2023 CVEs (page 19)
Page 19 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-40721 | Medium | 6.7 | 2025-02-11 | A use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged attacker to execute arbitrary code or comma… |
CVE-2023-37482 | Medium | 5.3 | 2025-02-11 | The login functionality of the web server in affected devices does not normalize the response times of login attempts. An unauthenticated remote attacker could… |
CVE-2023-5878 | | 2025-02-06 | Honeywell OneWireless Wireless Device Manager (WDM) for the following versions R310.x, R320.x, R321.x, R322.1, R322.2, R323.x, R330.1 contains a command inje… | |
CVE-2023-6386 | Medium | 6.5 | 2025-02-05 | A denial of service vulnerability was identified in GitLab CE/EE, affecting all versions from 15.11 prior to 16.6.7, 16.7 prior to 16.7.5 and 16.8 prior to 16… |
CVE-2023-52925 | Medium | 5.5 | 2025-02-05 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: don't fail inserts if duplicate has expired nftables selftests fail… |
CVE-2023-52924 | Medium | 5.5 | 2025-02-05 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: don't skip expired elements during walk There is an asymmetry betwe… |
CVE-2023-40222 | High | 7.8 | 2025-02-04 | In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build (1204.200), the affected application lacks proper validation of user-supplied data when parsing CO file… |
CVE-2023-39943 | High | 7.8 | 2025-02-04 | In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build (1204.200), the affected application lacks proper validation of user-supplied data when parsing XE file… |
CVE-2023-52164 | Medium | 5.1 | 2025-02-03 | access_device.cgi on Digiever DS-2105 Pro 3.1.0.71-11 devices allows arbitrary file read. NOTE: This vulnerability only affects products that are no longer sup… |
CVE-2023-52163 | High | 8.8 | 2025-02-03 | Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection. NOTE: This vulnerability only affects products that are no longer supported… |
CVE-2023-38739 | Medium | 4.3 | 2025-01-31 | IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.3 is vulnerable to cross-site request forgery which could allow an attacker to ex… |
CVE-2023-0092 | Medium | 4.9 | 2025-01-31 | An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from the controller's file… |
CVE-2023-6195 | Low | 2.6 | 2025-01-31 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.5 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from… |
CVE-2023-29080 | | 2025-01-30 | Potential privilege escalation vulnerability in Revenera InstallShield versions 2022 R2 and 2021 R2 due to adding InstallScript custom action to a Basic MSI or… | |
CVE-2023-37413 | Medium | 5.3 | 2025-01-29 | IBM Aspera Faspex 5.0.0 through 5.0.10 could disclose sensitive username information due to an observable response discrepancy. |
CVE-2023-37412 | Medium | 4.4 | 2025-01-29 | IBM Aspera Faspex 5.0.0 through 5.0.10 could allow a privileged user to make system changes without proper access controls. |
CVE-2023-37398 | Medium | 5.9 | 2025-01-29 | IBM Aspera Faspex 5.0.0 through 5.0.10 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise u… |
CVE-2023-35907 | Medium | 5.9 | 2025-01-29 | IBM Aspera Faspex 5.0.0 through 5.0.10 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise u… |
CVE-2023-33838 | Medium | 4.4 | 2025-01-29 | IBM Security Verify Governance 10.0.2 Identity Manager uses a one-way cryptographic hash against an input that should not be reversible, such as a password… |
CVE-2023-35017 | Medium | 5.9 | 2025-01-29 | IBM Security Verify Governance 10.0.2 Identity Manager can transmit user credentials in clear text that could be obtained by an attacker using man in the middl… |
CVE-2023-50316 | Medium | 6.3 | 2025-01-28 | IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.1 is vulnerable to SQL injection. A remote attacker could send specially crafted… |
CVE-2023-52292 | Medium | 6.4 | 2025-01-27 | IBM Sterling File Gateway 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to… |
CVE-2023-47159 | Medium | 4.3 | 2025-01-27 | IBM Sterling File Gateway 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.1 could allow an authenticated user to enumerate usernames due to an observable dis… |
CVE-2023-46187 | Medium | 5.4 | 2025-01-27 | IBM InfoSphere Master Data Management 11.6, 12.0, and 14.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary Jav… |
CVE-2023-50946 | Medium | 6.5 | 2025-01-26 | IBM Common Licensing 9.0 could allow an authenticated user to modify a configuration file that they should not have access to due to a broken authorization me… |
CVE-2023-50945 | Medium | 6.2 | 2025-01-26 | IBM Common Licensing 9.0 stores user credentials in plain clear text which can be read by a local user. |
CVE-2023-38009 | Medium | 4.2 | 2025-01-26 | IBM Cognos Mobile Client 1.1 iOS may be vulnerable to information disclosure through man in the middle techniques due to the lack of certificate pinning. |
