Vulnerabilities published in 2023
42,916 vulnerabilities were published in 2023: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 202 of 430.
- CVE-2023-46733 Symfony possible session fixation vulnerability
- CVE-2023-46732 Reflected Cross-site scripting through revision parameter in content menu in XWiki Platform
- CVE-2023-46731 Remote code execution through the section parameter in Administration as guest in XWiki Platform
- CVE-2023-46730 Server-Side Request Forgery in groupoffice
- CVE-2023-4673 SQLi in Sanalogy's Turasistan
- CVE-2023-46729 Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint
- CVE-2023-46728 SQUID-2021:8 Denial of Service in Gopher gateway
- CVE-2023-46727 GLPI SQL injection through inventory agent request
- CVE-2023-46726 GLPI Remote code execution from LDAP server configuration form on PHP 7.4
- CVE-2023-46725 FoodCoopShop Server-Side Request Forgery vulnerability
- CVE-2023-46724 SQUID-2023:4 Denial of Service in SSL Certificate validation
- CVE-2023-46723 lte-pic32-writer's sendto.txt may disclose URL and the API key
- CVE-2023-46722 Pimcore Admin Classic Bundle Cross-site Scripting (XSS) in PDF previews
- CVE-2023-46720 Memory corruption in FortiOS
- CVE-2023-4672 XSS in Talent Soft's ECOP
- CVE-2023-46718 Memory corruption in FortiOS
- CVE-2023-46717 Auth bypass in FortiOS
- CVE-2023-46715 Security feature bypass in FortiOS
- CVE-2023-46714 Memory corruption in FortiOS
- CVE-2023-46713 Other in FortiWeb
- CVE-2023-46712 Privilege escalation in FortiPortal
- CVE-2023-46711 Hardcoded credentials in VR-S1000
- CVE-2023-4671 SQLi in Talent Soft's ECOP
- CVE-2023-46708 Wlan has a use after free vulnerability
- CVE-2023-46706 MachineSense FeverWarn Use of Hard-coded Credentials
- CVE-2023-46705 Arkruntime has a type confusion vulnerability
- CVE-2023-46701 Inaccessible Post Information Leak via Run Timeline IDOR
- CVE-2023-46700 SQL injection in LuxCal Web Calendar
- CVE-2023-4670 SQLi in Innosa's Probbys
- CVE-2023-46699 Cross-site request forgery in GROWI
- CVE-2023-46695 Django potential denial of service vulnerability in UsernameField on Windows
- CVE-2023-46694 Vtenext 21.02 allows an authenticated attacker to upload arbitrary files, potentially enabling them to execute remote commands.
- CVE-2023-46693 Cross-site scripting in formalms:formalms
- CVE-2023-46691 Use after free in Intel(R) Power Gadget software for Windows
- CVE-2023-46690 Delta Electronics InfraSuite Device Master Path Traversal
- CVE-2023-4669 Authentication Bypass in Exagate SYSGuard 3001
- CVE-2023-46689 Privilege escalation in Intel(R) Power Gadget software for macOS
- CVE-2023-46688 Open redirect in Pleasanter
- CVE-2023-46687 Emerson Rosemount GC370XA, GC700XA, GC1500XA Command Injection
- CVE-2023-46686 Security feature bypass in Command Centre Diagnostics Service
- CVE-2023-46685 Hardcoded credentials in WBR-6013
- CVE-2023-46683 Command injection in ER7206 Omada Gigabit VPN Router
- CVE-2023-46681 Command injection in VR-S1000
- CVE-2023-4668 Ad Inserter <= 2.7.30 - Unauthenticated Sensitive Information Exposure via ai-debug-processing-fe
- CVE-2023-46679 Online Job Portal v1.0 - Multiple Unauthenticated SQL Injections (SQLi)
- CVE-2023-46677 Online Job Portal v1.0 - Multiple Unauthenticated SQL Injections (SQLi)
- CVE-2023-46675 Kibana Insertion of Sensitive Information into Log File
- CVE-2023-46674 Elasticsearch-hadoop Unsafe Deserialization
- CVE-2023-46673 Elasticsearch Improper Handling of Exceptional Conditions
- CVE-2023-46672 Logstash Insertion of Sensitive Information into Log File
- CVE-2023-46671 Kibana Insertion of Sensitive Information into Log File
- CVE-2023-4667 Stored Cross Site Scripting in webserver administration
- CVE-2023-46669 Elastic Agent / Elastic Endpoint Security local API key disclosure
- CVE-2023-46668 Elastic Endpoint Insertion of Sensitive Information into Log File
- CVE-2023-46667 Fleet Server Insertion of Sensitive Information into Log File
