2023 CVEs (page 145)
Page 145 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-44386 | Medium | 5.3 | 2023-10-05 | Vapor is an HTTP web framework for Swift. There is a denial of service vulnerability impacting all users of affected versions of Vapor. The HTTP1 error handler… |
CVE-2023-43073 | Medium | 4.3 | 2023-10-05 | Dell SmartFabric Storage Software v1.4 (and earlier) contains an Improper Input Validation vulnerability in RADIUS configuration. An authenticated remote atta… |
CVE-2023-43072 | Medium | 4.4 | 2023-10-05 | Dell SmartFabric Storage Software v1.4 (and earlier) contains an improper access control vulnerability in the CLI. A local possibly unauthenticated attacker c… |
CVE-2023-43071 | Medium | 4.4 | 2023-10-05 | Dell SmartFabric Storage Software v1.4 (and earlier) contains possible vulnerabilities for HTML injection or CVS formula injection which might escalate to cro… |
CVE-2023-43070 | Medium | 6.3 | 2023-10-05 | Dell SmartFabric Storage Software v1.4 (and earlier) contains a Path Traversal Vulnerability in the HTTP interface. A remote authenticated attacker could pote… |
CVE-2023-43069 | High | 7.8 | 2023-10-05 | Dell SmartFabric Storage Software v1.4 (and earlier) contain(s) an OS Command Injection Vulnerability in the CLI. An authenticated local attacker could potent… |
CVE-2023-43068 | High | 7.8 | 2023-10-05 | Dell SmartFabric Storage Software v1.4 (and earlier) contains an OS Command Injection Vulnerability in the restricted shell in SSH. An authenticated remote at… |
CVE-2023-2306 | Critical | 10.0 | 2023-10-05 | Qognify NiceVision versions 3.1 and prior are vulnerable to exposing sensitive information using hard-coded credentials. With these credentials an attacke… |
CVE-2023-4570 | High | 8.8 | 2023-10-05 | An improper access restriction in NI MeasurementLink Python services could allow an attacker on an adjacent network to reach services exposed on localhost. Th… |
CVE-2023-45160 | High | 8.8 | 2023-10-05 | In the affected version of the 1E Client, an ordinary user could subvert downloaded instruction resource files, e.g., to substitute a harmful script. by replac… |
CVE-2023-44839 | High | 7.5 | 2023-10-05 | D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the Encryption parameter in the SetWLanRadioSecurity function. This vulnerability a… |
CVE-2023-44838 | High | 7.5 | 2023-10-05 | D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the TXPower parameter in the SetWLanRadioSettings function. This vulnerability allo… |
CVE-2023-44837 | High | 7.5 | 2023-10-05 | D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the Password parameter in the SetWanSettings function. This vulnerability allows at… |
CVE-2023-44836 | High | 7.5 | 2023-10-05 | D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the SSID parameter in the SetWLanRadioSettings function. This vulnerability allows… |
CVE-2023-44835 | High | 7.5 | 2023-10-05 | D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the Mac parameter in the SetParentsControlInfo function. This vulnerability allows… |
CVE-2023-44834 | High | 7.5 | 2023-10-05 | D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the StartTime parameter in the SetParentsControlInfo function. This vulnerability a… |
CVE-2023-44833 | High | 7.5 | 2023-10-05 | D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the GuardInt parameter in the SetWLanRadioSettings function. This vulnerability all… |
CVE-2023-44832 | High | 7.5 | 2023-10-05 | D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the MacAddress parameter in the SetWanSettings function. This vulnerability allows… |
CVE-2023-44831 | High | 7.5 | 2023-10-05 | D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the Type parameter in the SetWLanRadioSettings function. This vulnerability allows… |
