2023 CVEs (page 28)
Page 28 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-50179 | Medium | 4.8 | 2024-07-09 | An improper certificate validation vulnerability [CWE-295] in FortiADC 7.4.0, 7.2 all versions, 7.1 all versions, 7.0 all versions may allow a remote and unaut… |
CVE-2023-50178 | High | 7.4 | 2024-07-09 | An improper certificate validation vulnerability [CWE-295] in FortiADC 7.4.0, 7.2.0 through 7.2.3, 7.1 all versions, 7.0 all versions, 6.2 all versions, 6.1 al… |
CVE-2023-40702 | | 2024-07-09 | PingOne MFA Integration Kit contains a vulnerability where the skipMFA action can be configured such that user authentication does not require the second facto… | |
CVE-2023-40356 | | 2024-07-09 | PingOne MFA Integration Kit contains a vulnerability related to the Prompt Users to Set Up MFA configuration. Under certain conditions, this configuration coul… | |
CVE-2023-39328 | Medium | 5.5 | 2024-07-09 | A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an application crash thro… |
CVE-2023-52891 | Medium | 5.3 | 2024-07-09 | A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.5), SIMATIC Energy Manager PRO (All versions < V7.5), SIMATIC IPC DiagBa… |
CVE-2023-52238 | Medium | 4.3 | 2024-07-09 | A vulnerability has been identified in RUGGEDCOM RST2228 (All versions < V5.9.0), RUGGEDCOM RST2228P (All versions < V5.9.0). The web server of the affected sy… |
CVE-2023-52237 | High | 7.5 | 2024-07-09 | A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RU… |
CVE-2023-32737 | Medium | 6.3 | 2024-07-09 | A vulnerability has been identified in SIMATIC STEP 7 Safety V18 (All versions < V18 Update 2). Affected applications do not properly restrict the .NET BinaryF… |
CVE-2023-32735 | Medium | 6.5 | 2024-07-09 | A vulnerability has been identified in SIMATIC STEP 7 Safety V16 (All versions < V16 Update 7), SIMATIC STEP 7 Safety V17 (All versions < V17 Update 7), SIMATI… |
CVE-2023-3290 | Medium | 5.0 | 2024-07-09 | A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user (customer) in the system. This results in unauthorized dat… |
CVE-2023-3289 | High | 7.7 | 2024-07-09 | A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the system (including admin). This results in unauthori… |
CVE-2023-3288 | High | 8.5 | 2024-07-09 | A BOLA vulnerability in POST /providers allows a low privileged user to create a privileged user (provider) in the system. This results in privilege escalation. |
CVE-2023-3287 | Critical | 9.9 | 2024-07-09 | A BOLA vulnerability in POST /admins allows a low privileged user to create a high privileged user (admin) in the system. This results in privilege escalation. |
CVE-2023-3286 | High | 7.7 | 2024-07-09 | A BOLA vulnerability in POST /secretaries allows a low privileged user to create a low privileged user (secretary) in the system. This results in unauthorized… |
CVE-2023-38055 | Critical | 9.6 | 2024-07-09 | A BOLA vulnerability in GET, PUT, DELETE /services/{serviceId} allows a low privileged user to fetch, modify or delete the services of any user (including admi… |
CVE-2023-38054 | Critical | 9.9 | 2024-07-09 | A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} allows a low privileged user to fetch, modify or delete a low privileged user (customer). This… |
CVE-2023-38053 | Critical | 9.9 | 2024-07-09 | A BOLA vulnerability in GET, PUT, DELETE /settings/{settingName} allows a low privileged user to fetch, modify or delete the settings of any user (including ad… |
CVE-2023-38052 | Critical | 9.9 | 2024-07-09 | A BOLA vulnerability in GET, PUT, DELETE /admins/{adminId} allows a low privileged user to fetch, modify or delete a high privileged user (admin). This results… |
CVE-2023-38051 | Critical | 9.9 | 2024-07-09 | A BOLA vulnerability in GET, PUT, DELETE /secretaries/{secretaryId} allows a low privileged user to fetch, modify or delete a low privileged user (secretary)… |
CVE-2023-38050 | Critical | 9.1 | 2024-07-09 | A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} allows a low privileged user to fetch, modify or delete a webhook of any user (including admin)… |
CVE-2023-38049 | Critical | 9.9 | 2024-07-09 | A BOLA vulnerability in GET, PUT, DELETE /appointments/{appointmentId} allows a low privileged user to fetch, modify or delete an appointment of any user (incl… |
CVE-2023-38048 | Critical | 9.9 | 2024-07-09 | A BOLA vulnerability in GET, PUT, DELETE /providers/{providerId} allows a low privileged user to fetch, modify or delete a privileged user (provider). This res… |
CVE-2023-38047 | High | 8.5 | 2024-07-09 | A BOLA vulnerability in GET, PUT, DELETE /categories/{categoryId} allows a low privileged user to fetch, modify or delete the category of any user (including a… |
