2023 CVEs (page 51)
Page 51 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-50167 | Medium | 5.4 | 2024-03-06 | Pega Platform from 7.1.7 to 23.1.1 is affected by an XSS issue with editing/rendering user html content. |
CVE-2023-50740 | Medium | 5.3 | 2024-03-06 | In Apache Linkis <=1.4.0, The password is printed to the log when using the Oracle data source of the Linkis data source module. We recommend users upgrade th… |
CVE-2023-52607 | Medium | 5.5 | 2024-03-06 | In the Linux kernel, the following vulnerability has been resolved: powerpc/mm: Fix null-pointer dereference in pgtable_cache_add kasprintf() returns a point… |
CVE-2023-52606 | High | 7.8 | 2024-03-06 | In the Linux kernel, the following vulnerability has been resolved: powerpc/lib: Validate size for vector operations Some of the fp/vmx code in sstep.c assum… |
CVE-2023-52604 | High | 7.8 | 2024-03-06 | In the Linux kernel, the following vulnerability has been resolved: FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree Syzkaller reported the following issu… |
CVE-2023-52603 | High | 7.8 | 2024-03-06 | In the Linux kernel, the following vulnerability has been resolved: UBSAN: array-index-out-of-bounds in dtSplitRoot Syzkaller reported the following issue: … |
CVE-2023-52602 | High | 7.8 | 2024-03-06 | In the Linux kernel, the following vulnerability has been resolved: jfs: fix slab-out-of-bounds Read in dtSearch Currently while searching for current page i… |
CVE-2023-52601 | High | 7.8 | 2024-03-06 | In the Linux kernel, the following vulnerability has been resolved: jfs: fix array-index-out-of-bounds in dbAdjTree Currently there is a bound check missing… |
CVE-2023-52600 | High | 7.8 | 2024-03-06 | In the Linux kernel, the following vulnerability has been resolved: jfs: fix uaf in jfs_evict_inode When the execution of diMount(ipimap) fails, the object i… |
CVE-2023-52599 | High | 7.8 | 2024-03-06 | In the Linux kernel, the following vulnerability has been resolved: jfs: fix array-index-out-of-bounds in diNewExt [Syz report] UBSAN: array-index-out-of-bou… |
CVE-2023-52598 | High | 7.1 | 2024-03-06 | In the Linux kernel, the following vulnerability has been resolved: s390/ptrace: handle setting of fpc register correctly If the content of the floating poin… |
CVE-2023-52597 | Medium | 4.0 | 2024-03-06 | In the Linux kernel, the following vulnerability has been resolved: KVM: s390: fix setting of fpc register kvm_arch_vcpu_ioctl_set_fpu() allows to set the fl… |
CVE-2023-52596 | Medium | 5.5 | 2024-03-06 | In the Linux kernel, the following vulnerability has been resolved: sysctl: Fix out of bounds access for empty sysctl registers When registering tables to th… |
CVE-2023-52595 | Medium | 5.5 | 2024-03-06 | In the Linux kernel, the following vulnerability has been resolved: wifi: rt2x00: restart beacon queue when hardware reset When a hardware reset is triggered… |
CVE-2023-52594 | High | 7.8 | 2024-03-06 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() Fix an… |
CVE-2023-52593 | Medium | 5.5 | 2024-03-06 | In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap() Since 'ieee80211_bea… |
CVE-2023-52591 | High | 7.8 | 2024-03-06 | In the Linux kernel, the following vulnerability has been resolved: reiserfs: Avoid touching renamed directory if parent does not change The VFS will not be… |
CVE-2023-52590 | High | 7.8 | 2024-03-06 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: Avoid touching renamed directory if parent does not change The VFS will not be loc… |
CVE-2023-52589 | Medium | 4.7 | 2024-03-06 | In the Linux kernel, the following vulnerability has been resolved: media: rkisp1: Fix IRQ disable race issue In rkisp1_isp_stop() and rkisp1_csi_disable() t… |
CVE-2023-52588 | High | 7.3 | 2024-03-06 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to tag gcing flag on page during block migration It needs to add missing gcing… |
CVE-2023-52587 | Medium | 5.5 | 2024-03-06 | In the Linux kernel, the following vulnerability has been resolved: IB/ipoib: Fix mcast list locking Releasing the `priv->lock` while iterating the `priv->mu… |
CVE-2023-52586 | High | 7.8 | 2024-03-06 | In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: Add mutex lock in control vblank irq Add a mutex lock to control vblank irq… |
CVE-2023-52585 | Medium | 5.5 | 2024-03-06 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix possible NULL dereference in amdgpu_ras_query_error_status_helper() Retur… |
