2023 CVEs (page 296)
Page 296 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-24230 | Medium | 4.8 | 2023-02-10 | A stored cross-site scripting (XSS) vulnerability in the component /formwork/panel/dashboard of Formwork v1.12.1 allows attackers to execute arbitrary web scri… |
CVE-2023-24352 | Critical | 9.8 | 2023-02-10 | D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the webpage parameter at /goform/formWPS. |
CVE-2023-24351 | Critical | 9.8 | 2023-02-10 | D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the FILECODE parameter at /goform/formLogin. |
CVE-2023-24350 | Critical | 9.8 | 2023-02-10 | D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the config.smtp_email_subject parameter at /goform/formSetEmail. |
CVE-2023-24349 | Critical | 9.8 | 2023-02-10 | D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the curTime parameter at /goform/formSetRoute. |
CVE-2023-24348 | Critical | 9.8 | 2023-02-10 | D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the curTime parameter at /goform/formSetACLFilter. |
CVE-2023-24347 | High | 8.8 | 2023-02-10 | D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the webpage parameter at /goform/formSetWanDhcpplus. |
CVE-2023-24346 | High | 8.8 | 2023-02-10 | D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the wan_connected parameter at /goform/formEasySetupWizard3. |
CVE-2023-24345 | High | 8.8 | 2023-02-10 | D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the curTime parameter at /goform/formSetWanDhcpplus. |
CVE-2023-24344 | High | 8.8 | 2023-02-10 | D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the webpage parameter at /goform/formWlanGuestSetup. |
CVE-2023-24343 | High | 8.8 | 2023-02-10 | D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the curTime parameter at /goform/formSchedule. |
CVE-2023-24573 | Medium | 4.7 | 2023-02-10 | Dell Command | Monitor versions prior to 10.9 contain an arbitrary folder delete vulnerability during uninstallation. A locally authenticated malicious user m… |
CVE-2023-24569 | High | 7.8 | 2023-02-10 | Dell Alienware Command Center versions 5.5.37.0 and prior contain an Improper Input validation vulnerability. A local authenticated malicious user could poten… |
CVE-2023-23698 | Medium | 5.5 | 2023-02-10 | Dell Command | Update, Dell Update, and Alienware Update versions before 4.6.0 and 4.7.1 contain Insecure Operation on Windows Junction in the installer compo… |
CVE-2023-0774 | High | 7.3 | 2023-02-10 | A vulnerability has been found in SourceCodester Medical Certificate Generator App 1.0 and classified as critical. This vulnerability affects unknown code of t… |
CVE-2023-22832 | High | 7.5 | 2023-02-10 | The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configurations that include the… |
CVE-2023-23286 | Medium | 6.1 | 2023-02-10 | Cross Site Scripting (XSS) vulnerability in Provide server 14.4 allows attackers to execute arbitrary code through the server-log via username field from the l… |
CVE-2023-0771 | High | 8.8 | 2023-02-10 | SQL Injection in GitHub repository ampache/ampache prior to 5.5.7,develop. |
CVE-2023-24690 | Medium | 5.4 | 2023-02-09 | ChurchCRM 4.5.3 and below was discovered to contain a stored cross-site scripting (XSS) vulnerability at /api/public/register/family. |
CVE-2023-24686 | Medium | 4.8 | 2023-02-09 | An issue in the CSV Import function of ChurchCRM v4.5.3 and below allows attackers to execute arbitrary code via importing a crafted CSV file. |
CVE-2023-24685 | High | 7.2 | 2023-02-09 | ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the Event parameter under the Event Attendance reports module. |
CVE-2023-24684 | High | 7.2 | 2023-02-09 | ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the EID parameter at GetText.php. |
CVE-2023-23592 | High | 7.5 | 2023-02-09 | WALLIX Access Manager 3.x through 4.0.x allows a remote attacker to access sensitive information. |
CVE-2023-0770 | High | 7.8 | 2023-02-09 | Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.2. |
CVE-2023-23631 | Medium | 5.9 | 2023-02-09 | github.com/ipfs/go-unixfsnode is an ADL IPLD prime node that wraps go-codec-dagpb's implementation of protobuf to enable pathing. In versions priot to 1.5.2 tr… |
CVE-2023-23626 | Medium | 5.9 | 2023-02-09 | go-bitfield is a simple bitfield package for the go language aiming to be more performant that the standard library. When feeding untrusted user input into the… |
