2023 CVEs (page 209)
Page 209 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-2010 | Low | 3.1 | 2023-07-04 | The Forminator WordPress plugin before 1.24.1 does not use an atomic operation to check whether a user has already voted, and then update that information. Thi… |
CVE-2023-1273 | High | 8.8 | 2023-07-04 | The ND Shortcodes WordPress plugin before 7.0 does not validate some shortcode attributes before using them to generate paths passed to include function/s, all… |
CVE-2023-28542 | High | 7.8 | 2023-07-04 | Memory Corruption in WLAN HOST while fetching TX status information. |
CVE-2023-28541 | High | 7.8 | 2023-07-04 | Memory Corruption in Data Modem while processing DMA buffer release event about CFR data. |
CVE-2023-24854 | High | 7.8 | 2023-07-04 | Memory Corruption in WLAN HOST while parsing QMI WLAN Firmware response message. |
CVE-2023-24851 | High | 7.8 | 2023-07-04 | Memory Corruption in WLAN HOST while parsing QMI response message from firmware. |
CVE-2023-22667 | High | 8.4 | 2023-07-04 | Memory Corruption in Audio while allocating the ion buffer during the music playback. |
CVE-2023-22387 | High | 7.8 | 2023-07-04 | Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption. |
CVE-2023-22386 | High | 7.8 | 2023-07-04 | Memory Corruption in WLAN HOST while processing WLAN FW request to allocate memory. |
CVE-2023-21672 | High | 8.4 | 2023-07-04 | Memory corruption in Audio while running concurrent tunnel playback or during concurrent audio tunnel recording sessions. |
CVE-2023-21641 | Medium | 6.6 | 2023-07-04 | An app with non-privileged access can change global system brightness and cause undesired system behavior. |
CVE-2023-21640 | Medium | 6.7 | 2023-07-04 | Memory corruption in Linux when the file upload API is called with parameters having large buffer. |
CVE-2023-21639 | Medium | 6.7 | 2023-07-04 | Memory corruption in Audio while processing sva_model_serializer using memory size passed by HIDL client. |
CVE-2023-21638 | Medium | 6.7 | 2023-07-04 | Memory corruption in Video while calling APIs with different instance ID than the one received in initialization. |
CVE-2023-21637 | Medium | 6.7 | 2023-07-04 | Memory corruption in Linux while calling system configuration APIs. |
CVE-2023-21635 | Medium | 6.7 | 2023-07-04 | Memory Corruption in Data Network Stack & Connectivity when sim gets detected on telephony. |
CVE-2023-21633 | Medium | 6.7 | 2023-07-04 | Memory Corruption in Linux while processing QcRilRequestImsRegisterMultiIdentityMessage request. |
CVE-2023-21631 | High | 7.5 | 2023-07-04 | Weak Configuration due to improper input validation in Modem while processing LTE security mode command message received from network. |
CVE-2023-21629 | Medium | 6.8 | 2023-07-04 | Memory Corruption in Modem due to double free while parsing the PKCS15 sim files. |
CVE-2023-21624 | Medium | 6.2 | 2023-07-04 | Information disclosure in DSP Services while loading dynamic module. |
CVE-2023-20775 | Medium | 6.7 | 2023-07-04 | In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privi… |
CVE-2023-20774 | Medium | 6.7 | 2023-07-04 | In display, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with System execution privil… |
CVE-2023-20773 | High | 7.8 | 2023-07-04 | In vow, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional exec… |
CVE-2023-20772 | Medium | 6.7 | 2023-07-04 | In vow, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional exec… |
CVE-2023-20771 | Medium | 6.4 | 2023-07-04 | In display, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges ne… |
CVE-2023-20768 | Medium | 6.7 | 2023-07-04 | In ion, there is a possible out of bounds read due to type confusion. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2023-20767 | Medium | 6.7 | 2023-07-04 | In pqframework, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2023-20766 | Medium | 6.7 | 2023-07-04 | In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20761 | Medium | 6.7 | 2023-07-04 | In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20760 | Medium | 6.7 | 2023-07-04 | In apu, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20759 | Medium | 4.4 | 2023-07-04 | In cmdq, there is a possible memory corruption due to a missing bounds check. This could lead to local denial of service with System execution privileges neede… |
