2023 CVEs (page 156)
Page 156 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-25530 | High | 8.0 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in the KVM service, where an attacker may cause improper input validation. A successful exploit of this vulnerabil… |
CVE-2023-25529 | High | 8.0 | 2023-09-20 | NVIDIA DGX H100 BMC and DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause a leak of another user’s sess… |
CVE-2023-25528 | High | 8.8 | 2023-09-20 | NVIDIA DGX H100 baseboard management controller (BMC) contains a vulnerability in a web server plugin, where an unauthenticated attacker may cause a stack over… |
CVE-2023-25527 | High | 7.8 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in the host KVM daemon, where an authenticated local attacker may cause corruption of kernel memory. A successful… |
CVE-2023-25526 | Medium | 6.5 | 2023-09-20 | NVIDIA Cumulus Linux contains a vulnerability in neighmgrd and nlmanager where an attacker on an adjacent network may cause an uncaught exception by injecting… |
CVE-2023-25525 | High | 7.5 | 2023-09-20 | NVIDIA Cumulus Linux contains a vulnerability in forwarding where a VxLAN-encapsulated IPv6 packet received on an SVI interface with DMAC/DIPv6 set to the link… |
CVE-2023-39575 | Medium | 5.4 | 2023-09-20 | A reflected cross-site scripting (XSS) vulnerability in the url_str URL parameter of ISL ARP Guard v4.0.2 allows attackers to execute arbitrary web scripts or… |
CVE-2023-36319 | High | 8.8 | 2023-09-20 | File Upload vulnerability in Openupload Stable v.0.4.3 allows a remote attacker to execute arbitrary code via the action parameter of the compress-inc.php file. |
CVE-2023-40934 | High | 7.2 | 2023-09-19 | A SQL injection vulnerability in Nagios XI 5.11.1 and below allows authenticated attackers with privileges to manage host escalations in the Core Configuration… |
CVE-2023-40933 | High | 8.8 | 2023-09-19 | A SQL injection vulnerability in Nagios XI v5.11.1 and below allows authenticated attackers with announcement banner configuration privileges to execute arbitr… |
CVE-2023-40932 | Medium | 5.4 | 2023-09-19 | A Cross-site scripting (XSS) vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom logo component to inj… |
CVE-2023-40931 | Medium | 6.5 | 2023-09-19 | A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via… |
CVE-2023-4376 | Medium | 4.8 | 2023-09-19 | The Serial Codes Generator and Validator with WooCommerce Support WordPress plugin before 2.4.15 does not sanitise and escape some of its settings, which could… |
CVE-2023-2995 | Medium | 4.8 | 2023-09-19 | The Leyka WordPress plugin before 3.30.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Sto… |
CVE-2023-43566 | Low | 3.5 | 2023-09-19 | In JetBrains TeamCity before 2023.05.4 stored XSS was possible during nodes configuration |
CVE-2023-42793 | Critical | 9.8 | 2023-09-19 | In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible |
CVE-2023-22513 | High | 8.8 | 2023-09-19 | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 8.0.0 of Bitbucket Data Center and Server. This RCE (Remote Code Executi… |
CVE-2023-42452 | Medium | 6.1 | 2023-09-19 | Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.x branch prior to versions 4.0.10, 4.2.8, and 4.2.0-rc2, under… |
CVE-2023-42451 | High | 7.4 | 2023-09-19 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2, under certain circumstances… |
CVE-2023-42450 | Medium | 5.4 | 2023-09-19 | Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 4.2.0-beta1 and prior to version 4.2.0-rc2, by crafting specifi… |
CVE-2023-38356 | High | 8.1 | 2023-09-19 | MiniTool Power Data Recovery 11.6 contains an insecure installation process that allows attackers to achieve remote code execution through a man in the middle… |
CVE-2023-38355 | High | 8.1 | 2023-09-19 | MiniTool Movie Maker 7.0 contains an insecure installation process that allows attackers to achieve remote code execution through a man in the middle attack. |
CVE-2023-38354 | High | 8.1 | 2023-09-19 | MiniTool Shadow Maker version 4.1 contains an insecure installation process that allows attackers to achieve remote code execution through a man in the middle… |
CVE-2023-38353 | Medium | 5.9 | 2023-09-19 | MiniTool Power Data Recovery version 11.6 and before contains an insecure in-app payment system that allows attackers to steal highly sensitive information thr… |
CVE-2023-38352 | High | 8.1 | 2023-09-19 | MiniTool Partition Wizard 12.8 contains an insecure update mechanism that allows attackers to achieve remote code execution through a man in the middle attack. |
