2023 CVEs (page 288)
Page 288 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-20940 | High | 7.8 | 2023-02-28 | In the Android operating system, there is a possible way to replace a boot partition due to improperly used crypto. This could lead to local escalation of priv… |
CVE-2023-20939 | High | 7.8 | 2023-02-28 | In multiple functions of looper_backed_event_loop.cpp, there is a possible way to corrupt memory due to improper locking. This could lead to local escalation o… |
CVE-2023-20938 | High | 7.8 | 2023-02-28 | In binder_transaction_buffer_release of binder.c, there is a possible use after free due to improper input validation. This could lead to local escalation of p… |
CVE-2023-20937 | High | 7.8 | 2023-02-28 | In several functions of the Android Linux kernel, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of pri… |
CVE-2023-20934 | High | 7.8 | 2023-02-28 | In resolveAttributionSource of ServiceUtilities.cpp, there is a possible way to disable the microphone privacy indicator due to a permissions bypass. This coul… |
CVE-2023-20933 | High | 7.8 | 2023-02-28 | In several functions of MediaCodec.cpp, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege wit… |
CVE-2023-20932 | Low | 3.3 | 2023-02-28 | In onCreatePreferences of EditInfoFragment.java, there is a possible way to read contacts belonging to other users due to improper input validation. This could… |
CVE-2023-20857 | Medium | 6.8 | 2023-02-28 | VMware Workspace ONE Content contains a passcode bypass vulnerability. A malicious actor, with access to a users rooted device, may be able to bypass the VMwar… |
CVE-2023-0511 | Critical | 9.1 | 2023-02-28 | Relative Path Traversal vulnerability in ForgeRock Access Management Java Policy Agent allows Authentication Bypass. This issue affects Access Management Java… |
CVE-2023-0339 | Critical | 9.1 | 2023-02-28 | Relative Path Traversal vulnerability in ForgeRock Access Management Web Policy Agent allows Authentication Bypass. This issue affects Access Management Web Po… |
CVE-2023-26256 | High | 7.5 | 2023-02-28 | An unauthenticated path traversal vulnerability affects the "STAGIL Navigation for Jira - Menu & Themes" plugin before 2.0.52 for Jira. By modifying the fileNa… |
CVE-2023-26255 | High | 7.5 | 2023-02-28 | An unauthenticated path traversal vulnerability affects the "STAGIL Navigation for Jira - Menu & Themes" plugin before 2.0.52 for Jira. By modifying the fileNa… |
CVE-2023-25807 | High | 7.2 | 2023-02-28 | DataEase is an open source data visualization and analysis tool. When saving a dashboard on the DataEase platform saved data can be modified and store maliciou… |
CVE-2023-25266 | High | 8.8 | 2023-02-28 | An issue was discovered in Docmosis Tornado prior to version 2.9.5. An authenticated attacker can change the Office directory setting pointing to an arbitrary… |
CVE-2023-25265 | High | 7.5 | 2023-02-28 | Docmosis Tornado <= 2.9.4 is vulnerable to Directory Traversal leading to the disclosure of arbitrary content on the file system. |
CVE-2023-25264 | High | 7.5 | 2023-02-28 | An issue was discovered in Docmosis Tornado prior to version 2.9.5. An unauthenticated attacker can bypass the authentication check filter completely by introd… |
CVE-2023-23983 | Medium | 5.4 | 2023-02-28 | Cross-Site Request Forgery (CSRF) vulnerability in wpdevart Responsive Vertical Icon Menu plugin <= 1.5.8 can lead to theme deletion. |
CVE-2023-23865 | Medium | 4.3 | 2023-02-28 | Cross-Site Request Forgery (CSRF) vulnerability in Checkout Plugins Stripe Payments For WooCommerce plugin <= 1.4.10 leads to settings change. |
CVE-2023-0461 | High | 7.8 | 2023-02-28 | There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel con… |
CVE-2023-24419 | High | 7.1 | 2023-02-28 | Cross-Site Request Forgery (CSRF) vulnerability in Strategy11 Form Builder Team Formidable Forms plugin <= 5.5.6 versions. |
CVE-2023-23992 | Medium | 4.3 | 2023-02-28 | Cross-Site Request Forgery (CSRF) vulnerability in AutomatorWP plugin <= 2.5.0 leads to object delete. |
CVE-2023-1080 | Medium | 6.1 | 2023-02-28 | The GN Publisher plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to, and including, 1.5.5 due to in… |
CVE-2023-1028 | Medium | 4.3 | 2023-02-28 | The WP Meta SEO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.3. This is due to missing or incorrect n… |
