Vulnerabilities published in 2023
42,916 vulnerabilities were published in 2023: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 132 of 430.
- CVE-2023-6383 Debug Log Manager < 2.3.0 - Sensitive Logs Exposure
- CVE-2023-6382 Master Slider - Responsive Touch Slider <= 3.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2023-6381 Improper input validation in Newsletter Software SuperMailer
- CVE-2023-6380 Open Redirect in Alkacon Software OpenCms
- CVE-2023-6379 Cross-site Scripting in Alkacon Software OpenCms
- CVE-2023-6378 Logback "receiver" DOS vulnerability
- CVE-2023-6377 Xorg-x11-server: out-of-bounds memory reads/writes in xkb button actions
- CVE-2023-6376 Henschen & Associates court document management software cache uses predictable file names
- CVE-2023-6375 Tyler Technologies Magistrate Court Case Management Plus stores backups insecurely
- CVE-2023-6374 Auth bypass in MELSEC WS Series WS0-GETH00200
- CVE-2023-6373 ArtPlacer Widget < 2.20.7 - Editor+ SQLi
- CVE-2023-6371 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2023-6369 Export WP Page to Static HTML/CSS <= 2.1.9 - Missing Authorization via Multiple AJAX Actions
- CVE-2023-6368 WhatsUp Gold Unauthenticated Access to an API Endpoint
- CVE-2023-6367 WhatsUp Gold Stored Cross-Site Scripting (XSS) via Roles
- CVE-2023-6366 WhatsUp Gold Stored Cross-Site Scripting (XSS) via Alert Center
- CVE-2023-6365 WhatsUp Gold Stored Cross-Site Scripting (XSS) via Device Groups
- CVE-2023-6364 WhatsUp Gold Stored Cross-Site Scripting (XSS) via Dashboard
- CVE-2023-6363 Mali GPU Kernel Driver allows improper GPU processing operations
- CVE-2023-6362 Memory corruption in WinHex
- CVE-2023-6361 Memory corruption in WinHex
- CVE-2023-6360 SQL injection in joedolson:my calendar
- CVE-2023-6359 Cross-Site Scripting in Alumne LMS
- CVE-2023-6357 OS Command Injection in multiple CODESYS products
- CVE-2023-6356 Kernel: null pointer dereference in nvmet_tcp_build_iovec
- CVE-2023-6355 Security feature bypass in Controller 7000
- CVE-2023-6354 Tyler Technologies Magistrate Court Case Management Plus PDFViewer.aspx allows authentication bypass
- CVE-2023-6353 Tyler Technologies Civil and Criminal Electronic Filing Upload.aspx allows authentication bypass
- CVE-2023-6352 Aquaforest TIFF Server default configuration allows access to arbitrary files
- CVE-2023-6351 Use after free in Chrome
- CVE-2023-6350 Use after free in Chrome
- CVE-2023-6349 Heap overflow in libvpx
- CVE-2023-6348 Memory corruption in Chrome
- CVE-2023-6347 Use after free in Chrome
- CVE-2023-6346 Use after free in Chrome
- CVE-2023-6345 Google Skia Integer Overflow
- CVE-2023-6344 Auth bypass in Court Case Management Plus
- CVE-2023-6343 Tyler Technologies Court Case Management Plus use of Aquaforest TIFF Server tssp.aspx allows authentication bypass
- CVE-2023-6342 Tyler Technologies Court Case Management Plus "pay for print" allows authentication bypass
- CVE-2023-6341 Catalis CM360 allows authentication bypass
- CVE-2023-6340 Memory corruption in Capture Client
- CVE-2023-6339 Google Nest WiFi Pro root code-execution & user-data compromise
- CVE-2023-6338 Privilege escalation in Universal Device Client (UDC)
- CVE-2023-6337 Vault May be Vulnerable to a Denial of Service Through Memory Exhaustion When Handling Large HTTP Requests
- CVE-2023-6336 Path traversal in Workforce Access
- CVE-2023-6335 Path traversal in Workforce Access
- CVE-2023-6334 Memory corruption in Workforce Access
- CVE-2023-6333 Cross-site Scripting in ControlByWeb Relays
- CVE-2023-6329 Control iD iDSecure passwordCustom Authentication Bypass
- CVE-2023-6327 ShopLentor (formerly WooLentor) <= 2.8.7 - Missing Authorization via purchased_new_products
- CVE-2023-6326 Master Slider - Responsive Touch Slider <= 3.9.10 - Cross-Site Request Forgery via process_bulk_action
