2023 CVEs (page 301)
Page 301 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-24057 | High | 8.1 | 2023-01-26 | HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal from a crafted ZIP o… |
CVE-2023-24022 | Critical | 10.0 | 2023-01-26 | Baicells Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB devices with firmware through RTS/RTD 3.7.11.3 have hardcoded credentials that are easily discovered a… |
CVE-2023-23951 | Medium | 6.1 | 2023-01-26 | Ability to enumerate the Oracle LDAP attributes for the current user by modifying the query used by the application |
CVE-2023-23950 | Medium | 6.1 | 2023-01-26 | User’s supplied input (usually a CRLF sequence) can be used to split a returning response into two responses. |
CVE-2023-23949 | Medium | 5.4 | 2023-01-26 | An authenticated user can supply malicious HTML and JavaScript code that will be executed in the client browser. |
CVE-2023-23619 | Critical | 9.9 | 2023-01-26 | Modelina is a library for generating data models based on inputs such as AsyncAPI, OpenAPI, or JSON Schema documents. Versions prior to 1.0.0 are vulnerable to… |
CVE-2023-23614 | High | 8.8 | 2023-01-26 | Pi-hole®'s Web interface (based off of AdminLTE) provides a central location to manage your Pi-hole. Versions 4.0 and above, prior to 5.18.3 are vulnerable to… |
CVE-2023-23613 | Medium | 5.7 | 2023-01-26 | OpenSearch is an open source distributed and RESTful search engine. In affected versions there is an issue in the implementation of field-level security (FLS)… |
CVE-2023-23612 | Medium | 4.7 | 2023-01-26 | OpenSearch is an open source distributed and RESTful search engine. OpenSearch uses JWTs to store role claims obtained from the Identity Provider (IdP) when th… |
CVE-2023-23611 | Medium | 5.4 | 2023-01-26 | LTI Consumer XBlock implements the consumer side of the LTI specification enabling integration of third-party LTI provider tools. Versions 7.0.0 and above, pri… |
CVE-2023-23610 | Medium | 6.5 | 2023-01-26 | GLPI is a Free Asset and IT Management Software package. Versions prior to 9.5.12 and 10.0.6 are vulnerable to Improper Privilege Management. Any user having a… |
CVE-2023-23609 | High | 8.2 | 2023-01-26 | Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. Versions prior to and including 4.8 are vulnerable to an out-of-… |
CVE-2023-23608 | Unrated | | 2023-01-26 | Spotipy is a light weight Python library for the Spotify Web API. In versions prior to 2.22.1, if a malicious URI is passed to the library, the library can be… |
CVE-2023-23151 | Medium | 6.5 | 2023-01-26 | bloofoxCMS v0.5.2.1 was discovered to contain an arbitrary file deletion vulnerability via the component /include/inc_content_media.php. |
CVE-2023-22971 | Medium | 6.1 | 2023-01-26 | Cross Site Scripting (XSS) vulnerability in Hughes Network Systems Router Terminal for HX200 v8.3.1.14, HX90 v6.11.0.5, HX50L v6.10.0.18, HN9460 v8.2.0.48, and… |
CVE-2023-22739 | Medium | 6.5 | 2023-01-26 | Discourse is an open source platform for community discussion. Versions prior to 3.0.1 (stable), 3.1.0.beta2 (beta), and 3.1.0.beta2 (tests-passed) are subject… |
CVE-2023-22736 | High | 8.5 | 2023-01-26 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions starting with 2.5.0-rc1 and above, prior to 2.5.8, and version 2.6.0-rc4, ar… |
CVE-2023-22725 | Medium | 6.2 | 2023-01-26 | GLPI is a Free Asset and IT Management Software package. Versions 0.6.0 and above, prior to 10.0.6 are vulnerable to Cross-site Scripting. This vulnerability a… |
CVE-2023-22724 | Medium | 6.2 | 2023-01-26 | GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator… |
CVE-2023-22722 | Medium | 6.8 | 2023-01-26 | GLPI is a Free Asset and IT Management Software package. Versions 9.4.0 and above, prior to 10.0.6 are subject to Cross-site Scripting. An attacker can persuad… |
CVE-2023-22500 | High | 7.5 | 2023-01-26 | GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6 are vulnerable to Incorrect Authorization. This vulnerabili… |
CVE-2023-22486 | Low | 3.5 | 2023-01-26 | cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 contain a polynomial time com… |
