2023 CVEs (page 90)
Page 90 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-6377 | High | 7.8 | 2023-12-13 | A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and… |
CVE-2023-48791 | High | 8.8 | 2023-12-13 | An improper neutralization of special elements used in a command ('Command Injection') vulnerability [CWE-77] in FortiPortal version 7.2.0, version 7.0.6 and b… |
CVE-2023-48782 | High | 8.8 | 2023-12-13 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 allows attacker t… |
CVE-2023-46713 | Medium | 5.3 | 2023-12-13 | An improper output neutralization for logs in Fortinet FortiWeb 6.2.0 - 6.2.8, 6.3.0 - 6.3.23, 7.0.0 - 7.0.9, 7.2.0 - 7.2.5 and 7.4.0 may allow an attacker to… |
CVE-2023-46675 | High | 8.0 | 2023-12-13 | An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error or in the event where debug level logg… |
CVE-2023-46671 | High | 8.0 | 2023-12-13 | An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error. Elastic has released Kibana 8.11.1 wh… |
CVE-2023-45587 | Low | 3.5 | 2023-12-13 | An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, FortiSandbo… |
CVE-2023-41844 | Low | 3.5 | 2023-12-13 | A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, FortiSandbox… |
CVE-2023-41678 | High | 8.8 | 2023-12-13 | A double free in Fortinet FortiOS versions 7.0.0 through 7.0.5, FortiPAM version 1.0.0 through 1.0.3, 1.1.0 through 1.1.1 allows attacker to execute unauthoriz… |
CVE-2023-41673 | High | 7.1 | 2023-12-13 | An improper authorization vulnerability [CWE-285] in Fortinet FortiADC version 7.4.0 and before 7.2.2 may allow a low privileged user to read or backup the ful… |
CVE-2023-40716 | Medium | 6.7 | 2023-12-13 | An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the command line interpreter of FortiTester 2.3.0 through 7.2.3… |
CVE-2023-36639 | High | 7.2 | 2023-12-13 | A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, FortiOS versions 7.4.0, 7.2.0 through 7… |
CVE-2023-45801 | High | 7.5 | 2023-12-13 | Improper Authentication vulnerability in Nadatel DVR allows Information Elicitation.This issue affects DVR: from 3.0.0 before 9.9.0. |
CVE-2023-47579 | High | 7.5 | 2023-12-13 | Relyum RELY-PCIe 22.2.1 devices suffer from a system group misconfiguration, allowing read access to the central password hash file of the operating system. |
CVE-2023-47578 | High | 8.8 | 2023-12-13 | Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 devices are susceptible to Cross Site Request Forgery (CSRF) attacks due to the absence of CSRF protection in the w… |
CVE-2023-47577 | Critical | 9.8 | 2023-12-13 | An issue discovered in Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 allows for unauthorized password changes due to no check for current password. |
CVE-2023-47576 | High | 8.8 | 2023-12-13 | An issue was discovered in Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 devices, allowing authenticated command injection through the web interface. |
CVE-2023-47575 | Medium | 6.1 | 2023-12-13 | An issue was discovered on Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 devices. The web interfaces of the Relyum devices are susceptible to reflected XSS. |
CVE-2023-47574 | Medium | 5.9 | 2023-12-13 | An issue was discovered on Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 devices. There is a Weak SMB configuration with signing disabled. |
CVE-2023-47573 | High | 8.8 | 2023-12-13 | An issue discovered in Relyum RELY-PCIe 22.2.1 devices. The authorization mechanism is not enforced in the web interface, allowing a low-privileged user to exe… |
CVE-2023-45800 | High | 7.5 | 2023-12-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hanbiro Hanbiro groupware allows Information Elicitation… |
