2023 CVEs (page 118)
Page 118 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-42554 | Medium | 5.4 | 2023-11-07 | Improper Authentication vulnerabiity in Samsung Pass prior to version 4.3.00.17 allows physical attackers to bypass authentication. |
CVE-2023-42553 | Medium | 4.0 | 2023-11-07 | Improper authorization verification vulnerability in Samsung Email prior to version 6.1.90.4 allows attackers to read sandbox data of email. |
CVE-2023-42552 | Medium | 4.4 | 2023-11-07 | Implicit intent hijacking vulnerability in Firewall application prior to versions 12.1.00.24 in Android 11, 13.1.00.16 in Android 12 and 14.1.00.7 in Android 1… |
CVE-2023-42551 | Medium | 5.5 | 2023-11-07 | Use of implicit intent for sensitive communication vulnerability in startTncActivity in Samsung Account prior to version 14.5.00.7 allows attackers to access a… |
CVE-2023-42550 | Medium | 5.5 | 2023-11-07 | Use of implicit intent for sensitive communication vulnerability in startSignIn in Samsung Account prior to version 14.5.00.7 allows attackers to access arbitr… |
CVE-2023-42549 | Medium | 5.5 | 2023-11-07 | Use of implicit intent for sensitive communication vulnerability in startNameValidationActivity in Samsung Account prior to version 14.5.00.7 allows attackers… |
CVE-2023-42548 | Medium | 5.5 | 2023-11-07 | Use of implicit intent for sensitive communication vulnerability in startMandatoryCheckActivity in Samsung Account prior to version 14.5.00.7 allows attackers… |
CVE-2023-42547 | Medium | 5.5 | 2023-11-07 | Use of implicit intent for sensitive communication vulnerability in startEmailValidationActivity in Samsung Account prior to version 14.5.00.7 allows attackers… |
CVE-2023-42546 | Medium | 5.5 | 2023-11-07 | Use of implicit intent for sensitive communication vulnerability in startAgreeToDisclaimerActivity in Samsung Account prior to version 14.5.00.7 allows attacke… |
CVE-2023-42545 | Medium | 5.5 | 2023-11-07 | Use of implicit intent for sensitive communication vulnerability in Phone prior to versions 12.7.20.12 in Android 11, 13.1.48, 13.5.28 in Android 12, and 14.7… |
CVE-2023-42544 | Medium | 5.5 | 2023-11-07 | Improper access control vulnerability in Quick Share prior to 13.5.52.0 allows local attacker to access local files. |
CVE-2023-42543 | Medium | 6.2 | 2023-11-07 | Improper verification of intent by broadcast receiver vulnerability in Bixby Voice prior to version 3.3.35.12 allows attackers to access arbitrary data with Bi… |
CVE-2023-42542 | Low | 3.3 | 2023-11-07 | Improper access control vulnerability in Samsung Push Service prior to 3.4.10 allows local attackers to get register ID to identify the device. |
CVE-2023-42541 | Medium | 4.0 | 2023-11-07 | Improper authorization in PushClientProvider of Samsung Push Service prior to version 3.4.10 allows attacker to access unique id. |
CVE-2023-42540 | Medium | 4.0 | 2023-11-07 | Improper access control vulnerability in Samsung Account prior to version 14.5.01.1 allows attackers to access sensitive information via implicit intent. |
CVE-2023-42539 | Medium | 4.7 | 2023-11-07 | PendingIntent hijacking vulnerability in ChallengeNotificationManager in Samsung Health prior to version 6.25 allows local attackers to access data. |
CVE-2023-42538 | Medium | 5.9 | 2023-11-07 | An improper input validation in saped_rec_silence in libsaped prior to SMR Nov-2023 Release 1 allows local attackers to cause out-of-bounds read and write. |
CVE-2023-42537 | High | 8.4 | 2023-11-07 | An improper input validation in get_head_crc in libsaped prior to SMR Nov-2023 Release 1 allows local attackers to cause out-of-bounds read and write. |
CVE-2023-42536 | High | 8.4 | 2023-11-07 | An improper input validation in saped_dec in libsaped prior to SMR Nov-2023 Release 1 allows local attackers to cause out-of-bounds read and write. |
CVE-2023-42535 | High | 8.4 | 2023-11-07 | Out-of-bounds Write in read_block of vold prior to SMR Nov-2023 Release 1 allows local attacker to execute arbitrary code. |
CVE-2023-42534 | Medium | 6.3 | 2023-11-07 | Improper input validation vulnerability in ChooserActivity prior to SMR Nov-2023 Release 1 allows local attackers to read arbitrary files with system privilege. |
