2023 CVEs (page 138)
Page 138 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-4257 | High | 7.6 | 2023-10-13 | Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. |
CVE-2023-4263 | High | 7.6 | 2023-10-13 | Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driver |
CVE-2023-36559 | Medium | 4.2 | 2023-10-13 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2023-34977 | Medium | 4.6 | 2023-10-13 | A cross-site scripting (XSS) vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to inject… |
CVE-2023-34976 | Critical | 10.0 | 2023-10-13 | A SQL injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to inject malicious co… |
CVE-2023-34975 | Medium | 6.6 | 2023-10-13 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… |
CVE-2023-32976 | Medium | 6.6 | 2023-10-13 | An OS command injection vulnerability has been reported to affect Container Station. If exploited, the vulnerability could allow authenticated administrators t… |
CVE-2023-32974 | High | 7.5 | 2023-10-13 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read th… |
CVE-2023-32973 | Low | 3.8 | 2023-10-13 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2023-32970 | Medium | 4.9 | 2023-10-13 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authen… |
CVE-2023-5449 | Low | 3.3 | 2023-10-13 | A potential security vulnerability has been identified in certain HP Displays supporting the Theft Deterrence feature which may allow a monitor’s Theft Deterre… |
CVE-2023-5409 | Medium | 6.8 | 2023-10-13 | HP is aware of a potential security vulnerability in HP t430 and t638 Thin Client PCs. These models may be susceptible to a physical attack, allowing an untrus… |
CVE-2023-4499 | High | 7.5 | 2023-10-13 | A potential security vulnerability has been identified in the HP ThinUpdate utility (also known as HP Recovery Image and Software Download Tool) which may lead… |
CVE-2023-45276 | Medium | 5.4 | 2023-10-13 | Cross-Site Request Forgery (CSRF) vulnerability in automatededitor.Com Automated Editor plugin <= 1.3 versions. |
CVE-2023-45270 | Medium | 4.3 | 2023-10-13 | Cross-Site Request Forgery (CSRF) vulnerability in PINPOINT.WORLD Pinpoint Booking System plugin <= 2.9.9.4.0 versions. |
CVE-2023-45269 | Medium | 5.4 | 2023-10-13 | Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO plugin <= 2.0.25 versions. |
CVE-2023-40682 | Medium | 4.4 | 2023-10-13 | IBM App Connect Enterprise 12.0.1.0 through 12.0.8.0 contains an unspecified vulnerability that could allow a local privileged user to obtain sensitive informa… |
CVE-2023-45268 | Medium | 4.3 | 2023-10-13 | Cross-Site Request Forgery (CSRF) vulnerability in Hitsteps Hitsteps Web Analytics plugin <= 5.86 versions. |
CVE-2023-45267 | Medium | 4.3 | 2023-10-13 | Cross-Site Request Forgery (CSRF) vulnerability in Zizou1988 IRivYou plugin <= 2.2.1 versions. |
CVE-2023-41843 | High | 7.5 | 2023-10-13 | A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.1, FortiSandbox… |
CVE-2023-41836 | Low | 3.5 | 2023-10-13 | An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0, FortiSandbox 4.2.1 throug… |
CVE-2023-41682 | High | 8.1 | 2023-10-13 | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0, FortiSandbox 4.2.1 through 4.2.5… |
CVE-2023-41681 | High | 7.5 | 2023-10-13 | A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.1, FortiSandbox… |
CVE-2023-41680 | High | 7.5 | 2023-10-13 | A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.1, FortiSandbox… |
CVE-2023-33303 | High | 8.1 | 2023-10-13 | A insufficient session expiration in Fortinet FortiEDR version 5.0.0 through 5.0.1 allows attacker to execute unauthorized code or commands via api request |
CVE-2023-45393 | Medium | 6.5 | 2023-10-13 | An indirect object reference (IDOR) in GRANDING UTime Master v9.0.7-Build:Apr 4,2023 allows authenticated attackers to access sensitive information via a craft… |
CVE-2023-45391 | Medium | 4.8 | 2023-10-13 | A stored cross-site scripting (XSS) vulnerability in the Create A New Employee function of Granding UTime Master v9.0.7-Build:Apr 4,2023 allows authenticated a… |