CVE-2023-45864 | Medium | 4.0 | 2023-12-13 | A race condition issue discovered in Samsung Mobile Processor Exynos 9820, 980, 1080, 2100, 2200, 1280, and 1380 allows unintended modifications of values with… |
CVE-2023-43122 | Medium | 4.8 | 2023-12-13 | Samsung Mobile Processor and Wearable Processor (Exynos 980, 850, 1080, 2100, 2200, 1280, 1380, 1330, and W920) allow Information Disclosure in the Bootloader. |
CVE-2023-42483 | Medium | 6.3 | 2023-12-13 | A TOCTOU race condition in Samsung Mobile Processor Exynos 9820, Exynos 980, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, and Exynos 1380 can cause unex… |
CVE-2023-6753 | High | 8.8 | 2023-12-13 | Path Traversal in GitHub repository mlflow/mlflow prior to 2.9.2. |
CVE-2023-50263 | Low | 3.7 | 2023-12-12 | Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL da… |
CVE-2023-3517 | High | 8.5 | 2023-12-12 | Hitachi Vantara Pentaho Data Integration & Analytics versions before 9.5.0.1 and 9.3.0.5, including 8.3.x does not restrict JNDI identifiers during the creat… |
CVE-2023-6710 | Medium | 5.4 | 2023-12-12 | A flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias' parameter in the URL to tr… |
CVE-2023-5764 | High | 7.1 | 2023-12-12 | A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. T… |
CVE-2023-5379 | High | 7.5 | 2023-12-12 | A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by… |
CVE-2023-50252 | High | 8.3 | 2023-12-12 | php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling `<use>` tag that references an `<image>` tag, it merges the attri… |
CVE-2023-50251 | Medium | 5.3 | 2023-12-12 | php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when parsing the attributes passed to a `use` tag inside an svg document, an at… |
CVE-2023-48225 | High | 8.9 | 2023-12-12 | Laf is a cloud development platform. Prior to version 1.0.0-beta.13, the control of LAF app enV is not strict enough, and in certain scenarios of privatization… |
CVE-2023-50247 | Low | 3.7 | 2023-12-12 | h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. The QUIC stack (quicly), as used by H2O up to commit 43f86e5 (in version 2.3.0-beta and pri… |
CVE-2023-49279 | Low | 3.7 | 2023-12-12 | Umbraco is an ASP.NET content management system (CMS). Starting in version 7.0.0 and prior to versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0, a user with… |
CVE-2023-49278 | Medium | 5.3 | 2023-12-12 | Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a brute force exploit can b… |
CVE-2023-49274 | Low | 3.7 | 2023-12-12 | Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a user enumeration attack i… |
CVE-2023-41337 | Medium | 6.1 | 2023-12-12 | h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. In version 2.3.0-beta2 and prior, when h2o is configured to listen to multiple addresses or… |
CVE-2023-34064 | Medium | 4.6 | 2023-12-12 | Workspace ONE Launcher contains a Privilege Escalation Vulnerability. A malicious actor with physical access to Workspace ONE Launcher could utilize the Edge P… |
CVE-2023-6687 | Medium | 6.8 | 2023-12-12 | An issue was discovered by Elastic whereby Elastic Agent would log a raw event in its own logs at the WARN or ERROR level if ingesting that event to Elasticsea… |
CVE-2023-49922 | Medium | 6.8 | 2023-12-12 | An issue was discovered by Elastic whereby Beats and Elastic Agent would log a raw event in its own logs at the WARN or ERROR level if ingesting that event to… |
CVE-2023-49273 | Medium | 5.4 | 2023-12-12 | Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, users with low privileges (… |
CVE-2023-49089 | High | 7.7 | 2023-12-12 | Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.0, Backoffice users with permi… |
