2023 CVEs (page 220)
Page 220 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-21136 | Medium | 5.5 | 2023-06-15 | In multiple functions of JobStore.java, there is a possible way to cause a crash on startup due to improper input validation. This could lead to local denial o… |
CVE-2023-21135 | High | 7.8 | 2023-06-15 | In onCreate of NotificationAccessSettings.java, there is a possible failure to persist notifications settings due to improper input validation. This could lead… |
CVE-2023-21131 | High | 7.8 | 2023-06-15 | In checkKeyIntentParceledCorrectly() of ActivityManagerService.java, there is a possible bypass of Parcel Mismatch mitigations due to a logic error in the code… |
CVE-2023-21130 | Critical | 9.8 | 2023-06-15 | In btm_ble_periodic_adv_sync_lost of btm_ble_gap.cc, there is a possible remote code execution due to a buffer overflow. This could lead to remote code executi… |
CVE-2023-21129 | High | 7.8 | 2023-06-15 | In getFullScreenIntentDecision of NotificationInterruptStateProviderImpl.java, there is a possible activity launch while the app is in the background due to a… |
CVE-2023-21128 | High | 7.8 | 2023-06-15 | In various functions of AppStandbyController.java, there is a possible way to break manageability scenarios due to a logic error in the code. This could lead t… |
CVE-2023-21127 | High | 8.8 | 2023-06-15 | In readSampleData of NuMediaExtractor.cpp, there is a possible out of bounds write due to uninitialized data. This could lead to remote code execution with no… |
CVE-2023-21126 | High | 7.8 | 2023-06-15 | In bindOutputSwitcherAndBroadcastButton of MediaControlPanel.java, there is a possible launch arbitrary activity under SysUI due to Unsafe Intent. This could l… |
CVE-2023-21124 | High | 7.8 | 2023-06-15 | In run of multiple files, there is a possible escalation of privilege due to unsafe deserialization. This could lead to local escalation of privilege with no a… |
CVE-2023-21123 | High | 7.8 | 2023-06-15 | In multiple functions of multiple files, there is a possible way to bypass the DISALLOW_DEBUGGING_FEATURES restriction for tracing due to a missing permission… |
CVE-2023-21122 | High | 7.8 | 2023-06-15 | In various functions of various files, there is a possible way to bypass the DISALLOW_DEBUGGING_FEATURES restriction for tracing due to a missing permission ch… |
CVE-2023-21121 | High | 7.8 | 2023-06-15 | In onResume of AppManagementFragment.java, there is a possible way to prevent users from forgetting a previously connected VPN due to improper input validation… |
CVE-2023-21120 | High | 7.8 | 2023-06-15 | In multiple functions of cdm_engine.cpp, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege with no a… |
CVE-2023-21115 | High | 8.8 | 2023-06-15 | In btm_sec_encrypt_change of btm_sec.cc, there is a possible way to downgrade the link key type due to improperly used crypto. This could lead to paired device… |
CVE-2023-21108 | High | 8.8 | 2023-06-15 | In sdpu_build_uuid_seq of sdp_discovery.cc, there is a possible out of bounds write due to a use after free. This could lead to remote code execution over Blue… |
CVE-2023-21105 | Medium | 5.5 | 2023-06-15 | In multiple functions of ChooserActivity.java, there is a possible cross-user media read due to a confused deputy. This could lead to local information disclos… |
CVE-2023-21101 | High | 7.0 | 2023-06-15 | In multiple functions of WVDrmPlugin.cpp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no… |
CVE-2023-21095 | Medium | 4.7 | 2023-06-15 | In canStartSystemGesture of RecentsAnimationDeviceState.java, there is a possible partial lockscreen bypass due to a race condition. This could lead to local e… |
CVE-2023-34833 | Medium | 6.1 | 2023-06-15 | An arbitrary file upload vulnerability in the component /api/upload.php of ThinkAdmin v6 allows attackers to execute arbitrary code via a crafted file. |
CVE-2023-34455 | High | 7.5 | 2023-06-15 | snappy-java is a fast compressor/decompressor for Java. Due to use of an unchecked chunk length, an unrecoverable fatal error can occur in versions prior to 1… |
CVE-2023-34880 | Critical | 9.8 | 2023-06-15 | cmseasy v7.7.7.7 20230520 was discovered to contain a path traversal vulnerability via the add_action method at lib/admin/language_admin.php. This vulnerabilit… |
