2023 CVEs (page 35)
Page 35 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-45845 | Medium | 4.4 | 2024-05-16 | Improper conditions check for some Intel(R) Wireless Bluetooth(R) products for Windows before version 23.20 may allow a privileged user to potentially enable d… |
CVE-2023-45745 | High | 7.9 | 2024-05-16 | Improper input validation in some Intel(R) TDX module software before version 1.5.05.46.698 may allow a privileged user to potentially enable escalation of pri… |
CVE-2023-45743 | Medium | 6.7 | 2024-05-16 | Uncontrolled search path in some Intel(R) DSA software uninstallers before version 23.4.39.10 may allow an authenticated user to potentially enable escalation… |
CVE-2023-45736 | Medium | 6.7 | 2024-05-16 | Insecure inherited permissions in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable escalation of p… |
CVE-2023-45733 | Low | 2.8 | 2024-05-16 | Hardware logic contains race conditions in some Intel(R) Processors may allow an authenticated user to potentially enable partial information disclosure via lo… |
CVE-2023-45320 | Medium | 6.7 | 2024-05-16 | Uncontrolled search path element in some Intel(R) VTune(TM) Profiler software before version 2024.0 may allow an authenticated user to potentially enable escal… |
CVE-2023-45315 | Medium | 5.5 | 2024-05-16 | Improper initialization in some Intel(R) Power Gadget software for Windwos all versions may allow an authenticated user to potentially enable denial of service… |
CVE-2023-45221 | Medium | 4.8 | 2024-05-16 | Improper buffer restrictions in Intel(R) Media SDK all versions may allow an authenticated user to potentially enable escalation of privilege via local access. |
CVE-2023-45217 | High | 8.8 | 2024-05-16 | Improper access control in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable escalation of privileg… |
CVE-2023-43751 | Medium | 6.7 | 2024-05-16 | Uncontrolled search path in Intel(R) Graphics Command Center Service bundled in some Intel(R) Graphics Windows DCH driver software before versions 31.0.101.379… |
CVE-2023-43748 | High | 7.8 | 2024-05-16 | Improper access control in some Intel(R) GPA Framework software installers before version 2023.3 may allow an authenticated user to potentially enable escalati… |
CVE-2023-43745 | Low | 2.8 | 2024-05-16 | Improper input validation in some Intel(R) CBI software before version 1.1.0 may allow an authenticated user to potentially enable denial of service via local… |
CVE-2023-43629 | High | 7.8 | 2024-05-16 | Incorrect default permissions in some Intel(R) GPA software installers before version 2023.3 may allow an authenticated user to potentially enable escalation o… |
CVE-2023-43487 | Medium | 4.7 | 2024-05-16 | Improper access control in some Intel(R) CST before version 2.1.10300 may allow an authenticated user to potentially enable denial of service via local access. |
CVE-2023-42773 | High | 8.8 | 2024-05-16 | Improper neutralization in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable escalation of privileg… |
CVE-2023-42668 | Medium | 6.7 | 2024-05-16 | Incorrect default permissions in some onboard video driver software before version 1.14 for Intel(R) Server Boards based on Intel(R) 62X Chipset may allow an a… |
CVE-2023-42433 | Medium | 6.7 | 2024-05-16 | Incorrect default permissions in some Endurance Gaming Mode software installers before version 1.3.937.0 may allow an authenticated user to potentially enable… |
CVE-2023-41961 | Medium | 6.7 | 2024-05-16 | Uncontrolled search path in some Intel(R) GPA software before version 2023.3 may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2023-41234 | Medium | 5.0 | 2024-05-16 | NULL pointer dereference in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable denial of service via… |
CVE-2023-41092 | High | 7.6 | 2024-05-16 | Unchecked return value in SDM firmware for Intel(R) Stratix 10 and Intel(R) Agilex 7 FPGAs before version 23.3 may allow an authenticated user to potentially e… |
CVE-2023-41082 | Medium | 4.4 | 2024-05-16 | Null pointer dereference for some Intel(R) CST software before version 2.1.10300 may allow an authenticated user to potentially enable denial of service via lo… |
CVE-2023-40536 | Medium | 4.3 | 2024-05-16 | Race condition for some some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.20 may allow an unauthenticated user to potentially enable de… |
CVE-2023-40155 | Medium | 6.7 | 2024-05-16 | Uncontrolled search path for some Intel(R) CST software before version 2.1.10300 may allow an authenticated user to potentially enable escalation of privilege… |
