2023 CVEs (page 124)
Page 124 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-46210 | Medium | 5.9 | 2023-10-31 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WebCource WC Captcha plugin <= 1.4 versions. |
CVE-2023-46451 | Medium | 5.4 | 2023-10-31 | Best Courier Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in the change username field. |
CVE-2023-46361 | Medium | 6.5 | 2023-10-31 | Artifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2_error at /jbig2dec/jbig2.c. |
CVE-2023-45996 | High | 8.8 | 2023-10-31 | SQL injection vulnerability in Senayan Library Management Systems Slims v.9 and Bulian v.9.6.1 allows a remote attacker to obtain sensitive information and exe… |
CVE-2023-43139 | Critical | 9.8 | 2023-10-31 | An issue in franfinance before v.2.0.27 allows a remote attacker to execute arbitrary code via the validation.php, and controllers/front/validation.php compone… |
CVE-2023-36263 | Critical | 9.8 | 2023-10-31 | Prestashop opartlimitquantity 1.4.5 and before is vulnerable to SQL Injection. OpartlimitquantityAlertlimitModuleFrontController::displayAjaxPushAlertMessage()… |
CVE-2023-47174 | Critical | 9.8 | 2023-10-31 | Thorn SFTP gateway 3.4.x before 3.4.4 uses Pivotal Spring Framework for Java deserialization of untrusted data, which is not supported by Pivotal, a related is… |
CVE-2023-46356 | Critical | 9.8 | 2023-10-31 | In the module "CSV Feeds PRO" (csvfeeds) before 2.6.1 from Bl Modules for PrestaShop, a guest can perform SQL injection. The method `SearchApiCsv::getProducts(… |
CVE-2023-45378 | Critical | 9.8 | 2023-10-31 | In the module "PrestaBlog" (prestablog) version 4.4.7 and before from HDclic for PrestaShop, a guest can perform SQL injection. The script ajax slider_position… |
CVE-2023-27846 | Critical | 9.8 | 2023-10-31 | SQL injection vulnerability found in PrestaShop themevolty v.4.0.8 and before allow a remote attacker to gain privileges via the tvcmsblog, tvcmsvideotab, tvcm… |
CVE-2023-46040 | Medium | 5.4 | 2023-10-31 | Cross Site Scripting vulnerability in GetSimpleCMS v.3.4.0a allows a remote attacker to execute arbitrary code via the a crafted payload to the components.php… |
CVE-2023-45899 | High | 7.5 | 2023-10-31 | An issue in the component SuperUserSetuserModuleFrontController:init() of idnovate superuser before v2.4.2 allows attackers to bypass authentication via a craf… |
CVE-2023-5867 | Medium | 5.4 | 2023-10-31 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.2. |
CVE-2023-5866 | Medium | 5.7 | 2023-10-31 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.2.1. |
CVE-2023-5865 | Critical | 9.8 | 2023-10-31 | Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2. |
CVE-2023-5864 | Medium | 4.8 | 2023-10-31 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.1. |
CVE-2023-5863 | Medium | 6.1 | 2023-10-31 | Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.2. |
CVE-2023-5862 | Low | 3.3 | 2023-10-31 | Missing Authorization in GitHub repository hamza417/inure prior to Build95. |
CVE-2023-5861 | Medium | 4.8 | 2023-10-31 | Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 2.0. |
CVE-2023-31794 | Medium | 5.5 | 2023-10-31 | MuPDF v1.21.1 was discovered to contain an infinite recursion in the component pdf_mark_list_push. This vulnerability allows attackers to cause a Denial of Ser… |
CVE-2023-46139 | Medium | 5.0 | 2023-10-31 | KernelSU is a Kernel based root solution for Android. Starting in version 0.6.1 and prior to version 0.7.0, if a KernelSU installed device is infected with a m… |
CVE-2023-46138 | Low | 3.7 | 2023-10-31 | JumpServer is an open source bastion host and maintenance security audit system that complies with 4A specifications. Prior to version 3.8.0, the default email… |
CVE-2023-46129 | High | 7.5 | 2023-10-31 | NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptogra… |
CVE-2023-46502 | Critical | 9.8 | 2023-10-30 | An issue in openCRX v.5.2.2 allows a remote attacker to read internal files and execute server side request forgery attack via insecure DocumentBuilderFactory. |
CVE-2023-46478 | High | 8.8 | 2023-10-30 | An issue in minCal v.1.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the customer_data parameter. |
CVE-2023-45672 | High | 7.5 | 2023-10-30 | Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, an unsafe deserialization vulnerability was identified in the endpoints used… |
