2023 CVEs (page 46)
Page 46 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-6236 | High | 7.3 | 2024-04-10 | A flaw was found in Red Hat Enterprise Application Platform 8. When an OIDC app that serves multiple tenants attempts to access the second tenant, it should pr… |
CVE-2023-40148 | Medium | 6.5 | 2024-04-10 | Server-side request forgery (SSRF) in PingFederate allows unauthenticated http requests to attack network resources and consume server-side resources via forge… |
CVE-2023-7046 | High | 7.5 | 2024-04-09 | The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score plugin for WordPress is vulnerable to Sensitive Information… |
CVE-2023-6999 | High | 8.8 | 2024-04-09 | The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Remote Code Exxecution via shortcode in all versions up to, and including, 3.0… |
CVE-2023-6993 | Medium | 6.4 | 2024-04-09 | The Custom post types, Custom Fields & more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode and custom post meta i… |
CVE-2023-6967 | High | 8.8 | 2024-04-09 | The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to SQL Injection via shortcode in all versions up to, and including, 3.0.10 (with… |
CVE-2023-6965 | Medium | 4.3 | 2024-04-09 | The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0.10 (with the e… |
CVE-2023-6964 | High | 8.5 | 2024-04-09 | The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and inc… |
CVE-2023-6799 | Medium | 5.9 | 2024-04-09 | The WP Reset – Most Advanced WordPress Reset Tool plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2… |
CVE-2023-6777 | Medium | 5.3 | 2024-04-09 | The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 9.0.34 due… |
CVE-2023-6695 | Medium | 6.5 | 2024-04-09 | The Beaver Themer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.9 via the 'wpbb' shortcode. Th… |
CVE-2023-6694 | Medium | 6.4 | 2024-04-09 | The Beaver Themer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.4.9 d… |
CVE-2023-6486 | Medium | 6.4 | 2024-04-09 | The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS metabox in all versions up to and… |
CVE-2023-49913 | High | 7.2 | 2024-04-09 | A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point… |
CVE-2023-49912 | High | 7.2 | 2024-04-09 | A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point… |
CVE-2023-49911 | High | 7.2 | 2024-04-09 | A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point… |
CVE-2023-49910 | High | 7.2 | 2024-04-09 | A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point… |
CVE-2023-49909 | High | 7.2 | 2024-04-09 | A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point… |
CVE-2023-49908 | High | 7.2 | 2024-04-09 | A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point… |
CVE-2023-49907 | High | 7.2 | 2024-04-09 | A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point… |
CVE-2023-49906 | High | 7.2 | 2024-04-09 | A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point… |
CVE-2023-49134 | High | 8.1 | 2024-04-09 | A command execution vulnerability exists in the tddpd enable_test_mode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0… |
CVE-2023-49133 | High | 8.1 | 2024-04-09 | A command execution vulnerability exists in the tddpd enable_test_mode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0… |
CVE-2023-49074 | High | 7.4 | 2024-04-09 | A denial of service vulnerability exists in the TDDP functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A… |
CVE-2023-48784 | Medium | 6.7 | 2024-04-09 | A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.1 and below, version 7.2.7 and below, 7.0 all versions, 6.4 all ver… |
CVE-2023-48724 | High | 7.5 | 2024-04-09 | A memory corruption vulnerability exists in the web interface functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20… |
CVE-2023-47542 | Medium | 6.7 | 2024-04-09 | A improper neutralization of special elements used in a template engine [CWE-1336] in FortiManager versions 7.4.1 and below, versions 7.2.4 and below, and 7.0… |
CVE-2023-47541 | Medium | 6.7 | 2024-04-09 | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, FortiSandbox 4.2… |