CVE-2023-34666 | Medium | 6.1 | 2023-06-15 | Cross-site scripting (XSS) vulnerability in Phpgurukul Cyber Cafe Management System 1.0 allows remote attackers to inject arbitrary web script or HTML via the… |
CVE-2023-34454 | Medium | 5.9 | 2023-06-15 | snappy-java is a fast compressor/decompressor for Java. Due to unchecked multiplications, an integer overflow may occur in versions prior to 1.1.10.1, causing… |
CVE-2023-34453 | Medium | 5.9 | 2023-06-15 | snappy-java is a fast compressor/decompressor for Java. Due to unchecked multiplications, an integer overflow may occur in versions prior to 1.1.10.1, causing… |
CVE-2023-34626 | Medium | 4.3 | 2023-06-15 | Piwigo 13.7.0 is vulnerable to SQL Injection via the "Users" function. |
CVE-2023-27634 | High | 8.8 | 2023-06-15 | Cross-Site Request Forgery (CSRF) vulnerability allows arbitrary file upload in Shingo Intrepidity plugin <= 1.5.1 versions. |
CVE-2023-25055 | Medium | 4.3 | 2023-06-15 | Cross-Site Request Forgery (CSRF) vulnerability in Amit Agarwal Google XML Sitemap for Videos plugin <= 2.6.1 versions. |
CVE-2023-24420 | High | 7.1 | 2023-06-15 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Zestard Technologies Admin side data storage for Contact Form 7 plugin <= 1.1.1 versions. |
CVE-2023-3276 | Medium | 5.5 | 2023-06-15 | A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the fi… |
CVE-2023-3275 | Medium | 6.3 | 2023-06-15 | A vulnerability classified as critical was found in PHPGurukul Rail Pass Management System 1.0. Affected by this vulnerability is an unknown functionality of t… |
CVE-2023-3274 | Medium | 6.3 | 2023-06-15 | A vulnerability classified as critical has been found in code-projects Supplier Management System 1.0. Affected is an unknown function of the file btn_function… |
CVE-2023-25972 | Medium | 5.9 | 2023-06-15 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in IKSWEB WordPress Старт plugin <= 3.7 versions. |
CVE-2023-25450 | Medium | 5.4 | 2023-06-15 | Cross-Site Request Forgery (CSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform plugin <= 2.25.1 versions. |
CVE-2023-23802 | Medium | 4.3 | 2023-06-15 | Cross-Site Request Forgery (CSRF) vulnerability in HasThemes HT Easy GA4 ( Google Analytics 4 ) plugin <= 1.0.6 versions. |
CVE-2023-25449 | Medium | 4.3 | 2023-06-15 | Cross-Site Request Forgery (CSRF) vulnerability in Oliver Seidel, Bastian Germann cformsII plugin <= 15.0.4 versions. |
CVE-2023-32229 | Medium | 4.9 | 2023-06-15 | Due to an error in the software interface to the secure element chip on Bosch IP cameras of family CPP13 and CPP14, the chip can be permanently damaged when en… |
CVE-2023-28175 | High | 7.1 | 2023-06-15 | Improper Authorization in SSH server in Bosch VMS 11.0, 11.1.0, and 11.1.1 allows a remote authenticated user to access resources within the trusted internal n… |
CVE-2023-2847 | High | 7.8 | 2023-06-15 | During internal security analysis, a local privilege escalation vulnerability has been identified. On a machine with the affected ESET product installed, it w… |
CVE-2023-35030 | High | 8.8 | 2023-06-15 | Cross-site request forgery (CSRF) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 updat… |
CVE-2023-2270 | High | 7.0 | 2023-06-15 | The Netskope client service running with NT\SYSTEM privileges accepts network connections from localhost to start various services and execute commands. The co… |
CVE-2023-3193 | Medium | 6.1 | 2023-06-15 | Cross-site scripting (XSS) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.73, and Liferay DXP 7.4 update 70 th… |
CVE-2023-35029 | Medium | 6.1 | 2023-06-15 | Open redirect vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allo… |
CVE-2023-25683 | Medium | 5.9 | 2023-06-15 | IBM PowerVM Hypervisor FW950.00 through FW950.71, FW1010.00 through FW1010.40, FW1020.00 through FW1020.20, and FW1030.00 through FW1030.11 could allow an atta… |
CVE-2023-34452 | Medium | 5.4 | 2023-06-14 | Grav is a flat-file content management system. In versions 1.7.42 and prior, the "/forgot_password" page has a self-reflected cross-site scripting vulnerabilit… |
CVE-2023-34448 | High | 8.8 | 2023-06-14 | Grav is a flat-file content management system. Prior to version 1.7.42, the patch for CVE-2022-2073, a server-side template injection vulnerability in Grav lev… |
CVE-2023-34253 | High | 8.8 | 2023-06-14 | Grav is a flat-file content management system. Prior to version 1.7.42, the denylist introduced in commit 9d6a2d to prevent dangerous functions from being exec… |
