2023 CVEs (page 286)
Page 286 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-27561 | High | 7.0 | 2023-03-03 | runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must… |
CVE-2023-24643 | Critical | 9.8 | 2023-03-03 | Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the sid parameter at /php-jms/updateBlankTxtview.php. |
CVE-2023-24642 | Critical | 9.8 | 2023-03-03 | Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the sid parameter at /php-jms/updateTxtview.php. |
CVE-2023-24641 | Critical | 9.8 | 2023-03-03 | Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the sid parameter at /php-jms/updateview.php. |
CVE-2023-26604 | High | 7.8 | 2023-03-03 | systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl sta… |
CVE-2023-20104 | Medium | 6.1 | 2023-03-03 | A vulnerability in the file upload functionality of Cisco Webex App for Web could allow an unauthenticated, remote attacker to conduct a cross-site scripting (… |
CVE-2023-20088 | Medium | 5.3 | 2023-03-03 | A vulnerability in the nginx configurations that are provided as part of the VPN-less reverse proxy for Cisco Finesse could allow an unauthenticated, remote at… |
CVE-2023-20079 | Critical | 9.8 | 2023-03-03 | Multiple vulnerabilities in the web-based management interface of certain Cisco IP Phones could allow an unauthenticated, remote attacker to execute arbitrary… |
CVE-2023-20078 | Critical | 9.8 | 2023-03-03 | Multiple vulnerabilities in the web-based management interface of certain Cisco IP Phones could allow an unauthenticated, remote attacker to execute arbitrary… |
CVE-2023-20069 | Medium | 5.4 | 2023-03-03 | A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager could allow an authent… |
CVE-2023-20062 | Medium | 6.5 | 2023-03-03 | Multiple vulnerabilities in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to collect sensitive information or perform a serve… |
CVE-2023-20061 | Medium | 6.5 | 2023-03-03 | Multiple vulnerabilities in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to collect sensitive information or perform a serve… |
CVE-2023-1165 | Medium | 5.5 | 2023-03-03 | A vulnerability was found in Zhong Bang CRMEB Java 1.3.4. It has been classified as critical. This affects an unknown part of the file /api/admin/system/store/… |
CVE-2023-0957 | High | 8.2 | 2023-03-03 | An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability that allows attackers… |
CVE-2023-1164 | High | 8.4 | 2023-03-03 | A vulnerability was found in KylinSoft kylin-activation on KylinOS and classified as critical. Affected by this issue is some unknown functionality of the comp… |
CVE-2023-1163 | Medium | 6.5 | 2023-03-03 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5 and classified as critical. Affected by this vulnerability… |
CVE-2023-1162 | High | 7.2 | 2023-03-03 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5. Affected is an unknown func… |
CVE-2023-0578 | Medium | 6.1 | 2023-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ASOS Information Technologies Book Cites allows Cross-Sit… |
CVE-2023-0577 | Medium | 6.1 | 2023-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ASOS Information Technologies SOBIAD allows Cross-Site Sc… |
CVE-2023-27560 | High | 7.5 | 2023-03-03 | Math/PrimeField.php in phpseclib 3.x before 3.0.19 has an infinite loop with composite primefields. |
CVE-2023-0457 | High | 7.5 | 2023-03-03 | Plaintext Storage of a Password vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series, MELSEC iQ-R Series, MELSEC-Q Series and MELSEC-L Series al… |
CVE-2023-1160 | Medium | 5.5 | 2023-03-03 | Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit prior to 2.4.0. |
CVE-2023-1101 | High | 8.8 | 2023-03-02 | SonicOS SSLVPN improper restriction of excessive MFA attempts vulnerability allows an authenticated attacker to use excessive MFA codes. |
CVE-2023-0656 | High | 7.5 | 2023-03-02 | A Stack-based buffer overflow vulnerability in the SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS), which could cause an impa… |
CVE-2023-22381 | Medium | 4.1 | 2023-03-02 | A code injection vulnerability was identified in GitHub Enterprise Server that allowed setting arbitrary environment variables from a single environment variab… |
