2023 CVEs (page 261)
Page 261 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-24513 | Medium | 6.5 | 2023-04-12 | On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential denial of service attack by sending malf… |
CVE-2023-1990 | Medium | 4.7 | 2023-04-12 | A use-after-free flaw was found in ndlc_remove in drivers/nfc/st-nci/ndlc.c in the Linux Kernel. This flaw could allow an attacker to crash the system due to a… |
CVE-2023-30532 | Medium | 6.5 | 2023-04-12 | A missing permission check in Jenkins TurboScript Plugin 1.3 and earlier allows attackers with Item/Read permission to trigger builds of jobs corresponding to… |
CVE-2023-30531 | Medium | 6.5 | 2023-04-12 | Jenkins Consul KV Builder Plugin 2.0.13 and earlier does not mask the HashiCorp Consul ACL Token on the global configuration form, increasing the potential for… |
CVE-2023-30530 | Medium | 4.3 | 2023-04-12 | Jenkins Consul KV Builder Plugin 2.0.13 and earlier stores the HashiCorp Consul ACL Token unencrypted in its global configuration file on the Jenkins controlle… |
CVE-2023-30529 | Medium | 4.3 | 2023-04-12 | Jenkins Lucene-Search Plugin 387.v938a_ecb_f7fe9 and earlier does not require POST requests for an HTTP endpoint, allowing attackers to reindex the database. |
CVE-2023-30528 | Medium | 6.5 | 2023-04-12 | Jenkins WSO2 Oauth Plugin 1.0 and earlier does not mask the WSO2 Oauth client secret on the global configuration form, increasing the potential for attackers t… |
CVE-2023-30527 | Medium | 4.3 | 2023-04-12 | Jenkins WSO2 Oauth Plugin 1.0 and earlier stores the WSO2 Oauth client secret unencrypted in the global config.xml file on the Jenkins controller where it can… |
CVE-2023-30526 | Medium | 6.5 | 2023-04-12 | A missing permission check in Jenkins Report Portal Plugin 0.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified UR… |
CVE-2023-30525 | High | 8.8 | 2023-04-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Report Portal Plugin 0.5 and earlier allows attackers to connect to an attacker-specified URL usin… |
CVE-2023-30524 | Medium | 4.3 | 2023-04-12 | Jenkins Report Portal Plugin 0.5 and earlier does not mask ReportPortal access tokens displayed on the configuration form, increasing the potential for attacke… |
CVE-2023-30523 | Medium | 4.3 | 2023-04-12 | Jenkins Report Portal Plugin 0.5 and earlier stores ReportPortal access tokens unencrypted in job config.xml files on the Jenkins controller as part of its con… |
CVE-2023-30522 | Medium | 4.3 | 2023-04-12 | A missing permission check in Jenkins Fogbugz Plugin 2.2.17 and earlier allows attackers with Item/Read permission to trigger builds of jobs specified in a 'jo… |
CVE-2023-30521 | Medium | 5.3 | 2023-04-12 | A missing permission check in Jenkins Assembla merge request builder Plugin 1.1.13 and earlier allows unauthenticated attackers to trigger builds of jobs corre… |
CVE-2023-30520 | Medium | 5.4 | 2023-04-12 | Jenkins Quay.io trigger Plugin 0.1 and earlier does not limit URL schemes for repository homepage URLs submitted via Quay.io trigger webhooks, resulting in a s… |
CVE-2023-30519 | Medium | 5.3 | 2023-04-12 | A missing permission check in Jenkins Quay.io trigger Plugin 0.1 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the at… |
CVE-2023-30518 | Medium | 4.3 | 2023-04-12 | A missing permission check in Jenkins Thycotic Secret Server Plugin 1.0.2 and earlier allows attackers with Overall/Read permission to enumerate credentials ID… |
CVE-2023-30517 | Medium | 5.3 | 2023-04-12 | Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier unconditionally disables SSL/TLS certificate and hostname validation when connecting to a confi… |
