2023 CVEs (page 230)
Page 230 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-32690 | Medium | 5.7 | 2023-06-01 | libspdm is a sample implementation that follows the DMTF SPDM specifications. Prior to versions 2.3.3 and 3.0, following a successful CAPABILITIES response, a… |
CVE-2023-32324 | High | 7.5 | 2023-06-01 | OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow vulnerability would allow a remote attacker to launch… |
CVE-2023-33963 | Critical | 9.8 | 2023-06-01 | DataEase is an open source data visualization and analysis tool. Prior to version 1.18.7, a deserialization vulnerability exists in the DataEase datasource, wh… |
CVE-2023-32310 | High | 8.1 | 2023-06-01 | DataEase is an open source data visualization and analysis tool. The API interface for DataEase delete dashboard and delete system messages is vulnerable to in… |
CVE-2023-28066 | High | 7.3 | 2023-06-01 | Dell OS Recovery Tool, versions 2.2.4013 and 2.3.7012.0, contain an Improper Access Control Vulnerability. A local authenticated non-administrator user could… |
CVE-2023-28043 | Medium | 6.5 | 2023-06-01 | Dell SCG 5.14 contains an information disclosure vulnerability during the SRS to SCG upgrade path. A remote low privileged malicious user could potentially ex… |
CVE-2023-33965 | Critical | 9.6 | 2023-06-01 | Brook is a cross-platform programmable network tool. The `tproxy` server is vulnerable to a drive-by command injection. An attacker may fool a victim into visi… |
CVE-2023-33552 | High | 7.8 | 2023-06-01 | Heap Buffer Overflow in the erofs_read_one_data function at data.c in erofs-utils v1.6 allows remote attackers to execute arbitrary code via a crafted erofs fi… |
CVE-2023-33551 | High | 7.8 | 2023-06-01 | Heap Buffer Overflow in the erofsfsck_dirent_iter function in fsck/main.c in erofs-utils v1.6 allows remote attackers to execute arbitrary code via a crafted e… |
CVE-2023-3035 | Low | 3.5 | 2023-06-01 | A vulnerability has been found in Guangdong Pythagorean OA Office System up to 4.50.31 and classified as problematic. Affected by this vulnerability is an unkn… |
CVE-2023-33546 | Medium | 5.5 | 2023-06-01 | Janino 3.1.9 and earlier are subject to denial of service (DOS) attacks when using the expression evaluator.guess parameter name method. If the parser runs on… |
CVE-2023-33544 | Medium | 5.5 | 2023-06-01 | hawtio 2.17.2 is vulnerable to Path Traversal. it is possible to input malicious zip files, which can result in the high-risk files after decompression being s… |
CVE-2023-22648 | High | 8.0 | 2023-06-01 | A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users while they are logged in the… |
CVE-2023-22647 | Critical | 9.9 | 2023-06-01 | An Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage their existing permissions to manipulate Kubernetes secrets i… |
CVE-2023-32181 | Low | 3.3 | 2023-06-01 | A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf allows for DoS via malformed configuration files Th… |
CVE-2023-22652 | Low | 3.3 | 2023-06-01 | A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf leads to DoS via malformed config files. This issue… |
CVE-2023-3029 | Medium | 4.3 | 2023-06-01 | A vulnerability has been found in Guangdong Pythagorean OA Office System up to 4.50.31 and classified as problematic. This vulnerability affects unknown code o… |
CVE-2023-3028 | High | 8.6 | 2023-06-01 | Insufficient authentication in the MQTT backend (broker) allows an attacker to access and even manipulate the telemetry data of the entire fleet of vehicles us… |
CVE-2023-24584 | High | 7.5 | 2023-06-01 | Controller 6000 is vulnerable to a buffer overflow via the Controller diagnostic web interface upload feature. This issue affects Controller 6000: before… |
CVE-2023-33778 | Critical | 9.8 | 2023-06-01 | Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor fi… |
CVE-2023-34312 | High | 7.8 | 2023-06-01 | In Tencent QQ through 9.7.8.29039 and TIM through 3.4.7.22084, QQProtect.exe and QQProtectEngine.dll do not validate pointers from inter-process communication… |
CVE-2023-33719 | Medium | 5.5 | 2023-06-01 | mp4v2 v2.1.3 was discovered to contain a memory leak via MP4SdpAtom::Read() at atom_sdp.cpp |
CVE-2023-33716 | Medium | 5.5 | 2023-06-01 | mp4v2 v2.1.3 was discovered to contain a memory leak via the class MP4StringProperty at mp4property.cpp. |
