2023 CVEs (page 160)
Page 160 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-36762 | High | 7.3 | 2023-09-12 | Microsoft Word Remote Code Execution Vulnerability |
CVE-2023-36761 | Medium | 6.5 | 2023-09-12 | Microsoft Word Information Disclosure Vulnerability |
CVE-2023-36760 | High | 7.8 | 2023-09-12 | 3D Viewer Remote Code Execution Vulnerability |
CVE-2023-36759 | Medium | 6.7 | 2023-09-12 | Visual Studio Elevation of Privilege Vulnerability |
CVE-2023-36758 | High | 7.8 | 2023-09-12 | Visual Studio Elevation of Privilege Vulnerability |
CVE-2023-36757 | High | 8.0 | 2023-09-12 | Microsoft Exchange Server Spoofing Vulnerability |
CVE-2023-36756 | High | 8.0 | 2023-09-12 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2023-36745 | High | 8.0 | 2023-09-12 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2023-36744 | High | 8.0 | 2023-09-12 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2023-36742 | High | 7.8 | 2023-09-12 | Visual Studio Code Remote Code Execution Vulnerability |
CVE-2023-36740 | High | 7.8 | 2023-09-12 | 3D Viewer Remote Code Execution Vulnerability |
CVE-2023-36739 | High | 7.8 | 2023-09-12 | 3D Viewer Remote Code Execution Vulnerability |
CVE-2023-36736 | Medium | 4.4 | 2023-09-12 | Microsoft Identity Linux Broker Remote Code Execution Vulnerability |
CVE-2023-35355 | High | 7.8 | 2023-09-12 | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability |
CVE-2023-33136 | High | 8.8 | 2023-09-12 | Azure DevOps Server Remote Code Execution Vulnerability |
CVE-2023-29463 | High | 8.8 | 2023-09-12 | The JMX Console within the Rockwell Automation Pavilion8 is exposed to application users and does not require authentication. If exploited, a malicious user c… |
CVE-2023-29332 | High | 7.5 | 2023-09-12 | Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability |
CVE-2023-34470 | Medium | 6.8 | 2023-09-12 | AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper access control via the local network. A successful exploit of this vulnerabi… |
CVE-2023-34469 | Medium | 4.9 | 2023-09-12 | AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper access control via the physical network. A successful exploit of this vulner… |
CVE-2023-0119 | Medium | 5.4 | 2023-09-12 | A stored Cross-site scripting vulnerability was found in foreman. The Comment section in the Hosts tab has incorrect filtering of user input data. As a result… |
CVE-2023-4914 | High | 7.5 | 2023-09-12 | Relative Path Traversal in GitHub repository cecilapp/cecil prior to 7.47.1. |
CVE-2023-4913 | Medium | 6.1 | 2023-09-12 | Cross-site Scripting (XSS) - Reflected in GitHub repository cecilapp/cecil prior to 7.47.1. |
CVE-2023-4863 | High | 8.8 | 2023-09-12 | Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write v… |
CVE-2023-40784 | Critical | 9.8 | 2023-09-12 | DedeCMS 5.7.102 has a File Upload vulnerability via uploads/dede/module_make.php. |
CVE-2023-40218 | Low | 2.0 | 2023-09-12 | An issue was discovered in the NPU kernel driver in Samsung Exynos Mobile Processor 9820, 980, 2100, 2200, 1280, and 1380. An integer overflow can bypass detec… |
CVE-2023-40834 | Critical | 9.8 | 2023-09-12 | OpenCart CMS v4.0.2.2 was discovered to lack a protective mechanism on its login page against excessive login attempts, allowing unauthenticated attackers to g… |
CVE-2023-2071 | Critical | 9.8 | 2023-09-12 | Rockwell Automation FactoryTalk View Machine Edition on the PanelView Plus, improperly verifies user’s input, which allows unauthenticated attacker to achieve… |
CVE-2023-39150 | Critical | 9.8 | 2023-09-12 | ConEmu before commit 230724 does not sanitize title responses correctly for control characters, potentially leading to arbitrary code execution. This is relate… |
CVE-2023-41013 | Medium | 6.1 | 2023-09-12 | Cross Site Scripting (XSS) in Webmail Calendar in IceWarp 10.3.1 allows remote attackers to inject arbitrary web script or HTML via the "p4" field. |
CVE-2023-40712 | Medium | 6.5 | 2023-09-12 | Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a… |
