2023 CVEs (page 57)
Page 57 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-22848 | Medium | 5.5 | 2024-02-14 | Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable denial… |
CVE-2023-22390 | Medium | 6.5 | 2024-02-14 | Improper buffer restrictions in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable i… |
CVE-2023-22342 | High | 7.7 | 2024-02-14 | Improper input validation in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable esca… |
CVE-2023-22311 | Medium | 6.7 | 2024-02-14 | Improper access control in some Intel(R) Optane(TM) PMem 100 Series Management Software before version 01.00.00.3547 may allow an authenticated user to potenti… |
CVE-2023-22293 | High | 8.2 | 2024-02-14 | Improper access control in the Intel(R) Thunderbolt(TM) DCH drivers for Windows may allow an authenticated user to potentially enable escalation of privilege v… |
CVE-2023-48987 | High | 7.5 | 2024-02-14 | Blind SQL Injection vulnerability in CU Solutions Group (CUSG) Content Management System (CMS) before v.7.75 allows a remote attacker to execute arbitrary code… |
CVE-2023-48986 | Medium | 6.1 | 2024-02-14 | Cross Site Scripting (XSS) vulnerability in CU Solutions Group (CUSG) Content Management System (CMS) before v.7.75 allows a remote attacker to execute arbitra… |
CVE-2023-48985 | Medium | 6.1 | 2024-02-14 | Cross Site Scripting (XSS) vulnerability in CU Solutions Group (CUSG) Content Management System (CMS) before v.7.75 allows a remote attacker to execute arbitra… |
CVE-2023-44294 | Medium | 5.4 | 2024-02-14 | In Dell Secure Connect Gateway Application and Secure Connect Gateway Appliance (between v5.10.00.00 and v5.18.00.00), a security concern has been identified… |
CVE-2023-44293 | Medium | 5.4 | 2024-02-14 | In Dell Secure Connect Gateway Application and Secure Connect Gateway Appliance (between v5.10.00.00 and v5.18.00.00), a security concern has been identified… |
CVE-2023-44283 | High | 7.8 | 2024-02-14 | In Dell SupportAssist for Home PCs (between v3.0 and v3.14.1) and SupportAssist for Business PCs (between v3.0 and v3.4.1), a security concern has been identi… |
CVE-2023-39249 | Medium | 6.3 | 2024-02-14 | Dell SupportAssist for Business PCs version 3.4.0 contains a local Authentication Bypass vulnerability that allows locally authenticated non-admin users to ga… |
CVE-2023-25535 | High | 7.2 | 2024-02-14 | Dell SupportAssist for Home PCs Installer Executable file version prior to 3.13.2.19 used for initial installation has a high vulnerability that can result in… |
CVE-2023-38960 | High | 7.3 | 2024-02-13 | Insecure Permissions issue in Raiden Professional Server RaidenFTPD v.2.4 build 4005 allows a local attacker to gain privileges and execute arbitrary code via… |
CVE-2023-6152 | Medium | 5.4 | 2024-02-13 | A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verify_email_e… |
CVE-2023-31347 | Medium | 4.9 | 2024-02-13 | Due to a code bug in Secure_TSC, SEV firmware may allow an attacker with high privileges to cause a guest to observe an incorrect TSC when Secure TSC is enable… |
CVE-2023-31346 | Medium | 6.0 | 2024-02-13 | Failure to initialize memory in SEV Firmware may allow a privileged attacker to access stale data from other guests. |
CVE-2023-20587 | High | 7.1 | 2024-02-13 | Improper Access Control in System Management Mode (SMM) may allow an attacker access to the SPI flash potentially leading to arbitrary code execution. … |
CVE-2023-20579 | Medium | 6.0 | 2024-02-13 | Improper Access Control in the AMD SPI protection feature may allow a user with Ring0 (kernel mode) privileged access to bypass protections potentially resulti… |
CVE-2023-50808 | Medium | 6.1 | 2024-02-13 | Zimbra Collaboration before Kepler 9.0.0 Patch 38 GA allows DOM-based JavaScript injection in the Modern UI. |
CVE-2023-20570 | Low | 3.3 | 2024-02-13 | Insufficient verification of data authenticity in the configuration state machine may allow a local attacker to potentially load arbitrary bitstreams. |
CVE-2023-48432 | Medium | 6.1 | 2024-02-13 | An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. XSS, with resultant session stealing, can occur via JavaScript code in a link (for… |
CVE-2023-45207 | Medium | 6.1 | 2024-02-13 | An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. An attacker can send a PDF document through mail that contains malicious JavaScrip… |