CVE-2023-22482 | Critical | 9.0 | 2023-01-26 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions of Argo CD starting with v1.8.2 and prior to 2.3.13, 2.4.19, 2.5.6, and 2.6… |
CVE-2023-22468 | High | 8.8 | 2023-01-26 | Discourse is an open source platform for community discussion. Versions prior to 2.8.13 (stable), 3.0.0.beta16 (beta) and 3.0.0beta16 (tests-passed), are vulne… |
CVE-2023-20928 | High | 7.8 | 2023-01-26 | In binder_vma_close of binder.c, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no additiona… |
CVE-2023-20925 | High | 7.8 | 2023-01-26 | In setUclampMinLocked of PowerSessionManager.cpp, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of pri… |
CVE-2023-20924 | Medium | 6.8 | 2023-01-26 | In (TBD) of (TBD), there is a possible way to bypass the lockscreen due to Biometric Auth Failure. This could lead to local escalation of privilege with physic… |
CVE-2023-20923 | Medium | 5.5 | 2023-01-26 | In exported content providers of ShannonRcs, there is a possible way to get access to protected content providers due to a permissions bypass. This could lead… |
CVE-2023-20922 | Medium | 5.5 | 2023-01-26 | In setMimeGroup of PackageManagerService.java, there is a possible crash loop due to resource exhaustion. This could lead to local denial of service with no ad… |
CVE-2023-20921 | High | 7.3 | 2023-01-26 | In onPackageRemoved of AccessibilityManagerService.java, there is a possibility to automatically grant accessibility services due to a logic error in the code… |
CVE-2023-20920 | High | 7.8 | 2023-01-26 | In queue of UsbRequest.java, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additi… |
CVE-2023-20919 | High | 7.8 | 2023-01-26 | In getStringsForPrefix of Settings.java, there is a possible prevention of package uninstallation due to a logic error in the code. This could lead to local es… |
CVE-2023-20916 | High | 7.8 | 2023-01-26 | In getMainActivityLaunchIntent of LauncherAppsService.java, there is a possible way to bypass the restrictions on starting activities from the background due t… |
CVE-2023-20915 | High | 7.8 | 2023-01-26 | In addOrReplacePhoneAccount of PhoneAccountRegistrar.java, there is a possible way to enable a phone account without user interaction due to a logic error in t… |
CVE-2023-20913 | High | 7.8 | 2023-01-26 | In onCreate of PhoneAccountSettingsActivity.java and related files, there is a possible way to mislead the user into enabling a malicious phone account due to… |
CVE-2023-20912 | High | 7.8 | 2023-01-26 | In onActivityResult of AvatarPickerActivity.java, there is a possible way to access images belonging to other users due to a missing permission check. This cou… |
CVE-2023-20908 | Medium | 5.5 | 2023-01-26 | In several functions of SettingsState.java, there is a possible system crash loop due to resource exhaustion. This could lead to local denial of service with n… |
CVE-2023-20905 | High | 7.8 | 2023-01-26 | In Mfc_Transceive of phNxpExtns_MifareStd.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of pr… |
CVE-2023-20904 | High | 7.8 | 2023-01-26 | In getTrampolineIntent of SettingsActivity.java, there is a possible launch of arbitrary activity due to an Intent mismatch in the code. This could lead to loc… |
CVE-2023-0516 | Medium | 5.5 | 2023-01-26 | A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been classified as critical. Affected is an unknown function o… |
CVE-2023-0515 | Medium | 5.5 | 2023-01-26 | A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0 and classified as critical. This issue affects some unknown processing… |
CVE-2023-0513 | Low | 3.5 | 2023-01-26 | A vulnerability has been found in isoftforce Dreamer CMS up to 4.0.1 and classified as problematic. This vulnerability affects unknown code. The manipulation l… |
CVE-2023-0476 | Medium | 6.5 | 2023-01-26 | A LDAP injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated attacker c… |
CVE-2023-0469 | Medium | 5.5 | 2023-01-26 | A use-after-free flaw was found in io_uring/filetable.c in io_install_fixed_file in the io_uring subcomponent in the Linux Kernel during call cleanup. This fla… |
