2023 CVEs (page 43)
Page 43 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-27325 | High | 7.8 | 2024-05-03 | Parallels Desktop Updater Improper Initialization Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on… |
CVE-2023-27324 | High | 7.8 | 2024-05-03 | Parallels Desktop Updater Improper Initialization Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on… |
CVE-2023-27323 | High | 7.8 | 2024-05-03 | Parallels Desktop Updater Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges… |
CVE-2023-27322 | High | 7.8 | 2024-05-03 | Parallels Desktop Service Improper Initialization Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on… |
CVE-2023-7067 | Medium | 4.3 | 2024-05-02 | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to una… |
CVE-2023-7064 | High | 7.5 | 2024-05-02 | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.17.5 via d… |
CVE-2023-7030 | Medium | 6.4 | 2024-05-02 | The Collapse-O-Matic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'expand' shortcode in all versions up to, and including… |
CVE-2023-6962 | Medium | 5.3 | 2024-05-02 | The WP Meta SEO plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.12 via the meta description. Thi… |
CVE-2023-6961 | High | 7.2 | 2024-05-02 | The WP Meta SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Referer’ header in all versions up to, and including, 4.5.12 due to… |
CVE-2023-6731 | Medium | 4.3 | 2024-05-02 | The WP Show Posts plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple AJAX functions in all version… |
CVE-2023-6214 | High | 7.5 | 2024-05-02 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.6 vi… |
CVE-2023-50685 | High | 7.5 | 2024-05-02 | An issue in Hipcam Cameras RealServer v.1.0 allows a remote attacker to cause a denial of service via a crafted script to the client_port parameter. |
CVE-2023-47727 | Medium | 4.3 | 2024-05-02 | IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.20.0 could allow an authenticated user to modify das… |
CVE-2023-37244 | Medium | 5.3 | 2024-05-02 | The affected AutomationManager.AgentService.exe application contains a TOCTOU race condition vulnerability that allows standard users to create a pseudo-symlin… |
CVE-2023-41971 | Medium | 5.3 | 2024-05-02 | An Improper Link Resolution Before File Access ('Link Following') vulnerability in Zscaler Client Connector on Windows allows a system file to be overwritten.T… |
CVE-2023-41970 | Medium | 6.0 | 2024-05-02 | An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on Windows during the Repair App functionality may allow Local Execut… |
CVE-2023-28798 | Medium | 6.5 | 2024-05-02 | An out-of-bounds write to heap in the pacparser library on Zscaler Client Connector on Mac may lead to arbitrary code execution. |
CVE-2023-51631 | Medium | 6.8 | 2024-05-02 | D-Link DIR-X3260 prog.cgi SetUsersSettings Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attacker… |
CVE-2023-46295 | Critical | 9.8 | 2024-05-01 | An issue was discovered in Teledyne FLIR M300 2.00-19. Unauthenticated remote code execution can occur in the web server. An attacker can exploit this by sendi… |
CVE-2023-46294 | Low | 3.4 | 2024-05-01 | An issue was discovered in Teledyne FLIR M300 2.00-19. User account passwords are encrypted locally, and can be decrypted to cleartext passwords using the util… |
CVE-2023-26793 | Critical | 9.8 | 2024-05-01 | libmodbus v3.1.10 has a heap-based buffer overflow vulnerability in read_io_status function in src/modbus.c. |
CVE-2023-23022 | Medium | 6.1 | 2024-05-01 | Cross site scripting (XSS) vulnerability in sourcecodester oretnom23 employee's payroll management system 1.0, allows attackers to execute arbitrary code via t… |
CVE-2023-23021 | Medium | 6.1 | 2024-05-01 | Cross Site Scripting (XSS) vulnerability in sourcecodester oretnom23 pos point sale system 1.0, allows attackers to execute arbitrary code via the code, name… |
CVE-2023-23019 | Medium | 5.4 | 2024-05-01 | Cross site scripting (XSS) vulnerability in file main.php in sourcecodester oretnom23 Blog Site 1.0 via the name and email parameters to function user_add.\ |
CVE-2023-7241 | High | 7.9 | 2024-05-01 | Privilege Escalation in WRSA.EXE in Webroot Antivirus 8.0.1X- 9.0.35.12 on Windows64 bit and 32 bit allows malicious software to abuse WRSA.EXE to delete arb… |
CVE-2023-49606 | Critical | 9.8 | 2024-05-01 | A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HTTP header can trig… |
