2023 CVEs (page 20)
Page 20 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-37013 | High | 7.3 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a sufficiently large ASN.1 packet over the S1AP interface. An attacker m… |
CVE-2023-37012 | Medium | 5.3 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an… |
CVE-2023-37011 | Medium | 6.3 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a… |
CVE-2023-37010 | Medium | 6.3 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an… |
CVE-2023-37009 | Medium | 6.3 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a… |
CVE-2023-37008 | Medium | 5.3 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contain a buffer overflow in the ASN.1 deserialization function of the S1AP handler. This buffer overflow causes type confusion i… |
CVE-2023-37007 | Medium | 5.3 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a… |
CVE-2023-37006 | Medium | 5.3 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a… |
CVE-2023-37005 | Medium | 5.3 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an… |
CVE-2023-37004 | Medium | 5.3 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an… |
CVE-2023-37003 | Medium | 5.3 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an… |
CVE-2023-37002 | Medium | 5.3 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an… |
CVE-2023-36998 | High | 8.9 | 2025-01-22 | The NextEPC MME <= 1.0.1 (fixed in commit a8492c9c5bc0a66c6999cb5a263545b32a4109df) contains a stack-based buffer overflow vulnerability in the Emergency Numbe… |
CVE-2023-37039 | Medium | 6.5 | 2025-01-22 | A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486… |
CVE-2023-40132 | High | 7.8 | 2025-01-21 | In setActualDefaultRingtoneUri of RingtoneManager.java, there is a possible way to bypass content providers read permissions due to a missing permission check… |
CVE-2023-40108 | Medium | 5.5 | 2025-01-21 | In multiple locations, there is a possible way to access media content belonging to another user due to a missing permission check. This could lead to local in… |
CVE-2023-37038 | Medium | 6.5 | 2025-01-21 | A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486… |
CVE-2023-37037 | Medium | 6.5 | 2025-01-21 | A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486… |
CVE-2023-37036 | Medium | 6.5 | 2025-01-21 | A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486… |
CVE-2023-37035 | Medium | 6.5 | 2025-01-21 | A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486… |
CVE-2023-37034 | Medium | 6.5 | 2025-01-21 | A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486… |
CVE-2023-37033 | Medium | 6.5 | 2025-01-21 | A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486… |
CVE-2023-37032 | High | 7.5 | 2025-01-21 | A Stack-based buffer overflow in the Mobile Management Entity (MME) of Magma versions <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486)… |
CVE-2023-37031 | Medium | 6.5 | 2025-01-21 | A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486… |
CVE-2023-37030 | Medium | 6.5 | 2025-01-21 | A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486… |
CVE-2023-37029 | High | 7.5 | 2025-01-21 | Magma versions <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) are susceptible to an assertion-based crash when an oversized NAS packe… |
CVE-2023-37028 | Medium | 6.5 | 2025-01-21 | A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486… |
CVE-2023-37027 | Medium | 6.5 | 2025-01-21 | Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486)… |
CVE-2023-37026 | Medium | 6.5 | 2025-01-21 | A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486… |
CVE-2023-37025 | Medium | 6.5 | 2025-01-21 | A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486… |
CVE-2023-37024 | High | 7.5 | 2025-01-21 | A reachable assertion in the Mobile Management Entity (MME) of Magma versions <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows r… |
CVE-2023-50733 | High | 8.6 | 2025-01-21 | A Server-Side Request Forgery (SSRF) vulnerability has been identified in the Web Services feature of newer Lexmark devices. |
CVE-2023-27113 | Critical | 9.8 | 2025-01-21 | pearProjectApi v2.8.10 was discovered to contain a SQL injection vulnerability via the organizationCode parameter at project.php. |
CVE-2023-27112 | Critical | 9.8 | 2025-01-21 | pearProjectApi v2.8.10 was discovered to contain a SQL injection vulnerability via the projectCode parameter at project.php. |
CVE-2023-45908 | Medium | 6.1 | 2025-01-21 | Homarr before v0.14.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Notebook widget. |
CVE-2023-52923 | High | 7.8 | 2025-01-20 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: adapt set backend to use GC transaction API Use the GC transaction… |
CVE-2023-50739 | High | 8.8 | 2025-01-18 | A buffer overflow vulnerability has been identified in the Internet Printing Protocol (IPP) in various Lexmark devices. The vulnerability can be leveraged by a… |