CVE-2023-0468 | Medium | 4.7 | 2023-01-26 | A use-after-free flaw was found in io_uring/poll.c in io_poll_check_events in the io_uring subcomponent in the Linux Kernel due to a race condition of poll_ref… |
CVE-2023-0463 | Low | 3.3 | 2023-01-26 | The force offline MFA prompt setting is not respected when switching to offline mode in Devolutions Remote Desktop Manager 2022.3.29 to 2022.3.30 allows a user… |
CVE-2023-0452 | Critical | 9.8 | 2023-01-26 | Econolite EOS versions prior to 3.2.23 use a weak hash algorithm for encrypting privileged user credentials. A configuration file that is accessible without au… |
CVE-2023-0451 | High | 7.5 | 2023-01-26 | Econolite EOS versions prior to 3.2.23 lack a password requirement for gaining “READONLY” access to log files and certain database and configuration files. One… |
CVE-2023-0448 | Medium | 6.1 | 2023-01-26 | The WP Helper Lite WordPress plugin, in versions < 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cross-site scripting v… |
CVE-2023-0444 | High | 8.8 | 2023-01-26 | A privilege escalation vulnerability exists in Delta Electronics InfraSuite Device Master 00.00.02a. A default user 'User', which is in the 'Read Only User' gr… |
CVE-2023-0417 | Medium | 6.3 | 2023-01-26 | Memory leak in the NFS dissector in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file |
CVE-2023-0416 | Medium | 6.3 | 2023-01-26 | GNW dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file |
CVE-2023-0415 | Medium | 6.3 | 2023-01-26 | iSCSI dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file |
CVE-2023-0414 | Medium | 6.3 | 2023-01-26 | Crash in the EAP dissector in Wireshark 4.0.0 to 4.0.2 allows denial of service via packet injection or crafted capture file |
CVE-2023-0413 | Medium | 6.3 | 2023-01-26 | Dissection engine bug in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file |
CVE-2023-0412 | Medium | 6.3 | 2023-01-26 | TIPC dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file |
CVE-2023-0411 | Medium | 6.3 | 2023-01-26 | Excessive loops in multiple dissectors in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file |
CVE-2023-0394 | Medium | 5.5 | 2023-01-26 | A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in the Linux kernel. This flaw causes the… |
CVE-2023-0356 | Medium | 5.7 | 2023-01-26 | SOCOMEC MODULYS GP Netvision versions 7.20 and prior lack strong encryption for credentials on HTTP connections, which could result in threat actors obtaining… |
CVE-2023-0321 | Critical | 9.1 | 2023-01-26 | Campbell Scientific dataloggers CR6, CR300, CR800, CR1000 and CR3000 may allow an attacker to download configuration files, which may contain sensitive informa… |
CVE-2023-0284 | Medium | 6.8 | 2023-01-26 | Improper Input Validation of LDAP user IDs in Tribe29 Checkmk allows attackers that can control LDAP user IDs to manipulate files on the server. Checkmk <= 2.1… |
CVE-2023-0229 | Medium | 6.3 | 2023-01-26 | A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to s… |
CVE-2023-0396 | Medium | 6.8 | 2023-01-25 | A malicious / defective bluetooth controller can cause buffer overreads in the most functions that process HCI command responses. |
CVE-2023-23331 | Critical | 9.8 | 2023-01-24 | Amano Xoffice parking solutions 7.1.3879 is vulnerable to SQL Injection. |
CVE-2023-22485 | Medium | 5.3 | 2023-01-24 | cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior 0.29.0.gfm.7, a crafted markdown document c… |
CVE-2023-21796 | High | 8.3 | 2023-01-24 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2023-21795 | High | 8.3 | 2023-01-24 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2023-21775 | High | 8.3 | 2023-01-24 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2023-21719 | Medium | 6.5 | 2023-01-24 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability |
CVE-2023-22484 | Low | 3.5 | 2023-01-23 | cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to a polynomial ti… |
CVE-2023-22483 | Low | 3.5 | 2023-01-23 | cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to several polynom… |
CVE-2023-22630 | Medium | 4.3 | 2023-01-23 | IzyBat Orange casiers before 20221102_1 allows SQL Injection via a getCasier.php?taille= URI. |
