Vulnerabilities published in 2023
42,916 vulnerabilities were published in 2023: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 191 of 430.
- CVE-2023-48312 Authentication bypass using an empty token in capsule-proxy
- CVE-2023-48311 Any image allowed by default
- CVE-2023-48310 Ability to DoS the testing infrastructure by overwriting files
- CVE-2023-4831 SQLi in nCep
- CVE-2023-48309 next-auth vulnerable to possible user mocking that bypasses basic authentication
- CVE-2023-48308 Calendar app returns full stacktrace when an error happens while editing appointment
- CVE-2023-48307 Nextcloud Mail app vulnerable to Server-Side Request Forgery
- CVE-2023-48306 Nextcloud Server DNS pin middleware can be tricked into DNS rebinding allowing SSRF
- CVE-2023-48305 Nextcloud Server user_ldap app logs user passwords in the log file on level debug
- CVE-2023-48304 Nextcloud Server vulnerable to attacker enabling/disabling birthday calendar for any user
- CVE-2023-48303 Nextcloud Server admins can change authentication details of user configured external storage
- CVE-2023-48302 Nextcloud Server vulnerable to Self XSS when pasting HTML into Text app with Ctrl+Shift+V
- CVE-2023-48301 Nextcloud Server HTML injection in search UI when selecting a circle with HTML in the display name
- CVE-2023-48300 Embed Privacy missing escaping for show_all attribute in opt-out shortcode
- CVE-2023-4830 SQLi in Tura's Signalix
- CVE-2023-48299 TorchServe ZipSlip
- CVE-2023-48298 Integer underflow leading to stack overflow in FPC codec decompression
- CVE-2023-48297 Discourse vulnerable to unlimited mentioned users in message serializer
- CVE-2023-48296 OroPlatform's storefront user can access history and most viewed data from matching back-office user with the same ID
- CVE-2023-48295 Cross-site Scripting at Device groups Deletion feature in LibreNMS
- CVE-2023-48294 Broken Access control on Graphs Feature in LibreNMS
- CVE-2023-48293 XWiki Admin Tools Application CSRF with QueryOnXWiki allows arbitrary database queries
- CVE-2023-48292 XWiki Admin Tools Application Run Shell Command allows CSRF RCE attacks
- CVE-2023-48291 Apache Airflow: Improper access control to DAG resources
- CVE-2023-48290 WordPress Form Maker by 10Web plugin <= 1.15.20 - Captcha Bypass Vulnerability vulnerability
- CVE-2023-4829 Cross-site Scripting (XSS) - Stored in froxlor/froxlor
- CVE-2023-48289 WordPress Import Spreadsheets from Microsoft Excel Plugin <= 10.1.3 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-48288 WordPress WordPress Job Board and Recruitment Plugin – JobWP Plugin <= 2.1 is vulnerable to Sensitive Data Exposure
- CVE-2023-48287 WordPress TextMe SMS plugin <= 1.9.0 - Broken Access Control vulnerability
- CVE-2023-48286 WordPress Accept Stripe Payments plugin <= 2.0.79 - Broken Access Control vulnerability
- CVE-2023-48285 WordPress Accept Stripe Payments plugin <= 2.0.79 - Content Injection vulnerability
- CVE-2023-48284 WordPress Decorator – WooCommerce Email Customizer Plugin <= 1.2.7 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-48283 WordPress Simple Testimonials Showcase Plugin <= 1.1.5 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-48282 WordPress Taxonomy filter Plugin <= 2.2.9 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-48281 WordPress Broken Link Checker for YouTube Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-48280 WordPress Consensu.io plugin <= 1.0.1 - Broken Access Control vulnerability
- CVE-2023-4828 ITM Server Communications Hijack
- CVE-2023-48279 WordPress Seraphinite Post .DOCX Source Plugin <= 2.16.6 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-48278 WordPress WP Forms Puzzle Captcha Plugin <= 4.1 is vulnerable to Cross Site Request Forgery (CSRF) leading to XSS
- CVE-2023-48277 WordPress Super Progressive Web Apps plugin <= 2.2.21 - Broken Access Control vulnerability
- CVE-2023-48276 WordPress WP Forms Puzzle Captcha plugin <= 4.1 - Captcha Bypass vulnerability
- CVE-2023-48275 WordPress Widgets for Google Reviews plugin <= 11.0.2 - Arbitrary File Upload vulnerability
- CVE-2023-48274 WordPress WCMultiShipping plugin <= 2.3.5 - Broken Access Control vulnerability
- CVE-2023-48273 WordPress Preloader for Website plugin <= 1.2.2 - Unauthenticated Broken Access Control vulnerability
- CVE-2023-48272 WordPress Maspik – Spam blacklist Plugin <= 0.9.2 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-48271 WordPress Maspik – Spam Blacklist plugin <= 0.10.3 - IP Filtering Bypass vulnerability
