2023 CVEs (page 219)
Page 219 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-25645 | High | 7.7 | 2023-06-16 | There is a permission and access control vulnerability in some ZTE AndroidTV STBs. Due to improper permission settings, non-privileged application can perform… |
CVE-2023-25188 | Medium | 5.1 | 2023-06-16 | An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. If/when CSP (as a BTS administrator) removes security hardenings from the Nokia… |
CVE-2023-25186 | Medium | 5.1 | 2023-06-16 | An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. If/when CSP (as a BTS administrator) removes security hardenings from a Nokia Si… |
CVE-2023-25185 | Low | 3.8 | 2023-06-16 | An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. A mobile network solution internal fault was found in Nokia Single RAN software… |
CVE-2023-34832 | Critical | 9.8 | 2023-06-16 | TP-Link Archer AX10(EU)_V1.2_230220 was discovered to contain a buffer overflow via the function FUN_131e8 - 0x132B4. |
CVE-2023-34660 | Medium | 6.5 | 2023-06-16 | jjeecg-boot V3.5.0 has an unauthorized arbitrary file upload in /jeecg-boot/jmreport/upload interface. |
CVE-2023-34659 | Critical | 9.8 | 2023-06-16 | jeecg-boot 3.5.0 and 3.5.1 have a SQL injection vulnerability the id parameter of the /jeecg-boot/jmreport/show interface. |
CVE-2023-34645 | High | 7.5 | 2023-06-16 | jfinal CMS 5.1.0 has an arbitrary file read vulnerability. |
CVE-2023-34733 | Medium | 6.8 | 2023-06-16 | A lack of exception handling in the Volkswagen Discover Media Infotainment System Software Version 0876 allows attackers to cause a Denial of Service (DoS) via… |
CVE-2023-30625 | High | 8.8 | 2023-06-16 | rudder-server is part of RudderStack, an open source Customer Data Platform (CDP). Versions of rudder-server prior to 1.3.0-rc.1 are vulnerable to SQL injectio… |
CVE-2023-30223 | High | 7.5 | 2023-06-16 | A broken authentication vulnerability in 4D SAS 4D Server software v17, v18, v19 R7, and earlier allows attackers to send crafted TCP packets containing reques… |
CVE-2023-30222 | High | 7.5 | 2023-06-16 | An information disclosure vulnerability in 4D SAS 4D Server Application v17, v18, v19 R7 and earlier allows attackers to retrieve password hashes for all users… |
CVE-2023-24243 | High | 7.5 | 2023-06-16 | CData RSB Connect v22.0.8336 was discovered to contain a Server-Side Request Forgery (SSRF). |
CVE-2023-34795 | High | 7.8 | 2023-06-16 | xlsxio v0.1.2 to v0.2.34 was discovered to contain a free of uninitialized pointer in the xlsxioread_sheetlist_close() function. This vulnerability allows atta… |
CVE-2023-30453 | Medium | 5.4 | 2023-06-16 | The Teamlead Reminder plugin through 2.6.5 for Jira allows persistent XSS via the message parameter. |
CVE-2023-25366 | Critical | 9.8 | 2023-06-16 | In Siglent SDS 1104X-E SDS1xx4X-E_V6.1.37R9.ADS, insecure SCPI interface discloses web password. |
CVE-2023-35783 | Medium | 6.3 | 2023-06-16 | The ke_search (aka Faceted Search) extension before 4.0.3, 4.1.x through 4.6.x before 4.6.6, and 5.x before 5.0.2 for TYPO3 allows XSS via indexed data. |
CVE-2023-35782 | High | 8.2 | 2023-06-16 | The ipandlanguageredirect extension before 5.1.2 for TYPO3 allows SQL Injection. |
CVE-2023-34548 | Critical | 9.8 | 2023-06-16 | Simple Customer Relationship Management 1.0 is vulnerable to SQL Injection via the email parameter. |
CVE-2023-20885 | Medium | 6.5 | 2023-06-16 | Vulnerability in Cloud Foundry Notifications, Cloud Foundry SMB-volume release, Cloud FOundry cf-nfs-volume release.This issue affects Notifications: All versi… |
CVE-2023-3294 | Medium | 6.1 | 2023-06-16 | Cross-site Scripting (XSS) - DOM in GitHub repository saleor/react-storefront prior to c29aab226f07ca980cc19787dcef101e11b83ef7. |
CVE-2023-26537 | Medium | 5.9 | 2023-06-16 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in nicolly WP No External Links plugin <= 1.0.2 versions. |
CVE-2023-26527 | Medium | 5.9 | 2023-06-16 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPIndeed Debug Assistant plugin <= 1.4 versions. |
CVE-2023-25974 | Medium | 5.9 | 2023-06-16 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in psicosi448 wp2syslog plugin <= 1.0.5 versions. |