CVE-2023-45206 | Medium | 6.1 | 2024-02-13 | An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. Through the help document endpoint in webmail, an attacker can inject JavaScript o… |
CVE-2023-26562 | Medium | 6.5 | 2024-02-13 | In Zimbra Collaboration (ZCS) 8.8.15 and 9.0, a closed account (with 2FA and generated passwords) can send e-mail messages when configured for Imap/smtp. |
CVE-2023-6516 | High | 7.5 | 2024-02-13 | To keep its cache database efficient, `named` running as a recursive resolver occasionally attempts to clean up the database. It uses several methods, includin… |
CVE-2023-5680 | Medium | 5.3 | 2024-02-13 | If a resolver cache has a very large number of ECS records stored for the same name, the process of cleaning the cache database node for this name can signific… |
CVE-2023-5679 | High | 7.5 | 2024-02-13 | A bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure during recursive resolution, when both of these features a… |
CVE-2023-5517 | High | 7.5 | 2024-02-13 | A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when: - `nxdomain-redirect <domain>;` is configured, and - t… |
CVE-2023-4408 | High | 7.5 | 2024-02-13 | The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, b… |
CVE-2023-6072 | Medium | 4.6 | 2024-02-13 | A cross-site scripting vulnerability in Trellix Central Management (CM) prior to 9.1.3.97129 allows a remote authenticated attacker to craft CM dashboard inte… |
CVE-2023-51440 | High | 7.5 | 2024-02-13 | A vulnerability has been identified in SIMATIC CP 343-1 (6GK7343-1EX30-0XE0) (All versions), SIMATIC CP 343-1 Lean (6GK7343-1CX10-0XE0) (All versions), SIPLUS… |
CVE-2023-50236 | High | 7.8 | 2024-02-13 | A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The affected product is vulnerable due to weak file and folder permissions in the… |
CVE-2023-49125 | High | 7.8 | 2024-02-13 | A vulnerability has been identified in Parasolid V35.0 (All versions < V35.0.263), Parasolid V35.1 (All versions < V35.1.252), Parasolid V36.0 (All versions <… |
CVE-2023-48364 | Medium | 6.5 | 2024-02-13 | A vulnerability has been identified in OpenPCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC BATCH V9.1 (All versions < V9.1 SP2 UC05), SIMATIC PCS 7 V9.1 (Al… |
CVE-2023-48363 | Medium | 6.5 | 2024-02-13 | A vulnerability has been identified in OpenPCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC BATCH V9.1 (All versions < V9.1 SP2 UC05), SIMATIC PCS 7 V9.1 (Al… |
CVE-2023-6815 | Medium | 6.5 | 2024-02-13 | Incorrect Privilege Assignment vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series Safety CPU R08/16/32/120SFCPU all versions and MELSEC iQ-R S… |
CVE-2023-52431 | High | 8.8 | 2024-02-13 | The Plack::Middleware::XSRFBlock package before 0.0.19 for Perl allows attackers to bypass a CSRF protection mechanism via an empty form value and an empty coo… |
CVE-2023-50358 | Medium | 5.8 | 2024-02-13 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to… |
CVE-2023-47218 | Medium | 5.8 | 2024-02-13 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to… |
CVE-2023-52060 | Medium | 4.3 | 2024-02-13 | A Cross-Site Request Forgery (CSRF) in Gestsup v3.2.46 allows attackers to arbitrarily edit user profile information via a crafted request. |
CVE-2023-52059 | Medium | 5.4 | 2024-02-13 | A cross-site scripting (XSS) vulnerability in Gestsup v3.2.46 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the… |
CVE-2023-49339 | Medium | 6.5 | 2024-02-13 | Ellucian Banner 9.17 allows Insecure Direct Object Reference (IDOR) via a modified bannerId to the /StudentSelfService/ssb/studentCard/retrieveData endpoint. |
CVE-2023-42374 | Critical | 9.8 | 2024-02-13 | An issue in mystenlabs Sui Blockchain before v.1.6.3 allow a remote attacker to execute arbitrary code and cause a denial of service via a crafted compressed s… |
CVE-2023-52430 | Medium | 6.1 | 2024-02-12 | The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload and begins with either a /admin or /set… |
CVE-2023-28018 | Medium | 5.5 | 2024-02-12 | HCL Connections is vulnerable to a denial of service, caused by improper validation on certain requests. Using a specially-crafted request an attacker could ex… |
CVE-2023-7233 | Medium | 4.8 | 2024-02-12 | The GigPress WordPress plugin through 2.3.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2023-6591 | Medium | 4.8 | 2024-02-12 | The Popup Box WordPress plugin before 20.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2023-6501 | Medium | 4.3 | 2024-02-12 | The Splashscreen WordPress plugin through 0.20 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in ad… |