- CVE-2023-48270 Memory corruption in WBR-6013
- CVE-2023-4827 File Manager Pro < 1.8 - Remote Code Execution via CSRF
- CVE-2023-48268 Denial of Service via Board Import Zip Bomb
- CVE-2023-48267 Memory corruption in Intel(R) System Security Report and System Resources Defense firmware
- CVE-2023-48266 Memory corruption in Nexo cordless nutrunner NXA011S-36V (0608842011)
- CVE-2023-48265 Memory corruption in Nexo cordless nutrunner NXA011S-36V (0608842011)
- CVE-2023-48264 Memory corruption in Nexo cordless nutrunner NXA011S-36V (0608842011)
- CVE-2023-48263 Memory corruption in Nexo cordless nutrunner NXA011S-36V (0608842011)
- CVE-2023-48262 Memory corruption in Nexo cordless nutrunner NXA011S-36V (0608842011)
- CVE-2023-48261 SQL injection in Nexo cordless nutrunner NXA011S-36V (0608842011)
- CVE-2023-48260 SQL injection in Nexo cordless nutrunner NXA011S-36V (0608842011)
- CVE-2023-4826 Socialdriver < 2024 - Prototype Pollution to XSS
- CVE-2023-48259 SQL injection in Nexo cordless nutrunner NXA011S-36V (0608842011)
- CVE-2023-48258 Cross-site request forgery in Nexo cordless nutrunner NXA011S-36V (0608842011)
- CVE-2023-48257 Auth bypass in Nexo cordless nutrunner NXA011S-36V (0608842011)
- CVE-2023-48256 Other in Nexo cordless nutrunner NXA011S-36V (0608842011)
- CVE-2023-48255 Cross-site scripting in Nexo cordless nutrunner NXA011S-36V (0608842011)
- CVE-2023-48254 Cross-site scripting in Nexo cordless nutrunner NXA011S-36V (0608842011)
- CVE-2023-48253 SQL injection in Nexo cordless nutrunner NXA011S-36V (0608842011)
- CVE-2023-48252 Missing authorization in Nexo cordless nutrunner NXA011S-36V (0608842011)
- CVE-2023-48251 Hardcoded credentials in Nexo cordless nutrunner NXA011S-36V (0608842011)
- CVE-2023-48250 Hardcoded credentials in Nexo cordless nutrunner NXA011S-36V (0608842011)
- CVE-2023-48249 Path traversal in Nexo cordless nutrunner NXA011S-36V (0608842011)
- CVE-2023-48248 Cross-site scripting in Nexo cordless nutrunner NXA011S-36V (0608842011)
- CVE-2023-48247 Missing authorization in Nexo cordless nutrunner NXA011S-36V (0608842011)
- CVE-2023-48246 Path traversal in Nexo cordless nutrunner NXA011S-36V (0608842011)
- CVE-2023-48245 File upload in Nexo cordless nutrunner NXA011S-36V (0608842011)
- CVE-2023-48244 Cross-site scripting in Nexo cordless nutrunner NXA011S-36V (0608842011)
- CVE-2023-48243 Path traversal in Nexo cordless nutrunner NXA011S-36V (0608842011)
- CVE-2023-48242 Path traversal in Nexo cordless nutrunner NXA011S-36V (0608842011)
- CVE-2023-48241 XWiki exposed whole content of all documents of all wikis to anybody with view right on Solr suggest service
- CVE-2023-48240 XWiki Platform sends cookies to external images in rendered diff and is vulnerable to server side request forgery
- CVE-2023-4824 WooHoo Newspaper Magazine Theme <= 2.5.3 - Settings Update via CSRF
- CVE-2023-48239 Nextcloud Server users can make external storage mount points inaccessible for other users
- CVE-2023-48238 JWT Algorithm Confusion in json-web-token library
- CVE-2023-48237 overflow in shift_line in vim
- CVE-2023-48236 overflow in get_number in vim
- CVE-2023-48235 overflow in ex address parsing in vim
- CVE-2023-48234 overflow in nv_z_get_count in vim
- CVE-2023-48233 overflow with count for :s command in vim
- CVE-2023-48232 Floating point Exception in adjust_plines_for_skipcol() in vim
- CVE-2023-48231 Use-After-Free in win_close() in vim
- CVE-2023-48230 Cap'n Proto WebSocket message can cause crash
- CVE-2023-4823 WP Meta and Date Remover < 2.2.0 - Subscriber+ Stored XSS
- CVE-2023-48229 Out-of-bounds write in the radio driver for Contiki-NG nRF platforms
- CVE-2023-48228 OAuth2: PKCE can be fully circumvented
- CVE-2023-48227 Umbraco CMS Backoffice User can bypass "Publish" restriction
- CVE-2023-48226 OpenReplay HTML Injection vulnerability
- CVE-2023-48225 Laf env causes sensitive information disclosure
- CVE-2023-48224 Cryptographically Weak Generation of One-Time Codes for Identity Verification in ethyca-fides
- CVE-2023-48223 fast-jwt JWT Algorithm Confusion
- CVE-2023-48222 Authenticated users can view or delete jobs they do not have authorization for in Rundeck
- CVE-2023-48221 wire-avs remote format string vulnerability
- CVE-2023-48220 Decidim's devise_invitable gem vulnerable to circumvention of invitation token expiry period