2023 CVEs (page 58)
Page 58 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-47617 | High | 7.2 | 2024-02-06 | A post authentication command injection vulnerability exists when configuring the web group member of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230… |
CVE-2023-47209 | High | 7.2 | 2024-02-06 | A post authentication command injection vulnerability exists in the ipsec policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322… |
CVE-2023-47167 | High | 7.2 | 2024-02-06 | A post authentication command injection vulnerability exists in the GRE policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Re… |
CVE-2023-46683 | High | 7.2 | 2024-02-06 | A post authentication command injection vulnerability exists when configuring the wireguard VPN functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0… |
CVE-2023-43482 | High | 7.2 | 2024-02-06 | A command execution vulnerability exists in the guest resource functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A speci… |
CVE-2023-42664 | High | 7.2 | 2024-02-06 | A post authentication command injection vulnerability exists when setting up the PPTP global configuration of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 bui… |
CVE-2023-36498 | High | 7.2 | 2024-02-06 | A post-authentication command injection vulnerability exists in the PPTP client functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 R… |
CVE-2023-50395 | High | 8.0 | 2024-02-06 | SQL Injection Remote Code Execution Vulnerability was found using an update statement in the SolarWinds Platform. This vulnerability requires user authenticat… |
CVE-2023-46183 | Medium | 5.3 | 2024-02-06 | IBM PowerVM Hypervisor FW950.00 through FW950.90, FW1020.00 through FW1020.40, and FW1030.00 through FW1030.30 could allow a system administrator to obtain sen… |
CVE-2023-35188 | High | 8.0 | 2024-02-06 | SQL Injection Remote Code Execution Vulnerability was found using a create statement in the SolarWinds Platform. This vulnerability requires user authenticati… |
CVE-2023-4503 | Medium | 6.8 | 2024-02-06 | An improper initialization vulnerability was found in Galleon. When using Galleon to provision custom EAP or EAP-XP servers, the servers are created unsecured… |
CVE-2023-32479 | Medium | 6.7 | 2024-02-06 | Dell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server versions prior to 11.9.0 contain privilege escalation vulnerabil… |
CVE-2023-32474 | Medium | 6.6 | 2024-02-06 | Dell Display Manager application, version 2.1.1.17 and prior, contain an insecure operation on windows junction/mount point. A local malicious user could pote… |
CVE-2023-32454 | Medium | 6.3 | 2024-02-06 | DUP framework version 4.9.4.36 and prior contains insecure operation on Windows junction/Mount point vulnerability. A local malicious standard user could expl… |
CVE-2023-32451 | High | 7.3 | 2024-02-06 | Dell Display Manager application, version 2.1.1.17, contains a vulnerability that low privilege user can execute malicious code during installation and uninst… |
CVE-2023-28063 | Medium | 6.7 | 2024-02-06 | Dell BIOS contains a Signed to Unsigned Conversion Error vulnerability. A local authenticated malicious user with admin privileges could potentially exploit t… |
CVE-2023-52239 | Medium | 6.5 | 2024-02-06 | The XML parser in Magic xpi Integration Platform 4.13.4 allows XXE attacks, e.g., via onItemImport. |
CVE-2023-28049 | Medium | 4.7 | 2024-02-06 | Dell Command | Monitor, versions prior to 10.9, contain an arbitrary folder deletion vulnerability. A locally authenticated malicious user may exploit this vu… |
CVE-2023-25543 | High | 7.8 | 2024-02-06 | Dell Power Manager, versions prior to 3.14, contain an Improper Authorization vulnerability in DPM service. A low privileged malicious user could potentially… |
CVE-2023-43536 | High | 7.5 | 2024-02-06 | Transient DOS while parse fils IE with length equal to 1. |
CVE-2023-43535 | High | 8.4 | 2024-02-06 | Memory corruption when negative display IDs are sent as input while processing DISPLAYESCAPE event trigger. |
