2023 CVEs (page 116)
Page 116 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-47367 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in platinum clinic Line 13.6.1 allows remote attackers to send malicious notifications to victims. |
CVE-2023-47366 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in craft_members Line 13.6.1 allows remote attackers to send malicious notifications to victims. |
CVE-2023-47365 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in Lil.OFF-PRICE STORE Line 13.6.1 allows remote attackers to send malicious notifications to victims. |
CVE-2023-47364 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in nagaoka taxi Line 13.6.1 allows remote attackers to send malicious notifications to victims |
CVE-2023-47363 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in F.B.P members Line 13.6.1 allows remote attackers to send malicious notifications to victims. |
CVE-2023-6052 | Medium | 6.3 | 2023-11-09 | A vulnerability classified as critical has been found in Tongda OA 2017 up to 11.9. Affected is an unknown function of the file general/system/censor_words/mod… |
CVE-2023-47616 | Low | 2.4 | 2023-11-09 | A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion P… |
CVE-2023-47615 | Low | 3.3 | 2023-11-09 | A CWE-526: Exposure of Sensitive Information Through Environmental Variables vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cint… |
CVE-2023-47612 | Medium | 6.8 | 2023-11-09 | A CWE-552: Files or Directories Accessible to External Parties vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8… |
CVE-2023-4218 | Medium | 5.0 | 2023-11-09 | In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any ev… |
CVE-2023-47248 | Critical | 9.8 | 2023-11-09 | Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable… |
CVE-2023-47613 | Medium | 4.4 | 2023-11-09 | A CWE-23: Relative Path Traversal vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, T… |
CVE-2023-47489 | High | 7.8 | 2023-11-09 | CSV injection in export as csv in Combodo iTop v.3.1.0-2-11973 allows a local attacker to execute arbitrary code via a crafted script to the export-v2.php and… |
CVE-2023-47488 | Medium | 6.1 | 2023-11-09 | Cross Site Scripting vulnerability in Combodo iTop v.3.1.0-2-11973 allows a local attacker to obtain sensitive information via a crafted script to the attrib_m… |
CVE-2023-46492 | Medium | 6.1 | 2023-11-09 | Cross Site Scripting vulnerability in MLDB.ai v.2017.04.17.0 allows a remote attacker to execute arbitrary code via a crafted payload to the public_html/doc/in… |
CVE-2023-26156 | Medium | 5.6 | 2023-11-09 | Versions of the package chromedriver before 119.0.1 are vulnerable to Command Injection when setting the chromedriver.path to an arbitrary system binary. This… |
CVE-2023-20902 | Medium | 5.9 | 2023-11-09 | A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below, Harbor 2.8.2 and below, and Harbor 1.10.17 and below allows an attacker with network acc… |
CVE-2023-37790 | Medium | 5.4 | 2023-11-09 | Jaspersoft Clarity PPM version 14.3.0.298 was discovered to contain an arbitrary file upload vulnerability via the Profile Picture Upload function. |
CVE-2023-37533 | Medium | 5.4 | 2023-11-09 | HCL Connections is vulnerable to reflected cross-site scripting (XSS) where an attacker may leverage these issues to execute arbitrary script code in the brows… |
CVE-2023-4249 | High | 8.8 | 2023-11-08 | Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 has a command in… |
CVE-2023-45225 | Critical | 9.8 | 2023-11-08 | Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable to… |
CVE-2023-45079 | Medium | 6.7 | 2023-11-08 | A memory leakage vulnerability was reported in the NvmramSmm SMM driver that may allow a local attacker with elevated privileges to write to NVRAM variables. |
CVE-2023-45078 | Medium | 6.7 | 2023-11-08 | A memory leakage vulnerability was reported in the DustFilterAlertSmm SMM driver that may allow a local attacker with elevated privileges to write to NVRAM var… |
CVE-2023-45077 | Medium | 6.7 | 2023-11-08 | A memory leakage vulnerability was reported in the 534D0740 DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables. |
CVE-2023-45076 | Medium | 6.7 | 2023-11-08 | A memory leakage vulnerability was reported in the 534D0140 DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables. |
