CVE-2023-23xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
684 records · Page 6 of 7
Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote attacker to influence the availability of the webserver by invocing several open file requests via the REST interface.
UpdatedImproper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote attacker to download files by using a therefore unpriviledged account via the REST interface.
UpdatedImproper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote attacker to gain unauthorized access to data fields by using a therefore unpriviledged account via the REST interface.
UpdatedMissing Authentication for Critical Function in SICK Flexi Classic and Flexi Soft Gateways with Partnumbers 1042193, 1042964, 1044078, 1044072, 1044073, 1044074, 1099830, 1099832, 1127717, 1069070, 1112296, 1051432, 1102420, 1127487, 1121596, 1121597 allows an unauthenticated remote attacker to influence the availability of the device by changing the IP settings of the device via broadcasted UDP p
Updated- CVE-2023-23443: CVE-2023-23443 4.6 Medium
Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.
Updated - CVE-2023-23442: CVE-2023-23442 4.6 Medium
Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.
Updated - CVE-2023-23441: CVE-2023-23441 6.0 Medium
Some Honor products are affected by out of bounds read vulnerability, successful exploitation could cause information leak.
Updated - CVE-2023-23440: CVE-2023-23440 3.3 Low
Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.
Updated - CVE-2023-23439: CVE-2023-23439 4.0 Medium
Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.
Updated - CVE-2023-23438: CVE-2023-23438 4.0 Medium
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions
Updated - CVE-2023-23437: CVE-2023-23437 3.3 Low
Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak
Updated - CVE-2023-23436: CVE-2023-23436 7.3 High
Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file
Updated - CVE-2023-23435: CVE-2023-23435 4.0 Medium
Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file
Updated - CVE-2023-23434: CVE-2023-23434 4.0 Medium
Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.
Updated - CVE-2023-23433: CVE-2023-23433 4.0 Medium
Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file.
Updated - CVE-2023-23432: CVE-2023-23432 7.3 High
Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file.
Updated - CVE-2023-23431: CVE-2023-23431 7.3 High
Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file.
Updated - CVE-2023-23430: CVE-2023-23430 3.3 Low
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.
Updated - CVE-2023-23429: CVE-2023-23429 4.0 Medium
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.
Updated - CVE-2023-23428: CVE-2023-23428 3.3 Low
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.
Updated - CVE-2023-23427: CVE-2023-23427 4.0 Medium
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.
Updated - CVE-2023-23426: CVE-2023-23426 6.6 Medium
Some Honor products are affected by file writing vulnerability, successful exploitation could cause information disclosure.
Updated - CVE-2023-23424: CVE-2023-23424 6.5 Medium
Some Honor products are affected by file writing vulnerability, successful exploitation could cause code execution
Updated Windows Kernel Elevation of Privilege Vulnerability
UpdatedWindows Kernel Elevation of Privilege Vulnerability
UpdatedWindows Kernel Elevation of Privilege Vulnerability
UpdatedWindows Kernel Elevation of Privilege Vulnerability
UpdatedWindows Resilient File System (ReFS) Elevation of Privilege Vulnerability
UpdatedWindows Resilient File System (ReFS) Elevation of Privilege Vulnerability
UpdatedWindows Partition Management Driver Elevation of Privilege Vulnerability
UpdatedWindows Cryptographic Services Remote Code Execution Vulnerability
Updated- CVE-2023-23415: Internet Control Message Protocol (ICMP) Remote Code Execution Vulnerability 9.8 Critical
Internet Control Message Protocol (ICMP) Remote Code Execution Vulnerability
Updated Windows Point-to-Point Protocol over Ethernet (PPPoE) Remote Code Execution Vulnerability
UpdatedMicrosoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
UpdatedWindows Accounts Picture Elevation of Privilege Vulnerability
UpdatedWindows Hyper-V Denial of Service Vulnerability
UpdatedWindows HTTP.sys Elevation of Privilege Vulnerability
Updated- CVE-2023-23409: Client Server Run-Time Subsystem (CSRSS) Information Disclosure Vulnerability 5.5 Medium
Client Server Run-Time Subsystem (CSRSS) Information Disclosure Vulnerability
Updated Azure Apache Ambari Spoofing Vulnerability