CVE-2023-47212 | Critical | 9.8 | 2024-05-01 | A heap-based buffer overflow vulnerability exists in the comment functionality of stb _vorbis.c v1.22. A specially crafted .ogg file can lead to an out-of-boun… |
CVE-2023-47166 | High | 8.8 | 2024-05-01 | A firmware update vulnerability exists in the luci2-io file-import functionality of Milesight UR32L v32.3.0.7-r2. A specially crafted network request can lead… |
CVE-2023-52653 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix a memleak in gss_import_v2_context The ctx->mech_used.data allocated by kmemd… |
CVE-2023-52652 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: NTB: fix possible name leak in ntb_register_device() If device_register() fails in ntb_re… |
CVE-2023-52650 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: drm/tegra: dsi: Add missing check for of_find_device_by_node Add check for the return val… |
CVE-2023-52649 | High | 7.8 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: drm/vkms: Avoid reading beyond LUT array When the floor LUT index (drm_fixp2int(lut_index… |
CVE-2023-52648 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Unmap the surface before resetting it on a plane state Switch to a new plane… |
CVE-2023-52647 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: Check whether crossbar pad is non-NULL before access When translati… |
CVE-2023-50059 | Medium | 5.3 | 2024-04-30 | An issue ingalxe.com Galxe platform 1.0 allows a remote attacker to obtain sensitive information via the Web3 authentication process of Galxe, the signed messa… |
CVE-2023-50053 | High | 7.6 | 2024-04-30 | An issue in Foundation.app Foundation platform 1.0 allows a remote attacker to obtain sensitive information via the Web3 authentication process of Foundation… |
CVE-2023-49473 | Critical | 9.8 | 2024-04-30 | Shenzhen JF6000 Cloud Media Collaboration Processing Platform firmware version V1.2.0 and software version V2.0.0 build 6245 is vulnerable to Incorrect Access… |
CVE-2023-45385 | High | 7.5 | 2024-04-30 | ProQuality pqprintshippinglabels before v.4.15.0 is vulnerable to Directory Traversal via the pqprintshippinglabels module. |
CVE-2023-38002 | Medium | 5.0 | 2024-04-30 | IBM Storage Scale 5.1.0.0 through 5.1.9.2 could allow an authenticated user to steal or manipulate an active session to gain access to the system. IBM X-Force… |
CVE-2023-50915 | Medium | 6.5 | 2024-04-30 | An issue exists in GalaxyClientService.exe in GOG Galaxy (Beta) 2.0.67.2 through 2.0.71.2 that could allow authenticated users to overwrite and corrupt critica… |
CVE-2023-50914 | Medium | 6.7 | 2024-04-30 | A Privilege Escalation issue in the inter-process communication procedure from GOG Galaxy (Beta) 2.0.67.2 through v2.0.71.2 allows authentictaed users to chang… |
CVE-2023-46304 | High | 8.1 | 2024-04-30 | modules/Users/models/Module.php in Vtiger CRM 7.5.0 allows a remote authenticated attacker to run arbitrary PHP code because an unprotected endpoint allows the… |
CVE-2023-52728 | Medium | 5.5 | 2024-04-30 | Open Networking Foundation SD-RAN ONOS onos-lib-go 0.10.25 allows an index out-of-range condition in putBitString. |
CVE-2023-52727 | High | 8.1 | 2024-04-30 | Open Networking Foundation SD-RAN ONOS onos-lib-go 0.10.25 allows an index out-of-range condition in parseAlignBits. |
CVE-2023-52726 | Medium | 6.5 | 2024-04-30 | Open Networking Foundation SD-RAN ONOS onos-ric-sdk-go 0.8.12 allows infinite repetition of the processing of an error (in the Subscribe function implementatio… |
CVE-2023-52725 | Medium | 6.5 | 2024-04-30 | Open Networking Foundation SD-RAN ONOS onos-kpimon 0.4.7 allows blocking of the errCh channel within the Start function of the monitoring package. |
CVE-2023-52724 | High | 8.1 | 2024-04-30 | Open Networking Foundation SD-RAN onos-kpimon 0.4.7 allows out-of-bounds array access in the processIndicationFormat1 function. |
CVE-2023-50434 | Critical | 9.8 | 2024-04-29 | emdns_resolve_raw in emdns.c in emdns through fbd1eef calls strlen with an input that may not be '\0' terminated, leading to a stack-based buffer over-read. Th… |
CVE-2023-50433 | Medium | 6.5 | 2024-04-29 | marshall in dhcp_packet.c in simple-dhcp-server through ec976d2 allows remote attackers to cause a denial of service by sending a malicious DHCP packet. The cr… |
