2023 CVEs (page 89)
Page 89 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-47619 | High | 8.1 | 2023-12-13 | Audiobookshelf is a self-hosted audiobook and podcast server. In versions 2.4.3 and prior, users with the update permission are able to read arbitrary files, d… |
CVE-2023-6774 | Medium | 4.3 | 2023-12-13 | A vulnerability was found in CodeAstro POS and Inventory Management System 1.0 and classified as problematic. Affected by this issue is some unknown functional… |
CVE-2023-6773 | Medium | 4.3 | 2023-12-13 | A vulnerability has been found in CodeAstro POS and Inventory Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown… |
CVE-2023-50444 | High | 7.5 | 2023-12-13 | By default, .ZED containers produced by PRIMX ZED! for Windows before Q.2020.3 (ANSSI qualification submission); ZED! for Windows before Q.2021.2 (ANSSI qualif… |
CVE-2023-50441 | Medium | 5.5 | 2023-12-13 | Encrypted folders created by PRIMX ZONECENTRAL for Windows before Q.2021.2 (ANSSI qualification submission) or ZONECENTRAL for Windows before 2023.5 can be mod… |
CVE-2023-49296 | Medium | 6.3 | 2023-12-13 | The Arduino Create Agent allows users to use the Arduino Create applications to upload code to any USB connected Arduino board directly from the browser. A vul… |
CVE-2023-46247 | High | 7.5 | 2023-12-13 | Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Contracts containing large arrays might underallocate the number of slots t… |
CVE-2023-6795 | Medium | 5.5 | 2023-12-13 | An OS command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to disrupt system processes and potentially… |
CVE-2023-6794 | Medium | 5.5 | 2023-12-13 | An arbitrary file upload vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface… |
CVE-2023-6793 | Low | 2.7 | 2023-12-13 | An improper privilege management vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to revoke active XML API… |
CVE-2023-6792 | Medium | 5.5 | 2023-12-13 | An OS command injection vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated API user to disrupt system processes and po… |
CVE-2023-6791 | Medium | 4.9 | 2023-12-13 | A credential disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to obtain the plaintext credential… |
CVE-2023-6790 | High | 8.8 | 2023-12-13 | A DOM-Based cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to execute a JavaScript payload in the con… |
CVE-2023-6789 | Medium | 4.3 | 2023-12-13 | A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a JavaScri… |
CVE-2023-6772 | Medium | 4.7 | 2023-12-13 | A vulnerability, which was classified as critical, was found in OTCMS 7.01. Affected is an unknown function of the file /admin/ind_backstage.php. The manipulat… |
CVE-2023-6771 | Medium | 5.5 | 2023-12-13 | A vulnerability, which was classified as critical, has been found in SourceCodester Simple Student Attendance System 1.0. This issue affects the function save_… |
CVE-2023-46727 | High | 8.6 | 2023-12-13 | GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, GLPI inventory endpoint can be used to drive… |
CVE-2023-46726 | High | 7.2 | 2023-12-13 | GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, on PHP 7.4 only, the LDAP server configuratio… |
CVE-2023-43813 | Medium | 6.5 | 2023-12-13 | GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, the saved search feature can be used to perfo… |
CVE-2023-6767 | Medium | 4.3 | 2023-12-13 | A vulnerability, which was classified as problematic, was found in SourceCodester Wedding Guest e-Book 1.0. This affects an unknown part of the file /endpoint/… |
CVE-2023-6766 | Medium | 4.3 | 2023-12-13 | A vulnerability classified as problematic has been found in PHPGurukul Teacher Subject Allocation Management System 1.0. Affected is an unknown function of the… |
CVE-2023-6765 | Medium | 5.5 | 2023-12-13 | A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been rated as critical. This issue affects the function prepar… |
CVE-2023-50779 | Medium | 4.3 | 2023-12-13 | Missing permission checks in Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier allow attackers with Overall/Read permission to connect to an attacker-specifie… |
CVE-2023-50778 | High | 8.8 | 2023-12-13 | A cross-site request forgery (CSRF) vulnerability in Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier allows attackers to connect to an attacker-specified UR… |
