2023 CVEs (page 302)
Page 302 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-0444 | High | 8.8 | 2023-01-26 | A privilege escalation vulnerability exists in Delta Electronics InfraSuite Device Master 00.00.02a. A default user 'User', which is in the 'Read Only User' gr… |
CVE-2023-0417 | Medium | 6.3 | 2023-01-26 | Memory leak in the NFS dissector in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file |
CVE-2023-0416 | Medium | 6.3 | 2023-01-26 | GNW dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file |
CVE-2023-0415 | Medium | 6.3 | 2023-01-26 | iSCSI dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file |
CVE-2023-0414 | Medium | 6.3 | 2023-01-26 | Crash in the EAP dissector in Wireshark 4.0.0 to 4.0.2 allows denial of service via packet injection or crafted capture file |
CVE-2023-0413 | Medium | 6.3 | 2023-01-26 | Dissection engine bug in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file |
CVE-2023-0412 | Medium | 6.3 | 2023-01-26 | TIPC dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file |
CVE-2023-0411 | Medium | 6.3 | 2023-01-26 | Excessive loops in multiple dissectors in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file |
CVE-2023-0394 | Medium | 5.5 | 2023-01-26 | A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in the Linux kernel. This flaw causes the… |
CVE-2023-0356 | Medium | 5.7 | 2023-01-26 | SOCOMEC MODULYS GP Netvision versions 7.20 and prior lack strong encryption for credentials on HTTP connections, which could result in threat actors obtaining… |
CVE-2023-0321 | Critical | 9.1 | 2023-01-26 | Campbell Scientific dataloggers CR6, CR300, CR800, CR1000 and CR3000 may allow an attacker to download configuration files, which may contain sensitive informa… |
CVE-2023-0284 | Medium | 6.8 | 2023-01-26 | Improper Input Validation of LDAP user IDs in Tribe29 Checkmk allows attackers that can control LDAP user IDs to manipulate files on the server. Checkmk <= 2.1… |
CVE-2023-0229 | Medium | 6.3 | 2023-01-26 | A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to s… |
CVE-2023-0396 | Medium | 6.8 | 2023-01-25 | A malicious / defective bluetooth controller can cause buffer overreads in the most functions that process HCI command responses. |
CVE-2023-23331 | Critical | 9.8 | 2023-01-24 | Amano Xoffice parking solutions 7.1.3879 is vulnerable to SQL Injection. |
CVE-2023-22485 | Medium | 5.3 | 2023-01-24 | cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior 0.29.0.gfm.7, a crafted markdown document c… |
CVE-2023-21796 | High | 8.3 | 2023-01-24 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2023-21795 | High | 8.3 | 2023-01-24 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2023-21775 | High | 8.3 | 2023-01-24 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2023-21719 | Medium | 6.5 | 2023-01-24 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability |
CVE-2023-22484 | Low | 3.5 | 2023-01-23 | cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to a polynomial ti… |
CVE-2023-22483 | Low | 3.5 | 2023-01-23 | cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to several polynom… |
CVE-2023-22630 | Medium | 4.3 | 2023-01-23 | IzyBat Orange casiers before 20221102_1 allows SQL Injection via a getCasier.php?taille= URI. |
CVE-2023-23560 | Critical | 9.8 | 2023-01-23 | In certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation. |
CVE-2023-22960 | High | 7.5 | 2023-01-23 | Lexmark products through 2023-01-10 have Improper Control of Interaction Frequency. |
CVE-2023-23824 | Medium | 6.7 | 2023-01-23 | Auth. SQL Injection (SQLi) vulnerability in WP-TopBar <= 5.36 versions. |
CVE-2023-23687 | Medium | 6.5 | 2023-01-23 | Auth. Stored Cross-Site Scripting (XSS) vulnerability in Youtube shortcode <= 1.8.5 versions. |
CVE-2023-22721 | Medium | 6.5 | 2023-01-23 | Auth. Stored Cross-Site Scripting (XSS) in Oi Yandex.Maps for WordPress <= 3.2.7 versions. |
CVE-2023-0447 | Medium | 4.3 | 2023-01-23 | The My YouTube Channel plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the clear_all_cache function in versions… |