UpdatedWindows Point-to-Point Protocol over Ethernet (PPPoE) Remote Code Execution Vulnerability
UpdatedMicrosoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
UpdatedRemote Procedure Call Runtime Remote Code Execution Vulnerability
Updated- CVE-2023-23404: Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability 8.1 High
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
Updated Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
UpdatedWindows Media Remote Code Execution Vulnerability
UpdatedWindows Media Remote Code Execution Vulnerability
UpdatedWindows DNS Server Remote Code Execution Vulnerability
UpdatedMicrosoft Excel Remote Code Execution Vulnerability
UpdatedMicrosoft Excel Spoofing Vulnerability
UpdatedMicrosoft Outlook Elevation of Privilege Vulnerability
UpdatedMicrosoft Excel Denial of Service Vulnerability
UpdatedMicrosoft SharePoint Server Spoofing Vulnerability
Updated- CVE-2023-23394: Client Server Run-Time Subsystem (CSRSS) Information Disclosure Vulnerability 5.5 Medium
Client Server Run-Time Subsystem (CSRSS) Information Disclosure Vulnerability
Updated Windows BrokerInfrastructure Service Elevation of Privilege Vulnerability
UpdatedHTTP Protocol Stack Remote Code Execution Vulnerability
UpdatedOffice for Android Spoofing Vulnerability
Updated3D Builder Remote Code Execution Vulnerability
UpdatedMicrosoft Defender Elevation of Privilege Vulnerability
UpdatedWindows Bluetooth Driver Elevation of Privilege Vulnerability
UpdatedWindows Point-to-Point Protocol over Ethernet (PPPoE) Elevation of Privilege Vulnerability
UpdatedMicrosoft SQL Server Remote Code Execution Vulnerability
UpdatedService Fabric Explorer Spoofing Vulnerability
Updated- CVE-2023-23382: Azure Machine Learning Compute Instance Information Disclosure Vulnerability 6.5 Medium
Azure Machine Learning Compute Instance Information Disclosure Vulnerability
Updated Visual Studio Remote Code Execution Vulnerability
UpdatedMicrosoft Defender for IoT Elevation of Privilege Vulnerability
UpdatedPrint 3D Remote Code Execution Vulnerability
Updated3D Builder Remote Code Execution Vulnerability
UpdatedWindows Common Log File System Driver Elevation of Privilege Vulnerability
UpdatedMicrosoft ODBC and OLE DB Remote Code Execution Vulnerability
UpdatedMicrosoft Edge (Chromium-based) Remote Code Execution Vulnerability
Updated- CVE-2023-23373: QUSBCam2 8.8 High
An OS command injection vulnerability has been reported to affect QUSBCam2. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following version: QUSBCam2 2.0.3 ( 2023/06/15 ) and later
Updated - CVE-2023-23372: QTS, QuTS hero 6.5 Medium
A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to inject malicious code via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2425 build 20230609 and later QTS 5.1.0.2444 build 20230629 and later QTS 4.5.4.2467 build 20230718 and later QuTS hero h
Updated - CVE-2023-23371: QVPN Device Client 5.2 Medium
A cleartext transmission of sensitive information vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local authenticated administrators to read sensitive data via unspecified vectors. We have already fixed the vulnerability in the following version: QVPN Windows 2.2.0.0823 and later
Updated - CVE-2023-23370: QVPN Device Client 6.7 Medium
An insufficiently protected credentials vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local authenticated administrators to gain access to user accounts and access sensitive data used by the user account via unspecified vectors. We have already fixed the vulnerability in the following version: QVPN Windows 2.1.0.0518 and later
Updated An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: Multimedia Console 2.1.2 ( 2023/05/04 ) and later Multimedia Console 1.4.8 ( 2023/05/05 ) and later QTS 5.1.0.2399 build 20230515 and later Q
Updated- CVE-2023-23368: QTS, QuTS hero, QuTScloud 9.8 Critical
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build 20230421 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0.1.2376 build 20230421 and later QuTS hero h4.5
Updated - CVE-2023-23367: QTS, QuTS hero, QuTScloud 4.7 Medium
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build 20230421 and later QuTS hero h5.0.1.2376 build 20230421 and later QuTScloud c5.1.0.2498 and later
Updated - CVE-2023-23366: Music Station 7.7 High
A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow authenticated users to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following version: Music Station 5.3.22 and later
Updated - CVE-2023-23365: Music Station 7.7 High
A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow authenticated users to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following version: Music Station 5.3.22 and later