CVE-2023-50777 | Medium | 4.3 | 2023-12-13 | Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier does not mask PaaSLane authentication tokens displayed on the job configuration form, increasing the potenti… |
CVE-2023-50776 | Medium | 4.3 | 2023-12-13 | Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier stores PaaSLane authentication tokens unencrypted in job config.xml files on the Jenkins controller where th… |
CVE-2023-50775 | Medium | 4.3 | 2023-12-13 | A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to copy jobs. |
CVE-2023-50774 | High | 8.1 | 2023-12-13 | A cross-site request forgery (CSRF) vulnerability in Jenkins HTMLResource Plugin 1.02 and earlier allows attackers to delete arbitrary files on the Jenkins con… |
CVE-2023-50773 | Medium | 4.3 | 2023-12-13 | Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job configuration form, increasing the potential for attackers… |
CVE-2023-50772 | Medium | 4.3 | 2023-12-13 | Jenkins Dingding JSON Pusher Plugin 2.0 and earlier stores access tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed… |
CVE-2023-50771 | Medium | 6.1 | 2023-12-13 | Jenkins OpenId Connect Authentication Plugin 2.6 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowin… |
CVE-2023-50770 | Medium | 6.7 | 2023-12-13 | Jenkins OpenId Connect Authentication Plugin 2.6 and earlier stores a password of a local user account used as an anti-lockout feature in a recoverable format… |
CVE-2023-50769 | Medium | 4.3 | 2023-12-13 | Missing permission checks in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allow attackers with Overall/Read permission to connect to an attacker-specifi… |
CVE-2023-50768 | High | 8.8 | 2023-12-13 | A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allows attackers to connect to an attacker-specified H… |
CVE-2023-50767 | Medium | 5.4 | 2023-12-13 | Missing permission checks in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allow attackers with Overall/Read permission to send an HTTP request to an att… |
CVE-2023-50766 | High | 8.8 | 2023-12-13 | A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allows attackers to send an HTTP request to an attacke… |
CVE-2023-50765 | Medium | 4.3 | 2023-12-13 | A missing permission check in Jenkins Scriptler Plugin 342.v6a_89fd40f466 and earlier allows attackers with Overall/Read permission to read the contents of a G… |
CVE-2023-50764 | High | 8.1 | 2023-12-13 | Jenkins Scriptler Plugin 342.v6a_89fd40f466 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing attackers with Scriptler/Co… |
CVE-2023-49363 | Critical | 9.8 | 2023-12-13 | Rockoa <2.3.3 is vulnerable to SQL Injection. The problem exists in the indexAction method in reimpAction.php. |
CVE-2023-6762 | Medium | 5.4 | 2023-12-13 | A vulnerability, which was classified as critical, was found in Thecosy IceCMS 2.0.1. Affected is an unknown function of the file /article/DelectArticleById/ o… |
CVE-2023-6761 | Medium | 4.3 | 2023-12-13 | A vulnerability, which was classified as problematic, has been found in Thecosy IceCMS up to 2.0.1. This issue affects some unknown processing of the component… |
CVE-2023-6760 | Medium | 6.3 | 2023-12-13 | A vulnerability classified as critical was found in Thecosy IceCMS up to 2.0.1. This vulnerability affects unknown code. The manipulation leads to manage user… |
CVE-2023-6759 | Medium | 5.3 | 2023-12-13 | A vulnerability classified as problematic has been found in Thecosy IceCMS 2.0.1. This affects an unknown part of the file /WebResource/resource of the compone… |
CVE-2023-6758 | Medium | 5.3 | 2023-12-13 | A vulnerability was found in Thecosy IceCMS 2.0.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file /adplanet/Pl… |
CVE-2023-6757 | Medium | 5.3 | 2023-12-13 | A vulnerability was found in Thecosy IceCMS 2.0.1. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2023-6756 | Medium | 5.3 | 2023-12-13 | A vulnerability was found in Thecosy IceCMS 2.0.1. It has been classified as problematic. Affected is an unknown function of the file /login of the component C… |
CVE-2023-48639 | High | 7.8 | 2023-12-13 | Adobe Substance 3D Designer versions 13.0.0 (and earlier) and 13.1.0 (and earlier) are affected by an out-of-bounds write vulnerability that could result in ar… |
CVE-2023-48638 | Medium | 5.5 | 2023-12-13 | Adobe Substance 3D Designer versions 13.0.0 (and earlier) and 13.1.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to discl… |
CVE-2023-48637 | Medium | 5.5 | 2023-12-13 | Adobe Substance 3D Designer versions 13.0.0 (and earlier) and 13.1.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to discl… |
