2023 CVEs (page 156)
Page 156 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-42464 | Critical | 9.8 | 2023-09-20 | A Type Confusion vulnerability was found in the Spotlight RPC functions in afpd in Netatalk 3.1.x before 3.1.17. When parsing Spotlight RPC packets, one encode… |
CVE-2023-43478 | High | 8.8 | 2023-09-20 | fake_upload.cgi on the Telstra Smart Modem Gen 2 (Arcadyan LH1000), firmware versions < 0.18.15r, allows unauthenticated attackers to upload firmware images an… |
CVE-2023-43207 | Critical | 9.8 | 2023-09-20 | D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function config_upload_handler. This vulnerability allows… |
CVE-2023-43206 | Critical | 9.8 | 2023-09-20 | D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function web_cert_download_handler. This vulnerability all… |
CVE-2023-43204 | Critical | 9.8 | 2023-09-20 | D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function sub_2EF50. This vulnerability allows attackers to… |
CVE-2023-43203 | Critical | 9.8 | 2023-09-20 | D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a stack overflow vulnerability in the function update_users. |
CVE-2023-43202 | Critical | 9.8 | 2023-09-20 | D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function pcap_download_handler. This vulnerability allows… |
CVE-2023-43201 | Critical | 9.8 | 2023-09-20 | D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the hi_up parameter in the qos_ext.asp function. |
CVE-2023-43200 | Critical | 9.8 | 2023-09-20 | D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the id parameter in the yyxz.data function. |
CVE-2023-43199 | Critical | 9.8 | 2023-09-20 | D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the prev parameter in the H5/login.cgi function. |
CVE-2023-43198 | Critical | 9.8 | 2023-09-20 | D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the popupId parameter in the H5/hi_block.asp function. |
CVE-2023-43197 | Critical | 9.8 | 2023-09-20 | D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the fn parameter in the tgfile.asp function. |
CVE-2023-43196 | Critical | 9.8 | 2023-09-20 | D-Link DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the zn_jb parameter in the arp_sys.asp function. |
CVE-2023-41902 | High | 7.8 | 2023-09-20 | An XPC misconfiguration vulnerability in CoreCode MacUpdater before 2.3.8, and 3.x before 3.1.2, allows attackers to escalate privileges by crafting malicious… |
CVE-2023-0462 | High | 8.0 | 2023-09-20 | An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary code on the underlying operating system by setti… |
CVE-2023-0118 | Critical | 9.1 | 2023-09-20 | An arbitrary code execution flaw was found in Foreman. This flaw allows an admin user to bypass safe mode in templates and execute arbitrary code on the underl… |
CVE-2023-4236 | High | 7.5 | 2023-09-20 | A flaw in the networking code handling DNS-over-TLS queries may cause `named` to terminate unexpectedly due to an assertion failure. This happens when internal… |
CVE-2023-43477 | Medium | 6.8 | 2023-09-20 | The ping_from parameter of ping_tracerte.cgi in the web UI of Telstra Smart Modem Gen 2 (Arcadyan LH1000), firmware versions < 0.18.15r, was not properly sanit… |
CVE-2023-3341 | High | 7.5 | 2023-09-20 | The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing. Recursion depth is only limited by… |
CVE-2023-0829 | High | 8.8 | 2023-09-20 | Plesk 17.0 through 18.0.31 version, is vulnerable to a Cross-Site Scripting. A malicious subscription owner (either a customer or an additional user), can full… |
CVE-2023-5042 | High | 7.5 | 2023-09-20 | Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before bu… |
CVE-2023-5084 | Low | 3.9 | 2023-09-20 | Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.8.8. |
CVE-2023-4853 | High | 8.1 | 2023-09-20 | A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in inco… |
CVE-2023-34047 | Low | 3.1 | 2023-09-20 | A batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context with values, including security contex… |
CVE-2023-41375 | High | 7.8 | 2023-09-20 | Use after free vulnerability exists in Kostac PLC Programming Software Version 1.6.11.0. Arbitrary code may be executed by having a user open a specially craft… |
CVE-2023-41374 | High | 7.8 | 2023-09-20 | Double free issue exists in Kostac PLC Programming Software Version 1.6.11.0 and earlier. Arbitrary code may be executed by having a user open a specially craf… |
CVE-2023-22644 | Medium | 5.5 | 2023-09-20 | A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malici… |
