2023 CVEs (page 44)
Page 44 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-50434 | Critical | 9.8 | 2024-04-29 | emdns_resolve_raw in emdns.c in emdns through fbd1eef calls strlen with an input that may not be '\0' terminated, leading to a stack-based buffer over-read. Th… |
CVE-2023-50433 | Medium | 6.5 | 2024-04-29 | marshall in dhcp_packet.c in simple-dhcp-server through ec976d2 allows remote attackers to cause a denial of service by sending a malicious DHCP packet. The cr… |
CVE-2023-50432 | Medium | 5.3 | 2024-04-29 | simple-dhcp-server through ec976d2 allows remote attackers to cause a denial of service (daemon crash) by sending a DHCP packet without any option fields, whic… |
CVE-2023-46960 | High | 8.6 | 2024-04-29 | Buffer Overflow vulnerability in PyPXE v.1.8.4 allows a remote attacker to cause a denial of service via the handle function in the tftp module. |
CVE-2023-46566 | High | 7.5 | 2024-04-29 | Buffer Overflow vulnerability in msoulier tftpy commit 467017b844bf6e31745138a30e2509145b0c529c allows a remote attacker to cause a denial of service via the p… |
CVE-2023-31889 | Medium | 5.5 | 2024-04-29 | An issue discovered in httpd in ASUS RT-AC51U with firmware version up to and including 3.0.0.4.380.8591 allows local attackers to cause a denial of service vi… |
CVE-2023-46565 | High | 7.5 | 2024-04-29 | Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of service via the handl… |
CVE-2023-51710 | Medium | 4.2 | 2024-04-29 | EMS SQL Manager 3.6.2 (build 55333) for Oracle allows DLL hijacking: a user can trigger the execution of arbitrary code every time the product is executed. |
CVE-2023-52080 | High | 7.7 | 2024-04-29 | IEIT NF5280M6 UEFI firmware through 8.4 has a pool overflow vulnerability, caused by improper use of the gRT->GetVariable() function. Attackers with access to… |
CVE-2023-51254 | Medium | 6.1 | 2024-04-29 | Cross Site Scripting vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the friendship link componen… |
CVE-2023-48684 | High | 7.1 | 2024-04-29 | Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux… |
CVE-2023-48683 | High | 7.1 | 2024-04-29 | Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux… |
CVE-2023-46270 | Low | 3.3 | 2024-04-29 | MacPaw The Unarchiver before 4.3.6 contains vulnerability related to missing quarantine attributes for extracted items. |
CVE-2023-52723 | High | 7.1 | 2024-04-29 | In KDE libksieve before 23.03.80, kmanagesieve/session.cpp places a cleartext password in server logs because a username variable is accidentally given a passw… |
CVE-2023-52722 | Medium | 5.5 | 2024-04-28 | An issue was discovered in Artifex Ghostscript before 10.03.1. psi/zmisc1.c, when SAFER mode is used, allows eexec seeds other than the Type 1 standard. |
CVE-2023-1000 | Medium | 6.3 | 2024-04-27 | A vulnerability was found in cyanomiko dcnnt-py up to 0.9.0. It has been classified as critical. Affected is the function main of the file dcnnt/plugins/notifi… |
CVE-2023-26603 | Medium | 5.9 | 2024-04-26 | JumpCloud Agent before 1.178.0 Creates a Temporary File in a Directory with Insecure Permissions. This allows privilege escalation to SYSTEM via a repair actio… |
CVE-2023-51794 | High | 7.8 | 2024-04-26 | Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/af_stereowiden.c:120:69. |
CVE-2023-51365 | High | 8.7 | 2024-04-26 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read th… |
CVE-2023-51364 | High | 8.7 | 2024-04-26 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read th… |
CVE-2023-50364 | Medium | 6.4 | 2024-04-26 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2023-50363 | High | 7.4 | 2024-04-26 | An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authen… |
CVE-2023-50362 | Medium | 5.0 | 2024-04-26 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2023-50361 | Medium | 5.0 | 2024-04-26 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2023-47222 | Critical | 9.6 | 2024-04-26 | An exposure of sensitive information vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnerability could allow users to com… |
CVE-2023-41291 | Medium | 5.5 | 2024-04-26 | A path traversal vulnerability has been reported to affect QuFirewall. If exploited, the vulnerability could allow authenticated administrators to read the con… |
CVE-2023-41290 | Medium | 4.1 | 2024-04-26 | A path traversal vulnerability has been reported to affect QuFirewall. If exploited, the vulnerability could allow authenticated administrators to read the con… |
