2023 CVEs (page 24)
Page 24 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-52922 | High | 7.8 | 2024-11-28 | In the Linux kernel, the following vulnerability has been resolved: can: bcm: Fix UAF in bcm_proc_show() BUG: KASAN: slab-use-after-free in bcm_proc_show+0x9… |
CVE-2023-29001 | High | 7.5 | 2024-11-27 | Contiki-NG is an open-source, cross-platform operating system for IoT devices. The Contiki-NG operating system processes source routing headers (SRH) in its tw… |
CVE-2023-2142 | Medium | 6.1 | 2024-11-26 | In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality. If there are two… |
CVE-2023-1521 | High | 7.8 | 2024-11-26 | On Linux the sccache client can execute arbitrary code with the privileges of a local sccache server, by preloading the code in a shared library passed to LD_P… |
CVE-2023-0163 | High | 8.4 | 2024-11-26 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Mozilla Convict. This allows an attacker to inject… |
CVE-2023-45181 | Medium | 6.1 | 2024-11-25 | IBM Jazz Foundation 7.0.2 and below are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI th… |
CVE-2023-26280 | Medium | 5.3 | 2024-11-25 | IBM Jazz Foundation 7.0.2 and 7.0.3 could allow a user to change their dashboard using a specially crafted HTTP request due to improper access control. |
CVE-2023-7299 | Medium | 6.3 | 2024-11-23 | A vulnerability was found in DataGear up to 4.60. It has been declared as critical. This vulnerability affects unknown code of the file /dataSet/resolveSql. Th… |
CVE-2023-52335 | High | 7.5 | 2024-11-22 | Advantech iView ConfigurationServlet SQL Injection Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive infor… |
CVE-2023-52334 | Medium | 6.5 | 2024-11-22 | Allegra downloadAttachmentGlobal Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive inf… |
CVE-2023-52333 | High | 7.3 | 2024-11-22 | Allegra saveFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected inst… |
CVE-2023-52332 | High | 7.5 | 2024-11-22 | Allegra serveMathJaxLibraries Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive inform… |
CVE-2023-51648 | Medium | 6.5 | 2024-11-22 | Allegra getFileContentAsString Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive infor… |
CVE-2023-51647 | Medium | 4.7 | 2024-11-22 | Allegra saveInlineEdit Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affecte… |
CVE-2023-51646 | Medium | 4.7 | 2024-11-22 | Allegra uploadSimpleFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affec… |
CVE-2023-51645 | Medium | 4.7 | 2024-11-22 | Allegra unzipFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected ins… |
CVE-2023-51644 | High | 7.3 | 2024-11-22 | Allegra SiteConfigAction Improper Access Control Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2023-51643 | Medium | 4.7 | 2024-11-22 | Allegra uploadFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected in… |
CVE-2023-51642 | Medium | 6.3 | 2024-11-22 | Allegra loadFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary c… |
CVE-2023-51641 | Medium | 6.3 | 2024-11-22 | Allegra renderFieldMatch Deserialization of Unstrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar… |
CVE-2023-51640 | Medium | 4.7 | 2024-11-22 | Allegra extarctZippedFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affe… |
CVE-2023-51639 | Critical | 9.8 | 2024-11-22 | Allegra downloadExportedChart Directory Traversal Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on a… |
CVE-2023-51638 | Critical | 9.8 | 2024-11-22 | Allegra Hard-coded Credentials Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installatio… |
CVE-2023-51635 | High | 8.8 | 2024-11-22 | NETGEAR RAX30 fing_dil Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitra… |
CVE-2023-51634 | High | 7.5 | 2024-11-22 | NETGEAR RAX30 Improper Certificate Validation Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to compromise the integ… |
CVE-2023-39470 | High | 7.2 | 2024-11-22 | PaperCut NG print.script.sandboxed Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitr… |
CVE-2023-24467 | High | 8.8 | 2024-11-22 | Possible Command Injection in iManager GET parameter has been discovered in OpenText™ iManager 3.2.6.0000. |
CVE-2023-24466 | High | 7.5 | 2024-11-22 | Possible XML External Entity Injection in iManager GET parameter has been discovered in OpenText™ iManager 3.2.6.0200. |
CVE-2023-27609 | Medium | 5.9 | 2024-11-19 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in NetTantra WP Roles at Registration allows Stored X… |
