2023 CVEs (page 91)
Page 91 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-46219 | Medium | 5.3 | 2023-12-12 | When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS… |
CVE-2023-49058 | Low | 3.5 | 2023-12-12 | SAP Master Data Governance File Upload application allows an attacker to exploit insufficient validation of path information provided by users, thus characters… |
CVE-2023-42932 | Medium | 5.5 | 2023-12-12 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.2, macOS Ventura 13.6.3, macOS Monterey 12.7.2. An app may be able to… |
CVE-2023-42926 | High | 7.8 | 2023-12-12 | Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted fil… |
CVE-2023-42924 | Medium | 5.5 | 2023-12-12 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.2, macOS Ventura 13.6.3. An app may be able to access sensitive user d… |
CVE-2023-42923 | Medium | 5.3 | 2023-12-12 | This issue was addressed through improved state management. This issue is fixed in iOS 17.2 and iPadOS 17.2. Private Browsing tabs may be accessed without auth… |
CVE-2023-42922 | Medium | 5.5 | 2023-12-12 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sonoma 14.2, iOS 17.2 and iPadOS 17.2, macOS Ventura 13… |
CVE-2023-42919 | Medium | 5.5 | 2023-12-12 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.2, iOS 17.2 and iPadOS 17.2, watchOS… |
CVE-2023-42914 | Medium | 6.3 | 2023-12-12 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.2, iOS 17.2 and iPadOS 17.2, watchOS 10.2, macOS Ventura 13.6.3… |
CVE-2023-42912 | High | 7.8 | 2023-12-12 | Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted fil… |
CVE-2023-42911 | High | 7.8 | 2023-12-12 | Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted fil… |
CVE-2023-42910 | High | 8.8 | 2023-12-12 | Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted fil… |
CVE-2023-42909 | High | 7.8 | 2023-12-12 | Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted fil… |
CVE-2023-42908 | High | 7.8 | 2023-12-12 | Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted fil… |
CVE-2023-42907 | High | 7.8 | 2023-12-12 | Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted fil… |
CVE-2023-42906 | High | 7.8 | 2023-12-12 | Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted fil… |
CVE-2023-42905 | High | 7.8 | 2023-12-12 | Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted fil… |
CVE-2023-42904 | High | 7.8 | 2023-12-12 | Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted fil… |
CVE-2023-42903 | High | 7.8 | 2023-12-12 | Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted fil… |
CVE-2023-42902 | High | 7.8 | 2023-12-12 | Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted fil… |
CVE-2023-42901 | High | 7.8 | 2023-12-12 | Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted fil… |
CVE-2023-42900 | Medium | 5.5 | 2023-12-12 | The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.2. An app may be able to access user-sensitive data. |
CVE-2023-42899 | High | 7.8 | 2023-12-12 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.2, iOS 17.2 and iPadOS 17.2, watchOS 10.2, macOS Ventura 13.6.3… |
CVE-2023-42898 | Medium | 5.5 | 2023-12-12 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.2, watchOS 10.2, iOS 17.2 and iPadOS 17.2, tvOS 17.2. Processing… |
CVE-2023-42897 | Medium | 4.6 | 2023-12-12 | The issue was addressed with improved checks. This issue is fixed in iOS 17.2 and iPadOS 17.2. An attacker with physical access may be able to use Siri to acce… |
CVE-2023-42894 | Medium | 5.5 | 2023-12-12 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sonoma 14.2, macOS Ventura 13.6.3, macOS Monterey 12.7… |
CVE-2023-42891 | Medium | 5.5 | 2023-12-12 | An authentication issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.2, macOS Ventura 13.6.3, macOS Monterey 12.7.2. An… |
CVE-2023-42890 | High | 8.8 | 2023-12-12 | The issue was addressed with improved memory handling. This issue is fixed in Safari 17.2, macOS Sonoma 14.2, watchOS 10.2, iOS 17.2 and iPadOS 17.2, tvOS 17.2… |
CVE-2023-42886 | High | 7.8 | 2023-12-12 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sonoma 14.2, macOS Ventura 13.6.3, macOS Monterey 12.7.2. A use… |
CVE-2023-42884 | Medium | 5.5 | 2023-12-12 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sonoma 14.2, iOS 17.2 and iPadOS 17.2, macOS Ventura 13… |
