2023 CVEs (page 93)
Page 93 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-26158 | High | 8.2 | 2023-12-08 | All versions of the package mockjs are vulnerable to Prototype Pollution via the Util.extend function due to missing check if the attribute resolves to the obj… |
CVE-2023-48122 | High | 7.5 | 2023-12-08 | An issue in microweber v.2.0.1 and fixed in v.2.0.4 allows a remote attacker to obtain sensitive information via the HTTP GET method. |
CVE-2023-43305 | High | 8.2 | 2023-12-08 | An issue in studio kent mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43744 | High | 7.2 | 2023-12-08 | An OS command injection vulnerability in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, and MX30 with firmware versions prior to 17.0.10 patch 17161 and 16.0… |
CVE-2023-43743 | High | 8.8 | 2023-12-08 | A SQL injection vulnerability in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, and MX30 with firmware versions prior to 17.0.10 patch 17161 and 16.04 patch… |
CVE-2023-43742 | Critical | 9.8 | 2023-12-08 | An authentication bypass in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, and MX30 with firmware versions prior to 17.0.10 patch 17161 and 16.04 patch 16109… |
CVE-2023-6599 | Medium | 4.3 | 2023-12-08 | Missing Standardized Error Handling Mechanism in GitHub repository microweber/microweber prior to 2.0. |
CVE-2023-5008 | Critical | 9.8 | 2023-12-08 | Student Information System v1.0 is vulnerable to an unauthenticated SQL Injection vulnerability on the 'regno' parameter of index.php page, allowing an externa… |
CVE-2023-5058 | High | 7.8 | 2023-12-07 | Improper Input Validation in the processing of user-supplied splash screen during system boot in Phoenix SecureCore™ Technology™ 4 potentially allows denial-of… |
CVE-2023-4122 | Critical | 9.9 | 2023-12-07 | Student Information System v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'photo' parameter of my-profile page, allowing an authenticated a… |
CVE-2023-6581 | Medium | 5.5 | 2023-12-07 | A vulnerability has been found in D-Link DAR-7000 up to 20231126 and classified as critical. This vulnerability affects unknown code of the file /user/inc/work… |
CVE-2023-6580 | High | 8.8 | 2023-12-07 | A vulnerability, which was classified as critical, was found in D-Link DIR-846 FW100A53DBR. This affects an unknown part of the file /HNAP1/ of the component Q… |
CVE-2023-6579 | High | 7.3 | 2023-12-07 | A vulnerability, which was classified as critical, has been found in osCommerce 4. Affected by this issue is some unknown functionality of the file /b2b-superm… |
CVE-2023-46693 | Medium | 6.1 | 2023-12-07 | Cross Site Scripting (XSS) vulnerability in FormaLMS before 4.0.5 allows attackers to run arbitrary code via title parameters. |
CVE-2023-6578 | High | 7.3 | 2023-12-07 | A vulnerability classified as critical has been found in Software AG WebMethods 10.11.x/10.15.x. Affected is an unknown function of the file wm.server/connect/… |
CVE-2023-6577 | Medium | 4.3 | 2023-12-07 | A vulnerability was found in Byzoro PatrolFlow 2530Pro up to 20231126. It has been rated as problematic. This issue affects some unknown processing of the file… |
CVE-2023-6576 | Medium | 6.3 | 2023-12-07 | A vulnerability was found in Byzoro S210 up to 20231123. It has been declared as critical. This vulnerability affects unknown code of the file /Tool/uploadfile… |
CVE-2023-38174 | Medium | 4.3 | 2023-12-07 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability |
CVE-2023-36880 | Medium | 4.8 | 2023-12-07 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability |
CVE-2023-35618 | Critical | 9.6 | 2023-12-07 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2023-6575 | Medium | 6.3 | 2023-12-07 | A vulnerability was found in Byzoro S210 up to 20231121. It has been classified as critical. This affects an unknown part of the file /Tool/repair.php of the c… |
CVE-2023-6574 | Medium | 6.3 | 2023-12-07 | A vulnerability was found in Byzoro Smart S20 up to 20231120 and classified as critical. Affected by this issue is some unknown functionality of the file /sysm… |
CVE-2023-4486 | High | 7.5 | 2023-12-07 | Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines pri… |