CVE-2023-50738 | Medium | 4.3 | 2025-01-17 | A new feature to prevent Firmware downgrades was recently added to some Lexmark products. A method to override this downgrade protection has been identified. |
CVE-2023-46715 | Medium | 5.0 | 2025-01-14 | An origin validation error [CWE-346] vulnerability in Fortinet FortiOS IPSec VPN version 7.4.0 through 7.4.1 and version 7.2.6 and below allows an authenticat… |
CVE-2023-42786 | Medium | 6.5 | 2025-01-14 | A null pointer dereference in FortiOS versions 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0 all versions, 6.4 all versions , 6.2 all versions and 6.0 all vers… |
CVE-2023-42785 | Medium | 6.5 | 2025-01-14 | A null pointer dereference in FortiOS versions 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0 all versions, 6.4 all versions , 6.2 all versions and 6.0 all vers… |
CVE-2023-37937 | High | 7.8 | 2025-01-14 | An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSwitch version 7.4.0 and 7.2.0 through 7.2.5 and… |
CVE-2023-37936 | Critical | 9.8 | 2025-01-14 | A use of hard-coded cryptographic key in Fortinet FortiSwitch version 7.4.0 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.7 and 6.4.0 through 6.4.13 and 6.2.0… |
CVE-2023-37931 | High | 8.8 | 2025-01-14 | An improper neutralization of special elements used in an sql command ('sql injection') vulnerability [CWE-88] in FortiVoice Entreprise version 7.0.0 through 7… |
CVE-2023-42250 | Medium | 6.1 | 2025-01-13 | Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via /common/autocomplete.php. |
CVE-2023-42249 | Medium | 6.1 | 2025-01-13 | Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via vam/vam_visits.php. |
CVE-2023-42248 | Medium | 6.5 | 2025-01-13 | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can write arbitrary files by manipulating POST parame… |
CVE-2023-42247 | Medium | 6.1 | 2025-01-13 | Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via monitor/s_monitor_map.php. |
CVE-2023-42246 | Medium | 6.1 | 2025-01-13 | Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via /vam/vam_ep.php. |
CVE-2023-42245 | Medium | 6.1 | 2025-01-13 | Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via monitor/s_scheduledfile.php. |
CVE-2023-42244 | High | 8.8 | 2025-01-13 | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters… |
CVE-2023-42243 | Medium | 5.4 | 2025-01-13 | In Selesta Visual Access Manager < 4.42.2, an authenticated user can access the administrative page /common/vam_Sql.php, which allows for arbitrary SQL queries. |
CVE-2023-42242 | Low | 3.8 | 2025-01-13 | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in a GET parameter of /moni… |
CVE-2023-42241 | Low | 3.8 | 2025-01-13 | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters… |
CVE-2023-42240 | Low | 3.8 | 2025-01-13 | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters… |
CVE-2023-42239 | Low | 3.8 | 2025-01-13 | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters… |
CVE-2023-42238 | Low | 3.8 | 2025-01-13 | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters… |
CVE-2023-42237 | Low | 3.8 | 2025-01-13 | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple GET parameters… |
CVE-2023-42236 | Low | 3.8 | 2025-01-13 | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in a GET parameter of /comm… |
CVE-2023-42235 | Low | 3.8 | 2025-01-13 | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple parameters of /… |
CVE-2023-42234 | Medium | 5.4 | 2025-01-13 | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Cross Site Request Forgery (CSRF) via the WSCView function. |
CVE-2023-42233 | Medium | 6.1 | 2025-01-13 | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Cross Site Scripting (XSS) via the Filter/FilterEditor function. |
CVE-2023-42232 | High | 7.5 | 2025-01-13 | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via the Navigator/Index function. |
CVE-2023-42231 | High | 8.1 | 2025-01-13 | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Incorrect Access Control. Low privileged users can delete admin users by sending a request… |
CVE-2023-42230 | Medium | 6.1 | 2025-01-13 | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Cross Site Scripting (XSS) via the WSCView/Save function. |
CVE-2023-42229 | Medium | 6.5 | 2025-01-13 | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal. Arbitrary files can be created on the system via authenticated SOAP re… |
CVE-2023-42228 | High | 8.8 | 2025-01-13 | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Incorrect Access Control. Low privileged users can edit their own ACL rules by sending a re… |
CVE-2023-42227 | High | 7.5 | 2025-01-13 | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via the WSCView/Save function. |
CVE-2023-42226 | High | 7.5 | 2025-01-13 | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via Email/SaveAttachment function. |
CVE-2023-42225 | High | 7.5 | 2025-01-13 | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via the Attachment/DownloadTempFile function. |
