2023 CVEs (page 99)
Page 99 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-42686 | High | 7.8 | 2023-12-04 | In wifi service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed |
CVE-2023-42685 | High | 7.8 | 2023-12-04 | In wifi service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed |
CVE-2023-42684 | Medium | 4.4 | 2023-12-04 | In gsp driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privilege… |
CVE-2023-42683 | Medium | 4.4 | 2023-12-04 | In gsp driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privilege… |
CVE-2023-42682 | Medium | 4.4 | 2023-12-04 | In gsp driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileg… |
CVE-2023-42681 | High | 7.8 | 2023-12-04 | In ion service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed |
CVE-2023-42680 | Medium | 4.4 | 2023-12-04 | In gpu driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privilege… |
CVE-2023-42679 | Medium | 4.4 | 2023-12-04 | In gpu driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileg… |
CVE-2023-42678 | Medium | 5.5 | 2023-12-04 | In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disc… |
CVE-2023-42677 | Medium | 5.5 | 2023-12-04 | In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disc… |
CVE-2023-42676 | Medium | 5.5 | 2023-12-04 | In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disc… |
CVE-2023-42675 | Medium | 5.5 | 2023-12-04 | In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disc… |
CVE-2023-42674 | Medium | 5.5 | 2023-12-04 | In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disc… |
CVE-2023-42673 | Medium | 5.5 | 2023-12-04 | In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disc… |
CVE-2023-42672 | Medium | 5.5 | 2023-12-04 | In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disc… |
CVE-2023-42671 | Medium | 5.5 | 2023-12-04 | In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disc… |
CVE-2023-38003 | High | 7.2 | 2023-12-04 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 could allow a user with DATAACCESS privileges to execute routines that t… |
CVE-2023-40692 | Medium | 5.9 | 2023-12-04 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, 11.5 is vulnerable to denial of service under extreme stress conditions. IBM X-F… |
CVE-2023-49948 | Medium | 5.3 | 2023-12-03 | Forgejo before 1.20.5-1 allows remote attackers to test for the existence of private user accounts by appending .rss (or another extension) to a URL. |
CVE-2023-49947 | High | 7.5 | 2023-12-03 | Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication. |
CVE-2023-49946 | Critical | 9.1 | 2023-12-03 | In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which permissions are being checked. This allows remot… |
CVE-2023-45178 | Medium | 6.5 | 2023-12-03 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 CLI is vulnerable to a denial of service when a specially crafted request is used. IBM… |
CVE-2023-49926 | Medium | 6.1 | 2023-12-03 | app/Lib/Tools/EventTimelineTool.php in MISP before 2.4.179 allows XSS in the event timeline widget. |
CVE-2023-6474 | Medium | 4.3 | 2023-12-03 | A vulnerability has been found in PHPGurukul Nipah Virus Testing Management System 1.0 and classified as problematic. This vulnerability affects unknown code o… |
CVE-2023-6473 | Low | 3.5 | 2023-12-02 | A vulnerability, which was classified as problematic, was found in SourceCodester Online Quiz System 1.0. This affects an unknown part of the file take-quiz.ph… |
CVE-2023-6472 | Low | 2.4 | 2023-12-02 | A vulnerability, which was classified as problematic, has been found in PHPEMS 7.0. This issue affects some unknown processing of the file app\content\cls\api… |
CVE-2023-6467 | Low | 3.1 | 2023-12-02 | A vulnerability was found in Thecosy IceCMS 2.0.1. It has been rated as problematic. This issue affects some unknown processing of the file /Websquare/likeClic… |
CVE-2023-6466 | Low | 3.5 | 2023-12-02 | A vulnerability was found in Thecosy IceCMS 2.0.1. It has been declared as problematic. This vulnerability affects unknown code of the file /planet of the comp… |
CVE-2023-6465 | Medium | 4.3 | 2023-12-02 | A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0. It has been classified as problematic. This affects an unknown part of the f… |