CVE-2023-44830 | High | 7.5 | 2023-10-05 | D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the EndTime parameter in the SetParentsControlInfo function. This vulnerability all… |
CVE-2023-44829 | High | 7.5 | 2023-10-05 | D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the AdminPassword parameter in the SetDeviceSettings function. This vulnerability a… |
CVE-2023-44828 | High | 7.5 | 2023-10-05 | D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the CurrentPassword parameter in the CheckPasswdSettings function. This vulnerabili… |
CVE-2023-44390 | Medium | 6.1 | 2023-10-05 | HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. The vulnerability occurs in configurati… |
CVE-2023-45159 | High | 8.4 | 2023-10-05 | 1E Client installer can perform arbitrary file deletion on protected files. A non-privileged user could provide a symbolic link or Windows junction to point… |
CVE-2023-45198 | High | 7.5 | 2023-10-05 | ftpd before "NetBSD-ftpd 20230930" can leak information about the host filesystem before authentication via an MLSD or MLST command. tnftpd (the portable versi… |
CVE-2023-26239 | Medium | 5.5 | 2023-10-05 | An issue was discovered in WatchGuard EPDR 8.0.21.0002. Due to a weak implementation of a password check, it is possible to obtain credentials to access the ma… |
CVE-2023-26238 | Medium | 5.5 | 2023-10-05 | An issue was discovered in WatchGuard EPDR 8.0.21.0002. It is possible to enable or disable defensive capabilities by sending a crafted message to a named pipe. |
CVE-2023-26237 | Medium | 6.7 | 2023-10-05 | An issue was discovered in WatchGuard EPDR 8.0.21.0002. It is possible to bypass the defensive capabilities by adding a registry key as SYSTEM. |
CVE-2023-26236 | High | 7.8 | 2023-10-05 | An issue was discovered in WatchGuard EPDR 8.0.21.0002. Due to a weak implementation of message handling between WatchGuard EPDR processes, it is possible to p… |
CVE-2023-43877 | Medium | 4.8 | 2023-10-04 | Rite CMS 3.0 has Multiple Cross-Site scripting (XSS) vulnerabilities that allow attackers to execute arbitrary code via a payload crafted in the Home Page fiel… |
CVE-2023-43321 | High | 8.8 | 2023-10-04 | File Upload vulnerability in Digital China Networks DCFW-1800-SDC v.3.0 allows an authenticated attacker to execute arbitrary code via the wget function in the… |
CVE-2023-40299 | High | 7.8 | 2023-10-04 | Kong Insomnia 2023.4.0 on macOS allows attackers to execute code and access restricted files, or make requests for TCC permissions, by using the DYLD_INSERT_LI… |
CVE-2023-35803 | Critical | 9.8 | 2023-10-04 | IQ Engine before 10.6r2 on Extreme Network AP devices has a Buffer Overflow. |
CVE-2023-44389 | Low | 3.1 | 2023-10-04 | Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while view… |
CVE-2023-43809 | High | 7.5 | 2023-10-04 | Soft Serve is a self-hostable Git server for the command line. Prior to version 0.6.2, a security vulnerability in Soft Serve could allow an unauthenticated, r… |
CVE-2023-43805 | High | 7.5 | 2023-10-04 | Nexkey is a fork of Misskey, an open source, decentralized social media platform. Prior to version 12.121.9, incomplete URL validation can allow users to bypas… |
CVE-2023-43799 | Medium | 5.0 | 2023-10-04 | Altair is a GraphQL Client. Prior to version 5.2.5, the Altair GraphQL Client Desktop Application does not sanitize external URLs before passing them to the un… |
CVE-2023-43793 | High | 7.5 | 2023-10-04 | Misskey is an open source, decentralized social media platform. Prior to version 2023.9.0, by editing the URL, a user can bypass the authentication of the Bull… |
CVE-2023-41094 | Critical | 10.0 | 2023-10-04 | TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Release of Resource after Effective Lifet… |
