2023 CVEs (page 19)
Page 19 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-51313 | High | 8.8 | 2025-02-20 | PHPJabbers Restaurant Booking System v3.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exist… |
CVE-2023-51312 | Medium | 5.4 | 2025-02-20 | PHPJabbers Restaurant Booking System v3.0 is vulnerable to Reflected Cross-Site Scripting (XSS) in Reservations menu, Schedule section date parameter. |
CVE-2023-51311 | High | 8.8 | 2025-02-20 | PHPJabbers Car Park Booking System v3.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists… |
CVE-2023-51310 | Medium | 4.3 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password', 'Email Settings' feature of PHPJabbers Car Park Booking System v3.0 allows attackers to send an excessive amo… |
CVE-2023-51309 | Medium | 4.3 | 2025-02-20 | A lack of rate limiting in the 'Email Settings' feature of PHPJabbers Car Park Booking System v3.0 allows attackers to send an excessive amount of email for a… |
CVE-2023-51308 | Medium | 6.1 | 2025-02-20 | PHPJabbers Car Park Booking System v3.0 is vulnerable to Multiple HTML Injection in the "name, plugin_sms_api_key, plugin_sms_country_code, title, plugin_sms_a… |
CVE-2023-51306 | Medium | 5.4 | 2025-02-20 | PHPJabbers Event Ticketing System v1.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "name, title" parameters. |
CVE-2023-51305 | Medium | 5.4 | 2025-02-19 | PHPJabbers Car Park Booking System v3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "name, plugin_sms_api_key, plugin_sms_country_code… |
CVE-2023-51303 | Medium | 6.1 | 2025-02-19 | PHPJabbers Event Ticketing System v1.0 is vulnerable to Multiple HTML Injection in the "lid, name, plugin_sms_api_key, plugin_sms_country_code, title, plugin_s… |
CVE-2023-51302 | High | 8.8 | 2025-02-19 | PHPJabbers Hotel Booking System v4.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due… |
CVE-2023-51301 | High | 7.5 | 2025-02-19 | A lack of rate limiting in the "Login Section, Forgot Email" feature of PHPJabbers Hotel Booking System v4.0 allows attackers to send an excessive amount of re… |
CVE-2023-51300 | Medium | 6.1 | 2025-02-19 | PHPJabbers Hotel Booking System v4.0 is vulnerable to Cross-Site Scripting (XSS) vulnerabilities in the "name, plugin_sms_api_key, plugin_sms_country_code, tit… |
CVE-2023-51299 | Medium | 6.1 | 2025-02-19 | PHPJabbers Hotel Booking System v4.0 is vulnerable to HTML Injection in the "name, plugin_sms_api_key, plugin_sms_country_code, title, plugin_sms_api_key, titl… |
CVE-2023-51298 | Medium | 4.7 | 2025-02-19 | PHPJabbers Event Booking Calendar v4.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists d… |
CVE-2023-51297 | Medium | 6.5 | 2025-02-19 | A lack of rate limiting in the 'Email Settings' feature of PHPJabbers Hotel Booking System v4.0 allows attackers to send an excessive amount of email for a leg… |
CVE-2023-51296 | Medium | 6.1 | 2025-02-19 | PHPJabbers Event Booking Calendar v4.0 is vulnerable to Cross-Site Scripting (XSS) in the "name, plugin_sms_api_key, plugin_sms_country_code, title, plugin_sms… |
CVE-2023-51293 | High | 7.5 | 2025-02-19 | A lack of rate limiting in the 'Forgot Password', 'Email Settings' feature of PHPJabbers Event Booking Calendar v4.0 allows attackers to send an excessive amou… |
CVE-2023-46272 | High | 8.8 | 2025-02-19 | Buffer Overflow vulnerability in Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, allows an attacker to execute arbitrary code via… |
CVE-2023-46271 | Critical | 9.8 | 2025-02-19 | Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, has a buffer overflow. This issue arises from the ah_webui service, which listens… |
CVE-2023-47160 | High | 8.2 | 2025-02-19 | IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing… |
CVE-2023-34406 | Low | 3.3 | 2025-02-13 | An issue was discovered on Mercedes Benz NTG 6. A possible integer overflow exists in the user data import/export function of NTG (New Telematics Generation) 6… |
CVE-2023-34404 | Medium | 4.9 | 2025-02-13 | Mercedes-Benz head-unit NTG6 has Ethernet pins on Base Board to connect module CSB. Attacker can connect to these pins and get access to internal network. As a… |
CVE-2023-34403 | Medium | 4.9 | 2025-02-13 | Mercedes-Benz head-unit NTG6 has Ethernet pins on Base Board to connect module CSB. Attacker can connect to this pins and get access to internal network. A rac… |
CVE-2023-34402 | High | 7.7 | 2025-02-13 | Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Inside file is encapsulate another file, which service will drop… |
CVE-2023-34401 | Low | 3.7 | 2025-02-13 | Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Inside profile folder there is a file, which is encoded with pro… |
CVE-2023-34400 | High | 7.5 | 2025-02-13 | Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. In case of parsing file, service try to define header inside the… |
CVE-2023-34399 | Critical | 9.8 | 2025-02-13 | Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Some values of this table are serialized archive according boost… |
CVE-2023-34398 | High | 7.5 | 2025-02-13 | Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Some values of this table are serialized archive according boost… |
CVE-2023-34397 | High | 7.5 | 2025-02-13 | Mercedes Benz head-unit NTG 6 contains functions to import or export profile settings over USB. During parsing you can trigger that the service will be crashed. |
CVE-2023-49618 | High | 7.5 | 2025-02-12 | Improper buffer restrictions in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enable es… |
CVE-2023-49615 | High | 7.5 | 2025-02-12 | Improper input validation in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enable escal… |
CVE-2023-49603 | High | 7.5 | 2025-02-12 | Race condition in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enable escalation of pr… |
CVE-2023-48366 | Medium | 5.3 | 2025-02-12 | Race condition in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enable information disc… |
CVE-2023-48267 | High | 7.9 | 2025-02-12 | Improper buffer restrictions in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enable es… |
CVE-2023-43758 | High | 8.2 | 2025-02-12 | Improper input validation in UEFI firmware for some Intel(R) processors may allow a privileged user to potentially enable escalation of privilege via local acc… |
CVE-2023-34440 | High | 7.5 | 2025-02-12 | Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local acc… |
CVE-2023-32277 | Medium | 6.1 | 2025-02-12 | Untrusted Pointer Dereference in I/O subsystem for some Intel(R) QAT software before version 2.0.5 may allow authenticated user to potentially enable informati… |
CVE-2023-31276 | High | 8.2 | 2025-02-12 | Heap-based buffer overflow in BMC Firmware for the Intel(R) Server Board S2600WF, Intel(R) Server Board S2600ST, Intel(R) Server Board S2600BP, before version… |
CVE-2023-29164 | High | 7.3 | 2025-02-12 | Improper access control in BMC Firmware for the Intel(R) Server Board S2600WF, Intel(R) Server Board S2600ST, Intel(R) Server Board S2600BP, before version 02… |
CVE-2023-49780 | Medium | 6.1 | 2025-02-12 | Cross-site scripting vulnerability exists in acmailer CGI ver.4.0.5 and earlier. An arbitrary script may be executed on the web browser of the user who accesse… |
CVE-2023-31345 | High | 7.5 | 2025-02-12 | Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution. |
CVE-2023-20508 | Medium | 5.0 | 2025-02-12 | Improper access control in the ASP could allow a privileged attacker to perform an out-of-bounds write to a memory location not controlled by the attacker, pot… |
CVE-2023-31352 | Medium | 6.0 | 2025-02-11 | A bug in the SEV firmware may allow an attacker with privileges to read unencrypted memory, potentially resulting in loss of guest private data. |
CVE-2023-31343 | High | 7.5 | 2025-02-11 | Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution. |
CVE-2023-31342 | High | 7.5 | 2025-02-11 | Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution. |
CVE-2023-31331 | Low | 3.0 | 2025-02-11 | Improper access control in the DRTM firmware could allow a privileged attacker to perform multiple driver initializations, resulting in stack memory corruption… |
CVE-2023-20582 | Medium | 5.3 | 2025-02-11 | Improper handling of invalid nested page table entries in the IOMMU may allow a privileged attacker to induce page table entry (PTE) faults to bypass RMP check… |
