CVE-2023-36xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
699 records · Page 1 of 7
The NextEPC MME <= 1.0.1 (fixed in commit a8492c9c5bc0a66c6999cb5a263545b32a4109df) contains a stack-based buffer overflow vulnerability in the Emergency Number List decoding method. An attacker may send a NAS message containing an oversized Emergency Number List value to the MME to overwrite the stack with arbitrary bytes. An attacker with a cellphone connection to any base station managed by the
UpdatedTravianZ through 8.3.4 allows XSS via the Alliance tag/name, the statistics page, the link preferences, the Admin Logs, or the COOKUSR cookie.
UpdatedIn TravianZ 8.3.4 and 8.3.3, Incorrect Access Control in the installation script allows an attacker to overwrite the server configuration and inject PHP code.
UpdatedThe cryptographically insecure random number generator being used in TravianZ 8.3.4 and 8.3.3 in the password reset function allows an attacker to guess the password reset.parameters and to take over accounts.
UpdatedPHP injection in TravianZ 8.3.4 and 8.3.3 in the config editor in the admin page allows remote attackers to execute PHP code.
UpdatedLavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure.
UpdatedLavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure.
UpdatedAn issue in Ethereum Blockchain v0.1.1+commit.6ff4cd6 cause the balance to be zeroed out when the value of betsize+casino.balance exceeds the threshold.
UpdatedA Cross-site scripting (XSS) vulnerability in CMS Made Simple v2.2.17 allows remote attackers to inject arbitrary web script or HTML via the File Upload function.
UpdatedCMS Made Simple v2.2.17 is vulnerable to Remote Command Execution via the File Upload Function.
UpdatedA SQL Injection vulnerability detected in Food Ordering System v1.0 allows attackers to run commands on the database by sending crafted SQL queries to the ID parameter.
UpdatedTOTOLINK CP300+ <=V5.2cu.7594_B20200910 was discovered to contain a stack overflow via the File parameter in the function UploadCustomModule.
Updated- CVE-2023-36954: TOTOLINK CP300+ V5.2cu.7594_B20200910 and before is vulnerable to command injection. Unscored
TOTOLINK CP300+ V5.2cu.7594_B20200910 and before is vulnerable to command injection.
Updated - CVE-2023-36953: TOTOLINK CP300+ V5.2cu.7594_B20200910 and before is vulnerable to command injection. Unscored
TOTOLINK CP300+ V5.2cu.7594_B20200910 and before is vulnerable to command injection.
Updated TOTOLINK CP300+ V5.2cu.7594_B20200910 was discovered to contain a stack overflow via the pingIp parameter in the function setDiagnosisCfg.
UpdatedTOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth.
UpdatedTOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the File parameter in the function UploadCustomModule.
UpdatedA cross-site scripting (XSS) vulnerability in PHPGurukul Online Fire Reporting System Using PHP and MySQL 1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the website title field.
UpdatedA cross-site scripting (XSS) vulnerability in PHPGurukul Online Fire Reporting System Using PHP and MySQL 1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the team name, leader, and member fields.
UpdatedCross Site Scripting (XSS) vulnerability in PHPGurukul Online Fire Reporting System Using PHP and MySQL v.1.2 allows attackers to execute arbitrary code via a crafted payload injected into the search field.
UpdatedCross-Site Scripting (XSS) vulnerability in Hostel Management System v2.1 allows an attacker to execute arbitrary code via a crafted payload to the search booking field.
UpdatedCross-Site Scripting (XSS) vulnerability in PHPGurukul Online Security Guards Hiring System using PHP and MySQL 1.0 allows attackers to execute arbitrary code via a crafted payload to the search booking box.
UpdatedDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Updated · Rejected recordIn Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to a MO
UpdatedIn Progress MOVEit Transfer before 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), it is possible for an attacker to invoke a method that results in an unhandled exception. Triggering this workflow can cause the MOVEit Transfer application to terminate unexpectedly.
UpdatedIn Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), multiple SQL injection vulnerabilities have been identified in the MOVEit Transfer web application that could allow an authenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload
UpdatedDue to missing authentication check in SAP Host Agent - version 7.22, an unauthenticated attacker can set an undocumented parameter to a particular compatibility value and in turn call read functions. This allows the attacker to gather some non-sensitive information about the server. There is no impact on integrity or availability.
UpdatedSAP Solution Manager (Diagnostics agent) - version 7.20, allows an unauthenticated attacker to blindly execute HTTP requests. On successful exploitation, the attacker can cause a limited impact on confidentiality and availability of the application and other applications the Diagnostics Agent can reach.
