2023 CVEs (page 275)
Page 275 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-20953 | High | 7.8 | 2023-03-24 | In onPrimaryClipChanged of ClipboardListener.java, there is a possible way to bypass factory reset protection due to incorrect UI being shown prior to setup co… |
CVE-2023-20952 | Medium | 5.5 | 2023-03-24 | In A2DP_BuildCodecHeaderSbc of a2dp_sbc.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclos… |
CVE-2023-20951 | Critical | 9.8 | 2023-03-24 | In gatt_process_prep_write_rsp of gatt_cl.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution w… |
CVE-2023-20947 | High | 7.8 | 2023-03-24 | In getGroupState of GrantPermissionsViewModel.kt, there is a possible way to keep a one-time permission granted due to a permissions bypass. This could lead to… |
CVE-2023-20936 | High | 7.8 | 2023-03-24 | In bta_av_rc_disc_done of bta_av_act.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privileg… |
CVE-2023-20931 | High | 7.8 | 2023-03-24 | In avdt_scb_hdl_write_req of avdt_scb_act.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of pri… |
CVE-2023-20929 | Medium | 5.5 | 2023-03-24 | In sendHalfSheetCancelBroadcast of HalfSheetActivity.java, there is a possible way to learn nearby BT MAC addresses due to an unrestricted broadcast intent. Th… |
CVE-2023-20926 | Medium | 6.8 | 2023-03-24 | In onParentVisible of HeaderPrivacyIconsController.kt, there is a possible way to bypass factory reset protections due to a missing permission check. This coul… |
CVE-2023-20917 | High | 7.8 | 2023-03-24 | In onTargetSelected of ResolverActivity.java, there is a possible way to share a wrong file due to a logic error in the code. This could lead to local escalati… |
CVE-2023-20911 | High | 7.8 | 2023-03-24 | In addPermission of PermissionManagerServiceImpl.java , there is a possible failure to persist permission settings due to resource exhaustion. This could lead… |
CVE-2023-20910 | Medium | 5.5 | 2023-03-24 | In add of WifiNetworkSuggestionsManager.java, there is a possible way to trigger permanent DoS due to resource exhaustion. This could lead to local denial of s… |
CVE-2023-20906 | High | 7.8 | 2023-03-24 | In onPackageAddedInternal of PermissionManagerService.java, there is a possible way to silently grant a permission after a Target SDK update due to a permissio… |
CVE-2023-28152 | Medium | 5.3 | 2023-03-24 | An issue was discovered in Independentsoft JWord before 1.1.110. The API is prone to XML external entity (XXE) injection via a remote DTD in a DOCX file. |
CVE-2023-24625 | Medium | 6.5 | 2023-03-24 | Faveo 5.0.1 allows remote attackers to obtain sensitive information via a modified user ID in an Insecure Direct Object Reference (IDOR) attack. |
CVE-2023-1177 | Critical | 9.3 | 2023-03-24 | Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1. |
CVE-2023-1176 | Low | 3.3 | 2023-03-24 | Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2. |
CVE-2023-27242 | Medium | 5.4 | 2023-03-24 | SourceCodester Loan Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Type parameter under the Edit Loan Type… |
CVE-2023-1616 | Low | 3.5 | 2023-03-24 | A vulnerability was found in XiaoBingBy TeaCMS up to 2.0.2. It has been classified as problematic. Affected is an unknown function of the component Article Tit… |
CVE-2023-28818 | Medium | 5.3 | 2023-03-24 | An issue was discovered in Veritas NetBackup IT Analytics 11 before 11.2.0. The application upgrade process included unsigned files that could be exploited and… |
CVE-2023-28686 | High | 7.1 | 2023-03-24 | Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 allows attackers to modify the personal bookmark store via a crafted message. The attacker can ch… |
CVE-2023-28445 | Critical | 9.9 | 2023-03-24 | Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Resizable ArrayBuffers passed to asynchronous functions that are shrunk duri… |
CVE-2023-28443 | Medium | 4.2 | 2023-03-24 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.23.3, the `directus_refresh_token` is not redacted properly… |
CVE-2023-28442 | High | 7.5 | 2023-03-24 | GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. Prior to versions 2.20.6, 2.19.6, and 2.18… |
CVE-2023-28441 | High | 8.0 | 2023-03-24 | smartCARS 3 is flight tracking software. In version 0.5.8 and prior, all persons who have failed login attempts will have their password stored in error logs… |
