2023 CVEs (page 26)
Page 26 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-30755 | Medium | 4.4 | 2024-09-10 | A vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) (All versions < V3.5.20), SIMATIC CP 1243-1 (incl. SIPLUS variants) (All ve… |
CVE-2023-2919 | Medium | 4.3 | 2024-09-10 | The Tutor LMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.4. This is due to missing or incorrect non… |
CVE-2023-28827 | Medium | 5.9 | 2024-09-10 | A vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) (All versions < V3.5.20), SIMATIC CP 1243-1 (incl. SIPLUS variants) (All ve… |
CVE-2023-50883 | Medium | 6.1 | 2024-09-09 | ONLYOFFICE Docs before 8.0.1 allows XSS because a macro is an immediately-invoked function expression (IIFE), and therefore a sandbox escape is possible by dir… |
CVE-2023-46809 | High | 7.4 | 2024-09-07 | Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the… |
CVE-2023-39333 | Medium | 5.3 | 2024-09-07 | Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that… |
CVE-2023-30587 | High | 7.5 | 2024-09-07 | A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module (node:ins… |
CVE-2023-30584 | High | 7.7 | 2024-09-07 | A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of pat… |
CVE-2023-30583 | High | 7.5 | 2024-09-07 | fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the `--allow-fs-read` flag in Node.js 20. This fl… |
CVE-2023-30582 | Medium | 5.3 | 2024-09-07 | A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a no… |
CVE-2023-51368 | Medium | 5.4 | 2024-09-06 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users… |
CVE-2023-51367 | Medium | 5.4 | 2024-09-06 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2023-51366 | High | 8.7 | 2024-09-06 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read th… |
CVE-2023-50366 | Medium | 4.3 | 2024-09-06 | A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow auth… |
CVE-2023-50360 | High | 8.8 | 2024-09-06 | A SQL injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to inject malicious co… |
CVE-2023-47563 | High | 7.4 | 2024-09-06 | An OS command injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to execute com… |
CVE-2023-45038 | Medium | 4.3 | 2024-09-06 | An improper authentication vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow users to compromise the securit… |
CVE-2023-39300 | High | 7.2 | 2024-09-06 | An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated administrators to execu… |
CVE-2023-39298 | High | 7.8 | 2024-09-06 | A missing authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow local aut… |
CVE-2023-34979 | Medium | 6.6 | 2024-09-06 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… |
CVE-2023-34974 | High | 8.8 | 2024-09-06 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to… |
CVE-2023-52916 | High | 7.8 | 2024-09-06 | In the Linux kernel, the following vulnerability has been resolved: media: aspeed: Fix memory overwrite if timing is 1600x900 When capturing 1600x900, system… |
CVE-2023-52915 | Medium | 5.5 | 2024-09-06 | In the Linux kernel, the following vulnerability has been resolved: media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer In af9035_i2c_mas… |
CVE-2023-51712 | Medium | 4.7 | 2024-09-05 | An issue was discovered in Trusted Firmware-M through 2.0.0. The lack of argument verification in the logging subsystem allows attackers to read sensitive data… |
CVE-2023-49233 | High | 8.8 | 2024-09-03 | Insufficient access checks in Visual Planning Admin Center 8 before v.1 Build 240207 allow attackers in possession of a non-administrative Visual Planning acco… |
CVE-2023-7279 | Low | 2.6 | 2024-09-02 | A vulnerability has been found in Secure Systems Engineering Connaisseur up to 3.3.0 and classified as problematic. This vulnerability affects unknown code of… |
CVE-2023-7256 | Medium | 4.4 | 2024-08-31 | In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo… |
CVE-2023-26324 | High | 8.8 | 2024-08-28 | A code execution vulnerability exists in the XiaomiGetApps application product. This vulnerability is caused by the verification logic being bypassed, and an a… |
CVE-2023-26323 | High | 7.6 | 2024-08-28 | A code execution vulnerability exists in the Xiaomi App market product. The vulnerability is caused by unsafe configuration and can be exploited by attackers t… |
CVE-2023-26322 | High | 8.8 | 2024-08-28 | A code execution vulnerability exists in the XiaomiGetApps application product. This vulnerability is caused by the verification logic being bypassed, and an a… |
CVE-2023-26321 | Medium | 6.3 | 2024-08-28 | A path traversal vulnerability exists in the Xiaomi File Manager application product(international version). The vulnerability is caused by unfiltered special… |
CVE-2023-43078 | Medium | 6.7 | 2024-08-28 | Dell Dock Firmware and Dell Client Platform contain an Improper Link Resolution vulnerability during installation resulting in arbitrary folder deletion, which… |
CVE-2023-45896 | High | 7.1 | 2024-08-28 | ntfs3 in the Linux kernel through 6.8.0 allows a physically proximate attacker to read kernel memory by mounting a filesystem (e.g., if a Linux distribution is… |
CVE-2023-49582 | Medium | 5.5 | 2024-08-26 | Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially r… |
CVE-2023-26315 | Medium | 6.5 | 2024-08-26 | The Xiaomi router AX9000 has a post-authentication command injection vulnerability. This vulnerability is caused by the lack of input filtering, allowing an at… |
CVE-2023-48957 | Medium | 5.3 | 2024-08-25 | PureVPN Linux client 2.0.2-Productions fails to properly handle DNS queries, allowing them to bypass the VPN tunnel and be sent directly to the ISP or default… |
CVE-2023-6987 | Medium | 6.1 | 2024-08-24 | The String locator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sql-column' parameter in all versions up to, and including, 2… |
CVE-2023-0926 | Medium | 4.4 | 2024-08-24 | The Custom Permalinks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.0 due to insufficient input sanit… |
CVE-2023-7260 | High | 7.5 | 2024-08-22 | Path Traversal vulnerability discovered in OpenText™ CX-E Voice, affecting all version through 22.4. The vulnerability could allow arbitrarily access files o… |
CVE-2023-6452 | Critical | 9.6 | 2024-08-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Web Security (Transaction Viewer) allows Store… |
CVE-2023-29929 | High | 7.5 | 2024-08-21 | Buffer Overflow vulnerability found in Kemptechnologies Loadmaster before v.7.2.60.0 allows a remote attacker to casue a denial of service via the libkemplink… |
CVE-2023-49198 | High | 7.5 | 2024-08-21 | Mysql security vulnerability in Apache SeaTunnel. Attackers can read files on the MySQL server by modifying the information in the MySQL URL allowLoadLocalI… |
CVE-2023-22576 | High | 7.0 | 2024-08-21 | Dell Repository Manager version 3.4.2 and earlier, contain a Local Privilege Escalation Vulnerability in Installation module. A local low privileged attacker m… |
CVE-2023-52914 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: io_uring/poll: add hash if ready poll request can't complete inline If we don't, then we… |
CVE-2023-52913 | High | 7.8 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential context UAFs gem_context_register() makes the context visible to… |
CVE-2023-52912 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fixed bug on error when unloading amdgpu Fixed bug on error when unloading am… |
CVE-2023-52911 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: drm/msm: another fix for the headless Adreno GPU Fix another oops reproducible when reboo… |
CVE-2023-52910 | High | 8.8 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: iommu/iova: Fix alloc iova overflows issue In __alloc_and_insert_iova_range, there is an… |
CVE-2023-52909 | High | 7.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix handling of cached open files in nfsd4_open codepath Commit fb70bf124b05 ("NFSD… |
CVE-2023-52908 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix potential NULL dereference Fix potential NULL dereference, in the case wh… |
CVE-2023-52907 | High | 7.8 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame() Fix a use-after-free… |
CVE-2023-52906 | High | 7.8 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: net/sched: act_mpls: Fix warning during failed attribute validation The 'TCA_MPLS_LABEL'… |