Updated- CVE-2023-36924: Log Injection vulnerability in SAP ERP Defense Forces and Public Security 4.9 Medium
While using a specific function, SAP ERP Defense Forces and Public Security - versions 600, 603, 604, 605, 616, 617, 618, 802, 803, 804, 805, 806, 807, allows an authenticated attacker with admin privileges to write arbitrary data to the syslog file. On successful exploitation, an attacker could modify all the syslog data causing a complete compromise of integrity of the application.
Updated SAP SQLA for PowerDesigner 17 bundled with SAP PowerDesigner 16.7 SP06 PL03, allows an attacker with local access to the system, to place a malicious library, that can be executed by the application. An attacker could thereby control the behavior of the application.
UpdatedDue to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary operating system command into an unprotected parameter in a common (default) extension. On successful exploitation, the attacker can read or modify the system data as well as shut down the system.
UpdatedSAP Solution Manager (Diagnostics agent) - version 7.20, allows an attacker to tamper with headers in a client request. This misleads SAP Diagnostics Agent to serve poisoned content to the server. On successful exploitation, the attacker can cause a limited impact on confidentiality and availability of the application.
UpdatedIn SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the X-FRAME-OPTIONS response header is not implemented, allowing an unauthenticated attacker to attempt clickjacking, which could result in disclosure or modification of information.
UpdatedIn SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the Referrer-Policy response header is not implemented, allowing an unauthenticated attacker to obtain referrer details, resulting in information disclosure.
UpdatedIn SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the X-Content-Type-Options response header is not implemented, allowing an unauthenticated attacker to trigger MIME type sniffing, which leads to Cross-Site Scripting, which could result in disclosure or modification of information.
UpdatedSAP BusinessObjects Business Intelligence Platform - version 420, 430, allows an unauthorized attacker who had hijacked a user session, to be able to bypass the victim’s old password via brute force, due to unrestricted rate limit for password change functionality. Although the attack has no impact on integrity loss or system availability, this could lead to an attacker to completely takeover a vi
UpdatedMultiple integer overflow vulnerabilities exist in the FST fstReaderIterBlocks2 chain_table allocation functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the allocation of the `chain_table_lengths` array.
UpdatedMultiple integer overflow vulnerabilities exist in the FST fstReaderIterBlocks2 chain_table allocation functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the allocation of the `chain_table` array.
Updated- CVE-2023-36914: Windows Smart Card Resource Management Server Security Feature Bypass Vulnerability 5.5 Medium
Windows Smart Card Resource Management Server Security Feature Bypass Vulnerability
Updated Microsoft Message Queuing Information Disclosure Vulnerability
UpdatedMicrosoft Message Queuing (MSMQ) Denial of Service Vulnerability
UpdatedMicrosoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
UpdatedMicrosoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
UpdatedMicrosoft Message Queuing (MSMQ) Denial of Service Vulnerability
UpdatedWindows Hyper-V Information Disclosure Vulnerability
UpdatedWindows Cryptographic Services Information Disclosure Vulnerability
UpdatedWindows Cryptographic Services Information Disclosure Vulnerability
UpdatedWindows Wireless Wide Area Network Service (WwanSvc) Information Disclosure Vulnerability
Updated- CVE-2023-36904: Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability 7.8 High
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Updated Windows System Assessment Tool Elevation of Privilege Vulnerability
UpdatedWindows Runtime Remote Code Execution Vulnerability
UpdatedWindows Common Log File System Driver Elevation of Privilege Vulnerability
UpdatedASP.NET Elevation of Privilege Vulnerability
Updated- CVE-2023-36898: Tablet Windows User Interface Application Core Remote Code Execution Vulnerability 7.8 High
Tablet Windows User Interface Application Core Remote Code Execution Vulnerability
Updated Visual Studio Tools for Office Runtime Spoofing Vulnerability
UpdatedMicrosoft Excel Remote Code Execution Vulnerability
UpdatedMicrosoft Outlook Remote Code Execution Vulnerability
UpdatedMicrosoft SharePoint Server Information Disclosure Vulnerability
UpdatedMicrosoft Outlook Spoofing Vulnerability
UpdatedMicrosoft SharePoint Server Spoofing Vulnerability
UpdatedMicrosoft SharePoint Server Spoofing Vulnerability
UpdatedMicrosoft SharePoint Server Information Disclosure Vulnerability
UpdatedWindows Group Policy Security Feature Bypass Vulnerability