CVE-2023-47540 | Medium | 6.7 | 2024-04-09 | An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, Forti… |
CVE-2023-45590 | Critical | 9.6 | 2024-04-09 | An improper control of generation of code ('code injection') in Fortinet FortiClientLinux version 7.2.0, 7.0.6 through 7.0.10 and 7.0.3 through 7.0.4 allows at… |
CVE-2023-41677 | High | 7.5 | 2024-04-09 | A insufficiently protected credentials in Fortinet FortiProxy 7.4.0, 7.2.0 through 7.2.6, 7.0.0 through 7.0.12, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1… |
CVE-2023-6320 | Critical | 9.1 | 2024-04-09 | A command injection vulnerability exists in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint on webOS versions 5 and 6. A series of spe… |
CVE-2023-6319 | Critical | 9.1 | 2024-04-09 | A command injection vulnerability exists in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service on webOS version 4 through 7… |
CVE-2023-6318 | Critical | 9.1 | 2024-04-09 | A command injection vulnerability exists in the processAnalyticsReport method from the com.webos.service.cloudupload service on webOS version 5 through 7. A se… |
CVE-2023-6317 | High | 7.2 | 2024-04-09 | A prompt bypass exists in the secondscreen.gateway service running on webOS version 4 through 7. An attacker can create a privileged account without asking the… |
CVE-2023-50821 | Medium | 6.2 | 2024-04-09 | A vulnerability has been identified in SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC04), SIMATIC WinCC Runtime Professional V17 (All versions < V17 Update 8)… |
CVE-2023-1083 | Critical | 9.8 | 2024-04-09 | An unauthenticated remote attacker who is aware of a MQTT topic name can send and receive messages, including GET/SET configuration commands, reboot commands… |
CVE-2023-1082 | High | 8.8 | 2024-04-09 | An remote attacker with low privileges can perform a command injection which can lead to root access. |
CVE-2023-7164 | High | 7.5 | 2024-04-08 | The BackWPup WordPress plugin before 4.0.4 does not prevent Directory Listing in its temporary backup folder, allowing unauthenticated attackers to download ba… |
CVE-2023-52386 | High | 7.5 | 2024-04-08 | Out-of-bounds write vulnerability in the RSMC module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52385 | Medium | 6.2 | 2024-04-08 | Out-of-bounds write vulnerability in the RSMC module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52364 | Medium | 6.3 | 2024-04-08 | Vulnerability of input parameters being not strictly verified in the RSMC module. Impact: Successful exploitation of this vulnerability may cause out-of-bounds… |
CVE-2023-52554 | Medium | 6.5 | 2024-04-08 | Permission control vulnerability in the Bluetooth module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-52553 | High | 7.4 | 2024-04-08 | Race condition vulnerability in the Wi-Fi module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52552 | High | 7.5 | 2024-04-08 | Input verification vulnerability in the power module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52551 | Medium | 5.3 | 2024-04-08 | Vulnerability of data verification errors in the kernel module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-52550 | High | 7.5 | 2024-04-08 | Vulnerability of data verification errors in the kernel module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-52549 | High | 7.5 | 2024-04-08 | Vulnerability of data verification errors in the kernel module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-52546 | High | 7.5 | 2024-04-08 | Vulnerability of package name verification being bypassed in the Calendar app. Impact: Successful exploitation of this vulnerability may affect service confide… |
CVE-2023-52545 | High | 7.5 | 2024-04-08 | Vulnerability of undefined permissions in the Calendar app. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52544 | Medium | 4.3 | 2024-04-08 | Vulnerability of file path verification being bypassed in the email module. Impact: Successful exploitation of this vulnerability may affect service confidenti… |