CVE-2023-27034 | Critical | 9.8 | 2023-03-23 | PrestaShop jmsblog 2.5.5 was discovered to contain a SQL injection vulnerability. |
CVE-2023-24295 | High | 7.8 | 2023-03-23 | A stack overfow in SoftMaker Software GmbH FlexiPDF v3.0.3.0 allows attackers to execute arbitrary code after opening a crafted PDF file. |
CVE-2023-28611 | Critical | 9.8 | 2023-03-23 | Incorrect authorization in OMICRON StationGuard 1.10 through 2.20 and StationScout 1.30 through 2.20 allows an attacker to bypass intended access restrictions. |
CVE-2023-28336 | Medium | 4.3 | 2023-03-23 | Insufficient filtering of grade report history made it possible for teachers to access the names of users they could not otherwise access. |
CVE-2023-28335 | High | 8.8 | 2023-03-23 | The link to reset all templates of a database activity did not include the necessary token to prevent a CSRF risk. |
CVE-2023-28334 | Medium | 4.3 | 2023-03-23 | Authenticated users were able to enumerate other users' names via the learning plans page. |
CVE-2023-28333 | Critical | 9.8 | 2023-03-23 | The Mustache pix helper contained a potential Mustache injection risk if combined with user input (note: This did not appear to be implemented/exploitable anyw… |
CVE-2023-28332 | Medium | 6.1 | 2023-03-23 | If the algebra filter was enabled but not functional (eg the necessary binaries were missing from the server), it presented an XSS risk. |
CVE-2023-28331 | Medium | 6.1 | 2023-03-23 | Content output by the database auto-linking filter required additional sanitizing to prevent an XSS risk. |
CVE-2023-28330 | Medium | 6.5 | 2023-03-23 | Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and ad… |
CVE-2023-28329 | High | 8.8 | 2023-03-23 | Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers). |
CVE-2023-24788 | High | 8.8 | 2023-03-23 | NotrinosERP v0.7 was discovered to contain a SQL injection vulnerability via the OrderNumber parameter at /NotrinosERP/sales/customer_delivery.php. |
CVE-2023-20861 | Medium | 6.5 | 2023-03-23 | In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provid… |
CVE-2023-20859 | Medium | 5.5 | 2023-03-23 | In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive inf… |
CVE-2023-1613 | Low | 3.5 | 2023-03-23 | A vulnerability has been found in Rebuild up to 3.2.3 and classified as problematic. This vulnerability affects unknown code of the file /feeds/post/publish. T… |
CVE-2023-1612 | Medium | 6.3 | 2023-03-23 | A vulnerability, which was classified as critical, was found in Rebuild up to 3.2.3. This affects an unknown part of the file /files/list-file. The manipulatio… |
CVE-2023-1513 | Low | 3.3 | 2023-03-23 | A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some uninitialized portions of the kvm_debugregs structure… |
CVE-2023-1402 | Medium | 4.3 | 2023-03-23 | The course participation report required additional checks to prevent roles being displayed which the user did not have access to view. |
CVE-2023-1252 | High | 7.8 | 2023-03-23 | A use-after-free flaw was found in the Linux kernel’s Ext4 File System in how a user triggers several file operations simultaneously with the overlay FS usage… |
CVE-2023-1249 | Medium | 5.5 | 2023-03-23 | A use-after-free flaw was found in the Linux kernel’s core dump subsystem. This flaw allows a local user to crash the system. Only if patch 390031c94211 ("core… |
CVE-2023-0590 | Medium | 4.7 | 2023-03-23 | A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race problem. This flaw leads to a denial of service issue… |
CVE-2023-0056 | Medium | 6.5 | 2023-03-23 | An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenticated remote atta… |
CVE-2023-28436 | Medium | 5.7 | 2023-03-23 | Tailscale is software for using Wireguard and multi-factor authentication (MFA). A vulnerability identified in the implementation of Tailscale SSH starting in… |
CVE-2023-26361 | Medium | 4.9 | 2023-03-23 | Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Dir… |
CVE-2023-26360 | High | 8.6 | 2023-03-23 | Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could resu… |
CVE-2023-26359 | Critical | 9.8 | 2023-03-23 | Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that c… |
CVE-2023-25655 | Critical | 9.8 | 2023-03-23 | baserCMS is a Content Management system. Prior to version 4.7.5, any file may be uploaded on the management system of baserCMS. Version 4.7.5 contains a patch. |
