2023 CVEs (page 62)
Page 62 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-47201 | High | 7.8 | 2024-01-23 | A plug-in manager origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected in… |
CVE-2023-47200 | High | 7.8 | 2024-01-23 | A plug-in manager origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected in… |
CVE-2023-47199 | High | 7.8 | 2024-01-23 | An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. … |
CVE-2023-47198 | High | 7.8 | 2024-01-23 | An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. … |
CVE-2023-47197 | High | 7.8 | 2024-01-23 | An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. … |
CVE-2023-47196 | High | 7.8 | 2024-01-23 | An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. … |
CVE-2023-47195 | High | 7.8 | 2024-01-23 | An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. … |
CVE-2023-47194 | High | 7.8 | 2024-01-23 | An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. … |
CVE-2023-47193 | High | 7.8 | 2024-01-23 | An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. … |
CVE-2023-47192 | High | 7.8 | 2024-01-23 | An agent link vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. Please… |
CVE-2023-46892 | High | 8.8 | 2024-01-23 | The radio frequency communication protocol being used by Meross MSH30Q 4.5.23 is vulnerable to replay attacks, allowing attackers to record and replay previous… |
CVE-2023-41178 | Medium | 6.1 | 2024-01-23 | Reflected cross-site scripting (XSS) vulnerabilities in Trend Micro Mobile Security (Enterprise) could allow an exploit against an authenticated victim that vi… |
CVE-2023-41177 | Medium | 6.1 | 2024-01-23 | Reflected cross-site scripting (XSS) vulnerabilities in Trend Micro Mobile Security (Enterprise) could allow an exploit against an authenticated victim that vi… |
CVE-2023-41176 | Medium | 6.1 | 2024-01-23 | Reflected cross-site scripting (XSS) vulnerabilities in Trend Micro Mobile Security (Enterprise) could allow an exploit against an authenticated victim that vi… |
CVE-2023-38627 | Medium | 5.4 | 2024-01-23 | A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow an attacker to inter… |
CVE-2023-38626 | Medium | 5.4 | 2024-01-23 | A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow an attacker to inter… |
CVE-2023-38625 | Medium | 5.4 | 2024-01-23 | A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow an attacker to inter… |
CVE-2023-38624 | Medium | 5.4 | 2024-01-23 | A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow an attacker to inter… |
CVE-2023-7238 | High | 7.1 | 2024-01-23 | A XSS payload can be uploaded as a DICOM study and when a user tries to view the infected study inside the Osimis WebViewer the XSS vulnerability gets trigger… |
CVE-2023-6926 | High | 8.4 | 2024-01-23 | There is an OS command injection vulnerability in Crestron AM-300 firmware version 1.4499.00018 which may enable a user of a limited-access SSH session to esc… |
CVE-2023-46889 | Medium | 5.7 | 2024-01-23 | Meross MSH30Q 4.5.23 is vulnerable to Cleartext Transmission of Sensitive Information. During the device setup phase, the MSH30Q creates an unprotected Wi-Fi a… |
CVE-2023-42144 | Medium | 5.5 | 2024-01-23 | Cleartext Transmission during initial setup in Shelly TRV 20220811-15234 v.2.1.8 allows a local attacker to obtain the Wi-Fi password. |
CVE-2023-42143 | Medium | 5.4 | 2024-01-23 | Missing Integrity Check in Shelly TRV 20220811-152343/v2.1.8@5afc928c allows malicious users to create a backdoor by redirecting the device to an attacker-cont… |
CVE-2023-51210 | Critical | 9.8 | 2024-01-23 | SQL injection vulnerability in Webkul Bundle Product 6.0.1 allows a remote attacker to execute arbitrary code via the id_product parameters in the UpdateProduc… |
CVE-2023-6573 | Medium | 5.5 | 2024-01-23 | HPE OneView may have a missing passphrase during restore. |
CVE-2023-45889 | Medium | 6.1 | 2024-01-23 | A Universal Cross Site Scripting (UXSS) vulnerability in ClassLink OneClick Extension through 10.8 allows remote attackers to inject JavaScript into any webpag… |
CVE-2023-50275 | High | 7.5 | 2024-01-23 | HPE OneView may allow clusterService Authentication Bypass resulting in denial of service. |
CVE-2023-50274 | High | 7.8 | 2024-01-23 | HPE OneView may allow command injection with local privilege escalation. |
CVE-2023-49657 | Critical | 9.6 | 2024-01-23 | A stored cross-site scripting (XSS) vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permissions on charts or… |
