2023 CVEs (page 287)
Page 287 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-0594 | High | 7.3 | 2023-03-01 | Grafana is an open-source platform for monitoring and observability. Starting with the 7.0 branch, Grafana had a stored XSS vulnerability in the trace view v… |
CVE-2023-0507 | High | 7.3 | 2023-03-01 | Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch, Grafana had a stored XSS vulnerability affecting the core… |
CVE-2023-25544 | High | 7.5 | 2023-03-01 | Dell NetWorker versions 19.5 and earlier contain 'Apache Tomcat' version disclosure vulnerability. A NetWorker server user with remote access to NetWorker cli… |
CVE-2023-25222 | High | 8.8 | 2023-03-01 | A heap-based buffer overflow vulnerability exits in GNU LibreDWG v0.12.5 via the bit_read_RC function at bits.c. |
CVE-2023-25221 | High | 7.8 | 2023-03-01 | Libde265 v1.0.10 was discovered to contain a heap-buffer-overflow vulnerability in the derive_spatial_luma_vector_prediction function in motion.cc. |
CVE-2023-24758 | Medium | 5.5 | 2023-03-01 | libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ff_hevc_put_weighted_pred_avg_8_sse function at sse-motion.cc. This vulnerability… |
CVE-2023-24757 | Medium | 5.5 | 2023-03-01 | libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the put_unweighted_pred_16_fallback function at fallback-motion.cc. This vulnerability… |
CVE-2023-24756 | Medium | 5.5 | 2023-03-01 | libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ff_hevc_put_unweighted_pred_8_sse function at sse-motion.cc. This vulnerability al… |
CVE-2023-24755 | Medium | 5.5 | 2023-03-01 | libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the put_weighted_pred_8_fallback function at fallback-motion.cc. This vulnerability al… |
CVE-2023-24754 | Medium | 5.5 | 2023-03-01 | libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ff_hevc_put_weighted_pred_avg_8_sse function at sse-motion.cc. This vulnerability… |
CVE-2023-24752 | Medium | 5.5 | 2023-03-01 | libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ff_hevc_put_hevc_epel_pixels_8_sse function at sse-motion.cc. This vulnerability a… |
CVE-2023-24751 | Medium | 6.5 | 2023-03-01 | libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the mc_chroma function at motion.cc. This vulnerability allows attackers to cause a De… |
CVE-2023-24567 | High | 7.5 | 2023-03-01 | Dell NetWorker versions 19.5 and earlier contain 'RabbitMQ' version disclosure vulnerability. A NetWorker server user with remote access to NetWorker clients… |
CVE-2023-23315 | Critical | 9.8 | 2023-03-01 | The PrestaShop e-commerce platform module stripejs contains a Blind SQL injection vulnerability up to version 4.5.5. The method `stripejsValidationModuleFrontC… |
CVE-2023-1117 | Medium | 5.4 | 2023-03-01 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18. |
CVE-2023-1116 | Medium | 5.4 | 2023-03-01 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18. |
CVE-2023-1115 | Medium | 5.4 | 2023-03-01 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18. |
CVE-2023-23984 | Medium | 4.3 | 2023-03-01 | Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Bubble Menu – circle floating menu plugin <= 3.0.1 leading to form deletion. |
CVE-2023-23974 | Medium | 4.3 | 2023-03-01 | Cross-Site Request Forgery (CSRF) vulnerability in Fullworks Quick Event Manager plugin <= 9.7.4 affecting all registration actions (delete, delete all, edit… |
CVE-2023-23973 | Medium | 4.3 | 2023-03-01 | Cross-Site Request Forgery (CSRF) vulnerability in a3rev Software Contact Us Page – Contact People plugin <= 3.7.0. |
CVE-2023-1114 | Critical | 9.8 | 2023-03-01 | Missing Authorization vulnerability in Eskom e-Belediye allows Information Elicitation. This issue affects e-Belediye: from 1.0.0.95 before 1.0.0.100. |
CVE-2023-1064 | Critical | 9.8 | 2023-03-01 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Uzay Baskul Weighbridge Automation Software allows SQL In… |
CVE-2023-1113 | Low | 2.4 | 2023-03-01 | A vulnerability was found in SourceCodester Simple Payroll System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functi… |