CVE-2023-0446 | Medium | 5.5 | 2023-01-23 | The My YouTube Channel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 3.0.12.1… |
CVE-2023-24099 | High | 8.8 | 2023-01-23 | TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the username parameter at /formWiz… |
CVE-2023-24098 | High | 8.8 | 2023-01-23 | TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the submit-url parameter at /formS… |
CVE-2023-24097 | High | 8.8 | 2023-01-23 | TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the submit-url parameter at /formP… |
CVE-2023-24096 | High | 8.8 | 2023-01-23 | TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the newpass parameter at /formPass… |
CVE-2023-24095 | High | 8.8 | 2023-01-23 | TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the submit-url parameter at /formS… |
CVE-2023-0440 | Medium | 5.3 | 2023-01-23 | Observable Discrepancy in GitHub repository healthchecks/healthchecks prior to v2.6. |
CVE-2023-0438 | Medium | 6.5 | 2023-01-23 | Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4. |
CVE-2023-24069 | Low | 3.3 | 2023-01-23 | Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to obtain potentially sensitive attachments sent in messages from the attachments.n… |
CVE-2023-24068 | High | 7.8 | 2023-01-23 | Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to modify conversation attachments within the attachments.noindex directory. Client… |
CVE-2023-24070 | Medium | 6.1 | 2023-01-23 | app/View/AuthKeys/authkey_display.ctp in MISP through 2.4.167 has an XSS in authkey add via a Referer field. |
CVE-2023-23314 | High | 8.8 | 2023-01-23 | An arbitrary file upload vulnerability in the /api/upload component of zdir v3.2.0 allows attackers to execute arbitrary code via a crafted .ssh file. |
CVE-2023-0435 | Critical | 9.8 | 2023-01-22 | Excessive Attack Surface in GitHub repository pyload/pyload prior to 0.5.0b3.dev41. |
CVE-2023-24059 | High | 7.3 | 2023-01-22 | Grand Theft Auto V for PC allows attackers to achieve partial remote code execution or modify files on a PC, as exploited in the wild in January 2023. |
CVE-2023-24058 | Medium | 4.3 | 2023-01-22 | Booked Scheduler 2.5.5 allows authenticated users to create and schedule events for any other user via a modified userId value to reservation_save.php. NOTE: 2… |
CVE-2023-24056 | Medium | 5.5 | 2023-01-22 | In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For exam… |
CVE-2023-24055 | Medium | 5.5 | 2023-01-22 | KeePass through 2.53 (in a default installation) allows an attacker, who has write access to the XML configuration file, to obtain the cleartext passwords by a… |
CVE-2023-24044 | Medium | 6.1 | 2023-01-22 | A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request h… |
CVE-2023-0434 | High | 7.5 | 2023-01-22 | Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40. |
CVE-2023-22617 | High | 7.5 | 2023-01-21 | A remote attacker might be able to cause infinite recursion in PowerDNS Recursor 4.8.0 via a DNS query that retrieves DS records for a misconfigured domain, be… |
CVE-2023-0433 | High | 7.8 | 2023-01-21 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1225. |
CVE-2023-22884 | Critical | 9.8 | 2023-01-21 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software… |
CVE-2023-24042 | High | 7.5 | 2023-01-21 | A race condition in LightFTP through 2.2 allows an attacker to achieve path traversal via a malformed FTP request. A handler thread can use an overwritten cont… |
CVE-2023-24040 | High | 7.1 | 2023-01-21 | dtprintinfo in Common Desktop Environment 1.6 has a bug in the parser of lpstat (an invoked external command) during listing of the names of available printers… |
CVE-2023-24039 | High | 7.8 | 2023-01-21 | A stack-based buffer overflow in ParseColors in libXm in Common Desktop Environment 1.6 can be exploited by local low-privileged users via the dtprintinfo setu… |
