2023 CVEs (page 146)
Page 146 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-4732 | Medium | 4.7 | 2023-10-03 | A flaw was found in pfn_swap_entry_to_page in memory management subsystem in the Linux Kernel. In this flaw, an attacker with a local user privilege may cause… |
CVE-2023-34970 | Medium | 4.7 | 2023-10-03 | A local non-privileged user can make improper GPU processing operations to access a limited amount outside of buffer bounds or to exploit a software race condi… |
CVE-2023-33200 | Medium | 4.7 | 2023-10-03 | A local non-privileged user can make improper GPU processing operations to exploit a software race condition. If the system’s memory is carefully prepared by t… |
CVE-2023-4817 | High | 7.2 | 2023-10-03 | This vulnerability allows an authenticated attacker to upload malicious files by bypassing the restrictions of the upload functionality, compromising the entir… |
CVE-2023-4564 | Medium | 4.7 | 2023-10-03 | This vulnerability could allow an attacker to store a malicious JavaScript payload in the broadcast message parameter within the admin panel. |
CVE-2023-3196 | Medium | 4.7 | 2023-10-03 | This vulnerability could allow an attacker to store a malicious JavaScript payload in the login footer and login page description parameters within the adminis… |
CVE-2023-4886 | Medium | 6.7 | 2023-10-03 | A sensitive information exposure vulnerability was found in foreman. Contents of tomcat's server.xml file, which contain passwords to candlepin's keystore and… |
CVE-2023-4885 | Medium | 6.5 | 2023-10-03 | Man in the Middle vulnerability, which could allow an attacker to intercept VNF (Virtual Network Function) communications resulting in the exposure of sensitiv… |
CVE-2023-4884 | Medium | 6.5 | 2023-10-03 | An attacker could send an HTTP request to an Open5GS endpoint and retrieve the information stored on the device due to the lack of Authentication. |
CVE-2023-4883 | High | 7.5 | 2023-10-03 | Invalid pointer release vulnerability. Exploitation of this vulnerability could allow an attacker to interrupt the correct operation of the service by sending… |
CVE-2023-4882 | High | 7.5 | 2023-10-03 | DOS vulnerability that could allow an attacker to register a new VNF (Virtual Network Function) value. This action could trigger the args_assets() function def… |
CVE-2023-4929 | Medium | 6.5 | 2023-10-03 | All firmware versions of the NPort 5000 Series are affected by an improper validation of integrity check vulnerability. This vulnerability results from insuffi… |
CVE-2023-41693 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in edward_plainview MyCryptoCheckout plugin <= 2.125 versions. |
CVE-2023-41244 | Medium | 4.3 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Buildfail Localize Remote Images plugin <= 1.0.9 versions. |
CVE-2023-40558 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in eMarket Design YouTube Video Gallery by YouTube Showcase plugin <= 3.3.5 versions. |
CVE-2023-3350 | High | 8.2 | 2023-10-03 | A Cryptographic Issue vulnerability has been found on IBERMATICA RPS, affecting version 2019. By firstly downloading the log file, an attacker could retrieve t… |
CVE-2023-3349 | High | 8.2 | 2023-10-03 | Information exposure vulnerability in IBERMATICA RPS 2019, which exploitation could allow an unauthenticated user to retrieve sensitive information, such as us… |
CVE-2023-39158 | Medium | 4.3 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Banner Management For WooCommerce plugin <= 2.4.2 versions. |
CVE-2023-32091 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in POEditor plugin <= 0.9.4 versions. |
CVE-2023-2544 | Medium | 5.3 | 2023-10-03 | Authorization bypass vulnerability in UPV PEIX, affecting the component "pdf_curri_new.php". Through a POST request, an authenticated user could change the ID… |
CVE-2023-27435 | Medium | 6.3 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Sami Ahmed Siddiqui HTTP Auth plugin <= 0.3.2 versions. |