CVE-2023-6499 | Medium | 5.4 | 2024-02-12 | The lasTunes WordPress plugin through 3.6.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attacke… |
CVE-2023-6294 | High | 7.2 | 2024-02-12 | The Popup Builder WordPress plugin before 4.2.6 does not validate a parameter before making a request to it, which could allow users with the administrator rol… |
CVE-2023-6082 | Medium | 5.4 | 2024-02-12 | The chartjs WordPress plugin through 2023.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2023-6081 | Medium | 5.4 | 2024-02-12 | The chartjs WordPress plugin through 2023.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2023-6036 | Critical | 9.8 | 2024-02-12 | The Web3 WordPress plugin before 3.0.0 is vulnerable to an authentication bypass due to incorrect authentication checking in the login flow in functions 'handl… |
CVE-2023-6681 | Medium | 5.3 | 2024-02-12 | A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service (DoS) attack and possible password brute-force and dictionary… |
CVE-2023-46615 | Medium | 5.4 | 2024-02-12 | Deserialization of Untrusted Data vulnerability in Kalli Dan. KD Coming Soon.This issue affects KD Coming Soon: from n/a through 1.7. |
CVE-2023-41708 | Medium | 5.4 | 2024-02-12 | References to the "app loader" functionality could contain redirects to unexpected locations. Attackers could forge app references that bypass existing safegua… |
CVE-2023-41707 | Medium | 6.5 | 2024-02-12 | Processing of user-defined mail search expressions is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the… |
CVE-2023-41706 | Medium | 6.5 | 2024-02-12 | Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached. Availability of OX Ap… |
CVE-2023-41705 | Medium | 6.5 | 2024-02-12 | Processing of user-defined DAV user-agent strings is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the… |
CVE-2023-41704 | High | 7.1 | 2024-02-12 | Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine. Malicious script code could be inject… |
CVE-2023-41703 | Medium | 6.1 | 2024-02-12 | User ID references at mentions in document comments were not correctly sanitized. Script code could be injected to a users session when working with a maliciou… |
CVE-2023-51403 | Medium | 6.5 | 2024-02-12 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nicdark Restaurant Reservations allows Stored XSS.This is… |
CVE-2023-51370 | Medium | 5.9 | 2024-02-12 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NinjaTeam WP Chat App allows Stored XSS.This issue affect… |
CVE-2023-50875 | Medium | 6.5 | 2024-02-12 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Sensei LMS – Online Courses, Quizzes, & Learni… |
CVE-2023-47526 | Medium | 5.9 | 2024-02-12 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chart Builder Team Chartify – WordPress Chart Plugin allo… |
CVE-2023-52429 | Medium | 5.5 | 2024-02-12 | dm_table_create in drivers/md/dm-table.c in the Linux kernel through 6.7.4 can attempt to (in alloc_targets) allocate more than INT_MAX bytes, and crash, becau… |
CVE-2023-52428 | High | 7.5 | 2024-02-11 | In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration c… |
CVE-2023-52427 | High | 7.5 | 2024-02-11 | In OpenDDS through 3.27, there is a segmentation fault for a DataWriter with a large value of resource_limits.max_samples. NOTE: the vendor's position is that… |
CVE-2023-50957 | High | 8.0 | 2024-02-10 | IBM Storage Defender - Resiliency Service 2.0 could allow a privileged user to perform unauthorized actions after obtaining encrypted data from clear text key… |
CVE-2023-51493 | Medium | 6.5 | 2024-02-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Howard Ehrenberg Custom Post Carousels with Owl allows St… |
CVE-2023-51492 | Medium | 6.5 | 2024-02-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If So Plugin If-So Dynamic Content Personalization allows… |
CVE-2023-51488 | High | 7.1 | 2024-02-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic, Inc. Crowdsignal Dashboard – Polls, Surveys &… |
CVE-2023-51485 | Medium | 6.5 | 2024-02-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Hosting Pay with Vipps and MobilePay for WooCommerce a… |