CVE-2023-49783 | Medium | 4.3 | 2024-01-23 | Silverstripe Admin provides a basic management interface for the Silverstripe Framework. In versions on the 1.x branch prior to 1.13.19 and on the 2.x branch p… |
CVE-2023-48714 | Medium | 4.3 | 2024-01-23 | Silverstripe Framework is the framework that forms the base of the Silverstripe content management system. Prior to versions 4.13.39 and 5.1.11, if a user shou… |
CVE-2023-44401 | Medium | 5.3 | 2024-01-23 | The Silverstripe CMS GraphQL Server serves Silverstripe data as GraphQL representations. In versions 4.0.0 prior to 4.3.7 and 5.0.0 prior to 5.1.3, `canView` p… |
CVE-2023-51043 | High | 7.0 | 2024-01-23 | In the Linux kernel before 6.4.5, drivers/gpu/drm/drm_atomic.c has a use-after-free during a race condition between a nonblocking atomic commit and a driver un… |
CVE-2023-51042 | High | 7.8 | 2024-01-23 | In the Linux kernel before 6.4.12, amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c has a fence use-after-free. |
CVE-2023-46343 | Medium | 5.5 | 2024-01-23 | In the Linux kernel before 6.5.9, there is a NULL pointer dereference in send_acknowledge in net/nfc/nci/spi.c. |
CVE-2023-39197 | Medium | 4.0 | 2024-01-23 | An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux kernel. This flaw allows a remote user to disclose sens… |
CVE-2023-42937 | Medium | 5.5 | 2024-01-23 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.7.5 and iPadOS 16.7.5, watchOS 10.2, macOS Ve… |
CVE-2023-42935 | Medium | 5.5 | 2024-01-23 | An authentication issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.6.4. A local attacker may be able to view the pre… |
CVE-2023-42888 | Medium | 5.5 | 2024-01-23 | The issue was addressed with improved checks. This issue is fixed in iOS 16.7.5 and iPadOS 16.7.5, watchOS 10.2, macOS Ventura 13.6.4, macOS Sonoma 14.2, macOS… |
CVE-2023-42887 | Medium | 6.3 | 2024-01-23 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Ventura 13.6.4, macOS Sonoma 14.2. An app may be able to read… |
CVE-2023-42881 | High | 7.8 | 2024-01-23 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.2. Processing a file may lead to unexpected app termination or ar… |
CVE-2023-40528 | Medium | 5.5 | 2024-01-23 | This issue was addressed by removing the vulnerable code. This issue is fixed in tvOS 17, watchOS 10, macOS Sonoma 14, iOS 17 and iPadOS 17, macOS Ventura 13.6… |
CVE-2023-47141 | Medium | 5.3 | 2024-01-22 | IIBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow an authenticated user with CONNECT privileges to cause a denial of service… |
CVE-2023-24135 | High | 7.8 | 2024-01-22 | Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a command injection vulnerability in the function formWriteFacMac. This vulnerabil… |
CVE-2023-7194 | Medium | 6.1 | 2024-01-22 | The Meris WordPress theme through 1.1.2 does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site S… |
CVE-2023-7170 | Medium | 6.1 | 2024-01-22 | The EventON-RSVP WordPress plugin before 2.9.5 does not sanitise and escape some parameters before outputting it back in the page, leading to a Reflected Cross… |
CVE-2023-7082 | High | 7.2 | 2024-01-22 | The Import any XML or CSV File to WordPress plugin before 3.7.3 accepts all zip files and automatically extracts the zip file into a publicly accessible direct… |
CVE-2023-6626 | Medium | 4.8 | 2024-01-22 | The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not sanitise and escape some of its settings, which could allow high privilege users such… |
CVE-2023-6625 | Medium | 4.3 | 2024-01-22 | The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not have a CSRF check in place when deleting inquiries, which could allow attackers to mak… |
CVE-2023-6456 | Medium | 4.8 | 2024-01-22 | The WP Review Slider WordPress plugin before 13.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2023-6447 | Medium | 5.3 | 2024-01-22 | The EventPrime WordPress plugin before 3.3.6 lacks authentication and authorization, allowing unauthenticated visitors to access private and password protected… |
CVE-2023-6384 | Medium | 4.3 | 2024-01-22 | The WP User Profile Avatar WordPress plugin before 1.0.1 does not properly check for authorisation, allowing authors to delete and update arbitrary avatar |
CVE-2023-6290 | Medium | 4.8 | 2024-01-22 | The SEOPress WordPress plugin before 7.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cro… |
