2023 CVEs (page 222)
Page 222 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-29357 | Critical | 9.8 | 2023-06-14 | Microsoft SharePoint Server Elevation of Privilege Vulnerability |
CVE-2023-29355 | Medium | 5.3 | 2023-06-14 | DHCP Server Service Information Disclosure Vulnerability |
CVE-2023-29353 | Medium | 5.5 | 2023-06-14 | Sysinternals Process Monitor for Windows Denial of Service Vulnerability |
CVE-2023-29352 | Medium | 6.5 | 2023-06-14 | Windows Remote Desktop Security Feature Bypass Vulnerability |
CVE-2023-29351 | High | 8.1 | 2023-06-14 | Windows Group Policy Elevation of Privilege Vulnerability |
CVE-2023-29346 | High | 7.8 | 2023-06-14 | NTFS Elevation of Privilege Vulnerability |
CVE-2023-24938 | Medium | 6.5 | 2023-06-14 | Windows CryptoAPI Denial of Service Vulnerability |
CVE-2023-21569 | Medium | 5.5 | 2023-06-14 | Azure DevOps Server Spoofing Vulnerability |
CVE-2023-21565 | High | 7.1 | 2023-06-14 | Azure DevOps Server Spoofing Vulnerability |
CVE-2023-24470 | Critical | 9.1 | 2023-06-13 | Potential XML External Entity Injection in ArcSight Logger versions prior to 7.3.0. |
CVE-2023-34250 | Medium | 4.8 | 2023-06-13 | Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branche… |
CVE-2023-32301 | Low | 3.1 | 2023-06-13 | Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branche… |
CVE-2023-32061 | Medium | 5.4 | 2023-06-13 | Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branche… |
CVE-2023-31142 | Low | 2.0 | 2023-06-13 | Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branche… |
CVE-2023-24469 | Medium | 6.1 | 2023-06-13 | Potential Cross-Site Scripting in ArcSight Logger versions prior to 7.3.0 |
CVE-2023-34944 | Critical | 9.8 | 2023-06-13 | An arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo 1.11.* up to v1.11.18 allows attackers to execute arbitrary code via upl… |
CVE-2023-34537 | Medium | 5.4 | 2023-06-13 | A Reflected XSS was discovered in HotelDruid version 3.0.5, an attacker can issue malicious code/command on affected webpage's parameter to trick user on brows… |
CVE-2023-33817 | High | 8.8 | 2023-06-13 | hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability. |
CVE-2023-2778 | High | 7.5 | 2023-06-13 | A denial-of-service vulnerability exists in Rockwell Automation FactoryTalk Transaction Manager. This vulnerability can be exploited by sending a modified pac… |
CVE-2023-2639 | Medium | 4.1 | 2023-06-13 | The underlying feedback mechanism of Rockwell Automation's FactoryTalk System Services that transfers the FactoryTalk Policy Manager rules to relevant device… |
CVE-2023-2638 | Medium | 5.9 | 2023-06-13 | Rockwell Automation's FactoryTalk System Services does not verify that a backup configuration archive is password protected. Improper authorization in FTS… |
CVE-2023-2637 | High | 7.3 | 2023-06-13 | Rockwell Automation's FactoryTalk System Services uses a hard-coded cryptographic key to generate administrator cookies. Hard-coded cryptographic key may lea… |
CVE-2023-24546 | High | 8.1 | 2023-06-13 | On affected versions of the CloudVision Portal improper access controls on the connection from devices to CloudVision could enable a malicious actor with netwo… |
CVE-2023-29562 | Critical | 9.8 | 2023-06-13 | TP-Link TL-WPA7510 (EU)_V2_190125 was discovered to contain a stack overflow via the operation parameter at /admin/locale. |
CVE-2023-34965 | Medium | 5.3 | 2023-06-13 | SSPanel-Uim 2023.3 does not restrict access to the /link/ interface which can lead to a leak of user information. |
CVE-2023-34115 | Medium | 4.3 | 2023-06-13 | Buffer copy without checking size of input in Zoom Meeting SDK before 5.13.0 may allow an authenticated user to potentially enable a denial of service via lo… |
CVE-2023-34114 | High | 7.4 | 2023-06-13 | Exposure of resource to wrong sphere in Zoom for Windows and Zoom for MacOS clients before 5.14.10 may allow an authenticated user to potentially enable infor… |
CVE-2023-27836 | Critical | 9.8 | 2023-06-13 | TP-Link TL-WPA8630P (US)_ V2_ Version 171011 was discovered to contain a command injection vulnerability via the devicePwd parameter in the function sub_ 40A80… |
CVE-2023-3224 | Critical | 9.8 | 2023-06-13 | Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3. |
