2023 CVEs (page 159)
Page 159 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-39916 | Critical | 9.3 | 2023-09-13 | NLnet Labs’ Routinator 0.9.0 up to and including 0.12.1 as well as 0.14.0 up to and including 0.14.2 contains a possible path traversal vulnerability in the op… |
CVE-2023-39915 | High | 7.5 | 2023-09-13 | NLnet Labs' Routinator up to and including version 0.12.1 may crash when trying to parse certain malformed RPKI objects. This is due to insufficient input chec… |
CVE-2023-39914 | High | 7.5 | 2023-09-13 | NLnet Labs' bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data with an error. This… |
CVE-2023-3935 | Critical | 9.8 | 2023-09-13 | A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE an… |
CVE-2023-38215 | Medium | 5.4 | 2023-09-13 | Adobe Experience Manager versions 6.5.17 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2023-38214 | Medium | 5.4 | 2023-09-13 | Adobe Experience Manager versions 6.5.17 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2023-40717 | Medium | 5.3 | 2023-09-13 | A use of hard-coded credentials vulnerability [CWE-798] in FortiTester 2.3.0 through 7.2.3 may allow an attacker who managed to get a shell on the device to ac… |
CVE-2023-40715 | Medium | 5.5 | 2023-09-13 | A cleartext storage of sensitive information vulnerability [CWE-312] in FortiTester 2.3.0 through 7.2.3 may allow an attacker with access to the DB contents to… |
CVE-2023-36642 | Medium | 6.7 | 2023-09-13 | An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiTester 3.0.0 through 7.2.3 may… |
CVE-2023-36638 | Medium | 4.3 | 2023-09-13 | An improper privilege management vulnerability [CWE-269] in FortiManager 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0… |
CVE-2023-36634 | High | 7.1 | 2023-09-13 | An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiAP-U 7.0.0, 6.2.0 through… |
CVE-2023-36551 | Medium | 4.3 | 2023-09-13 | A exposure of sensitive information to an unauthorized actor in Fortinet FortiSIEM version 6.7.0 through 6.7.5 allows attacker to information disclosure via a… |
CVE-2023-34984 | High | 7.5 | 2023-09-13 | A protection mechanism failure in Fortinet FortiWeb 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.0 through 6.4.3, 6.3.6 through 6.3.23 allows attacker to exec… |
CVE-2023-29183 | High | 8.0 | 2023-09-13 | An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiProxy 7.2.0 through 7.2.4, 7.0.0 through… |
CVE-2023-27998 | Medium | 5.3 | 2023-09-13 | A lack of custom error pages vulnerability [CWE-756] in FortiPresence versions 1.2.0 through 1.2.1 and all versions of 1.1 and 1.0 may allow an unauthenticated… |
CVE-2023-25608 | Medium | 5.5 | 2023-09-13 | An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiAP-W2 7.2.0 through 7.2.1… |
CVE-2023-41081 | High | 7.5 | 2023-09-13 | Important: Authentication Bypass CVE-2023-41081 The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included … |
CVE-2023-4039 | Medium | 4.8 | 2023-09-13 | **DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow… |
CVE-2023-29306 | Medium | 6.1 | 2023-09-13 | Adobe Connect versions 12.3 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to vi… |
CVE-2023-29305 | Medium | 6.1 | 2023-09-13 | Adobe Connect versions 12.3 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to vi… |
CVE-2023-26369 | High | 7.8 | 2023-09-13 | Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerabil… |
CVE-2023-4400 | Medium | 6.2 | 2023-09-13 | A password management vulnerability in Skyhigh Secure Web Gateway (SWG) in main releases 11.x prior to 11.2.14, 10.x prior to 10.2.25 and controlled release 1… |
CVE-2023-4917 | Medium | 5.3 | 2023-09-13 | The Leyka plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.30.7 via the 'leyka_ajax_get_env_and_options… |
CVE-2023-4916 | High | 8.8 | 2023-09-13 | The Login with phone number plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.6. This is due to missing no… |
CVE-2023-4915 | Medium | 5.3 | 2023-09-13 | The WP User Control plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 1.5.3. This is due to the plugin using… |
CVE-2023-4213 | High | 8.8 | 2023-09-13 | The Simplr Registration Form Plus+ plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 2.4.5. This is due… |
CVE-2023-4153 | High | 8.8 | 2023-09-13 | The BAN Users plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.5.3 due to a missing capability check on the 'w3de… |
CVE-2023-4928 | High | 7.2 | 2023-09-13 | SQL Injection in GitHub repository instantsoft/icms2 prior to 2.16.1. |
CVE-2023-4813 | Medium | 5.9 | 2023-09-12 | A flaw has been identified in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. Th… |
