2023 CVEs (page 244)
Page 244 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-22361 | Medium | 6.5 | 2023-05-10 | Improper privilege management vulnerability in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier allows a remote authenticated attacker to alter a WebUI pa… |
CVE-2023-32570 | Medium | 5.9 | 2023-05-10 | VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit. |
CVE-2023-32569 | High | 7.2 | 2023-05-10 | An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2.800 and 8.x before 8.0.410. The InfoScale VIOM web application is vulnerabl… |
CVE-2023-32568 | High | 7.2 | 2023-05-10 | An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2.800 and 8.x before 8.0.410. The VIOM web application does not validate user… |
CVE-2023-2616 | Medium | 5.4 | 2023-05-10 | Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21. |
CVE-2023-26126 | High | 7.5 | 2023-05-10 | All versions of the package m.static are vulnerable to Directory Traversal due to improper input sanitization of the path being requested via the requestFile f… |
CVE-2023-25833 | Medium | 5.4 | 2023-05-10 | There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.0 and below that may allow a remote, authenticated attacker to create a crafted… |
CVE-2023-31478 | High | 7.5 | 2023-05-09 | An issue was discovered on GL.iNet devices before 3.216. An API endpoint reveals information about the Wi-Fi configuration, including the SSID and key. |
CVE-2023-2610 | High | 7.8 | 2023-05-09 | Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532. |
CVE-2023-2156 | High | 7.5 | 2023-05-09 | A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol. This issue results from the lack of proper handling o… |
CVE-2023-28318 | Medium | 5.3 | 2023-05-09 | A vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of the Message_KeepHistory or Message_ShowDeletedStatus server conf… |
CVE-2023-28317 | Medium | 5.3 | 2023-05-09 | A vulnerability has been discovered in Rocket.Chat, where editing messages can change the original timestamp, causing the UI to display messages in an incorrec… |
CVE-2023-28316 | Critical | 9.8 | 2023-05-09 | A security vulnerability has been discovered in the implementation of 2FA on the rocket.chat platform, where other active sessions are not invalidated upon act… |
CVE-2023-28128 | High | 7.2 | 2023-05-09 | An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove… |
CVE-2023-28127 | High | 7.5 | 2023-05-09 | A path traversal vulnerability exists in Avalanche version 6.3.x and below that when exploited could result in possible information disclosure. |
CVE-2023-28126 | Medium | 5.9 | 2023-05-09 | An authentication bypass vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to gain access by exploiting the SetUser metho… |
CVE-2023-28125 | Medium | 5.9 | 2023-05-09 | An improper authentication vulnerability exists in Avalanche Premise versions 6.3.x and below that could allow an attacker to gain access to the server by regi… |
CVE-2023-30057 | Medium | 5.4 | 2023-05-09 | Multiple stored cross-site scripting (XSS) vulnerabilities in FICO Origination Manager Decision Module 4.8.1 allow attackers to execute arbitrary web scripts o… |
CVE-2023-30056 | High | 7.5 | 2023-05-09 | A session takeover vulnerability exists in FICO Origination Manager Decision Module 4.8.1 due to insufficient protection of the JSESSIONID cookie. |
CVE-2023-25832 | High | 8.8 | 2023-05-09 | There is a cross-site-request forgery vulnerability in Esri Portal for ArcGIS Versions 11.0 and below that may allow an attacker to trick an authorized user in… |
CVE-2023-25831 | Medium | 6.1 | 2023-05-09 | There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1and below which may allow a remote, unauthenticated attacker to create a crafte… |