CVE-2023-45671 | Medium | 4.7 | 2023-10-30 | Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, there is a reflected cross-site scripting vulnerability in any API endpoints… |
CVE-2023-45670 | High | 7.5 | 2023-10-30 | Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, the `config/save` and `config/set` endpoints of Frigate do not implement any… |
CVE-2023-44397 | High | 7.5 | 2023-10-30 | CloudExplorer Lite is an open source, lightweight cloud management platform. Prior to version 1.4.1, the gateway filter of CloudExplorer Lite uses a controller… |
CVE-2023-43798 | Medium | 5.6 | 2023-10-30 | BigBlueButton is an open-source virtual classroom. BigBlueButton prior to versions 2.6.12 and 2.7.0-rc.1 is vulnerable to Server-Side Request Forgery (SSRF). T… |
CVE-2023-43797 | Medium | 6.3 | 2023-10-30 | BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripting when users wai… |
CVE-2023-45956 | High | 7.5 | 2023-10-30 | An issue discovered in Govee LED Strip v3.00.42 allows attackers to cause a denial of service via crafted Move and MoveWithOnoff commands. |
CVE-2023-42323 | High | 8.8 | 2023-10-30 | Cross Site Request Forgery (CSRF) vulnerability in DouHaocms v.3.3 allows a remote attacker to execute arbitrary code via the adminAction.class.php file. |
CVE-2023-5349 | Medium | 5.3 | 2023-10-30 | A memory leak flaw was found in ruby-magick, an interface between Ruby and ImageMagick. This issue can lead to a denial of service (DOS) by memory exhaustion. |
CVE-2023-43792 | Critical | 9.8 | 2023-10-30 | baserCMS is a website development framework. In versions 4.6.0 through 4.7.6, there is a Code Injection vulnerability in the mail form of baserCMS. As of time… |
CVE-2023-47104 | Critical | 9.8 | 2023-10-30 | tinyfiledialogs (aka tiny file dialogs) before 3.15.0 allows shell metacharacters (such as a backquote or a dollar sign) in titles, messages, and other input d… |
CVE-2023-43649 | Medium | 4.7 | 2023-10-30 | baserCMS is a website development framework. Prior to version 4.8.0, there is a cross site request forgery vulnerability in the content preview feature of base… |
CVE-2023-43648 | Medium | 4.9 | 2023-10-30 | baserCMS is a website development framework. Prior to version 4.8.0, there is a Directory Traversal Vulnerability in the form submission data management featur… |
CVE-2023-43647 | Medium | 6.1 | 2023-10-30 | baserCMS is a website development framework. Prior to version 4.8.0, there is a cross-site scripting vulnerability in the file upload feature of baserCMS. Vers… |
CVE-2023-42804 | Low | 3.1 | 2023-10-30 | BigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.1 has a path traversal vulnerability that allows an attacker with… |
CVE-2023-42803 | Medium | 5.3 | 2023-10-30 | BigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.2 is vulnerable to unrestricted file upload, where the insertDocum… |
CVE-2023-41891 | Low | 3.5 | 2023-10-30 | FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. Prior to version 1.1.124, list endpoints on… |
CVE-2023-47101 | High | 7.8 | 2023-10-30 | The installer (aka openvpn-client-installer) in Securepoint SSL VPN Client before 2.0.40 allows local privilege escalation during installation or repair. |
CVE-2023-45780 | High | 7.3 | 2023-10-30 | In Print Service, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no add… |
CVE-2023-40101 | Medium | 5.5 | 2023-10-30 | In collapse of canonicalize_md.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no… |
CVE-2023-21398 | High | 7.8 | 2023-10-30 | In sdksandbox, there is a possible strandhogg style overlay attack due to a logic error in the code. This could lead to local escalation of privilege with no a… |
CVE-2023-21397 | High | 7.8 | 2023-10-30 | In Setup Wizard, there is a possible way to save a WiFi network due to an insecure default value. This could lead to local escalation of privilege with no addi… |
CVE-2023-21396 | High | 7.8 | 2023-10-30 | In Activity Manager, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with Use… |
CVE-2023-21395 | Medium | 6.5 | 2023-10-30 | In Bluetooth, there is a possible out of bounds read due to a use after free. This could lead to remote information disclosure over Bluetooth with no additiona… |
