2023 CVEs (page 58)
Page 58 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-45187 | Medium | 6.3 | 2024-02-09 | IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 does not invalidate session after logout which could allow an authenticated user to imperso… |
CVE-2023-42016 | Medium | 4.3 | 2024-02-09 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.3 does not set the secure attribute on authorization tokens or s… |
CVE-2023-32341 | Medium | 6.5 | 2024-02-09 | IBM Sterling B2B Integrator 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.3 could allow an authenticated user to cause a denial of service due to uncontrol… |
CVE-2023-51630 | Medium | 6.1 | 2024-02-08 | Paessler PRTG Network Monitor Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on… |
CVE-2023-47132 | Critical | 9.8 | 2024-02-08 | An issue discovered in N-able N-central before 2023.6 and earlier allows attackers to gain escalated privileges via API calls. |
CVE-2023-47131 | High | 7.5 | 2024-02-08 | The N-able PassPortal extension before 3.29.2 for Chrome inserts sensitive information into a log file. |
CVE-2023-40264 | Medium | 4.3 | 2024-02-08 | An issue was discovered in Atos Unify OpenScape Voice Trace Manager V8 before V8 R0.9.11. It allows authenticated path traversal in the user interface. |
CVE-2023-40263 | High | 8.8 | 2024-02-08 | An issue was discovered in Atos Unify OpenScape Voice Trace Manager V8 before V8 R0.9.11. It allows authenticated command injection via ftp. |
CVE-2023-40262 | Medium | 6.1 | 2024-02-08 | An issue was discovered in Atos Unify OpenScape Voice Trace Manager V8 before V8 R0.9.11. It allows unauthenticated Stored Cross-Site Scripting (XSS) in the ad… |
CVE-2023-49101 | Medium | 6.1 | 2024-02-08 | WebAdmin in Axigen 10.3.x before 10.3.3.61, 10.4.x before 10.4.24, and 10.5.x before 10.5.10 allows XSS attacks against admins because of mishandling of viewin… |
CVE-2023-40266 | Critical | 9.8 | 2024-02-08 | An issue was discovered in Atos Unify OpenScape Xpressions WebAssistant V7 before V7R1 FR5 HF42 P911. It allows path traversal. |
CVE-2023-40265 | High | 8.8 | 2024-02-08 | An issue was discovered in Atos Unify OpenScape Xpressions WebAssistant V7 before V7R1 FR5 HF42 P911. It allows authenticated remote code execution via file up… |
CVE-2023-27001 | High | 8.8 | 2024-02-08 | An issue discovered in Egerie Risk Manager v4.0.5 allows attackers to bypass the signature mechanism and tamper with the values inside the JWT payload resultin… |
CVE-2023-25365 | High | 7.8 | 2024-02-08 | Cross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to execute arbitrary code via the file type .mp3 |
CVE-2023-50061 | Critical | 9.8 | 2024-02-08 | PrestaShop Op'art Easy Redirect >= 1.3.8 and <= 1.3.12 is vulnerable to SQL Injection via Oparteasyredirect::hookActionDispatcher(). |
CVE-2023-42282 | Critical | 9.8 | 2024-02-08 | The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPubli… |
CVE-2023-47020 | High | 8.8 | 2024-02-08 | Multiple Cross-Site Request Forgery (CSRF) chaining in NCR Terminal Handler v.1.5.1 allows privileges to be escalated by an attacker through a crafted request… |
CVE-2023-7169 | Medium | 6.0 | 2024-02-08 | Authentication Bypass by Spoofing vulnerability in Snow Software Snow Inventory Agent on Windows allows Signature Spoof.This issue affects Snow Inventory Agent… |
CVE-2023-6564 | Medium | 6.5 | 2024-02-08 | An issue has been discovered in GitLab EE Premium and Ultimate affecting versions 16.4.3, 16.5.3, and 16.6.1. In projects using subgroups to define who can pus… |
CVE-2023-6519 | High | 7.5 | 2024-02-08 | Exposure of Data Element to Wrong Session vulnerability in Mia Technology Inc. MİA-MED allows Read Sensitive Strings Within an Executable. This issue affects… |
CVE-2023-6518 | High | 7.5 | 2024-02-08 | Plaintext Storage of a Password vulnerability in Mia Technology Inc. MİA-MED allows Read Sensitive Strings Within an Executable. This issue affects MİA-MED: b… |
CVE-2023-6517 | High | 7.5 | 2024-02-08 | Exposure of Sensitive Information Due to Incompatible Policies vulnerability in Mia Technology Inc. MİA-MED allows Collect Data as Provided by Users. This iss… |
