2023 CVEs (page 164)
Page 164 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-30706 | High | 7.5 | 2023-09-06 | Improper authorization in Samsung Keyboard prior to SMR Sep-2023 Release 1 allows attacker to read arbitrary file with system privilege. |
CVE-2023-4719 | High | 7.2 | 2023-09-06 | The Simple Membership plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `list_type` parameter in versions up to, and including, 4.3… |
CVE-2023-34352 | Medium | 5.3 | 2023-09-06 | A permissions issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Ventura 13.4, tvOS 16.5, iOS 16.5 and iPadOS 1… |
CVE-2023-32438 | Medium | 5.5 | 2023-09-06 | This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in tvOS 16.3, macOS Ventura 13.2, watchOS 9.3, iOS 16.3 and… |
CVE-2023-32432 | Medium | 5.5 | 2023-09-06 | A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Ventura 13.4, tvOS 16.5, iOS 16.5 and iPadOS 16.5, watchO… |
CVE-2023-32428 | High | 7.8 | 2023-09-06 | This issue was addressed with improved file handling. This issue is fixed in macOS Ventura 13.4, tvOS 16.5, iOS 16.5 and iPadOS 16.5, watchOS 9.5. An app may b… |
CVE-2023-32426 | High | 7.8 | 2023-09-06 | A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3. An app may be able to gain root privileges. |
CVE-2023-32425 | High | 7.8 | 2023-09-06 | The issue was addressed with improved memory handling. This issue is fixed in iOS 16.5 and iPadOS 16.5, watchOS 9.5. An app may be able to gain elevated privil… |
CVE-2023-32379 | High | 7.8 | 2023-09-06 | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.4. An app may be able to execute arbitrary code wi… |
CVE-2023-32370 | Medium | 5.3 | 2023-09-06 | A logic issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.3. Content Security Policy to block domains with wildcards may fa… |
CVE-2023-32362 | Medium | 6.5 | 2023-09-06 | Error handling was changed to not reveal sensitive information. This issue is fixed in macOS Ventura 13.3. A website may be able to track sensitive user inform… |
CVE-2023-32356 | High | 7.8 | 2023-09-06 | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.3. An app may be able to cause unexpected system t… |
CVE-2023-29166 | High | 8.8 | 2023-09-06 | A logic issue was addressed with improved state management. This issue is fixed in Pro Video Formats 2.2.5. A user may be able to elevate privileges. |
CVE-2023-28215 | High | 7.8 | 2023-09-06 | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.3. An app may be able to cause unexpected system t… |
CVE-2023-28214 | High | 7.8 | 2023-09-06 | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.3. An app may be able to cause unexpected system t… |
CVE-2023-28213 | High | 7.8 | 2023-09-06 | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.3. An app may be able to cause unexpected system t… |
CVE-2023-28212 | High | 7.8 | 2023-09-06 | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.3. An app may be able to cause unexpected system t… |
CVE-2023-28211 | High | 7.8 | 2023-09-06 | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.3. An app may be able to cause unexpected system t… |
CVE-2023-28210 | High | 7.8 | 2023-09-06 | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.3. An app may be able to cause unexpected system t… |
CVE-2023-28209 | High | 7.8 | 2023-09-06 | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.3. An app may be able to cause unexpected system t… |
CVE-2023-28208 | Medium | 4.3 | 2023-09-06 | A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3. A user may send a text from a… |
CVE-2023-28195 | Low | 3.3 | 2023-09-06 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventura 13.3. An app may be able to read sensi… |
CVE-2023-28188 | Medium | 6.5 | 2023-09-06 | A denial-of-service issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3. A remote user may be able to cause a denial-… |
CVE-2023-28187 | Medium | 6.5 | 2023-09-06 | This issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3. A user may be able to cause a denial-of-service. |
CVE-2023-27950 | Medium | 5.5 | 2023-09-06 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3. Processing an image may result in disclosure of… |