CVE-2023-20758 | Medium | 4.4 | 2023-07-04 | In cmdq, there is a possible memory corruption due to a missing bounds check. This could lead to local denial of service with System execution privileges neede… |
CVE-2023-20757 | Medium | 6.7 | 2023-07-04 | In cmdq, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileg… |
CVE-2023-20756 | Medium | 6.7 | 2023-07-04 | In keyinstall, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privi… |
CVE-2023-20755 | Medium | 6.7 | 2023-07-04 | In keyinstall, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privi… |
CVE-2023-20754 | Medium | 6.7 | 2023-07-04 | In keyinstall, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privi… |
CVE-2023-20753 | Medium | 6.7 | 2023-07-04 | In rpmb, there is a possible out of bounds write due to a logic error. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2023-20748 | Medium | 4.4 | 2023-07-04 | In display, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privile… |
CVE-2023-20693 | High | 7.5 | 2023-07-04 | In wlan firmware, there is possible system crash due to an uncaught exception. This could lead to remote denial of service with no additional execution privile… |
CVE-2023-20692 | High | 7.5 | 2023-07-04 | In wlan firmware, there is possible system crash due to an uncaught exception. This could lead to remote denial of service with no additional execution privile… |
CVE-2023-20691 | High | 7.5 | 2023-07-04 | In wlan firmware, there is possible system crash due to an integer overflow. This could lead to remote denial of service with no additional execution privilege… |
CVE-2023-20690 | High | 7.5 | 2023-07-04 | In wlan firmware, there is possible system crash due to an integer overflow. This could lead to remote denial of service with no additional execution privilege… |
CVE-2023-20689 | High | 7.5 | 2023-07-04 | In wlan firmware, there is possible system crash due to an integer overflow. This could lead to remote denial of service with no additional execution privilege… |
CVE-2023-30990 | High | 8.6 | 2023-07-04 | IBM i 7.2, 7.3, 7.4, and 7.5 could allow a remote attacker to execute CL commands as QUSER, caused by an exploitation of DDM architecture. IBM X-Force ID: 25… |
CVE-2023-25523 | Low | 3.3 | 2023-07-04 | NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in the nvdisasm binary file, where an attacker may cause a NULL pointer dereference by pr… |
CVE-2023-25522 | High | 7.5 | 2023-07-04 | NVIDIA DGX A100/A800 contains a vulnerability in SBIOS where an attacker may cause improper input validation by providing configuration information in a… |
CVE-2023-25521 | High | 7.5 | 2023-07-04 | NVIDIA DGX A100/A800 contains a vulnerability in SBIOS where an attacker may cause execution with unnecessary privileges by leveraging a weakness whereby… |
CVE-2023-25517 | High | 7.1 | 2023-07-04 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a guest OS may be able to control resources for which it is not… |
CVE-2023-25516 | High | 7.1 | 2023-07-04 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where an unprivileged user can cause an integer overflow, which may lea… |
CVE-2023-22906 | High | 8.8 | 2023-07-04 | Hero Qubo HCD01_02_V1.38_20220125 devices allow TELNET access with root privileges by default, without a password. |
CVE-2023-3395 | Medium | 6.5 | 2023-07-03 | All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory. An attacker with access to system files could open a file t… |
CVE-2023-36611 | Medium | 6.5 | 2023-07-03 | The affected TBox RTUs allow low privilege users to access software security tokens of higher privilege. This could allow an attacker with “user” privileges t… |
CVE-2023-36610 | Medium | 5.9 | 2023-07-03 | The affected TBox RTUs generate software security tokens using insufficient entropy. The random seed used to generate the software tokens is not initialized… |
CVE-2023-36377 | High | 7.8 | 2023-07-03 | Buffer Overflow vulnerability in mtrojnar osslsigncode v.2.3 and before allows a local attacker to execute arbitrary code via a crafted .exe, .sys, and .dll fi… |