CVE-2023-45109 | Medium | 5.4 | 2023-10-13 | Cross-Site Request Forgery (CSRF) vulnerability in ZAKSTAN WhitePage plugin <= 1.1.5 versions. |
CVE-2023-5240 | High | 7.5 | 2023-10-13 | Improper access control in PAM propagation scripts in Devolutions Server 2023.2.8.0 and ealier allows an attack with permission to manage PAM propagation scrip… |
CVE-2023-4995 | Medium | 6.4 | 2023-10-13 | The Embed Calendly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'calendly' shortcode in versions up to, and including, 3.6 due to insu… |
CVE-2023-4829 | Medium | 5.4 | 2023-10-13 | Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.0.22. |
CVE-2023-4517 | Medium | 5.4 | 2023-10-13 | Cross-site Scripting (XSS) - Stored in GitHub repository hestiacp/hestiacp prior to 1.8.6. |
CVE-2023-45468 | High | 7.5 | 2023-10-13 | Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the pingWdogIp. This vulnerability allows attackers to cause a Denial of Service (DoS) v… |
CVE-2023-45467 | Critical | 9.8 | 2023-10-13 | Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ntpServIP parameter in the Time Settings. |
CVE-2023-45466 | Critical | 9.8 | 2023-10-13 | Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the pin_host parameter in the WPS Settings. |
CVE-2023-45465 | Critical | 9.8 | 2023-10-13 | Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ddnsDomainName parameter in the Dynamic DNS settings. |
CVE-2023-45464 | High | 7.5 | 2023-10-13 | Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the servDomain parameter. This vulnerability allows attackers to cause a Denial of Servi… |
CVE-2023-45463 | High | 7.5 | 2023-10-13 | Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the hostName parameter in the FUN_0040dabc function. This vulnerability allows attackers… |
CVE-2023-45162 | Critical | 9.9 | 2023-10-13 | Affected 1E Platform versions have a Blind SQL Injection vulnerability that can lead to arbitrary code execution. Application of the relevant hotfix remediat… |
CVE-2023-45130 | High | 7.5 | 2023-10-13 | Frontier is Substrate's Ethereum compatibility layer. Prior to commit aea528198b3b226e0d20cce878551fd4c0e3d5d0, at the end of a contract execution, when opcode… |
CVE-2023-45108 | Medium | 4.3 | 2023-10-13 | Cross-Site Request Forgery (CSRF) vulnerability in Mailrelay plugin <= 2.1.1 versions. |
CVE-2023-45107 | Medium | 4.3 | 2023-10-13 | Cross-Site Request Forgery (CSRF) vulnerability in GoodBarber plugin <= 1.0.22 versions. |
CVE-2023-39960 | Medium | 5.0 | 2023-10-13 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server starting with 25.0.0 and prior to 25.09 and 26.04; as… |
CVE-2023-29464 | High | 8.2 | 2023-10-13 | FactoryTalk Linx, in the Rockwell Automation PanelView Plus, allows an unauthenticated threat actor to read data from memory via crafted malicious packets. Se… |
CVE-2023-43079 | High | 7.3 | 2023-10-13 | Dell OpenManage Server Administrator, versions 11.0.0.0 and prior, contains an Improper Access Control vulnerability. A local low-privileged malicious user co… |
CVE-2023-39999 | Medium | 4.3 | 2023-10-13 | Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through… |
CVE-2023-5573 | Medium | 6.5 | 2023-10-13 | Allocation of Resources Without Limits or Throttling in GitHub repository vriteio/vrite prior to 0.3.0. |
CVE-2023-5572 | Critical | 9.8 | 2023-10-13 | Server-Side Request Forgery (SSRF) in GitHub repository vriteio/vrite prior to 0.3.0. |
CVE-2023-5571 | High | 7.5 | 2023-10-13 | Improper Input Validation in GitHub repository vriteio/vrite prior to 0.3.0. |
CVE-2023-38000 | Medium | 6.5 | 2023-10-13 | Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from… |
CVE-2023-38251 | Medium | 5.3 | 2023-10-13 | Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Uncontrolled Res… |
CVE-2023-38250 | High | 8.0 | 2023-10-13 | Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutra… |
CVE-2023-38249 | High | 8.0 | 2023-10-13 | Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutra… |
CVE-2023-38221 | High | 8.0 | 2023-10-13 | Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutra… |
