2023 CVEs (page 18)
Page 18 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-52929 | Medium | 5.5 | 2025-03-27 | In the Linux kernel, the following vulnerability has been resolved: nvmem: core: fix cleanup after dev_set_name() If dev_set_name() fails, we leak nvmem->wp_… |
CVE-2023-52928 | Medium | 5.5 | 2025-03-27 | In the Linux kernel, the following vulnerability has been resolved: bpf: Skip invalid kfunc call in backtrack_insn The verifier skips invalid kfunc call in c… |
CVE-2023-52972 | Medium | 5.5 | 2025-03-26 | Huawei PCs have a vulnerability that allows low-privilege users to bypass SDDL permission checks . Successful exploitation this vulnerability could lead to ter… |
CVE-2023-25610 | Critical | 9.8 | 2025-03-24 | A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7… |
CVE-2023-43029 | Medium | 6.8 | 2025-03-21 | IBM Storage Virtualize vSphere Remote Plug-in 1.0 and 1.1 could allow a remote user to obtain sensitive credential information after deployment. |
CVE-2023-28207 | Medium | 5.5 | 2025-03-21 | The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. A plug-in may be able to… |
CVE-2023-47539 | Critical | 9.8 | 2025-03-18 | An improper access control vulnerability in FortiMail version 7.4.0 configured with RADIUS authentication and remote_wildcard enabled may allow a remote unauth… |
CVE-2023-48785 | Medium | 4.8 | 2025-03-14 | An improper certificate validation vulnerability [CWE-295] in FortiNAC-F version 7.2.4 and below may allow a remote and unauthenticated attacker to perform a M… |
CVE-2023-45588 | High | 8.2 | 2025-03-14 | An external control of file name or path vulnerability [CWE-73] in FortiClientMac version 7.2.3 and below, version 7.0.10 and below installer may allow a loca… |
CVE-2023-33300 | Medium | 5.3 | 2025-03-14 | A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiNAC 7.2.1 and earlier, 9.4.3 and earlier allows attacker… |
CVE-2023-52927 | High | 7.8 | 2025-03-14 | In the Linux kernel, the following vulnerability has been resolved: netfilter: allow exp not to be removed in nf_ct_find_expectation Currently nf_conntrack_i… |
CVE-2023-48790 | High | 7.5 | 2025-03-11 | A cross site request forgery vulnerability [CWE-352] in Fortinet FortiNDR version 7.4.0, 7.2.0 through 7.2.1 and 7.1.0 through 7.1.1 and before 7.0.5 may allow… |
CVE-2023-42784 | Medium | 5.6 | 2025-03-11 | An improper handling of syntactically invalid structure in Fortinet FortiWeb at least verions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 and 7.0.0 through 7… |
CVE-2023-40723 | High | 8.1 | 2025-03-11 | An exposure of sensitive information to an unauthorized actor in Fortinet FortiSIEM version 6.7.0 through 6.7.4 and 6.6.0 through 6.6.3 and 6.5.0 through 6.5.1… |
CVE-2023-37933 | High | 8.8 | 2025-03-11 | An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiADC GUI version 7.4.0, 7.2.0 through 7.2… |
CVE-2023-52971 | Medium | 4.9 | 2025-03-08 | MariaDB Server 10.10 through 10.11.* and 11.0 through 11.4.* crashes in JOIN::fix_all_splittings_in_plan. |
CVE-2023-52970 | Medium | 4.9 | 2025-03-08 | MariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through 10.11.*, 11.0 through 11.0.*, and 11.1 through 11.4.* crashes in Item_direct_view_ref::de… |
CVE-2023-52969 | Medium | 4.9 | 2025-03-08 | MariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through 10.11.*, and 11.0 through 11.0.* can sometimes crash with an empty backtrace log. This ma… |
CVE-2023-52968 | Medium | 4.9 | 2025-03-08 | MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 cal… |
CVE-2023-43052 | Medium | 5.3 | 2025-03-07 | IBM Control Center 6.2.1 through 6.3.1 is vulnerable to an external service interaction attack, caused by improper validation of user-supplied input. A remote… |
CVE-2023-35894 | Medium | 5.4 | 2025-03-07 | IBM Control Center 6.2.1 through 6.3.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an… |
CVE-2023-38693 | Critical | 9.8 | 2025-03-05 | Lucee Server (or simply Lucee) is a dynamic, Java based, tag and scripting language used for rapid web application development. The Lucee REST endpoint is vuln… |
CVE-2023-49031 | Medium | 5.1 | 2025-03-03 | Directory Traversal (Local File Inclusion) vulnerability in Tikit (now Advanced) eMarketing platform 6.8.3.0 allows a remote attacker to read arbitrary files a… |
CVE-2023-25574 | Critical | 10.0 | 2025-02-25 | `jupyterhub-ltiauthenticator` is a JupyterHub authenticator for learning tools interoperability (LTI). LTI13Authenticator that was introduced in `jupyterhub-lt… |
