Lista CVE - 2023 / Settembre
Visualizzazione 701 - 800 di 2148 CVE per Settembre 2023 (Pagina 8 di 22)
| ID CVE | Data | Titolo |
|---|---|---|
| CVE-2022-23382 | 2023-09-11 | Shenzhen Hichip Vision Technology IP Camera Firmware V11.4.8.1.1-20170926 has a denial of service vulnerability through sending a crafted multicast message in a local network. |
| CVE-2023-27470 | 2023-09-11 | BASupSrvcUpdater.exe in N-able Take Control Agent through 7.0.41.1141 before 7.0.43 has a TOCTOU Race Condition via a pseudo-symlink at %PROGRAMDATA%\GetSupportService_N-Central\PushUpdates, leading to arbitrary file deletion. |
| CVE-2023-30058 | 2023-09-11 | novel-plus 3.6.2 is vulnerable to SQL Injection. |
| CVE-2023-31067 | 2023-09-11 | An issue was discovered in TSplus Remote Access through 16.0.2.14. There are Full Control permissions for Everyone on some directories under %PROGRAMFILES(X86)%\TSplus\Clients\www. |
| CVE-2023-31068 | 2023-09-11 | An issue was discovered in TSplus Remote Access through 16.0.2.14. There are Full Control permissions for Everyone on some directories under %PROGRAMFILES(X86)%\TSplus\UserDesktop\themes. |
| CVE-2023-31069 | 2023-09-11 | An issue was discovered in TSplus Remote Access through 16.0.2.14. Credentials are stored as cleartext within the HTML source code of the login page. |
| CVE-2023-31468 | 2023-09-11 | An issue was discovered in Inosoft VisiWin 7 through 2022-2.1 (Runtime RT7.3 RC3 20221209.5). The "%PROGRAMFILES(X86)%\INOSOFT GmbH" folder has weak permissions for Everyone, allowing an attacker to insert a Trojan... |
| CVE-2023-35845 | 2023-09-11 | Anaconda 3 2023.03-1-Linux allows local users to disrupt TLS certificate validation by modifying the cacert.pem file used by the installed pip program. This occurs because many files are installed as... |
| CVE-2023-36140 | 2023-09-11 | In PHPJabbers Cleaning Business Software 1.0, there is no encryption on user passwords allowing an attacker to gain access to all user accounts. |
| CVE-2023-36161 | 2023-09-11 | An issue was discovered in Qubo Smart Plug 10A version HSP02_01_01_14_SYSTEM-10A, allows attackers to cause a denial of service (DoS) via Wi-Fi deauthentication. |
| CVE-2023-36980 | 2023-09-11 | An issue in Ethereum Blockchain v0.1.1+commit.6ff4cd6 cause the balance to be zeroed out when the value of betsize+casino.balance exceeds the threshold. |
| CVE-2023-38829 | 2023-09-11 | An issue in NETIS SYSTEMS WF2409E v.3.6.42541 allows a remote attacker to execute arbitrary code via the ping and traceroute functions of the diagnostic tools component in the admin management... |
| CVE-2023-38878 | 2023-09-11 | A reflected cross-site scripting (XSS) vulnerability in DevCode OpenSTAManager versions 2.4.24 to 2.4.47 may allow a remote attacker to execute arbitrary JavaScript in the web browser of a victim by... |
| CVE-2023-39063 | 2023-09-11 | Buffer Overflow vulnerability in RaidenFTPD 2.4.4005 allows a local attacker to execute arbitrary code via the Server name field of the Step by step setup wizard. |
| CVE-2023-39067 | 2023-09-11 | Cross Site Scripting vulnerability in ZLMediaKiet v.4.0 and v.5.0 allows an attacker to execute arbitrary code via a crafted script to the URL. |
| CVE-2023-39068 | 2023-09-11 | Buffer Overflow vulnerability in NBD80S09S-KLC v.YK_HZXM_NBD80S09S-KLC_V4.03.R11.7601.Nat.OnvifC.20230414.bin and NBD80N32RA-KL-V3 v.YK_HZXM_NBD80N32RA-KL_V4.03.R11.7601.Nat.OnvifC.20220120.bin allows a remote attacker to casue a denial of service via a crafted request to the service.XM component. |
| CVE-2023-39069 | 2023-09-11 | An issue in StrangeBee TheHive v.5.0.8, v.4.1.21 and Cortex v.3.1.6 allows a remote attacker to gain privileges via Active Directory authentication mechanism. |
| CVE-2023-39070 | 2023-09-11 | An issue in Cppcheck 2.12 dev allows a local attacker to execute arbitrary code via the removeContradiction parameter in token.cpp:1934. |
| CVE-2023-40039 | 2023-09-11 | An issue was discovered on ARRIS TG852G, TG862G, and TG1672G devices. A remote attacker (in proximity to a Wi-Fi network) can derive the default WPA2-PSK value by observing a beacon... |