CVE-2023-47747 | Medium | 5.3 | 2024-01-22 | IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.1, 10.5, and 11.1 could allow an authenticated user with CONNECT privileges to cause a den… |
CVE-2023-47158 | Medium | 5.3 | 2024-01-22 | IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1 and 11.5 could allow an authenticated user with CONNECT privileges to cause a… |
CVE-2023-47152 | Medium | 5.9 | 2024-01-22 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to an insecure cryptographic algorithm and to information disclosure in st… |
CVE-2023-27859 | Medium | 6.5 | 2024-01-22 | IBM Db2 10.1, 10.5, and 11.1 could allow a remote user to execute arbitrary code caused by installing like named jar files across multiple databases. A user c… |
CVE-2023-50308 | Medium | 6.5 | 2024-01-22 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 under certain circumstances could allow an authenticated user to the database to cause a… |
CVE-2023-48118 | Critical | 9.8 | 2024-01-22 | SQL Injection vulnerability in Quest Analytics LLC IQCRM v.2023.9.5 allows a remote attacker to execute arbitrary code via a crafted request to the Common.svc… |
CVE-2023-47746 | Medium | 5.3 | 2024-01-22 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 could allow an authenticated user with CONNECT privileges to cause a den… |
CVE-2023-45193 | Medium | 5.9 | 2024-01-22 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 federated server is vulnerable to a denial of service when a specially crafted cursor is… |
CVE-2023-44395 | Medium | 4.9 | 2024-01-22 | Autolab is a course management service that enables instructors to offer autograded programming assignments to their students over the Web. Path traversal vuln… |
CVE-2023-52354 | High | 7.5 | 2024-01-22 | chasquid before 1.13 allows SMTP smuggling because LF-terminated lines are accepted. |
CVE-2023-47352 | High | 8.8 | 2024-01-22 | Technicolor TC8715D devices have predictable default WPA2 security passwords. An attacker who scans for SSID and BSSID values may be able to predict these pass… |
CVE-2023-52353 | High | 7.5 | 2024-01-21 | An issue was discovered in Mbed TLS through 3.5.1. In mbedtls_ssl_session_reset, the maximum negotiable TLS version is mishandled. For example, if the last con… |
CVE-2023-6531 | High | 7.0 | 2024-01-21 | A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()… |
CVE-2023-7063 | High | 7.2 | 2024-01-20 | The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission parameters in all versions up to, and including, 1.8.5.3… |
CVE-2023-46447 | Medium | 4.3 | 2024-01-20 | The POPS! Rebel application 5.0 for Android, in POPS! Rebel Bluetooth Glucose Monitoring System, sends unencrypted glucose measurements over BLE. |
CVE-2023-51925 | Critical | 9.8 | 2024-01-20 | An arbitrary file upload vulnerability in the nccloud.web.arcp.taskmonitor.action.ArcpUploadAction.doAction() method of YonBIP v3_23.05 allows attackers to exe… |
CVE-2023-51924 | Critical | 9.8 | 2024-01-20 | An arbitrary file upload vulnerability in the uap.framework.rc.itf.IResourceManager interface of YonBIP v3_23.05 allows attackers to execute arbitrary code via… |
CVE-2023-51906 | Critical | 9.8 | 2024-01-20 | An issue in yonyou YonBIP v3_23.05 allows a remote attacker to execute arbitrary code via a crafted script to the ServiceDispatcherServlet uap.framework.rc.itf… |
CVE-2023-47024 | High | 8.8 | 2024-01-20 | Cross-Site Request Forgery (CSRF) in NCR Terminal Handler v.1.5.1 leads to a one-click account takeover. This is achieved by exploiting multiple vulnerabilitie… |
CVE-2023-51928 | Critical | 9.8 | 2024-01-20 | An arbitrary file upload vulnerability in the nccloud.web.arcp.taskmonitor.action.ArcpUploadAction.doAction() method of YonBIP v3_23.05 allows attackers to exe… |
CVE-2023-51927 | Critical | 9.8 | 2024-01-20 | YonBIP v3_23.05 was discovered to contain a SQL injection vulnerability via the com.yonyou.hrcloud.attend.web.AttendScriptController.runScript() method. |
CVE-2023-51926 | High | 7.5 | 2024-01-20 | YonBIP v3_23.05 was discovered to contain an arbitrary file read vulnerability via the nc.bs.framework.comn.serv.CommonServletDispatcher component. |
CVE-2023-51892 | Critical | 9.8 | 2024-01-20 | An issue in weaver e-cology v.10.0.2310.01 allows a remote attacker to execute arbitrary code via a crafted script to the FrameworkShellController component. |