CVE-2023-23625 | Medium | 5.9 | 2023-02-09 | go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag. Trying to read malformed HAMT sharded directories can cause panics and vi… |
CVE-2023-24689 | Medium | 4.3 | 2023-02-09 | An issue in Mojoportal v2.7.0.0 and below allows an authenticated attacker to list all css files inside the root path of the webserver via manipulation of the… |
CVE-2023-24688 | Medium | 5.3 | 2023-02-09 | An issue in Mojoportal v2.7.0.0 allows an unauthenticated attacker to register a new user even if the Allow User Registrations feature is disabled. |
CVE-2023-24687 | Medium | 5.4 | 2023-02-09 | Mojoportal v2.7.0.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Company Info Settings component. This vulnerability allo… |
CVE-2023-24323 | High | 8.8 | 2023-02-09 | Mojoportal v2.7 was discovered to contain an authenticated XML external entity (XXE) injection vulnerability. |
CVE-2023-24322 | Medium | 6.1 | 2023-02-09 | A reflected cross-site scripting (XSS) vulnerability in the FileDialog.aspx component of mojoPortal v2.7.0.0 allows attackers to execute arbitrary web scripts… |
CVE-2023-23912 | High | 8.8 | 2023-02-09 | A vulnerability, found in EdgeRouters Version 2.0.9-hotfix.5 and earlier and UniFi Security Gateways (USG) Version 4.4.56 and earlier with their DHCPv6 prefix… |
CVE-2023-22799 | High | 7.5 | 2023-02-09 | A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regular expression engin… |
CVE-2023-22798 | Medium | 6.1 | 2023-02-09 | Prior to commit 51867e0d15a6d7f80d5b714fd0e9976b9c160bb0, https://github.com/brave/adblock-lists removed redirect interceptors on some websites like Facebook i… |
CVE-2023-22797 | Medium | 6.1 | 2023-02-09 | An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling redirect_to with untrusted user input. In… |
CVE-2023-22796 | High | 7.5 | 2023-02-09 | A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the… |
CVE-2023-22795 | High | 7.5 | 2023-02-09 | A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Mat… |
CVE-2023-22794 | High | 8.8 | 2023-02-09 | A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the `annot… |
CVE-2023-22792 | High | 7.5 | 2023-02-09 | A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1. Specially crafted cookies, in combination with a specially cr… |
CVE-2023-21451 | Medium | 6.7 | 2023-02-09 | A Stack-based overflow vulnerability in IpcRxEmbmsSessionList in SECRIL prior to Android S(12) allows attacker to cause memory corruptions. |
CVE-2023-21450 | Low | 2.3 | 2023-02-09 | Missing Authorization vulnerability in One Hand Operation + prior to version 6.1.21 allows multi-users to access owner's widget without authorization via g… |
CVE-2023-21448 | Medium | 5.7 | 2023-02-09 | Path traversal vulnerability in Samsung Cloud prior to version 5.3.0.32 allows attacker to access specific png file. |
CVE-2023-21447 | Medium | 4.0 | 2023-02-09 | Improper access control vulnerabilities in Samsung Cloud prior to version 5.3.0.32 allows local attackers to access information with Samsung Cloud's privil… |
CVE-2023-21446 | Medium | 6.2 | 2023-02-09 | Improper input validation in MyFiles prior to version 12.2.09 in Android R(11), 13.1.03.501 in Android S( 12) and 14.1.00.422 in Android T(13) allows local att… |
CVE-2023-21445 | Medium | 5.5 | 2023-02-09 | Improper access control vulnerability in MyFiles prior to versions 12.2.09 in Android R(11), 13.1.03.501 in Android S(12) and 14.1.00.422 in Android T(13) allo… |
CVE-2023-21444 | High | 7.5 | 2023-02-09 | Improper cryptographic implementation in Samsung Flow for PC 4.9.14.0 allows adjacent attackers to decrypt encrypted messages or inject commands. |
CVE-2023-21443 | High | 7.5 | 2023-02-09 | Improper cryptographic implementation in Samsung Flow for Android prior to version 4.9.04 allows adjacent attackers to decrypt encrypted messages or inject com… |
CVE-2023-21442 | Medium | 4.0 | 2023-02-09 | Improper access control vulnerability in Runestone application prior to version 2.9.09.003 in Android R(11) and 3.2.01.007 in Android S(12) allows local attack… |
CVE-2023-21441 | High | 7.4 | 2023-02-09 | Insufficient Verification of Data Authenticity vulnerability in Routine prior to versions 2.6.30.6 in Android Q(10), 3.1.21.10 in Android R(11) and 3.5.2.23 in… |
CVE-2023-21440 | Medium | 6.2 | 2023-02-09 | Improper access control vulnerability in WindowManagerService prior to SMR Feb-2023 Release 1 allows attackers to take a screen capture. |