CVE-2023-24038 | High | 7.5 | 2023-01-21 | The HTML-StripScripts module through 1.06 for Perl allows _hss_attval_style ReDoS because of catastrophic backtracking for HTML content with certain style attr… |
CVE-2023-22742 | Medium | 5.3 | 2023-01-20 | libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2 backend, libgit2 does not perform certi… |
CVE-2023-24028 | Critical | 9.8 | 2023-01-20 | In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function. |
CVE-2023-24027 | Medium | 6.1 | 2023-01-20 | In MISP 2.4.167, app/webroot/js/action_table.js allows XSS via a network history name. |
CVE-2023-24026 | Medium | 6.1 | 2023-01-20 | In MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview payload. |
CVE-2023-22726 | High | 8.0 | 2023-01-20 | act is a project which allows for local running of github actions. The artifact server that stores artifacts from Github Action runs does not sanitize path inp… |
CVE-2023-0052 | Critical | 9.8 | 2023-01-20 | SAUTER Controls Nova 200–220 Series with firmware version 3.3-006 and prior and BACnetstac version 4.2.1 and prior allows the execution of commands without cre… |
CVE-2023-24025 | High | 7.5 | 2023-01-20 | CRYSTALS-DILITHIUM (in Post-Quantum Cryptography Selected Algorithms 2022) in PQClean d03da30 may allow universal forgeries of digital signatures via a templat… |
CVE-2023-23607 | Critical | 9.8 | 2023-01-20 | erohtar/Dasherr is a dashboard for self-hosted services. In affected versions unrestricted file upload allows any unauthenticated user to execute arbitrary cod… |
CVE-2023-24021 | High | 7.5 | 2023-01-20 | Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web A… |
CVE-2023-23492 | High | 8.8 | 2023-01-20 | The Login with Phone Number WordPress Plugin, version < 1.4.2, is affected by an authenticated SQL injection vulnerability in the 'ID' parameter of its 'lwp_fo… |
CVE-2023-23491 | Medium | 6.1 | 2023-01-20 | The Quick Event Manager WordPress Plugin, version < 9.7.5, is affected by a reflected cross-site scripting vulnerability in the 'category' parameter of its 'qe… |
CVE-2023-23490 | High | 8.8 | 2023-01-20 | The Survey Maker WordPress Plugin, version < 3.1.2, is affected by an authenticated SQL injection vulnerability in the 'surveys_ids' parameter of its 'ays_surv… |
CVE-2023-23145 | High | 7.8 | 2023-01-20 | GPAC version 2.2-rev0-gab012bbfb-master was discovered to contain a memory leak in lsr_read_rare_full function. |
CVE-2023-23144 | Medium | 5.5 | 2023-01-20 | Integer overflow vulnerability in function Q_DecCoordOnUnitSphere file bifs/unquantize.c in GPAC version 2.2-rev0-gab012bbfb-master. |
CVE-2023-23143 | High | 7.8 | 2023-01-20 | Buffer overflow vulnerability in function avc_parse_slice in file media_tools/av_parsers.c. GPAC version 2.3-DEV-rev1-g4669ba229-master. |
CVE-2023-23024 | Medium | 6.1 | 2023-01-20 | Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/book. This vulnerability allows at… |
CVE-2023-23015 | Medium | 6.1 | 2023-01-20 | Cross Site Scripting (XSS) vulnerability in Kalkun 0.8.0 via username input in file User_model.php. |
CVE-2023-23014 | Medium | 6.1 | 2023-01-20 | Cross Site Scripting (XSS) vulnerability in InventorySystem thru commit e08fbbe17902146313501ed0b5feba81d58f455c (on Apr 23, 2021) via edit_store_name and edit… |
CVE-2023-23012 | Medium | 6.1 | 2023-01-20 | Cross Site Scripting (XSS) vulnerability in craigrodway classroombookings 2.6.4 allows attackers to execute arbitrary code or other unspecified impacts via the… |
CVE-2023-23010 | Medium | 6.1 | 2023-01-20 | Cross Site Scripting (XSS) vulnerability in Ecommerce-CodeIgniter-Bootstrap thru commit d5904379ca55014c5df34c67deda982c73dc7fe5 (on Dec 27, 2022), allows atta… |
CVE-2023-22458 | Medium | 5.5 | 2023-01-20 | Redis is an in-memory database that persists on disk. Authenticated users can issue a `HRANDFIELD` or `ZRANDMEMBER` command with specially crafted arguments to… |
CVE-2023-0101 | High | 8.8 | 2023-01-20 | A privilege escalation vulnerability was identified in Nessus versions 8.10.1 through 8.15.8 and 10.0.0 through 10.4.1. An authenticated attacker could potenti… |