- CVE-2023-46666 Elastic Sharepoint Online Python Connector Improper Access Control
- CVE-2023-46665 Improper Access Control in Sielco PolyEco1000
- CVE-2023-46664 Improper Access Control in Sielco PolyEco1000
- CVE-2023-46663 Improper Access Control in Sielco PolyEco1000
- CVE-2023-46662 Improper Access Control in Sielco PolyEco1000
- CVE-2023-46661 Improper Access Control in Sielco PolyEco1000
- CVE-2023-46660 Non-constant time webhook token hash comparison in Jenkins Zanata Plugin
- CVE-2023-4666 Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload
- CVE-2023-46659 Jenkins Edgewall Trac Plugin vulnerable to Stored XSS
- CVE-2023-46658 Jenkins MSTeams Webhook Trigger Plugin uses non-constant time webhook token comparison
- CVE-2023-46657 Jenkins Gogs Plugin uses non-constant time webhook token comparison
- CVE-2023-46656 Jenkins Multibranch Scan Webhook Trigger Plugin uses non-constant time webhook token comparison
- CVE-2023-46655 Jenkins CloudBees CD Plugin vulnerable to arbitrary file read
- CVE-2023-46654 Jenkins CloudBees CD Plugin vulnerable to arbitrary file deletion
- CVE-2023-46653 Jenkins lambdatest-automation Plugin may expose Credentials access token
- CVE-2023-46652 Jenkins lambdatest-automation Plugin missing permission check
- CVE-2023-46651 Jenkins Warnings Plugin exposures system-scoped credentials
- CVE-2023-46650 Stored XSS vulnerability in Jenkins GitHub Plugin
- CVE-2023-4665 Privilage Escalation in Saphira Connect
- CVE-2023-46649 Race Condition allows Administrative Access on Organization Repositories
- CVE-2023-46648 Insufficient Entropy in GitHub Enterprise Server Management Console Invitation Token
- CVE-2023-46647 Improper Privilege Management in GitHub Enterprise Server management console leads to privilege escalation
- CVE-2023-46646 Missing authorization in Enterprise Server
- CVE-2023-46645 Path traversal in GitHub Enterprise Server leading to arbitrary file reading when building a GitHub Pages site
- CVE-2023-46644 WordPress WordPress CTA plugin <= 1.5.8 - Broken Access Control vulnerability
- CVE-2023-46643 WordPress Download CloudNet360 Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-46642 WordPress SAHU TikTok Pixel for E-Commerce Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-46641 WordPress 12 Step Meeting List Plugin <= 3.14.24 is vulnerable to Server Side Request Forgery (SSRF)
- CVE-2023-46640 WordPress Medialist Plugin <= 1.3.9 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-4664 Privilage Escalation in Saphira Connect
- CVE-2023-46639 WordPress kk Star Ratings plugin <= 5.4.5 - Broken Access Control vulnerability
- CVE-2023-46638 WordPress WCP OpenWeather Plugin <= 2.5.0 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-46637 WordPress Generate Dummy Posts plugin <= 1.0.0 - Broken Access Control vulnerability
- CVE-2023-46636 WordPress Custom Header Images Plugin <= 1.2.1 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-46635 WordPress YITH WooCommerce Product Add-Ons plugin <= 4.2.0 - Broken Access Control vulnerability
- CVE-2023-46634 WordPress Custom My Account for Woocommerce Plugin <= 2.1 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-46633 WordPress WP Glossary plugin <= 3.1.2 - Broken Access Control vulnerability
- CVE-2023-46632 WordPress My Shortcodes plugin <= 2.3 - Broken Access Control vulnerability
- CVE-2023-46631 WordPress Product Recommendation Quiz for eCommerce plugin <= 2.1.2 - Broken Access Control vulnerability
- CVE-2023-46630 Auth bypass in Admin and Site Enhancements (ASE)
- CVE-2023-4663 XSS in Saphira Connect
- CVE-2023-46629 WordPress Remove Add to Cart WooCommerce Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-46628 WordPress WP Word Count plugin <= 3.2.4 - Broken Access Control vulnerability
- CVE-2023-46627 WordPress WP Simple HTML Sitemap Plugin <= 2.1 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-46626 WordPress FLOWFACT WP Connector Plugin <= 2.1.7 is vulnerable to Cross Site Scripting (XSS)