CVE-2023-1027 | Medium | 4.3 | 2023-02-28 | The WP Meta SEO plugin for WordPress is vulnerable to unauthorized sitemap generation due to a missing capability check on the checkAllCategoryInSitemap functi… |
CVE-2023-1026 | Medium | 4.3 | 2023-02-28 | The WP Meta SEO plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the listPostsCategory function in versio… |
CVE-2023-1024 | Medium | 4.3 | 2023-02-28 | The WP Meta SEO plugin for WordPress is vulnerable to unauthorized sitemap generation due to a missing capability check on the regenerateSitemaps function in v… |
CVE-2023-1023 | Medium | 5.4 | 2023-02-28 | The WP Meta SEO plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the saveSitemapSettings function… |
CVE-2023-1022 | Medium | 5.4 | 2023-02-28 | The WP Meta SEO plugin for WordPress is vulnerable to unauthorized options update due to a missing capability check on the wpmsGGSaveInformation function in ve… |
CVE-2023-26105 | High | 7.5 | 2023-02-28 | All versions of the package utilities are vulnerable to Prototype Pollution via the _mix function. |
CVE-2023-22995 | High | 7.8 | 2023-02-28 | In the Linux kernel before 5.17, an error path in dwc3_qcom_acpi_register_core in drivers/usb/dwc3/dwc3-qcom.c lacks certain platform_device_put and kfree call… |
CVE-2023-1081 | Medium | 4.8 | 2023-02-28 | Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3. |
CVE-2023-1055 | Medium | 5.5 | 2023-02-27 | A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which… |
CVE-2023-26043 | Medium | 6.5 | 2023-02-27 | GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. GeoNode is vulnerable to an XML External E… |
CVE-2023-26041 | Low | 2.6 | 2023-02-27 | Nextcloud Talk is a fully on-premises audio/video and chat communication service. When cron jobs were misconfigured and therefore messages are not expired, the… |
CVE-2023-24258 | Critical | 9.8 | 2023-02-27 | SPIP v4.1.5 and earlier was discovered to contain a SQL injection vulnerability via the _oups parameter. This vulnerability allows attackers to execute arbitra… |
CVE-2023-23531 | High | 8.6 | 2023-02-27 | The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3. An app may be able to execute arbit… |
CVE-2023-23530 | High | 8.6 | 2023-02-27 | The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3. An app may be able to execute arbit… |
CVE-2023-23529 | High | 8.8 | 2023-02-27 | A type confusion issue was addressed with improved checks. This issue is fixed in iOS 15.7.4 and iPadOS 15.7.4, iOS 16.3.1 and iPadOS 16.3.1, macOS Ventura 13… |
CVE-2023-23524 | High | 7.5 | 2023-02-27 | A denial-of-service issue was addressed with improved input validation. This issue is fixed in tvOS 16.3.2, iOS 16.3.1 and iPadOS 16.3.1, watchOS 9.3.1, macOS… |
CVE-2023-23522 | Medium | 5.5 | 2023-02-27 | A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Ventura 13.2.1. An app may be able to observe unprotected… |
CVE-2023-23520 | Medium | 5.9 | 2023-02-27 | A race condition was addressed with additional validation. This issue is fixed in watchOS 9.3, tvOS 16.3, macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3. A user… |
CVE-2023-23519 | High | 7.5 | 2023-02-27 | A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 9.3, tvOS 16.3, macOS Ventura 13.2, iOS 16.3 and iPadOS… |
CVE-2023-23518 | High | 8.8 | 2023-02-27 | The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, watchOS 9.3, macOS Big Sur 11.7.3, Saf… |
CVE-2023-23517 | High | 8.8 | 2023-02-27 | The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, watchOS 9.3, macOS Big Sur 11.7.3, Saf… |
CVE-2023-23514 | High | 7.8 | 2023-02-27 | A use after free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, iOS 16.3.1 and iPadOS 1… |
CVE-2023-23513 | Critical | 9.8 | 2023-02-27 | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.7.3, macOS Ventura 13.2, macOS Monterey 12.6.3. Mo… |
CVE-2023-23512 | Medium | 6.5 | 2023-02-27 | The issue was addressed with improved handling of caches. This issue is fixed in watchOS 9.3, tvOS 16.3, macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3. Visiting… |
CVE-2023-23511 | Medium | 5.5 | 2023-02-27 | The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3, tvOS 16.3, w… |
