2023 CVEs (page 68)
Page 68 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-41075 | High | 7.8 | 2024-01-10 | A type confusion issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.7.5, macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, iOS 15.7… |
CVE-2023-41069 | Medium | 5.5 | 2024-01-10 | This issue was addressed by improving Face ID anti-spoofing models. This issue is fixed in iOS 17 and iPadOS 17. A 3D model constructed to look like the enroll… |
CVE-2023-41060 | High | 8.8 | 2024-01-10 | A type confusion issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14, iOS 17 and iPadOS 17. A remote user may be able to cause ker… |
CVE-2023-40529 | Low | 2.4 | 2024-01-10 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 17 and iPadOS 17. A person with physical access to a devi… |
CVE-2023-40439 | Low | 3.3 | 2024-01-10 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. An app… |
CVE-2023-40438 | Medium | 5.5 | 2024-01-10 | An issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sonoma 14, iOS 16.7 and iPadOS 16.7. An app may be able to acces… |
CVE-2023-40437 | Medium | 5.5 | 2024-01-10 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. An app… |
CVE-2023-40433 | Medium | 5.5 | 2024-01-10 | A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3. An app may bypass Gatekeeper checks. |
CVE-2023-40430 | Medium | 5.5 | 2024-01-10 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. An app may be able to access removable volumes without user consent. |
CVE-2023-40414 | Critical | 9.8 | 2024-01-10 | A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 10, iOS 17 and iPadOS 17, tvOS 17, macOS Sonoma 14, Safari… |
CVE-2023-40411 | Medium | 5.5 | 2024-01-10 | This issue was addressed with improved data protection. This issue is fixed in macOS Sonoma 14. An app may be able to access user-sensitive data. |
CVE-2023-40394 | Low | 3.3 | 2024-01-10 | The issue was addressed with improved validation of environment variables. This issue is fixed in iOS 16.6 and iPadOS 16.6. An app may be able to access sensit… |
CVE-2023-40393 | High | 7.5 | 2024-01-10 | An authentication issue was addressed with improved state management. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. Photos in the Hidden Photos… |
CVE-2023-40385 | Medium | 6.5 | 2024-01-10 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14, Safari 17, iOS 17 and iPadOS 17. A remote attacker may be abl… |
CVE-2023-40383 | Low | 3.3 | 2024-01-10 | A path handling issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.3. An app may be able to access user-sensitive data. |
CVE-2023-38612 | Low | 3.3 | 2024-01-10 | The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, iOS 17 and iPadOS 17, macOS Sonoma 14, macO… |
CVE-2023-38610 | High | 7.1 | 2024-01-10 | A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14, iOS 17 and iPadOS 17. An app may be able to ca… |
CVE-2023-38607 | Medium | 5.5 | 2024-01-10 | The issue was addressed with improved handling of caches. This issue is fixed in macOS Sonoma 14. An app may be able to modify Printer settings. |
CVE-2023-32436 | High | 7.1 | 2024-01-10 | The issue was addressed with improved bounds checks. This issue is fixed in macOS Ventura 13.3. An app may be able to cause unexpected system termination or wr… |
CVE-2023-32424 | Medium | 5.5 | 2024-01-10 | The issue was addressed with improved memory handling. This issue is fixed in iOS 16.4 and iPadOS 16.4, watchOS 9.4. An attacker that has already achieved kern… |
CVE-2023-32401 | High | 7.8 | 2024-01-10 | A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Monterey 12.6.6, macOS Big Sur 11.7.7, macOS Ventura 13.4. Parsing… |
CVE-2023-32383 | High | 7.8 | 2024-01-10 | This issue was addressed by forcing hardened runtime on the affected binaries at the system level. This issue is fixed in macOS Monterey 12.6.6, macOS Big Sur… |
CVE-2023-32378 | High | 7.8 | 2024-01-10 | A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.3, macOS Big Sur 11.7.5, macOS Monterey 12.6.4. A… |
CVE-2023-32366 | High | 7.8 | 2024-01-10 | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.7.5, macOS Ventura 13.3, iOS 16.4 and iPadOS… |
CVE-2023-28197 | Low | 3.3 | 2024-01-10 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Ventura 13.3, macOS Big Sur 11.7.5, macOS Monterey 12.6.4. An… |
CVE-2023-28185 | Medium | 5.5 | 2024-01-10 | An integer overflow was addressed through improved input validation. This issue is fixed in tvOS 16.4, macOS Big Sur 11.7.5, iOS 16.4 and iPadOS 16.4, watchOS… |
CVE-2023-52064 | Critical | 9.8 | 2024-01-10 | Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the $keywords parameter at /core/admin/copyfrom.php. |
CVE-2023-51127 | High | 7.5 | 2024-01-10 | FLIR AX8 thermal sensor cameras up to and including 1.46.16 are vulnerable to Directory Traversal due to improper access restriction. This vulnerability allows… |
CVE-2023-51126 | Critical | 9.8 | 2024-01-10 | Command injection vulnerability in /usr/www/res.php in FLIR AX8 up to 1.46.16 allows attackers to run arbitrary commands via the value parameter. NOTE: The ven… |