CVE-2023-6515 | High | 8.8 | 2024-02-08 | Authorization Bypass Through User-Controlled Key vulnerability in Mia Technology Inc. MİA-MED allows Authentication Abuse. This issue affects MİA-MED: before… |
CVE-2023-5665 | Medium | 6.4 | 2024-02-08 | The Payment Forms for Paystack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and includi… |
CVE-2023-47798 | Medium | 5.4 | 2024-02-08 | Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsupported versions do… |
CVE-2023-48974 | Critical | 9.6 | 2024-02-08 | Cross Site Scripting vulnerability in Axigen WebMail prior to 10.3.3.61 allows a remote attacker to escalate privileges via a crafted script to the serverName_… |
CVE-2023-6840 | Medium | 6.7 | 2024-02-07 | An issue has been discovered in GitLab EE affecting all versions from 16.4 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2 which allows a maint… |
CVE-2023-6736 | Medium | 6.5 | 2024-02-07 | An issue has been discovered in GitLab EE affecting all versions starting from 11.3 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions… |
CVE-2023-6536 | Medium | 6.5 | 2024-02-07 | A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NV… |
CVE-2023-6535 | Medium | 6.5 | 2024-02-07 | A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NV… |
CVE-2023-6356 | Medium | 6.5 | 2024-02-07 | A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NV… |
CVE-2023-38995 | Critical | 9.8 | 2024-02-07 | An issue in SCHUHFRIED v.8.22.00 allows remote attacker to obtain the database password via crafted curl command. |
CVE-2023-47700 | Medium | 5.9 | 2024-02-07 | IBM SAN Volume Controller, IBM Storwize, IBM FlashSystem and IBM Storage Virtualize 8.6 products could allow a remote attacker to spoof a trusted system that w… |
CVE-2023-43017 | High | 8.2 | 2024-02-07 | IBM Security Verify Access 10.0.0.0 through 10.0.6.1 could allow a privileged user to install a configuration file that could allow remote access. IBM X-Force… |
CVE-2023-38369 | Medium | 6.2 | 2024-02-07 | IBM Security Access Manager Container 10.0.0.0 through 10.0.6.1 does not require that docker images should have strong passwords by default, which makes it eas… |
CVE-2023-32330 | High | 7.5 | 2024-02-07 | IBM Security Verify Access 10.0.0.0 through 10.0.6.1 uses insecure calls that could allow an attacker on the network to take control of the server. IBM X-Forc… |
CVE-2023-32328 | High | 7.5 | 2024-02-07 | IBM Security Verify Access 10.0.0.0 through 10.0.6.1 uses insecure protocols in some instances that could allow an attacker on the network to take control of t… |
CVE-2023-31002 | Medium | 5.1 | 2024-02-07 | IBM Security Access Manager Container 10.0.0.0 through 10.0.6.1 temporarily stores sensitive information in files that could be accessed by a local user. IBM… |
CVE-2023-39196 | Medium | 5.3 | 2024-02-07 | Improper Authentication vulnerability in Apache Ozone. The vulnerability allows an attacker to download metadata internal to the Storage Container Manager ser… |
CVE-2023-51437 | High | 7.4 | 2024-02-07 | Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge a SASL Role Token that will pass signa… |
CVE-2023-46914 | Critical | 9.8 | 2024-02-07 | SQL Injection vulnerability in RM bookingcalendar module for PrestaShop versions 2.7.9 and before, allows remote attackers to execute arbitrary code, escalate… |
CVE-2023-40355 | Medium | 5.4 | 2024-02-07 | Cross Site Scripting (XSS) vulnerability in Axigen versions 10.3.3.0 before 10.3.3.59, 10.4.0 before 10.4.19, and 10.5.0 before 10.5.5, allows authenticated at… |
CVE-2023-6388 | Medium | 5.0 | 2024-02-07 | Suite CRM version 7.14.2 allows making arbitrary HTTP requests through the vulnerable server. This is possible because the application is vulnerable to SSRF. |
CVE-2023-45735 | High | 8.0 | 2024-02-06 | A potential attacker with access to the Westermo Lynx device may be able to execute malicious code that could affect the correct functioning of the device… |
CVE-2023-45227 | Medium | 5.4 | 2024-02-06 | An attacker with access to the web application with vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting… |
CVE-2023-45222 | Medium | 5.4 | 2024-02-06 | An attacker with access to the web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting pay… |