CVE-2023-49329 | High | 7.2 | 2024-01-19 | Anomali Match before 4.6.2 allows OS Command Injection. An authenticated admin user can inject and execute operating system commands. This arises from improper… |
CVE-2023-6450 | Medium | 5.5 | 2024-01-19 | An incorrect permissions vulnerability was reported in the Lenovo App Store app that could allow an attacker to use system resources, resulting in a denial of… |
CVE-2023-6044 | Medium | 6.3 | 2024-01-19 | A privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local attacker with physical access to impersonate Lenovo Vantage Servic… |
CVE-2023-6043 | High | 7.8 | 2024-01-19 | A privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local attacker to bypass integrity checks and execute arbitrary code wit… |
CVE-2023-5081 | Low | 3.3 | 2024-01-19 | An information disclosure vulnerability was reported in the Lenovo Tab M8 HD that could allow a local application to gather a non-resettable device identifier. |
CVE-2023-5080 | Medium | 6.8 | 2024-01-19 | A privilege escalation vulnerability was reported in some Lenovo tablet products that could allow local applications access to device identifiers and system co… |
CVE-2023-50694 | Critical | 9.8 | 2024-01-19 | An issue in dom96 HTTPbeast v.0.4.1 and before allows a remote attacker to send a malicious crafted request due to insufficient parsing in the parser.nim compo… |
CVE-2023-50693 | Critical | 9.8 | 2024-01-19 | An issue in Jester v.0.6.0 and before allows a remote attacker to send a malicious crafted request. |
CVE-2023-50447 | High | 8.1 | 2024-01-19 | Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which wa… |
CVE-2023-47035 | High | 7.5 | 2024-01-19 | RPTC 0x3b08c was discovered to not conduct status checks on the parameter tradingOpen. This vulnerability can allow attackers to conduct unauthorized transfer… |
CVE-2023-42766 | High | 7.5 | 2024-01-19 | Improper input validation in some Intel NUC 8 Compute Element BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local… |
CVE-2023-42429 | High | 7.5 | 2024-01-19 | Improper buffer restrictions in some Intel NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2023-38587 | High | 7.5 | 2024-01-19 | Improper input validation in some Intel NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2023-38541 | Medium | 6.7 | 2024-01-19 | Insecure inherited permissions in some Intel HID Event Filter drivers for Windows 10 for some Intel NUC laptop software installers before version 2.2.2.1 may a… |
CVE-2023-33295 | Medium | 6.5 | 2024-01-19 | Cohesity DataProtect prior to 6.8.1_u5 or 7.1 was discovered to have a incorrect access control vulnerability due to a lack of TLS Certificate Validation. |
CVE-2023-32544 | High | 7.3 | 2024-01-19 | Improper access control in some Intel HotKey Services for Windows 10 for Intel NUC P14E Laptop Element software installers before version 1.1.45 may allow an a… |
CVE-2023-32272 | High | 7.9 | 2024-01-19 | Uncontrolled search path in some Intel NUC Pro Software Suite Configuration Tool software installers before version 3.0.0.6 may allow an authenticated user to… |
CVE-2023-29495 | High | 7.5 | 2024-01-19 | Improper input validation for some Intel NUC BIOS firmware before version IN0048 may allow a privileged user to potentially enable escalation of privilege via… |
CVE-2023-29244 | Medium | 6.7 | 2024-01-19 | Incorrect default permissions in some Intel Integrated Sensor Hub (ISH) driver for Windows 10 for Intel NUC P14E Laptop Element software installers before vers… |
CVE-2023-28743 | High | 7.5 | 2024-01-19 | Improper input validation for some Intel NUC BIOS firmware before version QN0073 may allow a privileged user to potentially enable escalation of privilege via… |
CVE-2023-28738 | High | 7.5 | 2024-01-19 | Improper input validation for some Intel NUC BIOS firmware before version JY0070 may allow a privileged user to potentially enable escalation of privilege via… |
CVE-2023-28722 | Medium | 6.7 | 2024-01-19 | Improper buffer restrictions for some Intel NUC BIOS firmware before version IN0048 may allow a privileged user to potentially enable escalation of privilege v… |
CVE-2023-47034 | High | 7.5 | 2024-01-19 | A vulnerability in UniswapFrontRunBot 0xdB94c allows attackers to cause financial losses via unspecified vectors. |
CVE-2023-47033 | High | 7.5 | 2024-01-19 | MultiSigWallet 0xF0C99 was discovered to contain a reentrancy vulnerability via the function executeTransaction. |