, an aut… |
CVE-2023-25642 | Medium | 5.9 | 2023-12-14 | There is a buffer overflow vulnerability in some ZTE mobile internet producsts. Due to insufficient validation of tcp port parameter, an authenticated attacke… |
CVE-2023-1904 | Medium | 4.2 | 2023-12-14 | In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of Octopus Server. |
CVE-2023-48085 | Critical | 9.8 | 2023-12-14 | Nagios XI before version 5.11.3 was discovered to contain a remote code execution (RCE) vulnerability via the component command_test.php. |
CVE-2023-48084 | Critical | 9.8 | 2023-12-14 | Nagios XI before version 5.11.3 was discovered to contain a SQL injection vulnerability via the bulk modification tool. |
CVE-2023-25651 | Medium | 4.3 | 2023-12-14 | There is a SQL injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of SMS interface parameter, an authenticated… |
CVE-2023-25650 | Medium | 6.5 | 2023-12-14 | There is an arbitrary file download vulnerability in ZXCLOUD iRAI. Since the backend does not escape special strings or restrict paths, an attacker with user… |
CVE-2023-25648 | Medium | 6.5 | 2023-12-14 | There is a weak folder permission vulnerability in ZTE's ZXCLOUD iRAI product. Due to weak folder permission, an attacker with ordinary user privileges could… |
CVE-2023-44709 | Critical | 9.8 | 2023-12-14 | PlutoSVG commit 336c02997277a1888e6ccbbbe674551a0582e5c4 and before was discovered to contain an integer overflow via the component plutosvg_load_from_memory. |
CVE-2023-6407 | Medium | 5.3 | 2023-12-14 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause arbitrary file deletion upon se… |
CVE-2023-5630 | Medium | 6.5 | 2023-12-14 | A CWE-494: Download of Code Without Integrity Check vulnerability exists that could allow a privileged user to install an untrusted firmware. |
CVE-2023-5629 | High | 8.2 | 2023-12-14 | A CWE-601:URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability exists that could cause disclosure of information through phishing attempts over H… |
CVE-2023-49938 | High | 8.2 | 2023-12-14 | An issue was discovered in SchedMD Slurm 22.05.x and 23.02.x. There is Incorrect Access Control: an attacker can modified their extended group list that is use… |
CVE-2023-49937 | Critical | 9.8 | 2023-12-14 | An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. Because of a double free, attackers can cause a denial of service or possibly execute a… |
CVE-2023-49936 | High | 7.5 | 2023-12-14 | An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. A NULL pointer dereference leads to denial of service. The fixed versions are 22.05.11… |
CVE-2023-49935 | High | 8.8 | 2023-12-14 | An issue was discovered in SchedMD Slurm 23.02.x and 23.11.x. There is Incorrect Access Control because of a slurmd Message Integrity Bypass. An attacker can r… |
CVE-2023-49934 | Critical | 9.8 | 2023-12-14 | An issue was discovered in SchedMD Slurm 23.11.x. There is SQL Injection against the SlurmDBD database. The fixed version is 23.11.1. |
CVE-2023-49933 | High | 7.5 | 2023-12-14 | An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. There is Improper Enforcement of Message Integrity During Transmission in a Communicati… |
CVE-2023-45184 | Medium | 6.2 | 2023-12-14 | IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 could allow an attacker to obtain a decryption key due to improper authority chec… |
CVE-2023-41720 | High | 7.8 | 2023-12-14 | A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker with a foothold on an Ivanti Connect Secure (ICS) appliance can… |
CVE-2023-41719 | High | 7.2 | 2023-12-14 | A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker impersonating an administrator may craft a specific web request… |
CVE-2023-43042 | High | 7.5 | 2023-12-14 | IBM SAN Volume Controller, IBM Storwize, IBM FlashSystem and IBM Storage Virtualize 8.3 products use default passwords for a privileged user. IBM X-Force ID… |
CVE-2023-31546 | Critical | 9.6 | 2023-12-14 | Cross Site Scripting (XSS) vulnerability in DedeBIZ v6.0.3 allows attackers to run arbitrary code via the search feature. |
CVE-2023-41618 | Medium | 6.1 | 2023-12-14 | Emlog Pro v2.1.14 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /admin/article.php?active_savedraft. |
CVE-2023-40921 | Critical | 9.8 | 2023-12-14 | SQL Injection vulnerability in functions/point_list.php in Common Services soliberte before v4.3.03 allows attackers to obtain sensitive information via the la… |
CVE-2023-21751 | Medium | 6.5 | 2023-12-14 | Azure DevOps Server Spoofing Vulnerability |
CVE-2023-49646 | Medium | 6.4 | 2023-12-13 | Improper authentication in some Zoom clients before version 5.16.5 may allow an authenticated user to conduct a denial of service via network access. |