CVE-2023-43534 | High | 8.6 | 2024-02-06 | Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point. |
CVE-2023-43533 | High | 7.5 | 2024-02-06 | Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame. |
CVE-2023-43532 | High | 8.4 | 2024-02-06 | Memory corruption while reading ACPI config through the user mode app. |
CVE-2023-43523 | High | 7.5 | 2024-02-06 | Transient DOS while processing 11AZ RTT management action frame received through OTA. |
CVE-2023-43522 | High | 7.5 | 2024-02-06 | Transient DOS while key unwrapping process, when the given encrypted key is empty or NULL. |
CVE-2023-43520 | High | 8.6 | 2024-02-06 | Memory corruption when AP includes TID to link mapping IE in the beacons and STA is parsing the beacon TID to link mapping IE. |
CVE-2023-43519 | High | 7.3 | 2024-02-06 | Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size. |
CVE-2023-43518 | High | 7.3 | 2024-02-06 | Memory corruption in video while parsing invalid mp2 clip. |
CVE-2023-43517 | High | 8.4 | 2024-02-06 | Memory corruption in Automotive Multimedia due to improper access control in HAB. |
CVE-2023-43516 | High | 7.8 | 2024-02-06 | Memory corruption when malformed message payload is received from firmware. |
CVE-2023-43513 | High | 7.8 | 2024-02-06 | Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to addr… |
CVE-2023-33077 | Medium | 6.7 | 2024-02-06 | Memory corruption in HLOS while converting from authorization token to HIDL vector. |
CVE-2023-33076 | Medium | 5.9 | 2024-02-06 | Memory corruption in Core when updating rollback version for TA and OTA feature is enabled. |
CVE-2023-33072 | Critical | 9.3 | 2024-02-06 | Memory corruption in Core while processing control functions. |
CVE-2023-33069 | Medium | 6.7 | 2024-02-06 | Memory corruption in Audio while processing the calibration data returned from ACDB loader. |
CVE-2023-33068 | Medium | 6.7 | 2024-02-06 | Memory corruption in Audio while processing IIR config data from AFE calibration block. |
CVE-2023-33067 | Medium | 6.7 | 2024-02-06 | Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap points. |
CVE-2023-33065 | Medium | 6.1 | 2024-02-06 | Information disclosure in Audio while accessing AVCS services from ADSP payload. |
CVE-2023-33064 | Medium | 5.5 | 2024-02-06 | Transient DOS in Audio when invoking callback function of ASM driver. |
CVE-2023-33060 | High | 7.1 | 2024-02-06 | Transient DOS in Core when DDR memory check is called while DDR is not initialized. |
CVE-2023-33058 | High | 8.2 | 2024-02-06 | Information disclosure in Modem while processing SIB5. |
CVE-2023-33057 | High | 7.5 | 2024-02-06 | Transient DOS in Multi-Mode Call Processor while processing UE policy container. |
CVE-2023-33049 | High | 7.5 | 2024-02-06 | Transient DOS in Multi-Mode Call Processor due to UE failure because of heap leakage. |
CVE-2023-33046 | High | 7.8 | 2024-02-06 | Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation. |
CVE-2023-6234 | Critical | 9.8 | 2024-02-06 | Buffer overflow in CPCA Color LUT Resource Download process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network s… |
CVE-2023-6233 | Critical | 9.8 | 2024-02-06 | Buffer overflow in SLP attribute request process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to t… |
CVE-2023-6232 | Critical | 9.8 | 2024-02-06 | Buffer overflow in the Address Book username process in authentication of Mobile Device Function of Office Multifunction Printers and Laser Printers(*) which m… |
CVE-2023-6231 | Critical | 9.8 | 2024-02-06 | Buffer overflow in WSD probe request process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigg… |
CVE-2023-6230 | Critical | 9.8 | 2024-02-06 | Buffer overflow in the Address Book password process in authentication of Mobile Device Function of Office Multifunction Printers and Laser Printers(*) which m… |
CVE-2023-6229 | Critical | 9.8 | 2024-02-06 | Buffer overflow in CPCA PDL Resource Download process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment… |