CVE-2023-21394 | Medium | 5.5 | 2023-10-30 | In registerPhoneAccount of TelecomServiceImpl.java, there is a possible way to reveal images from another user due to a missing permission check. This could le… |
CVE-2023-21393 | High | 7.8 | 2023-10-30 | In Settings, there is a possible way for the user to change SIM due to a missing permission check. This could lead to local escalation of privilege with no add… |
CVE-2023-21392 | High | 8.8 | 2023-10-30 | In Bluetooth, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege when connecting to a Bluetoot… |
CVE-2023-21391 | High | 7.5 | 2023-10-30 | In Messaging, there is a possible way to disable the messaging application due to improper input validation. This could lead to remote denial of service with n… |
CVE-2023-21390 | High | 7.8 | 2023-10-30 | In Sim, there is a possible way to evade mobile preference restrictions due to a permission bypass. This could lead to local escalation of privilege with no ad… |
CVE-2023-21389 | High | 7.8 | 2023-10-30 | In Settings, there is a possible bypass of profile owner restrictions due to a missing permission check. This could lead to local escalation of privilege with… |
CVE-2023-21388 | High | 7.8 | 2023-10-30 | In Settings, there is a possible restriction bypass due to a missing permission check. This could lead to local escalation of privilege with no additional exec… |
CVE-2023-21387 | Medium | 4.4 | 2023-10-30 | In User Backup Manager, there is a possible way to leak a token to bypass user confirmation for backup due to log information disclosure. This could lead to lo… |
CVE-2023-21385 | Medium | 5.5 | 2023-10-30 | In Whitechapel, there is a possible out of bounds read due to memory corruption. This could lead to local information disclosure with no additional execution p… |
CVE-2023-21384 | Medium | 5.5 | 2023-10-30 | In Package Manager, there is a possible possible permissions bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User e… |
CVE-2023-21383 | Medium | 5.5 | 2023-10-30 | In Settings, there is a possible way for the user to unintentionally send extra data due to an unclear prompt. This could lead to local information disclosure… |
CVE-2023-21382 | Medium | 5.5 | 2023-10-30 | In Content Resolver, there is a possible method to access metadata about existing content providers on the device due to a missing permission check. This could… |
CVE-2023-21381 | High | 7.8 | 2023-10-30 | In Media Resource Manager, there is a possible local arbitrary code execution due to use after free. This could lead to local escalation of privilege with no a… |
CVE-2023-21380 | Medium | 6.7 | 2023-10-30 | In Bluetooth, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with System execution pri… |
CVE-2023-21379 | Medium | 4.4 | 2023-10-30 | In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure in the Bluetooth server wit… |
CVE-2023-21378 | High | 7.8 | 2023-10-30 | In Telecomm, there is a possible way to silence the ring for calls of secondary users due to a missing permission check. This could lead to local escalation of… |
CVE-2023-21377 | Medium | 5.5 | 2023-10-30 | In SELinux Policy, there is a possible restriction bypass due to a permissions bypass. This could lead to local information disclosure with no additional execu… |
CVE-2023-21376 | Medium | 5.5 | 2023-10-30 | In Telephony, there is a possible way to retrieve the ICCID due to a logic error in the code. This could lead to local information disclosure with no additiona… |
CVE-2023-21375 | High | 7.8 | 2023-10-30 | In Sysproxy, there is a possible out of bounds write due to an integer underflow. This could lead to local escalation of privilege with no additional execution… |
CVE-2023-21374 | High | 7.8 | 2023-10-30 | In System UI, there is a possible factory reset protection bypass due to a logic error in the code. This could lead to local escalation of privilege with no ad… |
CVE-2023-21373 | High | 7.8 | 2023-10-30 | In Telephony, there is a possible way for a guest user to change the preferred SIM due to a missing permission check. This could lead to local escalation of pr… |
CVE-2023-21372 | High | 7.8 | 2023-10-30 | In libdexfile, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execut… |
CVE-2023-47090 | Medium | 6.5 | 2023-10-30 | NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for u… |
