2023 CVEs (page 239)
Page 239 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-2724 | High | 8.8 | 2023-05-16 | Type confusion in V8 in Google Chrome prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2023-2723 | High | 8.8 | 2023-05-16 | Use after free in DevTools in Google Chrome prior to 113.0.5672.126 allowed a remote attacker who had compromised the renderer process to potentially exploit h… |
CVE-2023-2722 | High | 8.8 | 2023-05-16 | Use after free in Autofill UI in Google Chrome on Android prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap corruption via a crafte… |
CVE-2023-2721 | High | 8.8 | 2023-05-16 | Use after free in Navigation in Google Chrome prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2023-2631 | Medium | 4.3 | 2023-05-16 | A missing permission check in Jenkins Code Dx Plugin 3.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL. |
CVE-2023-2195 | Medium | 4.3 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins Code Dx Plugin 3.1.0 and earlier allows attackers to connect to an attacker-specified URL. |
CVE-2023-2633 | Medium | 4.3 | 2023-05-16 | Jenkins Code Dx Plugin 3.1.0 and earlier does not mask Code Dx server API keys displayed on the configuration form, increasing the potential for attackers to o… |
CVE-2023-2632 | Medium | 4.3 | 2023-05-16 | Jenkins Code Dx Plugin 3.1.0 and earlier stores Code Dx server API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed… |
CVE-2023-2196 | Medium | 4.3 | 2023-05-16 | A missing permission check in Jenkins Code Dx Plugin 3.1.0 and earlier allows attackers with Item/Read permission to check for the existence of an attacker-spe… |
CVE-2023-33007 | Medium | 5.4 | 2023-05-16 | Jenkins LoadComplete support Plugin 1.0 and earlier does not escape the LoadComplete test name, resulting in a stored cross-site scripting (XSS) vulnerability… |
CVE-2023-33006 | Medium | 5.4 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins WSO2 Oauth Plugin 1.0 and earlier allows attackers to trick users into logging in to the attacker'… |
CVE-2023-33005 | Medium | 5.4 | 2023-05-16 | Jenkins WSO2 Oauth Plugin 1.0 and earlier does not invalidate the previous session on login. |
CVE-2023-33004 | Medium | 4.3 | 2023-05-16 | A missing permission check in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers with Overall/Read permission to reset profiler statistics. |
CVE-2023-33003 | Medium | 4.3 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers to reset profiler statistics. |
CVE-2023-33002 | Medium | 5.4 | 2023-05-16 | Jenkins TestComplete support Plugin 2.8.1 and earlier does not escape the TestComplete project name, resulting in a stored cross-site scripting (XSS) vulnerabi… |
CVE-2023-33001 | High | 7.5 | 2023-05-16 | Jenkins HashiCorp Vault Plugin 360.v0a_1c04cf807d and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode… |
CVE-2023-33000 | High | 7.5 | 2023-05-16 | Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.149 and earlier does not mask credentials displayed on the configuration form, increasing the pote… |
CVE-2023-32999 | Medium | 4.3 | 2023-05-16 | A missing permission check in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL… |
CVE-2023-32998 | High | 8.8 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers to connect to an attacker-specified URL and s… |
CVE-2023-32997 | High | 8.8 | 2023-05-16 | Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the previous session on login. |
CVE-2023-32996 | Medium | 4.3 | 2023-05-16 | A missing permission check in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST requ… |
CVE-2023-32995 | High | 8.8 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers to send an HTTP POST request wi… |
CVE-2023-32994 | Low | 3.7 | 2023-05-16 | Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOrange or the configur… |
CVE-2023-32993 | Medium | 4.8 | 2023-05-16 | Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configured IdP to retrieve… |
CVE-2023-32992 | High | 8.8 | 2023-05-16 | Missing permission checks in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to… |
CVE-2023-32991 | High | 8.8 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allows attackers to send an HTTP request to an a… |
