2023 CVEs (page 122)
Page 122 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-42750 | Medium | 4.4 | 2023-11-01 | In gnss service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privil… |
CVE-2023-42655 | Medium | 6.7 | 2023-11-01 | In sim service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local escalation of p… |
CVE-2023-42654 | Medium | 5.5 | 2023-11-01 | In dm service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42653 | Medium | 5.5 | 2023-11-01 | In faceid service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional executi… |
CVE-2023-42652 | Medium | 5.5 | 2023-11-01 | In engineermode, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42651 | Medium | 5.5 | 2023-11-01 | In engineermode, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42650 | Medium | 5.5 | 2023-11-01 | In engineermode, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42649 | Medium | 5.5 | 2023-11-01 | In engineermode, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42648 | Medium | 5.5 | 2023-11-01 | In engineermode, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42647 | Medium | 5.5 | 2023-11-01 | In Ifaa service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information di… |
CVE-2023-42646 | Medium | 5.5 | 2023-11-01 | In Ifaa service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42645 | Medium | 5.5 | 2023-11-01 | In sim service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information dis… |
CVE-2023-42644 | Medium | 5.5 | 2023-11-01 | In dm service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42643 | Medium | 5.5 | 2023-11-01 | In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42642 | Medium | 5.5 | 2023-11-01 | In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42641 | Medium | 5.5 | 2023-11-01 | In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42640 | Medium | 5.5 | 2023-11-01 | In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42639 | Medium | 5.5 | 2023-11-01 | In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42638 | Medium | 5.5 | 2023-11-01 | In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42637 | Medium | 5.5 | 2023-11-01 | In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42636 | Medium | 5.5 | 2023-11-01 | In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42635 | Medium | 5.5 | 2023-11-01 | In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42634 | Medium | 5.5 | 2023-11-01 | In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42633 | Medium | 5.5 | 2023-11-01 | In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42632 | Medium | 5.5 | 2023-11-01 | In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42631 | Medium | 5.5 | 2023-11-01 | In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-1720 | Critical | 9.6 | 2023-11-01 | Lack of mime type response header in Bitrix24 22.0.300 allows authenticated remote attackers to execute arbitrary JavaScript code in the victim's browser, and… |
CVE-2023-1719 | High | 7.5 | 2023-11-01 | Global variable extraction in bitrix/modules/main/tools.php in Bitrix24 22.0.300 allows unauthenticated remote attackers to (1) enumerate attachments on the se… |
CVE-2023-1718 | High | 7.5 | 2023-11-01 | Improper file stream access in /desktop_app/file.ajax.php?action=uploadfile in Bitrix24 22.0.300 allows unauthenticated remote attackers to cause denial-of-se… |
CVE-2023-1717 | Critical | 9.6 | 2023-11-01 | Prototype pollution in bitrix/templates/bitrix24/components/bitrix/menu/left_vertical/script.js in Bitrix24 22.0.300 allows remote attackers to execute arbitr… |
CVE-2023-1716 | Critical | 9.0 | 2023-11-01 | Cross-site scripting (XSS) vulnerability in Invoice Edit Page in Bitrix24 22.0.300 allows attackers to execute arbitrary JavaScript code in the victim's brows… |
CVE-2023-1715 | Critical | 9.0 | 2023-11-01 | A logic error when using mb_strpos() to check for potential XSS payload in Bitrix24 22.0.300 allows attackers to bypass XSS sanitisation via placing HTML tags… |
