Base de datos CVE
Archivo de vulnerabilidades conocidas (CVE) con puntuación CVSS, gravedad, productos y fabricantes afectados. Filtra por año y severidad.
- CVE-2023-7102Crítica9.8
Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vulnerable logic.
- CVE-2023-7101Alta7.8
Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.
- CVE-2023-7024Alta8.8
Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- CVE-2023-47565Alta8.0
An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following versions: QVR Firmware 5.0.0 and later
- CVE-2023-36880Media4.8
Vulnerabilidad de divulgación de información en Microsoft Edge (basado en Chromium)
- CVE-2023-49897Alta8.8
An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.
- CVE-2023-44221Alta7.2
La neutralización inadecuada de elementos especiales en la interfaz de gestión SMA100 SSL-VPN permite a un atacante remoto autenticado con privilegio administrativo inyectar comandos arbitrarios como usuario 'nobody', lo que podría dar lugar a una vulnerabilidad de inyección de comandos del sistema operativo.
- CVE-2023-6448Crítica9.8
Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.
- CVE-2023-33107Alta8.4
Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.
- CVE-2023-33106Alta8.4
Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.
- CVE-2023-33063Alta7.8
Memory corruption in DSP Services during a remote call from HLOS to DSP.
- CVE-2023-42917Alta8.8
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.
- CVE-2023-42916Media6.5
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.
- CVE-2023-6345Crítica9.6
Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)
- CVE-2023-49105Crítica9.8
Se descubrió un problema en ownCloud owncloud/core antes de 10.13.1. Un atacante puede acceder, modificar o eliminar cualquier archivo sin autenticación si se conoce el nombre de usuario de una víctima y la víctima no tiene configurada ninguna signing-key. Esto ocurre porque las URL prefirmadas pueden aceptarse incluso cuando no hay ninguna signing-key configurada para el propietario de los archivos. La versión afectada más antigua es la 10.6.0.
- CVE-2023-49103Crítica10.0
An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo). This information includes all the environment variables of the webserver. In containerized deployments, these environment variables may include sensitive data such as the ownCloud admin password, mail server credentials, and license key. Simply disabling the graphapi app does not eliminate the vulnerability. Additionally, phpinfo exposes various other potentially sensitive configuration details that could be exploited by an attacker to gather information about the system. Therefore, even if ownCloud is not running in a containerized environment, this vulnerability should still be a cause for concern. Note that Docker containers from before February 2023 are not vulnerable to the credential disclosure.
- CVE-2023-48365Crítica9.6
Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. The fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17. NOTE: this issue exists because of an incomplete fix for CVE-2023-41265.
- CVE-2023-36424Alta7.8
Windows Common Log File System Driver Elevation of Privilege Vulnerability
- CVE-2023-36036Alta7.8
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
- CVE-2023-36033Alta7.8
Windows DWM Core Library Elevation of Privilege Vulnerability
This product uses the NVD API but is not endorsed or certified by the NVD.