2023 CVEs (page 55)
Page 55 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-42838 | High | 8.6 | 2024-02-21 | An access issue was addressed with improvements to the sandbox. This issue is fixed in macOS Ventura 13.6.3, macOS Sonoma 14.1, macOS Monterey 12.7.2. An app m… |
CVE-2023-42836 | Medium | 5.3 | 2024-02-21 | A logic issue was addressed with improved checks. This issue is fixed in iOS 17.1 and iPadOS 17.1, macOS Ventura 13.6.3, macOS Sonoma 14.1, macOS Monterey 12.7… |
CVE-2023-42835 | High | 7.5 | 2024-02-21 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1. An attacker may be able to access user data. |
CVE-2023-42834 | Medium | 5.5 | 2024-02-21 | A privacy issue was addressed with improved handling of files. This issue is fixed in watchOS 10.1, macOS Sonoma 14.1, macOS Monterey 12.7.2, macOS Ventura 13… |
CVE-2023-42823 | Medium | 5.5 | 2024-02-21 | The issue was resolved by sanitizing logging This issue is fixed in watchOS 10.1, macOS Sonoma 14.1, tvOS 17.1, macOS Monterey 12.7.1, iOS 16.7.2 and iPadOS 16… |
CVE-2023-42498 | Critical | 9.6 | 2024-02-21 | Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and Liferay DXP 2023.Q3 bef… |
CVE-2023-42496 | Critical | 9.6 | 2024-02-21 | Reflected cross-site scripting (XSS) vulnerability on the add assignees to a role page in Liferay Portal 7.3.3 through 7.4.3.97, and Liferay DXP 2023.Q3 before… |
CVE-2023-40191 | Critical | 9.0 | 2024-02-21 | Reflected cross-site scripting (XSS) vulnerability in the instance settings for Accounts in Liferay Portal 7.4.3.44 through 7.4.3.97, and Liferay DXP 2023.Q3 b… |
CVE-2023-50923 | Medium | 4.3 | 2024-02-21 | In QUIC in RFC 9000, the Latency Spin Bit specification (section 17.4) does not strictly constrain the bit value when the feature is disabled, which might allo… |
CVE-2023-6936 | Medium | 5.3 | 2024-02-20 | In wolfSSL prior to 5.6.6, if callback functions are enabled (via the WOLFSSL_CALLBACKS flag), then a malicious TLS client or network attacker can trigger a bu… |
CVE-2023-47422 | High | 8.8 | 2024-02-20 | An access control issue in /usr/sbin/httpd in Tenda TX9 V1 V22.03.02.54, Tenda AX3 V3 V16.03.12.11, Tenda AX9 V1 V22.03.01.46, and Tenda AX12 V1 V22.03.01.46 a… |
CVE-2023-52439 | High | 7.8 | 2024-02-20 | In the Linux kernel, the following vulnerability has been resolved: uio: Fix use-after-free in uio_open core-1 core-2 ------------------------------------… |
CVE-2023-52438 | High | 7.8 | 2024-02-20 | In the Linux kernel, the following vulnerability has been resolved: binder: fix use-after-free in shinker's callback The mmap read lock is used during the sh… |
CVE-2023-52436 | High | 7.8 | 2024-02-20 | In the Linux kernel, the following vulnerability has been resolved: f2fs: explicitly null-terminate the xattr list When setting an xattr, explicitly null-ter… |
CVE-2023-49034 | Medium | 6.1 | 2024-02-20 | Cross Site Scripting (XSS) vulnerability in ProjeQtOr 11.0.2 allows a remote attacker to execute arbitrary code via a crafted script to thecheckvalidHtmlText f… |
CVE-2023-46967 | Medium | 6.1 | 2024-02-20 | Cross Site Scripting vulnerability in the sanitize function in Enhancesoft osTicket 1.18.0 allows a remote attacker to escalate privileges via a crafted suppor… |
CVE-2023-52435 | Medium | 5.5 | 2024-02-20 | In the Linux kernel, the following vulnerability has been resolved: net: prevent mss overflow in skb_segment() Once again syzbot is able to crash the kernel… |
CVE-2023-52434 | High | 8.1 | 2024-02-20 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOBs in smb2_parse_contexts() Validate offsets and lengths bef… |
CVE-2023-51447 | Medium | 6.3 | 2024-02-20 | Decidim is a participatory democracy framework. Starting in version 0.27.0 and prior to versions 0.27.5 and 0.28.0, the dynamic file upload feature is subject… |
CVE-2023-48220 | Medium | 5.7 | 2024-02-20 | Decidim is a participatory democracy framework. Starting in version 0.4.rc3 and prior to version 2.0.9 of the `devise_invitable` gem, the invites feature allow… |
CVE-2023-47635 | Medium | 4.5 | 2024-02-20 | Decidim is a participatory democracy framework. Starting in version 0.23.0 and prior to versions 0.27.5 and 0.28.0, the CSRF authenticity token check is disabl… |
CVE-2023-45318 | Critical | 10.0 | 2024-02-20 | A heap-based buffer overflow vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP git commit 80d4004. A specially crafted network p… |
CVE-2023-39541 | Medium | 5.9 | 2024-02-20 | A denial of service vulnerability exists in the ICMP and ICMPv6 parsing functionality of Weston Embedded uC-TCP-IP v3.06.01. A specially crafted network packet… |
