2023 CVEs (page 90)
Page 90 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-36009 | Medium | 5.5 | 2023-12-12 | Microsoft Word Information Disclosure Vulnerability |
CVE-2023-36006 | High | 8.8 | 2023-12-12 | Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability |
CVE-2023-36005 | High | 7.5 | 2023-12-12 | Windows Telephony Server Elevation of Privilege Vulnerability |
CVE-2023-36004 | High | 7.5 | 2023-12-12 | Windows DPAPI (Data Protection Application Programming Interface) Spoofing Vulnerability |
CVE-2023-36003 | Medium | 6.7 | 2023-12-12 | XAML Diagnostics Elevation of Privilege Vulnerability |
CVE-2023-35644 | High | 7.8 | 2023-12-12 | Windows Sysmain Service Elevation of Privilege Vulnerability |
CVE-2023-35643 | High | 7.5 | 2023-12-12 | DHCP Server Service Information Disclosure Vulnerability |
CVE-2023-35642 | Medium | 6.5 | 2023-12-12 | Internet Connection Sharing (ICS) Denial of Service Vulnerability |
CVE-2023-35641 | High | 8.8 | 2023-12-12 | Internet Connection Sharing (ICS) Remote Code Execution Vulnerability |
CVE-2023-35639 | High | 8.8 | 2023-12-12 | Microsoft ODBC Driver Remote Code Execution Vulnerability |
CVE-2023-35638 | High | 7.5 | 2023-12-12 | DHCP Server Service Denial of Service Vulnerability |
CVE-2023-35636 | Medium | 6.5 | 2023-12-12 | Microsoft Outlook Information Disclosure Vulnerability |
CVE-2023-35635 | Medium | 5.5 | 2023-12-12 | Windows Kernel Denial of Service Vulnerability |
CVE-2023-35634 | High | 8.0 | 2023-12-12 | Windows Bluetooth Driver Remote Code Execution Vulnerability |
CVE-2023-35633 | High | 7.8 | 2023-12-12 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2023-35632 | High | 7.8 | 2023-12-12 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability |
CVE-2023-35631 | High | 7.8 | 2023-12-12 | Win32k Elevation of Privilege Vulnerability |
CVE-2023-35630 | High | 8.8 | 2023-12-12 | Internet Connection Sharing (ICS) Remote Code Execution Vulnerability |
CVE-2023-35629 | Medium | 6.8 | 2023-12-12 | Microsoft USBHUB 3.0 Device Driver Remote Code Execution Vulnerability |
CVE-2023-35628 | High | 8.1 | 2023-12-12 | Windows MSHTML Platform Remote Code Execution Vulnerability |
CVE-2023-35625 | Medium | 4.7 | 2023-12-12 | Azure Machine Learning Compute Instance for SDK Users Information Disclosure Vulnerability |
CVE-2023-35624 | High | 7.3 | 2023-12-12 | Azure Connected Machine Agent Elevation of Privilege Vulnerability |
CVE-2023-35622 | High | 7.5 | 2023-12-12 | Windows DNS Spoofing Vulnerability |
CVE-2023-35621 | High | 7.5 | 2023-12-12 | Microsoft Dynamics 365 Finance and Operations Denial of Service Vulnerability |
CVE-2023-35619 | Medium | 5.3 | 2023-12-12 | Microsoft Outlook for Mac Spoofing Vulnerability |
CVE-2023-21740 | High | 7.8 | 2023-12-12 | Windows Media Remote Code Execution Vulnerability |
CVE-2023-20275 | Medium | 4.1 | 2023-12-12 | A vulnerability in the AnyConnect SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could a… |
CVE-2023-4421 | Medium | 6.5 | 2023-12-12 | The NSS code used for checking PKCS#1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks. Both the overall correctness of the padding… |
CVE-2023-48227 | Medium | 4.3 | 2023-12-12 | Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.3.0, Backoffice users with send… |
CVE-2023-38694 | Low | 3.5 | 2023-12-12 | Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.1.0, a user with access to a spe… |
CVE-2023-31048 | Medium | 5.3 | 2023-12-12 | The OPC UA .NET Standard Reference Server before 1.4.371.86. places sensitive information into an error message that may be seen remotely. |
CVE-2023-28604 | Medium | 6.1 | 2023-12-12 | The fluid_components (aka Fluid Components) extension before 3.5.0 for TYPO3 allows XSS via a component argument parameter, for certain {content} use cases tha… |