CVE-2023-40611 | Medium | 4.3 | 2023-09-12 | Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail val… |
CVE-2023-39637 | Critical | 9.8 | 2023-09-12 | D-Link DIR-816 A2 1.10 B05 was discovered to contain a command injection vulnerability via the component /goform/Diagnosis. |
CVE-2023-27169 | Medium | 6.5 | 2023-09-12 | Xpand IT Write-back manager v2.3.1 uses a hardcoded salt in license class configuration which leads to the generation of a hardcoded and predictable symmetric… |
CVE-2023-4759 | High | 8.8 | 2023-09-12 | Arbitrary File Overwrite in Eclipse JGit <= 6.6.0 In Eclipse JGit, all versions <= 6.6.0.202305301015-r, a symbolic link present in a specially crafted git re… |
CVE-2023-41846 | High | 7.8 | 2023-09-12 | A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0008), Tecnomatix Plant Simulation V2302 (All versions < V2302.0… |
CVE-2023-41033 | High | 7.8 | 2023-09-12 | A vulnerability has been identified in Parasolid V35.0 (All versions < V35.0.260), Parasolid V35.1 (All versions < V35.1.246), Parasolid V36.0 (All versions <… |
CVE-2023-41032 | High | 7.8 | 2023-09-12 | A vulnerability has been identified in Parasolid V34.1 (All versions < V34.1.258), Parasolid V35.0 (All versions < V35.0.253), Parasolid V35.1 (All versions <… |
CVE-2023-40732 | Low | 3.9 | 2023-09-12 | A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application does not invalidate the sessio… |
CVE-2023-40731 | Medium | 5.7 | 2023-09-12 | A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application allows users to upload arbitrary file types. This could… |
CVE-2023-40730 | High | 7.1 | 2023-09-12 | A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application lacks sufficient authorization… |
CVE-2023-40729 | High | 7.3 | 2023-09-12 | A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application lacks security control to prevent unencrypted communica… |
CVE-2023-40728 | High | 7.3 | 2023-09-12 | A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application stores sensitive application d… |
CVE-2023-40727 | High | 7.8 | 2023-09-12 | A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application uses weak outdated application… |
CVE-2023-40726 | High | 8.8 | 2023-09-12 | A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application server responds with sensitive information about the se… |
CVE-2023-40725 | Medium | 4.0 | 2023-09-12 | A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application returns inconsistent error messages in response to inva… |
CVE-2023-40724 | High | 7.3 | 2023-09-12 | A vulnerability has been identified in QMS Automotive (All versions < V12.39). User credentials are found in memory as plaintext. An attacker could perform a m… |
CVE-2023-38076 | High | 7.8 | 2023-09-12 | A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), Teamcenter Visualization V… |
CVE-2023-38075 | High | 7.8 | 2023-09-12 | A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), Teamcenter Visualization V… |
CVE-2023-38074 | High | 7.8 | 2023-09-12 | A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), Teamcenter Visualization V… |
CVE-2023-38073 | High | 7.8 | 2023-09-12 | A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), Teamcenter Visualization V… |
CVE-2023-38072 | High | 7.8 | 2023-09-12 | A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), Teamcenter Visualization V… |
CVE-2023-38071 | High | 7.8 | 2023-09-12 | A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), Teamcenter Visualization V… |
CVE-2023-38070 | High | 7.8 | 2023-09-12 | A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), Teamcenter Visualization V… |
CVE-2023-28831 | High | 7.5 | 2023-09-12 | The OPC UA implementations (ANSI C and C++) in affected products contain an integer overflow vulnerability that could cause the application to run into an infi… |
CVE-2023-37881 | Medium | 4.9 | 2023-09-12 | Weak access control in Wing FTP Server (Admin Web Client) allows for privilege escalation.This issue affects Wing FTP Server: <= 7.2.0. |
