2023 CVEs (page 46)
Page 46 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-52541 | High | 7.5 | 2024-04-08 | Authentication vulnerability in the API for app pre-loading. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-52540 | High | 7.5 | 2024-04-08 | Vulnerability of improper authentication in the Iaware module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52539 | High | 7.5 | 2024-04-08 | Permission verification vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-52538 | Critical | 9.1 | 2024-04-08 | Vulnerability of package name verification being bypassed in the HwIms module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52537 | High | 7.5 | 2024-04-08 | Vulnerability of package name verification being bypassed in the HwIms module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52388 | High | 7.5 | 2024-04-08 | Permission control vulnerability in the clock module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52359 | High | 7.5 | 2024-04-08 | Vulnerability of permission verification in some APIs in the ActivityTaskManagerService module. Impact: Successful exploitation of this vulnerability will affe… |
CVE-2023-52536 | Medium | 4.4 | 2024-04-08 | In faceid service, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privi… |
CVE-2023-52535 | Medium | 4.4 | 2024-04-08 | In vsp driver, there is a possible missing verification incorrect input. This could lead to local denial of service with no additional execution privileges nee… |
CVE-2023-52534 | Medium | 5.9 | 2024-04-08 | In ngmm, there is a possible undefined behavior due to incorrect error handling. This could lead to remote denial of service with no additional execution privi… |
CVE-2023-52533 | Medium | 5.3 | 2024-04-08 | In modem-ps-nas-ngmm, there is a possible undefined behavior due to incorrect error handling. This could lead to remote information disclosure no additional ex… |
CVE-2023-52352 | Medium | 5.5 | 2024-04-08 | In Network Adapter Service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges ne… |
CVE-2023-52351 | High | 7.8 | 2024-04-08 | In ril service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privile… |
CVE-2023-52350 | Medium | 4.4 | 2024-04-08 | In ril service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privile… |
CVE-2023-52349 | Medium | 4.4 | 2024-04-08 | In ril service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privile… |
CVE-2023-52348 | Medium | 4.4 | 2024-04-08 | In ril service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privile… |
CVE-2023-52347 | Medium | 5.5 | 2024-04-08 | In ril service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privile… |
CVE-2023-52346 | Medium | 4.4 | 2024-04-08 | In modem driver, there is a possible system crash due to improper input validation. This could lead to local information disclosure with System execution privi… |
CVE-2023-52345 | Medium | 6.0 | 2024-04-08 | In modem driver, there is a possible system crash due to improper input validation. This could lead to local information disclosure with System execution privi… |
CVE-2023-52344 | Medium | 5.3 | 2024-04-08 | In modem-ps-nas-ngmm, there is a possible undefined behavior due to incorrect error handling. This could lead to remote information disclosure no additional ex… |
CVE-2023-52343 | Medium | 5.5 | 2024-04-08 | In SecurityCommand message after as security has been actived., there is a possible improper input validation. This could lead to remote information disclosure… |
CVE-2023-52342 | High | 7.5 | 2024-04-08 | In modem-ps-nas-ngmm, there is a possible undefined behavior due to incorrect error handling. This could lead to remote information disclosure no additional ex… |
CVE-2023-52341 | High | 7.5 | 2024-04-08 | In Plaintext COUNTER CHECK message accepted before AS security activation, there is a possible missing permission check. This could lead to remote information… |
CVE-2023-52717 | Medium | 5.3 | 2024-04-07 | Permission verification vulnerability in the lock screen module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52716 | High | 7.5 | 2024-04-07 | Vulnerability of starting activities in the background in the ActivityManagerService (AMS) module. Impact: Successful exploitation of this vulnerability will a… |