CVE-2023-3285 | High | 7.7 | 2024-07-09 | A BOLA vulnerability in POST /appointments allows a low privileged user to create an appointment for any user in the system (including admin). This results in… |
CVE-2023-50383 | High | 7.2 | 2024-07-08 | Three os command injection vulnerabilities exist in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP req… |
CVE-2023-50382 | High | 7.2 | 2024-07-08 | Three os command injection vulnerabilities exist in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP req… |
CVE-2023-50381 | High | 7.2 | 2024-07-08 | Three os command injection vulnerabilities exist in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP req… |
CVE-2023-50330 | High | 7.2 | 2024-07-08 | A stack-based buffer overflow vulnerability exists in the boa getInfo functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP r… |
CVE-2023-50244 | High | 7.2 | 2024-07-08 | Two stack-based buffer overflow vulnerabilities exist in the boa formIpQoS functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of H… |
CVE-2023-50243 | High | 7.2 | 2024-07-08 | Two stack-based buffer overflow vulnerabilities exist in the boa formIpQoS functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of H… |
CVE-2023-50240 | High | 7.2 | 2024-07-08 | Two stack-based buffer overflow vulnerabilities exist in the boa set_RadvdInterfaceParam functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially craft… |
CVE-2023-50239 | High | 7.2 | 2024-07-08 | Two stack-based buffer overflow vulnerabilities exist in the boa set_RadvdInterfaceParam functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially craft… |
CVE-2023-49867 | High | 7.2 | 2024-07-08 | A stack-based buffer overflow vulnerability exists in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP r… |
CVE-2023-49595 | High | 7.2 | 2024-07-08 | A stack-based buffer overflow vulnerability exists in the boa rollback_control_code functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted se… |
CVE-2023-49593 | High | 7.2 | 2024-07-08 | Leftover debug code exists in the boa formSysCmd functionality of LevelOne WBR-6013 RER4_A_v3411b_2T2R_LEV_09_170623. A specially crafted network request can l… |
CVE-2023-49073 | High | 7.2 | 2024-07-08 | A stack-based buffer overflow vulnerability exists in the boa formFilter functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTT… |
CVE-2023-48270 | High | 7.2 | 2024-07-08 | A stack-based buffer overflow vulnerability exists in the boa formDnsv6 functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of netw… |
CVE-2023-47856 | High | 7.2 | 2024-07-08 | A stack-based buffer overflow vulnerability exists in the boa set_RadvdPrefixParam functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted ser… |
CVE-2023-47677 | High | 8.8 | 2024-07-08 | A cross-site request forgery (csrf) vulnerability exists in the boa CSRF protection functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted ne… |
CVE-2023-46685 | Critical | 9.8 | 2024-07-08 | A hard-coded password vulnerability exists in the telnetd functionality of LevelOne WBR-6013 RER4_A_v3411b_2T2R_LEV_09_170623. A set of specially crafted netwo… |
CVE-2023-45742 | High | 7.2 | 2024-07-08 | An integer overflow vulnerability exists in the boa updateConfigIntoFlash functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HT… |
CVE-2023-45215 | High | 7.2 | 2024-07-08 | A stack-based buffer overflow vulnerability exists in the boa setRepeaterSsid functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series o… |
CVE-2023-41251 | High | 7.2 | 2024-07-08 | A stack-based buffer overflow vulnerability exists in the boa formRoute functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP… |
CVE-2023-34435 | High | 7.2 | 2024-07-08 | A firmware update vulnerability exists in the boa formUpload functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted network packets can lead… |
CVE-2023-52340 | High | 7.5 | 2024-07-05 | The IPv6 implementation in the Linux kernel before 6.3 has a net/ipv6/route.c max_size threshold that can be consumed easily, e.g., leading to a denial of serv… |
CVE-2023-52169 | High | 8.2 | 2024-07-03 | The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz) contains an out-of-bounds read that allows an attacker to read beyond the intended buffer. The… |
CVE-2023-52168 | High | 8.4 | 2024-07-03 | The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz) contains a heap-based buffer overflow that allows an attacker to overwrite two bytes at multip… |
CVE-2023-24531 | Critical | 9.8 | 2024-07-02 | Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a… |
