2023 CVEs (page 140)
Page 140 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-35966 | Critical | 9.8 | 2023-10-11 | Two heap-based buffer overflow vulnerabilities exist in the httpd manage_post functionality of Yifan YF325 v1.0_20221108. A specially crafted network request c… |
CVE-2023-35965 | Critical | 9.8 | 2023-10-11 | Two heap-based buffer overflow vulnerabilities exist in the httpd manage_post functionality of Yifan YF325 v1.0_20221108. A specially crafted network request c… |
CVE-2023-35194 | High | 7.2 | 2023-10-11 | An OS command injection vulnerability exists in the api.cgi cmd.mvpn.x509.write functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HT… |
CVE-2023-35193 | High | 7.2 | 2023-10-11 | An OS command injection vulnerability exists in the api.cgi cmd.mvpn.x509.write functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HT… |
CVE-2023-35056 | High | 8.8 | 2023-10-11 | A buffer overflow vulnerability exists in the httpd next_page functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to comma… |
CVE-2023-35055 | High | 8.8 | 2023-10-11 | A buffer overflow vulnerability exists in the httpd next_page functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to comma… |
CVE-2023-34426 | Critical | 9.8 | 2023-10-11 | A stack-based buffer overflow vulnerability exists in the httpd manage_request functionality of Yifan YF325 v1.0_20221108. A specially crafted network request… |
CVE-2023-34365 | Critical | 9.8 | 2023-10-11 | A stack-based buffer overflow vulnerability exists in the libutils.so nvram_restore functionality of Yifan YF325 v1.0_20221108. A specially crafted network req… |
CVE-2023-34356 | High | 7.2 | 2023-10-11 | An OS command injection vulnerability exists in the data.cgi xfer_dns functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request… |
CVE-2023-34354 | Low | 3.4 | 2023-10-11 | A stored cross-site scripting (XSS) vulnerability exists in the upload_brand.cgi functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted H… |
CVE-2023-34346 | Critical | 9.8 | 2023-10-11 | A stack-based buffer overflow vulnerability exists in the httpd gwcfg.cgi get functionality of Yifan YF325 v1.0_20221108. A specially crafted network packet ca… |
CVE-2023-32645 | Critical | 9.8 | 2023-10-11 | A leftover debug code vulnerability exists in the httpd debug credentials functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can l… |
CVE-2023-32632 | High | 8.8 | 2023-10-11 | A command execution vulnerability exists in the validate.so diag_ping_start functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can… |
CVE-2023-31272 | High | 8.8 | 2023-10-11 | A stack-based buffer overflow vulnerability exists in the httpd do_wds functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead… |
CVE-2023-28381 | High | 7.2 | 2023-10-11 | An OS command injection vulnerability exists in the admin.cgi MVPN_trial_init functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP… |
CVE-2023-27380 | High | 7.2 | 2023-10-11 | An OS command injection vulnerability exists in the admin.cgi USSD_send functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP reque… |
CVE-2023-24479 | Critical | 9.8 | 2023-10-11 | An authentication bypass vulnerability exists in the httpd nvram.cgi functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead t… |
CVE-2023-4957 | Medium | 5.4 | 2023-10-11 | A vulnerability of authentication bypass has been found on a Zebra Technologies ZTC ZT410-203dpi ZPL printer. This vulnerability allows an attacker that is in… |
CVE-2023-45396 | Medium | 6.5 | 2023-10-11 | An Insecure Direct Object Reference (IDOR) vulnerability leads to events profiles access in Elenos ETG150 FM transmitter running on version 3.12. |
CVE-2023-44119 | High | 7.5 | 2023-10-11 | Vulnerability of mutual exclusion management in the kernel module.Successful exploitation of this vulnerability will affect availability. |
