2023 CVEs (page 95)
Page 95 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-49283 | Medium | 5.4 | 2023-12-05 | microsoft-graph-core the Microsoft Graph Library for PHP. The Microsoft Graph Beta PHP SDK published packages which contained test code that enabled the use of… |
CVE-2023-49282 | Medium | 5.4 | 2023-12-05 | msgraph-sdk-php is the Microsoft Graph Library for PHP. The Microsoft Graph PHP SDK published packages which contained test code that enabled the use of the ph… |
CVE-2023-5970 | High | 8.8 | 2023-12-05 | Improper authentication in the SMA100 SSL-VPN virtual office portal allows a remote authenticated attacker to create an identical external domain user using ac… |
CVE-2023-49297 | Low | 3.3 | 2023-12-05 | PyDrive2 is a wrapper library of google-api-python-client that simplifies many common Google Drive API V2 tasks. Unsafe YAML deserilization will result in arbi… |
CVE-2023-46736 | Medium | 5.3 | 2023-12-05 | EspoCRM is an Open Source CRM (Customer Relationship Management) software. In affected versions there is Server-Side Request Forgery (SSRF) vulnerability via t… |
CVE-2023-44221 | High | 7.2 | 2023-12-05 | Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to… |
CVE-2023-6448 | Critical | 9.8 | 2023-12-05 | Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with ne… |
CVE-2023-46674 | Medium | 6.0 | 2023-12-05 | An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by… |
CVE-2023-45287 | High | 7.5 | 2023-12-05 | Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but… |
CVE-2023-45085 | Low | 3.2 | 2023-12-05 | An issue exists in SoftIron HyperCloud where compute nodes may come online immediately without following the correct initialization process. In this instance… |
CVE-2023-45084 | High | 7.0 | 2023-12-05 | An issue exists in SoftIron HyperCloud where drive caddy removal and reinsertion without a reboot may erroneously cause the system to recognize the caddy as ne… |
CVE-2023-45083 | Medium | 4.2 | 2023-12-05 | An Improper Privilege Management vulnerability exists in HyperCloud that will impact the ability for a user to authenticate against the management plane. An a… |
CVE-2023-44298 | Low | 3.6 | 2023-12-05 | Dell PowerEdge platforms 16G Intel E5 BIOS and Dell Precision BIOS, version 1.4.4, contain active debug code security vulnerability. An unauthenticated physic… |
CVE-2023-44297 | High | 7.1 | 2023-12-05 | Dell PowerEdge platforms 16G Intel E5 BIOS and Dell Precision BIOS, version 1.4.4, contain active debug code security vulnerability. An unauthenticated physic… |
CVE-2023-6357 | High | 8.8 | 2023-12-05 | A low-privileged remote attacker could exploit the vulnerability and inject additional system commands via file system libraries which could give the attacker… |
CVE-2023-6180 | Medium | 5.3 | 2023-12-05 | The tokio-boring library in version 4.0.0 is affected by a memory leak issue that can lead to excessive resource consumption and potential DoS by resource exha… |
CVE-2023-49448 | High | 8.8 | 2023-12-05 | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via admin/nav/delete. |
CVE-2023-49447 | High | 8.8 | 2023-12-05 | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/update. |
CVE-2023-49446 | High | 8.8 | 2023-12-05 | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/save. |
CVE-2023-49398 | High | 8.8 | 2023-12-05 | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/delete. |
CVE-2023-49397 | High | 8.8 | 2023-12-05 | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/updateStatus. |
CVE-2023-49396 | High | 8.8 | 2023-12-05 | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/save. |
CVE-2023-49395 | High | 8.8 | 2023-12-05 | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/update. |
CVE-2023-49383 | High | 8.8 | 2023-12-05 | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/save. |
