2023 CVEs (page 94)
Page 94 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-48840 | High | 7.5 | 2023-12-07 | A lack of rate limiting in pjActionAjaxSend in Appointment Scheduler 3.0 allows attackers to cause resource exhaustion. |
CVE-2023-48839 | Medium | 5.4 | 2023-12-07 | Appointment Scheduler 3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin_sms_api_key, plugin_sms_country_code, calenda… |
CVE-2023-48838 | Medium | 5.4 | 2023-12-07 | Appointment Scheduler 3.0 is vulnerable to Multiple HTML Injection issues via the SMS API Key or Default Country Code. |
CVE-2023-48837 | Medium | 5.4 | 2023-12-07 | Car Rental Script 3.0 is vulnerable to Multiple HTML Injection issues via SMS API Key or Default Country Code. |
CVE-2023-48836 | Medium | 5.4 | 2023-12-07 | Car Rental Script 3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin_sms_api_key, plugin_sms_country_code, calendar_id… |
CVE-2023-48835 | High | 8.8 | 2023-12-07 | Car Rental Script v3.0 is vulnerable to CSV Injection via a Language > Labels > Export action. |
CVE-2023-48834 | High | 7.5 | 2023-12-07 | A lack of rate limiting in pjActionAjaxSend in Car Rental v3.0 allows attackers to cause resource exhaustion. |
CVE-2023-48833 | High | 7.5 | 2023-12-07 | A lack of rate limiting in pjActionAJaxSend in Time Slots Booking Calendar 4.0 allows attackers to cause resource exhaustion. |
CVE-2023-48831 | High | 7.5 | 2023-12-07 | A lack of rate limiting in pjActionAJaxSend in Availability Booking Calendar 5.0 allows attackers to cause resource exhaustion. |
CVE-2023-48830 | High | 8.8 | 2023-12-07 | Shuttle Booking Software 2.0 is vulnerable to CSV Injection in the Languages section via an export. |
CVE-2023-48828 | Medium | 5.4 | 2023-12-07 | Time Slots Booking Calendar 4.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin_sms_api_key, plugin_sms_country_code, c… |
CVE-2023-48827 | Medium | 5.4 | 2023-12-07 | Time Slots Booking Calendar 4.0 is vulnerable to Multiple HTML Injection issues via the name, plugin_sms_api_key, plugin_sms_country_code, calendar_id, title… |
CVE-2023-48826 | High | 8.8 | 2023-12-07 | Time Slots Booking Calendar 4.0 is vulnerable to CSV Injection via the unique ID field of the Reservations List. |
CVE-2023-48825 | Medium | 5.4 | 2023-12-07 | Availability Booking Calendar 5.0 is vulnerable to Multiple HTML Injection issues via SMS API Key or Default Country Code. |
CVE-2023-48824 | Medium | 5.4 | 2023-12-07 | BoidCMS 2.0.1 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the title, subtitle, footer, or keywords parameter in a page=create action. |
CVE-2023-48823 | Critical | 9.8 | 2023-12-07 | A Blind SQL injection issue in ajax.php in GaatiTrack Courier Management System 1.0 allows an unauthenticated attacker to inject a payload via the email parame… |
CVE-2023-48208 | Medium | 6.1 | 2023-12-07 | A Cross Site Scripting vulnerability in Availability Booking Calendar 5.0 allows an attacker to inject JavaScript via the name, plugin_sms_api_key, plugin_sms_… |
CVE-2023-48207 | High | 8.8 | 2023-12-07 | Availability Booking Calendar 5.0 allows CSV injection via the unique ID field in the Reservations list component. |
CVE-2023-48206 | Medium | 6.1 | 2023-12-07 | A Cross Site Scripting (XSS) vulnerability in GaatiTrack Courier Management System 1.0 allows a remote attacker to inject JavaScript via the page parameter to… |
CVE-2023-48205 | Medium | 5.3 | 2023-12-07 | Jorani Leave Management System 1.0.2 allows a remote attacker to spoof a Host header associated with password reset emails. |
CVE-2023-43304 | High | 8.2 | 2023-12-07 | An issue in PARK DANDAN mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43303 | High | 8.2 | 2023-12-07 | An issue in craftbeer bar canvas mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token (via… |
CVE-2023-43302 | High | 8.2 | 2023-12-07 | An issue in sanTas mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43301 | High | 8.2 | 2023-12-07 | An issue in DARTS SHOP MAXIM mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43300 | High | 8.2 | 2023-12-07 | An issue in urban_project mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43299 | Medium | 5.3 | 2023-12-07 | An issue in DA BUTCHERS mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43298 | Medium | 5.3 | 2023-12-07 | An issue in SCOL Members Card mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-48172 | Medium | 5.4 | 2023-12-07 | A Cross Site Scripting (XSS) vulnerability in Shuttle Booking Software 2.0 allows a remote attacker to inject JavaScript via the name, description, title, or a… |