CVE-2023-47889 | High | 7.8 | 2024-02-06 | The Android application BINHDRM26 com.bdrm.superreboot 1.0.3, exposes several critical actions through its exported broadcast receivers. These exposed actions… |
CVE-2023-47353 | High | 8.8 | 2024-02-06 | An issue in the com.oneed.dvr.service.DownloadFirmwareService component of IMOU GO v1.0.11 allows attackers to force the download of arbitrary files. |
CVE-2023-47022 | Medium | 6.5 | 2024-02-06 | Insecure Direct Object Reference in NCR Terminal Handler v.1.5.1 allows an unprivileged user to edit the audit logs for any user and can lead to CSV injection. |
CVE-2023-46360 | High | 8.8 | 2024-02-06 | Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier is vulnerable to Execution with Unnecessary Privileges. |
CVE-2023-46359 | Critical | 9.8 | 2024-02-06 | An OS command injection vulnerability in Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier, may allow an unauthenticated remote attacker to execute arbi… |
CVE-2023-47354 | High | 7.8 | 2024-02-06 | An issue in the PowerOffWidgetReceiver function of Super Reboot (Root) Recovery v1.0.3 allows attackers to arbitrarily reset or power off the device via a craf… |
CVE-2023-7029 | Medium | 6.4 | 2024-02-05 | The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, a… |
CVE-2023-7014 | Medium | 5.3 | 2024-02-05 | The Author Box, Guest Author and Co-Authors for Your Posts – Molongui plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up t… |
CVE-2023-6996 | High | 8.8 | 2024-02-05 | The Display custom fields in the frontend – Post and User Profile Fields plugin for WordPress is vulnerable to Code Injection via the plugin's vg_display_data… |
CVE-2023-6989 | Critical | 9.8 | 2024-02-05 | The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and… |
CVE-2023-6985 | Medium | 6.5 | 2024-02-05 | The 10Web AI Assistant – AI content writing assistant plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check… |
CVE-2023-6983 | Medium | 4.3 | 2024-02-05 | The Display custom fields in the frontend – Post and User Profile Fields plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions… |
CVE-2023-6982 | Medium | 6.4 | 2024-02-05 | The Display custom fields in the frontend – Post and User Profile Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sho… |
CVE-2023-6963 | Medium | 5.3 | 2024-02-05 | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 2.0.4. This makes it possible for unauthen… |
CVE-2023-6959 | Medium | 4.3 | 2024-02-05 | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the recaptcha_api_ke… |
CVE-2023-6953 | Medium | 4.9 | 2024-02-05 | The PDF Generator For Fluent Forms – The Contact Form Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the header, PDF body and foo… |
CVE-2023-6933 | High | 8.8 | 2024-02-05 | The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrust… |
CVE-2023-6925 | High | 7.2 | 2024-02-05 | The Unlimited Addons for WPBakery Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'im… |
CVE-2023-6884 | Medium | 6.4 | 2024-02-05 | This plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 3.1 due to insufficient… |
CVE-2023-6846 | High | 8.8 | 2024-02-05 | The File Manager Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.3.4 via the mk_check_filemanager_php_s… |
CVE-2023-6808 | Medium | 6.4 | 2024-02-05 | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in al… |
CVE-2023-6807 | Medium | 6.4 | 2024-02-05 | The GeneratePress Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom meta output in all versions up to, and incl… |
CVE-2023-6701 | Medium | 6.4 | 2024-02-05 | The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a custom text field in all versions up to, and including… |
CVE-2023-6700 | High | 8.8 | 2024-02-05 | The Cookie Information | Free GDPR Consent Solution plugin for WordPress is vulnerable to arbitrary option updates due to a missing capability check on its AJA… |
CVE-2023-6635 | High | 7.2 | 2024-02-05 | The EditorsKit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation on the 'import_styles' function in versions up… |