CVE-2023-20524 | High | 7.5 | 2023-05-09 | An attacker with a compromised ASP could possibly send malformed commands to an ASP on another CPU, resulting in an out of bounds write, potentially leading to… |
CVE-2023-20520 | Critical | 9.8 | 2023-05-09 | Improper access control settings in ASP Bootloader may allow an attacker to corrupt the return address causing a stack-based buffer overrun potentially leading… |
CVE-2023-31474 | High | 7.5 | 2023-05-09 | An issue was discovered on GL.iNet devices before 3.216. Through the software installation feature, it is possible to inject arbitrary parameters in a request… |
CVE-2023-31472 | High | 7.5 | 2023-05-09 | An issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty file can be created anywhere on the filesystem. Thi… |
CVE-2023-2609 | Medium | 5.5 | 2023-05-09 | NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531. |
CVE-2023-29343 | High | 7.8 | 2023-05-09 | SysInternals Sysmon for Windows Elevation of Privilege Vulnerability |
CVE-2023-29341 | High | 7.8 | 2023-05-09 | AV1 Video Extension Remote Code Execution Vulnerability |
CVE-2023-29340 | High | 7.8 | 2023-05-09 | AV1 Video Extension Remote Code Execution Vulnerability |
CVE-2023-29338 | Medium | 6.6 | 2023-05-09 | Visual Studio Code Spoofing Vulnerability |
CVE-2023-29336 | High | 7.8 | 2023-05-09 | Win32k Elevation of Privilege Vulnerability |
CVE-2023-29335 | High | 7.5 | 2023-05-09 | Microsoft Word Security Feature Bypass Vulnerability |
CVE-2023-29333 | Low | 3.3 | 2023-05-09 | Microsoft Access Denial of Service Vulnerability |
CVE-2023-29325 | High | 8.1 | 2023-05-09 | Windows OLE Remote Code Execution Vulnerability |
CVE-2023-29324 | Medium | 6.5 | 2023-05-09 | Windows MSHTML Platform Security Feature Bypass Vulnerability |
CVE-2023-28290 | Medium | 5.3 | 2023-05-09 | Microsoft Remote Desktop app for Windows Information Disclosure Vulnerability |
CVE-2023-28283 | High | 8.1 | 2023-05-09 | Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability |
CVE-2023-28251 | Medium | 5.5 | 2023-05-09 | Windows Driver Revocation List Security Feature Bypass Vulnerability |
CVE-2023-24955 | High | 7.2 | 2023-05-09 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2023-24954 | Medium | 6.5 | 2023-05-09 | Microsoft SharePoint Server Information Disclosure Vulnerability |
CVE-2023-24953 | High | 7.8 | 2023-05-09 | Microsoft Excel Remote Code Execution Vulnerability |
CVE-2023-24950 | Medium | 6.5 | 2023-05-09 | Microsoft SharePoint Server Spoofing Vulnerability |
CVE-2023-24949 | High | 7.8 | 2023-05-09 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2023-24948 | High | 7.4 | 2023-05-09 | Windows Bluetooth Driver Elevation of Privilege Vulnerability |
CVE-2023-24947 | High | 8.8 | 2023-05-09 | Windows Bluetooth Driver Remote Code Execution Vulnerability |
CVE-2023-24946 | High | 7.8 | 2023-05-09 | Windows Backup Service Elevation of Privilege Vulnerability |
CVE-2023-24945 | Medium | 5.5 | 2023-05-09 | Windows iSCSI Target Service Information Disclosure Vulnerability |
CVE-2023-24944 | Medium | 6.5 | 2023-05-09 | Windows Bluetooth Driver Information Disclosure Vulnerability |
CVE-2023-24943 | Critical | 9.8 | 2023-05-09 | Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability |
CVE-2023-24942 | High | 7.5 | 2023-05-09 | Remote Procedure Call Runtime Denial of Service Vulnerability |
CVE-2023-24941 | Critical | 9.8 | 2023-05-09 | Windows Network File System Remote Code Execution Vulnerability |
CVE-2023-24940 | High | 7.5 | 2023-05-09 | Windows Pragmatic General Multicast (PGM) Denial of Service Vulnerability |
CVE-2023-24939 | High | 7.5 | 2023-05-09 | Server for NFS Denial of Service Vulnerability |