CVE-2023-42883 | Medium | 5.5 | 2023-12-12 | The issue was addressed with improved memory handling. This issue is fixed in Safari 17.2, macOS Sonoma 14.2, iOS 17.2 and iPadOS 17.2, watchOS 10.2, tvOS 17.2… |
CVE-2023-42882 | High | 7.8 | 2023-12-12 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.2. Processing an image may lead to arbitrary code execution. |
CVE-2023-42874 | Low | 2.4 | 2023-12-12 | This issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.2. Secure text fields may be displayed via the Accessibility Ke… |
CVE-2023-42481 | High | 8.1 | 2023-12-12 | In SAP Commerce Cloud - versions HY_COM 1905, HY_COM 2005, HY_COM2105, HY_COM 2011, HY_COM 2205, COM_CLOUD 2211, a locked B2B user can misuse the forgotten pas… |
CVE-2023-42479 | Medium | 6.1 | 2023-12-12 | An unauthenticated attacker can embed a hidden access to a Biller Direct URL in a frame which, when loaded by the user, will submit a cross-site scripting requ… |
CVE-2023-42478 | High | 7.5 | 2023-12-12 | SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to upload agnostic documents in the system which when open… |
CVE-2023-42476 | Medium | 6.8 | 2023-12-12 | SAP Business Objects Web Intelligence - version 420, allows an authenticated attacker to inject JavaScript code into Web Intelligence documents which is then… |
CVE-2023-40446 | High | 7.8 | 2023-12-12 | The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.7.1, iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1 and iPadOS 17.1. Pr… |
CVE-2023-36654 | Medium | 6.5 | 2023-12-12 | Directory traversal in the log-download REST API endpoint in ProLion CryptoSpike 3.0.15P2 allows remote authenticated attackers to download host server SSH pri… |
CVE-2023-36652 | Medium | 4.3 | 2023-12-12 | A SQL Injection in the users searching REST API endpoint in ProLion CryptoSpike 3.0.15P2 allows remote authenticated attackers to read database data via SQL co… |
CVE-2023-36651 | High | 7.2 | 2023-12-12 | Hidden and hard-coded credentials in ProLion CryptoSpike 3.0.15P2 allow remote attackers to login to web management as super-admin and consume the most privile… |
CVE-2023-36650 | High | 7.2 | 2023-12-12 | A missing integrity check in the update system in ProLion CryptoSpike 3.0.15P2 allows attackers to execute OS commands as the root Linux user on the host syste… |
CVE-2023-36649 | Critical | 9.1 | 2023-12-12 | Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows remote attackers to impersonate other use… |
CVE-2023-36648 | High | 8.2 | 2023-12-12 | Missing authentication in the internal data streaming system in ProLion CryptoSpike 3.0.15P2 allows remote unauthenticated users to read potentially sensitive… |
CVE-2023-36647 | High | 7.5 | 2023-12-12 | A hard-coded cryptographic private key used to sign JWT authentication tokens in ProLion CryptoSpike 3.0.15P2 allows remote attackers to impersonate arbitrary… |
CVE-2023-36646 | High | 8.8 | 2023-12-12 | Incorrect user role checking in multiple REST API endpoints in ProLion CryptoSpike 3.0.15P2 allows a remote attacker with low privileges to execute privileged… |
CVE-2023-50245 | Critical | 9.8 | 2023-12-11 | OpenEXR-viewer is a viewer for OpenEXR files with detailed metadata probing. Versions prior to 0.6.1 have a memory overflow vulnerability. This issue is fixed… |
CVE-2023-49805 | Medium | 6.0 | 2023-12-11 | Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, the application uses WebSocket (with Socket.io), but it does not verify tha… |
CVE-2023-49804 | Medium | 6.7 | 2023-12-11 | Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, when a user changes their login password in Uptime Kuma, a previously logge… |
CVE-2023-49803 | High | 8.6 | 2023-12-11 | @koa/cors npm provides Cross-Origin Resource Sharing (CORS) for koa, a web framework for Node.js. Prior to version 5.0.0, the middleware operates in a way that… |
CVE-2023-49802 | Medium | 6.7 | 2023-12-11 | The LinkedCustomFields plugin for MantisBT allows users to link values between two custom fields, creating linked drop-downs. Prior to version 2.0.1, cross-sit… |
CVE-2023-45292 | Medium | 5.3 | 2023-12-11 | When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a non-existent id, the… |
