2023 CVEs (page 141)
Page 141 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-36563 | Medium | 6.5 | 2023-10-10 | Microsoft WordPad Information Disclosure Vulnerability |
CVE-2023-36561 | High | 7.3 | 2023-10-10 | Azure DevOps Server Elevation of Privilege Vulnerability |
CVE-2023-36557 | High | 7.8 | 2023-10-10 | PrintHTML API Remote Code Execution Vulnerability |
CVE-2023-36438 | High | 7.5 | 2023-10-10 | Windows TCP/IP Information Disclosure Vulnerability |
CVE-2023-36436 | High | 7.8 | 2023-10-10 | Windows MSHTML Platform Remote Code Execution Vulnerability |
CVE-2023-36435 | High | 7.5 | 2023-10-10 | Microsoft QUIC Denial of Service Vulnerability |
CVE-2023-36434 | Critical | 9.8 | 2023-10-10 | Windows IIS Server Elevation of Privilege Vulnerability |
CVE-2023-36433 | Medium | 6.5 | 2023-10-10 | Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability |
CVE-2023-36431 | High | 7.5 | 2023-10-10 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
CVE-2023-36429 | Medium | 6.5 | 2023-10-10 | Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability |
CVE-2023-36420 | High | 7.8 | 2023-10-10 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability |
CVE-2023-36419 | High | 8.8 | 2023-10-10 | Azure HDInsight Apache Oozie Workflow Scheduler XXE Elevation of Privilege Vulnerability |
CVE-2023-36418 | High | 7.8 | 2023-10-10 | Azure RTOS GUIX Studio Remote Code Execution Vulnerability |
CVE-2023-36417 | High | 7.8 | 2023-10-10 | Microsoft SQL OLE DB Remote Code Execution Vulnerability |
CVE-2023-36416 | Medium | 6.1 | 2023-10-10 | Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability |
CVE-2023-36415 | High | 8.8 | 2023-10-10 | Azure Identity SDK Remote Code Execution Vulnerability |
CVE-2023-36414 | High | 8.8 | 2023-10-10 | Azure Identity SDK Remote Code Execution Vulnerability |
CVE-2023-35349 | Critical | 9.8 | 2023-10-10 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability |
CVE-2023-29348 | High | 7.5 | 2023-10-10 | Windows Remote Desktop Gateway (RD Gateway) Information Disclosure Vulnerability |
CVE-2023-5496 | Low | 3.1 | 2023-10-10 | A vulnerability was found in Translator PoqDev Add-On 1.0.11 on Firefox. It has been rated as problematic. This issue affects some unknown processing of the co… |
CVE-2023-5495 | Medium | 6.3 | 2023-10-10 | A vulnerability was found in QDocs Smart School 6.4.1. It has been classified as critical. This affects an unknown part of the file /course/filterRecords/ of t… |
CVE-2023-44399 | Medium | 5.3 | 2023-10-10 | ZITADEL provides identity infrastructure. In versions 2.37.2 and prior, ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which h… |
CVE-2023-44249 | Medium | 4.3 | 2023-10-10 | An authorization bypass through user-controlled key [CWE-639] vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7… |
CVE-2023-42788 | High | 7.8 | 2023-10-10 | An improper neutralization of special elements used in an os command ('OS Command Injection') vulnerability [CWE-78] in FortiManager & FortiAnalyzer version 7… |
CVE-2023-42787 | Medium | 6.5 | 2023-10-10 | A client-side enforcement of server-side security [CWE-602] vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4… |
CVE-2023-42782 | Medium | 5.3 | 2023-10-10 | A insufficient verification of data authenticity vulnerability [CWE-345] in FortiAnalyzer version 7.4.0 and below 7.2.3 allows a remote unauthenticated attacke… |
CVE-2023-41841 | High | 8.1 | 2023-10-10 | An improper authorization vulnerability in Fortinet FortiOS 7.0.0 - 7.0.11 and 7.2.0 - 7.2.4 allows an attacker belonging to the prof-admin profile to perform… |
CVE-2023-41838 | High | 7.1 | 2023-10-10 | An improper neutralization of special elements used in an os command ('os command injection') in FortiManager 7.4.0 and 7.2.0 through 7.2.3 may allow attacker… |