CVE-2023-36619 | Critical | 9.8 | 2023-10-04 | Atos Unify OpenScape Session Border Controller through V10 R3.01.03 allows execution of administrative scripts by unauthenticated users. |
CVE-2023-36618 | High | 8.8 | 2023-10-04 | Atos Unify OpenScape Session Border Controller through V10 R3.01.03 allows execution of OS commands as root user by low-privileged authenticated users. |
CVE-2023-44210 | Medium | 5.5 | 2023-10-04 | Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux… |
CVE-2023-44209 | High | 7.8 | 2023-10-04 | Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) b… |
CVE-2023-44075 | Medium | 5.4 | 2023-10-04 | Cross Site Scripting vulnerability in Small CRM in PHP v.3.0 allows a remote attacker to execute arbitrary code via a crafted payload to the Address parameter. |
CVE-2023-42809 | Critical | 9.6 | 2023-10-04 | Redisson is a Java Redis client that uses the Netty framework. Prior to version 3.22.0, some of the messages received from the Redis server contain Java object… |
CVE-2023-42808 | Medium | 6.1 | 2023-10-04 | Common Voice is the web app for Mozilla Common Voice, a platform for collecting speech donations in order to create public domain datasets for training voice r… |
CVE-2023-42449 | High | 8.1 | 2023-10-04 | Hydra is the two-layer scalability solution for Cardano. Prior to version 0.13.0, it is possible for a malicious head initializer to extract one or more PTs fo… |
CVE-2023-38538 | Medium | 5.0 | 2023-10-04 | A race condition in an event subsystem led to a heap use-after-free issue in established audio/video calls that could have resulted in app termination or unexp… |
CVE-2023-38537 | Medium | 5.6 | 2023-10-04 | A race condition in a network transport subsystem led to a heap use-after-free issue in established or unsilenced incoming audio/video calls that could have re… |
CVE-2023-5399 | Critical | 9.8 | 2023-10-04 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause tampering of files on the p… |
CVE-2023-5391 | Critical | 9.8 | 2023-10-04 | A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker to execute arbitrary code on the targeted system by sending a… |
CVE-2023-42824 | High | 7.8 | 2023-10-04 | The issue was addressed with improved checks. This issue is fixed in iOS 16.7.1 and iPadOS 16.7.1. A local attacker may be able to elevate their privileges. Ap… |
CVE-2023-42448 | High | 8.1 | 2023-10-04 | Hydra is the layer-two scalability solution for Cardano. Prior to version 0.13.0, the specification states that the contestation period in the datum of the UTx… |
CVE-2023-3576 | Medium | 5.5 | 2023-10-04 | A memory leak flaw was found in Libtiff's tiffcrop utility. This issue occurs when tiffcrop operates on a TIFF image file, allowing an attacker to pass a craft… |
CVE-2023-3428 | Medium | 6.2 | 2023-10-04 | A heap-based buffer overflow vulnerability was found in coders/tiff.c in ImageMagick. This issue may allow a local attacker to trick the user into opening a s… |
CVE-2023-39191 | High | 8.2 | 2023-10-04 | An improper input validation flaw was found in the eBPF subsystem in the Linux kernel. The issue occurs due to a lack of proper validation of dynamic pointers… |
CVE-2023-38701 | Critical | 9.1 | 2023-10-04 | Hydra is the layer-two scalability solution for Cardano. Users of the Hydra head protocol send the UTxOs they wish to commit into the Hydra head first to the `… |
CVE-2023-27121 | Medium | 6.1 | 2023-10-04 | A cross-site scripting (XSS) vulnerability in the component /framework/cron/action/humanize of Pleasant Solutions Pleasant Password Server v7.11.41.0 allows at… |
CVE-2023-5402 | Critical | 9.8 | 2023-10-04 | A CWE-269: Improper Privilege Management vulnerability exists that could cause a remote code execution when the transfer command is used over the network. |