| CVE-2023-40040 | 2023-09-11 | An issue was discovered in the MyCrops HiGrade "THC Testing & Cannabi" application 1.0.337 for Android. A remote attacker can start the camera feed via the com.cordovaplugincamerapreview.CameraActivity component in some... |
| CVE-2023-40786 | 2023-09-11 | HKcms v2.3.0.230709 is vulnerable to Cross Site Scripting (XSS) allowing administrator cookies to be stolen. |
| CVE-2023-40944 | 2023-09-11 | Schoolmate 1.3 is vulnerable to SQL Injection in the variable $schoolname from Database at ~\header.php. |
| CVE-2023-40945 | 2023-09-11 | Sourcecodester Doctor Appointment System 1.0 is vulnerable to SQL Injection in the variable $userid at doctors\myDetails.php. |
| CVE-2023-40946 | 2023-09-11 | Schoolmate 1.3 is vulnerable to SQL Injection in the variable $username from SESSION in ValidateLogin.php. |
| CVE-2023-41000 | 2023-09-11 | GPAC through 2.2.1 has a use-after-free vulnerability in the function gf_bifs_flush_command_list in bifs/memory_decoder.c. |
| CVE-2023-41593 | 2023-09-11 | Multiple cross-site scripting (XSS) vulnerabilities in Dairy Farm Shop Management System Using PHP and MySQL v1.1 allow attackers to execute arbitrary web scripts and HTML via a crafted payload injected... |
| CVE-2023-41609 | 2023-09-11 | An open redirect vulnerability in the sanitize_url() parameter of CouchCMS v2.3 allows attackers to redirect a victim user to an arbitrary web site via a crafted URL. |
| CVE-2023-42467 | 2023-09-11 | QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not prevent s->qdev.blocksize from being 256. This stops QEMU and the guest immediately. |
| CVE-2023-42470 | 2023-09-11 | The Imou Life com.mm.android.smartlifeiot application through 6.8.0 for Android allows Remote Code Execution via a crafted intent to an exported component. This relates to the com.mm.android.easy4ip.MainActivity activity. JavaScript execution is... |
| CVE-2023-42471 | 2023-09-11 | The wave.ai.browser application through 1.0.35 for Android allows a remote attacker to execute arbitrary JavaScript code via a crafted intent. It contains a manifest entry that exports the wave.ai.browser.ui.splash.SplashScreen activity.... |
| CVE-2023-38743 | 2023-09-11 | Zoho ManageEngine ADManager Plus before Build 7200 allows admin users to execute commands on the host machine. |
| CVE-2023-39780 | 2023-09-11 | On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply.htm qos_bw_rulelist parameter. NOTE: for the similar "token-generated module" issue, see CVE-2023-41345; for the similar "token-refresh... |
| CVE-2023-41103 | 2023-09-11 | Interact 7.9.79.5 allows stored Cross-site Scripting (XSS) attacks in several locations, allowing an attacker to store a JavaScript payload. |
| CVE-2023-4816 | 2023-09-11 | A vulnerability exists in the Equipment Tag Out authentication, when configured with Single Sign-On (SSO) with password validation in T214. This vulnerability can be exploited by an authenticated user per-forming... |
| CVE-2023-4573 | 2023-09-11 | When receiving rendering data over IPC `mStream` could have been destroyed when initialized, which could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox <... |
| CVE-2023-4574 | 2023-09-11 | When creating a callback over IPC for showing the Color Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as... |
| CVE-2023-4575 | 2023-09-11 | When creating a callback over IPC for showing the File Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as... |
| CVE-2023-4576 | 2023-09-11 | On Windows, an integer overflow could occur in `RecordedSourceSurfaceCreation` which resulted in a heap buffer overflow potentially leaking sensitive data that could have led to a sandbox escape. *This bug... |
| CVE-2023-4577 | 2023-09-11 | When `UpdateRegExpStatics` attempted to access `initialStringHeap` it could already have been garbage collected prior to entering the function, which could potentially have led to an exploitable crash. This vulnerability affects... |
| CVE-2023-4578 | 2023-09-11 | When calling `JS::CheckRegExpSyntax` a Syntax Error could have been set which would end in calling `convertToRuntimeErrorAndClear`. A path in the function could attempt to allocate memory when none is available... |