CVE-2023-42533 | Medium | 6.6 | 2023-11-07 | Improper Input Validation with USB Gadget Interface prior to SMR Nov-2023 Release 1 allows a physical attacker to execute arbitrary code in Kernel. |
CVE-2023-42532 | Medium | 5.9 | 2023-11-07 | Improper Certificate Validation in FotaAgent prior to SMR Nov-2023 Release1 allows remote attacker to intercept the network traffic including Firmware informat… |
CVE-2023-42531 | Medium | 6.2 | 2023-11-07 | Improper access control vulnerability in SmsController prior to SMR Nov-2023 Release1 allows local attackers to bypass restrictions on starting activities from… |
CVE-2023-42530 | Medium | 6.7 | 2023-11-07 | Improper access control vulnerability in SecSettings prior to SMR Nov-2023 Release 1 allows attackers to enable Wi-Fi and Wi-Fi Direct without User Interaction. |
CVE-2023-42529 | Medium | 6.7 | 2023-11-07 | Out-of-bound write vulnerability in libsec-ril prior to SMR Nov-2023 Release 1 allows local attackers to execute arbitrary code. |
CVE-2023-42528 | Medium | 6.7 | 2023-11-07 | Improper Input Validation vulnerability in ProcessNvBuffering of libsec-ril prior to SMR Nov-2023 Release 1 allows local attacker to execute arbitrary code. |
CVE-2023-42527 | Medium | 5.6 | 2023-11-07 | Improper input validation vulnerability in ProcessWriteFile of libsec-ril prior to SMR Nov-2023 Release 1 allows local attackers to expose sensitive informatio… |
CVE-2023-42284 | Critical | 9.8 | 2023-11-07 | Blind SQL injection in api_version parameter in Tyk Gateway version 5.0.3 allows attacker to access and dump the database via a crafted SQL query. |
CVE-2023-42283 | Critical | 9.8 | 2023-11-07 | Blind SQL injection in api_id parameter in Tyk Gateway version 5.0.3 allows attacker to access and dump the database via a crafted SQL query. |
CVE-2023-30739 | Medium | 6.7 | 2023-11-07 | Arbitrary File Descriptor Write vulnerability in libsec-ril prior to SMR Nov-2023 Release 1 allows local attacker to execute arbitrary code. |
CVE-2023-41723 | Medium | 4.3 | 2023-11-07 | A vulnerability in Veeam ONE allows a user with the Veeam ONE Read-Only User role to view the Dashboard Schedule. Note: The criticality of this vulnerability i… |
CVE-2023-38549 | Medium | 5.4 | 2023-11-07 | A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of the account used by… |
CVE-2023-38548 | Medium | 4.3 | 2023-11-07 | A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of the account used by… |
CVE-2023-38547 | Critical | 9.8 | 2023-11-07 | A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its configuration data… |
CVE-2023-47102 | Medium | 5.3 | 2023-11-07 | UrBackup Server 2.5.31 allows brute-force enumeration of user accounts because a failure message confirms that a username is not valid. |
CVE-2023-33074 | High | 8.4 | 2023-11-07 | Memory corruption in Audio when SSR event is triggered after music playback is stopped. |
CVE-2023-33061 | High | 7.5 | 2023-11-07 | Transient DOS in WLAN Firmware while parsing WLAN beacon or probe-response frame. |
CVE-2023-33059 | High | 7.8 | 2023-11-07 | Memory corruption in Audio while processing the VOC packet data from ADSP. |
CVE-2023-33056 | High | 7.5 | 2023-11-07 | Transient DOS in WLAN Firmware when firmware receives beacon including T2LM IE. |
CVE-2023-33055 | High | 7.8 | 2023-11-07 | Memory Corruption in Audio while invoking callback function in driver from ADSP. |
CVE-2023-33048 | High | 7.5 | 2023-11-07 | Transient DOS in WLAN Firmware while parsing t2lm buffers. |
CVE-2023-33047 | High | 7.5 | 2023-11-07 | Transient DOS in WLAN Firmware while parsing no-inherit IES. |
CVE-2023-33045 | Critical | 9.8 | 2023-11-07 | Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute. |
CVE-2023-33031 | High | 7.8 | 2023-11-07 | Memory corruption in Automotive Audio while copying data from ADSP shared buffer to the VOC packet data buffer. |
CVE-2023-28574 | Critical | 9.0 | 2023-11-07 | Memory corruption in core services when Diag handler receives a command to configure event listeners. |
CVE-2023-28572 | Medium | 6.6 | 2023-11-07 | Memory corruption in WLAN HOST while processing the WLAN scan descriptor list. |
CVE-2023-28570 | Medium | 6.7 | 2023-11-07 | Memory corruption while processing audio effects. |
