2023 CVEs (page 305)
Page 305 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-0289 | Medium | 5.4 | 2023-01-13 | Cross-site Scripting (XSS) - Stored in GitHub repository craigk5n/webcalendar prior to master. |
CVE-2023-0288 | High | 7.8 | 2023-01-13 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. |
CVE-2023-0221 | Medium | 4.4 | 2023-01-13 | Product security bypass vulnerability in ACC prior to version 8.3.4 allows a locally logged-in attacker with administrator privileges to bypass the execution c… |
CVE-2023-22493 | High | 8.8 | 2023-01-13 | RSSHub is an open source RSS feed generator. RSSHub is vulnerable to Server-Side Request Forgery (SSRF) attacks. This vulnerability allows an attacker to send… |
CVE-2023-0287 | Low | 3.5 | 2023-01-13 | A vulnerability was found in ityouknow favorites-web. It has been rated as problematic. Affected by this issue is some unknown functionality of the component C… |
CVE-2023-0283 | Medium | 6.3 | 2023-01-13 | A vulnerability classified as critical has been found in SourceCodester Online Flight Booking Management System. This affects an unknown part of the file revie… |
CVE-2023-0281 | Medium | 6.3 | 2023-01-13 | A vulnerability was found in SourceCodester Online Flight Booking Management System. It has been rated as critical. Affected by this issue is some unknown func… |
CVE-2023-0105 | Medium | 6.5 | 2023-01-13 | A flaw was found in Keycloak. This flaw allows impersonation and lockout due to the email trust not being handled correctly in Keycloak. An attacker can shadow… |
CVE-2023-0091 | Low | 3.8 | 2023-01-13 | A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. This flaw allows an attacker… |
CVE-2023-23566 | Critical | 9.8 | 2023-01-13 | A 2-Step Verification problem in Axigen 10.3.3.52 allows an attacker to access a mailbox by bypassing 2-Step Verification when they try to add an account to an… |
CVE-2023-23559 | High | 7.8 | 2023-01-13 | In rndis_query_oid in drivers/net/wireless/rndis_wlan.c in the Linux kernel through 6.1.5, there is an integer overflow in an addition. |
CVE-2023-22417 | High | 7.5 | 2023-01-13 | A Missing Release of Memory after Effective Lifetime vulnerability in the Flow Processing Daemon (flowd) of Juniper Networks Junos OS allows a network-based, u… |
CVE-2023-22416 | High | 7.5 | 2023-01-13 | A Buffer Overflow vulnerability in SIP ALG of Juniper Networks Junos OS allows a network-based, unauthenticated attacker to cause a Denial of Service (DoS). On… |
CVE-2023-22415 | High | 7.5 | 2023-01-13 | An Out-of-Bounds Write vulnerability in the H.323 ALG of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause Denial of Service… |
CVE-2023-22414 | Medium | 6.5 | 2023-01-13 | A Missing Release of Memory after Effective Lifetime vulnerability in Flexible PIC Concentrator (FPC) of Juniper Networks Junos OS allows an adjacent, unauthen… |
CVE-2023-22413 | High | 7.5 | 2023-01-13 | An Improper Check or Handling of Exceptional Conditions vulnerability in the IPsec library of Juniper Networks Junos OS allows a network-based, unauthenticated… |
CVE-2023-22412 | High | 7.5 | 2023-01-13 | An Improper Locking vulnerability in the SIP ALG of Juniper Networks Junos OS on MX Series with MS-MPC or MS-MIC card and SRX Series allows an unauthenticated… |
CVE-2023-22411 | High | 7.5 | 2023-01-13 | An Out-of-Bounds Write vulnerability in Flow Processing Daemon (flowd) of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause… |
CVE-2023-22410 | High | 7.5 | 2023-01-13 | A Missing Release of Memory after Effective Lifetime vulnerability in the Juniper Networks Junos OS on MX Series platforms with MPC10/MPC11 line cards, allows… |
CVE-2023-22409 | Medium | 5.5 | 2023-01-13 | An Unchecked Input for Loop Condition vulnerability in a NAT library of Juniper Networks Junos OS allows a local authenticated attacker with low privileges to… |
CVE-2023-22408 | High | 7.5 | 2023-01-13 | An Improper Validation of Array Index vulnerability in the SIP ALG of Juniper Networks Junos OS on SRX 5000 Series allows a network-based, unauthenticated atta… |