CVE-2023-24932 | Medium | 6.7 | 2023-05-09 | Secure Boot Security Feature Bypass Vulnerability |
CVE-2023-24905 | High | 7.8 | 2023-05-09 | Remote Desktop Client Remote Code Execution Vulnerability |
CVE-2023-24904 | High | 7.1 | 2023-05-09 | Windows Installer Elevation of Privilege Vulnerability |
CVE-2023-24903 | High | 8.1 | 2023-05-09 | Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability |
CVE-2023-24902 | High | 7.8 | 2023-05-09 | Win32k Elevation of Privilege Vulnerability |
CVE-2023-24901 | High | 7.5 | 2023-05-09 | Windows NFS Portmapper Information Disclosure Vulnerability |
CVE-2023-24900 | Medium | 5.9 | 2023-05-09 | Windows NTLM Security Support Provider Information Disclosure Vulnerability |
CVE-2023-24899 | High | 7.0 | 2023-05-09 | Windows Graphics Component Elevation of Privilege Vulnerability |
CVE-2023-24898 | High | 7.5 | 2023-05-09 | Windows SMB Denial of Service Vulnerability |
CVE-2023-20098 | Medium | 4.4 | 2023-05-09 | A vulnerability in the CLI of Cisco SDWAN vManage Software could allow an authenticated, local attacker to delete arbitrary files. This vulnerability is due… |
CVE-2023-20046 | High | 8.8 | 2023-05-09 | A vulnerability in the key-based SSH authentication feature of Cisco StarOS Software could allow an authenticated, remote attacker to elevate privileges on an… |
CVE-2023-25830 | Medium | 6.1 | 2023-05-09 | There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1and before which may allow a remote, unauthenticated attacker to create a craft… |
CVE-2023-25829 | Medium | 6.1 | 2023-05-09 | There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.0 and below that may allow a remote, unauthenticated attacker to craft a URL that c… |
CVE-2023-32071 | Critical | 9.0 | 2023-05-09 | XWiki Platform is a generic wiki platform. Starting in versions 2.2-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, it's possible to execute… |
CVE-2023-32069 | Critical | 9.9 | 2023-05-09 | XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-2 and prior to versions 14.10.4 and 15.0-rc-1, it's possible for a user to execute… |
CVE-2023-32066 | Medium | 5.4 | 2023-05-09 | Time Tracker is an open source time tracking system. The week view plugin in Time Tracker versions 1.22.11.5782 and prior was not escaping titles for notes in… |
CVE-2023-31807 | Medium | 5.4 | 2023-05-09 | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the personal notes… |
CVE-2023-31806 | Medium | 5.4 | 2023-05-09 | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the My Progress fu… |
CVE-2023-31805 | Medium | 4.8 | 2023-05-09 | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local authenticated attacker to execute arbitrary code via the homepage function. |
CVE-2023-31804 | Medium | 5.4 | 2023-05-09 | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the course category parameters. |
CVE-2023-31803 | Medium | 4.8 | 2023-05-09 | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the resource sequencing parameters. |
CVE-2023-31802 | Medium | 5.4 | 2023-05-09 | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skype and linedin_url parameters. |
CVE-2023-31801 | Medium | 6.1 | 2023-05-09 | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skills wheel parameter. |
CVE-2023-31800 | Medium | 5.4 | 2023-05-09 | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the forum title parameter. |
CVE-2023-31799 | Medium | 4.8 | 2023-05-09 | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the system annnouncements parameter. |
CVE-2023-31490 | High | 7.5 | 2023-05-09 | An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_attr_psid_sub() function. |
CVE-2023-31489 | Medium | 5.5 | 2023-05-09 | An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_capability_llgr() function. |