| CVE-2023-4579 | 2023-09-11 | Search queries in the default search engine could appear to have been the currently navigated URL if the search query itself was a well formed URL. This could have led... |
| CVE-2023-4580 | 2023-09-11 | Push notifications stored on disk in private browsing mode were not being encrypted potentially allowing the leak of sensitive information. This vulnerability affects Firefox < 117, Firefox ESR < 115.2,... |
| CVE-2023-4581 | 2023-09-11 | Excel `.xll` add-in files did not have a blocklist entry in Firefox's executable blocklist which allowed them to be downloaded without any warning of their potential harm. This vulnerability affects... |
| CVE-2023-4582 | 2023-09-11 | Due to large allocation checks in Angle for glsl shaders being too lenient a buffer overflow could have occured when allocating too much private shader memory on mac OS. *This... |
| CVE-2023-4583 | 2023-09-11 | When checking if the Browsing Context had been discarded in `HttpBaseChannel`, if the load group was not available then it was assumed to have already been discarded which was not... |
| CVE-2023-4584 | 2023-09-11 | Memory safety bugs present in Firefox 116, Firefox ESR 102.14, Firefox ESR 115.1, Thunderbird 102.14, and Thunderbird 115.1. Some of these bugs showed evidence of memory corruption and we presume... |
| CVE-2023-4585 | 2023-09-11 | Memory safety bugs present in Firefox 116, Firefox ESR 115.1, and Thunderbird 115.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some... |
| CVE-2023-4104 | 2023-09-11 | An invalid Polkit Authentication check and missing authentication requirements for D-Bus methods allowed any local user to configure arbitrary VPN setups. *This bug only affects Mozilla VPN on Linux. Other... |
| CVE-2023-3612 | 2023-09-11 | Unprotected WebView access in Govee Home App |
| CVE-2023-4630 | 2023-09-11 | Missing Authorization in GitLab |
| CVE-2022-28832 | 2023-09-11 | Adobe InDesign Font Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability |
| CVE-2022-28833 | 2023-09-11 | Adobe InDesign Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability |
| CVE-2022-28831 | 2023-09-11 | Adobe InDesign Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability |
| CVE-2022-28836 | 2023-09-11 | Adobe InCopy Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability |
| CVE-2022-28834 | 2023-09-11 | Adobe InCopy Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability |
| CVE-2022-28835 | 2023-09-11 | Adobe InCopy Font Parsing Use-After-Free Remote Code Execution Vulnerability |
| CVE-2022-34224 | 2023-09-11 | Adobe Acrobat Reader DC AcroForm setItems Use-After-Free Remote Code Execution Vulnerability |
| CVE-2022-34227 | 2023-09-11 | Adobe Acrobat Reader DC AcroForm value Use-After-Free Remote Code Execution Vulnerability |
| CVE-2022-34238 | 2023-09-11 | Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability |
| CVE-2019-7819 | 2023-09-11 | Adobe Acrobat Pro DC PostScript File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability |
| CVE-2019-16470 | 2023-09-11 | CoolType.dll crash - Tianfu Cup |
| CVE-2019-16471 | 2023-09-11 | Use-After-Free in app.measureDialog - Tianfu Cup |
| CVE-2023-40032 | 2023-09-11 | Potential segfault due to NULL pointer dereference in libvips |
| CVE-2023-41256 | 2023-09-11 | Dover Fueling Solutions MAGLINK LX Console Authentication Bypass |
| CVE-2023-40150 | 2023-09-11 | Softneta MedDream PACS Exposed Dangerous Method or Function |
| CVE-2023-39227 | 2023-09-11 | Softneta MedDream PACS Plaintext Storage of a Password |
| CVE-2023-41336 | 2023-09-11 | Prevent injection of invalid entity ids for "autocomplete" fields in symfony ux-autocomplete |
| CVE-2023-38256 | 2023-09-11 | Dover Fueling Solutions MAGLINK LX Console Path Traversal |
| CVE-2023-36497 | 2023-09-11 | Dover Fueling Solutions MAGLINK LX Web Console Authentication Bypass by Primary Weakness |
| CVE-2023-4307 | 2023-09-11 | Lock User Account <= 1.0.3 - Arbitrary Account Lock/Unlock via CSRF |
| CVE-2023-4270 | 2023-09-11 | Min Max Control < 4.6 - Reflected XSS |
| CVE-2023-4318 | 2023-09-11 | Herd Effects < 5.2.4 - Effect Deletion via CSRF |
| CVE-2023-4022 | 2023-09-11 | Herd Effects < 5.2.3 - Admin+ Stored XSS |