CVE-2023-5371 | Medium | 5.3 | 2023-10-04 | RTPS dissector memory leak in Wireshark 4.0.0 to 4.0.8 and 3.6.0 to 3.6.16 allows denial of service via packet injection or crafted capture file |
CVE-2023-43804 | Medium | 5.9 | 2023-10-04 | urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies o… |
CVE-2023-20259 | High | 8.6 | 2023-10-04 | A vulnerability in an API endpoint of multiple Cisco Unified Communications Products could allow an unauthenticated, remote attacker to cause high CPU utilizat… |
CVE-2023-20235 | Medium | 6.5 | 2023-10-04 | A vulnerability in the on-device application development workflow feature for the Cisco IOx application hosting infrastructure in Cisco IOS XE Software could a… |
CVE-2023-20101 | Critical | 9.8 | 2023-10-04 | A vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has… |
CVE-2023-43838 | High | 7.8 | 2023-10-04 | An arbitrary file upload vulnerability in Personal Management System v1.4.64 allows attackers to execute arbitrary code via uploading a crafted SVG file into a… |
CVE-2023-5113 | Medium | 6.1 | 2023-10-04 | Certain HP Enterprise LaserJet and HP LaserJet Managed Printers are potentially vulnerable to denial of service due to WS-Print request and potential injection… |
CVE-2023-4380 | Medium | 6.3 | 2023-10-04 | A logic flaw exists in Ansible Automation platform. Whenever a private project is created with incorrect credentials, they are logged in plaintext. This flaw a… |
CVE-2023-4237 | High | 7.3 | 2023-10-04 | A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2_key module prints out the private key directly to the standard output… |
CVE-2023-40559 | Medium | 4.3 | 2023-10-04 | Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Dynamic Pricing and Discount Rules for WooCommerce plugin <= 2.4.0 versions. |
CVE-2023-3971 | High | 7.3 | 2023-10-04 | An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login p… |
CVE-2023-3665 | Medium | 5.5 | 2023-10-04 | A code injection vulnerability in Trellix ENS 10.7.0 April 2023 release and earlier, allowed a local user to disable the ENS AMSI component via environment va… |
CVE-2023-5374 | Medium | 6.3 | 2023-10-04 | A vulnerability classified as critical was found in SourceCodester Online Computer and Laptop Store 1.0. Affected by this vulnerability is an unknown functiona… |
CVE-2023-40684 | Medium | 4.6 | 2023-10-04 | IBM Content Navigator 3.0.11, 3.0.13, and 3.0.14 with IBM Daeja ViewOne Virtual is vulnerable to cross-site scripting. This vulnerability allows users to embed… |
CVE-2023-40561 | Medium | 5.4 | 2023-10-04 | Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Enhanced Ecommerce Google Analytics for WooCommerce plugin <= 3.7.1 versions. |
CVE-2023-40376 | Medium | 5.3 | 2023-10-04 | IBM UrbanCode Deploy (UCD) 7.1 - 7.1.2.12, 7.2 through 7.2.3.5, and 7.3 through 7.3.2.0 under certain configurations could allow an authenticated user to make… |
CVE-2023-27433 | Medium | 5.4 | 2023-10-04 | Cross-Site Request Forgery (CSRF) vulnerability in YAS Global Team Make Paths Relative allows Cross Site Request Forgery.This issue affects Make Paths Relative… |
CVE-2023-25025 | Medium | 4.3 | 2023-10-04 | Cross-Site Request Forgery (CSRF) vulnerability in Chetan Gole WP-CopyProtect [Protect your blog posts] plugin <= 3.1.0 versions. |
CVE-2023-22515 | Critical | 9.8 | 2023-10-04 | Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in… |
CVE-2023-1832 | Medium | 6.8 | 2023-10-04 | An improper access control flaw was found in Candlepin. An attacker can create data scoped under another customer/tenant, which can result in loss of confident… |
CVE-2023-5373 | High | 7.3 | 2023-10-04 | A vulnerability classified as critical has been found in SourceCodester Online Computer and Laptop Store 1.0. Affected is the function register of the file Mas… |
