2023 CVEs (page 92)
Page 92 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-6651 | High | 7.3 | 2023-12-10 | A vulnerability was found in code-projects Matrimonial Site 1.0. It has been classified as critical. Affected is an unknown function of the file /auth/auth.php… |
CVE-2023-6650 | Medium | 4.3 | 2023-12-10 | A vulnerability was found in SourceCodester Simple Invoice Generator System 1.0 and classified as problematic. This issue affects some unknown processing of th… |
CVE-2023-6649 | Medium | 4.3 | 2023-12-10 | A vulnerability has been found in PHPGurukul Teacher Subject Allocation Management System 1.0 and classified as problematic. This vulnerability affects unknown… |
CVE-2023-6648 | High | 7.3 | 2023-12-10 | A vulnerability, which was classified as critical, was found in PHPGurukul Nipah Virus Testing Management System 1.0. This affects an unknown part of the file… |
CVE-2023-6647 | High | 7.3 | 2023-12-10 | A vulnerability, which was classified as critical, has been found in AMTT HiBOS 1.0. Affected by this issue is some unknown functionality. The manipulation of… |
CVE-2023-50431 | Medium | 5.5 | 2023-12-09 | sec_attest_info in drivers/accel/habanalabs/common/habanalabs_ioctl.c in the Linux kernel through 6.6.5 allows an information leak to user space because info->… |
CVE-2023-6646 | Low | 3.5 | 2023-12-09 | A vulnerability classified as problematic has been found in linkding 1.23.0. Affected is an unknown function. The manipulation of the argument q leads to cross… |
CVE-2023-50430 | Medium | 6.4 | 2023-12-09 | The Goodix Fingerprint Device, as shipped in Dell Inspiron 15 computers, does not follow the Secure Device Connection Protocol (SDCP) when enrolling via Linux… |
CVE-2023-50429 | Critical | 9.1 | 2023-12-09 | IzyBat Orange casiers before 20230803_1 allows getEnsemble.php ensemble SQL injection. |
CVE-2023-50428 | Medium | 5.3 | 2023-12-09 | In Bitcoin Core through 26.0 and Bitcoin Knots before 25.1.knots20231115, datacarrier size limits can be bypassed by obfuscating data as code (e.g., with OP_FA… |
CVE-2023-47254 | Critical | 9.8 | 2023-12-09 | An OS Command Injection in the CLI interface on DrayTek Vigor167 version 5.2.2, allows remote attackers to execute arbitrary system commands and escalate privi… |
CVE-2023-6120 | Medium | 4.1 | 2023-12-09 | The Welcart e-Commerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.6 via the upload_certificate_file fu… |
CVE-2023-5756 | Medium | 5.4 | 2023-12-09 | The Digital Publications by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.6. This is due to… |
CVE-2023-46932 | Critical | 9.8 | 2023-12-09 | Heap Buffer Overflow vulnerability in GPAC version 2.3-DEV-rev617-g671976fcc-master, allows attackers to execute arbitrary code and cause a denial of service (… |
CVE-2023-28874 | Medium | 6.1 | 2023-12-09 | The next parameter in the /accounts/login endpoint of Seafile 9.0.6 allows attackers to redirect users to arbitrary sites. |
CVE-2023-28873 | Medium | 5.4 | 2023-12-09 | An XSS issue in wiki and discussion pages in Seafile 9.0.6 allows attackers to inject JavaScript into the Markdown editor. |
CVE-2023-28871 | Medium | 4.3 | 2023-12-09 | Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to read registry information of the operating system by creating a symbolic lin… |
CVE-2023-28870 | Medium | 6.5 | 2023-12-09 | Insecure File Permissions in Support Assistant in NCP Secure Enterprise Client before 12.22 allow attackers to write to configuration files from low-privileged… |
CVE-2023-28869 | Medium | 6.5 | 2023-12-09 | Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers read the contents of arbitrary files on the operating system by creating a symb… |
CVE-2023-28868 | High | 8.1 | 2023-12-09 | Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to delete arbitrary files on the operating system by creating a symbolic link. |
CVE-2023-47465 | Medium | 5.5 | 2023-12-09 | An issue in GPAC v.2.2.1 and before allows a local attacker to cause a denial of service (DoS) via the ctts_box_read function of file src/isomedia/box_code_bas… |
CVE-2023-47722 | Medium | 6.2 | 2023-12-09 | IBM API Connect V10.0.5.3 and V10.0.6.0 stores user credentials in browser cache which can be read by a local user. IBM X-Force ID: 271912. |