CVE-2023-30516 | Medium | 6.5 | 2023-04-12 | Jenkins Image Tag Parameter Plugin 2.0 improperly introduces an option to opt out of SSL/TLS certificate validation when connecting to Docker registries, resul… |
CVE-2023-30515 | High | 7.5 | 2023-04-12 | Jenkins Thycotic DevOps Secrets Vault Plugin 1.0.0 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mod… |
CVE-2023-30514 | High | 7.5 | 2023-04-12 | Jenkins Azure Key Vault Plugin 187.va_cd5fecd198a_ and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mod… |
CVE-2023-30513 | High | 7.5 | 2023-04-12 | Jenkins Kubernetes Plugin 3909.v1f2c633e8590 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for… |
CVE-2023-27216 | High | 8.8 | 2023-04-12 | An issue found in D-Link DSL-3782 v.1.03 allows remote authenticated users to execute arbitrary code as root via the network settings page. |
CVE-2023-26852 | High | 7.2 | 2023-04-12 | An arbitrary file upload vulnerability in the upload plugin of Textpattern v4.8.8 and below allows attackers to execute arbitrary code by uploading a crafted P… |
CVE-2023-0006 | Medium | 6.3 | 2023-04-12 | A local file deletion vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a user to delete system files from the endpoint with… |
CVE-2023-0005 | Medium | 4.1 | 2023-04-12 | A vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to expose the plaintext values of secrets stored in the device con… |
CVE-2023-0004 | Medium | 6.5 | 2023-04-12 | A local file deletion vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to delete files from the local file system wit… |
CVE-2023-29581 | Medium | 5.5 | 2023-04-12 | yasm 1.3.0.55.g101bc has a segmentation violation in the function delete_Token at modules/preprocs/nasm/nasm-pp.c. NOTE: although a libyasm application could b… |
CVE-2023-28488 | Medium | 6.5 | 2023-04-12 | client.c in gdhcp in ConnMan through 1.41 could be used by network-adjacent attackers (operating a crafted DHCP server) to cause a stack-based buffer overflow… |
CVE-2023-27703 | Low | 3.3 | 2023-04-12 | The Android version of pikpak v1.29.2 was discovered to contain an information leak via the debug interface. |
CVE-2023-1872 | High | 7.8 | 2023-04-12 | A use-after-free vulnerability in the Linux Kernel io_uring system can be exploited to achieve local privilege escalation. The io_file_get_fixed function lack… |
CVE-2023-29571 | Medium | 5.5 | 2023-04-12 | Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via gc_sweep at src/mjs_gc.c. This vulnerability can lead to a Denial of Service (DoS). |
CVE-2023-27830 | Critical | 9.0 | 2023-04-12 | TightVNC before v2.8.75 allows attackers to escalate privileges on the host operating system via replacing legitimate files with crafted files when executing a… |
CVE-2023-27775 | Medium | 5.4 | 2023-04-12 | A stored HTML injection vulnerability in LiveAction LiveSP v21.1.2 allows attackers to execute arbitrary code via a crafted payload. |
CVE-2023-27704 | Medium | 5.5 | 2023-04-12 | Void Tools Everything lower than v1.4.1.1022 was discovered to contain a Regular Expression Denial of Service (ReDoS). |
CVE-2023-27032 | Critical | 9.8 | 2023-04-12 | Prestashop advancedpopupcreator v1.1.21 to v1.1.24 was discovered to contain a SQL injection vulnerability via the component AdvancedPopup::getPopups(). |
CVE-2023-23591 | Medium | 4.9 | 2023-04-12 | The Logback component in Terminalfour before 8.3.14.1 allows OS administrators to obtain sensitive information from application server logs when debug logging… |