CVE-2023-49382 | High | 8.8 | 2023-12-05 | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/delete. |
CVE-2023-49381 | High | 8.8 | 2023-12-05 | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/update. |
CVE-2023-49380 | High | 8.8 | 2023-12-05 | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/delete. |
CVE-2023-49379 | High | 8.8 | 2023-12-05 | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /admin/friend_link/save. |
CVE-2023-49378 | High | 8.8 | 2023-12-05 | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/form/save. |
CVE-2023-49377 | High | 8.8 | 2023-12-05 | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/update. |
CVE-2023-49376 | High | 8.8 | 2023-12-05 | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/delete. |
CVE-2023-49375 | High | 8.8 | 2023-12-05 | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/update. |
CVE-2023-49374 | High | 8.8 | 2023-12-05 | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/update. |
CVE-2023-49373 | High | 8.8 | 2023-12-05 | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/slide/delete. |
CVE-2023-49372 | High | 8.8 | 2023-12-05 | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/save. |
CVE-2023-45842 | High | 8.1 | 2023-12-05 | Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A special… |
CVE-2023-45841 | High | 8.1 | 2023-12-05 | Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A special… |
CVE-2023-45840 | High | 8.1 | 2023-12-05 | Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A special… |
CVE-2023-45839 | High | 8.1 | 2023-12-05 | Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A special… |
CVE-2023-45838 | High | 8.1 | 2023-12-05 | Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A special… |
CVE-2023-43628 | Medium | 5.9 | 2023-12-05 | An integer underflow vulnerability exists in the NTRIP Stream Parsing functionality of GPSd 3.25.1~dev. A specially crafted network packet can lead to memory c… |
CVE-2023-43608 | High | 8.1 | 2023-12-05 | A data integrity vulnerability exists in the BR_NO_CHECK_HASH_FOR functionality of Buildroot 2023.08.1 and dev commit 622698d7847. A specially crafted man-in-t… |
CVE-2023-41835 | High | 7.5 | 2023-12-05 | When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even… |
CVE-2023-6269 | Critical | 10.0 | 2023-12-05 | An argument injection vulnerability has been identified in the administrative web interface of the Atos Unify OpenScape products "Session Border Controller" (… |
CVE-2023-5188 | High | 7.5 | 2023-12-05 | The MMS Interpreter of WagoAppRTU in versions below 1.4.6.0 which is used by the WAGO Telecontrol Configurator is vulnerable to malformed packets. An remote un… |
CVE-2023-49070 | Critical | 9.8 | 2023-12-05 | Pre-auth RCE in Apache Ofbiz 18.12.09. It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10. Users are re… |
CVE-2023-43472 | High | 7.5 | 2023-12-05 | An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API. |
CVE-2023-44295 | Medium | 6.3 | 2023-12-05 | Dell PowerScale OneFS versions 8.2.2.x through 9.6.0.x contains an improper control of a resource through its lifetime vulnerability. A low privilege attacker… |
CVE-2023-44288 | High | 7.5 | 2023-12-05 | Dell PowerScale OneFS, 8.2.2.x through 9.6.0.x, contains an improper control of a resource through its lifetime vulnerability. An unauthenticated network atta… |
CVE-2023-39248 | High | 7.5 | 2023-12-05 | Dell OS10 Networking Switches running 10.5.2.x and above contain an Uncontrolled Resource Consumption (Denial of Service) vulnerability, when switches are con… |
CVE-2023-37572 | High | 7.5 | 2023-12-05 | Softing OPC Suite version 5.25 and before has Incorrect Access Control, allows attackers to obtain sensitive information via weak permissions in OSF_discovery… |
CVE-2023-47304 | High | 7.8 | 2023-12-05 | An issue was discovered in Vonage Box Telephone Adapter VDV23 version VDV21-3.2.11-0.5.1, allows local attackers to bypass UART authentication controls and rea… |
