Vulnerabilities published in 2023
42,916 vulnerabilities were published in 2023: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 129 of 430.
- CVE-2023-6740 Privilege escalation in jar_signature
- CVE-2023-6738 PageLayer <= 1.7.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via meta fields
- CVE-2023-6737 Enable Media Replace <= 4.1.4 - Reflected Cross-Site Scripting
- CVE-2023-6736 Inefficient Regular Expression Complexity in GitLab
- CVE-2023-6735 Privilege escalation in mk_tsm
- CVE-2023-6733 WP-Members Membership Plugin <= 3.4.8 - Missing Authorization to Sensitive Information Exposure
- CVE-2023-6732 Ultimate Maps by Supsystic < 1.2.16 - Admin+ Stored XSS
- CVE-2023-6731 WP Show Posts <= 1.1.5 - Improper Authorization to Information Exposure
- CVE-2023-6730 Deserialization of Untrusted Data in huggingface/transformers
- CVE-2023-6729 Nokia SR OS: File Access Security Vulnerability
- CVE-2023-6728 Nokia SR OS: BOF File Encryption Vulnerability
- CVE-2023-6727 Leak Inaccessible Playbook Information via Channel Action IDOR
- CVE-2023-6725 Tripleo-ansible: bind keys are world readable
- CVE-2023-6724 IDOR in Simgesel Software's Hearing Tracking System (Barosel)
- CVE-2023-6723 Unrestricted Upload of File with Dangerous Type in Repox
- CVE-2023-6722 Relative Path Traversal in Repox
- CVE-2023-6721 Improper Restriction of XML External Entity Reference in Repox
- CVE-2023-6720 Cross-site Scripting in Repox
- CVE-2023-6719 Cross-site Scripting in Repox
- CVE-2023-6718 Authentication Bypass Using an Alternate Path or Channel in Repox
- CVE-2023-6717 Keycloak: xss via assertion consumer service url in saml post-binding flow
- CVE-2023-6711 Memory corruption in RTU500 series CMU Firmware
- CVE-2023-6710 Mod_cluster/mod_proxy_cluster: stored cross site scripting
- CVE-2023-6709 Improper Neutralization of Special Elements Used in a Template Engine in mlflow/mlflow
- CVE-2023-6708 SVG Support <= 2.5.7 - Authenticated (Author+) Cross-Site Scripting via SVG
- CVE-2023-6707 Use after free in Chrome
- CVE-2023-6706 Use after free in Chrome
- CVE-2023-6705 Use after free in Chrome
- CVE-2023-6704 Use after free in Chrome
- CVE-2023-6703 Use after free in Chrome
- CVE-2023-6702 Memory corruption in Chrome
- CVE-2023-6701 Advanced Custom Fields <= 6.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field
- CVE-2023-6700 Cookie Information | Free GDPR Consent Solution <= 2.0.22 - Authenticated (Subscriber+) Arbitrary Options Update
- CVE-2023-6699 WP Compress – Image Optimizer [All-In-One] <= 6.10.33 - Unauthenticated Directory Traversal via css
- CVE-2023-6697 WP Go Maps (formerly WP Google Maps) <= 9.0.28 - Reflected Cross-Site Scripting
- CVE-2023-6696 Missing authorization in Popup Builder – Create highly converting, mobile friendly marketing popups.
- CVE-2023-6695 Beaver Themer <= 1.4.9 - Authenticated (Contributor+) Sensitive Information Exposure via shortcode
- CVE-2023-6694 Beaver Themer <= 1.4.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
- CVE-2023-6693 Qemu: virtio-net: stack buffer overflow in virtio_net_flush_tx()
- CVE-2023-6692 Cross-site scripting in Ultimate Blocks – 25+ Gutenberg Blocks for Block Editor
- CVE-2023-6691 Code Injection vulnerability in Cambium ePMP Force 300-25
- CVE-2023-6690 Race condition in Enterprise Server
- CVE-2023-6689 Cross-Site Request Forgery in EFACEC BCU 500
- CVE-2023-6688 Inefficient Regular Expression Complexity in GitLab
- CVE-2023-6687 Elastic Agent Insertion of Sensitive Information into Log File
- CVE-2023-6684 Ibtana – WordPress Website Builder <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2023-6683 Qemu: vnc: null pointer dereference in qemu_clipboard_request()
- CVE-2023-6682 Inefficient Regular Expression Complexity in GitLab
- CVE-2023-6681 Jwcrypto: denail of service via specifically crafted jwe
- CVE-2023-6680 Improper Certificate Validation in GitLab
- CVE-2023-6679 Kernel: null pointer dereference in dpll_pin_parent_pin_set() in drivers/dpll/dpll_netlink.c