CVE-2023-48636 | Medium | 5.5 | 2023-12-13 | Adobe Substance 3D Designer versions 13.0.0 (and earlier) and 13.1.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to discl… |
CVE-2023-48635 | Medium | 5.5 | 2023-12-13 | Adobe After Effects versions 24.0.3 (and earlier) and 23.6.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of… |
CVE-2023-48634 | High | 7.8 | 2023-12-13 | Adobe After Effects versions 24.0.3 (and earlier) and 23.6.0 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbi… |
CVE-2023-48633 | High | 7.8 | 2023-12-13 | Adobe After Effects versions 24.0.3 (and earlier) and 23.6.0 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code e… |
CVE-2023-48632 | High | 7.8 | 2023-12-13 | Adobe After Effects versions 24.0.3 (and earlier) and 23.6.0 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary… |
CVE-2023-48630 | High | 7.8 | 2023-12-13 | Adobe Substance 3D Sampler versions 4.2.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the… |
CVE-2023-48629 | High | 7.8 | 2023-12-13 | Adobe Substance 3D Sampler versions 4.2.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the… |
CVE-2023-48628 | High | 7.8 | 2023-12-13 | Adobe Substance 3D Sampler versions 4.2.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the… |
CVE-2023-48627 | High | 7.8 | 2023-12-13 | Adobe Substance 3D Sampler versions 4.2.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the… |
CVE-2023-48626 | High | 7.8 | 2023-12-13 | Adobe Substance 3D Sampler versions 4.2.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the… |
CVE-2023-48625 | High | 7.8 | 2023-12-13 | Adobe Substance 3D Sampler versions 4.2.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the… |
CVE-2023-47327 | Medium | 4.3 | 2023-12-13 | The "Create a Space" feature in Silverpeas Core 6.3.1 is reserved for use by administrators. This function suffers from broken access control, allowing any aut… |
CVE-2023-47326 | High | 8.8 | 2023-12-13 | Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) via the Domain SQL Create function. |
CVE-2023-47325 | Medium | 5.4 | 2023-12-13 | Silverpeas Core 6.3.1 administrative "Bin" feature is affected by broken access control. A user with low privileges is able to navigate directly to the bin, re… |
CVE-2023-47324 | Medium | 5.4 | 2023-12-13 | Silverpeas Core 6.3.1 is vulnerable to Cross Site Scripting (XSS) via the message/notification feature. |
CVE-2023-47323 | High | 7.5 | 2023-12-13 | The notification/messaging feature of Silverpeas Core 6.3.1 does not enforce access control on the ID parameter. This allows an attacker to read all messages s… |
CVE-2023-47322 | High | 8.8 | 2023-12-13 | The "userModify" feature of Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) leading to privilege escalation. If an administrator goes… |
CVE-2023-47321 | Medium | 4.9 | 2023-12-13 | Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets. |
CVE-2023-47320 | High | 8.1 | 2023-12-13 | Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control. An attacker with low privileges is able to execute the administrator-only function of putting… |
CVE-2023-47081 | Medium | 5.5 | 2023-12-13 | Adobe Substance 3D Stager versions 2.1.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An… |
CVE-2023-47080 | Medium | 5.5 | 2023-12-13 | Adobe Substance 3D Stager versions 2.1.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An… |
CVE-2023-34194 | High | 7.5 | 2023-12-13 | StringEqual in TiXmlDeclaration::Parse in tinyxmlparser.cpp in TinyXML through 2.6.2 has a reachable assertion (and application exit) via a crafted XML documen… |
CVE-2023-6755 | Medium | 4.7 | 2023-12-13 | A vulnerability was found in DedeBIZ 6.2 and classified as critical. This issue affects some unknown processing of the file /src/admin/content_batchup_action.p… |
CVE-2023-47079 | Medium | 5.5 | 2023-12-13 | Adobe Dimension versions 3.4.10 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker… |
CVE-2023-47078 | Medium | 5.5 | 2023-12-13 | Adobe Dimension versions 3.4.10 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker… |
CVE-2023-47062 | Medium | 5.5 | 2023-12-13 | Adobe Dimension versions 3.4.10 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker… |
CVE-2023-47061 | Medium | 5.5 | 2023-12-13 | Adobe Dimension versions 3.4.10 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker… |