CVE-2023-1714 | High | 8.8 | 2023-11-01 | Unsafe variable extraction in bitrix/modules/main/classes/general/user_options.php in Bitrix24 22.0.300 allows remote authenticated attackers to execute arbitr… |
CVE-2023-1713 | High | 8.8 | 2023-11-01 | Insecure temporary file creation in bitrix/modules/crm/lib/order/import/instagram.php in Bitrix24 22.0.300 hosted on Apache HTTP Server allows remote authentic… |
CVE-2023-4198 | Medium | 6.5 | 2023-11-01 | Improper Access Control in Dolibarr ERP CRM <= v17.0.3 allows an unauthorized authenticated user to read a database table containing customer data |
CVE-2023-4197 | High | 7.5 | 2023-11-01 | Improper input validation in Dolibarr ERP CRM <= v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker… |
CVE-2023-5516 | Medium | 5.3 | 2023-11-01 | Poorly constructed webap requests and URI components with special characters trigger unhandled errors and exceptions, disclosing information about the underly… |
CVE-2023-5515 | Medium | 5.3 | 2023-11-01 | The responses for web queries with certain parameters disclose internal path of resources. This information can be used to learn internal structure of the app… |
CVE-2023-5514 | Medium | 5.3 | 2023-11-01 | The response messages received from the eSOMS report generation using certain parameter queries with full file path can be abused for enumerating the local fi… |
CVE-2023-2622 | Low | 2.7 | 2023-11-01 | Authenticated clients can read arbitrary files on the MAIN Computer system using the remote procedure call (RPC) of the InspectSetup service endpoint. The low… |
CVE-2023-2621 | Medium | 6.5 | 2023-11-01 | The McFeeder server (distributed as part of SSW package), is susceptible to an arbitrary file write vulnerability on the MAIN computer system. This vulnerabil… |
CVE-2023-5899 | High | 8.8 | 2023-11-01 | Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16. |
CVE-2023-5898 | High | 8.8 | 2023-11-01 | Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16. |
CVE-2023-5897 | High | 8.8 | 2023-11-01 | Cross-Site Request Forgery (CSRF) in GitHub repository pkp/customLocale prior to 1.2.0-1. |
CVE-2023-5896 | Medium | 5.4 | 2023-11-01 | Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.4.0-4. |
CVE-2023-5895 | Medium | 5.4 | 2023-11-01 | Cross-site Scripting (XSS) - DOM in GitHub repository pkp/pkp-lib prior to 3.3.0-16. |
CVE-2023-5894 | Medium | 5.4 | 2023-11-01 | Cross-site Scripting (XSS) - Stored in GitHub repository pkp/ojs prior to 3.3.0-16. |
CVE-2023-5893 | High | 8.8 | 2023-11-01 | Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16. |
CVE-2023-5892 | Medium | 5.4 | 2023-11-01 | Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16. |
CVE-2023-5891 | Medium | 5.4 | 2023-11-01 | Cross-site Scripting (XSS) - Reflected in GitHub repository pkp/pkp-lib prior to 3.3.0-16. |
CVE-2023-5890 | Medium | 5.4 | 2023-11-01 | Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16. |
CVE-2023-5889 | High | 8.2 | 2023-11-01 | Insufficient Session Expiration in GitHub repository pkp/pkp-lib prior to 3.3.0-16. |
CVE-2023-47099 | Medium | 5.4 | 2023-11-01 | A Stored Cross-Site Scripting (XSS) vulnerability in the Create Virtual Server in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML… |
CVE-2023-47098 | Medium | 4.8 | 2023-11-01 | A Stored Cross-Site Scripting (XSS) vulnerability in the Manage Extra Admins under Administration Options in Virtualmin 7.7 allows remote attackers to inject a… |
CVE-2023-47097 | Medium | 5.4 | 2023-11-01 | A Stored Cross-Site Scripting (XSS) vulnerability in the Server Template under System Setting in Virtualmin 7.7 allows remote attackers to inject arbitrary web… |
CVE-2023-47096 | Medium | 5.4 | 2023-11-01 | A Reflected Cross-Site Scripting (XSS) vulnerability in the Cloudmin Services Client under System Setting in Virtualmin 7.7 allows remote attackers to inject a… |