CVE-2023-43621 | Medium | 4.7 | 2023-09-20 | An issue was discovered in Croc through 9.6.5. The shared secret, located on a command line, can be read by local users who list all processes and their argume… |
CVE-2023-43620 | High | 7.8 | 2023-09-20 | An issue was discovered in Croc through 9.6.5. A sender may place ANSI or CSI escape sequences in a filename to attack the terminal device of a receiver. |
CVE-2023-43619 | High | 7.8 | 2023-09-20 | An issue was discovered in Croc through 9.6.5. A sender may send dangerous new files to a receiver, such as executable content or a .ssh/authorized_keys file. |
CVE-2023-43618 | Medium | 5.3 | 2023-09-20 | An issue was discovered in Croc through 9.6.5. The protocol requires a sender to provide its local IP addresses in cleartext via an ips? message. |
CVE-2023-43617 | Medium | 5.3 | 2023-09-20 | An issue was discovered in Croc through 9.6.5. When a custom shared secret is used, the sender and receiver may divulge parts of this secret to an untrusted Re… |
CVE-2023-43616 | Medium | 5.5 | 2023-09-20 | An issue was discovered in Croc through 9.6.5. A sender can cause a receiver to overwrite files during ZIP extraction. |
CVE-2023-2163 | Critical | 10.0 | 2023-09-20 | Incorrect verifier pruning in BPF in Linux Kernel >=5.4 leads to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kerne… |
CVE-2023-26144 | Medium | 5.3 | 2023-09-20 | Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanB… |
CVE-2023-5063 | Medium | 6.4 | 2023-09-20 | The Widget Responsive for Youtube plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'youtube' shortcode in versions up to, and including, 1… |
CVE-2023-5062 | Medium | 6.4 | 2023-09-20 | The WordPress Charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wp_charts' shortcode in versions up to, and including, 0.7.0 due to… |
CVE-2023-4088 | Critical | 9.3 | 2023-09-20 | Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products allows a malicious local attacker to e… |
CVE-2023-31015 | Medium | 6.6 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in the REST service where a host user may cause as improper authentication issue. A successful exploit of this vul… |
CVE-2023-31014 | Medium | 4.2 | 2023-09-20 | NVIDIA GeForce Now for Android contains a vulnerability in the game launcher component, where a malicious application on the same device can process the implic… |
CVE-2023-31013 | Medium | 6.1 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in the REST service, where an attacker may cause improper input validation. A successful exploit of this vulnerabi… |
CVE-2023-31012 | Medium | 6.1 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in the REST service where an attacker may cause improper input validation. A successful exploit of this vulnerabil… |
CVE-2023-31011 | Medium | 5.2 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in the REST service where an attacker may cause improper input validation. A successful exploit of this vulnerabil… |
CVE-2023-31010 | Medium | 6.8 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause improper input validation. A successful exploit of this vulnerability may lea… |
CVE-2023-38888 | Critical | 9.6 | 2023-09-20 | Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code… |
CVE-2023-38887 | High | 8.8 | 2023-09-20 | File Upload vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to execute arbitrary code and obtain sensitive information via the e… |
CVE-2023-38886 | High | 7.2 | 2023-09-20 | An issue in Dolibarr ERP CRM v.17.0.1 and before allows a remote privileged attacker to execute arbitrary code via a crafted command/script. |
CVE-2023-31009 | High | 8.3 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in the REST service, where an attacker may cause improper input validation. A successful exploit of this vulnerabi… |
CVE-2023-31008 | High | 7.3 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause improper input validation. A successful exploit of this vulnerability may lea… |
CVE-2023-25534 | Medium | 5.7 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause improper input validation. A successful exploit of this vulnerability may lea… |
CVE-2023-25533 | High | 8.3 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in the web UI, where an attacker may cause improper input validation. A successful exploit of this vulnerability m… |
CVE-2023-25532 | Medium | 6.5 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause insufficient protection of credentials. A successful exploit of this vulnerab… |
