2023 CVEs (page 54)
Page 54 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-4895 | Medium | 4.3 | 2024-02-22 | An issue has been discovered in GitLab EE affecting all versions starting from 12.0 to 16.7.6, all versions starting from 16.8 before 16.8.3, all versions star… |
CVE-2023-6477 | Medium | 6.7 | 2024-02-22 | An issue has been discovered in GitLab EE affecting all versions starting from 16.5 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions… |
CVE-2023-3509 | Low | 3.7 | 2024-02-21 | An issue has been discovered in GitLab affecting all versions before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 bef… |
CVE-2023-52155 | High | 7.2 | 2024-02-21 | A SQL Injection vulnerability in /admin/sauvegarde/run.php in PMB 7.4.7 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via… |
CVE-2023-52154 | High | 7.2 | 2024-02-21 | File Upload vulnerability in pmb/camera_upload.php in PMB 7.4.7 and earlier allows attackers to run arbitrary code via upload of crafted PHTML files. |
CVE-2023-52153 | Critical | 9.8 | 2024-02-21 | A SQL Injection vulnerability in /pmb/opac_css/includes/sessions.inc.php in PMB 7.4.7 and earlier allows remote unauthenticated attackers to inject arbitrary S… |
CVE-2023-51828 | Critical | 9.8 | 2024-02-21 | A SQL Injection vulnerability in /admin/convert/export.class.php in PMB 7.4.7 and earlier versions allows remote unauthenticated attackers to execute arbitrary… |
CVE-2023-38844 | High | 7.5 | 2024-02-21 | SQL injection vulnerability in PMB v.7.4.7 and earlier allows a remote attacker to execute arbitrary code via the thesaurus parameter in export_skos.php. |
CVE-2023-37177 | Critical | 9.8 | 2024-02-21 | SQL Injection vulnerability in PMB Services PMB v.7.4.7 and before allows a remote unauthenticated attacker to execute arbitrary code via the query parameter i… |
CVE-2023-24334 | High | 8.0 | 2024-02-21 | A stack overflow vulnerability in Tenda AC23 with firmware version US_AC23V1.0re_V16.03.07.45_cn_TDC01 allows attackers to run arbitrary commands via schedStar… |
CVE-2023-24333 | High | 8.8 | 2024-02-21 | A stack overflow vulnerability in Tenda AC21 with firmware version US_AC21V1.0re_V16.03.08.15_cn_TDC01 allows attackers to run arbitrary commands via crafted P… |
CVE-2023-24332 | High | 8.1 | 2024-02-21 | A stack overflow vulnerability in Tenda AC6 with firmware version US_AC6V5.0re_V03.03.02.01_cn_TDC01 allows attackers to run arbitrary commands via crafted POS… |
CVE-2023-24331 | Critical | 9.8 | 2024-02-21 | Command Injection vulnerability in D-Link Dir 816 with firmware version DIR-816_A2_v1.10CNB04 allows attackers to run arbitrary commands via the urlAdd paramet… |
CVE-2023-24330 | High | 8.8 | 2024-02-21 | Command Injection vulnerability in D-Link Dir 882 with firmware version DIR882A1_FW130B06 allows attackers to run arbitrary commands via crafted POST request t… |
CVE-2023-6640 | Medium | 6.5 | 2024-02-21 | Malformed S2 Nonce Get Command Class packets can be sent to crash PC Controller v5.54.0 and earlier. |
CVE-2023-6533 | Medium | 6.5 | 2024-02-21 | Malformed Device Reset Locally Command Class packets can be sent to the controller, causing the controller to assume the end device has left the network. After… |
CVE-2023-50975 | High | 8.4 | 2024-02-21 | The TD Bank TD Advanced Dashboard client through 3.0.3 for macOS allows arbitrary code execution because of the lack of electron::fuses::IsRunAsNodeEnabled (i… |
CVE-2023-49100 | Medium | 4.4 | 2024-02-21 | Trusted Firmware-A (TF-A) before 2.10 has a potential read out-of-bounds in the SDEI service. The input parameter passed in register x1 is not validated well e… |