CVE-2023-52543 | Medium | 6.2 | 2024-04-08 | Permission verification vulnerability in the system module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52542 | Medium | 6.5 | 2024-04-08 | Permission verification vulnerability in the system module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52541 | High | 7.5 | 2024-04-08 | Authentication vulnerability in the API for app pre-loading. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-52540 | High | 7.5 | 2024-04-08 | Vulnerability of improper authentication in the Iaware module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52539 | High | 7.5 | 2024-04-08 | Permission verification vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-52538 | Critical | 9.1 | 2024-04-08 | Vulnerability of package name verification being bypassed in the HwIms module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52537 | High | 7.5 | 2024-04-08 | Vulnerability of package name verification being bypassed in the HwIms module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52388 | High | 7.5 | 2024-04-08 | Permission control vulnerability in the clock module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52359 | High | 7.5 | 2024-04-08 | Vulnerability of permission verification in some APIs in the ActivityTaskManagerService module. Impact: Successful exploitation of this vulnerability will affe… |
CVE-2023-52536 | Medium | 4.4 | 2024-04-08 | In faceid service, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privi… |
CVE-2023-52535 | Medium | 4.4 | 2024-04-08 | In vsp driver, there is a possible missing verification incorrect input. This could lead to local denial of service with no additional execution privileges nee… |
CVE-2023-52534 | Medium | 5.9 | 2024-04-08 | In ngmm, there is a possible undefined behavior due to incorrect error handling. This could lead to remote denial of service with no additional execution privi… |
CVE-2023-52533 | Medium | 5.3 | 2024-04-08 | In modem-ps-nas-ngmm, there is a possible undefined behavior due to incorrect error handling. This could lead to remote information disclosure no additional ex… |
CVE-2023-52352 | Medium | 5.5 | 2024-04-08 | In Network Adapter Service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges ne… |
CVE-2023-52351 | High | 7.8 | 2024-04-08 | In ril service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privile… |
CVE-2023-52350 | Medium | 4.4 | 2024-04-08 | In ril service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privile… |
CVE-2023-52349 | Medium | 4.4 | 2024-04-08 | In ril service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privile… |
CVE-2023-52348 | Medium | 4.4 | 2024-04-08 | In ril service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privile… |
CVE-2023-52347 | Medium | 5.5 | 2024-04-08 | In ril service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privile… |
CVE-2023-52346 | Medium | 4.4 | 2024-04-08 | In modem driver, there is a possible system crash due to improper input validation. This could lead to local information disclosure with System execution privi… |
CVE-2023-52345 | Medium | 6.0 | 2024-04-08 | In modem driver, there is a possible system crash due to improper input validation. This could lead to local information disclosure with System execution privi… |
CVE-2023-52344 | Medium | 5.3 | 2024-04-08 | In modem-ps-nas-ngmm, there is a possible undefined behavior due to incorrect error handling. This could lead to remote information disclosure no additional ex… |
CVE-2023-52343 | Medium | 5.5 | 2024-04-08 | In SecurityCommand message after as security has been actived., there is a possible improper input validation. This could lead to remote information disclosure… |
CVE-2023-52342 | High | 7.5 | 2024-04-08 | In modem-ps-nas-ngmm, there is a possible undefined behavior due to incorrect error handling. This could lead to remote information disclosure no additional ex… |
CVE-2023-52341 | High | 7.5 | 2024-04-08 | In Plaintext COUNTER CHECK message accepted before AS security activation, there is a possible missing permission check. This could lead to remote information… |
CVE-2023-52717 | Medium | 5.3 | 2024-04-07 | Permission verification vulnerability in the lock screen module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52716 | High | 7.5 | 2024-04-07 | Vulnerability of starting activities in the background in the ActivityManagerService (AMS) module. Impact: Successful exploitation of this vulnerability will a… |