- CVE-2023-6678 Inefficient Regular Expression Complexity in GitLab
- CVE-2023-6677 SQLi in Oduyo Online Collection Software
- CVE-2023-6676 Cross Site Request Forgery in National Keep's CyberMath
- CVE-2023-6675 Malicious File Upload in National Keep's CyberMath
- CVE-2023-6673 Reflected XSS in National Keep's CyberMath
- CVE-2023-6672 Stored XSS in National Keep's CyberMath
- CVE-2023-6671 Cross-Site Request Forgery on OPEN JOURNAL SYSTEMS
- CVE-2023-6660 NFS client data corruption and kernel memory disclosure
- CVE-2023-6659 Campcodes Web-Based Student Clearance System login.php sql injection
- CVE-2023-6658 SourceCodester Simple Student Attendance System sql injection
- CVE-2023-6657 SourceCodester Simple Student Attendance System student_form.php sql injection
- CVE-2023-6656 DeepFaceLab DFLJPG.py deserialization
- CVE-2023-6655 Hongjing e-HR Login Interface loadhistroyorgtree sql injection
- CVE-2023-6654 PHPEMS Session Data session.cls.php deserialization
- CVE-2023-6653 PHPGurukul Teacher Subject Allocation Management System Create a new Subject subject.php cross-site request forgery
- CVE-2023-6652 code-projects Matrimonial Site register.php register sql injection
- CVE-2023-6651 code-projects Matrimonial Site sql injection
- CVE-2023-6650 SourceCodester Simple Invoice Generator System login.php cross site scripting
- CVE-2023-6649 PHPGurukul Teacher Subject Allocation Management System index.php cross site scripting
- CVE-2023-6648 PHPGurukul Nipah Virus Testing Management System password-recovery.php sql injection
- CVE-2023-6647 AMTT HiBOS sql injection
- CVE-2023-6646 linkding cross site scripting
- CVE-2023-6645 Post Grid Combo – 36+ Gutenberg Blocks <= 2.2.64 - Authenticated (Contributor+) Cross-Site Scripting
- CVE-2023-6640 Silicon Labs PC Controller v5.54.0 and Earlier Denial of Service Vulnerability
- CVE-2023-6638 GTG Product Feed for Shopping <= 1.2.4 - Missing Authorization to Unauthenticated Plugin Settings Update
- CVE-2023-6637 CAOS | Host Google Analytics Locally <= 4.7.14 - Missing Authorization to Unauthenticated Plugin Settings Update
- CVE-2023-6636 Greenshift – animation and page builder blocks <= 7.6.2 - Authenticated (Administrator+) Arbitrary File Upload
- CVE-2023-6635 EditorsKit <= 1.40.3 - Authenticated (Administrator+) Arbitrary File Upload
- CVE-2023-6634 LearnPress <= 4.2.5.7 - Command Injection
- CVE-2023-6633 Site Notes <= 2.0.0 - Admin Note Deletion via CSRF
- CVE-2023-6632 Happy Addons for Elementor <= 3.9.1.1 - Reflected Cross-Site Scripting
- CVE-2023-6631 Subnet Solutions Inc. PowerSYSTEM Center Unquoted Search Path or Element
- CVE-2023-6630 Contact Form 7 – Dynamic Text Extension <= 4.1.0 - Insecure Direct Object Reference
- CVE-2023-6629 POST SMTP Mailer <= 2.8.6 - Reflected Cross-Site Scripting via msg
- CVE-2023-6627 WP Go Maps < 9.0.28 - Unauthenticated Stored XSS
- CVE-2023-6626 Product Enquiry for WooCommerce < 3.1 - Admin+ Stored XSS
- CVE-2023-6625 Product Enquiry for WooCommerce < 3.1 - Arbitrary Enquiry Deletion via CSRF
- CVE-2023-6624 Cross-site scripting in Import and export users and customers
- CVE-2023-6623 Essential Blocks < 4.4.3 - Unauthenticated Local File Inclusion
- CVE-2023-6622 Kernel: null pointer dereference vulnerability in nft_dynset_init()
- CVE-2023-6621 Post SMTP < 2.8.7 - Reflected Cross-Site Scripting
- CVE-2023-6620 Post SMTP < 2.8.7 - Admin+ SQL Injection
- CVE-2023-6619 SourceCodester Simple Student Attendance System class_form.php sql injection
- CVE-2023-6618 SourceCodester Simple Student Attendance System index.php file inclusion
- CVE-2023-6617 SourceCodester Simple Student Attendance System attendance.php sql injection
- CVE-2023-6616 SourceCodester Simple Student Attendance System index.php cross site scripting
- CVE-2023-6615 Typecho manage-users.php information disclosure
- CVE-2023-6614 Typecho Page manage-pages.php backdoor
- CVE-2023-6613 Typecho Logo options-theme.php cross site scripting