2023 CVEs (page 188)
Page 188 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-4110 | Low | 3.5 | 2023-08-03 | A vulnerability has been found in PHP Jabbers Availability Booking Calendar 5.0 and classified as problematic. Affected by this vulnerability is an unknown fun… |
CVE-2023-39144 | High | 7.5 | 2023-08-03 | Element55 KnowMore appliances version 21 and older was discovered to store passwords in plaintext. |
CVE-2023-37679 | Critical | 9.8 | 2023-08-03 | A remote command execution (RCE) vulnerability in NextGen Mirth Connect v4.3.0 allows attackers to execute arbitrary commands on the hosting server. |
CVE-2023-37364 | Critical | 9.1 | 2023-08-03 | In WS-Inc J WBEM Server 4.7.4 before 4.7.5, the CIM-XML protocol adapter does not disable entity resolution. This allows context-dependent attackers to read ar… |
CVE-2023-34196 | High | 8.2 | 2023-08-03 | In the Keyfactor EJBCA before 8.0.0, the RA web certificate distribution servlet /ejbca/ra/cert allows partial denial of service due to an authentication issue… |
CVE-2023-38958 | Medium | 5.3 | 2023-08-03 | An access control issue in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to arbitrarily close and open the doors managed by the platform remotel… |
CVE-2023-38956 | High | 7.5 | 2023-08-03 | A path traversal vulnerability in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload. |
CVE-2023-38955 | High | 7.5 | 2023-08-03 | ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to obtain sensitive information about all managed devices, including their IP addresses and device… |
CVE-2023-38954 | Critical | 9.8 | 2023-08-03 | ZKTeco BioAccess IVS v3.3.1 was discovered to contain a SQL injection vulnerability. |
CVE-2023-36255 | High | 8.8 | 2023-08-03 | An issue in Eramba Limited Eramba Enterprise and Community edition v.3.19.1 allows a remote attacker to execute arbitrary code via the path parameter in the UR… |
CVE-2023-36212 | High | 8.8 | 2023-08-03 | File Upload vulnerability in Total CMS v.1.7.4 allows a remote attacker to execute arbitrary code via a crafted PHP file to the edit page function. |
CVE-2023-26979 | Low | 3.1 | 2023-08-03 | Bluetens Electrostimulation Device BluetensQ device app version 4.3.15 is vulnerable to Man-in-the-middle attacks in the BLE channel. It allows attackers to de… |
CVE-2023-4078 | High | 8.8 | 2023-08-03 | Inappropriate implementation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension t… |
CVE-2023-4077 | High | 8.8 | 2023-08-03 | Insufficient data validation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension t… |
CVE-2023-4076 | High | 8.8 | 2023-08-03 | Use after free in WebRTC in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted WebRTC session… |
CVE-2023-4075 | High | 8.8 | 2023-08-03 | Use after free in Cast in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
CVE-2023-4074 | High | 8.8 | 2023-08-03 | Use after free in Blink Task Scheduling in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted… |
CVE-2023-4073 | High | 8.8 | 2023-08-03 | Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a cra… |
CVE-2023-4072 | High | 8.8 | 2023-08-03 | Out of bounds read and write in WebGL in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted H… |
CVE-2023-4071 | High | 8.8 | 2023-08-03 | Heap buffer overflow in Visuals in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2023-4070 | High | 8.1 | 2023-08-03 | Type Confusion in V8 in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium secu… |
CVE-2023-4069 | High | 8.8 | 2023-08-03 | Type Confusion in V8 in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2023-4068 | High | 8.1 | 2023-08-03 | Type Confusion in V8 in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium secu… |
CVE-2023-36082 | Critical | 9.8 | 2023-08-03 | An isssue in GatesAIr Flexiva FM Transmitter/Exiter Fax 150W allows a remote attacker to gain privileges via the LDAP and SMTP credentials. |
CVE-2023-33371 | Critical | 9.8 | 2023-08-03 | Control ID IDSecure 4.7.26.0 and prior uses a hardcoded cryptographic key in order to sign and verify JWT session tokens, allowing attackers to sign arbitrary… |
CVE-2023-33370 | High | 7.5 | 2023-08-03 | An uncaught exception vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing attackers to cause the main web server of IDSecure to fault and… |
