2023 CVEs (page 177)
Page 177 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-39852 | Critical | 9.8 | 2023-08-15 | Doctormms v1.0 was discovered to contain a SQL injection vulnerability via the $userid parameter at myAppoinment.php. NOTE: this is disputed by a third party w… |
CVE-2023-39843 | Low | 2.4 | 2023-08-15 | Missing encryption in the RFID tag of Suleve 5-in-1 Smart Door Lock v1.0 allows attackers to create a cloned tag via brief physical proximity to the original d… |
CVE-2023-39842 | Low | 2.4 | 2023-08-15 | Missing encryption in the RFID tag of Digoo DG-HAMB Smart Home Security System v1.0 allows attackers to create a cloned tag via brief physical proximity to the… |
CVE-2023-39841 | Medium | 4.6 | 2023-08-15 | Missing encryption in the RFID tag of Etekcity 3-in-1 Smart Door Lock v1.0 allows attackers to create a cloned tag via brief physical proximity to the original… |
CVE-2023-38866 | Critical | 9.8 | 2023-08-15 | COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub_415588. Attackers can send POST request messages to /usr/bin/webmgnt and… |
CVE-2023-38864 | Critical | 9.8 | 2023-08-15 | An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the protal_delete_picname parameter in the sub_41171C function at bin/webm… |
CVE-2023-4344 | Critical | 9.8 | 2023-08-15 | Broadcom RAID Controller web interface is vulnerable to insufficient randomness due to improper use of ssl.rnd to setup CIM connection |
CVE-2023-4343 | High | 7.5 | 2023-08-15 | Broadcom RAID Controller web interface is vulnerable due to exposure of sensitive password information in the URL as a URL search parameter |
CVE-2023-4342 | Critical | 9.8 | 2023-08-15 | Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP strict-transport-security policy |
CVE-2023-4341 | Critical | 9.8 | 2023-08-15 | Broadcom RAID Controller is vulnerable to Privilege escalation to root due to creation of insecure folders by Web GUI |
CVE-2023-4340 | Critical | 9.8 | 2023-08-15 | Broadcom RAID Controller is vulnerable to Privilege escalation by taking advantage of the Session prints in the log file |
CVE-2023-4339 | High | 7.5 | 2023-08-15 | Broadcom RAID Controller web interface is vulnerable to exposure of private keys used for CIM stored with insecure file permissions |
CVE-2023-4338 | Critical | 9.8 | 2023-08-15 | Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not provide X-Content-Type-Options Headers |
CVE-2023-4337 | Critical | 9.8 | 2023-08-15 | Broadcom RAID Controller web interface is vulnerable to improper session handling of managed servers on Gateway installation |
CVE-2023-4336 | Critical | 9.8 | 2023-08-15 | Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard cookies with Secure attribute |
CVE-2023-4335 | High | 7.5 | 2023-08-15 | Broadcom RAID Controller Web server (nginx) is serving private server-side files without any authentication on Linux |
CVE-2023-4334 | High | 7.5 | 2023-08-15 | Broadcom RAID Controller Web server (nginx) is serving private files without any authentication |
CVE-2023-4333 | Medium | 5.5 | 2023-08-15 | Broadcom RAID Controller web interface doesn’t enforce SSL cipher ordering by server |
CVE-2023-4332 | High | 7.5 | 2023-08-15 | Broadcom RAID Controller web interface is vulnerable due to Improper permissions on the log file |
CVE-2023-4331 | High | 7.5 | 2023-08-15 | Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configuration that support obsolete and vulnerable TLS protocols |
CVE-2023-4329 | Critical | 9.8 | 2023-08-15 | Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard SESSIONID cookie with SameSite attri… |
CVE-2023-4328 | Medium | 5.5 | 2023-08-15 | Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any local user on Windows |
CVE-2023-4327 | Medium | 5.5 | 2023-08-15 | Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any local user on Linux |
CVE-2023-4326 | High | 7.5 | 2023-08-15 | Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configuration that supports obsolete SHA1-based ciphersuites |
CVE-2023-4325 | Critical | 9.8 | 2023-08-15 | Broadcom RAID Controller web interface is vulnerable due to usage of Libcurl with LSA has known vulnerabilities |
