2023 CVEs (page 47)
Page 47 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-25200 | Medium | 4.7 | 2024-04-04 | An HTML injection vulnerability exists in the MT Safeline X-Ray X3310 webserver version NXG 19.05 that enables a remote attacker to render malicious HTML and o… |
CVE-2023-25199 | Medium | 5.4 | 2024-04-04 | A reflected cross-site scripting (XSS) vulnerability exists in the MT Safeline X-Ray X3310 webserver version NXG 19.05 that enables a remote attacker to execut… |
CVE-2023-52043 | High | 8.1 | 2024-04-03 | An issue in D-Link COVR 1100, 1102, 1103 AC1200 Dual-Band Whole-Home Mesh Wi-Fi System (Hardware Rev B1) truncates Wireless Access Point Passwords (WPA-PSK) al… |
CVE-2023-52641 | Medium | 5.5 | 2024-04-03 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add NULL ptr dereference checking at the end of attr_allocate_frame() It is pre… |
CVE-2023-52640 | High | 7.1 | 2024-04-03 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix oob in ntfs_listxattr The length of name cannot exceed the space occupied b… |
CVE-2023-45552 | Medium | 6.5 | 2024-04-03 | In VeridiumID before 3.5.0, a stored cross-site scripting (XSS) vulnerability has been discovered in the admin portal that allows an authenticated attacker to… |
CVE-2023-44040 | Medium | 6.1 | 2024-04-03 | In VeridiumID before 3.5.0, the identity provider page is susceptible to a cross-site scripting (XSS) vulnerability that can be exploited by an internal unauth… |
CVE-2023-44038 | Medium | 6.5 | 2024-04-03 | In VeridiumID before 3.5.0, the identity provider page allows an unauthenticated attacker to discover information about registered users via an LDAP injection… |
CVE-2023-35812 | Medium | 5.3 | 2024-04-03 | An issue was discovered in the Amazon Linux packages of OpenSSH 7.4 for Amazon Linux 1 and 2, because of an incomplete fix for CVE-2019-6111 within these speci… |
CVE-2023-44039 | Critical | 9.1 | 2024-04-03 | In VeridiumID before 3.5.0, the WebAuthn API allows an internal unauthenticated attacker (who can pass enrollment verifications and is allowed to enroll a FIDO… |
CVE-2023-52639 | Medium | 4.7 | 2024-04-03 | In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: fix race during shadow creation Right now it is possible to see gmap->pr… |
CVE-2023-52638 | Medium | 5.5 | 2024-04-03 | In the Linux kernel, the following vulnerability has been resolved: can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock The following 3 locks… |
CVE-2023-52637 | High | 7.8 | 2024-04-03 | In the Linux kernel, the following vulnerability has been resolved: can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER) Lock jsk-… |
CVE-2023-52296 | Medium | 5.3 | 2024-04-03 | IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to denial of service when querying a specific UDF built-in function concur… |
CVE-2023-38729 | Medium | 6.8 | 2024-04-03 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to sensitive information disclosure when using ADMIN_CMD w… |
CVE-2023-25699 | Critical | 9.0 | 2024-04-03 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in VideoWhisper.Com VideoWhisper Live Streaming Integr… |
CVE-2023-35764 | Medium | 5.3 | 2024-04-03 | Insufficient verification of data authenticity issue in Survey Maker prior to 3.6.4 allows a remote unauthenticated attacker to spoof an IP address when postin… |
CVE-2023-34423 | Medium | 6.1 | 2024-04-03 | Survey Maker prior to 3.6.4 contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on th… |
CVE-2023-50313 | Medium | 5.3 | 2024-04-02 | IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security for outbound TLS connections caused by a failure to honor user configu… |
CVE-2023-6951 | Medium | 6.6 | 2024-04-02 | A Use of Weak Credentials vulnerability affecting the Wi-Fi network generated by a set of DJI drones could allow a remote attacker to derive the WPA2 PSK key a… |
CVE-2023-6950 | Low | 3.0 | 2024-04-02 | An Improper Input Validation vulnerability affecting the FTP service running on the DJI Mavic Mini 3 Pro could allow an attacker to craft a malicious packet co… |
CVE-2023-6949 | Medium | 5.2 | 2024-04-02 | A Missing Authentication for Critical Function issue affecting the HTTP service running on the DJI Mavic Mini 3 Pro on the standard port 80 could allow an atta… |
CVE-2023-6948 | Low | 3.0 | 2024-04-02 | A Buffer Copy without Checking Size of Input issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker… |
