2023 CVEs (page 279)
Page 279 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-28113 | Medium | 5.9 | 2023-03-16 | russh is a Rust SSH client and server library. Starting in version 0.34.0 and prior to versions 0.36.2 and 0.37.1, Diffie-Hellman key validation is insufficien… |
CVE-2023-27494 | Medium | 5.9 | 2023-03-16 | Streamlit, software for turning data scripts into web applications, had a cross-site scripting (XSS) vulnerability in versions 0.63.0 through 0.80.0. Users of… |
CVE-2023-23935 | Low | 3.5 | 2023-03-16 | Discourse is an open-source messaging platform. In versions 3.0.1 and prior on the `stable` branch and versions 3.1.0.beta2 and prior on the `beta` and `tests-… |
CVE-2023-22883 | High | 7.2 | 2023-03-16 | Zoom Client for IT Admin Windows installers before version 5.13.5 contain a local privilege escalation vulnerability. A local low-privileged user could exploit… |
CVE-2023-22882 | Medium | 6.5 | 2023-03-16 | Zoom clients before version 5.13.5 contain a STUN parsing vulnerability. A malicious actor could send specially crafted UDP traffic to a victim Zoom client to… |
CVE-2023-22881 | Medium | 6.5 | 2023-03-16 | Zoom clients before version 5.13.5 contain a STUN parsing vulnerability. A malicious actor could send specially crafted UDP traffic to a victim Zoom client to… |
CVE-2023-22880 | Medium | 6.8 | 2023-03-16 | Zoom for Windows clients before version 5.13.3, Zoom Rooms for Windows clients before version 5.13.5 and Zoom VDI for Windows clients before 5.13.1 contain an… |
CVE-2023-21465 | Medium | 5.5 | 2023-03-16 | Improper access control vulnerability in BixbyTouch prior to version 3.2.02.5 in China models allows untrusted applications access local files. |
CVE-2023-21464 | Medium | 4.0 | 2023-03-16 | Improper access control in Samsung Calendar prior to versions 12.4.02.9000 in Android 13 and 12.3.08.2000 in Android 12 allows local attacker to configure impr… |
CVE-2023-21463 | Medium | 4.0 | 2023-03-16 | Improper access control vulnerability in MyFiles application prior to versions 12.2.09.0 in Android 11, 13.1.03.501 in Android 12 and 14.1.03.0 in Android 13 a… |
CVE-2023-21462 | Medium | 4.2 | 2023-03-16 | The sensitive information exposure vulnerability in Quick Share Agent prior to versions 3.5.14.18 in Android 12 and 3.5.16.20 in Android 13 allows to local att… |
CVE-2023-21461 | Medium | 4.0 | 2023-03-16 | Improper authorization vulnerability in AutoPowerOnOffConfirmDialog in Settings prior to SMR Mar-2023 Release 1 allows local attacker to turn device off via un… |
CVE-2023-21460 | Medium | 4.4 | 2023-03-16 | Improper authentication in SecSettings prior to SMR Mar-2023 Release 1 allows attacker to reset the setting. |
CVE-2023-21459 | Medium | 5.0 | 2023-03-16 | Use after free vulnerability in decon driver prior to SMR Mar-2023 Release 1 allows attackers to cause memory access fault. |
CVE-2023-21458 | Medium | 6.2 | 2023-03-16 | Improper privilege management vulnerability in PhoneStatusBarPolicy in System UI prior to SMR Mar-2023 Release 1 allows attacker to turn off Do not disturb via… |
CVE-2023-21457 | Medium | 4.1 | 2023-03-16 | Improper access control vulnerability in Bluetooth prior to SMR Mar-2023 Release 1 allows attackers to send file via Bluetooth without related permission. |
CVE-2023-21456 | Critical | 9.0 | 2023-03-16 | Path traversal vulnerability in Galaxy Themes Service prior to SMR Mar-2023 Release 1 allows attacker to access arbitrary file with system uid. |
CVE-2023-21455 | Medium | 5.9 | 2023-03-16 | Improper authorization implementation in Exynos baseband prior to SMR Mar-2023 Release 1 allows incorrect handling of unencrypted message. |