CVE-2023-1874 | High | 7.5 | 2023-04-12 | The WP Data Access plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.3.7. This is due to a lack of authorization c… |
CVE-2023-29580 | Medium | 5.5 | 2023-04-12 | yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the component yasm_expr_create at /libyasm/expr.c. |
CVE-2023-29574 | Medium | 5.5 | 2023-04-12 | Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp42avc component. |
CVE-2023-27826 | High | 8.8 | 2023-04-12 | SeowonIntech SWC 5100W WIMAX Bootloader 1.18.19.0, HW 0.0.7.0, and FW 1.11.0.1, 1.9.9.4 are vulnerable to OS Command Injection. which allows attackers to take… |
CVE-2023-22616 | High | 7.8 | 2023-04-12 | An issue was discovered in Insyde InsydeH2O with kernel 5.2 through 5.5. The Save State register is not checked before use. The IhisiSmm driver does not check… |
CVE-2023-1829 | High | 7.8 | 2023-04-12 | A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited to achieve local privilege escalation. The tcindex_d… |
CVE-2023-30512 | Medium | 6.5 | 2023-04-12 | CubeFS through 3.2.1 allows Kubernetes cluster-level privilege escalation. This occurs because DaemonSet has cfs-csi-cluster-role and can thus list all secrets… |
CVE-2023-22613 | High | 8.8 | 2023-04-11 | An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. It is possible to write to an attacker-controlled address. An attacker cou… |
CVE-2023-29576 | Medium | 5.5 | 2023-04-11 | Bento4 v1.6.0-639 was discovered to contain a segmentation violation via the AP4_TrunAtom::SetDataOffset(int) function in Ap4TrunAtom.h. |
CVE-2023-28808 | Critical | 9.1 | 2023-04-11 | Some Hikvision Hybrid SAN/Cluster Storage products have an access control vulnerability which can be used to obtain the admin permission. The attacker can expl… |
CVE-2023-28314 | Medium | 6.1 | 2023-04-11 | Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability |
CVE-2023-28313 | Medium | 6.1 | 2023-04-11 | Microsoft Dynamics 365 Customer Voice Cross-Site Scripting Vulnerability |
CVE-2023-28312 | Medium | 6.5 | 2023-04-11 | Azure Machine Learning Information Disclosure Vulnerability |
CVE-2023-28311 | High | 7.8 | 2023-04-11 | Microsoft Word Remote Code Execution Vulnerability |
CVE-2023-28309 | High | 7.6 | 2023-04-11 | Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability |
CVE-2023-28308 | Medium | 6.6 | 2023-04-11 | Windows DNS Server Remote Code Execution Vulnerability |
CVE-2023-28307 | Medium | 6.6 | 2023-04-11 | Windows DNS Server Remote Code Execution Vulnerability |
CVE-2023-28306 | Medium | 6.6 | 2023-04-11 | Windows DNS Server Remote Code Execution Vulnerability |
CVE-2023-28305 | Medium | 6.6 | 2023-04-11 | Windows DNS Server Remote Code Execution Vulnerability |
CVE-2023-28304 | High | 7.8 | 2023-04-11 | Microsoft ODBC and OLE DB Remote Code Execution Vulnerability |
CVE-2023-28302 | High | 7.5 | 2023-04-11 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
CVE-2023-28301 | Low | 3.7 | 2023-04-11 | Microsoft Edge (Chromium-based) Tampering Vulnerability |
CVE-2023-28300 | High | 7.5 | 2023-04-11 | Azure Service Connector Security Feature Bypass Vulnerability |
CVE-2023-28299 | Medium | 5.5 | 2023-04-11 | Visual Studio Spoofing Vulnerability |
CVE-2023-28298 | Medium | 5.5 | 2023-04-11 | Windows Kernel Denial of Service Vulnerability |
CVE-2023-28297 | High | 8.8 | 2023-04-11 | Windows Remote Procedure Call Service (RPCSS) Elevation of Privilege Vulnerability |
CVE-2023-28296 | High | 7.8 | 2023-04-11 | Visual Studio Remote Code Execution Vulnerability |
CVE-2023-28293 | High | 7.8 | 2023-04-11 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2023-28292 | High | 7.8 | 2023-04-11 | Raw Image Extension Remote Code Execution Vulnerability |
