2023 CVEs (page 198)
Page 198 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-38336 | Critical | 9.8 | 2023-07-14 | netkit-rcp in rsh-client 0.17-24 allows command injection via filenames because /bin/sh is used by susystem, a related issue to CVE-2006-0225, CVE-2019-7283, a… |
CVE-2023-37268 | Medium | 6.4 | 2023-07-14 | Warpgate is an SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. When logging in as a user with SSO enabled an attacker may au… |
CVE-2023-36818 | Medium | 6.5 | 2023-07-14 | Discourse is an open source discussion platform. In affected versions a request to create or update custom sidebar section can cause a denial of service. This… |
CVE-2023-36466 | Low | 3.5 | 2023-07-14 | Discourse is an open source discussion platform. When editing a topic, there is a vulnerability that enables a user to bypass the topic title validations for t… |
CVE-2023-34236 | High | 8.5 | 2023-07-14 | Weave GitOps Terraform Controller (aka Weave TF-controller) is a controller for Flux to reconcile Terraform resources in a GitOps way. A vulnerability has been… |
CVE-2023-37473 | High | 8.5 | 2023-07-14 | zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing _callable strings_ (ie `system`) caused the function to be ex… |
CVE-2023-37472 | High | 7.7 | 2023-07-14 | Knowage is an open source suite for business analytics. The application often use user supplied data to create HQL queries without prior sanitization. An attac… |
CVE-2023-37464 | High | 8.6 | 2023-07-14 | OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly uses the Tag length f… |
CVE-2023-37462 | Critical | 9.9 | 2023-07-14 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Improper escaping in the document `SkinsCode.XWikiSkin… |
CVE-2023-3633 | High | 8.1 | 2023-07-14 | An out-of-bounds write vulnerability in Bitdefender Engines on Windows causes the engine to crash. This issue affects Bitdefender Engines version 7.94791 and l… |
CVE-2023-38325 | High | 7.5 | 2023-07-14 | The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options. |
CVE-2023-37474 | High | 7.5 | 2023-07-14 | Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability detected in the `.cpr` subfolder. The Path Traversal… |
CVE-2023-36850 | Medium | 6.5 | 2023-07-14 | An Improper Validation of Specified Index, Position, or Offset in Input vulnerability in the Connectivity Fault Management(CFM) module of Juniper Networks Juno… |
CVE-2023-38253 | Medium | 4.7 | 2023-07-14 | An out-of-bounds read flaw was found in w3m, in the growbuf_to_Str function in indep.c. This issue may allow an attacker to cause a denial of service through a… |
CVE-2023-38252 | Medium | 4.7 | 2023-07-14 | An out-of-bounds read flaw was found in w3m, in the Strnew_size function in Str.c. This issue may allow an attacker to cause a denial of service through a craf… |
CVE-2023-37224 | Medium | 6.0 | 2023-07-14 | An issue in Archer Platform before v.6.13 fixed in v.6.12.0.6 and v.6.13.0 allows an authenticated attacker to obtain sensitive information via the log files. |
CVE-2023-37223 | Medium | 5.4 | 2023-07-14 | Cross Site Scripting (XSS) vulnerability in Archer Platform before v.6.13 and fixed in v.6.12.0.6 and v.6.13.0 allows a remote authenticated attacker to execut… |
CVE-2023-36888 | Medium | 6.3 | 2023-07-14 | Microsoft Edge for Android (Chromium-based) Tampering Vulnerability |
CVE-2023-36887 | High | 7.8 | 2023-07-14 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2023-36883 | Medium | 4.3 | 2023-07-14 | Microsoft Edge for iOS Spoofing Vulnerability |
CVE-2023-36849 | Medium | 6.5 | 2023-07-14 | An Improper Check or Handling of Exceptional Conditions vulnerability in the Layer-2 control protocols daemon (l2cpd) of Juniper Networks Junos OS and Junos OS… |
CVE-2023-36848 | Medium | 6.5 | 2023-07-14 | An Improper Handling of Undefined Values vulnerability in the periodic packet management daemon (PPMD) of Juniper Networks Junos OS on MX Series(except MPC10… |
CVE-2023-36840 | Medium | 5.5 | 2023-07-14 | A Reachable Assertion vulnerability in Routing Protocol Daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a locally-based, low-privileged a… |
CVE-2023-36836 | Medium | 4.7 | 2023-07-14 | A Use of an Uninitialized Resource vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, authent… |
CVE-2023-36835 | High | 7.5 | 2023-07-14 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on QFX10000 Series all… |