CVE-2023-28465 | High | 7.5 | 2023-12-12 | The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to certain directories vi… |
CVE-2023-26920 | Medium | 6.5 | 2023-12-12 | fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution. |
CVE-2023-6593 | Critical | 9.8 | 2023-12-12 | Client side permission bypass in Devolutions Remote Desktop Manager 2023.3.4.0 and earlier on iOS allows an attacker that has access to the application to ex… |
CVE-2023-50495 | Medium | 6.5 | 2023-12-12 | NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry(). |
CVE-2023-46456 | Critical | 9.8 | 2023-12-12 | In GL.iNET GL-AR300M routers with firmware 3.216 it is possible to inject arbitrary shell commands through the OpenVPN client file upload functionality. |
CVE-2023-46455 | High | 7.5 | 2023-12-12 | In GL.iNET GL-AR300M routers with firmware v4.3.7 it is possible to write arbitrary files through a path traversal attack in the OpenVPN client file upload fun… |
CVE-2023-46454 | Critical | 9.8 | 2023-12-12 | In GL.iNET GL-AR300M routers with firmware v4.3.7, it is possible to inject arbitrary shell commands through a crafted package name in the package information… |
CVE-2023-6193 | Medium | 5.3 | 2023-12-12 | quiche v. 0.15.0 through 0.19.0 was discovered to be vulnerable to unbounded queuing of path validation messages, which could lead to excessive resource consum… |
CVE-2023-49994 | Medium | 5.5 | 2023-12-12 | Espeak-ng 1.52-dev was discovered to contain a Floating Point Exception via the function PeaksToHarmspect at wavegen.c. |
CVE-2023-49993 | Medium | 5.3 | 2023-12-12 | Espeak-ng 1.52-dev was discovered to contain a Buffer Overflow via the function ReadClause at readclause.c. |
CVE-2023-49992 | Medium | 5.3 | 2023-12-12 | Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Overflow via the function RemoveEnding at dictionary.c. |
CVE-2023-49991 | Medium | 5.3 | 2023-12-12 | Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Underflow via the function CountVowelPosition at synthdata.c. |
CVE-2023-49990 | Medium | 5.3 | 2023-12-12 | Espeak-ng 1.52-dev was discovered to contain a buffer-overflow via the function SetUpPhonemeTable at synthdata.c. |
CVE-2023-49692 | High | 7.2 | 2023-12-12 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.2.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2D… |
CVE-2023-49691 | High | 7.2 | 2023-12-12 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2… |
CVE-2023-48431 | Medium | 6.8 | 2023-12-12 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). Affected software does not correctly validate the response received by an… |
CVE-2023-48430 | Low | 2.7 | 2023-12-12 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). The REST API of affected devices does not check the length of parameters i… |
CVE-2023-48429 | Low | 2.7 | 2023-12-12 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). The Web UI of affected devices does not check the length of parameters in… |
CVE-2023-48428 | High | 7.2 | 2023-12-12 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). The radius configuration mechanism of affected products does not correctly… |
CVE-2023-48427 | High | 8.1 | 2023-12-12 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). Affected products do not properly validate the certificate of the configur… |
CVE-2023-46285 | High | 7.5 | 2023-12-12 | A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All vers… |
CVE-2023-46284 | High | 7.5 | 2023-12-12 | A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All vers… |
CVE-2023-46283 | High | 7.5 | 2023-12-12 | A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All vers… |
CVE-2023-46282 | High | 7.1 | 2023-12-12 | A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All vers… |
CVE-2023-46281 | High | 7.1 | 2023-12-12 | A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All vers… |