CVE-2023-1112 | Medium | 4.7 | 2023-03-01 | A vulnerability was found in Drag and Drop Multiple File Upload Contact Form 7 5.0.6.1 on WordPress. It has been classified as critical. Affected is an unknown… |
CVE-2023-26281 | Medium | 5.9 | 2023-03-01 | IBM HTTP Server 8.5 used by IBM WebSphere Application Server could allow a remote user to cause a denial of service using a specially crafted URL. IBM X-Force… |
CVE-2023-22778 | Medium | 4.8 | 2023-03-01 | A vulnerability in the ArubaOS web management interface could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack agai… |
CVE-2023-22777 | Medium | 4.9 | 2023-03-01 | An authenticated information disclosure vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of this vulnerability resul… |
CVE-2023-22776 | Medium | 4.9 | 2023-03-01 | An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability results in the abilit… |
CVE-2023-22775 | Medium | 6.5 | 2023-03-01 | A vulnerability exists which allows an authenticated attacker to access sensitive information on the ArubaOS command line interface. Successful exploitation co… |
CVE-2023-22774 | High | 7.2 | 2023-03-01 | Authenticated path traversal vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the abilit… |
CVE-2023-22773 | High | 7.2 | 2023-03-01 | Authenticated path traversal vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the abilit… |
CVE-2023-22772 | Medium | 6.5 | 2023-03-01 | An authenticated path traversal vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of this vulnerability results in th… |
CVE-2023-22771 | Medium | 6.8 | 2023-03-01 | An insufficient session expiration vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability allows an attacker… |
CVE-2023-22770 | High | 7.2 | 2023-03-01 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the abi… |
CVE-2023-22769 | High | 7.2 | 2023-03-01 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the abi… |
CVE-2023-22768 | High | 7.2 | 2023-03-01 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the abi… |
CVE-2023-22767 | High | 7.2 | 2023-03-01 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the abi… |
CVE-2023-22766 | High | 7.2 | 2023-03-01 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the abi… |
CVE-2023-22765 | High | 7.2 | 2023-03-01 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the abi… |
CVE-2023-22764 | High | 7.2 | 2023-03-01 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the abi… |
CVE-2023-22763 | High | 7.2 | 2023-03-01 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the abi… |
CVE-2023-22762 | High | 7.2 | 2023-03-01 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the abi… |
CVE-2023-22761 | High | 7.2 | 2023-03-01 | Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities re… |
CVE-2023-22760 | High | 7.2 | 2023-03-01 | Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities re… |
CVE-2023-22759 | High | 7.2 | 2023-03-01 | Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities re… |
CVE-2023-22758 | High | 7.2 | 2023-03-01 | Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities re… |
CVE-2023-22757 | High | 8.1 | 2023-03-01 | There are buffer overflow vulnerabilities in multiple underlying operating system processes that could lead to unauthenticated remote code execution by sending… |
CVE-2023-22756 | High | 8.1 | 2023-03-01 | There are buffer overflow vulnerabilities in multiple underlying operating system processes that could lead to unauthenticated remote code execution by sending… |
CVE-2023-22755 | High | 8.1 | 2023-03-01 | There are buffer overflow vulnerabilities in multiple underlying operating system processes that could lead to unauthenticated remote code execution by sending… |
CVE-2023-22754 | High | 8.1 | 2023-03-01 | There are buffer overflow vulnerabilities in multiple underlying operating system processes that could lead to unauthenticated remote code execution by sending… |
CVE-2023-22753 | High | 8.1 | 2023-03-01 | There are buffer overflow vulnerabilities in multiple underlying operating system processes that could lead to unauthenticated remote code execution by sending… |