CVE-2023-33461 | Medium | 5.5 | 2023-06-01 | iniparser v4.1 is vulnerable to NULL Pointer Dereference in function iniparser_getlongint which misses check NULL for function iniparser_getstring's return. |
CVE-2023-29748 | High | 7.5 | 2023-06-01 | Story Saver for Instragram - Video Downloader 1.0.6 for Android has an exposed component that provides a method to modify the SharedPreference file. An attacke… |
CVE-2023-30758 | Medium | 5.4 | 2023-06-01 | Cross-site scripting vulnerability in Pleasanter 1.3.38.1 and earlier allows a remote authenticated attacker to inject an arbitrary script. |
CVE-2023-29159 | High | 7.5 | 2023-06-01 | Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web se… |
CVE-2023-29154 | High | 7.2 | 2023-06-01 | SQL injection vulnerability exists in the CONPROSYS HMI System (CHS) versions prior to 3.5.3. A user who can access the affected product with an administrative… |
CVE-2023-28937 | High | 8.8 | 2023-06-01 | DataSpider Servista version 4.4 and earlier uses a hard-coded cryptographic key. DataSpider Servista is data integration software. ScriptRunner and ScriptRunne… |
CVE-2023-28824 | Medium | 4.9 | 2023-06-01 | Server-side request forgery vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. A user who can access the affected product with an admi… |
CVE-2023-28713 | High | 8.1 | 2023-06-01 | Plaintext storage of a password exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. Because account information of the database is saved in a local f… |
CVE-2023-28657 | High | 8.8 | 2023-06-01 | Improper access control vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. A user of the PC where the affected product is installed ma… |
CVE-2023-28651 | Medium | 4.8 | 2023-06-01 | Cross-site scripting vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. If a user who can access the affected product with an administ… |
CVE-2023-28399 | High | 7.8 | 2023-06-01 | Incorrect permission assignment for critical resource exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. ACL (Access Control List) is not appropriat… |
CVE-2023-3026 | Medium | 6.1 | 2023-06-01 | Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 21.2.8. |
CVE-2023-2985 | Medium | 5.5 | 2023-06-01 | A use after free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw could allow a local user to cause a denial of service… |
CVE-2023-2977 | High | 7.1 | 2023-06-01 | A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package. The attacker can supply a s… |
CVE-2023-2598 | High | 7.8 | 2023-06-01 | A flaw was found in the fixed buffer registration code for io_uring (io_sqe_buffer_register in io_uring/rsrc.c) in the Linux kernel that allows out-of-bounds a… |
CVE-2023-23955 | High | 8.1 | 2023-06-01 | Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Server-Side Request Forgery vulnerability. |
CVE-2023-23954 | Medium | 5.4 | 2023-06-01 | Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Stored Cross-Site Scripting vulnerability. |
CVE-2023-23953 | High | 7.8 | 2023-06-01 | Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to an Elevation of Privilege vulnerability. |
CVE-2023-23952 | Critical | 9.8 | 2023-06-01 | Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Command Injection vulnerability. |
CVE-2023-33643 | High | 7.2 | 2023-05-31 | H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the AddWlanMacList interface at /goform/aspForm. |
CVE-2023-33642 | High | 7.2 | 2023-05-31 | H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the Edit_BasicSSID interface at /goform/aspForm. |
CVE-2023-33641 | High | 7.2 | 2023-05-31 | H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the AddMacList interface at /goform/aspForm. |
CVE-2023-33640 | High | 7.2 | 2023-05-31 | H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the SetAPWifiorLedInfoById interface at /goform/aspForm. |
CVE-2023-33639 | High | 7.2 | 2023-05-31 | H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the SetMobileAPInfoById interface at /goform/aspForm. |
CVE-2023-33638 | High | 7.2 | 2023-05-31 | H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the Edit_BasicSSID_5G interface at /goform/aspForm. |