CVE-2023-25531 | High | 7.6 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause insufficient protection of credentials. A successful exploit of this vulnerab… |
CVE-2023-25530 | High | 8.0 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in the KVM service, where an attacker may cause improper input validation. A successful exploit of this vulnerabil… |
CVE-2023-25529 | High | 8.0 | 2023-09-20 | NVIDIA DGX H100 BMC and DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause a leak of another user’s sess… |
CVE-2023-25528 | High | 8.8 | 2023-09-20 | NVIDIA DGX H100 baseboard management controller (BMC) contains a vulnerability in a web server plugin, where an unauthenticated attacker may cause a stack over… |
CVE-2023-25527 | High | 7.8 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in the host KVM daemon, where an authenticated local attacker may cause corruption of kernel memory. A successful… |
CVE-2023-25526 | Medium | 6.5 | 2023-09-20 | NVIDIA Cumulus Linux contains a vulnerability in neighmgrd and nlmanager where an attacker on an adjacent network may cause an uncaught exception by injecting… |
CVE-2023-25525 | High | 7.5 | 2023-09-20 | NVIDIA Cumulus Linux contains a vulnerability in forwarding where a VxLAN-encapsulated IPv6 packet received on an SVI interface with DMAC/DIPv6 set to the link… |
CVE-2023-39575 | Medium | 5.4 | 2023-09-20 | A reflected cross-site scripting (XSS) vulnerability in the url_str URL parameter of ISL ARP Guard v4.0.2 allows attackers to execute arbitrary web scripts or… |
CVE-2023-36319 | High | 8.8 | 2023-09-20 | File Upload vulnerability in Openupload Stable v.0.4.3 allows a remote attacker to execute arbitrary code via the action parameter of the compress-inc.php file. |
CVE-2023-40934 | High | 7.2 | 2023-09-19 | A SQL injection vulnerability in Nagios XI 5.11.1 and below allows authenticated attackers with privileges to manage host escalations in the Core Configuration… |
CVE-2023-40933 | High | 8.8 | 2023-09-19 | A SQL injection vulnerability in Nagios XI v5.11.1 and below allows authenticated attackers with announcement banner configuration privileges to execute arbitr… |
CVE-2023-40932 | Medium | 5.4 | 2023-09-19 | A Cross-site scripting (XSS) vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom logo component to inj… |
CVE-2023-40931 | Medium | 6.5 | 2023-09-19 | A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via… |
CVE-2023-4376 | Medium | 4.8 | 2023-09-19 | The Serial Codes Generator and Validator with WooCommerce Support WordPress plugin before 2.4.15 does not sanitise and escape some of its settings, which could… |
CVE-2023-2995 | Medium | 4.8 | 2023-09-19 | The Leyka WordPress plugin before 3.30.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Sto… |
CVE-2023-43566 | Low | 3.5 | 2023-09-19 | In JetBrains TeamCity before 2023.05.4 stored XSS was possible during nodes configuration |
CVE-2023-42793 | Critical | 9.8 | 2023-09-19 | In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible |
CVE-2023-22513 | High | 8.8 | 2023-09-19 | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 8.0.0 of Bitbucket Data Center and Server. This RCE (Remote Code Executi… |
CVE-2023-42452 | Medium | 6.1 | 2023-09-19 | Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.x branch prior to versions 4.0.10, 4.2.8, and 4.2.0-rc2, under… |
CVE-2023-42451 | High | 7.4 | 2023-09-19 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2, under certain circumstances… |
CVE-2023-42450 | Medium | 5.4 | 2023-09-19 | Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 4.2.0-beta1 and prior to version 4.2.0-rc2, by crafting specifi… |
CVE-2023-38356 | High | 8.1 | 2023-09-19 | MiniTool Power Data Recovery 11.6 contains an insecure installation process that allows attackers to achieve remote code execution through a man in the middle… |
CVE-2023-38355 | High | 8.1 | 2023-09-19 | MiniTool Movie Maker 7.0 contains an insecure installation process that allows attackers to achieve remote code execution through a man in the middle attack. |
CVE-2023-38354 | High | 8.1 | 2023-09-19 | MiniTool Shadow Maker version 4.1 contains an insecure installation process that allows attackers to achieve remote code execution through a man in the middle… |
CVE-2023-38353 | Medium | 5.9 | 2023-09-19 | MiniTool Power Data Recovery version 11.6 and before contains an insecure in-app payment system that allows attackers to steal highly sensitive information thr… |
