2023 CVEs (page 128)
Page 128 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-46419 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_415730 function. |
CVE-2023-46418 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_412688 function. |
CVE-2023-46417 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_415498 function. |
CVE-2023-46416 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_ The 41A414 function. |
CVE-2023-46415 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_41E588 function. |
CVE-2023-46414 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_ 41D494 function. |
CVE-2023-46413 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_4155DC function. |
CVE-2023-46412 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_41D998 function. |
CVE-2023-46411 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_415258 function. |
CVE-2023-46410 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ The 416F60 function. |
CVE-2023-46409 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ 41CC04 function. |
CVE-2023-46408 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ The 41DD80 function. |
CVE-2023-45136 | Critical | 9.6 | 2023-10-25 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When document names are validated according to a name… |
CVE-2023-45135 | Critical | 9.0 | 2023-10-25 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In `org.xwiki.platform:xwiki-platform-web` versions 7… |
CVE-2023-45134 | Critical | 9.0 | 2023-10-25 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. `org.xwiki.platform:xwiki-platform-web` starting in ve… |
CVE-2023-42861 | Medium | 6.5 | 2023-10-25 | A logic issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.1. An attacker with knowledge of a standard user's credentia… |
CVE-2023-42857 | Low | 3.3 | 2023-10-25 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1. An app… |
CVE-2023-42856 | High | 7.8 | 2023-10-25 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. Processing a file… |
CVE-2023-42854 | Medium | 5.5 | 2023-10-25 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. An app may be… |
CVE-2023-42852 | High | 8.8 | 2023-10-25 | A logic issue was addressed with improved checks. This issue is fixed in iOS 17.1 and iPadOS 17.1, watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, macOS Sonoma 14… |
CVE-2023-42850 | Medium | 5.5 | 2023-10-25 | The issue was addressed with improved permissions logic. This issue is fixed in macOS Sonoma 14.1. An app may be able to access sensitive user data. |
CVE-2023-42849 | Medium | 6.5 | 2023-10-25 | The issue was addressed with improved memory handling. This issue is fixed in iOS 17.1 and iPadOS 17.1, macOS Monterey 12.7.1, watchOS 10.1, iOS 16.7.2 and iPa… |
CVE-2023-42847 | High | 7.5 | 2023-10-25 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1. An attacker may be able to access passkey… |
CVE-2023-42846 | Medium | 5.3 | 2023-10-25 | This issue was addressed by removing the vulnerable code. This issue is fixed in watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, tvOS 17.1, iOS 17.1 and iPadOS 17… |
CVE-2023-42845 | Medium | 5.3 | 2023-10-25 | An authentication issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1. Photos in the Hidden… |
CVE-2023-42844 | High | 7.5 | 2023-10-25 | This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. A website m… |
CVE-2023-42842 | Medium | 5.5 | 2023-10-25 | The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1. An app may be able to access sensitive user data. |
CVE-2023-42841 | High | 7.8 | 2023-10-25 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1, iOS 16.7.2 and iPadOS 16.7.2, macOS… |
CVE-2023-42438 | Medium | 4.3 | 2023-10-25 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.1. Visiting a malicious website may l… |
CVE-2023-41997 | Medium | 4.6 | 2023-10-25 | This issue was addressed by restricting options offered on a locked device. This issue is fixed in macOS Sonoma 14.1, watchOS 10.1, iOS 16.7.2 and iPadOS 16.7… |
