2023 CVEs (page 306)
Page 306 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-21555 | High | 8.1 | 2023-01-10 | Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability |
CVE-2023-21552 | High | 7.8 | 2023-01-10 | Windows GDI Elevation of Privilege Vulnerability |
CVE-2023-21551 | High | 7.8 | 2023-01-10 | Microsoft Cryptographic Services Elevation of Privilege Vulnerability |
CVE-2023-21550 | Medium | 5.5 | 2023-01-10 | Windows Cryptographic Information Disclosure Vulnerability |
CVE-2023-21549 | High | 8.8 | 2023-01-10 | Windows SMB Witness Service Elevation of Privilege Vulnerability |
CVE-2023-21548 | High | 8.1 | 2023-01-10 | Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability |
CVE-2023-21547 | High | 7.5 | 2023-01-10 | Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability |
CVE-2023-21546 | High | 8.1 | 2023-01-10 | Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability |
CVE-2023-21543 | High | 8.1 | 2023-01-10 | Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability |
CVE-2023-21542 | High | 7.0 | 2023-01-10 | Windows Installer Elevation of Privilege Vulnerability |
CVE-2023-21541 | High | 7.8 | 2023-01-10 | Windows Task Scheduler Elevation of Privilege Vulnerability |
CVE-2023-21540 | Medium | 5.5 | 2023-01-10 | Windows Cryptographic Information Disclosure Vulnerability |
CVE-2023-21539 | High | 7.5 | 2023-01-10 | Windows Authentication Remote Code Execution Vulnerability |
CVE-2023-21538 | High | 7.5 | 2023-01-10 | .NET Denial of Service Vulnerability |
CVE-2023-21537 | High | 7.8 | 2023-01-10 | Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability |
CVE-2023-21536 | Medium | 4.7 | 2023-01-10 | Event Tracing for Windows Information Disclosure Vulnerability |
CVE-2023-21535 | High | 8.1 | 2023-01-10 | Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability |
CVE-2023-21532 | High | 7.0 | 2023-01-10 | Windows GDI Elevation of Privilege Vulnerability |
CVE-2023-21531 | High | 7.0 | 2023-01-10 | Azure Service Fabric Container Elevation of Privilege Vulnerability |
CVE-2023-21527 | High | 7.5 | 2023-01-10 | Windows iSCSI Service Denial of Service Vulnerability |
CVE-2023-21525 | Medium | 5.3 | 2023-01-10 | Remote Procedure Call Runtime Denial of Service Vulnerability |
CVE-2023-21524 | High | 7.8 | 2023-01-10 | Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability |
CVE-2023-22479 | High | 7.5 | 2023-01-10 | KubePi is a modern Kubernetes panel. A session fixation attack allows an attacker to hijack a legitimate user session, versions 1.6.3 and below are susceptible… |
CVE-2023-22469 | Medium | 5.8 | 2023-01-10 | Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. When getting the reference pr… |
CVE-2023-0141 | Medium | 4.3 | 2023-01-10 | Insufficient policy enforcement in CORS in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (C… |
CVE-2023-0140 | Medium | 6.5 | 2023-01-10 | Inappropriate implementation in in File System API in Google Chrome on Windows prior to 109.0.5414.74 allowed a remote attacker to bypass file system restricti… |
CVE-2023-0139 | Medium | 6.5 | 2023-01-10 | Insufficient validation of untrusted input in Downloads in Google Chrome on Windows prior to 109.0.5414.74 allowed a remote attacker to bypass download restric… |
CVE-2023-0138 | High | 8.8 | 2023-01-10 | Heap buffer overflow in libphonenumber in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to potentially exploit heap corruption via a crafted H… |
CVE-2023-0137 | High | 8.8 | 2023-01-10 | Heap buffer overflow in Platform Apps in Google Chrome on Chrome OS prior to 109.0.5414.74 allowed an attacker who convinced a user to install a malicious exte… |
CVE-2023-0136 | High | 8.8 | 2023-01-10 | Inappropriate implementation in in Fullscreen API in Google Chrome on Android prior to 109.0.5414.74 allowed a remote attacker to execute incorrect security UI… |
CVE-2023-0135 | High | 8.8 | 2023-01-10 | Use after free in Cart in Google Chrome prior to 109.0.5414.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit… |