CVE-2023-3217 | High | 8.8 | 2023-06-13 | Use after free in WebXR in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2023-3216 | High | 8.8 | 2023-06-13 | Type confusion in V8 in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2023-3215 | High | 8.8 | 2023-06-13 | Use after free in WebRTC in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2023-3214 | High | 8.8 | 2023-06-13 | Use after free in Autofill payments in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTM… |
CVE-2023-34121 | Medium | 4.1 | 2023-06-13 | Improper input validation in the Zoom for Windows, Zoom Rooms, Zoom VDI Windows Meeting clients before 5.14.0 may allow an authenticated user to potentially… |
CVE-2023-34120 | High | 8.7 | 2023-06-13 | Improper privilege management in Zoom for Windows, Zoom Rooms for Windows, and Zoom VDI for Windows clients before 5.14.0 may allow an authenticated user to p… |
CVE-2023-28603 | High | 7.7 | 2023-06-13 | Zoom VDI client installer prior to 5.14.0 contains an improper access control vulnerability. A malicious user may potentially delete local files without prop… |
CVE-2023-28602 | Low | 2.8 | 2023-06-13 | Zoom for Windows clients prior to 5.13.5 contain an improper verification of cryptographic signature vulnerability. A malicious user may potentially downgrade… |
CVE-2023-28601 | High | 8.3 | 2023-06-13 | Zoom for Windows clients prior to 5.14.0 contain an improper restriction of operations within the bounds of a memory buffer vulnerability. A malicious user ma… |
CVE-2023-28600 | Medium | 5.2 | 2023-06-13 | Zoom for MacOSclients prior to 5.14.0 contain an improper access control vulnerability. A malicious user may be able to delete/replace Zoom Client files poten… |
CVE-2023-1707 | High | 7.5 | 2023-06-13 | Certain HP Enterprise LaserJet and HP LaserJet Managed Printers are potentially vulnerable to information disclosure when IPsec is enabled with FutureSmart ver… |
CVE-2023-34249 | Critical | 9.8 | 2023-06-13 | benjjvi/PyBB is an open source bulletin board. Prior to commit dcaeccd37198ecd3e41ea766d1099354b60d69c2, benjjvi/PyBB is vulnerable to SQL Injection. This vuln… |
CVE-2023-34247 | Medium | 6.1 | 2023-06-13 | Keystone is a content management system for Node.JS. There is an open redirect in the `@keystone-6/auth` package versions 7.0.0 and prior, where the redirect l… |
CVE-2023-33620 | Medium | 5.9 | 2023-06-13 | GL.iNET GL-AR750S-Ext firmware v3.215 uses an insecure protocol in its communications which allows attackers to eavesdrop via a man-in-the-middle attack. |
CVE-2023-31541 | Critical | 9.8 | 2023-06-13 | A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature of the CKEditor v1.2.3 plugin for Redmine, which allows arbit… |
CVE-2023-31439 | Medium | 5.3 | 2023-06-13 | An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the… |
CVE-2023-31438 | Medium | 5.3 | 2023-06-13 | An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error… |
CVE-2023-31437 | Medium | 5.3 | 2023-06-13 | An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are display… |
CVE-2023-30179 | High | 7.2 | 2023-06-13 | CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI). An authenticated attacker can inject Twig Template to User Photo Location field… |
CVE-2023-28599 | Medium | 4.3 | 2023-06-13 | Zoom clients prior to 5.13.10 contain an HTML injection vulnerability. A malicious user could inject HTML into their display name potentially leading a victi… |
CVE-2023-28598 | High | 7.5 | 2023-06-13 | Zoom for Linux clients prior to 5.13.10 contain an HTML injection vulnerability. If a victim starts a chat with a malicious user it could result in a Zoom app… |
CVE-2023-28303 | Low | 3.3 | 2023-06-13 | Windows Snipping Tool Information Disclosure Vulnerability |
CVE-2023-27837 | Critical | 9.8 | 2023-06-13 | TP-Link TL-WPA8630P (US)_ V2_ Version 171011 was discovered to contain a command injection vulnerability via the key parameter in the function sub_ 40A774. |
CVE-2023-20867 | Low | 3.9 | 2023-06-13 | A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest… |
CVE-2023-33695 | High | 7.1 | 2023-06-13 | Hutool v5.8.17 and below was discovered to contain an information disclosure vulnerability via the File.createTempFile() function at /core/io/FileUtil.java. |