CVE-2023-46916 | Medium | 4.3 | 2023-12-07 | Maxima Max Pro Power 1.0 486A devices allow BLE traffic replay. An attacker can use GATT characteristic handle 0x0012 to perform potentially disruptive actions… |
CVE-2023-46857 | Medium | 5.4 | 2023-12-07 | Squidex before 7.9.0 allows XSS via an SVG document to the Upload Assets feature. This occurs because there is an incomplete blacklist in the SVG inspection, a… |
CVE-2023-46307 | High | 7.5 | 2023-12-07 | An issue was discovered in server.js in etcd-browser 87ae63d75260. By supplying a /../../../ Directory Traversal input to the URL's GET request while connectin… |
CVE-2023-43103 | Medium | 6.1 | 2023-12-07 | An XSS issue was discovered in a web endpoint in Zimbra Collaboration (ZCS) before 10.0.4 via an unsanitized parameter. This is also fixed in 8.8.15 Patch 43 a… |
CVE-2023-43102 | Medium | 6.1 | 2023-12-07 | An issue was discovered in Zimbra Collaboration (ZCS) before 10.0.4. An XSS issue can be exploited to access the mailbox of an authenticated user. This is also… |
CVE-2023-6568 | Medium | 6.1 | 2023-12-07 | A reflected Cross-Site Scripting (XSS) vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the Content-Type header in POS… |
CVE-2023-41913 | Critical | 9.8 | 2023-12-07 | strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the internal buffer in cha… |
CVE-2023-41106 | High | 7.5 | 2023-12-07 | An issue was discovered in Zimbra Collaboration (ZCS) before 10.0.3. An attacker can gain access to a Zimbra account. This is also fixed in 9.0.0 Patch 35 and… |
CVE-2023-28017 | Medium | 5.4 | 2023-12-07 | HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an… |
CVE-2023-40238 | Medium | 5.5 | 2023-12-07 | A LogoFAIL issue was discovered in BmpDecoderDxe in Insyde InsydeH2O with kernel 5.2 before 05.28.47, 5.3 before 05.37.47, 5.4 before 05.45.47, 5.5 before 05.5… |
CVE-2023-5761 | Critical | 9.8 | 2023-12-07 | The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'url' parameter in versions 1.4.0 t… |
CVE-2023-5714 | Medium | 4.3 | 2023-12-07 | The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_db_specs() function hooked v… |
CVE-2023-5713 | Medium | 4.3 | 2023-12-07 | The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_option_value() function hook… |
CVE-2023-5712 | Medium | 4.3 | 2023-12-07 | The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_global_value() function hook… |
CVE-2023-5711 | Medium | 4.3 | 2023-12-07 | The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_php_info() function hooked v… |
CVE-2023-5710 | Medium | 4.3 | 2023-12-07 | The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_constants() function hooked… |
CVE-2023-46218 | Medium | 6.5 | 2023-12-07 | This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. T… |
CVE-2023-6566 | Medium | 6.5 | 2023-12-07 | Business Logic Errors in GitHub repository microweber/microweber prior to 2.0. |
CVE-2023-46354 | High | 7.5 | 2023-12-06 | In the module "Orders (CSV, Excel) Export PRO" (ordersexport) < 5.2.0 from MyPrestaModules for PrestaShop, a guest can download personal information without re… |
CVE-2023-46353 | Critical | 9.8 | 2023-12-06 | In the module "Product Tag Icons Pro" (ticons) before 1.8.4 from MyPresta.eu for PrestaShop, a guest can perform SQL injection. The method TiconProduct::getTic… |
CVE-2023-49096 | High | 7.7 | 2023-12-06 | Jellyfin is a Free Software Media System for managing and streaming media. In affected versions there is an argument injection in the VideosController, specifi… |
CVE-2023-48123 | High | 8.8 | 2023-12-06 | An issue in Netgate pfSense Plus v.23.05.1 and before and pfSense CE v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the pa… |
CVE-2023-46751 | High | 7.5 | 2023-12-06 | An issue was discovered in the function gdev_prn_open_printer_seekable() in Artifex Ghostscript through 10.02.0 allows remote attackers to crash the applicatio… |