CVE-2023-52646 | Medium | 5.5 | 2024-04-26 | In the Linux kernel, the following vulnerability has been resolved: aio: fix mremap after fork null-deref Commit e4a0d3e720e7 ("aio: Make it possible to rema… |
CVE-2023-6116 | High | 8.9 | 2024-04-26 | Team ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the camera. An attacker could inject malicious into http reque… |
CVE-2023-6096 | High | 7.4 | 2024-04-26 | Vladimir Kononovich, a Security Researcher has found a flaw that using a inappropriate encryption logic on the DVR. firmware encryption is broken and allows t… |
CVE-2023-6095 | High | 8.9 | 2024-04-26 | Vladimir Kononovich, a Security Researcher has found a flaw that allows for a remote code execution on the DVR. An attacker could inject malicious HTTP header… |
CVE-2023-47252 | Medium | 6.3 | 2024-04-26 | An issue was discovered in PnpSmm in Insyde InsydeH2O with kernel 5.0 through 5.6. There is a possible out-of-bounds access in the SMM communication buffer, le… |
CVE-2023-6787 | Medium | 6.5 | 2024-04-25 | A flaw was found in Keycloak that occurs from an error in the re-authentication mechanism within org.keycloak.authentication. This flaw allows hijacking an act… |
CVE-2023-6717 | Medium | 6.0 | 2024-04-25 | A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Serv… |
CVE-2023-6596 | High | 7.5 | 2024-04-25 | An incomplete fix was shipped for the Rapid Reset (CVE-2023-44487/CVE-2023-39325) vulnerability for an OpenShift Containers. |
CVE-2023-6544 | Medium | 5.4 | 2024-04-25 | A flaw was found in the Keycloak package. This issue occurs due to a permissive regular expression hardcoded for filtering which allows hosts to register a dyn… |
CVE-2023-6484 | Medium | 5.3 | 2024-04-25 | A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This iss… |
CVE-2023-5675 | Medium | 6.5 | 2024-04-25 | A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Q… |
CVE-2023-3597 | Medium | 5.0 | 2024-04-25 | A flaw was found in Keycloak, where it does not correctly validate its client step-up authentication in org.keycloak.authentication. This flaw allows a remote… |
CVE-2023-52220 | Medium | 4.3 | 2024-04-25 | Missing Authorization vulnerability in MonsterInsights Google Analytics by Monster Insights.This issue affects Google Analytics by Monster Insights: from n/a t… |
CVE-2023-51484 | Critical | 9.8 | 2024-04-25 | Improper Authentication vulnerability in wp-buy Login as User or Customer (User Switching) allows Privilege Escalation.This issue affects Login as User or Cust… |
CVE-2023-51482 | Critical | 9.9 | 2024-04-25 | Improper Authentication vulnerability in EazyPlugins Eazy Plugin Manager allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Eaz… |
CVE-2023-51478 | Critical | 9.8 | 2024-04-25 | Improper Authentication vulnerability in Abdul Hakeem Build App Online allows Privilege Escalation.This issue affects Build App Online: from n/a through 1.0.19. |
CVE-2023-6237 | Medium | 5.9 | 2024-04-25 | Issue summary: Checking excessively long invalid RSA public keys may take a long time. Impact summary: Applications that use the function EVP_PKEY_public_chec… |
CVE-2023-20249 | Medium | 5.4 | 2024-04-24 | A vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) Software could allow an authenticated, remote attacker to co… |
CVE-2023-20248 | Medium | 5.4 | 2024-04-24 | A vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) Software could allow an authenticated, remote attacker to co… |
CVE-2023-51477 | Critical | 9.8 | 2024-04-24 | Improper Authentication vulnerability in BUDDYBOSS DMCC BuddyBoss Theme allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Budd… |
CVE-2023-51472 | Critical | 9.8 | 2024-04-24 | Improper Authentication vulnerability in Mestres do WP Checkout Mestres WP allows Privilege Escalation.This issue affects Checkout Mestres WP: from n/a through… |
CVE-2023-51471 | High | 8.2 | 2024-04-24 | Improper Authentication vulnerability in Mestres do WP Checkout Mestres WP allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects C… |
CVE-2023-51425 | Critical | 9.8 | 2024-04-24 | Improper Privilege Management vulnerability in Jacques Malgrange Rencontre – Dating Site allows Privilege Escalation.This issue affects Rencontre – Dating Site… |
CVE-2023-51405 | High | 8.2 | 2024-04-24 | Improper Authentication vulnerability in Repute Infosystems BookingPress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Boo… |