CVE-2023-49468 | High | 8.8 | 2023-12-07 | Libde265 v1.0.14 was discovered to contain a global buffer overflow vulnerability in the read_coding_unit function at slice.cc. |
CVE-2023-49467 | High | 8.8 | 2023-12-07 | Libde265 v1.0.14 was discovered to contain a heap-buffer-overflow vulnerability in the derive_combined_bipredictive_merging_candidates function at motion.cc. |
CVE-2023-49465 | High | 8.8 | 2023-12-07 | Libde265 v1.0.14 was discovered to contain a heap-buffer-overflow vulnerability in the derive_spatial_luma_vector_prediction function at motion.cc. |
CVE-2023-49464 | High | 8.8 | 2023-12-07 | libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::get_luma_bits_per_pixel_from_configuration_unci. |
CVE-2023-49463 | High | 8.8 | 2023-12-07 | libheif v1.17.5 was discovered to contain a segmentation violation via the function find_exif_tag at /libheif/exif.cc. |
CVE-2023-49462 | High | 8.8 | 2023-12-07 | libheif v1.17.5 was discovered to contain a segmentation violation via the component /libheif/exif.cc. |
CVE-2023-49460 | High | 8.8 | 2023-12-07 | libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::decode_uncompressed_image. |
CVE-2023-6333 | High | 7.5 | 2023-12-07 | The affected ControlByWeb Relay products are vulnerable to a stored cross-site scripting vulnerability, which could allow an attacker to inject arbitrary scri… |
CVE-2023-49411 | Critical | 9.8 | 2023-12-07 | Tenda W30E V16.01.0.12(4843) contains a stack overflow vulnerability via the function formDeleteMeshNode. |
CVE-2023-49409 | Critical | 9.8 | 2023-12-07 | Tenda AX3 V16.03.12.11 was discovered to contain a Command Execution vulnerability via the function /goform/telnet. |
CVE-2023-49408 | Critical | 9.8 | 2023-12-07 | Tenda AX3 V16.03.12.11 was discovered to contain a stack overflow via the function set_device_name. |
CVE-2023-49406 | Critical | 9.8 | 2023-12-07 | Tenda W30E V16.01.0.12(4843) was discovered to contain a Command Execution vulnerability via the function /goform/telnet. |
CVE-2023-49405 | Critical | 9.8 | 2023-12-07 | Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function UploadCfg. |
CVE-2023-49404 | Critical | 9.8 | 2023-12-07 | Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formAdvancedSetListSet. |
CVE-2023-48958 | Medium | 5.5 | 2023-12-07 | gpac 2.3-DEV-rev617-g671976fcc-master contains memory leaks in gf_mpd_resolve_url media_tools/mpd.c:4589. |
CVE-2023-47440 | Medium | 6.5 | 2023-12-07 | Gladys Assistant v4.27.0 and prior is vulnerable to Directory Traversal. The patch of CVE-2023-43256 was found to be incomplete, allowing authenticated attacke… |
CVE-2023-46871 | Medium | 5.3 | 2023-12-07 | GPAC version 2.3-DEV-rev602-ged8424300-master in MP4Box contains a memory leak in NewSFDouble scenegraph/vrml_tools.c:300. This vulnerability may lead to a den… |
CVE-2023-41905 | Medium | 5.4 | 2023-12-07 | NETSCOUT nGeniusONE 6.3.4 build 2298 allows a Reflected Cross-Site scripting (XSS) vulnerability by an authenticated user. |
CVE-2023-41172 | Medium | 5.4 | 2023-12-07 | NetScout nGeniusONE 6.3.4 build 2298 allows a Stored Cross-Site scripting vulnerability (issue 4 of 4). |
CVE-2023-41171 | Medium | 5.4 | 2023-12-07 | NetScout nGeniusONE 6.3.4 build 2298 allows a Stored Cross-Site scripting vulnerability (issue 3 of 4). |
CVE-2023-41170 | Medium | 6.1 | 2023-12-07 | NetScout nGeniusONE 6.3.4 build 2298 allows a Reflected Cross-Site scripting vulnerability. |
CVE-2023-41169 | Medium | 5.4 | 2023-12-07 | NetScout nGeniusONE 6.3.4 build 2298 allows a Stored Cross-Site scripting vulnerability (issue 2 of 4). |
CVE-2023-41168 | Medium | 5.4 | 2023-12-07 | NetScout nGeniusONE 6.3.4 build 2298 allows a Stored Cross-Site scripting vulnerability (issue 1 of 4). |
CVE-2023-40302 | Critical | 9.1 | 2023-12-07 | NETSCOUT nGeniusPULSE 3.8 has Weak File Permissions Vulnerability |
CVE-2023-40301 | Critical | 9.8 | 2023-12-07 | NETSCOUT nGeniusPULSE 3.8 has a Command Injection Vulnerability. |
CVE-2023-40300 | Critical | 9.8 | 2023-12-07 | NETSCOUT nGeniusPULSE 3.8 has a Hardcoded Cryptographic Key. |
CVE-2023-39909 | High | 8.8 | 2023-12-07 | Ericsson Network Manager before 23.2 mishandles Access Control and thus unauthenticated low-privilege users can access the NCM application. |