CVE-2023-21270 | High | 7.8 | 2024-11-19 | In restorePermissionState of PermissionManagerServiceImpl.java, there is a possible way for an app to keep permissions that should be revoked due to incorrect… |
CVE-2023-52921 | High | 7.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix possible UAF in amdgpu_cs_pass1() Since the gang_size check is outside of… |
CVE-2023-49952 | High | 7.5 | 2024-11-18 | Mastodon 4.1.x before 4.1.17 and 4.2.x before 4.2.9 allows a bypass of rate limiting via a crafted HTTP request header. |
CVE-2023-39180 | Medium | 4.0 | 2024-11-18 | A flaw was found within the handling of SMB2_READ commands in the kernel ksmbd module. The issue results from not releasing memory after its effective lifetime… |
CVE-2023-39179 | High | 7.5 | 2024-11-18 | A flaw was found within the handling of SMB2 read requests in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied da… |
CVE-2023-39176 | Medium | 5.8 | 2024-11-18 | A flaw was found within the parsing of SMB2 requests that have a transform header in the kernel ksmbd module. The issue results from the lack of proper validat… |
CVE-2023-43091 | Critical | 9.8 | 2024-11-17 | A flaw was found in GNOME Maps, which is vulnerable to a code injection attack via its service.json configuration file. If the configuration file is malicious… |
CVE-2023-6110 | Medium | 5.5 | 2024-11-17 | A flaw was found in OpenStack. When a user tries to delete a non-existing access rule in it's scope, it deletes other existing access rules which are not assoc… |
CVE-2023-4639 | High | 7.4 | 2024-11-17 | A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacke… |
CVE-2023-1419 | Medium | 5.9 | 2024-11-17 | A script injection vulnerability was found in the Debezium database connector, where it does not properly sanitize some parameters. This flaw allows an attacke… |
CVE-2023-0657 | Low | 3.4 | 2024-11-17 | A flaw was found in Keycloak. This issue occurs due to improperly enforcing token types when validating signatures locally. This could allow an authenticated a… |
CVE-2023-20094 | Medium | 4.3 | 2024-11-15 | A vulnerability in Cisco TelePresence CE and RoomOS could allow an unauthenticated, adjacent attacker to view sensitive information on an affected device. T… |
CVE-2023-20093 | Medium | 4.4 | 2024-11-15 | Three vulnerabilities in the CLI of Cisco TelePresence CE and RoomOS could allow an authenticated, local attacker to overwrite arbitrary files on the local fil… |
CVE-2023-20092 | Medium | 4.4 | 2024-11-15 | Three vulnerabilities in the CLI of Cisco TelePresence CE and RoomOS could allow an authenticated, local attacker to overwrite arbitrary files on the local fil… |
CVE-2023-20091 | Medium | 5.1 | 2024-11-15 | A vulnerability in the CLI of Cisco TelePresence CE and RoomOS could allow an authenticated, local attacker to overwrite arbitrary files on the local file syst… |
CVE-2023-20090 | Medium | 6.7 | 2024-11-15 | A vulnerability in Cisco TelePresence CE and RoomOS could allow an authenticated, local attacker to elevate privileges to root on an affected device. This v… |
CVE-2023-20060 | Medium | 6.1 | 2024-11-15 | A vulnerability in the web-based management interface of Cisco Prime Collaboration Deployment could allow an unauthenticated, remote attacker to conduct a cros… |
CVE-2023-20039 | Medium | 5.5 | 2024-11-15 | A vulnerability in Cisco IND could allow an authenticated, local attacker to read application data. This vulnerability is due to insufficient default file p… |
CVE-2023-20036 | Critical | 9.9 | 2024-11-15 | A vulnerability in the web UI of Cisco IND could allow an authenticated, remote attacker to execute arbitrary commands with administrative privileges on the un… |
CVE-2023-20004 | Medium | 4.4 | 2024-11-15 | Three vulnerabilities in the CLI of Cisco TelePresence CE and RoomOS could allow an authenticated, local attacker to overwrite arbitrary files on the local fil… |
CVE-2023-20154 | Critical | 9.1 | 2024-11-15 | A vulnerability in the external authentication mechanism of Cisco Modeling Labs could allow an unauthenticated, remote attacker to access the web interface wit… |
CVE-2023-20125 | High | 8.6 | 2024-11-15 | A vulnerability in the local interface of Cisco BroadWorks Network Server could allow an unauthenticated, remote attacker to exhaust system resources, causing… |
CVE-2023-4679 | Medium | 5.5 | 2024-11-15 | A use after free vulnerability exists in GPAC version 2.3-DEV-revrelease, specifically in the gf_filterpacket_del function in filter_core/filter.c at line 38… |