CVE-2023-48763 | Medium | 5.3 | 2024-04-24 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS vulnerability in Crocoblock JetFormBuilder allows Code Injection.This issue affect… |
CVE-2023-47774 | Medium | 5.4 | 2024-04-24 | Improper Restriction of Rendered UI Layers or Frames vulnerability in Automattic Jetpack allows Clickjacking.This issue affects Jetpack: from n/a before 12.7. |
CVE-2023-47504 | Medium | 6.5 | 2024-04-24 | Improper Authentication vulnerability in Elementor Elementor Website Builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects… |
CVE-2023-32127 | Medium | 5.3 | 2024-04-24 | Missing Authorization vulnerability in Daniel Powney Multi Rating allows Functionality Misuse.This issue affects Multi Rating: from n/a through 5.0.6. |
CVE-2023-31090 | Critical | 9.9 | 2024-04-24 | Unrestricted Upload of File with Dangerous Type vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows U… |
CVE-2023-25790 | Medium | 5.3 | 2024-04-24 | Improper Authentication, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xtemos WoodMart allows Cross-Sit… |
CVE-2023-25785 | Medium | 5.3 | 2024-04-24 | Missing Authorization vulnerability in Shoaib Saleem WP Post Rating allows Functionality Misuse.This issue affects WP Post Rating: from n/a through 2.5. |
CVE-2023-23989 | Medium | 5.3 | 2024-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss RegistrationMagic.This issue affects Registrati… |
CVE-2023-23985 | Low | 3.7 | 2024-04-24 | Missing Authorization vulnerability in Quiz Maker team Quiz Maker.This issue affects Quiz Maker: from n/a through 6.3.9.4. |
CVE-2023-23976 | High | 7.5 | 2024-04-24 | Incorrect Default Permissions vulnerability in Metagauss RegistrationMagic allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects R… |
CVE-2023-7253 | Medium | 6.1 | 2024-04-24 | The Import WP WordPress plugin before 2.13.1 does not prevent users with the administrator role from pinging conducting SSRF attacks, which may be a problem i… |
CVE-2023-47731 | Medium | 5.4 | 2024-04-23 | IBM QRadar Suite Software 1.10.12.0 through 1.10.19.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 is vulnerable to stored cross-site scripting. T… |
CVE-2023-48184 | Low | 3.9 | 2024-04-23 | QuickJS before 7414e5f has a quickjs.h JS_FreeValueRT use-after-free because of incorrect garbage collection of async functions with closures. |
CVE-2023-48183 | High | 7.5 | 2024-04-23 | QuickJS before c4cdd61 has a build_for_in_iterator NULL pointer dereference because of an erroneous lexical scope of "this" with eval. |
CVE-2023-6833 | Medium | 4.4 | 2024-04-23 | Insertion of Sensitive Information into Log File vulnerability in Hitachi Ops Center Administrator allows local users to gain sensitive information.This issue… |
CVE-2023-38302 | Medium | 4.3 | 2024-04-22 | A certain software build for the Sharp Rouvo V device (SHARP/VZW_STTM21VAPP/STTM21VAPP:12/SP1A.210812.016/1KN0_0_530:user/release-keys) leaks the Wi-Fi MAC add… |
CVE-2023-38301 | Low | 3.4 | 2024-04-22 | An issue was discovered in a third-party component related to vendor.gsm.serial, shipped on devices from multiple device manufacturers. Various software builds… |
CVE-2023-38300 | Medium | 6.2 | 2024-04-22 | A certain software build for the Orbic Maui device (Orbic/RC545L/RC545L:10/ORB545L_V1.4.2_BVZPP/230106:user/release-keys) leaks the IMEI and the ICCID to syste… |
CVE-2023-38299 | Medium | 5.5 | 2024-04-22 | Various software builds for the AT&T Calypso, Nokia C100, Nokia C200, and BLU View 3 devices leak the device IMEI to a system property that can be accessed by… |
CVE-2023-38298 | High | 8.8 | 2024-04-22 | Various software builds for the following TCL devices (30Z, A3X, 20XE, 10L) leak the device IMEI to a system property that can be accessed by any local app on… |
CVE-2023-38297 | High | 8.4 | 2024-04-22 | An issue was discovered in a third-party com.factory.mmigroup component, shipped on devices from multiple device manufacturers. Certain software builds for var… |
CVE-2023-38296 | High | 8.0 | 2024-04-22 | Various software builds for the following TCL 30Z and TCL A3X devices leak the ICCID to a system property that can be accessed by any local app on the device w… |
CVE-2023-38295 | High | 7.8 | 2024-04-22 | Certain software builds for the TCL 30Z and TCL 10 Android devices contain a vulnerable, pre-installed app that relies on a missing permission that provides no… |