CVE-2023-0506 | High | 8.8 | 2023-10-03 | The web service of ByDemes Group Airspace CCTV Web Service in its 2.616.BY00.11 version, contains a privilege escalation vulnerability, detected in the Camera… |
CVE-2023-5353 | Medium | 6.5 | 2023-10-03 | Improper Access Control in GitHub repository salesagility/suitecrm prior to 7.14.1. |
CVE-2023-42508 | Medium | 6.5 | 2023-10-03 | JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unauthenticated users be… |
CVE-2023-40212 | Medium | 4.3 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Product Attachment for WooCommerce plugin <= 2.1.8 versions. |
CVE-2023-40202 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Hannes Etzelstorfer // codemiq WP HTML Mail plugin <= 3.4.1 versions. |
CVE-2023-40201 | Medium | 6.5 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in FuturioWP Futurio Extra plugin <= 1.8.4 versions leads to activation of arbitrary plugin. |
CVE-2023-40199 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in CRUDLab WP Like Button plugin <= 1.7.0 versions. |
CVE-2023-40198 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Antsanchez Easy Cookie Law plugin <= 3.1 versions. |
CVE-2023-40009 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Pipes plugin <= 1.4.0 versions. |
CVE-2023-39159 | Medium | 4.3 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Fraud Prevention For Woocommerce plugin <= 2.1.5 versions. |
CVE-2023-32792 | Medium | 6.5 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in NXLog Manager 5.6.5633 version. This vulnerability allows an attacker to eliminate roles within the platform… |
CVE-2023-32791 | Medium | 6.5 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in NXLog Manager 5.6.5633 version. This vulnerability allows an attacker to manipulate and delete user accounts… |
CVE-2023-32790 | Medium | 4.6 | 2023-10-03 | Cross-Site Scripting (XSS) vulnerability in NXLog Manager 5.6.5633 version. This vulnerability allows an attacker to inject a malicious JavaScript payload into… |
CVE-2023-32671 | Medium | 6.3 | 2023-10-03 | A stored XSS vulnerability has been found on BuddyBoss Platform affecting version 2.2.9. This vulnerability allows an attacker to store a malicious javascript… |
CVE-2023-32670 | Critical | 9.0 | 2023-10-03 | Cross-Site Scripting vulnerability in BuddyBoss 2.2.9 version , which could allow a local attacker with basic privileges to execute a malicious payload thro… |
CVE-2023-32669 | Medium | 5.4 | 2023-10-03 | Authorization bypass vulnerability in BuddyBoss 2.2.9 version, the exploitation of which could allow an authenticated user to access and rename other users' al… |
CVE-2023-2681 | High | 8.8 | 2023-10-03 | An SQL Injection vulnerability has been found on Jorani version 1.0.0. This vulnerability allows an authenticated remote user, with low privileges, to send que… |
CVE-2023-5351 | Medium | 5.4 | 2023-10-03 | Cross-site Scripting (XSS) - Stored in GitHub repository salesagility/suitecrm prior to 7.14.1. |
CVE-2023-5350 | Critical | 9.1 | 2023-10-03 | SQL Injection in GitHub repository salesagility/suitecrm prior to 7.14.1. |
CVE-2023-4103 | High | 8.8 | 2023-10-03 | QSige statistics are affected by a remote SQLi vulnerability. It has been identified that the web application does not correctly filter input parameters, allow… |
CVE-2023-4102 | High | 8.8 | 2023-10-03 | QSige login SSO does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. As a prerequisi… |
CVE-2023-4101 | High | 8.8 | 2023-10-03 | The QSige login SSO does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. As a prereq… |
CVE-2023-4100 | Medium | 6.5 | 2023-10-03 | Allows an attacker to perform XSS attacks stored on certain resources. Exploiting this vulnerability can lead to a DoS condition, among other actions. |
CVE-2023-4099 | High | 7.6 | 2023-10-03 | The QSige Monitor application does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. A… |
CVE-2023-4098 | High | 8.8 | 2023-10-03 | It has been identified that the web application does not correctly filter input parameters, allowing SQL injections, DoS or information disclosure. As a prereq… |