CVE-2023-51778 | Medium | 5.5 | 2024-07-02 | Out-of-Bounds Write vulnerability in Jungo WinDriver before 12.1.0 allows local attackers to cause a Windows blue screen error and Denial of Service (DoS). |
CVE-2023-51777 | Medium | 5.5 | 2024-07-02 | Denial of Service (DoS) vulnerability in Jungo WinDriver before 12.1.0 allows local attackers to cause a Windows blue screen error. |
CVE-2023-51776 | High | 7.8 | 2024-07-02 | Improper privilege management in Jungo WinDriver before 12.1.0 allows local attackers to escalate privileges and execute arbitrary code. |
CVE-2023-41928 | Medium | 5.3 | 2024-07-02 | The device is observed to accept deprecated TLS protocols, increasing the risk of cryptographic weaknesses. |
CVE-2023-41927 | Medium | 5.3 | 2024-07-02 | The server supports at least one cipher suite which is on the NCSC-NL list of cipher suites to be phased out, increasing the risk of cryptographic weaknesses. |
CVE-2023-41926 | High | 8.8 | 2024-07-02 | The webserver utilizes basic authentication for its user login to the configuration interface. As encryption is disabled on port 80, it enables potential eaves… |
CVE-2023-41923 | High | 7.2 | 2024-07-02 | The user management section of the web application permits the creation of user accounts with excessively weak passwords, including single-character passwords. |
CVE-2023-41922 | High | 7.2 | 2024-07-02 | A 'Cross-site Scripting' (XSS) vulnerability, characterized by improper input neutralization during web page generation, has been discovered. This vulnerabilit… |
CVE-2023-41921 | Critical | 9.8 | 2024-07-02 | A vulnerability allows attackers to download source code or an executable from a remote location and execute the code without sufficiently verifying the origin… |
CVE-2023-41920 | Critical | 9.8 | 2024-07-02 | The vulnerability allows attackers access to the root account without having to authenticate. Specifically, if the device is configured with the IP address of… |
CVE-2023-41919 | Critical | 9.8 | 2024-07-02 | Hardcoded credentials are discovered within the application's source code, creating a potential security risk for unauthorized access. |
CVE-2023-41918 | Critical | 10.0 | 2024-07-02 | A vulnerability allows unauthorized access to functionality inadequately constrained by ACLs. Attackers may exploit this to unauthenticated execute commands po… |
CVE-2023-41917 | Critical | 10.0 | 2024-07-02 | Inadequate input validation exposes the system to potential remote code execution (RCE) risks. Attackers can exploit this vulnerability by appending shell comm… |
CVE-2023-43554 | High | 8.4 | 2024-07-01 | Memory corruption while processing IOCTL handler in FastRPC. |
CVE-2023-50964 | Medium | 5.4 | 2024-06-30 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2023-50953 | Medium | 5.4 | 2024-06-30 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. This… |
CVE-2023-50952 | Medium | 5.4 | 2024-06-30 | IBM InfoSphere Information Server 11.7 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized reque… |
CVE-2023-50954 | Medium | 4.3 | 2024-06-30 | IBM InfoSphere Information Server 11.7 returns sensitive information in URL information that could be used in further attacks against the system. IBM X-Force… |
CVE-2023-35022 | Low | 3.3 | 2024-06-30 | IBM InfoSphere Information Server 11.7 could allow a local user to update projects that they do not have the authorization to access. IBM X-Force ID: 258254. |
CVE-2023-4017 | Medium | 6.1 | 2024-06-29 | The Goya theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘attra-color’, 'attra-size', and 'product-cata' parameters in versions up… |
CVE-2023-47803 | Medium | 5.3 | 2024-06-28 | A vulnerability regarding improper limitation of a pathname to a restricted directory ('Path Traversal') is found in the Language Settings functionality. This… |
CVE-2023-47802 | High | 7.2 | 2024-06-28 | A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is found in the IP block functionality. Th… |
CVE-2023-52892 | High | 7.5 | 2024-06-27 | In phpseclib before 1.0.22, 2.x before 2.0.46, and 3.x before 3.0.33, some characters in Subject Alternative Name fields in TLS certificates are incorrectly al… |
CVE-2023-38370 | High | 7.5 | 2024-06-27 | IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1, under certain configurations, could allow a user on the network to install malicious packages. I… |
CVE-2023-38368 | Medium | 5.5 | 2024-06-27 | IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could disclose sensitive information to a local user to do improper permission controls. IBM X-Fo… |
CVE-2023-30998 | High | 7.8 | 2024-06-27 | IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain root access due to improper access controls. IBM X-Force ID… |