CVE-2023-41679 | High | 8.5 | 2023-10-10 | An improper access control vulnerability [CWE-284] in FortiManager management interface 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all… |
CVE-2023-41675 | Medium | 5.3 | 2023-10-10 | A use after free vulnerability [CWE-416] in FortiOS version 7.2.0 through 7.2.4 and version 7.0.0 through 7.0.10 and FortiProxy version 7.2.0 through 7.2.2 and… |
CVE-2023-40718 | High | 7.5 | 2023-10-10 | A interpretation conflict in Fortinet IPS Engine versions 7.321, 7.166 and 6.158 allows attacker to evade IPS features via crafted TCP packets. |
CVE-2023-37939 | Low | 3.3 | 2023-10-10 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClient for Windows 7.2.0, 7.0 all versions, 6.4 all versions, 6.2… |
CVE-2023-37935 | Medium | 6.5 | 2023-10-10 | A use of GET request method with sensitive query strings vulnerability in Fortinet FortiOS 7.0.0 - 7.0.12, 7.2.0 - 7.2.5 and 7.4.0 allows an attacker to view p… |
CVE-2023-36637 | Low | 3.5 | 2023-10-10 | An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiMail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authe… |
CVE-2023-36556 | High | 8.8 | 2023-10-10 | An incorrect authorization vulnerability [CWE-863] in FortiMail webmail version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.5 and below 6.4.7 allows an auth… |
CVE-2023-36555 | Low | 3.9 | 2023-10-10 | An improper neutralization of script-related html tags in a web page (basic xss) in Fortinet FortiOS 7.2.0 - 7.2.4 allows an attacker to execute unauthorized c… |
CVE-2023-36550 | Critical | 9.8 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through… |
CVE-2023-36549 | High | 8.8 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through… |
CVE-2023-36548 | Critical | 9.8 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through… |
CVE-2023-36547 | Critical | 9.8 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through… |
CVE-2023-36478 | High | 7.5 | 2023-10-10 | Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer ove… |
CVE-2023-34993 | Critical | 9.8 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through… |
CVE-2023-34992 | Critical | 10.0 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized… |
CVE-2023-34989 | High | 8.8 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through… |
CVE-2023-34988 | High | 8.8 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through… |
CVE-2023-34987 | High | 8.8 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through… |
CVE-2023-34986 | High | 8.8 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through… |
CVE-2023-34985 | High | 8.8 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through… |
CVE-2023-33301 | Medium | 6.5 | 2023-10-10 | An improper access control vulnerability in Fortinet FortiOS 7.2.0 - 7.2.4 and 7.4.0 allows an attacker to access a restricted resource from a non trusted host. |
CVE-2023-25607 | High | 7.8 | 2023-10-10 | An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78 ] in FortiManager 7.2.0 through 7.2.2, 7.0… |
CVE-2023-25604 | Medium | 5.5 | 2023-10-10 | An insertion of sensitive information into log file vulnerability in Fortinet FortiGuest 1.0.0 allows a local attacker to access plaintext passwords in the RAD… |
CVE-2023-5494 | Medium | 6.3 | 2023-10-10 | A vulnerability was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928 and classified as critical. Affected… |
CVE-2023-5493 | Medium | 6.3 | 2023-10-10 | A vulnerability has been found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928 and classified as critical. Aff… |
CVE-2023-5492 | Medium | 6.3 | 2023-10-10 | A vulnerability, which was classified as critical, was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928… |
CVE-2023-44996 | Medium | 5.4 | 2023-10-10 | Cross-Site Request Forgery (CSRF) vulnerability in Naresh Parmar Post View Count plugin <= 1.8.2 versions. |
CVE-2023-44995 | Medium | 5.4 | 2023-10-10 | Cross-Site Request Forgery (CSRF) vulnerability in WP Doctor WooCommerce Login Redirect plugin <= 2.2.4 versions. |
