Vulnerabilities published in 2023
42,916 vulnerabilities were published in 2023: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 173 of 430.
- CVE-2023-5084 Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp
- CVE-2023-50839 WordPress JS Help Desk – Best Help Desk & Support Plugin <= 2.8.1 is vulnerable to SQL Injection
- CVE-2023-50838 WordPress NEX-Forms – Ultimate Form Builder Plugin <= 8.5.5 is vulnerable to SQL Injection
- CVE-2023-50837 WordPress Login Lockdown Plugin <= 2.06 is vulnerable to SQL Injection
- CVE-2023-50836 WordPress HTML Forms Plugin <= 1.3.28 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-50835 WordPress Advanced Category Template Plugin <= 0.1 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-50834 WordPress WooCommerce Menu Extension Plugin <= 1.6.2 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-50833 WordPress Colibri Page Builder Plugin <= 1.0.239 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-50832 WordPress Multi Step Form Plugin <= 1.7.13 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-50831 WordPress CURCY Plugin <= 2.2.0 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-50830 WordPress Seos Contact Form Plugin <= 1.8.0 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-50829 WordPress Loan Repayment Calculator and Application Form Plugin <= 2.9.3 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-50828 WordPress Ultimate Dashboard Plugin <= 3.7.11 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-50827 WordPress Accredible Certificates & Open Badges Plugin <= 1.4.8 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-50826 WordPress Menu Image, Icons made easy Plugin <= 3.10 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-50825 WordPress iframe Shortcode Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-50824 Cross-site scripting in Insert or Embed Articulate Content into WordPress
- CVE-2023-50823 WordPress CSS & JavaScript Toolbox Plugin <= 11.7 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-50822 WordPress Currency Converter Widget Plugin <= 3.0.2 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-50821 Memory corruption in SIMATIC PCS 7 V9.1
- CVE-2023-5082 History Log by click5 < 1.0.13 - Admin+ Time-Based Blind SQL Injection
- CVE-2023-50811 Missing authorization in seling:visual access manager
- CVE-2023-50810 In certain Sonos products before Sonos S1 Release 11.12 and S2 release 15.9, a vulnerability exists in the U-Boot component of the firmware
- CVE-2023-5081 Information disclosure in Tablet
- CVE-2023-50809 In certain Sonos products before S1 Release 11.12 and S2 release 15.9, the mt_7615.ko wireless driver does not properly validate an informat
- CVE-2023-50808 Cross-site scripting in zimbra:collaboration
- CVE-2023-50807 Memory corruption in samsung:exynos 9110 firmware
- CVE-2023-50806 Memory corruption in samsung:exynos 1080 firmware
- CVE-2023-50805 Memory corruption in samsung:exynos 1080 firmware
- CVE-2023-50804 Auth bypass in samsung:exynos 1080 firmware
- CVE-2023-50803 Security feature bypass in samsung:exynos 1080 firmware
- CVE-2023-5080 Privilege escalation in Tablet
- CVE-2023-5079 Other in LeCloud Application
- CVE-2023-50786 Information disclosure in Dradis
- CVE-2023-50785 Path traversal in zohocorp:manageengine adaudit plus
- CVE-2023-50784 Memory corruption in unrealircd:unrealircd
- CVE-2023-50783 Apache Airflow: Improper access control vulnerability on the "varimport" endpoint
- CVE-2023-50782 Python-cryptography: bleichenbacher timing oracle attack against rsa decryption - incomplete fix for cve-2020-25659
- CVE-2023-50781 M2crypto: bleichenbacher timing attacks in the rsa decryption api - incomplete fix for cve-2020-25657
- CVE-2023-50780 Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans
- CVE-2023-5078 Security feature bypass in ThinkPad BIOS
- CVE-2023-50779 Missing permission check in Jenkins PaaSLane Estimate Plugin
- CVE-2023-50778 Cross-Site Request Forgery in Jenkins PaaSLane Estimate Plugin
- CVE-2023-50777 Tokens stored in plain text by PaaSLane Estimate Plugin
- CVE-2023-50776 Tokens stored in plain text by PaaSLane Estimate Plugin
- CVE-2023-50775 Cross-site request forgery vulnerability in Jenkins Deployment Dashboard Plugin
- CVE-2023-50774 Cross-site request forgery vulnerability in Jenkins HTMLResource Plugin
- CVE-2023-50773 Displayed in plain text by Dingding JSON Pusher Plugin
