2023 CVEs (page 72)
Page 72 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-6338 | High | 7.8 | 2024-01-03 | Uncontrolled search path vulnerabilities were reported in the Lenovo Universal Device Client (UDC) that could allow an attacker with local access to execute co… |
CVE-2023-49442 | Critical | 9.8 | 2024-01-03 | Deserialization of Untrusted Data in jeecgFormDemoController in JEECG 4.0 and earlier allows attackers to run arbitrary code via crafted POST request. |
CVE-2023-5881 | High | 8.2 | 2024-01-03 | Unauthenticated access permitted to web interface page The Genie Company Aladdin Connect (Retrofit-Kit Model ALDCM) "Garage Door Control Module Setup" and modi… |
CVE-2023-5880 | High | 8.8 | 2024-01-03 | When the Genie Company Aladdin Connect garage door opener (Retrofit-Kit Model ALDCM) is placed into configuration mode the web servers “Garage Door Control Mod… |
CVE-2023-5879 | Medium | 6.8 | 2024-01-03 | Users’ product account authentication data was stored in clear text in The Genie Company Aladdin Connect Mobile Application Version 5.65 Build 2075 (and below)… |
CVE-2023-50090 | Critical | 9.8 | 2024-01-03 | Arbitrary File Write vulnerability in the saveReportFile method of ureport2 2.2.9 and before allows attackers to write arbitrary files and run arbitrary comman… |
CVE-2023-46929 | High | 7.5 | 2024-01-03 | An issue discovered in GPAC 2.3-DEV-rev605-gfc9e29089-master in MP4Box in gf_avc_change_vui /afltest/gpac/src/media_tools/av_parsers.c:6872:55 allows attackers… |
CVE-2023-6004 | Medium | 4.8 | 2024-01-03 | A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow… |
CVE-2023-50253 | Critical | 9.6 | 2024-01-03 | Laf is a cloud development platform. In the Laf version design, the log uses communication with k8s to quickly retrieve logs from the container without the nee… |
CVE-2023-46742 | Medium | 4.8 | 2024-01-03 | CubeFS is an open-source cloud-native file storage system. CubeFS prior to version 3.3.1 was found to leak users secret keys and access keys in the logs in mul… |
CVE-2023-46741 | Medium | 4.8 | 2024-01-03 | CubeFS is an open-source cloud-native file storage system. A vulnerability was found in CubeFS prior to version 3.3.1 that could allow users to read sensitive… |
CVE-2023-46740 | Medium | 6.5 | 2024-01-03 | CubeFS is an open-source cloud-native file storage system. Prior to version 3.3.1, CubeFS used an insecure random string generator to generate user-specific, s… |
CVE-2023-46739 | Medium | 6.5 | 2024-01-03 | CubeFS is an open-source cloud-native file storage system. A vulnerability was found during in the CubeFS master component in versions prior to 3.3.1 that coul… |
CVE-2023-46738 | Medium | 6.5 | 2024-01-03 | CubeFS is an open-source cloud-native file storage system. A security vulnerability was found in CubeFS HandlerNode in versions prior to 3.3.1 that could allow… |
CVE-2023-30617 | Medium | 6.5 | 2024-01-03 | Kruise provides automated management of large-scale applications on Kubernetes. Starting in version 0.8.0 and prior to versions 1.3.1, 1.4.1, and 1.5.2, an att… |
CVE-2023-45559 | High | 8.2 | 2024-01-03 | An issue in Tamaki_hamanoki Line v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token. |
CVE-2023-50093 | Medium | 6.1 | 2024-01-03 | APIIDA API Gateway Manager for Broadcom Layer7 v2023.2.2 is vulnerable to Host Header Injection. |
CVE-2023-37607 | High | 7.5 | 2024-01-03 | Directory Traversal in Automatic Systems SOC FL9600 FirstLane V06 lego_T04E00 allows a remote attacker to obtain sensitive information via csvServer.php?file=… |
CVE-2023-50092 | Medium | 6.1 | 2024-01-03 | APIIDA API Gateway Manager for Broadcom Layer7 v2023.2 is vulnerable to Cross Site Scripting (XSS). |
CVE-2023-39655 | Critical | 9.6 | 2024-01-03 | A host header injection vulnerability exists in the NPM package @perfood/couch-auth versions <= 0.20.0. By sending a specially crafted host header in the forgo… |
CVE-2023-37608 | High | 7.5 | 2024-01-03 | An issue in Automatic Systems SOC FL9600 FirstLane V06 lego_T04E00 allows a remote attacker to obtain sensitive information because there is an automaticsystem… |
CVE-2023-51785 | High | 7.5 | 2024-01-03 | Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.9.0, the attackers can make a arbitrary… |
CVE-2023-51784 | Critical | 9.8 | 2024-01-03 | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache InLong.This issue affects Apache InLong: from 1.5.0 through 1.9.0, which coul… |