CVE-2023-43896 | High | 7.8 | 2023-10-10 | A buffer overflow in Macrium Reflect 8.1.7544 and below allows attackers to escalate privileges or execute arbitrary code. |
CVE-2023-5491 | Medium | 6.3 | 2023-10-10 | A vulnerability, which was classified as critical, has been found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230… |
CVE-2023-5490 | Medium | 6.3 | 2023-10-10 | A vulnerability classified as critical was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928. This vulnera… |
CVE-2023-5489 | Medium | 6.3 | 2023-10-10 | A vulnerability classified as critical has been found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928. This af… |
CVE-2023-44994 | Medium | 4.3 | 2023-10-10 | Cross-Site Request Forgery (CSRF) vulnerability in Bainternet ShortCodes UI plugin <= 1.9.8 versions. |
CVE-2023-44476 | Medium | 4.3 | 2023-10-10 | Cross-Site Request Forgery (CSRF) vulnerability in Andres Felipe Perea V. CopyRightPro plugin <= 2.1 versions. |
CVE-2023-44475 | Medium | 5.4 | 2023-10-10 | Cross-Site Request Forgery (CSRF) vulnerability in Michael Simpson Add Shortcodes Actions And Filters plugin <= 2.0.9 versions. |
CVE-2023-44471 | Medium | 4.3 | 2023-10-10 | Cross-Site Request Forgery (CSRF) vulnerability in Bernhard Kau Backend Localization plugin <= 2.1.10 versions. |
CVE-2023-30806 | Critical | 9.8 | 2023-10-10 | The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability. A remote and unauthenticated… |
CVE-2023-30805 | Critical | 9.8 | 2023-10-10 | The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability. A remote and unauthenticated… |
CVE-2023-30804 | Medium | 4.9 | 2023-10-10 | The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authenticated file disclosure vulnerability. A remote and authenticated attack… |
CVE-2023-30803 | Critical | 9.8 | 2023-10-10 | The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can… |
CVE-2023-30802 | Medium | 5.3 | 2023-10-10 | The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to a source code disclosure vulnerability. A remote and unauthenticated attacker can… |
CVE-2023-5499 | High | 7.5 | 2023-10-10 | Information exposure vulnerability in Shenzhen Reachfar v28, the exploitation of which could allow a remote attacker to retrieve all the week's logs stored in… |
CVE-2023-5488 | Medium | 6.3 | 2023-10-10 | A vulnerability was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928. It has been rated as critical. Affe… |
CVE-2023-4966 | Critical | 9.4 | 2023-10-10 | Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA v… |
CVE-2023-44487 | High | 7.5 | 2023-10-10 | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the w… |
CVE-2023-44470 | Medium | 5.4 | 2023-10-10 | Cross-Site Request Forgery (CSRF) vulnerability in Kvvaradha Kv TinyMCE Editor Add Fonts plugin <= 1.1 versions. |
CVE-2023-44241 | Medium | 4.3 | 2023-10-10 | Cross-Site Request Forgery (CSRF) vulnerability in Keap Keap Landing Pages plugin <= 1.4.2 versions. |
CVE-2023-30801 | Critical | 9.8 | 2023-10-10 | All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change… |
CVE-2023-5450 | High | 7.3 | 2023-10-10 | An insufficient verification of data vulnerability exists in BIG-IP Edge Client Installer on macOS that may allow an attacker elevation of privileges during t… |
CVE-2023-45226 | High | 7.4 | 2023-10-10 | The BIG-IP SPK TMM (Traffic Management Module) f5-debug-sidecar and f5-debug-sshd containers contains hardcoded credentials that may allow an attacker with th… |
CVE-2023-45219 | Medium | 4.4 | 2023-10-10 | Exposure of Sensitive Information vulnerability exist in an undisclosed BIG-IP TMOS shell (tmsh) command which may allow an authenticated attacker with resour… |
CVE-2023-43788 | Medium | 5.5 | 2023-10-10 | A vulnerability was found in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer() function. This flaw allows a local attacker to trigger… |