CVE-2023-0134 | High | 8.8 | 2023-01-10 | Use after free in Cart in Google Chrome prior to 109.0.5414.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit… |
CVE-2023-0133 | Medium | 6.5 | 2023-01-10 | Inappropriate implementation in in Permission prompts in Google Chrome on Android prior to 109.0.5414.74 allowed a remote attacker to bypass main origin permis… |
CVE-2023-0132 | Medium | 6.5 | 2023-01-10 | Inappropriate implementation in in Permission prompts in Google Chrome on Windows prior to 109.0.5414.74 allowed a remote attacker to force acceptance of a per… |
CVE-2023-0131 | Medium | 6.5 | 2023-01-10 | Inappropriate implementation in in iframe Sandbox in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to bypass file download restrictions via a… |
CVE-2023-0130 | Medium | 6.5 | 2023-01-10 | Inappropriate implementation in in Fullscreen API in Google Chrome on Android prior to 109.0.5414.74 allowed a remote attacker to spoof the contents of the Omn… |
CVE-2023-0129 | High | 8.8 | 2023-01-10 | Heap buffer overflow in Network Service in Google Chrome prior to 109.0.5414.74 allowed an attacker who convinced a user to install a malicious extension to po… |
CVE-2023-0128 | High | 8.8 | 2023-01-10 | Use after free in Overview Mode in Google Chrome on Chrome OS prior to 109.0.5414.74 allowed a remote attacker who convinced a user to engage in specific UI in… |
CVE-2023-0162 | Medium | 5.5 | 2023-01-10 | The CPO Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of its content type settings parameters in versions up to, and… |
CVE-2023-22911 | Medium | 6.1 | 2023-01-10 | An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. E-Widgets does widget replacement in HTML at… |
CVE-2023-22909 | Medium | 5.3 | 2023-01-10 | An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. SpecialMobileHistory allows remote attackers… |
CVE-2023-22903 | Critical | 9.8 | 2023-01-10 | api/views/user.py in LibrePhotos before e19e539 has incorrect access control. |
CVE-2023-22320 | High | 7.5 | 2023-01-10 | OpenAM Web Policy Agent (OpenAM Consortium Edition) provided by OpenAM Consortium parses URLs improperly, leading to a path traversal vulnerability(CWE-22). Fu… |
CVE-2023-0023 | Medium | 4.5 | 2023-01-10 | In SAP Bank Account Management (Manage Banks) application, when a user clicks a smart link to navigate to another app, personal data is shown directly in the U… |
CVE-2023-0022 | Critical | 9.9 | 2023-01-10 | SAP BusinessObjects Business Intelligence Analysis edition for OLAP allows an authenticated attacker to inject malicious code that can be executed by the appli… |
CVE-2023-0018 | Critical | 10.0 | 2023-01-10 | Due to improper input sanitization of user-controlled input in SAP BusinessObjects Business Intelligence Platform CMC application - versions 420, and 430, an a… |
CVE-2023-0017 | Critical | 9.4 | 2023-01-10 | An unauthenticated attacker in SAP NetWeaver AS for Java - version 7.50, due to improper access control, can attach to an open interface and make use of an ope… |
CVE-2023-0016 | Critical | 9.9 | 2023-01-10 | SAP BPC MS 10.0 - version 810, allows an unauthorized attacker to execute crafted database queries. The exploitation of this issue could lead to SQL injection… |
CVE-2023-0015 | Medium | 4.6 | 2023-01-10 | In SAP BusinessObjects Business Intelligence Platform (Web Intelligence user interface) - version 420, some calls return json with wrong content type in the he… |
CVE-2023-0014 | Critical | 9.0 | 2023-01-10 | SAP NetWeaver ABAP Server and ABAP Platform - versions SAP_BASIS 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, KERNEL 7.22, 7… |
CVE-2023-0013 | Medium | 6.1 | 2023-01-10 | The ABAP Keyword Documentation of SAP NetWeaver Application Server - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, for ABAP and ABAP Platform… |