CVE-2023-6464 | Medium | 6.3 | 2023-12-02 | A vulnerability was found in SourceCodester User Registration and Login System 1.0 and classified as critical. Affected by this issue is some unknown functiona… |
CVE-2023-39257 | High | 7.3 | 2023-12-02 | Dell Rugged Control Center, version prior to 4.7, contains an Improper Access Control vulnerability. A local malicious standard user could potentially exploit… |
CVE-2023-39256 | High | 7.3 | 2023-12-02 | Dell Rugged Control Center, version prior to 4.7, contains an improper access control vulnerability. A local malicious standard user could potentially exploit… |
CVE-2023-49914 | Medium | 6.5 | 2023-12-02 | InteraXon Muse 2 devices allow remote attackers to cause a denial of service (incorrect Muse App report of an outstanding, calm meditation state) via a 480 MHz… |
CVE-2023-6463 | Low | 3.5 | 2023-12-01 | A vulnerability has been found in SourceCodester User Registration and Login System 1.0 and classified as problematic. Affected by this vulnerability is an unk… |
CVE-2023-48887 | Critical | 9.8 | 2023-12-01 | A deserialization vulnerability in Jupiter v1.3.1 allows attackers to execute arbitrary commands via sending a crafted RPC request. |
CVE-2023-48886 | Critical | 9.8 | 2023-12-01 | A deserialization vulnerability in NettyRpc v1.2 allows attackers to execute arbitrary commands via sending a crafted RPC request. |
CVE-2023-48801 | Critical | 9.8 | 2023-12-01 | In TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, the shttpd file sub_415534 function obtains fields from the front-end, connects them through the snprintf f… |
CVE-2023-6462 | Low | 3.5 | 2023-12-01 | A vulnerability, which was classified as problematic, was found in SourceCodester User Registration and Login System 1.0. Affected is an unknown function of th… |
CVE-2023-49281 | Medium | 4.7 | 2023-12-01 | Calendarinho is an open source calendaring application to manage large teams of consultants. An Open Redirect issue occurs when a web application redirects use… |
CVE-2023-49276 | Medium | 6.3 | 2023-12-01 | Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Injection leading to Cr… |
CVE-2023-48314 | High | 7.1 | 2023-12-01 | Collabora Online is a collaborative online office suite based on LibreOffice technology. Users of Nextcloud with Collabora Online Built-in CODE Server app can… |
CVE-2023-46746 | Medium | 4.8 | 2023-12-01 | PostHog provides open-source product analytics, session recording, feature flagging and A/B testing that you can self-host. A server-side request forgery (SSRF… |
CVE-2023-44402 | Medium | 6.1 | 2023-12-01 | Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. This only impacts apps that have the `embe… |
CVE-2023-44382 | Critical | 9.1 | 2023-12-01 | October is a Content Management System (CMS) and web platform to assist with development workflow. An authenticated backend user with the `editor.cms_pages`, `… |
CVE-2023-44381 | Medium | 4.9 | 2023-12-01 | October is a Content Management System (CMS) and web platform to assist with development workflow. An authenticated backend user with the `editor.cms_pages`, `… |
CVE-2023-49277 | High | 8.3 | 2023-12-01 | dpaste is an open source pastebin application written in Python using the Django framework. A security vulnerability has been identified in the expires paramet… |
CVE-2023-46174 | Medium | 5.4 | 2023-12-01 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2023-43021 | Medium | 5.3 | 2023-12-01 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in th… |
CVE-2023-42022 | Medium | 5.4 | 2023-12-01 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2023-42019 | Medium | 5.9 | 2023-12-01 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to cause a denial of service due to improper input validation. IBM X-Force ID: 265161… |
CVE-2023-42009 | Medium | 5.4 | 2023-12-01 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2023-40699 | High | 7.5 | 2023-12-01 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to cause a denial of service due to improper input validation. IBM X-Force ID: 265161… |
