2023 CVEs (page 112)
Page 112 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-36422 | High | 7.8 | 2023-11-14 | Microsoft Windows Defender Elevation of Privilege Vulnerability |
CVE-2023-36413 | Medium | 6.5 | 2023-11-14 | Microsoft Office Security Feature Bypass Vulnerability |
CVE-2023-36410 | High | 7.6 | 2023-11-14 | Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability |
CVE-2023-36408 | High | 7.8 | 2023-11-14 | Windows Hyper-V Elevation of Privilege Vulnerability |
CVE-2023-36407 | High | 7.8 | 2023-11-14 | Windows Hyper-V Elevation of Privilege Vulnerability |
CVE-2023-36406 | Medium | 5.5 | 2023-11-14 | Windows Hyper-V Information Disclosure Vulnerability |
CVE-2023-36405 | High | 7.0 | 2023-11-14 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2023-36404 | Medium | 5.5 | 2023-11-14 | Windows Kernel Information Disclosure Vulnerability |
CVE-2023-36403 | High | 7.0 | 2023-11-14 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2023-36402 | High | 8.8 | 2023-11-14 | Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability |
CVE-2023-36401 | High | 7.2 | 2023-11-14 | Microsoft Remote Registry Service Remote Code Execution Vulnerability |
CVE-2023-36400 | High | 8.8 | 2023-11-14 | Windows HMAC Key Derivation Elevation of Privilege Vulnerability |
CVE-2023-36399 | High | 7.1 | 2023-11-14 | Windows Storage Elevation of Privilege Vulnerability |
CVE-2023-36398 | Medium | 6.5 | 2023-11-14 | Windows NTFS Information Disclosure Vulnerability |
CVE-2023-36397 | Critical | 9.8 | 2023-11-14 | Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability |
CVE-2023-36396 | High | 7.8 | 2023-11-14 | Windows Compressed Folder Remote Code Execution Vulnerability |
CVE-2023-36395 | High | 7.5 | 2023-11-14 | Windows Deployment Services Denial of Service Vulnerability |
CVE-2023-36394 | High | 7.0 | 2023-11-14 | Windows Search Service Elevation of Privilege Vulnerability |
CVE-2023-36393 | High | 7.8 | 2023-11-14 | Windows User Interface Application Core Remote Code Execution Vulnerability |
CVE-2023-36392 | High | 7.5 | 2023-11-14 | DHCP Server Service Denial of Service Vulnerability |
CVE-2023-36052 | High | 8.6 | 2023-11-14 | Azure CLI REST Command Information Disclosure Vulnerability |
CVE-2023-36050 | High | 8.0 | 2023-11-14 | Microsoft Exchange Server Spoofing Vulnerability |
CVE-2023-36047 | High | 7.8 | 2023-11-14 | Windows Authentication Elevation of Privilege Vulnerability |
CVE-2023-36046 | High | 7.1 | 2023-11-14 | Windows Authentication Denial of Service Vulnerability |
CVE-2023-36045 | High | 7.8 | 2023-11-14 | Microsoft Office Graphics Remote Code Execution Vulnerability |
CVE-2023-36043 | Medium | 6.5 | 2023-11-14 | Open Management Infrastructure Information Disclosure Vulnerability |
CVE-2023-36042 | Medium | 6.2 | 2023-11-14 | Visual Studio Denial of Service Vulnerability |
CVE-2023-36041 | High | 7.8 | 2023-11-14 | Microsoft Excel Remote Code Execution Vulnerability |
CVE-2023-36039 | High | 8.0 | 2023-11-14 | Microsoft Exchange Server Spoofing Vulnerability |
CVE-2023-36037 | High | 7.8 | 2023-11-14 | Microsoft Excel Security Feature Bypass Vulnerability |
CVE-2023-36036 | High | 7.8 | 2023-11-14 | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability |
CVE-2023-36035 | High | 8.0 | 2023-11-14 | Microsoft Exchange Server Spoofing Vulnerability |
CVE-2023-36033 | High | 7.8 | 2023-11-14 | Windows DWM Core Library Elevation of Privilege Vulnerability |
CVE-2023-36031 | High | 7.6 | 2023-11-14 | Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability |
CVE-2023-36030 | Medium | 6.1 | 2023-11-14 | Microsoft Dynamics 365 Sales Spoofing Vulnerability |
CVE-2023-36028 | Critical | 9.8 | 2023-11-14 | Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability |
CVE-2023-36025 | High | 8.8 | 2023-11-14 | Windows SmartScreen Security Feature Bypass Vulnerability |
CVE-2023-36021 | High | 8.0 | 2023-11-14 | Microsoft On-Prem Data Gateway Security Feature Bypass Vulnerability |
CVE-2023-36018 | High | 7.8 | 2023-11-14 | Visual Studio Code Jupyter Extension Spoofing Vulnerability |
CVE-2023-36017 | High | 8.8 | 2023-11-14 | Windows Scripting Engine Memory Corruption Vulnerability |
CVE-2023-36016 | Medium | 6.2 | 2023-11-14 | Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability |
CVE-2023-34991 | Critical | 9.8 | 2023-11-14 | A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4… |
CVE-2023-33304 | Medium | 4.4 | 2023-11-14 | A use of hard-coded credentials vulnerability in Fortinet FortiClient Windows 7.0.0 - 7.0.9 and 7.2.0 - 7.2.1 allows an attacker to bypass system protections v… |
CVE-2023-28002 | Medium | 6.4 | 2023-11-14 | An improper validation of integrity check value vulnerability [CWE-354] in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.12, 6.4 all versions, 6.2 all version… |
