2023 CVEs (page 229)
Page 229 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-25745 | High | 8.8 | 2023-06-02 | Memory safety bugs present in Firefox 109. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could h… |
CVE-2023-25744 | High | 8.8 | 2023-06-02 | Mmemory safety bugs present in Firefox 109 and Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effor… |
CVE-2023-25743 | High | 7.5 | 2023-06-02 | A lack of in app notification for entering fullscreen mode could have lead to a malicious website spoofing browser chrome.<br>*This bug only affects Firefox Fo… |
CVE-2023-25742 | Medium | 6.5 | 2023-06-02 | When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash. This vulnerability affects Firefox < 110, T… |
CVE-2023-25741 | Medium | 6.5 | 2023-06-02 | When dragging and dropping an image cross-origin, the image's size could potentially be leaked. This behavior was shipped in 109 and caused web compatibility p… |
CVE-2023-25740 | High | 8.8 | 2023-06-02 | After downloading a Windows <code>.scf</code> script from the local filesystem, an attacker could supply a remote path that would lead to unexpected network re… |
CVE-2023-25739 | High | 8.8 | 2023-06-02 | Module load requests that failed were not being checked as to whether or not they were cancelled causing a use-after-free in <code>ScriptLoadContext</code>. Th… |
CVE-2023-25738 | Medium | 6.5 | 2023-06-02 | Members of the <code>DEVMODEW</code> struct set by the printer device driver weren't being validated and could have resulted in invalid values which in turn wo… |
CVE-2023-25737 | High | 8.8 | 2023-06-02 | An invalid downcast from <code>nsTextNode</code> to <code>SVGElement</code> could have lead to undefined behavior. This vulnerability affects Firefox < 110, Th… |
CVE-2023-25735 | High | 8.8 | 2023-06-02 | Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-… |
CVE-2023-25734 | High | 8.1 | 2023-06-02 | After downloading a Windows <code>.url</code> shortcut from the local filesystem, an attacker could supply a remote path that would lead to unexpected network… |
CVE-2023-25732 | High | 8.8 | 2023-06-02 | When encoding data from an <code>inputStream</code> in <code>xpcom</code> the size of the input being encoded was not correctly calculated potentially leading… |
CVE-2023-25731 | High | 8.8 | 2023-06-02 | Due to URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially be used to overwrite global objects in… |
CVE-2023-25730 | Medium | 5.4 | 2023-06-02 | A background script invoking <code>requestFullscreen</code> and then blocking the main thread could force the browser into fullscreen mode indefinitely, result… |
CVE-2023-25729 | High | 8.8 | 2023-06-02 | Permission prompts for opening external schemes were only shown for <code>ContentPrincipals</code> resulting in extensions being able to open them without user… |
CVE-2023-25728 | Medium | 6.5 | 2023-06-02 | The <code>Content-Security-Policy-Report-Only</code> header could allow an attacker to leak a child iframe's unredacted URI when interaction with that iframe t… |
CVE-2023-23606 | High | 8.8 | 2023-06-02 | Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 108. Some of these bugs showed evidence of memory corruption and… |
CVE-2023-23605 | High | 8.8 | 2023-06-02 | Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 108 and Firefox ESR 102.6. Some of these bugs showed evidence of… |
CVE-2023-23604 | Medium | 6.5 | 2023-06-02 | A duplicate `SystemPrincipal` object could be created when parsing a non-system html document via `DOMParser::ParseFromSafeString`. This could have lead to byp… |
CVE-2023-23603 | Medium | 6.5 | 2023-06-02 | Regular expressions used to filter out forbidden properties and values from style directives in calls to `console.log` weren't accounting for external URLs. Da… |
CVE-2023-23602 | Medium | 6.5 | 2023-06-02 | A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored. This could lead to co… |
CVE-2023-23601 | Medium | 6.5 | 2023-06-02 | Navigations were being allowed when dragging a URL from a cross-origin iframe into the same tab which could lead to website spoofing attacks This vulnerability… |
CVE-2023-23600 | Medium | 6.5 | 2023-06-02 | Per origin notification permissions were being stored in a way that didn't take into account what browsing context the permission was granted in. This lead to… |
CVE-2023-23599 | Medium | 6.5 | 2023-06-02 | When copying a network request from the developer tools panel as a curl command the output was not being properly sanitized and could allow arbitrary commands… |
CVE-2023-23598 | Medium | 6.5 | 2023-06-02 | Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged a website cou… |