CVE-2023-21439 | High | 8.5 | 2023-02-09 | Improper input validation vulnerability in UwbDataTxStatusEvent prior to SMR Feb-2023 Release 1 allows attackers to launch certain activities. |
CVE-2023-21438 | Low | 2.1 | 2023-02-09 | Improper logic in HomeScreen prior to SMR Feb-2023 Release 1 allows physical attacker to access App preview protected by Secure Folder. |
CVE-2023-21437 | Medium | 4.0 | 2023-02-09 | Improper access control vulnerability in Phone application prior to SMR Feb-2023 Release 1 allows local attackers to access sensitive information via implicit… |
CVE-2023-21436 | Low | 3.3 | 2023-02-09 | Improper usage of implicit intent in Contacts prior to SMR Feb-2023 Release 1 allows attacker to get account ID. |
CVE-2023-21435 | Medium | 4.4 | 2023-02-09 | Exposure of Sensitive Information vulnerability in Fingerprint TA prior to SMR Feb-2023 Release 1 allows attackers to access the memory address information via… |
CVE-2023-21434 | Medium | 6.2 | 2023-02-09 | Improper input validation vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to execute JavaScript by launching a web page. |
CVE-2023-21433 | High | 7.8 | 2023-02-09 | Improper access control vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to install applications from Galaxy Store. |
CVE-2023-21432 | Medium | 4.2 | 2023-02-09 | Improper access control vulnerabilities in Smart Things prior to 1.7.93 allows to attacker to invite others without authorization of the owner. |
CVE-2023-21431 | Low | 3.3 | 2023-02-09 | Improper input validation in Bixby Vision prior to version 3.7.70.17 allows attacker to access data of Bixby Vision. |
CVE-2023-21430 | Medium | 4.4 | 2023-02-09 | An out-of-bound read vulnerability in mapToBuffer function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR JAN-2023 Release 1 allows attacker… |
CVE-2023-21429 | Medium | 4.0 | 2023-02-09 | Improper usage of implict intent in ePDG prior to SMR JAN-2023 Release 1 allows attacker to access SSID. |
CVE-2023-21428 | Medium | 4.0 | 2023-02-09 | Improper input validation vulnerability in TelephonyUI prior to SMR Jan-2023 Release 1 allows attackers to configure Preferred Call. The patch removes unused c… |
CVE-2023-21427 | Medium | 5.4 | 2023-02-09 | Improper access control vulnerability in NfcTile prior to SMR Jan-2023 Release 1 allows to attacker to use NFC without user recognition. |
CVE-2023-21426 | Medium | 4.3 | 2023-02-09 | Hardcoded AES key to encrypt cardemulation PINs in NFC prior to SMR Jan-2023 Release 1 allows attackers to access cardemulation PIN. |
CVE-2023-21425 | Medium | 4.3 | 2023-02-09 | Improper access control vulnerability in telecom application prior to SMR JAN-2023 Release 1 allows local attackers to get sensitive information. |
CVE-2023-21424 | Medium | 5.1 | 2023-02-09 | Improper Handling of Insufficient Permissions or Privileges vulnerability in SemChameleonHelper prior to SMR Jan-2023 Release 1 allows attacker to modify netwo… |
CVE-2023-21423 | Medium | 5.1 | 2023-02-09 | Improper authorization vulnerability in ChnFileShareKit prior to SMR Jan-2023 Release 1 allows attacker to control BLE advertising without permission using unp… |
CVE-2023-21422 | Medium | 5.7 | 2023-02-09 | Improper authorization vulnerability in semAddPublicDnsAddr in WifiSevice prior to SMR Jan-2023 Release 1 allows attackers to set custom DNS server without per… |
CVE-2023-21421 | Medium | 5.9 | 2023-02-09 | Improper Handling of Insufficient Permissions or Privileges vulnerability in KnoxCustomManagerService prior to SMR Jan-2023 Release 1 allows attacker to access… |
CVE-2023-21420 | High | 7.3 | 2023-02-09 | Use of Externally-Controlled Format String vulnerabilities in STST TA prior to SMR Jan-2023 Release 1 allows arbitrary code execution. |
CVE-2023-21419 | Medium | 4.3 | 2023-02-09 | An improper implementation logic in Secure Folder prior to SMR Jan-2023 Release 1 allows the Secure Folder container remain unlocked under certain condition. |
CVE-2023-24815 | Medium | 4.8 | 2023-02-09 | Vert.x-Web is a set of building blocks for building web applications in the java programming language. When running vertx web applications that serve files usi… |
CVE-2023-0745 | Medium | 6.7 | 2023-02-09 | The High Availability functionality of Yugabyte Anywhere can be abused to write arbitrary files through the backup upload endpoin… |
CVE-2023-0575 | High | 7.2 | 2023-02-09 | External Control of Critical State Data, Improper Control of Generation of Code ('Code Injection') vulnerability in YugaByte, Inc. Yugabyte DB on Windows, Linu… |
CVE-2023-0624 | Medium | 6.1 | 2023-02-09 | OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the application returns… |
CVE-2023-22953 | High | 8.8 | 2023-02-09 | In ExpressionEngine before 7.2.6, remote code execution can be achieved by an authenticated Control Panel user. |
CVE-2023-0574 | Medium | 6.8 | 2023-02-09 | Server-Side Request Forgery (SSRF), Improperly Controlled Modification of Dynamically-Determined Object Attributes, Improper Restriction of Excessive Authentic… |
CVE-2023-0760 | High | 7.8 | 2023-02-09 | Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to V2.1.0-DEV. |
CVE-2023-0759 | High | 8.8 | 2023-02-09 | Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8. |
CVE-2023-0758 | Medium | 6.3 | 2023-02-09 | A vulnerability was found in glorylion JFinalOA 1.0.2 and classified as critical. This issue affects some unknown processing of the file src/main/java/com/poin… |
CVE-2023-25168 | Critical | 9.6 | 2023-02-09 | Wings is Pterodactyl's server control plane. This vulnerability can be used to delete files and directories recursively on the host system. This vulnerability… |
CVE-2023-0251 | High | 7.8 | 2023-02-08 | Delta Electronics DIAScreen versions 1.2.1.23 and prior are vulnerable to a buffer overflow through improper restrictions of operations within memory, which co… |
CVE-2023-0250 | High | 7.8 | 2023-02-08 | Delta Electronics DIAScreen versions 1.2.1.23 and prior are vulnerable to a stack-based buffer overflow, which could allow an attacker to remotely execute arbi… |
CVE-2023-0249 | High | 7.8 | 2023-02-08 | Delta Electronics DIAScreen versions 1.2.1.23 and prior are vulnerable to out-of-bounds write, which may allow an attacker to remotely execute arbitrary code. |
CVE-2023-25163 | Medium | 6.3 | 2023-02-08 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v2.6.0-rc1 have an output sanitization bug whic… |
CVE-2023-25167 | Medium | 6.5 | 2023-02-08 | Discourse is an open source discussion platform. In affected versions a malicious user can cause a regular expression denial of service using a carefully craft… |
CVE-2023-25166 | Medium | 5.5 | 2023-02-08 | formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided strings to formula's parser might lead to polynomial execution ti… |
CVE-2023-25165 | Medium | 4.3 | 2023-02-08 | Helm is a tool that streamlines installing and managing Kubernetes applications.`getHostByName` is a Helm template function introduced in Helm v3. The function… |
CVE-2023-25164 | High | 8.6 | 2023-02-08 | Tinacms is a Git-backed headless content management system with support for visual editing. Sites being built with @tinacms/cli >= 1.0.0 && < 1.0.9 which store… |
CVE-2023-25151 | High | 7.5 | 2023-02-08 | opentelemetry-go-contrib is a collection of extensions for OpenTelemetry-Go. The v0.38.0 release of `go.opentelemetry.io/contrib/instrumentation/net/http/otelh… |
CVE-2023-25150 | Medium | 5.8 | 2023-02-08 | Nextcloud office/richdocuments is an office suit for the nextcloud server platform. In affected versions the Collabora integration can be tricked to provide ac… |
CVE-2023-0751 | Medium | 6.5 | 2023-02-08 | When GELI reads a key file from standard input, it does not reuse the key file to initialize multiple providers at once resulting in the second and subsequent… |
CVE-2023-0401 | High | 7.5 | 2023-02-08 | A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signa… |
CVE-2023-0286 | High | 7.4 | 2023-02-08 | There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the… |
CVE-2023-0217 | High | 7.5 | 2023-02-08 | An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVP_PKEY_public_check() function… |
CVE-2023-0216 | High | 7.5 | 2023-02-08 | An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKC… |
CVE-2023-0215 | High | 7.5 | 2023-02-08 | The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SM… |
CVE-2023-25396 | High | 7.8 | 2023-02-08 | Privilege escalation in the MSI repair functionality in Caphyon Advanced Installer 20.0 and below allows attackers to access and manipulate system files. |
CVE-2023-25152 | High | 8.4 | 2023-02-08 | Wings is Pterodactyl's server control plane. Affected versions are subject to a vulnerability which can be used to create new files and directory structures on… |