2023 CVEs (page 91)
Page 91 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-48431 | Medium | 6.8 | 2023-12-12 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). Affected software does not correctly validate the response received by an… |
CVE-2023-48430 | Low | 2.7 | 2023-12-12 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). The REST API of affected devices does not check the length of parameters i… |
CVE-2023-48429 | Low | 2.7 | 2023-12-12 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). The Web UI of affected devices does not check the length of parameters in… |
CVE-2023-48428 | High | 7.2 | 2023-12-12 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). The radius configuration mechanism of affected products does not correctly… |
CVE-2023-48427 | High | 8.1 | 2023-12-12 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). Affected products do not properly validate the certificate of the configur… |
CVE-2023-46285 | High | 7.5 | 2023-12-12 | A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All vers… |
CVE-2023-46284 | High | 7.5 | 2023-12-12 | A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All vers… |
CVE-2023-46283 | High | 7.5 | 2023-12-12 | A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All vers… |
CVE-2023-46282 | High | 7.1 | 2023-12-12 | A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All vers… |
CVE-2023-46281 | High | 7.1 | 2023-12-12 | A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All vers… |
CVE-2023-46156 | High | 7.5 | 2023-12-12 | Affected devices improperly handle specially crafted packets sent to port 102/tcp. This could allow an attacker to create a denial of service condition. A res… |
CVE-2023-38380 | High | 7.5 | 2023-12-12 | A vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP 1243-1 (incl. SIPLUS variants) (All ve… |
CVE-2023-6727 | Low | 3.1 | 2023-12-12 | Mattermost fails to perform correct authorization checks when creating a playbook action, allowing users without access to the playbook to create playbook acti… |
CVE-2023-4958 | Medium | 6.1 | 2023-12-12 | In Red Hat Advanced Cluster Security (RHACS), it was found that some security related HTTP headers were missing, allowing an attacker to exploit this with a cl… |
CVE-2023-4932 | Medium | 6.3 | 2023-12-12 | SAS application is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in the `_program` parameter of the the `/SASStoredProcess/do`… |
CVE-2023-49713 | High | 7.5 | 2023-12-12 | Denial-of-service (DoS) vulnerability exists in NetBIOS service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specially crafted packets to… |
CVE-2023-49143 | High | 7.5 | 2023-12-12 | Denial-of-service (DoS) vulnerability exists in rfe service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specially crafted packets to spec… |
CVE-2023-49140 | High | 7.5 | 2023-12-12 | Denial-of-service (DoS) vulnerability exists in commplex-link service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specially crafted packe… |
CVE-2023-41963 | High | 7.5 | 2023-12-12 | Denial-of-service (DoS) vulnerability exists in FTP service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specially crafted packets to spec… |
CVE-2023-6547 | Low | 3.7 | 2023-12-12 | Mattermost fails to validate team membership when a user attempts to access a playbook, allowing a user with permissions to a playbook but no permissions to th… |
CVE-2023-49874 | Medium | 4.3 | 2023-12-12 | Mattermost fails to check whether a user is a guest when updating the tasks of a private playbook run allowing a guest to update the tasks of a private playboo… |
CVE-2023-49809 | Medium | 4.3 | 2023-12-12 | Mattermost fails to handle a null request body in the /add endpoint, allowing a simple member to send a request with null request body to that endpoint and mak… |
CVE-2023-49695 | Medium | 6.8 | 2023-12-12 | OS command injection vulnerability in WRC-X3000GSN v1.0.2, WRC-X3000GS v1.0.24 and earlier, and WRC-X3000GSA v1.0.24 and earlier allows a network-adjacent atta… |
CVE-2023-49607 | Medium | 4.3 | 2023-12-12 | Mattermost fails to validate the type of the "reminder" body request parameter allowing an attacker to crash the Playbook Plugin when updating the status dialo… |