CVE-2023-46156 | High | 7.5 | 2023-12-12 | Affected devices improperly handle specially crafted packets sent to port 102/tcp. This could allow an attacker to create a denial of service condition. A res… |
CVE-2023-38380 | High | 7.5 | 2023-12-12 | A vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP 1243-1 (incl. SIPLUS variants) (All ve… |
CVE-2023-6727 | Low | 3.1 | 2023-12-12 | Mattermost fails to perform correct authorization checks when creating a playbook action, allowing users without access to the playbook to create playbook acti… |
CVE-2023-4958 | Medium | 6.1 | 2023-12-12 | In Red Hat Advanced Cluster Security (RHACS), it was found that some security related HTTP headers were missing, allowing an attacker to exploit this with a cl… |
CVE-2023-4932 | Medium | 6.3 | 2023-12-12 | SAS application is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in the `_program` parameter of the the `/SASStoredProcess/do`… |
CVE-2023-49713 | High | 7.5 | 2023-12-12 | Denial-of-service (DoS) vulnerability exists in NetBIOS service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specially crafted packets to… |
CVE-2023-49143 | High | 7.5 | 2023-12-12 | Denial-of-service (DoS) vulnerability exists in rfe service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specially crafted packets to spec… |
CVE-2023-49140 | High | 7.5 | 2023-12-12 | Denial-of-service (DoS) vulnerability exists in commplex-link service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specially crafted packe… |
CVE-2023-41963 | High | 7.5 | 2023-12-12 | Denial-of-service (DoS) vulnerability exists in FTP service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specially crafted packets to spec… |
CVE-2023-6547 | Low | 3.7 | 2023-12-12 | Mattermost fails to validate team membership when a user attempts to access a playbook, allowing a user with permissions to a playbook but no permissions to th… |
CVE-2023-49874 | Medium | 4.3 | 2023-12-12 | Mattermost fails to check whether a user is a guest when updating the tasks of a private playbook run allowing a guest to update the tasks of a private playboo… |
CVE-2023-49809 | Medium | 4.3 | 2023-12-12 | Mattermost fails to handle a null request body in the /add endpoint, allowing a simple member to send a request with null request body to that endpoint and mak… |
CVE-2023-49695 | Medium | 6.8 | 2023-12-12 | OS command injection vulnerability in WRC-X3000GSN v1.0.2, WRC-X3000GS v1.0.24 and earlier, and WRC-X3000GSA v1.0.24 and earlier allows a network-adjacent atta… |
CVE-2023-49607 | Medium | 4.3 | 2023-12-12 | Mattermost fails to validate the type of the "reminder" body request parameter allowing an attacker to crash the Playbook Plugin when updating the status dialo… |
CVE-2023-49563 | Medium | 6.1 | 2023-12-12 | Cross Site Scripting (XSS) in Voltronic Power SNMP Web Pro v.1.1 allows an attacker to execute arbitrary code via a crafted script within a request to the webs… |
CVE-2023-48677 | High | 7.8 | 2023-12-12 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40… |
CVE-2023-46701 | Medium | 6.5 | 2023-12-12 | Mattermost fails to perform authorization checks in the /plugins/playbooks/api/v0/runs/add-to-timeline-dialog endpoint of the Playbooks plugin allowing an att… |
CVE-2023-45847 | Medium | 4.3 | 2023-12-12 | Mattermost fails to to check the length when setting the title in a run checklist in Playbooks, allowing an attacker to send a specially crafted request and cr… |
CVE-2023-45316 | High | 7.3 | 2023-12-12 | Mattermost fails to validate if a relative path is passed in /plugins/playbooks/api/v0/telemetry/run/<telem_run_id> as a telemetry run ID, allowing an attacker… |
CVE-2023-41623 | High | 7.2 | 2023-12-12 | Emlog version pro2.1.14 was discovered to contain a SQL injection vulnerability via the uid parameter at /admin/media.php. |