CVE-2023-33369 | Critical | 9.1 | 2023-08-03 | A path traversal vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing attackers to delete arbitrary files on IDSecure filesystem, causing a… |
CVE-2023-33368 | Medium | 6.5 | 2023-08-03 | Some API routes exists in Control ID IDSecure 4.7.26.0 and prior, exfiltrating sensitive information and passwords to users accessing these API routes. |
CVE-2023-3329 | Medium | 6.5 | 2023-08-02 | SpiderControl SCADA Webserver versions 2.08 and prior are vulnerable to path traversal. An attacker with administrative privileges could overwrite files on the… |
CVE-2023-39114 | Medium | 5.5 | 2023-08-02 | ngiflib commit 84a75 was discovered to contain a segmentation violation via the function SDL_LoadAnimatedGif at ngiflibSDL.c. This vulnerability is triggered w… |
CVE-2023-39113 | Medium | 5.5 | 2023-08-02 | ngiflib commit fb271 was discovered to contain a segmentation violation via the function "main" at gif2tag.c. This vulnerability is triggered when running the… |
CVE-2023-1935 | Critical | 9.4 | 2023-08-02 | ROC800-Series RTU devices are vulnerable to an authentication bypass, which could allow an attacker to gain unauthorized access to data or control of the devic… |
CVE-2023-1437 | Critical | 9.8 | 2023-08-02 | All versions prior to 9.1.4 of Advantech WebAccess/SCADA are vulnerable to use of untrusted pointers. The RPC arguments the client sent could contain raw memor… |
CVE-2023-3978 | Medium | 6.1 | 2023-08-02 | Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack. |
CVE-2023-36081 | Medium | 5.4 | 2023-08-02 | Cross Site Scripting vulnerability in GatesAIr Flexiva FM Transmitter/Exciter v.FAX 150W allows a remote attacker to execute arbitrary code via a crafted scrip… |
CVE-2023-29409 | Medium | 5.3 | 2023-08-02 | Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys tr… |
CVE-2023-29408 | Medium | 6.5 | 2023-08-02 | The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small image (both in terms… |
CVE-2023-29407 | Medium | 6.5 | 2023-08-02 | A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cause excessive CPU co… |
CVE-2023-3470 | Medium | 6.0 | 2023-08-02 | Specific F5 BIG-IP platforms with Cavium Nitrox FIPS HSM cards generate a deterministic password for the Crypto User account. The predictable nature of the p… |
CVE-2023-38423 | Medium | 5.4 | 2023-08-02 | A cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the… |
CVE-2023-38419 | Medium | 4.3 | 2023-08-02 | An authenticated attacker with guest privileges or higher can cause the iControl SOAP process to terminate by sending undisclosed requests. Note: Software ver… |
CVE-2023-38418 | High | 7.8 | 2023-08-02 | The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. Note: Software versions wh… |
CVE-2023-38138 | High | 7.5 | 2023-08-02 | A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which allows an attacker to run JavaScr… |
CVE-2023-36858 | High | 7.1 | 2023-08-02 | An insufficient verification of data vulnerability exists in BIG-IP Edge Client for Windows and macOS that may allow an attacker to modify its configured serv… |
CVE-2023-36494 | Medium | 4.4 | 2023-08-02 | Audit logs on F5OS-A may contain undisclosed sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evalua… |
CVE-2023-38330 | Medium | 5.3 | 2023-08-02 | OXID eShop Enterprise Edition 6.5.0 – 6.5.2 before 6.5.3 allows uploading files with modified headers in the administration area. An attacker can upload a file… |
CVE-2023-23476 | Low | 3.1 | 2023-08-02 | IBM Robotic Process Automation 21.0.0 through 21.0.7.latest is vulnerable to unauthorized access to data due to insufficient authorization validation on some A… |
CVE-2023-33383 | Medium | 5.3 | 2023-08-02 | Shelly 4PM Pro four-channel smart switch 0.11.0 allows an attacker to trigger a BLE out of bounds read fault condition that results in a device reload. |
CVE-2023-33257 | Medium | 5.4 | 2023-08-02 | Verint Engagement Management 15.3 Update 2023R2 is vulnerable to HTML injection via the user data form in the live chat. |
CVE-2023-26317 | High | 7.0 | 2023-08-02 | Xiaomi routers have an external interface that can lead to command injection. The vulnerability is caused by lax filtering of responses from external interface… |
CVE-2023-26316 | Medium | 6.1 | 2023-08-02 | A XSS vulnerability exists in the Xiaomi cloud service Application product. The vulnerability is caused by Webview's whitelist checking function allowing javas… |