CVE-2023-4324 | Critical | 9.8 | 2023-08-15 | Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP Content-Security-Policy headers |
CVE-2023-4323 | Critical | 9.8 | 2023-08-15 | Broadcom RAID Controller web interface is vulnerable to improper session management of active sessions on Gateway setup |
CVE-2023-38865 | Critical | 9.8 | 2023-08-15 | COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub_4143F0. Attackers can send POST request messages to /usr/bin/webmgnt and… |
CVE-2023-38863 | Critical | 9.8 | 2023-08-15 | An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the ifname and mac parameters in the sub_410074 function at bin/webmgnt. |
CVE-2023-38862 | Critical | 9.8 | 2023-08-15 | An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the destination parameter of sub_431F64 function in bin/webmgnt. |
CVE-2023-38861 | Critical | 9.8 | 2023-08-15 | An issue in Wavlink WL_WNJ575A3 v.R75A3_V1410_220513 allows a remote attacker to execute arbitrary code via username parameter of the set_sys_adm function in a… |
CVE-2023-38402 | High | 7.1 | 2023-08-15 | A vulnerability in the HPE Aruba Networking Virtual Intranet Access (VIA) client could allow malicious users to overwrite arbitrary files as NT AUTHORITY\SYSTE… |
CVE-2023-38401 | High | 7.8 | 2023-08-15 | A vulnerability in the HPE Aruba Networking Virtual Intranet Access (VIA) client could allow local users to elevate privileges. Successful exploitation could a… |
CVE-2023-4369 | High | 8.8 | 2023-08-15 | Insufficient data validation in Systems Extensions in Google Chrome on ChromeOS prior to 116.0.5845.120 allowed an attacker who convinced a user to install a m… |
CVE-2023-4368 | High | 8.8 | 2023-08-15 | Insufficient policy enforcement in Extensions API in Google Chrome prior to 116.0.5845.96 allowed an attacker who convinced a user to install a malicious exten… |
CVE-2023-4367 | Medium | 6.5 | 2023-08-15 | Insufficient policy enforcement in Extensions API in Google Chrome prior to 116.0.5845.96 allowed an attacker who convinced a user to install a malicious exten… |
CVE-2023-4366 | High | 8.8 | 2023-08-15 | Use after free in Extensions in Google Chrome prior to 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extension to potentially e… |
CVE-2023-4365 | Medium | 4.3 | 2023-08-15 | Inappropriate implementation in Fullscreen in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a crafted HTML page… |
CVE-2023-4364 | Medium | 4.3 | 2023-08-15 | Inappropriate implementation in Permission Prompts in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a crafted HTM… |
CVE-2023-4363 | Medium | 4.3 | 2023-08-15 | Inappropriate implementation in WebShare in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker to spoof the contents of a dialog URL via… |
CVE-2023-4362 | High | 8.8 | 2023-08-15 | Heap buffer overflow in Mojom IDL in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process and gained control… |
CVE-2023-4361 | Medium | 5.3 | 2023-08-15 | Inappropriate implementation in Autofill in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker to bypass Autofill restrictions via a cra… |
CVE-2023-4360 | Medium | 4.3 | 2023-08-15 | Inappropriate implementation in Color in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chro… |
CVE-2023-4359 | Medium | 5.3 | 2023-08-15 | Inappropriate implementation in App Launcher in Google Chrome on iOS prior to 116.0.5845.96 allowed a remote attacker to potentially spoof elements of the secu… |
CVE-2023-4358 | High | 8.8 | 2023-08-15 | Use after free in DNS in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2023-4357 | High | 8.8 | 2023-08-15 | Insufficient validation of untrusted input in XML in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to bypass file access restrictions via a cr… |
CVE-2023-4356 | High | 8.8 | 2023-08-15 | Use after free in Audio in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who has convinced a user to engage in specific UI interaction to pote… |
CVE-2023-4355 | High | 8.8 | 2023-08-15 | Out of bounds memory access in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