CVE-2023-33413 | High | 8.8 | 2023-12-07 | The configuration functionality in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11… |
CVE-2023-33412 | High | 8.8 | 2023-12-07 | The web interface in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based… |
CVE-2023-33411 | High | 7.5 | 2023-12-07 | A web server in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devic… |
CVE-2023-50002 | Critical | 9.8 | 2023-12-07 | Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formRebootMeshNode. |
CVE-2023-50001 | Critical | 9.8 | 2023-12-07 | Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formUpgradeMeshOnline. |
CVE-2023-50000 | Critical | 9.8 | 2023-12-07 | Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formResetMeshNode. |
CVE-2023-49999 | Critical | 9.8 | 2023-12-07 | Tenda W30E V16.01.0.12(4843) was discovered to contain a command injection vulnerability via the function setUmountUSBPartition. |
CVE-2023-49410 | Critical | 9.8 | 2023-12-07 | Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function via the function set_wan_status. |
CVE-2023-49403 | Critical | 9.8 | 2023-12-07 | Tenda W30E V16.01.0.12(4843) was discovered to contain a command injection vulnerability via the function setFixTools. |
CVE-2023-49402 | Critical | 9.8 | 2023-12-07 | Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function localMsg. |
CVE-2023-6588 | Medium | 6.5 | 2023-12-07 | Offline mode is always enabled, even if permission disallows it, in Devolutions Server data source in Devolutions Workspace 2023.3.2.0 and earlier. This a… |
CVE-2023-49967 | High | 7.5 | 2023-12-07 | Typecho v1.2.1 was discovered to be vulnerable to an XML Quadratic Blowup attack via the component /index.php/action/xmlrpc. |
CVE-2023-49493 | Medium | 6.1 | 2023-12-07 | DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the v parameter at selectimages.php. |
CVE-2023-49492 | Medium | 6.1 | 2023-12-07 | DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the imgstick parameter at selectimages.php. |
CVE-2023-49436 | Critical | 9.8 | 2023-12-07 | Tenda AX9 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'list' parameter at /goform/SetNetControlList. |
CVE-2023-49435 | Critical | 9.8 | 2023-12-07 | Tenda AX9 V22.03.01.46 is vulnerable to command injection. |
CVE-2023-49434 | Critical | 9.8 | 2023-12-07 | Tenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'list' parameter at /goform/SetNetControlList. |
CVE-2023-49433 | Critical | 9.8 | 2023-12-07 | Tenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'list' parameter at /goform/SetVirtualServerCfg. |
CVE-2023-49432 | Critical | 9.8 | 2023-12-07 | Tenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'deviceList' parameter at /goform/setMacFilterCfg. |
CVE-2023-49431 | Critical | 9.8 | 2023-12-07 | Tenda AX9 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'mac' parameter at /goform/SetOnlineDevName. |
CVE-2023-49430 | Critical | 9.8 | 2023-12-07 | Tenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'list' parameter at /goform/SetStaticRouteCfg. |
CVE-2023-49429 | Critical | 9.8 | 2023-12-07 | Tenda AX9 V22.03.01.46 was discovered to contain a SQL command injection vulnerability in the 'setDeviceInfo' feature through the 'mac' parameter at /goform/se… |
CVE-2023-49437 | Critical | 9.8 | 2023-12-07 | Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'list' parameter at /goform/SetNetControlList. |
CVE-2023-49428 | Critical | 9.8 | 2023-12-07 | Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'mac' parameter at /goform/SetOnlineDevName. |
CVE-2023-49426 | Critical | 9.8 | 2023-12-07 | Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the list parameter at /goform/SetStaticRouteCfg. |
CVE-2023-49425 | Critical | 9.8 | 2023-12-07 | Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the deviceList parameter at /goform/setMacFilterCfg . |
CVE-2023-39171 | High | 7.2 | 2023-12-07 | SENEC Storage Box V1,V2 and V3 accidentially expose a management UI accessible with publicly known admin credentials. |
CVE-2023-39169 | Critical | 9.8 | 2023-12-07 | The affected devices use publicly available default credentials with administrative privileges. |
