2023 CVEs (page 73)
Page 73 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-6986 | Medium | 6.4 | 2024-01-03 | The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerabl… |
CVE-2023-47473 | High | 7.5 | 2024-01-03 | Directory Traversal vulnerability in fuwushe.org iFair versions 23.8_ad0 and before allows an attacker to obtain sensitive information via a crafted script. |
CVE-2023-6981 | Medium | 6.1 | 2024-01-03 | The WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc plugin for WordPress is vulnerable to SQL Injection via the 'group_id'… |
CVE-2023-6980 | Medium | 4.3 | 2024-01-03 | The WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc plugin for WordPress is vulnerable to Cross-Site Request Forgery in all… |
CVE-2023-6600 | High | 8.6 | 2024-01-03 | The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to unauthorized modification of data and Stored Cross-Site Scrip… |
CVE-2023-6524 | Medium | 6.4 | 2024-01-03 | The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the map title parameter in all versions up to and includi… |
CVE-2023-42358 | High | 7.7 | 2024-01-03 | An issue was discovered in O-RAN Software Community ric-plt-e2mgr in the G-Release environment, allows remote attackers to cause a denial of service (DoS) via… |
CVE-2023-7027 | High | 7.2 | 2024-01-03 | The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scrip… |
CVE-2023-6629 | Medium | 6.1 | 2024-01-03 | The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Sc… |
CVE-2023-46308 | Critical | 9.8 | 2024-01-03 | In Plotly plotly.js before 2.25.2, plot API calls have a risk of __proto__ being polluted in expandObjectPaths or nestedProperty. |
CVE-2023-50344 | Medium | 5.4 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by improper access control (Unauthenticated File Download) vulnerability. An unauthenticated user can download certain files. |
CVE-2023-50343 | High | 8.3 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by an Improper Access Control (Controller APIs) vulnerability. Certain API endpoints are accessible to Customer Admin Users t… |
CVE-2023-50342 | High | 7.1 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by an Insecure Direct Object Reference (IDOR) vulnerability. A user can obtain certain details about another user as a resul… |
CVE-2023-50341 | High | 7.6 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by Improper Access Control (Obsolete web pages) vulnerability. Discovery of outdated and accessible web pages, reflects a "Mi… |
CVE-2023-45724 | High | 8.2 | 2024-01-03 | HCL DRYiCE MyXalytics product is impacted by unauthenticated file upload vulnerability. The web application permits the upload of a certain file without requir… |
CVE-2023-45723 | High | 7.6 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by path traversal vulnerability which allows file upload capability. Certain endpoints permit users to manipulate the path (… |
CVE-2023-45722 | High | 8.8 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by path traversal arbitrary file read vulnerability because it uses external input to construct a pathname that is intended t… |
CVE-2023-50351 | High | 8.2 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by the use of an insecure key rotation mechanism which can allow an attacker to compromise the confidentiality or integrity o… |
CVE-2023-50350 | High | 8.2 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by the use of a broken cryptographic algorithm for encryption, potentially giving an attacker ability to decrypt sensitive in… |
CVE-2023-50348 | Low | 3.1 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by an improper error handling vulnerability. The application returns detailed error messages that can provide an attacker wit… |
CVE-2023-50346 | Low | 3.1 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by an information disclosure vulnerability. Certain endpoints within the application disclose detailed file information. |
CVE-2023-50345 | Low | 3.7 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by an Open Redirect vulnerability which could allow an attacker to redirect users to malicious sites, potentially leading to… |
CVE-2023-41783 | Medium | 4.3 | 2024-01-03 | There is a command injection vulnerability of ZTE's ZXCLOUD iRAI. Due to the program failed to adequately validate the user's input, an attacker could exploi… |
CVE-2023-41780 | Medium | 6.4 | 2024-01-03 | There is an unsafe DLL loading vulnerability in ZTE ZXCLOUD iRAI. Due to the program failed to adequately validate the user's input, an attacker could exploi… |
CVE-2023-41779 | Medium | 4.4 | 2024-01-03 | There is an illegal memory access vulnerability of ZTE's ZXCLOUD iRAI product.When the vulnerability is exploited by an attacker with the common user permissio… |
CVE-2023-41776 | Medium | 6.7 | 2024-01-03 | There is a local privilege escalation vulnerability of ZTE's ZXCLOUD iRAI.Attackers with regular user privileges can create a fake process, and to escalate loc… |
CVE-2023-49558 | Medium | 5.5 | 2024-01-03 | An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the expand_mmac_params function in the modules/preprocs/nasm/nasm-pp… |
CVE-2023-49557 | Medium | 5.5 | 2024-01-03 | An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the yasm_section_bcs_first function in the libyasm/section.c componen… |
CVE-2023-49556 | Medium | 5.5 | 2024-01-03 | Buffer Overflow vulnerability in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the expr_delete_term function in the libyasm/exp… |
CVE-2023-49555 | Medium | 5.5 | 2024-01-03 | An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the expand_smacro function in the modules/preprocs/nasm/nasm-pp.c com… |
CVE-2023-49554 | Medium | 5.5 | 2024-01-03 | Use After Free vulnerability in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the do_directive function in the modules/preprocs… |
CVE-2023-49553 | High | 7.5 | 2024-01-02 | An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_destroy function in the msj.c file. |
CVE-2023-49552 | High | 7.5 | 2024-01-02 | An Out of Bounds Write in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_op_json_stringify function in the msj.c file. |
CVE-2023-49551 | High | 7.5 | 2024-01-02 | An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_op_json_parse function in the msj.c file. |
CVE-2023-49550 | High | 7.5 | 2024-01-02 | An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs+0x4ec508 component. |
CVE-2023-49549 | High | 7.5 | 2024-01-02 | An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_getretvalpos function in the msj.c file. |
CVE-2023-48418 | Critical | 10.0 | 2024-01-02 | In checkDebuggingDisallowed of DeviceVersionFragment.java, there is a possible way to access adb before SUW completion due to an insecure default value… |
CVE-2023-6339 | Critical | 10.0 | 2024-01-02 | Google Nest WiFi Pro root code-execution & user-data compromise |
CVE-2023-50020 | High | 7.5 | 2024-01-02 | An issue was discovered in open5gs v2.6.6. SIGPIPE can be used to crash AMF. |
CVE-2023-50019 | Medium | 5.9 | 2024-01-02 | An issue was discovered in open5gs v2.6.6. InitialUEMessage, Registration request sent at a specific time can crash AMF due to incorrect error handling of Nudm… |
CVE-2023-4164 | High | 8.4 | 2024-01-02 | There is a possible information disclosure due to a missing permission check. This could lead to local information disclosure of health data with no additional… |
CVE-2023-47458 | Critical | 9.8 | 2024-01-02 | An issue in SpringBlade v.3.7.0 and before allows a remote attacker to escalate privileges via the lack of permissions control framework. |
CVE-2023-45893 | High | 7.5 | 2024-01-02 | An indirect Object Reference (IDOR) in the Order and Invoice pages in Floorsight Customer Portal Q3 2023 allows an unauthenticated remote attacker to view sens… |
CVE-2023-45892 | High | 7.5 | 2024-01-02 | An issue discovered in the Order and Invoice pages in Floorsight Insights Q3 2023 allows an unauthenticated remote attacker to view sensitive customer informat… |
CVE-2023-45561 | Medium | 5.3 | 2024-01-02 | An issue in A-WORLD OIRASE BEER_waiting Line v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token. |
CVE-2023-51652 | Medium | 6.1 | 2024-01-02 | OWASP AntiSamy .NET is a library for performing cleansing of HTML coming from untrusted sources. Prior to version 1.2.0, there is a potential for a mutation cr… |
CVE-2023-50711 | Medium | 5.7 | 2024-01-02 | vmm-sys-util is a collection of modules that provides helpers and utilities used by multiple rust-vmm components. Starting in version 0.5.0 and prior to versio… |
CVE-2023-49794 | Medium | 6.7 | 2024-01-02 | KernelSU is a Kernel-based root solution for Android devices. In versions 0.7.1 and prior, the logic of get apk path in KernelSU kernel module can be bypassed… |
CVE-2023-7192 | Medium | 5.5 | 2024-01-02 | A memory leak problem was found in ctnetlink_create_conntrack in net/netfilter/nf_conntrack_netlink.c in the Linux Kernel. This issue may allow a local attacke… |
CVE-2023-48419 | Critical | 10.0 | 2024-01-02 | An attacker in the wifi vicinity of a target Google Home can spy on the victim, resulting in Elevation of Privilege |
CVE-2023-4280 | Critical | 9.3 | 2024-01-02 | An unvalidated input in Silicon Labs TrustZone implementation in v4.3.x and earlier of the Gecko SDK allows an attacker to access the trusted region of memory… |
CVE-2023-6436 | Critical | 9.8 | 2024-01-02 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ekol Informatics Website Template allows SQL Injection. … |
CVE-2023-6693 | Medium | 4.9 | 2024-01-02 | A stack based buffer overflow was found in the virtio-net device of QEMU. This issue occurs when flushing TX in the virtio_net_flush_tx function if guest featu… |
CVE-2023-50333 | Low | 3.7 | 2024-01-02 | Mattermost fails to update the permissions of the current session for a user who was just demoted to guest, allowing freshly demoted guests to change group nam… |
CVE-2023-48732 | Medium | 4.3 | 2024-01-02 | Mattermost fails to scope the WebSocket response around notified users to a each user separately resulting in the WebSocket broadcasting the information about… |
CVE-2023-47858 | Medium | 4.3 | 2024-01-02 | Mattermost fails to properly verify the permissions needed for viewing archived public channels, allowing a member of one team to get details about the archiv… |
CVE-2023-49142 | Medium | 4.0 | 2024-01-02 | in OpenHarmony v3.2.2 and prior versions allow a local attacker cause multimedia audio crash through modify a released pointer. |
CVE-2023-49135 | Medium | 4.0 | 2024-01-02 | in OpenHarmony v3.2.2 and prior versions allow a local attacker cause multimedia player crash through modify a released pointer. |
CVE-2023-48360 | Medium | 4.0 | 2024-01-02 | in OpenHarmony v3.2.2 and prior versions allow a local attacker cause multimedia player crash through modify a released pointer. |
CVE-2023-47857 | Medium | 4.0 | 2024-01-02 | in OpenHarmony v3.2.2 and prior versions allow a local attacker cause multimedia camera crash through modify a released pointer. |
CVE-2023-47216 | Low | 2.9 | 2024-01-02 | in OpenHarmony v3.2.2 and prior versions allow a local attacker cause DOS through occupy all resources |
CVE-2023-47039 | High | 7.8 | 2024-01-02 | A vulnerability was found in Perl. This security issue occurs while Perl for Windows relies on the system path environment variable to find the shell (`cmd.exe… |
CVE-2023-43514 | High | 8.4 | 2024-01-02 | Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP. |
CVE-2023-43512 | High | 7.5 | 2024-01-02 | Transient DOS while parsing GATT service data when the total amount of memory that is required by the multiple services is greater than the actual size of the… |
CVE-2023-43511 | High | 7.5 | 2024-01-02 | Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header. |
CVE-2023-33120 | High | 7.8 | 2024-01-02 | Memory corruption in Audio when memory map command is executed consecutively in ADSP. |
CVE-2023-33118 | High | 7.8 | 2024-01-02 | Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL. |
CVE-2023-33117 | High | 7.8 | 2024-01-02 | Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCS_LOAD_MODULE command. |
CVE-2023-33116 | High | 7.5 | 2024-01-02 | Transient DOS while parsing ieee80211_parse_mscs_ie in WIN WLAN driver. |
CVE-2023-33114 | High | 8.4 | 2024-01-02 | Memory corruption while running NPU, when NETWORK_UNLOAD and (NETWORK_UNLOAD or NETWORK_EXECUTE_V2) commands are submitted at the same time. |
CVE-2023-33113 | High | 8.4 | 2024-01-02 | Memory corruption when resource manager sends the host kernel a reply message with multiple fragments. |
CVE-2023-33112 | High | 7.5 | 2024-01-02 | Transient DOS when WLAN firmware receives "reassoc response" frame including RIC_DATA element. |
CVE-2023-33110 | High | 7.8 | 2024-01-02 | The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may… |
CVE-2023-33109 | High | 7.5 | 2024-01-02 | Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host. |
CVE-2023-33108 | High | 8.4 | 2024-01-02 | Memory corruption in Graphics Driver when destroying a context with KGSL_GPU_AUX_COMMAND_TIMELINE objects queued. |
CVE-2023-33094 | High | 8.4 | 2024-01-02 | Memory corruption while running VK synchronization with KASAN enabled. |
CVE-2023-33085 | High | 7.8 | 2024-01-02 | Memory corruption in wearables while processing data from AON. |
CVE-2023-33062 | High | 7.5 | 2024-01-02 | Transient DOS in WLAN Firmware while parsing a BTM request. |
CVE-2023-33040 | High | 7.5 | 2024-01-02 | Transient DOS in Data Modem during DTLS handshake. |
CVE-2023-33038 | Medium | 6.7 | 2024-01-02 | Memory corruption while receiving a message in Bus Socket Transport Server. |
CVE-2023-33037 | High | 7.1 | 2024-01-02 | Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data. |
CVE-2023-33036 | High | 7.1 | 2024-01-02 | Permanent DOS in Hypervisor while untrusted VM without PSCI support makes a PSCI call. |
CVE-2023-33033 | High | 8.4 | 2024-01-02 | Memory corruption in Audio during playback with speaker protection. |
CVE-2023-33032 | Critical | 9.3 | 2024-01-02 | Memory corruption in TZ Secure OS while requesting a memory allocation from TA region. |
CVE-2023-33030 | Critical | 9.3 | 2024-01-02 | Memory corruption in HLOS while running playready use-case. |
CVE-2023-33025 | Critical | 9.8 | 2024-01-02 | Memory corruption in Data Modem when a non-standard SDP body, during a VOLTE call. |
CVE-2023-33014 | High | 7.6 | 2024-01-02 | Information disclosure in Core services while processing a Diag command. |
CVE-2023-28583 | Medium | 6.7 | 2024-01-02 | Memory corruption when IPv6 prefix timer object`s lifetime expires which are created while Netmgr daemon gets an IPv6 address. |
CVE-2023-26159 | High | 7.3 | 2024-01-02 | Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() func… |
CVE-2023-26157 | Medium | 5.5 | 2024-01-02 | Versions of the package libredwg before 0.12.5.6384 are vulnerable to Denial of Service (DoS) due to an out-of-bounds read involving section->num_pages in deco… |
CVE-2023-32891 | Medium | 6.7 | 2024-01-02 | In bluetooth service, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System ex… |
CVE-2023-32890 | High | 7.5 | 2024-01-02 | In modem EMM, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privi… |
CVE-2023-32889 | High | 7.5 | 2024-01-02 | In Modem IMS Call UA, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service with no additional exe… |
CVE-2023-32888 | High | 7.5 | 2024-01-02 | In Modem IMS Call UA, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service with no additional exe… |
CVE-2023-32887 | High | 7.5 | 2024-01-02 | In Modem IMS Stack, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service with no additional execution pr… |
CVE-2023-32886 | High | 7.5 | 2024-01-02 | In Modem IMS SMS UA, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service with no additional exec… |
CVE-2023-32885 | Medium | 6.7 | 2024-01-02 | In display drm, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege with System execution pri… |
CVE-2023-32884 | Medium | 6.7 | 2024-01-02 | In netdagent, there is a possible information disclosure due to an incorrect bounds check. This could lead to local escalation of privilege with System executi… |
CVE-2023-32883 | Medium | 6.7 | 2024-01-02 | In Engineer Mode, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution… |
CVE-2023-32882 | Medium | 6.7 | 2024-01-02 | In battery, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege with System execution privile… |