CVE-2023-0012 | Medium | 6.4 | 2023-01-10 | In SAP Host Agent (Windows) - versions 7.21, 7.22, an attacker who gains local membership to SAP_LocalAdmin could be able to replace executables with a malicio… |
CVE-2023-22899 | Medium | 5.9 | 2023-01-10 | Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive. |
CVE-2023-22898 | Medium | 6.5 | 2023-01-10 | workers/extractor.py in Pandora (aka pandora-analysis/pandora) 1.3.0 allows a denial of service when an attacker submits a deeply nested ZIP archive (aka ZIP b… |
CVE-2023-22895 | High | 7.5 | 2023-01-10 | The bzip2 crate before 0.4.4 for Rust allow attackers to cause a denial of service via a large file that triggers an integer overflow in mem.rs. NOTE: this is… |
CVE-2023-0125 | Low | 2.4 | 2023-01-09 | A vulnerability was found in Control iD Gerencia Web 1.30. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of t… |
CVE-2023-22477 | Medium | 5.3 | 2023-01-09 | Mercurius is a GraphQL adapter for Fastify. Any users of Mercurius until version 10.5.0 are subjected to a denial of service attack by sending a malformed pack… |
CVE-2023-22473 | Low | 2.1 | 2023-01-09 | Talk-Android enables users to have video & audio calls through Nextcloud on Android. Due to passcode bypass, an attacker is able to access the user's Nextcloud… |
CVE-2023-22472 | Medium | 5.3 | 2023-01-09 | Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. It is possible to make a user… |
CVE-2023-0036 | Medium | 6.5 | 2023-01-09 | platform_callback_stub in misc subsystem within OpenHarmony-v3.0.5 and prior versions has an authentication bypass vulnerability which allows an "SA relay atta… |
CVE-2023-0035 | Medium | 6.5 | 2023-01-09 | softbus_client_stub in communication subsystem within OpenHarmony-v3.0.5 and prior versions has an authentication bypass vulnerability which allows an "SA rela… |
CVE-2023-0114 | Low | 3.3 | 2023-01-07 | A vulnerability was found in Netis Netcore Router. It has been rated as problematic. Affected by this issue is some unknown functionality of the file param.fil… |
CVE-2023-0113 | Medium | 5.3 | 2023-01-07 | A vulnerability was found in Netis Netcore Router up to 2.2.6. It has been declared as problematic. Affected by this vulnerability is an unknown functionality… |
CVE-2023-0112 | Medium | 5.4 | 2023-01-07 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0. |
CVE-2023-0111 | Medium | 5.4 | 2023-01-07 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0. |
CVE-2023-0110 | Medium | 5.4 | 2023-01-07 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0. |
CVE-2023-0108 | Medium | 5.4 | 2023-01-07 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0. |
CVE-2023-0107 | Medium | 5.4 | 2023-01-07 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0. |
CVE-2023-0106 | Medium | 5.4 | 2023-01-07 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0. |
CVE-2023-22475 | Medium | 6.3 | 2023-01-06 | Canarytokens is an open source tool which helps track activity and actions on your network. A Cross-Site Scripting vulnerability was identified in the history… |
CVE-2023-22671 | Critical | 9.8 | 2023-01-06 | Ghidra/RuntimeScripts/Linux/support/launch.sh in NSA Ghidra through 10.2.2 passes user-provided input into eval, leading to command injection when calling anal… |
CVE-2023-22455 | Medium | 6.8 | 2023-01-05 | Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` bra… |
CVE-2023-22454 | High | 8.0 | 2023-01-05 | Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` bra… |
CVE-2023-22453 | Medium | 5.3 | 2023-01-05 | Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` bra… |
CVE-2023-0088 | High | 8.8 | 2023-01-05 | The Swifty Page Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.1. This is due to missing or inc… |
CVE-2023-0087 | Medium | 5.5 | 2023-01-05 | The Swifty Page Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘spm_plugin_options_page_tree_max_width’ parameter in version… |
CVE-2023-0086 | Medium | 5.4 | 2023-01-05 | The JetWidgets for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.12. This is due to missing… |