CVE-2023-21454 | Low | 2.4 | 2023-03-16 | Improper authorization in Samsung Keyboard prior to SMR Mar-2023 Release 1 allows physical attacker to access users text history on the lockscreen. |
CVE-2023-21453 | Medium | 6.0 | 2023-03-16 | Improper input validation vulnerability in SoftSim TA prior to SMR Mar-2023 Release 1 allows local attackers access to protected data. |
CVE-2023-21452 | Low | 3.3 | 2023-03-16 | Improper usage of implicit intent in Bluetooth prior to SMR Mar-2023 Release 1 allows attacker to get MAC address of connected device. |
CVE-2023-21449 | Medium | 4.0 | 2023-03-16 | Improper access control vulnerability in Call application prior to SMR Mar-2023 Release 1 allows local attackers to access sensitive information without proper… |
CVE-2023-1390 | High | 7.5 | 2023-03-16 | A remote denial of service vulnerability was found in the Linux kernel’s TIPC kernel module. The while loop in tipc_link_xmit() hits an unknown state while att… |
CVE-2023-0598 | High | 7.8 | 2023-03-16 | GE Digital Proficy iFIX 2022, GE Digital Proficy iFIX v6.1, and GE Digital Proficy iFIX v6.5 are vulnerable to code injection, which may allow an attacker to… |
CVE-2023-1256 | Critical | 9.8 | 2023-03-16 | The listed versions of AVEVA Plant SCADA and AVEVA Telemetry Server are vulnerable to an improper authorization exploit which could allow an unauthenticated us… |
CVE-2023-0811 | Critical | 9.1 | 2023-03-16 | Omron CJ1M unit v4.0 and prior has improper access controls on the memory region where the UM password is stored. If an adversary issues a PROGRAM AREA WRITE… |
CVE-2023-28110 | Medium | 5.7 | 2023-03-16 | Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, refactoring coco's SSH/SFTP service and We… |
CVE-2023-28109 | Medium | 6.5 | 2023-03-16 | Play With Docker is a browser-based Docker playground. Versions 0.0.2 and prior are vulnerable to domain hijacking. Because CORS configuration was not correct… |
CVE-2023-28108 | High | 7.9 | 2023-03-16 | Pimcore is an open source data and experience management platform. Prior to version 10.5.19, quoting is not done properly in UUID DAO model. There is the theor… |
CVE-2023-28106 | Medium | 6.1 | 2023-03-16 | Pimcore is an open source data and experience management platform. Prior to version 10.5.19, an attacker can use cross-site scripting to send a malicious scrip… |
CVE-2023-28105 | High | 8.8 | 2023-03-16 | go-used-util has commonly used utility functions for Go. Versions prior to 0.0.34 have a ZipSlip issue when using fsutil package to unzip files. When users use… |
CVE-2023-27041 | Critical | 9.8 | 2023-03-16 | School Registration and Fee System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at/bilal final/edit_user.php. |
CVE-2023-28104 | High | 7.5 | 2023-03-16 | `silverstripe/graphql` serves Silverstripe data as GraphQL representations. In versions 4.2.2 and 4.1.1, an attacker could use a specially crafted graphql quer… |
CVE-2023-28101 | Medium | 5.0 | 2023-03-16 | Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, i… |
CVE-2023-28100 | Critical | 10.0 | 2023-03-16 | Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 conta… |
CVE-2023-27040 | Critical | 9.8 | 2023-03-16 | Simple Image Gallery v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the username parameter. |
CVE-2023-28155 | Medium | 6.1 | 2023-03-16 | The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP… |
CVE-2023-27789 | High | 7.5 | 2023-03-16 | An issue found in TCPprep v.4.4.3 allows a remote attacker to cause a denial of service via the cidr2cidr function at the cidr.c:178 endpoint. |