CVE-2023-41989 | Medium | 6.8 | 2023-10-25 | The issue was addressed by restricting options offered on a locked device. This issue is fixed in macOS Sonoma 14.1. An attacker may be able to execute arbitra… |
CVE-2023-41988 | Medium | 6.8 | 2023-10-25 | This issue was addressed by restricting options offered on a locked device. This issue is fixed in macOS Sonoma 14.1, watchOS 10.1, iOS 17.1 and iPadOS 17.1. A… |
CVE-2023-41983 | Medium | 6.5 | 2023-10-25 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.1, Safari 17.1, iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1 and iPadOS… |
CVE-2023-41982 | Medium | 4.6 | 2023-10-25 | This issue was addressed by restricting options offered on a locked device. This issue is fixed in macOS Sonoma 14.1, watchOS 10.1, iOS 16.7.2 and iPadOS 16.7… |
CVE-2023-41977 | Medium | 4.3 | 2023-10-25 | The issue was addressed with improved handling of caches. This issue is fixed in macOS Sonoma 14.1, iOS 16.7.2 and iPadOS 16.7.2. Visiting a malicious website… |
CVE-2023-41976 | High | 8.8 | 2023-10-25 | A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 17.1 and iPadOS 17.1, watchOS 10.1, iOS 16.7.2 and iPadOS 16.7… |
CVE-2023-41975 | Medium | 4.3 | 2023-10-25 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. A website may… |
CVE-2023-41254 | Medium | 5.5 | 2023-10-25 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 17.1 and iPadOS 17.1, watchOS 10.1, iOS 16.7.2 a… |
CVE-2023-41077 | Medium | 5.5 | 2023-10-25 | An app may be able to access protected user data. This issue is fixed in macOS Sonoma 14, macOS Ventura 13.6.1. The issue was addressed with improved checks. |
CVE-2023-41072 | Medium | 5.5 | 2023-10-25 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1. An app… |
CVE-2023-40449 | Medium | 5.5 | 2023-10-25 | The issue was addressed with improved memory handling. This issue is fixed in iOS 17.1 and iPadOS 17.1, macOS Monterey 12.7.1, iOS 16.7.2 and iPadOS 16.7.2, ma… |
CVE-2023-40447 | High | 8.8 | 2023-10-25 | The issue was addressed with improved memory handling. This issue is fixed in iOS 17.1 and iPadOS 17.1, watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, macOS Sonom… |
CVE-2023-40445 | High | 7.5 | 2023-10-25 | The issue was addressed with improved UI handling. This issue is fixed in iOS 17.1 and iPadOS 17.1. A device may persistently fail to lock. |
CVE-2023-40444 | Medium | 5.5 | 2023-10-25 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.1. An app may be able to access user-sensitive data. |
CVE-2023-40425 | Medium | 4.4 | 2023-10-25 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14, macOS Monterey 12.7.1. An app with… |
CVE-2023-40423 | High | 7.8 | 2023-10-25 | The issue was addressed with improved memory handling. This issue is fixed in iOS 17.1 and iPadOS 17.1, macOS Monterey 12.7.1, iOS 16.7.2 and iPadOS 16.7.2, ma… |
CVE-2023-40421 | Medium | 5.5 | 2023-10-25 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. An app m… |
CVE-2023-40416 | Medium | 6.5 | 2023-10-25 | The issue was addressed with improved memory handling. This issue is fixed in iOS 17.1 and iPadOS 17.1, macOS Monterey 12.7.1, iOS 16.7.2 and iPadOS 16.7.2, ma… |
CVE-2023-40413 | Medium | 5.5 | 2023-10-25 | The issue was addressed with improved handling of caches. This issue is fixed in iOS 17.1 and iPadOS 17.1, macOS Monterey 12.7.1, watchOS 10.1, iOS 16.7.2 and… |
CVE-2023-40408 | Medium | 5.3 | 2023-10-25 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.1, watchOS 10.1, iOS 16.7.2 and iPadO… |
CVE-2023-40405 | Low | 3.3 | 2023-10-25 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.1. An app may be able to read sensit… |
CVE-2023-40404 | High | 7.8 | 2023-10-25 | A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Sonoma 14.1. An app may be able to execute arbitrary code wi… |
CVE-2023-40401 | High | 7.5 | 2023-10-25 | The issue was addressed with additional permissions checks. This issue is fixed in macOS Ventura 13.6.1. An attacker may be able to access passkeys without aut… |
CVE-2023-32359 | High | 7.5 | 2023-10-25 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 16.7.2 and iPadOS 16.7.2. A user's password may be read a… |