CVE-2023-3293 | Medium | 4.8 | 2023-06-16 | Cross-site Scripting (XSS) - Stored in GitHub repository salesagility/suitecrm-core prior to 8.3.0. |
CVE-2023-27420 | High | 7.1 | 2023-06-16 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Everest Themes Arya Multipurpose theme <= 1.0.5 versions. |
CVE-2023-26515 | Medium | 5.9 | 2023-06-16 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ko Takagi Simple Slug Translate plugin <= 2.7.2 versions. |
CVE-2023-33307 | Medium | 6.5 | 2023-06-16 | A null pointer dereference in Fortinet FortiOS before 7.2.5 and before 7.0.11, FortiProxy before 7.2.3 and before 7.0.9 allows attacker to denial of sslvpn ser… |
CVE-2023-33306 | Medium | 6.5 | 2023-06-16 | A null pointer dereference in Fortinet FortiOS before 7.2.5, before 7.0.11 and before 6.4.13, FortiProxy before 7.2.4 and before 7.0.10 allows attacker to den… |
CVE-2023-2831 | Medium | 4.3 | 2023-06-16 | Mattermost fails to unescape Markdown strings in a memory-efficient way, allowing an attacker to cause a Denial of Service by sending a message containing a la… |
CVE-2023-2797 | Low | 3.1 | 2023-06-16 | Mattermost fails to sanitize code permalinks, allowing an attacker to preview code from private repositories by posting a specially crafted permalink on a chan… |
CVE-2023-2793 | Medium | 6.5 | 2023-06-16 | Mattermost fails to validate links on external websites when constructing a preview for a linked website, allowing an attacker to cause a denial-of-service by… |
CVE-2023-2792 | Medium | 6.5 | 2023-06-16 | Mattermost fails to sanitize ephemeral error messages, allowing an attacker to obtain arbitrary message contents by a specially crafted /groupmsg command. |
CVE-2023-2785 | Medium | 4.3 | 2023-06-16 | Mattermost fails to properly truncate the postgres error log message of a search query failure allowing an attacker to cause the creation of large log files wh… |
CVE-2023-2791 | Medium | 4.3 | 2023-06-16 | When creating a playbook run via the /dialog API, Mattermost fails to validate all parameters, allowing an authenticated attacker to edit an arbitrary channel… |
CVE-2023-2788 | Medium | 6.2 | 2023-06-16 | Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to retain persistent acce… |
CVE-2023-2787 | Medium | 6.5 | 2023-06-16 | Mattermost fails to check channel membership when accessing message threads, allowing an attacker to access arbitrary posts by using the message threads API. |
CVE-2023-2786 | Medium | 4.3 | 2023-06-16 | Mattermost fails to properly check the permissions when executing commands allowing a member with no permissions to post a message in a channel to actually pos… |
CVE-2023-2784 | Medium | 4.2 | 2023-06-16 | Mattermost fails to verify if the requestor is a sysadmin or not, before allowing `install` requests to the Apps allowing a regular user send install requests… |
CVE-2023-2783 | Medium | 4.3 | 2023-06-16 | Mattermost Apps Framework fails to verify that a secret provided in the incoming webhook request allowing an attacker to modify the contents of the post sent b… |
CVE-2023-26541 | Medium | 5.9 | 2023-06-16 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alexander Suess asMember plugin <= 1.5.4 versions. |
CVE-2023-26013 | Medium | 6.5 | 2023-06-16 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WPChill Strong Testimonials plugin <= 3.0.2 versions. |
CVE-2023-25963 | Medium | 5.9 | 2023-06-16 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in JoomSky JS Job Manager plugin <= 2.0.0 versions. |
CVE-2023-2431 | Low | 3.4 | 2023-06-16 | A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but spe… |
CVE-2023-34165 | Medium | 5.3 | 2023-06-16 | Unauthorized access vulnerability in the Save for later feature provided by AI Touch.Successful exploitation of this vulnerability may cause third-party apps t… |
CVE-2023-34157 | Critical | 10.0 | 2023-06-16 | Vulnerability of HwWatchHealth being hijacked.Successful exploitation of this vulnerability may cause repeated pop-up windows of the app. |
CVE-2023-34154 | High | 8.2 | 2023-06-16 | Vulnerability of undefined permissions in HUAWEI VR screen projection.Successful exploitation of this vulnerability will cause third-party apps to create windo… |
