CVE-2023-26294

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published
Jun 12, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-262959.8Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges.CVE-2023-262968.8Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges.CVE-2023-262978.8Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges.CVE-2023-262988.8Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges.CVE-2023-262997.0A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (systeCVE-2023-26304.8Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-263007.8A potential security vulnerability has been identified in the system BIOS for certain HP PC products which might allow escalation of privileCVE-2023-263019.8Certain HP LaserJet Pro print products are potentially vulnerable to an Elevation of Privilege and/or Information Disclosure related to a laCVE-2023-263025.5Denial of service could be caused to the command line interface of markdown-it-py, before v2.2.0, if an attacker was allowed to use invalid CVE-2023-263035.5Denial of service could be caused to markdown-it-py, before v2.2.0, if an attacker was allowed to force null assertions with specially craftCVE-2023-263099.8A remote code execution vulnerability in the webview component of OnePlus Store app.CVE-2023-26314.3A missing permission check in Jenkins Code Dx Plugin 3.1.0 and earlier allows attackers with Overall/Read permission to connect to an attack
CVE-2023-26294: High severity, CVSS 7.8 | Vulnix