CVE-2023-2332 | Medium | 4.8 | 2024-11-15 | A stored Cross-site Scripting (XSS) vulnerability exists in the Conditions tab of Pricing Rules in pimcore/pimcore versions 10.5.19. The vulnerability is prese… |
CVE-2023-0737 | Medium | 6.5 | 2024-11-15 | wallabag version 2.5.2 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to arbitrarily delete user accounts via the /account/de… |
CVE-2023-0109 | Medium | 5.4 | 2024-11-15 | A stored cross-site scripting (XSS) vulnerability was discovered in usememos/memos version 0.9.1. This vulnerability allows an attacker to upload a JavaScript… |
CVE-2023-4458 | Medium | 4.0 | 2024-11-14 | A flaw was found within the parsing of extended attributes in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied da… |
CVE-2023-4134 | Medium | 5.5 | 2024-11-14 | A use-after-free vulnerability was found in the cyttsp4_core driver in the Linux kernel. This issue occurs in the device cleanup routine due to a possible rear… |
CVE-2023-34049 | Medium | 6.7 | 2024-11-14 | The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an att… |
CVE-2023-38920 | Medium | 4.8 | 2024-11-13 | Cross Site Scripting vulnerability in Cyber Cafe Management System v.1.0 allows a local attacker to execute arbitrary code via a crafted script to the adminnam… |
CVE-2023-35686 | High | 7.8 | 2024-11-13 | In PVRSRVRGXKickTA3DKM of rgxta3d.c, there is a possible arbitrary code execution due to improper input validation. This could lead to local escalation of priv… |
CVE-2023-35659 | High | 7.8 | 2024-11-13 | In DevmemIntChangeSparse of devicemem_server.c, there is a possible arbitrary code execution due to a logic error in the code. This could lead to local escalat… |
CVE-2023-52268 | Critical | 9.1 | 2024-11-12 | The End-User Portal module before 1.0.65 for FreeScout sometimes allows an attacker to authenticate as an arbitrary user because a session token can be sent to… |
CVE-2023-50176 | High | 7.5 | 2024-11-12 | A session fixation in Fortinet FortiOS version 7.4.0 through 7.4.3 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.13 allows attacker to execute unauthorized cod… |
CVE-2023-47543 | Medium | 5.4 | 2024-11-12 | An authorization bypass through user-controlled key vulnerability [CWE-639] in Fortinet FortiPortal version 7.0.0 through 7.0.3 allows an authenticated attacke… |
CVE-2023-44255 | Medium | 4.1 | 2024-11-12 | An exposure of sensitive information to an unauthorized actor [CWE-200] in Fortinet FortiManager before 7.4.2, FortiAnalyzer before 7.4.2 and FortiAnalyzer-Big… |
CVE-2023-32736 | High | 7.3 | 2024-11-12 | A vulnerability has been identified in SIMATIC S7-PLCSIM V16 (All versions), SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 Safety V16 (All versions), SI… |
CVE-2023-40457 | | 2024-11-11 | The BGP daemon in Extreme Networks ExtremeXOS (aka EXOS) 30.7.1.1 allows an attacker (who is not on a directly connected network) to cause a denial of service… | |
CVE-2023-27195 | Critical | 9.8 | 2024-11-08 | Trimble TM4Web 22.2.0 allows unauthenticated attackers to access /inc/tm_ajax.msw?func=UserfromUUID&uuid= to retrieve the last registration access code and use… |
CVE-2023-1973 | High | 7.5 | 2024-11-07 | A flaw was found in Undertow package. Using the FormAuthenticationMechanism, a malicious user could trigger a Denial of Service by sending crafted requests, le… |
CVE-2023-1932 | Medium | 6.1 | 2024-11-07 | A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can b… |
CVE-2023-29126 | Medium | 4.2 | 2024-11-05 | The Waybox Enel X web management application contains a PHP-type juggling vulnerability that may allow a brute force process and under certain conditions bypas… |
CVE-2023-29125 | Critical | 9.0 | 2024-11-05 | A heap buffer overflow could be triggered by sending a specific packet to TCP port 7700. |
CVE-2023-29122 | Medium | 6.7 | 2024-11-05 | Under certain conditions, access to service libraries is granted to account they should not have access to. |
CVE-2023-29121 | Critical | 9.6 | 2024-11-05 | Waybox Enel TCF Agent service could be used to get administrator’s privileges over the Waybox system. |
CVE-2023-29120 | Critical | 9.6 | 2024-11-05 | Waybox Enel X web management application could be used to execute arbitrary OS commands and provide administrator’s privileges over the Waybox system. |
CVE-2023-29119 | Critical | 9.6 | 2024-11-05 | Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/dbstore.php. |