CVE-2023-35708 | Critical | 9.8 | 2023-06-16 | In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3), a SQL injection vulnerabi… |
CVE-2023-34845 | Medium | 5.4 | 2023-06-16 | Bludit v3.14.1 was discovered to contain an arbitrary file upload vulnerability in the component /admin/new-content. This vulnerability allows attackers to exe… |
CVE-2023-32754 | Critical | 9.8 | 2023-06-16 | Thinking Software Efence login function has insufficient validation for user input. An unauthenticated remote attacker can exploit this vulnerability to inject… |
CVE-2023-32753 | Critical | 9.8 | 2023-06-16 | OMICARD EDM’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability t… |
CVE-2023-32752 | Critical | 9.8 | 2023-06-16 | L7 Networks InstantScan IS-8000 & InstantQoS IQ-8000’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote… |
CVE-2023-3291 | Low | 3.3 | 2023-06-16 | Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.2.2. |
CVE-2023-32028 | High | 7.8 | 2023-06-16 | Microsoft SQL OLE DB Remote Code Execution Vulnerability |
CVE-2023-32027 | High | 7.8 | 2023-06-16 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability |
CVE-2023-32026 | High | 7.8 | 2023-06-16 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability |
CVE-2023-32025 | High | 7.8 | 2023-06-16 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability |
CVE-2023-29356 | High | 7.8 | 2023-06-16 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability |
CVE-2023-29349 | High | 7.8 | 2023-06-16 | Microsoft ODBC and OLE DB Remote Code Execution Vulnerability |
CVE-2023-2080 | High | 8.5 | 2023-06-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Forcepoint Cloud Security Gateway (CSG) Portal on Web Clo… |
CVE-2023-28810 | Medium | 4.3 | 2023-06-15 | Some access control/intercom products have unauthorized modification of device network configuration vulnerabilities. Attackers can modify device network confi… |
CVE-2023-23841 | High | 7.5 | 2023-06-15 | SolarWinds Serv-U is submitting an HTTP request when changing or updating the attributes for File Share or File request. Part of the URL of the request disclo… |
CVE-2023-34800 | Critical | 9.8 | 2023-06-15 | D-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter at genacgi_main. |
CVE-2023-34797 | Medium | 5.4 | 2023-06-15 | Broken access control in the Registration page (/Registration.aspx) of Termenos CWX v8.5.6 allows attackers to access sensitive information. |
CVE-2023-24032 | High | 7.8 | 2023-06-15 | In Zimbra Collaboration Suite through 9.0 and 8.8.15, an attacker (who has initial user access to a Zimbra server instance) can execute commands as root by pas… |
CVE-2023-24031 | Medium | 6.1 | 2023-06-15 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 8.8.15. XSS can occur, via one of attributes of the webmail /h/ endpoint, to execute arbitrary Ja… |
CVE-2023-24030 | Medium | 6.1 | 2023-06-15 | An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0 and 8.8.15. To exploit the vulnerability, an attacker w… |
CVE-2023-34852 | Critical | 9.8 | 2023-06-15 | PublicCMS <=V4.0.202302 is vulnerable to Insecure Permissions. |
CVE-2023-34242 | Low | 3.4 | 2023-06-15 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to version 1.13.4, when Gateway API is enabled in Cilium, the… |
CVE-2023-33243 | High | 8.1 | 2023-06-15 | RedTeam Pentesting discovered that the web interface of STARFACE as well as its REST API allows authentication using the SHA512 hash of the password instead of… |
CVE-2023-31672 | Critical | 9.8 | 2023-06-15 | In the PrestaShop < 2.4.3 module "Length, weight or volume sell" (ailinear) there is a SQL injection vulnerability. |
CVE-2023-2747 | Low | 3.1 | 2023-06-15 | The initialization vector (IV) used by the secure engine (SE) for encrypting data stored in the SE flash memory is uninitialized. |
CVE-2023-2683 | Medium | 5.3 | 2023-06-15 | A memory leak in the EFR32 Bluetooth LE stack 5.1.0 through 5.1.1 allows an attacker to send an invalid pairing message and cause future legitimate connection… |
