2023 CVEs (page 208)
Page 208 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-30647 | High | 7.8 | 2023-07-06 | Heap out of bound write vulnerability in IpcRxUsimPhoneBookCapa of RILD prior to SMR Jul-2023 Release 1 allows attackers to execute arbitrary code. |
CVE-2023-30646 | High | 7.8 | 2023-07-06 | Heap out of bound write vulnerability in BroadcastSmsConfig of RILD prior to SMR Jul-2023 Release 1 allows attackers to execute arbitrary code. |
CVE-2023-30645 | High | 7.8 | 2023-07-06 | Heap out of bound write vulnerability in IpcRxIncomingCBMsg of RILD prior to SMR Jul-2023 Release 1 allows attackers to execute arbitrary code. |
CVE-2023-30644 | High | 7.8 | 2023-07-06 | Stack out of bound write vulnerability in CdmaSmsParser of RILD prior to SMR Jul-2023 Release 1 allows attackers to execute arbitrary code. |
CVE-2023-30643 | High | 7.7 | 2023-07-06 | Missing authentication vulnerability in Galaxy Themes Service prior to SMR Jul-2023 Release 1 allows local attackers to delete arbitrary non-preloaded applicat… |
CVE-2023-30642 | Medium | 6.2 | 2023-07-06 | Improper privilege management vulnerability in Galaxy Themes Service prior to SMR Jul-2023 Release 1 allows local attackers to call privilege function. |
CVE-2023-30641 | Medium | 4.3 | 2023-07-06 | Improper access control vulnerability in Settings prior to SMR Jul-2023 Release 1 allows physical attacker to use restricted user profile to access device owne… |
CVE-2023-30640 | Medium | 4.3 | 2023-07-06 | Improper access control vulnerability in PersonaManagerService prior to SMR Jul-2023 Release 1 allows local attackers to change confiugration. |
CVE-2023-3521 | Medium | 6.1 | 2023-07-06 | Cross-site Scripting (XSS) - Reflected in GitHub repository fossbilling/fossbilling prior to 0.5.4. |
CVE-2023-29656 | Medium | 6.1 | 2023-07-06 | An improper authorization vulnerability in Darktrace mobile app (Android) prior to version 6.0.15 allows disabled and low-privilege users to control "antigena"… |
CVE-2023-27225 | Medium | 5.4 | 2023-07-06 | A cross-site scripting (XSS) vulnerability in User Registration & Login and User Management System with Admin Panel v3 allows attackers to execute arbitrary we… |
CVE-2023-24256 | High | 7.8 | 2023-07-06 | An issue in the com.nextev.datastatistic component of NIO EC6 Aspen before v3.3.0 allows attackers to escalate privileges via path traversal. |
CVE-2023-3520 | Medium | 4.6 | 2023-07-06 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository it-novum/openitcockpit prior to 4.6.6. |
CVE-2023-36828 | Medium | 5.5 | 2023-07-05 | Statamic is a flat-first, Laravel and Git powered content management system. Prior to version 4.10.0, the SVG tag does not sanitize malicious SVG. Therefore, a… |
CVE-2023-36827 | High | 7.5 | 2023-07-05 | Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of pri… |
CVE-2023-36822 | Medium | 6.5 | 2023-07-05 | Uptime Kuma, a self-hosted monitoring tool, has a path traversal vulnerability in versions prior to 1.22.1. Uptime Kuma allows authenticated users to install p… |
CVE-2023-36821 | High | 8.8 | 2023-07-05 | Uptime Kuma, a self-hosted monitoring tool, allows an authenticated attacker to install a maliciously crafted plugin in versions prior to 1.22.1, which may lea… |
CVE-2023-36813 | High | 7.1 | 2023-07-05 | Kanboard is project management software that focuses on the Kanban methodology. In versions prior to 1.2.31authenticated user is able to perform a SQL Injectio… |
CVE-2023-36809 | High | 8.1 | 2023-07-05 | Kiwi TCMS, an open source test management system allows users to upload attachments to test plans, test cases, etc. Versions of Kiwi TCMS prior to 12.5 had int… |
CVE-2023-36808 | High | 8.6 | 2023-07-05 | GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.8, Computer Virtual Machine form and GLPI inventory… |
CVE-2023-36458 | Medium | 6.3 | 2023-07-05 | 1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craft a malicious paylo… |
CVE-2023-36457 | Medium | 6.3 | 2023-07-05 | 1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craft a malicious paylo… |
CVE-2023-35940 | High | 7.5 | 2023-07-05 | GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a file allows an u… |
CVE-2023-35939 | High | 8.1 | 2023-07-05 | GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a on a file access… |
