2023 CVEs (page 93)
Page 93 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-6617 | Medium | 5.5 | 2023-12-08 | A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been classified as critical. Affected is an unknown function of the fi… |
CVE-2023-6616 | Low | 3.5 | 2023-12-08 | A vulnerability was found in SourceCodester Simple Student Attendance System 1.0 and classified as problematic. This issue affects some unknown processing of t… |
CVE-2023-6615 | Low | 3.5 | 2023-12-08 | A vulnerability, which was classified as problematic, has been found in Typecho 1.2.1. Affected by this issue is some unknown functionality of the file /admin/… |
CVE-2023-6610 | High | 7.1 | 2023-12-08 | An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux Kernel. This issue could allow a local attacker to cr… |
CVE-2023-6606 | High | 7.1 | 2023-12-08 | An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash t… |
CVE-2023-6614 | Low | 2.7 | 2023-12-08 | A vulnerability classified as problematic was found in Typecho 1.2.1. Affected by this vulnerability is an unknown functionality of the file /admin/manage-page… |
CVE-2023-6613 | Low | 2.4 | 2023-12-08 | A vulnerability classified as problematic has been found in Typecho 1.2.1. Affected is an unknown function of the file /admin/options-theme.php of the componen… |
CVE-2023-6612 | Medium | 5.5 | 2023-12-08 | A vulnerability was found in Totolink X5000R 9.1.0cu.2300_B20230112. It has been rated as critical. This issue affects the function setDdnsCfg/setDynamicRoute/… |
CVE-2023-48423 | Critical | 9.8 | 2023-12-08 | In dhcp4_SetPDNAddress of dhcp4_Main.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no… |
CVE-2023-48422 | Medium | 5.5 | 2023-12-08 | In Init of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with n… |
CVE-2023-48421 | High | 7.8 | 2023-12-08 | In gpu_pixel_handle_buffer_liveness_update_ioctl of private/google-modules/gpu/mali_kbase/platform/pixel/pixel_gpu_slc.c, there is a possible out of bounds wri… |
CVE-2023-48420 | Medium | 6.4 | 2023-12-08 | there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User inte… |
CVE-2023-48416 | High | 7.5 | 2023-12-08 | In multiple locations, there is a possible null dereference due to a missing null check. This could lead to remote denial of service with no additional executi… |
CVE-2023-48415 | Medium | 5.5 | 2023-12-08 | In Init of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with… |
CVE-2023-48414 | Medium | 6.7 | 2023-12-08 | In the Pixel Camera Driver, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with System e… |
CVE-2023-48413 | Medium | 4.9 | 2023-12-08 | In Init of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with… |
CVE-2023-48412 | Medium | 5.5 | 2023-12-08 | In private_handle_t of mali_gralloc_buffer.h, there is a possible information leak due to a logic error in the code. This could lead to local information disc… |
CVE-2023-48411 | Medium | 5.5 | 2023-12-08 | In SignalStrengthAdapter::FillGsmSignalStrength() of protocolmiscadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could… |
CVE-2023-48410 | High | 7.5 | 2023-12-08 | In cd_ParseMsg of cd_codec.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no ad… |
CVE-2023-48409 | High | 7.8 | 2023-12-08 | In gpu_pixel_handle_buffer_liveness_update_ioctl of private/google-modules/gpu/mali_kbase/mali_kbase_core_linux.c, there is a possible out of bounds write due… |
CVE-2023-48408 | Medium | 5.5 | 2023-12-08 | In ProtocolNetSimFileInfoAdapter() of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local in… |
CVE-2023-48407 | High | 7.8 | 2023-12-08 | there is a possible DCK won't be deleted after factory reset due to a logic error in the code. This could lead to local escalation of privilege with no additio… |
CVE-2023-48406 | Medium | 6.7 | 2023-12-08 | there is a possible permanent DoS or way for the modem to boot unverified firmware due to a logic error in the code. This could lead to local escalation of pri… |
CVE-2023-48405 | Medium | 6.7 | 2023-12-08 | there is a possible way for the secure world to write to NS memory due to a logic error in the code. This could lead to local escalation of privilege with Syst… |