CVE-2023-25654 | Critical | 9.8 | 2023-03-23 | baserCMS is a Content Management system. Prior to version 4.7.5, there is a Remote Code Execution (RCE) Vulnerability in the management system of baserCMS. Ver… |
CVE-2023-1610 | Medium | 6.3 | 2023-03-23 | A vulnerability, which was classified as critical, has been found in Rebuild up to 3.2.3. Affected by this issue is some unknown functionality of the file /pro… |
CVE-2023-1609 | Low | 3.5 | 2023-03-23 | A vulnerability was found in Zhong Bang CRMEB Java up to 1.3.4. It has been rated as problematic. This issue affects the function save of the file /api/admin/s… |
CVE-2023-1608 | Medium | 6.3 | 2023-03-23 | A vulnerability was found in Zhong Bang CRMEB Java up to 1.3.4. It has been declared as critical. This vulnerability affects the function getAdminList of the f… |
CVE-2023-1607 | Medium | 4.7 | 2023-03-23 | A vulnerability was found in novel-plus 3.6.2. It has been classified as critical. This affects an unknown part of the file /common/sysFile/list. The manipulat… |
CVE-2023-1544 | Medium | 6.0 | 2023-03-23 | A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to allocate and initialize a huge numb… |
CVE-2023-1289 | Medium | 5.5 | 2023-03-23 | A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote attack… |
CVE-2023-1606 | Medium | 6.3 | 2023-03-23 | A vulnerability was found in novel-plus 3.6.2 and classified as critical. Affected by this issue is some unknown functionality of the file DictController.java… |
CVE-2023-1605 | High | 7.5 | 2023-03-23 | Denial of Service in GitHub repository radareorg/radare2 prior to 5.8.6. |
CVE-2023-27094 | High | 8.8 | 2023-03-23 | An issue found in OpenGoofy Hippo4j v.1.4.3 allows attackers to escalate privileges via the ThreadPoolController of the tenant Management module. |
CVE-2023-26008 | Medium | 5.9 | 2023-03-23 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ajay D'Souza Top 10 – Popular posts plugin for WordPress plugin <= 3.2.4 versions. |
CVE-2023-25992 | Medium | 5.9 | 2023-03-23 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CreativeMindsSolutions CM Answers plugin <= 3.1.9 versions. |
CVE-2023-25456 | Medium | 5.9 | 2023-03-23 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Klaviyo, Inc. Klaviyo plugin <= 3.0.7 versions. |
CVE-2023-23707 | Medium | 5.9 | 2023-03-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Unrestricted Upload of File with Dangerous Type vulnerability in Awsm Inn… |
CVE-2023-20113 | Medium | 6.5 | 2023-03-23 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to conduct a cross-site… |
CVE-2023-20112 | High | 7.4 | 2023-03-23 | A vulnerability in Cisco access point (AP) software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affect… |
CVE-2023-20107 | High | 7.5 | 2023-03-23 | A vulnerability in the deterministic random bit generator (DRBG), also known as pseudorandom number generator (PRNG), in Cisco Adaptive Security Appliance (ASA… |
CVE-2023-20100 | Medium | 6.8 | 2023-03-23 | A vulnerability in the access point (AP) joining process of the Control and Provisioning of Wireless Access Points (CAPWAP) protocol of Cisco IOS XE Software f… |
CVE-2023-20097 | Medium | 4.6 | 2023-03-23 | A vulnerability in Cisco access points (AP) software could allow an authenticated, local attacker to inject arbitrary commands and execute them with root privi… |
CVE-2023-20082 | Medium | 6.1 | 2023-03-23 | A vulnerability in Cisco IOS XE Software for Cisco Catalyst 9300 Series Switches could allow an authenticated, local attacker with level-15 privileges or an un… |
CVE-2023-20081 | Medium | 6.8 | 2023-03-23 | A vulnerability in the IPv6 DHCP (DHCPv6) client module of Cisco Adaptive Security Appliance (ASA) Software, Cisco Firepower Threat Defense (FTD) Software, Cis… |
CVE-2023-20080 | High | 8.6 | 2023-03-23 | A vulnerability in the IPv6 DHCP version 6 (DHCPv6) relay and server features of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker… |
CVE-2023-20072 | High | 8.6 | 2023-03-23 | A vulnerability in the fragmentation handling code of tunnel protocol packets in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause… |
CVE-2023-20067 | High | 7.4 | 2023-03-23 | A vulnerability in the HTTP-based client profiling feature of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, adjacen… |
CVE-2023-20066 | Medium | 6.5 | 2023-03-23 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to perform a directory traversal and access resources that… |