CVE-2023-51480 | Medium | 6.5 | 2024-02-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 Active Products Tables for WooCommerce. Profes… |
CVE-2023-51415 | Medium | 6.5 | 2024-02-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform… |
CVE-2023-51404 | Medium | 6.5 | 2024-02-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MyAgilePrivacy My Agile Privacy – The only GDPR solution… |
CVE-2023-45698 | Medium | 4.8 | 2024-02-10 | Sametime is impacted by lack of clickjacking protection in Outlook add-in. The application is not implementing appropriate protections in order to protect user… |
CVE-2023-45696 | Medium | 4.0 | 2024-02-10 | Sametime is impacted by sensitive fields with autocomplete enabled in the Legacy web chat client. By default, this allows user entered data to be stored by the… |
CVE-2023-28077 | Medium | 4.4 | 2024-02-10 | Dell BSAFE SSL-J, versions prior to 6.5, and versions 7.0 and 7.1 contain a debug message revealing unnecessary information vulnerability. This may lead to di… |
CVE-2023-6935 | Medium | 5.9 | 2024-02-09 | wolfSSL SP Math All RSA implementation is vulnerable to the Marvin Attack, new variation of a timing Bleichenbacher style attack, when built with the following… |
CVE-2023-45718 | Low | 3.9 | 2024-02-09 | Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. W… |
CVE-2023-45716 | Low | 1.7 | 2024-02-09 | Sametime is impacted by sensitive information passed in URL. |
CVE-2023-50349 | Medium | 5.9 | 2024-02-09 | Sametime is impacted by a Cross Site Request Forgery (CSRF) vulnerability. Some REST APIs in the Sametime Proxy application can allow an attacker to perform m… |
CVE-2023-50386 | High | 8.8 | 2024-02-09 | Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Functionality from Untrusted Control Sphe… |
CVE-2023-50298 | High | 7.5 | 2024-02-09 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 b… |
CVE-2023-50292 | High | 7.5 | 2024-02-09 | Incorrect Permission Assignment for Critical Resource, Improper Control of Dynamically-Managed Code Resources vulnerability in Apache Solr. This issue affects… |
CVE-2023-50291 | High | 7.5 | 2024-02-09 | Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of… |
CVE-2023-6677 | Critical | 9.8 | 2024-02-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oduyo Financial Technology Online Collection allows SQL I… |
CVE-2023-6724 | High | 8.8 | 2024-02-09 | Authorization Bypass Through User-Controlled Key vulnerability in Software Engineering Consultancy Machine Equipment Limited Company Hearing Tracking System al… |
CVE-2023-50026 | Critical | 9.8 | 2024-02-09 | SQL injection vulnerability in Presta Monster "Multi Accessories Pro" (hsmultiaccessoriespro) module for PrestaShop versions 5.1.1 and before, allows remote at… |
CVE-2023-46350 | Critical | 9.8 | 2024-02-09 | SQL injection vulnerability in InnovaDeluxe "Manufacturer or supplier alphabetical search" (idxrmanufacturer) module for PrestaShop versions 2.0.4 and before… |
CVE-2023-39683 | Medium | 6.1 | 2024-02-09 | Cross Site Scripting (XSS) vulnerability in EasyEmail v.4.12.2 and before allows a local attacker to execute arbitrary code via the user input parameter(s). NO… |
CVE-2023-31506 | Medium | 5.4 | 2024-02-09 | A cross-site scripting (XSS) vulnerability in Grav versions 1.7.44 and before, allows remote authenticated attackers to execute arbitrary web scripts or HTML v… |
CVE-2023-51761 | High | 8.3 | 2024-02-09 | In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could bypass authentication and acquire admin capabil… |
CVE-2023-49716 | Medium | 6.9 | 2024-02-09 | In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an authenticated user with network access could run arbitrary commands from a remote computer. |
CVE-2023-46687 | Critical | 9.8 | 2024-02-09 | In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could execute arbitrary commands in root context f… |
CVE-2023-43609 | Medium | 6.9 | 2024-02-09 | In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could obtain access to sensitive information or cause… |
CVE-2023-45191 | High | 7.5 | 2024-02-09 | IBM Engineering Lifecycle Optimization 7.0.2 and 7.0.3 uses an inadequate account lockout setting that could allow a remote attacker to brute force account cre… |
CVE-2023-45190 | Medium | 5.1 | 2024-02-09 | IBM Engineering Lifecycle Optimization 7.0.2 and 7.0.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. Thi… |