CVE-2023-6393 | Medium | 5.3 | 2023-12-06 | A flaw was found in the Quarkus Cache Runtime. When request processing utilizes a Uni cached using @CacheResult and the cached Uni reuses the initial "completi… |
CVE-2023-45285 | High | 7.5 | 2023-12-06 | Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "… |
CVE-2023-39326 | Medium | 5.3 | 2023-12-06 | A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are… |
CVE-2023-39539 | High | 7.5 | 2023-12-06 | AMI AptioV contains a vulnerability in BIOS where a User may cause an unrestricted upload of a PNG Logo file with dangerous type by Local access. A successful… |
CVE-2023-39538 | High | 7.5 | 2023-12-06 | AMI AptioV contains a vulnerability in BIOS where a User may cause an unrestricted upload of a BMP Logo file with dangerous type by Local access. A successful… |
CVE-2023-36655 | Critical | 9.8 | 2023-12-06 | The login REST API in ProLion CryptoSpike 3.0.15P2 (when LDAP or Active Directory is used as the users store) allows a remote blocked user to login and obtain… |
CVE-2023-48859 | High | 8.8 | 2023-12-06 | TOTOLINK A3002RU version 2.0.0-B20190902.1958 has a post-authentication RCE due to incorrect access control, allows attackers to bypass front-end security rest… |
CVE-2023-6288 | High | 7.8 | 2023-12-06 | Code injection in Remote Desktop Manager 2023.3.9.3 and earlier on macOS allows an attacker to execute code via the DYLIB_INSERT_LIBRARIES environment variable… |
CVE-2023-32268 | High | 7.2 | 2023-12-06 | Exposure of Proxy Administrator Credentials An authenticated administrator equivalent Filr user can access the credentials of proxy administrators. |
CVE-2023-6514 | High | 8.8 | 2023-12-06 | The Bluetooth module of some Huawei Smart Screen products has an identity authentication bypass vulnerability. Successful exploitation of this vulnerability m… |
CVE-2023-6459 | Medium | 5.3 | 2023-12-06 | Mattermost is grouping calls in the /metrics endpoint by id and reports that id in the response. Since this id is the channelID, the public /metrics endpoint i… |
CVE-2023-6458 | High | 7.1 | 2023-12-06 | Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perform a client-side path traversal. |
CVE-2023-6273 | Medium | 5.3 | 2023-12-06 | Permission management vulnerability in the module for disabling Sound Booster. Successful exploitation of this vulnerability may cause features to perform abno… |
CVE-2023-49248 | Medium | 5.5 | 2023-12-06 | Vulnerability of unauthorized file access in the Settings app. Successful exploitation of this vulnerability may cause unauthorized file access. |
CVE-2023-49247 | High | 7.5 | 2023-12-06 | Permission verification vulnerability in distributed scenarios. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-49246 | High | 7.5 | 2023-12-06 | Unauthorized access vulnerability in the card management module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-49245 | High | 7.5 | 2023-12-06 | Unauthorized access vulnerability in the Huawei Share module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-49244 | High | 7.5 | 2023-12-06 | Permission management vulnerability in the multi-user module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-49243 | High | 7.5 | 2023-12-06 | Vulnerability of unauthorized access to email attachments in the email module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-49242 | High | 7.5 | 2023-12-06 | Free broadcast vulnerability in the running management module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-49241 | High | 7.5 | 2023-12-06 | API permission control vulnerability in the network management module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-49240 | High | 7.5 | 2023-12-06 | Unauthorized access vulnerability in the launcher module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-49239 | High | 7.5 | 2023-12-06 | Unauthorized access vulnerability in the card management module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-46773 | Critical | 9.8 | 2023-12-06 | Permission management vulnerability in the PMS module. Successful exploitation of this vulnerability may cause privilege escalation. |
CVE-2023-46688 | Medium | 6.1 | 2023-12-06 | Open redirect vulnerability in Pleasanter 1.3.47.0 and earlier allows a remote unauthenticated attacker to redirect users to arbitrary web sites via a speciall… |