CVE-2023-33621 | Medium | 5.9 | 2023-06-13 | GL.iNET GL-AR750S-Ext firmware v3.215 inserts the admin authentication token into a GET request when the OpenVPN Server config file is downloaded. The token is… |
CVE-2023-27624 | Medium | 5.9 | 2023-06-13 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Marcelotorres Redirect After Login plugin <= 0.1.9 versions. |
CVE-2023-25978 | Medium | 5.9 | 2023-06-13 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Nate Reist Protected Posts Logout Button plugin <= 1.4.5 versions. |
CVE-2023-35064 | Critical | 9.8 | 2023-06-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Satos Satos Mobile allows SQL Injection through SOAP Para… |
CVE-2023-33568 | High | 7.5 | 2023-06-13 | An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppl… |
CVE-2023-28620 | Medium | 5.9 | 2023-06-13 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Cyberus Labs Cyberus Key plugin <= 1.0 versions. |
CVE-2023-26538 | Medium | 5.9 | 2023-06-13 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kamyabsoft Chat Bee plugin <= 1.1.0 versions. |
CVE-2023-26528 | Medium | 5.9 | 2023-06-13 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in jinit9906 Shipyaari Shipping Management plugin <= 1.0 versions. |
CVE-2023-25964 | Medium | 5.9 | 2023-06-13 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Noah Hearle, Design Extreme We’re Open! plugin <= 1.46 versions. |
CVE-2023-23831 | Medium | 6.5 | 2023-06-13 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Rating-Widget Rating-Widget: Star Review System plugin <= 3.1.9 versions. |
CVE-2023-3050 | Critical | 9.8 | 2023-06-13 | Reliance on Cookies without Validation and Integrity Checking in a Security Decision vulnerability in TMT Lockcell allows Privilege Abuse, Authentication Bypas… |
CVE-2023-3049 | Critical | 9.8 | 2023-06-13 | Unrestricted Upload of File with Dangerous Type vulnerability in TMT Lockcell allows Command Injection. This issue affects Lockcell: before 15. |
CVE-2023-3048 | Critical | 9.8 | 2023-06-13 | Authorization Bypass Through User-Controlled Key vulnerability in TMT Lockcell allows Authentication Abuse, Authentication Bypass. This issue affects Lockcell… |
CVE-2023-3047 | Critical | 9.8 | 2023-06-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMT Lockcell allows SQL Injection. This issue affects Lo… |
CVE-2023-2807 | Medium | 6.4 | 2023-06-13 | Authentication Bypass by Spoofing vulnerability in the password reset process of Pandora FMS allows an unauthenticated attacker to initiate a password reset pr… |
CVE-2023-3218 | Medium | 4.4 | 2023-06-13 | Race Condition within a Thread in GitHub repository it-novum/openitcockpit prior to 4.6.5. |
CVE-2023-32548 | High | 8.1 | 2023-06-13 | OS command injection vulnerability exists in WPS Office version 10.8.0.6186. If a remote attacker who can conduct a man-in-the-middle attack connects the produ… |
CVE-2023-32546 | Medium | 4.4 | 2023-06-13 | Code injection vulnerability exists in Chatwork Desktop Application (Mac) 2.6.43 and earlier. If this vulnerability is exploited, a non-administrative user of… |
CVE-2023-31198 | High | 7.2 | 2023-06-13 | OS command injection vulnerability exists in Wi-Fi AP UNIT allows. If this vulnerability is exploited, a remote authenticated attacker with an administrative p… |
CVE-2023-31196 | High | 7.5 | 2023-06-13 | Missing authentication for critical function in Wi-Fi AP UNIT allows a remote unauthenticated attacker to obtain sensitive information of the affected products… |
CVE-2023-31195 | Medium | 5.3 | 2023-06-13 | ASUS Router RT-AX3000 Firmware versions prior to 3.0.0.4.388.23403 uses sensitive cookies without 'Secure' attribute. When an attacker is in a position to be a… |
CVE-2023-30766 | Critical | 9.8 | 2023-06-13 | Hidden functionality issue exists in KB-AHR series and KB-IRIP series. If this vulnerability is exploited, an arbitrary OS command may be executed on the produ… |
CVE-2023-30764 | Critical | 9.8 | 2023-06-13 | OS command injection vulnerability exists in KB-AHR series and KB-IRIP series. If this vulnerability is exploited, an arbitrary OS command may be executed on t… |