CVE-2023-48404 | High | 7.5 | 2023-12-08 | In ProtocolMiscCarrierConfigSimInfoIndAdapter of protocolmiscadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead… |
CVE-2023-48403 | High | 7.5 | 2023-12-08 | In sms_DecodeCodedTpMsg of sms_PduCodec.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosu… |
CVE-2023-48402 | High | 7.8 | 2023-12-08 | In ppcfw_enable of ppcfw.c, there is a possible EoP due to a missing permission check. This could lead to local escalation of privilege with no additional exec… |
CVE-2023-48401 | Medium | 5.5 | 2023-12-08 | In GetSizeOfEenlRecords of protocoladapter.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information d… |
CVE-2023-48399 | Medium | 5.5 | 2023-12-08 | In ProtocolMiscATCommandAdapter::Init() of protocolmiscadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to lo… |
CVE-2023-48398 | High | 7.5 | 2023-12-08 | In ProtocolNetAcBarringInfo::ProtocolNetAcBarringInfo() of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This c… |
CVE-2023-48397 | Medium | 4.9 | 2023-12-08 | In Init of protocolcalladapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with… |
CVE-2023-47565 | High | 8.0 | 2023-12-08 | An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. If exploited, the vulnerability could a… |
CVE-2023-32975 | Medium | 4.9 | 2023-12-08 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2023-32968 | Medium | 4.5 | 2023-12-08 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2023-23372 | Medium | 6.5 | 2023-12-08 | A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow user… |
CVE-2023-6611 | Medium | 5.5 | 2023-12-08 | A vulnerability was found in Tongda OA 2017 up to 11.9. It has been declared as critical. This vulnerability affects unknown code of the file pda/pad/email/del… |
CVE-2023-6609 | Low | 3.5 | 2023-12-08 | A vulnerability was found in osCommerce 4. It has been classified as problematic. This affects an unknown part of the file /b2b-supermarket/catalog/all-product… |
CVE-2023-6608 | Medium | 5.5 | 2023-12-08 | A vulnerability was found in Tongda OA 2017 up to 11.9 and classified as critical. Affected by this issue is some unknown functionality of the file general/not… |
CVE-2023-6245 | High | 7.5 | 2023-12-08 | The Candid library causes a Denial of Service while parsing a specially crafted payload with 'empty' data type. For example, if the payload is `record { *… |
CVE-2023-6146 | Medium | 5.7 | 2023-12-08 | A Qualys web application was found to have a stored XSS vulnerability resulting from the absence of HTML encoding in the presentation of logging information t… |
CVE-2023-49487 | Medium | 5.4 | 2023-12-08 | JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the navigation management department. |
CVE-2023-49486 | Medium | 5.4 | 2023-12-08 | JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the model management department. |
CVE-2023-49485 | Medium | 5.4 | 2023-12-08 | JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the column management department. |
CVE-2023-49484 | Medium | 5.4 | 2023-12-08 | Dreamer CMS v4.1.3 was discovered to contain a cross-site scripting (XSS) vulnerability in the article management department. |
CVE-2023-49444 | Medium | 5.4 | 2023-12-08 | An arbitrary file upload vulnerability in DoraCMS v2.1.8 allow attackers to execute arbitrary code via uploading a crafted HTML or image file to the user avata… |
CVE-2023-49443 | Critical | 9.8 | 2023-12-08 | DoraCMS v2.1.8 was discovered to re-use the same code for verification of valid usernames and passwords. This vulnerability allows attackers to gain access to… |
CVE-2023-6607 | Medium | 5.5 | 2023-12-08 | A vulnerability has been found in Tongda OA 2017 up to 11.10 and classified as critical. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2023-49007 | Critical | 9.8 | 2023-12-08 | In Netgear Orbi RBR750 firmware before V7.2.6.21, there is a stack-based buffer overflow in /usr/sbin/httpd. |
CVE-2023-46157 | High | 8.8 | 2023-12-08 | File-Manager in MGT CloudPanel 2.0.0 through 2.3.2 allows the lowest privilege user to achieve OS command injection by changing file ownership and changing fil… |
CVE-2023-45866 | Medium | 6.3 | 2023-12-08 | Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboar… |