CVE-2023-52715 | High | 7.5 | 2024-04-07 | The SystemUI module has a vulnerability in permission management. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2023-52714 | High | 7.5 | 2024-04-07 | Vulnerability of defects introduced in the design process in the hwnff module. Impact: Successful exploitation of this vulnerability may affect service confide… |
CVE-2023-52713 | High | 7.7 | 2024-04-07 | Vulnerability of improper permission control in the window management module. Impact: Successful exploitation of this vulnerability will affect availability an… |
CVE-2023-6877 | Medium | 6.4 | 2024-04-07 | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Script… |
CVE-2023-5912 | Medium | 6.7 | 2024-04-05 | A potential memory leakage vulnerability was reported in some Lenovo Notebook products that may allow a local attacker with elevated privileges to write to NV… |
CVE-2023-4605 | Medium | 6.5 | 2024-04-05 | A valid authenticated Lenovo XClarity Administrator (LXCA) user can potentially leverage an unauthenticated API endpoint to retrieve system event information… |
CVE-2023-25494 | Medium | 6.7 | 2024-04-05 | A potential vulnerability were reported in the BIOS of some Desktop, Smart Edge, and ThinkStation products that could allow a local attacker with elevated pri… |
CVE-2023-25493 | Medium | 6.7 | 2024-04-05 | A potential vulnerability was reported in the BIOS update tool driver for some Desktop, Smart Edge, Smart Office, and ThinkStation products that could allow a… |
CVE-2023-31028 | Low | 2.8 | 2024-04-05 | NVIDIA nvJPEG2000 Library for Windows and Linux contains a vulnerability where improper input validation might enable an attacker to use a specially crafted i… |
CVE-2023-48426 | Critical | 10.0 | 2024-04-05 | u-boot bug that allows for u-boot shell and interrupt over UART |
CVE-2023-49965 | Medium | 6.8 | 2024-04-05 | SpaceX Starlink Wi-Fi router Gen 2 before 2023.48.0 allows XSS via the ssid and password parameters on the Setup Page. |
CVE-2023-5692 | Medium | 5.3 | 2024-04-05 | WordPress Core is vulnerable to Sensitive Information Exposure in versions up to, and including, 6.4.3 via the redirect_guess_404_permalink function. This can… |
CVE-2023-6523 | High | 8.8 | 2024-04-05 | Authorization Bypass Through User-Controlled Key vulnerability in ExtremePacs Extreme XDS allows Authentication Abuse. This issue affects Extreme XDS: before… |
CVE-2023-6522 | High | 7.2 | 2024-04-05 | Incorrect Use of Privileged APIs vulnerability in ExtremePacs Extreme XDS allows Collect Data as Provided by Users. This issue affects Extreme XDS: before 391… |
CVE-2023-52235 | High | 8.8 | 2024-04-05 | SpaceX Starlink Wi-Fi router GEN 2 before 2023.53.0 and Starlink Dish before 07dd2798-ff15-4722-a9ee-de28928aed34 allow CSRF (e.g., for a reboot) via a DNS Reb… |
CVE-2023-5973 | Medium | 4.3 | 2024-04-05 | Brocade Web Interface in Brocade Fabric OS v9.x and before v9.2.0 does not properly represent the portName to the user if the portName contains reserved cha… |
CVE-2023-45288 | High | 7.5 | 2024-04-04 | An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK stat… |
CVE-2023-38709 | High | 7.3 | 2024-04-04 | Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HT… |
CVE-2023-3454 | High | 8.6 | 2024-04-04 | Remote code execution (RCE) vulnerability in Brocade Fabric OS after v9.0 and before v9.2.0 could allow an attacker to execute arbitrary code and use this to g… |
CVE-2023-36645 | Critical | 9.1 | 2024-04-04 | SQL injection vulnerability in ITB-GmbH TradePro v9.5, allows remote attackers to run SQL queries via oordershow component in customer function. |
CVE-2023-36644 | High | 7.5 | 2024-04-04 | Incorrect Access Control in ITB-GmbH TradePro v9.5, allows remote attackers to receive all order confirmations from the online shop via the printmail plugin. |
CVE-2023-36643 | High | 7.5 | 2024-04-04 | Incorrect Access Control in ITB-GmbH TradePro v9.5, allows remote attackers to receive all orders from the online shop via oordershow component in customer fun… |
CVE-2023-25200 | Medium | 4.7 | 2024-04-04 | An HTML injection vulnerability exists in the MT Safeline X-Ray X3310 webserver version NXG 19.05 that enables a remote attacker to render malicious HTML and o… |
CVE-2023-25199 | Medium | 5.4 | 2024-04-04 | A reflected cross-site scripting (XSS) vulnerability exists in the MT Safeline X-Ray X3310 webserver version NXG 19.05 that enables a remote attacker to execut… |