CVE-2023-35936 | Medium | 6.1 | 2023-07-05 | Pandoc is a Haskell library for converting from one markup format to another, and a command-line tool that uses this library. Starting in version 1.13 and prio… |
CVE-2023-30207 | Medium | 5.5 | 2023-07-05 | A divide by zero issue discovered in Kodi Home Theater Software 19.5 and earlier allows attackers to cause a denial of service via use of crafted mp3 file. |
CVE-2023-36624 | High | 7.8 | 2023-07-05 | Loxone Miniserver Go Gen.2 through 14.0.3.28 allows an authenticated operating system user to escalate privileges via the Sudo configuration. This allows the e… |
CVE-2023-36623 | High | 7.8 | 2023-07-05 | The root password of the Loxone Miniserver Go Gen.2 before 14.2 is calculated using hard-coded secrets and the MAC address. This allows a local user to calcula… |
CVE-2023-36622 | High | 7.2 | 2023-07-05 | The websocket configuration endpoint of the Loxone Miniserver Go Gen.2 before 14.1.5.9 allows remote authenticated administrators to inject arbitrary OS comman… |
CVE-2023-35924 | High | 8.6 | 2023-07-05 | GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.8, GLPI inventory endpoint can be used to drive a… |
CVE-2023-34654 | Medium | 6.1 | 2023-07-05 | taocms <=3.0.2 is vulnerable to Cross Site Scripting (XSS). |
CVE-2023-34457 | Medium | 5.9 | 2023-07-05 | MechanicalSoup is a Python library for automating interaction with websites. Starting in version 0.2.0 and prior to version 1.3.0, a malicious web server can r… |
CVE-2023-34244 | Medium | 6.5 | 2023-07-05 | GLPI is a free asset and IT management software package. Starting in version 9.4.0 and prior to version 10.0.8, a malicious link can be crafted by an unauthent… |
CVE-2023-34107 | Medium | 6.5 | 2023-07-05 | GLPI is a free asset and IT management software package. Versions of the software starting with 9.2.0 and prior to 10.0.8 have an incorrect rights check on a o… |
CVE-2023-27199 | Medium | 6.7 | 2023-07-05 | PAX Technology A930 PayDroid_7.1.1_Virgo_V04.5.02_20220722 allows attackers to compile a malicious shared library and use LD_PRELOAD to bypass authorization ch… |
CVE-2023-27198 | Medium | 6.8 | 2023-07-05 | PAX A930 device with PayDroid_7.1.1_Virgo_V04.5.02_20220722 can allow the execution of arbitrary commands by using the exec service and including a specific wo… |
CVE-2023-27197 | Medium | 6.7 | 2023-07-05 | PAX A930 device with PayDroid_7.1.1_Virgo_V04.5.02_20220722 can allow an attacker to gain root access by running a crafted binary leveraging an exported functi… |
CVE-2023-35001 | High | 7.8 | 2023-07-05 | Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network na… |
CVE-2023-34473 | Medium | 6.6 | 2023-07-05 | AMI SPx contains a vulnerability in the BMC where a valid user may cause a use of hard-coded credentials. A successful exploit of this vulnerability may lead… |
CVE-2023-34472 | Medium | 5.7 | 2023-07-05 | AMI SPx contains a vulnerability in the BMC where an Attacker may cause an improper neutralization of CRLF sequences in HTTP Headers. A successful exploit of t… |
CVE-2023-34471 | Medium | 6.3 | 2023-07-05 | AMI SPx contains a vulnerability in the BMC where a user may cause a missing cryptographic step by generating a hash-based message authentication code (HMAC)… |
CVE-2023-34338 | High | 7.1 | 2023-07-05 | AMI SPx contains a vulnerability in the BMC where an Attacker may cause a use of hard-coded cryptographic key by a hard-coded certificate. A successful exploit… |
CVE-2023-34337 | High | 7.6 | 2023-07-05 | AMI SPx contains a vulnerability in the BMC where a user may cause an inadequate encryption strength by hash-based message authentication code (HMAC). A succe… |
CVE-2023-31248 | High | 7.8 | 2023-07-05 | Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active and CAP_NET… |
CVE-2023-35863 | Medium | 5.3 | 2023-07-05 | In MADEFORNET HTTP Debugger through 9.12, the Windows service does not set the seclevel registry key before launching the driver. Thus, it is possible for an u… |
CVE-2023-34106 | Medium | 6.5 | 2023-07-05 | GLPI is a free asset and IT management software package. Versions of the software starting with 0.68 and prior to 10.0.8 have an incorrect rights check on a on… |
CVE-2023-33335 | Medium | 6.1 | 2023-07-05 | Cross Site Scripting (XSS) in Sophos Sophos iView (The EOL was December 31st 2020) in grpname parameter that allows arbitrary script to be executed. |