CVE-2023-28569 | Medium | 6.1 | 2023-11-07 | Information disclosure in WLAN HAL while handling command through WMI interfaces. |
CVE-2023-28568 | Medium | 6.1 | 2023-11-07 | Information disclosure in WLAN HAL when reception status handler is called. |
CVE-2023-28566 | Medium | 6.1 | 2023-11-07 | Information disclosure in WLAN HAL while handling the WMI state info command. |
CVE-2023-28563 | Medium | 6.1 | 2023-11-07 | Information disclosure in IOE Firmware while handling WMI command. |
CVE-2023-28556 | High | 7.1 | 2023-11-07 | Cryptographic issue in HLOS during key management. |
CVE-2023-28554 | Medium | 6.1 | 2023-11-07 | Information Disclosure in Qualcomm IPC while reading values from shared memory in VM. |
CVE-2023-28553 | Medium | 6.1 | 2023-11-07 | Information Disclosure in WLAN Host when processing WMI event command. |
CVE-2023-28545 | High | 8.2 | 2023-11-07 | Memory corruption in TZ Secure OS while loading an app ELF. |
CVE-2023-24852 | High | 8.4 | 2023-11-07 | Memory Corruption in Core due to secure memory access by user while loading modem image. |
CVE-2023-22388 | Critical | 9.8 | 2023-11-07 | Memory Corruption in Multi-mode Call Processor while processing bit mask API. |
CVE-2023-21671 | Critical | 9.3 | 2023-11-07 | Memory Corruption in Core during syscall for Sectools Fuse comparison feature. |
CVE-2023-46998 | Medium | 6.1 | 2023-11-07 | Cross Site Scripting vulnerability in BootBox Bootbox.js v.3.2 through 6.0 allows a remote attacker to execute arbitrary code via a crafted payload to alert()… |
CVE-2023-35140 | Medium | 5.5 | 2023-11-07 | The improper privilege management vulnerability in the Zyxel GS1900-24EP switch firmware version V2.70(ABTO.5) could allow an authenticated local user with rea… |
CVE-2023-5976 | Medium | 4.3 | 2023-11-07 | Improper Access Control in GitHub repository microweber/microweber prior to 2.0. |
CVE-2023-5904 | Medium | 5.4 | 2023-11-07 | Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16. |
CVE-2023-5903 | Medium | 5.4 | 2023-11-07 | Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16. |
CVE-2023-5902 | Medium | 4.3 | 2023-11-07 | Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16. |
CVE-2023-5901 | Low | 3.5 | 2023-11-07 | Cross-site Scripting in GitHub repository pkp/pkp-lib prior to 3.3.0-16. |
CVE-2023-5900 | Low | 3.5 | 2023-11-07 | Cross-Site Request Forgery in GitHub repository pkp/pkp-lib prior to 3.3.0-16. |
CVE-2023-5748 | Low | 3.3 | 2023-11-07 | Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology SSL VPN Client before 1.4.7-0687 allows local… |
CVE-2023-41036 | High | 7.8 | 2023-11-07 | Macvim is a text editor for MacOS. Prior to version 178, Macvim makes use of an insecure interprocess communication (IPC) mechanism which could lead to a privi… |
CVE-2023-40453 | Medium | 6.5 | 2023-11-07 | Docker Machine through 0.16.2 allows an attacker, who has control of a worker node, to provide crafted version data, which might potentially trick an administr… |
CVE-2023-38509 | Medium | 4.3 | 2023-11-07 | XWiki Platform is a generic wiki platform. In org.xwiki.platform:xwiki-platform-livetable-ui starting with version 3.5-milestone-1 and prior to versions 14.10… |
CVE-2023-2675 | Critical | 9.8 | 2023-11-07 | Improper Restriction of Excessive Authentication Attempts in GitHub repository linagora/twake prior to 2023.Q1.1223. |
CVE-2023-36409 | Medium | 6.5 | 2023-11-07 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability |
CVE-2023-36769 | Medium | 4.6 | 2023-11-06 | Microsoft OneNote Spoofing Vulnerability |
CVE-2023-47004 | High | 8.8 | 2023-11-06 | Buffer Overflow vulnerability in Redis RedisGraph v.2.x through v.2.12.8 and fixed in v.2.12.9 allows an attacker to execute arbitrary code via the code logic… |
CVE-2023-45556 | Medium | 5.4 | 2023-11-06 | Cross Site Scripting vulnerability in Mybb Mybb Forums v.1.8.33 allows a local attacker to execute arbitrary code via the theme Name parameter in the theme man… |
CVE-2023-5771 | Medium | 6.1 | 2023-11-06 | Proofpoint Enterprise Protection contains a stored XSS vulnerability in the AdminUI. An unauthenticated attacker can send a specially crafted email with HTML i… |
