2023 CVEs (page 163)
Page 163 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-38485 | High | 8.0 | 2023-09-06 | Vulnerabilities exist in the BIOS implementation of Aruba 9200 and 9000 Series Controllers and Gateways that could allow an attacker to execute arbitrary code… |
CVE-2023-38484 | High | 8.0 | 2023-09-06 | Vulnerabilities exist in the BIOS implementation of Aruba 9200 and 9000 Series Controllers and Gateways that could allow an attacker to execute arbitrary code… |
CVE-2023-20269 | Medium | 5.0 | 2023-09-06 | A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could al… |
CVE-2023-20263 | Medium | 4.7 | 2023-09-06 | A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker to redirect a user to… |
CVE-2023-20243 | High | 8.6 | 2023-09-06 | A vulnerability in the RADIUS message processing feature of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause the a… |
CVE-2023-20238 | Critical | 10.0 | 2023-09-06 | A vulnerability in the single sign-on (SSO) implementation of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform cou… |
CVE-2023-0925 | Critical | 9.8 | 2023-09-06 | Version 10.11 of webMethods OneData runs an embedded instance of Azul Zulu Java 11.0.15 which hosts a Java RMI registry (listening on TCP port 2099 by default)… |
CVE-2023-4498 | Medium | 5.3 | 2023-09-06 | Tenda N300 Wireless N VDSL2 Modem Router allows unauthenticated access to pages that in turn should be accessible to authenticated users only |
CVE-2023-20250 | Medium | 6.5 | 2023-09-06 | A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote at… |
CVE-2023-4623 | High | 7.8 | 2023-09-06 | A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege esc… |
CVE-2023-4622 | High | 7.8 | 2023-09-06 | A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local privilege escalation. The unix_stream_sendpage() func… |
CVE-2023-4244 | High | 7.8 | 2023-09-06 | A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. Due to a race co… |
CVE-2023-4208 | High | 7.8 | 2023-09-06 | A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. When u32_change() is… |
CVE-2023-4207 | High | 7.8 | 2023-09-06 | A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. When fw_change() is c… |
CVE-2023-4206 | High | 7.8 | 2023-09-06 | A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to achieve local privilege escalation. When route4_change… |
CVE-2023-4015 | High | 7.8 | 2023-09-06 | A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. On an error when b… |
CVE-2023-3777 | High | 7.8 | 2023-09-06 | A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. When nf_tables_del… |
CVE-2023-39265 | Low | 3.8 | 2023-09-06 | Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or… |
CVE-2023-37941 | Medium | 6.6 | 2023-09-06 | If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote cod… |
CVE-2023-32672 | Medium | 4.3 | 2023-09-06 | An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0. This vulnerability allows an authenticated user to query tabl… |
CVE-2023-41947 | Medium | 4.3 | 2023-09-06 | A missing permission check in Jenkins Frugal Testing Plugin 1.1 and earlier allows attackers with Overall/Read permission to connect to Frugal Testing using at… |
CVE-2023-41946 | Low | 3.5 | 2023-09-06 | A cross-site request forgery (CSRF) vulnerability in Jenkins Frugal Testing Plugin 1.1 and earlier allows attackers to connect to Frugal Testing using attacker… |
CVE-2023-41945 | High | 8.8 | 2023-09-06 | Jenkins Assembla Auth Plugin 1.14 and earlier does not verify that the permissions it grants are enabled, resulting in users with EDIT permissions to be grante… |
CVE-2023-41944 | Medium | 6.1 | 2023-09-06 | Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not escape the queue name parameter passed to a form validation URL, when rendering an error mess… |
CVE-2023-41943 | Medium | 6.5 | 2023-09-06 | Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permissi… |
CVE-2023-41942 | Medium | 4.3 | 2023-09-06 | A cross-site request forgery (CSRF) vulnerability in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers to clear the SQS queue. |
CVE-2023-41941 | Medium | 4.3 | 2023-09-06 | A missing permission check in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers with Overall/Read permission to enumerate credentials I… |