CVE-2023-50432 | Medium | 5.3 | 2024-04-29 | simple-dhcp-server through ec976d2 allows remote attackers to cause a denial of service (daemon crash) by sending a DHCP packet without any option fields, whic… |
CVE-2023-46960 | High | 8.6 | 2024-04-29 | Buffer Overflow vulnerability in PyPXE v.1.8.4 allows a remote attacker to cause a denial of service via the handle function in the tftp module. |
CVE-2023-46566 | High | 7.5 | 2024-04-29 | Buffer Overflow vulnerability in msoulier tftpy commit 467017b844bf6e31745138a30e2509145b0c529c allows a remote attacker to cause a denial of service via the p… |
CVE-2023-31889 | Medium | 5.5 | 2024-04-29 | An issue discovered in httpd in ASUS RT-AC51U with firmware version up to and including 3.0.0.4.380.8591 allows local attackers to cause a denial of service vi… |
CVE-2023-46565 | High | 7.5 | 2024-04-29 | Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of service via the handl… |
CVE-2023-51710 | Medium | 4.2 | 2024-04-29 | EMS SQL Manager 3.6.2 (build 55333) for Oracle allows DLL hijacking: a user can trigger the execution of arbitrary code every time the product is executed. |
CVE-2023-52080 | High | 7.7 | 2024-04-29 | IEIT NF5280M6 UEFI firmware through 8.4 has a pool overflow vulnerability, caused by improper use of the gRT->GetVariable() function. Attackers with access to… |
CVE-2023-51254 | Medium | 6.1 | 2024-04-29 | Cross Site Scripting vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the friendship link componen… |
CVE-2023-48684 | High | 7.1 | 2024-04-29 | Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux… |
CVE-2023-48683 | High | 7.1 | 2024-04-29 | Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux… |
CVE-2023-46270 | Low | 3.3 | 2024-04-29 | MacPaw The Unarchiver before 4.3.6 contains vulnerability related to missing quarantine attributes for extracted items. |
CVE-2023-52723 | High | 7.1 | 2024-04-29 | In KDE libksieve before 23.03.80, kmanagesieve/session.cpp places a cleartext password in server logs because a username variable is accidentally given a passw… |
CVE-2023-52722 | Medium | 5.5 | 2024-04-28 | An issue was discovered in Artifex Ghostscript before 10.03.1. psi/zmisc1.c, when SAFER mode is used, allows eexec seeds other than the Type 1 standard. |
CVE-2023-1000 | Medium | 6.3 | 2024-04-27 | A vulnerability was found in cyanomiko dcnnt-py up to 0.9.0. It has been classified as critical. Affected is the function main of the file dcnnt/plugins/notifi… |
CVE-2023-26603 | Medium | 5.9 | 2024-04-26 | JumpCloud Agent before 1.178.0 Creates a Temporary File in a Directory with Insecure Permissions. This allows privilege escalation to SYSTEM via a repair actio… |
CVE-2023-51794 | High | 7.8 | 2024-04-26 | Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/af_stereowiden.c:120:69. |
CVE-2023-51365 | High | 8.7 | 2024-04-26 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read th… |
CVE-2023-51364 | High | 8.7 | 2024-04-26 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read th… |
CVE-2023-50364 | Medium | 6.4 | 2024-04-26 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2023-50363 | High | 7.4 | 2024-04-26 | An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authen… |
CVE-2023-50362 | Medium | 5.0 | 2024-04-26 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2023-50361 | Medium | 5.0 | 2024-04-26 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2023-47222 | Critical | 9.6 | 2024-04-26 | An exposure of sensitive information vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnerability could allow users to com… |
CVE-2023-41291 | Medium | 5.5 | 2024-04-26 | A path traversal vulnerability has been reported to affect QuFirewall. If exploited, the vulnerability could allow authenticated administrators to read the con… |
CVE-2023-41290 | Medium | 4.1 | 2024-04-26 | A path traversal vulnerability has been reported to affect QuFirewall. If exploited, the vulnerability could allow authenticated administrators to read the con… |
CVE-2023-52646 | Medium | 5.5 | 2024-04-26 | In the Linux kernel, the following vulnerability has been resolved: aio: fix mremap after fork null-deref Commit e4a0d3e720e7 ("aio: Make it possible to rema… |
CVE-2023-6116 | High | 8.9 | 2024-04-26 | Team ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the camera. An attacker could inject malicious into http reque… |