CVE-2023-23597 | Medium | 6.5 | 2023-06-02 | A compromised web child process could disable web security opening restrictions, leading to a new child process being spawned within the `file://` context. Giv… |
CVE-2023-1945 | Medium | 6.5 | 2023-06-02 | Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunder… |
CVE-2023-0767 | High | 8.8 | 2023-06-02 | An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled… |
CVE-2023-0616 | Medium | 6.5 | 2023-06-02 | If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and display the message, which could cause T… |
CVE-2023-0547 | Medium | 6.5 | 2023-06-02 | OCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted. Thunderbird v… |
CVE-2023-0430 | Medium | 6.5 | 2023-06-02 | Certificate OCSP revocation status was not checked when verifying S/Mime signatures. Mail signed with a revoked certificate would be displayed as having a vali… |
CVE-2023-3068 | Medium | 6.3 | 2023-06-02 | A vulnerability classified as critical has been found in Campcodes Retro Cellphone Online Store 1.0. Affected is an unknown function of the file /admin/modal_a… |
CVE-2023-3067 | Medium | 5.4 | 2023-06-02 | Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium prior to 0.59.4. |
CVE-2023-34094 | High | 7.5 | 2023-06-02 | ChuanhuChatGPT is a graphical user interface for ChatGPT and many large language models. A vulnerability in versions 20230526 and prior allows unauthorized acc… |
CVE-2023-2687 | Low | 2.9 | 2023-06-02 | Buffer overflow in Platform CLI component in Silicon Labs Gecko SDK v4.2.1 and earlier allows user to overwrite limited structures on the heap. |
CVE-2023-30149 | Critical | 9.8 | 2023-06-02 | SQL injection vulnerability in the City Autocomplete (cityautocomplete) module from ebewe.net for PrestaShop, prior to version 1.8.12 (for PrestaShop version 1… |
CVE-2023-3062 | Medium | 6.3 | 2023-06-02 | A vulnerability was found in code-projects Agro-School Management System 1.0. It has been classified as critical. Affected is an unknown function of the file i… |
CVE-2023-3061 | Medium | 6.3 | 2023-06-02 | A vulnerability was found in code-projects Agro-School Management System 1.0 and classified as critical. This issue affects some unknown processing of the file… |
CVE-2023-3060 | Low | 3.5 | 2023-06-02 | A vulnerability has been found in code-projects Agro-School Management System 1.0 and classified as problematic. This vulnerability affects the function doAddQ… |
CVE-2023-34362 | Critical | 9.8 | 2023-06-02 | In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerabi… |
CVE-2023-33476 | Critical | 9.8 | 2023-06-02 | ReadyMedia (MiniDLNA) versions from 1.1.15 up to 1.3.2 is vulnerable to Buffer Overflow. The vulnerability is caused by incorrect validation logic when handlin… |
CVE-2023-3059 | Medium | 6.3 | 2023-06-02 | A vulnerability, which was classified as critical, was found in SourceCodester Online Exam Form Submission 1.0. This affects an unknown part of the file /admin… |
CVE-2023-3058 | Low | 3.5 | 2023-06-02 | A vulnerability was found in 07FLY CRM up to 1.2.0. It has been declared as problematic. This vulnerability affects unknown code of the component User Profile… |
CVE-2023-3057 | Medium | 4.3 | 2023-06-02 | A vulnerability was found in YFCMF up to 3.0.4. It has been rated as problematic. This issue affects some unknown processing of the file app/admin/controller/A… |
CVE-2023-3033 | Medium | 6.8 | 2023-06-02 | Incorrect Authorization vulnerability in Mobatime web application allows Privilege Escalation, Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2023-3032 | High | 8.1 | 2023-06-02 | Unrestricted Upload of File with Dangerous Type vulnerability in Mobatime web application (Documentary proof upload modules) allows a malicious user to Upload… |
CVE-2023-3031 | Medium | 4.9 | 2023-06-02 | Improper Limitation of a Pathname leads to a Path Traversal vulnerability in the module King-Avis for Prestashop, allowing a user knowing the download token to… |
CVE-2023-3056 | Medium | 4.3 | 2023-06-02 | A vulnerability was found in YFCMF up to 3.0.4. It has been declared as problematic. This vulnerability affects unknown code of the file index.php. The manipul… |
CVE-2023-33731 | Medium | 6.1 | 2023-06-02 | Reflected Cross Site Scripting (XSS) in the view dashboard detail feature in Microworld Technologies eScan management console 14.0.1400.2281 allows remote atta… |
CVE-2023-33717 | Medium | 5.5 | 2023-06-02 | mp4v2 v2.1.3 was discovered to contain a memory leak when a method calling MP4File::ReadBytes() had allocated memory but did not catch exceptions thrown by Rea… |