CVE-2023-45213 | Medium | 6.6 | 2024-02-06 | A potential attacker with access to the Westermo Lynx device would be able to execute malicious code that could affect the correct functioning of the de… |
CVE-2023-42765 | Medium | 5.4 | 2024-02-06 | An attacker with access to the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "username… |
CVE-2023-40544 | Medium | 5.7 | 2024-02-06 | An attacker with access to the network where the affected devices are located could maliciously actions to obtain, via a sniffer, sensitive informat… |
CVE-2023-40143 | Medium | 5.4 | 2024-02-06 | An attacker with access to the Westermo Lynx web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site s… |
CVE-2023-38579 | High | 8.0 | 2024-02-06 | The cross-site request forgery token in the request may be predictable or easily guessable allowing attackers to craft a malicious request, which… |
CVE-2023-40545 | High | 8.8 | 2024-02-06 | Authentication bypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affected 11.3 versions via specially crafted requests. |
CVE-2023-47618 | High | 7.2 | 2024-02-06 | A post authentication command execution vulnerability exists in the web filtering functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322… |
CVE-2023-47617 | High | 7.2 | 2024-02-06 | A post authentication command injection vulnerability exists when configuring the web group member of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230… |
CVE-2023-47209 | High | 7.2 | 2024-02-06 | A post authentication command injection vulnerability exists in the ipsec policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322… |
CVE-2023-47167 | High | 7.2 | 2024-02-06 | A post authentication command injection vulnerability exists in the GRE policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Re… |
CVE-2023-46683 | High | 7.2 | 2024-02-06 | A post authentication command injection vulnerability exists when configuring the wireguard VPN functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0… |
CVE-2023-43482 | High | 7.2 | 2024-02-06 | A command execution vulnerability exists in the guest resource functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A speci… |
CVE-2023-42664 | High | 7.2 | 2024-02-06 | A post authentication command injection vulnerability exists when setting up the PPTP global configuration of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 bui… |
CVE-2023-36498 | High | 7.2 | 2024-02-06 | A post-authentication command injection vulnerability exists in the PPTP client functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 R… |
CVE-2023-50395 | High | 8.0 | 2024-02-06 | SQL Injection Remote Code Execution Vulnerability was found using an update statement in the SolarWinds Platform. This vulnerability requires user authenticat… |
CVE-2023-46183 | Medium | 5.3 | 2024-02-06 | IBM PowerVM Hypervisor FW950.00 through FW950.90, FW1020.00 through FW1020.40, and FW1030.00 through FW1030.30 could allow a system administrator to obtain sen… |
CVE-2023-35188 | High | 8.0 | 2024-02-06 | SQL Injection Remote Code Execution Vulnerability was found using a create statement in the SolarWinds Platform. This vulnerability requires user authenticati… |
CVE-2023-4503 | Medium | 6.8 | 2024-02-06 | An improper initialization vulnerability was found in Galleon. When using Galleon to provision custom EAP or EAP-XP servers, the servers are created unsecured… |
CVE-2023-32479 | Medium | 6.7 | 2024-02-06 | Dell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server versions prior to 11.9.0 contain privilege escalation vulnerabil… |
CVE-2023-32474 | Medium | 6.6 | 2024-02-06 | Dell Display Manager application, version 2.1.1.17 and prior, contain an insecure operation on windows junction/mount point. A local malicious user could pote… |
CVE-2023-32454 | Medium | 6.3 | 2024-02-06 | DUP framework version 4.9.4.36 and prior contains insecure operation on Windows junction/Mount point vulnerability. A local malicious standard user could expl… |
CVE-2023-32451 | High | 7.3 | 2024-02-06 | Dell Display Manager application, version 2.1.1.17, contains a vulnerability that low privilege user can execute malicious code during installation and uninst… |
