2023 CVEs (page 199)
Page 199 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-31820 | High | 7.5 | 2023-07-13 | An issue found in Shizutetsu Store v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp functi… |
CVE-2023-31819 | High | 7.5 | 2023-07-13 | An issue found in KEISEI STORE Co, Ltd. LIVRE KEISEI v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in… |
CVE-2023-3661 | Medium | 6.3 | 2023-07-13 | A vulnerability was found in SourceCodester AC Repair and Services System 1.0. It has been classified as critical. This affects an unknown part of the file /cl… |
CVE-2023-3660 | Low | 2.4 | 2023-07-13 | A vulnerability was found in Campcodes Retro Cellphone Online Store 1.0 and classified as problematic. Affected by this issue is some unknown functionality of… |
CVE-2023-2003 | Critical | 9.1 | 2023-07-13 | Embedded malicious code vulnerability in Vision1210, in the build 5 of operating system version 4.3, which could allow a remote attacker to store base64-encode… |
CVE-2023-26597 | High | 7.5 | 2023-07-13 | Controller DoS due to buffer overflow in the handling of a specially crafted message received by the controller. See Honeywell Security Notification for recomm… |
CVE-2023-25948 | High | 7.5 | 2023-07-13 | Server information leak of configuration data when an error is generated in response to a specially crafted message. See Honeywell Security Notification for re… |
CVE-2023-3659 | Low | 3.5 | 2023-07-13 | A vulnerability has been found in SourceCodester AC Repair and Services System 1.0 and classified as problematic. Affected by this vulnerability is an unknown… |
CVE-2023-3658 | Medium | 6.3 | 2023-07-13 | A vulnerability, which was classified as critical, was found in SourceCodester AC Repair and Services System 1.0. Affected is an unknown function of the file M… |
CVE-2023-25770 | Critical | 9.8 | 2023-07-13 | Controller DoS may occur due to buffer overflow when an error is generated in response to a specially crafted message. See Honeywell Security Notification for… |
CVE-2023-25178 | Critical | 9.8 | 2023-07-13 | Controller may be loaded with malicious firmware which could enable remote code execution. See Honeywell Security Notification for recommendations on upgrading… |
CVE-2023-25078 | Critical | 9.8 | 2023-07-13 | Server or Console Station DoS due to heap overflow occurring during the handling of a specially crafted message for a specific configuration operation. See H… |
CVE-2023-24480 | Critical | 9.8 | 2023-07-13 | Controller DoS due to stack overflow when decoding a message from the server. See Honeywell Security Notification for recommendations on upgrading and versio… |
CVE-2023-24474 | High | 7.5 | 2023-07-13 | Experion server may experience a DoS due to a heap overflow which could occur when handling a specially crafted message |
CVE-2023-23585 | Critical | 9.8 | 2023-07-13 | Experion server DoS due to heap overflow occurring during the handling of a specially crafted message for a specific configuration operation. See Honeywell S… |
CVE-2023-22435 | High | 7.5 | 2023-07-13 | Experion server may experience a DoS due to a stack overflow when handling a specially crafted message. |
CVE-2023-3657 | Medium | 6.3 | 2023-07-13 | A vulnerability, which was classified as critical, has been found in SourceCodester AC Repair and Services System 1.0. This issue affects some unknown processi… |
CVE-2023-29458 | Medium | 5.9 | 2023-07-13 | Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint. When adding too many values in valstack JavaScript wil… |
CVE-2023-29457 | Medium | 6.3 | 2023-07-13 | Reflected XSS attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script can be activated through Action for… |
CVE-2023-29456 | Medium | 5.7 | 2023-07-13 | URL validation scheme receives input from a user and then parses it to identify its various components. The validation scheme can ensure that all URL component… |
CVE-2023-29455 | Medium | 5.4 | 2023-07-13 | Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web application to the victim's browser. The scri… |
CVE-2023-29454 | Medium | 5.4 | 2023-07-13 | Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the application saves… |
CVE-2023-29452 | Medium | 5.5 | 2023-07-13 | Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when selected “Other” Tile… |
CVE-2023-29451 | Medium | 4.7 | 2023-07-13 | Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy. |
CVE-2023-29450 | High | 8.5 | 2023-07-13 | JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of user "zabbix") on the Zabbix Server or Z… |