CVE-2023-33637 | High | 7.2 | 2023-05-31 | H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the DelDNSHnList interface at /goform/aspForm. |
CVE-2023-33636 | High | 7.2 | 2023-05-31 | H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the ipqos_lanip_editlist interface at /goform/aspForm. |
CVE-2023-33635 | High | 7.2 | 2023-05-31 | H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the UpdateMacClone interface at /goform/aspForm. |
CVE-2023-33634 | High | 7.2 | 2023-05-31 | H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the EdittriggerList interface at /goform/aspForm. |
CVE-2023-33633 | High | 7.2 | 2023-05-31 | H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the UpdateWanParams interface at /goform/aspForm. |
CVE-2023-33632 | High | 7.2 | 2023-05-31 | H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the ipqos_lanip_dellist interface at /goform/aspForm. |
CVE-2023-33631 | High | 7.2 | 2023-05-31 | H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the DelSTList interface at /goform/aspForm. |
CVE-2023-33630 | High | 7.2 | 2023-05-31 | H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the EditvsList interface at /goform/aspForm. |
CVE-2023-33629 | High | 7.2 | 2023-05-31 | H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the DeltriggerList interface at /goform/aspForm. |
CVE-2023-33628 | High | 7.2 | 2023-05-31 | H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the DelvsList interface at /goform/aspForm. |
CVE-2023-33627 | High | 7.2 | 2023-05-31 | H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the UpdateSnat interface at /goform/aspForm. |
CVE-2023-3006 | Medium | 5.5 | 2023-05-31 | A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes actual again for the new hw AmpereOne. Spectre-BHB is… |
CVE-2023-34258 | High | 7.5 | 2023-05-31 | An issue was discovered in BMC Patrol before 22.1.00. The agent's configuration can be remotely queried. This configuration contains the Patrol account passwor… |
CVE-2023-34257 | Critical | 9.8 | 2023-05-31 | An issue was discovered in BMC Patrol through 23.1.00. The agent's configuration can be remotely modified (and, by default, authentication is not required). So… |
CVE-2023-34256 | Medium | 5.5 | 2023-05-31 | An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_… |
CVE-2023-33735 | Critical | 9.8 | 2023-05-31 | D-Link DIR-846 v1.00A52 was discovered to contain a remote command execution (RCE) vulnerability via the tomography_ping_address parameter in the /HNAP1 interf… |
CVE-2023-33732 | Medium | 6.1 | 2023-05-31 | Cross Site Scripting (XSS) in the New Policy form in Microworld Technologies eScan management console 14.0.1400.2281 allows a remote attacker to inject arbitra… |
CVE-2023-33730 | Critical | 9.8 | 2023-05-31 | Privilege Escalation in the "GetUserCurrentPwd" function in Microworld Technologies eScan Management Console 14.0.1400.2281 allows any remote attacker to retri… |
CVE-2023-33287 | Medium | 5.4 | 2023-05-31 | A stored cross-site scripting (XSS) vulnerability in the Inline Table Editing application before 3.8.0 for Confluence allows attackers to store and execute arb… |
CVE-2023-26278 | High | 8.2 | 2023-05-31 | IBM QRadar WinCollect Agent 10.0 through 10.1.3 could allow a local authenticated attacker to gain elevated privileges on the system. IBM X-Force ID: 248158. |
CVE-2023-34088 | High | 8.7 | 2023-05-31 | Collabora Online is a collaborative online office suite. A stored cross-site scripting (XSS) vulnerability was found in Collabora Online prior to versions 22.0… |
CVE-2023-33979 | Medium | 6.5 | 2023-05-31 | gpt_academic provides a graphical interface for ChatGPT/GLM. A vulnerability was found in gpt_academic 3.37 and prior. This issue affects some unknown processi… |
CVE-2023-33722 | High | 8.8 | 2023-05-31 | EDIMAX BR-6288ACL v1.12 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the pppUserName parameter. |
CVE-2023-33718 | High | 8.8 | 2023-05-31 | mp4v2 v2.1.3 was discovered to contain a memory leak via MP4File::ReadString() at mp4file_io.cpp |
CVE-2023-26277 | High | 7.8 | 2023-05-31 | IBM QRadar WinCollect Agent 10.0 though 10.1.3 could allow a local user to execute commands on the system due to execution with unnecessary privileges. IBM X-… |