CVE-2023-52926 | High | 7.8 | 2025-02-24 | In the Linux kernel, the following vulnerability has been resolved: IORING_OP_READ did not correctly consume the provided buffer list when read i/o returned <… |
CVE-2023-51339 | Medium | 6.5 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Event Ticketing System v1.0 allows attackers to send an excessive amount of email for a… |
CVE-2023-51338 | Medium | 5.4 | 2025-02-20 | PHPJabbers Meeting Room Booking System v1.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "title, name" parameters of index.php … |
CVE-2023-51337 | Medium | 5.4 | 2025-02-20 | PHPJabbers Event Ticketing System v1.0 is vulnerable to Reflected Cross-Site Scripting (XSS) in "lid" parameter in index. |
CVE-2023-51336 | High | 8.8 | 2025-02-20 | PHPJabbers Meeting Room Booking System v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exi… |
CVE-2023-51335 | Medium | 6.5 | 2025-02-20 | PHPJabbers Cinema Booking System v1.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "title, name" parameters. |
CVE-2023-51334 | Medium | 5.3 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Cinema Booking System v1.0 allows attackers to send an excessive amount of email for a l… |
CVE-2023-51333 | High | 8.8 | 2025-02-20 | PHPJabbers Cinema Booking System v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists du… |
CVE-2023-51332 | Medium | 4.3 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Meeting Room Booking System v1.0 allows attackers to send an excessive amount of email f… |
CVE-2023-51331 | Medium | 6.5 | 2025-02-20 | PHPJabbers Cleaning Business Software v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exis… |
CVE-2023-51330 | Medium | 5.4 | 2025-02-20 | PHPJabbers Cinema Booking System v1.0 is vulnerable to Reflected Cross-Site Scripting (XSS) in Now Showing menu "date" parameter. |
CVE-2023-51327 | Medium | 6.5 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Cleaning Business Software v1.0 allows attackers to send an excessive amount of email fo… |
CVE-2023-51326 | Medium | 6.5 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Cleaning Business Software v1.0 allows attackers to send an excessive amount of email fo… |
CVE-2023-51325 | Medium | 5.4 | 2025-02-20 | PHPJabbers Shared Asset Booking System v1.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "title, name" parameters. |
CVE-2023-51324 | Medium | 6.5 | 2025-02-20 | PHPJabbers Shared Asset Booking System v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exi… |
CVE-2023-51323 | Medium | 6.5 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Shared Asset Booking System v1.0 allows attackers to send an excessive amount of email f… |
CVE-2023-51321 | Medium | 6.5 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Night Club Booking Software v1.0 allows attackers to send an excessive amount of email f… |
CVE-2023-51320 | Medium | 5.3 | 2025-02-20 | PHPJabbers Night Club Booking Software v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exi… |
CVE-2023-51319 | High | 8.8 | 2025-02-20 | PHPJabbers Bus Reservation System v1.1 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists d… |
CVE-2023-51318 | Medium | 5.4 | 2025-02-20 | PHPJabbers Bus Reservation System v1.1 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "title, name" parameters. |
CVE-2023-51317 | Medium | 6.5 | 2025-02-20 | PHPJabbers Restaurant Booking System v3.0 is vulnerable to Multiple HTML Injection in the "name, plugin_sms_api_key, plugin_sms_country_code, title, plugin_sms… |
CVE-2023-51316 | High | 7.5 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Bus Reservation System v1.1 allows attackers to send an excessive amount of email for a… |
CVE-2023-51315 | Medium | 5.4 | 2025-02-20 | PHPJabbers Restaurant Booking System v3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "seat_name, plugin_sms_api_key, plugin_sms_country… |
CVE-2023-51314 | High | 7.5 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password', 'Email Settings' feature of PHPJabbers Restaurant Booking System v3.0 allows attackers to send an excessive a… |
CVE-2023-51313 | High | 8.8 | 2025-02-20 | PHPJabbers Restaurant Booking System v3.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exist… |
CVE-2023-51312 | Medium | 5.4 | 2025-02-20 | PHPJabbers Restaurant Booking System v3.0 is vulnerable to Reflected Cross-Site Scripting (XSS) in Reservations menu, Schedule section date parameter. |