CVE-2023-37879 | Medium | 6.5 | 2023-09-12 | Insecure storage of sensitive information in Wing FTP Server (User Web Client) allows information elicitation.This issue affects Wing FTP Server: <= 7.2.0. |
CVE-2023-37878 | Medium | 6.1 | 2023-09-12 | Insecure default permissions in Wing FTP Server (Admin Web Client) allows for privilege escalation.This issue affects Wing FTP Server: <= 7.2.0. |
CVE-2023-37875 | Low | 3.0 | 2023-09-12 | Improper encoding or escaping of output in Wing FTP Server (User Web Client) allows Cross-Site Scripting (XSS).This issue affects Wing FTP Server: <= 7.2.0. |
CVE-2023-3039 | High | 7.3 | 2023-09-12 | SD ROM Utility, versions prior to 1.0.2.0 contain an Improper Access Control vulnerability. A low-privileged malicious user may potentially exploit this vulne… |
CVE-2023-26142 | Medium | 6.5 | 2023-09-12 | All versions of the package crow are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values. Header values are not prop… |
CVE-2023-40625 | Medium | 5.4 | 2023-09-12 | S4CORE (Manage Purchase Contracts App) - versions 102, 103, 104, 105, 106, 107, does not perform necessary authorization checks for an authenticated user. This… |
CVE-2023-40624 | Medium | 5.5 | 2023-09-12 | SAP NetWeaver AS ABAP (applications based on Unified Rendering) - versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, SAP_BASIS 702, SAP_BASIS… |
CVE-2023-40623 | Medium | 6.2 | 2023-09-12 | SAP BusinessObjects Suite Installer - version 420, 430, allows an attacker within the network to create a directory under temporary directory and link it to a… |
CVE-2023-40622 | Critical | 9.9 | 2023-09-12 | SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, under certain condition allows an authenticated attacker to view… |
CVE-2023-40621 | Medium | 6.3 | 2023-09-12 | SAP PowerDesigner Client - version 16.7, allows an unauthenticated attacker to inject VBScript code in a document and have it opened by an unsuspecting user, t… |
CVE-2023-40309 | Critical | 9.8 | 2023-09-12 | SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resu… |
CVE-2023-4893 | Medium | 6.4 | 2023-09-12 | The Crayon Syntax Highlighter plugin for WordPress is vulnerable to Server Side Request Forgery via the 'crayon' shortcode in versions up to, and including, 2… |
CVE-2023-4890 | Medium | 6.4 | 2023-09-12 | The JQuery Accordion Menu Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dcwp-jquery-accordion' shortcode in versions up to, and… |
CVE-2023-4887 | Medium | 6.4 | 2023-09-12 | The Google Maps Plugin by Intergeo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'intergeo' shortcode in versions up to, and including… |
CVE-2023-4840 | Medium | 6.4 | 2023-09-12 | The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'mappress' shortcode in versions up to, and including, 2… |
CVE-2023-42472 | High | 8.7 | 2023-09-12 | Due to insufficient file type validation, SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) - version 420, allows a report c… |
CVE-2023-41369 | Low | 3.5 | 2023-09-12 | The Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, 107, 108, allows an attacker to upload the XML file as an at… |
CVE-2023-41368 | Low | 2.7 | 2023-09-12 | The OData service of the S4 HANA (Manage checkbook apps) - versions 102, 103, 104, 105, 106, 107, allows an attacker to change the checkbook name by simulating… |
CVE-2023-41367 | Medium | 5.3 | 2023-09-12 | Due to missing authentication check in webdynpro application, an unauthorized user in SAP NetWeaver (Guided Procedures) - version 7.50, can gain access to admi… |
CVE-2023-40308 | High | 7.5 | 2023-09-12 | SAP CommonCryptoLib allows an unauthenticated attacker to craft a request, which when submitted to an open port causes a memory corruption error in a library w… |
CVE-2023-37489 | Medium | 5.3 | 2023-09-12 | Due to the lack of validation, SAP BusinessObjects Business Intelligence Platform (Version Management System) - version 403, permits an unauthenticated user to… |
CVE-2023-32558 | High | 7.5 | 2023-09-12 | The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnerability affects all users using the expe… |