CVE-2023-5758 | Medium | 6.1 | 2023-10-25 | When opening a page in reader mode, the redirect URL could have caused attacker-controlled script to execute in a reflected Cross-Site Scripting (XSS) attack… |
CVE-2023-5753 | Medium | 6.3 | 2023-10-25 | Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c |
CVE-2023-5752 | Medium | 5.5 | 2023-10-25 | When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inje… |
CVE-2023-5746 | Critical | 9.8 | 2023-10-25 | A vulnerability regarding use of externally-controlled format string is found in the cgi component. This allows remote attackers to execute arbitrary code via… |
CVE-2023-5745 | Medium | 5.5 | 2023-10-25 | The Reusable Text Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'text-blocks' shortcode in versions up to, and including, 1.5.3… |
CVE-2023-5744 | Medium | 6.4 | 2023-10-25 | The Very Simple Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vsgmap' shortcode in all versions up to, and in… |
CVE-2023-5740 | Medium | 6.4 | 2023-10-25 | The Live Chat with Facebook Messenger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'messenger' shortcode in all versions… |
CVE-2023-5732 | Medium | 6.5 | 2023-10-25 | An attacker could have created a malicious link using bidirectional characters to spoof the location in the address bar when visited. This vulnerability affect… |
CVE-2023-5731 | Critical | 9.8 | 2023-10-25 | Memory safety bugs present in Firefox 118. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could h… |
CVE-2023-5730 | Critical | 9.8 | 2023-10-25 | Memory safety bugs present in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3. Some of these bugs showed evidence of memory corruption and we presume tha… |
CVE-2023-5729 | Medium | 4.3 | 2023-10-25 | A malicious web site can enter fullscreen mode while simultaneously triggering a WebAuthn prompt. This could have obscured the fullscreen notification and coul… |
CVE-2023-5728 | High | 7.5 | 2023-10-25 | During garbage collection extra operations were performed on a object that should not be. This could have led to a potentially exploitable crash. This vulnerab… |
CVE-2023-5727 | Medium | 6.5 | 2023-10-25 | The executable file warning was not presented when downloading .msix, .msixbundle, .appx, and .appxbundle files, which can run commands on a user's computer… |
CVE-2023-5726 | Medium | 4.3 | 2023-10-25 | A website could have obscured the full screen notification by using the file open dialog. This could have led to user confusion and possible spoofing attacks… |
CVE-2023-5725 | Medium | 4.3 | 2023-10-25 | A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to collect sensitive user data. This vulner… |
CVE-2023-5724 | High | 7.5 | 2023-10-25 | Drivers are not always robust to extremely large draw calls and in some cases this scenario could have led to a crash. This vulnerability affects Firefox < 119… |
CVE-2023-5723 | Medium | 5.3 | 2023-10-25 | An attacker with temporary script access to a site could have set a cookie containing invalid characters using `document.cookie` that could have led to unknown… |
CVE-2023-5722 | Medium | 5.3 | 2023-10-25 | Using iterative requests an attacker was able to learn the size of an opaque response, as well as the contents of a server-supplied Vary header. This vulnerabi… |
CVE-2023-5721 | Medium | 4.3 | 2023-10-25 | It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an insufficient activation-delay. This… |
CVE-2023-5717 | High | 7.8 | 2023-10-25 | A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege esc… |
CVE-2023-5671 | High | 7.8 | 2023-10-25 | HP Print and Scan Doctor for Windows may potentially be vulnerable to escalation of privilege. HP is releasing software updates to mitigate the potential vulne… |
CVE-2023-5568 | Medium | 5.9 | 2023-10-25 | A heap-based Buffer Overflow flaw was discovered in Samba. It could allow a remote, authenticated attacker to exploit this vulnerability to cause a denial of s… |