CVE-2023-51456 | Medium | 6.8 | 2024-04-02 | A Improper Input Validation issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to trigger an ou… |
CVE-2023-51455 | Medium | 6.8 | 2024-04-02 | A Improper Validation of Array Index issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to corr… |
CVE-2023-51454 | Medium | 6.8 | 2024-04-02 | A Out-of-bounds Write issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to overwrite a pointer… |
CVE-2023-51453 | Low | 3.0 | 2024-04-02 | A Improper Input Validation issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to cause a crash… |
CVE-2023-51452 | Low | 3.0 | 2024-04-02 | A Improper Input Validation issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to cause a crash… |
CVE-2023-52636 | High | 8.2 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: libceph: just wait for more data to be available on the socket A short read may occur whi… |
CVE-2023-52635 | Medium | 5.5 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: Synchronize devfreq_monitor_[start/stop] There is a chance if a frequent sw… |
CVE-2023-52634 | Medium | 5.5 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix disable_otg_wa logic [Why] When switching to another HDMI mode, we a… |
CVE-2023-52633 | Medium | 5.0 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: um: time-travel: fix time corruption In 'basic' time-travel mode (without =inf-cpu or =ex… |
CVE-2023-52632 | Medium | 5.5 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix lock dependency warning with srcu =======================================… |
CVE-2023-52631 | Medium | 5.5 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix an NULL dereference bug The issue here is when this is called from ntfs_loa… |
CVE-2023-51573 | Critical | 9.8 | 2024-04-01 | Voltronic Power ViewPower Pro updateManagerPassword Exposed Dangerous Function Authentication Bypass Vulnerability. This vulnerability allows remote attackers… |
CVE-2023-51572 | Critical | 9.8 | 2024-04-01 | Voltronic Power ViewPower Pro getMacAddressByIp Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute ar… |
CVE-2023-51571 | High | 7.5 | 2024-04-01 | Voltronic Power ViewPower Pro SocketService Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a deni… |
CVE-2023-51570 | Critical | 9.8 | 2024-04-01 | Voltronic Power ViewPower Pro Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbi… |
CVE-2023-48906 | Medium | 4.3 | 2024-04-01 | Stack Overflow vulnerability in Btstack 1.6 and earlier allows attackers to cause a denial of service via crafted input to the char_for_nibble function. |
CVE-2023-43515 | Medium | 6.6 | 2024-04-01 | Memory corruption in HLOS while running kernel address sanitizers (syzkaller) on tmecom with DEBUG_FS enabled. |
CVE-2023-33115 | High | 7.8 | 2024-04-01 | Memory corruption while processing buffer initialization, when trusted report for certain report types are generated. |
CVE-2023-33111 | Medium | 5.5 | 2024-04-01 | Information disclosure when VI calibration state set by ADSP is greater than MAX_FBSP_STATE in the response payload to AFE calibration command. |
CVE-2023-33101 | High | 7.5 | 2024-04-01 | Transient DOS while processing DL NAS TRANSPORT message with payload length 0. |
CVE-2023-33100 | High | 7.5 | 2024-04-01 | Transient DOS while processing DL NAS Transport message when message ID is not defined in the 3GPP specification. |
CVE-2023-33099 | High | 7.5 | 2024-04-01 | Transient DOS while processing SMS container of non-standard size received in DL NAS transport in NR. |
CVE-2023-33023 | High | 8.4 | 2024-04-01 | Memory corruption while processing finish_sign command to pass a rsp buffer. |
CVE-2023-28547 | High | 8.4 | 2024-04-01 | Memory corruption in SPS Application while requesting for public key in sorter TA. |
CVE-2023-6154 | High | 7.8 | 2024-04-01 | A configuration setting issue in seccenter.exe as used in Bitdefender Total Security, Bitdefender Internet Security, Bitdefender Antivirus Plus, Bitdefender An… |
CVE-2023-51803 | Critical | 9.8 | 2024-04-01 | LinuxServer.io Heimdall before 2.5.7 does not prevent use of icons that have non-image data such as the "<?php ?>" substring. |
CVE-2023-50959 | Medium | 5.3 | 2024-03-31 | IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2,19.0.1, 19.0.2, 19.0.3,20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1,2 2.0.2, 23.0.1, and… |
CVE-2023-50311 | Low | 3.1 | 2024-03-31 | IBM CICS Transaction Gateway for Multiplatforms 9.2 and 9.3 could disclose sensitive path information to an attacker that could reveal through debugging or err… |