CVE-2023-4354 | High | 8.8 | 2023-08-15 | Heap buffer overflow in Skia in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process to potentially exploit… |
CVE-2023-4353 | High | 8.8 | 2023-08-15 | Heap buffer overflow in ANGLE in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2023-4352 | High | 8.8 | 2023-08-15 | Type confusion in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2023-4351 | High | 8.8 | 2023-08-15 | Use after free in Network in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who has elicited a browser shutdown to potentially exploit heap cor… |
CVE-2023-4350 | Medium | 6.5 | 2023-08-15 | Inappropriate implementation in Fullscreen in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker to potentially spoof the contents of th… |
CVE-2023-4349 | High | 8.8 | 2023-08-15 | Use after free in Device Trust Connectors in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafte… |
CVE-2023-4345 | Medium | 6.5 | 2023-08-15 | Broadcom RAID Controller web interface is vulnerable client-side control bypass leads to unauthorized data access for low privileged user |
CVE-2023-40028 | Medium | 4.9 | 2023-08-15 | Ghost is an open source content management system. Versions prior to 5.59.1 are subject to a vulnerability which allows authenticated users to upload files tha… |
CVE-2023-40027 | Low | 3.7 | 2023-08-15 | Keystone is an open source headless CMS for Node.js — built with GraphQL and React. When `ui.isAccessAllowed` is set as `undefined`, the `adminMeta` GraphQL qu… |
CVE-2023-2312 | High | 8.8 | 2023-08-15 | Use after free in Offline in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2023-39662 | Critical | 9.8 | 2023-08-15 | An issue in llama_index v.0.7.13 and before allows a remote attacker to execute arbitrary code via the `exec` parameter in PandasQueryEngine function. |
CVE-2023-39661 | Critical | 9.8 | 2023-08-15 | An issue in pandas-ai v.0.9.1 and before allows a remote attacker to execute arbitrary code via the _is_jailbreak function. |
CVE-2023-39659 | Critical | 9.8 | 2023-08-15 | An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to execute arbitrary code via a crafted script to the PythonAstREPLTool._run c… |
CVE-2023-39438 | High | 8.1 | 2023-08-15 | A missing authorization check allows an arbitrary authenticated user to perform certain operations through the API of CLA-assistant by executing specific addit… |
CVE-2023-38916 | High | 8.8 | 2023-08-15 | SQL Injection vulnerability in eVotingSystem-PHP v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitive information via the user input f… |
CVE-2023-38915 | Critical | 9.8 | 2023-08-15 | File Upload vulnerability in Wolf-leo EasyAdmin8 v.1.0 allows a remote attacker to execute arbtirary code via the upload type function. |
CVE-2023-38898 | Medium | 5.3 | 2023-08-15 | An issue in Python cpython v.3.7 allows an attacker to obtain sensitive information via the _asyncio._swap_current_task component. NOTE: this is disputed by th… |
CVE-2023-38896 | Critical | 9.8 | 2023-08-15 | An issue in Harrison Chase langchain v.0.0.194 and before allows a remote attacker to execute arbitrary code via the from_math_prompt and from_colored_object_p… |
CVE-2023-38889 | Critical | 9.8 | 2023-08-15 | An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a crafted script to the username parameter of lluxio.util.CommonUtils.g… |
CVE-2023-38860 | Critical | 9.8 | 2023-08-15 | An issue in LangChain v.0.0.231 allows a remote attacker to execute arbitrary code via the prompt parameter. |
CVE-2023-38858 | Medium | 6.5 | 2023-08-15 | Buffer Overflow vulnerability infaad2 v.2.10.1 allows a remote attacker to execute arbitrary code and cause a denial of service via the mp4info function in mp4… |
CVE-2023-38857 | Medium | 5.5 | 2023-08-15 | Buffer Overflow vulnerability infaad2 v.2.10.1 allows a remote attacker to execute arbitrary code and cause a denial of service via the stcoin function in mp4r… |
CVE-2023-38856 | Medium | 6.5 | 2023-08-15 | Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the g… |
CVE-2023-38855 | Medium | 6.5 | 2023-08-15 | Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the g… |
CVE-2023-38854 | Medium | 6.5 | 2023-08-15 | Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the t… |
