2023 CVEs (page 94)
Page 94 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-40301 | Critical | 9.8 | 2023-12-07 | NETSCOUT nGeniusPULSE 3.8 has a Command Injection Vulnerability. |
CVE-2023-40300 | Critical | 9.8 | 2023-12-07 | NETSCOUT nGeniusPULSE 3.8 has a Hardcoded Cryptographic Key. |
CVE-2023-39909 | High | 8.8 | 2023-12-07 | Ericsson Network Manager before 23.2 mishandles Access Control and thus unauthenticated low-privilege users can access the NCM application. |
CVE-2023-33413 | High | 8.8 | 2023-12-07 | The configuration functionality in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11… |
CVE-2023-33412 | High | 8.8 | 2023-12-07 | The web interface in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based… |
CVE-2023-33411 | High | 7.5 | 2023-12-07 | A web server in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devic… |
CVE-2023-50002 | Critical | 9.8 | 2023-12-07 | Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formRebootMeshNode. |
CVE-2023-50001 | Critical | 9.8 | 2023-12-07 | Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formUpgradeMeshOnline. |
CVE-2023-50000 | Critical | 9.8 | 2023-12-07 | Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formResetMeshNode. |
CVE-2023-49999 | Critical | 9.8 | 2023-12-07 | Tenda W30E V16.01.0.12(4843) was discovered to contain a command injection vulnerability via the function setUmountUSBPartition. |
CVE-2023-49410 | Critical | 9.8 | 2023-12-07 | Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function via the function set_wan_status. |
CVE-2023-49403 | Critical | 9.8 | 2023-12-07 | Tenda W30E V16.01.0.12(4843) was discovered to contain a command injection vulnerability via the function setFixTools. |
CVE-2023-49402 | Critical | 9.8 | 2023-12-07 | Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function localMsg. |
CVE-2023-6588 | Medium | 6.5 | 2023-12-07 | Offline mode is always enabled, even if permission disallows it, in Devolutions Server data source in Devolutions Workspace 2023.3.2.0 and earlier. This a… |
CVE-2023-49967 | High | 7.5 | 2023-12-07 | Typecho v1.2.1 was discovered to be vulnerable to an XML Quadratic Blowup attack via the component /index.php/action/xmlrpc. |
CVE-2023-49493 | Medium | 6.1 | 2023-12-07 | DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the v parameter at selectimages.php. |
CVE-2023-49492 | Medium | 6.1 | 2023-12-07 | DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the imgstick parameter at selectimages.php. |
CVE-2023-49436 | Critical | 9.8 | 2023-12-07 | Tenda AX9 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'list' parameter at /goform/SetNetControlList. |
CVE-2023-49435 | Critical | 9.8 | 2023-12-07 | Tenda AX9 V22.03.01.46 is vulnerable to command injection. |
CVE-2023-49434 | Critical | 9.8 | 2023-12-07 | Tenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'list' parameter at /goform/SetNetControlList. |
CVE-2023-49433 | Critical | 9.8 | 2023-12-07 | Tenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'list' parameter at /goform/SetVirtualServerCfg. |
CVE-2023-49432 | Critical | 9.8 | 2023-12-07 | Tenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'deviceList' parameter at /goform/setMacFilterCfg. |
CVE-2023-49431 | Critical | 9.8 | 2023-12-07 | Tenda AX9 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'mac' parameter at /goform/SetOnlineDevName. |
CVE-2023-49430 | Critical | 9.8 | 2023-12-07 | Tenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'list' parameter at /goform/SetStaticRouteCfg. |
CVE-2023-49429 | Critical | 9.8 | 2023-12-07 | Tenda AX9 V22.03.01.46 was discovered to contain a SQL command injection vulnerability in the 'setDeviceInfo' feature through the 'mac' parameter at /goform/se… |
CVE-2023-49437 | Critical | 9.8 | 2023-12-07 | Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'list' parameter at /goform/SetNetControlList. |
CVE-2023-49428 | Critical | 9.8 | 2023-12-07 | Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'mac' parameter at /goform/SetOnlineDevName. |