CVE-2023-49796 | Medium | 5.3 | 2023-12-11 | MindsDB connects artificial intelligence models to real time data. Versions prior to 23.11.4.1 contain a limited file write vulnerability in `file.py` Users sh… |
CVE-2023-49494 | Medium | 6.1 | 2023-12-11 | DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component select_media_post_wangEditor.php. |
CVE-2023-49490 | Medium | 6.1 | 2023-12-11 | XunRuiCMS v4.5.5 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /admin.php. |
CVE-2023-49488 | Medium | 6.1 | 2023-12-11 | A cross-site scripting (XSS) vulnerability in Openfiler ESA v2.99.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload i… |
CVE-2023-6035 | High | 8.8 | 2023-12-11 | The EazyDocs WordPress plugin before 2.3.4 does not properly sanitize and escape "data" parameter before using it in an SQL statement via an AJAX action, which… |
CVE-2023-5955 | Medium | 4.8 | 2023-12-11 | The Contact Form Email WordPress plugin before 1.3.44 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2023-5940 | Medium | 4.8 | 2023-12-11 | The WP Not Login Hide (WPNLH) WordPress plugin through 1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2023-5907 | Medium | 6.5 | 2023-12-11 | The File Manager WordPress plugin before 6.3 does not restrict the file managers root directory, allowing an administrator to set a root outside of the WordPre… |
CVE-2023-5757 | Medium | 4.8 | 2023-12-11 | The WP Crowdfunding WordPress plugin before 2.1.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2023-5750 | Medium | 6.1 | 2023-12-11 | The EmbedPress WordPress plugin before 3.9.2 does not sanitise and escape a parameter before outputting it back in the page containing a specific content, lead… |
CVE-2023-5749 | Medium | 6.1 | 2023-12-11 | The EmbedPress WordPress plugin before 3.9.2 does not sanitise and escape user input before outputting it back in the page, leading to a Reflected Cross-Site S… |
CVE-2023-6679 | Medium | 5.5 | 2023-12-11 | A null pointer dereference vulnerability was found in dpll_pin_parent_pin_set() in drivers/dpll/dpll_netlink.c in the Digital Phase Locked Loop (DPLL) subsyste… |
CVE-2023-49795 | Medium | 6.5 | 2023-12-11 | MindsDB connects artificial intelligence models to real time data. Versions prior to 23.11.4.1 contain a server-side request forgery vulnerability in `file.py`… |
CVE-2023-48715 | Medium | 5.4 | 2023-12-11 | Tuleap is an open source suite to improve management of software developments and collaboration. Prior to version 15.2.99.103 of Tuleap Community Edition and p… |
CVE-2023-6538 | High | 7.6 | 2023-12-11 | SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation. Authenticated users in Storage, Server or co… |
CVE-2023-6671 | Medium | 6.3 | 2023-12-11 | A vulnerability has been discovered on OJS, that consists in a CSRF (Cross-Site Request Forgery) attack that forces an end user to execute unwanted actions on… |
CVE-2023-6194 | Low | 2.8 | 2023-12-11 | In Eclipse Memory Analyzer versions 0.7 to 1.14.0, report definition XML files are not filtered to prohibit document type definition (DTD) references to extern… |
CVE-2023-49418 | Critical | 9.8 | 2023-12-11 | TOTOLink A7000R V9.1.0u.6115_B20201022has a stack overflow vulnerability via setIpPortFilterRules. |
CVE-2023-49417 | Critical | 9.8 | 2023-12-11 | TOTOLink A7000R V9.1.0u.6115_B20201022 has a stack overflow vulnerability via setOpModeCfg. |
CVE-2023-6186 | High | 8.3 | 2023-12-11 | Insufficient macro permission validation of The Document Foundation LibreOffice allows an attacker to execute built-in macros without warning. In affected ver… |
CVE-2023-6185 | High | 8.3 | 2023-12-11 | Improper Input Validation vulnerability in GStreamer integration of The Document Foundation LibreOffice allows an attacker to execute arbitrary GStreamer plugi… |
CVE-2023-49964 | High | 8.8 | 2023-12-11 | An issue was discovered in Hyland Alfresco Community Edition through 7.2.0. By inserting malicious content in the folder.get.html.ftl file, an attacker may per… |
CVE-2023-5500 | High | 8.8 | 2023-12-11 | This vulnerability allows an remote attacker with low privileges to misuse Improper Control of Generation of Code ('Code Injection') to gain full control of th… |
CVE-2023-49355 | High | 7.5 | 2023-12-11 | decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " []-1.2e-1111111111" input. NOTE: this is not the same as CVE-20… |