CVE-2023-43015 | Medium | 5.4 | 2023-12-01 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2023-38268 | Medium | 4.3 | 2023-12-01 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions… |
CVE-2023-26024 | Medium | 6.5 | 2023-12-01 | IBM Planning Analytics on Cloud Pak for Data 4.0 could allow an attacker on a shared network to obtain sensitive information caused by insecure network communi… |
CVE-2023-42006 | High | 8.4 | 2023-12-01 | IBM Administration Runtime Expert for i 7.2, 7.3, 7.4, and 7.5 could allow a local user to obtain sensitive information caused by improper authority checks. I… |
CVE-2023-48893 | High | 8.8 | 2023-12-01 | SLiMS (aka SENAYAN Library Management System) through 9.6.1 allows admin/modules/reporting/customs/staff_act.php SQL Injection via startDate or untilDate. |
CVE-2023-48842 | Critical | 9.8 | 2023-12-01 | D-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter at hedwig.cgi. |
CVE-2023-48813 | High | 8.8 | 2023-12-01 | Senayan Library Management Systems (Slims) 9 Bulian v9.6.1 is vulnerable to SQL Injection via admin/modules/reporting/customs/fines_report.php. |
CVE-2023-4518 | Medium | 6.5 | 2023-12-01 | A vulnerability exists in the input validation of the GOOSE messages where out of range values received and processed by the IED caused a reboot of the devic… |
CVE-2023-49371 | Critical | 9.8 | 2023-12-01 | RuoYi up to v4.6 was discovered to contain a SQL injection vulnerability via /system/dept/edit. |
CVE-2023-45168 | High | 8.4 | 2023-12-01 | IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout command to execute arbitrary commands. IBM X… |
CVE-2023-6461 | Medium | 6.1 | 2023-12-01 | Cross-site Scripting (XSS) - Reflected in GitHub repository viliusle/minipaint prior to 4.14.0. |
CVE-2023-5637 | High | 7.5 | 2023-12-01 | Unrestricted Upload of File with Dangerous Type vulnerability in ArslanSoft Education Portal allows Read Sensitive Strings Within an Executable. This issue af… |
CVE-2023-5636 | Critical | 9.8 | 2023-12-01 | Unrestricted Upload of File with Dangerous Type vulnerability in ArslanSoft Education Portal allows Command Injection. This issue affects Education Portal: be… |
CVE-2023-5635 | High | 7.5 | 2023-12-01 | Improper Protection for Outbound Error Messages and Alert Signals vulnerability in ArslanSoft Education Portal allows Account Footprinting. This issue affects… |
CVE-2023-5634 | Critical | 9.8 | 2023-12-01 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ArslanSoft Education Portal allows SQL Injection. This i… |
CVE-2023-28896 | Low | 3.3 | 2023-12-01 | Access to critical Unified Diagnostics Services (UDS) of the Modular Infotainment Platform 3 (MIB3) infotainment is transmitted via Controller Area Network (CA… |
CVE-2023-28895 | Low | 3.5 | 2023-12-01 | The password for access to the debugging console of the PoWer Controller chip (PWC) of the MIB3 infotainment is hard-coded in the firmware. The console allows… |
CVE-2023-6449 | Medium | 6.6 | 2023-12-01 | The Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'validate' function and insuffi… |
CVE-2023-5427 | High | 7.8 | 2023-12-01 | Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows… |
CVE-2023-6033 | High | 8.7 | 2023-12-01 | Improper neutralization of input in Jira integration configuration in GitLab CE/EE, affecting all versions from 15.10 prior to 16.6.1, 16.5 prior to 16.5.3, an… |
CVE-2023-5995 | Medium | 4.4 | 2023-12-01 | An issue has been discovered in GitLab EE affecting all versions starting from 16.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions… |
CVE-2023-5915 | Medium | 5.3 | 2023-12-01 | A vulnerability of Uncontrolled Resource Consumption has been identified in STARDOM provided by Yokogawa Electric Corporation. This vulnerability may allow to… |
CVE-2023-5226 | Medium | 4.8 | 2023-12-01 | An issue has been discovered in GitLab affecting all versions before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 bef… |
CVE-2023-4912 | Low | 2.6 | 2023-12-01 | An issue has been discovered in GitLab EE affecting all versions starting from 10.5 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions… |
CVE-2023-4658 | Low | 3.1 | 2023-12-01 | An issue has been discovered in GitLab EE affecting all versions starting from 8.13 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions… |