CVE-2023-22752 | Critical | 9.8 | 2023-03-01 | There are stack-based buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to… |
CVE-2023-22751 | Critical | 9.8 | 2023-03-01 | There are stack-based buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to… |
CVE-2023-22750 | Critical | 9.8 | 2023-03-01 | There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to… |
CVE-2023-22749 | Critical | 9.8 | 2023-03-01 | There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to… |
CVE-2023-22748 | Critical | 9.8 | 2023-03-01 | There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to… |
CVE-2023-22747 | Critical | 9.8 | 2023-03-01 | There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to… |
CVE-2023-20085 | Medium | 6.1 | 2023-03-01 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cros… |
CVE-2023-20075 | Medium | 6.0 | 2023-03-01 | Vulnerability in the CLI of Cisco Secure Email Gateway could allow an authenticated, remote attacker to execute arbitrary commands. These vulnerability is d… |
CVE-2023-20053 | Medium | 6.1 | 2023-03-01 | A vulnerability in the web-based management interface of Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to conduct a cross-site scriptin… |
CVE-2023-20052 | Medium | 5.3 | 2023-03-01 | On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the DMG file parser of ClamAV versions 1.0.0… |
CVE-2023-20032 | Critical | 9.8 | 2023-03-01 | On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file parser of ClamAV ver… |
CVE-2023-20014 | High | 7.5 | 2023-03-01 | A vulnerability in the DNS functionality of Cisco Nexus Dashboard Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) c… |
CVE-2023-20009 | Medium | 6.5 | 2023-03-01 | A vulnerability in the Web UI and administrative CLI of the Cisco Secure Email Gateway (ESA) and Cisco Secure Email and Web Manager (SMA) could allow an authen… |
CVE-2023-0953 | High | 8.8 | 2023-03-01 | Insufficient input sanitization in the documentation feature of Devolutions Server 2022.3.12 and earlier allows an authenticated attacker to perform an SQL Inj… |
CVE-2023-0952 | Medium | 6.5 | 2023-03-01 | Improper access controls on entries in Devolutions Server 2022.3.12 and earlier could allow an authenticated user to access sensitive data without proper aut… |
CVE-2023-0951 | High | 8.8 | 2023-03-01 | Improper access controls on some API endpoints in Devolutions Server 2022.3.12 and earlier could allow a standard privileged user to perform privileged actio… |
CVE-2023-0567 | High | 7.7 | 2023-03-01 | In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such in… |
CVE-2023-1105 | High | 8.1 | 2023-03-01 | External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3. |
CVE-2023-1104 | Medium | 5.4 | 2023-03-01 | Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3. |
CVE-2023-26608 | Medium | 5.4 | 2023-03-01 | SOLDR (System of Orchestration, Lifecycle control, Detection and Response) 1.1.0 allows stored XSS via the module editor. |
CVE-2023-24045 | Medium | 6.5 | 2023-03-01 | In Dataiku DSS 11.2.1, an attacker can download other Dataiku files that were uploaded to the myfiles section by specifying the target username in a download r… |
CVE-2023-0847 | Medium | 5.3 | 2023-03-01 | The Sub-IoT implementation of the DASH 7 Alliance protocol has a vulnerability that can lead to an out-of-bounds write prior to implementation version 0.5.0… |
CVE-2023-25575 | High | 7.7 | 2023-02-28 | API Platform Core is the server component of API Platform: hypermedia and GraphQL APIs. Resource properties secured with the `security` option of the `ApiPlatf… |
CVE-2023-1095 | Medium | 5.5 | 2023-02-28 | In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction object. nft_trans_destroy() calls list_d… |
CVE-2023-22999 | Medium | 5.5 | 2023-02-28 | In the Linux kernel before 5.16.3, drivers/usb/dwc3/dwc3-qcom.c misinterprets the dwc3_qcom_create_urs_usb_platdev return value (expects it to be NULL in the e… |
CVE-2023-22998 | Medium | 5.5 | 2023-02-28 | In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misinterprets the drm_gem_shmem_get_sg_table return value (expects it to be NULL in t… |