CVE-2023-40210 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Sean Barton (Tortoise IT) SB Child List plugin <= 4.5 versions. |
CVE-2023-39989 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in 99robots Header Footer Code Manager plugin <= 1.1.34 versions. |
CVE-2023-39923 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme The Post Grid plugin <= 7.2.7 versions. |
CVE-2023-39917 | Medium | 4.3 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Photo Gallery Team Photo Gallery by Ays – Responsive Image Gallery plugin <= 5.2.6 versions. |
CVE-2023-39165 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Fetch Designs Sign-up Sheets plugin <= 2.2.8 versions. |
CVE-2023-2830 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Trustindex.Io WP Testimonials plugin <= 1.4.2 versions. |
CVE-2023-25989 | Medium | 4.3 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Meks Video Importer, Meks Time Ago, Meks ThemeForest Smart Widget, Meks Smart Author Widget, Meks Audio Play… |
CVE-2023-4097 | High | 8.8 | 2023-10-03 | The file upload functionality is not implemented correctly and allows uploading of any type of file. As a prerequisite, it is necessary for the attacker to log… |
CVE-2023-38398 | Medium | 4.3 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Taboola plugin <= 2.0.1 versions. |
CVE-2023-38396 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Alain Gonzalez plugin <= 3.1.2 versions. |
CVE-2023-38390 | Medium | 4.3 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Anshul Labs Mobile Address Bar Changer plugin <= 3.0 versions. |
CVE-2023-37990 | Medium | 4.3 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Mike Perelink Pro plugin <= 2.1.4 versions. |
CVE-2023-25463 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Gopi Ramasamy WP tell a friend popup form plugin <= 7.1 versions. |
CVE-2023-24518 | Medium | 6.7 | 2023-10-03 | A Cross-site Request Forgery (CSRF) vulnerability in Pandora FMS allows an attacker to force authenticated users to send a request to a web application they ar… |
CVE-2023-0828 | Medium | 6.7 | 2023-10-03 | Cross-site Scripting (XSS) vulnerability in Syslog Section of Pandora FMS allows attacker to cause that users cookie value will be transferred to the attackers… |
CVE-2023-38381 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Cyle Conoly WP-FlyBox plugin <= 6.46 versions. |
CVE-2023-37998 | Medium | 4.3 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Saas Disabler allows Cross Site Request Forgery.This issue affects Disabler: from n/a through 3.0.3. |
CVE-2023-37996 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in GTmetrix GTmetrix for WordPress plugin <= 0.4.7 versions. |
CVE-2023-37992 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in PressPage Entertainment Inc. Smarty for WordPress plugin <= 3.1.35 versions. |
CVE-2023-37991 | Medium | 4.3 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Monchito.Net WP Emoji One plugin <= 0.6.0 versions. |
CVE-2023-37891 | Medium | 4.3 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in OptiMonk OptiMonk: Popups, Personalization & A/B Testing plugin <= 2.0.4 versions. |
CVE-2023-3654 | Critical | 9.4 | 2023-10-03 | cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by a origin bypass via the ho… |
CVE-2023-44218 | High | 8.8 | 2023-10-03 | A flaw within the SonicWall NetExtender Pre-Logon feature enables an unauthorized user to gain access to the host Windows operating system with 'SYSTEM' level… |
CVE-2023-44217 | High | 7.8 | 2023-10-03 | A local privilege escalation vulnerability in SonicWall Net Extender MSI client for Windows 10.2.336 and earlier versions allows a local low-privileged user t… |
CVE-2023-3656 | Critical | 9.8 | 2023-10-03 | cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by an unauthenticated remote… |
CVE-2023-3655 | High | 7.5 | 2023-10-03 | cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by a dangerous methods, that… |