CVE-2023-32990 | Medium | 6.5 | 2023-05-16 | A missing permission check in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers with Overall/Read permission to connect to an atta… |
CVE-2023-2740 | Low | 3.5 | 2023-05-16 | A vulnerability, which was classified as problematic, has been found in SourceCodester Guest Management System 1.0. Affected by this issue is some unknown func… |
CVE-2023-32989 | High | 8.8 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers to connect to an attacker-s… |
CVE-2023-32988 | Medium | 4.3 | 2023-05-16 | A missing permission check in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers with Overall/Read permission to enumerate credenti… |
CVE-2023-32987 | High | 8.8 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins Reverse Proxy Auth Plugin 1.7.4 and earlier allows attackers to connect to an attacker-specified L… |
CVE-2023-32986 | High | 8.8 | 2023-05-16 | Jenkins File Parameter Plugin 285.v757c5b_67a_c25 and earlier does not restrict the name (and resulting uploaded file name) of Stashed File Parameters, allowin… |
CVE-2023-32985 | Medium | 4.3 | 2023-05-16 | Jenkins Sidebar Link Plugin 2.2.1 and earlier does not restrict the path of files in a method implementing form validation, allowing attackers with Overall/Rea… |
CVE-2023-32984 | Medium | 5.4 | 2023-05-16 | Jenkins TestNG Results Plugin 730.v4c5283037693 and earlier does not escape several values that are parsed from TestNG report files and displayed on the plugin… |
CVE-2023-32983 | Medium | 5.3 | 2023-05-16 | Jenkins Ansible Plugin 204.v8191fd551eb_f and earlier does not mask extra variables displayed on the configuration form, increasing the potential for attackers… |
CVE-2023-32982 | Medium | 4.3 | 2023-05-16 | Jenkins Ansible Plugin 204.v8191fd551eb_f and earlier stores extra variables unencrypted in job config.xml files on the Jenkins controller where they can be vi… |
CVE-2023-32981 | High | 8.8 | 2023-05-16 | An arbitrary file write vulnerability in Jenkins Pipeline Utility Steps Plugin 2.15.2 and earlier allows attackers able to provide crafted archives as paramete… |
CVE-2023-32980 | Medium | 4.3 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins Email Extension Plugin allows attackers to make another user stop watching an attacker-specified j… |
CVE-2023-32979 | Medium | 4.3 | 2023-05-16 | Jenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to… |
CVE-2023-32978 | Medium | 4.3 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins LDAP Plugin allows attackers to connect to an attacker-specified LDAP server using attacker-specif… |
CVE-2023-32977 | Medium | 5.4 | 2023-05-16 | Jenkins Pipeline: Job Plugin does not escape the display name of the build that caused an earlier build to be aborted, resulting in a stored cross-site scripti… |
CVE-2023-31890 | Critical | 9.8 | 2023-05-16 | An XML Deserialization vulnerability in glazedlists v1.11.0 allows an attacker to execute arbitrary code via the BeanXMLByteCoder.decode() parameter. |
CVE-2023-2739 | Medium | 4.3 | 2023-05-16 | A vulnerability classified as problematic was found in Gira HomeServer up to 4.12.0.220829 beta. This vulnerability affects unknown code of the file /hslist. T… |
CVE-2023-28076 | Medium | 5.9 | 2023-05-16 | CloudLink 7.1.2 and all prior versions contain a broken or risky cryptographic algorithm vulnerability. An unauthenticated remote attacker could potentially e… |
CVE-2023-31857 | Critical | 9.8 | 2023-05-16 | Sourcecodester Online Computer and Laptop Store 1.0 allows unrestricted file upload and can lead to remote code execution. The vulnerability path is /classes/U… |
CVE-2023-31856 | Critical | 9.8 | 2023-05-16 | A command injection vulnerability in the hostTime parameter in the function NTPSyncWithHostof TOTOLINK CP300+ V5.2cu.7594_B20200910 allows attackers to execute… |
CVE-2023-31587 | Critical | 9.8 | 2023-05-16 | Tenda AC5 router V15.03.06.28 was discovered to contain a remote code execution (RCE) vulnerability via the Mac parameter at ip/goform/WriteFacMac. |
CVE-2023-31519 | Critical | 9.8 | 2023-05-16 | Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the email parameter at login_core.php. |