CVE-2023-20581 | Low | 2.5 | 2025-02-11 | Improper access control in the IOMMU may allow a privileged attacker to bypass RMP checks, potentially leading to a loss of guest memory integrity. |
CVE-2023-20515 | Medium | 5.7 | 2025-02-11 | Improper access control in the fTPM driver in the trusted OS could allow a privileged attacker to corrupt system memory, potentially leading to loss of integri… |
CVE-2023-20507 | Low | 2.3 | 2025-02-11 | An integer overflow in the ASP could allow a privileged attacker to perform an out-of-bounds write, potentially resulting in loss of data integrity. |
CVE-2023-31361 | High | 7.3 | 2025-02-11 | A DLL hijacking vulnerability in AMD Integrated Management Technology (AIM-T) Manageability Service could allow an attacker to achieve privilege escalation pot… |
CVE-2023-31360 | High | 7.3 | 2025-02-11 | Incorrect default permissions in the AMD Integrated Management Technology (AIM-T) Manageability Service installation directory could allow an attacker to achie… |
CVE-2023-40721 | Medium | 6.7 | 2025-02-11 | A use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged attacker to execute arbitrary code or comma… |
CVE-2023-37482 | Medium | 5.3 | 2025-02-11 | The login functionality of the web server in affected devices does not normalize the response times of login attempts. An unauthenticated remote attacker could… |
CVE-2023-5878 | | 2025-02-06 | Honeywell OneWireless Wireless Device Manager (WDM) for the following versions R310.x, R320.x, R321.x, R322.1, R322.2, R323.x, R330.1 contains a command inje… | |
CVE-2023-6386 | Medium | 6.5 | 2025-02-05 | A denial of service vulnerability was identified in GitLab CE/EE, affecting all versions from 15.11 prior to 16.6.7, 16.7 prior to 16.7.5 and 16.8 prior to 16… |
CVE-2023-52925 | Medium | 5.5 | 2025-02-05 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: don't fail inserts if duplicate has expired nftables selftests fail… |
CVE-2023-52924 | Medium | 5.5 | 2025-02-05 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: don't skip expired elements during walk There is an asymmetry betwe… |
CVE-2023-40222 | High | 7.8 | 2025-02-04 | In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build (1204.200), the affected application lacks proper validation of user-supplied data when parsing CO file… |
CVE-2023-39943 | High | 7.8 | 2025-02-04 | In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build (1204.200), the affected application lacks proper validation of user-supplied data when parsing XE file… |
CVE-2023-52164 | Medium | 5.1 | 2025-02-03 | access_device.cgi on Digiever DS-2105 Pro 3.1.0.71-11 devices allows arbitrary file read. NOTE: This vulnerability only affects products that are no longer sup… |
CVE-2023-52163 | High | 8.8 | 2025-02-03 | Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection. NOTE: This vulnerability only affects products that are no longer supported… |
CVE-2023-38739 | Medium | 4.3 | 2025-01-31 | IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.3 is vulnerable to cross-site request forgery which could allow an attacker to ex… |
CVE-2023-0092 | Medium | 4.9 | 2025-01-31 | An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from the controller's file… |
CVE-2023-6195 | Low | 2.6 | 2025-01-31 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.5 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from… |
CVE-2023-29080 | | 2025-01-30 | Potential privilege escalation vulnerability in Revenera InstallShield versions 2022 R2 and 2021 R2 due to adding InstallScript custom action to a Basic MSI or… | |
CVE-2023-37413 | Medium | 5.3 | 2025-01-29 | IBM Aspera Faspex 5.0.0 through 5.0.10 could disclose sensitive username information due to an observable response discrepancy. |
CVE-2023-37412 | Medium | 4.4 | 2025-01-29 | IBM Aspera Faspex 5.0.0 through 5.0.10 could allow a privileged user to make system changes without proper access controls. |
CVE-2023-37398 | Medium | 5.9 | 2025-01-29 | IBM Aspera Faspex 5.0.0 through 5.0.10 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise u… |
CVE-2023-35907 | Medium | 5.9 | 2025-01-29 | IBM Aspera Faspex 5.0.0 through 5.0.10 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise u… |