CVE-2023-38351 | High | 8.1 | 2023-09-19 | MiniTool Partition Wizard 12.8 contains an insecure installation mechanism that allows attackers to achieve remote code execution through a man in the middle a… |
CVE-2023-32182 | Medium | 5.9 | 2023-09-19 | A Improper Link Resolution Before File Access ('Link Following') vulnerability in SUSE SUSE Linux Enterprise Desktop 15 SP5 postfix, SUSE SUSE Linux Enterprise… |
CVE-2023-42447 | High | 8.6 | 2023-09-19 | blurhash-rs is a pure Rust implementation of Blurhash, software for encoding images into ASCII strings that can be turned into a gradient of colors representin… |
CVE-2023-42444 | High | 8.6 | 2023-09-19 | phonenumber is a library for parsing, formatting and validating international phone numbers. Prior to versions `0.3.3+8.13.9` and `0.2.5+8.11.3`, the phonenumb… |
CVE-2023-41890 | High | 7.5 | 2023-09-19 | Sustainsys.Saml2 library adds SAML2P support to ASP.NET web sites, allowing the web site to act as a SAML2 Service Provider. Prior to versions 1.0.3 and 2.9.2… |
CVE-2023-3892 | Medium | 5.6 | 2023-09-19 | Improper Restriction of XML External Entity Reference vulnerability in MIM Assistant and Client DICOM RTst Loading modules allows XML Entity Linking / XML Exte… |
CVE-2023-4096 | High | 8.6 | 2023-09-19 | Weak password recovery mechanism vulnerability in Fujitsu Arconte Áurea version 1.5.0.0, which exploitation could allow an attacker to perform a brute force at… |
CVE-2023-4095 | Medium | 5.3 | 2023-09-19 | User enumeration vulnerability in Arconte Áurea 1.5.0.0 version. The exploitation of this vulnerability could allow an attacker to obtain a list of registered… |
CVE-2023-4094 | Medium | 6.5 | 2023-09-19 | ARCONTE Aurea's authentication system, in its 1.5.0.0 version, could allow an attacker to make incorrect access requests in order to block each legitimate acco… |
CVE-2023-4093 | Medium | 5.5 | 2023-09-19 | Reflected and persistent XSS vulnerability in Arconte Áurea, in its 1.5.0.0 version. The exploitation of this vulnerability could allow an attacker to inject m… |
CVE-2023-41179 | High | 7.2 | 2023-09-19 | A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security and Worry-Free Busine… |
CVE-2023-31808 | High | 7.2 | 2023-09-19 | Technicolor TG670 10.5.N.9 devices contain multiple accounts with hard-coded passwords. One account has administrative privileges, allowing for unrestricted ac… |
CVE-2023-4092 | High | 8.8 | 2023-09-19 | SQL injection vulnerability in Arconte Áurea, in its 1.5.0.0 version. The exploitation of this vulnerability could allow an attacker to read sensitive data fro… |
CVE-2023-41834 | Medium | 6.1 | 2023-09-19 | Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Flink Stateful Functions 3.1.0, 3.1.1 and 3.2.0 allows remote attackers to inject arbitrary… |
CVE-2023-23957 | Medium | 5.4 | 2023-09-19 | An authenticated user can see and modify the value for ‘next’ query parameter in Symantec Identity Portal 14.4 |
CVE-2023-32649 | High | 7.5 | 2023-09-19 | A Denial of Service (Dos) vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields used in the Asset Intelligence… |
CVE-2023-2567 | High | 8.8 | 2023-09-19 | A SQL Injection vulnerability has been found in Nozomi Networks Guardian and CMC, due to improper input validation in certain parameters used in the Query func… |
CVE-2023-29245 | High | 8.1 | 2023-09-19 | A SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields used in the Asset Intelligence functional… |
CVE-2023-32186 | High | 7.5 | 2023-09-19 | A Allocation of Resources Without Limits or Throttling vulnerability in SUSE RKE2 allows attackers with access to K3s servers apiserver/supervisor port (TCP 6… |
CVE-2023-32184 | High | 7.8 | 2023-09-19 | A Insecure Storage of Sensitive Information vulnerability in openSUSE opensuse-welcome allows local attackers to execute code as the user that runs opensuse-we… |
CVE-2023-0773 | Critical | 9.1 | 2023-09-19 | The vulnerability exists in Uniview IP Camera due to identification and authentication failure at its web-based management interface. A remote attacker could e… |
CVE-2023-41387 | Critical | 9.1 | 2023-09-19 | A SQL injection in the flutter_downloader component through 1.11.1 for iOS allows remote attackers to steal session tokens and overwrite arbitrary files inside… |
CVE-2023-5009 | High | 8.2 | 2023-09-19 | An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.2.7, all versions starting from 16.3 before 16.3.4. It was possi… |
