2023 CVEs (page 68)
Page 68 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-49589 | High | 8.8 | 2024-01-10 | An insufficient entropy vulnerability exists in the userRecoverPass.php recoverPass generation functionality of WWBN AVideo dev master commit 15fed957fb. A spe… |
CVE-2023-48730 | High | 8.5 | 2024-01-10 | A cross-site scripting (xss) vulnerability exists in the navbarMenuAndLogo.php user name functionality of WWBN AVideo dev master commit 15fed957fb. A specially… |
CVE-2023-48728 | Critical | 9.6 | 2024-01-10 | A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.6 and dev master commit 3c6bb3ff. A spe… |
CVE-2023-47862 | Critical | 9.8 | 2024-01-10 | A local file inclusion vulnerability exists in the getLanguageFromBrowser functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP r… |
CVE-2023-47861 | Critical | 9.0 | 2024-01-10 | A cross-site scripting (xss) vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb. A specia… |
CVE-2023-47171 | Medium | 6.5 | 2024-01-10 | An information disclosure vulnerability exists in the aVideoEncoder.json.php chunkFile path functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb… |
CVE-2023-45139 | High | 7.5 | 2024-01-10 | fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an… |
CVE-2023-41056 | High | 8.1 | 2024-01-10 | Redis is an in-memory database that persists on disk. Redis incorrectly handles resizing of memory buffers which can result in integer overflow that leads to h… |
CVE-2023-6158 | Medium | 6.5 | 2024-01-10 | The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing… |
CVE-2023-51965 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function setIptvInfo. |
CVE-2023-51964 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function setIptvInfo. |
CVE-2023-51963 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function setIptvInfo. |
CVE-2023-51960 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function formGetIptv. |
CVE-2023-51959 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function formGetIptv. |
CVE-2023-51958 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function formGetIptv. |
CVE-2023-51957 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function formGetIptv. |
CVE-2023-51956 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function formSetIptv |
CVE-2023-51955 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function formSetIptv. |
CVE-2023-51954 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function formSetIptv. |
CVE-2023-51953 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function formSetIptv. |
CVE-2023-51952 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function formSetIptv. |
CVE-2023-51966 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function setIptvInfo. |
CVE-2023-51961 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function formGetIptv. |
CVE-2023-5455 | Medium | 6.5 | 2024-01-10 | A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the use… |
CVE-2023-51972 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 was discovered to contain a command injection vulnerability via the function fromAdvSetLanIp. |
CVE-2023-51971 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function getIptvInfo. |
CVE-2023-48266 | High | 8.1 | 2024-01-10 | The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a… |
CVE-2023-48265 | High | 8.1 | 2024-01-10 | The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a… |
CVE-2023-48264 | High | 8.1 | 2024-01-10 | The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a… |
CVE-2023-48263 | High | 8.1 | 2024-01-10 | The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a… |
CVE-2023-48262 | High | 8.1 | 2024-01-10 | The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a… |
CVE-2023-48261 | Medium | 5.3 | 2024-01-10 | The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request. |
CVE-2023-48260 | Medium | 5.3 | 2024-01-10 | The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request. |
CVE-2023-48259 | Medium | 5.3 | 2024-01-10 | The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request. |