CVE-2023-38294 | Medium | 6.1 | 2024-04-22 | Certain software builds for the Itel Vision 3 Turbo Android device contain a vulnerable pre-installed app with a package name of com.transsion.autotest.factory… |
CVE-2023-38293 | High | 7.3 | 2024-04-22 | Certain software builds for the Nokia C200 and Nokia C100 Android devices contain a vulnerable, pre-installed app with a package name of com.tracfone.tfstatus… |
CVE-2023-38292 | High | 8.7 | 2024-04-22 | Certain software builds for the TCL 20XE Android device contain a vulnerable, pre-installed app with a package name of com.tct.gcs.hiddenmenuproxy (versionCode… |
CVE-2023-38291 | High | 7.1 | 2024-04-22 | An issue was discovered in a third-party component related to ro.boot.wifimacaddr, shipped on devices from multiple device manufacturers. Various software buil… |
CVE-2023-38290 | High | 7.8 | 2024-04-22 | Certain software builds for the BLU View 2 and Sharp Rouvo V Android devices contain a vulnerable pre-installed app with a package name of com.evenwell.fqc (ve… |
CVE-2023-7252 | Medium | 5.3 | 2024-04-22 | The Tickera WordPress plugin before 3.5.2.5 does not prevent users from leaking other users' tickets. |
CVE-2023-47435 | Critical | 9.8 | 2024-04-19 | An issue in the verifyPassword function of hexo-theme-matery v2.0.0 allows attackers to bypass authentication and access password protected pages. |
CVE-2023-51798 | High | 7.8 | 2024-04-19 | Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via a floating point exception (FPE) error at l… |
CVE-2023-51797 | Medium | 6.7 | 2024-04-19 | Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/avf_showwaves.c:722:24 in s… |
CVE-2023-51796 | Low | 3.6 | 2024-04-19 | Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/f_reverse.c:269:26 in areve… |
CVE-2023-51795 | High | 8.0 | 2024-04-19 | Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/avf_showspectrum.c:1789:52… |
CVE-2023-51793 | High | 7.8 | 2024-04-19 | Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavutil/imgutils.c:353:9 in image_cop… |
CVE-2023-51792 | Low | 3.3 | 2024-04-19 | Buffer Overflow vulnerability in libde265 v1.0.12 allows a local attacker to cause a denial of service via the allocation size exceeding the maximum supported… |
CVE-2023-51791 | High | 7.8 | 2024-04-19 | Buffer Overflow vulenrability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavcodec/jpegxl_parser.c in gen_alias… |
CVE-2023-50010 | High | 7.8 | 2024-04-19 | FFmpeg v.n6.1-3-g466799d4f5 allows a buffer over-read at ff_gradfun_blur_line_movdqa_sse2, as demonstrated by a call to the set_encoder_id function in /fftools… |
CVE-2023-50009 | High | 8.0 | 2024-04-19 | FFmpeg v.n6.1-3-g466799d4f5 allows a heap-based buffer overflow via the ff_gaussian_blur_8 function in libavfilter/edge_template.c:116:5 component. |
CVE-2023-50008 | High | 7.8 | 2024-04-19 | FFmpeg v.n6.1-3-g466799d4f5 allows memory consumption when using the colorcorrect filter, in the av_malloc function in libavutil/mem.c:105:9 component. |
CVE-2023-50007 | Medium | 4.0 | 2024-04-19 | FFmpeg v.n6.1-3-g466799d4f5 allows an attacker to trigger use of a parameter of negative size in the av_samples_set_silence function in thelibavutil/samplefmt… |
CVE-2023-49963 | High | 8.8 | 2024-04-19 | DYMO LabelWriter Print Server through 2.366 contains a backdoor hard-coded password that could allow an attacker to take control. |
CVE-2023-49502 | High | 8.8 | 2024-04-19 | Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the ff_bwdif_filter_intra_c function in the… |
CVE-2023-49501 | High | 8.0 | 2024-04-19 | Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfi… |
CVE-2023-37397 | Low | 3.6 | 2024-04-19 | IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain or modify sensitive information due to improper encryption of certain data. IBM X-For… |
CVE-2023-27279 | Medium | 6.5 | 2024-04-19 | IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a user to cause a denial of service due to missing API rate limiting. IBM X-Force ID: 248533. |
CVE-2023-37396 | Low | 2.5 | 2024-04-19 | IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain sensitive information due to improper encryption of certain data. IBM X-Force ID: 25… |
CVE-2023-22869 | Medium | 5.5 | 2024-04-19 | IBM Aspera Faspex 5.0.0 through 5.0.7 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 244119. |
CVE-2023-50260 | High | 8.8 | 2024-04-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. A wrong validation in the `host_deny` script allows to write any… |