Updated - CVE-2023-23364: Multimedia Console 8.1 High
A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote users to execute code via unspecified vectors. We have already fixed the vulnerability in the following versions: Multimedia Console 2.1.1 ( 2023/03/29 ) and later Multimedia Console 1.4.7 ( 2023/03/20 ) and later
Updated - CVE-2023-23363: QTS 8.1 High
A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating system. If exploited, the vulnerability possibly allows remote users to execute code via unspecified vectors. We have already fixed the vulnerability in the following versions: QTS 4.3.6.2441 build 20230621 and later QTS 4.3.3.2420 build 20230621 and later QTS 4.2.6 build 20230621 and later QTS 4
Updated An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability allows remote authenticated users to execute commands via susceptible QNAP devices. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build 20230421 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0.1.2376 build 20230421 and later
Updated- CVE-2023-23357: QuLog Center 4.8 Medium
A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following versions: QuLog Center 1.5.0.738 ( 2023/03/06 ) and later QuLog Center 1.4.1.
Updated - CVE-2023-23356: QuFirewall 5.5 Medium
A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QuFirewall 2.3.3 ( 2023/03/27 ) and later and later
Updated An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote authenticated administrators to execute commands via unspecified vectors. QES is not affected. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2346 build 20230322 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5
Updated- CVE-2023-23354: QuLog Center 7.3 High
A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following versions: QuLog Center 1.5.0.738 ( 2023/03/06 ) and later QuLog Center 1.4.1.691 ( 202
Updated Kaspersky has fixed a security issue in Kaspersky Password Manager (KPM) for Windows that allowed a local user to recover the auto-filled credentials from a memory dump when the KPM extension for Google Chrome is used. To exploit the issue, an attacker must trick a user into visiting a login form of a website with the saved credentials, and the KPM extension must autofill these credentials. The at
UpdatedHCL Launch could disclose sensitive information if a manual edit of a configuration file has been performed.
UpdatedHCL DRYiCE iAutomate is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of sensitive information.
UpdatedHCL DRYiCE MyCloud is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of sensitive information.
Updated- CVE-2023-23344: HCL BigFix WebUI Insights is susceptible to a lack of sufficient authorization 3.0 Low
A permission issue in BigFix WebUI Insights site version 14 allows an authenticated, unprivileged operator to access an administrator page.
Updated A clickjacking vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower allows attacker to use transparent or opaque layers to trick a user into clicking on a button or link on another page to perform a redirect to an attacker-controlled domain.
UpdatedIf certain local files are manipulated in a certain manner, the validation to use the cryptographic keys can be circumvented.
UpdatedThere is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassing internal restrictions through downloader.php.
Updated- CVE-2023-23331: Amano Xoffice parking solutions 7.1.3879 is vulnerable to SQL Injection. 9.8 Critical
Amano Xoffice parking solutions 7.1.3879 is vulnerable to SQL Injection.
Updated amano Xparc parking solutions 7.1.3879 was discovered to be vulnerable to local file inclusion.
UpdatedA File Upload vulnerability exists in AvantFAX 3.3.7. An authenticated user can bypass PHP file type validation in FileUpload.php by uploading a specially crafted PHP file.
UpdatedAn Information Disclosure vulnerability exists in AvantFAX 3.3.7. Backups of the AvantFAX sent/received faxes, and database backups are stored using the current date as the filename and hosted on the web server without access controls.
UpdatedA Stored Cross-Site Scripting (XSS) vulnerability exists in AvantFAX 3.3.7. An authenticated low privilege user can inject arbitrary Javascript into their e-mail address which is executed when an administrator logs into AvantFAX to view the admin dashboard. This may result in stealing an administrator's session cookie and hijacking their session.
UpdatedZumtobel Netlink CCD Onboard 3.74 - Firmware 3.80 was discovered to contain a command injection vulnerability via the NetHostname parameter.
Updated