CVE-2023-30607 | Medium | 5.0 | 2023-07-05 | icingaweb2-module-jira provides integration with Atlassian Jira. Starting in version 1.3.0 and prior to version 1.3.2, template and field configuration forms p… |
CVE-2023-25399 | Medium | 5.5 | 2023-07-05 | A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() function. Note: This is disputed as a bu… |
CVE-2023-36934 | Critical | 9.1 | 2023-07-05 | In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQ… |
CVE-2023-36933 | High | 7.5 | 2023-07-05 | In Progress MOVEit Transfer before 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), it is possible for an att… |
CVE-2023-36932 | High | 8.1 | 2023-07-05 | In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), mult… |
CVE-2023-31194 | Medium | 5.3 | 2023-07-05 | An improper array index validation vulnerability exists in the GraphPlanar::Write functionality of Diagon v1.0.139. A specially crafted markdown file can lead… |
CVE-2023-27390 | High | 7.8 | 2023-07-05 | A heap-based buffer overflow vulnerability exists in the Sequence::DrawText functionality of Diagon v1.0.139. A specially crafted markdown file can lead to arb… |
CVE-2023-3515 | Medium | 4.4 | 2023-07-05 | Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4. |
CVE-2023-35979 | Medium | 5.3 | 2023-07-05 | There is an unauthenticated buffer overflow vulnerability in the process controlling the ArubaOS web-based management interface. Successful exploitation of thi… |
CVE-2023-35978 | Medium | 6.1 | 2023-07-05 | A vulnerability in ArubaOS could allow an unauthenticated remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-ba… |
CVE-2023-35977 | Medium | 6.5 | 2023-07-05 | Vulnerabilities exist which allow an authenticated attacker to access sensitive information on the ArubaOS command line interface. Successful exploitation coul… |
CVE-2023-35976 | Medium | 6.5 | 2023-07-05 | Vulnerabilities exist which allow an authenticated attacker to access sensitive information on the ArubaOS command line interface. Successful exploitation coul… |
CVE-2023-35975 | Medium | 6.5 | 2023-07-05 | An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability results in the abilit… |
CVE-2023-35974 | High | 7.2 | 2023-07-05 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the abi… |
CVE-2023-35973 | High | 7.2 | 2023-07-05 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the abi… |
CVE-2023-35972 | High | 7.2 | 2023-07-05 | An authenticated remote command injection vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of this vulnerability res… |
CVE-2023-35971 | High | 8.8 | 2023-07-05 | A vulnerability in the ArubaOS web-based management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) att… |
CVE-2023-36665 | Critical | 9.8 | 2023-07-05 | "protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled prot… |
CVE-2023-3455 | Critical | 9.1 | 2023-07-05 | Key management vulnerability on system. Successful exploitation of this vulnerability may affect service availability and integrity. |
CVE-2023-3089 | High | 7.0 | 2023-07-05 | A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic m… |
CVE-2023-2538 | Medium | 5.8 | 2023-07-05 | A CWE-552 "Files or Directories Accessible to External Parties” in the web interface of the Tyan S5552 BMC version 3.00 allows an unauthenticated remote attack… |
CVE-2023-3482 | Medium | 6.5 | 2023-07-05 | When Firefox is configured to block storage of all cookies, it was still possible to store data in localstorage by using an iframe with a source of 'about:blan… |
CVE-2023-3336 | Medium | 5.3 | 2023-07-05 | TN-5900 Series version 3.3 and prior versions is vulnearble to user enumeration vulnerability. The vulnerability may allow a remote attacker to determine wheth… |
CVE-2023-37212 | High | 8.8 | 2023-07-05 | Memory safety bugs present in Firefox 114. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could h… |
CVE-2023-37211 | High | 8.8 | 2023-07-05 | Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume t… |
CVE-2023-37210 | Medium | 6.5 | 2023-07-05 | A website could prevent a user from exiting full-screen mode via alert and prompt calls. This could lead to user confusion and possible spoofing attacks. This… |
CVE-2023-37209 | High | 8.8 | 2023-07-05 | A use-after-free condition existed in `NotifyOnHistoryReload` where a `LoadingSessionHistoryEntry` object was freed and a reference to that object remained. T… |
CVE-2023-37206 | Medium | 6.5 | 2023-07-05 | Uploading files which contain symlinks may have allowed an attacker to trick a user into submitting sensitive data to a malicious website. This vulnerability a… |