CVE-2023-43787 | High | 7.8 | 2023-10-10 | A vulnerability was found in libX11 due to an integer overflow within the XCreateImage() function. This flaw allows a local user to trigger an integer overflow… |
CVE-2023-43786 | Medium | 5.5 | 2023-10-10 | A vulnerability was found in libX11 due to an infinite loop within the PutSubImage() function. This flaw allows a local user to consume all available system re… |
CVE-2023-43785 | Medium | 6.5 | 2023-10-10 | A vulnerability was found in libX11 due to a boundary condition within the _XkbReadKeySyms() function. This flaw allows a local user to trigger an out-of-bound… |
CVE-2023-43746 | High | 8.7 | 2023-10-10 | When running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing BIG-IP exte… |
CVE-2023-43611 | High | 7.8 | 2023-10-10 | The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. This vulnerability is due… |
CVE-2023-43485 | Medium | 5.5 | 2023-10-10 | When TACACS+ audit forwarding is configured on BIG-IP or BIG-IQ system, sharedsecret is logged in plaintext in the audit log. Note: Software versions which h… |
CVE-2023-42768 | High | 7.2 | 2023-10-10 | When a non-admin user has been assigned an administrator role via an iControl REST PUT request and later the user's role is reverted back to a non-admin role… |
CVE-2023-41964 | Medium | 4.3 | 2023-10-10 | The BIG-IP and BIG-IQ systems do not encrypt some sensitive information written to Database (DB) variables. Note: Software versions which have reached End o… |
CVE-2023-41373 | Critical | 9.9 | 2023-10-10 | A directory traversal vulnerability exists in the BIG-IP Configuration Utility that may allow an authenticated attacker to execute commands on the BIG-IP syst… |
CVE-2023-41253 | Medium | 5.5 | 2023-10-10 | When on BIG-IP DNS or BIG-IP LTM enabled with DNS Services License, and a TSIG key is created, it is logged in plaintext in the audit log. Note: Software ver… |
CVE-2023-41085 | High | 7.5 | 2023-10-10 | When IPSec is configured on a Virtual Server, undisclosed traffic can cause TMM to terminate. Note: Software versions which have reached End of Technical Su… |
CVE-2023-40542 | High | 7.5 | 2023-10-10 | When TCP Verified Accept is enabled on a TCP profile that is configured on a Virtual Server, undisclosed requests can cause an increase in memory resource util… |
CVE-2023-40537 | High | 8.1 | 2023-10-10 | An authenticated user's session cookie may remain valid for a limited time after logging out from the BIG-IP Configuration utility on a multi-blade VIPRION pl… |
CVE-2023-40534 | High | 7.5 | 2023-10-10 | When a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, and an iRule using the HTTP_REQUEST event or Local Traffic P… |
CVE-2023-39447 | Medium | 4.4 | 2023-10-10 | When BIG-IP APM Guided Configurations are configured, undisclosed sensitive information may be logged in restnoded log. Note: Software versions which have… |
CVE-2023-44763 | Medium | 5.4 | 2023-10-10 | Concrete CMS v9.2.1 is affected by an Arbitrary File Upload vulnerability via a Thumbnail file upload, which allows Cross-Site Scripting (XSS). NOTE: the vendo… |
CVE-2023-45601 | High | 7.8 | 2023-10-10 | A vulnerability has been identified in Parasolid V35.0 (All versions < V35.0.262), Parasolid V35.1 (All versions < V35.1.250), Parasolid V36.0 (All versions <… |
CVE-2023-45205 | High | 7.8 | 2023-10-10 | A vulnerability has been identified in SICAM PAS/PQS (All versions >= V8.00 < V8.20). The affected application is installed with specific files and folders wit… |
CVE-2023-45204 | High | 7.8 | 2023-10-10 | A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (All versions < V2302.0… |
CVE-2023-44315 | Medium | 4.7 | 2023-10-10 | A vulnerability has been identified in SINEC NMS (All versions < V2.0). The affected application improperly sanitizes certain SNMP configuration data retrieved… |