2023 CVEs (page 139)
Page 139 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-5485 | Medium | 4.3 | 2023-10-11 | Inappropriate implementation in Autofill in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to bypass autofill restrictions via a crafted HTML p… |
CVE-2023-5484 | Medium | 6.5 | 2023-10-11 | Inappropriate implementation in Navigation in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chr… |
CVE-2023-5483 | Medium | 6.5 | 2023-10-11 | Inappropriate implementation in Intents in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to bypass content security policy via a crafted HTML… |
CVE-2023-5481 | Medium | 6.5 | 2023-10-11 | Inappropriate implementation in Downloads in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chro… |
CVE-2023-5479 | Medium | 6.5 | 2023-10-11 | Inappropriate implementation in Extensions API in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extensio… |
CVE-2023-5478 | Medium | 4.3 | 2023-10-11 | Inappropriate implementation in Autofill in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (… |
CVE-2023-5477 | Medium | 4.3 | 2023-10-11 | Inappropriate implementation in Installer in Google Chrome prior to 118.0.5993.70 allowed a local attacker to bypass discretionary access control via a crafted… |
CVE-2023-5476 | High | 8.8 | 2023-10-11 | Use after free in Blink History in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pag… |
CVE-2023-5475 | Medium | 6.5 | 2023-10-11 | Inappropriate implementation in DevTools in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extension to b… |
CVE-2023-5474 | High | 8.8 | 2023-10-11 | Heap buffer overflow in PDF in Google Chrome prior to 118.0.5993.70 allowed a remote attacker who convinced a user to engage in specific user interactions to p… |
CVE-2023-5473 | Medium | 6.3 | 2023-10-11 | Use after free in Cast in Google Chrome prior to 118.0.5993.70 allowed a remote attacker who had compromised the renderer process to potentially exploit heap c… |
CVE-2023-5218 | High | 8.8 | 2023-10-11 | Use after free in Site Isolation in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2023-44190 | Medium | 6.1 | 2023-10-11 | An Origin Validation vulnerability in MAC address validation of Juniper Networks Junos OS Evolved on PTX10001, PTX10004, PTX10008, and PTX10016 devices allows… |
CVE-2023-44189 | Medium | 6.1 | 2023-10-11 | An Origin Validation vulnerability in MAC address validation of Juniper Networks Junos OS Evolved on PTX10003 Series allows a network-adjacent attacker to byp… |
CVE-2023-39325 | High | 7.5 | 2023-10-11 | A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of… |
CVE-2023-45132 | Critical | 9.1 | 2023-10-11 | NAXSI is an open-source maintenance web application firewall (WAF) for NGINX. An issue present starting in version 1.3 and prior to version 1.6 allows someone… |
CVE-2023-44188 | Medium | 5.3 | 2023-10-11 | A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in telemetry processing of Juniper Networks Junos OS allows a network-based authenticated at… |
CVE-2023-44187 | Medium | 5.9 | 2023-10-11 | An Exposure of Sensitive Information vulnerability in the 'file copy' command of Junos OS Evolved allows a local, authenticated attacker with shell access to v… |
CVE-2023-44186 | High | 7.5 | 2023-10-11 | An Improper Handling of Exceptional Conditions vulnerability in AS PATH processing of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to sen… |
CVE-2023-3781 | High | 7.8 | 2023-10-11 | there is a possible use-after-free write due to improper locking. This could lead to local escalation of privilege with no additional execution privileges need… |
CVE-2023-5535 | High | 7.8 | 2023-10-11 | Use After Free in GitHub repository vim/vim prior to v9.0.2010. |
CVE-2023-43661 | High | 8.8 | 2023-10-11 | Cachet, the open-source status page system. Prior to the 2.4 branch, a template functionality which allows users to create templates allows them to execute any… |
CVE-2023-41882 | Medium | 5.4 | 2023-10-11 | vantage6 is privacy preserving federated learning infrastructure. The endpoint /api/collaboration/{id}/task is used to collect all tasks from a certain collabo… |
CVE-2023-41881 | Low | 3.7 | 2023-10-11 | vantage6 is privacy preserving federated learning infrastructure. When a collaboration is deleted, the linked resources (such as tasks from that collaboration)… |
CVE-2023-40142 | High | 7.8 | 2023-10-11 | In TBD of TBD, there is a possible way to bypass carrier restrictions due to a logic error in the code. This could lead to local escalation of privilege with n… |