CVE-2023-20065 | High | 7.8 | 2023-03-23 | A vulnerability in the Cisco IOx application hosting subsystem of Cisco IOS XE Software could allow an authenticated, local attacker to elevate privileges to r… |
CVE-2023-20059 | Medium | 4.3 | 2023-03-23 | A vulnerability in the implementation of the Cisco Network Plug-and-Play (PnP) agent of Cisco DNA Center could allow an authenticated, remote attacker to view… |
CVE-2023-20056 | Medium | 6.5 | 2023-03-23 | A vulnerability in the management CLI of Cisco access point (AP) software could allow an authenticated, local attacker to cause a denial of service (DoS) condi… |
CVE-2023-20055 | High | 8.0 | 2023-03-23 | A vulnerability in the management API of Cisco DNA Center could allow an authenticated, remote attacker to elevate privileges in the context of the web-based m… |
CVE-2023-20035 | High | 7.8 | 2023-03-23 | A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to execute arbitrary commands with elevated privileges… |
CVE-2023-20029 | Medium | 4.4 | 2023-03-23 | A vulnerability in the Meraki onboarding feature of Cisco IOS XE Software could allow an authenticated, local attacker to gain root level privileges on an affe… |
CVE-2023-20027 | High | 8.6 | 2023-03-23 | A vulnerability in the implementation of the IPv4 Virtual Fragmentation Reassembly (VFR) feature of Cisco IOS XE Software could allow an unauthenticated, remot… |
CVE-2023-28610 | Critical | 9.8 | 2023-03-23 | The update process in OMICRON StationGuard and OMICRON StationScout before 2.21 can be exploited by providing a modified firmware update image. This allows a r… |
CVE-2023-28772 | Medium | 6.7 | 2023-03-23 | An issue was discovered in the Linux kernel before 5.13.3. lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow. |
CVE-2023-27135 | Critical | 9.8 | 2023-03-23 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the enabled parameter at /setting/setWanIeCfg. |
CVE-2023-27078 | Critical | 9.8 | 2023-03-23 | A command injection issue was found in TP-Link MR3020 v.1_150921 that allows a remote attacker to execute arbitrary commands via a crafted request to the tftp… |
CVE-2023-27077 | High | 7.5 | 2023-03-23 | Stack Overflow vulnerability found in 360 D901 allows a remote attacker to cause a Distributed Denial of Service (DDOS) via a crafted HTTP package. |
CVE-2023-23728 | Medium | 6.5 | 2023-03-23 | Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Winwar Media WP Flipclock plugin <= 1.7.4 versions. |
CVE-2023-23722 | Medium | 5.9 | 2023-03-23 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Winwar Media WP eBay Product Feeds plugin <= 3.3.1 versions. |
CVE-2023-22702 | Medium | 6.5 | 2023-03-23 | Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in WPMobile.App WPMobile.App — Android and iOS Mobile Application plugin <= 11.13 versions. |
CVE-2023-27079 | High | 7.5 | 2023-03-23 | Command Injection vulnerability found in Tenda G103 v.1.0.05 allows an attacker to obtain sensitive information via a crafted package |
CVE-2023-23864 | Medium | 6.5 | 2023-03-23 | Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Michael Aronoff Very Simple Google Maps plugin <= 2.8.4 versions. |
CVE-2023-23650 | Medium | 6.5 | 2023-03-23 | Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in MainWP MainWP Code Snippets Extension plugin <= 4.0.2 versions. |
CVE-2023-22716 | Medium | 5.9 | 2023-03-23 | Auth. (admin+) Cross-Site Scripting vulnerability in OOPSpam OOPSpam Anti-Spam plugin <= 1.1.35 versions. |
CVE-2023-22715 | Medium | 5.9 | 2023-03-23 | Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Lester 'GaMerZ' Chan WP-CommentNavi plugin <= 1.12.1 versions. |
CVE-2023-22712 | Medium | 6.5 | 2023-03-23 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in TemplatesNext TemplatesNext ToolKit plugin <= 3.2.7 versions. |
CVE-2023-28422 | Medium | 5.9 | 2023-03-23 | Auth. (admin+) Stored Cross-site Scripting (XSS) vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce <= 3.8.6. versions. |
CVE-2023-22704 | High | 7.1 | 2023-03-23 | Reflected Cross-Site Scripting (XSS) vulnerability in Michael Winkler teachPress plugin <= 8.1.8 versions. |
CVE-2023-1595 | Medium | 4.7 | 2023-03-23 | A vulnerability has been found in novel-plus 3.6.2 and classified as critical. Affected by this vulnerability is an unknown functionality of the file common/lo… |