2023 CVEs (page 109)
Page 109 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-44329 | Medium | 5.5 | 2023-11-16 | Adobe Bridge versions 13.0.4 (and earlier) and 14.0.0 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could lead to disclos… |
CVE-2023-44328 | Medium | 5.5 | 2023-11-16 | Adobe Bridge versions 13.0.4 (and earlier) and 14.0.0 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive m… |
CVE-2023-44327 | Medium | 5.5 | 2023-11-16 | Adobe Bridge versions 13.0.4 (and earlier) and 14.0.0 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could lead to disclos… |
CVE-2023-4771 | Medium | 6.1 | 2023-11-16 | A Cross-Site scripting vulnerability has been found in CKSource CKEditor affecting versions 4.15.1 and earlier. An attacker could send malicious javascript cod… |
CVE-2023-6174 | Medium | 6.3 | 2023-11-16 | SSH dissector crash in Wireshark 4.0.0 to 4.0.10 allows denial of service via packet injection or crafted capture file |
CVE-2023-6119 | Medium | 6.5 | 2023-11-16 | An Improper Privilege Management vulnerability in Trellix GetSusp prior to version 5.0.0.27 allows a local, low privilege attacker to gain access to files tha… |
CVE-2023-44372 | High | 7.8 | 2023-11-16 | Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by a Use After Free vulnerability that could result in arb… |
CVE-2023-44371 | High | 7.8 | 2023-11-16 | Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by a Use After Free vulnerability that could result in arb… |
CVE-2023-44367 | High | 7.8 | 2023-11-16 | Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by a Use After Free vulnerability that could result in arb… |
CVE-2023-44366 | High | 7.8 | 2023-11-16 | Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by an out-of-bounds write vulnerability that could result… |
CVE-2023-44365 | High | 7.8 | 2023-11-16 | Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that c… |
CVE-2023-44361 | Medium | 5.5 | 2023-11-16 | Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by a Use After Free vulnerability that could lead to discl… |
CVE-2023-44360 | Medium | 5.5 | 2023-11-16 | Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to… |
CVE-2023-44359 | High | 7.8 | 2023-11-16 | Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by a Use After Free vulnerability that could result in arb… |
CVE-2023-44358 | Medium | 5.5 | 2023-11-16 | Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to… |
CVE-2023-44357 | Medium | 5.5 | 2023-11-16 | Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to… |
CVE-2023-44356 | Medium | 5.5 | 2023-11-16 | Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to… |
CVE-2023-44348 | Medium | 5.5 | 2023-11-16 | Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to… |
CVE-2023-44340 | Medium | 5.5 | 2023-11-16 | Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to… |
CVE-2023-44339 | Medium | 5.5 | 2023-11-16 | Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to… |
CVE-2023-44338 | High | 7.8 | 2023-11-16 | Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a craf… |
CVE-2023-44337 | High | 7.8 | 2023-11-16 | Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a craf… |
CVE-2023-44336 | High | 7.8 | 2023-11-16 | Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by a Use After Free vulnerability that could result in arb… |
CVE-2023-44292 | Medium | 6.7 | 2023-11-16 | Dell Repository Manager, 3.4.3 and prior, contains an Improper Access Control vulnerability in its installation module. A local low-privileged attacker could… |
CVE-2023-44282 | Medium | 6.7 | 2023-11-16 | Dell Repository Manager, 3.4.3 and prior, contains an Improper Access Control vulnerability in its installation module. A local low-privileged attacker could… |
CVE-2023-39259 | High | 7.3 | 2023-11-16 | Dell OS Recovery Tool, versions 2.2.4013, 2.3.7012.0, and 2.3.7515.0 contain an Improper Access Control Vulnerability. A local authenticated non-administrator… |
CVE-2023-39246 | Medium | 4.6 | 2023-11-16 | Dell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server version prior to 11.8.1 contain an Insecure Operation on Windows… |
CVE-2023-32469 | High | 7.5 | 2023-11-16 | Dell Precision Tower BIOS contains an Improper Input Validation vulnerability. A locally authenticated malicious user with admin privileges could potentially… |