CVE-2023-28527 | Medium | 6.2 | 2023-12-09 | IBM Informix Dynamic Server 12.10 and 14.10 cdr is vulnerable to a heap buffer overflow, caused by improper bounds checking which could allow a local user to… |
CVE-2023-28526 | Medium | 6.2 | 2023-12-09 | IBM Informix Dynamic Server 12.10 and 14.10 archecker is vulnerable to a heap buffer overflow, caused by improper bounds checking which could allow a local us… |
CVE-2023-28523 | High | 8.4 | 2023-12-09 | IBM Informix Dynamic Server 12.10 and 14.10 onsmsync is vulnerable to a heap buffer overflow, caused by improper bounds checking which could allow an attacker… |
CVE-2023-6394 | High | 7.4 | 2023-12-09 | A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarku… |
CVE-2023-49797 | High | 8.8 | 2023-12-09 | PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may… |
CVE-2023-6560 | Medium | 5.5 | 2023-12-09 | An out-of-bounds memory access flaw was found in the io_uring SQ/CQ rings functionality in the Linux kernel. This issue could allow a local user to crash the s… |
CVE-2023-49800 | High | 7.5 | 2023-12-09 | `nuxt-api-party` is an open source module to proxy API requests. The library allows the user to send many options directly to `ofetch`. There is no filter on w… |
CVE-2023-49799 | High | 7.5 | 2023-12-09 | `nuxt-api-party` is an open source module to proxy API requests. nuxt-api-party attempts to check if the user has passed an absolute URL to prevent the aforeme… |
CVE-2023-49798 | Medium | 5.9 | 2023-12-09 | OpenZeppelin Contracts is a library for smart contract development. A merge issue when porting the 5.0.1 patch to the 4.9 branch caused a line duplication. In… |
CVE-2023-6337 | High | 7.5 | 2023-12-08 | HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthent… |
CVE-2023-34320 | Medium | 5.5 | 2023-12-08 | Cortex-A77 cores (r0p0 and r1p0) are affected by erratum 1508412 where software, under certain circumstances, could deadlock a core due to the execution of eit… |
CVE-2023-49788 | High | 7.2 | 2023-12-08 | Collabora Online is a collaborative online office suite based on LibreOffice technology. Unlike a standalone dedicated Collabora Online server, the Built-in CO… |
CVE-2023-49782 | High | 7.1 | 2023-12-08 | Collabora Online is a collaborative online office suite based on LibreOffice technology. Users of Nextcloud with `Collabora Online - Built-in CODE Server` app… |
CVE-2023-48311 | High | 8.0 | 2023-12-08 | dockerspawner is a tool to spawn JupyterHub single user servers in Docker containers. Users of JupyterHub deployments running DockerSpawner starting with 0.11… |
CVE-2023-46499 | Medium | 6.1 | 2023-12-08 | Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information via a crafted scripts… |
CVE-2023-46498 | Critical | 9.8 | 2023-12-08 | An issue in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information and execute arbitrary code via the /deleteCustom… |
CVE-2023-46497 | Medium | 5.4 | 2023-12-08 | Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request t… |
CVE-2023-46496 | High | 8.3 | 2023-12-08 | Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request t… |
CVE-2023-46495 | Medium | 6.1 | 2023-12-08 | Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request… |
CVE-2023-46494 | Medium | 6.1 | 2023-12-08 | Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information via a crafted request… |
CVE-2023-46493 | Medium | 5.3 | 2023-12-08 | Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request t… |
CVE-2023-6507 | Medium | 6.1 | 2023-12-08 | An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. … |
CVE-2023-6622 | Medium | 5.5 | 2023-12-08 | A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in nf_tables in the Linux kernel. This issue may allow a… |
CVE-2023-6619 | Medium | 5.5 | 2023-12-08 | A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been rated as critical. Affected by this issue is some unknown functio… |
CVE-2023-6618 | Medium | 5.5 | 2023-12-08 | A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been declared as problematic. Affected by this vulnerability is an unk… |
CVE-2023-6617 | Medium | 5.5 | 2023-12-08 | A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been classified as critical. Affected is an unknown function of the fi… |
CVE-2023-6616 | Low | 3.5 | 2023-12-08 | A vulnerability was found in SourceCodester Simple Student Attendance System 1.0 and classified as problematic. This issue affects some unknown processing of t… |