CVE-2023-22407 | Medium | 6.5 | 2023-01-13 | An Incomplete Cleanup vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated… |
CVE-2023-22406 | Medium | 6.5 | 2023-01-13 | A Missing Release of Memory after Effective Lifetime vulnerability in the kernel of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthen… |
CVE-2023-22405 | Medium | 6.5 | 2023-01-13 | An Improper Preservation of Consistency Between Independent Representations of Shared State vulnerability in the Packet Forwarding Engine (PFE) of Juniper Netw… |
CVE-2023-22404 | Medium | 6.5 | 2023-01-13 | An Out-of-bounds Write vulnerability in the Internet Key Exchange Protocol daemon (iked) of Juniper Networks Junos OS on SRX series and MX with SPC3 allows an… |
CVE-2023-22403 | High | 7.5 | 2023-01-13 | An Allocation of Resources Without Limits or Throttling vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows a network-base… |
CVE-2023-22402 | Medium | 5.9 | 2023-01-13 | A Use After Free vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Servic… |
CVE-2023-22401 | High | 7.5 | 2023-01-13 | An Improper Validation of Array Index vulnerability in the Advanced Forwarding Toolkit Manager daemon (aftmand) of Juniper Networks Junos OS and Junos OS Evolv… |
CVE-2023-22400 | High | 7.5 | 2023-01-13 | An Uncontrolled Resource Consumption vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos OS Evolved allows an unauthenticated, n… |
CVE-2023-22399 | High | 7.5 | 2023-01-13 | When sFlow is enabled and it monitors a packet forwarded via ECMP, a buffer management vulnerability in the dcpfe process of Juniper Networks Junos OS on QFX10… |
CVE-2023-22398 | Medium | 5.3 | 2023-01-13 | An Access of Uninitialized Pointer vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a locally authen… |
CVE-2023-22397 | Medium | 6.1 | 2023-01-13 | An Allocation of Resources Without Limits or Throttling weakness in the memory management of the Packet Forwarding Engine (PFE) on Juniper Networks Junos OS Ev… |
CVE-2023-22396 | High | 7.5 | 2023-01-13 | An Uncontrolled Resource Consumption vulnerability in TCP processing on the Routing Engine (RE) of Juniper Networks Junos OS allows an unauthenticated network-… |
CVE-2023-22395 | Medium | 6.5 | 2023-01-13 | A Missing Release of Memory after Effective Lifetime vulnerability in the kernel of Juniper Networks Junos OS allows an unauthenticated, adjacent attacker to c… |
CVE-2023-22394 | High | 7.5 | 2023-01-13 | An Improper Handling of Unexpected Data Type vulnerability in the handling of SIP calls in Juniper Networks Junos OS on SRX Series and MX Series platforms allo… |
CVE-2023-22393 | High | 7.5 | 2023-01-13 | An Improper Check for Unusual or Exceptional Conditions vulnerability in BGP route processing of Juniper Networks Junos OS and Junos OS Evolved allows an attac… |
CVE-2023-22391 | High | 7.5 | 2023-01-13 | A vulnerability in class-of-service (CoS) queue management in Juniper Networks Junos OS on the ACX2K Series devices allows an unauthenticated network-based att… |
CVE-2023-22601 | Critical | 10.0 | 2023-01-12 | InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-330: Us… |
CVE-2023-22600 | Critical | 10.0 | 2023-01-12 | InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-284: Im… |
CVE-2023-22599 | High | 7.0 | 2023-01-12 | InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-760: Us… |
CVE-2023-22598 | High | 7.2 | 2023-01-12 | InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-78: Im… |
CVE-2023-22597 | Medium | 6.5 | 2023-01-12 | InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-319: Cl… |
CVE-2023-0258 | Low | 2.4 | 2023-01-12 | A vulnerability was found in SourceCodester Online Food Ordering System 2.0. It has been rated as problematic. Affected by this issue is some unknown functiona… |
CVE-2023-0257 | Medium | 4.7 | 2023-01-12 | A vulnerability was found in SourceCodester Online Food Ordering System 2.0. It has been declared as critical. Affected by this vulnerability is an unknown fun… |