CVE-2023-45075 | Medium | 6.7 | 2023-11-08 | A memory leakage vulnerability was reported in the SWSMI_Shadow DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables. |
CVE-2023-43755 | Critical | 9.8 | 2023-11-08 | Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable t… |
CVE-2023-43581 | Medium | 6.7 | 2023-11-08 | A buffer overflow was reported in the Update_WMI module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arb… |
CVE-2023-43580 | Medium | 6.7 | 2023-11-08 | A buffer overflow was reported in the SmuV11DxeVMR module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute a… |
CVE-2023-43579 | Medium | 6.7 | 2023-11-08 | A buffer overflow was reported in the SmuV11Dxe driver in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbi… |
CVE-2023-43578 | Medium | 6.7 | 2023-11-08 | A buffer overflow was reported in the SmiFlash module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbit… |
CVE-2023-43577 | Medium | 6.7 | 2023-11-08 | A buffer overflow was reported in the ReFlash module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitr… |
CVE-2023-43576 | Medium | 6.7 | 2023-11-08 | A buffer overflow was reported in the WMISwSmi module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbit… |
CVE-2023-43575 | Medium | 6.7 | 2023-11-08 | A buffer overflow was reported in the UltraFunctionTable module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to exe… |
CVE-2023-43574 | Medium | 4.4 | 2023-11-08 | A buffer over-read was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products that may allow a local attacker with elevated pri… |
CVE-2023-43573 | Medium | 6.7 | 2023-11-08 | A buffer overflow was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products that may allow a local attacker with elevated priv… |
CVE-2023-43572 | Medium | 4.4 | 2023-11-08 | A buffer over-read was reported in the BiosExtensionLoader module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to d… |
CVE-2023-43571 | Medium | 6.7 | 2023-11-08 | A buffer overflow was reported in the BiosExtensionLoader module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to ex… |
CVE-2023-3959 | Critical | 9.8 | 2023-11-08 | Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable to… |
CVE-2023-39435 | High | 8.8 | 2023-11-08 | Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable to… |
CVE-2023-5079 | High | 7.5 | 2023-11-08 | Lenovo LeCloud App improper input validation allows attackers to access arbitrary components and arbitrary file downloads, which could result in information di… |
CVE-2023-5078 | Medium | 6.7 | 2023-11-08 | A vulnerability was reported in some ThinkPad BIOS that could allow a physical or local attacker with elevated privileges to tamper with BIOS firmware. |
CVE-2023-5075 | Medium | 6.7 | 2023-11-08 | A buffer overflow was reported in the FmpSipoCapsuleDriver driver in the IdeaPad Duet 3-10IGL5 that may allow a local attacker with elevated privileges to exec… |
CVE-2023-4891 | Medium | 5.5 | 2023-11-08 | A potential use-after-free vulnerability was reported in the Lenovo View driver that could result in denial of service. |
CVE-2023-4706 | High | 7.3 | 2023-11-08 | A privilege escalation vulnerability was reported in Lenovo preloaded devices deployed using Microsoft AutoPilot under a standard user account due to incorrec… |
CVE-2023-4632 | High | 7.8 | 2023-11-08 | An uncontrolled search path vulnerability was reported in Lenovo System Update that could allow an attacker with local access to execute code with elevated pri… |
CVE-2023-47114 | Medium | 4.3 | 2023-11-08 | Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in your runtime environment, and the enforcement of… |
CVE-2023-47113 | High | 7.3 | 2023-11-08 | BleachBit cleans files to free disk space and to maintain privacy. BleachBit for Windows up to version 4.4.2 is vulnerable to a DLL Hijacking vulnerability. By… |
CVE-2023-47111 | High | 7.3 | 2023-11-08 | ZITADEL provides identity infrastructure. ZITADEL provides administrators the possibility to define a `Lockout Policy` with a maximum amount of failed password… |
CVE-2023-47109 | Medium | 5.5 | 2023-11-08 | PrestaShop blockreassurance adds an information block aimed at offering helpful information to reassure customers that the store is trustworthy. When adding a… |