CVE-2023-31476 | High | 7.5 | 2023-05-09 | An issue was discovered on GL.iNet devices running firmware before 3.216. There is an arbitrary file write in which an empty file can be created almost anywher… |
CVE-2023-31144 | Medium | 6.1 | 2023-05-09 | Craft CMS is a content management system. Starting in version 3.0.0 and prior to versions 3.8.4 and 4.4.4, a malformed title in the feed widget can deliver a c… |
CVE-2023-30088 | Medium | 5.5 | 2023-05-09 | An issue found in Cesanta MJS v.1.26 allows a local attacker to cause a denial of service via the mjs_execute function in mjs.c. |
CVE-2023-30087 | Medium | 5.5 | 2023-05-09 | Buffer Overflow vulnerability found in Cesanta MJS v.1.26 allows a local attacker to cause a denial of service via the mjs_mk_string function in mjs.c. |
CVE-2023-30086 | Medium | 5.5 | 2023-05-09 | Buffer Overflow vulnerability found in Libtiff V.4.0.7 allows a local attacker to cause a denial of service via the tiffcp function in tiffcp.c. |
CVE-2023-30085 | Medium | 5.5 | 2023-05-09 | Buffer Overflow vulnerability found in Libming swftophp v.0.4.8 allows a local attacker to cause a denial of service via the cws2fws function in util/decompile… |
CVE-2023-30084 | Medium | 5.5 | 2023-05-09 | An issue found in libming swftophp v.0.4.8 allows a local attacker to cause a denial of service via the stackVal function in util/decompile.c. |
CVE-2023-30083 | Medium | 5.5 | 2023-05-09 | Buffer Overflow vulnerability found in Libming swftophp v.0.4.8 allows a local attacker to cause a denial of service via the newVar_N in util/decompile.c. |
CVE-2023-25834 | Medium | 5.4 | 2023-05-09 | Changes to user permissions in Portal for ArcGIS 10.9.1 and below are incompletely applied in specific use cases. This issue may allow users to access content… |
CVE-2023-32060 | Medium | 6.5 | 2023-05-09 | DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.35 branch and prior to versions 2.36.13… |
CVE-2023-31143 | Medium | 5.9 | 2023-05-09 | mage-ai is an open-source data pipeline tool for transforming and integrating data. Those who use Mage starting in version 0.8.34 and prior to 0.8.72 with user… |
CVE-2023-31139 | Medium | 4.3 | 2023-05-09 | DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.37 branch and prior to versions 2.37.9.1… |
CVE-2023-31138 | High | 7.1 | 2023-05-09 | DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.36 branch and prior to versions 2.37.9.1… |
CVE-2023-31982 | High | 7.8 | 2023-05-09 | Sngrep v1.6.0 was discovered to contain a heap buffer overflow via the function capture_packet_reasm_ip at /src/capture.c. |
CVE-2023-31981 | High | 7.8 | 2023-05-09 | Sngrep v1.6.0 was discovered to contain a stack buffer overflow via the function packet_set_payload at /src/packet.c. |
CVE-2023-31979 | High | 7.8 | 2023-05-09 | Catdoc v0.95 was discovered to contain a global buffer overflow via the function process_file at /src/reader.c. |
CVE-2023-31976 | High | 8.8 | 2023-05-09 | libming v0.4.8 was discovered to contain a stack buffer overflow via the function makeswf_preprocess at /util/makeswf_utils.c. |
CVE-2023-31973 | Medium | 5.5 | 2023-05-09 | yasm v1.3.0 was discovered to contain a use after free via the function expand_mmac_params at /nasm/nasm-pp.c. Note: Multiple third parties dispute this as a b… |
CVE-2023-31137 | High | 7.5 | 2023-05-09 | MaraDNS is open-source software that implements the Domain Name System (DNS). In version 3.5.0024 and prior, a remotely exploitable integer underflow vulnerabi… |
CVE-2023-31136 | Low | 3.7 | 2023-05-09 | PostgresNIO is a Swift client for PostgreSQL. Any user of PostgresNIO prior to version 1.14.2 connecting to servers with TLS enabled is vulnerable to a man-in-… |