CVE-2023-33971 | Medium | 6.1 | 2023-05-31 | Formcreator is a GLPI plugin which allow creation of custom forms and the creation of one or more tickets when the form is filled. A probable stored cross-site… |
CVE-2023-33967 | High | 8.2 | 2023-05-31 | EaseProbe is a tool that can do health/status checking. An SQL injection issue was discovered in EaseProbe before 2.1.0 when using MySQL/PostgreSQL data checki… |
CVE-2023-33966 | High | 8.6 | 2023-05-31 | Deno is a runtime for JavaScript and TypeScript. In deno 1.34.0 and deno_runtime 0.114.0, outbound HTTP requests made using the built-in `node:http` or `node:h… |
CVE-2023-33964 | High | 8.6 | 2023-05-31 | mx-chain-go is an implementation of the MultiversX blockchain protocol written in the Go language. Metachain cannot process a cross-shard miniblock. Prior to v… |
CVE-2023-3021 | Medium | 5.4 | 2023-05-31 | Cross-site Scripting (XSS) - Stored in GitHub repository mkucej/i-librarian-free prior to 5.10.4. |
CVE-2023-3020 | Medium | 6.1 | 2023-05-31 | Cross-site Scripting (XSS) - Reflected in GitHub repository mkucej/i-librarian-free prior to 5.10.4. |
CVE-2023-29747 | Critical | 9.8 | 2023-05-31 | Story Saver for Instragram - Video Downloader 1.0.6 for Android exists exposed component, the component provides the method to modify the SharedPreference file… |
CVE-2023-3018 | Medium | 6.3 | 2023-05-31 | A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been declared as critical. This vulnerability affects unknown code of… |
CVE-2023-3017 | Low | 2.4 | 2023-05-31 | A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been classified as problematic. This affects an unknown part of the f… |
CVE-2023-2758 | Low | 3.7 | 2023-05-31 | A denial of service vulnerability exists in Contec CONPROSYS HMI System versions 3.5.2 and prior. When there is a time-zone mismatch in certain configuration f… |
CVE-2023-3016 | Low | 3.5 | 2023-05-31 | A vulnerability was found in yiwent Vip Video Analysis 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file admi… |
CVE-2023-3015 | Medium | 6.3 | 2023-05-31 | A vulnerability has been found in yiwent Vip Video Analysis 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the f… |
CVE-2023-3014 | Low | 3.5 | 2023-05-31 | A vulnerability, which was classified as problematic, was found in BeipyVideoResolution up to 2.6. Affected is an unknown function of the file admin/admincore… |
CVE-2023-3013 | High | 7.1 | 2023-05-31 | Unchecked Return Value in GitHub repository gpac/gpac prior to 2.2.2. |
CVE-2023-3012 | High | 7.8 | 2023-05-31 | NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.2.2. |
CVE-2023-34229 | Medium | 4.6 | 2023-05-31 | In JetBrains TeamCity before 2023.05 stored XSS in GitLab Connection page was possible |
CVE-2023-34228 | Medium | 5.3 | 2023-05-31 | In JetBrains TeamCity before 2023.05 authentication checks were missing – 2FA was not checked for some sensitive account actions |
CVE-2023-34227 | Medium | 5.3 | 2023-05-31 | In JetBrains TeamCity before 2023.05 a specific endpoint was vulnerable to brute force attacks |
CVE-2023-34226 | Medium | 4.6 | 2023-05-31 | In JetBrains TeamCity before 2023.05 reflected XSS in the Subscriptions page was possible |
CVE-2023-34225 | Medium | 4.6 | 2023-05-31 | In JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possible |
CVE-2023-34224 | Medium | 4.8 | 2023-05-31 | In JetBrains TeamCity before 2023.05 open redirect during oAuth configuration was possible |
CVE-2023-34223 | Medium | 4.3 | 2023-05-31 | In JetBrains TeamCity before 2023.05 parameters of the "password" type from build dependencies could be logged in some cases |
CVE-2023-34222 | Medium | 4.6 | 2023-05-31 | In JetBrains TeamCity before 2023.05 possible XSS in the Plugin Vendor URL was possible |
CVE-2023-34221 | Medium | 4.6 | 2023-05-31 | In JetBrains TeamCity before 2023.05 stored XSS in the Show Connection page was possible |
CVE-2023-34220 | Medium | 4.6 | 2023-05-31 | In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possible |
CVE-2023-34219 | Medium | 4.3 | 2023-05-31 | In JetBrains TeamCity before 2023.05 improper permission checks allowed users without appropriate permissions to edit Build Configuration settings via REST API |
CVE-2023-34218 | Critical | 9.1 | 2023-05-31 | In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible |