2023 CVEs (page 26)
Page 26 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-52950 | Medium | 5.3 | 2024-09-26 | Missing encryption of sensitive data vulnerability in login component in Synology Active Backup for Business Agent before 2.7.0-3221 allows adjacent man-in-the… |
CVE-2023-52949 | Medium | 5.5 | 2024-09-26 | Missing authentication for critical function vulnerability in proxy settings functionality in Synology Active Backup for Business Agent before 2.7.0-3221 allow… |
CVE-2023-52948 | Medium | 5.0 | 2024-09-26 | Missing encryption of sensitive data vulnerability in settings functionality in Synology Active Backup for Business Agent before 2.7.0-3221 allows local users… |
CVE-2023-52947 | Medium | 4.0 | 2024-09-26 | Missing authentication for critical function vulnerability in logout functionality in Synology Active Backup for Business Agent before 2.6.3-3101 allows local… |
CVE-2023-52946 | High | 8.2 | 2024-09-26 | Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in vss service component in Synology Drive Client before 3.5.0-16084 allow… |
CVE-2023-51157 | Medium | 5.4 | 2024-09-25 | Cross Site Scripting vulnerability in ZKTeco WDMS v.5.1.3 Pro allows a remote attacker to execute arbitrary code and obtain sensitive information via a crafted… |
CVE-2023-25189 | Low | 3.3 | 2024-09-25 | BTS is affected by information disclosure vulnerability where mobile network operator personnel connected over BTS Web Element Manager, regardless of the acces… |
CVE-2023-5359 | Low | 3.7 | 2024-09-25 | The W3 Total Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.5 via Google OAuth API secrets st… |
CVE-2023-26691 | High | 7.2 | 2024-09-25 | Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via crafted zip file when installing a new add-on. |
CVE-2023-26690 | High | 8.8 | 2024-09-25 | File Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via File Manager/Editor component in the vendor or admin… |
CVE-2023-26689 | Critical | 9.8 | 2024-09-25 | An issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user account profiles via crafted post request. |
CVE-2023-26688 | Medium | 5.4 | 2024-09-25 | Cross Site Scripting (XSS) vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via the product_data parameter of add/edit… |
CVE-2023-26687 | High | 8.8 | 2024-09-25 | Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to obtain sensitive information via the product_data parameter in the P… |
CVE-2023-26686 | Critical | 9.8 | 2024-09-25 | File Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via the image upload feature when customizing a shop. |
CVE-2023-7282 | Medium | 4.3 | 2024-09-23 | Inappropriate implementation in Navigation in Google Chrome prior to 113.0.5672.63 allowed a remote attacker who convinced a user to engage in specific UI gest… |
CVE-2023-7281 | Medium | 4.3 | 2024-09-23 | Inappropriate implementation in Compositing in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform UI spoofing via a crafted HTML page… |
CVE-2023-46948 | Medium | 5.4 | 2024-09-23 | A reflected Cross-Site Scripting (XSS) vulnerability was found on Temenos T24 Browser R19.40 that enables a remote attacker to execute arbitrary JavaScript cod… |
CVE-2023-47480 | High | 8.4 | 2024-09-20 | An issue in Pure Data 0.54-0 and fixed in 0.54-1 allows a local attacker to escalate privileges via the set*id () function. |
CVE-2023-27584 | Critical | 9.8 | 2024-09-19 | Dragonfly is an open source P2P-based file distribution and image acceleration system. It is hosted by the Cloud Native Computing Foundation (CNCF) as an Incub… |
CVE-2023-30464 | High | 7.5 | 2024-09-18 | CoreDNS through 1.10.1 enables attackers to achieve DNS cache poisoning and inject fake responses via a birthday attack. |
CVE-2023-41612 | High | 8.8 | 2024-09-18 | Victure PC420 1.1.39 was discovered to use a weak encryption key for the file enabled_telnet.dat on the Micro SD card. |
CVE-2023-41611 | Medium | 6.5 | 2024-09-18 | Victure PC420 1.1.39 was discovered to use a weak and partially hardcoded key to encrypt data. |
CVE-2023-41610 | High | 8.8 | 2024-09-18 | Victure PC420 1.1.39 was discovered to contain a hardcoded root password which is stored in plaintext. |
CVE-2023-47105 | High | 8.6 | 2024-09-18 | exec.CommandContext in Chaosblade 0.3 through 1.7.3, when server mode is used, allows OS command execution via the cmd parameter without authentication. |
CVE-2023-49203 | High | 7.5 | 2024-09-18 | Technitium 11.5.3 allows remote attackers to cause a denial of service (bandwidth amplification) because the DNSBomb manipulation causes accumulation of low-ra… |
CVE-2023-28457 | High | 7.5 | 2024-09-18 | An issue was discovered in Technitium through 11.0.3. It enables attackers to conduct a DNS cache poisoning attack and inject fake responses within 1 second, w… |
CVE-2023-28456 | High | 7.5 | 2024-09-18 | An issue was discovered in Technitium through 11.0.2. It enables attackers to launch amplification attacks (3 times more than other "golden model" software lik… |
CVE-2023-28455 | High | 7.5 | 2024-09-18 | An issue was discovered in Technitium through 11.0.2. The forwarding mode enables attackers to create a query loop using Technitium resolvers, launching amplif… |
CVE-2023-28452 | High | 7.5 | 2024-09-18 | An issue was discovered in CoreDNS through 1.10.1. There is a vulnerability in DNS resolving software, which triggers a resolver to ignore valid responses, thu… |
CVE-2023-28451 | High | 7.5 | 2024-09-18 | An issue was discovered in Technitium 11.0.2. There is a vulnerability (called BadDNS) in DNS resolving software, which triggers a resolver to ignore valid res… |
CVE-2023-45854 | High | 7.5 | 2024-09-16 | A Business Logic vulnerability in Shopkit 1.0 allows an attacker to add products with negative quantities to the shopping cart via the qtd parameter in the add… |
CVE-2023-43753 | Medium | 5.3 | 2024-09-16 | Improper conditions check in some Intel(R) Processors with Intel(R) SGX may allow a privileged user to potentially enable information disclosure via local acce… |
CVE-2023-43626 | High | 7.5 | 2024-09-16 | Improper access control in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local acces… |
CVE-2023-42772 | High | 8.2 | 2024-09-16 | Untrusted pointer dereference in UEFI firmware for some Intel(R) reference processors may allow a privileged user to potentially enable escalation of privilege… |
CVE-2023-41833 | High | 7.5 | 2024-09-16 | A race condition in UEFI firmware for some Intel(R) processors may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2023-25546 | Low | 2.5 | 2024-09-16 | Out-of-bounds read in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable denial of service via local access. |
CVE-2023-23904 | Medium | 6.1 | 2024-09-16 | NULL pointer dereference in the UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local… |
CVE-2023-22351 | Medium | 6.1 | 2024-09-16 | Out-of-bounds write in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2023-3410 | Medium | 5.4 | 2024-09-14 | The Bricks theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘customTag' attribute in versions up to, and including, 1.10.1 due to insuf… |
CVE-2023-6841 | High | 7.5 | 2024-09-10 | A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests… |
CVE-2023-37234 | Critical | 9.8 | 2024-09-10 | Loftware Spectrum through 4.6 has unprotected JMX Registry. |
CVE-2023-37233 | High | 8.8 | 2024-09-10 | Loftware Spectrum before 4.6 HF14 allows authenticated XXE attacks. |
CVE-2023-37232 | High | 7.5 | 2024-09-10 | Loftware Spectrum through 4.6 exposes Sensitive Information (Logs) to an Unauthorized Actor. |
CVE-2023-36103 | Critical | 9.8 | 2024-09-10 | Command Injection vulnerability in goform/SetIPTVCfg interface of Tenda AC15 V15.03.05.20 allows remote attackers to run arbitrary commands via crafted POST re… |
CVE-2023-44254 | Medium | 5.0 | 2024-09-10 | An authorization bypass through user-controlled key [CWE-639] vulnerability in FortiAnalyzer version 7.4.1 and before 7.2.5 and FortiManager version 7.4.1 and… |
CVE-2023-37231 | Critical | 9.8 | 2024-09-10 | Loftware Spectrum before 4.6 HF14 uses a Hard-coded Password. |
CVE-2023-37230 | High | 8.8 | 2024-09-10 | Loftware Spectrum (testDeviceConnection) before 5.1 allows SSRF. |
CVE-2023-37229 | High | 8.8 | 2024-09-10 | Loftware Spectrum before 5.1 allows SSRF. |
CVE-2023-37227 | Critical | 9.8 | 2024-09-10 | Loftware Spectrum before 4.6 HF13 Deserializes Untrusted Data. |
CVE-2023-37226 | Critical | 9.8 | 2024-09-10 | Loftware Spectrum before 4.6 HF14 has Missing Authentication for a Critical Function. |
CVE-2023-49069 | Medium | 5.3 | 2024-09-10 | A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.17.0 only if the basic authentication mechanism is used by the application), Mend… |
CVE-2023-30756 | Medium | 5.9 | 2024-09-10 | A vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) (All versions < V3.5.20), SIMATIC CP 1243-1 (incl. SIPLUS variants) (All ve… |
CVE-2023-30755 | Medium | 4.4 | 2024-09-10 | A vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) (All versions < V3.5.20), SIMATIC CP 1243-1 (incl. SIPLUS variants) (All ve… |
CVE-2023-2919 | Medium | 4.3 | 2024-09-10 | The Tutor LMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.4. This is due to missing or incorrect non… |
CVE-2023-28827 | Medium | 5.9 | 2024-09-10 | A vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) (All versions < V3.5.20), SIMATIC CP 1243-1 (incl. SIPLUS variants) (All ve… |
CVE-2023-50883 | Medium | 6.1 | 2024-09-09 | ONLYOFFICE Docs before 8.0.1 allows XSS because a macro is an immediately-invoked function expression (IIFE), and therefore a sandbox escape is possible by dir… |
CVE-2023-46809 | High | 7.4 | 2024-09-07 | Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the… |
CVE-2023-39333 | Medium | 5.3 | 2024-09-07 | Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that… |
CVE-2023-30587 | High | 7.5 | 2024-09-07 | A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module (node:ins… |
CVE-2023-30584 | High | 7.7 | 2024-09-07 | A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of pat… |
CVE-2023-30583 | High | 7.5 | 2024-09-07 | fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the `--allow-fs-read` flag in Node.js 20. This fl… |
CVE-2023-30582 | Medium | 5.3 | 2024-09-07 | A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a no… |
CVE-2023-51368 | Medium | 5.4 | 2024-09-06 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users… |
CVE-2023-51367 | Medium | 5.4 | 2024-09-06 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2023-51366 | High | 8.7 | 2024-09-06 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read th… |
CVE-2023-50366 | Medium | 4.3 | 2024-09-06 | A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow auth… |
CVE-2023-50360 | High | 8.8 | 2024-09-06 | A SQL injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to inject malicious co… |
CVE-2023-47563 | High | 7.4 | 2024-09-06 | An OS command injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to execute com… |
CVE-2023-45038 | Medium | 4.3 | 2024-09-06 | An improper authentication vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow users to compromise the securit… |
CVE-2023-39300 | High | 7.2 | 2024-09-06 | An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated administrators to execu… |
CVE-2023-39298 | High | 7.8 | 2024-09-06 | A missing authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow local aut… |
CVE-2023-34979 | Medium | 6.6 | 2024-09-06 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… |
CVE-2023-34974 | High | 8.8 | 2024-09-06 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to… |
CVE-2023-52916 | High | 7.8 | 2024-09-06 | In the Linux kernel, the following vulnerability has been resolved: media: aspeed: Fix memory overwrite if timing is 1600x900 When capturing 1600x900, system… |
CVE-2023-52915 | Medium | 5.5 | 2024-09-06 | In the Linux kernel, the following vulnerability has been resolved: media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer In af9035_i2c_mas… |
CVE-2023-51712 | Medium | 4.7 | 2024-09-05 | An issue was discovered in Trusted Firmware-M through 2.0.0. The lack of argument verification in the logging subsystem allows attackers to read sensitive data… |
CVE-2023-49233 | High | 8.8 | 2024-09-03 | Insufficient access checks in Visual Planning Admin Center 8 before v.1 Build 240207 allow attackers in possession of a non-administrative Visual Planning acco… |