CVE-2023-4485 | Critical | 9.8 | 2023-09-06 | ARDEREG Sistema SCADA Central versions 2.203 and prior login page are vulnerable to an unauthenticated blind SQL injection attack. An attacker could manipulat… |
CVE-2023-4487 | High | 7.8 | 2023-09-05 | GE CIMPLICITY 2023 is by a process control vulnerability, which could allow a local attacker to insert malicious configuration files in the expected web serve… |
CVE-2023-4764 | Medium | 6.5 | 2023-09-05 | Incorrect security UI in BFCache in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafte… |
CVE-2023-4763 | High | 8.8 | 2023-09-05 | Use after free in Networks in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (… |
CVE-2023-4762 | High | 8.8 | 2023-09-05 | Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security s… |
CVE-2023-4761 | High | 8.1 | 2023-09-05 | Out of bounds memory access in FedCM in Google Chrome prior to 116.0.5845.179 allowed a remote attacker who had compromised the renderer process to perform an… |
CVE-2023-41507 | Critical | 9.8 | 2023-09-05 | Super Store Finder v3.6 was discovered to contain multiple SQL injection vulnerabilities in the store locator component via the products, distance, lat, and ln… |
CVE-2023-39516 | Medium | 6.1 | 2023-09-05 | Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerabili… |
CVE-2023-39365 | Medium | 4.6 | 2023-09-05 | Cacti is an open source operational monitoring and fault management framework. Issues with Cacti Regular Expression validation combined with the external links… |
CVE-2023-39364 | Low | 3.5 | 2023-09-05 | Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, users with console access can be redirected to an arbitrary web… |
CVE-2023-39362 | High | 7.2 | 2023-09-05 | Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, under certain conditions, an authenticated privileged user, can… |
CVE-2023-39358 | High | 8.8 | 2023-09-05 | Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authent… |
CVE-2023-39357 | High | 8.8 | 2023-09-05 | Cacti is an open source operational monitoring and fault management framework. A defect in the sql_save function was discovered. When the column type is numeri… |
CVE-2023-34637 | Medium | 5.4 | 2023-09-05 | A stored cross-site scripting (XSS) vulnerability in IsarNet AG IsarFlow v5.23 allows authenticated attackers to execute arbitrary web scripts or HTML via inje… |
CVE-2023-31132 | High | 7.8 | 2023-09-05 | Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a privilege escalation vulnerability. A low-pri… |
CVE-2023-30534 | Medium | 4.3 | 2023-09-05 | Cacti is an open source operational monitoring and fault management framework. There are two instances of insecure deserialization in Cacti version 1.2.24. Whi… |
CVE-2023-4310 | Critical | 9.8 | 2023-09-05 | BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) versions 23.2.1 and 23.2.2 contain a command injection vulnerability which can be exploited… |
CVE-2023-41508 | Critical | 9.8 | 2023-09-05 | A hard coded password in Super Store Finder v3.6 allows attackers to access the administration panel. |
CVE-2023-39515 | Medium | 6.1 | 2023-09-05 | Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerabili… |
CVE-2023-39514 | Medium | 6.1 | 2023-09-05 | Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerabili… |
CVE-2023-39513 | Medium | 6.1 | 2023-09-05 | Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerabili… |
CVE-2023-39512 | Medium | 6.1 | 2023-09-05 | Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerabili… |
CVE-2023-39510 | Medium | 6.1 | 2023-09-05 | Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerabili… |
CVE-2023-39366 | Medium | 6.1 | 2023-09-05 | Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerabili… |
CVE-2023-39361 | Critical | 9.8 | 2023-09-05 | Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a SQL injection discovered in graph_view.php. S… |
CVE-2023-39360 | Medium | 6.1 | 2023-09-05 | Cacti is an open source operational monitoring and fault management framework.Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerabilit… |