CVE-2023-42495 | Critical | 9.8 | 2023-12-13 | Dasan Networks - W-Web versions 1.22-1.27 - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') |
CVE-2023-44362 | Medium | 5.5 | 2023-12-13 | Adobe Prelude versions 22.6 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could lead to disclosure of sensitive memory. An… |
CVE-2023-6723 | Critical | 10.0 | 2023-12-13 | An unrestricted file upload vulnerability has been identified in Repbox, which allows an attacker to upload malicious files via the transforamationfileupload f… |
CVE-2023-6381 | Low | 3.3 | 2023-12-13 | Improper input validation vulnerability in Newsletter Software SuperMailer affecting version 11.20.0.2204. An attacker could exploit this vulnerability by send… |
CVE-2023-6380 | Medium | 6.1 | 2023-12-13 | Open redirect vulnerability has been found in the Open CMS product affecting versions 14 and 15 of the 'Mercury' template. An attacker could create a specially… |
CVE-2023-6379 | Medium | 5.4 | 2023-12-13 | Cross-site scripting (XSS) vulnerability in Alkacon Software Open CMS, affecting versions 14 and 15 of the 'Mercury' template. This vulnerability could allow a… |
CVE-2023-6722 | High | 7.5 | 2023-12-13 | A path traversal vulnerability has been detected in Repox, which allows an attacker to read arbitrary files on the running server, resulting in a disclosure of… |
CVE-2023-6721 | High | 8.3 | 2023-12-13 | An XEE vulnerability has been found in Repox, which allows a remote attacker to interfere with the application's XML data processing in the fileupload function… |
CVE-2023-6720 | Medium | 5.5 | 2023-12-13 | An XSS vulnerability stored in Repox has been identified, which allows a local attacker to store a specially crafted JavaScript payload on the server, due to t… |
CVE-2023-6719 | Medium | 6.3 | 2023-12-13 | An XSS vulnerability has been detected in Repox, which allows an attacker to compromise interactions between a user and the vulnerable application, and can be… |
CVE-2023-47077 | Medium | 5.5 | 2023-12-13 | Adobe InDesign versions 19.0 (and earlier) and 17.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensit… |
CVE-2023-47076 | Medium | 5.5 | 2023-12-13 | Adobe InDesign versions 19.0 (and earlier) and 17.4.2 (and earlier) are affected by a NULL Pointer Dereference vulnerability. An unauthenticated attacker could… |
CVE-2023-47075 | High | 7.8 | 2023-12-13 | Adobe Illustrator versions 28.0 (and earlier) and 27.9 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code executi… |
CVE-2023-47074 | High | 7.8 | 2023-12-13 | Adobe Illustrator versions 28.0 (and earlier) and 27.9 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which cou… |
CVE-2023-47063 | High | 7.8 | 2023-12-13 | Adobe Illustrator versions 28.0 (and earlier) and 27.9 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code e… |
CVE-2023-6718 | Critical | 9.4 | 2023-12-13 | An authentication bypass vulnerability has been found in Repox, which allows a remote user to send a specially crafted POST request, due to the lack of any aut… |
CVE-2023-6660 | Medium | 6.5 | 2023-12-13 | When a program running on an affected system appends data to a file via an NFS client mount, the bug can cause the NFS client to fail to copy in the data to be… |
CVE-2023-6534 | High | 7.5 | 2023-12-13 | In versions of FreeBSD 14.0-RELEASE before 14-RELEASE-p2, FreeBSD 13.2-RELEASE before 13.2-RELEASE-p7 and FreeBSD 12.4-RELEASE before 12.4-RELEASE-p9, the pf(4… |
CVE-2023-44252 | High | 8.8 | 2023-12-13 | ** UNSUPPORTED WHEN ASSIGNED **An improper authentication vulnerability [CWE-287] in Fortinet FortiWAN version 5.2.0 through 5.2.1 and version 5.1.1 through 5… |
CVE-2023-44251 | High | 8.3 | 2023-12-13 | ** UNSUPPORTED WHEN ASSIGNED **A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability [CWE-22] in Fortinet FortiWAN ver… |
CVE-2023-31210 | High | 8.8 | 2023-12-13 | Usage of user controlled LD_LIBRARY_PATH in agent in Checkmk 2.2.0p10 up to 2.2.0p16 allows malicious Checkmk site user to escalate rights via injection of mal… |
CVE-2023-47536 | Low | 3.1 | 2023-12-13 | An improper access control vulnerability [CWE-284] in FortiOS version 7.2.0, version 7.0.13 and below, version 6.4.14 and below and FortiProxy version 7.2.3 an… |
CVE-2023-45725 | Medium | 5.7 | 2023-12-13 | Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document. T… |
CVE-2023-6478 | High | 7.6 | 2023-12-13 | A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer overflow which may le… |