CVE-2023-40071 | High | 7.3 | 2024-05-16 | Improper access control in some Intel(R) GPA software installers before version 2023.3 may allow an authenticated user to potentially enable escalation of priv… |
CVE-2023-40070 | High | 8.8 | 2024-05-16 | Improper access control in some Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable escalation of privi… |
CVE-2023-39929 | Medium | 6.7 | 2024-05-16 | Uncontrolled search path in some Libva software maintained by Intel(R) before version 2.20.0 may allow an authenticated user to potentially enable escalation o… |
CVE-2023-39433 | Medium | 4.4 | 2024-05-16 | Improper access control for some Intel(R) CST software before version 2.1.10300 may allow an authenticated user to potentially enable escalation of privilege v… |
CVE-2023-38654 | High | 8.2 | 2024-05-16 | Improper input validation for some some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.20 may allow an unauthenticated user to potentiall… |
CVE-2023-38581 | High | 8.8 | 2024-05-16 | Buffer overflow in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable escalation of privilege via lo… |
CVE-2023-38420 | Low | 3.8 | 2024-05-16 | Improper conditions check in Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable information disclosure… |
CVE-2023-38417 | Medium | 4.3 | 2024-05-16 | Improper input validation for some Intel(R) PROSet/Wireless WiFi software before version 23.20 may allow an unauthenticated user to potentially enable denial o… |
CVE-2023-35192 | Medium | 6.7 | 2024-05-16 | Uncontrolled search path in some Intel(R) GPA Framework software before version 2023.3 may allow an authenticated user to potentially enable escalation of priv… |
CVE-2023-28402 | High | 7.2 | 2024-05-16 | Improper input validation in some Intel(R) BIOS Guard firmware may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2023-28383 | Medium | 6.1 | 2024-05-16 | Improper conditions check in some Intel(R) BIOS PPAM firmware may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2023-27504 | High | 7.2 | 2024-05-16 | Improper conditions check in some Intel(R) BIOS Guard firmware may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2023-24460 | High | 8.2 | 2024-05-16 | Incorrect default permissions in some Intel(R) GPA software installers before version 2023.3 may allow an authenticated user to potentially enable escalation o… |
CVE-2023-22662 | Medium | 5.8 | 2024-05-16 | Improper input validation of EpsdSrMgmtConfig in UEFI firmware for some Intel(R) Server Board S2600BP products may allow a privileged user to potentially enabl… |
CVE-2023-22656 | Low | 3.9 | 2024-05-16 | Out-of-bounds read in Intel(R) Media SDK and some Intel(R) oneVPL software before version 23.3.5 may allow an authenticated user to potentially enable escalati… |
CVE-2023-47717 | Medium | 4.4 | 2024-05-16 | IBM Security Guardium 12.0 could allow a privileged user to perform unauthorized actions that could lead to a denial of service. IBM X-Force ID: 271690. |
CVE-2023-48643 | Critical | 9.8 | 2024-05-16 | Shrubbery tac_plus 2.x, 3.x. and 4.x through F4.0.4.28 allows unauthenticated Remote Command Execution. The product allows users to configure authorization che… |
CVE-2023-46842 | Medium | 6.5 | 2024-05-16 | Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and other modes. This in particular means that they may set registers used to pass 32-bit… |
CVE-2023-40297 | High | 7.5 | 2024-05-15 | Stakater Forecastle 1.0.139 and before allows %5C../ directory traversal in the website component. |
CVE-2023-7258 | Medium | 4.8 | 2024-05-15 | A denial of service exists in Gvisor Sandbox where a bug in reference counting code in mount point tracking could lead to a panic, making it possible for an at… |
CVE-2023-5938 | High | 8.0 | 2024-05-15 | Multiple functions use archives without properly validating the filenames therein, rendering the application vulnerable to path traversal via 'zip slip' attack… |
CVE-2023-5937 | Low | 3.8 | 2024-05-15 | On Windows systems, the Arc configuration files resulted to be world-readable. This can lead to information disclosure by local attackers, via exfiltration… |
CVE-2023-5936 | High | 7.8 | 2024-05-15 | On Unix systems (Linux, MacOS), Arc uses a temporary file with unsafe privileges. By tampering with such file, a malicious local user in the system may be a… |
CVE-2023-5935 | High | 7.4 | 2024-05-15 | When configuring Arc (e.g. during the first setup), a local web interface is provided to ease the configuration process. Such web interface lacks authenticatio… |
CVE-2023-6324 | High | 8.1 | 2024-05-15 | ThroughTek Kalay SDK uses a predictable PSK value in the DTLS session when encountering an unexpected PSK identity |