CVE-2023-4497 | Medium | 6.1 | 2023-10-04 | Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability… |
CVE-2023-4496 | Medium | 6.1 | 2023-10-04 | Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability… |
CVE-2023-4495 | Medium | 6.1 | 2023-10-04 | Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability… |
CVE-2023-4494 | Critical | 9.8 | 2023-10-04 | Stack-based buffer overflow vulnerability in Easy Chat Server 3.1 version. An attacker could send an excessively long username string to the register.ghp file… |
CVE-2023-4493 | Medium | 6.1 | 2023-10-04 | Stored Cross-Site Scripting in Easy Address Book Web Server 1.6 version, through the users_admin.ghp file that affects multiple parameters such as (firstname… |
CVE-2023-4492 | Medium | 6.1 | 2023-10-04 | Vulnerability in Easy Address Book Web Server 1.6 version, affecting the parameters (firstname, homephone, lastname, middlename, workaddress, workcity, workcou… |
CVE-2023-4491 | Critical | 9.8 | 2023-10-04 | Buffer overflow vulnerability in Easy Address Book Web Server 1.6 version. The exploitation of this vulnerability could allow an attacker to send a very long u… |
CVE-2023-4090 | Medium | 5.4 | 2023-10-04 | Cross-site Scripting (XSS) reflected vulnerability on WideStand until 5.3.5 version, which generates one of the meta tags directly using the content of the que… |
CVE-2023-4037 | Critical | 9.9 | 2023-10-04 | Blind SQL injection vulnerability in the Conacwin 3.7.1.2 web interface, the exploitation of which could allow a local attacker to obtain sensitive data stored… |
CVE-2023-44208 | Critical | 9.1 | 2023-10-04 | Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Home Office (Windows… |
CVE-2023-43261 | High | 7.5 | 2023-10-04 | An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensitive router components. |
CVE-2023-3361 | High | 7.7 | 2023-10-04 | A flaw was found in Red Hat OpenShift Data Science. When exporting a pipeline from the Elyra notebook pipeline editor as Python DSL or YAML, it reads S3 creden… |
CVE-2023-3153 | Medium | 5.3 | 2023-10-04 | A flaw was found in Open Virtual Network where the service monitor MAC does not properly rate limit. This issue could allow an attacker to cause a denial of se… |
CVE-2023-3038 | Critical | 9.8 | 2023-10-04 | SQL injection vulnerability in HelpDezk Community affecting version 1.1.10. This vulnerability could allow a remote attacker to send a specially crafted SQL qu… |
CVE-2023-3037 | High | 8.6 | 2023-10-04 | Improper authorization vulnerability in HelpDezk Community affecting version 1.1.10. This vulnerability could allow a remote attacker to access the platform wi… |
CVE-2023-22618 | High | 8.1 | 2023-10-04 | If Security Hardening guide rules are not followed, then Nokia WaveLite products allow a local user to create new users with administrative privileges by manip… |
CVE-2023-4997 | High | 8.8 | 2023-10-04 | Improper authorisation of regular users in ProIntegra Uptime DC software (versions below 2.0.0.33940) allows them to change passwords of all other users includ… |
CVE-2023-4586 | High | 7.4 | 2023-10-04 | A vulnerability was found in the Hot Rod client. This security issue occurs as the Hot Rod client does not enable hostname validation when using TLS, possibly… |
CVE-2023-3701 | Critical | 9.9 | 2023-10-04 | Aqua Drive, in its 2.4 version, is vulnerable to a relative path traversal vulnerability. By exploiting this vulnerability, an authenticated non privileged use… |
CVE-2023-3512 | High | 7.5 | 2023-10-04 | Relative path traversal vulnerability in Setelsa Security's ConacWin CB, in its 3.8.2.2 version and earlier, the exploitation of which could allow an attacker… |