2023 CVEs (page 293)
Page 293 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-0860 | High | 7.5 | 2023-02-16 | Improper Restriction of Excessive Authentication Attempts in GitHub repository modoboa/modoboa-installer prior to 2.0.4. |
CVE-2023-0861 | High | 7.2 | 2023-02-16 | NetModule NSRW web administration interface executes an OS command constructed with unsanitized user input. A successful exploit could allow an authenticated u… |
CVE-2023-0662 | High | 7.5 | 2023-02-16 | In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP form upload can cause high resource consumption and e… |
CVE-2023-0568 | High | 7.5 | 2023-02-16 | In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths… |
CVE-2023-0850 | Low | 2.7 | 2023-02-15 | A vulnerability was found in Netgear WNDR3700v2 1.0.1.14 and classified as problematic. This issue affects some unknown processing of the component Web Interfa… |
CVE-2023-0849 | Medium | 4.7 | 2023-02-15 | A vulnerability has been found in Netgear WNDR3700v2 1.0.1.14 and classified as critical. This vulnerability affects unknown code of the component Web Interfac… |
CVE-2023-0848 | Medium | 5.3 | 2023-02-15 | A vulnerability was found in Netgear WNDR3700v2 1.0.1.14. It has been rated as problematic. This issue affects some unknown processing of the component Web Man… |
CVE-2023-22855 | Critical | 9.8 | 2023-02-15 | Kardex Mlog MCC 5.7.12+0-a203c2a213-master allows remote code execution. It spawns a web interface listening on port 8088. A user-controllable path is handed t… |
CVE-2023-24499 | Medium | 4.3 | 2023-02-15 | Butterfly Button plugin may leave traces of its use on user's device. Since it is used for reporting domestic problems, this may lead to spouse knowing about i… |
CVE-2023-24498 | High | 7.5 | 2023-02-15 | An uspecified endpoint in the web server of the switch does not properly authenticate the user identity, and may allow downloading a config page with the passw… |
CVE-2023-23850 | Medium | 4.3 | 2023-02-15 | A missing permission check in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of… |
CVE-2023-23848 | Medium | 4.3 | 2023-02-15 | Missing permission checks in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allow attackers with Overall/Read permission to connect to an attacker-specifie… |
CVE-2023-23847 | Low | 3.5 | 2023-02-15 | A cross-site request forgery (CSRF) vulnerability in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers to connect to an attacker-specified HT… |
CVE-2023-23836 | High | 7.2 | 2023-02-15 | SolarWinds Platform version 2022.4.1 was found to be susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Or… |
CVE-2023-23467 | High | 8.1 | 2023-02-15 | Media CP Media Control Panel latest version. Reflected XSS possible through unspecified endpoint. |
CVE-2023-23466 | Medium | 6.5 | 2023-02-15 | Media CP Media Control Panel latest version. Insufficiently protected credential change. |
CVE-2023-23465 | Critical | 9.1 | 2023-02-15 | Media CP Media Control Panel latest version. CSRF possible through unspecified endpoint. |
CVE-2023-23464 | High | 8.1 | 2023-02-15 | Media CP Media Control Panel latest version. A Permissive Flash Cross-domain Policy may allow information disclosure. |
CVE-2023-23463 | Medium | 5.3 | 2023-02-15 | Sunell DVR, latest version, Insufficiently Protected Credentials (CWE-522) may be exposed through an unspecified request. |
CVE-2023-23462 | Critical | 9.8 | 2023-02-15 | Libpeconv – integer overflow, before commit 75b1565 (30/11/2022). |
CVE-2023-23461 | Critical | 9.8 | 2023-02-15 | Libpeconv – access violation, before commit b076013 (30/11/2022). |
CVE-2023-23460 | Critical | 9.1 | 2023-02-15 | Priority Web version 19.1.0.68, parameter manipulation on an unspecified end-point may allow authentication bypass. |
CVE-2023-23459 | Critical | 9.1 | 2023-02-15 | Priority Windows may allow Command Execution via SQL Injection using an unspecified method. |
CVE-2023-23458 | Medium | 6.5 | 2023-02-15 | Sunell DVR, latest version, CWE-200: Exposure of Sensitive Information to an Unauthorized Actor through an unspecified request. |
CVE-2023-22807 | Critical | 9.8 | 2023-02-15 | LS ELECTRIC XBC-DN32U with operating system version 01.80 does not properly control access to the PLC over its internal XGT protocol. An attacker could contro… |
CVE-2023-22806 | High | 7.5 | 2023-02-15 | LS ELECTRIC XBC-DN32U with operating system version 01.80 transmits sensitive information in cleartext when communicating over its XGT protocol. This could all… |
CVE-2023-22805 | Medium | 6.5 | 2023-02-15 | LS ELECTRIC XBC-DN32U with operating system version 01.80 has improper access control to its read prohibition feature. This could allow a remote attacker to re… |