CVE-2023-32460 | High | 8.8 | 2023-12-08 | Dell PowerEdge BIOS contains an improper privilege management security vulnerability. An unauthenticated local attacker could potentially exploit this vulnera… |
CVE-2023-48929 | Critical | 9.8 | 2023-12-08 | Franklin Fueling Systems System Sentinel AnyWare (SSA) version 1.6.24.492 is vulnerable to Session Fixation. The 'sid' parameter in the group_status.asp resour… |
CVE-2023-48928 | Medium | 6.1 | 2023-12-08 | Franklin Fueling Systems System Sentinel AnyWare (SSA) version 1.6.24.492 is vulnerable to Open Redirect. The 'path' parameter of the prefs.asp resource allows… |
CVE-2023-26158 | High | 8.2 | 2023-12-08 | All versions of the package mockjs are vulnerable to Prototype Pollution via the Util.extend function due to missing check if the attribute resolves to the obj… |
CVE-2023-48122 | High | 7.5 | 2023-12-08 | An issue in microweber v.2.0.1 and fixed in v.2.0.4 allows a remote attacker to obtain sensitive information via the HTTP GET method. |
CVE-2023-43305 | High | 8.2 | 2023-12-08 | An issue in studio kent mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-43744 | High | 7.2 | 2023-12-08 | An OS command injection vulnerability in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, and MX30 with firmware versions prior to 17.0.10 patch 17161 and 16.0… |
CVE-2023-43743 | High | 8.8 | 2023-12-08 | A SQL injection vulnerability in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, and MX30 with firmware versions prior to 17.0.10 patch 17161 and 16.04 patch… |
CVE-2023-43742 | Critical | 9.8 | 2023-12-08 | An authentication bypass in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, and MX30 with firmware versions prior to 17.0.10 patch 17161 and 16.04 patch 16109… |
CVE-2023-6599 | Medium | 4.3 | 2023-12-08 | Missing Standardized Error Handling Mechanism in GitHub repository microweber/microweber prior to 2.0. |
CVE-2023-5008 | Critical | 9.8 | 2023-12-08 | Student Information System v1.0 is vulnerable to an unauthenticated SQL Injection vulnerability on the 'regno' parameter of index.php page, allowing an externa… |
CVE-2023-5058 | High | 7.8 | 2023-12-07 | Improper Input Validation in the processing of user-supplied splash screen during system boot in Phoenix SecureCore™ Technology™ 4 potentially allows denial-of… |
CVE-2023-4122 | Critical | 9.9 | 2023-12-07 | Student Information System v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'photo' parameter of my-profile page, allowing an authenticated a… |
CVE-2023-6581 | Medium | 5.5 | 2023-12-07 | A vulnerability has been found in D-Link DAR-7000 up to 20231126 and classified as critical. This vulnerability affects unknown code of the file /user/inc/work… |
CVE-2023-6580 | High | 8.8 | 2023-12-07 | A vulnerability, which was classified as critical, was found in D-Link DIR-846 FW100A53DBR. This affects an unknown part of the file /HNAP1/ of the component Q… |
CVE-2023-6579 | High | 7.3 | 2023-12-07 | A vulnerability, which was classified as critical, has been found in osCommerce 4. Affected by this issue is some unknown functionality of the file /b2b-superm… |
CVE-2023-46693 | Medium | 6.1 | 2023-12-07 | Cross Site Scripting (XSS) vulnerability in FormaLMS before 4.0.5 allows attackers to run arbitrary code via title parameters. |
CVE-2023-6578 | High | 7.3 | 2023-12-07 | A vulnerability classified as critical has been found in Software AG WebMethods 10.11.x/10.15.x. Affected is an unknown function of the file wm.server/connect/… |
CVE-2023-6577 | Medium | 4.3 | 2023-12-07 | A vulnerability was found in Byzoro PatrolFlow 2530Pro up to 20231126. It has been rated as problematic. This issue affects some unknown processing of the file… |
CVE-2023-6576 | Medium | 6.3 | 2023-12-07 | A vulnerability was found in Byzoro S210 up to 20231123. It has been declared as critical. This vulnerability affects unknown code of the file /Tool/uploadfile… |
CVE-2023-38174 | Medium | 4.3 | 2023-12-07 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability |
CVE-2023-36880 | Medium | 4.8 | 2023-12-07 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability |
CVE-2023-35618 | Critical | 9.6 | 2023-12-07 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2023-6575 | Medium | 6.3 | 2023-12-07 | A vulnerability was found in Byzoro S210 up to 20231121. It has been classified as critical. This affects an unknown part of the file /Tool/repair.php of the c… |