CVE-2023-33039 | High | 8.4 | 2023-10-03 | Memory corruption in Automotive Display while destroying the image handle created using connected display driver. |
CVE-2023-33035 | High | 7.8 | 2023-10-03 | Memory corruption while invoking callback function of AFE from ADSP. |
CVE-2023-33034 | High | 7.8 | 2023-10-03 | Memory corruption while parsing the ADSP response command. |
CVE-2023-33029 | High | 8.4 | 2023-10-03 | Memory corruption in DSP Service during a remote call from HLOS to DSP. |
CVE-2023-33028 | Critical | 9.8 | 2023-10-03 | Memory corruption in WLAN Firmware while doing a memory copy of pmk cache. |
CVE-2023-33027 | High | 7.5 | 2023-10-03 | Transient DOS in WLAN Firmware while parsing rsn ies. |
CVE-2023-33026 | High | 7.5 | 2023-10-03 | Transient DOS in WLAN Firmware while parsing a NAN management frame. |
CVE-2023-28571 | Medium | 6.1 | 2023-10-03 | Information disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan. |
CVE-2023-28540 | Critical | 9.1 | 2023-10-03 | Cryptographic issue in Data Modem due to improper authentication during TLS handshake. |
CVE-2023-28539 | Medium | 6.6 | 2023-10-03 | Memory corruption in WLAN Host when the firmware invokes multiple WMI Service Available command. |
CVE-2023-24855 | Critical | 9.8 | 2023-10-03 | Memory corruption in Modem while processing security related configuration before AS Security Exchange. |
CVE-2023-24853 | High | 8.4 | 2023-10-03 | Memory Corruption in HLOS while registering for key provisioning notify. |
CVE-2023-24850 | High | 7.8 | 2023-10-03 | Memory Corruption in HLOS while importing a cryptographic key into KeyMaster Trusted Application. |
CVE-2023-24849 | High | 8.2 | 2023-10-03 | Information Disclosure in data Modem while parsing an FMTP line in an SDP message. |
CVE-2023-24848 | High | 8.2 | 2023-10-03 | Information Disclosure in Data Modem while performing a VoLTE call with an undefined RTCP FB line value. |
CVE-2023-24847 | High | 7.5 | 2023-10-03 | Transient DOS in Modem while allocating DSM items. |
CVE-2023-24844 | High | 8.4 | 2023-10-03 | Memory Corruption in Core while invoking a call to Access Control core library with hardware protected address range. |
CVE-2023-24843 | High | 7.5 | 2023-10-03 | Transient DOS in Modem while triggering a camping on an 5G cell. |
CVE-2023-22385 | High | 8.2 | 2023-10-03 | Memory Corruption in Data Modem while making a MO call or MT VOLTE call. |
CVE-2023-22384 | Medium | 6.7 | 2023-10-03 | Memory Corruption in VR Service while sending data using Fast Message Queue (FMQ). |
CVE-2023-22382 | High | 7.4 | 2023-10-03 | Weak configuration in Automotive while VM is processing a listener request from TEE. |
CVE-2023-21673 | High | 8.7 | 2023-10-03 | Improper Access to the VM resource manager can lead to Memory Corruption. |
CVE-2023-26152 | High | 7.5 | 2023-10-03 | All versions of the package static-server are vulnerable to Directory Traversal due to improper input sanitization passed via the validPath function of server… |
CVE-2023-26151 | Medium | 5.3 | 2023-10-03 | Versions of the package asyncua before 0.9.96 are vulnerable to Denial of Service (DoS) such that an attacker can send a malformed packet and as a result, the… |
CVE-2023-26150 | Medium | 6.5 | 2023-10-03 | Versions of the package asyncua before 0.9.96 are vulnerable to Improper Authentication such that it is possible to access Address Space without encryption and… |
CVE-2023-5345 | High | 7.8 | 2023-10-03 | A use-after-free vulnerability in the Linux kernel's fs/smb/client component can be exploited to achieve local privilege escalation. In case of an error in sm… |
CVE-2023-5334 | Medium | 6.4 | 2023-10-03 | The WP Responsive header image slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sp_responsiveslider' shortcode in versions up to… |
CVE-2023-3967 | Medium | 5.3 | 2023-10-03 | Allocation of Resources Without Limits or Throttling vulnerability in Hitachi Ops Center Common Services on Linux allows DoS.This issue affects Hitachi Ops Cen… |