CVE-2023-21xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
960 records · Page 5 of 10
- CVE-2023-21576: Adobe Photoshop Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability 7.8 High
Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Updated - CVE-2023-21575: Adobe Photoshop Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability 7.8 High
Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Updated - CVE-2023-21574: Adobe Photoshop Improper Input Validation Remote Code Execution Vulnerability 7.8 High
Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Updated Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
UpdatedMicrosoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
UpdatedMicrosoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
UpdatedMicrosoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
UpdatedAzure DevOps Server Spoofing Vulnerability
UpdatedMicrosoft SQL Server Integration Service (VS extension) Remote Code Execution Vulnerability
UpdatedVisual Studio Denial of Service Vulnerability
UpdatedVisual Studio Elevation of Privilege Vulnerability
UpdatedAzure DevOps Server Spoofing Vulnerability
UpdatedAzure DevOps Server Cross-Site Scripting Vulnerability
UpdatedBitLocker Security Feature Bypass Vulnerability
UpdatedMicrosoft Cryptographic Services Elevation of Privilege Vulnerability
UpdatedWindows Boot Manager Security Feature Bypass Vulnerability
UpdatedWindows Cryptographic Information Disclosure Vulnerability
UpdatedWindows Error Reporting Service Elevation of Privilege Vulnerability
Updated- CVE-2023-21557: Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability 7.5 High
Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability
Updated - CVE-2023-21556: Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability 8.1 High
Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability
Updated - CVE-2023-21555: Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability 8.1 High
Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability
Updated Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
UpdatedAzure DevOps Server Remote Code Execution Vulnerability
UpdatedWindows GDI Elevation of Privilege Vulnerability
UpdatedMicrosoft Cryptographic Services Elevation of Privilege Vulnerability
UpdatedWindows Cryptographic Information Disclosure Vulnerability
UpdatedWindows SMB Witness Service Elevation of Privilege Vulnerability
Updated- CVE-2023-21548: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability 8.1 High
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Updated Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability
Updated- CVE-2023-21546: Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability 8.1 High
Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability
Updated - CVE-2023-21543: Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability 8.1 High
Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability
Updated Windows Installer Elevation of Privilege Vulnerability
UpdatedWindows Task Scheduler Elevation of Privilege Vulnerability
UpdatedWindows Cryptographic Information Disclosure Vulnerability
UpdatedWindows Authentication Remote Code Execution Vulnerability
Updated.NET Denial of Service Vulnerability
UpdatedMicrosoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability
UpdatedEvent Tracing for Windows Information Disclosure Vulnerability
Updated- CVE-2023-21535: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability 8.1 High
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Updated Windows GDI Elevation of Privilege Vulnerability
UpdatedAzure Service Fabric Container Elevation of Privilege Vulnerability
UpdatedMicrosoft Exchange Server Remote Code Execution Vulnerability
UpdatedMicrosoft SQL Server Remote Code Execution Vulnerability
UpdatedWindows iSCSI Service Denial of Service Vulnerability
UpdatedWindows Netlogon Information Disclosure Vulnerability
UpdatedRemote Procedure Call Runtime Denial of Service Vulnerability
Updated- CVE-2023-21524: Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability 7.8 High
Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability
Updated - CVE-2023-21523: CVE-2023-21523 Unscored
A Stored Cross-site Scripting (XSS) vulnerability in the Management Console (User Management and Alerts) of BlackBerry AtHoc version 7.15 could allow an attacker to execute script commands in the context of the affected user account.
Updated - CVE-2023-21522: CVE-2023-21522 Unscored
A Reflected Cross-site Scripting (XSS) vulnerability in the Management Console (Reports) of BlackBerry AtHoc version 7.15 could allow an attacker to potentially control a script that is executed in the victim's browser then they can execute script commands in the context of the affected user account.
Updated - CVE-2023-21521: CVE-2023-21521 Unscored
An SQL Injection vulnerability in the Management Console (Operator Audit Trail) of BlackBerry AtHoc version 7.15 could allow an attacker to potentially read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database, recover the content of a given file present on the DBMS file system and in some cases issue commands to the ope
Updated - CVE-2023-21520: CVE-2023-21520 Unscored
A PII Enumeration via Credential Recovery in the Self Service (Credential Recovery) of BlackBerry AtHoc version 7.15 could allow an attacker to potentially associate a list of contact details with an AtHoc IWS organization.