CVE-2023-49923 | Medium | 6.8 | 2023-12-12 | An issue was discovered by Elastic whereby the Documents API of App Search logged the raw contents of indexed documents at INFO log level. Depending on the co… |
CVE-2023-48313 | Medium | 4.3 | 2023-12-12 | Umbraco is an ASP.NET content management system (CMS). Starting in 10.0.0 and prior to versions 10.8.1 and 12.3.4, Umbraco contains a cross-site scripting (XS… |
CVE-2023-43364 | Critical | 9.8 | 2023-12-12 | main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution. |
CVE-2023-36696 | High | 7.8 | 2023-12-12 | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability |
CVE-2023-36391 | High | 7.8 | 2023-12-12 | Local Security Authority Subsystem Service Elevation of Privilege Vulnerability |
CVE-2023-36020 | High | 7.6 | 2023-12-12 | Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability |
CVE-2023-36019 | Critical | 9.6 | 2023-12-12 | Microsoft Power Platform Connector Spoofing Vulnerability |
CVE-2023-36012 | Medium | 5.3 | 2023-12-12 | DHCP Server Service Information Disclosure Vulnerability |
CVE-2023-36011 | High | 7.8 | 2023-12-12 | Win32k Elevation of Privilege Vulnerability |
CVE-2023-36010 | High | 7.5 | 2023-12-12 | Microsoft Defender Denial of Service Vulnerability |
CVE-2023-36009 | Medium | 5.5 | 2023-12-12 | Microsoft Word Information Disclosure Vulnerability |
CVE-2023-36006 | High | 8.8 | 2023-12-12 | Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability |
CVE-2023-36005 | High | 7.5 | 2023-12-12 | Windows Telephony Server Elevation of Privilege Vulnerability |
CVE-2023-36004 | High | 7.5 | 2023-12-12 | Windows DPAPI (Data Protection Application Programming Interface) Spoofing Vulnerability |
CVE-2023-36003 | Medium | 6.7 | 2023-12-12 | XAML Diagnostics Elevation of Privilege Vulnerability |
CVE-2023-35644 | High | 7.8 | 2023-12-12 | Windows Sysmain Service Elevation of Privilege Vulnerability |
CVE-2023-35643 | High | 7.5 | 2023-12-12 | DHCP Server Service Information Disclosure Vulnerability |
CVE-2023-35642 | Medium | 6.5 | 2023-12-12 | Internet Connection Sharing (ICS) Denial of Service Vulnerability |
CVE-2023-35641 | High | 8.8 | 2023-12-12 | Internet Connection Sharing (ICS) Remote Code Execution Vulnerability |
CVE-2023-35639 | High | 8.8 | 2023-12-12 | Microsoft ODBC Driver Remote Code Execution Vulnerability |
CVE-2023-35638 | High | 7.5 | 2023-12-12 | DHCP Server Service Denial of Service Vulnerability |
CVE-2023-35636 | Medium | 6.5 | 2023-12-12 | Microsoft Outlook Information Disclosure Vulnerability |
CVE-2023-35635 | Medium | 5.5 | 2023-12-12 | Windows Kernel Denial of Service Vulnerability |
CVE-2023-35634 | High | 8.0 | 2023-12-12 | Windows Bluetooth Driver Remote Code Execution Vulnerability |
CVE-2023-35633 | High | 7.8 | 2023-12-12 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2023-35632 | High | 7.8 | 2023-12-12 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability |
CVE-2023-35631 | High | 7.8 | 2023-12-12 | Win32k Elevation of Privilege Vulnerability |
CVE-2023-35630 | High | 8.8 | 2023-12-12 | Internet Connection Sharing (ICS) Remote Code Execution Vulnerability |
CVE-2023-35629 | Medium | 6.8 | 2023-12-12 | Microsoft USBHUB 3.0 Device Driver Remote Code Execution Vulnerability |
CVE-2023-35628 | High | 8.1 | 2023-12-12 | Windows MSHTML Platform Remote Code Execution Vulnerability |
CVE-2023-35625 | Medium | 4.7 | 2023-12-12 | Azure Machine Learning Compute Instance for SDK Users Information Disclosure Vulnerability |
CVE-2023-35624 | High | 7.3 | 2023-12-12 | Azure Connected Machine Agent Elevation of Privilege Vulnerability |
CVE-2023-35622 | High | 7.5 | 2023-12-12 | Windows DNS Spoofing Vulnerability |