CVE-2023-52043 | High | 8.1 | 2024-04-03 | An issue in D-Link COVR 1100, 1102, 1103 AC1200 Dual-Band Whole-Home Mesh Wi-Fi System (Hardware Rev B1) truncates Wireless Access Point Passwords (WPA-PSK) al… |
CVE-2023-52641 | Medium | 5.5 | 2024-04-03 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add NULL ptr dereference checking at the end of attr_allocate_frame() It is pre… |
CVE-2023-52640 | High | 7.1 | 2024-04-03 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix oob in ntfs_listxattr The length of name cannot exceed the space occupied b… |
CVE-2023-45552 | Medium | 6.5 | 2024-04-03 | In VeridiumID before 3.5.0, a stored cross-site scripting (XSS) vulnerability has been discovered in the admin portal that allows an authenticated attacker to… |
CVE-2023-44040 | Medium | 6.1 | 2024-04-03 | In VeridiumID before 3.5.0, the identity provider page is susceptible to a cross-site scripting (XSS) vulnerability that can be exploited by an internal unauth… |
CVE-2023-44038 | Medium | 6.5 | 2024-04-03 | In VeridiumID before 3.5.0, the identity provider page allows an unauthenticated attacker to discover information about registered users via an LDAP injection… |
CVE-2023-35812 | Medium | 5.3 | 2024-04-03 | An issue was discovered in the Amazon Linux packages of OpenSSH 7.4 for Amazon Linux 1 and 2, because of an incomplete fix for CVE-2019-6111 within these speci… |
CVE-2023-44039 | Critical | 9.1 | 2024-04-03 | In VeridiumID before 3.5.0, the WebAuthn API allows an internal unauthenticated attacker (who can pass enrollment verifications and is allowed to enroll a FIDO… |
CVE-2023-52639 | Medium | 4.7 | 2024-04-03 | In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: fix race during shadow creation Right now it is possible to see gmap->pr… |
CVE-2023-52638 | Medium | 5.5 | 2024-04-03 | In the Linux kernel, the following vulnerability has been resolved: can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock The following 3 locks… |
CVE-2023-52637 | High | 7.8 | 2024-04-03 | In the Linux kernel, the following vulnerability has been resolved: can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER) Lock jsk-… |
CVE-2023-52296 | Medium | 5.3 | 2024-04-03 | IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to denial of service when querying a specific UDF built-in function concur… |
CVE-2023-38729 | Medium | 6.8 | 2024-04-03 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to sensitive information disclosure when using ADMIN_CMD w… |
CVE-2023-25699 | Critical | 9.0 | 2024-04-03 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in VideoWhisper.Com VideoWhisper Live Streaming Integr… |
CVE-2023-35764 | Medium | 5.3 | 2024-04-03 | Insufficient verification of data authenticity issue in Survey Maker prior to 3.6.4 allows a remote unauthenticated attacker to spoof an IP address when postin… |
CVE-2023-34423 | Medium | 6.1 | 2024-04-03 | Survey Maker prior to 3.6.4 contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on th… |
CVE-2023-50313 | Medium | 5.3 | 2024-04-02 | IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security for outbound TLS connections caused by a failure to honor user configu… |
CVE-2023-6951 | Medium | 6.6 | 2024-04-02 | A Use of Weak Credentials vulnerability affecting the Wi-Fi network generated by a set of DJI drones could allow a remote attacker to derive the WPA2 PSK key a… |
CVE-2023-6950 | Low | 3.0 | 2024-04-02 | An Improper Input Validation vulnerability affecting the FTP service running on the DJI Mavic Mini 3 Pro could allow an attacker to craft a malicious packet co… |
CVE-2023-6949 | Medium | 5.2 | 2024-04-02 | A Missing Authentication for Critical Function issue affecting the HTTP service running on the DJI Mavic Mini 3 Pro on the standard port 80 could allow an atta… |
CVE-2023-6948 | Low | 3.0 | 2024-04-02 | A Buffer Copy without Checking Size of Input issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker… |
CVE-2023-51456 | Medium | 6.8 | 2024-04-02 | A Improper Input Validation issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to trigger an ou… |
CVE-2023-51455 | Medium | 6.8 | 2024-04-02 | A Improper Validation of Array Index issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to corr… |
CVE-2023-51454 | Medium | 6.8 | 2024-04-02 | A Out-of-bounds Write issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to overwrite a pointer… |