CVE-2023-29449 | Medium | 5.9 | 2023-07-13 | JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configu… |
CVE-2023-3319 | Medium | 5.4 | 2023-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iDisplay PlatPlay DS allows Stored XSS. This issue affec… |
CVE-2023-37415 | High | 8.8 | 2023-07-13 | Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Apache Hive Provider. Patching on top of CVE-2023-35797 Before 6.1.2 the… |
CVE-2023-35069 | High | 7.5 | 2023-07-13 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bullwark allows Path Traversal. This issue affects Bullwark: b… |
CVE-2023-2957 | Critical | 9.8 | 2023-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Lisa Software Florist Site allows SQL Injection. This is… |
CVE-2023-1547 | Critical | 9.8 | 2023-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Elra Parkmatik allows SQL Injection through SOAP Paramete… |
CVE-2023-37565 | High | 8.0 | 2023-07-13 | Code injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent authenticated attacker to execute arbitrary code by sending a specially c… |
CVE-2023-37564 | High | 8.0 | 2023-07-13 | OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent authenticated attacker to execute an arbitrary OS command with a ro… |
CVE-2023-3444 | Medium | 5.7 | 2023-07-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, all vers… |
CVE-2023-3424 | High | 7.5 | 2023-07-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, all vers… |
CVE-2023-3363 | Low | 3.9 | 2023-07-13 | An information disclosure issue in Gitlab CE/EE affecting all versions from 13.6 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, all versions from 1… |
CVE-2023-3362 | Medium | 5.3 | 2023-07-13 | An information disclosure issue in GitLab CE/EE affecting all versions from 16.0 prior to 16.0.6, and version 16.1.0 allows unauthenticated actors to access th… |
CVE-2023-3343 | High | 8.8 | 2023-07-13 | The User Registration plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.0.1 via deserialization of untrusted input… |
CVE-2023-3342 | Critical | 9.9 | 2023-07-13 | The User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to a hardcoded encryption key and missing file type validation on the 'u… |
CVE-2023-38199 | Critical | 9.8 | 2023-07-13 | coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type request headers on some platforms. This might allow attac… |
CVE-2023-38198 | Critical | 9.8 | 2023-07-13 | acme.sh before 3.0.6 runs arbitrary commands from a remote server via eval, as exploited in the wild in June 2023. |
CVE-2023-37563 | Medium | 6.5 | 2023-07-13 | ELECOM wireless LAN routers are vulnerable to sensitive information exposure, which allows a network-adjacent unauthorized attacker to obtain sensitive informa… |
CVE-2023-37562 | High | 8.8 | 2023-07-13 | Cross-site request forgery (CSRF) vulnerability in exists in WTC-C1167GC-B v1.17 and earlier, and WTC-C1167GC-W v1.17 and earlier. If a user views a malicious… |
CVE-2023-34137 | Critical | 9.8 | 2023-07-13 | SonicWall GMS and Analytics CAS Web Services application use static values for authentication without proper checks leading to authentication bypass vulnerabil… |
CVE-2023-34136 | Critical | 9.8 | 2023-07-13 | Vulnerability in SonicWall GMS and Analytics allows unauthenticated attacker to upload files to a restricted location not controlled by the attacker. This issu… |
CVE-2023-34135 | Medium | 6.5 | 2023-07-13 | Path Traversal vulnerability in SonicWall GMS and Analytics allows a remote authenticated attacker to read arbitrary files from the underlying file system via… |
CVE-2023-34134 | Medium | 6.5 | 2023-07-13 | Exposure of sensitive information to an unauthorized actor vulnerability in SonicWall GMS and Analytics allows authenticated attacker to read administrator pas… |
CVE-2023-34133 | High | 7.5 | 2023-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SonicWall GMS and Analytics allows an unauthenticated att… |
CVE-2023-34132 | Critical | 9.8 | 2023-07-13 | Use of password hash instead of password for authentication vulnerability in SonicWall GMS and Analytics allows Pass-the-Hash attacks. This issue affects GMS… |
CVE-2023-34131 | Medium | 5.3 | 2023-07-13 | Exposure of sensitive information to an unauthorized actor vulnerability in SonicWall GMS and Analytics enables an unauthenticated attacker to access restricte… |
CVE-2023-2620 | Medium | 5.5 | 2023-07-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.1 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, all versions… |
CVE-2023-2576 | Medium | 4.3 | 2023-07-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 before 15.11.10, all versions starting from 16.0 before 16.0.6, all vers… |
