2023 CVEs (page 181)
Page 181 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-38222 | High | 7.8 | 2023-08-10 | Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by a Use After Free vulnerability that could result in arb… |
CVE-2023-38210 | Medium | 5.5 | 2023-08-10 | Adobe XMP Toolkit versions 2022.06 is affected by a Uncontrolled Resource Consumption vulnerability. An unauthenticated attacker could leverage this vulnerabil… |
CVE-2023-37734 | Critical | 9.8 | 2023-08-10 | EZ softmagic MP3 Audio Converter 2.7.3.700 was discovered to contain a buffer overflow. |
CVE-2023-37388 | Medium | 5.9 | 2023-08-10 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Sudipto Pratap Mahato Simple Light Weight Social Share plugin <= 2.0 versions. |
CVE-2023-29320 | High | 7.8 | 2023-08-10 | Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an Violation of Secure Design Principles vulnerability… |
CVE-2023-29303 | Medium | 5.5 | 2023-08-10 | Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by a Use After Free vulnerability that could lead to discl… |
CVE-2023-29299 | Medium | 4.7 | 2023-08-10 | Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an Untrusted Search Path vulnerability that could lead… |
CVE-2023-39314 | High | 7.1 | 2023-08-10 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Teplitsa of social technologies Leyka plugin <= 3.30.2 versions. |
CVE-2023-37983 | Medium | 6.5 | 2023-08-10 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Noël Jackson Art Direction plugin <= 0.2.4 versions. |
CVE-2023-37069 | Critical | 9.8 | 2023-08-10 | Code-Projects Online Hospital Management System V1.0 is vulnerable to SQL Injection (SQLI) attacks, which allow an attacker to manipulate the SQL queries execu… |
CVE-2023-28779 | High | 7.1 | 2023-08-10 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Vladimir Statsenko Terms descriptions plugin <= 3.4.4 versions. |
CVE-2023-24393 | Medium | 6.5 | 2023-08-10 | Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Sk. Abul Hasan Animated Number Counters plugin <= 1.6 versions. |
CVE-2023-24391 | Medium | 5.9 | 2023-08-10 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Spider Teams ApplyOnline plugin <= 2.5 versions. |
CVE-2023-23828 | Medium | 6.5 | 2023-08-10 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Swashata WP Category Post List Widget plugin <= 2.0.3 versions. |
CVE-2023-4283 | Medium | 6.4 | 2023-08-10 | The EmbedPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'embedpress_calendar' shortcode in versions up to, and including, 3.8… |
CVE-2023-4282 | Medium | 5.4 | 2023-08-10 | The EmbedPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'admin_post_remove' and 'remove_private… |
CVE-2023-36530 | Medium | 5.9 | 2023-08-10 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Smartypants SP Project & Document Manager plugin <= 4.67 versions. |
CVE-2023-34374 | Medium | 5.9 | 2023-08-10 | Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Rahul Aryan AnsPress plugin <= 4.3.0 versions. |
CVE-2023-30481 | High | 7.1 | 2023-08-10 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Alexey Golubnichenko AGP Font Awesome Collection plugin <= 3.2.4 versions. |
CVE-2023-23900 | Medium | 5.8 | 2023-08-10 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in YIKES, Inc. Easy Forms for Mailchimp plugin <= 6.8.8 versions. |
CVE-2023-37988 | High | 7.1 | 2023-08-10 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Creative Solutions Contact Form Generator plugin <= 2.5.5 versions. |
CVE-2023-26311 | High | 7.4 | 2023-08-10 | A remote code execution vulnerability in the webview component of OPPO Store app. |
CVE-2023-24009 | Medium | 5.4 | 2023-08-10 | Auth. (subscriber+) Reflected Cross-site Scripting (XSS) vulnerability in Wpazure Themes Upfrontwp theme <= 1.1 versions. |
CVE-2023-23871 | Medium | 5.9 | 2023-08-10 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Webdzier Button plugin <= 1.1.23 versions. |
CVE-2023-23798 | Medium | 6.5 | 2023-08-10 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Muneeb Layer Slider plugin <= 1.1.9.7 versions. |
CVE-2023-24389 | Medium | 5.9 | 2023-08-10 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in brandiD Social Proof (Testimonial) Slider plugin <= 2.2.3 versions. |
CVE-2023-23826 | Medium | 6.5 | 2023-08-10 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Arsham Mirshah Add Posts to Pages plugin <= 1.4.1 versions. |
