2023 CVEs (page 73)
Page 73 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-50333 | Low | 3.7 | 2024-01-02 | Mattermost fails to update the permissions of the current session for a user who was just demoted to guest, allowing freshly demoted guests to change group nam… |
CVE-2023-48732 | Medium | 4.3 | 2024-01-02 | Mattermost fails to scope the WebSocket response around notified users to a each user separately resulting in the WebSocket broadcasting the information about… |
CVE-2023-47858 | Medium | 4.3 | 2024-01-02 | Mattermost fails to properly verify the permissions needed for viewing archived public channels, allowing a member of one team to get details about the archiv… |
CVE-2023-49142 | Medium | 4.0 | 2024-01-02 | in OpenHarmony v3.2.2 and prior versions allow a local attacker cause multimedia audio crash through modify a released pointer. |
CVE-2023-49135 | Medium | 4.0 | 2024-01-02 | in OpenHarmony v3.2.2 and prior versions allow a local attacker cause multimedia player crash through modify a released pointer. |
CVE-2023-48360 | Medium | 4.0 | 2024-01-02 | in OpenHarmony v3.2.2 and prior versions allow a local attacker cause multimedia player crash through modify a released pointer. |
CVE-2023-47857 | Medium | 4.0 | 2024-01-02 | in OpenHarmony v3.2.2 and prior versions allow a local attacker cause multimedia camera crash through modify a released pointer. |
CVE-2023-47216 | Low | 2.9 | 2024-01-02 | in OpenHarmony v3.2.2 and prior versions allow a local attacker cause DOS through occupy all resources |
CVE-2023-47039 | High | 7.8 | 2024-01-02 | A vulnerability was found in Perl. This security issue occurs while Perl for Windows relies on the system path environment variable to find the shell (`cmd.exe… |
CVE-2023-43514 | High | 8.4 | 2024-01-02 | Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP. |
CVE-2023-43512 | High | 7.5 | 2024-01-02 | Transient DOS while parsing GATT service data when the total amount of memory that is required by the multiple services is greater than the actual size of the… |
CVE-2023-43511 | High | 7.5 | 2024-01-02 | Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header. |
CVE-2023-33120 | High | 7.8 | 2024-01-02 | Memory corruption in Audio when memory map command is executed consecutively in ADSP. |
CVE-2023-33118 | High | 7.8 | 2024-01-02 | Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL. |
CVE-2023-33117 | High | 7.8 | 2024-01-02 | Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCS_LOAD_MODULE command. |
CVE-2023-33116 | High | 7.5 | 2024-01-02 | Transient DOS while parsing ieee80211_parse_mscs_ie in WIN WLAN driver. |
CVE-2023-33114 | High | 8.4 | 2024-01-02 | Memory corruption while running NPU, when NETWORK_UNLOAD and (NETWORK_UNLOAD or NETWORK_EXECUTE_V2) commands are submitted at the same time. |
CVE-2023-33113 | High | 8.4 | 2024-01-02 | Memory corruption when resource manager sends the host kernel a reply message with multiple fragments. |
CVE-2023-33112 | High | 7.5 | 2024-01-02 | Transient DOS when WLAN firmware receives "reassoc response" frame including RIC_DATA element. |
CVE-2023-33110 | High | 7.8 | 2024-01-02 | The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may… |
CVE-2023-33109 | High | 7.5 | 2024-01-02 | Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host. |
CVE-2023-33108 | High | 8.4 | 2024-01-02 | Memory corruption in Graphics Driver when destroying a context with KGSL_GPU_AUX_COMMAND_TIMELINE objects queued. |
CVE-2023-33094 | High | 8.4 | 2024-01-02 | Memory corruption while running VK synchronization with KASAN enabled. |
CVE-2023-33085 | High | 7.8 | 2024-01-02 | Memory corruption in wearables while processing data from AON. |
CVE-2023-33062 | High | 7.5 | 2024-01-02 | Transient DOS in WLAN Firmware while parsing a BTM request. |
CVE-2023-33040 | High | 7.5 | 2024-01-02 | Transient DOS in Data Modem during DTLS handshake. |
CVE-2023-33038 | Medium | 6.7 | 2024-01-02 | Memory corruption while receiving a message in Bus Socket Transport Server. |