CVE-2023-22804 | Critical | 9.1 | 2023-02-15 | LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication to create users on the PLC. This could allow an attacker to create and use… |
CVE-2023-22803 | High | 7.5 | 2023-02-15 | LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication to perform critical functions to the PLC. This could allow an attacker to c… |
CVE-2023-0361 | High | 7.4 | 2023-02-15 | A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be sufficient to recover the key encryp… |
CVE-2023-0103 | High | 7.5 | 2023-02-15 | If an attacker were to access memory locations of LS ELECTRIC XBC-DN32U with operating system version 01.80 that are outside of the communication buffer, the d… |
CVE-2023-0102 | Critical | 9.1 | 2023-02-15 | LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication for its deletion command. This could allow an attacker to delete arbitrary… |
CVE-2023-25578 | High | 7.5 | 2023-02-15 | Starlite is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 1.5.2, the request body parsing in `starlite` allows a potentially unau… |
CVE-2023-25192 | Medium | 5.3 | 2023-02-15 | AMI MegaRAC SPX devices allow User Enumeration through Redfish. The fixed versions are SPx12-update-7.00 and SPx13-update-5.00. |
CVE-2023-25191 | High | 7.5 | 2023-02-15 | AMI MegaRAC SPX devices allow Password Disclosure through Redfish. The fixed versions are SPx_12-update-7.00 and SPx_13-update-5.00. |
CVE-2023-25171 | High | 7.5 | 2023-02-15 | Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt denial-of-service atta… |
CVE-2023-25156 | High | 7.5 | 2023-02-15 | Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt brute-force attacks ag… |
CVE-2023-25768 | Medium | 6.5 | 2023-02-15 | A missing permission check in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers with Overall/Read permission to connect to an att… |
CVE-2023-25767 | High | 8.8 | 2023-02-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers to connect to an attacker-… |
CVE-2023-25766 | Medium | 4.3 | 2023-02-15 | A missing permission check in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers with Overall/Read permission to enumerate credent… |
CVE-2023-25765 | Critical | 9.9 | 2023-02-15 | In Jenkins Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection, allowing attackers able t… |
CVE-2023-25764 | Medium | 5.4 | 2023-02-15 | Jenkins Email Extension Plugin 2.93 and earlier does not escape, sanitize, or sandbox rendered email template output or log output generated during template re… |
CVE-2023-25763 | Medium | 5.4 | 2023-02-15 | Jenkins Email Extension Plugin 2.93 and earlier does not escape various fields included in bundled email templates, resulting in a stored cross-site scripting… |
CVE-2023-25762 | Medium | 5.4 | 2023-02-15 | Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in… |
CVE-2023-25761 | Medium | 5.4 | 2023-02-15 | Jenkins JUnit Plugin 1166.va_436e268e972 and earlier does not escape test case class names in JavaScript expressions, resulting in a stored cross-site scriptin… |
CVE-2023-0841 | Medium | 6.3 | 2023-02-15 | A vulnerability, which was classified as critical, has been found in GPAC 2.3-DEV-rev40-g3602a5ded. This issue affects the function mp3_dmx_process of the file… |
CVE-2023-0840 | Low | 3.5 | 2023-02-15 | A vulnerability classified as problematic was found in PHPCrazy 1.1.1. This vulnerability affects unknown code of the file admin/admin.php?action=users&mode=in… |
CVE-2023-25011 | High | 7.8 | 2023-02-15 | PC settings tool Ver10.1.26.0 and earlier, PC settings tool Ver11.0.22.0 and earlier allows a attacker to write to the registry as administrator privileges wit… |
CVE-2023-20949 | Medium | 5.5 | 2023-02-15 | In s2mpg11_pmic_probe of s2mpg11-regulator.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclo… |
CVE-2023-20927 | High | 7.8 | 2023-02-15 | In permissions of AndroidManifest.xml, there is a possible way to grant signature permissions due to a permissions bypass. This could lead to local escalation… |
CVE-2023-24580 | High | 7.5 | 2023-02-15 | An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an… |
CVE-2023-22377 | High | 7.4 | 2023-02-15 | Improper restriction of XML external entity reference (XXE) vulnerability exists in tsClinical Define.xml Generator all versions (v1.0.0 to v1.4.0) and tsClini… |
CVE-2023-22368 | High | 7.8 | 2023-02-15 | Untrusted search path vulnerability in ELECOM Camera Assistant 1.00 and QuickFileDealer Ver.1.2.1 and earlier allows an attacker to gain privileges via a Troja… |
CVE-2023-23618 | High | 8.6 | 2023-02-14 | Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, when `gitk` is run on Windows, it potentially… |
CVE-2023-23381 | High | 7.8 | 2023-02-14 | Visual Studio Remote Code Execution Vulnerability |