CVE-2023-46241 | Critical | 9.0 | 2024-02-21 | `discourse-microsoft-auth` is a plugin that enables authentication via Microsoft. On sites with the `discourse-microsoft-auth` plugin enabled, an attack can po… |
CVE-2023-50955 | Low | 2.4 | 2024-02-21 | IBM InfoSphere Information Server 11.7 could allow an authenticated privileged user to obtain the absolute path of the web server installation which could aid… |
CVE-2023-33843 | Medium | 5.4 | 2024-02-21 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2023-47795 | Critical | 9.0 | 2024-02-21 | Stored cross-site scripting (XSS) vulnerability in the Document and Media widget in Liferay Portal 7.4.3.18 through 7.4.3.101, and Liferay DXP 2023.Q3 before p… |
CVE-2023-7235 | High | 8.4 | 2024-02-21 | The OpenVPN GUI installer before version 2.6.9 did not set the proper access control restrictions to the installation directory of OpenVPN binaries when using… |
CVE-2023-52442 | Critical | 9.1 | 2024-02-21 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate session id and tree id in compound request `smb2_get_msg()` in smb2_get_k… |
CVE-2023-52441 | Critical | 9.1 | 2024-02-21 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of bounds in init_smb2_rsp_hdr() If client send smb2 negotiate request and… |
CVE-2023-52440 | Critical | 9.8 | 2024-02-21 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob() If authblob->SessionKey.Leng… |
CVE-2023-42953 | Medium | 5.5 | 2024-02-21 | A permissions issue was addressed with additional restrictions. This issue is fixed in tvOS 17.1, watchOS 10.1, macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1. An… |
CVE-2023-42952 | Medium | 4.4 | 2024-02-21 | The issue was addressed with improved checks. This issue is fixed in iOS 17.1 and iPadOS 17.1, macOS Ventura 13.6.3, macOS Sonoma 14.1, macOS Monterey 12.7.1… |
CVE-2023-42951 | Medium | 4.3 | 2024-02-21 | The issue was addressed with improved handling of caches. This issue is fixed in iOS 17.1 and iPadOS 17.1. A user may be unable to delete browsing history item… |
CVE-2023-42946 | Medium | 5.5 | 2024-02-21 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in tvOS 17.1, watchOS 10.1, macOS Sonoma 14.1, iOS 17.1 and iPad… |
CVE-2023-42945 | Medium | 5.5 | 2024-02-21 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.1. An app may gain unauthorized access to Bluetooth. |
CVE-2023-42942 | High | 7.8 | 2024-02-21 | This issue was addressed with improved handling of symlinks. This issue is fixed in watchOS 10.1, macOS Sonoma 14.1, tvOS 17.1, iOS 16.7.2 and iPadOS 16.7.2, i… |
CVE-2023-42939 | Low | 3.3 | 2024-02-21 | A logic issue was addressed with improved checks. This issue is fixed in iOS 17.1 and iPadOS 17.1. A user's private browsing activity may be unexpectedly saved… |
CVE-2023-42928 | High | 7.8 | 2024-02-21 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 17.1 and iPadOS 17.1. An app may be able to gain elevated privileges. |
CVE-2023-42889 | Medium | 5.5 | 2024-02-21 | The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. An app may be able to bypa… |
CVE-2023-42878 | Medium | 5.5 | 2024-02-21 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in watchOS 10.1, macOS Sonoma 14.1, iOS 17.1 and iPadOS… |
CVE-2023-42877 | Medium | 5.5 | 2024-02-21 | The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. An app may be able to modi… |
CVE-2023-42873 | High | 7.8 | 2024-02-21 | The issue was addressed with improved bounds checks. This issue is fixed in macOS Sonoma 14.1, tvOS 17.1, macOS Monterey 12.7.1, iOS 16.7.2 and iPadOS 16.7.2… |