CVE-2023-34252 | High | 8.8 | 2023-06-14 | Grav is a flat-file content management system. Prior to version 1.7.42, there is a logic flaw in the `GravExtension.filterFilter()` function whereby validation… |
CVE-2023-34251 | Critical | 9.9 | 2023-06-14 | Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection. Remote code execution is possible by… |
CVE-2023-2820 | Medium | 6.1 | 2023-06-14 | An information disclosure vulnerability in the faye endpoint in Proofpoint Threat Response / Threat Response Auto-Pull (PTR/TRAP) could be used by an attacker… |
CVE-2023-2819 | Medium | 4.3 | 2023-06-14 | A stored cross-site scripting vulnerability in the Sources UI in Proofpoint Threat Response/ Threat Response Auto Pull (PTR/TRAP) could allow an authenticated… |
CVE-2023-34565 | Medium | 5.4 | 2023-06-14 | Netbox 3.5.1 is vulnerable to Cross Site Scripting (XSS) in the "Create Wireless LAN Groups" function. |
CVE-2023-34449 | Medium | 5.3 | 2023-06-14 | ink! is an embedded domain specific language to write smart contracts in Rust for blockchains built on the Substrate framework. Starting in version 4.0.0 and p… |
CVE-2023-33515 | Medium | 5.4 | 2023-06-14 | SoftExpert Excellence Suite 2.1.9 is vulnerable to Cross Site Scripting (XSS) via query screens. |
CVE-2023-31746 | Critical | 9.8 | 2023-06-14 | There is a command injection vulnerability in the adslr VW2100 router with firmware version M1DV1.0. An unauthenticated attacker can exploit the vulnerability… |
CVE-2023-30150 | Critical | 9.8 | 2023-06-14 | PrestaShop leocustomajax 1.0 and 1.0.0 are vulnerable to SQL Injection via modules/leocustomajax/leoajax.php. |
CVE-2023-26965 | Medium | 5.5 | 2023-06-14 | loadImage() in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based use after free via a crafted TIFF image. |
CVE-2023-1329 | Critical | 9.8 | 2023-06-14 | A potential security vulnerability has been identified for certain HP multifunction printers (MFPs). The vulnerability may lead to Buffer Overflow and/or Remot… |
CVE-2023-34367 | Medium | 6.5 | 2023-06-14 | Windows 7 is vulnerable to a full blind TCP/IP hijacking attack. The vulnerability exists in Windows 7 (any Windows until Windows 8) and in any implementation… |
CVE-2023-30082 | High | 7.5 | 2023-06-14 | A denial of service attack might be launched against the server if an unusually lengthy password (more than 10000000 characters) is supplied using the osTicket… |
CVE-2023-26062 | High | 7.0 | 2023-06-14 | A mobile network solution internal fault is found in Nokia Web Element Manager before 22 R1, in which an authenticated, unprivileged user can execute administr… |
CVE-2023-25434 | High | 8.8 | 2023-06-14 | libtiff 4.5.0 is vulnerable to Buffer Overflow via extractContigSamplesBytes() at /libtiff/tools/tiffcrop.c:3215. |
CVE-2023-25369 | High | 7.5 | 2023-06-14 | Siglent SDS 1104X-E SDS1xx4X-E_V6.1.37R9.ADS is vulnerable to Denial of Service on the user interface triggered by malformed SCPI command. |
CVE-2023-25368 | High | 7.5 | 2023-06-14 | Siglent SDS 1104X-E SDS1xx4X-E_V6.1.37R9.ADS is vulnerable to Incorrect Access Control. An unauthenticated attacker can overwrite firmnware. |
CVE-2023-31671 | Critical | 9.8 | 2023-06-14 | PrestaShop postfinance <= 17.1.13 is vulnerable to SQL Injection via PostfinanceValidationModuleFrontController::postProcess(). |
CVE-2023-2976 | Medium | 5.5 | 2023-06-14 | Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cr… |
CVE-2023-34095 | Critical | 9.8 | 2023-06-14 | cpdb-libs provides frontend and backend libraries for the Common Printing Dialog Backends (CPDB) project. In versions 1.0 through 2.0b4, cpdb-libs is vulnerabl… |
CVE-2023-25367 | Critical | 9.8 | 2023-06-14 | Siglent SDS 1104X-E SDS1xx4X-E_V6.1.37R9.ADS allows unfiltered user input resulting in Remote Code Execution (RCE) with SCPI interface or web server. |
CVE-2023-0010 | Medium | 5.4 | 2023-06-14 | A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software can allow a JavaScript payload to be e… |
CVE-2023-0009 | High | 7.8 | 2023-06-14 | A local privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows enables a local user to execute programs with elevated p… |
CVE-2023-34868 | High | 7.5 | 2023-06-14 | Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the parser_parse_for_statement_start at jerry-core/parser/js/js-parser-stat… |