CVE-2023-49563 | Medium | 6.1 | 2023-12-12 | Cross Site Scripting (XSS) in Voltronic Power SNMP Web Pro v.1.1 allows an attacker to execute arbitrary code via a crafted script within a request to the webs… |
CVE-2023-48677 | High | 7.8 | 2023-12-12 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40… |
CVE-2023-46701 | Medium | 6.5 | 2023-12-12 | Mattermost fails to perform authorization checks in the /plugins/playbooks/api/v0/runs/add-to-timeline-dialog endpoint of the Playbooks plugin allowing an att… |
CVE-2023-45847 | Medium | 4.3 | 2023-12-12 | Mattermost fails to to check the length when setting the title in a run checklist in Playbooks, allowing an attacker to send a specially crafted request and cr… |
CVE-2023-45316 | High | 7.3 | 2023-12-12 | Mattermost fails to validate if a relative path is passed in /plugins/playbooks/api/v0/telemetry/run/<telem_run_id> as a telemetry run ID, allowing an attacker… |
CVE-2023-41623 | High | 7.2 | 2023-12-12 | Emlog version pro2.1.14 was discovered to contain a SQL injection vulnerability via the uid parameter at /admin/media.php. |
CVE-2023-48642 | Medium | 5.4 | 2023-12-12 | Archer Platform 6.x before 6.13 P2 (6.13.0.2) contains an authenticated HTML content injection vulnerability. A remote authenticated malicious Archer user coul… |
CVE-2023-48641 | High | 7.5 | 2023-12-12 | Archer Platform 6.x before 6.14 P1 HF2 (6.14.0.1.2) contains an insecure direct object reference vulnerability. An authenticated malicious user in a multi-inst… |
CVE-2023-41120 | Medium | 6.5 | 2023-12-12 | An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15… |
CVE-2023-41119 | High | 8.8 | 2023-12-12 | An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15… |
CVE-2023-41118 | High | 8.8 | 2023-12-12 | An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15… |
CVE-2023-41117 | High | 8.8 | 2023-12-12 | An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15… |
CVE-2023-41116 | Medium | 4.3 | 2023-12-12 | An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15… |
CVE-2023-41115 | Medium | 6.5 | 2023-12-12 | An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15… |
CVE-2023-41114 | Medium | 6.5 | 2023-12-12 | An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15… |
CVE-2023-41113 | Medium | 4.3 | 2023-12-12 | An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15… |
CVE-2023-6709 | High | 8.8 | 2023-12-12 | Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2. |
CVE-2023-50424 | Critical | 9.1 | 2023-12-12 | SAP BTP Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go) - versions < 0.17.0, allow under certain conditions an escalat… |
CVE-2023-6542 | High | 7.1 | 2023-12-12 | Due to lack of proper authorization checks in Emarsys SDK for Android, an attacker can call a particular activity and can forward himself web pages and/or deep… |
CVE-2023-5536 | Medium | 5.0 | 2023-12-12 | A feature in LXD (LP#1829071), affects the default configuration of Ubuntu Server which allows privileged users in the lxd group to escalate their privilege to… |
CVE-2023-50423 | Critical | 9.1 | 2023-12-12 | SAP BTP Security Services Integration Library ([Python] sap-xssec) - versions < 4.1.0, allow under certain conditions an escalation of privileges. On successfu… |
CVE-2023-50422 | Critical | 9.1 | 2023-12-12 | SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) - versions below 2.17.0 and versions from 3.0.0 to before 3… |
CVE-2023-49587 | Medium | 6.4 | 2023-12-12 | SAP Solution Manager - version 720, allows an authorized attacker to execute certain deprecated function modules which can read or modify data of same or other… |
CVE-2023-49584 | Medium | 4.3 | 2023-12-12 | SAP Fiori launchpad - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, UI_700 200, SAP_BASIS 793, allows an attacker to use HTT… |
CVE-2023-49583 | Critical | 9.1 | 2023-12-12 | SAP BTP Security Services Integration Library ([Node.js] @sap/xssec - versions < 3.6.0, allow under certain conditions an escalation of privileges. On successf… |