CVE-2023-26476 | High | 7.5 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in version 3.2-m3, users can deduce the content of the password fields by repeated call to `LiveTableResult… |
CVE-2023-26475 | Critical | 9.9 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a restricted context… |
CVE-2023-26474 | Critical | 9.9 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in version 13.10, it's possible to use the right of an existing document content author to execute a text a… |
CVE-2023-26473 | Medium | 6.5 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in version 1.3-rc-1, any user with edit right can execute arbitrary database select and access data stored… |
CVE-2023-26472 | Critical | 9.9 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in version 6.2-milestone-1, one can execute any wiki content with the right of IconThemeSheet author by cre… |
CVE-2023-26471 | Critical | 9.9 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in version 11.6-rc-1, comments are supposed to be executed with the right of superadmin but in restricted m… |
CVE-2023-26470 | Medium | 5.7 | 2023-03-02 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to make the farm unusable by adding an o… |
CVE-2023-26056 | Medium | 5.4 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in version 3.0-milestone-1, it's possible to execute a script with the right of another user, provided the… |
CVE-2023-26055 | Critical | 9.9 | 2023-03-02 | XWiki Commons are technical libraries common to several other top level XWiki projects. Starting in version 3.1-milestone-1, any user can edit their own profil… |
CVE-2023-26052 | Low | 3.7 | 2023-03-02 | Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handled properly and thus… |
CVE-2023-26051 | Medium | 6.5 | 2023-03-02 | Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handled properly and thus… |
CVE-2023-1157 | Low | 2.8 | 2023-03-02 | A vulnerability, which was classified as problematic, was found in finixbit elf-parser. Affected is the function elf_parser::Elf_parser::get_segments of the fi… |
CVE-2023-1156 | Low | 3.5 | 2023-03-02 | A vulnerability classified as problematic was found in SourceCodester Health Center Patient Record Management System 1.0. This vulnerability affects unknown co… |
CVE-2023-0084 | High | 7.2 | 2023-03-02 | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via text areas on forms in versions up to, and inc… |
CVE-2023-26480 | High | 8.9 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in version 12.10, a user without script rights can introduce a stored cross-site scripting by using the Liv… |
CVE-2023-26479 | Medium | 6.5 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in version 6.0, users with write rights can insert well-formed content that is not handled well by the pars… |
CVE-2023-26478 | Medium | 6.6 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in version 14.3-rc-1, `org.xwiki.store.script.TemporaryAttachmentsScriptService#uploadTemporaryAttachment`… |
CVE-2023-26477 | Critical | 10.0 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in versions 6.3-rc-1 and 6.2.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and… |
CVE-2023-1155 | Medium | 6.4 | 2023-03-02 | The Cost Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the nd_cc_meta_box_cc_price_icon parameter in versions up to, and inc… |
CVE-2023-1118 | High | 7.8 | 2023-03-02 | A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the way user detaching rc device. A local user could use… |
CVE-2023-0085 | Medium | 5.3 | 2023-03-02 | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to reCaptcha Bypass in versions up to, and including, 3.2.1. This is due to insuf… |
CVE-2023-26780 | Critical | 9.8 | 2023-03-02 | CleverStupidDog yf-exam v 1.8.0 is vulnerable to SQL Injection. |
CVE-2023-25536 | Medium | 6.7 | 2023-03-02 | Dell PowerScale OneFS 9.4.0.x contains exposure of sensitive information to an unauthorized actor. A malicious authenticated local user could potentially expl… |
CVE-2023-25363 | High | 8.8 | 2023-03-02 | A use-after-free vulnerability in WebCore::RenderLayer::updateDescendantDependentFlags in WebKitGTK before 2.36.8 allows attackers to execute code remotely. |
