Vulnerabilities published in 2023
42,916 vulnerabilities were published in 2023: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 131 of 430.
- CVE-2023-6502 Inefficient Regular Expression Complexity in GitLab
- CVE-2023-6501 Splashscreen <= 0.20 - Settings Update via CSRF
- CVE-2023-6500 Shariff Wrapper <= 4.6.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2023-6499 lasTunes <= 3.6.1 - Settings Update via CSRF
- CVE-2023-6498 Complianz | GDPR/CCPA Cookie Consent <= 6.5.5 - Authenticated(Administrator+) Stored Cross-site Scripting via settings
- CVE-2023-6497 WordPress Simple Shopping Cart <= 4.7.1 - Authenticated(Administrator+) Stored Cross-Site Scripting
- CVE-2023-6496 Manage Notification E-mails <= 1.8.5 - Missing Authorization
- CVE-2023-6495 YARPP – Yet Another Related Posts Plugin <= 5.30.9 - Authenticated(Administrator+) Cross-Site Scripting
- CVE-2023-6494 WPC Smart Quick View for WooCommerce <= 4.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
- CVE-2023-6493 Depicter Slider – Responsive Image Slider, Video Slider & Post Slider <= 2.0.6 - Cross-Site Request Forgery via save
- CVE-2023-6492 Simple Sitemap <= 3.5.13 - Cross-Site Request Forgery via admin_notices
- CVE-2023-6491 Strong Testimonials <= 3.1.12 - Authenticated(Contributor+) Improper Authorization to Views Modification
- CVE-2023-6489 Inefficient Regular Expression Complexity in GitLab
- CVE-2023-6488 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2023-6487 LuckyWP Table of Contents <= 2.1.5 - Authenticated (Administrator+) Cross-Site Scripting
- CVE-2023-6486 Spectra – WordPress Gutenberg Blocks <= 2.10.3 - Authenticated(Contributor+) Cross-Site Scripting via Custom CSS
- CVE-2023-6485 Html5 Video Player < 2.5.19 - Subscriber+ Stored XSS
- CVE-2023-6484 Keycloak: log injection during webauthn authentication or registration
- CVE-2023-6483 Improper Authentication Vulnerability in ADiTaaS
- CVE-2023-6482 Encryption key derived from static host information
- CVE-2023-6481 Logback "receiver" DOS vulnerability CVE-2023-6378 incomplete fix
- CVE-2023-6478 Xorg-x11-server: out-of-bounds memory read in rrchangeoutputproperty and rrchangeproviderproperty
- CVE-2023-6477 Incorrect Privilege Assignment in GitLab
- CVE-2023-6476 Cri-o: pods are able to break out of resource confinement on cgroupv2
- CVE-2023-6474 PHPGurukul Nipah Virus Testing Management System manage-phlebotomist.php cross-site request forgery
- CVE-2023-6473 SourceCodester Online Quiz System take-quiz.php cross site scripting
- CVE-2023-6472 PHPEMS Content Section api.cls.php cross site scripting
- CVE-2023-6467 Thecosy IceCMS Comment Like improper enforcement of a single, unique action
- CVE-2023-6466 Thecosy IceCMS User Comment planet cross site scripting
- CVE-2023-6465 PHPGurukul Nipah Virus Testing Management System registered-user-testing.php cross site scripting
- CVE-2023-6464 SourceCodester User Registration and Login System add-user.php sql injection
- CVE-2023-6463 SourceCodester User Registration and Login System add-user.php cross site scripting
- CVE-2023-6462 SourceCodester User Registration and Login System delete-user.php cross site scripting
- CVE-2023-6461 Cross-site Scripting (XSS) - Reflected in viliusle/minipaint
- CVE-2023-6460 Information leak in nodejs-firestore
- CVE-2023-6459 Public endpoint /metrics of Calls plugin reveals channel IDs
- CVE-2023-6458 Client side path traversal due to lack of route parameters validation
- CVE-2023-6457 File and Directory Permission Vulnerability in Hitachi Tuning Manager
- CVE-2023-6456 WP Review Slider < 13.0 - Admin+ Stored XSS
- CVE-2023-6452 Cross-site scripting in Web Security
- CVE-2023-6451 Publicly Known Cryptographic Machine Key In Procura Portal Application
- CVE-2023-6450 Denial of service in Lenovo App Store Application
- CVE-2023-6449 Contact Form 7 <= 5.8.3 - Authenticated (Editor+) Arbitrary File Upload
- CVE-2023-6448 Unitronics Vision PLC and HMI Insecure Default Password
- CVE-2023-6447 EventPrime < 3.3.6 - Unauthenticated Event Access
- CVE-2023-6446 Calculated Fields Form <= 1.2.40 - Authenticated (Admin+) Stored Cross-Site Scripting
- CVE-2023-6444 Seriously Simple Podcasting < 3.0.0 - Unauthenticated Administrator Email Disclosure
- CVE-2023-6442 PHPGurukul Nipah Virus Testing Management System add-phlebotomist.php cross site scripting
- CVE-2023-6441 SQLi in UNI-PA's University Information System
- CVE-2023-6440 SourceCodester Book Borrower System add-book.php cross site scripting
- CVE-2023-6439 ZenTao PMS cross site scripting
- CVE-2023-6438 Thecosy IceCMS Like improper enforcement of a single, unique action
- CVE-2023-6437 Authenticated RCE
- CVE-2023-6436 SQLi in Ekol Bilisim Website Template
- CVE-2023-6435 Cross-site Scripting vulnerability in BigProf products
- CVE-2023-6434 Cross-site Scripting vulnerability in BigProf products
- CVE-2023-6433 Cross-site Scripting vulnerability in BigProf products
- CVE-2023-6432 Cross-site Scripting vulnerability in BigProf products
- CVE-2023-6431 Cross-site Scripting vulnerability in BigProf products
- CVE-2023-6430 Cross-site Scripting vulnerability in BigProf products
- CVE-2023-6429 Cross-site Scripting vulnerability in BigProf products
- CVE-2023-6428 Cross-site Scripting vulnerability in BigProf products
- CVE-2023-6427 Cross-site Scripting vulnerability in BigProf products
- CVE-2023-6426 Cross-site Scripting vulnerability in BigProf products
- CVE-2023-6425 Cross-site Scripting vulnerability in BigProf products
- CVE-2023-6424 Cross-site Scripting vulnerability in BigProf products
- CVE-2023-6423 Cross-site Scripting vulnerability in BigProf products
- CVE-2023-6422 Cross-site Scripting vulnerability in BigProf products
- CVE-2023-6421 Download Manager < 3.2.83 - Unauthenticated Protected File Download Password Leak
- CVE-2023-6420 Cross-site Scripting vulnerability in Voovi Social Networking Script
- CVE-2023-6419 Cross-site Scripting vulnerability in Voovi Social Networking Script
- CVE-2023-6418 SQL injection in Voovi Social Networking Script
- CVE-2023-6417 SQL injection in Voovi Social Networking Script
- CVE-2023-6416 SQL injection in Voovi Social Networking Script
- CVE-2023-6415 SQL injection in Voovi Social Networking Script
- CVE-2023-6414 SQL injection in Voovi Social Networking Script
- CVE-2023-6413 SQL injection in Voovi Social Networking Script
- CVE-2023-6412 SQL injection in Voovi Social Networking Script
- CVE-2023-6411 SQL injection in Voovi Social Networking Script
- CVE-2023-6410 SQL injection in Voovi Social Networking Script
- CVE-2023-6409 Hardcoded credentials in EcoStruxure Control Expert
- CVE-2023-6408 Other in EcoStruxure Control Expert
- CVE-2023-6407 Path traversal in Easy UPS Online Monitoring Software
- CVE-2023-6402 PHPGurukul Nipah Virus Testing Management System add-phlebotomist.php sql injection
- CVE-2023-6401 NotePad++ dbghelp.exe uncontrolled search path
- CVE-2023-6400 Incorrect user authorization vulnerability on OpenText ZENworks Configuration Management (ZCM) product.
- CVE-2023-6399 Denial of service in USG FLEX 50(W) series firmware
- CVE-2023-6398 Command injection in NWA50AX firmware
- CVE-2023-6397 Null dereference in ATP series firmware
- CVE-2023-6395 Mock: privilege escalation for users that can access mock configuration
- CVE-2023-6394 Quarkus: graphql operations over websockets bypass
- CVE-2023-6393 Quarkus: potential invalid reuse of context when @cacheresult on a uni is used
- CVE-2023-6391 Custom User CSS <= 0.2 - Settings Update via CSRF
- CVE-2023-6390 WordPress Users <= 1.4 - Settings Update via CSRF
- CVE-2023-6389 WordPress Toolbar <= 2.2.6 - Open Redirect
- CVE-2023-6388 Suite CRM v7.14.2 - SSRF
- CVE-2023-6387 Incorrect buffer parsing in Bluetooth LE sample code may lead to buffer overflow
- CVE-2023-6386 Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2023-6385 WordPress Ping Optimizer <= 2.35.1.3.0 - Log Clearing via CSRF
- CVE-2023-6384 WP User Profile Avatar < 1.0.1 - Author+ Avatar Deletion/Update via IDOR