CVE-2023-45210 | Medium | 4.3 | 2023-12-06 | Pleasanter 1.3.47.0 and earlier contains an improper access control vulnerability, which may allow a remote authenticated attacker to view the temporary files… |
CVE-2023-44113 | High | 7.5 | 2023-12-06 | Vulnerability of missing permission verification for APIs in the Designed for Reliability (DFR) module. Successful exploitation of this vulnerability may affec… |
CVE-2023-44099 | High | 7.5 | 2023-12-06 | Vulnerability of data verification errors in the kernel module. Successful exploitation of this vulnerability may cause WLAN interruption. |
CVE-2023-34439 | Medium | 5.4 | 2023-12-06 | Pleasanter 1.3.47.0 and earlier contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed o… |
CVE-2023-48849 | Critical | 9.8 | 2023-12-06 | Ruijie EG Series Routers version EG_3.0(1)B11P216 and before allows unauthenticated attackers to remotely execute arbitrary code due to incorrect filtering. |
CVE-2023-49897 | High | 8.8 | 2023-12-06 | An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. If this vulnerabilit… |
CVE-2023-2861 | Medium | 6.0 | 2023-12-06 | A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, poten… |
CVE-2023-6527 | Medium | 6.1 | 2023-12-06 | The Email Subscription Popup plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the HTTP_REFERER header in all versions up to, and includ… |
CVE-2023-26154 | Medium | 5.9 | 2023-12-06 | Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the p… |
CVE-2023-22524 | Critical | 9.8 | 2023-12-06 | Certain versions of the Atlassian Companion App for MacOS were affected by a remote code execution vulnerability. An attacker could utilize WebSockets to bypas… |
CVE-2023-22523 | High | 8.8 | 2023-12-06 | This vulnerability, if exploited, allows an attacker to perform privileged RCE (Remote Code Execution) on machines with the Assets Discovery agent installed. T… |
CVE-2023-22522 | High | 8.8 | 2023-12-06 | This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page… |
CVE-2023-41268 | Medium | 5.3 | 2023-12-06 | Improper input validation vulnerability in Samsung Open Source Escargot allows stack overflow and segmentation fault. This issue affects Escargot: from 3.0.0 t… |
CVE-2023-40053 | Medium | 5.0 | 2023-12-06 | A vulnerability has been identified within Serv-U 15.4 that allows an authenticated actor to insert content on the file share function feature of Serv-U, which… |
CVE-2023-6512 | Medium | 6.5 | 2023-12-06 | Inappropriate implementation in Web Browser UI in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to potentially spoof the contents of an iframe… |
CVE-2023-6511 | Medium | 4.3 | 2023-12-06 | Inappropriate implementation in Autofill in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to bypass Autofill restrictions via a crafted HTML p… |
CVE-2023-6510 | High | 8.8 | 2023-12-06 | Use after free in Media Capture in Google Chrome prior to 120.0.6099.62 allowed a remote attacker who convinced a user to engage in specific UI interaction to… |
CVE-2023-6509 | High | 8.8 | 2023-12-06 | Use after free in Side Panel Search in Google Chrome prior to 120.0.6099.62 allowed a remote attacker who convinced a user to engage in specific UI interaction… |
CVE-2023-6508 | High | 8.8 | 2023-12-06 | Use after free in Media Stream in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2023-48940 | Medium | 5.4 | 2023-12-06 | A stored cross-site scripting (XSS) vulnerability in /admin.php of DaiCuo v2.5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted paylo… |
CVE-2023-48930 | Critical | 9.8 | 2023-12-06 | xinhu xinhuoa 2.2.1 contains a File upload vulnerability. |
CVE-2023-28876 | Medium | 4.3 | 2023-12-06 | A Broken Access Control issue in comments to uploaded files in Filerun through Update 20220202 allows attackers to delete comments on files uploaded by other u… |
CVE-2023-28875 | Medium | 5.4 | 2023-12-06 | A Stored XSS issue in shared files download terms in Filerun Update 20220202 allows attackers to inject JavaScript code that is executed when a user follows th… |
CVE-2023-24547 | Medium | 5.9 | 2023-12-06 | On affected platforms running Arista MOS, the configuration of a BGP password will cause the password to be logged in clear text that can be revealed in local… |