2023 CVEs (page 35)
Page 35 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-50180 | Medium | 5.5 | 2024-05-14 | An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiADC version 7.4.1 and below, version 7.2.3 and be… |
CVE-2023-46714 | High | 7.2 | 2024-05-14 | A stack-based buffer overflow [CWE-121] vulnerability in Fortinet FortiOS version 7.2.1 through 7.2.6 and version 7.4.0 through 7.4.1 allows a privileged attac… |
CVE-2023-45586 | Medium | 5.0 | 2024-05-14 | An insufficient verification of data authenticity vulnerability [CWE-345] in Fortinet FortiOS SSL-VPN tunnel mode version 7.4.0 through 7.4.1, version 7.2.0 th… |
CVE-2023-45583 | Medium | 6.7 | 2024-05-14 | A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, FortiOS 6.4 all ve… |
CVE-2023-44247 | Medium | 6.6 | 2024-05-14 | A double free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 6.4 all versions may allow a privileged attacker to execute code or commands via crafte… |
CVE-2023-40720 | High | 7.1 | 2024-05-14 | An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiVoiceEntreprise version 7.0.0 through 7.0.1 and before 6.4.8 allows an auth… |
CVE-2023-36640 | Medium | 6.7 | 2024-05-14 | A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, FortiOS 6.4 all ve… |
CVE-2023-24204 | Medium | 5.4 | 2024-05-14 | SQL injection vulnerability in SourceCodester Simple Customer Relationship Management System v1.0 allows attacker to execute arbitrary code via the name parame… |
CVE-2023-24203 | Medium | 5.4 | 2024-05-14 | Cross Site Scripting vulnerability in SourceCodester Simple Customer Relationship Management System v1.0 allows attacker to execute arbitary code via the compa… |
CVE-2023-6812 | Medium | 4.3 | 2024-05-14 | The WP Compress – Image Optimizer [All-In-One plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 6.20.01. This is due to… |
CVE-2023-46280 | Medium | 6.5 | 2024-05-14 | A vulnerability has been identified in Security Configuration Tool (SCT) (All versions), SIMATIC Automation Tool (All versions < V5.0 SP2), SIMATIC BATCH V9.1… |
CVE-2023-35841 | High | 7.8 | 2024-05-14 | Exposed IOCTL with Insufficient Access Control in Phoenix WinFlash Driver on Windows allows Privilege Escalation which allows for modification of system firmwa… |
CVE-2023-6688 | Medium | 6.5 | 2024-05-14 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.11 prior to 16.11.2. A problem with the processing logic for Google Chat M… |
CVE-2023-6682 | Medium | 6.5 | 2024-05-14 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from… |
CVE-2023-6327 | Medium | 5.3 | 2024-05-14 | The ShopLentor (formerly WooLentor) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the purchased_new_pr… |
CVE-2023-5971 | Medium | 4.8 | 2024-05-14 | The Save as PDF Plugin by Pdfcrowd WordPress plugin before 3.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such… |
CVE-2023-5447 | Medium | 5.5 | 2024-05-14 | Missing lock check in SynHsaService may create a use-after-free condition which causes abnormal termination of the service, resulting in denial of service for… |
CVE-2023-5052 | Medium | 6.3 | 2024-05-14 | vulnerability in Uniform Server Zero, version 10.2.5, consisting of an XSS through the /us_extra/phpinfo.php page. This vulnerability could allow a remote user… |
CVE-2023-52721 | Medium | 6.2 | 2024-05-14 | The WindowManager module has a vulnerability in permission control. Impact: Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2023-52720 | Medium | 4.1 | 2024-05-14 | Race condition vulnerability in the soundtrigger module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52719 | High | 7.1 | 2024-05-14 | Privilege escalation vulnerability in the PMS module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-52656 | High | 7.8 | 2024-05-14 | In the Linux kernel, the following vulnerability has been resolved: io_uring: drop any code related to SCM_RIGHTS This is dead code after we dropped support… |
CVE-2023-52655 | Medium | 5.5 | 2024-05-14 | In the Linux kernel, the following vulnerability has been resolved: usb: aqc111: check packet for fixup for true limit If a device sends a packet that is inb… |
CVE-2023-52654 | High | 7.8 | 2024-05-14 | In the Linux kernel, the following vulnerability has been resolved: io_uring/af_unix: disable sending io_uring over sockets File reference cycles have caused… |