CVE-2023-25362 | High | 8.8 | 2023-03-02 | A use-after-free vulnerability in WebCore::RenderLayer::repaintBlockSelectionGaps in WebKitGTK before 2.36.8 allows attackers to execute code remotely. |
CVE-2023-25361 | High | 8.8 | 2023-03-02 | A use-after-free vulnerability in WebCore::RenderLayer::setNextSibling in WebKitGTK before 2.36.8 allows attackers to execute code remotely. |
CVE-2023-25360 | High | 8.8 | 2023-03-02 | A use-after-free vulnerability in WebCore::RenderLayer::renderer in WebKitGTK before 2.36.8 allows attackers to execute code remotely. |
CVE-2023-25358 | High | 8.8 | 2023-03-02 | A use-after-free vulnerability in WebCore::RenderLayer::addChild in WebKitGTK before 2.36.8 allows attackers to execute code remotely. |
CVE-2023-1151 | Medium | 6.3 | 2023-03-02 | A vulnerability was found in SourceCodester Electronic Medical Records System 1.0. It has been declared as critical. Affected by this vulnerability is an unkno… |
CVE-2023-1149 | Medium | 5.4 | 2023-03-02 | Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.8.0. |
CVE-2023-26053 | Medium | 6.6 | 2023-03-02 | Gradle is a build tool with a focus on build automation and support for multi-language development. This is a collision attack on long IDs (64bits) for PGP key… |
CVE-2023-25806 | Medium | 5.3 | 2023-03-02 | OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. There is an observable discrepancy in the authenticati… |
CVE-2023-25155 | Medium | 5.5 | 2023-03-02 | Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SRANDMEMBER`, `ZRANDMEMBER`, and `HRANDFIELD` commands can… |
CVE-2023-1148 | Medium | 4.8 | 2023-03-02 | Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3. |
CVE-2023-1147 | Medium | 5.4 | 2023-03-02 | Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3. |
CVE-2023-1146 | Medium | 5.4 | 2023-03-02 | Cross-site Scripting (XSS) - Generic in GitHub repository flatpressblog/flatpress prior to 1.3. |
CVE-2023-1107 | Medium | 5.4 | 2023-03-02 | Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3. |
CVE-2023-1106 | Medium | 6.1 | 2023-03-02 | Cross-site Scripting (XSS) - Reflected in GitHub repository flatpressblog/flatpress prior to 1.3. |
CVE-2023-0228 | High | 8.8 | 2023-03-02 | Improper Authentication vulnerability in ABB Symphony Plus S+ Operations.This issue affects Symphony Plus S+ Operations: from 2.X through 2.1 SP2, 2.2, from 3… |
CVE-2023-0196 | Low | 3.3 | 2023-03-02 | NVIDIA CUDA Toolkit SDK contains a bug in cuobjdump, where a local user running the tool against an ill-formed binary may cause a null- pointer dereference, w… |
CVE-2023-26046 | Medium | 6.5 | 2023-03-02 | teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. In teler-waf prior to version 0.1.1 is vulnerable… |
CVE-2023-22462 | Medium | 6.4 | 2023-03-02 | Grafana is an open-source platform for monitoring and observability. On 2023-01-01 during an internal audit of Grafana, a member of the security team found a s… |
CVE-2023-0053 | High | 7.5 | 2023-03-02 | SAUTER Controls Nova 200–220 Series with firmware version 3.3-006 and prior and BACnetstac version 4.2.1 and prior have only FTP and Telnet available for dev… |
CVE-2023-24127 | Medium | 6.5 | 2023-03-01 | Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey1 parameter at /goform/WifiBasicSet. |
CVE-2023-24126 | Medium | 6.5 | 2023-03-01 | Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey4_5g parameter at /goform/WifiBasicSet. |
CVE-2023-24125 | Medium | 6.5 | 2023-03-01 | Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey2_5g parameter at /goform/WifiBasicSet. |
CVE-2023-24124 | Medium | 6.5 | 2023-03-01 | Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wrlEn parameter at /goform/WifiBasicSet. |
CVE-2023-24123 | Medium | 6.5 | 2023-03-01 | Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepauth parameter at /goform/WifiBasicSet. |
CVE-2023-24122 | Medium | 6.5 | 2023-03-01 | Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the ssid_5g parameter at /goform/WifiBasicSet. |
CVE-2023-24121 | Medium | 6.5 | 2023-03-01 | Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the security_5g parameter at /goform/WifiBasicSet. |