CVE-2023-31209 | High | 8.8 | 2023-08-10 | Improper neutralization of active check command arguments in Checkmk < 2.1.0p32, < 2.0.0p38, < 2.2.0p4 leads to arbitrary command execution for authenticated u… |
CVE-2023-26309 | High | 7.4 | 2023-08-10 | A remote code execution vulnerability in the webview component of OnePlus Store app. |
CVE-2023-4277 | High | 8.8 | 2023-08-10 | The Realia plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.0. This is due to missing nonce validation on… |
CVE-2023-4276 | High | 8.8 | 2023-08-10 | The Absolute Privacy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1. This is due to missing nonce valid… |
CVE-2023-30705 | Medium | 6.8 | 2023-08-10 | Improper sanitization of incoming intent in Galaxy Store prior to version 4.5.56.6?allows local attackers to access privileged content providers as Galaxy Stor… |
CVE-2023-30704 | Low | 3.8 | 2023-08-10 | Improper Authorization vulnerability in Samsung Internet prior to version 22.0.0.35 allows physical attacker access downloaded files in Secret Mode without use… |
CVE-2023-30703 | Low | 3.3 | 2023-08-10 | Improper URL validation vulnerability in Samsung Members prior to version 14.0.07.1 allows attackers to access sensitive information. |
CVE-2023-30702 | Medium | 6.7 | 2023-08-10 | Stack overflow vulnerability in SSHDCPAPP TA prior to "SAMSUNG ELECTONICS, CO, LTD. - System Hardware Update - 7/13/2023" in Windows Update for Galax… |
CVE-2023-30701 | Medium | 4.7 | 2023-08-10 | PendingIntent hijacking in WifiGeofenceManager prior to SMR Aug-2023 Release 1 allows local attacker to arbitrary file access. |
CVE-2023-30700 | Medium | 5.3 | 2023-08-10 | PendingIntent hijacking vulnerability in SemWifiApTimeOutImpl in framework prior to SMR Aug-2023 Release 1 allows local attackers to access ContentProvider wit… |
CVE-2023-30699 | High | 7.5 | 2023-08-10 | Out-of-bounds write vulnerability in parser_hvcC function of libsimba library prior to SMR Aug-2023 Release 1 allows code execution by remote attackers. |
CVE-2023-30698 | Medium | 5.5 | 2023-08-10 | Improper access control vulnerability in TelephonyUI prior to SMR Aug-2023 Release 1 allows local attacker to connect BLE without privilege. |
CVE-2023-30697 | Medium | 4.4 | 2023-08-10 | An improper input validation in IpcTxCfgSetSimlockPayload in libsec-ril prior to SMR Aug-2023 Release 1 allows attacker to cause out-of-bounds write. |
CVE-2023-30696 | Medium | 4.4 | 2023-08-10 | An improper input validation in IpcTxGetVerifyAkey in libsec-ril prior to SMR Aug-2023 Release 1 allows attacker to cause out-of-bounds write. |
CVE-2023-30695 | Medium | 6.7 | 2023-08-10 | Out-of-bounds Write vulnerability in SSHDCPAPP TA prior to "SAMSUNG ELECTONICS, CO, LTD. - System Hardware Update - 7/13/2023" in Windows Update for… |
CVE-2023-30694 | Medium | 6.7 | 2023-08-10 | Out-of-bounds Write in IpcTxPcscTransmitApdu of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute arbitrary code. |
CVE-2023-30693 | Medium | 6.7 | 2023-08-10 | Out-of-bounds Write in DoOemFactorySendFactoryBypassCommand of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute arbitrary code. |
CVE-2023-30691 | High | 8.4 | 2023-08-10 | Parcel mismatch in AuthenticationConfig prior to SMR Aug-2023 Release 1 allows local attacker to privilege escalation. |
CVE-2023-30689 | Medium | 6.7 | 2023-08-10 | Out-of-bounds Write in BuildOemEmbmsGetSigStrengthResponse of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute arbitrary code. |
CVE-2023-30688 | Medium | 6.7 | 2023-08-10 | Out-of-bounds Write in MakeUiccAuthForOem of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute arbitrary code. |
CVE-2023-30687 | Medium | 6.7 | 2023-08-10 | Out-of-bounds Write in RmtUimApdu of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute arbitrary code. |
CVE-2023-30686 | Medium | 6.7 | 2023-08-10 | Out-of-bounds Write in ReqDataRaw of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute arbitrary code. |
CVE-2023-30685 | Medium | 4.3 | 2023-08-10 | Improper access control vulnerability in Telecom prior to SMR Aug-2023 Release 1 allows local attakcers to change TTY mode. |
CVE-2023-30684 | Medium | 4.3 | 2023-08-10 | Improper access control in Samsung Telecom prior to SMR Aug-2023 Release 1 allows local attackers to call acceptRingingCall API without permission. |