CVE-2023-48642 | Medium | 5.4 | 2023-12-12 | Archer Platform 6.x before 6.13 P2 (6.13.0.2) contains an authenticated HTML content injection vulnerability. A remote authenticated malicious Archer user coul… |
CVE-2023-48641 | High | 7.5 | 2023-12-12 | Archer Platform 6.x before 6.14 P1 HF2 (6.14.0.1.2) contains an insecure direct object reference vulnerability. An authenticated malicious user in a multi-inst… |
CVE-2023-41120 | Medium | 6.5 | 2023-12-12 | An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15… |
CVE-2023-41119 | High | 8.8 | 2023-12-12 | An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15… |
CVE-2023-41118 | High | 8.8 | 2023-12-12 | An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15… |
CVE-2023-41117 | High | 8.8 | 2023-12-12 | An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15… |
CVE-2023-41116 | Medium | 4.3 | 2023-12-12 | An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15… |
CVE-2023-41115 | Medium | 6.5 | 2023-12-12 | An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15… |
CVE-2023-41114 | Medium | 6.5 | 2023-12-12 | An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15… |
CVE-2023-41113 | Medium | 4.3 | 2023-12-12 | An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15… |
CVE-2023-6709 | High | 8.8 | 2023-12-12 | Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2. |
CVE-2023-50424 | Critical | 9.1 | 2023-12-12 | SAP BTP Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go) - versions < 0.17.0, allow under certain conditions an escalat… |
CVE-2023-6542 | High | 7.1 | 2023-12-12 | Due to lack of proper authorization checks in Emarsys SDK for Android, an attacker can call a particular activity and can forward himself web pages and/or deep… |
CVE-2023-5536 | Medium | 5.0 | 2023-12-12 | A feature in LXD (LP#1829071), affects the default configuration of Ubuntu Server which allows privileged users in the lxd group to escalate their privilege to… |
CVE-2023-50423 | Critical | 9.1 | 2023-12-12 | SAP BTP Security Services Integration Library ([Python] sap-xssec) - versions < 4.1.0, allow under certain conditions an escalation of privileges. On successfu… |
CVE-2023-50422 | Critical | 9.1 | 2023-12-12 | SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) - versions below 2.17.0 and versions from 3.0.0 to before 3… |
CVE-2023-49587 | Medium | 6.4 | 2023-12-12 | SAP Solution Manager - version 720, allows an authorized attacker to execute certain deprecated function modules which can read or modify data of same or other… |
CVE-2023-49584 | Medium | 4.3 | 2023-12-12 | SAP Fiori launchpad - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, UI_700 200, SAP_BASIS 793, allows an attacker to use HTT… |
CVE-2023-49583 | Critical | 9.1 | 2023-12-12 | SAP BTP Security Services Integration Library ([Node.js] @sap/xssec - versions < 3.6.0, allow under certain conditions an escalation of privileges. On successf… |
CVE-2023-49581 | Medium | 4.1 | 2023-12-12 | SAP GUI for Windows and SAP GUI for Java allow an unauthenticated attacker to access information which would otherwise be restricted and confidential. In addit… |
CVE-2023-49580 | High | 7.3 | 2023-12-12 | SAP GUI for Windows and SAP GUI for Java - versions SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, allow an unauthenticated attacker to access inf… |
CVE-2023-49578 | Low | 3.5 | 2023-12-12 | SAP Cloud Connector - version 2.0, allows an authenticated user with low privilege to perform Denial of service attack from adjacent UI by sending a malicious… |
CVE-2023-49577 | Medium | 6.1 | 2023-12-12 | The SAP HCM (SMART PAYE solution) - versions S4HCMCIE 100, SAP_HRCIE 600, SAP_HRCIE 604, SAP_HRCIE 608, does not sufficiently encode user-controlled inputs, re… |