CVE-2023-46808 | Critical | 9.9 | 2024-03-31 | An file upload vulnerability in Ivanti ITSM before 2023.4, allows an authenticated remote user to perform file writes to the server. Successful exploitation ma… |
CVE-2023-41724 | High | 8.8 | 2024-03-31 | A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operatin… |
CVE-2023-49234 | Medium | 6.3 | 2024-03-29 | An XML external entity (XXE) vulnerability was found in Stilog Visual Planning 8. It allows an authenticated attacker to access local server files and exfiltra… |
CVE-2023-49232 | Critical | 9.8 | 2024-03-29 | An authentication bypass vulnerability was found in Stilog Visual Planning 8. It allows an unauthenticated attacker to brute-force the password reset PINs of a… |
CVE-2023-49231 | Critical | 9.8 | 2024-03-29 | An authentication bypass vulnerability was found in Stilog Visual Planning 8. It allows an unauthenticated attacker to receive an administrative API token. |
CVE-2023-6191 | Critical | 9.8 | 2024-03-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Egehan Security WebPDKS allows SQL Injection. This issue… |
CVE-2023-6047 | Medium | 6.1 | 2024-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Algoritim E-commerce Software allows Reflected XSS. This… |
CVE-2023-52629 | High | 8.4 | 2024-03-29 | In the Linux kernel, the following vulnerability has been resolved: sh: push-switch: Reorder cleanup operations to avoid use-after-free bug The original code… |
CVE-2023-50969 | Critical | 9.8 | 2024-03-28 | Thales Imperva SecureSphere WAF 14.7.0.40 allows remote attackers to bypass WAF rules via a crafted POST request, a different vulnerability than CVE-2021-45468. |
CVE-2023-33528 | Medium | 6.1 | 2024-03-28 | halo v1.6.0 is vulnerable to Cross Site Scripting (XSS). |
CVE-2023-25341 | Medium | 6.5 | 2024-03-28 | A Directory Traversal vulnerability in ladle dev server 2.5.1 and earlier allows an attacker on the same network to read files accessible to the user via GET r… |
CVE-2023-42974 | High | 7.0 | 2024-03-28 | A race condition was addressed with improved state handling. This issue is fixed in macOS Monterey 12.7.2, macOS Ventura 13.6.3, iOS 17.2 and iPadOS 17.2, iOS… |
CVE-2023-42962 | High | 7.5 | 2024-03-28 | This issue was addressed with improved checks This issue is fixed in iOS 17.2 and iPadOS 17.2, iOS 16.7.3 and iPadOS 16.7.3. A remote attacker may be able to c… |
CVE-2023-42956 | Medium | 6.5 | 2024-03-28 | The issue was addressed with improved memory handling. This issue is fixed in Safari 17.2, iOS 17.2 and iPadOS 17.2, macOS Sonoma 14.2. Processing web content… |
CVE-2023-42950 | High | 8.8 | 2024-03-28 | A use after free issue was addressed with improved memory management. This issue is fixed in Safari 17.2, iOS 17.2 and iPadOS 17.2, tvOS 17.2, watchOS 10.2, ma… |
CVE-2023-42947 | High | 8.6 | 2024-03-28 | A path handling issue was addressed with improved validation. This issue is fixed in macOS Monterey 12.7.2, macOS Ventura 13.6.3, iOS 17.2 and iPadOS 17.2, tvO… |
CVE-2023-42936 | Medium | 5.5 | 2024-03-28 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Monterey 12.7.2, macOS Ventura 13.6.3, iOS 17.2 and iPa… |
CVE-2023-42931 | High | 7.8 | 2024-03-28 | The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.6.3, macOS Sonoma 14.2, macOS Monterey 12.7.2. A process may gain admin p… |
CVE-2023-42930 | Medium | 5.5 | 2024-03-28 | This issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.6.3, macOS Sonoma 14.2, macOS Monterey 12.7.2. An app may be able to mod… |
CVE-2023-42913 | High | 8.8 | 2024-03-28 | This issue was addressed through improved state management. This issue is fixed in macOS Sonoma 14.2. Remote Login sessions may be able to obtain full disk acc… |
CVE-2023-42896 | Medium | 5.5 | 2024-03-28 | An issue was addressed with improved handling of temporary files. This issue is fixed in macOS Monterey 12.7.2, macOS Ventura 13.6.3, iOS 17.2 and iPadOS 17.2… |
CVE-2023-42893 | Medium | 5.5 | 2024-03-28 | A permissions issue was addressed by removing vulnerable code and adding additional checks. This issue is fixed in macOS Monterey 12.7.2, macOS Ventura 13.6.3… |
CVE-2023-42892 | High | 7.8 | 2024-03-28 | A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.6.3, macOS Sonoma 14.2, macOS Monterey 12.7.2. A… |