CVE-2023-26205 | High | 8.1 | 2023-11-14 | An improper access control vulnerability [CWE-284] in FortiADC automation feature 7.1.0 through 7.1.2, 7.0 all versions, 6.2 all versions, 6.1 all versions may… |
CVE-2023-6131 | High | 8.8 | 2023-11-14 | Code Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. |
CVE-2023-6130 | High | 8.8 | 2023-11-14 | Path Traversal: '\..\filename' in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. |
CVE-2023-48094 | Medium | 6.1 | 2023-11-14 | A cross-site scripting (XSS) vulnerability in CesiumJS v1.111 allows attackers to execute arbitrary code in the context of the victim's browser via sending a c… |
CVE-2023-47660 | Medium | 5.9 | 2023-11-14 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP Wham Product Visibility by Country for WooCommerce plugin <= 1.4.9 versions. |
CVE-2023-47659 | Medium | 6.5 | 2023-11-14 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Lavacode Lava Directory Manager plugin <= 1.1.34 versions. |
CVE-2023-6128 | Medium | 5.4 | 2023-11-14 | Cross-site Scripting (XSS) - Reflected in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. |
CVE-2023-6127 | Medium | 5.4 | 2023-11-14 | Unrestricted Upload of File with Dangerous Type in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. |
CVE-2023-6126 | Critical | 9.8 | 2023-11-14 | Code Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. |
CVE-2023-6125 | High | 8.8 | 2023-11-14 | Code Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. |
CVE-2023-47262 | Medium | 5.2 | 2023-11-14 | The startup process and device configurations of the Abbott ID NOW device, before v7.1, can be interrupted and/or modified via physical access to an internal s… |
CVE-2023-6124 | Medium | 4.3 | 2023-11-14 | Server-Side Request Forgery (SSRF) in GitHub repository salesagility/suitecrm prior to 7.14.2, 8.4.2, 7.12.14. |
CVE-2023-48021 | High | 8.8 | 2023-11-14 | Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/task/update. |
CVE-2023-48020 | High | 8.8 | 2023-11-14 | Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/task/changeStatus. |
CVE-2023-45684 | High | 7.5 | 2023-11-14 | Northern.tech CFEngine Enterprise before 3.21.3 allows SQL Injection. The fixed versions are 3.18.6 and 3.21.3. The earliest affected version is 3.6.0. The iss… |
CVE-2023-6111 | High | 7.8 | 2023-11-14 | A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The function nft_t… |
CVE-2023-46601 | Critical | 9.6 | 2023-11-14 | A vulnerability has been identified in COMOS (All versions). The affected application lacks proper access controls in making the SQLServer connection. This cou… |
CVE-2023-46590 | High | 7.5 | 2023-11-14 | A vulnerability has been identified in Siemens OPC UA Modelling Editor (SiOME) (All versions < V2.8). Affected products suffer from a XML external entity (XXE)… |
CVE-2023-46099 | Medium | 5.4 | 2023-11-14 | A vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1). There is a stored cross-site scripting vulnerability in the Administration Consol… |
CVE-2023-46098 | High | 8.0 | 2023-11-14 | A vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1). When accessing the Information Server from affected products, the products use an… |
CVE-2023-46097 | Medium | 6.3 | 2023-11-14 | A vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1). The PUD Manager of affected products does not properly neutralize user provided i… |
CVE-2023-46096 | Medium | 6.5 | 2023-11-14 | A vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1). The PUD Manager of affected products does not properly authenticate users in the… |
CVE-2023-45794 | Medium | 6.8 | 2023-11-14 | A vulnerability has been identified in Mendix Applications using Mendix 10 (All versions < V10.4.0), Mendix Applications using Mendix 7 (All versions < V7.23.3… |
CVE-2023-44374 | Medium | 6.5 | 2023-11-14 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2… |
CVE-2023-44373 | Critical | 9.1 | 2023-11-14 | Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges to inject code or s… |
CVE-2023-44322 | Low | 3.7 | 2023-11-14 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2… |
CVE-2023-44321 | Low | 2.7 | 2023-11-14 | Affected devices do not properly validate the length of inputs when performing certain configuration changes in the web interface allowing an authenticated att… |
CVE-2023-44320 | Medium | 4.3 | 2023-11-14 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.2.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2D… |
CVE-2023-44319 | Medium | 4.9 | 2023-11-14 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2… |
CVE-2023-44318 | Medium | 4.9 | 2023-11-14 | Affected devices use a hardcoded key to obfuscate the configuration backup that an administrator can export from the device. This could allow an authenticated… |
