2023 CVEs (page 299)
Page 299 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-23087 | Critical | 9.8 | 2023-02-03 | An issue was found in MojoJson v1.2.3 allows attackers to execute arbitary code via the destroy function. |
CVE-2023-23086 | Critical | 9.8 | 2023-02-03 | Buffer OverFlow Vulnerability in MojoJson v1.2.3 allows an attacker to execute arbitrary code via the SkipString function. |
CVE-2023-0659 | Medium | 5.3 | 2023-02-03 | A vulnerability was found in BDCOM 1704-WGL 2.0.6314. It has been classified as critical. This affects an unknown part of the file /param.file.tgz of the compo… |
CVE-2023-22975 | Medium | 6.1 | 2023-02-03 | A cross-site scripting (XSS) vulnerability in JFinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into t… |
CVE-2023-24157 | Critical | 9.8 | 2023-02-03 | A command injection vulnerability in the serverIp parameter in the function updateWifiInfo of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary comman… |
CVE-2023-24156 | Critical | 9.8 | 2023-02-03 | A command injection vulnerability in the ip parameter in the function recvSlaveUpgstatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands… |
CVE-2023-24155 | Critical | 9.8 | 2023-02-03 | TOTOLINK T8 V4.1.5cu was discovered to contain a hard code password for the telnet service which is stored in the component /web_cste/cgi-bin/product.ini. |
CVE-2023-24154 | Critical | 9.8 | 2023-02-03 | TOTOLINK T8 V4.1.5cu was discovered to contain a command injection vulnerability via the slaveIpList parameter in the function setUpgradeFW. |
CVE-2023-24153 | Critical | 9.8 | 2023-02-03 | A command injection vulnerability in the version parameter in the function recvSlaveCloudCheckStatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitr… |
CVE-2023-24152 | Critical | 9.8 | 2023-02-03 | A command injection vulnerability in the serverIp parameter in the function meshSlaveUpdate of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary comma… |
CVE-2023-24151 | Critical | 9.8 | 2023-02-03 | A command injection vulnerability in the ip parameter in the function recvSlaveCloudCheckStatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary c… |
CVE-2023-24150 | Critical | 9.8 | 2023-02-03 | A command injection vulnerability in the serverIp parameter in the function meshSlaveDlfw of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary command… |
CVE-2023-24149 | Critical | 9.8 | 2023-02-03 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a hard code password for root which is stored in the component /etc/shadow. |
CVE-2023-24148 | Critical | 9.8 | 2023-02-03 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the FileName parameter in the setUploadUserData function. |
CVE-2023-24147 | High | 7.5 | 2023-02-03 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a hard code password for the telnet service which is stored in the component /etc/config/product.ini. |
CVE-2023-24146 | Critical | 9.8 | 2023-02-03 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the minute parameter in the setRebootScheCfg function. |
CVE-2023-24145 | Critical | 9.8 | 2023-02-03 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the plugin_version parameter in the setUnloadUserData function. |
CVE-2023-24144 | Critical | 9.8 | 2023-02-03 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the hour parameter in the setRebootScheCfg function. |
CVE-2023-24143 | Critical | 9.8 | 2023-02-03 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagTracertHop parameter in the setNetworkDiag function. |
CVE-2023-24142 | Critical | 9.8 | 2023-02-03 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingSize parameter in the setNetworkDiag function. |
CVE-2023-24141 | Critical | 9.8 | 2023-02-03 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingTimeOut parameter in the setNetworkDiag function. |
CVE-2023-24140 | Critical | 9.8 | 2023-02-03 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingNum parameter in the setNetworkDiag function. |
CVE-2023-24139 | Critical | 9.8 | 2023-02-03 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagHost parameter in the setNetworkDiag function. |
CVE-2023-24138 | Critical | 9.8 | 2023-02-03 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the host_time parameter in the NTPSyncWithHost function. |
CVE-2023-25139 | Critical | 9.8 | 2023-02-03 | sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct buffer size. This is unrelated to CWE-6… |