CVE-2023-2200 | Medium | 4.1 | 2023-07-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.14 before 15.11.10, all versions starting from 16.0 before 16.0.6, all vers… |
CVE-2023-38197 | High | 7.5 | 2023-07-13 | An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3. There are infinite loops in recursive entity expansion. |
CVE-2023-37568 | High | 8.0 | 2023-07-13 | ELECOM wireless LAN routers WRC-1167GHBK-S v1.03 and earlier, and WRC-1167GEBK-S v1.03 and earlier allow a network-adjacent authenticated attacker to execute a… |
CVE-2023-37567 | Critical | 9.8 | 2023-07-13 | Command injection vulnerability in ELECOM and LOGITEC wireless LAN routers allows a remote unauthenticated attacker to execute an arbitrary command by sending… |
CVE-2023-37566 | High | 8.0 | 2023-07-13 | Command injection vulnerability in ELECOM and LOGITEC wireless LAN routers allows a network-adjacent authenticated attacker to execute an arbitrary command by… |
CVE-2023-37561 | Medium | 6.1 | 2023-07-13 | Open redirect vulnerability in ELECOM wireless LAN routers and ELECOM wireless LAN repeaters allows a remote unauthenticated attacker to redirect users to arbi… |
CVE-2023-37560 | Medium | 6.1 | 2023-07-13 | Cross-site scripting vulnerability in WRH-300WH-H v2.12 and earlier, and WTC-300HWH v1.09 and earlier allows a remote unauthenticated attacker to inject an arb… |
CVE-2023-34130 | Critical | 9.8 | 2023-07-13 | SonicWall GMS and Analytics use outdated Tiny Encryption Algorithm (TEA) with a hardcoded key to encrypt sensitive data. This issue affects GMS: 9.3.2-SP1 and… |
CVE-2023-34129 | High | 8.8 | 2023-07-13 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in SonicWall GMS and Analytics allows an authenticated remote atta… |
CVE-2023-2190 | Medium | 6.5 | 2023-07-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.10 before 15.11.10, all versions starting from 16.0 before 16.0.6, all ver… |
CVE-2023-34128 | Critical | 9.8 | 2023-07-13 | Tomcat application credentials are hardcoded in SonicWall GMS and Analytics configuration file. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analyti… |
CVE-2023-34127 | High | 8.8 | 2023-07-13 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SonicWall GMS, SonicWall Analytics enables an authe… |
CVE-2023-34126 | High | 8.8 | 2023-07-13 | Vulnerability in SonicWall GMS and Analytics allows an authenticated attacker to upload files on the underlying filesystem with root privileges. This issue aff… |
CVE-2023-34125 | Medium | 6.5 | 2023-07-13 | Path Traversal vulnerability in GMS and Analytics allows an authenticated attacker to read arbitrary files from the underlying filesystem with root privileges… |
CVE-2023-34124 | Critical | 9.8 | 2023-07-13 | The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authentication bypass. This issue affects GMS: 9.3.2… |
CVE-2023-21260 | Medium | 5.5 | 2023-07-13 | In notification access permission dialog box, malicious application can embedded a very long service label that overflow the original user prompt and possibly… |
CVE-2023-35694 | High | 7.5 | 2023-07-13 | In DMPixelLogger_ProcessDmCommand of DMPixelLogger.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote informa… |
CVE-2023-35693 | Medium | 6.7 | 2023-07-13 | In incfs_kill_sb of fs/incfs/vfs.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System… |
CVE-2023-35691 | High | 7.2 | 2023-07-13 | there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with System execution privileges needed. User… |
CVE-2023-34123 | High | 7.5 | 2023-07-13 | Use of Hard-coded Cryptographic Key vulnerability in SonicWall GMS, SonicWall Analytics. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5… |
CVE-2023-21400 | Medium | 6.7 | 2023-07-13 | In multiple functions of io_uring.c, there is a possible kernel memory corruption due to improper locking. This could lead to local escalation of privilege in… |
CVE-2023-21399 | High | 7.8 | 2023-07-13 | there is a possible way to bypass cryptographic assurances due to a logic error in the code. This could lead to local escalation of privilege with no additiona… |
CVE-2023-21262 | Low | 3.1 | 2023-07-13 | In startInput of AudioPolicyInterfaceImpl.cpp, there is a possible way of erroneously displaying the microphone privacy indicator due to a race condition. This… |
CVE-2023-21257 | High | 7.8 | 2023-07-13 | In updateSettingsInternalLI of InstallPackageHelper.java, there is a possible way to sideload an app in the work profile due to a missing permission check. Thi… |