CVE-2023-35621 | High | 7.5 | 2023-12-12 | Microsoft Dynamics 365 Finance and Operations Denial of Service Vulnerability |
CVE-2023-35619 | Medium | 5.3 | 2023-12-12 | Microsoft Outlook for Mac Spoofing Vulnerability |
CVE-2023-21740 | High | 7.8 | 2023-12-12 | Windows Media Remote Code Execution Vulnerability |
CVE-2023-20275 | Medium | 4.1 | 2023-12-12 | A vulnerability in the AnyConnect SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could a… |
CVE-2023-4421 | Medium | 6.5 | 2023-12-12 | The NSS code used for checking PKCS#1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks. Both the overall correctness of the padding… |
CVE-2023-48227 | Medium | 4.3 | 2023-12-12 | Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.3.0, Backoffice users with send… |
CVE-2023-38694 | Low | 3.5 | 2023-12-12 | Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.1.0, a user with access to a spe… |
CVE-2023-31048 | Medium | 5.3 | 2023-12-12 | The OPC UA .NET Standard Reference Server before 1.4.371.86. places sensitive information into an error message that may be seen remotely. |
CVE-2023-28604 | Medium | 6.1 | 2023-12-12 | The fluid_components (aka Fluid Components) extension before 3.5.0 for TYPO3 allows XSS via a component argument parameter, for certain {content} use cases tha… |
CVE-2023-28465 | High | 7.5 | 2023-12-12 | The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to certain directories vi… |
CVE-2023-26920 | Medium | 6.5 | 2023-12-12 | fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution. |
CVE-2023-6593 | Critical | 9.8 | 2023-12-12 | Client side permission bypass in Devolutions Remote Desktop Manager 2023.3.4.0 and earlier on iOS allows an attacker that has access to the application to ex… |
CVE-2023-50495 | Medium | 6.5 | 2023-12-12 | NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry(). |
CVE-2023-46456 | Critical | 9.8 | 2023-12-12 | In GL.iNET GL-AR300M routers with firmware 3.216 it is possible to inject arbitrary shell commands through the OpenVPN client file upload functionality. |
CVE-2023-46455 | High | 7.5 | 2023-12-12 | In GL.iNET GL-AR300M routers with firmware v4.3.7 it is possible to write arbitrary files through a path traversal attack in the OpenVPN client file upload fun… |
CVE-2023-46454 | Critical | 9.8 | 2023-12-12 | In GL.iNET GL-AR300M routers with firmware v4.3.7, it is possible to inject arbitrary shell commands through a crafted package name in the package information… |
CVE-2023-6193 | Medium | 5.3 | 2023-12-12 | quiche v. 0.15.0 through 0.19.0 was discovered to be vulnerable to unbounded queuing of path validation messages, which could lead to excessive resource consum… |
CVE-2023-49994 | Medium | 5.5 | 2023-12-12 | Espeak-ng 1.52-dev was discovered to contain a Floating Point Exception via the function PeaksToHarmspect at wavegen.c. |
CVE-2023-49993 | Medium | 5.3 | 2023-12-12 | Espeak-ng 1.52-dev was discovered to contain a Buffer Overflow via the function ReadClause at readclause.c. |
CVE-2023-49992 | Medium | 5.3 | 2023-12-12 | Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Overflow via the function RemoveEnding at dictionary.c. |
CVE-2023-49991 | Medium | 5.3 | 2023-12-12 | Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Underflow via the function CountVowelPosition at synthdata.c. |
CVE-2023-49990 | Medium | 5.3 | 2023-12-12 | Espeak-ng 1.52-dev was discovered to contain a buffer-overflow via the function SetUpPhonemeTable at synthdata.c. |
CVE-2023-49692 | High | 7.2 | 2023-12-12 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.2.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2D… |
CVE-2023-49691 | High | 7.2 | 2023-12-12 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2… |