CVE-2023-27788 | High | 7.5 | 2023-03-16 | An issue found in TCPrewrite v.4.4.3 allows a remote attacker to cause a denial of service via the ports2PORT function at the portmap.c:69 endpoint. |
CVE-2023-27787 | High | 7.5 | 2023-03-16 | An issue found in TCPprep v.4.4.3 allows a remote attacker to cause a denial of service via the parse_list function at the list.c:81 endpoint. |
CVE-2023-27786 | High | 7.5 | 2023-03-16 | An issue found in TCPprep v.4.4.3 allows a remote attacker to cause a denial of service via the macinstring function. |
CVE-2023-27785 | High | 7.5 | 2023-03-16 | An issue found in TCPreplay TCPprep v.4.4.3 allows a remote attacker to cause a denial of service via the parse endpoints function. |
CVE-2023-27784 | High | 7.5 | 2023-03-16 | An issue found in TCPReplay v.4.4.3 allows a remote attacker to cause a denial of service via the read_hexstring function at the utils.c:309 endpoint. |
CVE-2023-27783 | High | 7.5 | 2023-03-16 | An issue found in TCPreplay tcprewrite v.4.4.3 allows a remote attacker to cause a denial of service via the tcpedit_dlt_cleanup function at plugins/dlt_plugin… |
CVE-2023-27711 | Medium | 4.8 | 2023-03-16 | Cross Site Scripting vulnerability found in Typecho v.1.2.0 allows a remote attacker to execute arbitrary code via the Comment Manager /admin/manage-comments.p… |
CVE-2023-27709 | High | 7.2 | 2023-03-16 | SQL injection vulnerability found in DedeCMS v.5.7.106 allows a remote attacker to execute arbitrary code via the rank_* parameter in the /dedestory_catalog.ph… |
CVE-2023-27707 | High | 7.2 | 2023-03-16 | SQL injection vulnerability found in DedeCMS v.5.7.106 allows a remote attacker to execute arbitrary code via the rank_* parameter in the /dede/group_store.php… |
CVE-2023-27131 | Medium | 4.8 | 2023-03-16 | Cross Site Scripting vulnerability found in Typecho v.1.2.0 allows a remote attacker to execute arbitrary code viathe Post Editorparameter. |
CVE-2023-27130 | Medium | 4.8 | 2023-03-16 | Cross Site Scripting vulnerability found in Typecho v.1.2.0 allows a remote attacker to execute arbitrary code via an arbitrarily supplied URL parameter. |
CVE-2023-27037 | High | 8.8 | 2023-03-16 | Qibosoft QiboCMS v7 was discovered to contain a remote code execution (RCE) vulnerability via the Get_Title function at label_set_rs.php |
CVE-2023-26769 | High | 7.5 | 2023-03-16 | Buffer Overflow vulnerability found in Liblouis Lou_Trace v.3.24.0 allows a remote attacker to cause a denial of service via the resolveSubtable function at co… |
CVE-2023-26768 | High | 7.5 | 2023-03-16 | Buffer Overflow vulnerability found in Liblouis v.3.24.0 allows a remote attacker to cause a denial of service via the compileTranslationTable.c and lou_setDat… |
CVE-2023-26767 | High | 7.5 | 2023-03-16 | Buffer Overflow vulnerability found in Liblouis v.3.24.0 allows a remote attacker to cause a denial of service via the lou_logFile function at logginc.c endpoi… |
CVE-2023-27875 | High | 7.5 | 2023-03-16 | IBM Aspera Faspex 5.0.4 could allow a user to change other user's credentials due to improper access controls. IBM X-Force ID: 249847. |
CVE-2023-27250 | Critical | 9.8 | 2023-03-16 | Online Book Store Project v1.0 is vulnerable to SQL Injection via /bookstore/bookPerPub.php. |
CVE-2023-1433 | Medium | 4.7 | 2023-03-16 | A vulnerability was found in SourceCodester Gadget Works Online Ordering System 1.0. It has been classified as problematic. This affects an unknown part of the… |
CVE-2023-1432 | High | 7.3 | 2023-03-16 | A vulnerability was found in SourceCodester Online Food Ordering System 2.0 and classified as critical. Affected by this issue is some unknown functionality of… |