CVE-2023-39359 | High | 8.8 | 2023-09-05 | Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authent… |
CVE-2023-41009 | Critical | 9.8 | 2023-09-05 | File Upload vulnerability in adlered bolo-solo v.2.6 allows a remote attacker to execute arbitrary code via a crafted script to the authorization field in the… |
CVE-2023-39654 | Critical | 9.8 | 2023-09-05 | abupy up to v0.4.0 was discovered to contain a SQL injection vulnerability via the component abupy.MarketBu.ABuSymbol.search_to_symbol_dict. |
CVE-2023-4781 | High | 7.8 | 2023-09-05 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873. |
CVE-2023-4531 | Critical | 9.8 | 2023-09-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mestav Software E-commerce Software allows SQL Injection… |
CVE-2023-4178 | Critical | 9.8 | 2023-09-05 | Authentication Bypass by Spoofing vulnerability in Neutron Neutron Smart VMS allows Authentication Bypass. This issue affects Neutron Smart VMS: before b1130… |
CVE-2023-4034 | Critical | 9.8 | 2023-09-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Digita Information Technology Smartrise Document Manageme… |
CVE-2023-41317 | High | 7.5 | 2023-09-05 | The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Affected versio… |
CVE-2023-40918 | High | 8.8 | 2023-09-05 | KnowStreaming 3.3.0 is vulnerable to Escalation of Privileges. Unauthorized users can create a new user with an admin role. |
CVE-2023-3616 | Critical | 9.8 | 2023-09-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mava Software Hotel Management System allows SQL Injectio… |
CVE-2023-39681 | Critical | 9.8 | 2023-09-05 | Cuppa CMS v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the email_outgoing parameter at /Configuration.php. This vulnerability… |
CVE-2023-39598 | Medium | 6.1 | 2023-09-05 | Cross Site Scripting vulnerability in IceWarp Corporation WebClient v.10.2.1 allows a remote attacker to execute arbitrary code via a crafted payload to the mi… |
CVE-2023-35072 | Critical | 9.8 | 2023-09-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Coyav Travel Proagent allows SQL Injection. This issue a… |
CVE-2023-35068 | Critical | 9.8 | 2023-09-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BMA Personnel Tracking System allows SQL Injection. This… |
CVE-2023-35065 | Critical | 9.8 | 2023-09-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Osoft Paint Production Management allows SQL Injection. … |
CVE-2023-3375 | High | 7.2 | 2023-09-05 | Unrestricted Upload of File with Dangerous Type vulnerability in Unisign Bookreen allows OS Command Injection. This issue affects Bookreen: before 3.0.0. |
CVE-2023-3374 | Critical | 9.8 | 2023-09-05 | Incomplete List of Disallowed Inputs vulnerability in Unisign Bookreen allows Privilege Escalation. This issue affects Bookreen: before 3.0.0. |
CVE-2023-35124 | Low | 3.1 | 2023-09-05 | An information disclosure vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OAS Platform v18.00.0072. A… |
CVE-2023-34998 | High | 8.1 | 2023-09-05 | An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series… |
CVE-2023-34994 | Low | 3.1 | 2023-09-05 | An improper resource allocation vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OAS Platform v18.00.0… |
CVE-2023-34353 | High | 7.5 | 2023-09-05 | An authentication bypass vulnerability exists in the OAS Engine authentication functionality of Open Automation Software OAS Platform v18.00.0072. A specially… |
CVE-2023-34317 | Medium | 6.5 | 2023-09-05 | An improper input validation vulnerability exists in the OAS Engine User Creation functionality of Open Automation Software OAS Platform v18.00.0072. A special… |
CVE-2023-32615 | Medium | 6.5 | 2023-09-05 | A file write vulnerability exists in the OAS Engine configuration functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted serie… |
CVE-2023-32271 | Medium | 6.5 | 2023-09-05 | An information disclosure vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OAS Platform v18.00.0072. A… |
CVE-2023-31242 | High | 8.1 | 2023-09-05 | An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072. A specially-crafted series… |