CVE-2023-52715 | High | 7.5 | 2024-04-07 | The SystemUI module has a vulnerability in permission management. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2023-52714 | High | 7.5 | 2024-04-07 | Vulnerability of defects introduced in the design process in the hwnff module. Impact: Successful exploitation of this vulnerability may affect service confide… |
CVE-2023-52713 | High | 7.7 | 2024-04-07 | Vulnerability of improper permission control in the window management module. Impact: Successful exploitation of this vulnerability will affect availability an… |
CVE-2023-6877 | Medium | 6.4 | 2024-04-07 | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Script… |
CVE-2023-5912 | Medium | 6.7 | 2024-04-05 | A potential memory leakage vulnerability was reported in some Lenovo Notebook products that may allow a local attacker with elevated privileges to write to NV… |
CVE-2023-4605 | Medium | 6.5 | 2024-04-05 | A valid authenticated Lenovo XClarity Administrator (LXCA) user can potentially leverage an unauthenticated API endpoint to retrieve system event information… |
CVE-2023-25494 | Medium | 6.7 | 2024-04-05 | A potential vulnerability were reported in the BIOS of some Desktop, Smart Edge, and ThinkStation products that could allow a local attacker with elevated pri… |
CVE-2023-25493 | Medium | 6.7 | 2024-04-05 | A potential vulnerability was reported in the BIOS update tool driver for some Desktop, Smart Edge, Smart Office, and ThinkStation products that could allow a… |
CVE-2023-31028 | Low | 2.8 | 2024-04-05 | NVIDIA nvJPEG2000 Library for Windows and Linux contains a vulnerability where improper input validation might enable an attacker to use a specially crafted i… |
CVE-2023-48426 | Critical | 10.0 | 2024-04-05 | u-boot bug that allows for u-boot shell and interrupt over UART |
CVE-2023-49965 | Medium | 6.8 | 2024-04-05 | SpaceX Starlink Wi-Fi router Gen 2 before 2023.48.0 allows XSS via the ssid and password parameters on the Setup Page. |
CVE-2023-5692 | Medium | 5.3 | 2024-04-05 | WordPress Core is vulnerable to Sensitive Information Exposure in versions up to, and including, 6.4.3 via the redirect_guess_404_permalink function. This can… |
CVE-2023-6523 | High | 8.8 | 2024-04-05 | Authorization Bypass Through User-Controlled Key vulnerability in ExtremePacs Extreme XDS allows Authentication Abuse. This issue affects Extreme XDS: before… |
CVE-2023-6522 | High | 7.2 | 2024-04-05 | Incorrect Use of Privileged APIs vulnerability in ExtremePacs Extreme XDS allows Collect Data as Provided by Users. This issue affects Extreme XDS: before 391… |
CVE-2023-52235 | High | 8.8 | 2024-04-05 | SpaceX Starlink Wi-Fi router GEN 2 before 2023.53.0 and Starlink Dish before 07dd2798-ff15-4722-a9ee-de28928aed34 allow CSRF (e.g., for a reboot) via a DNS Reb… |
CVE-2023-5973 | Medium | 4.3 | 2024-04-05 | Brocade Web Interface in Brocade Fabric OS v9.x and before v9.2.0 does not properly represent the portName to the user if the portName contains reserved cha… |
CVE-2023-45288 | High | 7.5 | 2024-04-04 | An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK stat… |
CVE-2023-38709 | High | 7.3 | 2024-04-04 | Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HT… |
CVE-2023-3454 | High | 8.6 | 2024-04-04 | Remote code execution (RCE) vulnerability in Brocade Fabric OS after v9.0 and before v9.2.0 could allow an attacker to execute arbitrary code and use this to g… |
CVE-2023-36645 | Critical | 9.1 | 2024-04-04 | SQL injection vulnerability in ITB-GmbH TradePro v9.5, allows remote attackers to run SQL queries via oordershow component in customer function. |
CVE-2023-36644 | High | 7.5 | 2024-04-04 | Incorrect Access Control in ITB-GmbH TradePro v9.5, allows remote attackers to receive all order confirmations from the online shop via the printmail plugin. |
CVE-2023-36643 | High | 7.5 | 2024-04-04 | Incorrect Access Control in ITB-GmbH TradePro v9.5, allows remote attackers to receive all orders from the online shop via oordershow component in customer fun… |