CVE-2023-2686 | Critical | 9.8 | 2023-06-15 | Buffer overflow in Wi-Fi Commissioning MicriumOS example in Silicon Labs Gecko SDK v4.2.3 or earlier allows connected device to write payload onto the stack. |
CVE-2023-29322 | Medium | 5.4 | 2023-06-15 | Adobe Experience Manager versions 6.5.16.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is a… |
CVE-2023-29321 | High | 7.8 | 2023-06-15 | Adobe Animate versions 22.0.9 (and earlier) and 23.0.1 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code executi… |
CVE-2023-29307 | Medium | 5.4 | 2023-06-15 | Adobe Experience Manager versions 6.5.16.0 (and earlier) is affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege au… |
CVE-2023-29304 | Medium | 5.4 | 2023-06-15 | Adobe Experience Manager versions 6.5.16.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is a… |
CVE-2023-29302 | Medium | 5.4 | 2023-06-15 | Adobe Experience Manager versions 6.5.16.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is a… |
CVE-2023-29297 | Critical | 9.1 | 2023-06-15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Improper Neutralization of Special Elements Us… |
CVE-2023-29296 | Medium | 4.3 | 2023-06-15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that co… |
CVE-2023-29295 | Medium | 4.3 | 2023-06-15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that co… |
CVE-2023-29294 | Medium | 4.3 | 2023-06-15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Business Logic Errors vulnerability that could… |
CVE-2023-29293 | Low | 2.7 | 2023-06-15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Improper Input Validation vulnerability that… |
CVE-2023-29292 | Medium | 4.9 | 2023-06-15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerabili… |
CVE-2023-29291 | Medium | 4.9 | 2023-06-15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerabili… |
CVE-2023-29290 | Medium | 5.3 | 2023-06-15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that co… |
CVE-2023-29289 | Medium | 6.5 | 2023-06-15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an XML Injection vulnerability. An attacker with… |
CVE-2023-29288 | Medium | 4.3 | 2023-06-15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that co… |
CVE-2023-29287 | Medium | 5.3 | 2023-06-15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Information Exposure vulnerability that could… |
CVE-2023-28809 | High | 7.5 | 2023-06-15 | Some access control products are vulnerable to a session hijacking attack because the product does not update the session ID after a user successfully logs in… |
CVE-2023-22248 | High | 7.5 | 2023-06-15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that co… |
CVE-2023-21618 | High | 7.8 | 2023-06-15 | Adobe Substance 3D Designer version 12.4.1 (and earlier) is affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code ex… |
CVE-2023-21144 | High | 7.5 | 2023-06-15 | In doInBackground of NotificationContentInflater.java, there is a possible temporary denial or service due to long running operations. This could lead to remot… |
CVE-2023-21143 | Medium | 5.5 | 2023-06-15 | In multiple functions of multiple files, there is a possible way to make the device unusable due to improper input validation. This could lead to local denial… |
CVE-2023-21142 | Medium | 5.5 | 2023-06-15 | In multiple files, there is a possible way to access traces in the dev mode due to a permissions bypass. This could lead to local information disclosure with n… |
CVE-2023-21141 | Medium | 5.5 | 2023-06-15 | In several functions of several files, there is a possible way to access developer mode traces due to a permissions bypass. This could lead to local informatio… |
CVE-2023-21139 | High | 7.8 | 2023-06-15 | In bindPlayer of MediaControlPanel.java, there is a possible launch arbitrary activity in SysUI due to Unsafe Intent. This could lead to local escalation of pr… |
CVE-2023-21138 | High | 7.8 | 2023-06-15 | In onNullBinding of CallRedirectionProcessor.java, there is a possible long lived connection due to improper input validation. This could lead to local escalat… |
CVE-2023-21137 | Medium | 5.5 | 2023-06-15 | In several methods of JobStore.java, uncaught exceptions in job map parsing could lead to local persistent denial of service with no additional execution privi… |