CVE-2023-25136 | Medium | 6.5 | 2023-02-03 | OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be l… |
CVE-2023-25135 | Critical | 9.8 | 2023-02-03 | vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This o… |
CVE-2023-0124 | High | 7.8 | 2023-02-03 | Delta Electronics DOPSoft versions 4.00.16.22 and prior are vulnerable to an out-of-bounds write, which could allow an attacker to remotely execute arbitrary c… |
CVE-2023-0123 | High | 7.8 | 2023-02-03 | Delta Electronics DOPSoft versions 4.00.16.22 and prior are vulnerable to a stack-based buffer overflow, which could allow an attacker to remotely execute arbi… |
CVE-2023-24613 | Medium | 4.9 | 2023-02-03 | The user interface of Array Networks AG Series and vxAG through 9.4.0.470 could allow a remote attacker to use the gdb tool to overwrite the backend function c… |
CVE-2023-23636 | Medium | 5.4 | 2023-02-03 | In Jellyfin 10.8.x through 10.8.3, the name of a playlist is vulnerable to stored XSS. This allows an attacker to steal access tokens from the localStorage of… |
CVE-2023-23635 | Medium | 5.4 | 2023-02-03 | In Jellyfin 10.8.x through 10.8.3, the name of a collection is vulnerable to stored XSS. This allows an attacker to steal access tokens from the localStorage o… |
CVE-2023-0658 | Medium | 5.3 | 2023-02-03 | A vulnerability, which was classified as critical, was found in Multilaser RE057 and RE170 2.1/2.2. This affects an unknown part of the file /param.file.tgz of… |
CVE-2023-24574 | High | 7.5 | 2023-02-02 | Dell Enterprise SONiC OS, 3.5.3, 4.0.0, 4.0.1, 4.0.2, contains an "Uncontrolled Resource Consumption vulnerability" in authentication component. An unauthenti… |
CVE-2023-23120 | Medium | 5.9 | 2023-02-02 | The use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes TRENDnet TV-IP651WI Network Camera firmware version v1… |
CVE-2023-23119 | Medium | 5.9 | 2023-02-02 | The use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes Ubiquiti airFiber AF2X Radio firmware version 3.2.2 and… |
CVE-2023-0651 | Medium | 6.3 | 2023-02-02 | A vulnerability was found in FastCMS 0.1.0. It has been classified as critical. Affected is an unknown function of the component Template Management. The manip… |
CVE-2023-23110 | High | 7.4 | 2023-02-02 | An exploitable firmware modification vulnerability was discovered in certain Netgear products. The data integrity of the uploaded firmware image is ensured wit… |
CVE-2023-0650 | Low | 3.5 | 2023-02-02 | A vulnerability was found in YAFNET up to 3.1.11 and classified as problematic. This issue affects some unknown processing of the component Signature Handler… |
CVE-2023-0649 | Medium | 6.3 | 2023-02-02 | A vulnerability has been found in dst-admin 1.5.0 and classified as critical. This vulnerability affects unknown code of the file /home/sendBroadcast. The mani… |
CVE-2023-0648 | Medium | 6.3 | 2023-02-02 | A vulnerability, which was classified as critical, was found in dst-admin 1.5.0. This affects an unknown part of the file /home/masterConsole. The manipulation… |
CVE-2023-0647 | Medium | 6.3 | 2023-02-02 | A vulnerability, which was classified as critical, has been found in dst-admin 1.5.0. Affected by this issue is some unknown functionality of the file /home/ki… |
CVE-2023-0646 | Medium | 6.3 | 2023-02-02 | A vulnerability classified as critical was found in dst-admin 1.5.0. Affected by this vulnerability is an unknown functionality of the file /home/cavesConsole… |
CVE-2023-0643 | Medium | 6.1 | 2023-02-02 | Improper Handling of Additional Special Element in GitHub repository squidex/squidex prior to 7.4.0. |
CVE-2023-0642 | Medium | 6.5 | 2023-02-02 | Cross-Site Request Forgery (CSRF) in GitHub repository squidex/squidex prior to 7.4.0. |
CVE-2023-0641 | Low | 3.7 | 2023-02-02 | A vulnerability was found in PHPGurukul Employee Leaves Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknow… |
CVE-2023-0640 | High | 7.2 | 2023-02-02 | A vulnerability was found in TRENDnet TEW-652BRP 3.04b01. It has been classified as critical. Affected is an unknown function of the file ping.ccp of the compo… |
CVE-2023-0639 | Low | 2.4 | 2023-02-02 | A vulnerability was found in TRENDnet TEW-652BRP 3.04b01 and classified as problematic. This issue affects some unknown processing of the file get_set.ccp of t… |
CVE-2023-0638 | High | 7.2 | 2023-02-02 | A vulnerability has been found in TRENDnet TEW-811DRU 1.0.10.0 and classified as critical. This vulnerability affects unknown code of the component Web Interfa… |