| CVE-2023-2705 | 2023-09-11 | Appointment booking addon for Gravity Forms < 1.10.0 - Reflected Cross-Site Scripting |
| CVE-2023-4314 | 2023-09-11 | wpDataTables < 2.1.66 - Admin+ PHP Object Injection |
| CVE-2023-3169 | 2023-09-11 | tagDiv Composer < 4.2 - Unauthenticated Stored XSS |
| CVE-2023-3510 | 2023-09-11 | FTP Access <= 1.0 - Subscriber+ Stored XSS |
| CVE-2023-4060 | 2023-09-11 | WP Adminify < 3.1.6 - Admin+ Stored XSS |
| CVE-2023-4278 | 2023-09-11 | MasterStudy LMS < 3.0.18 - Unauthenticated Instructor Account Creation |
| CVE-2023-3170 | 2023-09-11 | tagDiv Composer < 4.2 - Admin+ Stored XSS |
| CVE-2023-4294 | 2023-09-11 | URL Shortify < 1.7.6 - Unauthenticated Stored XSS via referer header |
| CVE-2023-4897 | 2023-09-11 | Relative Path Traversal in mintplex-labs/anything-llm |
| CVE-2023-35658 | 2023-09-11 | In gatt_process_prep_write_rsp of gatt_cl.cc, there is a possible privilege escalation due to a use after free. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed.... |
| CVE-2023-35664 | 2023-09-11 | In convertSubgraphFromHAL of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges... |
| CVE-2023-35665 | 2023-09-11 | In multiple files, there is a possible way to import a contact from another user due to a missing permission check. This could lead to local escalation of privilege with... |
| CVE-2023-35666 | 2023-09-11 | In bta_av_rc_msg of bta_av_act.cc, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional... |
| CVE-2023-35667 | 2023-09-11 | In updateList of NotificationAccessSettings.java, there is a possible way to hide approved notification listeners in the settings due to a logic error in the code. This could lead to local... |
| CVE-2023-35669 | 2023-09-11 | In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to control other running activities due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution... |
| CVE-2023-35670 | 2023-09-11 | In computeValuesFromData of FileUtils.java, there is a possible way to insert files to other apps' external private directories due to a path traversal error. This could lead to local escalation... |
| CVE-2023-35671 | 2023-09-11 | In onHostEmulationData of HostEmulationManager.java, there is a possible way for a general purpose NFC reader to read the full card number and expiry details when the device is in locked... |
| CVE-2023-35673 | 2023-09-11 | In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges... |
| CVE-2023-35674 | 2023-09-11 | In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation of privilege... |
| CVE-2023-35675 | 2023-09-11 | In loadMediaResumptionControls of MediaResumeListener.kt, there is a possible way to play and listen to media files played by another user on the same device due to a logic error in... |
| CVE-2023-35676 | 2023-09-11 | In createQuickShareAction of SaveImageInBackgroundTask.java, there is a possible way to trigger a background activity launch due to an unsafe PendingIntent. This could lead to local escalation of privilege with no... |
| CVE-2023-35677 | 2023-09-11 | In onCreate of DeviceAdminAdd.java, there is a possible way to forcibly add a device admin due to a missing permission check. This could lead to local denial of service (factory... |
| CVE-2023-35679 | 2023-09-11 | In MtpPropertyValue of MtpProperty.h, there is a possible out of bounds read due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User... |
| CVE-2023-35680 | 2023-09-11 | In multiple locations, there is a possible way to import contacts belonging to other users due to a confused deputy. This could lead to local information disclosure with no additional... |
| CVE-2023-35681 | 2023-09-11 | In eatt_l2cap_reconfig_completed of eatt_impl.h, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed.... |
| CVE-2023-35682 | 2023-09-11 | In hasPermissionForActivity of PackageManagerHelper.java, there is a possible way to start arbitrary components due to a confused deputy. This could lead to local escalation of privilege with no additional execution... |
| CVE-2023-35683 | 2023-09-11 | In bindSelection of DatabaseUtils.java, there is a possible way to access files from other applications due to SQL injection. This could lead to local information disclosure with no additional execution... |