CVE-2023-6323 | Medium | 4.3 | 2024-05-15 | ThroughTek Kalay SDK does not verify the authenticity of received messages, allowing an attacker to impersonate an authoritative server. |
CVE-2023-6322 | High | 7.2 | 2024-05-15 | A stack-based buffer overflow vulnerability exists in the message parsing functionality of the Roku Indoor Camera SE version 3.0.2.4679 and Wyze Cam v3 version… |
CVE-2023-6321 | High | 7.2 | 2024-05-15 | A command injection vulnerability exists in the IOCTL that manages OTA updates. A specially crafted command can lead to command execution as the root user. An… |
CVE-2023-33327 | High | 8.8 | 2024-05-14 | Improper Privilege Management vulnerability in Teplitsa of social technologies Leyka allows Privilege Escalation.This issue affects Leyka: from n/a through 3.3… |
CVE-2023-50180 | Medium | 5.5 | 2024-05-14 | An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiADC version 7.4.1 and below, version 7.2.3 and be… |
CVE-2023-46714 | High | 7.2 | 2024-05-14 | A stack-based buffer overflow [CWE-121] vulnerability in Fortinet FortiOS version 7.2.1 through 7.2.6 and version 7.4.0 through 7.4.1 allows a privileged attac… |
CVE-2023-45586 | Medium | 5.0 | 2024-05-14 | An insufficient verification of data authenticity vulnerability [CWE-345] in Fortinet FortiOS SSL-VPN tunnel mode version 7.4.0 through 7.4.1, version 7.2.0 th… |
CVE-2023-45583 | Medium | 6.7 | 2024-05-14 | A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, FortiOS 6.4 all ve… |
CVE-2023-44247 | Medium | 6.6 | 2024-05-14 | A double free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 6.4 all versions may allow a privileged attacker to execute code or commands via crafte… |
CVE-2023-40720 | High | 7.1 | 2024-05-14 | An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiVoiceEntreprise version 7.0.0 through 7.0.1 and before 6.4.8 allows an auth… |
CVE-2023-36640 | Medium | 6.7 | 2024-05-14 | A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, FortiOS 6.4 all ve… |
CVE-2023-24204 | Medium | 5.4 | 2024-05-14 | SQL injection vulnerability in SourceCodester Simple Customer Relationship Management System v1.0 allows attacker to execute arbitrary code via the name parame… |
CVE-2023-24203 | Medium | 5.4 | 2024-05-14 | Cross Site Scripting vulnerability in SourceCodester Simple Customer Relationship Management System v1.0 allows attacker to execute arbitary code via the compa… |
CVE-2023-6812 | Medium | 4.3 | 2024-05-14 | The WP Compress – Image Optimizer [All-In-One plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 6.20.01. This is due to… |
CVE-2023-46280 | Medium | 6.5 | 2024-05-14 | A vulnerability has been identified in Security Configuration Tool (SCT) (All versions), SIMATIC Automation Tool (All versions < V5.0 SP2), SIMATIC BATCH V9.1… |
CVE-2023-35841 | High | 7.8 | 2024-05-14 | Exposed IOCTL with Insufficient Access Control in Phoenix WinFlash Driver on Windows allows Privilege Escalation which allows for modification of system firmwa… |
CVE-2023-6688 | Medium | 6.5 | 2024-05-14 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.11 prior to 16.11.2. A problem with the processing logic for Google Chat M… |
CVE-2023-6682 | Medium | 6.5 | 2024-05-14 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from… |
CVE-2023-6327 | Medium | 5.3 | 2024-05-14 | The ShopLentor (formerly WooLentor) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the purchased_new_pr… |
CVE-2023-5971 | Medium | 4.8 | 2024-05-14 | The Save as PDF Plugin by Pdfcrowd WordPress plugin before 3.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such… |
CVE-2023-5447 | Medium | 5.5 | 2024-05-14 | Missing lock check in SynHsaService may create a use-after-free condition which causes abnormal termination of the service, resulting in denial of service for… |
CVE-2023-5052 | Medium | 6.3 | 2024-05-14 | vulnerability in Uniform Server Zero, version 10.2.5, consisting of an XSS through the /us_extra/phpinfo.php page. This vulnerability could allow a remote user… |
CVE-2023-52721 | Medium | 6.2 | 2024-05-14 | The WindowManager module has a vulnerability in permission control. Impact: Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2023-52720 | Medium | 4.1 | 2024-05-14 | Race condition vulnerability in the soundtrigger module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52719 | High | 7.1 | 2024-05-14 | Privilege escalation vulnerability in the PMS module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-52656 | High | 7.8 | 2024-05-14 | In the Linux kernel, the following vulnerability has been resolved: io_uring: drop any code related to SCM_RIGHTS This is dead code after we dropped support… |