CVE-2023-6574 | Medium | 6.3 | 2023-12-07 | A vulnerability was found in Byzoro Smart S20 up to 20231120 and classified as critical. Affected by this issue is some unknown functionality of the file /sysm… |
CVE-2023-4486 | High | 7.5 | 2023-12-07 | Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines pri… |
CVE-2023-49468 | High | 8.8 | 2023-12-07 | Libde265 v1.0.14 was discovered to contain a global buffer overflow vulnerability in the read_coding_unit function at slice.cc. |
CVE-2023-49467 | High | 8.8 | 2023-12-07 | Libde265 v1.0.14 was discovered to contain a heap-buffer-overflow vulnerability in the derive_combined_bipredictive_merging_candidates function at motion.cc. |
CVE-2023-49465 | High | 8.8 | 2023-12-07 | Libde265 v1.0.14 was discovered to contain a heap-buffer-overflow vulnerability in the derive_spatial_luma_vector_prediction function at motion.cc. |
CVE-2023-49464 | High | 8.8 | 2023-12-07 | libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::get_luma_bits_per_pixel_from_configuration_unci. |
CVE-2023-49463 | High | 8.8 | 2023-12-07 | libheif v1.17.5 was discovered to contain a segmentation violation via the function find_exif_tag at /libheif/exif.cc. |
CVE-2023-49462 | High | 8.8 | 2023-12-07 | libheif v1.17.5 was discovered to contain a segmentation violation via the component /libheif/exif.cc. |
CVE-2023-49460 | High | 8.8 | 2023-12-07 | libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::decode_uncompressed_image. |
CVE-2023-6333 | High | 7.5 | 2023-12-07 | The affected ControlByWeb Relay products are vulnerable to a stored cross-site scripting vulnerability, which could allow an attacker to inject arbitrary scri… |
CVE-2023-49411 | Critical | 9.8 | 2023-12-07 | Tenda W30E V16.01.0.12(4843) contains a stack overflow vulnerability via the function formDeleteMeshNode. |
CVE-2023-49409 | Critical | 9.8 | 2023-12-07 | Tenda AX3 V16.03.12.11 was discovered to contain a Command Execution vulnerability via the function /goform/telnet. |
CVE-2023-49408 | Critical | 9.8 | 2023-12-07 | Tenda AX3 V16.03.12.11 was discovered to contain a stack overflow via the function set_device_name. |
CVE-2023-49406 | Critical | 9.8 | 2023-12-07 | Tenda W30E V16.01.0.12(4843) was discovered to contain a Command Execution vulnerability via the function /goform/telnet. |
CVE-2023-49405 | Critical | 9.8 | 2023-12-07 | Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function UploadCfg. |
CVE-2023-49404 | Critical | 9.8 | 2023-12-07 | Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formAdvancedSetListSet. |
CVE-2023-48958 | Medium | 5.5 | 2023-12-07 | gpac 2.3-DEV-rev617-g671976fcc-master contains memory leaks in gf_mpd_resolve_url media_tools/mpd.c:4589. |
CVE-2023-47440 | Medium | 6.5 | 2023-12-07 | Gladys Assistant v4.27.0 and prior is vulnerable to Directory Traversal. The patch of CVE-2023-43256 was found to be incomplete, allowing authenticated attacke… |
CVE-2023-46871 | Medium | 5.3 | 2023-12-07 | GPAC version 2.3-DEV-rev602-ged8424300-master in MP4Box contains a memory leak in NewSFDouble scenegraph/vrml_tools.c:300. This vulnerability may lead to a den… |
CVE-2023-41905 | Medium | 5.4 | 2023-12-07 | NETSCOUT nGeniusONE 6.3.4 build 2298 allows a Reflected Cross-Site scripting (XSS) vulnerability by an authenticated user. |
CVE-2023-41172 | Medium | 5.4 | 2023-12-07 | NetScout nGeniusONE 6.3.4 build 2298 allows a Stored Cross-Site scripting vulnerability (issue 4 of 4). |
CVE-2023-41171 | Medium | 5.4 | 2023-12-07 | NetScout nGeniusONE 6.3.4 build 2298 allows a Stored Cross-Site scripting vulnerability (issue 3 of 4). |
CVE-2023-41170 | Medium | 6.1 | 2023-12-07 | NetScout nGeniusONE 6.3.4 build 2298 allows a Reflected Cross-Site scripting vulnerability. |
CVE-2023-41169 | Medium | 5.4 | 2023-12-07 | NetScout nGeniusONE 6.3.4 build 2298 allows a Stored Cross-Site scripting vulnerability (issue 2 of 4). |
CVE-2023-41168 | Medium | 5.4 | 2023-12-07 | NetScout nGeniusONE 6.3.4 build 2298 allows a Stored Cross-Site scripting vulnerability (issue 1 of 4). |
CVE-2023-40302 | Critical | 9.1 | 2023-12-07 | NETSCOUT nGeniusPULSE 3.8 has Weak File Permissions Vulnerability |