CVE-2023-7068 | Medium | 4.3 | 2024-01-03 | The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthorized access of data due to a miss… |
CVE-2023-6984 | Medium | 5.3 | 2024-01-03 | The PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up… |
CVE-2023-6747 | Medium | 6.4 | 2024-01-03 | The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom attributes in all versions up t… |
CVE-2023-6621 | Medium | 6.1 | 2024-01-03 | The POST SMTP WordPress plugin before 2.8.7 does not sanitise and escape the msg parameter before outputting it back in the page, leading to a Reflected Cross-… |
CVE-2023-52314 | Critical | 9.6 | 2024-01-03 | PaddlePaddle before 2.6.0 has a command injection in convert_shape_compare. This resulted in the ability to execute arbitrary commands on the operating system… |
CVE-2023-52313 | Medium | 4.7 | 2024-01-03 | FPE in paddle.argmin and paddle.argmax in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service. |
CVE-2023-52312 | Medium | 4.7 | 2024-01-03 | Nullptr dereference in paddle.crop in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service. |
CVE-2023-52311 | Critical | 9.6 | 2024-01-03 | PaddlePaddle before 2.6.0 has a command injection in _wget_download. This resulted in the ability to execute arbitrary commands on the operating system. |
CVE-2023-52310 | Critical | 9.6 | 2024-01-03 | PaddlePaddle before 2.6.0 has a command injection in get_online_pass_interval. This resulted in the ability to execute arbitrary commands on the operating syst… |
CVE-2023-52309 | High | 8.2 | 2024-01-03 | Heap buffer overflow in paddle.repeat_interleave in PaddlePaddle before 2.6.0. This flaw can lead to a denial of service, information disclosure, or more damag… |
CVE-2023-52308 | Medium | 4.7 | 2024-01-03 | FPE in paddle.amin in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service. |
CVE-2023-52307 | High | 8.2 | 2024-01-03 | Stack overflow in paddle.linalg.lu_unpack in PaddlePaddle before 2.6.0. This flaw can lead to a denial of service, or even more damage. |
CVE-2023-52306 | Medium | 4.7 | 2024-01-03 | FPE in paddle.lerp in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service. |
CVE-2023-52305 | Medium | 4.7 | 2024-01-03 | FPE in paddle.topk in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service. |
CVE-2023-52304 | High | 8.2 | 2024-01-03 | Stack overflow in paddle.searchsorted in PaddlePaddle before 2.6.0. This flaw can lead to a denial of service, or even more damage. |
CVE-2023-52303 | Medium | 4.7 | 2024-01-03 | Nullptr in paddle.put_along_axis in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service. |
CVE-2023-52302 | Medium | 4.7 | 2024-01-03 | Nullptr in paddle.nextafter in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service. |
CVE-2023-50921 | Critical | 9.8 | 2024-01-03 | An issue was discovered on GL.iNet devices through 4.5.0. Attackers can invoke the add_user interface in the system module to gain root privileges. This affect… |
CVE-2023-38678 | Medium | 4.7 | 2024-01-03 | OOB access in paddle.mode in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service. |
CVE-2023-38677 | Medium | 4.7 | 2024-01-03 | FPE in paddle.linalg.eig in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service. |
CVE-2023-38676 | Medium | 4.7 | 2024-01-03 | Nullptr in paddle.dot in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service. |
CVE-2023-38675 | Medium | 4.7 | 2024-01-03 | FPE in paddle.linalg.matrix_rank in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service. |
CVE-2023-38674 | Medium | 4.7 | 2024-01-03 | FPE in paddle.nanmedian in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service. |
CVE-2023-50922 | High | 7.2 | 2024-01-03 | An issue was discovered on GL.iNet devices through 4.5.0. Attackers who are able to steal the AdminToken cookie can execute arbitrary code by uploading a cront… |
CVE-2023-6986 | Medium | 6.4 | 2024-01-03 | The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerabl… |
CVE-2023-47473 | High | 7.5 | 2024-01-03 | Directory Traversal vulnerability in fuwushe.org iFair versions 23.8_ad0 and before allows an attacker to obtain sensitive information via a crafted script. |
CVE-2023-6981 | Medium | 6.1 | 2024-01-03 | The WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc plugin for WordPress is vulnerable to SQL Injection via the 'group_id'… |
CVE-2023-6980 | Medium | 4.3 | 2024-01-03 | The WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc plugin for WordPress is vulnerable to Cross-Site Request Forgery in all… |