CVE-2023-40141 | High | 7.8 | 2023-10-11 | In temp_residency_name_store of thermal_metrics.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation o… |
CVE-2023-35662 | Critical | 9.8 | 2023-10-11 | there is a possible out of bounds write due to buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User i… |
CVE-2023-35661 | High | 7.5 | 2023-10-11 | In ProfSixDecomTcpSACKoption of RohcPacketCommon.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote informati… |
CVE-2023-35660 | Medium | 6.7 | 2023-10-11 | In lwis_transaction_client_cleanup of lwis_transaction.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalatio… |
CVE-2023-35655 | Medium | 6.7 | 2023-10-11 | In CanConvertPadV2Op of darwinn_mlir_converter_aidl.cc, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local escalati… |
CVE-2023-35654 | Medium | 6.7 | 2023-10-11 | In ctrl_roi of stmvl53l1_module.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local escalation of privilege wi… |
CVE-2023-35653 | Medium | 4.4 | 2023-10-11 | In TBD of TBD, there is a possible way to access location information due to a permissions bypass. This could lead to local information disclosure with System… |
CVE-2023-35652 | High | 7.5 | 2023-10-11 | In ProtocolEmergencyCallListIndAdapter::Init of protocolcalladapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead… |
CVE-2023-35649 | High | 7.2 | 2023-10-11 | In several functions of Exynos modem files, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution wit… |
CVE-2023-35648 | Critical | 9.8 | 2023-10-11 | In ProtocolMiscLceIndAdapter::GetConfLevel() of protocolmiscadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead… |
CVE-2023-35647 | Critical | 9.8 | 2023-10-11 | In ProtocolEmbmsGlobalCellIdAdapter::Init() of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead… |
CVE-2023-35646 | Critical | 9.8 | 2023-10-11 | In TBD of TBD, there is a possible stack buffer overflow due to a missing bounds check. This could lead to remote code execution with no additional execution p… |
CVE-2023-28635 | Medium | 5.4 | 2023-10-11 | vantage6 is privacy preserving federated learning infrastructure. Prior to version 4.0.0, malicious users may try to get access to resources they are not allow… |
CVE-2023-44962 | Medium | 5.3 | 2023-10-11 | File Upload vulnerability in Koha Library Software 23.05.04 and before allows a remote attacker to read arbitrary files via the upload-cover-image.pl component. |
CVE-2023-44961 | High | 7.5 | 2023-10-11 | SQL Injection vulnerability in Koha Library Software 23.0.5.04 and before allows a remote attacker to obtain sensitive information via the intranet/cgi bin/cat… |
CVE-2023-38817 | High | 7.8 | 2023-10-11 | An issue in Inspect Element Ltd Echo.ac v.5.2.1.0 allows a local attacker to gain privileges via a crafted command to the echo_driver.sys component. NOTE: the… |
CVE-2023-35645 | Medium | 6.4 | 2023-10-11 | In tbd of tbd, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges… |
CVE-2023-43960 | High | 8.8 | 2023-10-11 | An issue in DLINK DPH-400SE FRU 2.2.15.8 allows a remote attacker to escalate privileges via the User Modify function in the Maintenance/Access function compon… |
CVE-2023-23930 | Medium | 5.5 | 2023-10-11 | vantage6 is privacy preserving federated learning infrastructure. Versions prior to 4.0.0 use pickle, which has known security issue, as a default serializatio… |
CVE-2023-4936 | Medium | 5.5 | 2023-10-11 | It is possible to sideload a compromised DLL during the installation at elevated privilege. |
CVE-2023-35968 | Critical | 9.8 | 2023-10-11 | Two heap-based buffer overflow vulnerabilities exist in the gwcfg_cgi_set_manage_post_data functionality of Yifan YF325 v1.0_20221108. A specially crafted netw… |
CVE-2023-35967 | Critical | 9.8 | 2023-10-11 | Two heap-based buffer overflow vulnerabilities exist in the gwcfg_cgi_set_manage_post_data functionality of Yifan YF325 v1.0_20221108. A specially crafted netw… |
CVE-2023-35966 | Critical | 9.8 | 2023-10-11 | Two heap-based buffer overflow vulnerabilities exist in the httpd manage_post functionality of Yifan YF325 v1.0_20221108. A specially crafted network request c… |
CVE-2023-35965 | Critical | 9.8 | 2023-10-11 | Two heap-based buffer overflow vulnerabilities exist in the httpd manage_post functionality of Yifan YF325 v1.0_20221108. A specially crafted network request c… |