CVE-2023-47095 | Medium | 5.4 | 2023-11-01 | A Stored Cross-Site Scripting (XSS) vulnerability in the Custom fields of Edit Virtual Server under System Customization in Virtualmin 7.7 allows remote attack… |
CVE-2023-47094 | Medium | 5.4 | 2023-11-01 | A Stored Cross-Site Scripting (XSS) vulnerability in the Account Plans tab of System Settings in Virtualmin 7.7 allows remote attackers to inject arbitrary web… |
CVE-2023-46278 | Medium | 6.5 | 2023-11-01 | Uncontrolled resource consumption vulnerability in Cybozu Remote Service 4.1.0 to 4.1.1 allows a remote authenticated attacker to consume huge storage space or… |
CVE-2023-46378 | Medium | 5.4 | 2023-10-31 | Stored Cross Site Scripting (XSS) vulnerability in MiniCMS 1.1.1 allows attackers to run arbitrary code via crafted string appended to /mc-admin/conf.php. |
CVE-2023-39695 | Medium | 5.3 | 2023-10-31 | Insufficient session expiration in Elenos ETG150 FM Transmitter v3.12 allows attackers to arbitrarily change transmitter configuration and data after logging o… |
CVE-2023-37833 | Low | 2.7 | 2023-10-31 | Improper access control in Elenos ETG150 FM transmitter v3.12 allows attackers to make arbitrary configuration edits that are only accessed by privileged users. |
CVE-2023-44484 | Medium | 6.1 | 2023-10-31 | Online Blood Donation Management System v1.0 is vulnerable to a Stored Cross-Site Scripting vulnerability. The 'firstName' parameter of the users/register.php… |
CVE-2023-46485 | Critical | 9.8 | 2023-10-31 | An issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the setTracerouteCfg function of the stecgi.cgi compo… |
CVE-2023-46484 | Critical | 9.8 | 2023-10-31 | An issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the setLedCfg function. |
CVE-2023-43295 | Low | 3.5 | 2023-10-31 | Cross Site Request Forgery vulnerability in Click Studios (SA) Pty Ltd Passwordstate v.Build 9785 and before allows a local attacker to execute arbitrary code… |
CVE-2023-3955 | High | 8.8 | 2023-10-31 | A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes… |
CVE-2023-3676 | High | 8.8 | 2023-10-31 | A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes… |
CVE-2023-39610 | Medium | 6.5 | 2023-10-31 | An issue in TP-Link Tapo C100 v1.1.15 Build 211130 Rel.15378n(4555) and before allows attackers to cause a Denial of Service (DoS) via supplying a crafted web… |
CVE-2023-20886 | High | 8.8 | 2023-10-31 | VMware Workspace ONE UEM console contains an open redirect vulnerability. A malicious actor may be able to redirect a victim to an attacker and retrieve thei… |
CVE-2023-45955 | High | 7.5 | 2023-10-31 | An issue discovered in Nanoleaf Light strip v3.5.10 allows attackers to cause a denial of service via crafted write binding attribute commands. |
CVE-2023-37832 | High | 7.5 | 2023-10-31 | A lack of rate limiting in Elenos ETG150 FM transmitter v3.12 allows attackers to obtain user credentials via brute force and cause other unspecified impacts. |
CVE-2023-37831 | Medium | 5.3 | 2023-10-31 | An issue discovered in Elenos ETG150 FM transmitter v3.12 allows attackers to enumerate user accounts based on server responses when credentials are submitted. |
CVE-2023-43796 | Medium | 5.3 | 2023-10-31 | Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be queried from Synapse. This… |
CVE-2023-5739 | High | 7.8 | 2023-10-31 | Certain versions of HP PC Hardware Diagnostics Windows are potentially vulnerable to elevation of privilege. |
CVE-2023-46723 | High | 8.9 | 2023-10-31 | lte-pic32-writer is a writer for PIC32 devices. In versions 0.0.1 and prior, those who use `sendto.txt` are vulnerable to attackers who known the IMEI reading… |
CVE-2023-46722 | Medium | 6.1 | 2023-10-31 | The Pimcore Admin Classic Bundle provides a backend UI for Pimcore. Prior to version 1.2.0, a cross-site scripting vulnerability has the potential to steal a u… |