CVE-2023-1431 | Medium | 5.3 | 2023-03-16 | The WP Simple Shopping Cart plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.6.3 due to the plugin savi… |
CVE-2023-24671 | High | 7.8 | 2023-03-16 | VX Search v13.8 and v14.7 was discovered to contain an unquoted service path vulnerability which allows attackers to execute arbitrary commands at elevated pri… |
CVE-2023-1429 | Medium | 5.4 | 2023-03-16 | Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19. |
CVE-2023-24571 | High | 7.5 | 2023-03-16 | Dell BIOS contains an Improper Input Validation vulnerability. A local authenticated malicious user with administrator privileges could potentially exploit th… |
CVE-2023-27095 | Medium | 6.5 | 2023-03-16 | Insecure Permissions vulnerability found in OpenGoofy Hippo4j v.1.4.3 allows attacker toescalate privileges via the AddUser method of the UserController functi… |
CVE-2023-27084 | Medium | 5.3 | 2023-03-16 | Permissions vulnerability found in isoftforce Dreamer CMS v.4.0.1 allows local attackers to obtain sensitive information via the AttachmentController parameter. |
CVE-2023-26784 | Critical | 9.8 | 2023-03-16 | SQL Injection vulnerability found in Kirin Fortress Machine v.1.7-2020-0610 allows attackers to execute arbitrary code via the /admin.php?controller=admin_comm… |
CVE-2023-24795 | Critical | 9.8 | 2023-03-16 | Command execution vulnerability was discovered in JHR-N916R router firmware version<=21.11.1.1483. |
CVE-2023-24760 | High | 8.8 | 2023-03-16 | An issue found in Ofcms v.1.1.4 allows a remote attacker to to escalate privileges via the respwd method in SysUserController. |
CVE-2023-23150 | Critical | 9.8 | 2023-03-16 | SA-WR915ND router firmware v17.35.1 was discovered to be vulnerable to code execution. |
CVE-2023-28487 | Medium | 5.3 | 2023-03-16 | Sudo before 1.9.13 does not escape control characters in sudoreplay output. |
CVE-2023-28486 | Medium | 5.3 | 2023-03-16 | Sudo before 1.9.13 does not escape control characters in log messages. |
CVE-2023-26951 | Medium | 5.4 | 2023-03-16 | onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Member List module. |
CVE-2023-25281 | High | 7.5 | 2023-03-16 | A stack overflow vulnerability exists in pingV4Msg component in D-Link DIR820LA1_FW105B03, allows attackers to cause a denial of service via the nextPage param… |
CVE-2023-25280 | Critical | 9.8 | 2023-03-16 | OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parame… |
CVE-2023-28466 | High | 7.0 | 2023-03-16 | do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading to a race condition (with a resultant use-after-free… |
CVE-2023-28461 | Critical | 9.8 | 2023-03-15 | Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using… |
CVE-2023-28460 | High | 7.2 | 2023-03-15 | A command injection vulnerability was discovered in Array Networks APV products. A remote attacker can send a crafted packet after logging into the affected ap… |
CVE-2023-28338 | High | 7.5 | 2023-03-15 | Any request send to a Netgear Nighthawk Wifi6 Router (RAX30)'s web service containing a “Content-Type” of “multipartboundary=” will result in the request body… |
CVE-2023-28337 | High | 8.8 | 2023-03-15 | When uploading a firmware image to a Netgear Nighthawk Wifi6 Router (RAX30), a hidden “forceFWUpdate” parameter may be provided to force the upgrade to complet… |
CVE-2023-28099 | Medium | 5.9 | 2023-03-15 | OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.9 and 3.2.6, if `ds_is_in_list()` is used with an invalid IP addre… |
CVE-2023-28098 | Medium | 5.9 | 2023-03-15 | OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, a specially crafted Authorization header causes OpenS… |