- CVE-2023-50772 Tokens stored in plain text by Dingding JSON Pusher Plugin
- CVE-2023-50771 Open redirect vulnerability in Jenkins OpenId Connect Authentication Plugin
- CVE-2023-50770 Password stored in a recoverable format by Jenkins OpenId Connect Authentication Plugin
- CVE-2023-5077 Vault's Google Cloud Secrets Engine Removed Existing IAM Conditions When Creating / Updating Rolesets
- CVE-2023-50769 Jenkins Nexus Platform Plugin missing permission check
- CVE-2023-50768 Jenkins Nexus Platform Plugin Cross-Site Request Forgery vulnerability
- CVE-2023-50767 Jenkins Nexus Platform Plugin missing permission check
- CVE-2023-50766 Jenkins Nexus Platform Plugin Cross-Site Request Forgery vulnerability
- CVE-2023-50765 Missing permission check in Jenkins Scriptler Plugin
- CVE-2023-50764 Arbitrary file deletion vulnerability in Jenkins Scriptler Plugin
- CVE-2023-50763 Denial of service in SIMATIC CP 1542SP-1
- CVE-2023-50762 Security feature bypass in Thunderbird
- CVE-2023-50761 Security feature bypass in Thunderbird
- CVE-2023-50760 Online Notice Board System v1.0 - Insecure File Upload
- CVE-2023-5076 Ziteboard Online Whiteboard <= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via ziteboard Shortcode
- CVE-2023-50753 Online Notice Board System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)
- CVE-2023-50752 Online Notice Board System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)
- CVE-2023-5075 Memory corruption in IdeaPad Duet 3-10IGL5
- CVE-2023-50743 Online Notice Board System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)
- CVE-2023-50740 Apache Linkis DataSource: DataSource module Oracle SQL Database Password Logged
- CVE-2023-5074 Authentication Bypass in D-Link D-View 8
- CVE-2023-50739 A buffer overflow vulnerability has been identified in the Internet Printing Protocol (IPP) in various Lexmark devices.
- CVE-2023-50738 A firmware downgrade prevention vulnerability has been identified in newer Lexmark devices.
- CVE-2023-50737 An input validation vulnerability in the SE Menu allows an attacker to execute arbitrary code.
- CVE-2023-50736 A vulnerability has been identified in the PostScript interpreter in various Lexmark devices.
- CVE-2023-50735 A vulnerability has been identified in the PostScript interpreter in various Lexmark devices.
- CVE-2023-50734 A vulnerability has been identified in the PostScript interpreter in various Lexmark devices.
- CVE-2023-50733 A Server-Side Request Forgery (SSRF) vulnerability exists in newer Lexmark devices.
- CVE-2023-50732 Velocity execution without script right through tree macro
- CVE-2023-50731 MindsDB has arbitrary file write in file.py
- CVE-2023-50730 Grackle has StackOverflowError in GraphQL query processing
- CVE-2023-5073 iframe forms <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via iframe Shortcode
- CVE-2023-50729 An unrestricted file upload vulnerability in traccar leads to RCE
- CVE-2023-50728 Unauthenticated Denial of Service in the octokit/webhooks library
- CVE-2023-50727 Resque vulnerable to reflected XSS in Queue Endpoint
- CVE-2023-50726 Users with `create` but not `override` privileges can perform local sync in argo-cd
- CVE-2023-50725 Resque vulnerable to reflected XSS in resque-web failed and queues lists
- CVE-2023-50724 Resque vulnerable to reflected cross site scripting through pathname
- CVE-2023-50723 XWiki Platform remote code execution/programming rights with configuration section from any user account
- CVE-2023-50722 XWiki Platform XSS/CSRF Remote Code Execution in XWiki.ConfigurableClass
- CVE-2023-50721 XWiki Platform RCE from account through SearchAdmin
- CVE-2023-50720 XWiki Platform Solr search discloses email addresses of users
- CVE-2023-5072 DoS Vulnerability in JSON-Java
- CVE-2023-50719 XWiki Platform Solr search discloses password hashes of all users
- CVE-2023-50718 NocoDB SQL Injection vulnerability
- CVE-2023-50717 NocoDB Allows Preview of File with Dangerous Content
- CVE-2023-50716 Invalid DATA_FRAG Submessage causes a bad-free error
- CVE-2023-50715 User accounts disclosed to unauthenticated actors on the LAN
- CVE-2023-50714 The Oauth2 PKCE implementation is vulnerable
- CVE-2023-50713 Speckle Server API Token Privilege Escalation
- CVE-2023-50712 Improper Neutralization of Alternate XSS Syntax in iris-web
- CVE-2023-50711 `serde` deserialization for `FamStructWrapper` lacks bound checks that could potentially lead to out-of-bounds memory access