CVE-2023-52655 | Medium | 5.5 | 2024-05-14 | In the Linux kernel, the following vulnerability has been resolved: usb: aqc111: check packet for fixup for true limit If a device sends a packet that is inb… |
CVE-2023-52654 | High | 7.8 | 2024-05-14 | In the Linux kernel, the following vulnerability has been resolved: io_uring/af_unix: disable sending io_uring over sockets File reference cycles have caused… |
CVE-2023-52384 | Medium | 4.7 | 2024-05-14 | Double-free vulnerability in the RSMC module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52383 | Medium | 4.7 | 2024-05-14 | Double-free vulnerability in the RSMC module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2023-50718 | Medium | 6.5 | 2024-05-14 | NocoDB is software for building databases as spreadsheets. Prior to version 0.202.10, an authenticated attacker with create access could conduct a SQL Injectio… |
CVE-2023-50717 | Medium | 5.7 | 2024-05-14 | NocoDB is software for building databases as spreadsheets. Starting in verson 0.202.6 and prior to version 0.202.10, an attacker can upload a html file with ma… |
CVE-2023-49781 | High | 7.3 | 2024-05-14 | NocoDB is software for building databases as spreadsheets. Prior to 0.202.9, a stored cross-site scripting vulnerability exists within the Formula virtual cell… |
CVE-2023-47712 | High | 7.8 | 2024-05-14 | IBM Security Guardium 11.3, 11.4, 11.5, and 12.0 could allow a local user to gain elevated privileges on the system due to improper permissions control. IBM X… |
CVE-2023-47711 | Low | 2.7 | 2024-05-14 | IBM Security Guardium 11.3, 11.4, 11.5, and 12.0 could allow an authenticated user to upload files that would cause a denial of service. IBM X-Force ID: 2715… |
CVE-2023-47709 | Critical | 9.1 | 2024-05-14 | IBM Security Guardium 11.3, 11.4, 11.5, and 12.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially… |
CVE-2023-46870 | High | 7.3 | 2024-05-14 | extcap/nrf_sniffer_ble.py, extcap/nrf_sniffer_ble.sh, extcap/SnifferAPI/*.py in Nordic Semiconductor nRF Sniffer for Bluetooth LE 3.0.0, 3.1.0, 4.0.0, 4.1.0, a… |
CVE-2023-43040 | Medium | 6.5 | 2024-05-14 | IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access. IBM X-Force… |
CVE-2023-42955 | Medium | 4.9 | 2024-05-14 | Claris International has successfully resolved an issue of potentially exposing password information to front-end websites when signed in to the Admin Console… |
CVE-2023-38264 | Medium | 5.9 | 2024-05-14 | The IBM SDK, Java Technology Edition's Object Request Broker (ORB) 7.1.0.0 through 7.1.5.21 and 8.0.0.0 through 8.0.8.21 is vulnerable to a denial of service a… |
CVE-2023-37526 | Medium | 6.5 | 2024-05-14 | HCL DRYiCE Lucy (now AEX) is affected by a Cross Origin Resource Sharing (CORS) vulnerability. The mobile app is vulnerable to a CORS misconfiguration which co… |
CVE-2023-29881 | Medium | 6.5 | 2024-05-14 | phpok 6.4.003 is vulnerable to SQL injection in the function index_f() in phpok64/framework/api/call_control.php. |
CVE-2023-26566 | High | 8.6 | 2024-05-14 | Sangoma FreePBX 1805 through 2203 on Linux contains hardcoded credentials for the Asterisk REST Interface (ARI), which allows remote attackers to reconfigure A… |
CVE-2023-41651 | Medium | 6.5 | 2024-05-08 | Missing Authorization vulnerability in Multi-column Tag Map.This issue affects Multi-column Tag Map: from n/a through 17.0.26. |
CVE-2023-40490 | High | 7.8 | 2024-05-07 | Maxon Cinema 4D SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on af… |
CVE-2023-37325 | Medium | 5.4 | 2024-05-07 | D-Link DAP-2622 DDP Set SSID List Missing Authentication Vulnerability. This vulnerability allows network-adjacent attackers to make unauthorized changes to de… |
CVE-2023-35757 | High | 8.8 | 2024-05-07 | D-Link DAP-2622 DDP Set Date-Time NTP Server Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attack… |
CVE-2023-35749 | High | 8.8 | 2024-05-07 | D-Link DAP-2622 DDP Firmware Upgrade Filename Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attac… |
CVE-2023-35748 | High | 8.8 | 2024-05-07 | D-Link DAP-2622 DDP Firmware Upgrade Server IPv6 Address Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adj… |
CVE-2023-27321 | High | 7.5 | 2024-05-07 | OPC Foundation UA .NET Standard ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a de… |
CVE-2023-40694 | Medium | 6.2 | 2024-05-07 | IBM Watson CP4D Data Stores 4.0.0 through 4.8.4 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 264… |
CVE-2023-42757 | Medium | 4.2 | 2024-05-07 | Process Explorer before 17.04 allows attackers to make it functionally unavailable (a denial of service for analysis) by renaming an executable file to a new e… |