CVE-2023-5054 | Medium | 5.8 | 2023-09-19 | The Super Store Finder plugin for WordPress is vulnerable to unauthenticated arbitrary email creation and relay in versions up to, and including, 6.9.3. This i… |
CVE-2023-26143 | Medium | 6.5 | 2023-09-19 | Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile() API. The library does not sanitize for user in… |
CVE-2023-42399 | Medium | 6.1 | 2023-09-19 | Cross Site Scripting vulnerability in xdsoft.net Jodit Editor v.4.0.0-beta.86 allows a remote attacker to obtain sensitive information via the rich text editor… |
CVE-2023-5060 | Medium | 6.1 | 2023-09-19 | Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.1. |
CVE-2023-41599 | Medium | 5.3 | 2023-09-19 | An issue in the component /common/DownController.java of JFinalCMS v5.0.0 allows attackers to execute a directory traversal. |
CVE-2023-40788 | Medium | 5.3 | 2023-09-19 | SpringBlade <=V3.6.0 is vulnerable to Incorrect Access Control due to incorrect configuration in the default gateway resulting in unauthorized access to error… |
CVE-2023-42454 | Critical | 10.0 | 2023-09-18 | SQLpage is a SQL-only webapp builder. Someone using SQLpage versions prior to 0.11.1, whose SQLpage instance is exposed publicly, with a database connection st… |
CVE-2023-42446 | Medium | 6.5 | 2023-09-18 | Pow is a authentication and user management solution for Phoenix and Plug-based apps. Starting in version 1.0.14 and prior to version 1.0.34, use of `Pow.Store… |
CVE-2023-41443 | High | 7.2 | 2023-09-18 | SQL injection vulnerability in Novel-Plus v.4.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parameter in /sys/menu/li… |
CVE-2023-39056 | Medium | 6.5 | 2023-09-18 | An information leak in Coffee-jumbo v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39049 | Medium | 6.5 | 2023-09-18 | An information leak in youmart-tokunaga v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39046 | Medium | 6.5 | 2023-09-18 | An information leak in TonTon-Tei_waiting Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-37611 | Medium | 5.4 | 2023-09-18 | Cross Site Scripting (XSS) vulnerability in Neos CMS 8.3.3 allows a remote authenticated attacker to execute arbitrary code via a crafted SVG file to the neos/… |
CVE-2023-42443 | High | 8.1 | 2023-09-18 | Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In version 0.3.9 and prior, under certain conditions, the memory used by th… |
CVE-2023-42441 | Medium | 5.3 | 2023-09-18 | Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Starting in version 0.2.9 and prior to version 0.3.10, locks of the type `@… |
CVE-2023-39452 | High | 7.5 | 2023-09-18 | The web application that owns the device clearly stores the credentials within the user management section. Obtaining this information can be do… |
CVE-2023-39446 | High | 8.9 | 2023-09-18 | Thanks to the weaknesses that the web application has at the user management level, an attacker could obtain the information from the headers that is ne… |
CVE-2023-39058 | Medium | 6.5 | 2023-09-18 | An information leak in THE_B_members card v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39043 | Medium | 6.5 | 2023-09-18 | An information leak in YKC Tokushima_awayokocho Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39040 | Medium | 6.5 | 2023-09-18 | An information leak in Cheese Cafe Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39039 | Medium | 6.5 | 2023-09-18 | An information leak in Camp Style Project Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-38582 | Medium | 6.3 | 2023-09-18 | Persistent cross-site scripting (XSS) in the web application of MOD3GP-SY-120K allows an authenticated remote attacker to introduce arbitrary JavaScri… |
CVE-2023-38255 | Medium | 6.5 | 2023-09-18 | A potential attacker with or without (cookie theft) access to the device would be able to include malicious code (XSS) when uploading new devi… |
CVE-2023-41965 | High | 7.5 | 2023-09-18 | Sending some requests in the web application of the vulnerable device allows information to be obtained due to the lack of security in the authentication proce… |
CVE-2023-41084 | Critical | 10.0 | 2023-09-18 | Session management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions that the… |
CVE-2023-40221 | High | 8.8 | 2023-09-18 | The absence of filters when loading some sections in the web application of the vulnerable device allows potential attackers to inject malicious c… |
CVE-2023-33831 | Critical | 9.8 | 2023-09-18 | A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST… |
CVE-2023-41030 | Medium | 6.3 | 2023-09-18 | Hard-coded credentials in Juplink RX4-1500 versions V1.0.2 through V1.0.5 allow unauthenticated attackers to log in to the web interface or telnet service as t… |