CVE-2023-30683 | Medium | 4.3 | 2023-08-10 | Improper access control in Telecom prior to SMR Aug-2023 Release 1 allows local attackers to call endCall API without permission. |
CVE-2023-30682 | Medium | 4.3 | 2023-08-10 | Improper access control in Telecom prior to SMR Aug-2023 Release 1 allows local attackers to call silenceRinger API without permission. |
CVE-2023-30681 | Medium | 4.4 | 2023-08-10 | An improper input validation vulnerability within initialize function in HAL VaultKeeper prior to SMR Aug-2023 Release 1 allows attacker to cause out-of-bounds… |
CVE-2023-30680 | High | 8.4 | 2023-08-10 | Improper privilege management vulnerability in MMIGroup prior to SMR Aug-2023 Release 1 allows code execution with privilege. |
CVE-2023-30679 | High | 7.8 | 2023-08-10 | Improper access control in HDCP trustlet prior to SMR Aug-2023 Release 1 allows local attackers to execute arbitrary code. |
CVE-2023-30654 | Medium | 6.7 | 2023-08-10 | Improper access control vulnerability in SLocationService prior to SMR Aug-2023 Release 1 allows local attacker to update fake location. |
CVE-2023-36673 | High | 7.3 | 2023-08-09 | An issue was discovered in Avira Phantom VPN through 2.23.1 for macOS. The VPN client insecurely configures the operating system such that all IP traffic to th… |
CVE-2023-36672 | Medium | 5.7 | 2023-08-09 | An issue was discovered in the Clario VPN client through 5.9.1.1662 for macOS. The VPN client insecurely configures the operating system such that traffic to t… |
CVE-2023-36671 | Medium | 6.3 | 2023-08-09 | An issue was discovered in the Clario VPN client through 5.9.1.1662 for macOS. The VPN client insecurely configures the operating system such that all IP traff… |
CVE-2023-35838 | Medium | 5.7 | 2023-08-09 | The WireGuard client 0.5.3 on Windows insecurely configures the operating system and firewall such that traffic to a local network that uses non-RFC1918 IP add… |
CVE-2023-33242 | Critical | 9.6 | 2023-08-09 | Crypto wallets implementing the Lindell17 TSS protocol might allow an attacker to extract the full ECDSA private key by exfiltrating a single bit in every sign… |
CVE-2023-33241 | Critical | 9.6 | 2023-08-09 | Crypto wallets implementing the GG18 or GG20 TSS protocol might allow an attacker to extract a full ECDSA private key by injecting a malicious pallier key and… |
CVE-2023-38348 | High | 8.8 | 2023-08-09 | A CSRF issue was discovered in LWsystems Benno MailArchiv 2.10.1. |
CVE-2023-38347 | Medium | 6.1 | 2023-08-09 | An issue was discovered in LWsystems Benno MailArchiv 2.10.1. Attackers can cause XSS via JavaScript content to a mailbox. |
CVE-2023-37068 | Critical | 9.8 | 2023-08-09 | Code-Projects Gym Management System V1.0 allows remote attackers to execute arbitrary SQL commands via the login form, leading to unauthorized access and poten… |
CVE-2023-33469 | High | 7.8 | 2023-08-09 | In instances where the screen is visible and remote mouse connection is enabled, KramerAV VIA Connect (2) and VIA Go (2) devices with a version prior to 4.0.1… |
CVE-2023-33468 | Critical | 9.1 | 2023-08-09 | KramerAV VIA Connect (2) and VIA Go (2) devices with a version prior to 4.0.1.1326 exhibit a vulnerability that enables remote manipulation of the device. This… |
CVE-2023-23347 | Medium | 6.4 | 2023-08-09 | HCL DRYiCE iAutomate is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of s… |
CVE-2023-39008 | Critical | 9.8 | 2023-08-09 | A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allo… |
CVE-2023-39007 | Critical | 9.6 | 2023-08-09 | /ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows XSS via openAction in app/controll… |
CVE-2023-39006 | Medium | 5.4 | 2023-08-09 | The Crash Reporter (crash_reporter.php) component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 mishandles input sanitization. |
CVE-2023-39005 | High | 7.5 | 2023-08-09 | Insecure permissions exist for configd.socket in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2. |
CVE-2023-39004 | Critical | 9.8 | 2023-08-09 | Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to ac… |
CVE-2023-39003 | High | 7.5 | 2023-08-09 | OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 was discovered to contain insecure permissions in the directory /tmp. |
CVE-2023-39002 | Medium | 6.1 | 2023-08-09 | A cross-site scripting (XSS) vulnerability in the act parameter of system_certmanager.php in OPNsense Community Edition before 23.7 and Business Edition before… |
