Vulnerabilities published in 2023
42,916 vulnerabilities were published in 2023: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 139 of 430.
- CVE-2023-5607 Path traversal in Trellix Application and Change Control (TACC)
- CVE-2023-5606 Cross-site scripting in AI ChatBot
- CVE-2023-5605 URL Shortify < 1.7.9.1 - Admin+ Stored XSS
- CVE-2023-5604 Asgaros Forum < 2.7.1 - Unauthenticated Arbitrary File Upload
- CVE-2023-5602 Social Media Share Buttons & Social Sharing Icons <= 2.8.5 - Cross-Site Request Forgery
- CVE-2023-5601 WooCommerce Ninja Forms Product Add-ons < 1.7.1 - Unauthenticated Arbitrary File Upload
- CVE-2023-5600 Missing Authorization in GitLab
- CVE-2023-5599 Cross-site scripting in 3DSwymer
- CVE-2023-5598 Cross-site scripting in 3DSwymer
- CVE-2023-5597 Cross-site scripting in 3DSwymer
- CVE-2023-5595 Denial of Service in gpac/gpac
- CVE-2023-5594 Improper following of a certificate's chain of trust in ESET security products
- CVE-2023-5593 Memory corruption in SecuExtender SSL VPN Client
- CVE-2023-5592 Phoenix Contact: ProConOs prone to Download of Code Without Integrity Check
- CVE-2023-5591 SQL Injection in librenms/librenms
- CVE-2023-5590 NULL Pointer Dereference in seleniumhq/selenium
- CVE-2023-5589 SourceCodester Judging Management System login.php sql injection
- CVE-2023-5588 kphrx pleroma pack.ex Pleroma.Emoji.Pack path traversal
- CVE-2023-5587 SourceCodester Free Hospital Management System for Small Practices Parameter doctors.php sql injection
- CVE-2023-5586 NULL Pointer Dereference in gpac/gpac
- CVE-2023-5585 SourceCodester Online Motorcycle Rental System Bike List cross site scripting
- CVE-2023-5583 WP Simple Galleries <= 1.34 - Authenticated (Contributor+) PHP Object Injection
- CVE-2023-5582 ZZZCMS Personal Profile Page cross site scripting
- CVE-2023-5581 SourceCodester Medicine Tracker System index.php cross site scripting
- CVE-2023-5580 SourceCodester Library System index.php sql injection
- CVE-2023-5579 yhz66 Sandbox User Data information disclosure
- CVE-2023-5578 Portábilis i-Educar HTTP GET Request agenda_imprimir.php cross site scripting
- CVE-2023-5577 Bitly's WordPress Plugin <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2023-5576 Migration, Backup, Staging – WPvivid <= 0.9.91 - Google Drive Client Secret Exposure
- CVE-2023-5575 Missing authorization in Server
- CVE-2023-5574 Xorg-x11-server: use-after-free bug in damagedestroy
- CVE-2023-5573 Allocation of Resources Without Limits or Throttling in vriteio/vrite
- CVE-2023-5572 Server-Side Request Forgery (SSRF) in vriteio/vrite
- CVE-2023-5571 Improper Input Validation in vriteio/vrite
- CVE-2023-5570 User Enumeration in Inohom's Home Manager Gateway
- CVE-2023-5568 Samba: heap buffer overflow with freshness tokens in the heimdal kdc
- CVE-2023-5567 QR Code Tag <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2023-5566 Simple Shortcodes <= 1.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2023-5565 Shortcode Menu <= 3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2023-5564 Cross-site Scripting (XSS) - Stored in froxlor/froxlor
- CVE-2023-5563 Denial of service in Zephyr
- CVE-2023-5562 Unsafe default allows for cross-site scripting attacks in KNIME Server and KNIME Business Hub
- CVE-2023-5561 WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure
- CVE-2023-5560 WP-UserOnline < 2.88.3 - Unauthenticated Stored XSS
- CVE-2023-5559 10Web Booster < 2.24.18 - Unauthenticated Arbitrary Option Deletion
- CVE-2023-5558 LearnPress < 4.2.5.5 - Reflected Cross-Site Scripting
- CVE-2023-5557 Tracker-miners: sandbox escape
- CVE-2023-5556 Cross-site Scripting (XSS) - Reflected in structurizr/onpremises
- CVE-2023-5555 Cross-site Scripting (XSS) - Generic in frappe/lms