CVE-2023-48258 | Medium | 5.5 | 2024-01-10 | The vulnerability allows a remote attacker to delete arbitrary files on the file system via a crafted URL or HTTP request through a victim’s session. |
CVE-2023-48257 | High | 7.8 | 2024-01-10 | The vulnerability allows a remote attacker to access sensitive data inside exported packages or obtain up to Remote Code Execution (RCE) with root privileges o… |
CVE-2023-48256 | Medium | 5.3 | 2024-01-10 | The vulnerability allows a remote attacker to inject arbitrary HTTP response headers or manipulate HTTP response bodies inside a victim’s session via a crafted… |
CVE-2023-48255 | Medium | 6.3 | 2024-01-10 | The vulnerability allows an unauthenticated remote attacker to send malicious network requests containing arbitrary client-side script code and obtain its exec… |
CVE-2023-48254 | Medium | 5.3 | 2024-01-10 | The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted URL or HTTP request. |
CVE-2023-48253 | High | 8.8 | 2024-01-10 | The vulnerability allows a remote authenticated attacker to read or update arbitrary content of the authentication database via a crafted HTTP request. By abu… |
CVE-2023-48252 | High | 8.8 | 2024-01-10 | The vulnerability allows an authenticated remote attacker to perform actions exceeding their authorized access via crafted HTTP requests. |
CVE-2023-48251 | High | 8.1 | 2024-01-10 | The vulnerability allows a remote attacker to authenticate to the SSH service with root privileges through a hidden hard-coded account. |
CVE-2023-48250 | High | 8.1 | 2024-01-10 | The vulnerability allows a remote attacker to authenticate to the web application with high privileges through multiple hidden hard-coded accounts. |
CVE-2023-48249 | Medium | 6.5 | 2024-01-10 | The vulnerability allows an authenticated remote attacker to list arbitrary folders in all paths of the system under the context of the application OS user (“r… |
CVE-2023-48248 | Medium | 5.5 | 2024-01-10 | The vulnerability allows an authenticated remote attacker to upload a malicious file to the SD card containing arbitrary client-side script code and obtain its… |
CVE-2023-48247 | Medium | 5.3 | 2024-01-10 | The vulnerability allows an unauthenticated remote attacker to read arbitrary files under the context of the application OS user (“root”) via a crafted HTTP re… |
CVE-2023-48246 | Medium | 6.5 | 2024-01-10 | The vulnerability allows a remote attacker to download arbitrary files in all paths of the system under the context of the application OS user (“root”) via a c… |
CVE-2023-48245 | Medium | 6.5 | 2024-01-10 | The vulnerability allows an unauthenticated remote attacker to upload arbitrary files under the context of the application OS user (“root”) via a crafted HTTP… |
CVE-2023-48244 | Medium | 5.3 | 2024-01-10 | The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted URL or HTTP request. |
CVE-2023-48243 | High | 8.1 | 2024-01-10 | The vulnerability allows a remote attacker to upload arbitrary files in all paths of the system under the context of the application OS user (“root”) via a cra… |
CVE-2023-48242 | Medium | 6.5 | 2024-01-10 | The vulnerability allows an authenticated remote attacker to download arbitrary files in all paths of the system under the context of the application OS user (… |
CVE-2023-51252 | Medium | 5.4 | 2024-01-10 | PublicCMS 4.0 is vulnerable to Cross Site Scripting (XSS). Because files can be uploaded and online preview function is provided, pdf files and html files cont… |
CVE-2023-50120 | Medium | 5.5 | 2024-01-10 | MP4Box GPAC version 2.3-DEV-rev636-gfbd7e13aa-master was discovered to contain an infinite loop in the function av1_uvlc at media_tools/av_parsers.c. This vuln… |
CVE-2023-49619 | Low | 3.1 | 2024-01-10 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Answer. This issue affects Apache Answer… |
CVE-2023-49471 | High | 8.8 | 2024-01-10 | Blind Server-Side Request Forgery (SSRF) vulnerability in karlomikus Bar Assistant before version 3.2.0 does not validate a parameter before making a request t… |