CVE-2023-51453 | Low | 3.0 | 2024-04-02 | A Improper Input Validation issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to cause a crash… |
CVE-2023-51452 | Low | 3.0 | 2024-04-02 | A Improper Input Validation issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to cause a crash… |
CVE-2023-52636 | High | 8.2 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: libceph: just wait for more data to be available on the socket A short read may occur whi… |
CVE-2023-52635 | Medium | 5.5 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: Synchronize devfreq_monitor_[start/stop] There is a chance if a frequent sw… |
CVE-2023-52634 | Medium | 5.5 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix disable_otg_wa logic [Why] When switching to another HDMI mode, we a… |
CVE-2023-52633 | Medium | 5.0 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: um: time-travel: fix time corruption In 'basic' time-travel mode (without =inf-cpu or =ex… |
CVE-2023-52632 | Medium | 5.5 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix lock dependency warning with srcu =======================================… |
CVE-2023-52631 | Medium | 5.5 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix an NULL dereference bug The issue here is when this is called from ntfs_loa… |
CVE-2023-51573 | Critical | 9.8 | 2024-04-01 | Voltronic Power ViewPower Pro updateManagerPassword Exposed Dangerous Function Authentication Bypass Vulnerability. This vulnerability allows remote attackers… |
CVE-2023-51572 | Critical | 9.8 | 2024-04-01 | Voltronic Power ViewPower Pro getMacAddressByIp Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute ar… |
CVE-2023-51571 | High | 7.5 | 2024-04-01 | Voltronic Power ViewPower Pro SocketService Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a deni… |
CVE-2023-51570 | Critical | 9.8 | 2024-04-01 | Voltronic Power ViewPower Pro Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbi… |
CVE-2023-48906 | Medium | 4.3 | 2024-04-01 | Stack Overflow vulnerability in Btstack 1.6 and earlier allows attackers to cause a denial of service via crafted input to the char_for_nibble function. |
CVE-2023-43515 | Medium | 6.6 | 2024-04-01 | Memory corruption in HLOS while running kernel address sanitizers (syzkaller) on tmecom with DEBUG_FS enabled. |
CVE-2023-33115 | High | 7.8 | 2024-04-01 | Memory corruption while processing buffer initialization, when trusted report for certain report types are generated. |
CVE-2023-33111 | Medium | 5.5 | 2024-04-01 | Information disclosure when VI calibration state set by ADSP is greater than MAX_FBSP_STATE in the response payload to AFE calibration command. |
CVE-2023-33101 | High | 7.5 | 2024-04-01 | Transient DOS while processing DL NAS TRANSPORT message with payload length 0. |
CVE-2023-33100 | High | 7.5 | 2024-04-01 | Transient DOS while processing DL NAS Transport message when message ID is not defined in the 3GPP specification. |
CVE-2023-33099 | High | 7.5 | 2024-04-01 | Transient DOS while processing SMS container of non-standard size received in DL NAS transport in NR. |
CVE-2023-33023 | High | 8.4 | 2024-04-01 | Memory corruption while processing finish_sign command to pass a rsp buffer. |
CVE-2023-28547 | High | 8.4 | 2024-04-01 | Memory corruption in SPS Application while requesting for public key in sorter TA. |
CVE-2023-6154 | High | 7.8 | 2024-04-01 | A configuration setting issue in seccenter.exe as used in Bitdefender Total Security, Bitdefender Internet Security, Bitdefender Antivirus Plus, Bitdefender An… |
CVE-2023-51803 | Critical | 9.8 | 2024-04-01 | LinuxServer.io Heimdall before 2.5.7 does not prevent use of icons that have non-image data such as the "<?php ?>" substring. |
CVE-2023-50959 | Medium | 5.3 | 2024-03-31 | IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2,19.0.1, 19.0.2, 19.0.3,20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1,2 2.0.2, 23.0.1, and… |
CVE-2023-50311 | Low | 3.1 | 2024-03-31 | IBM CICS Transaction Gateway for Multiplatforms 9.2 and 9.3 could disclose sensitive path information to an attacker that could reveal through debugging or err… |
CVE-2023-46808 | Critical | 9.9 | 2024-03-31 | An file upload vulnerability in Ivanti ITSM before 2023.4, allows an authenticated remote user to perform file writes to the server. Successful exploitation ma… |
CVE-2023-41724 | High | 8.8 | 2024-03-31 | A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operatin… |