CVE-2023-42860 | Medium | 5.5 | 2024-02-21 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. An app m… |
CVE-2023-42859 | Medium | 5.5 | 2024-02-21 | The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. An app may be able to modi… |
CVE-2023-42858 | Medium | 5.5 | 2024-02-21 | The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. An app may be able to acce… |
CVE-2023-42855 | Medium | 4.6 | 2024-02-21 | This issue was addressed with improved state management. This issue is fixed in iOS 17.1 and iPadOS 17.1. An attacker with physical access may be able to silen… |
CVE-2023-42853 | Medium | 5.5 | 2024-02-21 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. An app may be able to… |
CVE-2023-42848 | High | 7.8 | 2024-02-21 | The issue was addressed with improved bounds checks. This issue is fixed in watchOS 10.1, macOS Sonoma 14.1, tvOS 17.1, iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1… |
CVE-2023-42843 | Medium | 4.3 | 2024-02-21 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1 and iPadOS 17… |
CVE-2023-42840 | Medium | 5.5 | 2024-02-21 | The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. An app may be able to acce… |
CVE-2023-42839 | Medium | 5.5 | 2024-02-21 | This issue was addressed with improved state management. This issue is fixed in tvOS 17.1, watchOS 10.1, macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1. An app ma… |
CVE-2023-42838 | High | 8.6 | 2024-02-21 | An access issue was addressed with improvements to the sandbox. This issue is fixed in macOS Ventura 13.6.3, macOS Sonoma 14.1, macOS Monterey 12.7.2. An app m… |
CVE-2023-42836 | Medium | 5.3 | 2024-02-21 | A logic issue was addressed with improved checks. This issue is fixed in iOS 17.1 and iPadOS 17.1, macOS Ventura 13.6.3, macOS Sonoma 14.1, macOS Monterey 12.7… |
CVE-2023-42835 | High | 7.5 | 2024-02-21 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1. An attacker may be able to access user data. |
CVE-2023-42834 | Medium | 5.5 | 2024-02-21 | A privacy issue was addressed with improved handling of files. This issue is fixed in watchOS 10.1, macOS Sonoma 14.1, macOS Monterey 12.7.2, macOS Ventura 13… |
CVE-2023-42823 | Medium | 5.5 | 2024-02-21 | The issue was resolved by sanitizing logging This issue is fixed in watchOS 10.1, macOS Sonoma 14.1, tvOS 17.1, macOS Monterey 12.7.1, iOS 16.7.2 and iPadOS 16… |
CVE-2023-42498 | Critical | 9.6 | 2024-02-21 | Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and Liferay DXP 2023.Q3 bef… |
CVE-2023-42496 | Critical | 9.6 | 2024-02-21 | Reflected cross-site scripting (XSS) vulnerability on the add assignees to a role page in Liferay Portal 7.3.3 through 7.4.3.97, and Liferay DXP 2023.Q3 before… |
CVE-2023-40191 | Critical | 9.0 | 2024-02-21 | Reflected cross-site scripting (XSS) vulnerability in the instance settings for Accounts in Liferay Portal 7.4.3.44 through 7.4.3.97, and Liferay DXP 2023.Q3 b… |
CVE-2023-50923 | Medium | 4.3 | 2024-02-21 | In QUIC in RFC 9000, the Latency Spin Bit specification (section 17.4) does not strictly constrain the bit value when the feature is disabled, which might allo… |
CVE-2023-6936 | Medium | 5.3 | 2024-02-20 | In wolfSSL prior to 5.6.6, if callback functions are enabled (via the WOLFSSL_CALLBACKS flag), then a malicious TLS client or network attacker can trigger a bu… |
CVE-2023-47422 | High | 8.8 | 2024-02-20 | An access control issue in /usr/sbin/httpd in Tenda TX9 V1 V22.03.02.54, Tenda AX3 V3 V16.03.12.11, Tenda AX9 V1 V22.03.01.46, and Tenda AX12 V1 V22.03.01.46 a… |
