CVE-2023-3218

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

Race Condition within a Thread in GitHub repository it-novum/openitcockpit prior to 4.6.5.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-366

Affected software

No affected versions have been published.

Timeline

Published
Jun 13, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-321816.5A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf allows for DoS via malformed conCVE-2023-321827.8A Improper Link Resolution Before File Access ('Link Following') vulnerability in SUSE SUSE Linux Enterprise Desktop 15 SP5 postfix, SUSE SUCVE-2023-321837.8Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed hawk2 package allows users with access to the hacluster to escalate tCVE-2023-321847.8A Insecure Storage of Sensitive Information vulnerability in openSUSE opensuse-welcome allows local attackers to execute code as the user thCVE-2023-321867.5A Allocation of Resources Without Limits or Throttling vulnerability in SUSE RKE2 allows attackers with access to K3s servers apiserver/supCVE-2023-321877.5An Allocation of Resources Without Limits or Throttling vulnerability in SUSE k3s allows attackers with access to K3s servers' apiserver/supCVE-2023-321889.4A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector TokeCVE-2023-321895.9Insecure handling of ssh keys used to bootstrap clients allows local attackers to potentially gain access to the keysCVE-2023-32195.3The EventON WordPress plugin before 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid ECVE-2023-321907.8mlocate's %post script allows RUN_UPDATEDB_AS user to make arbitrary files world readable by abusing insecure file operations that run with CVE-2023-321919.9When RKE provisions a cluster, it stores the cluster state in a configmap called `full-cluster-state` inside the `kube-system` namespace of CVE-2023-321928.3A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in the API Server's public API endpoint can be exp
CVE-2023-3218: Medium severity, CVSS 4.4 | Vulnix