CVE-2023-0256 | Medium | 6.3 | 2023-01-12 | A vulnerability was found in SourceCodester Online Food Ordering System 2.0. It has been classified as critical. Affected is an unknown function of the file /f… |
CVE-2023-22488 | Medium | 6.8 | 2023-01-12 | Flarum is a forum software for building communities. Using the notifications feature, one can read restricted/private content and bypass access checks that wou… |
CVE-2023-23457 | Medium | 5.3 | 2023-01-12 | A Segmentation fault was found in UPX in PackLinuxElf64::invert_pt_dynamic() in p_lx_elf.cpp. An attacker with a crafted input file allows invalid memory addre… |
CVE-2023-23456 | Medium | 5.3 | 2023-01-12 | A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in p_tmt.cpp file. The flow allows an attacker to cause a denial of service (abort)… |
CVE-2023-0254 | High | 7.2 | 2023-01-12 | The Simple Membership WP user Import plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in versions up to, and including, 1.7 due… |
CVE-2023-0247 | High | 7.8 | 2023-01-12 | Uncontrolled Search Path Element in GitHub repository bits-and-blooms/bloom prior to 3.3.1. |
CVE-2023-0246 | Low | 3.5 | 2023-01-12 | A vulnerability, which was classified as problematic, was found in earclink ESPCMS P8.21120101. Affected is an unknown function of the component Content Handle… |
CVE-2023-0245 | Medium | 6.3 | 2023-01-12 | A vulnerability, which was classified as critical, has been found in SourceCodester Online Flight Booking Management System. This issue affects some unknown pr… |
CVE-2023-0244 | Medium | 6.3 | 2023-01-12 | A vulnerability classified as critical was found in TuziCMS 2.0.6. This vulnerability affects the function delall of the file \App\Manage\Controller\KefuContro… |
CVE-2023-0243 | Medium | 6.3 | 2023-01-12 | A vulnerability classified as critical has been found in TuziCMS 2.0.6. This affects the function index of the file App\Manage\Controller\ArticleController.cla… |
CVE-2023-23455 | Medium | 5.5 | 2023-01-12 | atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative n… |
CVE-2023-23454 | Medium | 5.5 | 2023-01-12 | cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type c… |
CVE-2023-0042 | Medium | 6.1 | 2023-01-12 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2. GitLab… |
CVE-2023-0227 | Medium | 6.5 | 2023-01-12 | Insufficient Session Expiration in GitHub repository pyload/pyload prior to 0.5.0b3.dev36. |
CVE-2023-22492 | Medium | 5.9 | 2023-01-11 | ZITADEL is a combination of Auth0 and Keycloak. RefreshTokens is an OAuth 2.0 feature that allows applications to retrieve new access tokens and refresh the us… |
CVE-2023-22487 | High | 7.7 | 2023-01-11 | Flarum is a forum software for building communities. Using the mentions feature provided by the flarum/mentions extension, users can mention any post ID on the… |
CVE-2023-22952 | High | 8.8 | 2023-01-11 | In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. |
CVE-2023-20532 | Medium | 5.3 | 2023-01-11 | Insufficient input validation in the SMU may allow an attacker to improperly lock resources, potentially resulting in a denial of service. |
CVE-2023-20531 | High | 7.5 | 2023-01-11 | Insufficient bound checks in the SMU may allow an attacker to update the SRAM from/to address space to an invalid value potentially resulting in a denial of se… |
CVE-2023-20530 | High | 7.5 | 2023-01-11 | Insufficient input validation of BIOS mailbox messages in SMU may result in out-of-bounds memory reads potentially resulting in a denial of service. |
CVE-2023-20529 | High | 7.5 | 2023-01-11 | Insufficient bound checks in the SMU may allow an attacker to update the from/to address space to an invalid value potentially resulting in a denial of service… |
CVE-2023-20528 | Low | 2.4 | 2023-01-11 | Insufficient input validation in the SMU may allow a physical attacker to exfiltrate SMU memory contents over the I2C bus potentially leading to a loss of conf… |
CVE-2023-20527 | Medium | 6.5 | 2023-01-11 | Improper syscall input validation in the ASP Bootloader may allow a privileged attacker to read memory out-of-bounds, potentially leading to a denial-of-servic… |