CVE-2023-52439 | High | 7.8 | 2024-02-20 | In the Linux kernel, the following vulnerability has been resolved: uio: Fix use-after-free in uio_open core-1 core-2 ------------------------------------… |
CVE-2023-52438 | High | 7.8 | 2024-02-20 | In the Linux kernel, the following vulnerability has been resolved: binder: fix use-after-free in shinker's callback The mmap read lock is used during the sh… |
CVE-2023-52436 | High | 7.8 | 2024-02-20 | In the Linux kernel, the following vulnerability has been resolved: f2fs: explicitly null-terminate the xattr list When setting an xattr, explicitly null-ter… |
CVE-2023-49034 | Medium | 6.1 | 2024-02-20 | Cross Site Scripting (XSS) vulnerability in ProjeQtOr 11.0.2 allows a remote attacker to execute arbitrary code via a crafted script to thecheckvalidHtmlText f… |
CVE-2023-46967 | Medium | 6.1 | 2024-02-20 | Cross Site Scripting vulnerability in the sanitize function in Enhancesoft osTicket 1.18.0 allows a remote attacker to escalate privileges via a crafted suppor… |
CVE-2023-52435 | Medium | 5.5 | 2024-02-20 | In the Linux kernel, the following vulnerability has been resolved: net: prevent mss overflow in skb_segment() Once again syzbot is able to crash the kernel… |
CVE-2023-52434 | High | 8.1 | 2024-02-20 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOBs in smb2_parse_contexts() Validate offsets and lengths bef… |
CVE-2023-51447 | Medium | 6.3 | 2024-02-20 | Decidim is a participatory democracy framework. Starting in version 0.27.0 and prior to versions 0.27.5 and 0.28.0, the dynamic file upload feature is subject… |
CVE-2023-48220 | Medium | 5.7 | 2024-02-20 | Decidim is a participatory democracy framework. Starting in version 0.4.rc3 and prior to version 2.0.9 of the `devise_invitable` gem, the invites feature allow… |
CVE-2023-47635 | Medium | 4.5 | 2024-02-20 | Decidim is a participatory democracy framework. Starting in version 0.23.0 and prior to versions 0.27.5 and 0.28.0, the CSRF authenticity token check is disabl… |
CVE-2023-45318 | Critical | 10.0 | 2024-02-20 | A heap-based buffer overflow vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP git commit 80d4004. A specially crafted network p… |
CVE-2023-39541 | Medium | 5.9 | 2024-02-20 | A denial of service vulnerability exists in the ICMP and ICMPv6 parsing functionality of Weston Embedded uC-TCP-IP v3.06.01. A specially crafted network packet… |
CVE-2023-39540 | Medium | 5.9 | 2024-02-20 | A denial of service vulnerability exists in the ICMP and ICMPv6 parsing functionality of Weston Embedded uC-TCP-IP v3.06.01. A specially crafted network packet… |
CVE-2023-38562 | High | 8.7 | 2024-02-20 | A double-free vulnerability exists in the IP header loopback parsing functionality of Weston Embedded uC-TCP-IP v3.06.01. A specially crafted set of network pa… |
CVE-2023-50306 | Medium | 4.0 | 2024-02-20 | IBM Common Licensing 9.0 could allow a local user to enumerate usernames due to an observable response discrepancy. IBM X-Force ID: 273337. |
CVE-2023-42791 | High | 8.8 | 2024-02-20 | A relative path traversal in Fortinet FortiManager version 7.4.0 and 7.2.0 through 7.2.3 and 7.0.0 through 7.0.8 and 6.4.0 through 6.4.12 and 6.2.0 through 6.2… |
CVE-2023-52433 | High | 7.8 | 2024-02-20 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction New elements… |
CVE-2023-7245 | High | 7.8 | 2024-02-20 | The nodejs framework in OpenVPN Connect 3.0 through 3.4.3 (Windows)/3.4.7 (macOS) was not properly configured, which allows a local user to execute arbitrary c… |
CVE-2023-51770 | High | 7.5 | 2024-02-20 | Arbitrary File Read Vulnerability in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache… |