CVE-2023-4778 | Medium | 5.5 | 2023-09-05 | Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV. |
CVE-2023-41108 | High | 8.8 | 2023-09-05 | TEF portal 2023-07-17 is vulnerable to authenticated remote code execution. |
CVE-2023-41107 | Medium | 5.4 | 2023-09-05 | TEF portal 2023-07-17 is vulnerable to a persistent cross site scripting (XSS)attack. |
CVE-2023-41012 | Critical | 9.8 | 2023-09-05 | An issue in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows a remote attacker to execute arbitrary code via the authenticat… |
CVE-2023-36361 | Critical | 9.8 | 2023-09-05 | Audimexee v14.1.7 was discovered to contain a SQL injection vulnerability via the p_table_name parameter. |
CVE-2023-4480 | Medium | 5.5 | 2023-09-05 | Due to an out-of-date dependency in the “Fusion File Manager” component accessible through the admin panel, an attacker can send a crafted request that allows… |
CVE-2023-40743 | Critical | 9.8 | 2023-09-05 | ** UNSUPPORTED WHEN ASSIGNED ** When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through "ServiceFact… |
CVE-2023-2453 | High | 8.8 | 2023-09-05 | There is insufficient sanitization of tainted file names that are directly concatenated with a path that is subsequently passed to a ‘require_once’ statement… |
CVE-2023-20898 | Medium | 4.2 | 2023-09-05 | Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that… |
CVE-2023-20897 | Medium | 5.3 | 2023-09-05 | Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker… |
CVE-2023-38569 | Medium | 5.4 | 2023-09-05 | Stored cross-site scripting vulnerability in SHIRASAGI prior to v1.18.0 allows a remote authenticated attacker to execute an arbitrary script on the web browse… |
CVE-2023-36492 | Medium | 6.1 | 2023-09-05 | Reflected cross-site scripting vulnerability in SHIRASAGI prior to v1.18.0 allows a remote unauthenticated attacker to execute an arbitrary script on the web b… |
CVE-2023-40705 | Medium | 5.4 | 2023-09-05 | Stored cross-site scripting vulnerability in Map setting page of VI Web Client prior to 7.9.6 allows a remote authenticated attacker to inject an arbitrary scr… |
CVE-2023-40535 | Medium | 5.4 | 2023-09-05 | Stored cross-site scripting vulnerability in View setting page of VI Web Client prior to 7.9.6 allows a remote authenticated attacker to inject an arbitrary sc… |
CVE-2023-39938 | Medium | 6.1 | 2023-09-05 | Reflected cross-site scripting vulnerability in VI Web Client prior to 7.9.6 allows a remote unauthenticated attacker to inject an arbitrary script. |
CVE-2023-39448 | High | 8.8 | 2023-09-05 | Path traversal vulnerability in SHIRASAGI prior to v1.18.0 allows a remote authenticated attacker to alter or create arbitrary files on the server, resulting… |
CVE-2023-38574 | Medium | 6.1 | 2023-09-05 | Open redirect vulnerability in VI Web Client prior to 7.9.6 allows a remote unauthenticated attacker to redirect users to arbitrary web sites and conduct phish… |
CVE-2023-4540 | High | 7.5 | 2023-09-05 | Improper Handling of Exceptional Conditions vulnerability in Daurnimator lua-http library allows Excessive Allocation and a denial of service (DoS) attack to b… |
CVE-2023-41910 | Critical | 9.8 | 2023-09-05 | An issue was discovered in lldpd before 1.0.17. By crafting a CDP PDU packet with specific CDP_TLV_ADDRESSES TLVs, a malicious actor can remotely force the lld… |
CVE-2023-41909 | High | 7.5 | 2023-09-05 | An issue was discovered in FRRouting FRR through 9.0. bgp_nlri_parse_flowspec in bgpd/bgp_flowspec.c processes malformed requests with no attributes, leading t… |
CVE-2023-41908 | Medium | 5.3 | 2023-09-05 | Cerebrate before 1.15 lacks the Secure attribute for the session cookie. |
CVE-2023-33021 | High | 8.4 | 2023-09-05 | Memory corruption in Graphics while processing user packets for command submission. |
CVE-2023-33020 | High | 7.5 | 2023-09-05 | Transient DOS in WLAN Host when an invalid channel (like channel out of range) is received in STA during CSA IE. |
CVE-2023-33019 | High | 7.5 | 2023-09-05 | Transient DOS in WLAN Host while doing channel switch announcement (CSA), when a mobile station receives invalid channel in CSA IE. |