CVE-2023-5472 | High | 8.8 | 2023-10-25 | Use after free in Profiles in Google Chrome prior to 118.0.5993.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (… |
CVE-2023-5363 | High | 7.5 | 2023-10-25 | Issue summary: A bug has been identified in the processing of key and initialisation vector (IV) lengths. This can lead to potential truncation or overruns du… |
CVE-2023-5311 | High | 8.8 | 2023-10-25 | The WP EXtra plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the register() function in versions u… |
CVE-2023-5127 | Medium | 6.4 | 2023-10-25 | The WP Font Awesome plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.7.9 due to insufficien… |
CVE-2023-5126 | Medium | 4.9 | 2023-10-25 | The Delete Me plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'plugin_delete_me' shortcode in versions up to, and including, 3.0 due to i… |
CVE-2023-5110 | Medium | 6.4 | 2023-10-25 | The BSK PDF Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'bsk-pdfm-category-dropdown' shortcode in versions up to, and includi… |
CVE-2023-5085 | Medium | 6.4 | 2023-10-25 | The Advanced Menu Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'advMenu' shortcode in versions up to, and including, 0.4.1 due… |
CVE-2023-4693 | Medium | 5.3 | 2023-10-25 | An out-of-bounds read flaw was found on grub2's NTFS filesystem driver. This issue may allow a physically present attacker to present a specially crafted NTFS… |
CVE-2023-4692 | High | 7.5 | 2023-10-25 | An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS filesystem image… |
CVE-2023-4608 | Medium | 4.1 | 2023-10-25 | An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command. This affects ThinkSystem v… |
CVE-2023-4607 | High | 7.5 | 2023-10-25 | An authenticated XCC user can change permissions for any user through a crafted API command. |
CVE-2023-4606 | High | 8.1 | 2023-10-25 | An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command. This affects ThinkSystem v2 and v3… |
CVE-2023-46660 | Medium | 5.3 | 2023-10-25 | Jenkins Zanata Plugin 0.6 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token hashes are equ… |
CVE-2023-46659 | Medium | 5.4 | 2023-10-25 | Jenkins Edgewall Trac Plugin 1.13 and earlier does not escape the Trac website URL on the build page, resulting in a stored cross-site scripting (XSS) vulnerab… |
CVE-2023-46658 | Medium | 5.3 | 2023-10-25 | Jenkins MSTeams Webhook Trigger Plugin 0.1.1 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook t… |
CVE-2023-46657 | Medium | 5.3 | 2023-10-25 | Jenkins Gogs Plugin 1.0.15 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, po… |
CVE-2023-46656 | Medium | 5.3 | 2023-10-25 | Jenkins Multibranch Scan Webhook Trigger Plugin 1.0.9 and earlier uses a non-constant time comparison function when checking whether the provided and expected… |
CVE-2023-46655 | Medium | 6.5 | 2023-10-25 | Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the directory from which artifacts are published during the 'Clou… |
CVE-2023-46654 | High | 8.1 | 2023-10-25 | Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the expected directory during the cleanup process of the 'CloudBe… |
CVE-2023-46653 | Medium | 6.5 | 2023-10-25 | Jenkins lambdatest-automation Plugin 1.20.10 and earlier logs LAMBDATEST Credentials access token at the INFO level, potentially resulting in its exposure. |
CVE-2023-46652 | Medium | 4.3 | 2023-10-25 | A missing permission check in Jenkins lambdatest-automation Plugin 1.20.9 and earlier allows attackers with Overall/Read permission to enumerate credentials ID… |
CVE-2023-46651 | Medium | 6.5 | 2023-10-25 | Jenkins Warnings Plugin 10.5.0 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to ac… |
CVE-2023-46650 | Medium | 5.4 | 2023-10-25 | Jenkins GitHub Plugin 1.37.3 and earlier does not escape the GitHub project URL on the build page when showing changes, resulting in a stored cross-site script… |
CVE-2023-46574 | Critical | 9.8 | 2023-10-25 | An issue in TOTOLINK A3700R v.9.1.2u.6165_20211012 allows a remote attacker to execute arbitrary code via the FileName parameter of the UploadFirmwareFile func… |