CVE-2023-29447 | Medium | 5.7 | 2024-01-10 | An insufficiently protected credentials vulnerability in KEPServerEX could allow an adversary to capture user credentials as the web server uses basic authenti… |
CVE-2023-29446 | Medium | 4.7 | 2024-01-10 | An improper input validation vulnerability has been discovered that could allow an adversary to inject a UNC path via a malicious project file. This allows an… |
CVE-2023-29445 | High | 7.8 | 2024-01-10 | An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges… |
CVE-2023-31488 | Critical | 9.8 | 2024-01-10 | Hyland Perceptive Filters releases before 2023-12-08 (e.g., 11.4.0.2647), as used in Cisco IronPort Email Security Appliance Software, Cisco Secure Email Gatew… |
CVE-2023-50916 | High | 7.2 | 2024-01-10 | Kyocera Device Manager before 3.1.1213.0 allows NTLM credential exposure during UNC path authentication via a crafted change from a local path to a UNC path. I… |
CVE-2023-48783 | Medium | 5.4 | 2024-01-10 | An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] affecting PortiPortal version 7.2.1 and below, version 7.0.6 and below, version 6.0… |
CVE-2023-46712 | High | 7.2 | 2024-01-10 | A improper access control in Fortinet FortiPortal version 7.0.0 through 7.0.6, Fortinet FortiPortal version 7.2.0 through 7.2.1 allows attacker to escalate its… |
CVE-2023-44250 | High | 8.8 | 2024-01-10 | An improper privilege management vulnerability [CWE-269] in a Fortinet FortiOS HA cluster version 7.4.0 through 7.4.1 and 7.2.5 and in a FortiProxy HA cluster… |
CVE-2023-37934 | Medium | 4.3 | 2024-01-10 | An allocation of resources without limits or throttling vulnerability [CWE-770] in FortiPAM 1.0 all versions allows an authenticated attacker to perform a deni… |
CVE-2023-37932 | Medium | 6.5 | 2024-01-10 | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability [CWE-22] in FortiVoiceEntreprise version 7.0.0 and before 6.4.7… |
CVE-2023-29444 | Medium | 6.3 | 2024-01-10 | An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges… |
CVE-2023-51970 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function formSetIptv. |
CVE-2023-51969 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function getIptvInfo. |
CVE-2023-51968 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function getIptvInfo. |
CVE-2023-51967 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function getIptvInfo. |
CVE-2023-51962 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function setIptvInfo. |
CVE-2023-50172 | Medium | 5.3 | 2024-01-10 | A recovery notification bypass vulnerability exists in the userRecoverPass.php captcha validation functionality of WWBN AVideo dev master commit 15fed957fb. A… |
CVE-2023-49864 | Medium | 6.5 | 2024-01-10 | An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb… |
CVE-2023-49863 | Medium | 6.5 | 2024-01-10 | An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb… |
CVE-2023-49862 | Medium | 6.5 | 2024-01-10 | An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb… |
CVE-2023-49810 | High | 7.3 | 2024-01-10 | A login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafte… |
CVE-2023-49738 | High | 7.5 | 2024-01-10 | An information disclosure vulnerability exists in the image404Raw.php functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP reque… |
CVE-2023-49715 | Medium | 4.3 | 2024-01-10 | A unrestricted php file upload vulnerability exists in the import.json.php temporary copy functionality of WWBN AVideo dev master commit 15fed957fb. A speciall… |
CVE-2023-49599 | Critical | 9.8 | 2024-01-10 | An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted series of HT… |
CVE-2023-49589 | High | 8.8 | 2024-01-10 | An insufficient entropy vulnerability exists in the userRecoverPass.php recoverPass generation functionality of WWBN AVideo dev master commit 15fed957fb. A spe… |
CVE-2023-48730 | High | 8.5 | 2024-01-10 | A cross-site scripting (xss) vulnerability exists in the navbarMenuAndLogo.php user name functionality of WWBN AVideo dev master commit 15fed957fb. A specially… |
CVE-2023-48728 | Critical | 9.6 | 2024-01-10 | A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.6 and dev master commit 3c6bb3ff. A spe… |
CVE-2023-47862 | Critical | 9.8 | 2024-01-10 | A local file inclusion vulnerability exists in the getLanguageFromBrowser functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP r… |
CVE-2023-47861 | Critical | 9.0 | 2024-01-10 | A cross-site scripting (xss) vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb. A specia… |
CVE-2023-47171 | Medium | 6.5 | 2024-01-10 | An information disclosure vulnerability exists in the aVideoEncoder.json.php chunkFile path functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb… |
CVE-2023-45139 | High | 7.5 | 2024-01-10 | fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an… |
CVE-2023-41056 | High | 8.1 | 2024-01-10 | Redis is an in-memory database that persists on disk. Redis incorrectly handles resizing of memory buffers which can result in integer overflow that leads to h… |
CVE-2023-6158 | Medium | 6.5 | 2024-01-10 | The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing… |