CVE-2023-42581 | High | 7.5 | 2023-12-05 | Improper URL validation from InstantPlay deeplink in Galaxy Store prior to version 4.5.64.4 allows attackers to execute JavaScript API to access data. |
CVE-2023-42580 | High | 7.5 | 2023-12-05 | Improper URL validation from MCSLaunch deeplink in Galaxy Store prior to version 4.5.64.4 allows attackers to execute JavaScript API to install APK from Galaxy… |
CVE-2023-42579 | Medium | 6.5 | 2023-12-05 | Improper usage of insecure protocol (i.e. HTTP) in SogouSDK of Chinese Samsung Keyboard prior to versions 5.3.70.1 in Android 11, 5.4.60.49, 5.4.85.5, 5.5.00.5… |
CVE-2023-42578 | Medium | 6.5 | 2023-12-05 | Improper handling of insufficient permissions or privileges vulnerability in Samsung Data Store prior to version 5.2.00.7 allows remote attackers to access loc… |
CVE-2023-42577 | Medium | 6.8 | 2023-12-05 | Improper Access Control in Samsung Voice Recorder prior to versions 21.4.15.01 in Android 12 and Android 13, 21.4.50.17 in Android 14 allows physical attackers… |
CVE-2023-42576 | Medium | 5.4 | 2023-12-05 | Improper Authentication vulnerability in Samsung Pass prior to version 4.3.00.17 allows physical attackers to bypass authentication due to invalid exception ha… |
CVE-2023-42575 | Medium | 5.4 | 2023-12-05 | Improper Authentication vulnerability in Samsung Pass prior to version 4.3.00.17 allows physical attackers to bypass authentication due to invalid flag setting. |
CVE-2023-42574 | Medium | 5.1 | 2023-12-05 | Improper access control vulnerablility in GameHomeCN prior to version 4.2.60.2 allows local attackers to launch arbitrary activity in GameHomeCN. |
CVE-2023-42573 | Medium | 4.7 | 2023-12-05 | PendingIntent hijacking vulnerability in Search Widget prior to version 3.4 in China models allows local attackers to access data. |
CVE-2023-42572 | Low | 3.3 | 2023-12-05 | Implicit intent hijacking vulnerability in Samsung Account Web SDK prior to version 1.5.24 allows attacker to get sensitive information. |
CVE-2023-42571 | High | 7.6 | 2023-12-05 | Abuse of remote unlock in Find My Mobile prior to version 7.3.13.4 allows physical attacker to unlock the device remotely by resetting the Samsung Account pass… |
CVE-2023-42570 | Medium | 5.9 | 2023-12-05 | Improper access control vulnerability in KnoxCustomManagerService prior to SMR Dec-2023 Release 1 allows attacker to access device SIM PIN. |
CVE-2023-42569 | Medium | 4.0 | 2023-12-05 | Improper authorization verification vulnerability in AR Emoji prior to SMR Dec-2023 Release 1 allows attackers to read sandbox data of AR Emoji. |
CVE-2023-42568 | High | 7.3 | 2023-12-05 | Improper access control vulnerability in SmartManagerCN prior to SMR Dec-2023 Release 1 allows local attackers to access arbitrary files with system privilege. |
CVE-2023-42567 | High | 7.3 | 2023-12-05 | Improper size check vulnerability in softsimd prior to SMR Dec-2023 Release 1 allows stack-based buffer overflow. |
CVE-2023-42566 | High | 7.3 | 2023-12-05 | Out-of-bound write vulnerability in libsavsvc prior to SMR Dec-2023 Release 1 allows local attackers to execute arbitrary code. |
CVE-2023-42565 | High | 7.3 | 2023-12-05 | Improper input validation vulnerability in Smart Clip prior to SMR Dec-2023 Release 1 allows local attackers with shell privilege to execute arbitrary code. |
CVE-2023-42564 | Medium | 6.6 | 2023-12-05 | Improper access control in knoxcustom service prior to SMR Dec-2023 Release 1 allows attacker to send broadcast with system privilege. |
CVE-2023-42563 | Medium | 6.7 | 2023-12-05 | Integer overflow vulnerability in landmarkCopyImageToNative of libFacePreProcessingjni.camera.samsung.so prior to SMR Dec-2023 Release 1 allows attacker to tri… |
CVE-2023-42562 | Medium | 6.7 | 2023-12-05 | Integer overflow vulnerability in detectionFindFaceSupportMultiInstance of libFacePreProcessingjni.camera.samsung.so prior to SMR Dec-2023 Release 1 allows att… |