CVE-2023-49424 | Critical | 9.8 | 2023-12-07 | Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the list parameter at /goform/SetVirtualServerCfg. |
CVE-2023-46974 | Medium | 5.4 | 2023-12-07 | Cross Site Scripting vulnerability in Best Courier Management System v.1.000 allows a remote attacker to execute arbitrary code via a crafted payload to the pa… |
CVE-2023-39172 | Critical | 9.1 | 2023-12-07 | The affected devices transmit sensitive information unencrypted allowing a remote unauthenticated attacker to capture and modify network traffic. |
CVE-2023-39167 | High | 7.5 | 2023-12-07 | In SENEC Storage Box V1,V2 and V3 an unauthenticated remote attacker can obtain the devices' logfiles that contain sensitive data. |
CVE-2023-49958 | High | 7.5 | 2023-12-07 | An issue was discovered in Dalmann OCPP.Core through 1.2.0 for OCPP (Open Charge Point Protocol) for electric vehicles. The server processes mishandle StartTra… |
CVE-2023-49957 | High | 7.5 | 2023-12-07 | An issue was discovered in Dalmann OCPP.Core before 1.3.0 for OCPP (Open Charge Point Protocol) for electric vehicles. It permits multiple transactions with th… |
CVE-2023-49956 | High | 7.5 | 2023-12-07 | An issue was discovered in Dalmann OCPP.Core before 1.3.0 for OCPP (Open Charge Point Protocol) for electric vehicles. A StopTransaction message with any rando… |
CVE-2023-49955 | High | 7.5 | 2023-12-07 | An issue was discovered in Dalmann OCPP.Core before 1.2.0 for OCPP (Open Charge Point Protocol) for electric vehicles. It does not validate the length of the c… |
CVE-2023-47548 | Medium | 4.7 | 2023-12-07 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in SoftLab Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, an… |
CVE-2023-45762 | Medium | 4.7 | 2023-12-07 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Michael Uno (miunosoft) Responsive Column Widgets.This issue affects Responsive Column Wid… |
CVE-2023-48325 | Medium | 4.7 | 2023-12-07 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in PluginOps Landing Page Builder – Lead Page – Optin Page – Squeeze Page – WordPress Landing… |
CVE-2023-47779 | Medium | 4.7 | 2023-12-07 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks. Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja… |
CVE-2023-35909 | Medium | 5.3 | 2023-12-07 | Uncontrolled Resource Consumption vulnerability in Saturday Drive Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress leading to DoS.This i… |
CVE-2023-35039 | Critical | 9.8 | 2023-12-07 | Improper Restriction of Excessive Authentication Attempts vulnerability in Be Devious Web Development Password Reset with Code for WordPress REST API allows Au… |
CVE-2023-49746 | Medium | 4.9 | 2023-12-07 | Server-Side Request Forgery (SSRF) vulnerability in Softaculous Team SpeedyCache – Cache, Optimization, Performance.This issue affects SpeedyCache – Cache, Opt… |
CVE-2023-46641 | Medium | 4.9 | 2023-12-07 | Server-Side Request Forgery (SSRF) vulnerability in Code for Recovery 12 Step Meeting List.This issue affects 12 Step Meeting List: from n/a through 3.14.24. |
CVE-2023-41804 | High | 7.1 | 2023-12-07 | Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Starter Templates — Elementor, WordPress & Beaver Builder Templates.This issue affects Sta… |
CVE-2023-50164 | Critical | 9.8 | 2023-12-07 | An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be u… |
CVE-2023-48861 | High | 7.8 | 2023-12-07 | DLL hijacking vulnerability in TTplayer version 7.0.2, allows local attackers to escalate privileges and execute arbitrary code via urlmon.dll. |
CVE-2023-48860 | Critical | 9.8 | 2023-12-07 | TOTOLINK N300RT version 3.2.4-B20180730.0906 has a post-authentication RCE due to incorrect access control, allows attackers can bypass front-end security rest… |
CVE-2023-49225 | Medium | 6.1 | 2023-12-07 | A cross-site-scripting vulnerability exists in Ruckus Access Point products (ZoneDirector, SmartZone, and AP Solo). If this vulnerability is exploited, an arbi… |
CVE-2023-48841 | High | 8.8 | 2023-12-07 | Appointment Scheduler 3.0 is vulnerable to CSV Injection via a Language > Labels > Export action. |