2023 CVEs (page 92)
Page 92 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-49805 | Medium | 6.0 | 2023-12-11 | Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, the application uses WebSocket (with Socket.io), but it does not verify tha… |
CVE-2023-49804 | Medium | 6.7 | 2023-12-11 | Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, when a user changes their login password in Uptime Kuma, a previously logge… |
CVE-2023-49803 | High | 8.6 | 2023-12-11 | @koa/cors npm provides Cross-Origin Resource Sharing (CORS) for koa, a web framework for Node.js. Prior to version 5.0.0, the middleware operates in a way that… |
CVE-2023-49802 | Medium | 6.7 | 2023-12-11 | The LinkedCustomFields plugin for MantisBT allows users to link values between two custom fields, creating linked drop-downs. Prior to version 2.0.1, cross-sit… |
CVE-2023-45292 | Medium | 5.3 | 2023-12-11 | When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a non-existent id, the… |
CVE-2023-49796 | Medium | 5.3 | 2023-12-11 | MindsDB connects artificial intelligence models to real time data. Versions prior to 23.11.4.1 contain a limited file write vulnerability in `file.py` Users sh… |
CVE-2023-49494 | Medium | 6.1 | 2023-12-11 | DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component select_media_post_wangEditor.php. |
CVE-2023-49490 | Medium | 6.1 | 2023-12-11 | XunRuiCMS v4.5.5 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /admin.php. |
CVE-2023-49488 | Medium | 6.1 | 2023-12-11 | A cross-site scripting (XSS) vulnerability in Openfiler ESA v2.99.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload i… |
CVE-2023-6035 | High | 8.8 | 2023-12-11 | The EazyDocs WordPress plugin before 2.3.4 does not properly sanitize and escape "data" parameter before using it in an SQL statement via an AJAX action, which… |
CVE-2023-5955 | Medium | 4.8 | 2023-12-11 | The Contact Form Email WordPress plugin before 1.3.44 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2023-5940 | Medium | 4.8 | 2023-12-11 | The WP Not Login Hide (WPNLH) WordPress plugin through 1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2023-5907 | Medium | 6.5 | 2023-12-11 | The File Manager WordPress plugin before 6.3 does not restrict the file managers root directory, allowing an administrator to set a root outside of the WordPre… |
CVE-2023-5757 | Medium | 4.8 | 2023-12-11 | The WP Crowdfunding WordPress plugin before 2.1.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2023-5750 | Medium | 6.1 | 2023-12-11 | The EmbedPress WordPress plugin before 3.9.2 does not sanitise and escape a parameter before outputting it back in the page containing a specific content, lead… |
CVE-2023-5749 | Medium | 6.1 | 2023-12-11 | The EmbedPress WordPress plugin before 3.9.2 does not sanitise and escape user input before outputting it back in the page, leading to a Reflected Cross-Site S… |
CVE-2023-6679 | Medium | 5.5 | 2023-12-11 | A null pointer dereference vulnerability was found in dpll_pin_parent_pin_set() in drivers/dpll/dpll_netlink.c in the Digital Phase Locked Loop (DPLL) subsyste… |
CVE-2023-49795 | Medium | 6.5 | 2023-12-11 | MindsDB connects artificial intelligence models to real time data. Versions prior to 23.11.4.1 contain a server-side request forgery vulnerability in `file.py`… |
CVE-2023-48715 | Medium | 5.4 | 2023-12-11 | Tuleap is an open source suite to improve management of software developments and collaboration. Prior to version 15.2.99.103 of Tuleap Community Edition and p… |
CVE-2023-6538 | High | 7.6 | 2023-12-11 | SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation. Authenticated users in Storage, Server or co… |
CVE-2023-6671 | Medium | 6.3 | 2023-12-11 | A vulnerability has been discovered on OJS, that consists in a CSRF (Cross-Site Request Forgery) attack that forces an end user to execute unwanted actions on… |
CVE-2023-6194 | Low | 2.8 | 2023-12-11 | In Eclipse Memory Analyzer versions 0.7 to 1.14.0, report definition XML files are not filtered to prohibit document type definition (DTD) references to extern… |
CVE-2023-49418 | Critical | 9.8 | 2023-12-11 | TOTOLink A7000R V9.1.0u.6115_B20201022has a stack overflow vulnerability via setIpPortFilterRules. |
CVE-2023-49417 | Critical | 9.8 | 2023-12-11 | TOTOLink A7000R V9.1.0u.6115_B20201022 has a stack overflow vulnerability via setOpModeCfg. |
CVE-2023-6186 | High | 8.3 | 2023-12-11 | Insufficient macro permission validation of The Document Foundation LibreOffice allows an attacker to execute built-in macros without warning. In affected ver… |
