2023 CVEs (page 297)
Page 297 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-21441 | High | 7.4 | 2023-02-09 | Insufficient Verification of Data Authenticity vulnerability in Routine prior to versions 2.6.30.6 in Android Q(10), 3.1.21.10 in Android R(11) and 3.5.2.23 in… |
CVE-2023-21440 | Medium | 6.2 | 2023-02-09 | Improper access control vulnerability in WindowManagerService prior to SMR Feb-2023 Release 1 allows attackers to take a screen capture. |
CVE-2023-21439 | High | 8.5 | 2023-02-09 | Improper input validation vulnerability in UwbDataTxStatusEvent prior to SMR Feb-2023 Release 1 allows attackers to launch certain activities. |
CVE-2023-21438 | Low | 2.1 | 2023-02-09 | Improper logic in HomeScreen prior to SMR Feb-2023 Release 1 allows physical attacker to access App preview protected by Secure Folder. |
CVE-2023-21437 | Medium | 4.0 | 2023-02-09 | Improper access control vulnerability in Phone application prior to SMR Feb-2023 Release 1 allows local attackers to access sensitive information via implicit… |
CVE-2023-21436 | Low | 3.3 | 2023-02-09 | Improper usage of implicit intent in Contacts prior to SMR Feb-2023 Release 1 allows attacker to get account ID. |
CVE-2023-21435 | Medium | 4.4 | 2023-02-09 | Exposure of Sensitive Information vulnerability in Fingerprint TA prior to SMR Feb-2023 Release 1 allows attackers to access the memory address information via… |
CVE-2023-21434 | Medium | 6.2 | 2023-02-09 | Improper input validation vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to execute JavaScript by launching a web page. |
CVE-2023-21433 | High | 7.8 | 2023-02-09 | Improper access control vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to install applications from Galaxy Store. |
CVE-2023-21432 | Medium | 4.2 | 2023-02-09 | Improper access control vulnerabilities in Smart Things prior to 1.7.93 allows to attacker to invite others without authorization of the owner. |
CVE-2023-21431 | Low | 3.3 | 2023-02-09 | Improper input validation in Bixby Vision prior to version 3.7.70.17 allows attacker to access data of Bixby Vision. |
CVE-2023-21430 | Medium | 4.4 | 2023-02-09 | An out-of-bound read vulnerability in mapToBuffer function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR JAN-2023 Release 1 allows attacker… |
CVE-2023-21429 | Medium | 4.0 | 2023-02-09 | Improper usage of implict intent in ePDG prior to SMR JAN-2023 Release 1 allows attacker to access SSID. |
CVE-2023-21428 | Medium | 4.0 | 2023-02-09 | Improper input validation vulnerability in TelephonyUI prior to SMR Jan-2023 Release 1 allows attackers to configure Preferred Call. The patch removes unused c… |
CVE-2023-21427 | Medium | 5.4 | 2023-02-09 | Improper access control vulnerability in NfcTile prior to SMR Jan-2023 Release 1 allows to attacker to use NFC without user recognition. |
CVE-2023-21426 | Medium | 4.3 | 2023-02-09 | Hardcoded AES key to encrypt cardemulation PINs in NFC prior to SMR Jan-2023 Release 1 allows attackers to access cardemulation PIN. |
CVE-2023-21425 | Medium | 4.3 | 2023-02-09 | Improper access control vulnerability in telecom application prior to SMR JAN-2023 Release 1 allows local attackers to get sensitive information. |
CVE-2023-21424 | Medium | 5.1 | 2023-02-09 | Improper Handling of Insufficient Permissions or Privileges vulnerability in SemChameleonHelper prior to SMR Jan-2023 Release 1 allows attacker to modify netwo… |
CVE-2023-21423 | Medium | 5.1 | 2023-02-09 | Improper authorization vulnerability in ChnFileShareKit prior to SMR Jan-2023 Release 1 allows attacker to control BLE advertising without permission using unp… |
CVE-2023-21422 | Medium | 5.7 | 2023-02-09 | Improper authorization vulnerability in semAddPublicDnsAddr in WifiSevice prior to SMR Jan-2023 Release 1 allows attackers to set custom DNS server without per… |
CVE-2023-21421 | Medium | 5.9 | 2023-02-09 | Improper Handling of Insufficient Permissions or Privileges vulnerability in KnoxCustomManagerService prior to SMR Jan-2023 Release 1 allows attacker to access… |