CVE-2023-6557 | Medium | 5.3 | 2024-02-05 | The The Events Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.2.8.2 via the route functi… |
CVE-2023-6526 | Medium | 6.4 | 2024-02-05 | The Meta Box – WordPress Custom Fields Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom post meta values displayed throug… |
CVE-2023-4637 | Medium | 4.3 | 2024-02-05 | The WPvivid plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the restore() and get_restore_progress() fun… |
CVE-2023-34042 | Medium | 4.1 | 2024-02-05 | The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be written by anyone with… |
CVE-2023-22819 | Medium | 4.9 | 2024-02-05 | An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount of memory, eventua… |
CVE-2023-22817 | Medium | 5.5 | 2024-02-05 | Server-side request forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL using another DNS address to point back… |
CVE-2023-51951 | Critical | 9.8 | 2024-02-05 | SQL Injection vulnerability in Stock Management System 1.0 allows a remote attacker to execute arbitrary code via the id parameter in the manage_bo.php file. |
CVE-2023-50782 | High | 7.5 | 2024-02-05 | A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchan… |
CVE-2023-50781 | High | 7.5 | 2024-02-05 | A flaw was found in m2crypto. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to… |
CVE-2023-27318 | Medium | 6.5 | 2024-02-05 | StorageGRID (formerly StorageGRID Webscale) versions 11.6.0 through 11.6.0.13 are susceptible to a Denial of Service (DoS) vulnerability. A successful exploi… |
CVE-2023-6874 | High | 7.5 | 2024-02-05 | Prior to v7.4.0, Ember ZNet is vulnerable to a denial of service attack through manipulation of the NWK sequence number |
CVE-2023-6028 | Medium | 6.1 | 2024-02-05 | A reflected cross-site scripting (XSS) vulnerability exists in the SVG version of System Diagnostics Manager of B&R Automation Runtime versions <= G4.93 that e… |
CVE-2023-47355 | High | 7.5 | 2024-02-05 | The com.eypcnnapps.quickreboot (aka Eyuep Can Yilmaz {ROOT] Quick Reboot) application 1.0.8 for Android has exposed broadcast receivers for PowerOff, Reboot, a… |
CVE-2023-7216 | Medium | 5.3 | 2024-02-05 | A path traversal vulnerability was found in the CPIO utility. This issue could allow a remote unauthenticated attacker to trick a user into opening a specially… |
CVE-2023-52138 | High | 8.2 | 2024-02-05 | Engrampa is an archive manager for the MATE environment. Engrampa is found to be vulnerable to a Path Traversal vulnerability that can be leveraged to achieve… |
CVE-2023-5643 | High | 7.8 | 2024-02-05 | Out-of-bounds Write vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver a… |
CVE-2023-5249 | High | 7.0 | 2024-02-05 | Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver allows a local non-privileged user to make improper memory… |
CVE-2023-7077 | Critical | 9.8 | 2024-02-05 | Sharp NEC Displays (P403, P463, P553, P703, P801, X554UN, X464UN, X554UNS, X464UNV, X474HB, X464UNS, X554UNV, X555UNS, X555UNV, X754HB, X554HB, E705, E805, E90… |
CVE-2023-5800 | Medium | 5.4 | 2024-02-05 | Vintage, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API create_overlay.cgi did not have a sufficient input validation allowing for a po… |
CVE-2023-5677 | Medium | 6.3 | 2024-02-05 | Brandon Rothel from QED Secure Solutions and Sam Hanson of Dragos have found that the VAPIX API tcptest.cgi did not have a sufficient input validation allowing… |
CVE-2023-51504 | Medium | 6.5 | 2024-02-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Dulaney Dan's Embedder for Google Calendar allows Sto… |
CVE-2023-52426 | Medium | 5.5 | 2024-02-04 | libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time. |
CVE-2023-52425 | High | 7.5 | 2024-02-04 | libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multi… |
CVE-2023-6240 | Medium | 6.5 | 2024-02-04 | A Marvin vulnerability side-channel leakage was found in the RSA decryption operation in the Linux Kernel. This issue may allow a network attacker to decrypt c… |