CVE-2023-38352 | High | 8.1 | 2023-09-19 | MiniTool Partition Wizard 12.8 contains an insecure update mechanism that allows attackers to achieve remote code execution through a man in the middle attack. |
CVE-2023-38351 | High | 8.1 | 2023-09-19 | MiniTool Partition Wizard 12.8 contains an insecure installation mechanism that allows attackers to achieve remote code execution through a man in the middle a… |
CVE-2023-32182 | Medium | 5.9 | 2023-09-19 | A Improper Link Resolution Before File Access ('Link Following') vulnerability in SUSE SUSE Linux Enterprise Desktop 15 SP5 postfix, SUSE SUSE Linux Enterprise… |
CVE-2023-42447 | High | 8.6 | 2023-09-19 | blurhash-rs is a pure Rust implementation of Blurhash, software for encoding images into ASCII strings that can be turned into a gradient of colors representin… |
CVE-2023-42444 | High | 8.6 | 2023-09-19 | phonenumber is a library for parsing, formatting and validating international phone numbers. Prior to versions `0.3.3+8.13.9` and `0.2.5+8.11.3`, the phonenumb… |
CVE-2023-41890 | High | 7.5 | 2023-09-19 | Sustainsys.Saml2 library adds SAML2P support to ASP.NET web sites, allowing the web site to act as a SAML2 Service Provider. Prior to versions 1.0.3 and 2.9.2… |
CVE-2023-3892 | Medium | 5.6 | 2023-09-19 | Improper Restriction of XML External Entity Reference vulnerability in MIM Assistant and Client DICOM RTst Loading modules allows XML Entity Linking / XML Exte… |
CVE-2023-4096 | High | 8.6 | 2023-09-19 | Weak password recovery mechanism vulnerability in Fujitsu Arconte Áurea version 1.5.0.0, which exploitation could allow an attacker to perform a brute force at… |
CVE-2023-4095 | Medium | 5.3 | 2023-09-19 | User enumeration vulnerability in Arconte Áurea 1.5.0.0 version. The exploitation of this vulnerability could allow an attacker to obtain a list of registered… |
CVE-2023-4094 | Medium | 6.5 | 2023-09-19 | ARCONTE Aurea's authentication system, in its 1.5.0.0 version, could allow an attacker to make incorrect access requests in order to block each legitimate acco… |
CVE-2023-4093 | Medium | 5.5 | 2023-09-19 | Reflected and persistent XSS vulnerability in Arconte Áurea, in its 1.5.0.0 version. The exploitation of this vulnerability could allow an attacker to inject m… |
CVE-2023-41179 | High | 7.2 | 2023-09-19 | A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security and Worry-Free Busine… |
CVE-2023-31808 | High | 7.2 | 2023-09-19 | Technicolor TG670 10.5.N.9 devices contain multiple accounts with hard-coded passwords. One account has administrative privileges, allowing for unrestricted ac… |
CVE-2023-4092 | High | 8.8 | 2023-09-19 | SQL injection vulnerability in Arconte Áurea, in its 1.5.0.0 version. The exploitation of this vulnerability could allow an attacker to read sensitive data fro… |
CVE-2023-41834 | Medium | 6.1 | 2023-09-19 | Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Flink Stateful Functions 3.1.0, 3.1.1 and 3.2.0 allows remote attackers to inject arbitrary… |
CVE-2023-23957 | Medium | 5.4 | 2023-09-19 | An authenticated user can see and modify the value for ‘next’ query parameter in Symantec Identity Portal 14.4 |
CVE-2023-32649 | High | 7.5 | 2023-09-19 | A Denial of Service (Dos) vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields used in the Asset Intelligence… |
CVE-2023-2567 | High | 8.8 | 2023-09-19 | A SQL Injection vulnerability has been found in Nozomi Networks Guardian and CMC, due to improper input validation in certain parameters used in the Query func… |
CVE-2023-29245 | High | 8.1 | 2023-09-19 | A SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields used in the Asset Intelligence functional… |
CVE-2023-32186 | High | 7.5 | 2023-09-19 | A Allocation of Resources Without Limits or Throttling vulnerability in SUSE RKE2 allows attackers with access to K3s servers apiserver/supervisor port (TCP 6… |
CVE-2023-32184 | High | 7.8 | 2023-09-19 | A Insecure Storage of Sensitive Information vulnerability in openSUSE opensuse-welcome allows local attackers to execute code as the user that runs opensuse-we… |
CVE-2023-0773 | Critical | 9.1 | 2023-09-19 | The vulnerability exists in Uniview IP Camera due to identification and authentication failure at its web-based management interface. A remote attacker could e… |
CVE-2023-41387 | Critical | 9.1 | 2023-09-19 | A SQL injection in the flutter_downloader component through 1.11.1 for iOS allows remote attackers to steal session tokens and overwrite arbitrary files inside… |