CVE-2023-49581 | Medium | 4.1 | 2023-12-12 | SAP GUI for Windows and SAP GUI for Java allow an unauthenticated attacker to access information which would otherwise be restricted and confidential. In addit… |
CVE-2023-49580 | High | 7.3 | 2023-12-12 | SAP GUI for Windows and SAP GUI for Java - versions SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, allow an unauthenticated attacker to access inf… |
CVE-2023-49578 | Low | 3.5 | 2023-12-12 | SAP Cloud Connector - version 2.0, allows an authenticated user with low privilege to perform Denial of service attack from adjacent UI by sending a malicious… |
CVE-2023-49577 | Medium | 6.1 | 2023-12-12 | The SAP HCM (SMART PAYE solution) - versions S4HCMCIE 100, SAP_HRCIE 600, SAP_HRCIE 604, SAP_HRCIE 608, does not sufficiently encode user-controlled inputs, re… |
CVE-2023-46219 | Medium | 5.3 | 2023-12-12 | When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS… |
CVE-2023-49058 | Low | 3.5 | 2023-12-12 | SAP Master Data Governance File Upload application allows an attacker to exploit insufficient validation of path information provided by users, thus characters… |
CVE-2023-42932 | Medium | 5.5 | 2023-12-12 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.2, macOS Ventura 13.6.3, macOS Monterey 12.7.2. An app may be able to… |
CVE-2023-42926 | High | 7.8 | 2023-12-12 | Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted fil… |
CVE-2023-42924 | Medium | 5.5 | 2023-12-12 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.2, macOS Ventura 13.6.3. An app may be able to access sensitive user d… |
CVE-2023-42923 | Medium | 5.3 | 2023-12-12 | This issue was addressed through improved state management. This issue is fixed in iOS 17.2 and iPadOS 17.2. Private Browsing tabs may be accessed without auth… |
CVE-2023-42922 | Medium | 5.5 | 2023-12-12 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sonoma 14.2, iOS 17.2 and iPadOS 17.2, macOS Ventura 13… |
CVE-2023-42919 | Medium | 5.5 | 2023-12-12 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.2, iOS 17.2 and iPadOS 17.2, watchOS… |
CVE-2023-42914 | Medium | 6.3 | 2023-12-12 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.2, iOS 17.2 and iPadOS 17.2, watchOS 10.2, macOS Ventura 13.6.3… |
CVE-2023-42912 | High | 7.8 | 2023-12-12 | Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted fil… |
CVE-2023-42911 | High | 7.8 | 2023-12-12 | Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted fil… |
CVE-2023-42910 | High | 8.8 | 2023-12-12 | Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted fil… |
CVE-2023-42909 | High | 7.8 | 2023-12-12 | Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted fil… |
CVE-2023-42908 | High | 7.8 | 2023-12-12 | Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted fil… |
CVE-2023-42907 | High | 7.8 | 2023-12-12 | Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted fil… |
CVE-2023-42906 | High | 7.8 | 2023-12-12 | Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted fil… |
CVE-2023-42905 | High | 7.8 | 2023-12-12 | Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted fil… |
CVE-2023-42904 | High | 7.8 | 2023-12-12 | Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted fil… |
CVE-2023-42903 | High | 7.8 | 2023-12-12 | Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted fil… |
CVE-2023-42902 | High | 7.8 | 2023-12-12 | Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted fil… |
CVE-2023-42901 | High | 7.8 | 2023-12-12 | Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted fil… |
CVE-2023-42900 | Medium | 5.5 | 2023-12-12 | The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.2. An app may be able to access user-sensitive data. |
CVE-2023-42899 | High | 7.8 | 2023-12-12 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.2, iOS 17.2 and iPadOS 17.2, watchOS 10.2, macOS Ventura 13.6.3… |
CVE-2023-42898 | Medium | 5.5 | 2023-12-12 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.2, watchOS 10.2, iOS 17.2 and iPadOS 17.2, tvOS 17.2. Processing… |
CVE-2023-42897 | Medium | 4.6 | 2023-12-12 | The issue was addressed with improved checks. This issue is fixed in iOS 17.2 and iPadOS 17.2. An attacker with physical access may be able to use Siri to acce… |