CVE-2023-39540 | Medium | 5.9 | 2024-02-20 | A denial of service vulnerability exists in the ICMP and ICMPv6 parsing functionality of Weston Embedded uC-TCP-IP v3.06.01. A specially crafted network packet… |
CVE-2023-38562 | High | 8.7 | 2024-02-20 | A double-free vulnerability exists in the IP header loopback parsing functionality of Weston Embedded uC-TCP-IP v3.06.01. A specially crafted set of network pa… |
CVE-2023-50306 | Medium | 4.0 | 2024-02-20 | IBM Common Licensing 9.0 could allow a local user to enumerate usernames due to an observable response discrepancy. IBM X-Force ID: 273337. |
CVE-2023-42791 | High | 8.8 | 2024-02-20 | A relative path traversal in Fortinet FortiManager version 7.4.0 and 7.2.0 through 7.2.3 and 7.0.0 through 7.0.8 and 6.4.0 through 6.4.12 and 6.2.0 through 6.2… |
CVE-2023-52433 | High | 7.8 | 2024-02-20 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction New elements… |
CVE-2023-7245 | High | 7.8 | 2024-02-20 | The nodejs framework in OpenVPN Connect 3.0 through 3.4.3 (Windows)/3.4.7 (macOS) was not properly configured, which allows a local user to execute arbitrary c… |
CVE-2023-51770 | High | 7.5 | 2024-02-20 | Arbitrary File Read Vulnerability in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache… |
CVE-2023-50270 | Medium | 6.5 | 2024-02-20 | Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change. Users are recommended to upgrade to ver… |
CVE-2023-49250 | High | 7.3 | 2024-02-20 | Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could i… |
CVE-2023-49109 | Critical | 9.8 | 2024-02-20 | Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache… |
CVE-2023-44308 | Medium | 6.1 | 2024-02-20 | Open redirect vulnerability in adaptive media administration page in Liferay DXP 2023.Q3 before patch 6, and 7.4 GA through update 92 allows remote attackers t… |
CVE-2023-5190 | Medium | 6.1 | 2024-02-20 | Open redirect vulnerability in the Countries Management’s edit region page in Liferay Portal 7.4.3.45 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6… |
CVE-2023-6764 | High | 8.1 | 2024-02-20 | A format string vulnerability in a function of the IPSec VPN feature in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX… |
CVE-2023-6399 | Medium | 5.7 | 2024-02-20 | A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Pa… |
CVE-2023-6398 | High | 7.2 | 2024-02-20 | A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX… |
CVE-2023-6397 | Medium | 6.5 | 2024-02-20 | A null pointer dereference vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1 and USG FLEX series firmware versions… |
CVE-2023-6260 | Critical | 9.0 | 2024-02-19 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Brivo ACS100, ACS300 allows OS Command Injection, B… |
CVE-2023-6259 | High | 7.1 | 2024-02-19 | Insufficiently Protected Credentials, : Improper Access Control vulnerability in Brivo ACS100, ACS300 allows Password Recovery Exploitation, Bypassing Physical… |
CVE-2023-50257 | Critical | 9.6 | 2024-02-19 | eProsima Fast DDS (formerly Fast RTPS) is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Even with the applicat… |
CVE-2023-6249 | High | 8.0 | 2024-02-18 | Signed to unsigned conversion esp32_ipm_send |
CVE-2023-5779 | Medium | 4.4 | 2024-02-18 | can: out of bounds in remove_rx_filter function |
CVE-2023-6749 | High | 8.0 | 2024-02-18 | Unchecked length coming from user input in settings shell |
CVE-2023-52381 | Critical | 9.8 | 2024-02-18 | Script injection vulnerability in the email module.Successful exploitation of this vulnerability may affect service confidentiality, integrity, and availabilit… |
CVE-2023-52380 | Medium | 4.3 | 2024-02-18 | Vulnerability of improper access control in the email module.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-52379 | High | 7.5 | 2024-02-18 | Permission control vulnerability in the calendarProvider module.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-52378 | Critical | 9.8 | 2024-02-18 | Vulnerability of incorrect service logic in the WindowManagerServices module.Successful exploitation of this vulnerability may cause features to perform abnorm… |
CVE-2023-52377 | High | 7.4 | 2024-02-18 | Vulnerability of input data not being verified in the cellular data module.Successful exploitation of this vulnerability may cause out-of-bounds access. |
CVE-2023-52376 | High | 7.5 | 2024-02-18 | Information management vulnerability in the Gallery module.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-52375 | High | 7.5 | 2024-02-18 | Permission control vulnerability in the WindowManagerServices module.Successful exploitation of this vulnerability may affect availability. |
