CVE-2023-36xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
699 records · Page 7 of 7
Buffer Overflow vulnerability in OpenImageIO v.2.4.12.0 and before allows a remote to execute arbitrary code and obtain sensitive information via a crafted file to the readimg function.
UpdatedAn issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute arbitrary code and gain sensitive information via crafted request in JSON-RPC-API.
UpdatedDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Updated · Rejected recordDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Updated · Rejected recordDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Updated · Rejected recordDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Updated · Rejected recordDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Updated · Rejected recordDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Updated · Rejected recordCross Site Scripting vulnerability in IP-DOT BuildaGate v.BuildaGate5 allows a remote attacker to execute arbitrary code via a crafted script to the mc parameter of the URL.
UpdatedCross Site Request Forgery vulnerability in ZZCMS v.2023 and earlier allows a remote attacker to gain privileges via the add function in adminlist.php.
UpdatedAn issue was discovered in Qubo Smart Plug 10A version HSP02_01_01_14_SYSTEM-10A, allows attackers to cause a denial of service (DoS) via Wi-Fi deauthentication.
UpdatedAn issue was discovered in Qubo Smart Plug10A version HSP02_01_01_14_SYSTEM-10 A, allows local attackers to gain sensitive information and other unspecified impact via UART console.
UpdatedCross Site Scripting (XSS) vulnerability in sourcecodester Lost and Found Information System 1.0 allows remote attackers to run arbitrary code via the First Name, Middle Name and Last Name fields on the Create User page.
UpdatedCross Site Scripting (XSS) vulnerability in sourcecodester Toll Tax Management System 1.0 allows remote attackers to run arbitrary code via the First Name and Last Name fields on the My Account page.
UpdatedA Stored Cross-Site Scripting (XSS) vulnerability was found in Multilaser RE 170 using firmware 2.2.6733.
UpdatedAn authentication bypass in Intelbras Switch SG 2404 MR in firmware 1.00.54 allows an unauthenticated attacker to download the backup file of the device, exposing critical information about the device configuration.
UpdatedMaxprint Maxlink 1200G v3.4.11E has an OS command injection vulnerability in the "Diagnostic tool" functionality of the device.
UpdatedUser enumeration is found in in PHPJabbers Cleaning Business Software 1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
UpdatedIn PHPJabbers Cleaning Business Software 1.0, there is no encryption on user passwords allowing an attacker to gain access to all user accounts.
UpdatedIn PHPJabbers Cleaning Business Software 1.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take over accounts.
UpdatedPHPJabbers Cleaning Business Software 1.0 is vulnerable to Cross Site Scripting (XSS) via the theme parameter of preview.php.
UpdatedThere is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Class Scheduling System 1.0.
UpdatedPHPJabbers Class Scheduling System 1.0 lacks encryption on the password when editing a user account (update user page) allowing an attacker to capture all user names and passwords in clear text.
UpdatedUser enumeration is found in in PHPJabbers Class Scheduling System v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
UpdatedIn PHP Jabbers Class Scheduling System 1.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take over accounts.
UpdatedPHPJabbers Availability Booking Calendar 5.0 is vulnerable to User Account Takeover through username/password change.
UpdatedPHP Jabbers Availability Booking Calendar 5.0 is vulnerable to Incorrect Access Control.
UpdatedPHPJabbers Availability Booking Calendar 5.0 is vulnerable to Incorrect Access Control due to improper input validation of password parameter.
UpdatedUser enumeration is found in in PHPJabbers Appointment Scheduler 3.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
UpdatedThere is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Appointment Scheduler v3.0
UpdatedDirectory Traversal vulnerability in Hex-Dragon Plain Craft Launcher 2 version Alpha 1.3.9, allows local attackers to execute arbitrary code and gain sensitive information.
UpdatedCross Site Scripting vulnerability in e107 v.2.3.2 allows a remote attacker to execute arbitrary code via the description function in the SEO project.
UpdatedDO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Updated · Rejected recordDO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Updated · Rejected recordCross Site Scripting vulnerability in Faculty Evaulation System using PHP/MySQLi v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the page parameter.
UpdatedBuffer Overflow vulnerability in JerryScript version 3.0, allows remote attackers to execute arbitrary code via ecma_stringbuilder_append_raw component at /jerry-core/ecma/base/ecma-helpers-string.c.
UpdatedAn incorrect access control vulnerability in powerjob 4.3.2 and earlier allows remote attackers to obtain sensitive information via the interface for querying via appId parameter to /container/list.
UpdatedCommand Injection vulnerability in goform/SetIPTVCfg interface of Tenda AC15 V15.03.05.20 allows remote attackers to run arbitrary commands via crafted POST request.
UpdatedAn issue was discovered in IceCMS version 2.0.1, allows attackers to escalate privileges and gain sensitive information via UserID parameter in api/User/ChangeUser.
Updatedfunadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install.
UpdatedAn issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions include from_math_prompt and from_colored_object_prompt.