CVE-2023-28063 | Medium | 6.7 | 2024-02-06 | Dell BIOS contains a Signed to Unsigned Conversion Error vulnerability. A local authenticated malicious user with admin privileges could potentially exploit t… |
CVE-2023-52239 | Medium | 6.5 | 2024-02-06 | The XML parser in Magic xpi Integration Platform 4.13.4 allows XXE attacks, e.g., via onItemImport. |
CVE-2023-28049 | Medium | 4.7 | 2024-02-06 | Dell Command | Monitor, versions prior to 10.9, contain an arbitrary folder deletion vulnerability. A locally authenticated malicious user may exploit this vu… |
CVE-2023-25543 | High | 7.8 | 2024-02-06 | Dell Power Manager, versions prior to 3.14, contain an Improper Authorization vulnerability in DPM service. A low privileged malicious user could potentially… |
CVE-2023-43536 | High | 7.5 | 2024-02-06 | Transient DOS while parse fils IE with length equal to 1. |
CVE-2023-43535 | High | 8.4 | 2024-02-06 | Memory corruption when negative display IDs are sent as input while processing DISPLAYESCAPE event trigger. |
CVE-2023-43534 | High | 8.6 | 2024-02-06 | Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point. |
CVE-2023-43533 | High | 7.5 | 2024-02-06 | Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame. |
CVE-2023-43532 | High | 8.4 | 2024-02-06 | Memory corruption while reading ACPI config through the user mode app. |
CVE-2023-43523 | High | 7.5 | 2024-02-06 | Transient DOS while processing 11AZ RTT management action frame received through OTA. |
CVE-2023-43522 | High | 7.5 | 2024-02-06 | Transient DOS while key unwrapping process, when the given encrypted key is empty or NULL. |
CVE-2023-43520 | High | 8.6 | 2024-02-06 | Memory corruption when AP includes TID to link mapping IE in the beacons and STA is parsing the beacon TID to link mapping IE. |
CVE-2023-43519 | High | 7.3 | 2024-02-06 | Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size. |
CVE-2023-43518 | High | 7.3 | 2024-02-06 | Memory corruption in video while parsing invalid mp2 clip. |
CVE-2023-43517 | High | 8.4 | 2024-02-06 | Memory corruption in Automotive Multimedia due to improper access control in HAB. |
CVE-2023-43516 | High | 7.8 | 2024-02-06 | Memory corruption when malformed message payload is received from firmware. |
CVE-2023-43513 | High | 7.8 | 2024-02-06 | Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to addr… |
CVE-2023-33077 | Medium | 6.7 | 2024-02-06 | Memory corruption in HLOS while converting from authorization token to HIDL vector. |
CVE-2023-33076 | Medium | 5.9 | 2024-02-06 | Memory corruption in Core when updating rollback version for TA and OTA feature is enabled. |
CVE-2023-33072 | Critical | 9.3 | 2024-02-06 | Memory corruption in Core while processing control functions. |
CVE-2023-33069 | Medium | 6.7 | 2024-02-06 | Memory corruption in Audio while processing the calibration data returned from ACDB loader. |
CVE-2023-33068 | Medium | 6.7 | 2024-02-06 | Memory corruption in Audio while processing IIR config data from AFE calibration block. |
CVE-2023-33067 | Medium | 6.7 | 2024-02-06 | Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap points. |
CVE-2023-33065 | Medium | 6.1 | 2024-02-06 | Information disclosure in Audio while accessing AVCS services from ADSP payload. |
CVE-2023-33064 | Medium | 5.5 | 2024-02-06 | Transient DOS in Audio when invoking callback function of ASM driver. |
CVE-2023-33060 | High | 7.1 | 2024-02-06 | Transient DOS in Core when DDR memory check is called while DDR is not initialized. |
CVE-2023-33058 | High | 8.2 | 2024-02-06 | Information disclosure in Modem while processing SIB5. |
CVE-2023-33057 | High | 7.5 | 2024-02-06 | Transient DOS in Multi-Mode Call Processor while processing UE policy container. |
CVE-2023-33049 | High | 7.5 | 2024-02-06 | Transient DOS in Multi-Mode Call Processor due to UE failure because of heap leakage. |
CVE-2023-33046 | High | 7.8 | 2024-02-06 | Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation. |
CVE-2023-6234 | Critical | 9.8 | 2024-02-06 | Buffer overflow in CPCA Color LUT Resource Download process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network s… |
CVE-2023-6233 | Critical | 9.8 | 2024-02-06 | Buffer overflow in SLP attribute request process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to t… |