CVE-2023-42894 | Medium | 5.5 | 2023-12-12 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sonoma 14.2, macOS Ventura 13.6.3, macOS Monterey 12.7… |
CVE-2023-42891 | Medium | 5.5 | 2023-12-12 | An authentication issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.2, macOS Ventura 13.6.3, macOS Monterey 12.7.2. An… |
CVE-2023-42890 | High | 8.8 | 2023-12-12 | The issue was addressed with improved memory handling. This issue is fixed in Safari 17.2, macOS Sonoma 14.2, watchOS 10.2, iOS 17.2 and iPadOS 17.2, tvOS 17.2… |
CVE-2023-42886 | High | 7.8 | 2023-12-12 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sonoma 14.2, macOS Ventura 13.6.3, macOS Monterey 12.7.2. A use… |
CVE-2023-42884 | Medium | 5.5 | 2023-12-12 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sonoma 14.2, iOS 17.2 and iPadOS 17.2, macOS Ventura 13… |
CVE-2023-42883 | Medium | 5.5 | 2023-12-12 | The issue was addressed with improved memory handling. This issue is fixed in Safari 17.2, macOS Sonoma 14.2, iOS 17.2 and iPadOS 17.2, watchOS 10.2, tvOS 17.2… |
CVE-2023-42882 | High | 7.8 | 2023-12-12 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.2. Processing an image may lead to arbitrary code execution. |
CVE-2023-42874 | Low | 2.4 | 2023-12-12 | This issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.2. Secure text fields may be displayed via the Accessibility Ke… |
CVE-2023-42481 | High | 8.1 | 2023-12-12 | In SAP Commerce Cloud - versions HY_COM 1905, HY_COM 2005, HY_COM2105, HY_COM 2011, HY_COM 2205, COM_CLOUD 2211, a locked B2B user can misuse the forgotten pas… |
CVE-2023-42479 | Medium | 6.1 | 2023-12-12 | An unauthenticated attacker can embed a hidden access to a Biller Direct URL in a frame which, when loaded by the user, will submit a cross-site scripting requ… |
CVE-2023-42478 | High | 7.5 | 2023-12-12 | SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to upload agnostic documents in the system which when open… |
CVE-2023-42476 | Medium | 6.8 | 2023-12-12 | SAP Business Objects Web Intelligence - version 420, allows an authenticated attacker to inject JavaScript code into Web Intelligence documents which is then… |
CVE-2023-40446 | High | 7.8 | 2023-12-12 | The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.7.1, iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1 and iPadOS 17.1. Pr… |
CVE-2023-36654 | Medium | 6.5 | 2023-12-12 | Directory traversal in the log-download REST API endpoint in ProLion CryptoSpike 3.0.15P2 allows remote authenticated attackers to download host server SSH pri… |
CVE-2023-36652 | Medium | 4.3 | 2023-12-12 | A SQL Injection in the users searching REST API endpoint in ProLion CryptoSpike 3.0.15P2 allows remote authenticated attackers to read database data via SQL co… |
CVE-2023-36651 | High | 7.2 | 2023-12-12 | Hidden and hard-coded credentials in ProLion CryptoSpike 3.0.15P2 allow remote attackers to login to web management as super-admin and consume the most privile… |
CVE-2023-36650 | High | 7.2 | 2023-12-12 | A missing integrity check in the update system in ProLion CryptoSpike 3.0.15P2 allows attackers to execute OS commands as the root Linux user on the host syste… |
CVE-2023-36649 | Critical | 9.1 | 2023-12-12 | Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows remote attackers to impersonate other use… |
CVE-2023-36648 | High | 8.2 | 2023-12-12 | Missing authentication in the internal data streaming system in ProLion CryptoSpike 3.0.15P2 allows remote unauthenticated users to read potentially sensitive… |
CVE-2023-36647 | High | 7.5 | 2023-12-12 | A hard-coded cryptographic private key used to sign JWT authentication tokens in ProLion CryptoSpike 3.0.15P2 allows remote attackers to impersonate arbitrary… |
CVE-2023-36646 | High | 8.8 | 2023-12-12 | Incorrect user role checking in multiple REST API endpoints in ProLion CryptoSpike 3.0.15P2 allows a remote attacker with low privileges to execute privileged… |
CVE-2023-50245 | Critical | 9.8 | 2023-12-11 | OpenEXR-viewer is a viewer for OpenEXR files with detailed metadata probing. Versions prior to 0.6.1 have a memory overflow vulnerability. This issue is fixed… |