2023 CVEs (page 64)
Page 64 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-48356 | Medium | 4.4 | 2024-01-18 | In jpg driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileg… |
CVE-2023-48355 | Medium | 4.4 | 2024-01-18 | In jpg driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileg… |
CVE-2023-48354 | Medium | 5.5 | 2024-01-18 | In telephone service, there is a possible improper input validation. This could lead to local information disclosure with no additional execution privileges ne… |
CVE-2023-48353 | Medium | 4.4 | 2024-01-18 | In vsp driver, there is a possible use after free due to a logic error. This could lead to local denial of service with System execution privileges needed |
CVE-2023-48352 | Medium | 5.5 | 2024-01-18 | In phasecheckserver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execu… |
CVE-2023-48351 | Medium | 5.5 | 2024-01-18 | In video decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional executio… |
CVE-2023-48350 | Medium | 5.5 | 2024-01-18 | In video decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional executio… |
CVE-2023-48349 | Medium | 5.5 | 2024-01-18 | In video decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional executio… |
CVE-2023-48348 | Medium | 5.5 | 2024-01-18 | In video decoder, there is a possible out of bounds write due to improper input validation. This could lead to local denial of service with no additional execu… |
CVE-2023-48347 | Medium | 5.5 | 2024-01-18 | In video decoder, there is a possible out of bounds read due to improper input validation. This could lead to local denial of service with no additional execut… |
CVE-2023-48346 | Medium | 5.5 | 2024-01-18 | In video decoder, there is a possible improper input validation. This could lead to local denial of service with no additional execution privileges needed |
CVE-2023-48345 | Medium | 5.5 | 2024-01-18 | In video decoder, there is a possible out of bounds read due to improper input validation. This could lead to local denial of service with no additional execut… |
CVE-2023-48344 | Medium | 5.5 | 2024-01-18 | In video decoder, there is a possible out of bounds read due to improper input validation. This could lead to local denial of service with no additional execut… |
CVE-2023-48343 | Medium | 5.5 | 2024-01-18 | In video decoder, there is a possible out of bounds write due to improper input validation. This could lead to local denial of service with no additional execu… |
CVE-2023-48342 | Medium | 4.4 | 2024-01-18 | In media service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privi… |
CVE-2023-48341 | Medium | 5.5 | 2024-01-18 | In video decoder, there is a possible out of bounds read due to improper input validation. This could lead to local denial of service with no additional execut… |
CVE-2023-48340 | Medium | 5.5 | 2024-01-18 | In video decoder, there is a possible out of bounds write due to improper input validation. This could lead to local denial of service with no additional execu… |
CVE-2023-48339 | Medium | 4.4 | 2024-01-18 | In jpg driver, there is a possible missing permission check. This could lead to local information disclosure with System execution privileges needed |
CVE-2023-6184 | Medium | 5.0 | 2024-01-18 | Cross SiteScripting vulnerability in Citrix Session Recording allows attacker to perform Cross Site Scripting |
CVE-2023-6340 | Medium | 5.5 | 2024-01-18 | SonicWall Capture Client version 3.7.10, NetExtender client version 10.2.337 and earlier versions are installed with sfpmonitor.sys driver. The driver has bee… |
CVE-2023-6549 | High | 8.2 | 2024-01-17 | Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated Denial of Service and Out… |
CVE-2023-5914 | Medium | 5.4 | 2024-01-17 | Cross-site scripting (XSS) |
CVE-2023-6548 | Medium | 5.5 | 2024-01-17 | Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with mana… |
CVE-2023-48858 | Medium | 6.1 | 2024-01-17 | A Cross-site scripting (XSS) vulnerability in login page php code in Armex ABO.CMS 5.9 allows remote attackers to inject arbitrary web script or HTML via the l… |