CVE-2023-34867 | High | 7.5 | 2023-06-14 | Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the ecma_property_hashmap_create at jerry-core/ecma/base/ecma-property-hash… |
CVE-2023-34540 | Critical | 9.8 | 2023-06-14 | Langchain before v0.0.225 was discovered to contain a remote code execution (RCE) vulnerability in the component JiraAPIWrapper (aka the JIRA API wrapper). Thi… |
CVE-2023-34101 | High | 7.3 | 2023-06-14 | Contiki-NG is an operating system for internet of things devices. In version 4.8 and prior, when processing ICMP DAO packets in the `dao_input_storing` functio… |
CVE-2023-32031 | High | 8.8 | 2023-06-14 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2023-32030 | High | 7.5 | 2023-06-14 | .NET and Visual Studio Denial of Service Vulnerability |
CVE-2023-32024 | Low | 3.0 | 2023-06-14 | Microsoft Power Apps Spoofing Vulnerability |
CVE-2023-29337 | High | 7.1 | 2023-06-14 | NuGet Client Remote Code Execution Vulnerability |
CVE-2023-29331 | High | 7.5 | 2023-06-14 | .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability |
CVE-2023-29326 | High | 7.8 | 2023-06-14 | .NET Framework Remote Code Execution Vulnerability |
CVE-2023-28310 | High | 8.0 | 2023-06-14 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2023-24936 | High | 7.5 | 2023-06-14 | .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability |
CVE-2023-24897 | High | 7.8 | 2023-06-14 | .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability |
CVE-2023-24895 | High | 7.8 | 2023-06-14 | .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability |
CVE-2023-35116 | Medium | 4.7 | 2023-06-14 | jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies. N… |
CVE-2023-35110 | High | 7.5 | 2023-06-14 | An issue was discovered jjson thru 0.1.7 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic depende… |
CVE-2023-34878 | High | 7.5 | 2023-06-14 | An issue was discovered in Ujcms v6.0.2 allows attackers to gain sensitive information via the dir parameter to /api/backend/core/web-file-html/download-zip. |
CVE-2023-34865 | Critical | 9.8 | 2023-06-14 | Directory traversal vulnerability in ujcms 6.0.2 allows attackers to move files via the rename feature. |
CVE-2023-34824 | Medium | 5.5 | 2023-06-14 | fdkaac before 1.0.5 was discovered to contain a heap buffer overflow in caf_info function in caf_reader.c. |
CVE-2023-34823 | Medium | 5.5 | 2023-06-14 | fdkaac before 1.0.5 was discovered to contain a stack overflow in read_callback function in src/main.c. |
CVE-2023-34756 | Critical | 9.8 | 2023-06-14 | bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the cid parameter at admin/index.php?mode=settings&page=charset&action=edit. |
CVE-2023-34755 | Critical | 9.8 | 2023-06-14 | bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the userid parameter at admin/index.php?mode=user&action=edit. |
CVE-2023-34754 | Critical | 9.8 | 2023-06-14 | bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the pid parameter at admin/index.php?mode=settings&page=plugins&action=edit. |
CVE-2023-34753 | Critical | 9.8 | 2023-06-14 | bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the tid parameter at admin/index.php?mode=settings&page=tmpl&action=edit. |
CVE-2023-34752 | Critical | 9.8 | 2023-06-14 | bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the lid parameter at admin/index.php?mode=settings&page=lang&action=edit. |
CVE-2023-34751 | Critical | 9.8 | 2023-06-14 | bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the gid parameter at admin/index.php?mode=user&page=groups&action=edit. |
CVE-2023-34750 | Critical | 9.8 | 2023-06-14 | bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the cid parameter at admin/index.php?mode=settings&page=projects&action=edit. |
CVE-2023-34747 | Critical | 9.8 | 2023-06-14 | File upload vulnerability in ujcms 6.0.2 via /api/backend/core/web-file-upload/upload. |
CVE-2023-34624 | High | 7.5 | 2023-06-14 | An issue was discovered htmlcleaner thru = 2.28 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic… |
CVE-2023-34623 | High | 7.5 | 2023-06-14 | An issue was discovered jtidy thru r938 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependen… |
CVE-2023-34620 | High | 7.5 | 2023-06-14 | An issue was discovered hjson thru 3.0.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic depende… |