CVE-2023-28291 | High | 8.4 | 2023-04-11 | Raw Image Extension Remote Code Execution Vulnerability |
CVE-2023-28288 | High | 8.1 | 2023-04-11 | Microsoft SharePoint Server Spoofing Vulnerability |
CVE-2023-28285 | High | 7.8 | 2023-04-11 | Microsoft Office Remote Code Execution Vulnerability |
CVE-2023-28284 | Medium | 4.3 | 2023-04-11 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability |
CVE-2023-28278 | Medium | 6.6 | 2023-04-11 | Windows DNS Server Remote Code Execution Vulnerability |
CVE-2023-28277 | Medium | 4.9 | 2023-04-11 | Windows DNS Server Information Disclosure Vulnerability |
CVE-2023-28276 | Medium | 4.4 | 2023-04-11 | Windows Group Policy Security Feature Bypass Vulnerability |
CVE-2023-28275 | High | 8.8 | 2023-04-11 | Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability |
CVE-2023-28274 | High | 7.8 | 2023-04-11 | Windows Win32k Elevation of Privilege Vulnerability |
CVE-2023-28273 | High | 7.0 | 2023-04-11 | Windows Clip Service Elevation of Privilege Vulnerability |
CVE-2023-28272 | High | 7.8 | 2023-04-11 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2023-28271 | Medium | 5.5 | 2023-04-11 | Windows Kernel Memory Information Disclosure Vulnerability |
CVE-2023-28270 | Medium | 6.8 | 2023-04-11 | Windows Lock Screen Security Feature Bypass Vulnerability |
CVE-2023-28269 | Medium | 6.2 | 2023-04-11 | Windows Boot Manager Security Feature Bypass Vulnerability |
CVE-2023-28268 | High | 8.1 | 2023-04-11 | Netlogon RPC Elevation of Privilege Vulnerability |
CVE-2023-28267 | Medium | 6.5 | 2023-04-11 | Remote Desktop Protocol Client Information Disclosure Vulnerability |
CVE-2023-28266 | Medium | 5.5 | 2023-04-11 | Windows Common Log File System Driver Information Disclosure Vulnerability |
CVE-2023-28263 | Medium | 5.5 | 2023-04-11 | Visual Studio Information Disclosure Vulnerability |
CVE-2023-28262 | High | 7.8 | 2023-04-11 | Visual Studio Elevation of Privilege Vulnerability |
CVE-2023-28260 | High | 7.8 | 2023-04-11 | .NET DLL Hijacking Remote Code Execution Vulnerability |
CVE-2023-28256 | Medium | 6.6 | 2023-04-11 | Windows DNS Server Remote Code Execution Vulnerability |
CVE-2023-28255 | Medium | 6.6 | 2023-04-11 | Windows DNS Server Remote Code Execution Vulnerability |
CVE-2023-28254 | High | 7.2 | 2023-04-11 | Windows DNS Server Remote Code Execution Vulnerability |
CVE-2023-28253 | Medium | 5.5 | 2023-04-11 | Windows Kernel Information Disclosure Vulnerability |
CVE-2023-28252 | High | 7.8 | 2023-04-11 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
CVE-2023-28250 | Critical | 9.8 | 2023-04-11 | Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability |
CVE-2023-28249 | Medium | 6.2 | 2023-04-11 | Windows Boot Manager Security Feature Bypass Vulnerability |
CVE-2023-28248 | High | 7.8 | 2023-04-11 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2023-28247 | High | 7.5 | 2023-04-11 | Windows Network File System Information Disclosure Vulnerability |
CVE-2023-28246 | High | 7.8 | 2023-04-11 | Windows Registry Elevation of Privilege Vulnerability |
CVE-2023-28244 | High | 8.1 | 2023-04-11 | Windows Kerberos Elevation of Privilege Vulnerability |
CVE-2023-28243 | High | 8.8 | 2023-04-11 | Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability |
CVE-2023-28241 | High | 7.5 | 2023-04-11 | Windows Secure Socket Tunneling Protocol (SSTP) Denial of Service Vulnerability |
CVE-2023-28240 | High | 8.8 | 2023-04-11 | Windows Network Load Balancing Remote Code Execution Vulnerability |