CVE-2023-38716 | Medium | 5.3 | 2025-01-25 | IBM Cloud Pak System 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, and 2.3.4.0 could disclose sensitive information about the system that could… |
CVE-2023-38714 | Medium | 5.3 | 2025-01-25 | IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensit… |
CVE-2023-38713 | Medium | 5.3 | 2025-01-25 | IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensit… |
CVE-2023-38271 | Medium | 4.3 | 2025-01-25 | IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could allow an authen… |
CVE-2023-38013 | Medium | 5.3 | 2025-01-25 | IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensit… |
CVE-2023-38012 | Medium | 5.3 | 2025-01-25 | IBM Cloud Pak System 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, and 2.3.4.0 could allow a remote attacker to traverse directories on the sy… |
CVE-2023-46401 | Critical | 9.8 | 2025-01-23 | KWHotel 0.47 is vulnerable to CSV Formula Injection in the invoice adding function. |
CVE-2023-46400 | Critical | 9.8 | 2025-01-23 | KWHotel 0.47 is vulnerable to CSV Formula Injection in the add guest function. |
CVE-2023-50309 | Medium | 6.4 | 2025-01-23 | IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrar… |
CVE-2023-32340 | Medium | 4.6 | 2025-01-23 | IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaS… |
CVE-2023-37777 | Critical | 9.8 | 2025-01-22 | A SQL injection vulnerability exists in Synnefo Internet Management Software (IMS) version 2023 and earlier. This vulnerability occurs due to improper input va… |
CVE-2023-37023 | High | 8.6 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `Uplink NAS Transport` packet handler. A packet missing its `MME_UE_S1AP_ID` field causes Op… |
CVE-2023-37022 | High | 7.5 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `UE Context Release Request` packet handler. A packet containing an invalid `MME_UE_S1AP_ID`… |
CVE-2023-37021 | High | 8.6 | 2025-01-22 | Open5GS MME version <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a… |
CVE-2023-37020 | High | 8.6 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a… |
CVE-2023-37019 | High | 8.6 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a… |
CVE-2023-37018 | High | 8.6 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a… |
CVE-2023-37017 | High | 8.6 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an… |
CVE-2023-37016 | High | 8.6 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a… |
CVE-2023-37015 | High | 8.6 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a… |
CVE-2023-37014 | High | 7.5 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a… |
CVE-2023-37013 | High | 7.3 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a sufficiently large ASN.1 packet over the S1AP interface. An attacker m… |
CVE-2023-37012 | Medium | 5.3 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an… |
CVE-2023-37011 | Medium | 6.3 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a… |
CVE-2023-37010 | Medium | 6.3 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an… |
CVE-2023-37009 | Medium | 6.3 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a… |
CVE-2023-37008 | Medium | 5.3 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contain a buffer overflow in the ASN.1 deserialization function of the S1AP handler. This buffer overflow causes type confusion i… |
CVE-2023-37007 | Medium | 5.3 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a… |
CVE-2023-37006 | Medium | 5.3 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a… |
CVE-2023-37005 | Medium | 5.3 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an… |
CVE-2023-37004 | Medium | 5.3 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an… |
CVE-2023-37003 | Medium | 5.3 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an… |
CVE-2023-37002 | Medium | 5.3 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an… |
CVE-2023-36998 | High | 8.9 | 2025-01-22 | The NextEPC MME <= 1.0.1 (fixed in commit a8492c9c5bc0a66c6999cb5a263545b32a4109df) contains a stack-based buffer overflow vulnerability in the Emergency Numbe… |
CVE-2023-37039 | Medium | 6.5 | 2025-01-22 | A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486… |
CVE-2023-40132 | High | 7.8 | 2025-01-21 | In setActualDefaultRingtoneUri of RingtoneManager.java, there is a possible way to bypass content providers read permissions due to a missing permission check… |
CVE-2023-40108 | Medium | 5.5 | 2025-01-21 | In multiple locations, there is a possible way to access media content belonging to another user due to a missing permission check. This could lead to local in… |
CVE-2023-37038 | Medium | 6.5 | 2025-01-21 | A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486… |
CVE-2023-37037 | Medium | 6.5 | 2025-01-21 | A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486… |
CVE-2023-37036 | Medium | 6.5 | 2025-01-21 | A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486… |
CVE-2023-37035 | Medium | 6.5 | 2025-01-21 | A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486… |