CVE-2023-52384 | Medium | 4.7 | 2024-05-14 | Double-free vulnerability in the RSMC module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52383 | Medium | 4.7 | 2024-05-14 | Double-free vulnerability in the RSMC module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2023-50718 | Medium | 6.5 | 2024-05-14 | NocoDB is software for building databases as spreadsheets. Prior to version 0.202.10, an authenticated attacker with create access could conduct a SQL Injectio… |
CVE-2023-50717 | Medium | 5.7 | 2024-05-14 | NocoDB is software for building databases as spreadsheets. Starting in verson 0.202.6 and prior to version 0.202.10, an attacker can upload a html file with ma… |
CVE-2023-49781 | High | 7.3 | 2024-05-14 | NocoDB is software for building databases as spreadsheets. Prior to 0.202.9, a stored cross-site scripting vulnerability exists within the Formula virtual cell… |
CVE-2023-47712 | High | 7.8 | 2024-05-14 | IBM Security Guardium 11.3, 11.4, 11.5, and 12.0 could allow a local user to gain elevated privileges on the system due to improper permissions control. IBM X… |
CVE-2023-47711 | Low | 2.7 | 2024-05-14 | IBM Security Guardium 11.3, 11.4, 11.5, and 12.0 could allow an authenticated user to upload files that would cause a denial of service. IBM X-Force ID: 2715… |
CVE-2023-47709 | Critical | 9.1 | 2024-05-14 | IBM Security Guardium 11.3, 11.4, 11.5, and 12.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially… |
CVE-2023-46870 | High | 7.3 | 2024-05-14 | extcap/nrf_sniffer_ble.py, extcap/nrf_sniffer_ble.sh, extcap/SnifferAPI/*.py in Nordic Semiconductor nRF Sniffer for Bluetooth LE 3.0.0, 3.1.0, 4.0.0, 4.1.0, a… |
CVE-2023-43040 | Medium | 6.5 | 2024-05-14 | IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access. IBM X-Force… |
CVE-2023-42955 | Medium | 4.9 | 2024-05-14 | Claris International has successfully resolved an issue of potentially exposing password information to front-end websites when signed in to the Admin Console… |
CVE-2023-38264 | Medium | 5.9 | 2024-05-14 | The IBM SDK, Java Technology Edition's Object Request Broker (ORB) 7.1.0.0 through 7.1.5.21 and 8.0.0.0 through 8.0.8.21 is vulnerable to a denial of service a… |
CVE-2023-37526 | Medium | 6.5 | 2024-05-14 | HCL DRYiCE Lucy (now AEX) is affected by a Cross Origin Resource Sharing (CORS) vulnerability. The mobile app is vulnerable to a CORS misconfiguration which co… |
CVE-2023-29881 | Medium | 6.5 | 2024-05-14 | phpok 6.4.003 is vulnerable to SQL injection in the function index_f() in phpok64/framework/api/call_control.php. |
CVE-2023-26566 | High | 8.6 | 2024-05-14 | Sangoma FreePBX 1805 through 2203 on Linux contains hardcoded credentials for the Asterisk REST Interface (ARI), which allows remote attackers to reconfigure A… |
CVE-2023-41651 | Medium | 6.5 | 2024-05-08 | Missing Authorization vulnerability in Multi-column Tag Map.This issue affects Multi-column Tag Map: from n/a through 17.0.26. |
CVE-2023-40490 | High | 7.8 | 2024-05-07 | Maxon Cinema 4D SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on af… |
CVE-2023-37325 | Medium | 5.4 | 2024-05-07 | D-Link DAP-2622 DDP Set SSID List Missing Authentication Vulnerability. This vulnerability allows network-adjacent attackers to make unauthorized changes to de… |
CVE-2023-35757 | High | 8.8 | 2024-05-07 | D-Link DAP-2622 DDP Set Date-Time NTP Server Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attack… |
CVE-2023-35749 | High | 8.8 | 2024-05-07 | D-Link DAP-2622 DDP Firmware Upgrade Filename Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attac… |
CVE-2023-35748 | High | 8.8 | 2024-05-07 | D-Link DAP-2622 DDP Firmware Upgrade Server IPv6 Address Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adj… |
CVE-2023-27321 | High | 7.5 | 2024-05-07 | OPC Foundation UA .NET Standard ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a de… |
CVE-2023-40694 | Medium | 6.2 | 2024-05-07 | IBM Watson CP4D Data Stores 4.0.0 through 4.8.4 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 264… |
CVE-2023-42757 | Medium | 4.2 | 2024-05-07 | Process Explorer before 17.04 allows attackers to make it functionally unavailable (a denial of service for analysis) by renaming an executable file to a new e… |