CVE-2023-49427 | High | 7.5 | 2024-01-10 | Buffer Overflow vulnerability in Tenda AX12 V22.03.01.46, allows remote attackers to cause a denial of service (DoS) via list parameter in SetNetControlList fu… |
CVE-2023-49394 | Medium | 6.1 | 2024-01-10 | Zentao versions 4.1.3 and before has a URL redirect vulnerability, which prevents the system from functioning properly. |
CVE-2023-48864 | High | 7.5 | 2024-01-10 | SEMCMS v4.8 was discovered to contain a SQL injection vulnerability via the languageID parameter in /web_inc.php. |
CVE-2023-41603 | Medium | 5.3 | 2024-01-10 | D-Link R15 before v1.08.02 was discovered to contain no firewall restrictions for IPv6 traffic. This allows attackers to arbitrarily access any services runnin… |
CVE-2023-41781 | Medium | 5.7 | 2024-01-10 | There is a Cross-site scripting (XSS) vulnerability in ZTE MF258. Due to insufficient input validation of SMS interface parameter, an XSS attack will be trig… |
CVE-2023-31446 | Critical | 9.8 | 2024-01-10 | In Cassia Gateway firmware XC1000_2.1.1.2303082218 and XC2000_2.1.1.2303090947, the queueUrl parameter in /bypass/config is not sanitized. This leads to inject… |
CVE-2023-47997 | Medium | 6.5 | 2024-01-10 | An issue discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0 leads to an infinite loop and allows attackers to cause a denial of servi… |
CVE-2023-47996 | Medium | 6.5 | 2024-01-09 | An integer overflow vulnerability in Exif.cpp::jpeg_read_exif_dir in FreeImage 3.18.0 allows attackers to obtain information and cause a denial of service. |
CVE-2023-47995 | Medium | 6.5 | 2024-01-09 | Memory Allocation with Excessive Size Value discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0 allows attackers to cause a denial of… |
CVE-2023-47994 | High | 8.8 | 2024-01-09 | An integer overflow vulnerability in LoadPixelDataRLE4 function in PluginBMP.cpp in Freeimage 3.18.0 allows attackers to obtain sensitive information, cause a… |
CVE-2023-47993 | Medium | 6.5 | 2024-01-09 | A Buffer out-of-bound read vulnerability in Exif.cpp::ReadInt32 in FreeImage 3.18.0 allows attackers to cause a denial-of-service. |
CVE-2023-47992 | High | 8.8 | 2024-01-09 | An integer overflow vulnerability in FreeImageIO.cpp::_MemoryReadProc in FreeImage 3.18.0 allows attackers to obtain sensitive information, cause a denial-of-s… |
CVE-2023-3043 | Critical | 9.6 | 2024-01-09 | AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a stack-based buffer overflow via an adjacent network. A successful exploita… |
CVE-2023-37297 | High | 8.3 | 2024-01-09 | AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a heap memory corruption via an adjacent network. A successful exploitation of this… |
CVE-2023-37296 | High | 8.3 | 2024-01-09 | AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a stack memory corruption via an adjacent network. A successful exploitation of th… |
CVE-2023-37295 | High | 8.3 | 2024-01-09 | AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a heap memory corruption via an adjacent network. A successful exploitation of t… |
CVE-2023-37294 | High | 8.3 | 2024-01-09 | AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a heap memory corruption via an adjacent network. A successful exploitation of… |
CVE-2023-37293 | Critical | 9.6 | 2024-01-09 | AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a stack-based buffer overflow via an adjacent network. A successful exploitation of t… |
CVE-2023-34333 | High | 7.8 | 2024-01-09 | AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause an untrusted pointer to dereference via a local network. A successful expl… |
CVE-2023-34332 | High | 7.8 | 2024-01-09 | AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause an untrusted pointer to dereference by a local network. A successful explo… |
CVE-2023-6476 | Medium | 6.5 | 2024-01-09 | A flaw was found in CRI-O that involves an experimental annotation leading to a container being unconfined. This may allow a pod to specify and get any amount… |
CVE-2023-5770 | Medium | 5.3 | 2024-01-09 | Proofpoint Enterprise Protection contains a vulnerability in the email delivery agent that allows an unauthenticated attacker to inject improperly encoded HTML… |