CVE-2023-43570 | Medium | 6.7 | 2023-11-08 | A potential vulnerability was reported in the SMI callback function of the OemSmi driver that may allow a local attacker with elevated permissions to execute… |
CVE-2023-43569 | Medium | 6.7 | 2023-11-08 | A buffer overflow was reported in the OemSmi module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitra… |
CVE-2023-43568 | Medium | 4.4 | 2023-11-08 | A buffer over-read was reported in the LemSecureBootForceKey module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to… |
CVE-2023-43567 | Medium | 6.7 | 2023-11-08 | A buffer overflow was reported in the LemSecureBootForceKey module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to… |
CVE-2023-36667 | High | 7.5 | 2023-11-08 | Couchbase Server 7.1.4 before 7.1.5 and 7.2.0 before 7.2.1 allows Directory Traversal. |
CVE-2023-46363 | Medium | 5.5 | 2023-11-08 | jbig2enc v0.28 was discovered to contain a SEGV via jbig2_add_page in src/jbig2enc.cc:512. |
CVE-2023-46362 | Medium | 5.5 | 2023-11-08 | jbig2enc v0.28 was discovered to contain a heap-use-after-free via jbig2enc_auto_threshold_using_hash in src/jbig2enc.cc. |
CVE-2023-45875 | High | 7.5 | 2023-11-08 | An issue was discovered in Couchbase Server 7.2.0. There is a private key leak in debug.log while adding a pre-7.0 node to a 7.2 cluster. |
CVE-2023-45857 | Medium | 6.5 | 2023-11-08 | An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for ever… |
CVE-2023-29974 | Critical | 9.8 | 2023-11-08 | An issue discovered in Pfsense CE version 2.6.0 allows attackers to compromise user accounts via weak password requirements. |
CVE-2023-0392 | Medium | 6.7 | 2023-11-08 | The LDAP Agent Update service with versions prior to 5.18 used an unquoted path, which could allow arbitrary code execution. |
CVE-2023-5996 | High | 8.8 | 2023-11-08 | Use after free in WebAudio in Google Chrome prior to 119.0.6045.123 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (… |
CVE-2023-26221 | Medium | 5.0 | 2023-11-08 | The Spotfire Connectors component of TIBCO Software Inc.'s Spotfire Analyst, Spotfire Server, and Spotfire for AWS Marketplace contains an easily exploitable v… |
CVE-2023-47231 | Medium | 6.5 | 2023-11-08 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Bainternet ShortCodes UI plugin <= 1.9.8 versions. |
CVE-2023-47229 | Medium | 6.5 | 2023-11-08 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Vyas Dipen Top 25 Social Icons plugin <= 3.1 versions. |
CVE-2023-47228 | Medium | 5.9 | 2023-11-08 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Muneeb Layer Slider plugin <= 1.1.9.7 versions. |
CVE-2023-47227 | Medium | 5.9 | 2023-11-08 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Web-Settler Social Feed | All social media in one place plugin <= 1.5.4.6 versions. |
CVE-2023-47226 | Medium | 5.9 | 2023-11-08 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Post Sliders & Post Grids plugin <= 1.0.20 versions. |
CVE-2023-47223 | Medium | 5.9 | 2023-11-08 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP Map Plugins Basic Interactive World Map plugin <= 2.0 versions. |
CVE-2023-47190 | Medium | 6.5 | 2023-11-08 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Apollo13Themes Apollo13 Framework Extensions plugin <= 1.9.0 versions. |
CVE-2023-47181 | Medium | 5.9 | 2023-11-08 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Martin Gibson IdeaPush plugin <= 8.52 versions. |
CVE-2023-3282 | Medium | 6.4 | 2023-11-08 | A local privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XSOAR engine software running on a Linux operating system enables a local atta… |
CVE-2023-5913 | High | 8.2 | 2023-11-08 | Incorrect Privilege Assignment vulnerability in opentext Fortify ScanCentral DAST. The vulnerability could be exploited to gain elevated privileges.This issue… |
CVE-2023-5760 | High | 8.2 | 2023-11-08 | A time-of-check to time-of-use (TOCTOU) bug in handling of IOCTL (input/output control) requests. This TOCTOU bug leads to an out-of-bounds write vulnerability… |
CVE-2023-47379 | Medium | 5.4 | 2023-11-08 | Microweber CMS version 2.0.1 is vulnerable to stored Cross Site Scripting (XSS) via the profile picture file upload functionality. |