Updated Improper access control vulnerability in SearchWidget prior to version 3.3 in China models allows untrusted applications to start arbitrary activity.
UpdatedHeap out-of-bound write vulnerability in Exynos baseband prior to SMR Jun-2023 Release 1 allows remote attacker to execute arbitrary code.
UpdatedXSS vulnerability from InstantPlay in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from Galaxy Store.
UpdatedInstantPlay which included vulnerable script which could execute javascript in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from Galaxy Store.
UpdatedImproper scheme validation from InstantPlay Deeplink in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from Galaxy Store.
UpdatedImproper privilege management vulnerability in CC Mode prior to SMR Jun-2023 Release 1 allows physical attackers to manipulate device to operate in way that results in unexpected behavior in CC Mode under specific condition.
UpdatedImproper Knox ID validation logic in notification framework prior to SMR Jun-2023 Release 1 allows local attackers to read work profile notifications without proper access permission.
UpdatedOut-of-bounds Read vulnerability while processing CMD_COLDWALLET_BTC_SET_PRV_UTXO in bc_core trustlet from Samsung Blockchain Keystore prior to version 1.3.12.1 allows local attacker to read arbitrary memory.
UpdatedOut-of-bounds Read vulnerability while processing BC_TUI_CMD_UPDATE_SCREEN in bc_tui trustlet from Samsung Blockchain Keystore prior to version 1.3.12.1 allows local attacker to read arbitrary memory.
UpdatedOut-of-bounds Write vulnerability while processing BC_TUI_CMD_UPDATE_SCREEN in bc_tui trustlet from Samsung Blockchain Keystore prior to version 1.3.12.1 allows local attacker to execute arbitrary code.
UpdatedOut-of-bounds Write vulnerability while processing BC_TUI_CMD_SEND_RESOURCE_DATA command in bc_tui trustlet from Samsung Blockchain Keystore prior to version 1.3.12.1 allows local attacker to execute arbitrary code.
UpdatedOut-of-bounds Read vulnerability while processing BC_TUI_CMD_SEND_RESOURCE_DATA_ARRAY command in bc_tui trustlet from Samsung Blockchain Keystore prior to version 1.3.12.1 allows local attacker to read arbitrary memory.
UpdatedOut-of-bounds Write vulnerability while processing BC_TUI_CMD_SEND_RESOURCE_DATA_ARRAY command in bc_tui trustlet from Samsung Blockchain Keystore prior to version 1.3.12.1 allows local attacker to execute arbitrary code.
UpdatedImproper access control in Samsung Core Service prior to version 2.1.00.36 allows attacker to write arbitrary file in sandbox.
UpdatedPotential buffer overflow vulnerability in mm_Plmncoordination.c in Shannon baseband prior to SMR May-2023 Release 1 allows remote attackers to cause invalid memory access.
UpdatedPotential buffer overflow vulnerability in mm_LteInterRatManagement.c in Shannon baseband prior to SMR May-2023 Release 1 allows remote attackers to cause invalid memory access.
UpdatedImproper input validation vulnerability in FactoryTest application prior to SMR May-2023 Release 1 allows local attackers to get privilege escalation via debugging commands.
UpdatedImproper input validation vulnerability in mPOS fiserve trustlet prior to SMR May-2023 Release 1 allows local attackers to execute arbitrary code.
UpdatedDouble free validation vulnerability in setPinPadImages in mPOS TUI trustlet prior to SMR May-2023 Release 1 allows local attackers to access the trustlet memory.
UpdatedOut-of-bounds write vulnerability in TA_Communication_mpos_encrypt_pin in mPOS TUI trustlet prior to SMR May-2023 Release 1 allows local attackers to execute arbitrary code.
UpdatedImproper input validation vulnerability in setPartnerTAInfo in mPOS TUI trustlet prior to SMR May-2023 Release 1 allows local attackers to overwrite the trustlet memory.
UpdatedUse of externally-controlled format string vulnerability in mPOS TUI trustlet prior to SMR May-2023 Release 1 allows local attackers to access the memory address.