CVE-2023-41423 | Medium | 5.4 | 2023-09-12 | Cross Site Scripting vulnerability in WP Githuber MD plugin v.1.16.2 allows a remote attacker to execute arbitrary code via a crafted payload to the new articl… |
CVE-2023-39073 | Critical | 9.8 | 2023-09-12 | An issue in SNMP Web Pro v.1.1 allows a remote attacker to execute arbitrary code and obtain senstive information via a crafted request. |
CVE-2023-4909 | Medium | 4.3 | 2023-09-12 | Inappropriate implementation in Interstitials in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to obfuscate security UI via a crafted HTML pag… |
CVE-2023-4908 | Medium | 4.3 | 2023-09-12 | Inappropriate implementation in Picture in Picture in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML pa… |
CVE-2023-4907 | Medium | 4.3 | 2023-09-12 | Inappropriate implementation in Intents in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to obfuscate security UI via a crafted HTM… |
CVE-2023-4906 | Medium | 4.3 | 2023-09-12 | Insufficient policy enforcement in Autofill in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to bypass Autofill restrictions via a crafted HTM… |
CVE-2023-4905 | Medium | 4.3 | 2023-09-12 | Inappropriate implementation in Prompts in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromi… |
CVE-2023-4904 | Medium | 4.3 | 2023-09-12 | Insufficient policy enforcement in Downloads in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to bypass Enterprise policy restrictions via a c… |
CVE-2023-4903 | Medium | 4.3 | 2023-09-12 | Inappropriate implementation in Custom Mobile Tabs in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a craf… |
CVE-2023-4902 | Medium | 4.3 | 2023-09-12 | Inappropriate implementation in Input in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium… |
CVE-2023-4901 | Medium | 4.3 | 2023-09-12 | Inappropriate implementation in Prompts in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to potentially spoof security UI via a crafted HTML p… |
CVE-2023-4900 | Medium | 4.3 | 2023-09-12 | Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to obfuscate a permission prompt via a… |
CVE-2023-41885 | Medium | 5.3 | 2023-09-12 | Piccolo is an ORM and query builder which supports asyncio. In versions 0.120.0 and prior, the implementation of `BaseUser.login` leaks enough information to a… |
CVE-2023-4921 | High | 7.8 | 2023-09-12 | A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. When the plug qdisc… |
CVE-2023-4918 | High | 8.8 | 2023-09-12 | A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile. When a user registers itself through registration flow, the "password" an… |
CVE-2023-41331 | Critical | 9.8 | 2023-09-12 | SOFARPC is a Java RPC framework. Versions prior to 5.11.0 are vulnerable to remote command execution. Through a carefully crafted payload, an attacker can achi… |
CVE-2023-3712 | Medium | 6.6 | 2023-09-12 | Files or Directories Accessible to External Parties vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Privilege Escalation.This… |
CVE-2023-3711 | Medium | 6.4 | 2023-09-12 | Session Fixation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Session Credential Falsification through Prediction.This issu… |
CVE-2023-3710 | Critical | 9.9 | 2023-09-12 | Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injection.This issue affects PM43 versions p… |
CVE-2023-39215 | High | 7.1 | 2023-09-12 | Improper authentication in Zoom clients may allow an authenticated user to conduct a denial of service via network access. |
CVE-2023-39208 | Medium | 6.5 | 2023-09-12 | Improper input validation in Zoom Desktop Client for Linux before version 5.15.10 may allow an unauthenticated user to conduct a denial of service via network… |
CVE-2023-39201 | High | 7.2 | 2023-09-12 | Untrusted search path in CleanZoom before file date 07/24/2023 may allow a privileged user to conduct an escalation of privilege via local access. |
CVE-2023-21523 | Medium | 5.4 | 2023-09-12 | A Stored Cross-site Scripting (XSS) vulnerability in the Management Console (User Management and Alerts) of BlackBerry AtHoc version 7.1… |
CVE-2023-21520 | Medium | 5.3 | 2023-09-12 | A PII Enumeration via Credential Recovery in the Self Service (Credential Recovery) of BlackBerry AtHoc version 7.15 could allow an atta… |
CVE-2023-4501 | Critical | 9.8 | 2023-09-12 | User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and Enter… |
CVE-2023-30962 | Medium | 6.8 | 2023-09-12 | The Gotham Cerberus service was found to have a stored cross-site scripting (XSS) vulnerability that could have allowed an attacker with access to Gotham to la… |