CVE-2023-35194 | High | 7.2 | 2023-10-11 | An OS command injection vulnerability exists in the api.cgi cmd.mvpn.x509.write functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HT… |
CVE-2023-35193 | High | 7.2 | 2023-10-11 | An OS command injection vulnerability exists in the api.cgi cmd.mvpn.x509.write functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HT… |
CVE-2023-35056 | High | 8.8 | 2023-10-11 | A buffer overflow vulnerability exists in the httpd next_page functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to comma… |
CVE-2023-35055 | High | 8.8 | 2023-10-11 | A buffer overflow vulnerability exists in the httpd next_page functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to comma… |
CVE-2023-34426 | Critical | 9.8 | 2023-10-11 | A stack-based buffer overflow vulnerability exists in the httpd manage_request functionality of Yifan YF325 v1.0_20221108. A specially crafted network request… |
CVE-2023-34365 | Critical | 9.8 | 2023-10-11 | A stack-based buffer overflow vulnerability exists in the libutils.so nvram_restore functionality of Yifan YF325 v1.0_20221108. A specially crafted network req… |
CVE-2023-34356 | High | 7.2 | 2023-10-11 | An OS command injection vulnerability exists in the data.cgi xfer_dns functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request… |
CVE-2023-34354 | Low | 3.4 | 2023-10-11 | A stored cross-site scripting (XSS) vulnerability exists in the upload_brand.cgi functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted H… |
CVE-2023-34346 | Critical | 9.8 | 2023-10-11 | A stack-based buffer overflow vulnerability exists in the httpd gwcfg.cgi get functionality of Yifan YF325 v1.0_20221108. A specially crafted network packet ca… |
CVE-2023-32645 | Critical | 9.8 | 2023-10-11 | A leftover debug code vulnerability exists in the httpd debug credentials functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can l… |
CVE-2023-32632 | High | 8.8 | 2023-10-11 | A command execution vulnerability exists in the validate.so diag_ping_start functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can… |
CVE-2023-31272 | High | 8.8 | 2023-10-11 | A stack-based buffer overflow vulnerability exists in the httpd do_wds functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead… |
CVE-2023-28381 | High | 7.2 | 2023-10-11 | An OS command injection vulnerability exists in the admin.cgi MVPN_trial_init functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP… |
CVE-2023-27380 | High | 7.2 | 2023-10-11 | An OS command injection vulnerability exists in the admin.cgi USSD_send functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP reque… |
CVE-2023-24479 | Critical | 9.8 | 2023-10-11 | An authentication bypass vulnerability exists in the httpd nvram.cgi functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead t… |
CVE-2023-4957 | Medium | 5.4 | 2023-10-11 | A vulnerability of authentication bypass has been found on a Zebra Technologies ZTC ZT410-203dpi ZPL printer. This vulnerability allows an attacker that is in… |
CVE-2023-45396 | Medium | 6.5 | 2023-10-11 | An Insecure Direct Object Reference (IDOR) vulnerability leads to events profiles access in Elenos ETG150 FM transmitter running on version 3.12. |
CVE-2023-44119 | High | 7.5 | 2023-10-11 | Vulnerability of mutual exclusion management in the kernel module.Successful exploitation of this vulnerability will affect availability. |
CVE-2023-44118 | Critical | 9.1 | 2023-10-11 | Vulnerability of undefined permissions in the MeeTime module.Successful exploitation of this vulnerability will affect availability and confidentiality. |
CVE-2023-44116 | Critical | 9.8 | 2023-10-11 | Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this vulnerability may cause some apps to ru… |
CVE-2023-44114 | High | 7.5 | 2023-10-11 | Out-of-bounds array vulnerability in the dataipa module.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-44108 | High | 7.5 | 2023-10-11 | Type confusion vulnerability in the distributed file module.Successful exploitation of this vulnerability may cause the device to restart. |
CVE-2023-44107 | Critical | 9.1 | 2023-10-11 | Vulnerability of defects introduced in the design process in the screen projection module.Successful exploitation of this vulnerability may affect service ava… |
CVE-2023-44105 | Critical | 9.8 | 2023-10-11 | Vulnerability of permissions not being strictly verified in the window management module.Successful exploitation of this vulnerability may cause features to pe… |