CVE-2023-50270 | Medium | 6.5 | 2024-02-20 | Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change. Users are recommended to upgrade to ver… |
CVE-2023-49250 | High | 7.3 | 2024-02-20 | Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could i… |
CVE-2023-49109 | Critical | 9.8 | 2024-02-20 | Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache… |
CVE-2023-44308 | Medium | 6.1 | 2024-02-20 | Open redirect vulnerability in adaptive media administration page in Liferay DXP 2023.Q3 before patch 6, and 7.4 GA through update 92 allows remote attackers t… |
CVE-2023-5190 | Medium | 6.1 | 2024-02-20 | Open redirect vulnerability in the Countries Management’s edit region page in Liferay Portal 7.4.3.45 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6… |
CVE-2023-6764 | High | 8.1 | 2024-02-20 | A format string vulnerability in a function of the IPSec VPN feature in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX… |
CVE-2023-6399 | Medium | 5.7 | 2024-02-20 | A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Pa… |
CVE-2023-6398 | High | 7.2 | 2024-02-20 | A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX… |
CVE-2023-6397 | Medium | 6.5 | 2024-02-20 | A null pointer dereference vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1 and USG FLEX series firmware versions… |
CVE-2023-6260 | Critical | 9.0 | 2024-02-19 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Brivo ACS100, ACS300 allows OS Command Injection, B… |
CVE-2023-6259 | High | 7.1 | 2024-02-19 | Insufficiently Protected Credentials, : Improper Access Control vulnerability in Brivo ACS100, ACS300 allows Password Recovery Exploitation, Bypassing Physical… |
CVE-2023-50257 | Critical | 9.6 | 2024-02-19 | eProsima Fast DDS (formerly Fast RTPS) is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Even with the applicat… |
CVE-2023-6249 | High | 8.0 | 2024-02-18 | Signed to unsigned conversion esp32_ipm_send |
CVE-2023-5779 | Medium | 4.4 | 2024-02-18 | can: out of bounds in remove_rx_filter function |
CVE-2023-6749 | High | 8.0 | 2024-02-18 | Unchecked length coming from user input in settings shell |
CVE-2023-52381 | Critical | 9.8 | 2024-02-18 | Script injection vulnerability in the email module.Successful exploitation of this vulnerability may affect service confidentiality, integrity, and availabilit… |
CVE-2023-52380 | Medium | 4.3 | 2024-02-18 | Vulnerability of improper access control in the email module.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-52379 | High | 7.5 | 2024-02-18 | Permission control vulnerability in the calendarProvider module.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-52378 | Critical | 9.8 | 2024-02-18 | Vulnerability of incorrect service logic in the WindowManagerServices module.Successful exploitation of this vulnerability may cause features to perform abnorm… |
CVE-2023-52377 | High | 7.4 | 2024-02-18 | Vulnerability of input data not being verified in the cellular data module.Successful exploitation of this vulnerability may cause out-of-bounds access. |
CVE-2023-52376 | High | 7.5 | 2024-02-18 | Information management vulnerability in the Gallery module.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-52375 | High | 7.5 | 2024-02-18 | Permission control vulnerability in the WindowManagerServices module.Successful exploitation of this vulnerability may affect availability. |
CVE-2023-52374 | High | 7.5 | 2024-02-18 | Permission control vulnerability in the package management module.Successful exploitation of this vulnerability may affect service confidentiality. |