CVE-2023-28097 | High | 7.5 | 2023-03-15 | OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.9 and 3.2.6, a malformed SIP message containing a large _Content-L… |
CVE-2023-24468 | Critical | 9.8 | 2023-03-15 | Broken access control in Advanced Authentication versions prior to 6.4.1.1 and 6.3.7.2 |
CVE-2023-1421 | Low | 3.5 | 2023-03-15 | A reflected cross-site scripting vulnerability in the OAuth flow completion endpoints in Mattermost allows an attacker to send AJAX requests on behalf of the v… |
CVE-2023-1389 | High | 8.8 | 2023-03-15 | TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci… |
CVE-2023-28096 | Medium | 4.5 | 2023-03-15 | OpenSIPS, a Session Initiation Protocol (SIP) server implementation, has a memory leak starting in the 2.3 branch and priot to versions 3.1.8 and 3.2.5. The me… |
CVE-2023-28095 | High | 7.5 | 2023-03-15 | OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.1.7 and 3.2.4 have a potential issue in `msg_translator.c:2628` whic… |
CVE-2023-27601 | High | 7.5 | 2023-03-15 | OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, OpenSIPS crashes when a malformed SDP body is receive… |
CVE-2023-27600 | High | 7.5 | 2023-03-15 | OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, OpenSIPS crashes when a malformed SDP body is receive… |
CVE-2023-25267 | High | 8.8 | 2023-03-15 | An issue was discovered in GFI Kerio Connect 9.4.1 patch 1 (fixed in 10.0.0). There is a stack-based Buffer Overflow in the webmail component's 2FASetup functi… |
CVE-2023-28450 | High | 7.5 | 2023-03-15 | An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020. |
CVE-2023-27599 | High | 7.5 | 2023-03-15 | OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, when the function `append_hf` handles a SIP message w… |
CVE-2023-27598 | High | 7.5 | 2023-03-15 | OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, sending a malformed `Via` header to OpenSIPS triggers… |
CVE-2023-27597 | High | 7.5 | 2023-03-15 | OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.8 and 3.2.5, when a specially crafted SIP message is processed by… |
CVE-2023-27596 | High | 7.5 | 2023-03-15 | OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.8 and 3.2.5, OpenSIPS crashes when a malformed SDP body is sent mu… |
CVE-2023-26484 | High | 8.2 | 2023-03-15 | KubeVirt is a virtual machine management add-on for Kubernetes. In versions 0.59.0 and prior, if a malicious user has taken over a Kubernetes node where virt-h… |
CVE-2023-22591 | Low | 3.9 | 2023-03-15 | IBM Robotic Process Automation 21.0.1 through 21.0.7 and 23.0.0 through 23.0.1 could allow a user with physical access to the system due to session tokens for… |
CVE-2023-26912 | Medium | 4.8 | 2023-03-15 | Cross site scripting (XSS) vulnerability in xenv S-mall-ssm thru commit 3d9e77f7d80289a30f67aaba1ae73e375d33ef71 on Feb 17, 2020, allows local attackers to exe… |
CVE-2023-25680 | Medium | 4.2 | 2023-03-15 | IBM Robotic Process Automation 21.0.1 through 21.0.5 is vulnerable to insufficiently protecting credentials. Queue Provider credentials are not obfuscated wh… |
CVE-2023-25345 | High | 7.5 | 2023-03-15 | Directory traversal vulnerability in swig-templates thru 2.0.4 and swig thru 1.4.2, allows attackers to read arbitrary files via the include or extends tags. |
CVE-2023-25344 | Critical | 9.8 | 2023-03-15 | An issue was discovered in swig-templates thru 2.0.4 and swig thru 1.4.2, allows attackers to execute arbitrary code via crafted Object.prototype anonymous fun… |
CVE-2023-25282 | Medium | 6.5 | 2023-03-15 | A heap overflow vulnerability in D-Link DIR820LA1_FW106B02 allows attackers to cause a denial of service via the config.log_to_syslog and log_opt_dropPackets p… |