CVE-2023-6600 | High | 8.6 | 2024-01-03 | The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to unauthorized modification of data and Stored Cross-Site Scrip… |
CVE-2023-6524 | Medium | 6.4 | 2024-01-03 | The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the map title parameter in all versions up to and includi… |
CVE-2023-42358 | High | 7.7 | 2024-01-03 | An issue was discovered in O-RAN Software Community ric-plt-e2mgr in the G-Release environment, allows remote attackers to cause a denial of service (DoS) via… |
CVE-2023-7027 | High | 7.2 | 2024-01-03 | The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scrip… |
CVE-2023-6629 | Medium | 6.1 | 2024-01-03 | The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Sc… |
CVE-2023-46308 | Critical | 9.8 | 2024-01-03 | In Plotly plotly.js before 2.25.2, plot API calls have a risk of __proto__ being polluted in expandObjectPaths or nestedProperty. |
CVE-2023-50344 | Medium | 5.4 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by improper access control (Unauthenticated File Download) vulnerability. An unauthenticated user can download certain files. |
CVE-2023-50343 | High | 8.3 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by an Improper Access Control (Controller APIs) vulnerability. Certain API endpoints are accessible to Customer Admin Users t… |
CVE-2023-50342 | High | 7.1 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by an Insecure Direct Object Reference (IDOR) vulnerability. A user can obtain certain details about another user as a resul… |
CVE-2023-50341 | High | 7.6 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by Improper Access Control (Obsolete web pages) vulnerability. Discovery of outdated and accessible web pages, reflects a "Mi… |
CVE-2023-45724 | High | 8.2 | 2024-01-03 | HCL DRYiCE MyXalytics product is impacted by unauthenticated file upload vulnerability. The web application permits the upload of a certain file without requir… |
CVE-2023-45723 | High | 7.6 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by path traversal vulnerability which allows file upload capability. Certain endpoints permit users to manipulate the path (… |
CVE-2023-45722 | High | 8.8 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by path traversal arbitrary file read vulnerability because it uses external input to construct a pathname that is intended t… |
CVE-2023-50351 | High | 8.2 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by the use of an insecure key rotation mechanism which can allow an attacker to compromise the confidentiality or integrity o… |
CVE-2023-50350 | High | 8.2 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by the use of a broken cryptographic algorithm for encryption, potentially giving an attacker ability to decrypt sensitive in… |
CVE-2023-50348 | Low | 3.1 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by an improper error handling vulnerability. The application returns detailed error messages that can provide an attacker wit… |
CVE-2023-50346 | Low | 3.1 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by an information disclosure vulnerability. Certain endpoints within the application disclose detailed file information. |
CVE-2023-50345 | Low | 3.7 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by an Open Redirect vulnerability which could allow an attacker to redirect users to malicious sites, potentially leading to… |
CVE-2023-41783 | Medium | 4.3 | 2024-01-03 | There is a command injection vulnerability of ZTE's ZXCLOUD iRAI. Due to the program failed to adequately validate the user's input, an attacker could exploi… |
CVE-2023-41780 | Medium | 6.4 | 2024-01-03 | There is an unsafe DLL loading vulnerability in ZTE ZXCLOUD iRAI. Due to the program failed to adequately validate the user's input, an attacker could exploi… |
CVE-2023-41779 | Medium | 4.4 | 2024-01-03 | There is an illegal memory access vulnerability of ZTE's ZXCLOUD iRAI product.When the vulnerability is exploited by an attacker with the common user permissio… |
CVE-2023-41776 | Medium | 6.7 | 2024-01-03 | There is a local privilege escalation vulnerability of ZTE's ZXCLOUD iRAI.Attackers with regular user privileges can create a fake process, and to escalate loc… |
CVE-2023-49558 | Medium | 5.5 | 2024-01-03 | An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the expand_mmac_params function in the modules/preprocs/nasm/nasm-pp… |
CVE-2023-49557 | Medium | 5.5 | 2024-01-03 | An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the yasm_section_bcs_first function in the libyasm/section.c componen… |
CVE-2023-49556 | Medium | 5.5 | 2024-01-03 | Buffer Overflow vulnerability in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the expr_delete_term function in the libyasm/exp… |
CVE-2023-49555 | Medium | 5.5 | 2024-01-03 | An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the expand_smacro function in the modules/preprocs/nasm/nasm-pp.c com… |
CVE-2023-49554 | Medium | 5.5 | 2024-01-03 | Use After Free vulnerability in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the do_directive function in the modules/preprocs… |
CVE-2023-49553 | High | 7.5 | 2024-01-02 | An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_destroy function in the msj.c file. |
CVE-2023-49552 | High | 7.5 | 2024-01-02 | An Out of Bounds Write in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_op_json_stringify function in the msj.c file. |
CVE-2023-49551 | High | 7.5 | 2024-01-02 | An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_op_json_parse function in the msj.c file. |
CVE-2023-49550 | High | 7.5 | 2024-01-02 | An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs+0x4ec508 component. |
CVE-2023-49549 | High | 7.5 | 2024-01-02 | An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_getretvalpos function in the msj.c file. |
CVE-2023-48418 | Critical | 10.0 | 2024-01-02 | In checkDebuggingDisallowed of DeviceVersionFragment.java, there is a possible way to access adb before SUW completion due to an insecure default value… |
CVE-2023-6339 | Critical | 10.0 | 2024-01-02 | Google Nest WiFi Pro root code-execution & user-data compromise |
CVE-2023-50020 | High | 7.5 | 2024-01-02 | An issue was discovered in open5gs v2.6.6. SIGPIPE can be used to crash AMF. |
CVE-2023-50019 | Medium | 5.9 | 2024-01-02 | An issue was discovered in open5gs v2.6.6. InitialUEMessage, Registration request sent at a specific time can crash AMF due to incorrect error handling of Nudm… |
CVE-2023-4164 | High | 8.4 | 2024-01-02 | There is a possible information disclosure due to a missing permission check. This could lead to local information disclosure of health data with no additional… |
CVE-2023-47458 | Critical | 9.8 | 2024-01-02 | An issue in SpringBlade v.3.7.0 and before allows a remote attacker to escalate privileges via the lack of permissions control framework. |
CVE-2023-45893 | High | 7.5 | 2024-01-02 | An indirect Object Reference (IDOR) in the Order and Invoice pages in Floorsight Customer Portal Q3 2023 allows an unauthenticated remote attacker to view sens… |
CVE-2023-45892 | High | 7.5 | 2024-01-02 | An issue discovered in the Order and Invoice pages in Floorsight Insights Q3 2023 allows an unauthenticated remote attacker to view sensitive customer informat… |
CVE-2023-45561 | Medium | 5.3 | 2024-01-02 | An issue in A-WORLD OIRASE BEER_waiting Line v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token. |
CVE-2023-51652 | Medium | 6.1 | 2024-01-02 | OWASP AntiSamy .NET is a library for performing cleansing of HTML coming from untrusted sources. Prior to version 1.2.0, there is a potential for a mutation cr… |
CVE-2023-50711 | Medium | 5.7 | 2024-01-02 | vmm-sys-util is a collection of modules that provides helpers and utilities used by multiple rust-vmm components. Starting in version 0.5.0 and prior to versio… |
CVE-2023-49794 | Medium | 6.7 | 2024-01-02 | KernelSU is a Kernel-based root solution for Android devices. In versions 0.7.1 and prior, the logic of get apk path in KernelSU kernel module can be bypassed… |
CVE-2023-7192 | Medium | 5.5 | 2024-01-02 | A memory leak problem was found in ctnetlink_create_conntrack in net/netfilter/nf_conntrack_netlink.c in the Linux Kernel. This issue may allow a local attacke… |
CVE-2023-48419 | Critical | 10.0 | 2024-01-02 | An attacker in the wifi vicinity of a target Google Home can spy on the victim, resulting in Elevation of Privilege |
CVE-2023-4280 | Critical | 9.3 | 2024-01-02 | An unvalidated input in Silicon Labs TrustZone implementation in v4.3.x and earlier of the Gecko SDK allows an attacker to access the trusted region of memory… |
CVE-2023-6436 | Critical | 9.8 | 2024-01-02 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ekol Informatics Website Template allows SQL Injection. … |
CVE-2023-6693 | Medium | 4.9 | 2024-01-02 | A stack based buffer overflow was found in the virtio-net device of QEMU. This issue occurs when flushing TX in the virtio_net_flush_tx function if guest featu… |