CVE-2023-52584 | Low | 3.8 | 2024-03-06 | In the Linux kernel, the following vulnerability has been resolved: spmi: mediatek: Fix UAF on device remove The pmif driver data that contains the clocks is… |
CVE-2023-52583 | Medium | 5.5 | 2024-03-06 | In the Linux kernel, the following vulnerability has been resolved: ceph: fix deadlock or deadcode of misusing dget() The lock order is incorrect between den… |
CVE-2023-49977 | Medium | 5.4 | 2024-03-06 | A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inject… |
CVE-2023-49976 | Medium | 5.4 | 2024-03-06 | A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inject… |
CVE-2023-49974 | Medium | 6.1 | 2024-03-06 | A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inject… |
CVE-2023-49973 | Medium | 6.1 | 2024-03-06 | A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inject… |
CVE-2023-49971 | Medium | 6.1 | 2024-03-06 | A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inject… |
CVE-2023-33677 | High | 7.5 | 2024-03-06 | Sourcecodester Lost and Found Information System's Version 1.0 is vulnerable to unauthenticated SQL Injection at "?page=items/view&id=*". |
CVE-2023-43318 | High | 8.8 | 2024-03-06 | TP-Link JetStream Smart Switch TL-SG2210P 5.0 Build 20211201 allows attackers to escalate privileges via modification of the 'tid' and 'usrlvl' values in GET r… |
CVE-2023-38946 | High | 8.8 | 2024-03-06 | An issue in Multilaser RE160 firmware v5.07.51_pt_MTL01 and v5.07.52_pt_MTL01 allows attackers to bypass the access control and gain complete access to the app… |
CVE-2023-38945 | Critical | 9.8 | 2024-03-06 | Multilaser RE160 v5.07.51_pt_MTL01 and v5.07.52_pt_MTL01, Multilaser RE160V v12.03.01.08_pt and V12.03.01.09_pt, and Multilaser RE163V v12.03.01.08_pt allows a… |
CVE-2023-38944 | Critical | 9.8 | 2024-03-06 | An issue in Multilaser RE160V firmware v12.03.01.09_pt and Multilaser RE163V firmware v12.03.01.10_pt allows attackers to bypass the access control and gain co… |
CVE-2023-48644 | Medium | 6.1 | 2024-03-05 | An issue was discovered in the Archibus app 4.0.3 for iOS. There is an XSS vulnerability in the create work request feature of the maintenance module, via the… |
CVE-2023-45290 | Medium | 6.5 | 2024-03-05 | When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFi… |
CVE-2023-45289 | Medium | 4.3 | 2024-03-05 | When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive head… |
CVE-2023-26282 | Medium | 4.2 | 2024-03-05 | IBM Watson CP4D Data Stores 4.6.0 through 4.6.3 could allow a user with physical access and specific knowledge of the system to modify files or data on the sys… |
CVE-2023-25681 | Medium | 5.3 | 2024-03-05 | LDAP users on IBM Spectrum Virtualize 8.5 which are configured to require multifactor authentication can still authenticate to the CIM interface using only use… |
CVE-2023-7103 | Critical | 9.8 | 2024-03-05 | Authentication Bypass by Primary Weakness vulnerability in ZKSoftware Biometric Security Solutions UFace 5 allows Authentication Bypass. This issue affects UF… |
CVE-2023-5457 | High | 7.5 | 2024-03-05 | A CWE-1269 “Product Released in Non-Release Configuration” vulnerability in the Django web framework used by the web application (due to the “debug” configurat… |
CVE-2023-45600 | Medium | 5.6 | 2024-03-05 | A CWE-613 “Insufficient Session Expiration” vulnerability in the web application, due to the session cookie “sessionid” lasting two weeks, facilitates session… |
CVE-2023-45599 | Medium | 5.5 | 2024-03-05 | A CWE-646 “Reliance on File Name or Extension of Externally-Supplied File” vulnerability in the “iec61850” functionality of the web application allows a remote… |
CVE-2023-45598 | Medium | 5.3 | 2024-03-05 | A CWE-425 “Direct Request ('Forced Browsing')” vulnerability in the “measure” functionality of the web application allows a remote unauthenticated attacker to… |
CVE-2023-45597 | Medium | 5.9 | 2024-03-05 | A CWE-1236 “Improper Neutralization of Formula Elements in a CSV File” vulnerability in the “file_configuration” functionality of the web application (concerni… |
CVE-2023-45596 | Medium | 5.3 | 2024-03-05 | A CWE-425 “Direct Request ('Forced Browsing')” vulnerability in the “file_configuration” functionality of the web application allows a remote unauthenticated a… |