CVE-2023-23510 | Medium | 5.5 | 2023-02-27 | A permissions issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.2. An app may be able to access a user’s Safari history. |
CVE-2023-23508 | Medium | 5.5 | 2023-02-27 | The issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.7.3, macOS Ventura 13.2, macOS Monterey 12.6.3. An app may be ab… |
CVE-2023-23507 | High | 7.8 | 2023-02-27 | The issue was addressed with improved bounds checks. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2. An app may be able to execute arbitrary… |
CVE-2023-23506 | Medium | 5.5 | 2023-02-27 | A permissions issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.2. An app may be able to access user-sensitive data. |
CVE-2023-23505 | Low | 3.3 | 2023-02-27 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, watchOS 9… |
CVE-2023-23504 | High | 7.8 | 2023-02-27 | The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, watchOS 9.3, iOS 15.7.3 and iPadOS 15… |
CVE-2023-23503 | Medium | 5.5 | 2023-02-27 | A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3, iOS 15.7.3 and iPadOS 15.7.3… |
CVE-2023-23502 | Medium | 5.5 | 2023-02-27 | An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, iOS 16.3 and i… |
CVE-2023-23501 | Medium | 5.5 | 2023-02-27 | The issue was addressed with improved memory handling This issue is fixed in macOS Ventura 13.2. An app may be able to disclose kernel memory. |
CVE-2023-23500 | Medium | 5.5 | 2023-02-27 | The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3, iOS 15.7.3 and iPadOS 15.7.3, tvOS… |
CVE-2023-23499 | Medium | 5.5 | 2023-02-27 | This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, watchOS 9.3, macOS Big Sur 11.7.3, tvO… |
CVE-2023-23498 | Low | 3.3 | 2023-02-27 | A logic issue was addressed with improved state management. This issue is fixed in iOS 15.7.3 and iPadOS 15.7.3, macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3… |
CVE-2023-23497 | High | 7.8 | 2023-02-27 | A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.7.3, macOS Ventura 13.2, macOS Monterey 12.6.3. An app may… |
CVE-2023-23496 | High | 8.8 | 2023-02-27 | The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.2, watchOS 9.3, iOS 15.7.2 and iPadOS 15.7.2, Safari 16.3, tvOS 16.3, iOS… |
CVE-2023-23493 | Low | 3.3 | 2023-02-27 | A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.2, macOS Monterey 12.6.3. An encrypted volume may be unmoun… |
CVE-2023-24253 | Critical | 9.8 | 2023-02-27 | Domotica Labs srl Ikon Server before v2.8.6 was discovered to contain a SQL injection vulnerability. |
CVE-2023-24249 | High | 7.2 | 2023-02-27 | An arbitrary file upload vulnerability in laravel-admin v1.8.19 allows attackers to execute arbitrary code via a crafted PHP file. |
CVE-2023-26762 | High | 8.8 | 2023-02-27 | Sme.UP ERP TOKYO V6R1M220406 was discovered to contain an arbitrary file upload vulnerability. |
CVE-2023-26760 | High | 7.5 | 2023-02-27 | Sme.UP ERP TOKYO V6R1M220406 was discovered to contain an information disclosure vulnerability via the /debug endpoint. This vulnerability allows attackers to… |
CVE-2023-26759 | High | 8.8 | 2023-02-27 | Sme.UP ERP TOKYO V6R1M220406 was discovered to contain an OS command injection vulnerability via calls made to the XMService component. |
CVE-2023-26758 | High | 7.5 | 2023-02-27 | Sme.UP TOKYO V6R1M220406 was discovered to contain an arbitrary file download vulnerabilty via the component /ResourceService. |
CVE-2023-25235 | High | 7.5 | 2023-02-27 | Tenda AC500 V2.0.1.9(1307) is vulnerable to Buffer Overflow in function formOneSsidCfgSet via parameter ssid. |
CVE-2023-25234 | Critical | 9.8 | 2023-02-27 | Tenda AC500 V2.0.1.9(1307) is vulnerable to Buffer Overflow in function fromAddressNat via parameters entrys and mitInterface. |
CVE-2023-25233 | Critical | 9.8 | 2023-02-27 | Tenda AC500 V2.0.1.9(1307) is vulnerable to Buffer Overflow in function fromRouteStatic via parameters entrys and mitInterface. |
CVE-2023-25231 | Critical | 9.8 | 2023-02-27 | Tenda Router W30E V1.0.1.25(633) is vulnerable to Buffer Overflow in function fromRouteStatic via parameters entrys and mitInterface. |
CVE-2023-24656 | High | 8.8 | 2023-02-27 | Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the subject parameter under the Create Ticket f… |