CVE-2023-21420 | High | 7.3 | 2023-02-09 | Use of Externally-Controlled Format String vulnerabilities in STST TA prior to SMR Jan-2023 Release 1 allows arbitrary code execution. |
CVE-2023-21419 | Medium | 4.3 | 2023-02-09 | An improper implementation logic in Secure Folder prior to SMR Jan-2023 Release 1 allows the Secure Folder container remain unlocked under certain condition. |
CVE-2023-24815 | Medium | 4.8 | 2023-02-09 | Vert.x-Web is a set of building blocks for building web applications in the java programming language. When running vertx web applications that serve files usi… |
CVE-2023-0745 | Medium | 6.7 | 2023-02-09 | The High Availability functionality of Yugabyte Anywhere can be abused to write arbitrary files through the backup upload endpoin… |
CVE-2023-0575 | High | 7.2 | 2023-02-09 | External Control of Critical State Data, Improper Control of Generation of Code ('Code Injection') vulnerability in YugaByte, Inc. Yugabyte DB on Windows, Linu… |
CVE-2023-0624 | Medium | 6.1 | 2023-02-09 | OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the application returns… |
CVE-2023-22953 | High | 8.8 | 2023-02-09 | In ExpressionEngine before 7.2.6, remote code execution can be achieved by an authenticated Control Panel user. |
CVE-2023-0574 | Medium | 6.8 | 2023-02-09 | Server-Side Request Forgery (SSRF), Improperly Controlled Modification of Dynamically-Determined Object Attributes, Improper Restriction of Excessive Authentic… |
CVE-2023-0760 | High | 7.8 | 2023-02-09 | Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to V2.1.0-DEV. |
CVE-2023-0759 | High | 8.8 | 2023-02-09 | Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8. |
CVE-2023-0758 | Medium | 6.3 | 2023-02-09 | A vulnerability was found in glorylion JFinalOA 1.0.2 and classified as critical. This issue affects some unknown processing of the file src/main/java/com/poin… |
CVE-2023-25168 | Critical | 9.6 | 2023-02-09 | Wings is Pterodactyl's server control plane. This vulnerability can be used to delete files and directories recursively on the host system. This vulnerability… |
CVE-2023-0251 | High | 7.8 | 2023-02-08 | Delta Electronics DIAScreen versions 1.2.1.23 and prior are vulnerable to a buffer overflow through improper restrictions of operations within memory, which co… |
CVE-2023-0250 | High | 7.8 | 2023-02-08 | Delta Electronics DIAScreen versions 1.2.1.23 and prior are vulnerable to a stack-based buffer overflow, which could allow an attacker to remotely execute arbi… |
CVE-2023-0249 | High | 7.8 | 2023-02-08 | Delta Electronics DIAScreen versions 1.2.1.23 and prior are vulnerable to out-of-bounds write, which may allow an attacker to remotely execute arbitrary code. |
CVE-2023-25163 | Medium | 6.3 | 2023-02-08 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v2.6.0-rc1 have an output sanitization bug whic… |
CVE-2023-25167 | Medium | 6.5 | 2023-02-08 | Discourse is an open source discussion platform. In affected versions a malicious user can cause a regular expression denial of service using a carefully craft… |
CVE-2023-25166 | Medium | 5.5 | 2023-02-08 | formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided strings to formula's parser might lead to polynomial execution ti… |
CVE-2023-25165 | Medium | 4.3 | 2023-02-08 | Helm is a tool that streamlines installing and managing Kubernetes applications.`getHostByName` is a Helm template function introduced in Helm v3. The function… |
CVE-2023-25164 | High | 8.6 | 2023-02-08 | Tinacms is a Git-backed headless content management system with support for visual editing. Sites being built with @tinacms/cli >= 1.0.0 && < 1.0.9 which store… |
CVE-2023-25151 | High | 7.5 | 2023-02-08 | opentelemetry-go-contrib is a collection of extensions for OpenTelemetry-Go. The v0.38.0 release of `go.opentelemetry.io/contrib/instrumentation/net/http/otelh… |
CVE-2023-25150 | Medium | 5.8 | 2023-02-08 | Nextcloud office/richdocuments is an office suit for the nextcloud server platform. In affected versions the Collabora integration can be tricked to provide ac… |