CVE-2023-37205 | Medium | 6.5 | 2023-07-05 | The use of RTL Arabic characters in the address bar may have allowed for URL spoofing. This vulnerability affects Firefox < 115. |
CVE-2023-37204 | Medium | 6.5 | 2023-07-05 | A website could have obscured the fullscreen notification by using an option element by introducing lag via an expensive computational function. This could hav… |
CVE-2023-37203 | High | 7.8 | 2023-07-05 | Insufficient validation in the Drag and Drop API in conjunction with social engineering, may have allowed an attacker to trick end-users into creating a shortc… |
CVE-2023-2880 | High | 7.5 | 2023-07-05 | Frauscher Sensortechnik GmbH FDS001 for FAdC/FAdCi v1.3.3 and all previous versions are vulnerable to a path traversal vulnerability of the web interface by a… |
CVE-2023-37208 | High | 7.8 | 2023-07-05 | When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code. This vulnerability affects Firefox < 115, Firefox ESR <… |
CVE-2023-37207 | Medium | 6.5 | 2023-07-05 | A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have le… |
CVE-2023-37202 | High | 8.8 | 2023-07-05 | Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-… |
CVE-2023-37201 | High | 8.8 | 2023-07-05 | An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS. This vulnerability affects Firefox < 115, Firefox ESR… |
CVE-2023-34150 | Medium | 6.5 | 2023-07-05 | ** UNSUPPORTED WHEN ASSIGNED ** Use of TikaEncodingDetector in Apache Any23 can cause excessive memory usage. |
CVE-2023-35786 | Medium | 4.9 | 2023-07-05 | Zoho ManageEngine ADManager Plus before 7183 allows admin users to exploit an XXE issue to view files. |
CVE-2023-33201 | Medium | 5.3 | 2023-07-05 | Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from… |
CVE-2023-31999 | High | 8.8 | 2023-07-04 | All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all requests for all users. The purpose of the… |
CVE-2023-3506 | Low | 3.5 | 2023-07-04 | A vulnerability was found in Active It Zone Active eCommerce CMS 6.5.0. It has been declared as problematic. This vulnerability affects unknown code of the fil… |
CVE-2023-3505 | Low | 3.5 | 2023-07-04 | A vulnerability was found in Onest CRM 1.0. It has been classified as problematic. This affects an unknown part of the file /admin/project/update/2 of the comp… |
CVE-2023-3504 | Medium | 6.3 | 2023-07-04 | A vulnerability was found in SmartWeb Infotech Job Board 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /sett… |
CVE-2023-3503 | Medium | 6.3 | 2023-07-04 | A vulnerability has been found in SourceCodester Shopping Website 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2023-3502 | Medium | 6.3 | 2023-07-04 | A vulnerability, which was classified as critical, was found in SourceCodester Shopping Website 1.0. Affected is an unknown function of the file search-result… |
CVE-2023-2974 | Medium | 6.5 | 2023-07-04 | A vulnerability was found in quarkus-core. This vulnerability occurs because the TLS protocol configured with quarkus.http.ssl.protocols is not enforced, and t… |
CVE-2023-3460 | Critical | 9.8 | 2023-07-04 | The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attac… |
CVE-2023-3139 | Medium | 6.1 | 2023-07-04 | The Protect WP Admin WordPress plugin before 4.0 discloses the URL of the admin panel via a redirection of a crafted URL, bypassing the protection offered. |
CVE-2023-3133 | High | 7.5 | 2023-07-04 | The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowing unauthenticated attackers to access… |
CVE-2023-2333 | Medium | 6.1 | 2023-07-04 | The Ninja Forms Google Sheet Connector WordPress plugin before 1.2.7, gsheetconnector-ninja-forms-pro WordPress plugin through 1.2.7 does not escape a paramete… |
CVE-2023-2324 | Medium | 6.1 | 2023-07-04 | The Elementor Forms Google Sheet Connector WordPress plugin before 1.0.7, gsheetconnector-for-elementor-forms-pro WordPress plugin through 1.0.7 does not escap… |
CVE-2023-2321 | Medium | 6.1 | 2023-07-04 | The WPForms Google Sheet Connector WordPress plugin before 3.4.6, gsheetconnector-wpforms-pro WordPress plugin through 3.4.6 does not escape a parameter before… |
CVE-2023-2320 | Medium | 6.1 | 2023-07-04 | The CF7 Google Sheets Connector WordPress plugin before 5.0.2, cf7-google-sheets-connector-pro WordPress plugin through 5.0.2 does not escape a parameter befor… |