CVE-2023-38220 | High | 7.5 | 2023-10-13 | Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Author… |
CVE-2023-38219 | High | 8.7 | 2023-10-13 | Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a stored Cross-Sit… |
CVE-2023-38218 | High | 8.8 | 2023-10-13 | Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Incorrect Autho… |
CVE-2023-26367 | Medium | 4.9 | 2023-10-13 | Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Input… |
CVE-2023-26366 | Medium | 6.8 | 2023-10-13 | Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Server-Side Requ… |
CVE-2023-5557 | High | 7.5 | 2023-10-13 | A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-… |
CVE-2023-4562 | Critical | 9.1 | 2023-10-13 | Improper Authentication vulnerability in Mitsubishi Electric Corporation MELSEC-F Series main modules allows a remote unauthenticated attacker to obtain sequen… |
CVE-2023-42752 | Medium | 5.5 | 2023-10-13 | An integer overflow flaw was found in the Linux kernel. This issue leads to the kernel allocating `skb_shared_info` in the userspace, which is exploitable in s… |
CVE-2023-5564 | Medium | 4.8 | 2023-10-13 | Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.1.0-dev1. |
CVE-2023-5563 | High | 7.1 | 2023-10-13 | The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIG_CAN_AUTO_BUS_OFF_RECOVERY=y. This result… |
CVE-2023-44204 | Medium | 6.5 | 2023-10-13 | An Improper Validation of Syntactic Correctness of Input vulnerability in Routing Protocol Daemon (rpd) Juniper Networks Junos OS and Junos OS Evolved allows… |
CVE-2023-44203 | Medium | 6.5 | 2023-10-13 | An Improper Check or Handling of Exceptional Conditions vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on QFX5000 Series, EX… |
CVE-2023-44201 | Medium | 5.0 | 2023-10-13 | An Incorrect Permission Assignment for Critical Resource vulnerability in a specific file of Juniper Networks Junos OS and Junos OS Evolved allows a local aut… |
CVE-2023-44199 | High | 7.5 | 2023-10-13 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series allows a… |
CVE-2023-44198 | Medium | 5.8 | 2023-10-13 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the SIP ALG of Juniper Networks Junos OS on SRX Series and MX Series allows an unauth… |
CVE-2023-44197 | High | 7.5 | 2023-10-13 | An Out-of-Bounds Write vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network… |
CVE-2023-44196 | Medium | 6.5 | 2023-10-13 | An Improper Check for Unusual or Exceptional Conditions in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS Evolved on PTX10003 Series allows a… |
CVE-2023-44195 | Medium | 5.4 | 2023-10-13 | An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the NetworkStack agent daemon (nsagentd) of Juniper Networks Junos OS… |
CVE-2023-44194 | High | 8.4 | 2023-10-13 | An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS allows an unauthenticated attacker with local access to the device to create a bac… |
CVE-2023-44193 | Medium | 5.5 | 2023-10-13 | An Improper Release of Memory Before Removing Last Reference vulnerability in Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows a local, low… |
CVE-2023-44192 | High | 7.5 | 2023-10-13 | An Improper Input Validation vulnerability in the Packet Forwarding Engine of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to c… |
CVE-2023-44191 | High | 7.5 | 2023-10-13 | An Allocation of Resources Without Limits or Throttling vulnerability in Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause… |
CVE-2023-44185 | High | 7.5 | 2023-10-13 | An Improper Input Validation vulnerability in the routing protocol daemon (rpd) of Juniper Networks allows an attacker to cause a Denial of Service (DoS )to t… |
CVE-2023-44184 | Medium | 6.5 | 2023-10-13 | An Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in the management daemon (mgd) process of Juniper Networks Junos OS a… |
CVE-2023-44183 | Medium | 6.5 | 2023-10-13 | An Improper Input Validation vulnerability in the VxLAN packet forwarding engine (PFE) of Juniper Networks Junos OS on QFX5000 Series, EX4600 Series devices a… |