CVE-2023-42561 | High | 7.1 | 2023-12-05 | Heap out-of-bounds write vulnerability in bootloader prior to SMR Dec-2023 Release 1 allows a physical attacker to execute arbitrary code. |
CVE-2023-42560 | High | 7.4 | 2023-12-05 | Heap out-of-bounds write vulnerability in dec_mono_audb of libsavsac.so prior to SMR Dec-2023 Release 1 allows an attacker to execute arbitrary code. |
CVE-2023-42559 | Medium | 4.9 | 2023-12-05 | Improper exception management vulnerability in Knox Guard prior to SMR Dec-2023 Release 1 allows Knox Guard lock bypass via changing system time. |
CVE-2023-42558 | Medium | 6.0 | 2023-12-05 | Out of bounds write vulnerability in HDCP in HAL prior to SMR Dec-2023 Release 1 allows attacker to perform code execution. |
CVE-2023-42557 | Medium | 5.6 | 2023-12-05 | Out-of-bound write vulnerability in libIfaaCa prior to SMR Dec-2023 Release 1 allows local system attackers to execute arbitrary code. |
CVE-2023-42556 | Low | 3.3 | 2023-12-05 | Improper usage of implicit intent in Contacts prior to SMR Dec-2023 Release 1 allows attacker to get sensitive information. |
CVE-2023-33107 | High | 8.4 | 2023-12-05 | Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call. |
CVE-2023-33106 | High | 8.4 | 2023-12-05 | Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND. |
CVE-2023-33098 | High | 7.5 | 2023-12-05 | Transient DOS while parsing WPA IES, when it is passed with length more than expected size. |
CVE-2023-33097 | High | 7.5 | 2023-12-05 | Transient DOS in WLAN Firmware while processing a FTMR frame. |
CVE-2023-33092 | High | 8.4 | 2023-12-05 | Memory corruption while processing pin reply in Bluetooth, when pin code received from APP layer is greater than expected size. |
CVE-2023-33089 | High | 7.5 | 2023-12-05 | Transient DOS when processing a NULL buffer while parsing WLAN vdev. |
CVE-2023-33088 | High | 8.4 | 2023-12-05 | Memory corruption when processing cmd parameters while parsing vdev. |
CVE-2023-33087 | High | 7.8 | 2023-12-05 | Memory corruption in Core while processing RX intent request. |
CVE-2023-33083 | Critical | 9.8 | 2023-12-05 | Memory corruption in WLAN Host while processing RRM beacon on the AP. |
CVE-2023-33082 | Critical | 9.8 | 2023-12-05 | Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE. |
CVE-2023-33081 | High | 7.5 | 2023-12-05 | Transient DOS while converting TWT (Target Wake Time) frame parameters in the OTA broadcast. |
CVE-2023-33080 | High | 7.5 | 2023-12-05 | Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame. |
CVE-2023-33079 | High | 7.8 | 2023-12-05 | Memory corruption in Audio while running invalid audio recording from ADSP. |
CVE-2023-33071 | High | 8.4 | 2023-12-05 | Memory corruption in Automotive OS whenever untrusted apps try to access HAb for graphics functionalities. |
CVE-2023-33070 | High | 7.1 | 2023-12-05 | Transient DOS in Automotive OS due to improper authentication to the secure IO calls. |
CVE-2023-33063 | High | 7.8 | 2023-12-05 | Memory corruption in DSP Services during a remote call from HLOS to DSP. |
CVE-2023-33054 | Critical | 9.1 | 2023-12-05 | Cryptographic issue in GPS HLOS Driver while downloading Qualcomm GNSS assistance data. |
CVE-2023-33053 | High | 8.4 | 2023-12-05 | Memory corruption in Kernel while parsing metadata. |
CVE-2023-33044 | High | 7.5 | 2023-12-05 | Transient DOS in Data modem while handling TLB control messages from the Network. |
CVE-2023-33043 | High | 7.5 | 2023-12-05 | Transient DOS in Modem when a Beam switch request is made with a non-configured BWP. |
CVE-2023-33042 | High | 7.5 | 2023-12-05 | Transient DOS in Modem after RRC Setup message is received. |
CVE-2023-33041 | High | 7.5 | 2023-12-05 | Under certain scenarios the WLAN Firmware will reach an assertion due to state confusion while looking up peer ids. |