CVE-2023-29118 | Critical | 9.6 | 2024-11-05 | Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/versions.php. |
CVE-2023-29117 | High | 8.8 | 2024-11-05 | Waybox Enel X web management API authentication could be bypassed and provide administrator’s privileges over the Waybox system. |
CVE-2023-29116 | Medium | 4.3 | 2024-11-05 | Under certain conditions, through a request directed to the Waybox Enel X web management application, information like Waybox OS version or service configurati… |
CVE-2023-29115 | Medium | 6.5 | 2024-11-05 | In certain conditions a request directed to the Waybox Enel X Web management application could cause a denial-of-service (e.g. reboot). |
CVE-2023-29114 | Medium | 5.7 | 2024-11-05 | System logs could be accessed through web management application due to a lack of access control. An attacker can obtain the following sensitive information… |
CVE-2023-52920 | High | 7.8 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: bpf: support non-r10 register spill/fill to/from stack in precision tracking Use instruct… |
CVE-2023-34445 | High | 8.8 | 2024-11-05 | Combodo iTop is a simple, web based IT Service Management tool. When displaying pages/ajax.render.php XSS are possible for scripts outside of script tags. This… |
CVE-2023-34444 | High | 8.8 | 2024-11-05 | Combodo iTop is a simple, web based IT Service Management tool. When displaying pages/ajax.searchform.php XSS are possible for scripts outside of script tags… |
CVE-2023-34443 | High | 8.8 | 2024-11-05 | Combodo iTop is a simple, web based IT Service Management tool. When displaying page Run queries Cross-site Scripting (XSS) are possible for scripts outside of… |
CVE-2023-52045 | Medium | 6.1 | 2024-10-31 | Studio-42 eLfinder 2.1.62 contains a filename restriction bypass leading to a persistent Cross-site Scripting (XSS) vulnerability. |
CVE-2023-52044 | Critical | 9.8 | 2024-10-31 | Studio-42 eLfinder 2.1.62 is vulnerable to Remote Code Execution (RCE) as there is no restriction for uploading files with the .php8 extension. |
CVE-2023-52066 | High | 7.2 | 2024-10-30 | http.zig commit 76cf5 was discovered to contain a CRLF injection vulnerability via the url parameter. |
CVE-2023-5816 | Medium | 4.9 | 2024-10-30 | The Code Explorer plugin for WordPress is vulnerable to arbitrary external file reading in all versions up to, and including, 1.4.5. This is due to the fact th… |
CVE-2023-26248 | Medium | 5.3 | 2024-10-25 | The Kademlia DHT (go-libp2p-kad-dht 0.20.0 and earlier) used in IPFS (0.18.1 and earlier) assigns routing information for content (i.e., information about who… |
CVE-2023-50355 | Low | 3.6 | 2024-10-23 | HCL Sametime is impacted by the error messages containing sensitive information. An attacker can use this information to launch another, more focused attack. |
CVE-2023-50310 | Medium | 4.9 | 2024-10-23 | IBM CICS Transaction Gateway for Multiplatforms 9.2 and 9.3 transmits or stores authentication credentials, but it uses an insecure method that is susceptible… |
CVE-2023-52919 | Medium | 5.5 | 2024-10-22 | In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix possible NULL pointer dereference in send_acknowledge() Handle memory alloc… |
CVE-2023-52918 | Medium | 5.5 | 2024-10-22 | In the Linux kernel, the following vulnerability has been resolved: media: pci: cx23885: check cx23885_vdev_init() return cx23885_vdev_init() can return a NU… |
CVE-2023-6243 | Medium | 4.3 | 2024-10-19 | The EventON PRO - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including… |
CVE-2023-6080 | High | 7.8 | 2024-10-18 | Lakeside Software’s SysTrack LsiAgent Installer version 10.7.8 for Windows contains a local privilege escalation vulnerability which allows attackers SYSTEM le… |
CVE-2023-49570 | High | 7.4 | 2024-10-18 | A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software trusts a certificate issued by an entity that… |
CVE-2023-6058 | Medium | 6.8 | 2024-10-18 | A vulnerability has been identified in Bitdefender Safepay's handling of HTTPS connections. The issue arises when the product blocks a connection due to an unt… |
CVE-2023-6057 | High | 7.4 | 2024-10-18 | A vulnerability has been discovered in Bitdefender Total Security HTTPS scanning functionality that results in the improper trust of certificates issued using… |
CVE-2023-6056 | High | 7.4 | 2024-10-18 | A vulnerability has been discovered in Bitdefender Total Security HTTPS scanning functionality that results in the improper trust of self-signed certificates… |