Vulnerabilities published in 2023
42,916 vulnerabilities were published in 2023: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 128 of 430.
- CVE-2023-6854 Breakdance <= 1.7.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via custom postmeta
- CVE-2023-6853 kalcaddle KodExplorer app.php index server-side request forgery
- CVE-2023-6852 kalcaddle KodExplorer app.php server-side request forgery
- CVE-2023-6851 kalcaddle KodExplorer ZIP Archive app.php unzipList code injection
- CVE-2023-6850 kalcaddle KodExplorer API Endpoint unrestricted upload
- CVE-2023-6849 kalcaddle kodbox app.php cover server-side request forgery
- CVE-2023-6848 kalcaddle kodbox index.class.php check command injection
- CVE-2023-6847 Improper Authentication in GitHub Enterprise Server leading to Authentication Bypass for Public Repository Data
- CVE-2023-6846 File Manager Pro <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Upload
- CVE-2023-6845 CommentTweets <= 0.6 - Settings Update via CSRF
- CVE-2023-6844 iframe <= 5.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
- CVE-2023-6843 easy.jobs < 2.4.7 - Subscriber+ Arbitrary Settings Update
- CVE-2023-6842 Formidable Forms <= 6.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
- CVE-2023-6841 Keycloak: amount of attributes per object is not limited and it may lead to dos
- CVE-2023-6840 Missing Authorization in GitLab
- CVE-2023-6839 Information disclosure in WSO2 API Manager
- CVE-2023-6838 Cross-site scripting in WSO2 API Manager
- CVE-2023-6837 Multiple WSO2 products vulnerable to perform user impersonatoin using JIT provisioning
- CVE-2023-6836 WSO2 products vulnerable to XML External Entity attack
- CVE-2023-6835 WSO2 API Manager allows attackers to change the API rating
- CVE-2023-6833 Information Exposure Vulnerability in Hitachi Ops Center Administrator
- CVE-2023-6832 Business Logic Errors in microweber/microweber
- CVE-2023-6831 Path Traversal: '\..\filename' in mlflow/mlflow
- CVE-2023-6830 Formidable Forms <= 6.7 - HTML Injection
- CVE-2023-6828 ARForms <= 1.5.8 - Unauthenticated Stored Cross-Site Scripting via arf_http_referrer_url
- CVE-2023-6827 Essential Real Estate <= 4.3.5 - Authenticated (Subscriber+) Arbitrary File Upload
- CVE-2023-6826 E2Pdf <= 1.20.25 - Authenticated (Administrator+) Arbitrary File Upload
- CVE-2023-6825 File Manager And File Manager Pro (Multiple Versions) - Directory Traversal
- CVE-2023-6824 WP Customer Area < 8.2.1 - Subscriber+ Account Address Leak
- CVE-2023-6821 Error Log Viewer < 1.1.3 - Directory Listing to Sensitive Data Exposure
- CVE-2023-6817 Use-after-free in Linux kernel's netfilter: nf_tables component
- CVE-2023-6816 Xorg-x11-server: heap buffer overflow in devicefocusevent and procxiquerypointer
- CVE-2023-6815 Privilege escalation in MELSEC iQ-R Series SIL2 Process CPU R08PSFCPU
- CVE-2023-6814 Information Exposure Vulnerability in Cosminexus Component Container
- CVE-2023-6813 Login by Auth0 <= 4.6.0 - Reflected Cross-Site Scripting via wle
- CVE-2023-6812 WP Compress – Image Optimizer [All-In-One] <= 6.20.01 - Open Redirect via css
- CVE-2023-6811 Language Translate Widget for WordPress – ConveyThis <= 223 - Unauthenticated Stored Cross-Site Scripting via api_key
- CVE-2023-6810 ClickCease Click Fraud Protection <= 3.2.4 - Improper Authorization to sensitive information exposure via get_settings
- CVE-2023-6809 Custom fields shortcode <= 0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
- CVE-2023-6808 Cross-site scripting in Booking for Appointments and Events Calendar – Amelia
- CVE-2023-6807 GeneratePress Premium <= 2.3.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Custom Meta
- CVE-2023-6806 Starbox <= 3.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Job Settings
- CVE-2023-6805 Server-side request forgery in RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
- CVE-2023-6804 Improper Privilege Management allows for arbitrary workflows to be run
- CVE-2023-6803 Race Condition allows Unauthorized Outside Collaborator
- CVE-2023-6802 Sensitive Information in Log File in GitHub Enterprise Server
- CVE-2023-6801 Cross-site scripting in RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
- CVE-2023-6799 WP Reset <= 2.0 - Sensitive Information Exposure due to Insufficient Randomness