CVE-2023-4806 | Medium | 5.9 | 2023-09-18 | A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an applicatio… |
CVE-2023-4527 | Medium | 6.5 | 2023-09-18 | A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/re… |
CVE-2023-42328 | High | 8.8 | 2023-09-18 | An issue in PeppermintLabs Peppermint v.0.2.4 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the hardcoded… |
CVE-2023-42320 | Critical | 9.8 | 2023-09-18 | Buffer Overflow vulnerability in Tenda AC10V4 v.US_AC10V4.0si_V16.03.10.13_cn_TDC01 allows a remote attacker to cause a denial of service via the mac parameter… |
CVE-2023-41595 | High | 7.5 | 2023-09-18 | An issue in xui-xray v1.8.3 allows attackers to obtain sensitive information via default password. |
CVE-2023-42387 | High | 7.5 | 2023-09-18 | An issue in TDSQL Chitu management platform v.10.3.19.5.0 allows a remote attacker to obtain sensitive information via get_db_info function in install.php. |
CVE-2023-42371 | Medium | 5.4 | 2023-09-18 | Cross Site Scripting vulnerability in Summernote Rich Text Editor v.0.8.18 and before allows a remote attacker to execute arbitrary code via a crafted script t… |
CVE-2023-34195 | High | 7.8 | 2023-09-18 | An issue was discovered in SystemFirmwareManagementRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. The implementation of the GetImage method retrie… |
CVE-2023-32187 | High | 7.5 | 2023-09-18 | An Allocation of Resources Without Limits or Throttling vulnerability in SUSE k3s allows attackers with access to K3s servers' apiserver/supervisor port (TCP 6… |
CVE-2023-42359 | Critical | 9.8 | 2023-09-18 | SQL injection vulnerability in Exam Form Submission in PHP with Source Code v.1.0 allows a remote attacker to escalate privileges via the val-username paramete… |
CVE-2023-42253 | Medium | 6.1 | 2023-09-18 | Code-Projects Vehicle Management 1.0 is vulnerable to Cross Site Scripting (XSS) in Add Accounts via Invoice No, To, and Mammul. |
CVE-2023-41929 | High | 7.3 | 2023-09-18 | A DLL hijacking vulnerability in Samsung Memory Card & UFD Authentication Utility PC Software before 1.0.1 could allow a local attacker to escalate privileges… |
CVE-2023-34999 | High | 8.4 | 2023-09-18 | A command injection vulnerability exists in RTS VLink Virtual Matrix Software Versions v5 (< 5.7.6) and v6 (< 6.5.0) that allows an attacker to perform arbitra… |
CVE-2023-43115 | High | 8.8 | 2023-09-18 | In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted PostScript documents because they can switch to the… |
CVE-2023-43114 | Medium | 5.5 | 2023-09-18 | An issue was discovered in Qt before 5.15.16, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3 on Windows. When using the GDI font engine, if a corrupte… |
CVE-2023-42525 | High | 7.5 | 2023-09-18 | Certain WithSecure products allow an infinite loop in a scanning engine via unspecified file types. This affects WithSecure Client Security 15, WithSecure Serv… |
CVE-2023-42524 | High | 7.5 | 2023-09-18 | Certain WithSecure products allow an infinite loop in a scanning engine via unspecified file types. This affects WithSecure Client Security 15, WithSecure Serv… |
CVE-2023-42523 | High | 7.5 | 2023-09-18 | Certain WithSecure products allow a remote crash of a scanning engine via unpacking of a PE file. This affects WithSecure Client Security 15, WithSecure Server… |
CVE-2023-42522 | High | 7.5 | 2023-09-18 | Certain WithSecure products allow a remote crash of a scanning engine via processing of an import struct in a PE file. This affects WithSecure Client Security… |
CVE-2023-42521 | High | 7.5 | 2023-09-18 | Certain WithSecure products allow a remote crash of a scanning engine via processing of a compressed file. This affects WithSecure Client Security 15, WithSecu… |
CVE-2023-5036 | High | 8.8 | 2023-09-18 | Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.15.1. |
CVE-2023-42526 | High | 7.5 | 2023-09-18 | Certain WithSecure products allow a remote crash of a scanning engine via decompression of crafted data files. This affects WithSecure Client Security 15, With… |
CVE-2023-42520 | High | 7.5 | 2023-09-18 | Certain WithSecure products allow a remote crash of a scanning engine via unpacking of crafted data files. This affects WithSecure Client Security 15, WithSecu… |
CVE-2023-5034 | Medium | 6.3 | 2023-09-18 | A vulnerability classified as problematic was found in SourceCodester My Food Recipe 1.0. This vulnerability affects unknown code of the file index.php of the… |