CVE-2023-26451 | High | 7.5 | 2023-08-02 | Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorization codes were predi… |
CVE-2023-26450 | Medium | 5.4 | 2023-08-02 | The "OX Count" web service did not specify a media-type when processing responses by external resources. Malicious script code can be executed within the victi… |
CVE-2023-26449 | Medium | 5.4 | 2023-08-02 | The "OX Chat" web service did not specify a media-type when processing responses by external resources. Malicious script code can be executed within the victim… |
CVE-2023-26448 | Medium | 5.4 | 2023-08-02 | Custom log-in and log-out locations are used-defined as jslob but were not checked to contain malicious protocol handlers. Malicious script code can be execute… |
CVE-2023-26447 | Medium | 5.4 | 2023-08-02 | The "upsell" widget for the portal allows to specify a product description. This description taken from a user-controllable jslob did not get escaped before be… |
CVE-2023-26446 | Medium | 5.4 | 2023-08-02 | The users clientID at "application passwords" was not sanitized or escaped before being added to DOM. Malicious script code can be executed within the victims… |
CVE-2023-26445 | Medium | 5.4 | 2023-08-02 | Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets processed during login. Malicious script cod… |
CVE-2023-26443 | Medium | 5.5 | 2023-08-02 | Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements. With existing sanitization in place, this can be abused to trig… |
CVE-2023-26442 | Low | 3.2 | 2023-08-02 | In case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP redirects issued by that backend. An attacker with access to… |
CVE-2023-26441 | Medium | 5.7 | 2023-08-02 | Cacheservice did not correctly check if relative cache object were pointing to the defined absolute location when accessing resources. An attacker with access… |
CVE-2023-26440 | High | 7.1 | 2023-08-02 | The cacheservice API could be abused to indirectly inject parameters with SQL syntax which was insufficiently sanitized and would later be executed when creati… |
CVE-2023-26439 | High | 7.6 | 2023-08-02 | The cacheservice API could be abused to inject parameters with SQL syntax which was insufficiently sanitized before getting executed as SQL statement. Attacker… |
CVE-2023-26438 | Medium | 4.3 | 2023-08-02 | External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use (TOCTOU) weakness, involving the JDK DNS cache. Attackers tha… |
CVE-2023-26430 | Low | 3.5 | 2023-08-02 | Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules. This could be abused to access SIEVE extension that… |
CVE-2023-3426 | Medium | 4.3 | 2023-08-02 | The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows re… |
CVE-2023-4067 | Medium | 6.1 | 2023-08-02 | The Bus Ticket Booking with Seat Reservation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab_date' and 'tab_date_r' parameter… |
CVE-2023-3401 | Medium | 4.8 | 2023-08-02 | An issue has been discovered in GitLab affecting all versions before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 bef… |
CVE-2023-2022 | Medium | 4.3 | 2023-08-02 | An issue has been discovered in GitLab CE/EE affecting all versions starting before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions startin… |
CVE-2023-38556 | High | 7.5 | 2023-08-02 | Improper input validation vulnerability in SEIKO EPSON printer Web Config allows a remote attacker to turned off the printer. [Note] Web Config is the softwar… |
CVE-2023-4011 | Medium | 4.3 | 2023-08-02 | An issue has been discovered in GitLab EE affecting all versions from 15.11 prior to 16.2.2 which allows an attacker to spike the resource consumption resultin… |
CVE-2023-4016 | Low | 2.5 | 2023-08-02 | Under some circumstances, this weakness allows a user who has access to run the “ps” utility on a machine, the ability to write almost unlimited amounts of unf… |
CVE-2023-3994 | High | 7.5 | 2023-08-02 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all version… |
CVE-2023-3993 | Medium | 4.9 | 2023-08-02 | An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions… |
CVE-2023-3900 | Medium | 4.3 | 2023-08-02 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. An invalid… |
CVE-2023-3500 | Medium | 4.8 | 2023-08-02 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versio… |
