CWE-345

658 vulnerabilities with CWE-345

CVE-2023-48238 HIGH

joaquimserafim/json-web-token < 3.1.1 - JWT Algorithm Confusion via Unverified Algorithm Header

CVSS 7.5

CVE-2023-47631 HIGH

vantage6 < 4.1.2 - Insufficient Verification of Data Authenticity via Parent ID Bypass

CVSS 7.2

CVE-2023-47630 HIGH

Kyverno < 1.10.5 - Insufficient Verification of Data Authenticity

CVSS 7.1

CVE-2023-46445 MEDIUM

asyncssh < 2.14.1 - Rogue Extension Negotiation via Man-in-the-Middle Attack

CVSS 5.9

CVE-2023-42816 MEDIUM

Kyverno - Denial of Service via Malicious Notary Verifier Response

CVSS 6.1

CVE-2023-5747 HIGH

HanwhaVision Wave Server Software - Remote Code Execution via Command Injection

CVSS 7.2

CVE-2023-5548 LOW

Moodle - Cache Poisoning via File Serving Endpoints

CVSS 3.3

CVE-2023-4699 CRITICAL

Mitsubishielectric Fx3u-32mt/es Firmware - Missing Authentication

CVSS 10.0

CVE-2023-5482 HIGH

Google Chrome < 119.0.6045.105 - Out-of-Bounds Memory Access via USB Data Validation

CVSS 8.8

CVE-2023-41898 HIGH

Home Assistant Companion < 2023.9.2 - Arbitrary URL Loading in WebView

CVSS 8.6

CVE-2023-41896 HIGH

Home Assistant < 2023.8.0 - Cross-Site Scripting via WebSocket State Parameter Manipulation

CVSS 7.1

CVE-2023-43800 HIGH

Arduino Create Agent <1.3.3 - Privilege Escalation

CVSS 7.3

CVE-2023-38552 HIGH

Node.js 18.0.0-18.18.0 and 20.x - Policy Integrity Check Bypass via Forged Checksum

CVSS 7.5

CVE-2023-43666 MEDIUM

Apache InLong <1.9.0 - Info Disclosure

CVSS 6.5

CVE-2023-42782 MEDIUM

FortiAnalyzer <= 7.4.0 and < 7.2.3 - Unauthenticated Syslog Message Spoofing via Device Serial Number

CVSS 5.3

CVE-2023-5450 HIGH

BIG-IP Edge Client Installer - Privilege Escalation via Insufficient Data Verification

CVSS 7.3

CVE-2023-5366 HIGH

Openvswitch < 2023-02-28 - Data Authenticity Bypass

CVSS 7.1

CVE-2023-39347 HIGH

Cilium < 1.12.14, 1.13.0-1.13.7 - Network Policy Bypass via Pod Label Manipulation

CVSS 7.6

CVE-2023-43636 HIGH

EVE OS - Info Disclosure

CVSS 8.8

CVE-2023-26141 HIGH

Sidekiq < 6.5.10 and 7.0.0-7.1.3 - Denial of Service via Dashboard Polling Manipulation

CVSS 7.5

CVE-2023-20236 MEDIUM

Cisco IOS XR - Privilege Escalation

CVSS 6.7

CVE-2023-4589 CRITICAL

Delinea Secret Server <10.9.000002 - Code Injection

CVSS 9.1

CVE-2023-35719 MEDIUM

ManageEngine ADSelfService Plus - Unauthenticated Authentication Bypass via GINA Client Password Reset Portal

CVSS 6.8

CVE-2023-35906 MEDIUM

IBM Aspera Faspex 5.0.5 - Auth Bypass

CVSS 5.3

CVE-2023-41045 LOW

Graylog < 5.0.9 and 5.1.0-5.1.3 - DNS Cache Poisoning via Predictable Source Port

CVSS 3.7