CVE-2023-45595 | Medium | 5.9 | 2024-03-05 | A CWE-434 “Unrestricted Upload of File with Dangerous Type” vulnerability in the “file_configuration” functionality of the web application allows a remote auth… |
CVE-2023-45594 | Medium | 6.8 | 2024-03-05 | A CWE-552 “Files or Directories Accessible to External Parties” vulnerability in the embedded Chromium browser allows a physical attacker to arbitrarily downlo… |
CVE-2023-45593 | Medium | 6.8 | 2024-03-05 | A CWE-184 “Incomplete List of Disallowed Inputs” vulnerability in the embedded Chromium browser (concerning the handling of alternative URLs, other than “ http… |
CVE-2023-45592 | Medium | 6.8 | 2024-03-05 | A CWE-250 “Execution with Unnecessary Privileges” vulnerability in the embedded Chromium browser (due to the binary being executed with the “--no-sandbox” opti… |
CVE-2023-45591 | High | 7.5 | 2024-03-05 | A CWE-122 “Heap-based Buffer Overflow” vulnerability in the “logger_generic” function of the “Ax_rtu” binary allows a remote authenticated attacker to trigger… |
CVE-2023-5456 | High | 8.1 | 2024-03-05 | A CWE-798 “Use of Hard-coded Credentials” vulnerability in the MariaDB database of the web application allows a remote unauthenticated attacker to access the d… |
CVE-2023-42419 | Low | 3.8 | 2024-03-05 | Maintenance Server, in Cybellum's QCOW air-gapped distribution (China Edition), versions 2.15.5 through 2.27, was compiled with a hard-coded private cryptograp… |
CVE-2023-52432 | Medium | 5.9 | 2024-03-05 | Improper input validation in IpcTxSndSetLoopbackCtrl in libsec-ril prior to SMR Sep-2023 Release 1 allows local attackers to write out-of-bounds memory. |
CVE-2023-49970 | Critical | 9.8 | 2024-03-05 | Customer Support System v1 was discovered to contain a SQL injection vulnerability via the subject parameter at /customer_support/ajax.php?action=save_ticket. |
CVE-2023-49969 | Medium | 4.3 | 2024-03-05 | Customer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customer_support/index.php?page=edit_customer. |
CVE-2023-49968 | High | 7.3 | 2024-03-05 | Customer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customer_support/manage_department.php. |
CVE-2023-49548 | High | 8.8 | 2024-03-05 | Customer Support System v1 was discovered to contain a SQL injection vulnerability via the lastname parameter at /customer_support/ajax.php?action=save_user. |
CVE-2023-49547 | Critical | 9.8 | 2024-03-05 | Customer Support System v1 was discovered to contain a SQL injection vulnerability via the username parameter at /customer_support/ajax.php?action=login. |
CVE-2023-49546 | High | 8.8 | 2024-03-05 | Customer Support System v1 was discovered to contain a SQL injection vulnerability via the email parameter at /customer_support/ajax.php. |
CVE-2023-41829 | Medium | 5.0 | 2024-03-04 | An improper export vulnerability was reported in the Motorola Carrier Services application that could allow a malicious, local application to read files withou… |
CVE-2023-41827 | Medium | 5.1 | 2024-03-04 | An improper export vulnerability was reported in the Motorola OTA update application, that could allow a malicious, local application to inject an HTML-based m… |
CVE-2023-6068 | Low | 3.1 | 2024-03-04 | On affected 7130 Series FPGA platforms running MOS and recent versions of the MultiAccess FPGA, application of ACL’s may result in incorrect operation of the c… |
CVE-2023-32331 | High | 7.5 | 2024-03-04 | IBM Connect:Express for UNIX 1.5.0 is vulnerable to a buffer overflow that could allow a remote attacker to cause a denial of service through its browser UI… |
CVE-2023-38360 | Medium | 6.1 | 2024-03-04 | IBM CICS TX Advanced 10.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering… |
CVE-2023-5451 | Medium | 6.1 | 2024-03-04 | Forcepoint NGFW Security Management Center Management Server has SMC Downloads optional feature to offer standalone Management Client downloads and ECA conf… |
CVE-2023-38362 | Medium | 5.3 | 2024-03-04 | IBM CICS TX Advanced 10.1 could disclose sensitive information to a remote attacker due to observable discrepancy in HTTP responses. IBM X-Force ID: 260814. |
CVE-2023-6241 | High | 7.0 | 2024-03-04 | Use After Free vulnerability in Arm Ltd Midgard GPU Kernel Driver, Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GP… |
CVE-2023-43553 | Critical | 9.8 | 2024-03-04 | Memory corruption while parsing beacon/probe response frame when AP sends more supported links in MLIE. |