CVE-2023-36834 | Medium | 6.5 | 2023-07-14 | An Incomplete Internal State Distinction vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX 4600 and SRX 5000 Series allow… |
CVE-2023-32761 | High | 8.1 | 2023-07-14 | Cross Site Request Forgery (CSRF) vulnerability in Archer Platform before v.6.13 and fixed in v.6.12.0.6 and v.6.13.0 allows an authenticated attacker to execu… |
CVE-2023-32760 | High | 7.7 | 2023-07-14 | An issue in Archer Platform before v.6.13 fixed in v.6.12.0.6 and v.6.13.0 allows an authenticated attacker to obtain sensitive information via API calls relat… |
CVE-2023-32759 | High | 7.5 | 2023-07-14 | An issue in Archer Platform before v.6.13 and fixed in 6.12.0.6 and 6.13.0 allows an authenticated attacker to obtain sensitive information via a crafted URL. |
CVE-2023-24896 | Medium | 5.4 | 2023-07-14 | Dynamics 365 Finance Spoofing Vulnerability |
CVE-2023-36838 | Medium | 5.5 | 2023-07-14 | An Out-of-bounds Read vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX Series allows a local, authenticated attacker wit… |
CVE-2023-36833 | Medium | 6.5 | 2023-07-14 | A Use After Free vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS Evolved on PTX10001-36MR, and PTX10004, PTX10008, PTX10016 wi… |
CVE-2023-28985 | High | 7.5 | 2023-07-14 | An Improper Validation of Syntactic Correctness of Input vulnerability in Intrusion Detection and Prevention (IDP) of Juniper Networks SRX Series and MX Series… |
CVE-2023-36832 | High | 7.5 | 2023-07-14 | An Improper Handling of Exceptional Conditions vulnerability in packet processing of Juniper Networks Junos OS on MX Series allows an unauthenticated network-b… |
CVE-2023-35692 | High | 7.8 | 2023-07-14 | In getLocationCache of GeoLocation.java, there is a possible way to send a mock location during an emergency call due to improper input validation. This could… |
CVE-2023-36831 | High | 7.5 | 2023-07-14 | An Improper Check or Handling of Exceptional Conditions vulnerability in the UTM (Unified Threat Management) Web-Filtering feature of Juniper Networks Junos OS… |
CVE-2023-3673 | High | 7.2 | 2023-07-14 | SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.24. |
CVE-2023-3434 | Medium | 4.4 | 2023-07-14 | Improper Input Validation in the hyperlink interpretation in Savoir-faire Linux's Jami (version 20222284) on Windows. This allows an attacker to send a custo… |
CVE-2023-3433 | Medium | 5.5 | 2023-07-14 | The "nickname" field within Savoir-faire Linux's Jami application is susceptible to a failed state when a user inserts special characters into the field. When… |
CVE-2023-2975 | Medium | 5.3 | 2023-07-14 | Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequen… |
CVE-2023-3672 | Medium | 6.1 | 2023-07-14 | Cross-site Scripting (XSS) - DOM in GitHub repository plaidweb/webmention.js prior to 0.5.5. |
CVE-2023-3649 | Medium | 5.3 | 2023-07-14 | iSCSI dissector crash in Wireshark 4.0.0 to 4.0.6 allows denial of service via packet injection or crafted capture file |
CVE-2023-3648 | Medium | 5.3 | 2023-07-14 | Kafka dissector crash in Wireshark 4.0.0 to 4.0.6 and 3.6.0 to 3.6.14 allows denial of service via packet injection or crafted capture file |
CVE-2023-3514 | High | 7.8 | 2023-07-14 | Improper Privilege Control in RazerCentralSerivce Named Pipe in Razer RazerCentral <=7.11.0.558 on Windows allows a malicious actor with local access to gain S… |
CVE-2023-3513 | High | 7.8 | 2023-07-14 | Improper Privilege Control in RazerCentralSerivce Named Pipe in Razer RazerCentral <=7.11.0.558 on Windows allows a malicious actor with local access to gain S… |
CVE-2023-38286 | High | 7.5 | 2023-07-14 | Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin (aka Spring Boot Admin) through 3.1.1 and other products, allows sandbox bypass via crafted HTML… |
CVE-2023-2082 | Medium | 6.4 | 2023-07-14 | The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 3.6 due to insuff… |
CVE-2023-3668 | High | 7.2 | 2023-07-14 | Improper Encoding or Escaping of Output in GitHub repository froxlor/froxlor prior to 2.0.21. |
CVE-2023-37723 | Critical | 9.8 | 2023-07-14 | Tenda F1202 V1.0BR_V1.2.0.20(408), FH1202_V1.2.0.19_EN were discovered to contain a stack overflow in the page parameter in the function fromqossetting. |
CVE-2023-37722 | Critical | 9.8 | 2023-07-14 | Tenda F1202 V1.0BR_V1.2.0.20(408), FH1202_V1.2.0.19_EN were discovered to contain a stack overflow in the page parameter in the function fromSafeUrlFilter. |