CVE-2023-31927 | Medium | 5.3 | 2023-08-02 | An information disclosure in the web interface of Brocade Fabric OS versions before Brocade Fabric OS v9.2.0 and v9.1.1c, could allow a remote unauthenticated… |
CVE-2023-31926 | High | 7.1 | 2023-08-02 | System files could be overwritten using the less command in Brocade Fabric OS before Brocade Fabric OS v9.1.1c and v9.2.0. |
CVE-2023-3385 | Medium | 6.3 | 2023-08-02 | An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions sta… |
CVE-2023-3364 | High | 7.5 | 2023-08-02 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versio… |
CVE-2023-38990 | Medium | 4.3 | 2023-08-02 | An issue in the delete function in the MenuController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete menus created by the Adminis… |
CVE-2023-36121 | Medium | 5.4 | 2023-08-02 | Cross Site Scripting vulnerability in e107 v.2.3.2 allows a remote attacker to execute arbitrary code via the description function in the SEO project. |
CVE-2023-31928 | Medium | 6.3 | 2023-08-02 | A reflected cross-site scripting (XSS) vulnerability exists in Brocade Webtools PortSetting.html of Brocade Fabric OS version before Brocade Fabric OS v9.2.0… |
CVE-2023-31432 | High | 7.8 | 2023-08-02 | Through manipulation of passwords or other variables, using commands such as portcfgupload, configupload, license, myid, a non-privileged user could obtain roo… |
CVE-2023-31431 | Medium | 5.5 | 2023-08-02 | A buffer overflow vulnerability in “diagstatus” command in Brocade Fabric OS before Brocade Fabric v9.2.0 and v9.1.1c could allow an authenticated user to cras… |
CVE-2023-31430 | Medium | 5.5 | 2023-08-02 | A buffer overflow vulnerability in “secpolicydelete” command in Brocade Fabric OS before Brocade Fabric OS v9.1.1c and v9.2.0 could allow an authenticated priv… |
CVE-2023-31428 | Medium | 5.5 | 2023-08-02 | Brocade Fabric OS before Brocade Fabric OS v9.1.1c, v9.2.0 contains a vulnerability in the command line that could allow a local user to dump files under user'… |
CVE-2023-2164 | Medium | 5.4 | 2023-08-02 | An issue has been discovered in GitLab affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions sta… |
CVE-2023-1210 | Low | 3.1 | 2023-08-02 | An issue has been discovered in GitLab affecting all versions starting from 12.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions sta… |
CVE-2023-0632 | Medium | 6.5 | 2023-08-02 | An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions sta… |
CVE-2023-3740 | Medium | 4.3 | 2023-08-01 | Insufficient validation of untrusted input in Themes in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially serve malicious content t… |
CVE-2023-3739 | Medium | 6.3 | 2023-08-01 | Insufficient validation of untrusted input in Chromad in Google Chrome on ChromeOS prior to 115.0.5790.131 allowed a remote attacker to execute arbitrary code… |
CVE-2023-3738 | Medium | 4.3 | 2023-08-01 | Inappropriate implementation in Autofill in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (C… |
CVE-2023-3737 | Medium | 4.3 | 2023-08-01 | Inappropriate implementation in Notifications in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to spoof the contents of media notifications vi… |
CVE-2023-3736 | Medium | 4.3 | 2023-08-01 | Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 115.0.5790.98 allowed a remote attacker to leak cross-origin data via a crafte… |
CVE-2023-3735 | Medium | 4.3 | 2023-08-01 | Inappropriate implementation in Web API Permission Prompts in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to obfuscate security UI via a cra… |
CVE-2023-3734 | Medium | 4.3 | 2023-08-01 | Inappropriate implementation in Picture In Picture in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially spoof the contents of the O… |
CVE-2023-3733 | Medium | 4.3 | 2023-08-01 | Inappropriate implementation in WebApp Installs in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially spoof the contents of the Omni… |
CVE-2023-3732 | High | 8.8 | 2023-08-01 | Out of bounds memory access in Mojo in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who had compromised the renderer process to potentially e… |
CVE-2023-3731 | High | 8.8 | 2023-08-01 | Use after free in Diagnostics in Google Chrome on ChromeOS prior to 115.0.5790.131 allowed an attacker who convinced a user to install a malicious extension to… |