CVE-2023-51311 | High | 8.8 | 2025-02-20 | PHPJabbers Car Park Booking System v3.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists… |
CVE-2023-51310 | Medium | 4.3 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password', 'Email Settings' feature of PHPJabbers Car Park Booking System v3.0 allows attackers to send an excessive amo… |
CVE-2023-51309 | Medium | 4.3 | 2025-02-20 | A lack of rate limiting in the 'Email Settings' feature of PHPJabbers Car Park Booking System v3.0 allows attackers to send an excessive amount of email for a… |
CVE-2023-51308 | Medium | 6.1 | 2025-02-20 | PHPJabbers Car Park Booking System v3.0 is vulnerable to Multiple HTML Injection in the "name, plugin_sms_api_key, plugin_sms_country_code, title, plugin_sms_a… |
CVE-2023-51306 | Medium | 5.4 | 2025-02-20 | PHPJabbers Event Ticketing System v1.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "name, title" parameters. |
CVE-2023-51305 | Medium | 5.4 | 2025-02-19 | PHPJabbers Car Park Booking System v3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "name, plugin_sms_api_key, plugin_sms_country_code… |
CVE-2023-51303 | Medium | 6.1 | 2025-02-19 | PHPJabbers Event Ticketing System v1.0 is vulnerable to Multiple HTML Injection in the "lid, name, plugin_sms_api_key, plugin_sms_country_code, title, plugin_s… |
CVE-2023-51302 | High | 8.8 | 2025-02-19 | PHPJabbers Hotel Booking System v4.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due… |
CVE-2023-51301 | High | 7.5 | 2025-02-19 | A lack of rate limiting in the "Login Section, Forgot Email" feature of PHPJabbers Hotel Booking System v4.0 allows attackers to send an excessive amount of re… |
CVE-2023-51300 | Medium | 6.1 | 2025-02-19 | PHPJabbers Hotel Booking System v4.0 is vulnerable to Cross-Site Scripting (XSS) vulnerabilities in the "name, plugin_sms_api_key, plugin_sms_country_code, tit… |
CVE-2023-51299 | Medium | 6.1 | 2025-02-19 | PHPJabbers Hotel Booking System v4.0 is vulnerable to HTML Injection in the "name, plugin_sms_api_key, plugin_sms_country_code, title, plugin_sms_api_key, titl… |
CVE-2023-51298 | Medium | 4.7 | 2025-02-19 | PHPJabbers Event Booking Calendar v4.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists d… |
CVE-2023-51297 | Medium | 6.5 | 2025-02-19 | A lack of rate limiting in the 'Email Settings' feature of PHPJabbers Hotel Booking System v4.0 allows attackers to send an excessive amount of email for a leg… |
CVE-2023-51296 | Medium | 6.1 | 2025-02-19 | PHPJabbers Event Booking Calendar v4.0 is vulnerable to Cross-Site Scripting (XSS) in the "name, plugin_sms_api_key, plugin_sms_country_code, title, plugin_sms… |
CVE-2023-51293 | High | 7.5 | 2025-02-19 | A lack of rate limiting in the 'Forgot Password', 'Email Settings' feature of PHPJabbers Event Booking Calendar v4.0 allows attackers to send an excessive amou… |
CVE-2023-46272 | High | 8.8 | 2025-02-19 | Buffer Overflow vulnerability in Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, allows an attacker to execute arbitrary code via… |
CVE-2023-46271 | Critical | 9.8 | 2025-02-19 | Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, has a buffer overflow. This issue arises from the ah_webui service, which listens… |
CVE-2023-47160 | High | 8.2 | 2025-02-19 | IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing… |
CVE-2023-34406 | Low | 3.3 | 2025-02-13 | An issue was discovered on Mercedes Benz NTG 6. A possible integer overflow exists in the user data import/export function of NTG (New Telematics Generation) 6… |
CVE-2023-34404 | Medium | 4.9 | 2025-02-13 | Mercedes-Benz head-unit NTG6 has Ethernet pins on Base Board to connect module CSB. Attacker can connect to these pins and get access to internal network. As a… |
CVE-2023-34403 | Medium | 4.9 | 2025-02-13 | Mercedes-Benz head-unit NTG6 has Ethernet pins on Base Board to connect module CSB. Attacker can connect to this pins and get access to internal network. A rac… |
CVE-2023-34402 | High | 7.7 | 2025-02-13 | Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Inside file is encapsulate another file, which service will drop… |
CVE-2023-34401 | Low | 3.7 | 2025-02-13 | Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Inside profile folder there is a file, which is encoded with pro… |
CVE-2023-34400 | High | 7.5 | 2025-02-13 | Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. In case of parsing file, service try to define header inside the… |