CVE-2023-49426 | Critical | 9.8 | 2023-12-07 | Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the list parameter at /goform/SetStaticRouteCfg. |
CVE-2023-49425 | Critical | 9.8 | 2023-12-07 | Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the deviceList parameter at /goform/setMacFilterCfg . |
CVE-2023-39171 | High | 7.2 | 2023-12-07 | SENEC Storage Box V1,V2 and V3 accidentially expose a management UI accessible with publicly known admin credentials. |
CVE-2023-39169 | Critical | 9.8 | 2023-12-07 | The affected devices use publicly available default credentials with administrative privileges. |
CVE-2023-49424 | Critical | 9.8 | 2023-12-07 | Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the list parameter at /goform/SetVirtualServerCfg. |
CVE-2023-46974 | Medium | 5.4 | 2023-12-07 | Cross Site Scripting vulnerability in Best Courier Management System v.1.000 allows a remote attacker to execute arbitrary code via a crafted payload to the pa… |
CVE-2023-39172 | Critical | 9.1 | 2023-12-07 | The affected devices transmit sensitive information unencrypted allowing a remote unauthenticated attacker to capture and modify network traffic. |
CVE-2023-39167 | High | 7.5 | 2023-12-07 | In SENEC Storage Box V1,V2 and V3 an unauthenticated remote attacker can obtain the devices' logfiles that contain sensitive data. |
CVE-2023-49958 | High | 7.5 | 2023-12-07 | An issue was discovered in Dalmann OCPP.Core through 1.2.0 for OCPP (Open Charge Point Protocol) for electric vehicles. The server processes mishandle StartTra… |
CVE-2023-49957 | High | 7.5 | 2023-12-07 | An issue was discovered in Dalmann OCPP.Core before 1.3.0 for OCPP (Open Charge Point Protocol) for electric vehicles. It permits multiple transactions with th… |
CVE-2023-49956 | High | 7.5 | 2023-12-07 | An issue was discovered in Dalmann OCPP.Core before 1.3.0 for OCPP (Open Charge Point Protocol) for electric vehicles. A StopTransaction message with any rando… |
CVE-2023-49955 | High | 7.5 | 2023-12-07 | An issue was discovered in Dalmann OCPP.Core before 1.2.0 for OCPP (Open Charge Point Protocol) for electric vehicles. It does not validate the length of the c… |
CVE-2023-47548 | Medium | 4.7 | 2023-12-07 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in SoftLab Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, an… |
CVE-2023-45762 | Medium | 4.7 | 2023-12-07 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Michael Uno (miunosoft) Responsive Column Widgets.This issue affects Responsive Column Wid… |
CVE-2023-48325 | Medium | 4.7 | 2023-12-07 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in PluginOps Landing Page Builder – Lead Page – Optin Page – Squeeze Page – WordPress Landing… |
CVE-2023-47779 | Medium | 4.7 | 2023-12-07 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks. Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja… |
CVE-2023-35909 | Medium | 5.3 | 2023-12-07 | Uncontrolled Resource Consumption vulnerability in Saturday Drive Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress leading to DoS.This i… |
CVE-2023-35039 | Critical | 9.8 | 2023-12-07 | Improper Restriction of Excessive Authentication Attempts vulnerability in Be Devious Web Development Password Reset with Code for WordPress REST API allows Au… |
CVE-2023-49746 | Medium | 4.9 | 2023-12-07 | Server-Side Request Forgery (SSRF) vulnerability in Softaculous Team SpeedyCache – Cache, Optimization, Performance.This issue affects SpeedyCache – Cache, Opt… |
CVE-2023-46641 | Medium | 4.9 | 2023-12-07 | Server-Side Request Forgery (SSRF) vulnerability in Code for Recovery 12 Step Meeting List.This issue affects 12 Step Meeting List: from n/a through 3.14.24. |
CVE-2023-41804 | High | 7.1 | 2023-12-07 | Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Starter Templates — Elementor, WordPress & Beaver Builder Templates.This issue affects Sta… |
CVE-2023-50164 | Critical | 9.8 | 2023-12-07 | An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be u… |
CVE-2023-48861 | High | 7.8 | 2023-12-07 | DLL hijacking vulnerability in TTplayer version 7.0.2, allows local attackers to escalate privileges and execute arbitrary code via urlmon.dll. |