CVE-2023-26031 | High | 7.5 | 2023-11-16 | Relative library resolution in linux container-executor binary in Apache Hadoop 3.3.1-3.3.4 on Linux allows local user to gain root privileges. If the YARN clu… |
CVE-2023-47674 | Critical | 9.8 | 2023-11-16 | Missing authentication for critical function vulnerability in First Corporation's DVRs allows a remote unauthenticated attacker to rewrite or obtain the config… |
CVE-2023-47213 | Critical | 9.8 | 2023-11-16 | First Corporation's DVRs use a hard-coded password, which may allow a remote unauthenticated attacker to rewrite or obtain the configuration information of the… |
CVE-2023-44296 | High | 8.4 | 2023-11-16 | Dell ELab-Navigator, version 3.1.9 contains a hard-coded credential vulnerability. A local attacker could potentially exploit this vulnerability, leading to u… |
CVE-2023-43757 | Medium | 6.5 | 2023-11-16 | Inadequate encryption strength vulnerability in multiple routers provided by ELECOM CO.,LTD. and LOGITEC CORPORATION allows a network-adjacent unauthenticated… |
CVE-2023-43752 | High | 8.0 | 2023-11-16 | OS command injection vulnerability in WRC-X3000GS2-W v1.05 and earlier, WRC-X3000GS2-B v1.05 and earlier, and WRC-X3000GS2A-B v1.05 and earlier allows a networ… |
CVE-2023-47335 | Medium | 6.5 | 2023-11-16 | Insecure permissions in the setNFZEnable function of Autel Robotics EVO Nano drone v1.6.5 allows attackers to breach the geo-fence and fly into no-fly zones. |
CVE-2023-47003 | Critical | 9.8 | 2023-11-16 | An issue in RedisGraph v.2.12.10 allows an attacker to execute arbitrary code and cause a denial of service via a crafted string in DataBlock_ItemIsDeleted. |
CVE-2023-43275 | High | 8.8 | 2023-11-16 | Cross-Site Request Forgery (CSRF) vulnerability in DedeCMS v5.7 in 110 backend management interface via /catalog_add.php, allows attackers to create crafted we… |
CVE-2023-47471 | Medium | 6.5 | 2023-11-16 | Buffer Overflow vulnerability in strukturag libde265 v1.10.12 allows a local attacker to cause a denial of service via the slice_segment_header function in the… |
CVE-2023-47470 | High | 7.8 | 2023-11-16 | Buffer Overflow vulnerability in Ffmpeg before github commit 4565747056a11356210ed8edcecb920105e40b60 allows a remote attacker to achieve an out-of-array write… |
CVE-2023-47264 | High | 7.5 | 2023-11-16 | Certain WithSecure products have a buffer over-read whereby processing certain fuzz file types may cause a denial of service (DoS). This affects WithSecure Cli… |
CVE-2023-47263 | High | 7.5 | 2023-11-16 | Certain WithSecure products allow a Denial of Service (DoS) in the antivirus engine when scanning a fuzzed PE32 file. This affects WithSecure Client Security 1… |
CVE-2023-48204 | Medium | 6.5 | 2023-11-16 | An issue in PublicCMS v.4.0.202302.e allows a remote attacker to obtain sensitive information via the appToken and Parameters parameter of the api/method/getHt… |
CVE-2023-5381 | Medium | 4.4 | 2023-11-15 | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.12.7 due… |
CVE-2023-4723 | Medium | 5.3 | 2023-11-15 | The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.12.7 via the ajax_eae_pos… |
CVE-2023-4690 | Medium | 5.4 | 2023-11-15 | The Elementor Addon Elements plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.12.7. This is due to missing… |
CVE-2023-4689 | Medium | 5.4 | 2023-11-15 | The Elementor Addon Elements plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.12.7. This is due to missing… |
CVE-2023-48200 | Medium | 5.4 | 2023-11-15 | Cross Site Scripting vulnerability in Grocy v.4.0.3 allows a local attacker to execute arbitrary code and obtain sensitive information via the equipment descri… |
CVE-2023-48199 | High | 7.8 | 2023-11-15 | HTML Injection vulnerability in the 'manageApiKeys' component in Grocy <= 4.0.3 allows attackers to inject arbitrary HTML content without script execution. Thi… |
CVE-2023-48198 | Medium | 5.4 | 2023-11-15 | A Cross-Site Scripting (XSS) vulnerability in the 'product description' component within '/api/stock/products' of Grocy version <= 4.0.3 allows attackers to ob… |
CVE-2023-48197 | Medium | 5.4 | 2023-11-15 | Cross-Site Scripting (XSS) vulnerability in the ‘manageApiKeys’ component of Grocy 4.0.3 and earlier allows attackers to obtain victim's cookies when the victi… |
CVE-2023-48365 | Critical | 9.6 | 2023-11-15 | Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP hea… |
CVE-2023-47444 | High | 8.8 | 2023-11-15 | An issue discovered in OpenCart 4.0.0.0 to 4.0.2.3 allows authenticated backend users having common/security write privilege can write arbitrary untrusted data… |