CVE-2023-7279 | Low | 2.6 | 2024-09-02 | A vulnerability has been found in Secure Systems Engineering Connaisseur up to 3.3.0 and classified as problematic. This vulnerability affects unknown code of… |
CVE-2023-7256 | Medium | 4.4 | 2024-08-31 | In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo… |
CVE-2023-26324 | High | 8.8 | 2024-08-28 | A code execution vulnerability exists in the XiaomiGetApps application product. This vulnerability is caused by the verification logic being bypassed, and an a… |
CVE-2023-26323 | High | 7.6 | 2024-08-28 | A code execution vulnerability exists in the Xiaomi App market product. The vulnerability is caused by unsafe configuration and can be exploited by attackers t… |
CVE-2023-26322 | High | 8.8 | 2024-08-28 | A code execution vulnerability exists in the XiaomiGetApps application product. This vulnerability is caused by the verification logic being bypassed, and an a… |
CVE-2023-26321 | Medium | 6.3 | 2024-08-28 | A path traversal vulnerability exists in the Xiaomi File Manager application product(international version). The vulnerability is caused by unfiltered special… |
CVE-2023-43078 | Medium | 6.7 | 2024-08-28 | Dell Dock Firmware and Dell Client Platform contain an Improper Link Resolution vulnerability during installation resulting in arbitrary folder deletion, which… |
CVE-2023-45896 | High | 7.1 | 2024-08-28 | ntfs3 in the Linux kernel through 6.8.0 allows a physically proximate attacker to read kernel memory by mounting a filesystem (e.g., if a Linux distribution is… |
CVE-2023-49582 | Medium | 5.5 | 2024-08-26 | Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially r… |
CVE-2023-26315 | Medium | 6.5 | 2024-08-26 | The Xiaomi router AX9000 has a post-authentication command injection vulnerability. This vulnerability is caused by the lack of input filtering, allowing an at… |
CVE-2023-48957 | Medium | 5.3 | 2024-08-25 | PureVPN Linux client 2.0.2-Productions fails to properly handle DNS queries, allowing them to bypass the VPN tunnel and be sent directly to the ISP or default… |
CVE-2023-6987 | Medium | 6.1 | 2024-08-24 | The String locator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sql-column' parameter in all versions up to, and including, 2… |
CVE-2023-0926 | Medium | 4.4 | 2024-08-24 | The Custom Permalinks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.0 due to insufficient input sanit… |
CVE-2023-7260 | High | 7.5 | 2024-08-22 | Path Traversal vulnerability discovered in OpenText™ CX-E Voice, affecting all version through 22.4. The vulnerability could allow arbitrarily access files o… |
CVE-2023-6452 | Critical | 9.6 | 2024-08-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Web Security (Transaction Viewer) allows Store… |
CVE-2023-29929 | High | 7.5 | 2024-08-21 | Buffer Overflow vulnerability found in Kemptechnologies Loadmaster before v.7.2.60.0 allows a remote attacker to casue a denial of service via the libkemplink… |
CVE-2023-49198 | High | 7.5 | 2024-08-21 | Mysql security vulnerability in Apache SeaTunnel. Attackers can read files on the MySQL server by modifying the information in the MySQL URL allowLoadLocalI… |
CVE-2023-22576 | High | 7.0 | 2024-08-21 | Dell Repository Manager version 3.4.2 and earlier, contain a Local Privilege Escalation Vulnerability in Installation module. A local low privileged attacker m… |
CVE-2023-52914 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: io_uring/poll: add hash if ready poll request can't complete inline If we don't, then we… |
CVE-2023-52913 | High | 7.8 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential context UAFs gem_context_register() makes the context visible to… |
CVE-2023-52912 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fixed bug on error when unloading amdgpu Fixed bug on error when unloading am… |
CVE-2023-52911 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: drm/msm: another fix for the headless Adreno GPU Fix another oops reproducible when reboo… |
CVE-2023-52910 | High | 8.8 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: iommu/iova: Fix alloc iova overflows issue In __alloc_and_insert_iova_range, there is an… |