CVE-2023-6185 | High | 8.3 | 2023-12-11 | Improper Input Validation vulnerability in GStreamer integration of The Document Foundation LibreOffice allows an attacker to execute arbitrary GStreamer plugi… |
CVE-2023-49964 | High | 8.8 | 2023-12-11 | An issue was discovered in Hyland Alfresco Community Edition through 7.2.0. By inserting malicious content in the folder.get.html.ftl file, an attacker may per… |
CVE-2023-5500 | High | 8.8 | 2023-12-11 | This vulnerability allows an remote attacker with low privileges to misuse Improper Control of Generation of Code ('Code Injection') to gain full control of th… |
CVE-2023-49355 | High | 7.5 | 2023-12-11 | decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " []-1.2e-1111111111" input. NOTE: this is not the same as CVE-20… |
CVE-2023-6181 | Critical | 9.8 | 2023-12-11 | An oversight in BCB handling of reboot reason that allows for persistent code execution |
CVE-2023-48425 | Critical | 9.8 | 2023-12-11 | U-Boot vulnerability resulting in persistent Code Execution |
CVE-2023-48424 | Critical | 9.8 | 2023-12-11 | U-Boot shell vulnerability resulting in Privilege escalation in a production device |
CVE-2023-48417 | Critical | 9.8 | 2023-12-11 | Missing Permission checks resulting in unauthorized access and Manipulation in KeyChainActivity Application |
CVE-2023-6659 | Medium | 6.3 | 2023-12-11 | A vulnerability, which was classified as critical, has been found in Campcodes Web-Based Student Clearance System 1.0. This issue affects some unknown processi… |
CVE-2023-50465 | Medium | 5.4 | 2023-12-11 | A stored cross-site scripting (XSS) vulnerability exists in Monica (aka MonicaHQ) 4.0.0 via an SVG document uploaded by an authenticated user. |
CVE-2023-6658 | Medium | 5.5 | 2023-12-10 | A vulnerability classified as critical was found in SourceCodester Simple Student Attendance System 1.0. This vulnerability affects unknown code of the file aj… |
CVE-2023-50463 | Medium | 6.5 | 2023-12-10 | The caddy-geo-ip (aka GeoIP) middleware through 0.6.0 for Caddy 2, when trust_header X-Forwarded-For is used, allows attackers to spoof their source IP address… |
CVE-2023-6657 | Medium | 5.5 | 2023-12-10 | A vulnerability classified as critical has been found in SourceCodester Simple Student Attendance System 1.0. This affects an unknown part of the file /modals/… |
CVE-2023-6656 | Medium | 5.0 | 2023-12-10 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in DeepFaceLab pretrained DF.wf.288res.384.92.72.22. It has been rated as critical. Affected by this… |
CVE-2023-50457 | Medium | 4.3 | 2023-12-10 | An issue was discovered in Zammad before 6.2.0. When listing tickets linked to a knowledge base answer, or knowledge base answers of a ticket, a user could see… |
CVE-2023-50456 | Medium | 5.3 | 2023-12-10 | An issue was discovered in Zammad before 6.2.0. An attacker can trigger phishing links in generated notification emails via a crafted first or last name. |
CVE-2023-50455 | High | 7.5 | 2023-12-10 | An issue was discovered in Zammad before 6.2.0. Due to lack of rate limiting in the "email address verification" feature, an attacker could send many requests… |
CVE-2023-50454 | Medium | 5.9 | 2023-12-10 | An issue was discovered in Zammad before 6.2.0. In several subsystems, SSL/TLS was used to establish connections to external services without proper validation… |
CVE-2023-50453 | Medium | 5.3 | 2023-12-10 | An issue was discovered in Zammad before 6.2.0. It uses the public endpoint /api/v1/signshow for its login screen. This endpoint returns internal configuration… |
CVE-2023-5870 | Low | 2.2 | 2023-12-10 | A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum wor… |
CVE-2023-5869 | High | 8.8 | 2023-12-10 | A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modifi… |
CVE-2023-5868 | Medium | 4.3 | 2023-12-10 | A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function cal… |
CVE-2023-50449 | High | 7.5 | 2023-12-10 | JFinalCMS 5.0.0 could allow a remote attacker to read files via ../ Directory Traversal in the /common/down/file fileKey parameter. |
CVE-2023-50446 | High | 7.8 | 2023-12-10 | An issue was discovered in Mullvad VPN Windows app before 2023.6-beta1. Insufficient permissions on a directory allow any local unprivileged user to escalate p… |
CVE-2023-6655 | High | 7.3 | 2023-12-10 | A vulnerability, which was classified as critical, has been found in Hongjing e-HR 2020. Affected by this issue is some unknown functionality of the file /w_se… |