CVE-2023-40390 | Medium | 5.5 | 2024-03-28 | A privacy issue was addressed by moving sensitive data to a protected location. This issue is fixed in macOS Sonoma 14.2. An app may be able to access user-sen… |
CVE-2023-45715 | Low | 3.5 | 2024-03-28 | The console may experience a service interruption when processing file names with invalid characters. |
CVE-2023-45706 | Low | 2.0 | 2024-03-28 | An administrative user of WebReports may perform a Cross Site Scripting (XSS) and/or Man in the Middle (MITM) exploit through SAML configuration. |
CVE-2023-45705 | Low | 3.5 | 2024-03-28 | An administrative user of WebReports may perform a Server Side Request Forgery (SSRF) exploit through SMTP configuration options. |
CVE-2023-6437 | Critical | 9.8 | 2024-03-28 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TP-Link TP-Link EX20v AX1800, Tp-Link Archer C5v AC… |
CVE-2023-6371 | High | 8.7 | 2024-03-28 | An issue has been discovered in GitLab CE/EE affecting all versions before 16.8.5, all versions starting from 16.9 before 16.9.3, all versions starting from 16… |
CVE-2023-52628 | High | 7.8 | 2024-03-28 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: exthdr: fix 4-byte stack OOB write If priv->len is a multiple of 4… |
CVE-2023-52234 | Medium | 6.5 | 2024-03-28 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Booster Booster Elite for WooCommerce.This issue affects Booster Elite for WooComme… |
CVE-2023-52231 | Medium | 6.5 | 2024-03-28 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Booster Booster Plus for WooCommerce.This issue affects Booster Plus for WooCommerc… |
CVE-2023-50374 | Medium | 5.5 | 2024-03-28 | Server-Side Request Forgery (SSRF) vulnerability in NiteoThemes CMP – Coming Soon & Maintenance.This issue affects CMP – Coming Soon & Maintenance: from n/a th… |
CVE-2023-39309 | High | 8.5 | 2024-03-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThemeFusion Fusion Builder.This issue affects Fusion Buil… |
CVE-2023-23649 | High | 8.1 | 2024-03-28 | Deserialization of Untrusted Data vulnerability in MainWP MainWP Links Manager Extension.This issue affects MainWP Links Manager Extension: from n/a through 2… |
CVE-2023-39313 | High | 7.7 | 2024-03-28 | Server-Side Request Forgery (SSRF) vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1. |
CVE-2023-36679 | High | 7.1 | 2024-03-28 | Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Spectra.This issue affects Spectra: from n/a through 2.6.6. |
CVE-2023-34370 | High | 7.1 | 2024-03-28 | Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Starter Templates — Elementor, WordPress & Beaver Builder Templates, Brainstorm Force Prem… |
CVE-2023-47438 | Medium | 6.5 | 2024-03-27 | SQL Injection vulnerability in Reportico Till 8.1.0 allows attackers to obtain sensitive information or other system information via the project parameter. |
CVE-2023-0582 | High | 8.1 | 2024-03-27 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ForgeRock Access Management allows Authorization Bypass. This… |
CVE-2023-44999 | Medium | 5.4 | 2024-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Stripe Payment Gateway.This issue affects WooCommerce Stripe Payment Gateway: from n… |
CVE-2023-39311 | High | 7.1 | 2024-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Fusion Builder.This issue affects Fusion Builder: from n/a through 3.11.1. |
CVE-2023-34020 | Medium | 4.7 | 2024-03-27 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash.This issue affects Uncanny Toolkit for LearnDash… |
CVE-2023-6400 | High | 7.4 | 2024-03-27 | Incorrect Authorization vulnerability in OpenText™ ZENworks Configuration Management (ZCM) allows Unauthorized Use of Device Resources.This issue affects ZENwo… |
CVE-2023-6153 | Critical | 9.8 | 2024-03-27 | Authentication Bypass by Primary Weakness vulnerability in TeoSOFT Software TeoBASE allows Authentication Bypass. This issue affects TeoBASE: through 20240327… |
CVE-2023-50961 | Medium | 4.8 | 2024-03-27 | IBM QRadar SIEM 7.5 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2023-6173 | Critical | 9.8 | 2024-03-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeoSOFT Software TeoBASE allows SQL Injection. This issu… |
CVE-2023-43768 | High | 7.5 | 2024-03-27 | An issue was discovered in Couchbase Server 6.6.x through 7.2.0, before 7.1.5 and 7.2.1. Unauthenticated users may cause memcached to run out of memory via lar… |
CVE-2023-25364 | Medium | 6.1 | 2024-03-27 | Opswat Metadefender Core before 5.2.1 does not properly defend against potential HTML injection and XSS attacks. |