CVE-2023-37034 | Medium | 6.5 | 2025-01-21 | A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486… |
CVE-2023-37033 | Medium | 6.5 | 2025-01-21 | A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486… |
CVE-2023-37032 | High | 7.5 | 2025-01-21 | A Stack-based buffer overflow in the Mobile Management Entity (MME) of Magma versions <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486)… |
CVE-2023-37031 | Medium | 6.5 | 2025-01-21 | A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486… |
CVE-2023-37030 | Medium | 6.5 | 2025-01-21 | A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486… |
CVE-2023-37029 | High | 7.5 | 2025-01-21 | Magma versions <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) are susceptible to an assertion-based crash when an oversized NAS packe… |
CVE-2023-37028 | Medium | 6.5 | 2025-01-21 | A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486… |
CVE-2023-37027 | Medium | 6.5 | 2025-01-21 | Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486)… |
CVE-2023-37026 | Medium | 6.5 | 2025-01-21 | A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486… |
CVE-2023-37025 | Medium | 6.5 | 2025-01-21 | A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486… |
CVE-2023-37024 | High | 7.5 | 2025-01-21 | A reachable assertion in the Mobile Management Entity (MME) of Magma versions <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows r… |
CVE-2023-50733 | High | 8.6 | 2025-01-21 | A Server-Side Request Forgery (SSRF) vulnerability has been identified in the Web Services feature of newer Lexmark devices. |
CVE-2023-27113 | Critical | 9.8 | 2025-01-21 | pearProjectApi v2.8.10 was discovered to contain a SQL injection vulnerability via the organizationCode parameter at project.php. |
CVE-2023-27112 | Critical | 9.8 | 2025-01-21 | pearProjectApi v2.8.10 was discovered to contain a SQL injection vulnerability via the projectCode parameter at project.php. |
CVE-2023-45908 | Medium | 6.1 | 2025-01-21 | Homarr before v0.14.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Notebook widget. |
CVE-2023-52923 | High | 7.8 | 2025-01-20 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: adapt set backend to use GC transaction API Use the GC transaction… |
CVE-2023-50739 | High | 8.8 | 2025-01-18 | A buffer overflow vulnerability has been identified in the Internet Printing Protocol (IPP) in various Lexmark devices. The vulnerability can be leveraged by a… |
CVE-2023-50738 | Medium | 4.3 | 2025-01-17 | A new feature to prevent Firmware downgrades was recently added to some Lexmark products. A method to override this downgrade protection has been identified. |
CVE-2023-46715 | Medium | 5.0 | 2025-01-14 | An origin validation error [CWE-346] vulnerability in Fortinet FortiOS IPSec VPN version 7.4.0 through 7.4.1 and version 7.2.6 and below allows an authenticat… |
CVE-2023-42786 | Medium | 6.5 | 2025-01-14 | A null pointer dereference in FortiOS versions 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0 all versions, 6.4 all versions , 6.2 all versions and 6.0 all vers… |
CVE-2023-42785 | Medium | 6.5 | 2025-01-14 | A null pointer dereference in FortiOS versions 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0 all versions, 6.4 all versions , 6.2 all versions and 6.0 all vers… |
CVE-2023-37937 | High | 7.8 | 2025-01-14 | An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSwitch version 7.4.0 and 7.2.0 through 7.2.5 and… |
CVE-2023-37936 | Critical | 9.8 | 2025-01-14 | A use of hard-coded cryptographic key in Fortinet FortiSwitch version 7.4.0 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.7 and 6.4.0 through 6.4.13 and 6.2.0… |
CVE-2023-37931 | High | 8.8 | 2025-01-14 | An improper neutralization of special elements used in an sql command ('sql injection') vulnerability [CWE-88] in FortiVoice Entreprise version 7.0.0 through 7… |
CVE-2023-42250 | Medium | 6.1 | 2025-01-13 | Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via /common/autocomplete.php. |
CVE-2023-42249 | Medium | 6.1 | 2025-01-13 | Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via vam/vam_visits.php. |
CVE-2023-42248 | Medium | 6.5 | 2025-01-13 | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can write arbitrary files by manipulating POST parame… |
CVE-2023-42247 | Medium | 6.1 | 2025-01-13 | Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via monitor/s_monitor_map.php. |
CVE-2023-42246 | Medium | 6.1 | 2025-01-13 | Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via /vam/vam_ep.php. |
CVE-2023-42245 | Medium | 6.1 | 2025-01-13 | Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via monitor/s_scheduledfile.php. |
CVE-2023-42244 | High | 8.8 | 2025-01-13 | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters… |
CVE-2023-42243 | Medium | 5.4 | 2025-01-13 | In Selesta Visual Access Manager < 4.42.2, an authenticated user can access the administrative page /common/vam_Sql.php, which allows for arbitrary SQL queries. |