CVE-2023-46643 | High | 7.1 | 2023-11-08 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in GARY JEZORSKI CloudNet360 plugin <= 3.2.0 versions. |
CVE-2023-46642 | Medium | 5.9 | 2023-11-08 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in sahumedia SAHU TikTok Pixel for E-Commerce plugin <= 1.2.2 versions. |
CVE-2023-5759 | High | 7.5 | 2023-11-08 | In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the buffer was identified. Reported by Jason Geffner. |
CVE-2023-5136 | Medium | 5.5 | 2023-11-08 | An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. An attacker could exploit this vulnerability b… |
CVE-2023-47397 | Critical | 9.8 | 2023-11-08 | WeBid <=1.2.2 is vulnerable to code injection via admin/categoriestrans.php. |
CVE-2023-47107 | High | 8.8 | 2023-11-08 | PILOS is an open source front-end for BigBlueButton servers with a built-in load balancer. The password reset component deployed within PILOS uses the hostname… |
CVE-2023-46640 | Medium | 6.5 | 2023-11-08 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in D. Relton Medialist plugin <= 1.3.9 versions. |
CVE-2023-46627 | High | 7.1 | 2023-11-08 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ashish Ajani WordPress Simple HTML Sitemap plugin <= 2.1 versions. |
CVE-2023-46626 | High | 7.1 | 2023-11-08 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in FLOWFACT WP Connector plugin <= 2.1.7 versions. |
CVE-2023-46621 | High | 7.1 | 2023-11-08 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Enej Bajgoric / Gagan Sandhu / CTLT DEV User Avatar plugin <= 1.4.11 versions. |
CVE-2023-46613 | Medium | 6.5 | 2023-11-08 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Jens Kuerschner Add to Calendar Button plugin <= 1.5.1 versions. |
CVE-2023-45849 | Critical | 9.0 | 2023-11-08 | An arbitrary code execution which results in privilege escalation was discovered in Helix Core versions prior to 2023.2. Reported by Jason Geffner. |
CVE-2023-45319 | High | 7.5 | 2023-11-08 | In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the commit function was identified. Reported by Jason Geffner. |
CVE-2023-45140 | Medium | 4.8 | 2023-11-08 | The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. SCP and SFTP plugins don't honor group-based JIT MFA. Estab… |
CVE-2023-35767 | High | 7.5 | 2023-11-08 | In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the shutdown function was identified. Reported by Jason Geffner… |
CVE-2023-32298 | High | 7.1 | 2023-11-08 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Kathy Darling Simple User Listing plugin <= 1.9.2 versions. |
CVE-2023-6012 | High | 8.3 | 2023-11-08 | An improper input validation vulnerability has been found in Lanaccess ONSAFE MonitorHM affecting version 3.7.0. This vulnerability could lead a remote attacke… |
CVE-2023-46759 | High | 7.5 | 2023-11-08 | Permission control vulnerability in the call module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-46758 | High | 7.5 | 2023-11-08 | Permission management vulnerability in the multi-screen interaction module. Successful exploitation of this vulnerability may cause service exceptions of the d… |
CVE-2023-46757 | High | 7.5 | 2023-11-08 | The remote PIN module has a vulnerability that causes incorrect information storage locations.Successful exploitation of this vulnerability may affect confiden… |
CVE-2023-46756 | Medium | 5.3 | 2023-11-08 | Permission control vulnerability in the window management module. Successful exploitation of this vulnerability may cause malicious pop-up windows. |
CVE-2023-46774 | High | 7.5 | 2023-11-08 | Vulnerability of uncaught exceptions in the NFC module. Successful exploitation of this vulnerability can affect NFC availability. |
CVE-2023-46772 | High | 7.5 | 2023-11-08 | Vulnerability of parameters being out of the value range in the QMI service module. Successful exploitation of this vulnerability may cause errors in reading f… |
CVE-2023-46767 | High | 7.5 | 2023-11-08 | Out-of-bounds write vulnerability in the kernel driver module. Successful exploitation of this vulnerability may cause process exceptions. |
CVE-2023-46766 | High | 7.5 | 2023-11-08 | Out-of-bounds write vulnerability in the kernel driver module. Successful exploitation of this vulnerability may cause process exceptions. |