CVE-2023-39001 | Critical | 9.8 | 2023-08-09 | A command injection vulnerability in the component diag_backup.php of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attacker… |
CVE-2023-39000 | Medium | 6.1 | 2023-08-09 | A reflected cross-site scripting (XSS) vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community Edition before 23.7 and Business Edition… |
CVE-2023-38999 | Medium | 6.5 | 2023-08-09 | A Cross-Site Request Forgery (CSRF) in the System Halt API (/system/halt) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows a… |
CVE-2023-38998 | Medium | 6.1 | 2023-08-09 | An open redirect in the Login page of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to redirect a victim user to a… |
CVE-2023-38997 | High | 7.2 | 2023-08-09 | A directory traversal vulnerability in the Captive Portal templates of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attacke… |
CVE-2023-23346 | Medium | 6.4 | 2023-08-09 | HCL DRYiCE MyCloud is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of sen… |
CVE-2023-39531 | Medium | 6.5 | 2023-08-09 | Sentry is an error tracking and performance monitoring platform. Starting in version 10.0.0 and prior to version 23.7.2, an attacker with sufficient client-sid… |
CVE-2023-40012 | Medium | 5.9 | 2023-08-09 | uthenticode is a small cross-platform library for partially verifying Authenticode digital signatures. Versions of uthenticode prior to the 2.x series did not… |
CVE-2023-3518 | High | 7.4 | 2023-08-09 | HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in… |
CVE-2023-39969 | Critical | 9.0 | 2023-08-09 | uthenticode is a small cross-platform library for partially verifying Authenticode digital signatures. Version 1.0.9 of uthenticode hashed the entire file rath… |
CVE-2023-4273 | Medium | 6.0 | 2023-08-09 | A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation of the file name reconstruction function, which is res… |
CVE-2023-3953 | Medium | 5.3 | 2023-08-09 | A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause memory corruption when an authenticat… |
CVE-2023-34545 | Critical | 9.8 | 2023-08-09 | A SQL injection vulnerability in CSZCMS 1.3.0 allows remote attackers to run arbitrary SQL commands via p parameter or the search URL. |
CVE-2023-33953 | High | 7.5 | 2023-08-09 | gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional cases/ Th… |
CVE-2023-32782 | High | 7.2 | 2023-08-09 | A command injection was identified in PRTG 23.2.84.1566 and earlier versions in the Dicom C-ECHO sensor where an authenticated user with write permissions coul… |
CVE-2023-32781 | High | 7.2 | 2023-08-09 | A command injection vulnerability was identified in PRTG 23.2.84.1566 and earlier versions in the HL7 sensor where an authenticated user with write permissions… |
CVE-2023-31452 | High | 8.8 | 2023-08-09 | A cross-site request forgery (CSRF) token bypass was identified in PRTG 23.2.84.1566 and earlier versions that allows remote attackers to perform actions with… |
CVE-2023-31450 | Medium | 4.7 | 2023-08-09 | A path traversal vulnerability was identified in the SQL v2 sensors in PRTG 23.2.84.1566 and earlier versions where an authenticated user with write permission… |
CVE-2023-31449 | Medium | 4.7 | 2023-08-09 | A path traversal vulnerability was identified in the WMI Custom sensor in PRTG 23.2.84.1566 and earlier versions where an authenticated user with write permiss… |
CVE-2023-31448 | Medium | 4.7 | 2023-08-09 | A path traversal vulnerability was identified in the HL7 sensor in PRTG 23.2.84.1566 and earlier versions where an authenticated user with write permissions co… |
CVE-2023-24015 | Medium | 4.3 | 2023-08-09 | A partial DoS vulnerability has been detected in the Reports section, exploitable by a malicious authenticated user forcing a report to be saved with its name… |
CVE-2023-23903 | Medium | 4.9 | 2023-08-09 | An authenticated administrator can upload a SAML configuration file with the wrong format, with the application not checking the correct file format. Every sub… |
CVE-2023-3632 | Critical | 9.8 | 2023-08-09 | Use of Hard-coded Cryptographic Key vulnerability in Sifir Bes Education and Informatics Kunduz - Homework Helper App allows Authentication Abuse, Authenticati… |
CVE-2023-38213 | Medium | 5.5 | 2023-08-09 | Adobe Dimension version 3.4.9 is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage… |