Base de données CVE
Archive des vulnérabilités connues (CVE) avec score CVSS, gravité, produits et éditeurs concernés. Filtrez par année et par sévérité.
- CVE-2023-33063Élevée7.8
Memory corruption in DSP Services during a remote call from HLOS to DSP.
- CVE-2023-42917Élevée8.8
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.
- CVE-2023-42916Moyenne6.5
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.
- CVE-2023-6345Critique9.6
Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)
- CVE-2023-49105Critique9.8
Un problème a été découvert dans ownCloud owncloud/core avant 10.13.1. Un attaquant peut accéder, modifier ou supprimer tout fichier sans authentification si le nom d'utilisateur d'une victime est connu, et que la victime n'a pas de signing-key configurée. Cela se produit parce que les URL pré-signées peuvent être acceptées même lorsqu'aucune signing-key n'est configurée pour le propriétaire des fichiers. La première version affectée est la 10.6.0.
- CVE-2023-49103Critique10.0
An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo). This information includes all the environment variables of the webserver. In containerized deployments, these environment variables may include sensitive data such as the ownCloud admin password, mail server credentials, and license key. Simply disabling the graphapi app does not eliminate the vulnerability. Additionally, phpinfo exposes various other potentially sensitive configuration details that could be exploited by an attacker to gather information about the system. Therefore, even if ownCloud is not running in a containerized environment, this vulnerability should still be a cause for concern. Note that Docker containers from before February 2023 are not vulnerable to the credential disclosure.
- CVE-2023-48365Critique9.6
Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. The fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17. NOTE: this issue exists because of an incomplete fix for CVE-2023-41265.
- CVE-2023-36424Élevée7.8
Windows Common Log File System Driver Elevation of Privilege Vulnerability
- CVE-2023-36036Élevée7.8
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
- CVE-2023-36033Élevée7.8
Windows DWM Core Library Elevation of Privilege Vulnerability
- CVE-2023-36025Élevée8.8
Windows SmartScreen Security Feature Bypass Vulnerability
- CVE-2023-47246Critique9.8
In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023.
- CVE-2023-22518Critique9.8
All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to - but not limited to - full loss of confidentiality, integrity and availability. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.
- CVE-2023-46604Critique10.0
Le marshaller du protocole Java OpenWire est vulnérable à l’exécution de code à distance. Cette vulnérabilité peut permettre à un attaquant distant ayant accès au réseau à un broker ou à un client OpenWire basé sur Java d’exécuter des commandes shell arbitraires en manipulant les types de classes sérialisés dans le protocole OpenWire, afin de provoquer l’instanciation de n’importe quelle classe du classpath par le client ou le broker, respectivement. Il est recommandé aux utilisateurs de mettre à niveau les brokers et les clients vers la version 5.15.16, 5.16.7, 5.17.6 ou 5.18.3, qui corrige ce problème.
- CVE-2023-46748Élevée8.8
An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- CVE-2023-46747Critique9.8
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- CVE-2023-43208Critique9.8
NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the incomplete patch of CVE-2023-37679.
- CVE-2023-34048Critique9.8
vCenter Server contient une vulnérabilité d'écriture hors limites dans l'implémentation du protocole DCERPC. Un acteur malveillant disposant d'un accès réseau à vCenter Server peut déclencher une écriture hors limites pouvant potentiellement conduire à l'exécution de code à distance.
- CVE-2023-20273Élevée7.2
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.
- CVE-2023-5631Moyenne6.1
Roundcube avant 1.4.15, 1.5.x avant 1.5.5, et 1.6.x avant 1.6.4 permet un XSS stocké via un message électronique HTML avec un document SVG fabriqué en raison du comportement de program/lib/Roundcube/rcube_washtml.php. Cela pourrait permettre à un attaquant distant de charger du code JavaScript arbitraire.
This product uses the NVD API but is not endorsed or certified by the NVD.