CVE-2023-44118 | Critical | 9.1 | 2023-10-11 | Vulnerability of undefined permissions in the MeeTime module.Successful exploitation of this vulnerability will affect availability and confidentiality. |
CVE-2023-44116 | Critical | 9.8 | 2023-10-11 | Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this vulnerability may cause some apps to ru… |
CVE-2023-44114 | High | 7.5 | 2023-10-11 | Out-of-bounds array vulnerability in the dataipa module.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-44108 | High | 7.5 | 2023-10-11 | Type confusion vulnerability in the distributed file module.Successful exploitation of this vulnerability may cause the device to restart. |
CVE-2023-44107 | Critical | 9.1 | 2023-10-11 | Vulnerability of defects introduced in the design process in the screen projection module.Successful exploitation of this vulnerability may affect service ava… |
CVE-2023-44105 | Critical | 9.8 | 2023-10-11 | Vulnerability of permissions not being strictly verified in the window management module.Successful exploitation of this vulnerability may cause features to pe… |
CVE-2023-37538 | Critical | 9.3 | 2023-10-11 | HCL Digital Experience is susceptible to cross site scripting (XSS). One subcomponent is vulnerable to reflected XSS. In reflected XSS, an attacker must induce… |
CVE-2023-5521 | Critical | 9.8 | 2023-10-11 | Incorrect Authorization in GitHub repository tiann/kernelsu prior to v0.6.9. |
CVE-2023-5520 | High | 7.7 | 2023-10-11 | Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2. |
CVE-2023-44981 | Critical | 9.1 | 2023-10-11 | Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.ena… |
CVE-2023-44111 | High | 7.5 | 2023-10-11 | Vulnerability of brute-force attacks on the device authentication module.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-44110 | Medium | 4.3 | 2023-10-11 | Out-of-bounds access vulnerability in the audio module.Successful exploitation of this vulnerability may affect availability. |
CVE-2023-44106 | Critical | 9.8 | 2023-10-11 | API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may cause features to perform abnormally. |
CVE-2023-44104 | High | 7.5 | 2023-10-11 | Broadcast permission control vulnerability in the Bluetooth module.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-44103 | High | 7.5 | 2023-10-11 | Out-of-bounds read vulnerability in the Bluetooth module.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-44102 | Medium | 5.3 | 2023-10-11 | Broadcast permission control vulnerability in the Bluetooth module.Successful exploitation of this vulnerability can cause the Bluetooth function to be unavail… |
CVE-2023-44101 | High | 7.5 | 2023-10-11 | The Bluetooth module has a vulnerability in permission control for broadcast notifications.Successful exploitation of this vulnerability may affect confidentia… |
CVE-2023-44100 | High | 7.5 | 2023-10-11 | Broadcast permission control vulnerability in the Bluetooth module.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-44097 | High | 7.5 | 2023-10-11 | Vulnerability of the permission to access device SNs being improperly managed.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-44095 | High | 7.5 | 2023-10-11 | Use-After-Free (UAF) vulnerability in the surfaceflinger module.Successful exploitation of this vulnerability can cause system crash. |
CVE-2023-41304 | Medium | 5.3 | 2023-10-11 | Parameter verification vulnerability in the window module.Successful exploitation of this vulnerability may cause the size of an app window to be adjusted to t… |
CVE-2023-38217 | Medium | 5.5 | 2023-10-11 | Adobe Bridge versions 12.0.4 (and earlier) and 13.0.3 (and earlier) are affected by an Out-of-bounds Read vulnerability that could lead to disclosure of sensit… |