CVE-2023-0077 | Medium | 6.5 | 2023-01-05 | Integer overflow or wraparound vulnerability in CGI component in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows remote attackers to… |
CVE-2023-22626 | High | 7.5 | 2023-01-05 | PgHero before 3.1.0 allows Information Disclosure via EXPLAIN because query results may be present in an error message. (Depending on database user privileges… |
CVE-2023-22622 | Medium | 5.3 | 2023-01-05 | WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes… |
CVE-2023-0057 | Medium | 6.1 | 2023-01-05 | Improper Restriction of Rendered UI Layers or Frames in GitHub repository pyload/pyload prior to 0.5.0b3.dev33. |
CVE-2023-22467 | High | 7.5 | 2023-01-04 | Luxon is a library for working with dates and times in JavaScript. On the 1.x branch prior to 1.38.1, the 2.x branch prior to 2.5.2, and the 3.x branch on 3.2… |
CVE-2023-22466 | Medium | 5.4 | 2023-01-04 | Tokio is a runtime for writing applications with Rust. Starting with version 1.7.0 and prior to versions 1.18.4, 1.20.3, and 1.23.1, when configuring a Windows… |
CVE-2023-0055 | Medium | 5.3 | 2023-01-04 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository pyload/pyload prior to 0.5.0b3.dev32. |
CVE-2023-0054 | High | 7.8 | 2023-01-04 | Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145. |
CVE-2023-0051 | High | 7.8 | 2023-01-04 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. |
CVE-2023-22465 | High | 7.5 | 2023-01-04 | Http4s is a Scala interface for HTTP services. Starting with version 0.1.0 and prior to versions 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38, the `User-Agent` and… |
CVE-2023-22464 | Medium | 5.4 | 2023-01-04 | ViewVC is a browser interface for CVS and Subversion version control repositories. Versions prior to 1.2.3 and 1.1.30 are vulnerable to cross-site scripting. T… |
CVE-2023-22463 | Critical | 9.8 | 2023-01-04 | KubePi is a k8s panel. The jwt authentication function of KubePi through version 1.6.2 uses hard-coded Jwtsigkeys, resulting in the same Jwtsigkeys for all onl… |
CVE-2023-0049 | High | 7.8 | 2023-01-04 | Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. |
CVE-2023-22461 | High | 7.6 | 2023-01-04 | The `sanitize-svg` package, a small SVG sanitizer to prevent cross-site scripting attacks, uses a deny-list-pattern to sanitize SVGs to prevent XSS. In doing s… |
CVE-2023-22460 | High | 7.5 | 2023-01-04 | go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JS… |
CVE-2023-22457 | Critical | 9.0 | 2023-01-04 | CKEditor Integration UI adds support for editing wiki pages using CKEditor. Prior to versions 1.64.3,t he `CKEditor.HTMLConverter` document lacked a protection… |
CVE-2023-0048 | High | 8.8 | 2023-01-04 | Code Injection in GitHub repository lirantal/daloradius prior to master-branch. |
CVE-2023-0046 | High | 7.2 | 2023-01-04 | Improper Restriction of Names for Files and Other Resources in GitHub repository lirantal/daloradius prior to master-branch. |
CVE-2023-22456 | Medium | 6.1 | 2023-01-03 | ViewVC, a browser interface for CVS and Subversion version control repositories, as a cross-site scripting vulnerability that affects versions prior to 1.2.2 a… |
CVE-2023-0038 | High | 7.2 | 2023-01-03 | The "Survey Maker – Best WordPress Survey Plugin" plugin for WordPress is vulnerable to Stored Cross-Site Scripting via survey answers in versions up to, and i… |
CVE-2023-22452 | Medium | 6.5 | 2023-01-02 | kenny2automate is a Discord bot. In the web interface for server settings, form elements were generated with Discord channel IDs as part of input names. Prior… |
CVE-2023-22451 | Medium | 6.5 | 2023-01-02 | Kiwi TCMS is an open source test management system. In version 11.6 and prior, when users register new accounts and/or change passwords, there is no validation… |
CVE-2023-22551 | High | 7.5 | 2023-01-01 | The FTP (aka "Implementation of a simple FTP client and server") project through 96c1a35 allows remote attackers to cause a denial of service (memory consumpti… |