CVE-2023-0751 | Medium | 6.5 | 2023-02-08 | When GELI reads a key file from standard input, it does not reuse the key file to initialize multiple providers at once resulting in the second and subsequent… |
CVE-2023-0401 | High | 7.5 | 2023-02-08 | A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signa… |
CVE-2023-0286 | High | 7.4 | 2023-02-08 | There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the… |
CVE-2023-0217 | High | 7.5 | 2023-02-08 | An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVP_PKEY_public_check() function… |
CVE-2023-0216 | High | 7.5 | 2023-02-08 | An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKC… |
CVE-2023-0215 | High | 7.5 | 2023-02-08 | The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SM… |
CVE-2023-25396 | High | 7.8 | 2023-02-08 | Privilege escalation in the MSI repair functionality in Caphyon Advanced Installer 20.0 and below allows attackers to access and manipulate system files. |
CVE-2023-25152 | High | 8.4 | 2023-02-08 | Wings is Pterodactyl's server control plane. Affected versions are subject to a vulnerability which can be used to create new files and directory structures on… |
CVE-2023-23475 | Medium | 4.6 | 2023-02-08 | IBM Infosphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2023-0690 | Medium | 5.0 | 2023-02-08 | HashiCorp Boundary from 0.10.0 through 0.11.2 contain an issue where when using a PKI-based worker with a Key Management Service (KMS) defined in the configura… |
CVE-2023-0003 | Medium | 6.5 | 2023-02-08 | A file disclosure vulnerability in the Palo Alto Networks Cortex XSOAR server software enables an authenticated user with access to the web interface to read l… |
CVE-2023-0002 | Medium | 5.5 | 2023-02-08 | A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to execute privileged cytool commands t… |
CVE-2023-0001 | Medium | 6.0 | 2023-02-08 | An information exposure vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local system administrator to disclose the admin p… |
CVE-2023-0748 | Medium | 6.4 | 2023-02-08 | Open Redirect in GitHub repository btcpayserver/btcpayserver prior to 1.7.6. |
CVE-2023-0747 | Medium | 5.5 | 2023-02-08 | Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.6. |
CVE-2023-0744 | Critical | 9.8 | 2023-02-08 | Improper Access Control in GitHub repository answerdev/answer prior to 1.0.4. |
CVE-2023-0743 | Critical | 9.0 | 2023-02-08 | Cross-site Scripting (XSS) - Generic in GitHub repository answerdev/answer prior to 1.0.4. |
CVE-2023-0742 | Critical | 9.0 | 2023-02-08 | Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.4. |
CVE-2023-0741 | Critical | 9.0 | 2023-02-08 | Cross-site Scripting (XSS) - DOM in GitHub repository answerdev/answer prior to 1.0.4. |
CVE-2023-0740 | Critical | 9.0 | 2023-02-08 | Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.4. |
CVE-2023-0739 | Medium | 6.8 | 2023-02-08 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitHub repository answerdev/answer prior to 1.0.4. |
CVE-2023-0726 | Medium | 5.4 | 2023-02-08 | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorr… |
CVE-2023-0725 | Medium | 5.4 | 2023-02-08 | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorr… |
CVE-2023-0724 | Medium | 5.4 | 2023-02-08 | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorr… |
CVE-2023-0722 | Medium | 5.4 | 2023-02-08 | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorr… |
CVE-2023-0720 | Medium | 5.4 | 2023-02-08 | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_folder_order function in versi… |
CVE-2023-0717 | Medium | 5.4 | 2023-02-08 | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_delete_folder function in versions… |
CVE-2023-0716 | Medium | 5.4 | 2023-02-08 | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_edit_folder function in versions up… |
CVE-2023-0715 | Medium | 5.4 | 2023-02-08 | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_clone_folder function in versions u… |
CVE-2023-0711 | Medium | 5.4 | 2023-02-08 | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_state function in versions up… |