CVE-2023-33838 | Medium | 4.4 | 2025-01-29 | IBM Security Verify Governance 10.0.2 Identity Manager uses a one-way cryptographic hash against an input that should not be reversible, such as a password… |
CVE-2023-35017 | Medium | 5.9 | 2025-01-29 | IBM Security Verify Governance 10.0.2 Identity Manager can transmit user credentials in clear text that could be obtained by an attacker using man in the middl… |
CVE-2023-50316 | Medium | 6.3 | 2025-01-28 | IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.1 is vulnerable to SQL injection. A remote attacker could send specially crafted… |
CVE-2023-52292 | Medium | 6.4 | 2025-01-27 | IBM Sterling File Gateway 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to… |
CVE-2023-47159 | Medium | 4.3 | 2025-01-27 | IBM Sterling File Gateway 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.1 could allow an authenticated user to enumerate usernames due to an observable dis… |
CVE-2023-46187 | Medium | 5.4 | 2025-01-27 | IBM InfoSphere Master Data Management 11.6, 12.0, and 14.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary Jav… |
CVE-2023-50946 | Medium | 6.5 | 2025-01-26 | IBM Common Licensing 9.0 could allow an authenticated user to modify a configuration file that they should not have access to due to a broken authorization me… |
CVE-2023-50945 | Medium | 6.2 | 2025-01-26 | IBM Common Licensing 9.0 stores user credentials in plain clear text which can be read by a local user. |
CVE-2023-38009 | Medium | 4.2 | 2025-01-26 | IBM Cognos Mobile Client 1.1 iOS may be vulnerable to information disclosure through man in the middle techniques due to the lack of certificate pinning. |
CVE-2023-38716 | Medium | 5.3 | 2025-01-25 | IBM Cloud Pak System 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, and 2.3.4.0 could disclose sensitive information about the system that could… |
CVE-2023-38714 | Medium | 5.3 | 2025-01-25 | IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensit… |
CVE-2023-38713 | Medium | 5.3 | 2025-01-25 | IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensit… |
CVE-2023-38271 | Medium | 4.3 | 2025-01-25 | IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could allow an authen… |
CVE-2023-38013 | Medium | 5.3 | 2025-01-25 | IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensit… |
CVE-2023-38012 | Medium | 5.3 | 2025-01-25 | IBM Cloud Pak System 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, and 2.3.4.0 could allow a remote attacker to traverse directories on the sy… |
CVE-2023-46401 | Critical | 9.8 | 2025-01-23 | KWHotel 0.47 is vulnerable to CSV Formula Injection in the invoice adding function. |
CVE-2023-46400 | Critical | 9.8 | 2025-01-23 | KWHotel 0.47 is vulnerable to CSV Formula Injection in the add guest function. |
CVE-2023-50309 | Medium | 6.4 | 2025-01-23 | IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrar… |
CVE-2023-32340 | Medium | 4.6 | 2025-01-23 | IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaS… |
CVE-2023-37777 | Critical | 9.8 | 2025-01-22 | A SQL injection vulnerability exists in Synnefo Internet Management Software (IMS) version 2023 and earlier. This vulnerability occurs due to improper input va… |
CVE-2023-37023 | High | 8.6 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `Uplink NAS Transport` packet handler. A packet missing its `MME_UE_S1AP_ID` field causes Op… |
CVE-2023-37022 | High | 7.5 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `UE Context Release Request` packet handler. A packet containing an invalid `MME_UE_S1AP_ID`… |
CVE-2023-37021 | High | 8.6 | 2025-01-22 | Open5GS MME version <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a… |
CVE-2023-37020 | High | 8.6 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a… |
CVE-2023-37019 | High | 8.6 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a… |
CVE-2023-37018 | High | 8.6 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a… |
CVE-2023-37017 | High | 8.6 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an… |
CVE-2023-37016 | High | 8.6 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a… |
CVE-2023-37015 | High | 8.6 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a… |
CVE-2023-37014 | High | 7.5 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a… |