CVE-2023-6654 | Medium | 6.3 | 2023-12-10 | A vulnerability classified as critical was found in PHPEMS 6.x/7.x/8.x/9.0. Affected by this vulnerability is an unknown functionality in the library lib/sessi… |
CVE-2023-6653 | Medium | 4.3 | 2023-12-10 | A vulnerability was found in PHPGurukul Teacher Subject Allocation Management System 1.0. It has been rated as problematic. Affected by this issue is some unkn… |
CVE-2023-6652 | High | 7.3 | 2023-12-10 | A vulnerability was found in code-projects Matrimonial Site 1.0. It has been declared as critical. Affected by this vulnerability is the function register of t… |
CVE-2023-6651 | High | 7.3 | 2023-12-10 | A vulnerability was found in code-projects Matrimonial Site 1.0. It has been classified as critical. Affected is an unknown function of the file /auth/auth.php… |
CVE-2023-6650 | Medium | 4.3 | 2023-12-10 | A vulnerability was found in SourceCodester Simple Invoice Generator System 1.0 and classified as problematic. This issue affects some unknown processing of th… |
CVE-2023-6649 | Medium | 4.3 | 2023-12-10 | A vulnerability has been found in PHPGurukul Teacher Subject Allocation Management System 1.0 and classified as problematic. This vulnerability affects unknown… |
CVE-2023-6648 | High | 7.3 | 2023-12-10 | A vulnerability, which was classified as critical, was found in PHPGurukul Nipah Virus Testing Management System 1.0. This affects an unknown part of the file… |
CVE-2023-6647 | High | 7.3 | 2023-12-10 | A vulnerability, which was classified as critical, has been found in AMTT HiBOS 1.0. Affected by this issue is some unknown functionality. The manipulation of… |
CVE-2023-50431 | Medium | 5.5 | 2023-12-09 | sec_attest_info in drivers/accel/habanalabs/common/habanalabs_ioctl.c in the Linux kernel through 6.6.5 allows an information leak to user space because info->… |
CVE-2023-6646 | Low | 3.5 | 2023-12-09 | A vulnerability classified as problematic has been found in linkding 1.23.0. Affected is an unknown function. The manipulation of the argument q leads to cross… |
CVE-2023-50430 | Medium | 6.4 | 2023-12-09 | The Goodix Fingerprint Device, as shipped in Dell Inspiron 15 computers, does not follow the Secure Device Connection Protocol (SDCP) when enrolling via Linux… |
CVE-2023-50429 | Critical | 9.1 | 2023-12-09 | IzyBat Orange casiers before 20230803_1 allows getEnsemble.php ensemble SQL injection. |
CVE-2023-50428 | Medium | 5.3 | 2023-12-09 | In Bitcoin Core through 26.0 and Bitcoin Knots before 25.1.knots20231115, datacarrier size limits can be bypassed by obfuscating data as code (e.g., with OP_FA… |
CVE-2023-47254 | Critical | 9.8 | 2023-12-09 | An OS Command Injection in the CLI interface on DrayTek Vigor167 version 5.2.2, allows remote attackers to execute arbitrary system commands and escalate privi… |
CVE-2023-6120 | Medium | 4.1 | 2023-12-09 | The Welcart e-Commerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.6 via the upload_certificate_file fu… |
CVE-2023-5756 | Medium | 5.4 | 2023-12-09 | The Digital Publications by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.6. This is due to… |
CVE-2023-46932 | Critical | 9.8 | 2023-12-09 | Heap Buffer Overflow vulnerability in GPAC version 2.3-DEV-rev617-g671976fcc-master, allows attackers to execute arbitrary code and cause a denial of service (… |
CVE-2023-28874 | Medium | 6.1 | 2023-12-09 | The next parameter in the /accounts/login endpoint of Seafile 9.0.6 allows attackers to redirect users to arbitrary sites. |
CVE-2023-28873 | Medium | 5.4 | 2023-12-09 | An XSS issue in wiki and discussion pages in Seafile 9.0.6 allows attackers to inject JavaScript into the Markdown editor. |
CVE-2023-28871 | Medium | 4.3 | 2023-12-09 | Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to read registry information of the operating system by creating a symbolic lin… |
CVE-2023-28870 | Medium | 6.5 | 2023-12-09 | Insecure File Permissions in Support Assistant in NCP Secure Enterprise Client before 12.22 allow attackers to write to configuration files from low-privileged… |
CVE-2023-28869 | Medium | 6.5 | 2023-12-09 | Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers read the contents of arbitrary files on the operating system by creating a symb… |
CVE-2023-28868 | High | 8.1 | 2023-12-09 | Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to delete arbitrary files on the operating system by creating a symbolic link. |