CVE-2023-6181 | Critical | 9.8 | 2023-12-11 | An oversight in BCB handling of reboot reason that allows for persistent code execution |
CVE-2023-48425 | Critical | 9.8 | 2023-12-11 | U-Boot vulnerability resulting in persistent Code Execution |
CVE-2023-48424 | Critical | 9.8 | 2023-12-11 | U-Boot shell vulnerability resulting in Privilege escalation in a production device |
CVE-2023-48417 | Critical | 9.8 | 2023-12-11 | Missing Permission checks resulting in unauthorized access and Manipulation in KeyChainActivity Application |
CVE-2023-6659 | Medium | 6.3 | 2023-12-11 | A vulnerability, which was classified as critical, has been found in Campcodes Web-Based Student Clearance System 1.0. This issue affects some unknown processi… |
CVE-2023-50465 | Medium | 5.4 | 2023-12-11 | A stored cross-site scripting (XSS) vulnerability exists in Monica (aka MonicaHQ) 4.0.0 via an SVG document uploaded by an authenticated user. |
CVE-2023-6658 | Medium | 5.5 | 2023-12-10 | A vulnerability classified as critical was found in SourceCodester Simple Student Attendance System 1.0. This vulnerability affects unknown code of the file aj… |
CVE-2023-50463 | Medium | 6.5 | 2023-12-10 | The caddy-geo-ip (aka GeoIP) middleware through 0.6.0 for Caddy 2, when trust_header X-Forwarded-For is used, allows attackers to spoof their source IP address… |
CVE-2023-6657 | Medium | 5.5 | 2023-12-10 | A vulnerability classified as critical has been found in SourceCodester Simple Student Attendance System 1.0. This affects an unknown part of the file /modals/… |
CVE-2023-6656 | Medium | 5.0 | 2023-12-10 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in DeepFaceLab pretrained DF.wf.288res.384.92.72.22. It has been rated as critical. Affected by this… |
CVE-2023-50457 | Medium | 4.3 | 2023-12-10 | An issue was discovered in Zammad before 6.2.0. When listing tickets linked to a knowledge base answer, or knowledge base answers of a ticket, a user could see… |
CVE-2023-50456 | Medium | 5.3 | 2023-12-10 | An issue was discovered in Zammad before 6.2.0. An attacker can trigger phishing links in generated notification emails via a crafted first or last name. |
CVE-2023-50455 | High | 7.5 | 2023-12-10 | An issue was discovered in Zammad before 6.2.0. Due to lack of rate limiting in the "email address verification" feature, an attacker could send many requests… |
CVE-2023-50454 | Medium | 5.9 | 2023-12-10 | An issue was discovered in Zammad before 6.2.0. In several subsystems, SSL/TLS was used to establish connections to external services without proper validation… |
CVE-2023-50453 | Medium | 5.3 | 2023-12-10 | An issue was discovered in Zammad before 6.2.0. It uses the public endpoint /api/v1/signshow for its login screen. This endpoint returns internal configuration… |
CVE-2023-5870 | Low | 2.2 | 2023-12-10 | A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum wor… |
CVE-2023-5869 | High | 8.8 | 2023-12-10 | A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modifi… |
CVE-2023-5868 | Medium | 4.3 | 2023-12-10 | A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function cal… |
CVE-2023-50449 | High | 7.5 | 2023-12-10 | JFinalCMS 5.0.0 could allow a remote attacker to read files via ../ Directory Traversal in the /common/down/file fileKey parameter. |
CVE-2023-50446 | High | 7.8 | 2023-12-10 | An issue was discovered in Mullvad VPN Windows app before 2023.6-beta1. Insufficient permissions on a directory allow any local unprivileged user to escalate p… |
CVE-2023-6655 | High | 7.3 | 2023-12-10 | A vulnerability, which was classified as critical, has been found in Hongjing e-HR 2020. Affected by this issue is some unknown functionality of the file /w_se… |
CVE-2023-6654 | Medium | 6.3 | 2023-12-10 | A vulnerability classified as critical was found in PHPEMS 6.x/7.x/8.x/9.0. Affected by this vulnerability is an unknown functionality in the library lib/sessi… |
CVE-2023-6653 | Medium | 4.3 | 2023-12-10 | A vulnerability was found in PHPGurukul Teacher Subject Allocation Management System 1.0. It has been rated as problematic. Affected by this issue is some unkn… |
CVE-2023-6652 | High | 7.3 | 2023-12-10 | A vulnerability was found in code-projects Matrimonial Site 1.0. It has been declared as critical. Affected by this vulnerability is the function register of t… |