CVE-2023-6615 | Low | 3.5 | 2023-12-08 | A vulnerability, which was classified as problematic, has been found in Typecho 1.2.1. Affected by this issue is some unknown functionality of the file /admin/… |
CVE-2023-6610 | High | 7.1 | 2023-12-08 | An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux Kernel. This issue could allow a local attacker to cr… |
CVE-2023-6606 | High | 7.1 | 2023-12-08 | An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash t… |
CVE-2023-6614 | Low | 2.7 | 2023-12-08 | A vulnerability classified as problematic was found in Typecho 1.2.1. Affected by this vulnerability is an unknown functionality of the file /admin/manage-page… |
CVE-2023-6613 | Low | 2.4 | 2023-12-08 | A vulnerability classified as problematic has been found in Typecho 1.2.1. Affected is an unknown function of the file /admin/options-theme.php of the componen… |
CVE-2023-6612 | Medium | 5.5 | 2023-12-08 | A vulnerability was found in Totolink X5000R 9.1.0cu.2300_B20230112. It has been rated as critical. This issue affects the function setDdnsCfg/setDynamicRoute/… |
CVE-2023-48423 | Critical | 9.8 | 2023-12-08 | In dhcp4_SetPDNAddress of dhcp4_Main.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no… |
CVE-2023-48422 | Medium | 5.5 | 2023-12-08 | In Init of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with n… |
CVE-2023-48421 | High | 7.8 | 2023-12-08 | In gpu_pixel_handle_buffer_liveness_update_ioctl of private/google-modules/gpu/mali_kbase/platform/pixel/pixel_gpu_slc.c, there is a possible out of bounds wri… |
CVE-2023-48420 | Medium | 6.4 | 2023-12-08 | there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User inte… |
CVE-2023-48416 | High | 7.5 | 2023-12-08 | In multiple locations, there is a possible null dereference due to a missing null check. This could lead to remote denial of service with no additional executi… |
CVE-2023-48415 | Medium | 5.5 | 2023-12-08 | In Init of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with… |
CVE-2023-48414 | Medium | 6.7 | 2023-12-08 | In the Pixel Camera Driver, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with System e… |
CVE-2023-48413 | Medium | 4.9 | 2023-12-08 | In Init of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with… |
CVE-2023-48412 | Medium | 5.5 | 2023-12-08 | In private_handle_t of mali_gralloc_buffer.h, there is a possible information leak due to a logic error in the code. This could lead to local information disc… |
CVE-2023-48411 | Medium | 5.5 | 2023-12-08 | In SignalStrengthAdapter::FillGsmSignalStrength() of protocolmiscadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could… |
CVE-2023-48410 | High | 7.5 | 2023-12-08 | In cd_ParseMsg of cd_codec.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no ad… |
CVE-2023-48409 | High | 7.8 | 2023-12-08 | In gpu_pixel_handle_buffer_liveness_update_ioctl of private/google-modules/gpu/mali_kbase/mali_kbase_core_linux.c, there is a possible out of bounds write due… |
CVE-2023-48408 | Medium | 5.5 | 2023-12-08 | In ProtocolNetSimFileInfoAdapter() of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local in… |
CVE-2023-48407 | High | 7.8 | 2023-12-08 | there is a possible DCK won't be deleted after factory reset due to a logic error in the code. This could lead to local escalation of privilege with no additio… |
CVE-2023-48406 | Medium | 6.7 | 2023-12-08 | there is a possible permanent DoS or way for the modem to boot unverified firmware due to a logic error in the code. This could lead to local escalation of pri… |
CVE-2023-48405 | Medium | 6.7 | 2023-12-08 | there is a possible way for the secure world to write to NS memory due to a logic error in the code. This could lead to local escalation of privilege with Syst… |
CVE-2023-48404 | High | 7.5 | 2023-12-08 | In ProtocolMiscCarrierConfigSimInfoIndAdapter of protocolmiscadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead… |
CVE-2023-48403 | High | 7.5 | 2023-12-08 | In sms_DecodeCodedTpMsg of sms_PduCodec.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosu… |
CVE-2023-48402 | High | 7.8 | 2023-12-08 | In ppcfw_enable of ppcfw.c, there is a possible EoP due to a missing permission check. This could lead to local escalation of privilege with no additional exec… |