UpdatedActive Debug Code vulnerability in ActivityManagerService prior to SMR May-2023 Release 1 allows attacker to use debug function via setting debug level.
UpdatedImproper access control vulnerability in Knox Enrollment Service prior to SMR May-2023 Release 1 allow attacker install KSP app when device admin is set.
UpdatedPotential buffer overflow vulnerability in auth api in mm_Authentication.c in Shannon baseband prior to SMR May-2023 Release 1 allows remote attackers to cause invalid memory access.
UpdatedImproper access control vulnerability in SemShareFileProvider prior to SMR May-2023 Release 1 allows local attackers to access protected data.
UpdatedKernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR.
UpdatedImproper access control vulnerability in ThemeManager prior to SMR May-2023 Release 1 allows local attackers to write arbitrary files with system privilege.
UpdatedImproper access control in GearManagerStub prior to SMR May-2023 Release 1 allows a local attacker to delete applications installed by watchmanager.
UpdatedHeap out-of-bounds write vulnerability in bootloader prior to SMR May-2023 Release 1 allows a physical attacker to execute arbitrary code.
UpdatedImproper access control vulnerablility in Tips prior to SMR May-2023 Release 1 allows local attackers to launch arbitrary activity in Tips.
UpdatedImproper access control vulnerability in Telephony framework prior to SMR May-2023 Release 1 allows local attackers to change a call setting.
UpdatedImproper export of android application components vulnerability in ImagePreviewActivity in Call Settings to SMR May-2023 Release 1 allows physical attackers to access some media data stored in sandbox.
UpdatedImproper export of android application components vulnerability in VideoPreviewActivity in Call Settings to SMR May-2023 Release 1 allows physical attackers to access some media data stored in sandbox.
UpdatedImproper access control vulnerability in AppLock prior to SMR May-2023 Release 1 allows local attackers without proper permission to execute a privileged operation.
UpdatedImproper Access Control vulnerability in Galaxy Store prior to version 4.5.53.6 allows local attacker to access protected data using exported service.
UpdatedMissing authorization vulnerability in Camera prior to versions 11.1.02.18 in Android 11, 12.1.03.8 in Android 12 and 13.1.01.4 in Android 13 allows physical attackers to install package through Galaxy store before completion of Setup wizard.
UpdatedImproper URL input validation vulnerability in Samsung Account application prior to version 14.1.0.0 allows remote attackers to get sensitive information.
UpdatedImproper input validation vulnerability in CertByte prior to SMR Apr-2023 Release 1 allows local attackers to launch privileged activities.
UpdatedImproper authorization in Smart suggestions prior to SMR Apr-2023 Release 1 in Android 13 and 4.1.01.0 in Android 12 allows remote attackers to register a schedule.
UpdatedImproper input validation vulnerability in TIGERF trustlet prior to SMR Apr-2023 Release 1 allows local attackers to access protected data.
UpdatedAccess of Memory Location After End of Buffer vulnerability in TIGERF trustlet prior to SMR Apr-2023 Release 1 allows local attackers to access protected data.
UpdatedOut-of-bounds Write vulnerability in libaudiosaplus_sec.so library prior to SMR Apr-2023 Release 1 allows local attacker to execute arbitrary code.
UpdatedOut-of-bounds Write vulnerability in libaudiosaplus_sec.so library prior to SMR Apr-2023 Release 1 allows local attacker to execute arbitrary code.
UpdatedIntent redirection vulnerability in SecSettings prior to SMR Apr-2022 Release 1 allows attackers to access arbitrary file with system privilege.
UpdatedImproper input validation with Exynos Fastboot USB Interface prior to SMR Apr-2023 Release 1 allows a physical attacker to execute arbitrary code in bootloader.
UpdatedImproper input validation with Exynos Fastboot USB Interface prior to SMR Apr-2023 Release 1 allows a physical attacker to execute arbitrary code in bootloader.
UpdatedImproper access control vulnerability in SemClipboard prior to SMR Apr-2023 Release 1 allows attackers to read arbitrary files with system permission.
UpdatedImproper access control vulnerability in SLocation prior to SMR Apr-2022 Release 1 allows local attackers to get device location information using com.samsung.android.wifi.NETWORK_LOCATION action.
Updated