CVE-2023-2738 | Medium | 6.3 | 2023-05-16 | A vulnerability classified as critical has been found in Tongda OA 11.10. This affects the function actionGetdata of the file GatewayController.php. The manipu… |
CVE-2023-29439 | High | 7.1 | 2023-05-16 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in FooPlugins FooGallery plugin <= 2.2.35 versions. |
CVE-2023-31576 | High | 8.8 | 2023-05-16 | An arbitrary file upload vulnerability in Serendipity 2.4-beta1 allows attackers to execute arbitrary code via a crafted HTML or Javascript file. |
CVE-2023-31572 | High | 8.8 | 2023-05-16 | An issue in Bludit 4.0.0-rc-2 allows authenticated attackers to change the Administrator password and escalate privileges via a crafted request. |
CVE-2023-2730 | Medium | 5.4 | 2023-05-16 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3. |
CVE-2023-23720 | Medium | 5.9 | 2023-05-16 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in NetReviews SAS Verified Reviews (Avis Vérifiés) plugin <= 2.3.13 versions. |
CVE-2023-23709 | Medium | 6.5 | 2023-05-16 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Denis WPJAM Basic plugin <= 6.2.1 versions. |
CVE-2023-23703 | Medium | 6.5 | 2023-05-16 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Tyche Softwares Arconix Shortcodes plugin <= 2.1.7 versions. |
CVE-2023-23657 | Medium | 6.5 | 2023-05-16 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Richard Leishman t/a Webforward Mail Subscribe List plugin <= 2.1.9 versions. |
CVE-2023-23641 | Medium | 6.5 | 2023-05-16 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WPmanage Uji Popup plugin <= 1.4.3 versions. |
CVE-2023-2548 | Medium | 6.6 | 2023-05-16 | The RegistrationMagic plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 5.2.0.5. This is due to the plu… |
CVE-2023-2499 | Critical | 9.8 | 2023-05-16 | The RegistrationMagic plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.2.1.0. This is due to insufficient verifi… |
CVE-2023-23727 | Medium | 5.9 | 2023-05-16 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Formilla Live Chat by Formilla plugin <= 1.3 versions. |
CVE-2023-23676 | Medium | 6.5 | 2023-05-16 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Bruno "Aesqe" Babic File Gallery plugin <= 1.8.5.3 versions. |
CVE-2023-23673 | Medium | 5.9 | 2023-05-16 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Harish Chouhan, Themeist I Recommend This plugin <= 3.8.3 versions. |
CVE-2023-32956 | Critical | 9.8 | 2023-05-16 | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in CGI component in Synology Router Manager (SRM) befo… |
CVE-2023-32955 | High | 8.1 | 2023-05-16 | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DHCP Client Functionality in Synology Router Manage… |
CVE-2023-2161 | Medium | 5.0 | 2023-05-16 | A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized read access to the file system when a mali… |
CVE-2023-2710 | Medium | 6.1 | 2023-05-16 | The video carousel slider with lightbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter in versions up to, a… |
CVE-2023-2708 | Medium | 6.1 | 2023-05-16 | The Video Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘search_term’ parameter in versions up to, and including, 1.0.10… |
CVE-2023-29961 | Critical | 9.8 | 2023-05-16 | D-Link DIR-605L firmware version 1.17B01 BETA is vulnerable to stack overflow via /goform/formTcpipSetup, |
CVE-2023-31131 | High | 7.4 | 2023-05-15 | Greenplum Database (GPDB) is an open source data warehouse based on PostgreSQL. In versions prior to 6.22.3 Greenplum Database used an unsafe methods to extrac… |
CVE-2023-2700 | Medium | 5.5 | 2023-05-15 | A vulnerability was found in libvirt. This security flaw ouccers due to repeatedly querying an SR-IOV PCI device's capabilities that exposes a memory leak caus… |
CVE-2023-2124 | High | 7.8 | 2023-05-15 | An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure (with a dirty log journal… |
CVE-2023-21118 | Medium | 5.5 | 2023-05-15 | In unflattenString8 of Sensor.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with n… |
CVE-2023-21117 | High | 7.8 | 2023-05-15 | In registerReceiverWithFeature of ActivityManagerService.java, there is a possible way for isolated processes to register a broadcast receiver due to a permiss… |