CVE-2023-46012 | Critical | 9.8 | 2024-05-07 | Buffer Overflow vulnerability LINKSYS EA7500 3.0.1.207964 allows a remote attacker to execute arbitrary code via an HTTP request to the IGD UPnP. |
CVE-2023-7240 | Medium | 5.8 | 2024-05-07 | An improper authorization level has been detected in the login panel. It may lead to unauthenticated Server Side Request Forgery and allows to perform open se… |
CVE-2023-31234 | Medium | 6.3 | 2024-05-07 | Missing Authorization vulnerability in Tilda Publishing.This issue affects Tilda Publishing: from n/a through 0.3.23. |
CVE-2023-6810 | Medium | 4.3 | 2024-05-07 | The ClickCease Click Fraud Protection plugin for WordPress is vulnerable to unauthorized access of data due to an improper capability check on the get_settings… |
CVE-2023-33548 | Medium | 6.8 | 2024-05-06 | Cross Site Scripting (XSS) vulnerability in ASUS RT-AC51U with firmware versions up to and including 3.0.0.4.380.8591 allows attackers to run arbitrary code vi… |
CVE-2023-43531 | High | 8.4 | 2024-05-06 | Memory corruption while verifying the serialized header when the key pairs are generated. |
CVE-2023-43530 | Medium | 5.9 | 2024-05-06 | Memory corruption in HLOS while checking for the storage type. |
CVE-2023-43529 | High | 7.5 | 2024-05-06 | Transient DOS while processing IKEv2 Informational request messages, when a malformed fragment packet is received. |
CVE-2023-43528 | Medium | 6.1 | 2024-05-06 | Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size. |
CVE-2023-43527 | Medium | 6.8 | 2024-05-06 | Information disclosure while parsing dts header atom in Video. |
CVE-2023-43526 | Medium | 6.7 | 2024-05-06 | Memory corruption while querying module parameters from Listen Sound model client in kernel from user space. |
CVE-2023-43525 | Medium | 6.7 | 2024-05-06 | Memory corruption while copying the sound model data from user to kernel buffer during sound model register. |
CVE-2023-43524 | Medium | 6.7 | 2024-05-06 | Memory corruption when the bandpass filter order received from AHAL is not within the expected range. |
CVE-2023-43521 | Medium | 6.7 | 2024-05-06 | Memory corruption when multiple listeners are being registered with the same file descriptor. |
CVE-2023-33119 | High | 8.4 | 2024-05-06 | Memory corruption while loading a VM from a signed VM image that is not coherent in the processor cache. |
CVE-2023-49676 | Medium | 5.5 | 2024-05-06 | An unauthenticated local attacker may trick a user to open corrupted project files to crash the system due to use after free vulnerability. |
CVE-2023-49675 | High | 7.8 | 2024-05-06 | An unauthenticated local attacker may trick a user to open corrupted project files to execute arbitrary code or crash the system due to an out-of-bounds write… |
CVE-2023-6854 | Medium | 6.4 | 2024-05-06 | The Breakdance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom postmeta output in all versions up to, and including… |
CVE-2023-32873 | Medium | 6.7 | 2024-05-06 | In keyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution pr… |
CVE-2023-32871 | Medium | 5.3 | 2024-05-06 | In DA, there is a possible permission bypass due to an incorrect status check. This could lead to local escalation of privilege with no additional execution pr… |
CVE-2023-52729 | High | 7.5 | 2024-05-04 | TCPServer.cpp in SimpleNetwork through 29bc615 has an off-by-one error that causes a buffer overflow when trying to add '\0' to the end of long msg data. It ca… |
CVE-2023-27283 | Medium | 5.3 | 2024-05-04 | IBM Aspera Orchestrator 4.0.1 could allow a remote attacker to enumerate usernames due to observable response discrepancies. IBM X-Force ID: 248545. |
CVE-2023-7065 | Medium | 5.4 | 2024-05-04 | The Stop Spammers Security | Block Spam Users, Comments, Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and incl… |
CVE-2023-40695 | Medium | 6.3 | 2024-05-03 | IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user o… |
CVE-2023-40696 | Medium | 5.9 | 2024-05-03 | IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive in… |
CVE-2023-38724 | Medium | 6.3 | 2024-05-03 | IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could all… |
CVE-2023-28952 | Medium | 5.3 | 2024-05-03 | IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 is vulnerable to injection attacks in application logging by not sanitizing user provided data. IBM X-Force I… |
CVE-2023-23474 | Low | 3.7 | 2024-05-03 | IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser… |