CVE-2023-37721 | Critical | 9.8 | 2023-07-14 | Tenda F1202 V1.0BR_V1.2.0.20(408), FH1202_V1.2.0.19_EN were discovered to contain a stack overflow in the page parameter in the function fromSafeMacFilter. |
CVE-2023-37719 | Critical | 9.8 | 2023-07-14 | Tenda F1202 V1.0BR_V1.2.0.20(408), FH1202_V1.2.0.19_EN were discovered to contain a stack overflow in the page parameter in the function fromP2pListFilter. |
CVE-2023-37718 | Critical | 9.8 | 2023-07-14 | Tenda F1202 V1.0BR_V1.2.0.20(408), FH1202_V1.2.0.19_EN were discovered to contain a stack overflow in the page parameter in the function fromSafeClientFilter. |
CVE-2023-37717 | Critical | 9.8 | 2023-07-14 | Tenda F1202 V1.0BR_V1.2.0.20(408) and FH1202_V1.2.0.19_EN, AC10 V1.0, AC1206 V1.0, AC7 V1.0, AC5 V1.0, and AC9 V3.0 were discovered to contain a stack overflow… |
CVE-2023-37716 | Critical | 9.8 | 2023-07-14 | Tenda F1202 V1.0BR_V1.2.0.20(408) and FH1202_V1.2.0.19_EN, AC10 V1.0, AC1206 V1.0, AC7 V1.0, AC5 V1.0, and AC9 V3.0 were discovered to contain a stack overflow… |
CVE-2023-37715 | Critical | 9.8 | 2023-07-14 | Tenda F1202 V1.0BR_V1.2.0.20(408), FH1202_V1.2.0.19_EN were discovered to contain a stack overflow in the page parameter in the function frmL7ProtForm. |
CVE-2023-37714 | Critical | 9.8 | 2023-07-14 | Tenda F1202 V1.0BR_V1.2.0.20(408), FH1202_V1.2.0.19_EN were discovered to contain a stack overflow in the page parameter in the function fromRouteStatic. |
CVE-2023-37466 | Critical | 9.8 | 2023-07-14 | vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project… |
CVE-2023-37837 | Medium | 6.5 | 2023-07-13 | libjpeg commit db33a6e was discovered to contain a heap buffer overflow via LineBitmapRequester::EncodeRegion at linebitmaprequester.cpp. This vulnerability al… |
CVE-2023-37836 | Medium | 6.5 | 2023-07-13 | libjpeg commit db33a6e was discovered to contain a reachable assertion via BitMapHook::BitMapHook at bitmaphook.cpp. This vulnerability allows attackers to cau… |
CVE-2023-37278 | Medium | 6.8 | 2023-07-13 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An administrator c… |
CVE-2023-37275 | Low | 3.1 | 2023-07-13 | Auto-GPT is an experimental open-source application showcasing the capabilities of the GPT-4 language model. The Auto-GPT command line UI makes heavy use of co… |
CVE-2023-37274 | High | 7.5 | 2023-07-13 | Auto-GPT is an experimental open-source application showcasing the capabilities of the GPT-4 language model. When Auto-GPT is executed directly on the host sys… |
CVE-2023-37273 | High | 8.1 | 2023-07-13 | Auto-GPT is an experimental open-source application showcasing the capabilities of the GPT-4 language model. Running Auto-GPT version prior to 0.4.3 by cloning… |
CVE-2023-37272 | Medium | 6.3 | 2023-07-13 | JS7 is an Open Source Job Scheduler. Users specify file names when uploading files holding user-generated documentation for JOC Cockpit. Specifically crafted f… |
CVE-2023-37849 | Medium | 6.5 | 2023-07-13 | A DLL hijacking vulnerability in Panda Security VPN for Windows prior to version v15.14.8 allows attackers to execute arbitrary code via placing a crafted DLL… |
CVE-2023-37839 | Critical | 9.8 | 2023-07-13 | An arbitrary file upload vulnerability in /dede/file_manage_control.php of DedeCMS v5.7.109 allows attackers to execute arbitrary code via uploading a crafted… |
CVE-2023-37599 | High | 7.5 | 2023-07-13 | An issue in issabel-pbx v.4.0.0-6 allows a remote attacker to obtain sensitive information via the modules directory |
CVE-2023-37598 | Medium | 4.5 | 2023-07-13 | A Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of service via the delete new virtual fax… |
CVE-2023-37468 | Medium | 6.0 | 2023-07-13 | Feedbacksystem is a personalized feedback system for students using artificial intelligence. Passwords of users using LDAP login are stored in clear text in th… |
CVE-2023-36473 | Medium | 6.8 | 2023-07-13 | Discourse is an open source discussion platform. A CSP (Content Security Policy) nonce reuse vulnerability could allow XSS attacks to bypass CSP protection. Th… |
CVE-2023-35945 | High | 7.5 | 2023-07-13 | Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_S… |
CVE-2023-37463 | Medium | 6.4 | 2023-07-13 | cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version of Markdown syntax with a spec. Three polynomial time… |
CVE-2023-30565 | Low | 3.5 | 2023-07-13 | An insecure connection between Systems Manager and CQI Reporter application could expose infusion data to an attacker. |
