Vulnerabilities published in 2023
42,916 vulnerabilities were published in 2023: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 135 of 430.
- CVE-2023-6037 WP TripAdvisor Review Slider < 11.9 - Admin+ Stored XSS
- CVE-2023-6036 Web3 – Crypto wallet Login & NFT token gating < 3.0.0 - Authentication Bypass
- CVE-2023-6035 EazyDocs < 2.3.4 - Subscriber + SQLi
- CVE-2023-6033 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2023-6032 Path traversal in Galaxy VL
- CVE-2023-6030 LogDash Activity Log < 1.1.4 - Unauthenticated SQLi
- CVE-2023-6029 EazyDocs < 2.3.6 - Unauthenticated Arbitrary Posts Deletion and Document Management
- CVE-2023-6028 SDM Web interface vulnerable to XSS
- CVE-2023-6027 Cross-site Scripting vulnerability in PHPMemcachedAdmin
- CVE-2023-6026 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in PHPMemcachedAdmin
- CVE-2023-6023 ModelDB Local File Include
- CVE-2023-6022 Cross-Site Request Forgery (CSRF) in prefecthq/prefect
- CVE-2023-6021 Ray Log File Local File Include
- CVE-2023-6020 Ray Static File Local File Include
- CVE-2023-6019 Ray Command Injection in cpu_profile Parameter
- CVE-2023-6018 MLflow Arbitrary File Write
- CVE-2023-6017 H2O S3 Bucket Takeover
- CVE-2023-6016 H2O Remote Code Execution via POJO Model Import
- CVE-2023-6015 MLflow Arbitrary File Upload
- CVE-2023-6014 MLflow Authentication Bypass
- CVE-2023-6013 H2O Local File Include
- CVE-2023-6012 Incorrect input data validation in Lanaccess ONSAFE MonitorHM Web Console
- CVE-2023-6011 Stored XSS in Geodi
- CVE-2023-6009 UserPro <= 5.1.4 - Authenticated (Subscriber+) Privilege Escalation
- CVE-2023-6008 UserPro <= 5.1.1 - Cross-Site Request Forgery via multiple functions
- CVE-2023-6007 UserPro <= 5.1.1 - Missing Authorization via multiple functions
- CVE-2023-6006 Privilege Escalation Vulnerability
- CVE-2023-6005 EventON (Free < 2.2.7, Premium < 4.5.5) - Admin+ Stored Cross-Site Scripting
- CVE-2023-6004 Libssh: proxycommand/proxyjump features allow injection of malicious code through hostname
- CVE-2023-6002 Log Injection
- CVE-2023-6001 Prometheus Metrics Accessible Pre-Authentication
- CVE-2023-6000 Popup Builder < 4.2.3 - Unauthenticated Stored XSS
- CVE-2023-5998 Out-of-bounds Read in gpac/gpac
- CVE-2023-5997 Use after free in Chrome
- CVE-2023-5996 Use after free in Chrome
- CVE-2023-5995 Incorrect Authorization in GitLab
- CVE-2023-5993 Privilege Escalation in SafeNet Authentication Client Installer
- CVE-2023-5992 Opensc: side-channel leaks while stripping encryption pkcs#1 padding
- CVE-2023-5991 Hotel Booking Lite < 4.8.5 - Unauthenticated Arbitrary File Download & Deletion
- CVE-2023-5990 Funnelforms Free < 3.4.2 - Form Deletion/Duplication via CSRF
- CVE-2023-5989 Stored XSS in Uyumsoft ERP
- CVE-2023-5988 Reflected XSS in Uyumsoft ERP
- CVE-2023-5987 Cross-site scripting in EcoStruxure Power Monitoring Expert (PME)
- CVE-2023-5986 Open redirect in EcoStruxure Power Monitoring Expert (PME)
- CVE-2023-5985 Cross-site scripting in ION8650
- CVE-2023-5984 Security feature bypass in ION8650
- CVE-2023-5983 Information Disclosure in Botanik Software Pharmacy Automation
- CVE-2023-5982 UpdraftPlus <= 1.23.10 - Cross-Site Request Forgery to Google Drive Storage Update
- CVE-2023-5981 Gnutls: timing side-channel in the rsa-psk authentication
- CVE-2023-5980 BSK Forms Blacklist < 3.7 - Admin+ Stored Cross-Site Scripting
- CVE-2023-5979 eCommerce Product Catalog Plugin for WordPress < 3.3.26 - Products Deletion via CSRF
- CVE-2023-5978 Incorrect libcap_net limitation list manipulation
- CVE-2023-5976 Improper Access Control in microweber/microweber