- CVE-2023-6325 RomethemeForm For Elementor <= 1.1.5 - Missing Authorization via export_entries, rtformnewform, and rtformupdate
- CVE-2023-6324 ThroughTek Kalay SDK error in handling the PSK identity
- CVE-2023-6323 ThroughTek Kalay SDK insufficient verification of message authenticity
- CVE-2023-6322 Stack-based buffer overflow in message parser functionality
- CVE-2023-6321 Owlet Camera OS command injection
- CVE-2023-6320 Command injection in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint
- CVE-2023-6319 Command injection in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service
- CVE-2023-6318 Command injection in the processAnalyticsReport method from the com.webos.service.cloudupload service
- CVE-2023-6317 PIN/prompt bypass on the secondscreen.gateway service allows access to the SSAP API without user interaction
- CVE-2023-6316 MW WP Form <= 5.0.1 - Unauthenticated Arbitrary File Upload
- CVE-2023-6315 Memory corruption in Control FPWIN Pro
- CVE-2023-6314 Memory corruption in Control FPWIN Pro
- CVE-2023-6313 SourceCodester URL Shortener Long URL cross site scripting
- CVE-2023-6312 SourceCodester Loan Management System Users Page deleteUser.php delete_user sql injection
- CVE-2023-6311 SourceCodester Loan Management System Loan Type Page delete_ltype.php delete_ltype sql injection
- CVE-2023-6310 SourceCodester Loan Management System deleteBorrower.php delete_borrower sql injection
- CVE-2023-6309 moses-smt mosesdecoder trans_result.php os command injection
- CVE-2023-6308 Xiamen Four-Faith Video Surveillance Management System Apache Struts unrestricted upload
- CVE-2023-6307 jeecgboot JimuReport image path traversal
- CVE-2023-6306 SourceCodester Free and Open Source Inventory Management System member_data.php sql injection
- CVE-2023-6305 SourceCodester Free and Open Source Inventory Management System suppliar_data.php sql injection
- CVE-2023-6304 Tecno 4G Portable WiFi TR118 Ping Tool goform_get_cmd_process os command injection
- CVE-2023-6303 CSZCMS Site Settings Page cross site scripting
- CVE-2023-6302 CSZCMS File Manager Page templates permission
- CVE-2023-6301 SourceCodester Best Courier Management System GET Parameter parcel_list.php cross site scripting
- CVE-2023-6300 SourceCodester Best Courier Management System cross site scripting
- CVE-2023-6299 Apryse iText Reference Table PdfDocument.java memory leak
- CVE-2023-6298 Apryse iText PdfDocument.java main array index
- CVE-2023-6297 PHPGurukul Nipah Virus Testing Management System Search Report Page patient-search-report.php cross site scripting
- CVE-2023-6296 osCommerce Instant Message compare cross site scripting
- CVE-2023-6295 so-widgets-bundle < 1.51.0 - Admin+ Local File Inclusion
- CVE-2023-6294 popup-builder < 4.2.6 - Admin+ SSRF & File Read
- CVE-2023-6293 Prototype Pollution in robinbuschmann/sequelize-typescript
- CVE-2023-6292 Ecwid Ecommerce Shopping Cart < 6.12.5 - Arbitrary Plugin Settings Change via CSRF
- CVE-2023-6291 Keycloak: redirect_uri validation bypass
- CVE-2023-6290 WP SEO Press < 7.3 - Admin+ Stored XSS
- CVE-2023-6289 Swift Performance Lite <= 2.3.6.14 - Unauthenticated Configuration Export
- CVE-2023-6288 Code injection in Remote Desktop Manager
- CVE-2023-6287 Backup password in GET parameter
- CVE-2023-6282 Cross-Site Scripting vulnerability in IceHrm
- CVE-2023-6280 XML External Entity Reference on 52North WPS
- CVE-2023-6279 Woostify Sites Library < 1.4.8 - Subscriber+ Arbitrary Options Update to DoS
- CVE-2023-6278 Biteship for WooCommerce < 2.2.25 - Reflected Cross-Site Scripting
- CVE-2023-6277 Libtiff: out-of-memory in tiffopen via a craft file
- CVE-2023-6276 Tongda OA 2017 delete.php sql injection
- CVE-2023-6275 TOTVS Fluig Platform mobileredir openApp.jsp cross site scripting
- CVE-2023-6274 Byzoro Smart S80 PHP File updatelib.php unrestricted upload
- CVE-2023-6273 Misconfiguration in EMUI
- CVE-2023-6272 Theme My Login 2FA < 1.2 - Lack of Rate Limiting