CVE-2023-0637 | Medium | 6.5 | 2023-02-02 | A vulnerability, which was classified as critical, was found in TRENDnet TEW-811DRU 1.0.10.0. This affects an unknown part of the file wan.asp of the component… |
CVE-2023-0400 | Medium | 5.9 | 2023-02-02 | The protection bypass vulnerability in DLP for Windows 11.9.x is addressed in version 11.10.0. This allowed a local user to bypass DLP controls when uploading… |
CVE-2023-25015 | Medium | 6.5 | 2023-02-02 | Clockwork Web before 0.1.2, when Rails before 5.2 is used, allows CSRF. |
CVE-2023-25014 | High | 8.6 | 2023-02-02 | An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in the InvitationContr… |
CVE-2023-25013 | High | 8.6 | 2023-02-02 | An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in the InvitationContr… |
CVE-2023-25012 | Medium | 4.6 | 2023-02-02 | The Linux kernel through 6.1.9 has a Use-After-Free in bigben_remove in drivers/hid/hid-bigbenff.c via a crafted USB device because the LED controllers remain… |
CVE-2023-0599 | Medium | 6.1 | 2023-02-01 | Rapid7 Metasploit Pro versions 4.21.2 and lower suffer from a stored cross site scripting vulnerability, due to a lack of JavaScript request string sanitizatio… |
CVE-2023-23751 | Medium | 4.3 | 2023-02-01 | An issue was discovered in Joomla! 4.0.0 through 4.2.4. A missing ACL check allows non super-admin users to access com_actionlogs. |
CVE-2023-23750 | Medium | 6.3 | 2023-02-01 | An issue was discovered in Joomla! 4.0.0 through 4.2.6. A missing token check causes a CSRF vulnerability in the handling of post-installation messages. |
CVE-2023-23078 | Medium | 6.1 | 2023-02-01 | Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via the comment field when changing the credentials in the Assets. |
CVE-2023-23077 | Medium | 6.1 | 2023-02-01 | Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 13 via the comment field when adding a new status comment. |
CVE-2023-23076 | Critical | 9.8 | 2023-02-01 | OS Command injection vulnerability in Support Center Plus 11 via Executor in Action when creating new schedules. |
CVE-2023-23075 | Medium | 6.1 | 2023-02-01 | Cross Site Scripting (XSS) vulnerability in Zoho Asset Explorer 6.9 via the credential name when creating a new Assets Workstation. |
CVE-2023-23074 | Medium | 6.1 | 2023-02-01 | Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via embedding videos in the language component. |
CVE-2023-23073 | Medium | 6.1 | 2023-02-01 | Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via PO in the purchase component. |
CVE-2023-0619 | Medium | 6.5 | 2023-02-01 | The Kraken.io Image Optimizer plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up t… |
CVE-2023-23969 | High | 7.5 | 2023-02-01 | In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsi… |
CVE-2023-23469 | Medium | 4.0 | 2023-02-01 | IBM ICP4A - Automation Decision Services 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 al… |
CVE-2023-22501 | Critical | 9.1 | 2023-02-01 | An authentication vulnerability was discovered in Jira Service Management Server and Data Center which allows an attacker to impersonate another user and gain… |
CVE-2023-23555 | High | 7.5 | 2023-02-01 | On BIG-IP Virtual Edition versions 15.1x beginning in 15.1.4 to before 15.1.8 and 14.1.x beginning in 14.1.5 to before 14.1.5.3, and BIG-IP SPK beginning in 1… |
CVE-2023-23552 | High | 7.5 | 2023-02-01 | On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.0 before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a BIG-IP Advanced WA… |
CVE-2023-22842 | High | 7.5 | 2023-02-01 | On BIG-IP versions 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a SIP profile is configured on a Me… |
CVE-2023-22839 | High | 7.5 | 2023-02-01 | On BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all version of 13.1.x, when a DNS profil… |
CVE-2023-22664 | High | 7.5 | 2023-02-01 | On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, and BIG-IP SPK starting in version 1.6.0, when a client-side HTTP/2 profile and the HTTP… |
CVE-2023-22657 | High | 7.0 | 2023-02-01 | On F5OS-A beginning in version 1.2.0 to before 1.3.0 and F5OS-C beginning in version 1.3.0 to before 1.5.0, processing F5OS tenant file names may allow for com… |
CVE-2023-22422 | High | 7.5 | 2023-02-01 | On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, when a HTTP profile with the non-default Enforcement options of Enforce HTTP Compliance a… |