CVE-2023-37407 | High | 8.8 | 2024-05-03 | IBM Aspera Orchestrator 4.0.1 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request… |
CVE-2023-6363 | Medium | 5.1 | 2024-05-03 | Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to mak… |
CVE-2023-41830 | Medium | 6.5 | 2024-05-03 | An improper absolute path traversal vulnerability was reported for the Ready For application allowing a local application access to files without authorizatio… |
CVE-2023-41828 | Medium | 4.4 | 2024-05-03 | An implicit intent export vulnerability was reported in the Motorola Phone application, that could allow unauthorized access to a non-exported content provide… |
CVE-2023-41826 | Medium | 5.1 | 2024-05-03 | A PendingIntent hijacking vulnerability in Motorola Device Help (Genie) application that could allow local attackers to access files or interact with non-expor… |
CVE-2023-41825 | Low | 2.8 | 2024-05-03 | A path traversal vulnerability was reported in the Motorola Ready For application that could allow a local attacker to access local files. |
CVE-2023-41824 | Low | 2.8 | 2024-05-03 | An implicit intent vulnerability was reported in the Motorola Phone Calls application that could allow a local attacker to read the calling phone number and c… |
CVE-2023-41823 | Medium | 4.4 | 2024-05-03 | An improper export vulnerability was reported in the Motorola Phone Extension application, that could allow a local attacker to execute unauthorized Activitie… |
CVE-2023-41822 | Medium | 4.8 | 2024-05-03 | An improper export vulnerability was reported in the Motorola Interface Test Tool application that could allow a malicious local application to execute OS com… |
CVE-2023-41821 | Medium | 5.0 | 2024-05-03 | A an improper export vulnerability was reported in the Motorola Setup application that could allow a local attacker to read sensitive user information. |
CVE-2023-41820 | Medium | 5.0 | 2024-05-03 | An implicit intent vulnerability was reported in the Motorola Ready For application that could allow a local attacker to read information about connected Blue… |
CVE-2023-41819 | Medium | 6.1 | 2024-05-03 | A PendingIntent hijacking vulnerability was reported in the Motorola Face Unlock application that could allow a local attacker to access unauthorized content… |
CVE-2023-41818 | Medium | 5.0 | 2024-05-03 | An improper use of the SD card for sensitive data vulnerability was reported in the Motorola Device Help application that could allow a local attacker to read… |
CVE-2023-41817 | Low | 2.8 | 2024-05-03 | An improper export vulnerability was reported in the Motorola Phone Calls application that could allow a local attacker to read unauthorized information. |
CVE-2023-41816 | Medium | 5.0 | 2024-05-03 | An improper export vulnerability was reported in the Motorola Services Main application that could allow a local attacker to write to a local database. |
CVE-2023-35701 | Medium | 6.6 | 2024-05-03 | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Hive. The vulnerability affects the Hive JDBC driver component and it can po… |
CVE-2023-44472 | Medium | 4.3 | 2024-05-03 | Missing Authorization vulnerability in ThemeFuse Unyson.This issue affects Unyson: from n/a through 2.7.28. |
CVE-2023-25457 | Medium | 5.3 | 2024-05-03 | Missing Authorization vulnerability in Richteam Slider Carousel – Responsive Image Slider.This issue affects Slider Carousel – Responsive Image Slider: from n/… |
CVE-2023-51633 | Critical | 9.6 | 2024-05-03 | Centreon sysName Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected ins… |
CVE-2023-51629 | High | 8.8 | 2024-05-03 | D-Link DCS-8300LHV2 ONVIF Hardcoded PIN Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on a… |
CVE-2023-51628 | High | 8.0 | 2024-05-03 | D-Link DCS-8300LHV2 ONVIF SetHostName Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to… |
CVE-2023-51627 | High | 8.0 | 2024-05-03 | D-Link DCS-8300LHV2 ONVIF Duration Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to exe… |
CVE-2023-51626 | High | 8.8 | 2024-05-03 | D-Link DCS-8300LHV2 RTSP ValidateAuthorizationHeader Username Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows networ… |
CVE-2023-51625 | High | 8.0 | 2024-05-03 | D-Link DCS-8300LHV2 ONVIF SetSystemDateAndTime Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to e… |