CVE-2023-51965 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function setIptvInfo. |
CVE-2023-51964 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function setIptvInfo. |
CVE-2023-51963 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function setIptvInfo. |
CVE-2023-51960 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function formGetIptv. |
CVE-2023-51959 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function formGetIptv. |
CVE-2023-51958 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function formGetIptv. |
CVE-2023-51957 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function formGetIptv. |
CVE-2023-51956 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function formSetIptv |
CVE-2023-51955 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function formSetIptv. |
CVE-2023-51954 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function formSetIptv. |
CVE-2023-51953 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function formSetIptv. |
CVE-2023-51952 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function formSetIptv. |
CVE-2023-51966 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function setIptvInfo. |
CVE-2023-51961 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function formGetIptv. |
CVE-2023-5455 | Medium | 6.5 | 2024-01-10 | A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the use… |
CVE-2023-51972 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 was discovered to contain a command injection vulnerability via the function fromAdvSetLanIp. |
CVE-2023-51971 | Critical | 9.8 | 2024-01-10 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function getIptvInfo. |
CVE-2023-48266 | High | 8.1 | 2024-01-10 | The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a… |
CVE-2023-48265 | High | 8.1 | 2024-01-10 | The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a… |
CVE-2023-48264 | High | 8.1 | 2024-01-10 | The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a… |
CVE-2023-48263 | High | 8.1 | 2024-01-10 | The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a… |
CVE-2023-48262 | High | 8.1 | 2024-01-10 | The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a… |
CVE-2023-48261 | Medium | 5.3 | 2024-01-10 | The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request. |
CVE-2023-48260 | Medium | 5.3 | 2024-01-10 | The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request. |
CVE-2023-48259 | Medium | 5.3 | 2024-01-10 | The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request. |
CVE-2023-48258 | Medium | 5.5 | 2024-01-10 | The vulnerability allows a remote attacker to delete arbitrary files on the file system via a crafted URL or HTTP request through a victim’s session. |
CVE-2023-48257 | High | 7.8 | 2024-01-10 | The vulnerability allows a remote attacker to access sensitive data inside exported packages or obtain up to Remote Code Execution (RCE) with root privileges o… |
CVE-2023-48256 | Medium | 5.3 | 2024-01-10 | The vulnerability allows a remote attacker to inject arbitrary HTTP response headers or manipulate HTTP response bodies inside a victim’s session via a crafted… |
CVE-2023-48255 | Medium | 6.3 | 2024-01-10 | The vulnerability allows an unauthenticated remote attacker to send malicious network requests containing arbitrary client-side script code and obtain its exec… |
CVE-2023-48254 | Medium | 5.3 | 2024-01-10 | The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted URL or HTTP request. |
CVE-2023-48253 | High | 8.8 | 2024-01-10 | The vulnerability allows a remote authenticated attacker to read or update arbitrary content of the authentication database via a crafted HTTP request. By abu… |
CVE-2023-48252 | High | 8.8 | 2024-01-10 | The vulnerability allows an authenticated remote attacker to perform actions exceeding their authorized access via crafted HTTP requests. |
CVE-2023-48251 | High | 8.1 | 2024-01-10 | The vulnerability allows a remote attacker to authenticate to the SSH service with root privileges through a hidden hard-coded account. |
CVE-2023-48250 | High | 8.1 | 2024-01-10 | The vulnerability allows a remote attacker to authenticate to the web application with high privileges through multiple hidden hard-coded accounts. |
CVE-2023-48249 | Medium | 6.5 | 2024-01-10 | The vulnerability allows an authenticated remote attacker to list arbitrary folders in all paths of the system under the context of the application OS user (“r… |
CVE-2023-48248 | Medium | 5.5 | 2024-01-10 | The vulnerability allows an authenticated remote attacker to upload a malicious file to the SD card containing arbitrary client-side script code and obtain its… |
CVE-2023-48247 | Medium | 5.3 | 2024-01-10 | The vulnerability allows an unauthenticated remote attacker to read arbitrary files under the context of the application OS user (“root”) via a crafted HTTP re… |
CVE-2023-48246 | Medium | 6.5 | 2024-01-10 | The vulnerability allows a remote attacker to download arbitrary files in all paths of the system under the context of the application OS user (“root”) via a c… |