CVE-2023-36291 | Medium | 6.1 | 2023-07-03 | Cross Site Scripting vulnerability in Maxsite CMS v.108.7 allows a remote attacker to execute arbitrary code via the f_content parameter in the admin/page_new… |
CVE-2023-36258 | Critical | 9.8 | 2023-07-03 | An issue in LangChain before 0.0.236 allows an attacker to execute arbitrary code because Python code with os.system, exec, or eval can be used. |
CVE-2023-36223 | Medium | 5.4 | 2023-07-03 | Cross Site Scripting vulnerability in mlogclub bbs-go v. 3.5.5. and before allows a remote attacker to execute arbitrary code via a crafted payload to the anno… |
CVE-2023-36222 | Medium | 5.4 | 2023-07-03 | Cross Site Scripting vulnerability in mlogclub bbs-go v. 3.5.5. and before allows a remote attacker to execute arbitrary code via a crafted payload to the comm… |
CVE-2023-36183 | High | 7.8 | 2023-07-03 | Buffer Overflow vulnerability in OpenImageIO v.2.4.12.0 and before allows a remote to execute arbitrary code and obtain sensitive information via a crafted fil… |
CVE-2023-36162 | High | 8.8 | 2023-07-03 | Cross Site Request Forgery vulnerability in ZZCMS v.2023 and earlier allows a remote attacker to gain privileges via the add function in adminlist.php. |
CVE-2023-2728 | Medium | 6.5 | 2023-07-03 | Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers… |
CVE-2023-2727 | Medium | 6.5 | 2023-07-03 | Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only aff… |
CVE-2023-37378 | Medium | 5.3 | 2023-07-03 | Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory. |
CVE-2023-36609 | High | 7.2 | 2023-07-03 | The affected TBox RTUs run OpenVPN with root privileges and can run user defined configuration scripts. An attacker could set up a local OpenVPN server and pu… |
CVE-2023-36608 | Medium | 6.5 | 2023-07-03 | The affected TBox RTUs store hashed passwords using MD5 encryption, which is an insecure encryption algorithm. |
CVE-2023-36819 | Medium | 6.5 | 2023-07-03 | Knowage is the professional open source suite for modern business analytics over traditional sources and big data systems. The endpoint `_/knowage/restful-serv… |
CVE-2023-36817 | High | 7.5 | 2023-07-03 | `tktchurch/website` contains the codebase for The King's Temple Church website. In version 0.1.0, a Stripe API key was found in the public code repository of t… |
CVE-2023-36815 | High | 7.3 | 2023-07-03 | Sealos is a Cloud Operating System designed for managing cloud-native applications. In version 4.2.0 and prior, there is a permission flaw in the Sealos billin… |
CVE-2023-3497 | Medium | 4.6 | 2023-07-03 | Out of bounds read in Google Security Processor firmware in Google Chrome on Chrome OS prior to 114.0.5735.90 allowed a local attacker to perform denial of ser… |
CVE-2023-36816 | Medium | 6.1 | 2023-07-03 | 2FA is a Web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Cross site scripting (XSS) injection can be done via the… |
CVE-2023-36814 | High | 7.5 | 2023-07-03 | Products.CMFCore are the key framework services for the Zope Content Management Framework (CMF). The use of Python's marshal module to handle unchecked input i… |
CVE-2023-34451 | High | 8.2 | 2023-07-03 | CometBFT is a Byzantine Fault Tolerant (BFT) middleware that takes a state transition machine and replicates it on many machines. The mempool maintains two dat… |
CVE-2023-34450 | Low | 3.7 | 2023-07-03 | CometBFT is a Byzantine Fault Tolerant (BFT) middleware that takes a state transition machine and replicates it on many machines. An internal modification made… |
CVE-2023-26509 | High | 7.5 | 2023-07-03 | AnyDesk 7.0.8 allows remote Denial of Service. |
CVE-2023-26258 | Critical | 9.8 | 2023-07-03 | Arcserve UDP through 9.0.6034 allows authentication bypass. The method getVersionInfo at WebServiceImpl/services/FlashServiceImpl leaks the AuthUUID token. Thi… |
CVE-2023-36053 | High | 7.5 | 2023-07-03 | In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial… |
CVE-2023-35797 | Critical | 9.8 | 2023-07-03 | Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Hive Provider. This issue affects Apache Airflow Apache Hive Provider: bef… |