CVE-2023-38853 | Medium | 6.5 | 2023-08-15 | Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the x… |
CVE-2023-38852 | Medium | 6.5 | 2023-08-15 | Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the u… |
CVE-2023-38851 | Medium | 6.5 | 2023-08-15 | Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the x… |
CVE-2023-38850 | Medium | 5.5 | 2023-08-15 | Buffer Overflow vulnerability in Michaelrsweet codedoc v.3.7 allows an attacker to cause a denial of service via the codedoc.c:1742 comppnent. |
CVE-2023-38840 | Medium | 5.5 | 2023-08-15 | Bitwarden Desktop 2023.7.0 and below allows an attacker with local access to obtain sensitive information via the Bitwarden.exe process. |
CVE-2023-35082 | Critical | 9.8 | 2023-08-15 | An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the applica… |
CVE-2023-32006 | High | 8.8 | 2023-08-15 | The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. … |
CVE-2023-32004 | High | 8.8 | 2023-08-15 | A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of Buf… |
CVE-2023-32003 | Medium | 5.3 | 2023-08-15 | `fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the permission model check using a path traversal attack. This flaw arises from a missing check in… |
CVE-2023-4371 | Low | 3.5 | 2023-08-15 | A vulnerability was found in phpRecDB 1.3.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /index.php. The… |
CVE-2023-28479 | High | 8.8 | 2023-08-15 | An issue was discovered in Tigergraph Enterprise 3.7.0. The TigerGraph platform installs a full development toolchain within every TigerGraph deployment. An at… |
CVE-2023-30778 | Medium | 5.5 | 2023-08-15 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Blubrry PowerPress Podcasting plugin by Blubrry plugin <= 10.0.1 versions. |
CVE-2023-30747 | High | 7.1 | 2023-08-15 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPGem WooCommerce Easy Duplicate Product plugin <= 0.3.0.0 versions. |
CVE-2023-30498 | High | 7.1 | 2023-08-15 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CodeFlavors Vimeotheque: Vimeo WordPress Plugin <= 2.2.1 versions. |
CVE-2023-24478 | Medium | 5.5 | 2023-08-15 | Use of insufficiently random values for some Intel Agilex(R) software included as part of Intel(R) Quartus(R) Prime Pro Edition for linux before version 22.4 m… |
CVE-2023-2916 | High | 7.5 | 2023-08-15 | The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the 'admin_notice' func… |
CVE-2023-4308 | High | 7.2 | 2023-08-15 | The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user-submitted-content’ parameter in versions up to, and in… |
CVE-2023-4347 | Medium | 5.4 | 2023-08-15 | Cross-site Scripting (XSS) - Reflected in GitHub repository librenms/librenms prior to 23.8.0. |
CVE-2023-32358 | High | 8.8 | 2023-08-14 | A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.4 and iPadOS 16.4, macOS Ventura 13.3. Processing web content may lead… |
CVE-2023-28199 | Medium | 5.5 | 2023-08-14 | An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in macO… |
CVE-2023-28198 | High | 8.8 | 2023-08-14 | A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 16.4 and iPadOS 16.4, macOS Ventura 13.3. Processing web conte… |
CVE-2023-28179 | High | 7.1 | 2023-08-14 | The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.3. Processing a maliciously crafted AppleScript binary may resul… |
CVE-2023-27948 | Medium | 5.5 | 2023-08-14 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3. Processing an image may result in disclosure of… |
CVE-2023-27947 | Medium | 5.5 | 2023-08-14 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3. Processing an image may result in disclosure of… |
CVE-2023-27939 | Medium | 5.5 | 2023-08-14 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3. Processing an image may result in disclosure of… |
CVE-2023-40518 | High | 7.5 | 2023-08-14 | LiteSpeed OpenLiteSpeed before 1.7.18 does not strictly validate HTTP request headers. |
CVE-2023-35689 | High | 7.8 | 2023-08-14 | In checkDebuggingDisallowed of DeviceVersionFragment.java, there is a possible way to access adb before SUW completion due to an insecure default value. This c… |