CVE-2023-22743 | High | 7.2 | 2023-02-14 | Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, by carefully crafting DLL and putting into a s… |
CVE-2023-21823 | High | 7.8 | 2023-02-14 | Windows Graphics Component Remote Code Execution Vulnerability |
CVE-2023-21815 | High | 7.8 | 2023-02-14 | Visual Studio Remote Code Execution Vulnerability |
CVE-2023-21808 | High | 7.8 | 2023-02-14 | .NET and Visual Studio Remote Code Execution Vulnerability |
CVE-2023-21778 | High | 8.0 | 2023-02-14 | Microsoft Dynamics Unified Service Desk Remote Code Execution Vulnerability |
CVE-2023-21567 | Medium | 5.6 | 2023-02-14 | Visual Studio Denial of Service Vulnerability |
CVE-2023-21566 | High | 7.8 | 2023-02-14 | Visual Studio Elevation of Privilege Vulnerability |
CVE-2023-21553 | High | 7.5 | 2023-02-14 | Azure DevOps Server Remote Code Execution Vulnerability |
CVE-2023-25577 | High | 7.5 | 2023-02-14 | Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts… |
CVE-2023-23946 | Medium | 6.2 | 2023-02-14 | Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2… |
CVE-2023-23934 | Low | 2.6 | 2023-02-14 | Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like `=value` instead of `key=value`. A vulnerable br… |
CVE-2023-23390 | High | 7.8 | 2023-02-14 | 3D Builder Remote Code Execution Vulnerability |
CVE-2023-23382 | Medium | 6.5 | 2023-02-14 | Azure Machine Learning Compute Instance Information Disclosure Vulnerability |
CVE-2023-23379 | High | 7.8 | 2023-02-14 | Microsoft Defender for IoT Elevation of Privilege Vulnerability |
CVE-2023-23378 | High | 7.8 | 2023-02-14 | Print 3D Remote Code Execution Vulnerability |
CVE-2023-23377 | High | 7.8 | 2023-02-14 | 3D Builder Remote Code Execution Vulnerability |
CVE-2023-23376 | High | 7.8 | 2023-02-14 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
CVE-2023-23374 | High | 8.3 | 2023-02-14 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2023-22629 | High | 8.8 | 2023-02-14 | An issue was discovered in TitanFTP through 1.94.1205. The move-file function has a path traversal vulnerability in the newPath parameter. An authenticated att… |
CVE-2023-22490 | Medium | 5.5 | 2023-02-14 | Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2… |
CVE-2023-21822 | High | 7.8 | 2023-02-14 | Windows Graphics Component Elevation of Privilege Vulnerability |
CVE-2023-21820 | High | 7.4 | 2023-02-14 | Windows Distributed File System (DFS) Remote Code Execution Vulnerability |
CVE-2023-21819 | High | 7.5 | 2023-02-14 | Windows Secure Channel Denial of Service Vulnerability |
CVE-2023-21818 | High | 7.5 | 2023-02-14 | Windows Secure Channel Denial of Service Vulnerability |
CVE-2023-21817 | High | 7.8 | 2023-02-14 | Windows Kerberos Elevation of Privilege Vulnerability |
CVE-2023-21816 | High | 7.5 | 2023-02-14 | Windows Active Directory Domain Services API Denial of Service Vulnerability |
CVE-2023-21813 | High | 7.5 | 2023-02-14 | Windows Secure Channel Denial of Service Vulnerability |
CVE-2023-21812 | High | 7.8 | 2023-02-14 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
CVE-2023-21811 | High | 7.5 | 2023-02-14 | Windows iSCSI Service Denial of Service Vulnerability |
CVE-2023-21809 | High | 7.8 | 2023-02-14 | Microsoft Defender for Endpoint Security Feature Bypass Vulnerability |
CVE-2023-21807 | Medium | 6.5 | 2023-02-14 | Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability |
CVE-2023-21806 | High | 8.2 | 2023-02-14 | Power BI Report Server Spoofing Vulnerability |
CVE-2023-21805 | High | 7.8 | 2023-02-14 | Windows MSHTML Platform Remote Code Execution Vulnerability |
CVE-2023-21804 | High | 7.8 | 2023-02-14 | Windows Graphics Component Elevation of Privilege Vulnerability |
CVE-2023-21803 | Critical | 9.8 | 2023-02-14 | Windows iSCSI Discovery Service Remote Code Execution Vulnerability |
CVE-2023-21802 | High | 7.8 | 2023-02-14 | Windows Media Remote Code Execution Vulnerability |
CVE-2023-21801 | High | 7.8 | 2023-02-14 | Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability |
CVE-2023-21800 | High | 7.8 | 2023-02-14 | Windows Installer Elevation of Privilege Vulnerability |
CVE-2023-21799 | High | 8.8 | 2023-02-14 | Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability |
CVE-2023-21798 | High | 8.8 | 2023-02-14 | Microsoft ODBC Driver Remote Code Execution Vulnerability |
CVE-2023-21797 | High | 8.8 | 2023-02-14 | Microsoft ODBC Driver Remote Code Execution Vulnerability |
CVE-2023-21794 | Medium | 4.3 | 2023-02-14 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2023-21777 | High | 8.7 | 2023-02-14 | Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability |
CVE-2023-21722 | Medium | 5.0 | 2023-02-14 | .NET Framework Denial of Service Vulnerability |
CVE-2023-21721 | Medium | 6.5 | 2023-02-14 | Microsoft OneNote Elevation of Privilege Vulnerability |