CVE-2023-23489 | Critical | 9.8 | 2023-01-20 | The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection vulnerability in the 's' parameter of… |
CVE-2023-23488 | Critical | 9.8 | 2023-01-20 | The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the 'code' parameter of the '/pmpr… |
CVE-2023-22912 | Medium | 5.3 | 2023-01-20 | An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. CheckUser TokenManager insecurely uses AES-C… |
CVE-2023-22910 | Medium | 5.4 | 2023-01-20 | An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. There is XSS in Wikibase date formatting via… |
CVE-2023-22964 | Critical | 9.1 | 2023-01-20 | Zoho ManageEngine ServiceDesk Plus MSP before 10611, and 13x before 13004, is vulnerable to authentication bypass when LDAP authentication is enabled. |
CVE-2023-23691 | High | 8.1 | 2023-01-20 | Dell EMC PV ME5, versions ME5.1.0.0.0 and ME5.1.0.1.0, contains a Client-side desync Vulnerability. An unauthenticated attacker could potentially exploit this… |
CVE-2023-23596 | High | 8.8 | 2023-01-20 | jc21 NGINX Proxy Manager through 2.9.19 allows OS command injection. When creating an access list, the backend builds an htpasswd file with crafted username an… |
CVE-2023-20058 | Medium | 6.1 | 2023-01-20 | A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a reflect… |
CVE-2023-20057 | Unrated | | 2023-01-20 | A vulnerability in the URL filtering mechanism of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attack… |
CVE-2023-20047 | Medium | 6.5 | 2023-01-20 | A vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco Webex Room Phone and Cisco Webex Share devices could allow an unauthenticated, adj… |
CVE-2023-20045 | Medium | 4.9 | 2023-01-20 | A vulnerability in the web-based management interface of Cisco Small Business RV160 and RV260 Series VPN Routers could allow an authenticated, remote attacker… |
CVE-2023-20044 | Medium | 6.7 | 2023-01-20 | A vulnerability in Cisco CX Cloud Agent of could allow an authenticated, local attacker to elevate their privileges. This vulnerability is due to insecure f… |
CVE-2023-20043 | Medium | 6.7 | 2023-01-20 | A vulnerability in Cisco CX Cloud Agent of could allow an authenticated, local attacker to elevate their privileges. This vulnerability is due to insecure f… |
CVE-2023-20040 | Medium | 5.5 | 2023-01-20 | A vulnerability in the NETCONF service of Cisco Network Services Orchestrator (NSO) could allow an authenticated, remote attacker to cause a denial of service… |
CVE-2023-20038 | High | 8.8 | 2023-01-20 | A vulnerability in the monitoring application of Cisco Industrial Network Director could allow an authenticated, local attacker to access a static secret key u… |
CVE-2023-20037 | Medium | 5.4 | 2023-01-20 | A vulnerability in Cisco Industrial Network Director could allow an authenticated, remote attacker to conduct stored cross-site scripting (XSS) attacks. The… |
CVE-2023-20026 | Medium | 6.5 | 2023-01-20 | A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320 and RV325 Routers could allow an authenticated… |
CVE-2023-20025 | Critical | 9.0 | 2023-01-20 | A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, and RV082 Routers could allow an unauthenticated, remote at… |
CVE-2023-20020 | High | 8.6 | 2023-01-20 | A vulnerability in the Device Management Servlet application of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform c… |
CVE-2023-20019 | Medium | 6.1 | 2023-01-20 | A vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform, Cisco BroadWorks Application Server, and Cisco BroadWo… |
CVE-2023-20018 | High | 8.6 | 2023-01-20 | A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote attacker to bypass a… |
CVE-2023-20010 | High | 8.1 | 2023-01-20 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Man… |
CVE-2023-20008 | Medium | 4.4 | 2023-01-20 | A vulnerability in the CLI of Cisco TelePresence CE and RoomOS Software could allow an authenticated, local attacker to overwrite arbitrary files on the local… |