UpdatedMicrosoft Edge for Android (Chromium-based) Tampering Vulnerability
UpdatedMicrosoft Edge (Chromium-based) Remote Code Execution Vulnerability
UpdatedMicrosoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
UpdatedWindows Search Remote Code Execution Vulnerability
UpdatedMicrosoft Edge for iOS Spoofing Vulnerability
Updated- CVE-2023-36882: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability 8.8 High
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Updated Azure Apache Ambari Spoofing Vulnerability
UpdatedMicrosoft Edge (Chromium-based) Information Disclosure Vulnerability
UpdatedMicrosoft Edge (Chromium-based) Security Feature Bypass Vulnerability
UpdatedAzure Apache Oozie Spoofing Vulnerability
UpdatedReliability Analysis Metrics Calculation (RacTask) Elevation of Privilege Vulnerability
UpdatedWindows Error Reporting Service Elevation of Privilege Vulnerability
Updated.NET Framework Spoofing Vulnerability
UpdatedVP9 Video Extensions Information Disclosure Vulnerability
UpdatedAzure Active Directory Security Feature Bypass Vulnerability
UpdatedAzure DevOps Server Spoofing Vulnerability
UpdatedAzure Service Fabric on Windows Information Disclosure Vulnerability
UpdatedVisual Studio Code GitHub Pull Requests and Issues Extension Remote Code Execution Vulnerability
UpdatedMicrosoft Office Visio Remote Code Execution Vulnerability
UpdatedMicrosoft Office Visio Remote Code Execution Vulnerability
UpdatedAn integer overflow vulnerability exists in the fstReaderIterBlocks2 temp_signal_value_buf allocation functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.
UpdatedThis CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
Updated · Rejected recordA downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS Ventura 13.5. An app may be able to determine a user’s current location.
UpdatedAn out-of-bounds write vulnerability exists in the VZT LZMA_read_varint functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.
UpdatedImproper input validation for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via network access.
UpdatedPiiGAB M-Bus SoftwarePack 900S does not correctly sanitize user input, which could allow an attacker to inject arbitrary commands.
UpdatedAn insufficient verification of data vulnerability exists in BIG-IP Edge Client for Windows and macOS that may allow an attacker to modify its configured server list. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Updated- CVE-2023-36857: Baker Hughes Bently Nevada 3500 System Authentication Bypass by Capture-replay 5.4 Medium
Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a replay vulnerability which could allow an attacker to replay older captured packets of traffic to the device to gain access.
Updated This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
Updated · Rejected recordThis CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
Updated · Rejected recordThe issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.8, macOS Ventura 13.5, macOS Big Sur 11.7.9. Processing a file may lead to unexpected app termination or arbitrary code execution.
UpdatedIn Keysight Geolocation Server v2.4.2 and prior, a low privileged attacker could create a local ZIP file containing a malicious script in any location. The attacker could abuse this to load a DLL with SYSTEM privileges.
UpdatedThis CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
Updated · Rejected recordA Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauth_operation.php that doesn't require authentication, an attacker is able to upload and download arbitrary files via J-Web, leading to a loss of integri
Updated- CVE-2023-36850: Junos OS: MX Series: An MPC will crash upon receipt of a malformed CFM packet. 6.5 Medium
An Improper Validation of Specified Index, Position, or Offset in Input vulnerability in the Connectivity Fault Management(CFM) module of Juniper Networks Junos OS on MX Series(except MPC10, MPC11 and LC9600) allows an adjacent attacker on the local broadcast domain to cause a Denial of Service(DoS). Upon receiving a malformed CFM packet, the MPC crashes. Continued receipt of these packets causes
Updated An Improper Check or Handling of Exceptional Conditions vulnerability in the Layer-2 control protocols daemon (l2cpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a Denial of Service (DoS). When a malformed LLDP packet is received, l2cpd will crash and restart. The impact of the l2cpd crash is reinitialization of STP protocols (RSTP, MSTP
Updated- CVE-2023-36848: Junos OS: MX Series: The FPC will crash on receiving a malformed CFM packet 6.5 Medium
An Improper Handling of Undefined Values vulnerability in the periodic packet management daemon (PPMD) of Juniper Networks Junos OS on MX Series(except MPC10, MPC11 and LC9600) allows an unauthenticated adjacent attacker to cause a Denial of Service (DoS). When a malformed CFM packet is received, it leads to an FPC crash. Continued receipt of these packets causes a sustained denial of service. Th
Updated