CVE-2023-38216 | Medium | 5.5 | 2023-10-11 | Adobe Bridge versions 12.0.4 (and earlier) and 13.0.3 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive m… |
CVE-2023-26370 | High | 7.8 | 2023-10-11 | Adobe Photoshop versions 23.5.5 (and earlier) and 24.7 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could result in arbi… |
CVE-2023-44109 | High | 7.5 | 2023-10-11 | Clone vulnerability in the huks ta module.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-44096 | High | 7.5 | 2023-10-11 | Vulnerability of brute-force attacks on the device authentication module.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-44094 | Medium | 5.3 | 2023-10-11 | Type confusion vulnerability in the distributed file module.Successful exploitation of this vulnerability may cause the device to restart. |
CVE-2023-44093 | High | 7.5 | 2023-10-11 | Vulnerability of package names' public keys not being verified in the security module.Successful exploitation of this vulnerability may affect service confiden… |
CVE-2023-42138 | High | 7.8 | 2023-10-11 | Out-of-bounds read vulnerability exists in KV STUDIO Ver. 11.62 and earlier and KV REPLAY VIEWER Ver. 2.62 and earlier. If this vulnerability is exploited, inf… |
CVE-2023-4990 | High | 8.3 | 2023-10-11 | Directory traversal vulnerability in MCL-Net versions prior to 4.6 Update Package (P01) may allow attackers to read arbitrary files. |
CVE-2023-44997 | Medium | 5.4 | 2023-10-11 | Cross-Site Request Forgery (CSRF) vulnerability in Nitin Rathod WP Forms Puzzle Captcha plugin <= 4.1 versions. |
CVE-2023-37536 | High | 8.2 | 2023-10-11 | An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request. |
CVE-2023-26320 | High | 7.5 | 2023-10-11 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Xiaomi Xiaomi Router allows Command Injection. |
CVE-2023-26319 | Medium | 6.7 | 2023-10-11 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Xiaomi Xiaomi Router allows Command Injection. |
CVE-2023-26318 | Medium | 6.7 | 2023-10-11 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Xiaomi Xiaomi Router allows Overflow Buffers. |
CVE-2023-5511 | High | 8.8 | 2023-10-11 | Cross-Site Request Forgery (CSRF) in GitHub repository snipe/snipe-it prior to v.6.2.3. |
CVE-2023-45194 | Medium | 4.3 | 2023-10-11 | Use of default credentials vulnerability in MR-GM2 firmware Ver. 3.00.03 and earlier, and MR-GM3 (-D/-K/-S/-DK/-DKS/-M/-W) firmware Ver. 1.03.45 and earlier al… |
CVE-2023-44689 | Medium | 4.3 | 2023-10-11 | e-Gov Client Application (Windows version) versions prior to 2.1.1.0 and e-Gov Client Application (macOS version) versions prior to 1.1.1.0 are vulnerable to i… |
CVE-2023-26220 | Medium | 5.4 | 2023-10-10 | The Spotfire Library component of TIBCO Software Inc.'s Spotfire Analyst and Spotfire Server contains an easily exploitable vulnerability that allows a low pri… |
CVE-2023-36127 | High | 7.5 | 2023-10-10 | User enumeration is found in in PHPJabbers Appointment Scheduler 3.0. This issue occurs during password recovery, where a difference in messages could allow an… |
CVE-2023-36126 | Medium | 6.1 | 2023-10-10 | There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Appointment Scheduler v3.0 |
CVE-2023-45312 | High | 8.8 | 2023-10-10 | In the mtproto_proxy (aka MTProto proxy) component through 0.7.2 for Erlang, a low-privileged remote attacker can access an improperly secured default installa… |
CVE-2023-45648 | Medium | 5.3 | 2023-10-10 | Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81… |
CVE-2023-31096 | High | 7.8 | 2023-10-10 | An issue was discovered in Broadcom) LSI PCI-SV92EX Soft Modem Kernel Driver through 2.2.100.1 (aka AGRSM64.sys). There is Local Privilege Escalation to SYSTEM… |
CVE-2023-5497 | Medium | 6.3 | 2023-10-10 | A vulnerability classified as critical has been found in Tongda OA 2017 11.10. Affected is an unknown function of the file general/hr/salary/welfare_manage/del… |