CVE-2023-32005 | Medium | 5.3 | 2023-09-12 | A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a no… |
CVE-2023-25519 | High | 7.8 | 2023-09-12 | NVIDIA ConnectX Host Firmware for the BlueField Data Processing Unit contains a vulnerability where a restricted host may cause an incorrect user management e… |
CVE-2023-4899 | High | 8.8 | 2023-09-12 | SQL Injection in GitHub repository mintplex-labs/anything-llm prior to 0.0.1. |
CVE-2023-4898 | High | 7.5 | 2023-09-12 | Authentication Bypass by Primary Weakness in GitHub repository mintplex-labs/anything-llm prior to 0.0.1. |
CVE-2023-41990 | High | 7.8 | 2023-09-12 | The issue was addressed with improved handling of caches. This issue is fixed in tvOS 16.3, iOS 16.3 and iPadOS 16.3, macOS Monterey 12.6.8, macOS Big Sur 11.7… |
CVE-2023-40442 | Low | 3.3 | 2023-09-12 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS 15.7.8… |
CVE-2023-40440 | High | 7.5 | 2023-09-12 | This issue was addressed with improved state management of S/MIME encrypted emails. This issue is fixed in macOS Monterey 12.6.8. A S/MIME encrypted email may… |
CVE-2023-39069 | Critical | 9.8 | 2023-09-11 | An issue in StrangeBee TheHive v.5.0.8, v.4.1.21 and Cortex v.3.1.6 allows a remote attacker to gain privileges via Active Directory authentication mechanism. |
CVE-2023-41879 | High | 7.5 | 2023-09-11 | Magento LTS is the official OpenMage LTS codebase. Guest orders may be viewed without authentication using a "guest-view" cookie which contains the order's "pr… |
CVE-2023-38878 | Medium | 6.1 | 2023-09-11 | A reflected cross-site scripting (XSS) vulnerability in DevCode OpenSTAManager versions 2.4.24 to 2.4.47 may allow a remote attacker to execute arbitrary JavaS… |
CVE-2023-4897 | Critical | 9.8 | 2023-09-11 | Relative Path Traversal in GitHub repository mintplex-labs/anything-llm prior to 0.0.1. |
CVE-2023-35687 | High | 7.8 | 2023-09-11 | In MtpPropertyValue of MtpProperty.h, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no a… |
CVE-2023-35684 | High | 8.8 | 2023-09-11 | In avdt_msg_asmbl of avdt_msg.cc, there is a possible out of bounds write due to an integer overflow. This could lead to paired device escalation of privilege… |
CVE-2023-35683 | Medium | 5.5 | 2023-09-11 | In bindSelection of DatabaseUtils.java, there is a possible way to access files from other applications due to SQL injection. This could lead to local informat… |
CVE-2023-35682 | High | 7.8 | 2023-09-11 | In hasPermissionForActivity of PackageManagerHelper.java, there is a possible way to start arbitrary components due to a confused deputy. This could lead to lo… |
CVE-2023-35681 | Critical | 9.8 | 2023-09-11 | In eatt_l2cap_reconfig_completed of eatt_impl.h, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution w… |
CVE-2023-35680 | Medium | 5.5 | 2023-09-11 | In multiple locations, there is a possible way to import contacts belonging to other users due to a confused deputy. This could lead to local information discl… |
CVE-2023-35679 | Medium | 5.5 | 2023-09-11 | In MtpPropertyValue of MtpProperty.h, there is a possible out of bounds read due to uninitialized data. This could lead to local information disclosure with no… |
CVE-2023-35677 | Medium | 5.5 | 2023-09-11 | In onCreate of DeviceAdminAdd.java, there is a possible way to forcibly add a device admin due to a missing permission check. This could lead to local denial o… |
CVE-2023-35676 | High | 7.8 | 2023-09-11 | In createQuickShareAction of SaveImageInBackgroundTask.java, there is a possible way to trigger a background activity launch due to an unsafe PendingIntent. Th… |
CVE-2023-35675 | Medium | 5.5 | 2023-09-11 | In loadMediaResumptionControls of MediaResumeListener.kt, there is a possible way to play and listen to media files played by another user on the same device d… |
CVE-2023-35674 | High | 7.8 | 2023-09-11 | In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation… |
CVE-2023-35673 | High | 8.8 | 2023-09-11 | In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote (proximal/adjacent) code e… |