CVE-2023-4317 | Medium | 4.3 | 2023-12-01 | An issue has been discovered in GitLab affecting all versions starting from 9.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions star… |
CVE-2023-3964 | Medium | 4.3 | 2023-12-01 | An issue has been discovered in GitLab affecting all versions starting from 13.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions sta… |
CVE-2023-3949 | Medium | 5.3 | 2023-12-01 | An issue has been discovered in GitLab affecting all versions starting from 11.3 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions sta… |
CVE-2023-3443 | Low | 3.1 | 2023-12-01 | An issue has been discovered in GitLab affecting all versions starting from 12.1 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions sta… |
CVE-2023-45253 | High | 7.8 | 2023-12-01 | An issue was discovered in Huddly HuddlyCameraService before version 8.0.7, not including version 7.99, allows attackers to manipulate files and escalate privi… |
CVE-2023-45252 | High | 7.8 | 2023-12-01 | DLL Hijacking vulnerability in Huddly HuddlyCameraService before version 8.0.7, not including version 7.99, due to the installation of the service in a directo… |
CVE-2023-48016 | High | 7.5 | 2023-12-01 | Restaurant Table Booking System V1.0 is vulnerable to SQL Injection in rtbs/admin/index.php via the username parameter. |
CVE-2023-43455 | Critical | 9.8 | 2023-12-01 | An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the command parameter of t… |
CVE-2023-43454 | Critical | 9.8 | 2023-12-01 | An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the hostName parameter of… |
CVE-2023-43453 | Critical | 9.8 | 2023-12-01 | An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the IP parameter of the se… |
CVE-2023-43089 | Medium | 4.4 | 2023-12-01 | Dell Rugged Control Center, version prior to 4.7, contains insufficient protection for the Policy folder. A local malicious standard user could potentially ex… |
CVE-2023-47307 | High | 7.5 | 2023-11-30 | Buffer Overflow vulnerability in /apply.cgi in Shenzhen Libituo Technology Co., Ltd LBT-T300-T310 v2.2.2.6 allows attackers to cause a denial of service via th… |
CVE-2023-47279 | High | 7.5 | 2023-11-30 | In Delta Electronics InfraSuite Device Master v.1.0.7, A vulnerability exists that allows an unauthenticated attacker to disclose user information through a si… |
CVE-2023-46956 | High | 7.2 | 2023-11-30 | SQL injection vulnerability in Packers and Movers Management System v.1.0 allows a remote attacker to execute arbitrary code via crafted payload to the /mpms/a… |
CVE-2023-46389 | High | 7.5 | 2023-11-30 | LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Incorrect Access Control via registry.xml file. This vulnerability allow… |
CVE-2023-46388 | High | 7.5 | 2023-11-30 | LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Insecure Permissions via dpal_config.zml file. This vulnerability allows… |
CVE-2023-46387 | High | 7.5 | 2023-11-30 | LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Incorrect Access Control via dpal_config.zml file. This vulnerability al… |
CVE-2023-46386 | High | 7.5 | 2023-11-30 | LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Insecure Permissions via registry.xml file. This vulnerability allows re… |
CVE-2023-46385 | High | 7.5 | 2023-11-30 | LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions. An admin credential is passed as a value of URL parameters with… |
CVE-2023-46384 | High | 7.5 | 2023-11-30 | LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions. Cleartext storage of credentials allows remote attackers to dis… |
CVE-2023-46383 | High | 7.5 | 2023-11-30 | LOYTEC electronics GmbH LINX Configurator (all versions) uses HTTP Basic Authentication, which transmits usernames and passwords in base64-encoded cleartext an… |
CVE-2023-46326 | High | 8.8 | 2023-11-30 | ZStack Cloud version 3.10.38 and before allows unauthenticated API access to the list of active job UUIDs and the session ID for each of these. This leads to p… |
CVE-2023-42917 | High | 8.8 | 2023-11-30 | A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2… |