CVE-2023-43552 | Critical | 9.8 | 2024-03-04 | Memory corruption while processing MBSSID beacon containing several subelement IE. |
CVE-2023-43550 | High | 7.8 | 2024-03-04 | Memory corruption while processing a QMI request for allocating memory from a DHMS supported subsystem. |
CVE-2023-43549 | High | 8.4 | 2024-03-04 | Memory corruption while processing TPC target power table in FTM TPC. |
CVE-2023-43548 | High | 7.3 | 2024-03-04 | Memory corruption while parsing qcp clip with invalid chunk data size. |
CVE-2023-43547 | High | 8.4 | 2024-03-04 | Memory corruption while invoking IOCTLs calls in Automotive Multimedia. |
CVE-2023-43546 | High | 8.4 | 2024-03-04 | Memory corruption while invoking HGSL IOCTL context create. |
CVE-2023-43541 | High | 8.4 | 2024-03-04 | Memory corruption while invoking the SubmitCommands call on Gfx engine during the graphics render. |
CVE-2023-43540 | High | 8.4 | 2024-03-04 | Memory corruption while processing the IOCTL FM HCI WRITE request. |
CVE-2023-43539 | High | 7.5 | 2024-03-04 | Transient DOS while processing an improperly formatted 802.11az Fine Time Measurement protocol frame. |
CVE-2023-33105 | High | 7.5 | 2024-03-04 | Transient DOS in WLAN Host and Firmware when large number of open authentication frames are sent with an invalid transaction sequence number. |
CVE-2023-33104 | High | 7.5 | 2024-03-04 | Transient DOS while processing PDU Release command with a parameter PDU ID out of range. |
CVE-2023-33103 | High | 7.5 | 2024-03-04 | Transient DOS while processing CAG info IE received from NW. |
CVE-2023-33096 | High | 7.5 | 2024-03-04 | Transient DOS while processing DL NAS Transport message, as specified in 3GPP 24.501 v16. |
CVE-2023-33095 | High | 7.5 | 2024-03-04 | Transient DOS while processing multiple payload container type with incorrect container length received in DL NAS transport OTA in NR. |
CVE-2023-33090 | Medium | 5.5 | 2024-03-04 | Transient DOS while processing channel information for speaker protection v2 module in ADSP. |
CVE-2023-33086 | High | 7.5 | 2024-03-04 | Transient DOS while processing multiple IKEV2 Informational Request to device from IPSEC server with different identifiers. |
CVE-2023-33084 | High | 7.5 | 2024-03-04 | Transient DOS while processing IE fragments from server during DTLS handshake. |
CVE-2023-33078 | Medium | 5.1 | 2024-03-04 | Information Disclosure while processing IOCTL request in FastRPC. |
CVE-2023-33066 | High | 8.4 | 2024-03-04 | Memory corruption in Audio while processing RT proxy port register driver. |
CVE-2023-28582 | Critical | 9.8 | 2024-03-04 | Memory corruption in Data Modem while verifying hello-verify message during the DTLS handshake. |
CVE-2023-28578 | Critical | 9.3 | 2024-03-04 | Memory corruption in Core Services while executing the command for removing a single event listener. |
CVE-2023-6143 | High | 8.4 | 2024-03-04 | Use After Free vulnerability in Arm Ltd Midgard GPU Kernel Driver, Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GP… |
CVE-2023-4479 | High | 7.3 | 2024-03-04 | Stored XSS Vulnerability in M-Files Web versions before 23.8 allows attacker to execute script on users browser via stored HTML document within limited time pe… |
CVE-2023-49602 | Low | 2.9 | 2024-03-04 | in OpenHarmony v3.2.4 and prior versions allow a local attacker cause apps crash through type confusion. |
CVE-2023-46708 | Medium | 4.3 | 2024-03-04 | in OpenHarmony v3.2.4 and prior versions allow a local attacker arbitrary code execution in any apps through use after free. |
CVE-2023-25176 | Low | 2.9 | 2024-03-04 | in OpenHarmony v3.2.4 and prior versions allow a local attacker cause information leak through out-of-bounds Read. |
CVE-2023-28512 | Medium | 5.9 | 2024-03-03 | IBM Watson CP4D Data Stores 4.6.0, 4.6.1, and 4.6.2 could allow an attacker with specific knowledge about the system to manipulate data due to improper input v… |
CVE-2023-27291 | Medium | 4.5 | 2024-03-03 | IBM Watson CP4D Data Stores 4.6.0, 4.6.1, 4.6.2, and 4.6.3 does not encrypt sensitive or critical information before storage or transmission which could allow… |
CVE-2023-47742 | Medium | 5.9 | 2024-03-03 | IBM QRadar Suite Products 1.10.12.0 through 1.10.18.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could disclose sensitive information using man… |
CVE-2023-43054 | Medium | 6.4 | 2024-03-03 | IBM Engineering Test Management 7.0.2 and 7.0.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript cod… |