- CVE-2023-5975 ImageMapper <= 1.2.6 - Cross-Site Request Forgery to Plugin Settings Change via ajax
- CVE-2023-5974 WPB Show Core <= 2.2 - Unauthenticated Server Side Request Forgery
- CVE-2023-5973 Truncated port name
- CVE-2023-5972 Kernel: the nfta_inner_num and nfta_expr_name netlink attributes accessed without checking its presence in nft_inner.c
- CVE-2023-5971 Save as PDF < 3.2.0 - Admin+ Stored XSS
- CVE-2023-5970 Auth bypass in SMA100
- CVE-2023-5969 Denial of Service via Link Preview in /api/v4/redirect_location
- CVE-2023-5968 Password hash in response body after username update
- CVE-2023-5967 Denial of Service via crashing the Calls Plugin
- CVE-2023-5966 Unrestricted Upload of File with Dangerous Type in EspoCRM
- CVE-2023-5965 Unrestricted Upload of File with Dangerous Type in EspoCRM
- CVE-2023-5964 1E-Exchange-DisplayMessage instruction allows for arbitrary code execution
- CVE-2023-5963 Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2023-5962 ioLogik E1200 Series: Weak Cryptographic Algorithm Vulnerability
- CVE-2023-5961 ioLogik E1200 Series: Cross-Site Request Forgery (CSRF) Vulnerability
- CVE-2023-5960 Privilege escalation in USG FLEX series firmware
- CVE-2023-5959 Byzoro Smart S85F Management Platform login.php password recovery
- CVE-2023-5958 POST SMTP Mailer < 2.7.1 - Unauthenticated Cross-site Scripting
- CVE-2023-5957 Ni Purchase Order(PO) For WooCommerce <= 1.2.1 - Admin+ File Upload to Remote Code Execution
- CVE-2023-5956 Wp-Adv-Quiz <= 1.0.2 - Admin+ Stored XSS in Quiz Overview
- CVE-2023-5955 Contact Form Email < 1.3.44 - Editor+ Stored Cross-Site Scripting
- CVE-2023-5954 Vault Requests Triggering Policy Checks May Lead To Unbounded Memory Consumption
- CVE-2023-5953 Welcart e-Commerce < 2.9.5 - Subscriber+ Arbitrary File Upload
- CVE-2023-5952 Welcart e-Commerce < 2.9.5 - Unauthenticated PHP Object Injection
- CVE-2023-5951 Welcart e-Commerce < 2.9.5 - Reflected XSS
- CVE-2023-5950 Rapid7 Velociraptor Reflected XSS
- CVE-2023-5949 SmartCrawl WordPress SEO checker < 3.8.3 - Unauthenticated Password Protected Post Disclosure
- CVE-2023-5948 Improper Authorization in teamamaze/amazefileutilities
- CVE-2023-5946 Cross-site scripting in Digirisk
- CVE-2023-5945 Cross-site request forgery in video carousel slider with lightbox
- CVE-2023-5944 Delta Electronics DOPSoft Stack-based Buffer Overflow
- CVE-2023-5943 Wp-Adv-Quiz < 1.0.3 - Admin+ Stored XSS
- CVE-2023-5942 Medialist < 1.4.1 - Contributor+ Stored XSS
- CVE-2023-5941 libc stdio buffer overflow
- CVE-2023-5940 WP Not Login Hide <= 1.0 - Admin+ Stored XSS
- CVE-2023-5939 rtMedia for WordPress, BuddyPress and bbPress < 4.6.16 - Admin+ RCE
- CVE-2023-5938 Path traversal via 'zip slip' in Arc before v1.6.0
- CVE-2023-5937 Sensitive data exfiltration via unsafe permissions on Windows systems in Arc before v1.6.0
- CVE-2023-5936 Unsafe temporary data privileges on Unix systems in Arc before v1.6.0
- CVE-2023-5935 Missing authentication for local web interface in Arc before v1.6.0
- CVE-2023-5934 Travelpayouts < 1.1.13 - Settings Update via CSRF
- CVE-2023-5933 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab
- CVE-2023-5932 Travelpayouts < 1.1.14 - Reflected XSS
- CVE-2023-5931 rtMedia for WordPress, BuddyPress and bbPress < 4.6.16 - Subscriber+ RCE
- CVE-2023-5930 Campcodes Simple Student Information System manage_academic.php cross site scripting
- CVE-2023-5929 Campcodes Simple Student Information System manage_academic.php sql injection
- CVE-2023-5928 Campcodes Simple Student Information System manage_department.php sql injection