Export limit exceeded: 47185 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (47185 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-27515 | 1 Intel | 1 Driver \& Support Assistant | 2024-11-21 | 8.1 High |
| Cross-site scripting (XSS) for the Intel(R) DSA software before version 23.1.9 may allow unauthenticated user to potentially enable escalation of privilege via network access. | ||||
| CVE-2023-27509 | 1 Intel | 1 Ispc Software Installer | 2024-11-21 | 6.6 Medium |
| Improper access control in some Intel(R) ISPC software installers before version 1.19.0 may allow an authenticated user to potentially enable escalation of privileges via local access. | ||||
| CVE-2023-27506 | 1 Intel | 1 Optimization For Tensorflow | 2024-11-21 | 5.5 Medium |
| Improper buffer restrictions in the Intel(R) Optimization for Tensorflow software before version 2.12 may allow an authenticated user to potentially enable escalation of privilege via local access. | ||||
| CVE-2023-27505 | 1 Intel | 1 Advanced Link Analyzer | 2024-11-21 | 6.7 Medium |
| Incorrect default permissions in some Intel(R) Advanced Link Analyzer Standard Edition software installers before version 22.1 .1 may allow an authenticated user to potentially enable escalation of privilege via local access. | ||||
| CVE-2023-27471 | 1 Insyde | 1 Insydeh2o | 2024-11-21 | 5.5 Medium |
| An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. UEFI implementations do not correctly protect and validate information contained in the 'MeSetup' UEFI variable. On some systems, this variable can be overwritten using operating system APIs. Exploitation of this vulnerability could potentially lead to denial of service for the platform. | ||||
| CVE-2023-27435 | 1 Yasglobal | 1 Http Auth | 2024-11-21 | 6.3 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in Sami Ahmed Siddiqui HTTP Auth plugin <= 0.3.2 versions. | ||||
| CVE-2023-27421 | 1 Everestthemes | 1 Everest News | 2024-11-21 | 7.1 High |
| Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Everest themes Everest News theme <= 1.1.0 versions. | ||||
| CVE-2023-27415 | 1 Themeqx | 1 Letterpress | 2024-11-21 | 5.9 Medium |
| Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Themeqx LetterPress plugin <= 1.1.2 versions. | ||||
| CVE-2023-27392 | 1 Intel | 1 Support | 2024-11-21 | 4.4 Medium |
| Incorrect default permissions in the Intel(R) Support android application before version v23.02.07 may allow a privileged user to potentially enable information disclosure via local access. | ||||
| CVE-2023-27391 | 1 Intel | 29 Advisor For Oneapi, Cpu Runtime For Opencl Applications, Distribution For Python Programming Language and 26 more | 2024-11-21 | 6.7 Medium |
| Improper access control in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.1.493 may allow a privileged user to potentially enable escalation of privilege via local access. | ||||
| CVE-2023-26979 | 1 Bluetens | 1 Bluetensq | 2024-11-21 | 3.1 Low |
| Bluetens Electrostimulation Device BluetensQ device app version 4.3.15 is vulnerable to Man-in-the-middle attacks in the BLE channel. It allows attackers to decrease or increase the intensity of the stimulator by hijacking the BLE communication. | ||||
| CVE-2023-26961 | 1 Alteryx | 1 Alteryx Server | 2024-11-21 | 4.8 Medium |
| Alteryx Server 2022.1.1.42590 does not employ file type verification for uploaded files. This vulnerability allows attackers to upload arbitrary files (e.g., JavaScript content for stored XSS) via the type field in a JSON document within a PUT /gallery/api/media request. | ||||
| CVE-2023-26587 | 1 Intel | 1 Easy Streaming Wizard | 2024-11-21 | 7.8 High |
| Improper input validation for the Intel(R) Easy Streaming Wizard software may allow an authenticated user to potentially enable escalation of privilege via local access. | ||||
| CVE-2023-26451 | 1 Open-xchange | 1 Open-xchange Appsuite Backend | 2024-11-21 | 7.5 High |
| Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorization codes were predictable for third parties and could be used to intercept and take over the client authorization process. As a result, other users accounts could be compromised. The oAuth Authorization Service is not enabled by default. We have updated the implementation to use sources with sufficient randomness to generate authorization tokens. No publicly available exploits are known. | ||||
| CVE-2023-26450 | 1 Open-xchange | 1 Open-xchange Appsuite Frontend | 2024-11-21 | 5.4 Medium |
| The "OX Count" web service did not specify a media-type when processing responses by external resources. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We are now defining the accepted media-type to avoid code execution. No publicly available exploits are known. | ||||
| CVE-2023-26449 | 1 Open-xchange | 1 Open-xchange Appsuite Frontend | 2024-11-21 | 5.4 Medium |
| The "OX Chat" web service did not specify a media-type when processing responses by external resources. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We are now defining the accepted media-type to avoid code execution. No publicly available exploits are known. | ||||
| CVE-2023-26448 | 1 Open-xchange | 1 Open-xchange Appsuite Frontend | 2024-11-21 | 5.4 Medium |
| Custom log-in and log-out locations are used-defined as jslob but were not checked to contain malicious protocol handlers. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We now sanitize jslob content for those locations to avoid redirects to malicious content. No publicly available exploits are known. | ||||
| CVE-2023-26447 | 1 Open-xchange | 1 Open-xchange Appsuite Frontend | 2024-11-21 | 5.4 Medium |
| The "upsell" widget for the portal allows to specify a product description. This description taken from a user-controllable jslob did not get escaped before being added to DOM. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We now sanitize jslob content. No publicly available exploits are known. | ||||
| CVE-2023-26446 | 1 Open-xchange | 1 Open-xchange Appsuite Frontend | 2024-11-21 | 5.4 Medium |
| The users clientID at "application passwords" was not sanitized or escaped before being added to DOM. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We now sanitize the user-controllable clientID parameter. No publicly available exploits are known. | ||||
| CVE-2023-26445 | 1 Open-xchange | 1 Open-xchange Appsuite Frontend | 2024-11-21 | 5.4 Medium |
| Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets processed during login. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We now sanitize the theme value and use a default fallback if no theme matches. No publicly available exploits are known. | ||||