CVE-2023-20525 | Medium | 6.5 | 2023-01-11 | Insufficient syscall input validation in the ASP Bootloader may allow a privileged attacker to read memory outside the bounds of a mapped register potentially… |
CVE-2023-20523 | Medium | 5.7 | 2023-01-11 | TOCTOU in the ASP may allow a physical attacker to write beyond the buffer bounds, potentially leading to a loss of integrity or denial of service. |
CVE-2023-20522 | High | 7.5 | 2023-01-11 | Insufficient input validation in ASP may allow an attacker with a malicious BIOS to potentially cause a denial of service. |
CVE-2023-22963 | Medium | 5.3 | 2023-01-11 | The personnummer implementation before 3.0.3 for Dart mishandles numbers in which the last four digits match the ^000[0-9]$ regular expression. |
CVE-2023-22959 | High | 8.8 | 2023-01-11 | WebChess through 0.9.0 and 1.0.0.rc2 allows SQL injection: mainmenu.php, chess.php, and opponentspassword.php (txtFirstName, txtLastName). |
CVE-2023-22958 | Medium | 6.1 | 2023-01-11 | The Syracom Secure Login plugin before 3.1.1.0 for Jira may allow spoofing of 2FA PIN validation via the plugins/servlet/twofactor/public/pinvalidation target… |
CVE-2023-22947 | High | 7.3 | 2023-01-11 | Insecure folder permissions in the Windows installation path of Shibboleth Service Provider (SP) before 3.4.1 allow an unprivileged local attacker to escalate… |
CVE-2023-22945 | Medium | 4.3 | 2023-01-11 | In the GrowthExperiments extension for MediaWiki through 1.39, the growthmanagementorlist API allows blocked users (blocked in ApiManageMentorList) to enroll a… |
CVE-2023-21793 | High | 7.8 | 2023-01-10 | 3D Builder Remote Code Execution Vulnerability |
CVE-2023-21792 | High | 7.8 | 2023-01-10 | 3D Builder Remote Code Execution Vulnerability |
CVE-2023-21791 | High | 7.8 | 2023-01-10 | 3D Builder Remote Code Execution Vulnerability |
CVE-2023-21790 | High | 7.8 | 2023-01-10 | 3D Builder Remote Code Execution Vulnerability |
CVE-2023-21789 | High | 7.8 | 2023-01-10 | 3D Builder Remote Code Execution Vulnerability |
CVE-2023-21788 | High | 7.8 | 2023-01-10 | 3D Builder Remote Code Execution Vulnerability |
CVE-2023-21787 | High | 7.8 | 2023-01-10 | 3D Builder Remote Code Execution Vulnerability |
CVE-2023-21786 | High | 7.8 | 2023-01-10 | 3D Builder Remote Code Execution Vulnerability |
CVE-2023-21785 | High | 7.8 | 2023-01-10 | 3D Builder Remote Code Execution Vulnerability |
CVE-2023-21784 | High | 7.8 | 2023-01-10 | 3D Builder Remote Code Execution Vulnerability |
CVE-2023-21783 | High | 7.8 | 2023-01-10 | 3D Builder Remote Code Execution Vulnerability |
CVE-2023-21782 | High | 7.8 | 2023-01-10 | 3D Builder Remote Code Execution Vulnerability |
CVE-2023-21781 | High | 7.8 | 2023-01-10 | 3D Builder Remote Code Execution Vulnerability |
CVE-2023-21780 | High | 7.8 | 2023-01-10 | 3D Builder Remote Code Execution Vulnerability |
CVE-2023-21779 | High | 7.8 | 2023-01-10 | Visual Studio Code Remote Code Execution Vulnerability |
CVE-2023-21776 | Medium | 5.5 | 2023-01-10 | Windows Kernel Information Disclosure Vulnerability |
CVE-2023-21774 | High | 7.8 | 2023-01-10 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2023-21773 | High | 7.8 | 2023-01-10 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2023-21772 | High | 7.8 | 2023-01-10 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2023-21771 | High | 7.0 | 2023-01-10 | Windows Local Session Manager (LSM) Elevation of Privilege Vulnerability |
CVE-2023-21768 | High | 7.8 | 2023-01-10 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability |
CVE-2023-21767 | High | 7.8 | 2023-01-10 | Windows Overlay Filter Elevation of Privilege Vulnerability |
CVE-2023-21766 | Medium | 4.7 | 2023-01-10 | Windows Overlay Filter Information Disclosure Vulnerability |
CVE-2023-21765 | High | 7.8 | 2023-01-10 | Windows Print Spooler Elevation of Privilege Vulnerability |
CVE-2023-21764 | High | 7.8 | 2023-01-10 | Microsoft Exchange Server Elevation of Privilege Vulnerability |