CVE-2023-44077 | Critical | 9.8 | 2024-01-17 | Studio Network Solutions ShareBrowser before 7.0 on macOS mishandles signature verification, aka PMP-2636. |
CVE-2023-7031 | Medium | 5.7 | 2024-01-17 | Insecure Direct Object Reference vulnerabilities were discovered in the Avaya Aura Experience Portal Manager which may allow partial information disclosure to… |
CVE-2023-50950 | Low | 3.7 | 2024-01-17 | IBM QRadar SIEM 7.5 could disclose sensitive email information in responses from offense rules. IBM X-Force ID: 275709. |
CVE-2023-23896 | Medium | 5.4 | 2024-01-17 | Missing Authorization vulnerability in MyThemeShop URL Shortener by MyThemeShop.This issue affects URL Shortener by MyThemeShop: from n/a through 1.0.17. |
CVE-2023-23882 | Medium | 4.3 | 2024-01-17 | Missing Authorization vulnerability in Brainstorm Force Ultimate Addons for Beaver Builder – Lite.This issue affects Ultimate Addons for Beaver Builder – Lite… |
CVE-2023-20271 | Medium | 6.5 | 2024-01-17 | A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow an authen… |
CVE-2023-20260 | Medium | 6.0 | 2024-01-17 | A vulnerability in the application CLI of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager could allow an authenticated, local attacke… |
CVE-2023-20258 | Medium | 6.5 | 2024-01-17 | A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to execute arbitrary commands… |
CVE-2023-20257 | Medium | 4.8 | 2024-01-17 | A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to conduct cross-site scripti… |
CVE-2023-34379 | Medium | 5.4 | 2024-01-17 | Missing Authorization vulnerability in MagneticOne Cart2Cart: Magento to WooCommerce Migration.This issue affects Cart2Cart: Magento to WooCommerce Migration… |
CVE-2023-5041 | High | 8.8 | 2024-01-17 | The Track The Click WordPress plugin before 0.3.12 does not properly sanitize query parameters to the stats REST endpoint before using them in a database query… |
CVE-2023-5006 | Medium | 6.5 | 2024-01-17 | The WP Discord Invite WordPress plugin before 2.5.1 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to perform… |
CVE-2023-52285 | High | 7.5 | 2024-01-17 | ExamSys 9150244 allows SQL Injection via the /Support/action/Pages.php s_score2 parameter. |
CVE-2023-51743 | Medium | 6.5 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Set Upstream Channel ID (UC… |
CVE-2023-51742 | Medium | 6.5 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Add Downstream Frequency pa… |
CVE-2023-51741 | High | 7.5 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to transmission of authentication credentials in plaintext over the network. A remote… |
CVE-2023-51740 | High | 7.5 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to transmission of authentication credentials in plaintext over the network. A remote… |
CVE-2023-51739 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Device Name parameter at it… |
CVE-2023-51738 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Network Name (SSID) paramet… |
CVE-2023-51737 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Preshared Phrase parameter… |
CVE-2023-51736 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the L2TP/PPTP Username paramete… |
CVE-2023-51735 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Pre-shared key parameter at… |
CVE-2023-51734 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Identity parameter under Re… |
CVE-2023-51733 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Identity parameter under Lo… |
CVE-2023-51732 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the IPsec Tunnel Name parameter… |
CVE-2023-51731 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Hostname parameter at its w… |
CVE-2023-51730 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the DDNS Password parameter at… |
CVE-2023-51729 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the DDNS Username parameter at… |
CVE-2023-51728 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the SMTP Password parameter at… |