CVE-2023-52905 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix resource leakage in VF driver unbind resources allocated like mcam entr… |
CVE-2023-52904 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix possible NULL pointer dereference in snd_usb_pcm_has_fixed_rate() Th… |
CVE-2023-52903 | High | 7.8 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: io_uring: lock overflowing for IOPOLL syzbot reports an issue with overflow filling for I… |
CVE-2023-52902 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: nommu: fix memory leak in do_mmap() error path The preallocation of the maple tree nodes… |
CVE-2023-52901 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Check endpoint is valid before dereferencing it When the host controller is no… |
CVE-2023-52900 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix general protection fault in nilfs_btree_insert() If nilfs2 reads a corrupted… |
CVE-2023-52899 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: Add exception protection processing for vd in axi_chan_handle_err function Since there is… |
CVE-2023-52898 | Medium | 4.7 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: xhci: Fix null pointer dereference when host dies Make sure xhci_free_dev() and xhci_kill… |
CVE-2023-52897 | Medium | 4.7 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: do not warn on record without old_roots populated [BUG] There are some rep… |
CVE-2023-52896 | Medium | 4.7 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between quota rescan and disable leading to NULL pointer deref If we have… |
CVE-2023-52895 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: io_uring/poll: don't reissue in case of poll race on multishot request A previous commit… |
CVE-2023-52894 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate() In Google internal bug… |
CVE-2023-52893 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: gsmi: fix null-deref in gsmi_get_variable We can get EFI variables without fetching the a… |
CVE-2023-3419 | High | 7.2 | 2024-08-17 | The tagDiv Opt-In Builder plugin is vulnerable to Blind SQL Injection via the 'couponId' parameter of the 'recreate_stripe_subscription' REST API endpoint in v… |
CVE-2023-3416 | High | 7.2 | 2024-08-17 | The tagDiv Opt-In Builder plugin is vulnerable to Blind SQL Injection via the 'subscriptionCouponId' parameter via the 'create_stripe_subscription' REST API en… |
CVE-2023-0714 | High | 8.1 | 2024-08-17 | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in versions up to, and… |
CVE-2023-5505 | Medium | 6.8 | 2024-08-17 | The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.0.1 via the job-specific backup folder. This allows… |
CVE-2023-52889 | Medium | 5.5 | 2024-08-17 | In the Linux kernel, the following vulnerability has been resolved: apparmor: Fix null pointer deref when receiving skb during sock creation The panic below… |
CVE-2023-3409 | Medium | 5.4 | 2024-08-17 | The Bricks theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.1. This is due to missing or incorrect nonce v… |
CVE-2023-3408 | Medium | 4.3 | 2024-08-17 | The Bricks theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.1. This is due to missing or incorrect nonce v… |
CVE-2023-4730 | Medium | 5.3 | 2024-08-17 | The LadiApp plugn for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the init_endpoint() function hooked via… |
CVE-2023-4604 | Medium | 6.1 | 2024-08-17 | The Slideshow, Image Slider by 2J plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘post’ parameter in versions up to, and includin… |
CVE-2023-4507 | Medium | 6.1 | 2024-08-17 | The Admission AppManager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'q' parameter in versions up to, and including, 1.0.0 due… |
CVE-2023-4027 | Medium | 5.3 | 2024-08-17 | The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_settings function in v… |
CVE-2023-4025 | Medium | 5.3 | 2024-08-17 | The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_player function in ver… |
CVE-2023-4024 | Medium | 5.3 | 2024-08-17 | The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_player function in ver… |
CVE-2023-1604 | Medium | 4.7 | 2024-08-17 | The Short URL plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.8. This is due to missing or incorrect non… |