CVE-2023-3314 | High | 8.1 | 2023-07-03 | A vulnerability arises out of a failure to comprehensively sanitize the processing of a zip file(s). Incomplete neutralization of external commands used to co… |
CVE-2023-3438 | Medium | 4.4 | 2023-07-03 | An unquoted Windows search path vulnerability existed in the install the MOVE 4.10.x and earlier Windows install service (mvagtsce.exe). The misconfiguration… |
CVE-2023-3313 | High | 7.8 | 2023-07-03 | An OS common injection vulnerability exists in the ESM certificate API, whereby incorrectly neutralized special elements may have allowed an unauthorized user… |
CVE-2023-26136 | Medium | 6.5 | 2023-07-01 | Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPubli… |
CVE-2023-31997 | Critical | 9.0 | 2023-07-01 | UniFi OS 3.1 introduces a misconfiguration on consoles running UniFi Network that allows users on a local network to access MongoDB. Applicable Cloud Keys that… |
CVE-2023-30589 | High | 7.5 | 2023-07-01 | The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling… |
CVE-2023-30586 | High | 7.5 | 2023-07-01 | A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, whi… |
CVE-2023-28365 | Critical | 9.1 | 2023-07-01 | A backup file vulnerability found in UniFi applications (Version 7.3.83 and earlier) running on Linux operating systems allows application administrators to ex… |
CVE-2023-28364 | Medium | 6.1 | 2023-07-01 | An Open Redirect vulnerability exists prior to version 1.52.117, where the built-in QR scanner in Brave Browser Android navigated to scanned URLs automatically… |
CVE-2023-28324 | Critical | 9.8 | 2023-07-01 | A improper input validation vulnerability exists in Ivanti Endpoint Manager 2022 and below that could allow privilege escalation or remote code execution. |
CVE-2023-28323 | Critical | 9.8 | 2023-07-01 | A deserialization of untrusted data exists in EPM 2022 Su3 and all prior versions that allows an unauthenticated user to elevate rights. This exploit could pot… |
CVE-2023-22814 | Critical | 10.0 | 2023-07-01 | An authentication bypass issue via spoofing was discovered in the token-based authentication mechanism that could allow an attacker to carry out an impersonati… |
CVE-2023-36812 | Critical | 9.8 | 2023-06-30 | OpenTSDB is a open source, distributed, scalable Time Series Database (TSDB). OpenTSDB is vulnerable to Remote Code Execution vulnerability by writing user-con… |
CVE-2023-36144 | High | 7.5 | 2023-06-30 | An authentication bypass in Intelbras Switch SG 2404 MR in firmware 1.00.54 allows an unauthenticated attacker to download the backup file of the device, expos… |
CVE-2023-3493 | High | 8.0 | 2023-06-30 | Improper Neutralization of Formula Elements in a CSV File in GitHub repository fossbilling/fossbilling prior to 0.5.3. |
CVE-2023-3491 | High | 8.8 | 2023-06-30 | Unrestricted Upload of File with Dangerous Type in GitHub repository fossbilling/fossbilling prior to 0.5.3. |
CVE-2023-3490 | Critical | 9.8 | 2023-06-30 | SQL Injection in GitHub repository fossbilling/fossbilling prior to 0.5.3. |
CVE-2023-3338 | Medium | 6.5 | 2023-06-30 | A null pointer dereference flaw was found in the Linux kernel's DECnet networking protocol. This issue could allow a remote user to crash the system. |
CVE-2023-33298 | High | 7.8 | 2023-06-30 | com.perimeter81.osx.HelperTool in Perimeter81 10.0.0.19 on macOS allows Local Privilege Escalation (to root) via shell metacharacters in usingCAPath. |
CVE-2023-2908 | Medium | 5.5 | 2023-06-30 | A null pointer dereference issue was found in Libtiff's tif_dir.c file. This issue may allow an attacker to pass a crafted TIFF image file to the tiffcp utilit… |
CVE-2023-29241 | High | 8.1 | 2023-06-30 | Improper Information in Cybersecurity Guidebook in Bosch Building Integration System (BIS) 5.0 may lead to wrong configuration which allows local users to acce… |
CVE-2023-22816 | Medium | 6.0 | 2023-06-30 | A post-authentication remote command injection vulnerability in a CGI file in Western Digital My Cloud OS 5 devices that could allow an attacker to build files… |
CVE-2023-22815 | Medium | 6.2 | 2023-06-30 | Post-authentication remote command injection vulnerability in Western Digital My Cloud OS 5 devices that could allow an attacker to execute code in the context… |