CVE-2023-34399 | Critical | 9.8 | 2025-02-13 | Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Some values of this table are serialized archive according boost… |
CVE-2023-34398 | High | 7.5 | 2025-02-13 | Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Some values of this table are serialized archive according boost… |
CVE-2023-34397 | High | 7.5 | 2025-02-13 | Mercedes Benz head-unit NTG 6 contains functions to import or export profile settings over USB. During parsing you can trigger that the service will be crashed. |
CVE-2023-49618 | High | 7.5 | 2025-02-12 | Improper buffer restrictions in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enable es… |
CVE-2023-49615 | High | 7.5 | 2025-02-12 | Improper input validation in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enable escal… |
CVE-2023-49603 | High | 7.5 | 2025-02-12 | Race condition in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enable escalation of pr… |
CVE-2023-48366 | Medium | 5.3 | 2025-02-12 | Race condition in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enable information disc… |
CVE-2023-48267 | High | 7.9 | 2025-02-12 | Improper buffer restrictions in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enable es… |
CVE-2023-43758 | High | 8.2 | 2025-02-12 | Improper input validation in UEFI firmware for some Intel(R) processors may allow a privileged user to potentially enable escalation of privilege via local acc… |
CVE-2023-34440 | High | 7.5 | 2025-02-12 | Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local acc… |
CVE-2023-32277 | Medium | 6.1 | 2025-02-12 | Untrusted Pointer Dereference in I/O subsystem for some Intel(R) QAT software before version 2.0.5 may allow authenticated user to potentially enable informati… |
CVE-2023-31276 | High | 8.2 | 2025-02-12 | Heap-based buffer overflow in BMC Firmware for the Intel(R) Server Board S2600WF, Intel(R) Server Board S2600ST, Intel(R) Server Board S2600BP, before version… |
CVE-2023-29164 | High | 7.3 | 2025-02-12 | Improper access control in BMC Firmware for the Intel(R) Server Board S2600WF, Intel(R) Server Board S2600ST, Intel(R) Server Board S2600BP, before version 02… |
CVE-2023-49780 | Medium | 6.1 | 2025-02-12 | Cross-site scripting vulnerability exists in acmailer CGI ver.4.0.5 and earlier. An arbitrary script may be executed on the web browser of the user who accesse… |
CVE-2023-31345 | High | 7.5 | 2025-02-12 | Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution. |
CVE-2023-20508 | Medium | 5.0 | 2025-02-12 | Improper access control in the ASP could allow a privileged attacker to perform an out-of-bounds write to a memory location not controlled by the attacker, pot… |
CVE-2023-31352 | Medium | 6.0 | 2025-02-11 | A bug in the SEV firmware may allow an attacker with privileges to read unencrypted memory, potentially resulting in loss of guest private data. |
CVE-2023-31343 | High | 7.5 | 2025-02-11 | Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution. |
CVE-2023-31342 | High | 7.5 | 2025-02-11 | Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution. |
CVE-2023-31331 | Low | 3.0 | 2025-02-11 | Improper access control in the DRTM firmware could allow a privileged attacker to perform multiple driver initializations, resulting in stack memory corruption… |
CVE-2023-20582 | Medium | 5.3 | 2025-02-11 | Improper handling of invalid nested page table entries in the IOMMU may allow a privileged attacker to induce page table entry (PTE) faults to bypass RMP check… |
CVE-2023-20581 | Low | 2.5 | 2025-02-11 | Improper access control in the IOMMU may allow a privileged attacker to bypass RMP checks, potentially leading to a loss of guest memory integrity. |
CVE-2023-20515 | Medium | 5.7 | 2025-02-11 | Improper access control in the fTPM driver in the trusted OS could allow a privileged attacker to corrupt system memory, potentially leading to loss of integri… |
CVE-2023-20507 | Low | 2.3 | 2025-02-11 | An integer overflow in the ASP could allow a privileged attacker to perform an out-of-bounds write, potentially resulting in loss of data integrity. |
CVE-2023-31361 | High | 7.3 | 2025-02-11 | A DLL hijacking vulnerability in AMD Integrated Management Technology (AIM-T) Manageability Service could allow an attacker to achieve privilege escalation pot… |
CVE-2023-31360 | High | 7.3 | 2025-02-11 | Incorrect default permissions in the AMD Integrated Management Technology (AIM-T) Manageability Service installation directory could allow an attacker to achie… |