CVE-2023-22418 | Medium | 6.1 | 2023-02-01 | On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.7, 14.1.x before 14.1.5.3, and all versions of 13.1.x, an open redirect vulnerab… |
CVE-2023-22374 | High | 8.5 | 2023-02-01 | A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or, potentially execute arb… |
CVE-2023-22358 | High | 7.8 | 2023-02-01 | In versions beginning with 7.2.2 to before 7.2.3.1, a DLL hijacking vulnerability exists in the BIG-IP Edge Client Windows Installer. Note: Software versions… |
CVE-2023-22341 | High | 7.5 | 2023-02-01 | On version 14.1.x before 14.1.5.3, and all versions of 13.1.x, when the BIG-IP APM system is configured with all the following elements, undisclosed requests m… |
CVE-2023-22340 | High | 7.5 | 2023-02-01 | On BIG-IP versions 16.1.x before 16.1.3.3, 15.1.x before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a SIP profile is configured on a Mess… |
CVE-2023-22326 | Medium | 4.9 | 2023-02-01 | In BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, and all versions… |
CVE-2023-22323 | High | 7.5 | 2023-02-01 | In BIP-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when OCSP authen… |
CVE-2023-22302 | Medium | 5.9 | 2023-02-01 | In BIG-IP versions 17.0.x before 17.0.0.2, and 16.1.x beginning in 16.1.2.2 to before 16.1.3.3, when an HTTP profile is configured on a virtual server and cond… |
CVE-2023-22283 | Medium | 6.5 | 2023-02-01 | On versions beginning in 7.1.5 to before 7.2.3.1, a DLL hijacking vulnerability exists in the BIG-IP Edge Client for Windows. User interaction and administrati… |
CVE-2023-22281 | High | 7.5 | 2023-02-01 | On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a BIG-IP AFM NAT pol… |
CVE-2023-0618 | High | 7.5 | 2023-02-01 | A vulnerability was found in TRENDnet TEW-652BRP 3.04B01. It has been declared as critical. This vulnerability affects unknown code of the file cfg_op.ccp of t… |
CVE-2023-0617 | High | 7.5 | 2023-02-01 | A vulnerability was found in TRENDNet TEW-811DRU 1.0.10.0. It has been classified as critical. This affects an unknown part of the file /wireless/guestnetwork… |
CVE-2023-23136 | Medium | 6.5 | 2023-02-01 | lmxcms v1.41 was discovered to contain an arbitrary file deletion vulnerability via BackdbAction.class.php. |
CVE-2023-23135 | High | 7.2 | 2023-02-01 | An arbitrary file upload vulnerability in Ftdms v3.1.6 allows attackers to execute arbitrary code via uploading a crafted JPG file. |
CVE-2023-24997 | Critical | 9.8 | 2023-02-01 | Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users a… |
CVE-2023-24610 | High | 8.8 | 2023-02-01 | NOSH 4a5cfdb allows remote authenticated users to execute PHP arbitrary code via the "practice logo" upload feature. The client-side checks can be bypassed. Th… |
CVE-2023-23132 | High | 7.5 | 2023-02-01 | Selfwealth iOS mobile App 3.3.1 is vulnerable to Sensitive key disclosure. The application reveals hardcoded API keys. |
CVE-2023-23131 | High | 7.5 | 2023-02-01 | Selfwealth iOS mobile App 3.3.1 is vulnerable to Insecure App Transport Security (ATS) Settings. |
CVE-2023-23130 | Medium | 5.9 | 2023-02-01 | Connectwise Automate 2022.11 is vulnerable to Cleartext authentication. Authentication is being done via HTTP (cleartext) with SSL disabled. OTE: the vendor's… |
CVE-2023-23128 | Medium | 6.1 | 2023-02-01 | Connectwise Control 22.8.10013.8329 is vulnerable to Cross Origin Resource Sharing (CORS). The vendor's position is that two endpoints have Access-Control-Allo… |
CVE-2023-23127 | Medium | 5.3 | 2023-02-01 | In Connectwise Control 22.8.10013.8329, the login page does not implement HSTS headers therefore not enforcing HTTPS. NOTE: the vendor's position is that, by d… |
CVE-2023-23126 | Medium | 6.1 | 2023-02-01 | Connectwise Automate 2022.11 is vulnerable to Clickjacking. The login screen can be iframed and used to manipulate users to perform unintended actions. NOTE: t… |
CVE-2023-22575 | High | 8.7 | 2023-02-01 | Dell PowerScale OneFS 9.0.0.x - 9.4.0.x contain an insertion of sensitive information into log file vulnerability in celog. A low privileges user could potenti… |
CVE-2023-22574 | High | 8.1 | 2023-02-01 | Dell PowerScale OneFS 9.0.0.x - 9.4.0.x contain an insertion of sensitive information into log file vulnerability in platform API of IPMI module. A low-privil… |
CVE-2023-22573 | High | 7.9 | 2023-02-01 | Dell PowerScale OneFS 9.0.0.x-9.4.0.x contain an insertion of sensitive information into log file vulnerability in cloudpool. A low privileged local attacker c… |