CVE-2023-0685 | Medium | 5.4 | 2023-02-08 | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorr… |
CVE-2023-0684 | Medium | 5.4 | 2023-02-08 | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_unassign_folders function in versio… |
CVE-2023-24828 | High | 8.1 | 2023-02-08 | Onedev is a self-hosted Git Server with CI/CD and Kanban. In versions prior to 7.9.12 the algorithm used to generate access token and password reset keys was n… |
CVE-2023-0718 | Medium | 5.4 | 2023-02-08 | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_folder function in versions up… |
CVE-2023-23026 | Medium | 6.1 | 2023-02-07 | Cross site scripting (XSS) vulnerability in sourcecodester oretnom23 sales management system 1.0, allows attackers to execute arbitrary code via the product_na… |
CVE-2023-23011 | Medium | 6.1 | 2023-02-07 | Cross Site Scripting (XSS) vulnerability in InvoicePlane 1.6 via filter_product input to file modal_product_lookups.php. |
CVE-2023-0736 | Medium | 5.4 | 2023-02-07 | Cross-site Scripting (XSS) - Stored in GitHub repository wallabag/wallabag prior to 2.5.4. |
CVE-2023-0735 | Medium | 6.5 | 2023-02-07 | Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.5.4. |
CVE-2023-0731 | Medium | 6.4 | 2023-02-07 | The Interactive Geo Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the action content parameter in versions up to, and including, 1… |
CVE-2023-0730 | Medium | 5.4 | 2023-02-07 | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorr… |
CVE-2023-0727 | Medium | 5.4 | 2023-02-07 | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorr… |
CVE-2023-0723 | Medium | 5.4 | 2023-02-07 | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorr… |
CVE-2023-0719 | Medium | 5.4 | 2023-02-07 | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_sort_order function in version… |
CVE-2023-0712 | Medium | 5.4 | 2023-02-07 | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_move_object function in versions up… |
CVE-2023-0728 | Medium | 5.4 | 2023-02-07 | The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorr… |
CVE-2023-0713 | Medium | 5.4 | 2023-02-07 | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_add_folder function in versions up… |
CVE-2023-23931 | Medium | 4.8 | 2023-02-07 | cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept… |
CVE-2023-0705 | High | 7.5 | 2023-02-07 | Integer overflow in Core in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who had one a race condition to potentially exploit heap corruption… |
CVE-2023-0704 | Medium | 6.5 | 2023-02-07 | Insufficient policy enforcement in DevTools in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to bypass same origin policy and proxy settings v… |
CVE-2023-0703 | High | 8.8 | 2023-02-07 | Type confusion in DevTools in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who convinced a user to engage in specific UI interactions to pote… |
CVE-2023-0702 | High | 8.8 | 2023-02-07 | Type confusion in Data Transfer in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who convinced a user to engage in specific UI interactions to… |
CVE-2023-0701 | High | 8.8 | 2023-02-07 | Heap buffer overflow in WebUI in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who convinced a user to engage in specific UI interactions to p… |
CVE-2023-0700 | Medium | 6.5 | 2023-02-07 | Inappropriate implementation in Download in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially spoof the contents of the Omnibox (UR… |
CVE-2023-0699 | High | 8.8 | 2023-02-07 | Use after free in GPU in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page and brow… |
CVE-2023-0698 | High | 8.8 | 2023-02-07 | Out of bounds read in WebRTC in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page… |
CVE-2023-0697 | Medium | 6.5 | 2023-02-07 | Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 110.0.5481.77 allowed a remote attacker to spoof the contents of the secu… |
CVE-2023-0696 | High | 8.8 | 2023-02-07 | Type confusion in V8 in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |