Vulnerabilities published in 2023
42,916 vulnerabilities were published in 2023: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 130 of 430.
- CVE-2023-6612 Totolink X5000R cstecgi.cgi setWizardCfg os command injection
- CVE-2023-6611 Tongda OA 2017 delete.php sql injection
- CVE-2023-6610 Kernel: oob access in smb2_dump_detail
- CVE-2023-6609 osCommerce all-products cross site scripting
- CVE-2023-6608 Tongda OA 2017 delete.php sql injection
- CVE-2023-6607 Tongda OA 2017 delete.php sql injection
- CVE-2023-6606 Kernel: out-of-bounds read vulnerability in smbcalcsize
- CVE-2023-6605 Ffmpeg: dash playlist ssrf vulnerability in ffmpeg
- CVE-2023-6604 Ffmpeg: hls xbin demuxer dos amplification in ffmpeg
- CVE-2023-6603 Ffmpeg: null pointer dereference in ffmpeg hls parsing
- CVE-2023-6602 Ffmpeg: improper handling of input format in tty demuxer of ffmpeg
- CVE-2023-6601 Ffmpeg: hls unsafe file extension bypass in ffmpeg
- CVE-2023-6600 Missing authorization in OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
- CVE-2023-6599 Missing Standardized Error Handling Mechanism in microweber/microweber
- CVE-2023-6598 SpeedyCache <= 1.1.3 - Missing Authorization to Plugin Options Update
- CVE-2023-6597 Other in CPython
- CVE-2023-6596 Openshift: incomplete fix for rapid reset (cve-2023-44487/cve-2023-39325)
- CVE-2023-6595 WhatsUp Gold Unauthenticated Access to an API Endpoint
- CVE-2023-6594 WordPress Button Plugin MaxButtons <= 9.7.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
- CVE-2023-6593 Missing authorization in Remote Desktop Manager
- CVE-2023-6592 Information disclosure in FastDup
- CVE-2023-6591 Popup Box Pro < 20.9.0 - Admin+ Stored XSS
- CVE-2023-6588 Security feature bypass in Workspace
- CVE-2023-6585 JobSearch WP Job Board < 2.3.4 - Arbitrary File Upload to RCE
- CVE-2023-6584 JobSearch WP Job Board < 2.3.4 - Authentication Bypass
- CVE-2023-6583 Path traversal in Import and export users and customers
- CVE-2023-6582 ElementsKit Lite <= 3.0.3 - Unauthenticated Sensitive Information Exposure
- CVE-2023-6581 D-Link DAR-7000 workidajax.php sql injection
- CVE-2023-6580 D-Link DIR-846 QoS POST deserialization
- CVE-2023-6579 osCommerce POST Parameter shopping-cart sql injection
- CVE-2023-6578 Software AG WebMethods access control
- CVE-2023-6577 Byzoro PatrolFlow 2530Pro mailsendview.php path traversal
- CVE-2023-6576 Byzoro S210 HTTP POST Request uploadfile.php unrestricted upload
- CVE-2023-6575 Byzoro S210 HTTP POST Request repair.php sql injection
- CVE-2023-6574 Byzoro Smart S20 HTTP POST Request updateos.php unrestricted upload
- CVE-2023-6573 Information disclosure in HPE OneView
- CVE-2023-6572 Command Injection in gradio-app/gradio
- CVE-2023-6571 Cross-site Scripting (XSS) - Reflected in kubeflow/kubeflow
- CVE-2023-6570 Server-Side Request Forgery (SSRF) in kubeflow/kubeflow
- CVE-2023-6569 External Control of File Name or Path in h2oai/h2o-3
- CVE-2023-6568 Reflected XSS via Content-Type Header in mlflow/mlflow
- CVE-2023-6567 LearnPress <= 4.2.5.7 - Unauthenticated SQL Injection via order_by
- CVE-2023-6566 Business Logic Errors in microweber/microweber
- CVE-2023-6565 InfiniteWP Client <= 1.12.3 - Unauthenticated Sensitive Information Exposure
- CVE-2023-6564 Incorrect Authorization in GitLab
- CVE-2023-6563 Keycloak: offline session token dos
- CVE-2023-6562 Path traversal in Kakadu SDK
- CVE-2023-6561 Cross-site scripting in Featured Image from URL (FIFU)
- CVE-2023-6560 Kernel: io_uring out of boundary memory access in __io_uaddr_map()
- CVE-2023-6559 MW WP Form <= 5.0.3 - Improper Limitation of File Name to Unauthenticated Arbitrary File Deletion