CVE-2023-30564 | Medium | 6.9 | 2023-07-13 | Alaris Systems Manager does not perform input validation during the Device Import Function. |
CVE-2023-30563 | High | 8.2 | 2023-07-13 | A malicious file could be uploaded into a System Manager User Import Function resulting in a hijacked session. |
CVE-2023-30562 | Medium | 6.7 | 2023-07-13 | A GRE dataset file within Systems Manager can be tampered with and distributed to PCUs. |
CVE-2023-30561 | Medium | 6.1 | 2023-07-13 | The data flowing between the PCU and its modules is insecure. A threat actor with physical access could potentially read or modify data by attaching a speciall… |
CVE-2023-34458 | High | 7.1 | 2023-07-13 | mx-chain-go is the official implementation of the MultiversX blockchain protocol, written in golang. When executing a relayed transaction, if the inner transac… |
CVE-2023-30560 | Medium | 6.8 | 2023-07-13 | The configuration from the PCU can be modified without authentication using physical connection to the PCU. |
CVE-2023-30559 | Medium | 5.2 | 2023-07-13 | The firmware update package for the wireless card is not properly signed and can be modified. |
CVE-2023-37787 | Medium | 4.8 | 2023-07-13 | Multiple cross-site scripting (XSS) vulnerabilities in Geeklog v2.2.2 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected i… |
CVE-2023-37786 | Medium | 4.8 | 2023-07-13 | Multiple cross-site scripting (XSS) vulnerabilities in Geeklog v2.2.2 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected i… |
CVE-2023-37785 | Medium | 4.8 | 2023-07-13 | A cross-site scripting (XSS) vulnerability in ImpressCMS v1.4.5 and before allows attackers to execute arbitrary web scripts or HTML via a crafted payload inje… |
CVE-2023-37746 | Medium | 6.1 | 2023-07-13 | A cross-site scripting (XSS) vulnerability in Maid Hiring Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payloa… |
CVE-2023-35833 | Medium | 6.5 | 2023-07-13 | An issue was discovered in YSoft SAFEQ 6 Server before 6.0.82. When modifying the URL of the LDAP server configuration from LDAPS to LDAP, the system does not… |
CVE-2023-30151 | Critical | 9.8 | 2023-07-13 | A SQL injection vulnerability in the Boxtal (envoimoinscher) module for PrestaShop, after version 3.1.10, allows remote attackers to execute arbitrary SQL comm… |
CVE-2023-37745 | Medium | 6.1 | 2023-07-13 | A cross-site scripting (XSS) vulnerability in Maid Hiring Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payloa… |
CVE-2023-37744 | Medium | 6.1 | 2023-07-13 | Maid Hiring Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/search-booking-request.php. |
CVE-2023-37743 | Medium | 6.1 | 2023-07-13 | A cross-site scripting (XSS) vulnerability in Teacher Subject Allocation System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted pa… |
CVE-2023-33768 | Medium | 6.5 | 2023-07-13 | Incorrect signature verification of the firmware during the Device Firmware Update process of Belkin Wemo Smart Plug WSP080 v1.2 allows attackers to cause a De… |
CVE-2023-31824 | High | 7.5 | 2023-07-13 | An issue found in DERICIA Co. Ltd, DELICIA v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniap… |
CVE-2023-31823 | High | 7.5 | 2023-07-13 | An issue found in Marui Co Marui Official app v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the min… |
CVE-2023-31821 | High | 7.5 | 2023-07-13 | An issue found in ALBIS Co. ALBIS v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp ALBIS f… |
CVE-2023-31705 | Medium | 5.4 | 2023-07-13 | A Reflected Cross-site scripting (XSS) vulnerability in Sourcecodester Task Reminder System 1.0 allows an authenticated user to inject malicious javascript int… |
CVE-2023-31704 | Critical | 9.8 | 2023-07-13 | Sourcecodester Online Computer and Laptop Store 1.0 is vulnerable to Incorrect Access Control, which allows remote attackers to elevate privileges to the admin… |
CVE-2023-37267 | High | 7.5 | 2023-07-13 | Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerability was pat… |
CVE-2023-35070 | Critical | 9.8 | 2023-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VegaGroup Web Collection allows SQL Injection. This issu… |
CVE-2023-31825 | High | 7.5 | 2023-07-13 | An issue found in Inageya v.13.4.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp Inageya functio… |
CVE-2023-31822 | High | 7.5 | 2023-07-13 | An issue found in Entetsu Store v.13.4.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp Entetsu S… |