CVE-2023-6096 | High | 7.4 | 2024-04-26 | Vladimir Kononovich, a Security Researcher has found a flaw that using a inappropriate encryption logic on the DVR. firmware encryption is broken and allows t… |
CVE-2023-6095 | High | 8.9 | 2024-04-26 | Vladimir Kononovich, a Security Researcher has found a flaw that allows for a remote code execution on the DVR. An attacker could inject malicious HTTP header… |
CVE-2023-47252 | Medium | 6.3 | 2024-04-26 | An issue was discovered in PnpSmm in Insyde InsydeH2O with kernel 5.0 through 5.6. There is a possible out-of-bounds access in the SMM communication buffer, le… |
CVE-2023-6787 | Medium | 6.5 | 2024-04-25 | A flaw was found in Keycloak that occurs from an error in the re-authentication mechanism within org.keycloak.authentication. This flaw allows hijacking an act… |
CVE-2023-6717 | Medium | 6.0 | 2024-04-25 | A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Serv… |
CVE-2023-6596 | High | 7.5 | 2024-04-25 | An incomplete fix was shipped for the Rapid Reset (CVE-2023-44487/CVE-2023-39325) vulnerability for an OpenShift Containers. |
CVE-2023-6544 | Medium | 5.4 | 2024-04-25 | A flaw was found in the Keycloak package. This issue occurs due to a permissive regular expression hardcoded for filtering which allows hosts to register a dyn… |
CVE-2023-6484 | Medium | 5.3 | 2024-04-25 | A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This iss… |
CVE-2023-5675 | Medium | 6.5 | 2024-04-25 | A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Q… |
CVE-2023-3597 | Medium | 5.0 | 2024-04-25 | A flaw was found in Keycloak, where it does not correctly validate its client step-up authentication in org.keycloak.authentication. This flaw allows a remote… |
CVE-2023-52220 | Medium | 4.3 | 2024-04-25 | Missing Authorization vulnerability in MonsterInsights Google Analytics by Monster Insights.This issue affects Google Analytics by Monster Insights: from n/a t… |
CVE-2023-51484 | Critical | 9.8 | 2024-04-25 | Improper Authentication vulnerability in wp-buy Login as User or Customer (User Switching) allows Privilege Escalation.This issue affects Login as User or Cust… |
CVE-2023-51482 | Critical | 9.9 | 2024-04-25 | Improper Authentication vulnerability in EazyPlugins Eazy Plugin Manager allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Eaz… |
CVE-2023-51478 | Critical | 9.8 | 2024-04-25 | Improper Authentication vulnerability in Abdul Hakeem Build App Online allows Privilege Escalation.This issue affects Build App Online: from n/a through 1.0.19. |
CVE-2023-6237 | Medium | 5.9 | 2024-04-25 | Issue summary: Checking excessively long invalid RSA public keys may take a long time. Impact summary: Applications that use the function EVP_PKEY_public_chec… |
CVE-2023-20249 | Medium | 5.4 | 2024-04-24 | A vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) Software could allow an authenticated, remote attacker to co… |
CVE-2023-20248 | Medium | 5.4 | 2024-04-24 | A vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) Software could allow an authenticated, remote attacker to co… |
CVE-2023-51477 | Critical | 9.8 | 2024-04-24 | Improper Authentication vulnerability in BUDDYBOSS DMCC BuddyBoss Theme allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Budd… |
CVE-2023-51472 | Critical | 9.8 | 2024-04-24 | Improper Authentication vulnerability in Mestres do WP Checkout Mestres WP allows Privilege Escalation.This issue affects Checkout Mestres WP: from n/a through… |
CVE-2023-51471 | High | 8.2 | 2024-04-24 | Improper Authentication vulnerability in Mestres do WP Checkout Mestres WP allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects C… |
CVE-2023-51425 | Critical | 9.8 | 2024-04-24 | Improper Privilege Management vulnerability in Jacques Malgrange Rencontre – Dating Site allows Privilege Escalation.This issue affects Rencontre – Dating Site… |
CVE-2023-51405 | High | 8.2 | 2024-04-24 | Improper Authentication vulnerability in Repute Infosystems BookingPress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Boo… |
CVE-2023-48763 | Medium | 5.3 | 2024-04-24 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS vulnerability in Crocoblock JetFormBuilder allows Code Injection.This issue affect… |
CVE-2023-47774 | Medium | 5.4 | 2024-04-24 | Improper Restriction of Rendered UI Layers or Frames vulnerability in Automattic Jetpack allows Clickjacking.This issue affects Jetpack: from n/a before 12.7. |