CVE-2023-44182 | High | 7.3 | 2023-10-13 | An Unchecked Return Value vulnerability in the user interfaces to the Juniper Networks Junos OS and Junos OS Evolved, the CLI, the XML API, the XML Management… |
CVE-2023-44181 | High | 7.5 | 2023-10-13 | An Improperly Implemented Security Check for Standard vulnerability in storm control of Juniper Networks Junos OS QFX5k devices allows packets to be punted to… |
CVE-2023-44178 | Medium | 5.5 | 2023-10-13 | A Stack-based Buffer Overflow vulnerability in the CLI command of Juniper Networks Junos OS allows a low privileged attacker to execute a specific CLI command… |
CVE-2023-44177 | Medium | 5.5 | 2023-10-13 | A Stack-based Buffer Overflow vulnerability in the CLI command of Juniper Networks Junos and Junos EVO allows a low privileged attacker to execute a specific… |
CVE-2023-44176 | Medium | 5.5 | 2023-10-13 | A Stack-based Buffer Overflow vulnerability in the CLI command of Juniper Networks Junos OS allows a low privileged attacker to execute a specific CLI command… |
CVE-2023-44175 | Medium | 6.5 | 2023-10-12 | A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows to send specific genuine PIM… |
CVE-2023-41263 | Low | 3.7 | 2023-10-12 | An issue was discovered in Plixer Scrutinizer before 19.3.1. It exposes debug logs to unauthenticated users at the /debug/ URL path. With knowledge of valid IP… |
CVE-2023-41262 | Critical | 9.8 | 2023-10-12 | An issue was discovered in /fcgi/scrut_fcgi.fcgi in Plixer Scrutinizer before 19.3.1. The csvExportReport endpoint action generateCSV is vulnerable to SQL inje… |
CVE-2023-41261 | Medium | 5.3 | 2023-10-12 | An issue was discovered in /fcgi/scrut_fcgi.fcgi in Plixer Scrutinizer before 19.3.1. The csvExportReport endpoint action generateCSV does not require authenti… |
CVE-2023-36843 | High | 7.5 | 2023-10-12 | An Improper Handling of Inconsistent Special Elements vulnerability in the Junos Services Framework (jsf) module of Juniper Networks Junos OS allows an unauth… |
CVE-2023-36841 | High | 7.5 | 2023-10-12 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series allows a… |
CVE-2023-36839 | Medium | 6.5 | 2023-10-12 | An Improper Validation of Specified Quantity in Input vulnerability in the Layer-2 control protocols daemon (l2cpd) of Juniper Networks Junos OS and Junos OS… |
CVE-2023-22392 | Medium | 6.5 | 2023-10-12 | A Missing Release of Memory after Effective Lifetime vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows an adjacent, unau… |
CVE-2023-27316 | High | 8.8 | 2023-10-12 | SnapCenter versions 4.8 through 4.9 are susceptible to a vulnerability which may allow an authenticated SnapCenter Server user to become an admin user on a r… |
CVE-2023-45511 | Medium | 5.5 | 2023-10-12 | A memory leak in tsMuxer version git-2539d07 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file. |
CVE-2023-45510 | High | 7.5 | 2023-10-12 | tsMuxer version git-2539d07 was discovered to contain an alloc-dealloc-mismatch (operator new [] vs operator delete) error. |
CVE-2023-5562 | Medium | 6.1 | 2023-10-12 | An unsafe default configuration in KNIME Analytics Platform before 5.2.0 allows for a cross-site scripting attack. When KNIME Analytics Platform is used as an… |
CVE-2023-23632 | High | 7.8 | 2023-10-12 | BeyondTrust Privileged Remote Access (PRA) versions 22.2.x to 22.4.x are vulnerable to a local authentication bypass. Attackers can exploit a flawed secret ver… |
CVE-2023-43148 | High | 8.1 | 2023-10-12 | SPA-Cart 1.9.0.3 has a Cross Site Request Forgery (CSRF) vulnerability that allows a remote attacker to delete all accounts. |
CVE-2023-27314 | High | 7.5 | 2023-10-12 | ONTAP 9 versions prior to 9.8P19, 9.9.1P16, 9.10.1P12, 9.11.1P8, 9.12.1P2 and 9.13.1 are susceptible to a vulnerability which could allow a remote unauthenti… |
CVE-2023-27313 | High | 8.3 | 2023-10-12 | SnapCenter versions 3.x and 4.x prior to 4.9 are susceptible to a vulnerability which may allow an authenticated unprivileged user to gain access as an admin… |