2023 CVEs (page 61)
Page 61 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-46838 | High | 7.5 | 2024-01-29 | Transmit requests in Xen's virtual network protocol can consist of multiple parts. While not really useful, except for the initial part any of them may be of… |
CVE-2023-6200 | High | 7.5 | 2024-01-28 | A race condition was found in the Linux Kernel. Under certain conditions, an unauthenticated attacker from an adjacent network could send an ICMPv6 router adve… |
CVE-2023-48202 | Medium | 5.4 | 2024-01-27 | Cross-Site Scripting (XSS) vulnerability in Sunlight CMS 8.0.1 allows an authenticated low-privileged user to escalate privileges via a crafted SVG file in the… |
CVE-2023-48201 | Medium | 5.4 | 2024-01-27 | Cross Site Scripting (XSS) vulnerability in Sunlight CMS v.8.0.1, allows remote authenticated attackers to execute arbitrary code and escalate privileges via a… |
CVE-2023-6497 | Medium | 4.4 | 2024-01-27 | The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the automatic redirect URL setting in all versions up… |
CVE-2023-52389 | Critical | 9.8 | 2024-01-27 | UTF32Encoding.cpp in POCO has a Poco::UTF32Encoding integer overflow and resultant stack buffer overflow because Poco::UTF32Encoding::convert() and Poco::UTF32… |
CVE-2023-6482 | Medium | 5.2 | 2024-01-27 | Use of encryption key derived from static information in Synaptics Fingerprint Driver allows an attacker to set up a TLS session with the fingerprint sensor… |
CVE-2023-52187 | Medium | 5.3 | 2024-01-27 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Thomas Maier Image Source Control Lite – Show Image Credits and Captions.This issue… |
CVE-2023-29081 | Medium | 5.5 | 2024-01-26 | A vulnerability has been reported in Suite Setups built with versions prior to InstallShield 2023 R2. This vulnerability may allow locally authenticated users… |
CVE-2023-6291 | High | 7.1 | 2024-01-26 | A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may… |
CVE-2023-6919 | High | 7.5 | 2024-01-26 | Path Traversal: '/../filedir' vulnerability in Biges Safe Life Technologies Electronics Inc. VGuard allows Absolute Path Traversal. This issue affects VGuard… |
CVE-2023-48129 | Medium | 5.4 | 2024-01-26 | An issue in kimono-oldnew mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-48135 | Medium | 5.4 | 2024-01-26 | An issue in mimasaka_farm mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-48133 | Medium | 5.4 | 2024-01-26 | An issue in angel coffee mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-48132 | Medium | 5.4 | 2024-01-26 | An issue in kosei entertainment esportsstudioLegends mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the chann… |
CVE-2023-48131 | Medium | 5.4 | 2024-01-26 | An issue in CHIGASAKI BAKERY mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-48130 | Medium | 5.4 | 2024-01-26 | An issue in GINZA CAFE mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-48128 | Medium | 5.4 | 2024-01-26 | An issue in UNITED BOXING GYM mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-48127 | Medium | 5.4 | 2024-01-26 | An issue in myGAKUYA mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-48126 | Medium | 5.4 | 2024-01-26 | An issue in Luxe Beauty Clinic mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-38323 | Critical | 9.8 | 2024-01-26 | An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the status path script entry in the configuration file, allowing attackers that have dir… |
CVE-2023-38319 | Critical | 9.8 | 2024-01-26 | An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the FAS key entry in the configuration file, allowing attackers that have direct or indi… |
CVE-2023-38318 | Critical | 9.8 | 2024-01-26 | An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the gateway FQDN entry in the configuration file, allowing attackers that have direct or… |
CVE-2023-38317 | Critical | 9.8 | 2024-01-26 | An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the network interface name entry in the configuration file, allowing attackers that have… |