CVE-2023-48401 | Medium | 5.5 | 2023-12-08 | In GetSizeOfEenlRecords of protocoladapter.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information d… |
CVE-2023-48399 | Medium | 5.5 | 2023-12-08 | In ProtocolMiscATCommandAdapter::Init() of protocolmiscadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to lo… |
CVE-2023-48398 | High | 7.5 | 2023-12-08 | In ProtocolNetAcBarringInfo::ProtocolNetAcBarringInfo() of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This c… |
CVE-2023-48397 | Medium | 4.9 | 2023-12-08 | In Init of protocolcalladapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with… |
CVE-2023-47565 | High | 8.0 | 2023-12-08 | An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. If exploited, the vulnerability could a… |
CVE-2023-32975 | Medium | 4.9 | 2023-12-08 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2023-32968 | Medium | 4.5 | 2023-12-08 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2023-23372 | Medium | 6.5 | 2023-12-08 | A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow user… |
CVE-2023-6611 | Medium | 5.5 | 2023-12-08 | A vulnerability was found in Tongda OA 2017 up to 11.9. It has been declared as critical. This vulnerability affects unknown code of the file pda/pad/email/del… |
CVE-2023-6609 | Low | 3.5 | 2023-12-08 | A vulnerability was found in osCommerce 4. It has been classified as problematic. This affects an unknown part of the file /b2b-supermarket/catalog/all-product… |
CVE-2023-6608 | Medium | 5.5 | 2023-12-08 | A vulnerability was found in Tongda OA 2017 up to 11.9 and classified as critical. Affected by this issue is some unknown functionality of the file general/not… |
CVE-2023-6245 | High | 7.5 | 2023-12-08 | The Candid library causes a Denial of Service while parsing a specially crafted payload with 'empty' data type. For example, if the payload is `record { *… |
CVE-2023-6146 | Medium | 5.7 | 2023-12-08 | A Qualys web application was found to have a stored XSS vulnerability resulting from the absence of HTML encoding in the presentation of logging information t… |
CVE-2023-49487 | Medium | 5.4 | 2023-12-08 | JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the navigation management department. |
CVE-2023-49486 | Medium | 5.4 | 2023-12-08 | JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the model management department. |
CVE-2023-49485 | Medium | 5.4 | 2023-12-08 | JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the column management department. |
CVE-2023-49484 | Medium | 5.4 | 2023-12-08 | Dreamer CMS v4.1.3 was discovered to contain a cross-site scripting (XSS) vulnerability in the article management department. |
CVE-2023-49444 | Medium | 5.4 | 2023-12-08 | An arbitrary file upload vulnerability in DoraCMS v2.1.8 allow attackers to execute arbitrary code via uploading a crafted HTML or image file to the user avata… |
CVE-2023-49443 | Critical | 9.8 | 2023-12-08 | DoraCMS v2.1.8 was discovered to re-use the same code for verification of valid usernames and passwords. This vulnerability allows attackers to gain access to… |
CVE-2023-6607 | Medium | 5.5 | 2023-12-08 | A vulnerability has been found in Tongda OA 2017 up to 11.10 and classified as critical. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2023-49007 | Critical | 9.8 | 2023-12-08 | In Netgear Orbi RBR750 firmware before V7.2.6.21, there is a stack-based buffer overflow in /usr/sbin/httpd. |
CVE-2023-46157 | High | 8.8 | 2023-12-08 | File-Manager in MGT CloudPanel 2.0.0 through 2.3.2 allows the lowest privilege user to achieve OS command injection by changing file ownership and changing fil… |
CVE-2023-45866 | Medium | 6.3 | 2023-12-08 | Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboar… |
CVE-2023-32460 | High | 8.8 | 2023-12-08 | Dell PowerEdge BIOS contains an improper privilege management security vulnerability. An unauthenticated local attacker could potentially exploit this vulnera… |
CVE-2023-48929 | Critical | 9.8 | 2023-12-08 | Franklin Fueling Systems System Sentinel AnyWare (SSA) version 1.6.24.492 is vulnerable to Session Fixation. The 'sid' parameter in the group_status.asp resour… |
CVE-2023-48928 | Medium | 6.1 | 2023-12-08 | Franklin Fueling Systems System Sentinel AnyWare (SSA) version 1.6.24.492 is vulnerable to Open Redirect. The 'path' parameter of the prefs.asp resource allows… |