CVE-2023-51727 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the SMTP Username parameter at… |
CVE-2023-51726 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the SMTP Server Name parameter… |
CVE-2023-51725 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Contact Email Address param… |
CVE-2023-51724 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the URL parameter at its web in… |
CVE-2023-51723 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Description parameter at it… |
CVE-2023-51722 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Time Server 3 parameter at… |
CVE-2023-51721 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Time Server 2 parameter at… |
CVE-2023-51720 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Time Server 1 parameter at… |
CVE-2023-51719 | Medium | 6.9 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Traceroute parameter at its… |
CVE-2023-52069 | Medium | 5.4 | 2024-01-17 | kodbox v1.49.04 was discovered to contain a cross-site scripting (XSS) vulnerability via the URL parameter. |
CVE-2023-46952 | Medium | 6.1 | 2024-01-17 | Cross Site Scripting vulnerability in ABO.CMS v.5.9.3 allows an attacker to execute arbitrary code via a crafted payload to the Referer header. |
CVE-2023-36235 | Medium | 6.5 | 2024-01-17 | An issue in webkul qloapps before v1.6.0 allows an attacker to obtain sensitive information via the id_order parameter. |
CVE-2023-25295 | Medium | 6.1 | 2024-01-17 | A Cross Site Scripting (XSS) vulnerability in evewa3ajax.php in GRUEN eVEWA3 Community 31 through 53 allows attackers to obtain escalated privileges via a craf… |
CVE-2023-49515 | Medium | 4.6 | 2024-01-17 | Insecure Permissiosn vulnerability in TP Link TC70 and C200 WIFI Camera v.3 firmware v.1.3.4 and fixed in v.1.3.11 allows a physically proximate attacker to ob… |
CVE-2023-51807 | Medium | 5.4 | 2024-01-16 | Cross Site Scripting vulnerability in OFCMS v.1.14 allows a remote attacker to obtain sensitive information via a crafted payload to the title addition compone… |
CVE-2023-52068 | Medium | 6.1 | 2024-01-16 | kodbox v1.43 was discovered to contain a cross-site scripting (XSS) vulnerability via the operation and login logs. |
CVE-2023-52042 | Critical | 9.8 | 2024-01-16 | An issue discovered in sub_4117F8 function in TOTOLINK X6000R V9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the 'lang' parameter. |
CVE-2023-39691 | Critical | 9.8 | 2024-01-16 | An issue discovered in kodbox through 1.43 allows attackers to arbitrarily add Administrator accounts via crafted GET request. |
CVE-2023-36236 | Medium | 4.8 | 2024-01-16 | Cross Site Scripting vulnerability in webkil Bagisto v.1.5.0 and before allows an attacker to execute arbitrary code via a crafted SVG file uplad. |
CVE-2023-21901 | High | 7.4 | 2024-01-16 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Infrastruct… |
CVE-2023-48926 | Medium | 5.3 | 2024-01-16 | An issue in 202 ecommerce Advanced Loyalty Program: Loyalty Points before v2.3.4 for PrestaShop allows unauthenticated attackers to arbitrarily change an order… |
CVE-2023-6336 | High | 7.2 | 2024-01-16 | Improper Link Resolution Before File Access ('Link Following') vulnerability in HYPR Workforce Access on MacOS allows User-Controlled Filename.This issue affec… |
CVE-2023-6335 | Medium | 6.4 | 2024-01-16 | Improper Link Resolution Before File Access ('Link Following') vulnerability in HYPR Workforce Access on Windows allows User-Controlled Filename.This issue aff… |
CVE-2023-6334 | Medium | 5.3 | 2024-01-16 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in HYPR Workforce Access on Windows allows Overflow Buffers.This issue af… |
CVE-2023-5097 | High | 7.0 | 2024-01-16 | Improper Input Validation vulnerability in HYPR Workforce Access on Windows allows Path Traversal.This issue affects Workforce Access: before 8.7. |
CVE-2023-7234 | Medium | 5.3 | 2024-01-16 | OPCUAServerToolkit will write a log message once an OPC UA client has successfully connected containing the client's self-defined description field. |