CVE-2023-6159 | Medium | 6.5 | 2024-01-26 | An issue has been discovered in GitLab CE/EE affecting all versions from 12.7 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 It was possible f… |
CVE-2023-5612 | Medium | 5.3 | 2024-01-26 | An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the user e… |
CVE-2023-5933 | Medium | 6.4 | 2024-01-26 | An issue has been discovered in GitLab CE/EE affecting all versions after 13.7 before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. Improper input sa… |
CVE-2023-51833 | High | 8.1 | 2024-01-25 | A command injection issue in TRENDnet TEW-411BRPplus v.2.07_eu that allows a local attacker to execute arbitrary code via the data1 parameter in the debug.cgi… |
CVE-2023-52251 | High | 8.8 | 2024-01-25 | An issue discovered in provectus kafka-ui 0.4.0 through 0.7.1 allows remote attackers to execute arbitrary code via the q parameter of /api/clusters/local/topi… |
CVE-2023-52046 | Medium | 4.8 | 2024-01-25 | Cross Site Scripting vulnerability (XSS) in webmin v.2.105 and earlier allows a remote attacker to execute arbitrary code via a crafted payload to the "Execute… |
CVE-2023-52356 | High | 7.5 | 2024-01-25 | A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a re… |
CVE-2023-52355 | High | 7.5 | 2024-01-25 | An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a rem… |
CVE-2023-41474 | Medium | 6.5 | 2024-01-25 | Directory Traversal vulnerability in Ivanti Avalanche 6.3.4.153 allows a remote authenticated attacker to obtain sensitive information via the javax.faces.reso… |
CVE-2023-7227 | Critical | 9.8 | 2024-01-25 | SystemK NVR 504/508/516 versions 2.3.5SK.30084998 and prior are vulnerable to a command injection vulnerability in the dynamic domain name system (DDNS) setti… |
CVE-2023-6267 | High | 8.6 | 2024-01-25 | A flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is being proc… |
CVE-2023-52076 | High | 8.5 | 2024-01-25 | Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists… |
CVE-2023-40547 | High | 8.3 | 2024-01-25 | A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allow… |
CVE-2023-3181 | High | 7.8 | 2024-01-25 | The C:\Program Files (x86)\Splashtop\Splashtop Software Updater\uninst.exe process creates a folder at C:\Windows\Temp~nsu.tmp and copies itself to it as Au_.e… |
CVE-2023-6282 | Medium | 5.4 | 2024-01-25 | IceHrm 23.0.0.OS does not sufficiently encode user-controlled input, which creates a Cross-Site Scripting (XSS) vulnerability via /icehrm/app/fileupload_page.p… |
CVE-2023-33760 | Medium | 5.3 | 2024-01-25 | SpliceCom Maximiser Soft PBX v1.5 and before was discovered to utilize a default SSL certificate. This issue can allow attackers to eavesdrop on communications… |
CVE-2023-33759 | Critical | 9.8 | 2024-01-25 | SpliceCom Maximiser Soft PBX v1.5 and before does not restrict excessive authentication attempts, allowing attackers to bypass authentication via a brute force… |
CVE-2023-33758 | Medium | 6.1 | 2024-01-25 | Splicecom Maximiser Soft PBX v1.5 and before was discovered to contain a cross-site scripting (XSS) vulnerability via the CLIENT_NAME and DEVICE_GUID fields in… |
CVE-2023-33757 | Medium | 5.9 | 2024-01-25 | A lack of SSL certificate validation in Splicecom iPCS (iOS App) v1.3.4, iPCS2 (iOS App) v2.8 and before, and iPCS (Android App) v1.8.5 and before allows attac… |
CVE-2023-50785 | Low | 2.7 | 2024-01-25 | Zoho ManageEngine ADAudit Plus before 7270 allows admin users to view names of arbitrary directories via path traversal. |
CVE-2023-24676 | High | 7.2 | 2024-01-24 | An issue found in ProcessWire 3.0.210 allows attackers to execute arbitrary code and install a reverse shell via the download_zip_url parameter when installing… |
CVE-2023-52040 | Critical | 9.8 | 2024-01-24 | An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_41284C function. |
CVE-2023-52039 | Critical | 9.8 | 2024-01-24 | An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_415AA4 function. |
CVE-2023-52038 | Critical | 9.8 | 2024-01-24 | An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_415C80 function. |
CVE-2023-51890 | High | 7.5 | 2024-01-24 | An infinite loop issue discovered in Mathtex 1.05 and before allows a remote attackers to consume CPU resources via crafted string in the application URL. |