CVE-2023-22997 | Medium | 5.5 | 2023-02-28 | In the Linux kernel before 6.1.2, kernel/module/decompress.c misinterprets the module_get_next_page return value (expects it to be NULL in the error case, wher… |
CVE-2023-22996 | Medium | 5.5 | 2023-02-28 | In the Linux kernel before 5.17.2, drivers/soc/qcom/qcom_aoss.c does not release an of_find_device_by_node reference after use, e.g., with put_device. |
CVE-2023-1100 | Medium | 6.3 | 2023-02-28 | A vulnerability classified as critical has been found in SourceCodester Online Catering Reservation System 1.0. This affects an unknown part of the file /reser… |
CVE-2023-1099 | Medium | 6.3 | 2023-02-28 | A vulnerability was found in SourceCodester Online Student Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functio… |
CVE-2023-27372 | Critical | 9.8 | 2023-02-28 | SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4… |
CVE-2023-27371 | Medium | 5.9 | 2023-02-28 | GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_crea… |
CVE-2023-1065 | Medium | 6.5 | 2023-02-28 | This vulnerability in the Snyk Kubernetes Monitor can result in irrelevant data being posted to a Snyk Organization, which could in turn obfuscate other, relev… |
CVE-2023-1017 | High | 7.8 | 2023-02-28 | An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDe… |
CVE-2023-27320 | High | 7.2 | 2023-02-28 | Sudo before 1.9.13p2 has a double free in the per-command chroot feature. |
CVE-2023-25432 | High | 7.2 | 2023-02-28 | An issue was discovered in Online Reviewer Management System v1.0. There is a SQL injection that can directly issue instructions to the background database sys… |
CVE-2023-25431 | Medium | 4.8 | 2023-02-28 | An issue was discovered in Online Reviewer Management System v1.0. There is a XSS vulnerability via reviewer_0/admins/assessments/course/course-update.php. |
CVE-2023-1018 | Medium | 5.5 | 2023-02-28 | An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end of a TPM2.0 command in the CryptParameterDecryption r… |
CVE-2023-27295 | Medium | 5.4 | 2023-02-28 | Cross-site request forgery is facilitated by OpenCATS failure to require CSRF tokens in POST requests. An attacker can exploit this issue by creating a dummy p… |
CVE-2023-27294 | Medium | 5.4 | 2023-02-28 | Improper neutralization of input during web page generation allows an authenticated attacker with access to a restricted account to submit malicious Javascript… |
CVE-2023-27293 | Medium | 6.1 | 2023-02-28 | Improper neutralization of input during web page generation allows an unauthenticated attacker to submit malicious Javascript as the answer to a questionnaire… |
CVE-2023-27292 | Medium | 5.4 | 2023-02-28 | An open redirect vulnerability exposes OpenCATS to template injection due to improper validation of user-supplied GET parameters. |
CVE-2023-25540 | Medium | 6.0 | 2023-02-28 | Dell PowerScale OneFS 9.4.0.x contains an incorrect default permissions vulnerability. A local malicious user could potentially exploit this vulnerability to… |
CVE-2023-23689 | Medium | 5.3 | 2023-02-28 | Dell PowerScale nodes A200, A2000, H400, H500, H600, H5600, F800, F810 integrated hardware management software contains an uncontrolled resource consumption v… |
CVE-2023-20948 | High | 7.5 | 2023-02-28 | In dropFramesUntilIframe of AAVCAssembler.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disc… |
CVE-2023-20946 | Critical | 9.8 | 2023-02-28 | In onStart of BluetoothSwitchPreferenceController.java, there is a possible permission bypass due to a confused deputy. This could lead to remote escalation of… |
CVE-2023-20945 | High | 7.8 | 2023-02-28 | In phNciNfc_MfCreateXchgDataHdr of phNxpExtns_MifareStd.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local es… |
CVE-2023-20944 | High | 7.8 | 2023-02-28 | In run of ChooseTypeAndAccountActivity.java, there is a possible escalation of privilege due to unsafe deserialization. This could lead to local escalation of… |
CVE-2023-20943 | High | 7.8 | 2023-02-28 | In clearApplicationUserData of ActivityManagerService.java, there is a possible way to remove system files due to a path traversal error. This could lead to lo… |