CVE-2023-41940 | Medium | 5.4 | 2023-09-06 | Jenkins TAP Plugin 2.3 and earlier does not escape TAP file contents, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers a… |
CVE-2023-41939 | High | 8.8 | 2023-09-06 | Jenkins SSH2 Easy Plugin 1.4 and earlier does not verify that permissions configured to be granted are enabled, potentially allowing users formerly granted (ty… |
CVE-2023-41938 | Medium | 6.5 | 2023-09-06 | A cross-site request forgery (CSRF) vulnerability in Jenkins Ivy Plugin 2.5 and earlier allows attackers to delete disabled modules. |
CVE-2023-41937 | High | 7.5 | 2023-09-06 | Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 (both inclusive) trusts values provided in the webhook payload, including certain URLs, and… |
CVE-2023-41936 | High | 7.5 | 2023-09-06 | Jenkins Google Login Plugin 1.7 and earlier uses a non-constant time comparison function when checking whether the provided and expected token are equal, poten… |
CVE-2023-41935 | High | 7.5 | 2023-09-06 | Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b_1154b_3fb_, uses a non-constant time comparison function when checking whether the… |
CVE-2023-41934 | Medium | 5.3 | 2023-09-06 | Jenkins Pipeline Maven Integration Plugin 1330.v18e473854496 and earlier does not properly mask (i.e., replace with asterisks) usernames of credentials specifi… |
CVE-2023-41933 | High | 8.8 | 2023-09-06 | Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-41932 | Medium | 6.5 | 2023-09-06 | Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict 'timestamp' query parameters in multiple endpoints, allowing attacke… |
CVE-2023-41931 | Medium | 5.4 | 2023-09-06 | Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not property sanitize or escape the timestamp value from history entries when ren… |
CVE-2023-41930 | Medium | 4.3 | 2023-09-06 | Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict the 'name' query parameter when rendering a history entry, allowing… |
CVE-2023-41150 | Medium | 5.4 | 2023-09-06 | F-RevoCRM 7.3 series prior to version7.3.8 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be execut… |
CVE-2023-41149 | Critical | 9.8 | 2023-09-06 | F-RevoCRM version7.3.7 and version7.3.8 contains an OS command injection vulnerability. If this vulnerability is exploited, an attacker who can access the prod… |
CVE-2023-39264 | Medium | 4.3 | 2023-09-06 | By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists i… |
CVE-2023-36388 | Medium | 4.3 | 2023-09-06 | Improper REST API permission in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma users to test network connections, possible SSRF. |
CVE-2023-36387 | Medium | 5.4 | 2023-09-06 | An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database co… |
CVE-2023-27526 | Medium | 4.3 | 2023-09-06 | A non Admin authenticated user could incorrectly create resources using the import charts feature, on Apache Superset up to and including 2.1.0. |
CVE-2023-27523 | Medium | 5.0 | 2023-09-06 | Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on… |
CVE-2023-4589 | Critical | 9.1 | 2023-09-06 | Insufficient verification of data authenticity vulnerability in Delinea Secret Server, in its v10.9.000002 version. An attacker with an administrator account c… |
CVE-2023-4588 | Medium | 6.8 | 2023-09-06 | File accessibility vulnerability in Delinea Secret Server, in its v10.9.000002 and v11.4.000002 versions. Exploitation of this vulnerability could allow an aut… |
CVE-2023-40531 | High | 8.0 | 2023-09-06 | Archer AX6000 firmware versions prior to 'Archer AX6000(JP)_V1_1.3.0 Build 20221208' allows a network-adjacent authenticated attacker to execute arbitrary OS c… |
CVE-2023-40357 | High | 8.0 | 2023-09-06 | Multiple TP-LINK products allow a network-adjacent authenticated attacker to execute arbitrary OS commands. Affected products/versions are as follows: Archer A… |
CVE-2023-40193 | High | 8.0 | 2023-09-06 | Deco M4 firmware versions prior to 'Deco M4(JP)_V2_1.5.8 Build 20230619' allows a network-adjacent authenticated attacker to execute arbitrary OS commands. |
CVE-2023-39935 | High | 8.0 | 2023-09-06 | Archer C5400 firmware versions prior to 'Archer C5400(JP)_V2_230506' allows a network-adjacent authenticated attacker to execute arbitrary OS commands. |
CVE-2023-39224 | High | 8.0 | 2023-09-06 | Archer C5 firmware all versions and Archer C7 firmware versions prior to 'Archer C7(JP)_V2_230602' allow a network-adjacent authenticated attacker to execute a… |