CVE-2023-47347 | High | 7.5 | 2023-11-15 | Buffer Overflow vulnerability in free5gc 3.3.0 allows attackers to cause a denial of service via crafted PFCP messages whose Sequence Number is mutated to over… |
CVE-2023-47345 | High | 7.5 | 2023-11-15 | Buffer Overflow vulnerability in free5gc 3.3.0 allows attackers to cause a denial of service via crafted PFCP message with malformed PFCP Heartbeat message who… |
CVE-2023-41442 | Critical | 9.8 | 2023-11-15 | An issue in Kloudq Technologies Limited Tor Equip 1.0, Tor Loco Mini 1.0 through 3.1 allows a remote attacker to execute arbitrary code via a crafted request t… |
CVE-2023-6105 | Medium | 5.5 | 2023-11-15 | An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user wit… |
CVE-2023-48224 | High | 8.2 | 2023-11-15 | Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of pri… |
CVE-2023-47637 | High | 8.8 | 2023-11-15 | Pimcore is an Open Source Data & Experience Management Platform. In affected versions the `/admin/object/grid-proxy` endpoint calls `getFilterCondition()` on f… |
CVE-2023-47636 | Medium | 5.3 | 2023-11-15 | The Pimcore Admin Classic Bundle provides a Backend UI for Pimcore. Full Path Disclosure (FPD) vulnerabilities enable the attacker to see the path to the webro… |
CVE-2023-41699 | Medium | 6.1 | 2023-11-15 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server, Micro and Embedded (Servlet Implementation modules) allows… |
CVE-2023-30954 | Low | 2.7 | 2023-11-15 | The Gotham video-application-server service contained a race condition which would cause it to not apply certain acls new videos if the source system had not y… |
CVE-2023-22818 | High | 7.3 | 2023-11-15 | Multiple DLL Search Order Hijack vulnerabilities were addressed in the SanDisk Security Installer for Windows that could allow attackers with local access to e… |
CVE-2023-48219 | Medium | 6.1 | 2023-11-15 | TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo/redo functionality and o… |
CVE-2023-48014 | High | 7.8 | 2023-11-15 | GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a stack overflow via the hevc_parse_vps_extension function at /media_tools/av_parsers.c. |
CVE-2023-48013 | High | 7.8 | 2023-11-15 | GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a double free via the gf_filterpacket_del function at /gpac/src/filter_core/filter.c. |
CVE-2023-48011 | High | 7.8 | 2023-11-15 | GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a heap-use-after-free via the flush_ref_samples function at /gpac/src/isomedia/movie_fragments… |
CVE-2023-6112 | High | 8.8 | 2023-11-15 | Use after free in Navigation in Google Chrome prior to 119.0.6045.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2023-5997 | High | 8.8 | 2023-11-15 | Use after free in Garbage Collection in Google Chrome prior to 119.0.6045.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HT… |
CVE-2023-34982 | Medium | 5.5 | 2023-11-15 | This external control vulnerability, if exploited, could allow a local OS-authenticated user with standard privileges to delete files with System privilege on… |
CVE-2023-33873 | High | 7.8 | 2023-11-15 | This privilege escalation vulnerability, if exploited, cloud allow a local OS-authenticated user with standard privileges to escalate to System privilege on t… |
CVE-2023-48089 | High | 8.8 | 2023-11-15 | xxl-job-admin 2.4.0 is vulnerable to Remote Code Execution (RCE) via /xxl-job-admin/jobcode/save. |
CVE-2023-48088 | Medium | 5.4 | 2023-11-15 | xxl-job-admin 2.4.0 is vulnerable to Cross Site Scripting (XSS) via /xxl-job-admin/joblog/logDetailPage. |
CVE-2023-48087 | Medium | 5.4 | 2023-11-15 | xxl-job-admin 2.4.0 is vulnerable to Insecure Permissions via /xxl-job-admin/joblog/clearLog and /xxl-job-admin/joblog/logDetailCat. |
CVE-2023-5720 | High | 7.7 | 2023-11-15 | A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain… |
CVE-2023-5676 | Medium | 4.1 | 2023-11-15 | In Eclipse OpenJ9 before version 0.41.0, the JVM can be forced into an infinite busy hang on a spinlock or a segmentation fault if a shutdown signal (SIGTERM… |
CVE-2023-5245 | High | 7.5 | 2023-11-15 | FileUtil.extract() enumerates all zip file entries and extracts each file without validating whether file paths in the archive are outside the intended directo… |