CVE-2023-30997 | High | 7.8 | 2024-06-27 | IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain root access due to improper access controls. IBM X-Force ID… |
CVE-2023-42014 | Medium | 5.4 | 2024-06-27 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.2.0.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to… |
CVE-2023-42011 | Medium | 4.3 | 2024-06-27 | IBM Sterling B2B Integrator Standard Edition 6.1 and 6.2 does not restrict or incorrectly restricts frame objects or UI layers that belong to another applicati… |
CVE-2023-38371 | Medium | 5.9 | 2024-06-27 | IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly… |
CVE-2023-30430 | Medium | 5.5 | 2024-06-27 | IBM Security Verify Access 10.0.0 through 10.0.7.1 could allow a local user to obtain sensitive information from trace logs. IBM X-Force ID: 252183. |
CVE-2023-7270 | Medium | 5.3 | 2024-06-27 | An issue was discovered in SoftMaker Office 2024 / NX before revision 1214 and SoftMaker FreeOffice 2014 before revision 1215. FreeOffice 2021 is also affected… |
CVE-2023-26877 | Medium | 6.3 | 2024-06-26 | File upload vulnerability found in Softexpert Excellence Suite v.2.1 allows attackers to execute arbitrary code via a .php file upload to the form/efms_exec_ht… |
CVE-2023-37541 | Low | 3.5 | 2024-06-25 | HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios. |
CVE-2023-5038 | High | 7.5 | 2024-06-25 | badmonkey, a Security Researcher has found a flaw that allows for a unauthenticated DoS attack on the camera. An attacker runs a crafted URL, nobody can access… |
CVE-2023-6198 | Critical | 9.3 | 2024-06-25 | Use of Hard-coded Credentials vulnerability in Baicells Snap Router BaiCE_BMI on EP3011 (User Passwords modules) allows unauthorized access to the device. |
CVE-2023-50029 | Critical | 10.0 | 2024-06-24 | PHP Injection vulnerability in the module "M4 PDF Extensions" (m4pdf) up to version 3.3.2 from PrestaAddons for PrestaShop allows attackers to run arbitrary co… |
CVE-2023-45195 | Medium | 5.3 | 2024-06-24 | Adminer and AdminerEvo are vulnerable to SSRF via database connection fields. This could allow an unauthenticated remote attacker to enumerate or access system… |
CVE-2023-45196 | High | 7.5 | 2024-06-24 | Adminer and AdminerEvo allow an unauthenticated remote attacker to cause a denial of service by connecting to an attacker-controlled service that responds with… |
CVE-2023-49793 | Medium | 6.5 | 2024-06-24 | CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Zip files uploaded to the server endpoin… |
CVE-2023-45673 | High | 8.9 | 2024-06-21 | Joplin is a free, open source note taking and to-do application. A remote code execution (RCE) vulnerability in affected versions allows clicking on a link in… |
CVE-2023-39517 | High | 8.2 | 2024-06-21 | Joplin is a free, open source note taking and to-do application. A Cross site scripting (XSS) vulnerability in affected versions allows clicking on an untruste… |
CVE-2023-38506 | High | 8.2 | 2024-06-21 | Joplin is a free, open source note taking and to-do application. A Cross-site Scripting (XSS) vulnerability allows pasting untrusted data into the rich text ed… |
CVE-2023-37898 | High | 8.2 | 2024-06-21 | Joplin is a free, open source note taking and to-do application. A Cross-site Scripting (XSS) vulnerability allows an untrusted note opened in safe mode to exe… |
CVE-2023-38389 | Critical | 9.8 | 2024-06-21 | Incorrect Authorization vulnerability in Artbees JupiterX Core allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JupiterX Core… |
CVE-2023-45197 | Critical | 9.8 | 2024-06-21 | The file upload plugin in Adminer and AdminerEvo allows an attacker to upload a file with a table name of “..” to the root of the Adminer directory. The attack… |
CVE-2023-51375 | Medium | 4.3 | 2024-06-21 | Missing Authorization vulnerability in WPDeveloper EmbedPress.This issue affects EmbedPress: from n/a through 3.8.3. |
CVE-2023-52884 | Medium | 4.4 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: Input: cyapa - add missing input core locking to suspend/resume functions Grab input->mut… |
CVE-2023-3352 | Medium | 4.3 | 2024-06-21 | The Smush plugin for WordPress is vulnerable to unauthorized deletion of the resmush list due to a missing capability check on the delete_resmush_list() functi… |
CVE-2023-49113 | High | 7.8 | 2024-06-20 | The Kiuwan Local Analyzer (KLA) Java scanning application contains several hard-coded secrets in plain text format. In some cases, this can potentially compr… |
CVE-2023-49112 | Medium | 6.5 | 2024-06-20 | Kiuwan provides an API endpoint /saas/rest/v1/info/application to get information about any application, providing only its name via the "application" param… |