CVE-2023-24654 | High | 8.8 | 2023-02-27 | Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter under the Request a Quote fu… |
CVE-2023-24653 | High | 8.8 | 2023-02-27 | Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the oldpass parameter under the Change Password… |
CVE-2023-24652 | High | 8.8 | 2023-02-27 | Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the Description parameter under the Create tick… |
CVE-2023-24651 | Medium | 5.4 | 2023-02-27 | Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter on the registration page. |
CVE-2023-24364 | High | 8.8 | 2023-02-27 | Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter under the Admin Panel. |
CVE-2023-24251 | Medium | 5.4 | 2023-02-27 | WangEditor v5 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /dist/index.js. |
CVE-2023-23158 | Medium | 5.4 | 2023-02-27 | A stored cross-site scripting (XSS) vulnerability in Art Gallery Management System Project v1.0 allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2023-23157 | Medium | 5.4 | 2023-02-27 | A stored cross-site scripting (XSS) vulnerability in Art Gallery Management System Project v1.0 allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2023-23156 | Critical | 9.8 | 2023-02-27 | Art Gallery Management System Project in PHP 1.0 was discovered to contain a SQL injection vulnerability via the pid parameter in the single-product page. |
CVE-2023-23155 | Critical | 9.8 | 2023-02-27 | Art Gallery Management System Project in PHP 1.0 was discovered to contain a SQL injection vulnerability via the username parameter in the Admin Login. |
CVE-2023-1070 | High | 7.1 | 2023-02-27 | External Control of File Name or Path in GitHub repository nilsteampassnet/teampass prior to 3.0.0.22. |
CVE-2023-0552 | Medium | 5.4 | 2023-02-27 | The Registration Forms WordPress plugin before 3.8.2.3 does not properly validate the redirection URL when logging in and login out, leading to an Open Redirec… |
CVE-2023-0548 | Medium | 4.8 | 2023-02-27 | The Namaste! LMS WordPress plugin before 2.5.9.4 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to per… |
CVE-2023-0543 | Medium | 4.8 | 2023-02-27 | The Arigato Autoresponder and Newsletter WordPress plugin before 2.1.7.2 does not sanitize and escape some of its settings, which could allow high-privilege us… |
CVE-2023-0539 | Medium | 5.4 | 2023-02-27 | The GS Insever Portfolio WordPress plugin before 1.4.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post… |
CVE-2023-0535 | Medium | 5.4 | 2023-02-27 | The Donation Block For PayPal WordPress plugin before 2.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page… |
CVE-2023-0487 | High | 7.2 | 2023-02-27 | The My Sticky Elements WordPress plugin before 2.0.9 does not properly sanitise and escape a parameter before using it in a SQL statement when deleting message… |
CVE-2023-0381 | High | 8.8 | 2023-02-27 | The GigPress WordPress plugin through 2.3.28 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could al… |
CVE-2023-0334 | Medium | 6.1 | 2023-02-27 | The ShortPixel Adaptive Images WordPress plugin before 3.6.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refle… |
CVE-2023-0331 | High | 7.5 | 2023-02-27 | The Correos Oficial WordPress plugin through 1.2.0.2 does not have an authorization check user input validation when generating a file path, allowing unauthent… |
CVE-2023-0279 | High | 7.2 | 2023-02-27 | The Media Library Assistant WordPress plugin before 3.06 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL… |
CVE-2023-0278 | High | 7.2 | 2023-02-27 | The GeoDirectory WordPress plugin before 2.2.24 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injectio… |
CVE-2023-0230 | Medium | 5.4 | 2023-02-27 | The VK All in One Expansion Unit WordPress plugin before 9.86.0.0 does not validate and escape some of its block options before outputting them back in a page/… |
CVE-2023-0168 | Medium | 5.4 | 2023-02-27 | The Olevmedia Shortcodes WordPress plugin through 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/pos… |
CVE-2023-0043 | Medium | 6.1 | 2023-02-27 | The Custom Add User WordPress plugin through 2.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross… |
CVE-2023-27266 | Low | 2.7 | 2023-02-27 | Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the /api/v4/users/me/teams API endpoint, allowing an attacker with team… |