CVE-2023-4602 | Medium | 6.1 | 2023-11-15 | The Namaste! LMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'course_id' parameter in versions up to, and including, 2.6.1.1… |
CVE-2023-23549 | Low | 2.7 | 2023-11-15 | Improper Input Validation in Checkmk <2.2.0p15, <2.1.0p37, <=2.0.0p39 allows priviledged attackers to cause partial denial of service of the UI via too long ho… |
CVE-2023-34062 | High | 7.5 | 2023-11-15 | In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted… |
CVE-2023-46672 | High | 8.4 | 2023-11-15 | An issue was identified by Elastic whereby sensitive information is recorded in Logstash logs under specific circumstances. The prerequisites for the manifest… |
CVE-2023-6133 | Medium | 6.6 | 2023-11-15 | The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient blacklisting on the 'forminator_allowed_mime_types' function in… |
CVE-2023-4889 | Medium | 6.4 | 2023-11-15 | The Shareaholic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'shareaholic' shortcode in versions up to, and including, 9.7.8 due to in… |
CVE-2023-47586 | High | 7.8 | 2023-11-15 | Multiple heap-based buffer overflow vulnerabilities exist in V-Server V4.0.18.0 and earlier and V-Server Lite V4.0.18.0 and earlier. If a user opens a speciall… |
CVE-2023-47585 | High | 7.8 | 2023-11-15 | Out-of-bounds read vulnerability exists in V-Server V4.0.18.0 and earlier and V-Server Lite V4.0.18.0 and earlier. If a user opens a specially crafted VPR file… |
CVE-2023-47584 | High | 7.8 | 2023-11-15 | Out-of-bounds write vulnerability exists in V-Server V4.0.18.0 and earlier and V-Server Lite V4.0.18.0 and earlier. If a user opens a specially crafted VPR fil… |
CVE-2023-47583 | High | 7.8 | 2023-11-15 | Multiple out-of-bounds read vulnerabilities exist in TELLUS Simulator V4.0.17.0 and earlier. If a user opens a specially crafted file (X1 or V9 file), informat… |
CVE-2023-47582 | High | 7.8 | 2023-11-15 | Access of uninitialized pointer vulnerability exists in TELLUS V4.0.17.0 and earlier and TELLUS Lite V4.0.17.0 and earlier. If a user opens a specially crafted… |
CVE-2023-47581 | High | 7.8 | 2023-11-15 | Out-of-bounds read vulnerability exists in TELLUS V4.0.17.0 and earlier and TELLUS Lite V4.0.17.0 and earlier. If a user opens a specially crafted file (X1, V8… |
CVE-2023-47580 | High | 7.8 | 2023-11-15 | Multiple improper restriction of operations within the bounds of a memory buffer issues exist in TELLUS V4.0.17.0 and earlier and TELLUS Lite V4.0.17.0 and ear… |
CVE-2023-47446 | Medium | 5.4 | 2023-11-15 | Pre-School Enrollment version 1.0 is vulnerable to Cross Site Scripting (XSS) on the profile.php page via fullname parameter. |
CVE-2023-47445 | Critical | 9.8 | 2023-11-15 | Pre-School Enrollment version 1.0 is vulnerable to SQL Injection via the username parameter in preschool/admin/ page. |
CVE-2023-41597 | Medium | 6.1 | 2023-11-15 | EyouCms v1.6.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /admin/twitter.php?active_t. |
CVE-2023-40923 | High | 8.8 | 2023-11-15 | MyPrestaModules ordersexport before v5.0 was discovered to contain multiple SQL injection vulnerabilities at send.php via the key and save_setting parameters. |
CVE-2023-6032 | Medium | 5.3 | 2023-11-15 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause a file system enumeration and f… |
CVE-2023-5987 | Medium | 6.1 | 2023-11-15 | A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability that could cause a vulnerability leading to a cross… |
CVE-2023-5986 | High | 8.2 | 2023-11-15 | A CWE-601 URL Redirection to Untrusted Site vulnerability exists that could cause an openredirect vulnerability leading to a cross site scripting attack. By p… |
CVE-2023-5985 | Medium | 4.8 | 2023-11-15 | A CWE-79 Improper Neutralization of Input During Web Page Generation vulnerability exists that could cause compromise of a user’s browser when an attacker w… |
CVE-2023-5984 | High | 7.2 | 2023-11-15 | A CWE-494 Download of Code Without Integrity Check vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins… |
CVE-2023-47678 | Critical | 9.1 | 2023-11-15 | An improper access control vulnerability exists in RT-AC87U all versions. An attacker may read or write files that are not intended to be accessed by connectin… |
CVE-2023-47309 | Medium | 5.4 | 2023-11-15 | Nukium nkmgls before version 3.0.2 is vulnerable to Cross Site Scripting (XSS) via NkmGlsCheckoutModuleFrontController::displayAjaxSavePhoneMobile. |