CVE-2023-45174 | High | 8.4 | 2023-12-13 | IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a privileged local user to exploit a vulnerability in the qdaemon command to escalate privileges or cause a denial o… |
CVE-2023-45170 | High | 8.4 | 2023-12-13 | IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the piobe command to escalate privileges or cause a denial… |
CVE-2023-45166 | High | 8.4 | 2023-12-13 | IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the piodmgrsu command to obtain elevated privileges. IBM… |
CVE-2023-43586 | High | 7.3 | 2023-12-13 | Path traversal in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows may allow an authenticated user to conduct an escalat… |
CVE-2023-43585 | High | 7.1 | 2023-12-13 | Improper access control in Zoom Mobile App for iOS and Zoom SDKs for iOS before version 5.16.5 may allow an authenticated user to conduct a disclosure of infor… |
CVE-2023-43583 | Medium | 4.9 | 2023-12-13 | Cryptographic issues Zoom Mobile App for Android, Zoom Mobile App for iOS, and Zoom SDKs for Android and iOS before version 5.16.0 may allow a privileged user… |
CVE-2023-41621 | Medium | 6.1 | 2023-12-13 | A Cross Site Scripting (XSS) vulnerability was discovered in Emlog Pro v2.1.14 via the component /admin/store.php. |
CVE-2023-50709 | Medium | 6.5 | 2023-12-13 | Cube is a semantic layer for building data applications. Prior to version 0.34.34, it is possible to make the entire Cube API unavailable by submitting a speci… |
CVE-2023-47623 | Medium | 6.1 | 2023-12-13 | Scrypted is a home video integration and automation platform. In versions 0.55.0 and prior, a reflected cross-site scripting vulnerability exists in the login… |
CVE-2023-47620 | Medium | 6.1 | 2023-12-13 | Scrypted is a home video integration and automation platform. In versions 0.55.0 and prior, a reflected cross-site scripting vulnerability exists in the plugin… |
CVE-2023-6775 | Low | 3.5 | 2023-12-13 | A vulnerability was found in CodeAstro POS and Inventory Management System 1.0. It has been classified as problematic. This affects an unknown part of the file… |
CVE-2023-50443 | Medium | 4.6 | 2023-12-13 | Encrypted disks created by PRIMX CRYHOD for Windows before Q.2020.4 (ANSSI qualification submission) or CRYHOD for Windows before 2023.5 can be modified by an… |
CVE-2023-50442 | Medium | 5.5 | 2023-12-13 | Encrypted folders created by PRIMX ZONECENTRAL through 2023.5 can be modified by a local attacker (with appropriate privileges) so that specific file types are… |
CVE-2023-50440 | Medium | 5.5 | 2023-12-13 | ZED containers produced by PRIMX ZED! for Windows before Q.2020.3 (ANSSI qualification submission); ZED! for Windows before Q.2021.2 (ANSSI qualification submi… |
CVE-2023-50439 | Medium | 5.3 | 2023-12-13 | ZED containers produced by PRIMX ZED! for Windows before Q.2020.3 (ANSSI qualification submission), ZED! for Windows before Q.2021.2 (ANSSI qualification submi… |
CVE-2023-50268 | Medium | 6.2 | 2023-12-13 | jq is a command-line JSON processor. Version 1.7 is vulnerable to stack-based buffer overflow in builds using decNumber. Version 1.7.1 contains a patch for thi… |
CVE-2023-50262 | Medium | 5.3 | 2023-12-13 | Dompdf is an HTML to PDF converter for PHP. When parsing SVG images Dompdf performs an initial validation to ensure that paths within the SVG are allowed. One… |
CVE-2023-50248 | Medium | 4.5 | 2023-12-13 | CKAN is an open-source data management system for powering data hubs and data portals. Starting in version 2.0.0 and prior to versions 2.9.10 and 2.10.3, when… |
CVE-2023-50246 | Medium | 6.2 | 2023-12-13 | jq is a command-line JSON processor. Version 1.7 is vulnerable to heap-based buffer overflow. Version 1.7.1 contains a patch for this issue. |
CVE-2023-49878 | Medium | 4.3 | 2023-12-13 | IBM System Storage Virtualization Engine TS7700 3957-VEC, 3948-VED and 3957-VEC could allow a remote attacker to obtain sensitive information when a detailed t… |
CVE-2023-49877 | Medium | 4.3 | 2023-12-13 | IBM System Storage Virtualization Engine TS7700 3957-VEC, 3948-VED and 3957-VEC could allow a remote authenticated user to obtain sensitive information, caused… |
CVE-2023-48702 | High | 7.2 | 2023-12-13 | Jellyfin is a system for managing and streaming media. Prior to version 10.8.13, the `/System/MediaEncoder/Path` endpoint executes an arbitrary file using `Pro… |
CVE-2023-47624 | High | 7.5 | 2023-12-13 | Audiobookshelf is a self-hosted audiobook and podcast server. In versions 2.4.3 and prior, any user (regardless of their permissions) may be able to read files… |