CVE-2023-30762 | Critical | 9.8 | 2023-06-13 | Improper authentication vulnerability exists in KB-AHR series and KB-IRIP series. If this vulnerability is exploited, an arbitrary OS command may be executed o… |
CVE-2023-29501 | Medium | 4.8 | 2023-06-13 | Jiyu Kukan Toku-Toku coupon App for iOS versions 3.5.0 and earlier, and Jiyu Kukan Toku-Toku coupon App for Android versions 3.5.0 and earlier are vulnerable t… |
CVE-2023-29498 | Medium | 5.5 | 2023-06-13 | Improper restriction of XML external entity reference (XXE) vulnerability exists in FRENIC RHC Loader v1.1.0.3 and earlier. If a user opens a specially crafted… |
CVE-2023-29167 | High | 7.8 | 2023-06-13 | Out-of-bound reads vulnerability exists in FRENIC RHC Loader v1.1.0.3. If a user opens a specially crafted FNE file, sensitive information on the system where… |
CVE-2023-29160 | High | 7.8 | 2023-06-13 | Stack-based buffer overflow vulnerability exists in FRENIC RHC Loader v1.1.0.3. If a user opens a specially crafted FNE file, sensitive information on the syst… |
CVE-2023-33921 | Medium | 6.8 | 2023-06-13 | A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050 MASTER MODULE (All versions < CPCI85 V05). The affected devic… |
CVE-2023-33920 | Medium | 6.8 | 2023-06-13 | A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050 MASTER MODULE (All versions < CPCI85 V05). The affected devic… |
CVE-2023-33919 | High | 7.2 | 2023-06-13 | A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050 MASTER MODULE (All versions < CPCI85 V05). The web interface… |
CVE-2023-33305 | Medium | 4.9 | 2023-06-13 | A loop with unreachable exit condition ('infinite loop') in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS version 7.0.0 through 7.0.10, FortiOS 6.4 all… |
CVE-2023-33124 | High | 7.8 | 2023-06-13 | A vulnerability has been identified in JT2Go (All versions < V14.2.0.3), Teamcenter Visualization V13.2 (All versions < V13.2.0.13), Teamcenter Visualization V… |
CVE-2023-33123 | High | 7.8 | 2023-06-13 | A vulnerability has been identified in JT2Go (All versions < V14.2.0.3), Teamcenter Visualization V13.2 (All versions < V13.2.0.13), Teamcenter Visualization V… |
CVE-2023-33122 | Low | 3.3 | 2023-06-13 | A vulnerability has been identified in JT2Go (All versions < V14.2.0.3), Teamcenter Visualization V13.2 (All versions < V13.2.0.13), Teamcenter Visualization V… |
CVE-2023-33121 | Low | 3.3 | 2023-06-13 | A vulnerability has been identified in JT2Go (All versions < V14.2.0.3), Teamcenter Visualization V13.2 (All versions < V13.2.0.13), Teamcenter Visualization V… |
CVE-2023-31238 | Medium | 5.5 | 2023-06-13 | A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.11), SICAM P850 (7KG8500-0AA00-2AA0) (All versions < V3.11), SICAM P8… |
CVE-2023-30901 | Medium | 4.3 | 2023-06-13 | A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.11), SICAM P850 (7KG8500-0AA00-2AA0) (All versions < V3.11), SICAM P8… |
CVE-2023-30897 | High | 7.8 | 2023-06-13 | A vulnerability has been identified in SIMATIC WinCC (All versions < V7.5.2.13). Affected applications fail to set proper access rights for their installation… |
CVE-2023-30757 | Medium | 6.2 | 2023-06-13 | A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation Portal (TIA Portal)… |
CVE-2023-29178 | Medium | 4.3 | 2023-06-13 | A access of uninitialized pointer vulnerability [CWE-824] in Fortinet FortiProxy version 7.2.0 through 7.2.3 and before 7.0.9 and FortiOS version 7.2.0 throug… |
CVE-2023-29175 | Medium | 4.8 | 2023-06-13 | An improper certificate validation vulnerability [CWE-295] in FortiOS 6.2 all versions, 6.4 all versions, 7.0.0 through 7.0.10, 7.2.0 and FortiProxy 1.2 all ve… |
CVE-2023-29129 | Critical | 9.1 | 2023-06-13 | A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.3 < V1.18.0), Mendix SAML (Mendix 7 compatible) (All versions >… |
CVE-2023-28829 | Low | 3.9 | 2023-06-13 | A vulnerability has been identified in SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15 (All versions), SIMATIC PCS 7 V8.2 (All versions… |
CVE-2023-28000 | Medium | 6.7 | 2023-06-13 | An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC CLI 7.1.0, 7.0.0 through 7.0.3, 6.2.0 through 6.2.4, 6… |
CVE-2023-27997 | Critical | 9.8 | 2023-06-13 | A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and… |