UpdatedThere is a storage type cross site scripting (XSS) vulnerability in the filing number of the Basic Information tab on the backend management page of EyouCMS v1.6.3
UpdatedAuthentication Bypass vulnerability in D-Link DIR-859 FW105b03 allows remote attackers to gain escalated privileges via via phpcgi_main. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
UpdatedAuthentication Bypass vulnerability in D-Link DIR-895 FW102b07 allows remote attackers to gain escalated privileges via via function phpcgi_main in cgibin. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
UpdatedAuthentication Bypass vulnerability in D-Link DIR-885L FW102b01 allows remote attackers to gain escalated privileges via phpcgi. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
UpdatedAuthentication Bypass vulnerability in D-Link DIR-645 firmware version 1.03 allows remote attackers to gain escalated privileges via function phpcgi_main in cgibin. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
UpdatedServer Side Request Forgery (SSRF) vulnerability in NebulaGraph Studio version 3.7.0, allows remote attackers to gain sensitive information.
UpdatedThe sisqualWFM 7.1.319.103 thru 7.1.319.111 for Android, has a host header injection vulnerability in its "/sisqualIdentityServer/core/" endpoint. By modifying the HTTP Host header, an attacker can change webpage links and even redirect users to arbitrary or malicious locations. This can lead to phishing attacks, malware distribution, and unauthorized access to sensitive resources.
UpdatedAn isssue in GatesAIr Flexiva FM Transmitter/Exiter Fax 150W allows a remote attacker to gain privileges via the LDAP and SMTP credentials.
UpdatedCross Site Scripting vulnerability in GatesAIr Flexiva FM Transmitter/Exciter v.FAX 150W allows a remote attacker to execute arbitrary code via a crafted script to the web application dashboard.
UpdatedSQL Injection vulnerability in smanga version 3.1.9 and earlier, allows remote attackers to execute arbitrary code and gain sensitive information via mediaId, mangaId, and userId parameters in php/history/add.php.
Updatedlib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.
UpdatedIn Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.
UpdatedAzure CLI REST Command Information Disclosure Vulnerability
UpdatedMicrosoft Exchange Server Spoofing Vulnerability
Updated- CVE-2023-36049: .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability 7.6 High
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
Updated Windows Authentication Elevation of Privilege Vulnerability
UpdatedWindows Authentication Denial of Service Vulnerability
UpdatedMicrosoft Office Graphics Remote Code Execution Vulnerability
UpdatedOpen Management Infrastructure Information Disclosure Vulnerability
UpdatedVisual Studio Denial of Service Vulnerability
UpdatedMicrosoft Excel Remote Code Execution Vulnerability
UpdatedMicrosoft Exchange Server Spoofing Vulnerability
UpdatedASP.NET Core Denial of Service Vulnerability
UpdatedMicrosoft Excel Security Feature Bypass Vulnerability
Updated- CVE-2023-36036: Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability 7.8 High
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Updated Microsoft Exchange Server Spoofing Vulnerability
UpdatedMicrosoft Edge (Chromium-based) Remote Code Execution Vulnerability
UpdatedWindows DWM Core Library Elevation of Privilege Vulnerability
UpdatedMicrosoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
UpdatedMicrosoft Dynamics 365 Sales Spoofing Vulnerability
UpdatedMicrosoft Edge (Chromium-based) Spoofing Vulnerability
Updated- CVE-2023-36028: Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability 9.8 Critical
Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
Updated Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
UpdatedMicrosoft Edge (Chromium-based) Spoofing Vulnerability
UpdatedWindows SmartScreen Security Feature Bypass Vulnerability
UpdatedMicrosoft Edge (Chromium-based) Elevation of Privilege Vulnerability
UpdatedMicrosoft Edge (Chromium-based) Remote Code Execution Vulnerability
UpdatedMicrosoft On-Prem Data Gateway Security Feature Bypass Vulnerability
UpdatedMicrosoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
UpdatedMicrosoft Power Platform Connector Spoofing Vulnerability
UpdatedVisual Studio Code Jupyter Extension Spoofing Vulnerability
UpdatedWindows Scripting Engine Memory Corruption Vulnerability
UpdatedMicrosoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
UpdatedMicrosoft Edge (Chromium-based) Remote Code Execution Vulnerability
UpdatedPowerShell Information Disclosure Vulnerability
UpdatedDHCP Server Service Information Disclosure Vulnerability
UpdatedWin32k Elevation of Privilege Vulnerability
UpdatedMicrosoft Defender Denial of Service Vulnerability
UpdatedMicrosoft Word Information Disclosure Vulnerability
UpdatedMicrosoft Edge (Chromium-based) Remote Code Execution Vulnerability
Updated- CVE-2023-36007: Microsoft Send Customer Voice survey from Dynamics 365 Spoofing Vulnerability 7.6 High
Microsoft Send Customer Voice survey from Dynamics 365 Spoofing Vulnerability
Updated - CVE-2023-36006: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability 8.8 High
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Updated Windows Telephony Server Elevation of Privilege Vulnerability
UpdatedWindows DPAPI (Data Protection Application Programming Interface) Spoofing Vulnerability
UpdatedXAML Diagnostics Elevation of Privilege Vulnerability
UpdatedA missing authorization check in multiple URL validation endpoints of the Insider Threat Management Server enables an anonymous attacker on an adjacent network to smuggle content via DNS lookups. All versions before 7.14.3 are affected.
UpdatedDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.
Updated · Rejected recordA missing authorization check in the MacOS agent configuration endpoint of the Insider Threat Management Server enables an anonymous attacker on an adjacent network to obtain sensitive information. Successful exploitation requires an attacker to first obtain a valid agent authentication token. All versions before 7.14.3 are affected.
Updated