- CVE-2023-6558 Export and Import Users and Customers <= 2.4.8 - Authenticated (Shop Manager+) Arbitrary File Upload
- CVE-2023-6557 The Events Calendar <= 6.2.8.2 - Unauthenticated Sensitive Information Exposure
- CVE-2023-6556 Cross-site scripting in FOX – Currency Switcher Professional for WooCommerce
- CVE-2023-6555 Email Subscription Popup < 1.2.20 - Reflected XSS
- CVE-2023-6554 Missing authorisation in TCExam
- CVE-2023-6553 Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution
- CVE-2023-6552 Open redirect in TasmoAdmin
- CVE-2023-6551 Stored XSS in class.upload.php
- CVE-2023-6549 Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow
- CVE-2023-6548 Citrix NetScaler ADC and NetScaler Gateway Code Injection
- CVE-2023-6547 Playbooks access/modification by removed team member
- CVE-2023-6546 Kernel: gsm multiplexing race condition leads to privilege escalation
- CVE-2023-6545 Beckhoff: Open redirect in TwinCAT/BSD package authelia-bhf
- CVE-2023-6544 Keycloak: authorization bypass
- CVE-2023-6542 Improper Export of Android Application Components in SAP EMARSYS SDK ANDROID
- CVE-2023-6541 Allow SVG < 1.2.0 - Author+ Stored XSS via SVG
- CVE-2023-6540 Code injection in Lenovo Browser HD
- CVE-2023-6538 Missing authorization in System Management Unit (SMU)
- CVE-2023-6536 Kernel: null pointer dereference in __nvmet_req_complete
- CVE-2023-6535 Kernel: null pointer dereference in nvmet_tcp_execute_request
- CVE-2023-6534 TCP spoofing vulnerability in pf(4)
- CVE-2023-6533 Silicon Labs PC Controller Denial of Service Vulnerability
- CVE-2023-6532 WP Blogs' Planetarium <= 1.0 - Settings Update via CSRF
- CVE-2023-6531 Kernel: gc's deletion of an skb races with unix_stream_read_generic() leading to uaf
- CVE-2023-6530 TJ Shortcodes <= 0.1.3 - Contributor+ Stored XSS via Shortcodes
- CVE-2023-6529 WP VR < 8.3.15 - Unauthenticated Plugin Downgrade leading to XSS
- CVE-2023-6528 Slider Revolution < 6.6.19 - Author+ Insecure Deserialization leading to RCE
- CVE-2023-6527 Email Subscription Popup <= 1.2.18 - Reflected Cross-Site Scripting
- CVE-2023-6526 Meta Box – WordPress Custom Fields Framework <= 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2023-6525 ElementsKit Elementor addons <= 3.0.3 - Authenticated(Editor+) Stored Cross-Site Scripting
- CVE-2023-6524 MapPress Maps for WordPress <= 2.88.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2023-6523 IDOR in ExtremePacs's Extreme XDS
- CVE-2023-6522 Information Disclosure in ExtremePacs's Extreme XDS
- CVE-2023-6520 WP 2FA – Two-factor authentication for WordPress <= 2.5.0 - Cross-Site Request Forgery
- CVE-2023-6519 Seeing admin password hash value in Mia Technology's Mia-Med
- CVE-2023-6518 Password Disclosure in Mia Technology's Mia-Med
- CVE-2023-6517 Seeing the SMS Verification Code in Mia Technology's Mia-Med
- CVE-2023-6516 Specific recursive query patterns may lead to an out-of-memory condition
- CVE-2023-6515 IDOR in Mia Technology's Mia-Med
- CVE-2023-6514 Auth bypass in AJMD-370S
- CVE-2023-6512 Other in Chrome
- CVE-2023-6511 Security feature bypass in Chrome
- CVE-2023-6510 Use after free in Chrome
- CVE-2023-6509 Use after free in Chrome
- CVE-2023-6508 Use after free in Chrome
- CVE-2023-6507 Groups not dropped before running subprocess when using empty 'extra_groups' parameter
- CVE-2023-6506 WP 2FA <= 2.5.0 - Insecure Direct Object Reference to Arbitrary Email Sending
- CVE-2023-6505 Prime Mover < 1.9.3 - Directory Listing to Sensitive Data Exposure
- CVE-2023-6504 Profile Builder <= 3.10.7 - Insecure Direct Object Reference to Sensitive Information Exposure via user_meta Shortcode
- CVE-2023-6503 WP Plugin Lister <= 2.1.0 - Settings Update to Stored XSS via CSRF