CVE-2023-47728 | Medium | 6.5 | 2024-08-16 | IBM QRadar Suite Software 1.10.12.0 through 1.10.22.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow a remote attacker to obtain sensiti… |
CVE-2023-7049 | Medium | 4.3 | 2024-08-16 | The Custom Field For WP Job Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2 via the th… |
CVE-2023-50314 | Medium | 5.3 | 2024-08-14 | IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.8 could allow an attacker with access to the network to conduct spoofing attacks. An attacker… |
CVE-2023-50315 | Medium | 5.3 | 2024-08-14 | IBM WebSphere Application Server 8.5 and 9.0 could allow an attacker with access to the network to conduct spoofing attacks. An attacker could exploit this vu… |
CVE-2023-49144 | Medium | 6.7 | 2024-08-14 | Out of bounds read in OpenBMC Firmware for some Intel(R) Server Platforms before versions egs-1.15-0, bhs-0.27 may allow a privileged user to potentially enabl… |
CVE-2023-49141 | High | 7.8 | 2024-08-14 | Improper isolation in some Intel(R) Processors stream cache mechanism may allow an authenticated user to potentially enable escalation of privilege via local a… |
CVE-2023-48361 | Low | 2.3 | 2024-08-14 | Improper initialization in firmware for some Intel(R) CSME may allow a privileged user to potentially enable information disclosure via local access. |
CVE-2023-43747 | Medium | 6.7 | 2024-08-14 | Incorrect default permissions for some Intel(R) Connectivity Performance Suite software installers before version 2.0 may allow an authenticated user to potent… |
CVE-2023-43489 | Medium | 5.5 | 2024-08-14 | Improper access control for some Intel(R) CIP software before version 2.4.10717 may allow an authenticated user to potentially enable denial of service via loc… |
CVE-2023-42667 | High | 7.8 | 2024-08-14 | Improper isolation in the Intel(R) Core(TM) Ultra Processor stream cache mechanism may allow an authenticated user to potentially enable escalation of privileg… |
CVE-2023-40067 | Medium | 5.7 | 2024-08-14 | Unchecked return value in firmware for some Intel(R) CSME may allow an unauthenticated user to potentially enable escalation of privilege via physical access. |
CVE-2023-38655 | Medium | 6.8 | 2024-08-14 | Improper buffer restrictions in firmware for some Intel(R) AMT and Intel(R) Standard Manageability may allow a privileged user to potentially enable denial of… |
CVE-2023-35123 | Medium | 4.3 | 2024-08-14 | Uncaught exception in OpenBMC Firmware for some Intel(R) Server Platforms before versions egs-1.14-0, bhs-0.27 may allow an authenticated user to potentially e… |
CVE-2023-34424 | Medium | 4.4 | 2024-08-14 | Improper input validation in firmware for some Intel(R) CSME may allow a privileged user to potentially enable denial of service via local access. |
CVE-2023-31366 | Low | 3.3 | 2024-08-13 | Improper input validation in AMD μProf could allow an attacker to perform a write to an invalid address, potentially resulting in denial of service. |
CVE-2023-31356 | Medium | 4.4 | 2024-08-13 | Incomplete system memory cleanup in SEV firmware could allow a privileged attacker to corrupt guest private memory, potentially resulting in a loss of data int… |
CVE-2023-31349 | High | 7.3 | 2024-08-13 | Incorrect default permissions in the AMD μProf installation directory could allow an attacker to achieve privilege escalation, potentially resulting in arbitra… |
CVE-2023-31348 | High | 7.3 | 2024-08-13 | A DLL hijacking vulnerability in AMD μProf could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution. |
CVE-2023-31341 | High | 7.3 | 2024-08-13 | Insufficient validation of the Input Output Control (IOCTL) input buffer in AMD μProf may allow an authenticated attacker to cause an out-of-bounds write, pote… |
CVE-2023-31339 | Medium | 4.8 | 2024-08-13 | Improper input validation in ARM® Trusted Firmware used in AMD’s Zynq™ UltraScale+™) MPSoC/RFSoC may allow a privileged attacker to perform out of bound reads… |
CVE-2023-31310 | Medium | 5.0 | 2024-08-13 | Improper input validation in Power Management Firmware (PMFW) may allow an attacker with privileges to send a malformed input for the "set temperature input se… |