CVE-2023-28469 | Medium | 5.5 | 2023-06-02 | An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to gain access to already freed me… |
CVE-2023-30604 | Critical | 9.8 | 2023-06-02 | It is identified a vulnerability of insufficient authentication in the system configuration interface of Hitron Technologies CODA-5310. An unauthorized remote… |
CVE-2023-30603 | Critical | 9.8 | 2023-06-02 | Hitron Technologies CODA-5310 Telnet function with the default account and password, and there is no warning or prompt to ask users to change the default passw… |
CVE-2023-30602 | High | 7.5 | 2023-06-02 | Hitron Technologies CODA-5310’s Telnet function transfers sensitive data in plaintext. An unauthenticated remote attacker can exploit this vulnerability to acc… |
CVE-2023-28705 | Medium | 5.4 | 2023-06-02 | Openfind Mail2000 has insufficient filtering special characters of email content of its content filtering function. A remote attacker can exploit this vulnerab… |
CVE-2023-28704 | High | 8.8 | 2023-06-02 | Furbo dog camera has insufficient filtering for special parameter of device log management function. An unauthenticated remote attacker in the Bluetooth networ… |
CVE-2023-28703 | High | 7.2 | 2023-06-02 | ASUS RT-AC86U’s specific cgi function has a stack-based buffer overflow vulnerability due to insufficient validation for network packet header length. A remote… |
CVE-2023-28702 | High | 8.8 | 2023-06-02 | ASUS RT-AC86U does not filter special characters for parameters in specific web URLs. A remote attacker with normal user privileges can exploit this vulnerabil… |
CVE-2023-28701 | Critical | 9.8 | 2023-06-02 | ELITE TECHNOLOGY CORP. Web Fax has a vulnerability of SQL Injection. An unauthenticated remote attacker can inject SQL commands into the input field of the log… |
CVE-2023-28700 | Medium | 6.8 | 2023-06-02 | OMICARD EDM backend system’s file uploading function does not restrict upload of file with dangerous type. A local area network attacker with administrator pri… |
CVE-2023-28699 | High | 8.8 | 2023-06-02 | Wade Graphic Design FANTSY has a vulnerability of insufficient filtering for file type in its file update function. An authenticated remote attacker with gener… |
CVE-2023-28698 | Critical | 9.8 | 2023-06-02 | Wade Graphic Design FANTSY has a vulnerability of insufficient authorization check. An unauthenticated remote user can exploit this vulnerability by modifying… |
CVE-2023-25780 | Medium | 5.7 | 2023-06-02 | It is identified a vulnerability of insufficient authentication in an important specific function of Status PowerBPM. A LAN attacker with normal user privilege… |
CVE-2023-3000 | Critical | 9.8 | 2023-06-02 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Erikoglu Technology ErMon allows Command Line Execution t… |
CVE-2023-2835 | Medium | 6.1 | 2023-06-02 | The WP Directory Kit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in versions up to, and including, 1.2.3 du… |
CVE-2023-1159 | Medium | 4.0 | 2023-06-02 | The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via service titles in versions up to, and including, 21.5 due to insufficient inpu… |
CVE-2023-2063 | Medium | 6.3 | 2023-06-02 | Unrestricted Upload of File with Dangerous Type vulnerability in FTP function on Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP9… |
CVE-2023-2062 | Medium | 6.2 | 2023-06-02 | Missing Password Field Masking vulnerability in Mitsubishi Electric Corporation EtherNet/IP configuration tools SW1DNN-EIPCT-BD and SW1DNN-EIPCTFX5-BD allows a… |
CVE-2023-2061 | Medium | 6.2 | 2023-06-02 | Use of Hard-coded Password vulnerability in FTP function on Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Ser… |
CVE-2023-2060 | High | 7.5 | 2023-06-02 | Weak Password Requirements vulnerability in FTP function on Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Ser… |
CVE-2023-2201 | High | 8.8 | 2023-06-02 | The Web Directory Free for WordPress is vulnerable to SQL Injection via the ‘post_id’ parameter in versions up to, and including, 1.6.8 due to insufficient es… |
CVE-2023-29746 | Critical | 9.8 | 2023-06-02 | An issue found in The Thaiger v.1.2 for Android allows unauthorized apps to cause a code execution attack by manipulating the SharedPreference files. |
CVE-2023-29725 | Medium | 5.5 | 2023-06-02 | The BT21 x BTS Wallpaper app 12 for Android allows unauthorized applications to actively request permission to insert data into the database that records infor… |
CVE-2023-29724 | High | 7.8 | 2023-06-02 | The BT21 x BTS Wallpaper app 12 for Android allows unauthorized apps to actively request permission to modify data in the database that records information abo… |