CVE-2023-51889 | Critical | 9.8 | 2024-01-24 | Stack Overflow vulnerability in the validate() function in Mathtex v.1.05 and before allows a remote attacker to execute arbitrary code via crafted string in t… |
CVE-2023-51888 | High | 7.5 | 2024-01-24 | Buffer Overflow vulnerability in the nomath() function in Mathtex v.1.05 and before allows a remote attacker to cause a denial of service via a crafted string… |
CVE-2023-51887 | Critical | 9.8 | 2024-01-24 | Command Injection vulnerability in Mathtex v.1.05 and before allows a remote attacker to execute arbitrary code via crafted string in application URL. |
CVE-2023-51886 | High | 7.5 | 2024-01-24 | Buffer Overflow vulnerability in the main() function in Mathtex 1.05 and before allows a remote attacker to cause a denial of service when using \convertpath. |
CVE-2023-51885 | Critical | 9.8 | 2024-01-24 | Buffer Overflow vulnerability in Mathtex v.1.05 and before allows a remote attacker to execute arbitrary code via the length of the LaTeX string component. |
CVE-2023-44281 | Medium | 6.6 | 2024-01-24 | Dell Pair Installer version prior to 1.2.1 contains an elevation of privilege vulnerability. A low privilege user with local access to the system could potent… |
CVE-2023-6697 | Medium | 6.1 | 2024-01-24 | The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the map id parameter in all versions up to, a… |
CVE-2023-51702 | Medium | 6.5 | 2024-01-24 | Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configu… |
CVE-2023-50944 | Medium | 6.5 | 2024-01-24 | Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to which they don't have acces… |
CVE-2023-50943 | High | 7.5 | 2024-01-24 | Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the protection of "enable_xco… |
CVE-2023-52221 | Critical | 10.0 | 2024-01-24 | Unrestricted Upload of File with Dangerous Type vulnerability in UkrSolution Barcode Scanner and Inventory manager.This issue affects Barcode Scanner and Inven… |
CVE-2023-44001 | Medium | 5.4 | 2024-01-24 | An issue in Ailand clinic mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-44000 | Medium | 5.4 | 2024-01-24 | An issue in Otakara lapis totuka mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43999 | Medium | 5.4 | 2024-01-24 | An issue in COLORFUL_laundry mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43998 | Medium | 5.4 | 2024-01-24 | An issue in Books-futaba mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43997 | Medium | 5.4 | 2024-01-24 | An issue in Yoruichi hobby base mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43996 | Medium | 5.4 | 2024-01-24 | An issue in Q co ltd mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43995 | Medium | 5.4 | 2024-01-24 | An issue in picot.golf mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43994 | Medium | 5.4 | 2024-01-24 | An issue in Cleaning_makotoya mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43993 | Medium | 5.4 | 2024-01-24 | An issue in smaregi_app_market mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43992 | Medium | 5.4 | 2024-01-24 | An issue in STOCKMAN GROUP mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43991 | Medium | 5.4 | 2024-01-24 | An issue in PRIMA CLINIC mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43990 | Medium | 5.4 | 2024-01-24 | An issue in cherub-hair mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43989 | Medium | 5.4 | 2024-01-24 | An issue in mokumoku chohu mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43988 | Medium | 5.4 | 2024-01-24 | An issue in nature fitness saijo mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-51711 | High | 7.8 | 2024-01-24 | An issue was discovered in Regify Regipay Client for Windows version 4.5.1.0 allows DLL hijacking: a user can trigger the execution of arbitrary code every tim… |
CVE-2023-43317 | High | 8.8 | 2024-01-24 | An issue in Coign CRM Portal v.06.06 allows a remote attacker to escalate privileges via the userPermissionsList parameter in Session Storage component. |