CVE-2023-48860 | Critical | 9.8 | 2023-12-07 | TOTOLINK N300RT version 3.2.4-B20180730.0906 has a post-authentication RCE due to incorrect access control, allows attackers can bypass front-end security rest… |
CVE-2023-49225 | Medium | 6.1 | 2023-12-07 | A cross-site-scripting vulnerability exists in Ruckus Access Point products (ZoneDirector, SmartZone, and AP Solo). If this vulnerability is exploited, an arbi… |
CVE-2023-48841 | High | 8.8 | 2023-12-07 | Appointment Scheduler 3.0 is vulnerable to CSV Injection via a Language > Labels > Export action. |
CVE-2023-48840 | High | 7.5 | 2023-12-07 | A lack of rate limiting in pjActionAjaxSend in Appointment Scheduler 3.0 allows attackers to cause resource exhaustion. |
CVE-2023-48839 | Medium | 5.4 | 2023-12-07 | Appointment Scheduler 3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin_sms_api_key, plugin_sms_country_code, calenda… |
CVE-2023-48838 | Medium | 5.4 | 2023-12-07 | Appointment Scheduler 3.0 is vulnerable to Multiple HTML Injection issues via the SMS API Key or Default Country Code. |
CVE-2023-48837 | Medium | 5.4 | 2023-12-07 | Car Rental Script 3.0 is vulnerable to Multiple HTML Injection issues via SMS API Key or Default Country Code. |
CVE-2023-48836 | Medium | 5.4 | 2023-12-07 | Car Rental Script 3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin_sms_api_key, plugin_sms_country_code, calendar_id… |
CVE-2023-48835 | High | 8.8 | 2023-12-07 | Car Rental Script v3.0 is vulnerable to CSV Injection via a Language > Labels > Export action. |
CVE-2023-48834 | High | 7.5 | 2023-12-07 | A lack of rate limiting in pjActionAjaxSend in Car Rental v3.0 allows attackers to cause resource exhaustion. |
CVE-2023-48833 | High | 7.5 | 2023-12-07 | A lack of rate limiting in pjActionAJaxSend in Time Slots Booking Calendar 4.0 allows attackers to cause resource exhaustion. |
CVE-2023-48831 | High | 7.5 | 2023-12-07 | A lack of rate limiting in pjActionAJaxSend in Availability Booking Calendar 5.0 allows attackers to cause resource exhaustion. |
CVE-2023-48830 | High | 8.8 | 2023-12-07 | Shuttle Booking Software 2.0 is vulnerable to CSV Injection in the Languages section via an export. |
CVE-2023-48828 | Medium | 5.4 | 2023-12-07 | Time Slots Booking Calendar 4.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin_sms_api_key, plugin_sms_country_code, c… |
CVE-2023-48827 | Medium | 5.4 | 2023-12-07 | Time Slots Booking Calendar 4.0 is vulnerable to Multiple HTML Injection issues via the name, plugin_sms_api_key, plugin_sms_country_code, calendar_id, title… |
CVE-2023-48826 | High | 8.8 | 2023-12-07 | Time Slots Booking Calendar 4.0 is vulnerable to CSV Injection via the unique ID field of the Reservations List. |
CVE-2023-48825 | Medium | 5.4 | 2023-12-07 | Availability Booking Calendar 5.0 is vulnerable to Multiple HTML Injection issues via SMS API Key or Default Country Code. |
CVE-2023-48824 | Medium | 5.4 | 2023-12-07 | BoidCMS 2.0.1 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the title, subtitle, footer, or keywords parameter in a page=create action. |
CVE-2023-48823 | Critical | 9.8 | 2023-12-07 | A Blind SQL injection issue in ajax.php in GaatiTrack Courier Management System 1.0 allows an unauthenticated attacker to inject a payload via the email parame… |
CVE-2023-48208 | Medium | 6.1 | 2023-12-07 | A Cross Site Scripting vulnerability in Availability Booking Calendar 5.0 allows an attacker to inject JavaScript via the name, plugin_sms_api_key, plugin_sms_… |
CVE-2023-48207 | High | 8.8 | 2023-12-07 | Availability Booking Calendar 5.0 allows CSV injection via the unique ID field in the Reservations list component. |
CVE-2023-48206 | Medium | 6.1 | 2023-12-07 | A Cross Site Scripting (XSS) vulnerability in GaatiTrack Courier Management System 1.0 allows a remote attacker to inject JavaScript via the page parameter to… |
CVE-2023-48205 | Medium | 5.3 | 2023-12-07 | Jorani Leave Management System 1.0.2 allows a remote attacker to spoof a Host header associated with password reset emails. |