CVE-2023-38588 | High | 8.0 | 2023-09-06 | Archer C3150 firmware versions prior to 'Archer C3150(JP)_V2_230511' allows a network-adjacent authenticated attacker to execute arbitrary OS commands. |
CVE-2023-38568 | High | 8.8 | 2023-09-06 | Archer A10 firmware versions prior to 'Archer A10(JP)_V2_230504' allows a network-adjacent unauthenticated attacker to execute arbitrary OS commands. |
CVE-2023-38563 | High | 8.8 | 2023-09-06 | Archer C1200 firmware versions prior to 'Archer C1200(JP)_V2_230508' and Archer C9 firmware versions prior to 'Archer C9(JP)_V3_230508' allow a network-adjacen… |
CVE-2023-37284 | High | 8.8 | 2023-09-06 | Improper authentication vulnerability in Archer C20 firmware versions prior to 'Archer C20(JP)_V1_230616' allows a network-adjacent unauthenticated attacker to… |
CVE-2023-36489 | High | 8.8 | 2023-09-06 | Multiple TP-LINK products allow a network-adjacent unauthenticated attacker to execute arbitrary OS commands. Affected products/versions are as follows: TL-WR8… |
CVE-2023-32619 | High | 8.8 | 2023-09-06 | Archer C50 firmware versions prior to 'Archer C50(JP)_V3_230505' and Archer C55 firmware versions prior to 'Archer C55(JP)_V1_230506' use hard-coded credential… |
CVE-2023-31188 | High | 8.0 | 2023-09-06 | Multiple TP-LINK products allow a network-adjacent authenticated attacker to execute arbitrary OS commands. Affected products/versions are as follows: Archer C… |
CVE-2023-4634 | Critical | 9.8 | 2023-09-06 | The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. This i… |
CVE-2023-40601 | High | 7.1 | 2023-09-06 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Estatik Estatik Mortgage Calculator plugin <= 2.0.7 versions. |
CVE-2023-40560 | Medium | 5.9 | 2023-09-06 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Greg Ross Schedule Posts Calendar plugin <= 5.2 versions. |
CVE-2023-40554 | High | 7.1 | 2023-09-06 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Blog2Social, Adenion Blog2Social: Social Media Auto Post & Scheduler plugin <= 7.2.0 versions. |
CVE-2023-40553 | Medium | 5.8 | 2023-09-06 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Plausible.Io Plausible Analytics plugin <= 1.3.3 versions. |
CVE-2023-40552 | Medium | 5.9 | 2023-09-06 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gurcharan Singh Fitness calculators plugin plugin <= 2.0.7 versions. |
CVE-2023-40329 | Medium | 5.9 | 2023-09-06 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPZest Custom Admin Login Page | WPZest plugin <= 1.2.0 versions. |
CVE-2023-40328 | Medium | 5.9 | 2023-09-06 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Carrrot plugin <= 1.1.0 versions. |
CVE-2023-40007 | Medium | 5.9 | 2023-09-06 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ujwol Bastakoti CT Commerce plugin <= 2.0.1 versions. |
CVE-2023-30497 | High | 7.1 | 2023-09-06 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Simon Chuang WP LINE Notify plugin <= 1.4.4 versions. |
CVE-2023-29441 | High | 7.1 | 2023-09-06 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Robert Heller WebLibrarian plugin <= 3.5.8.1 versions. |
CVE-2023-4779 | Medium | 6.4 | 2023-09-06 | The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [usp_gallery] shortcode in versions up to, and incl… |
CVE-2023-3472 | High | 8.6 | 2023-09-06 | Use after free vulnerability in Panasonic KW Watcher versions 1.00 through 2.82 may allow attackers to execute arbitrary code. |
CVE-2023-3471 | High | 8.6 | 2023-09-06 | Buffer overflow vulnerability in Panasonic KW Watcher versions 1.00 through 2.82 may allow attackers to execute arbitrary code. |
CVE-2023-35719 | Medium | 6.8 | 2023-09-06 | ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability. This vulnerability allows physi… |
CVE-2023-32163 | High | 7.8 | 2023-09-06 | Wacom Drivers for Windows Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected… |
CVE-2023-32162 | High | 7.8 | 2023-09-06 | Wacom Drivers for Windows Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privi… |
CVE-2023-4773 | Medium | 6.4 | 2023-09-06 | The WordPress Social Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wordpress_social_login_meta' shortcode in versions up to… |
CVE-2023-30730 | Low | 3.3 | 2023-09-06 | Implicit intent hijacking vulnerability in Camera prior to versions 11.0.16.43 in Android 11, 12.1.00.30, 12.0.07.53, 12.1.03.10 in Android 12, and 13.0.01.43… |