CVE-2023-50136 | Medium | 5.4 | 2024-01-09 | Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the name field when creating a new custom table. |
CVE-2023-38827 | Medium | 6.1 | 2024-01-09 | Cross Site Scripting vulnerability in Follet School Solutions Destiny v.20_0_1_AU4 and later allows a remote attacker to run arbitrary code via presentonesearc… |
CVE-2023-7032 | High | 7.8 | 2024-01-09 | A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker logged in with a user level account to gain higher privileges b… |
CVE-2023-6129 | Medium | 6.5 | 2024-01-09 | Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on Po… |
CVE-2023-7223 | Medium | 5.3 | 2024-01-09 | A vulnerability classified as problematic has been found in Totolink T6 4.1.9cu.5241_B20210923. This affects an unknown part of the file /cgi-bin/cstecgi.cgi… |
CVE-2023-7222 | High | 7.2 | 2024-01-09 | A vulnerability was found in Totolink X2000R 1.0.0-B20221212.1452. It has been declared as critical. This vulnerability affects the function formTmultiAP of th… |
CVE-2023-7221 | Critical | 9.8 | 2024-01-09 | A vulnerability was found in Totolink T6 4.1.9cu.5241_B20210923. It has been classified as critical. This affects the function main of the file /cgi-bin/cstecg… |
CVE-2023-5376 | High | 8.6 | 2024-01-09 | An Improper Authentication vulnerability in Korenix JetNet TFTP allows abuse of this service. This issue affects JetNet devices older than firmware version 202… |
CVE-2023-5347 | Critical | 9.8 | 2024-01-09 | An Improper Verification of Cryptographic Signature vulnerability in the update process of Korenix JetNet Series allows replacing the whole operating system in… |
CVE-2023-51746 | High | 7.8 | 2024-01-09 | A vulnerability has been identified in JT2Go (All versions < V14.3.0.6), Teamcenter Visualization V13.3 (All versions < V13.3.0.13), Teamcenter Visualization V… |
CVE-2023-51745 | High | 7.8 | 2024-01-09 | A vulnerability has been identified in JT2Go (All versions < V14.3.0.6), Teamcenter Visualization V13.3 (All versions < V13.3.0.13), Teamcenter Visualization V… |
CVE-2023-51744 | Low | 3.3 | 2024-01-09 | A vulnerability has been identified in JT2Go (All versions < V14.3.0.6), Teamcenter Visualization V13.3 (All versions < V13.3.0.13), Teamcenter Visualization V… |
CVE-2023-51439 | High | 7.8 | 2024-01-09 | A vulnerability has been identified in JT2Go (All versions < V14.3.0.6), Teamcenter Visualization V13.3 (All versions < V13.3.0.13), Teamcenter Visualization V… |
CVE-2023-51438 | Critical | 10.0 | 2024-01-09 | A vulnerability has been identified in SIMATIC IPC1047E (All versions with maxView Storage Manager < V4.14.00.26068 on Windows), SIMATIC IPC647E (All versions… |
CVE-2023-49722 | High | 8.3 | 2024-01-09 | Network port 8899 open in WiFi firmware of BCC101/BCC102/BCC50 products, that allows an attacker to connect to the device via same WiFi network. |
CVE-2023-49621 | Critical | 9.8 | 2024-01-09 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The "intermediate installation" system state of the affected application uses def… |
CVE-2023-49252 | High | 7.5 | 2024-01-09 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The affected application allows IP configuration change without authentication to… |
CVE-2023-49251 | High | 8.8 | 2024-01-09 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The "intermediate installation" system state of the affected application allows a… |
CVE-2023-49132 | High | 7.8 | 2024-01-09 | A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to uninitialized pointer acc… |
CVE-2023-49131 | High | 7.8 | 2024-01-09 | A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to uninitialized pointer acc… |
CVE-2023-49130 | High | 7.8 | 2024-01-09 | A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to uninitialized pointer acc… |
CVE-2023-49129 | High | 7.8 | 2024-01-09 | A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected applications contain a stack overflow vulnerability wh… |
CVE-2023-49128 | High | 7.8 | 2024-01-09 | A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application contains an out of bounds write past the e… |