CVE-2023-5605 | Medium | 4.8 | 2023-11-06 | The URL Shortify WordPress plugin before 1.7.9.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per… |
CVE-2023-5601 | Critical | 9.8 | 2023-11-06 | The WooCommerce Ninja Forms Product Add-ons WordPress plugin before 1.7.1 does not validate the file to be uploaded, allowing any unauthenticated users to uplo… |
CVE-2023-5530 | Medium | 4.8 | 2023-11-06 | The Ninja Forms Contact Form WordPress plugin before 3.6.34 does not sanitize and escape its label fields, which could allow high privilege users such as admin… |
CVE-2023-5454 | High | 7.5 | 2023-11-06 | The Templately WordPress plugin before 2.2.6 does not properly authorize the `saved-templates/delete` REST API call, allowing unauthenticated users to delete a… |
CVE-2023-5355 | High | 8.1 | 2023-11-06 | The Awesome Support WordPress plugin before 6.1.5 does not sanitize file paths when deleting temporary attachment files, allowing a ticket submitter to delete… |
CVE-2023-5354 | Medium | 6.1 | 2023-11-06 | The Awesome Support WordPress plugin before 6.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-… |
CVE-2023-5352 | Medium | 4.3 | 2023-11-06 | The Awesome Support WordPress plugin before 6.1.5 does not correctly authorize the wpas_edit_reply function, allowing users to edit posts for which they do not… |
CVE-2023-5228 | Medium | 4.8 | 2023-11-06 | The User Registration WordPress plugin before 3.0.4.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin t… |
CVE-2023-5181 | Medium | 4.8 | 2023-11-06 | The WP Discord Invite WordPress plugin before 2.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2023-5082 | High | 7.2 | 2023-11-06 | The History Log by click5 WordPress plugin before 1.0.13 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL… |
CVE-2023-4930 | Medium | 6.5 | 2023-11-06 | The Front End PM WordPress plugin before 11.4.3 does not block listing the contents of the directories where it stores attachments to private messages, allowin… |
CVE-2023-4858 | Medium | 4.8 | 2023-11-06 | The Simple Table Manager WordPress plugin through 1.5.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2023-4810 | Medium | 4.8 | 2023-11-06 | The Responsive Pricing Table WordPress plugin before 5.1.8 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2023-5777 | Critical | 9.8 | 2023-11-06 | Weintek EasyBuilder Pro contains a vulnerability that, even when the private key is immediately deleted after the crash report transmission is finished, the… |
CVE-2023-5719 | High | 8.8 | 2023-11-06 | The Crimson 3.2 Windows-based configuration tool allows users with administrative access to define new passwords for users and to download the resulting secur… |
CVE-2023-46732 | Critical | 9.6 | 2023-11-06 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to reflected cross-site scripting… |
CVE-2023-46731 | Critical | 10.0 | 2023-11-06 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki doesn't properly escape the section URL paramete… |
CVE-2023-46254 | Medium | 4.3 | 2023-11-06 | capsule-proxy is a reverse proxy for Capsule kubernetes multi-tenancy framework. A bug in the RoleBinding reflector used by `capsule-proxy` gives ServiceAccoun… |
CVE-2023-39345 | High | 7.6 | 2023-11-06 | strapi is an open-source headless CMS. Versions prior to 4.13.1 did not properly restrict write access to fielded marked as private in the user registration en… |
CVE-2023-4700 | Low | 3.5 | 2023-11-06 | An authorization issue affecting GitLab EE affecting all versions from 14.7 prior to 16.3.6, 16.4 prior to 16.4.2, and 16.5 prior to 16.5.1, allowed a user to… |
CVE-2023-46728 | High | 7.5 | 2023-11-06 | Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer dereference bug Squid is vulnerable to a Denial of Service at… |
CVE-2023-46251 | High | 7.5 | 2023-11-06 | MyBB is a free and open source forum software. Custom MyCode (BBCode) for the visual editor (_SCEditor_) doesn't escape input properly when rendering HTML, re… |
CVE-2023-45827 | High | 7.3 | 2023-11-06 | Dot diver is a lightweight, powerful, and dependency-free TypeScript utility library that provides types and functions to work with object paths in dot notatio… |