CVE-2023-23560 | Critical | 9.8 | 2023-01-23 | In certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation. |
CVE-2023-22960 | High | 7.5 | 2023-01-23 | Lexmark products through 2023-01-10 have Improper Control of Interaction Frequency. |
CVE-2023-23824 | Medium | 6.7 | 2023-01-23 | Auth. SQL Injection (SQLi) vulnerability in WP-TopBar <= 5.36 versions. |
CVE-2023-23687 | Medium | 6.5 | 2023-01-23 | Auth. Stored Cross-Site Scripting (XSS) vulnerability in Youtube shortcode <= 1.8.5 versions. |
CVE-2023-22721 | Medium | 6.5 | 2023-01-23 | Auth. Stored Cross-Site Scripting (XSS) in Oi Yandex.Maps for WordPress <= 3.2.7 versions. |
CVE-2023-0447 | Medium | 4.3 | 2023-01-23 | The My YouTube Channel plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the clear_all_cache function in versions… |
CVE-2023-0446 | Medium | 5.5 | 2023-01-23 | The My YouTube Channel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 3.0.12.1… |
CVE-2023-24099 | High | 8.8 | 2023-01-23 | TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the username parameter at /formWiz… |
CVE-2023-24098 | High | 8.8 | 2023-01-23 | TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the submit-url parameter at /formS… |
CVE-2023-24097 | High | 8.8 | 2023-01-23 | TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the submit-url parameter at /formP… |
CVE-2023-24096 | High | 8.8 | 2023-01-23 | TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the newpass parameter at /formPass… |
CVE-2023-24095 | High | 8.8 | 2023-01-23 | TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the submit-url parameter at /formS… |
CVE-2023-0440 | Medium | 5.3 | 2023-01-23 | Observable Discrepancy in GitHub repository healthchecks/healthchecks prior to v2.6. |
CVE-2023-0438 | Medium | 6.5 | 2023-01-23 | Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4. |
CVE-2023-24069 | Low | 3.3 | 2023-01-23 | Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to obtain potentially sensitive attachments sent in messages from the attachments.n… |
CVE-2023-24068 | High | 7.8 | 2023-01-23 | Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to modify conversation attachments within the attachments.noindex directory. Client… |
CVE-2023-24070 | Medium | 6.1 | 2023-01-23 | app/View/AuthKeys/authkey_display.ctp in MISP through 2.4.167 has an XSS in authkey add via a Referer field. |
CVE-2023-23314 | High | 8.8 | 2023-01-23 | An arbitrary file upload vulnerability in the /api/upload component of zdir v3.2.0 allows attackers to execute arbitrary code via a crafted .ssh file. |
CVE-2023-0435 | Critical | 9.8 | 2023-01-22 | Excessive Attack Surface in GitHub repository pyload/pyload prior to 0.5.0b3.dev41. |
CVE-2023-24059 | High | 7.3 | 2023-01-22 | Grand Theft Auto V for PC allows attackers to achieve partial remote code execution or modify files on a PC, as exploited in the wild in January 2023. |
CVE-2023-24058 | Medium | 4.3 | 2023-01-22 | Booked Scheduler 2.5.5 allows authenticated users to create and schedule events for any other user via a modified userId value to reservation_save.php. NOTE: 2… |
CVE-2023-24056 | Medium | 5.5 | 2023-01-22 | In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For exam… |
CVE-2023-24055 | Medium | 5.5 | 2023-01-22 | KeePass through 2.53 (in a default installation) allows an attacker, who has write access to the XML configuration file, to obtain the cleartext passwords by a… |
CVE-2023-24044 | Medium | 6.1 | 2023-01-22 | A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request h… |
CVE-2023-0434 | High | 7.5 | 2023-01-22 | Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40. |
CVE-2023-22617 | High | 7.5 | 2023-01-21 | A remote attacker might be able to cause infinite recursion in PowerDNS Recursor 4.8.0 via a DNS query that retrieves DS records for a misconfigured domain, be… |
CVE-2023-0433 | High | 7.8 | 2023-01-21 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1225. |
CVE-2023-22884 | Critical | 9.8 | 2023-01-21 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software… |