CVE-2023-44317 | High | 7.2 | 2023-11-14 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.2.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2D… |
CVE-2023-43505 | Critical | 9.6 | 2023-11-14 | A vulnerability has been identified in COMOS (All versions). The affected application lacks proper access controls in SMB shares. This could allow an attacker… |
CVE-2023-43504 | Critical | 9.6 | 2023-11-14 | A vulnerability has been identified in COMOS (All versions < V10.4.4). Ptmcast executable used for testing cache validation service in affected application is… |
CVE-2023-43503 | Low | 3.5 | 2023-11-14 | A vulnerability has been identified in COMOS (All versions < V10.4.4). Caching system in the affected application leaks sensitive information such as user and… |
CVE-2023-31247 | Critical | 9.0 | 2023-11-14 | A memory corruption vulnerability exists in the HTTP Server Host header parsing functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted network… |
CVE-2023-28391 | Critical | 9.0 | 2023-11-14 | A memory corruption vulnerability exists in the HTTP Server header parsing functionality of Weston Embedded uC-HTTP v3.01.01. Specially crafted network packets… |
CVE-2023-28379 | Critical | 9.0 | 2023-11-14 | A memory corruption vulnerability exists in the HTTP Server form boundary functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted network packet… |
CVE-2023-27882 | Critical | 9.0 | 2023-11-14 | A heap-based buffer overflow vulnerability exists in the HTTP Server form boundary functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted netwo… |
CVE-2023-25181 | Critical | 9.0 | 2023-11-14 | A heap-based buffer overflow vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted set of network pack… |
CVE-2023-24585 | High | 7.7 | 2023-11-14 | An out-of-bounds write vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted network packet can lead t… |
CVE-2023-6109 | Medium | 5.3 | 2023-11-14 | The YOP Poll plugin for WordPress is vulnerable to a race condition in all versions up to, and including, 6.5.26. This is due to improper restrictions on the a… |
CVE-2023-47609 | High | 8.8 | 2023-11-14 | SQL injection vulnerability in OSS Calendar versions prior to v.2.0.3 allows a remote authenticated attacker to execute arbitrary code or obtain and/or alter t… |
CVE-2023-45881 | Medium | 6.1 | 2023-11-14 | GibbonEdu Gibbon through version 25.0.0 allows /modules/Planner/resources_addQuick_ajaxProcess.php file upload with resultant XSS. The imageAsLinks parameter m… |
CVE-2023-45880 | High | 7.2 | 2023-11-14 | GibbonEdu Gibbon through version 25.0.0 allows Directory Traversal via the report template builder. An attacker can create a new Asset Component. The templateF… |
CVE-2023-45879 | Medium | 5.4 | 2023-11-14 | GibbonEdu Gibbon version 25.0.0 allows HTML Injection via an IFRAME element to the Messager component. |
CVE-2023-45878 | Critical | 9.8 | 2023-11-14 | GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not require authentication. The endpoint ac… |
CVE-2023-43902 | Critical | 9.8 | 2023-11-14 | Incorrect access control in the Forgot Your Password function of EMSigner v2.8.7 allows unauthenticated attackers to access accounts of all registered users, i… |
CVE-2023-43901 | Medium | 5.9 | 2023-11-14 | Incorrect access control in the AdHoc User creation form of EMSigner v2.8.7 allows unauthenticated attackers to arbitrarily modify usernames and privileges by… |
CVE-2023-43900 | Medium | 6.5 | 2023-11-14 | Insecure Direct Object References (IDOR) in EMSigner v2.8.7 allow attackers to gain unauthorized access to application content and view sensitive data of other… |
CVE-2023-42326 | High | 8.8 | 2023-11-14 | An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfaces_gif_edit.php and interfaces_gre_… |
CVE-2023-6006 | High | 7.8 | 2023-11-14 | This vulnerability potentially allows local attackers to escalate privileges on affected installations of PaperCut NG. An attacker must have local write access… |
CVE-2023-42327 | Medium | 5.4 | 2023-11-14 | Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted URL to the getserviceproviders.ph… |
CVE-2023-42325 | Medium | 5.4 | 2023-11-14 | Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted url to the status_logs_filter_dyn… |
CVE-2023-31754 | Medium | 4.8 | 2023-11-14 | Optimizely CMS UI before v12.16.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Admin panel. |
CVE-2023-46446 | Medium | 6.8 | 2023-11-14 | An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation, aka a… |
CVE-2023-46445 | Medium | 5.9 | 2023-11-14 | An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message (RFC 8308) via a man-in-the-middle attack, aka a "Rogue Extension Neg… |