CVE-2023-52374 | High | 7.5 | 2024-02-18 | Permission control vulnerability in the package management module.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-52373 | High | 7.5 | 2024-02-18 | Vulnerability of permission verification in the content sharing pop-up module.Successful exploitation of this vulnerability may cause unauthorized file sharing. |
CVE-2023-52372 | High | 7.5 | 2024-02-18 | Vulnerability of input parameter verification in the motor module.Successful exploitation of this vulnerability may affect availability. |
CVE-2023-52371 | Low | 3.5 | 2024-02-18 | Vulnerability of null references in the motor module.Successful exploitation of this vulnerability may affect availability. |
CVE-2023-52370 | Critical | 9.8 | 2024-02-18 | Stack overflow vulnerability in the network acceleration module.Successful exploitation of this vulnerability may cause unauthorized file access. |
CVE-2023-52369 | Critical | 9.1 | 2024-02-18 | Stack overflow vulnerability in the NFC module.Successful exploitation of this vulnerability may affect service availability and integrity. |
CVE-2023-52368 | Medium | 5.3 | 2024-02-18 | Input verification vulnerability in the account module.Successful exploitation of this vulnerability may cause features to perform abnormally. |
CVE-2023-52367 | High | 7.7 | 2024-02-18 | Vulnerability of improper access control in the media library module.Successful exploitation of this vulnerability may affect service availability and integrit… |
CVE-2023-52366 | High | 7.5 | 2024-02-18 | Out-of-bounds read vulnerability in the smart activity recognition module.Successful exploitation of this vulnerability may cause features to perform abnormall… |
CVE-2023-52387 | High | 7.5 | 2024-02-18 | Resource reuse vulnerability in the GPU module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-52365 | Medium | 5.3 | 2024-02-18 | Out-of-bounds read vulnerability in the smart activity recognition module.Successful exploitation of this vulnerability may cause features to perform abnormall… |
CVE-2023-52363 | Medium | 5.3 | 2024-02-18 | Vulnerability of defects introduced in the design process in the Control Panel module.Successful exploitation of this vulnerability may cause app processes to… |
CVE-2023-52362 | High | 7.5 | 2024-02-18 | Permission management vulnerability in the lock screen module.Successful exploitation of this vulnerability may affect availability. |
CVE-2023-52361 | High | 7.5 | 2024-02-18 | The VerifiedBoot module has a vulnerability that may cause authentication errors.Successful exploitation of this vulnerability may affect integrity. |
CVE-2023-52360 | High | 7.5 | 2024-02-18 | Logic vulnerabilities in the baseband.Successful exploitation of this vulnerability may affect service integrity. |
CVE-2023-52358 | Medium | 6.2 | 2024-02-18 | Vulnerability of configuration defects in some APIs of the audio module.Successful exploitation of this vulnerability may affect availability. |
CVE-2023-52357 | High | 7.5 | 2024-02-18 | Vulnerability of serialization/deserialization mismatch in the vibration framework.Successful exploitation of this vulnerability may affect availability. |
CVE-2023-52097 | High | 7.5 | 2024-02-18 | Vulnerability of foreground service restrictions being bypassed in the NMS module.Successful exploitation of this vulnerability may affect service confidential… |
CVE-2023-50951 | Medium | 4.0 | 2024-02-17 | IBM QRadar Suite 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 in some circumstances will log some sensitive informatio… |
CVE-2023-31728 | High | 7.0 | 2024-02-17 | Teltonika RUT240 devices with firmware before 07.04.2, when bridge mode is used, sometimes make SSH and HTTP services available on the IPv6 WAN interface even… |
CVE-2023-21833 | Medium | 4.3 | 2024-02-17 | Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Object Store). The supported version that is affected is 8.8. Eas… |
CVE-2023-40085 | Medium | 5.5 | 2024-02-16 | In convertSubgraphFromHAL of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disc… |
CVE-2023-21165 | High | 7.8 | 2024-02-16 | In DevmemIntUnmapPMR of devicemem_server.c, there is a possible arbitrary code execution due to a use after free. This could lead to local escalation of privil… |
CVE-2023-45860 | Medium | 6.5 | 2024-02-16 | In Hazelcast Platform through 5.3.4, a security issue exists within the SQL mapping for the CSV File Source connector. This issue arises from inadequate permis… |