CVE-2023-31037 | High | 7.2 | 2024-01-24 | NVIDIA Bluefield 2 and Bluefield 3 DPU BMC contains a vulnerability in ipmitool, where a root user may cause code injection by a network call. A successful ex… |
CVE-2023-47115 | High | 7.1 | 2024-01-23 | Label Studio is an a popular open source data labeling tool. Versions prior to 1.9.2 have a cross-site scripting (XSS) vulnerability that could be exploited wh… |
CVE-2023-35837 | Critical | 9.8 | 2024-01-23 | An issue was discovered in SolaX Pocket WiFi 3 through 3.001.02. Authentication for web interface is completed via an unauthenticated WiFi AP. The administrati… |
CVE-2023-35836 | Medium | 6.5 | 2024-01-23 | An issue was discovered in SolaX Pocket WiFi 3 through 3.001.02. An attacker within RF range can obtain a cleartext copy of the network configuration of the de… |
CVE-2023-35835 | Critical | 9.8 | 2024-01-23 | An issue was discovered in SolaX Pocket WiFi 3 through 3.001.02. The device provides a WiFi access point for initial configuration. The WiFi network provided h… |
CVE-2023-7237 | Medium | 5.7 | 2024-01-23 | Lantronix XPort sends weakly encoded credentials within web request headers. |
CVE-2023-36177 | Critical | 9.8 | 2024-01-23 | An issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute arbitrary code and gain sensitive information via crafted request… |
CVE-2023-31654 | Critical | 9.8 | 2024-01-23 | Redis raft master-1b8bd86 to master-7b46079 was discovered to contain an ODR violation via the component hiredisAllocFns at /opt/fs/redisraft/deps/hiredis/allo… |
CVE-2023-52338 | High | 7.8 | 2024-01-23 | A link following vulnerability in the Trend Micro Deep Security 20.0 and Trend Micro Cloud One - Endpoint and Workload Security Agent could allow a local attac… |
CVE-2023-52337 | High | 7.8 | 2024-01-23 | An improper access control vulnerability in Trend Micro Deep Security 20.0 and Trend Micro Cloud One - Endpoint and Workload Security Agent could allow a local… |
CVE-2023-52331 | High | 7.1 | 2024-01-23 | A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central could allow an attacker to interact with internal or local se… |
CVE-2023-52330 | Medium | 6.1 | 2024-01-23 | A cross-site scripting vulnerability in Trend Micro Apex Central could allow a remote attacker to execute arbitrary code on affected installations of Trend Mic… |
CVE-2023-52329 | Medium | 6.1 | 2024-01-23 | Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve r… |
CVE-2023-52328 | Medium | 6.1 | 2024-01-23 | Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve r… |
CVE-2023-52327 | Medium | 6.1 | 2024-01-23 | Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve r… |
CVE-2023-52326 | Medium | 6.1 | 2024-01-23 | Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve r… |
CVE-2023-52325 | High | 7.5 | 2024-01-23 | A local file inclusion vulnerability in one of Trend Micro Apex Central's widgets could allow a remote attacker to execute arbitrary code on affected installat… |
CVE-2023-52324 | High | 8.8 | 2024-01-23 | An unrestricted file upload vulnerability in Trend Micro Apex Central could allow a remote attacker to create arbitrary files on affected installations. Ple… |
CVE-2023-52094 | High | 7.8 | 2024-01-23 | An updater link following vulnerability in the Trend Micro Apex One agent could allow a local attacker to abuse the updater to delete an arbitrary folder, lead… |
CVE-2023-52093 | High | 7.8 | 2024-01-23 | An exposed dangerous function vulnerability in the Trend Micro Apex One agent could allow a local attacker to escalate privileges on affected installations. … |
CVE-2023-52092 | High | 7.8 | 2024-01-23 | A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please… |
CVE-2023-52091 | High | 7.8 | 2024-01-23 | An anti-spyware engine link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. P… |
CVE-2023-52090 | High | 7.8 | 2024-01-23 | A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please… |
CVE-2023-47202 | High | 7.8 | 2024-01-23 | A local file inclusion vulnerability on the Trend Micro Apex One management server could allow a local attacker to escalate privileges on affected installation… |