CVE-2023-21116 | Medium | 6.7 | 2023-05-15 | In verifyReplacingVersionCode of InstallPackageHelper.java, there is a possible way to downgrade system apps below system image version due to a logic error in… |
CVE-2023-21112 | Medium | 5.5 | 2023-05-15 | In AnalyzeMfcResp of NxpMfcReader.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure wit… |
CVE-2023-21111 | Medium | 5.5 | 2023-05-15 | In several functions of PhoneAccountRegistrar.java, there is a possible way to prevent an access to emergency services due to improper input validation. This c… |
CVE-2023-21110 | High | 7.8 | 2023-05-15 | In several functions of SnoozeHelper.java, there is a possible way to grant notifications access due to resource exhaustion. This could lead to local escalatio… |
CVE-2023-21109 | High | 7.8 | 2023-05-15 | In multiple places of AccessibilityService, there is a possible way to hide the app from the user due to a logic error in the code. This could lead to local es… |
CVE-2023-21107 | High | 7.8 | 2023-05-15 | In retrieveAppEntry of NotificationAccessDetails.java, there is a missing permission check. This could lead to local escalation of privilege across user bounda… |
CVE-2023-21106 | High | 7.8 | 2023-05-15 | In adreno_set_param of adreno_gpu.c, there is a possible memory corruption due to a double free. This could lead to local escalation of privilege with no addit… |
CVE-2023-21104 | Medium | 5.5 | 2023-05-15 | In applySyncTransaction of WindowOrganizer.java, a missing permission check could lead to local information disclosure with no additional execution privileges… |
CVE-2023-21103 | Medium | 5.5 | 2023-05-15 | In registerPhoneAccount of PhoneAccountRegistrar.java, uncaught exceptions in parsing persisted user data could lead to local persistent denial of service with… |
CVE-2023-21102 | High | 7.8 | 2023-05-15 | In __efi_rt_asm_wrapper of efi-rt-wrapper.S, there is a possible bypass of shadow stack protection due to a logic error in the code. This could lead to local e… |
CVE-2023-20930 | Medium | 5.5 | 2023-05-15 | In pushDynamicShortcut of ShortcutPackage.java, there is a possible way to get the device into a boot loop due to resource exhaustion. This could lead to local… |
CVE-2023-20914 | Medium | 5.5 | 2023-05-15 | In onSetRuntimePermissionGrantStateByDeviceAdmin of AdminRestrictedPermissionsUtils.java, there is a possible way for the work profile to read SMS messages due… |
CVE-2023-20726 | Low | 3.3 | 2023-05-15 | In mnld, there is a possible leak of GPS location due to a missing permission check. This could lead to local information disclosure with no additional executi… |
CVE-2023-20722 | Medium | 6.7 | 2023-05-15 | In m4u, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privil… |
CVE-2023-20721 | Medium | 6.7 | 2023-05-15 | In isp, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privil… |
CVE-2023-20720 | Medium | 6.7 | 2023-05-15 | In pqframework, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with System execution pr… |
CVE-2023-20719 | Medium | 4.4 | 2023-05-15 | In pqframework, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution pri… |
CVE-2023-20718 | Medium | 6.7 | 2023-05-15 | In vcu, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20717 | Medium | 4.1 | 2023-05-15 | In vcu, there is a possible leak of dma buffer due to a race condition. This could lead to local information disclosure with System execution privileges needed… |
CVE-2023-20711 | Medium | 4.4 | 2023-05-15 | In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution priv… |
CVE-2023-20710 | Medium | 4.4 | 2023-05-15 | In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution priv… |
CVE-2023-20709 | Medium | 4.4 | 2023-05-15 | In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution priv… |
CVE-2023-20708 | Medium | 6.7 | 2023-05-15 | In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with System execution pri… |
CVE-2023-20707 | Medium | 6.7 | 2023-05-15 | In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20706 | Medium | 5.5 | 2023-05-15 | In apu, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution priv… |
CVE-2023-20705 | Medium | 5.5 | 2023-05-15 | In apu, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution priv… |