- CVE-2023-5554 Security feature bypass in LINE client for iOS
- CVE-2023-5553 Security feature bypass in AXIS OS
- CVE-2023-5552 Information disclosure in Sophos Firewall
- CVE-2023-5551 Moodle: forum summary report shows students from other groups when in separate groups mode
- CVE-2023-5550 Moodle: rce due to lfi risk in some misconfigured shared hosting environments
- CVE-2023-5549 Moodle: insufficient capability checks when updating the parent of a course category
- CVE-2023-5548 Moodle: cache poisoning risk with endpoint revision numbers
- CVE-2023-5547 Moodle: xss risk when previewing data in course upload tool
- CVE-2023-5546 Moodle: stored xss in quiz grading report via user id number
- CVE-2023-5545 Moodle: auto-populated h5p author name causes a potential information leak
- CVE-2023-5544 Moodle: stored xss and potential idor risk in wiki comments
- CVE-2023-5543 Moodle: duplicating a bigbluebutton activity assigns the same meeting id
- CVE-2023-5542 Moodle: students can view other users in "only see own membership" groups
- CVE-2023-5541 Moodle: xss risk when using csv grade import method
- CVE-2023-5540 Moodle: authenticated remote code execution risk in imscp
- CVE-2023-5539 Moodle: authenticated remote code execution risk in lesson
- CVE-2023-5538 MpOperationLogs <= 1.0.1 - Unauthenticated Stored Cross-Site Scripting
- CVE-2023-5537 Delete Usermetas <= 1.1.2 - Cross-Site Request Forgery
- CVE-2023-5536 Privilege escalation in Ubuntu Server
- CVE-2023-5535 Use After Free in vim/vim
- CVE-2023-5534 AI ChatBot <= 4.8.9 and 4.9.2 - Cross-Site Request Forgery on AJAX actions
- CVE-2023-5533 AI ChatBot <= 4.8.9 and 4.9.2 - Missing Authorization on AJAX actions
- CVE-2023-5532 ImageMapper <= 1.2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting via imgmap_save_area_title
- CVE-2023-5531 Thumbnail Slider With Lightbox <= 1.0 - Cross-Site Request Forgery
- CVE-2023-5530 Ninja Forms < 3.6.34 - Admin+ Stored XSS
- CVE-2023-5529 Advanced Page Visit Counter <= 8.0.6 - Admin+ Stored XSS
- CVE-2023-5528 Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation
- CVE-2023-5527 Business Directory Plugin <= 6.4.3 - Authenticated (Author+) CSV Injection
- CVE-2023-5525 Limit Login Attempts Reloaded < 2.25.26 - Admin+ Missing Authorization to Toggle Plugin Auto-Update
- CVE-2023-5524 M-Files Web Companion allows Remote Code Execution for some filetypes
- CVE-2023-5523 M-Files Web Companion allows Remote Code Execution
- CVE-2023-5522 Mobile app freezes when receiving a post with hundreds of emojis
- CVE-2023-5521 Incorrect Authorization in tiann/kernelsu
- CVE-2023-5520 Out-of-bounds Read in gpac/gpac
- CVE-2023-5519 EventPrime < 3.2.0 - Booking Creation via CSRF
- CVE-2023-5517 Querying RFC 1918 reverse zones may cause an assertion failure when "nxdomain-redirect" is enabled
- CVE-2023-5516 Information disclosure in eSOMS
- CVE-2023-5515 Information disclosure in eSOMS
- CVE-2023-5514 Information disclosure in eSOMS
- CVE-2023-5512 Improper Control of Generation of Code ('Code Injection') in GitLab
- CVE-2023-5511 Cross-Site Request Forgery (CSRF) in snipe/snipe-it
- CVE-2023-5509 myStickymenu < 2.6.5 - Subscriber+ Arbitrary Form Leads Deletion
- CVE-2023-5507 ImageMapper <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2023-5506 Missing authorization in ImageMapper
- CVE-2023-5505 BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal
- CVE-2023-5504 BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal
- CVE-2023-5502 Auth bypass in EOS
- CVE-2023-5500 Frauscher: FDS102 for FAdC/FAdCi remote code execution vulnerability
- CVE-2023-5499 Shenzhen Reachfar v28 information exposure
- CVE-2023-5498 Cross-Site Request Forgery (CSRF) in chiefonboarding/chiefonboarding
- CVE-2023-5497 Tongda OA 2017 delete.php sql injection