CVE-2023-30729 | High | 8.1 | 2023-09-06 | Improper Certificate Validation in Samsung Email prior to version 6.1.82.0 allows remote attacker to intercept the network traffic including sensitive informat… |
CVE-2023-30728 | Medium | 4.4 | 2023-09-06 | Intent redirection vulnerability in PackageInstallerCHN prior to version 13.1.03.00 allows local attacker to access arbitrary file. This vulnerability requires… |
CVE-2023-30726 | Medium | 4.7 | 2023-09-06 | PendingIntent hijacking vulnerability in GameLauncher prior to version 4.2.59.5 allows local attackers to access data. |
CVE-2023-30725 | Medium | 5.1 | 2023-09-06 | Improper authentication in LocalProvier of Gallery prior to version 14.5.01.2 allows attacker to access the data in content provider. |
CVE-2023-30724 | Medium | 4.0 | 2023-09-06 | Improper authentication in GallerySearchProvider of Gallery prior to version 14.5.01.2 allows attacker to access search history. |
CVE-2023-30723 | Medium | 5.5 | 2023-09-06 | Improper input validation vulnerability in Samsung Health prior to version 6.24.2.011 allows attackers to write arbitrary file with Samsung Health privilege. |
CVE-2023-30722 | Medium | 5.5 | 2023-09-06 | Protection Mechanism Failure in bc_tui trustlet from Samsung Blockchain Keystore prior to version 1.3.13.5 allows local attacker to execute arbitrary code. |
CVE-2023-30721 | Medium | 4.4 | 2023-09-06 | Insertion of sensitive information into log vulnerability in Locksettings prior to SMR Sep-2023 Release 1 allows a privileged local attacker to get lock screen… |
CVE-2023-30720 | Medium | 4.7 | 2023-09-06 | PendingIntent hijacking in LmsAssemblyTrackerCTC prior to SMR Sep-2023 Release 1 allows local attacker to gain arbitrary file access. |
CVE-2023-30719 | Medium | 4.0 | 2023-09-06 | Exposure of Sensitive Information vulnerability in InboundSmsHandler prior to SMR Sep-2023 Release 1 allows local attackers to access certain message data. |
CVE-2023-30718 | Medium | 4.0 | 2023-09-06 | Improper export of android application components vulnerability in WifiApAutoHotspotEnablingActivity prior to SMR Sep-2023 Release 1 allows local attacker to c… |
CVE-2023-30717 | Medium | 4.0 | 2023-09-06 | Sensitive information exposure vulnerability in SVCAgent prior to SMR Sep-2023 Release 1 allows attackers to get unresettable identifiers. |
CVE-2023-30716 | Medium | 4.0 | 2023-09-06 | Improper access control vulnerability in SVCAgent prior to SMR Sep-2023 Release 1 allows attackers to trigger certain commands. |
CVE-2023-30715 | Medium | 4.0 | 2023-09-06 | Improper access control vulnerability in Weather prior to SMR Sep-2023 Release 1 allows attackers to access location information set in Weather without permiss… |
CVE-2023-30714 | Medium | 4.6 | 2023-09-06 | Improper authorization vulnerability in FolderContainerDragDelegate in One UI Home prior to SMR Sep-2023 Release 1 allows physical attackers to change some set… |
CVE-2023-30713 | Medium | 6.2 | 2023-09-06 | Improper privilege management vulnerability in FolderLockNotifier in One UI Home prior to SMR Sep-2023 Release 1 allows local attackers to change some settings… |
CVE-2023-30712 | Medium | 6.8 | 2023-09-06 | Improper input validation in Settings Suggestions prior to SMR Sep-2023 Release 1 allows attackers to launch arbitrary activity. |
CVE-2023-30711 | Medium | 4.0 | 2023-09-06 | Improper authentication in Phone and Messaging Storage SMR SEP-2023 Release 1 allows attacker to insert arbitrary data to the provider. |
CVE-2023-30710 | High | 8.5 | 2023-09-06 | Improper input validation vulnerability in Knox AI prior to SMR Sep-2023 Release 1 allows local attackers to launch privileged activities. |
CVE-2023-30709 | High | 7.9 | 2023-09-06 | Improper access control in Dual Messenger prior to SMR Sep-2023 Release 1 allows local attackers launch activity with system privilege. |
CVE-2023-30708 | Medium | 4.6 | 2023-09-06 | Improper authentication in SecSettings prior to SMR Sep-2023 Release 1 allows attacker to access Captive Portal Wi-Fi in Reactivation Lock status. |
CVE-2023-30707 | Medium | 4.0 | 2023-09-06 | Improper input validation vulnerability in FileProviderStatusReceiver in Samsung Keyboard prior to SMR Sep-2023 Release 1 allows local attackers to delete arbi… |