CVE-2023-33037 | High | 7.1 | 2024-01-02 | Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data. |
CVE-2023-33036 | High | 7.1 | 2024-01-02 | Permanent DOS in Hypervisor while untrusted VM without PSCI support makes a PSCI call. |
CVE-2023-33033 | High | 8.4 | 2024-01-02 | Memory corruption in Audio during playback with speaker protection. |
CVE-2023-33032 | Critical | 9.3 | 2024-01-02 | Memory corruption in TZ Secure OS while requesting a memory allocation from TA region. |
CVE-2023-33030 | Critical | 9.3 | 2024-01-02 | Memory corruption in HLOS while running playready use-case. |
CVE-2023-33025 | Critical | 9.8 | 2024-01-02 | Memory corruption in Data Modem when a non-standard SDP body, during a VOLTE call. |
CVE-2023-33014 | High | 7.6 | 2024-01-02 | Information disclosure in Core services while processing a Diag command. |
CVE-2023-28583 | Medium | 6.7 | 2024-01-02 | Memory corruption when IPv6 prefix timer object`s lifetime expires which are created while Netmgr daemon gets an IPv6 address. |
CVE-2023-26159 | High | 7.3 | 2024-01-02 | Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() func… |
CVE-2023-26157 | Medium | 5.5 | 2024-01-02 | Versions of the package libredwg before 0.12.5.6384 are vulnerable to Denial of Service (DoS) due to an out-of-bounds read involving section->num_pages in deco… |
CVE-2023-32891 | Medium | 6.7 | 2024-01-02 | In bluetooth service, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System ex… |
CVE-2023-32890 | High | 7.5 | 2024-01-02 | In modem EMM, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privi… |
CVE-2023-32889 | High | 7.5 | 2024-01-02 | In Modem IMS Call UA, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service with no additional exe… |
CVE-2023-32888 | High | 7.5 | 2024-01-02 | In Modem IMS Call UA, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service with no additional exe… |
CVE-2023-32887 | High | 7.5 | 2024-01-02 | In Modem IMS Stack, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service with no additional execution pr… |
CVE-2023-32886 | High | 7.5 | 2024-01-02 | In Modem IMS SMS UA, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service with no additional exec… |
CVE-2023-32885 | Medium | 6.7 | 2024-01-02 | In display drm, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege with System execution pri… |
CVE-2023-32884 | Medium | 6.7 | 2024-01-02 | In netdagent, there is a possible information disclosure due to an incorrect bounds check. This could lead to local escalation of privilege with System executi… |
CVE-2023-32883 | Medium | 6.7 | 2024-01-02 | In Engineer Mode, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution… |
CVE-2023-32882 | Medium | 6.7 | 2024-01-02 | In battery, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege with System execution privile… |
CVE-2023-32881 | Medium | 4.4 | 2024-01-02 | In battery, there is a possible information disclosure due to an integer overflow. This could lead to local information disclosure with System execution privil… |
CVE-2023-32880 | Medium | 4.4 | 2024-01-02 | In battery, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with System execution pri… |
CVE-2023-32879 | Medium | 6.7 | 2024-01-02 | In battery, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privi… |
CVE-2023-32878 | Medium | 4.4 | 2024-01-02 | In battery, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with System execution pri… |
CVE-2023-32877 | Medium | 6.7 | 2024-01-02 | In battery, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privi… |
CVE-2023-32876 | Medium | 4.4 | 2024-01-02 | In keyInstall, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with System execution… |
CVE-2023-32875 | Medium | 4.4 | 2024-01-02 | In keyInstall, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with System execution… |
CVE-2023-32874 | Critical | 9.8 | 2024-01-02 | In Modem IMS Stack, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional executio… |
CVE-2023-32872 | Medium | 6.7 | 2024-01-02 | In keyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution pr… |
CVE-2023-32831 | Medium | 5.5 | 2024-01-02 | In wlan driver, there is a possible PIN crack due to use of insufficiently random values. This could lead to local information disclosure with no execution pri… |
CVE-2023-50096 | High | 7.5 | 2024-01-01 | STMicroelectronics STSAFE-A1xx middleware before 3.3.7 allows MCU code execution if an adversary has the ability to read from and write to the I2C bus. This is… |
CVE-2023-50094 | High | 8.8 | 2024-01-01 | reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/waf_detector/?u… |
CVE-2023-6485 | Medium | 5.4 | 2024-01-01 | The Html5 Video Player WordPress plugin before 2.5.19 does not sanitise and escape some of its player settings, which combined with missing capability checks a… |
CVE-2023-6421 | High | 7.5 | 2024-01-01 | The Download Manager WordPress plugin before 3.2.83 does not protect file download's passwords, leaking it upon receiving an invalid one. |
CVE-2023-6271 | High | 7.5 | 2024-01-01 | The Backup Migration WordPress plugin before 1.3.6 stores in-progress backups information in easy to find, publicly-accessible files, which may allow attackers… |
CVE-2023-6113 | High | 7.5 | 2024-01-01 | The WP STAGING WordPress Backup Plugin before 3.1.3 and WP STAGING Pro WordPress Backup Plugin before 5.1.3 do not prevent visitors from leaking key informatio… |
CVE-2023-6064 | High | 7.5 | 2024-01-01 | The PayHere Payment Gateway WordPress plugin before 2.2.12 automatically creates publicly-accessible log files containing sensitive information when transactio… |
CVE-2023-6037 | Medium | 4.8 | 2024-01-01 | The WP TripAdvisor Review Slider WordPress plugin before 11.9 does not sanitise and escape some of its settings, which could allow high privilege users such as… |
CVE-2023-6000 | Medium | 6.1 | 2024-01-01 | The Popup Builder WordPress plugin before 4.2.3 does not prevent simple visitors from updating existing popups, and injecting raw JavaScript in them, which cou… |
CVE-2023-5877 | Critical | 9.8 | 2024-01-01 | The affiliate-toolkit WordPress plugin before 3.4.3 lacks authorization and authentication for requests to it's affiliate-toolkit-starter/tools/atkp_imagerecei… |
CVE-2023-52133 | High | 8.5 | 2023-12-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WhileTrue Most And Least Read Posts Widget.This issue aff… |
CVE-2023-52132 | High | 7.6 | 2023-12-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jewel Theme WP Adminify.This issue affects WP Adminify: f… |
CVE-2023-52131 | High | 7.6 | 2023-12-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Zinc Page Generator.This issue affects Page Generator… |
CVE-2023-51547 | High | 7.6 | 2023-12-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPManageNinja LLC Fluent Support – WordPress Helpdesk and… |
CVE-2023-51503 | Medium | 5.9 | 2023-12-31 | Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affe… |
CVE-2023-51469 | Critical | 9.3 | 2023-12-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mestres do WP Checkout Mestres WP.This issue affects Chec… |
CVE-2023-51423 | Critical | 9.3 | 2023-12-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saleswonder Team Webinar Plugin: Create live/evergreen/au… |
CVE-2023-7193 | Medium | 4.6 | 2023-12-31 | A vulnerability was found in MTab Bookmark up to 1.2.6 and classified as critical. This issue affects some unknown processing of the file public/install.php of… |
CVE-2023-52185 | Medium | 5.3 | 2023-12-31 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Everestthemes Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning… |
CVE-2023-52134 | High | 7.6 | 2023-12-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eyal Fitoussi GEO my WordPress.This issue affects GEO my… |
CVE-2023-7191 | Medium | 5.5 | 2023-12-31 | A vulnerability, which was classified as critical, was found in S-CMS up to 2.0_build20220529-20231006. This affects an unknown part of the file member/reg.php… |
CVE-2023-7190 | Medium | 5.5 | 2023-12-31 | A vulnerability, which was classified as critical, has been found in S-CMS up to 2.0_build20220529-20231006. Affected by this issue is some unknown functionali… |
CVE-2023-7189 | Medium | 5.5 | 2023-12-31 | A vulnerability classified as critical was found in S-CMS up to 2.0_build20220529-20231006. Affected by this vulnerability is an unknown functionality of the f… |
CVE-2023-7188 | Medium | 5.0 | 2023-12-31 | A vulnerability classified as critical has been found in Shipping 100 Fahuo100 up to 1.1. Affected is an unknown function of the file member/login.php. The man… |
CVE-2023-7187 | Medium | 5.5 | 2023-12-31 | A vulnerability was found in Totolink N350RT 9.3.5u.6139_B20201216. It has been rated as critical. This issue affects some unknown processing of the file /cgi-… |
CVE-2023-7186 | Medium | 5.5 | 2023-12-31 | A vulnerability was found in 7-card Fakabao up to 1.0_build20230805. It has been declared as critical. This vulnerability affects unknown code of the file memb… |
CVE-2023-7185 | Medium | 5.5 | 2023-12-31 | A vulnerability was found in 7-card Fakabao up to 1.0_build20230805. It has been classified as critical. This affects an unknown part of the file shop/wxpay_no… |
CVE-2023-7184 | Medium | 5.5 | 2023-12-31 | A vulnerability was found in 7-card Fakabao up to 1.0_build20230805 and classified as critical. Affected by this issue is some unknown functionality of the fil… |
CVE-2023-7183 | Medium | 5.5 | 2023-12-31 | A vulnerability has been found in 7-card Fakabao up to 1.0_build20230805 and classified as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2023-52180 | High | 7.6 | 2023-12-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Really Simple Plugins Recipe Maker For Your Food Blog fro… |
CVE-2023-49777 | Critical | 9.1 | 2023-12-31 | Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Product Add-Ons.This issue affects YITH WooCommerce Product Add-Ons: from n/a through… |
CVE-2023-6094 | Medium | 5.3 | 2023-12-31 | A vulnerability has been identified in OnCell G3150A-LTE Series firmware versions v1.3 and prior. The vulnerability results from lack of protection for sensiti… |
CVE-2023-6093 | Medium | 5.3 | 2023-12-31 | A clickjacking vulnerability has been identified in OnCell G3150A-LTE Series firmware versions v1.3 and prior. This vulnerability is caused by incorrectly res… |
CVE-2023-52182 | Critical | 9.9 | 2023-12-31 | Deserialization of Untrusted Data vulnerability in ARI Soft ARI Stream Quiz – WordPress Quizzes Builder.This issue affects ARI Stream Quiz – WordPress Quizzes… |
CVE-2023-52181 | Critical | 10.0 | 2023-12-31 | Deserialization of Untrusted Data vulnerability in Presslabs Theme per user.This issue affects Theme per user: from n/a through 1.0.1. |
CVE-2023-39157 | Critical | 9.0 | 2023-12-31 | Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: f… |
CVE-2023-7130 | Medium | 6.3 | 2023-12-31 | A vulnerability has been found in code-projects College Notes Gallery 2.0 and classified as critical. Affected by this vulnerability is an unknown functionalit… |
CVE-2023-52286 | High | 7.5 | 2023-12-31 | Tencent tdsqlpcloud through 1.8.5 allows unauthenticated remote attackers to discover database credentials via an index.php/api/install/get_db_info request, a… |
CVE-2023-52284 | Medium | 5.5 | 2023-12-31 | Bytecode Alliance wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) before 1.3.0 can have an "double free or corruption" error for a valid WebAssembly… |
CVE-2023-52277 | High | 7.8 | 2023-12-31 | Royal RoyalTSX before 6.0.2.1 allows attackers to cause a denial of service (Heap Memory Corruption and application crash) or possibly have unspecified other i… |
CVE-2023-52275 | Low | 2.1 | 2023-12-31 | Gallery3d on Tecno Camon X CA7 devices allows attackers to view hidden images by navigating to data/com.android.gallery3d/.privatealbum/.encryptfiles and guess… |
CVE-2023-52269 | Medium | 4.8 | 2023-12-31 | MDaemon SecurityGateway through 9.0.3 allows XSS via a crafted Message Content Filtering rule. This might allow domain administrators to conduct attacks agains… |
CVE-2023-52267 | High | 7.5 | 2023-12-31 | ehttp 1.0.6 before 17405b9 has a simple_log.cpp _log out-of-bounds-read during error logging for long strings. |