CVE-2023-51931 | High | 7.5 | 2024-02-16 | An issue in alanclarke URLite v.3.1.0 allows an attacker to cause a denial of service (DoS) via a crafted payload to the parsing function. |
CVE-2023-49508 | Medium | 6.5 | 2024-02-16 | Directory Traversal vulnerability in YetiForceCompany YetiForceCRM versions 6.4.0 and before allows a remote authenticated attacker to obtain sensitive informa… |
CVE-2023-6451 | High | 8.6 | 2024-02-16 | Publicly known cryptographic machine key in AlayaCare's Procura Portal before 9.0.1.2 allows attackers to forge their own authentication cookies and bypass the… |
CVE-2023-40122 | Low | 3.3 | 2024-02-16 | In applyCustomDescription of SaveUi.java, there is a possible way to view other user's images due to a confused deputy. This could lead to local information di… |
CVE-2023-40093 | Medium | 5.5 | 2024-02-16 | In multiple files, there is a possible way that trimmed content could be included in PDF output due to a logic error in the code. This could lead to local info… |
CVE-2023-40124 | Medium | 5.5 | 2024-02-15 | In multiple locations, there is a possible cross-user read due to a confused deputy. This could lead to local information disclosure of photos or other images… |
CVE-2023-40115 | High | 7.8 | 2024-02-15 | In readLogs of StatsService.cpp, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additi… |
CVE-2023-40114 | High | 7.8 | 2024-02-15 | In multiple functions of MtpFfsHandle.cpp , there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege w… |
CVE-2023-40113 | Medium | 5.5 | 2024-02-15 | In multiple locations, there is a possible way for apps to access cross-user message data due to a missing permission check. This could lead to local informati… |
CVE-2023-40112 | Medium | 5.5 | 2024-02-15 | In ippSetValueTag of ipp.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure of past print… |
CVE-2023-40111 | High | 7.8 | 2024-02-15 | In setMediaButtonReceiver of MediaSessionRecord.java, there is a possible way to send a pending intent on behalf of system_server due to a confused deputy. Thi… |
CVE-2023-40110 | High | 7.8 | 2024-02-15 | In multiple functions of MtpPacket.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege… |
CVE-2023-40109 | High | 7.8 | 2024-02-15 | In createFromParcel of UsbConfiguration.java, there is a possible background activity launch (BAL) due to a permissions bypass. This could lead to local escala… |
CVE-2023-40107 | High | 7.8 | 2024-02-15 | In ARTPWriter of ARTPWriter.cpp, there is a possible use after free due to uninitialized data. This could lead to local escalation of privilege with no additio… |
CVE-2023-40106 | High | 7.8 | 2024-02-15 | In sanitizeSbn of NotificationManagerService.java, there is a possible way to launch an activity from the background due to BAL Bypass. This could lead to loca… |
CVE-2023-40105 | Medium | 5.5 | 2024-02-15 | In backupAgentCreated of ActivityManagerService.java, there is a possible way to leak sensitive data due to a missing permission check. This could lead to loca… |
CVE-2023-40104 | High | 7.5 | 2024-02-15 | In ca-certificates, there is a possible way to read encrypted TLS data due to untrusted cryptographic certificates. This could lead to remote information discl… |
CVE-2023-40100 | High | 7.8 | 2024-02-15 | In discovery_thread of Dns64Configuration.cpp, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege… |
CVE-2023-6123 | High | 7.5 | 2024-02-15 | Improper Neutralization vulnerability affects OpenText ALM Octane version 16.2.100 and above. The vulnerability could result in a remote code execution attack. |
CVE-2023-40057 | Critical | 9.0 | 2024-02-15 | The SolarWinds Access Rights Manager was found to be susceptible to a Remote Code Execution Vulnerability. If exploited, this vulnerability allows an authentic… |
CVE-2023-6937 | Medium | 5.3 | 2024-02-15 | wolfSSL prior to 5.6.6 did not check that messages in one (D)TLS record do not span key boundaries. As a result, it was possible to combine (D)TLS messages usi… |
CVE-2023-7081 | Critical | 9.8 | 2024-02-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in POSTAHSİL Online Payment System allows SQL Injection. Th… |
CVE-2023-6255 | High | 7.5 | 2024-02-15 | Use of Hard-coded Credentials vulnerability in Utarit Information Technologies SoliPay Mobile App allows Read Sensitive Strings Within an Executable. This iss… |
CVE-2023-5155 | Critical | 9.8 | 2024-02-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Utarit Information Technologies SoliPay Mobile App allows… |