CVE-2023-37538 | Critical | 9.3 | 2023-10-11 | HCL Digital Experience is susceptible to cross site scripting (XSS). One subcomponent is vulnerable to reflected XSS. In reflected XSS, an attacker must induce… |
CVE-2023-5521 | Critical | 9.8 | 2023-10-11 | Incorrect Authorization in GitHub repository tiann/kernelsu prior to v0.6.9. |
CVE-2023-5520 | High | 7.7 | 2023-10-11 | Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2. |
CVE-2023-44981 | Critical | 9.1 | 2023-10-11 | Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.ena… |
CVE-2023-44111 | High | 7.5 | 2023-10-11 | Vulnerability of brute-force attacks on the device authentication module.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-44110 | Medium | 4.3 | 2023-10-11 | Out-of-bounds access vulnerability in the audio module.Successful exploitation of this vulnerability may affect availability. |
CVE-2023-44106 | Critical | 9.8 | 2023-10-11 | API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may cause features to perform abnormally. |
CVE-2023-44104 | High | 7.5 | 2023-10-11 | Broadcast permission control vulnerability in the Bluetooth module.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-44103 | High | 7.5 | 2023-10-11 | Out-of-bounds read vulnerability in the Bluetooth module.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-44102 | Medium | 5.3 | 2023-10-11 | Broadcast permission control vulnerability in the Bluetooth module.Successful exploitation of this vulnerability can cause the Bluetooth function to be unavail… |
CVE-2023-44101 | High | 7.5 | 2023-10-11 | The Bluetooth module has a vulnerability in permission control for broadcast notifications.Successful exploitation of this vulnerability may affect confidentia… |
CVE-2023-44100 | High | 7.5 | 2023-10-11 | Broadcast permission control vulnerability in the Bluetooth module.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-44097 | High | 7.5 | 2023-10-11 | Vulnerability of the permission to access device SNs being improperly managed.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-44095 | High | 7.5 | 2023-10-11 | Use-After-Free (UAF) vulnerability in the surfaceflinger module.Successful exploitation of this vulnerability can cause system crash. |
CVE-2023-41304 | Medium | 5.3 | 2023-10-11 | Parameter verification vulnerability in the window module.Successful exploitation of this vulnerability may cause the size of an app window to be adjusted to t… |
CVE-2023-38217 | Medium | 5.5 | 2023-10-11 | Adobe Bridge versions 12.0.4 (and earlier) and 13.0.3 (and earlier) are affected by an Out-of-bounds Read vulnerability that could lead to disclosure of sensit… |
CVE-2023-38216 | Medium | 5.5 | 2023-10-11 | Adobe Bridge versions 12.0.4 (and earlier) and 13.0.3 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive m… |
CVE-2023-26370 | High | 7.8 | 2023-10-11 | Adobe Photoshop versions 23.5.5 (and earlier) and 24.7 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could result in arbi… |
CVE-2023-44109 | High | 7.5 | 2023-10-11 | Clone vulnerability in the huks ta module.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-44096 | High | 7.5 | 2023-10-11 | Vulnerability of brute-force attacks on the device authentication module.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-44094 | Medium | 5.3 | 2023-10-11 | Type confusion vulnerability in the distributed file module.Successful exploitation of this vulnerability may cause the device to restart. |
CVE-2023-44093 | High | 7.5 | 2023-10-11 | Vulnerability of package names' public keys not being verified in the security module.Successful exploitation of this vulnerability may affect service confiden… |
CVE-2023-42138 | High | 7.8 | 2023-10-11 | Out-of-bounds read vulnerability exists in KV STUDIO Ver. 11.62 and earlier and KV REPLAY VIEWER Ver. 2.62 and earlier. If this vulnerability is exploited, inf… |
CVE-2023-4990 | High | 8.3 | 2023-10-11 | Directory traversal vulnerability in MCL-Net versions prior to 4.6 Update Package (P01) may allow attackers to read arbitrary files. |
CVE-2023-44997 | Medium | 5.4 | 2023-10-11 | Cross-Site Request Forgery (CSRF) vulnerability in Nitin Rathod WP Forms Puzzle Captcha plugin <= 4.1 versions. |
CVE-2023-37536 | High | 8.2 | 2023-10-11 | An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request. |
CVE-2023-26320 | High | 7.5 | 2023-10-11 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Xiaomi Xiaomi Router allows Command Injection. |