CVE-2023-43304 | High | 8.2 | 2023-12-07 | An issue in PARK DANDAN mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43303 | High | 8.2 | 2023-12-07 | An issue in craftbeer bar canvas mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token (via… |
CVE-2023-43302 | High | 8.2 | 2023-12-07 | An issue in sanTas mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43301 | High | 8.2 | 2023-12-07 | An issue in DARTS SHOP MAXIM mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43300 | High | 8.2 | 2023-12-07 | An issue in urban_project mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43299 | Medium | 5.3 | 2023-12-07 | An issue in DA BUTCHERS mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43298 | Medium | 5.3 | 2023-12-07 | An issue in SCOL Members Card mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-48172 | Medium | 5.4 | 2023-12-07 | A Cross Site Scripting (XSS) vulnerability in Shuttle Booking Software 2.0 allows a remote attacker to inject JavaScript via the name, description, title, or a… |
CVE-2023-46916 | Medium | 4.3 | 2023-12-07 | Maxima Max Pro Power 1.0 486A devices allow BLE traffic replay. An attacker can use GATT characteristic handle 0x0012 to perform potentially disruptive actions… |
CVE-2023-46857 | Medium | 5.4 | 2023-12-07 | Squidex before 7.9.0 allows XSS via an SVG document to the Upload Assets feature. This occurs because there is an incomplete blacklist in the SVG inspection, a… |
CVE-2023-46307 | High | 7.5 | 2023-12-07 | An issue was discovered in server.js in etcd-browser 87ae63d75260. By supplying a /../../../ Directory Traversal input to the URL's GET request while connectin… |
CVE-2023-43103 | Medium | 6.1 | 2023-12-07 | An XSS issue was discovered in a web endpoint in Zimbra Collaboration (ZCS) before 10.0.4 via an unsanitized parameter. This is also fixed in 8.8.15 Patch 43 a… |
CVE-2023-43102 | Medium | 6.1 | 2023-12-07 | An issue was discovered in Zimbra Collaboration (ZCS) before 10.0.4. An XSS issue can be exploited to access the mailbox of an authenticated user. This is also… |
CVE-2023-6568 | Medium | 6.1 | 2023-12-07 | A reflected Cross-Site Scripting (XSS) vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the Content-Type header in POS… |
CVE-2023-41913 | Critical | 9.8 | 2023-12-07 | strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the internal buffer in cha… |
CVE-2023-41106 | High | 7.5 | 2023-12-07 | An issue was discovered in Zimbra Collaboration (ZCS) before 10.0.3. An attacker can gain access to a Zimbra account. This is also fixed in 9.0.0 Patch 35 and… |
CVE-2023-28017 | Medium | 5.4 | 2023-12-07 | HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an… |
CVE-2023-40238 | Medium | 5.5 | 2023-12-07 | A LogoFAIL issue was discovered in BmpDecoderDxe in Insyde InsydeH2O with kernel 5.2 before 05.28.47, 5.3 before 05.37.47, 5.4 before 05.45.47, 5.5 before 05.5… |
CVE-2023-5761 | Critical | 9.8 | 2023-12-07 | The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'url' parameter in versions 1.4.0 t… |
CVE-2023-5714 | Medium | 4.3 | 2023-12-07 | The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_db_specs() function hooked v… |
CVE-2023-5713 | Medium | 4.3 | 2023-12-07 | The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_option_value() function hook… |
CVE-2023-5712 | Medium | 4.3 | 2023-12-07 | The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_global_value() function hook… |
CVE-2023-5711 | Medium | 4.3 | 2023-12-07 | The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_php_info() function hooked v… |
CVE-2023-5710 | Medium | 4.3 | 2023-12-07 | The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_constants() function hooked… |
CVE-2023-46218 | Medium | 6.5 | 2023-12-07 | This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. T… |
CVE-2023-6566 | Medium | 6.5 | 2023-12-07 | Business Logic Errors in GitHub repository microweber/microweber prior to 2.0. |
CVE-2023-46354 | High | 7.5 | 2023-12-06 | In the module "Orders (CSV, Excel) Export PRO" (ordersexport) < 5.2.0 from MyPrestaModules for PrestaShop, a guest can download personal information without re… |