CVE-2023-52041 | Critical | 9.8 | 2024-01-16 | An issue discovered in TOTOLINK X6000R V9.4.0cu.852_B20230719 allows attackers to run arbitrary code via the sub_410118 function of the shttpd program. |
CVE-2023-49351 | Critical | 9.8 | 2024-01-16 | A stack-based buffer overflow vulnerability in /bin/webs binary in Edimax BR6478AC V2 firmware veraion v1.23 allows attackers to overwrite other values located… |
CVE-2023-37523 | Medium | 5.6 | 2024-01-16 | Missing or insecure tags in the HCL BigFix Bare OSD Metal Server WebUI version 311.19 or lower could allow an attacker to execute a malicious script on the use… |
CVE-2023-22514 | High | 7.8 | 2024-01-16 | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.14 of Sourcetree for Mac and Sourcetree for Windows. This RCE… |
CVE-2023-22512 | High | 7.5 | 2024-01-16 | This High severity DoS (Denial of Service) vulnerability was introduced in version 5.6.0 of Confluence Data Center and Server. With a CVSS Score of 7.5, this v… |
CVE-2023-4969 | Medium | 6.5 | 2024-01-16 | A GPU kernel can read sensitive data from another GPU kernel (even from another user or app) through an optimized GPU memory region called _local memory_ on va… |
CVE-2023-7154 | Medium | 4.8 | 2024-01-16 | The Hubbub Lite (formerly Grow Social) WordPress plugin before 1.32.0 does not sanitise and escape some of its settings, which could allow high privilege users… |
CVE-2023-7151 | Medium | 6.1 | 2024-01-16 | The Product Enquiry for WooCommerce WordPress plugin before 3.2 does not sanitise and escape the page parameter before outputting it back in an attribute, lead… |
CVE-2023-7125 | Medium | 4.3 | 2024-01-16 | The Community by PeepSo WordPress plugin before 6.3.1.2 does not have CSRF check when creating a user post (visible on their wall in their profile page), which… |
CVE-2023-7084 | Medium | 5.4 | 2024-01-16 | The Voting Record WordPress plugin through 2.0 is missing sanitisation as well as escaping, which could allow any authenticated users, such as subscriber to pe… |
CVE-2023-7083 | Medium | 5.4 | 2024-01-16 | The Voting Record WordPress plugin through 2.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow atta… |
CVE-2023-6824 | Medium | 6.5 | 2024-01-16 | The WP Customer Area WordPress plugin before 8.2.1 does not properly validates user capabilities in some of its AJAX actions, allowing any users to retrieve ot… |
CVE-2023-6741 | Medium | 4.3 | 2024-01-16 | The WP Customer Area WordPress plugin before 8.2.1 does not properly validate users capabilities in some of its AJAX actions, allowing malicious users to edit… |
CVE-2023-6732 | Medium | 4.8 | 2024-01-16 | The Ultimate Maps by Supsystic WordPress plugin before 1.2.16 does not sanitise and escape some of its settings, which could allow high privilege users such as… |
CVE-2023-6592 | Medium | 5.3 | 2024-01-16 | The FastDup WordPress plugin before 2.2 does not prevent directory listing in sensitive directories containing export files. |
CVE-2023-6373 | High | 8.8 | 2024-01-16 | The ArtPlacer Widget WordPress plugin before 2.20.7 does not sanitize and escape the "id" parameter before submitting the query, leading to a SQLI exploitable… |
CVE-2023-6292 | Medium | 4.3 | 2024-01-16 | The Ecwid Ecommerce Shopping Cart WordPress plugin before 6.12.5 does not have CSRF check in place when updating its settings, which could allow attackers to m… |
CVE-2023-6046 | Medium | 4.8 | 2024-01-16 | The EventON WordPress plugin before 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stor… |
CVE-2023-6005 | Medium | 4.8 | 2024-01-16 | The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 does not sanitize and escape some of its settings, which could allow high priv… |
CVE-2023-5922 | High | 7.5 | 2024-01-16 | The Royal Elementor Addons and Templates WordPress plugin before 1.3.81 does not ensure that users accessing posts via an AJAX action (and REST endpoint, curre… |
CVE-2023-5558 | Medium | 6.1 | 2024-01-16 | The LearnPress WordPress plugin before 4.2.5.5 does not sanitise and escape user input before outputting it back in the page, leading to a Reflected Cross-Site… |