CVE-2023-46256 | Medium | 4.4 | 2023-10-31 | PX4-Autopilot provides PX4 flight control solution for drones. In versions 1.14.0-rc1 and prior, PX4-Autopilot has a heap buffer overflow vulnerability in the… |
CVE-2023-46255 | Medium | 4.2 | 2023-10-31 | SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Prior to version 1.27.0-rc1… |
CVE-2023-46250 | Medium | 5.1 | 2023-10-31 | pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions 3.7.0 through 3.16.4 can craft a PDF which le… |
CVE-2023-46249 | Critical | 9.6 | 2023-10-31 | authentik is an open-source Identity Provider. Prior to versions 2023.8.4 and 2023.10.2, when the default admin user has been deleted, it is potentially possib… |
CVE-2023-46248 | Critical | 9.0 | 2023-10-31 | Cody is an artificial intelligence (AI) coding assistant. The Cody AI VSCode extension versions 0.10.0 through 0.14.0 are vulnerable to Remote Code Execution u… |
CVE-2023-46245 | High | 7.2 | 2023-10-31 | Kimai is a web-based multi-user time-tracking application. Versions prior to 2.1.0 are vulnerable to a Server-Side Template Injection (SSTI) which can be escal… |
CVE-2023-46240 | High | 7.5 | 2023-10-31 | CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error report is displayed even… |
CVE-2023-46239 | High | 7.5 | 2023-10-31 | quic-go is an implementation of the QUIC protocol in Go. Starting in version 0.37.0 and prior to version 0.37.3, by serializing an ACK frame after the CRYTPO t… |
CVE-2023-46993 | Critical | 9.8 | 2023-10-31 | In TOTOLINK A3300R V17.0.0cu.557_B20221024 when dealing with setLedCfg request, there is no verification for the enable parameter, which can lead to command in… |
CVE-2023-46992 | High | 7.5 | 2023-10-31 | TOTOLINK A3300R V17.0.0cu.557_B20221024 is vulnerable to Incorrect Access Control. Attackers are able to reset serveral critical passwords without authenticati… |
CVE-2023-46237 | Medium | 5.8 | 2023-10-31 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, an endpoint intended to offer limited enumeration… |
CVE-2023-46236 | High | 8.6 | 2023-10-31 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, a server-side-request-forgery (SSRF) vulnerability… |
CVE-2023-46235 | Medium | 5.4 | 2023-10-31 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10.15, due to a lack of request sanitization in the lo… |
CVE-2023-42658 | High | 8.8 | 2023-10-31 | Archive command in Chef InSpec prior to 4.56.58 and 5.22.29 allow local command execution via maliciously crafted profile. |
CVE-2023-42425 | Critical | 9.8 | 2023-10-31 | An issue in Turing Video Turing Edge+ EVC5FD v.1.38.6 allows remote attacker to execute arbitrary code and obtain sensitive information via the cloud connectio… |
CVE-2023-40050 | Critical | 9.9 | 2023-10-31 | Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with maliciously crafted… |
CVE-2023-37966 | High | 7.6 | 2023-10-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Solwin Infotech User Activity Log user-activity-log allow… |
CVE-2023-37243 | High | 7.8 | 2023-10-31 | The C:\Windows\Temp\Agent.Package.Availability\Agent.Package.Availability.exe file is automatically launched as SYSTEM when the system reboots. Since the C:\Wi… |
CVE-2023-36508 | High | 7.6 | 2023-10-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BestWebSoft Contact Form to DB by BestWebSoft – Messages… |
CVE-2023-35879 | High | 7.6 | 2023-10-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce Product Vendors allows SQL Injection.This iss… |
CVE-2023-33927 | High | 7.6 | 2023-10-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Multiple Page Generator Plugin – MPG multiple-p… |
CVE-2023-31212 | High | 8.5 | 2023-10-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks Database for Contact Form 7, WPforms, Elementor… |
CVE-2023-24410 | Medium | 5.5 | 2023-10-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Contact Form - WPManageNinja LLC Contact Form Plugin – Fa… |