CVE-2023-36920 | Medium | 6.1 | 2023-10-30 | In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the X-FRAME-OPTIONS response header is not i… |
CVE-2023-21371 | Medium | 6.7 | 2023-10-30 | In Secure Element, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution p… |
CVE-2023-21370 | Medium | 6.7 | 2023-10-30 | In the Security Element API, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System e… |
CVE-2023-21369 | Medium | 5.5 | 2023-10-30 | In Usage Access, there is a possible way to display a Settings usage access restriction toggle screen due to a permissions bypass. This could lead to local den… |
CVE-2023-21368 | Medium | 5.5 | 2023-10-30 | In Audio, there is a possible out of bounds read due to missing bounds check. This could lead to local information disclosure with no additional execution priv… |
CVE-2023-21367 | Medium | 5.5 | 2023-10-30 | In Scudo, there is a possible way to exploit certain heap OOB read/write issues due to an insecure implementation/design. This could lead to local information… |
CVE-2023-21366 | Medium | 5.5 | 2023-10-30 | In Scudo, there is a possible way for an attacker to predict heap allocation patterns due to insecure implementation/design. This could lead to local informati… |
CVE-2023-21365 | Medium | 5.5 | 2023-10-30 | In Contacts, there is a possible crash loop due to resource exhaustion. This could lead to local denial of service in the Phone app with User execution privile… |
CVE-2023-21364 | Medium | 5.5 | 2023-10-30 | In ContactsProvider, there is a possible crash loop due to resource exhaustion. This could lead to local persistent denial of service in the Phone app with Use… |
CVE-2023-21362 | Medium | 5.5 | 2023-10-30 | In Usage, there is a possible permanent DoS due to resource exhaustion. This could lead to local denial of service with no additional execution privileges need… |
CVE-2023-21361 | High | 8.8 | 2023-10-30 | In Bluetooth, there is a possibility of code-execution due to a use after free. This could lead to paired device escalation of privilege in the privileged Blue… |
CVE-2023-21360 | Medium | 6.7 | 2023-10-30 | In Bluetooth, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution… |
CVE-2023-21359 | Medium | 4.4 | 2023-10-30 | In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure in the Bluetooth server wit… |
CVE-2023-21358 | High | 7.8 | 2023-10-30 | In UWB Google, there is a possible way for a malicious app to masquerade as system app com.android.uwb.resources due to improperly used crypto. This could lead… |
CVE-2023-21357 | Medium | 4.4 | 2023-10-30 | In NFC, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges… |
CVE-2023-21356 | High | 8.8 | 2023-10-30 | In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent) code execution with no addit… |
CVE-2023-21355 | High | 7.8 | 2023-10-30 | In libaudioclient, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with no additional executi… |
CVE-2023-21354 | Medium | 5.5 | 2023-10-30 | In Package Manager Service, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclo… |
CVE-2023-21353 | High | 7.5 | 2023-10-30 | In NFA, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution pri… |
CVE-2023-21352 | Medium | 5.5 | 2023-10-30 | In NFA, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution priv… |
CVE-2023-21351 | High | 7.8 | 2023-10-30 | In multiple locations, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with n… |
CVE-2023-21350 | Medium | 5.5 | 2023-10-30 | In Media Projection, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. T… |
CVE-2023-21349 | Low | 3.3 | 2023-10-30 | In Package Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Th… |
CVE-2023-21348 | Low | 3.3 | 2023-10-30 | In Window Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Thi… |
CVE-2023-21347 | High | 7.5 | 2023-10-30 | In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional executi… |
CVE-2023-21346 | Low | 3.3 | 2023-10-30 | In the Device Idle Controller, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information dis… |
CVE-2023-21345 | Low | 3.3 | 2023-10-30 | In Game Manager Service, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosur… |
CVE-2023-21344 | Medium | 5.5 | 2023-10-30 | In Job Scheduler, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This… |