CVE-2023-47465 | Medium | 5.5 | 2023-12-09 | An issue in GPAC v.2.2.1 and before allows a local attacker to cause a denial of service (DoS) via the ctts_box_read function of file src/isomedia/box_code_bas… |
CVE-2023-47722 | Medium | 6.2 | 2023-12-09 | IBM API Connect V10.0.5.3 and V10.0.6.0 stores user credentials in browser cache which can be read by a local user. IBM X-Force ID: 271912. |
CVE-2023-28527 | Medium | 6.2 | 2023-12-09 | IBM Informix Dynamic Server 12.10 and 14.10 cdr is vulnerable to a heap buffer overflow, caused by improper bounds checking which could allow a local user to… |
CVE-2023-28526 | Medium | 6.2 | 2023-12-09 | IBM Informix Dynamic Server 12.10 and 14.10 archecker is vulnerable to a heap buffer overflow, caused by improper bounds checking which could allow a local us… |
CVE-2023-28523 | High | 8.4 | 2023-12-09 | IBM Informix Dynamic Server 12.10 and 14.10 onsmsync is vulnerable to a heap buffer overflow, caused by improper bounds checking which could allow an attacker… |
CVE-2023-6394 | High | 7.4 | 2023-12-09 | A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarku… |
CVE-2023-49797 | High | 8.8 | 2023-12-09 | PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may… |
CVE-2023-6560 | Medium | 5.5 | 2023-12-09 | An out-of-bounds memory access flaw was found in the io_uring SQ/CQ rings functionality in the Linux kernel. This issue could allow a local user to crash the s… |
CVE-2023-49800 | High | 7.5 | 2023-12-09 | `nuxt-api-party` is an open source module to proxy API requests. The library allows the user to send many options directly to `ofetch`. There is no filter on w… |
CVE-2023-49799 | High | 7.5 | 2023-12-09 | `nuxt-api-party` is an open source module to proxy API requests. nuxt-api-party attempts to check if the user has passed an absolute URL to prevent the aforeme… |
CVE-2023-49798 | Medium | 5.9 | 2023-12-09 | OpenZeppelin Contracts is a library for smart contract development. A merge issue when porting the 5.0.1 patch to the 4.9 branch caused a line duplication. In… |
CVE-2023-6337 | High | 7.5 | 2023-12-08 | HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthent… |
CVE-2023-34320 | Medium | 5.5 | 2023-12-08 | Cortex-A77 cores (r0p0 and r1p0) are affected by erratum 1508412 where software, under certain circumstances, could deadlock a core due to the execution of eit… |
CVE-2023-49788 | High | 7.2 | 2023-12-08 | Collabora Online is a collaborative online office suite based on LibreOffice technology. Unlike a standalone dedicated Collabora Online server, the Built-in CO… |
CVE-2023-49782 | High | 7.1 | 2023-12-08 | Collabora Online is a collaborative online office suite based on LibreOffice technology. Users of Nextcloud with `Collabora Online - Built-in CODE Server` app… |
CVE-2023-48311 | High | 8.0 | 2023-12-08 | dockerspawner is a tool to spawn JupyterHub single user servers in Docker containers. Users of JupyterHub deployments running DockerSpawner starting with 0.11… |
CVE-2023-46499 | Medium | 6.1 | 2023-12-08 | Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information via a crafted scripts… |
CVE-2023-46498 | Critical | 9.8 | 2023-12-08 | An issue in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information and execute arbitrary code via the /deleteCustom… |
CVE-2023-46497 | Medium | 5.4 | 2023-12-08 | Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request t… |
CVE-2023-46496 | High | 8.3 | 2023-12-08 | Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request t… |
CVE-2023-46495 | Medium | 6.1 | 2023-12-08 | Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request… |
CVE-2023-46494 | Medium | 6.1 | 2023-12-08 | Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information via a crafted request… |
CVE-2023-46493 | Medium | 5.3 | 2023-12-08 | Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request t… |
CVE-2023-6507 | Medium | 6.1 | 2023-12-08 | An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. … |
CVE-2023-6622 | Medium | 5.5 | 2023-12-08 | A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in nf_tables in the Linux kernel. This issue may allow a… |
CVE-2023-6619 | Medium | 5.5 | 2023-12-08 | A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been rated as critical. Affected by this issue is some unknown functio… |
CVE-2023-6618 | Medium | 5.5 | 2023-12-08 | A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been declared as problematic. Affected by this vulnerability is an unk… |