CVE-2023-4309 | Critical | 10.0 | 2023-10-10 | Election Services Co. (ESC) Internet Election Service is vulnerable to SQL injection in multiple pages and parameters. These vulnerabilities allow an unauthent… |
CVE-2023-45129 | Medium | 4.9 | 2023-10-10 | Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Prior to version 1.94.0, a malicious server ACL event can impa… |
CVE-2023-42795 | Medium | 5.3 | 2023-10-10 | Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 th… |
CVE-2023-42794 | Medium | 5.9 | 2023-10-10 | Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 throug… |
CVE-2023-41774 | High | 8.1 | 2023-10-10 | Layer 2 Tunneling Protocol Remote Code Execution Vulnerability |
CVE-2023-41773 | High | 8.1 | 2023-10-10 | Layer 2 Tunneling Protocol Remote Code Execution Vulnerability |
CVE-2023-41772 | High | 7.8 | 2023-10-10 | Win32k Elevation of Privilege Vulnerability |
CVE-2023-41771 | High | 8.1 | 2023-10-10 | Layer 2 Tunneling Protocol Remote Code Execution Vulnerability |
CVE-2023-41770 | High | 8.1 | 2023-10-10 | Layer 2 Tunneling Protocol Remote Code Execution Vulnerability |
CVE-2023-41769 | High | 8.1 | 2023-10-10 | Layer 2 Tunneling Protocol Remote Code Execution Vulnerability |
CVE-2023-41768 | High | 8.1 | 2023-10-10 | Layer 2 Tunneling Protocol Remote Code Execution Vulnerability |
CVE-2023-41767 | High | 8.1 | 2023-10-10 | Layer 2 Tunneling Protocol Remote Code Execution Vulnerability |
CVE-2023-41766 | High | 7.8 | 2023-10-10 | Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability |
CVE-2023-41765 | High | 8.1 | 2023-10-10 | Layer 2 Tunneling Protocol Remote Code Execution Vulnerability |
CVE-2023-41763 | Medium | 5.3 | 2023-10-10 | Skype for Business Elevation of Privilege Vulnerability |
CVE-2023-38171 | High | 7.5 | 2023-10-10 | Microsoft QUIC Denial of Service Vulnerability |
CVE-2023-38166 | High | 8.1 | 2023-10-10 | Layer 2 Tunneling Protocol Remote Code Execution Vulnerability |
CVE-2023-38159 | High | 7.0 | 2023-10-10 | Windows Graphics Component Elevation of Privilege Vulnerability |
CVE-2023-36902 | High | 7.0 | 2023-10-10 | Windows Runtime Remote Code Execution Vulnerability |
CVE-2023-36790 | High | 7.8 | 2023-10-10 | Windows RDP Encoder Mirror Driver Elevation of Privilege Vulnerability |
CVE-2023-36789 | High | 7.2 | 2023-10-10 | Skype for Business Remote Code Execution Vulnerability |
CVE-2023-36786 | High | 7.2 | 2023-10-10 | Skype for Business Remote Code Execution Vulnerability |
CVE-2023-36785 | High | 7.8 | 2023-10-10 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability |
CVE-2023-36780 | High | 7.2 | 2023-10-10 | Skype for Business Remote Code Execution Vulnerability |
CVE-2023-36778 | High | 8.0 | 2023-10-10 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2023-36776 | High | 7.0 | 2023-10-10 | Win32k Elevation of Privilege Vulnerability |
CVE-2023-36743 | High | 7.8 | 2023-10-10 | Win32k Elevation of Privilege Vulnerability |
CVE-2023-36737 | High | 7.8 | 2023-10-10 | Azure Network Watcher VM Agent Elevation of Privilege Vulnerability |
CVE-2023-36732 | High | 7.8 | 2023-10-10 | Win32k Elevation of Privilege Vulnerability |
CVE-2023-36731 | High | 7.8 | 2023-10-10 | Win32k Elevation of Privilege Vulnerability |
CVE-2023-36730 | High | 7.8 | 2023-10-10 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability |
CVE-2023-36729 | High | 7.8 | 2023-10-10 | Named Pipe File System Elevation of Privilege Vulnerability |
CVE-2023-36728 | Medium | 5.5 | 2023-10-10 | Microsoft SQL Server Denial of Service Vulnerability |
CVE-2023-36726 | High | 7.8 | 2023-10-10 | Windows Internet Key Exchange (IKE) Extension Elevation of Privilege Vulnerability |
CVE-2023-36725 | High | 7.8 | 2023-10-10 | Windows Kernel Elevation of Privilege Vulnerability |