CVE-2023-21256 | High | 7.8 | 2023-07-13 | In SettingsHomepageActivity.java, there is a possible way to launch arbitrary activities via Settings due to a logic error in the code. This could lead to loca… |
CVE-2023-21255 | High | 7.8 | 2023-07-13 | In multiple functions of binder.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no addi… |
CVE-2023-21254 | High | 7.8 | 2023-07-13 | In getCurrentState of OneTimePermissionUserManager.java, there is a possible way to hold one-time permissions after the app is being killed due to a logic erro… |
CVE-2023-21251 | High | 7.3 | 2023-07-13 | In onCreate of ConfirmDialog.java, there is a possible way to connect to VNP bypassing user's consent due to improper input validation. This could lead to loca… |
CVE-2023-21250 | Critical | 9.8 | 2023-07-13 | In gatt_end_operation of gatt_utils.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no… |
CVE-2023-21249 | Medium | 5.5 | 2023-07-13 | In multiple functions of OneTimePermissionUserManager.java, there is a possible one-time permission retention due to a permissions bypass. This could lead to l… |
CVE-2023-21248 | High | 7.8 | 2023-07-13 | In getAvailabilityStatus of WifiScanningMainSwitchPreferenceController.java, there is a possible way to bypass a device policy restriction due to a missing per… |
CVE-2023-21247 | High | 7.8 | 2023-07-13 | In getAvailabilityStatus of BluetoothScanningMainSwitchPreferenceController.java, there is a possible way to bypass a device policy restriction due to a missin… |
CVE-2023-21246 | Low | 3.3 | 2023-07-13 | In ShortcutInfo of ShortcutInfo.java, there is a possible way for an app to retain notification listening access due to an uncaught exception. This could lead… |
CVE-2023-21245 | High | 7.8 | 2023-07-13 | In showNextSecurityScreenOrFinish of KeyguardSecurityContainerController.java, there is a possible way to access the lock screen during device setup due to a l… |
CVE-2023-21243 | Medium | 5.5 | 2023-07-13 | In validateForCommonR1andR2 of PasspointConfiguration.java, there is a possible way to inflate the size of a config file with no limits due to a buffer overflo… |
CVE-2023-21241 | High | 7.8 | 2023-07-13 | In rw_i93_send_to_upper of rw_i93.cc, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with… |
CVE-2023-21240 | Medium | 5.5 | 2023-07-13 | In Policy of Policy.java, there is a possible boot loop due to resource exhaustion. This could lead to local denial of service with no additional execution pri… |
CVE-2023-21239 | Medium | 5.5 | 2023-07-13 | In visitUris of Notification.java, there is a possible way to leak image data across user boundaries due to a confused deputy. This could lead to local informa… |
CVE-2023-21238 | Medium | 5.5 | 2023-07-13 | In visitUris of RemoteViews.java, there is a possible leak of images between users due to a confused deputy. This could lead to local information disclosure wi… |
CVE-2023-21145 | High | 7.8 | 2023-07-13 | In updatePictureInPictureMode of ActivityRecord.java, there is a possible bypass of background launch restrictions due to a logic error in the code. This could… |
CVE-2023-20942 | Medium | 5.5 | 2023-07-13 | In openMmapStream of AudioFlinger.cpp, there is a possible way to record audio without displaying the microphone privacy indicator due to a logic error in the… |
CVE-2023-20918 | Critical | 9.8 | 2023-07-13 | In getPendingIntentLaunchFlags of ActivityOptions.java, there is a possible elevation of privilege due to a confused deputy with no additional execution privil… |
CVE-2023-33274 | Critical | 9.8 | 2023-07-12 | The authentication mechanism in PowerShield SNMP Web Pro 1.1 contains a vulnerability that allows unauthenticated users to directly access Common Gateway Inter… |
CVE-2023-26564 | Critical | 9.8 | 2023-07-12 | The Syncfusion EJ2 ASPCore File Provider 3ac357f is vulnerable to Models/PhysicalFileProvider.cs directory traversal. As a result, an unauthenticated attacker… |
CVE-2023-26563 | Critical | 9.8 | 2023-07-12 | The Syncfusion EJ2 Node File Provider 0102271 is vulnerable to filesystem-server.js directory traversal. As a result, an unauthenticated attacker can: - On Win… |
CVE-2023-3635 | Medium | 5.9 | 2023-07-12 | GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when h… |
CVE-2023-3644 | Medium | 6.3 | 2023-07-12 | A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been declared as critical. This vulnerability affects unknown code o… |
CVE-2023-3643 | High | 7.3 | 2023-07-12 | A vulnerability was found in Boss Mini 1.4.0 Build 6221. It has been classified as critical. This affects an unknown part of the file boss/servlet/document. Th… |