CVE-2023-28354 | Critical | 9.8 | 2025-01-09 | An issue was discovered in Opsview Monitor Agent 6.8. An unauthenticated remote attacker can call check_nrpe against affected targets, specifying known NRPE pl… |
CVE-2023-24012 | High | 8.2 | 2025-01-09 | An attacker can arbitrarily craft malicious DDS Participants (or ROS 2 Nodes) with valid certificates to compromise and get full control of the attacked secure… |
CVE-2023-24011 | High | 8.2 | 2025-01-09 | An attacker can arbitrarily craft malicious DDS Participants (or ROS 2 Nodes) with valid certificates to compromise and get full control of the attacked secure… |
CVE-2023-24010 | High | 8.2 | 2025-01-09 | An attacker can arbitrarily craft malicious DDS Participants (or ROS 2 Nodes) with valid certificates to compromise and get full control of the attacked secure… |
CVE-2023-1907 | High | 8.0 | 2025-01-09 | A vulnerability was found in pgadmin. Users logging into pgAdmin running in server mode using LDAP authentication may be attached to another user's session if… |
CVE-2023-38037 | Medium | 5.5 | 2025-01-09 | ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file's permissions are defaulted to the user's curren… |
CVE-2023-28362 | Medium | 4.0 | 2025-01-09 | The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for dow… |
CVE-2023-28120 | Medium | 5.3 | 2025-01-09 | There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input. |
CVE-2023-27539 | Medium | 5.3 | 2025-01-09 | There is a denial of service vulnerability in the header parsing component of Rack. |
CVE-2023-27531 | Medium | 5.3 | 2025-01-09 | There is a deserialization of untrusted data vulnerability in the Kredis JSON deserialization code |
CVE-2023-23913 | Medium | 6.3 | 2025-01-09 | There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the contente… |
CVE-2023-35685 | High | 7.8 | 2025-01-08 | In DevmemIntMapPages of devicemem_server.c, there is a possible physical page uaf due to a logic error in the code. This could lead to local escalation of priv… |
CVE-2023-52955 | Medium | 6.5 | 2025-01-08 | Vulnerability of improper authentication in the ANS system service module Impact: Successful exploitation of this vulnerability may cause features to perform a… |
CVE-2023-52954 | Medium | 4.4 | 2025-01-08 | Vulnerability of improper permission control in the Gallery module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2023-52953 | Medium | 6.2 | 2025-01-08 | Path traversal vulnerability in the Medialibrary module Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality. |
CVE-2023-6605 | High | 7.2 | 2025-01-06 | A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg vi… |
CVE-2023-6604 | Medium | 5.3 | 2025-01-06 | A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or de… |
CVE-2023-6601 | Medium | 4.7 | 2025-01-06 | A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows bypassing unsafe file extension checks and triggering arbitrary demuxers via base64-encoded… |
CVE-2023-23672 | Medium | 5.4 | 2025-01-02 | Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP.This issue affects GiveWP: from n/a through 2.25.1. |
CVE-2023-48758 | High | 7.1 | 2025-01-02 | Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2023-48739 | Medium | 5.3 | 2025-01-02 | Missing Authorization vulnerability in Porto Theme Porto Theme - Functionality porto-functionality allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2023-47807 | Medium | 4.3 | 2025-01-02 | Missing Authorization vulnerability in 10Web 10WebAnalytics wd-google-analytics allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2023-47778 | Medium | 4.3 | 2025-01-02 | Missing Authorization vulnerability in LuckyWP LuckyWP Scripts Control luckywp-scripts-control allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2023-45633 | Medium | 6.5 | 2025-01-02 | Missing Authorization vulnerability in IDX IMPress Listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IMPress… |
CVE-2023-45272 | Medium | 5.4 | 2025-01-02 | Missing Authorization vulnerability in 10Web 10Web Map Builder for Google Maps allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2023-40327 | Medium | 6.5 | 2025-01-02 | Missing Authorization vulnerability in Putler / Storeapps Putler Connector for WooCommerce.This issue affects Putler Connector for WooCommerce: from n/a throug… |
CVE-2023-39994 | Medium | 4.3 | 2025-01-02 | Missing Authorization vulnerability in Repute InfoSystems ARMember Premium allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2023-32240 | Medium | 5.4 | 2025-01-02 | Missing Authorization vulnerability in Xtemos WoodMart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WoodMart: fro… |
CVE-2023-47693 | High | 7.5 | 2025-01-02 | Missing Authorization vulnerability in Themefic Ultimate Addons for Contact Form 7 ultimate-addons-for-contact-form-7 allows Exploiting Incorrectly Configured… |
CVE-2023-47692 | Medium | 4.3 | 2025-01-02 | Missing Authorization vulnerability in flothemesplugins Flo Forms flo-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |