2023 CVEs (page 89)
Page 89 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-48632 | High | 7.8 | 2023-12-13 | Adobe After Effects versions 24.0.3 (and earlier) and 23.6.0 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary… |
CVE-2023-48630 | High | 7.8 | 2023-12-13 | Adobe Substance 3D Sampler versions 4.2.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the… |
CVE-2023-48629 | High | 7.8 | 2023-12-13 | Adobe Substance 3D Sampler versions 4.2.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the… |
CVE-2023-48628 | High | 7.8 | 2023-12-13 | Adobe Substance 3D Sampler versions 4.2.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the… |
CVE-2023-48627 | High | 7.8 | 2023-12-13 | Adobe Substance 3D Sampler versions 4.2.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the… |
CVE-2023-48626 | High | 7.8 | 2023-12-13 | Adobe Substance 3D Sampler versions 4.2.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the… |
CVE-2023-48625 | High | 7.8 | 2023-12-13 | Adobe Substance 3D Sampler versions 4.2.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the… |
CVE-2023-47327 | Medium | 4.3 | 2023-12-13 | The "Create a Space" feature in Silverpeas Core 6.3.1 is reserved for use by administrators. This function suffers from broken access control, allowing any aut… |
CVE-2023-47326 | High | 8.8 | 2023-12-13 | Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) via the Domain SQL Create function. |
CVE-2023-47325 | Medium | 5.4 | 2023-12-13 | Silverpeas Core 6.3.1 administrative "Bin" feature is affected by broken access control. A user with low privileges is able to navigate directly to the bin, re… |
CVE-2023-47324 | Medium | 5.4 | 2023-12-13 | Silverpeas Core 6.3.1 is vulnerable to Cross Site Scripting (XSS) via the message/notification feature. |
CVE-2023-47323 | High | 7.5 | 2023-12-13 | The notification/messaging feature of Silverpeas Core 6.3.1 does not enforce access control on the ID parameter. This allows an attacker to read all messages s… |
CVE-2023-47322 | High | 8.8 | 2023-12-13 | The "userModify" feature of Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) leading to privilege escalation. If an administrator goes… |
CVE-2023-47321 | Medium | 4.9 | 2023-12-13 | Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets. |
CVE-2023-47320 | High | 8.1 | 2023-12-13 | Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control. An attacker with low privileges is able to execute the administrator-only function of putting… |
CVE-2023-47081 | Medium | 5.5 | 2023-12-13 | Adobe Substance 3D Stager versions 2.1.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An… |
CVE-2023-47080 | Medium | 5.5 | 2023-12-13 | Adobe Substance 3D Stager versions 2.1.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An… |
CVE-2023-34194 | High | 7.5 | 2023-12-13 | StringEqual in TiXmlDeclaration::Parse in tinyxmlparser.cpp in TinyXML through 2.6.2 has a reachable assertion (and application exit) via a crafted XML documen… |
CVE-2023-6755 | Medium | 4.7 | 2023-12-13 | A vulnerability was found in DedeBIZ 6.2 and classified as critical. This issue affects some unknown processing of the file /src/admin/content_batchup_action.p… |
CVE-2023-47079 | Medium | 5.5 | 2023-12-13 | Adobe Dimension versions 3.4.10 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker… |
CVE-2023-47078 | Medium | 5.5 | 2023-12-13 | Adobe Dimension versions 3.4.10 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker… |
CVE-2023-47062 | Medium | 5.5 | 2023-12-13 | Adobe Dimension versions 3.4.10 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker… |
CVE-2023-47061 | Medium | 5.5 | 2023-12-13 | Adobe Dimension versions 3.4.10 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker… |
CVE-2023-42495 | Critical | 9.8 | 2023-12-13 | Dasan Networks - W-Web versions 1.22-1.27 - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') |
CVE-2023-44362 | Medium | 5.5 | 2023-12-13 | Adobe Prelude versions 22.6 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could lead to disclosure of sensitive memory. An… |
CVE-2023-6723 | Critical | 10.0 | 2023-12-13 | An unrestricted file upload vulnerability has been identified in Repbox, which allows an attacker to upload malicious files via the transforamationfileupload f… |
CVE-2023-6381 | Low | 3.3 | 2023-12-13 | Improper input validation vulnerability in Newsletter Software SuperMailer affecting version 11.20.0.2204. An attacker could exploit this vulnerability by send… |
CVE-2023-6380 | Medium | 6.1 | 2023-12-13 | Open redirect vulnerability has been found in the Open CMS product affecting versions 14 and 15 of the 'Mercury' template. An attacker could create a specially… |
CVE-2023-6379 | Medium | 5.4 | 2023-12-13 | Cross-site scripting (XSS) vulnerability in Alkacon Software Open CMS, affecting versions 14 and 15 of the 'Mercury' template. This vulnerability could allow a… |
CVE-2023-6722 | High | 7.5 | 2023-12-13 | A path traversal vulnerability has been detected in Repox, which allows an attacker to read arbitrary files on the running server, resulting in a disclosure of… |
CVE-2023-6721 | High | 8.3 | 2023-12-13 | An XEE vulnerability has been found in Repox, which allows a remote attacker to interfere with the application's XML data processing in the fileupload function… |
CVE-2023-6720 | Medium | 5.5 | 2023-12-13 | An XSS vulnerability stored in Repox has been identified, which allows a local attacker to store a specially crafted JavaScript payload on the server, due to t… |
CVE-2023-6719 | Medium | 6.3 | 2023-12-13 | An XSS vulnerability has been detected in Repox, which allows an attacker to compromise interactions between a user and the vulnerable application, and can be… |
CVE-2023-47077 | Medium | 5.5 | 2023-12-13 | Adobe InDesign versions 19.0 (and earlier) and 17.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensit… |
CVE-2023-47076 | Medium | 5.5 | 2023-12-13 | Adobe InDesign versions 19.0 (and earlier) and 17.4.2 (and earlier) are affected by a NULL Pointer Dereference vulnerability. An unauthenticated attacker could… |
CVE-2023-47075 | High | 7.8 | 2023-12-13 | Adobe Illustrator versions 28.0 (and earlier) and 27.9 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code executi… |
CVE-2023-47074 | High | 7.8 | 2023-12-13 | Adobe Illustrator versions 28.0 (and earlier) and 27.9 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which cou… |
CVE-2023-47063 | High | 7.8 | 2023-12-13 | Adobe Illustrator versions 28.0 (and earlier) and 27.9 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code e… |
CVE-2023-6718 | Critical | 9.4 | 2023-12-13 | An authentication bypass vulnerability has been found in Repox, which allows a remote user to send a specially crafted POST request, due to the lack of any aut… |
CVE-2023-6660 | Medium | 6.5 | 2023-12-13 | When a program running on an affected system appends data to a file via an NFS client mount, the bug can cause the NFS client to fail to copy in the data to be… |
CVE-2023-6534 | High | 7.5 | 2023-12-13 | In versions of FreeBSD 14.0-RELEASE before 14-RELEASE-p2, FreeBSD 13.2-RELEASE before 13.2-RELEASE-p7 and FreeBSD 12.4-RELEASE before 12.4-RELEASE-p9, the pf(4… |
CVE-2023-44252 | High | 8.8 | 2023-12-13 | ** UNSUPPORTED WHEN ASSIGNED **An improper authentication vulnerability [CWE-287] in Fortinet FortiWAN version 5.2.0 through 5.2.1 and version 5.1.1 through 5… |
CVE-2023-44251 | High | 8.3 | 2023-12-13 | ** UNSUPPORTED WHEN ASSIGNED **A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability [CWE-22] in Fortinet FortiWAN ver… |
CVE-2023-31210 | High | 8.8 | 2023-12-13 | Usage of user controlled LD_LIBRARY_PATH in agent in Checkmk 2.2.0p10 up to 2.2.0p16 allows malicious Checkmk site user to escalate rights via injection of mal… |
CVE-2023-47536 | Low | 3.1 | 2023-12-13 | An improper access control vulnerability [CWE-284] in FortiOS version 7.2.0, version 7.0.13 and below, version 6.4.14 and below and FortiProxy version 7.2.3 an… |
CVE-2023-45725 | Medium | 5.7 | 2023-12-13 | Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document. T… |
CVE-2023-6478 | High | 7.6 | 2023-12-13 | A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer overflow which may le… |
CVE-2023-6377 | High | 7.8 | 2023-12-13 | A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and… |
CVE-2023-48791 | High | 8.8 | 2023-12-13 | An improper neutralization of special elements used in a command ('Command Injection') vulnerability [CWE-77] in FortiPortal version 7.2.0, version 7.0.6 and b… |
CVE-2023-48782 | High | 8.8 | 2023-12-13 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 allows attacker t… |
CVE-2023-46713 | Medium | 5.3 | 2023-12-13 | An improper output neutralization for logs in Fortinet FortiWeb 6.2.0 - 6.2.8, 6.3.0 - 6.3.23, 7.0.0 - 7.0.9, 7.2.0 - 7.2.5 and 7.4.0 may allow an attacker to… |
CVE-2023-46675 | High | 8.0 | 2023-12-13 | An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error or in the event where debug level logg… |
CVE-2023-46671 | High | 8.0 | 2023-12-13 | An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error. Elastic has released Kibana 8.11.1 wh… |
CVE-2023-45587 | Low | 3.5 | 2023-12-13 | An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, FortiSandbo… |
CVE-2023-41844 | Low | 3.5 | 2023-12-13 | A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, FortiSandbox… |
CVE-2023-41678 | High | 8.8 | 2023-12-13 | A double free in Fortinet FortiOS versions 7.0.0 through 7.0.5, FortiPAM version 1.0.0 through 1.0.3, 1.1.0 through 1.1.1 allows attacker to execute unauthoriz… |
CVE-2023-41673 | High | 7.1 | 2023-12-13 | An improper authorization vulnerability [CWE-285] in Fortinet FortiADC version 7.4.0 and before 7.2.2 may allow a low privileged user to read or backup the ful… |
CVE-2023-40716 | Medium | 6.7 | 2023-12-13 | An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the command line interpreter of FortiTester 2.3.0 through 7.2.3… |
CVE-2023-36639 | High | 7.2 | 2023-12-13 | A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, FortiOS versions 7.4.0, 7.2.0 through 7… |
CVE-2023-45801 | High | 7.5 | 2023-12-13 | Improper Authentication vulnerability in Nadatel DVR allows Information Elicitation.This issue affects DVR: from 3.0.0 before 9.9.0. |
CVE-2023-47579 | High | 7.5 | 2023-12-13 | Relyum RELY-PCIe 22.2.1 devices suffer from a system group misconfiguration, allowing read access to the central password hash file of the operating system. |
CVE-2023-47578 | High | 8.8 | 2023-12-13 | Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 devices are susceptible to Cross Site Request Forgery (CSRF) attacks due to the absence of CSRF protection in the w… |
CVE-2023-47577 | Critical | 9.8 | 2023-12-13 | An issue discovered in Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 allows for unauthorized password changes due to no check for current password. |
CVE-2023-47576 | High | 8.8 | 2023-12-13 | An issue was discovered in Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 devices, allowing authenticated command injection through the web interface. |
CVE-2023-47575 | Medium | 6.1 | 2023-12-13 | An issue was discovered on Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 devices. The web interfaces of the Relyum devices are susceptible to reflected XSS. |
CVE-2023-47574 | Medium | 5.9 | 2023-12-13 | An issue was discovered on Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 devices. There is a Weak SMB configuration with signing disabled. |
CVE-2023-47573 | High | 8.8 | 2023-12-13 | An issue discovered in Relyum RELY-PCIe 22.2.1 devices. The authorization mechanism is not enforced in the web interface, allowing a low-privileged user to exe… |
CVE-2023-45800 | High | 7.5 | 2023-12-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hanbiro Hanbiro groupware allows Information Elicitation… |
CVE-2023-45864 | Medium | 4.0 | 2023-12-13 | A race condition issue discovered in Samsung Mobile Processor Exynos 9820, 980, 1080, 2100, 2200, 1280, and 1380 allows unintended modifications of values with… |
CVE-2023-43122 | Medium | 4.8 | 2023-12-13 | Samsung Mobile Processor and Wearable Processor (Exynos 980, 850, 1080, 2100, 2200, 1280, 1380, 1330, and W920) allow Information Disclosure in the Bootloader. |
CVE-2023-42483 | Medium | 6.3 | 2023-12-13 | A TOCTOU race condition in Samsung Mobile Processor Exynos 9820, Exynos 980, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, and Exynos 1380 can cause unex… |
CVE-2023-6753 | High | 8.8 | 2023-12-13 | Path Traversal in GitHub repository mlflow/mlflow prior to 2.9.2. |
CVE-2023-50263 | Low | 3.7 | 2023-12-12 | Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL da… |
CVE-2023-3517 | High | 8.5 | 2023-12-12 | Hitachi Vantara Pentaho Data Integration & Analytics versions before 9.5.0.1 and 9.3.0.5, including 8.3.x does not restrict JNDI identifiers during the creat… |
CVE-2023-6710 | Medium | 5.4 | 2023-12-12 | A flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias' parameter in the URL to tr… |
CVE-2023-5764 | High | 7.1 | 2023-12-12 | A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. T… |
CVE-2023-5379 | High | 7.5 | 2023-12-12 | A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by… |
CVE-2023-50252 | High | 8.3 | 2023-12-12 | php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling `<use>` tag that references an `<image>` tag, it merges the attri… |
CVE-2023-50251 | Medium | 5.3 | 2023-12-12 | php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when parsing the attributes passed to a `use` tag inside an svg document, an at… |
CVE-2023-48225 | High | 8.9 | 2023-12-12 | Laf is a cloud development platform. Prior to version 1.0.0-beta.13, the control of LAF app enV is not strict enough, and in certain scenarios of privatization… |
CVE-2023-50247 | Low | 3.7 | 2023-12-12 | h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. The QUIC stack (quicly), as used by H2O up to commit 43f86e5 (in version 2.3.0-beta and pri… |
CVE-2023-49279 | Low | 3.7 | 2023-12-12 | Umbraco is an ASP.NET content management system (CMS). Starting in version 7.0.0 and prior to versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0, a user with… |
CVE-2023-49278 | Medium | 5.3 | 2023-12-12 | Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a brute force exploit can b… |
CVE-2023-49274 | Low | 3.7 | 2023-12-12 | Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a user enumeration attack i… |
CVE-2023-41337 | Medium | 6.1 | 2023-12-12 | h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. In version 2.3.0-beta2 and prior, when h2o is configured to listen to multiple addresses or… |
CVE-2023-34064 | Medium | 4.6 | 2023-12-12 | Workspace ONE Launcher contains a Privilege Escalation Vulnerability. A malicious actor with physical access to Workspace ONE Launcher could utilize the Edge P… |
CVE-2023-6687 | Medium | 6.8 | 2023-12-12 | An issue was discovered by Elastic whereby Elastic Agent would log a raw event in its own logs at the WARN or ERROR level if ingesting that event to Elasticsea… |
CVE-2023-49922 | Medium | 6.8 | 2023-12-12 | An issue was discovered by Elastic whereby Beats and Elastic Agent would log a raw event in its own logs at the WARN or ERROR level if ingesting that event to… |
CVE-2023-49273 | Medium | 5.4 | 2023-12-12 | Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, users with low privileges (… |
CVE-2023-49089 | High | 7.7 | 2023-12-12 | Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.0, Backoffice users with permi… |
CVE-2023-49923 | Medium | 6.8 | 2023-12-12 | An issue was discovered by Elastic whereby the Documents API of App Search logged the raw contents of indexed documents at INFO log level. Depending on the co… |
CVE-2023-48313 | Medium | 4.3 | 2023-12-12 | Umbraco is an ASP.NET content management system (CMS). Starting in 10.0.0 and prior to versions 10.8.1 and 12.3.4, Umbraco contains a cross-site scripting (XS… |
CVE-2023-43364 | Critical | 9.8 | 2023-12-12 | main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution. |
CVE-2023-36696 | High | 7.8 | 2023-12-12 | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability |
CVE-2023-36391 | High | 7.8 | 2023-12-12 | Local Security Authority Subsystem Service Elevation of Privilege Vulnerability |
CVE-2023-36020 | High | 7.6 | 2023-12-12 | Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability |
CVE-2023-36019 | Critical | 9.6 | 2023-12-12 | Microsoft Power Platform Connector Spoofing Vulnerability |
CVE-2023-36012 | Medium | 5.3 | 2023-12-12 | DHCP Server Service Information Disclosure Vulnerability |
CVE-2023-36011 | High | 7.8 | 2023-12-12 | Win32k Elevation of Privilege Vulnerability |
CVE-2023-36010 | High | 7.5 | 2023-12-12 | Microsoft Defender Denial of Service Vulnerability |