CVE-2023-21522 | Medium | 6.1 | 2023-09-12 | A Reflected Cross-site Scripting (XSS) vulnerability in the Management Console (Reports) of BlackBerry AtHoc version 7.15 could allow an attacker to potential… |
CVE-2023-21521 | High | 7.2 | 2023-09-12 | An SQL Injection vulnerability in the Management Console (Operator Audit Trail) of BlackBerry AtHoc version 7.15 could allow an attacker to potentially read… |
CVE-2023-41764 | Medium | 5.5 | 2023-09-12 | Microsoft Office Spoofing Vulnerability |
CVE-2023-38164 | High | 7.6 | 2023-09-12 | Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability |
CVE-2023-38163 | High | 7.8 | 2023-09-12 | Windows Defender Attack Surface Reduction Security Feature Bypass |
CVE-2023-38162 | High | 7.5 | 2023-09-12 | DHCP Server Service Denial of Service Vulnerability |
CVE-2023-38161 | High | 7.8 | 2023-09-12 | Windows GDI Elevation of Privilege Vulnerability |
CVE-2023-38160 | Medium | 5.5 | 2023-09-12 | Windows TCP/IP Information Disclosure Vulnerability |
CVE-2023-38156 | High | 7.2 | 2023-09-12 | Azure HDInsight Apache Ambari JDBC Injection Elevation of Privilege Vulnerability |
CVE-2023-38155 | High | 7.0 | 2023-09-12 | Azure DevOps Server Remote Code Execution Vulnerability |
CVE-2023-38152 | Medium | 5.3 | 2023-09-12 | DHCP Server Service Information Disclosure Vulnerability |
CVE-2023-38150 | High | 7.8 | 2023-09-12 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2023-38149 | High | 7.5 | 2023-09-12 | Windows TCP/IP Denial of Service Vulnerability |
CVE-2023-38148 | High | 8.8 | 2023-09-12 | Internet Connection Sharing (ICS) Remote Code Execution Vulnerability |
CVE-2023-38147 | High | 8.8 | 2023-09-12 | Windows Miracast Wireless Display Remote Code Execution Vulnerability |
CVE-2023-38146 | High | 8.8 | 2023-09-12 | Windows Themes Remote Code Execution Vulnerability |
CVE-2023-38144 | High | 7.8 | 2023-09-12 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
CVE-2023-38143 | High | 7.8 | 2023-09-12 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
CVE-2023-38142 | High | 7.8 | 2023-09-12 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2023-38141 | High | 7.8 | 2023-09-12 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2023-38140 | Medium | 5.5 | 2023-09-12 | Windows Kernel Information Disclosure Vulnerability |
CVE-2023-38139 | High | 7.8 | 2023-09-12 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2023-36886 | High | 7.6 | 2023-09-12 | Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability |
CVE-2023-36805 | High | 7.0 | 2023-09-12 | Windows MSHTML Platform Security Feature Bypass Vulnerability |
CVE-2023-36804 | High | 7.8 | 2023-09-12 | Windows GDI Elevation of Privilege Vulnerability |
CVE-2023-36803 | Medium | 5.5 | 2023-09-12 | Windows Kernel Information Disclosure Vulnerability |
CVE-2023-36802 | High | 7.8 | 2023-09-12 | Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability |
CVE-2023-36801 | Medium | 5.3 | 2023-09-12 | DHCP Server Service Information Disclosure Vulnerability |
CVE-2023-36800 | High | 7.6 | 2023-09-12 | Dynamics Finance and Operations Cross-site Scripting Vulnerability |
CVE-2023-36799 | Medium | 6.5 | 2023-09-12 | .NET Core and Visual Studio Denial of Service Vulnerability |
CVE-2023-36796 | High | 7.8 | 2023-09-12 | Visual Studio Remote Code Execution Vulnerability |
CVE-2023-36794 | High | 7.8 | 2023-09-12 | Visual Studio Remote Code Execution Vulnerability |
CVE-2023-36793 | High | 7.8 | 2023-09-12 | Visual Studio Remote Code Execution Vulnerability |
CVE-2023-36792 | High | 7.8 | 2023-09-12 | Visual Studio Remote Code Execution Vulnerability |
CVE-2023-36788 | High | 7.8 | 2023-09-12 | .NET Framework Remote Code Execution Vulnerability |
CVE-2023-36777 | Medium | 5.7 | 2023-09-12 | Microsoft Exchange Server Information Disclosure Vulnerability |
CVE-2023-36773 | High | 7.8 | 2023-09-12 | 3D Builder Remote Code Execution Vulnerability |
CVE-2023-36772 | High | 7.8 | 2023-09-12 | 3D Builder Remote Code Execution Vulnerability |
CVE-2023-36771 | High | 7.8 | 2023-09-12 | 3D Builder Remote Code Execution Vulnerability |
CVE-2023-36770 | High | 7.8 | 2023-09-12 | 3D Builder Remote Code Execution Vulnerability |
CVE-2023-36767 | Medium | 4.3 | 2023-09-12 | Microsoft Office Security Feature Bypass Vulnerability |
CVE-2023-36766 | High | 7.8 | 2023-09-12 | Microsoft Excel Information Disclosure Vulnerability |
CVE-2023-36765 | High | 7.8 | 2023-09-12 | Microsoft Office Elevation of Privilege Vulnerability |
CVE-2023-36764 | High | 8.8 | 2023-09-12 | Microsoft SharePoint Server Elevation of Privilege Vulnerability |
CVE-2023-36763 | High | 7.5 | 2023-09-12 | Microsoft Outlook Information Disclosure Vulnerability |