- CVE-2023-6798 Missing authorization in RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
- CVE-2023-6795 PAN-OS: OS Command Injection Vulnerability in the Web Interface
- CVE-2023-6794 PAN-OS: File Upload Vulnerability in the Web Interface
- CVE-2023-6793 PAN-OS: XML API Keys Revoked by Read-Only PAN-OS Administrator
- CVE-2023-6792 PAN-OS: OS Command Injection Vulnerability in the XML API
- CVE-2023-6791 PAN-OS: Plaintext Disclosure of External System Integration Credentials
- CVE-2023-6790 PAN-OS: DOM-Based Cross-Site Scripting (XSS) Vulnerability in the Web Interface
- CVE-2023-6789 PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface
- CVE-2023-6788 Metform Elementor Contact Form Builder <= 3.8.1 - Cross-Site Request Forgery
- CVE-2023-6787 Keycloak: session hijacking via re-authentication
- CVE-2023-6786 Payment Gateway for Telcell <= 2.0.1 - Unauthenticated Open Redirect
- CVE-2023-6785 Download Manager <= 3.2.84 - Missing Authorization
- CVE-2023-6784 Potential Use of the Sitefinity System for Distribution of Phishing Emails
- CVE-2023-6783 WolfNet IDX for WordPress <= 1.19.1 - Admin+ Stored XSS
- CVE-2023-6782 AMP for WP – Accelerated Mobile Pages <= 1.0.92 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode
- CVE-2023-6781 Orbit Fox Companion <= 2.10.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via custom fields
- CVE-2023-6780 Glibc: integer overflow in __vsyslog_internal()
- CVE-2023-6779 Glibc: off-by-one heap-based buffer overflow in __vsyslog_internal()
- CVE-2023-6778 Cross-site Scripting (XSS) - Stored in allegroai/clearml-server
- CVE-2023-6777 WP Go Maps (formerly WP Google Maps) <= 9.0.34 - Information Exposure to Potential Denial of Service
- CVE-2023-6776 3D Flipbook <= 1.15.2 - Authenticated (Contributor+) Cross-Site Scripting via Ready Function
- CVE-2023-6775 CodeAstro POS and Inventory Management System item_con cross site scripting
- CVE-2023-6774 CodeAstro POS and Inventory Management System register_account cross site scripting
- CVE-2023-6773 CodeAstro POS and Inventory Management System User Creation register_account access control
- CVE-2023-6772 OTCMS ind_backstage.php sql injection
- CVE-2023-6771 SourceCodester Simple Student Attendance System actions.class.php save_attendance sql injection
- CVE-2023-6769 Stored XSS vulnerability in Amazing Little Poll
- CVE-2023-6768 Authentication bypass vulnerability in Amazing Little Poll
- CVE-2023-6767 SourceCodester Wedding Guest e-Book add-guest.php cross site scripting
- CVE-2023-6766 PHPGurukul Teacher Subject Allocation Management System Delete Course course.php cross-site request forgery
- CVE-2023-6765 SourceCodester Online Tours & Travels Management System email_setup.php prepare sql injection
- CVE-2023-6764 Memory corruption in ATP series firmware
- CVE-2023-6762 Thecosy IceCMS Article permission
- CVE-2023-6761 Thecosy IceCMS User Data access control
- CVE-2023-6760 Thecosy IceCMS user session
- CVE-2023-6759 Thecosy IceCMS Love resource improper enforcement of a single, unique action
- CVE-2023-6758 Thecosy IceCMS API PlanetCommentList access control
- CVE-2023-6757 Thecosy IceCMS API PlanetUser information disclosure
- CVE-2023-6756 Thecosy IceCMS Captcha login excessive authentication
- CVE-2023-6755 DedeBIZ content_batchup_action.php sql injection
- CVE-2023-6753 Path Traversal in mlflow/mlflow
- CVE-2023-6751 Hostinger <= 1.9.7 - Missing Authorization to Maintenance Mode Activation
- CVE-2023-6750 Clone < 2.4.3 - Unauthenticated Backup Download
- CVE-2023-6749 Unchecked user input length in the Zephyr Settings Shell
- CVE-2023-6748 Custom Field Template <= 2.6.1 - Authenticated(Contributor+) Information Exposure
- CVE-2023-6747 FooGallery Premium <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2023-6746 Sensitive Information in Log File in GitHub Enterprise Server
- CVE-2023-6745 Custom Field Template <= 2.6.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
- CVE-2023-6744 Divi <= 4.23.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2023-6743 Unlimited Elements for Elementor <= 1.5.89 - Authenticated(Contributor+) Remote Code Execution via template import
- CVE-2023-6742 Envira Gallery Lite <= 1.8.7.2 - Missing Authorization to Gallery Modification via envira_gallery_insert_images
- CVE-2023-6741 WP Customer Area < 8.2.1 - Subscriber+ Account Address Update