CVE-2023-24120 | Medium | 6.5 | 2023-03-01 | Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wrlEn_5g parameter at /goform/WifiBasicSet. |
CVE-2023-24119 | Medium | 6.5 | 2023-03-01 | Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the ssid parameter at /goform/WifiBasicSet. |
CVE-2023-24118 | Medium | 6.5 | 2023-03-01 | Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the security parameter at /goform/WifiBasicSet. |
CVE-2023-24117 | Medium | 6.5 | 2023-03-01 | Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepauth_5g parameter at /goform/WifiBasicSet. |
CVE-2023-22738 | Medium | 6.3 | 2023-03-01 | vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Assigning existing users to a different organizations is curren… |
CVE-2023-24134 | Medium | 6.5 | 2023-03-01 | Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey3 parameter at /goform/WifiBasicSet. |
CVE-2023-24133 | Medium | 6.5 | 2023-03-01 | Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey_5g parameter at /goform/WifiBasicSet. |
CVE-2023-24132 | Medium | 6.5 | 2023-03-01 | Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey3_5g parameter at /goform/WifiBasicSet. |
CVE-2023-24131 | Medium | 6.5 | 2023-03-01 | Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey1_5g parameter at /goform/WifiBasicSet. |
CVE-2023-24130 | Medium | 6.5 | 2023-03-01 | Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey parameter at /goform/WifiBasicSet. |
CVE-2023-24129 | Medium | 6.5 | 2023-03-01 | Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey4 parameter at /goform/WifiBasicSet. |
CVE-2023-24128 | Medium | 6.5 | 2023-03-01 | Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey2 parameter at /goform/WifiBasicSet. |
CVE-2023-23006 | Medium | 5.5 | 2023-03-01 | In the Linux kernel before 5.15.13, drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c misinterprets the mlx5_get_uars_page return value (expects it… |
CVE-2023-23005 | Medium | 5.5 | 2023-03-01 | In the Linux kernel before 6.2, mm/memory-tiers.c misinterprets the alloc_memory_type return value (expects it to be NULL in the error case, whereas it is actu… |
CVE-2023-23004 | Medium | 5.5 | 2023-03-01 | In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidp_planes.c misinterprets the get_sg_table return value (expects it to be NULL in the error case, wher… |
CVE-2023-23003 | Medium | 4.0 | 2023-03-01 | In the Linux kernel before 5.16, tools/perf/util/expr.c lacks a check for the hashmap__new return value. |
CVE-2023-23002 | Medium | 5.5 | 2023-03-01 | In the Linux kernel before 5.16.3, drivers/bluetooth/hci_qca.c misinterprets the devm_gpiod_get_index_optional return value (expects it to be NULL in the error… |
CVE-2023-23001 | Medium | 5.5 | 2023-03-01 | In the Linux kernel before 5.16.3, drivers/scsi/ufs/ufs-mediatek.c misinterprets the regulator_get return value (expects it to be NULL in the error case, where… |
CVE-2023-1131 | Low | 3.5 | 2023-03-01 | A vulnerability has been found in SourceCodester Computer Parts Sales and Inventory System 1.0 and classified as problematic. This vulnerability affects unknow… |
CVE-2023-1130 | Medium | 6.3 | 2023-03-01 | A vulnerability, which was classified as critical, was found in SourceCodester Computer Parts Sales and Inventory System 1.0. This affects an unknown part of t… |
CVE-2023-1097 | Critical | 9.3 | 2023-03-01 | Baicells EG7035-M11 devices with firmware through BCE-ODU-1.0.8 are vulnerable to improper code exploitation via HTTP GET command injections. Commands are exe… |
CVE-2023-25931 | Medium | 6.4 | 2023-03-01 | Medtronic identified that the Pelvic Health clinician apps, which are installed on the Smart Programmer mobile device, have a password vulnerability that requi… |
CVE-2023-23000 | Medium | 5.5 | 2023-03-01 | In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return value. Callers expect NULL in the error case, but an… |
CVE-2023-1127 | High | 7.8 | 2023-03-01 | Divide By Zero in GitHub repository vim/vim prior to 9.0.1367. |
CVE-2023-0460 | Medium | 5.1 | 2023-03-01 | The YouTube Embedded 1.2 SDK binds to a service within the YouTube Main App. After binding, a remote context is created with the flags Context.CONTEXT_INCLUDE_… |