CVE-2023-27745 | High | 8.8 | 2023-06-02 | An issue in South River Technologies TitanFTP Before v2.0.1.2102 allows attackers with low-level privileges to perform Administrative actions by sending reques… |
CVE-2023-27744 | High | 7.8 | 2023-06-02 | An issue was discovered in South River Technologies TitanFTP NextGen server that allows for a vertical privilege escalation leading to remote code execution. |
CVE-2023-28147 | Medium | 5.5 | 2023-06-02 | An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to gain access to already freed me… |
CVE-2023-29736 | Critical | 9.8 | 2023-06-01 | Keyboard Themes 1.275.1.164 for Android contains a dictionary traversal vulnerability that allows unauthorized apps to overwrite arbitrary files in its interna… |
CVE-2023-29723 | High | 7.5 | 2023-06-01 | The Glitter Unicorn Wallpaper app for Android 7.0 thru 8.0 allows unauthorized applications to actively request permission to insert data into the database tha… |
CVE-2023-29722 | Critical | 9.1 | 2023-06-01 | The Glitter Unicorn Wallpaper app for Android 7.0 thru 8.0 allows unauthorized apps to actively request permission to modify data in the database that records… |
CVE-2023-27640 | High | 7.5 | 2023-06-01 | An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with the POST parame… |
CVE-2023-27639 | High | 7.5 | 2023-06-01 | An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with the POST parame… |
CVE-2023-33764 | Medium | 5.4 | 2023-06-01 | eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component #/de/casting/show… |
CVE-2023-33754 | Medium | 6.5 | 2023-06-01 | The captive portal in Inpiazza Cloud WiFi versions prior to v4.2.17 does not enforce limits on the number of attempts for password recovery, allowing attackers… |
CVE-2023-34339 | Low | 3.3 | 2023-06-01 | In JetBrains Ktor before 2.3.1 headers containing authentication data could be added to the exception's message |
CVE-2023-34092 | High | 7.5 | 2023-06-01 | Vite provides frontend tooling. Prior to versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9, Vite Server Options (`server.fs.deny`) can be bypassed using d… |
CVE-2023-34091 | Medium | 6.5 | 2023-06-01 | Kyverno is a policy engine designed for Kubernetes. In versions of Kyverno prior to 1.10.0, resources which have the `deletionTimestamp` field defined can bypa… |
CVE-2023-33960 | High | 7.5 | 2023-06-01 | OpenProject is web-based project management software. For any OpenProject installation, a `robots.txt` file is generated through the server to denote which rou… |
CVE-2023-32717 | Medium | 4.3 | 2023-06-01 | On Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and in Splunk Cloud Platform versions below 9.0.2303.100, an unauthorized user can access the {{… |
CVE-2023-32716 | Medium | 6.5 | 2023-06-01 | In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, an attacker can exploit a vulnerability i… |
CVE-2023-32715 | Medium | 4.7 | 2023-06-01 | In the Splunk App for Lookup File Editing versions below 4.0.1, a user can insert potentially malicious JavaScript code into the app, which causes that code to… |
CVE-2023-32714 | High | 8.1 | 2023-06-01 | In the Splunk App for Lookup File Editing versions below 4.0.1, a low-privileged user can, with a specially crafted web request, trigger a path traversal explo… |
CVE-2023-32713 | High | 7.8 | 2023-06-01 | In Splunk App for Stream versions below 8.1.1, a low-privileged user could use a vulnerability in the streamfwd process within the Splunk App for Stream to esc… |
CVE-2023-32712 | High | 8.6 | 2023-06-01 | In Splunk Enterprise versions below 9.1.0.2, 9.0.5.1, and 8.2.11.2, an attacker can inject American National Standards Institute (ANSI) escape codes into Splun… |
CVE-2023-32711 | Medium | 5.4 | 2023-06-01 | In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, a Splunk dashboard view lets a low-privileged user exploit a vulnerability in the Bootstrap web… |
CVE-2023-32710 | Medium | 4.8 | 2023-06-01 | In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and in Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user can perform an u… |
CVE-2023-32709 | Medium | 4.3 | 2023-06-01 | In Splunk Enterprise versions below 9.0.5, 8.2.11. and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user who holds the ‘user… |
CVE-2023-32708 | High | 7.2 | 2023-06-01 | In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user can trigger an HTTP… |
CVE-2023-32707 | High | 8.8 | 2023-06-01 | In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role… |
CVE-2023-32706 | High | 7.7 | 2023-06-01 | On Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, an unauthenticated attacker can send specially-crafted messages to the XML parser within SAML au… |