Vulnerabilities published in 2023
42,916 vulnerabilities were published in 2023: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 235 of 430.
- CVE-2023-41953 WordPress ProfilePress plugin <= 4.13.1 - Broken Access Control vulnerability
- CVE-2023-41952 WordPress Fluent Forms plugin <= 5.0.8 - Broken Access Control vulnerability
- CVE-2023-41951 WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.6.14 - Broken Access Control vulnerability
- CVE-2023-41950 WordPress Laposta Signup Basic Plugin <= 1.4.1 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-4195 PHP Remote File Inclusion in cockpit-hq/cockpit
- CVE-2023-41949 WordPress iFolders Plugin <= 1.5.0 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-41948 WordPress Cookie Notice & Consent Plugin <= 1.6.0 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-41947 Missing permission checks in Jenkins Frugal Testing Plugin
- CVE-2023-41946 CSRF vulnerability in Jenkins Frugal Testing Plugin
- CVE-2023-41945 Disabled permissions granted by Jenkins Assembla Auth Plugin
- CVE-2023-41944 HTML injection vulnerability in Jenkins AWS CodeCommit Trigger Plugin
- CVE-2023-41943 Missing permission check in Jenkins AWS CodeCommit Trigger Plugin
- CVE-2023-41942 CSRF vulnerability in Jenkins AWS CodeCommit Trigger Plugin
- CVE-2023-41941 Missing permission check in Jenkins AWS CodeCommit Trigger Plugin allows enumerating credentials IDs
- CVE-2023-41940 Stored XSS vulnerability in Jenkins TAP Plugin
- CVE-2023-4194 Kernel: tap: tap_open(): correctly initialize socket uid next fix of i_uid to current_fsuid
- CVE-2023-41939 Disabled permissions can be granted by Jenkins SSH2 Easy Plugin
- CVE-2023-41938 CSRF vulnerability in Jenkins Ivy Plugin
- CVE-2023-41937 SSRF vulnerability in Jenkins Bitbucket Push and Pull Request Plugin allows capturing credentials
- CVE-2023-41936 Jenkins Google Login Plugin non-constant time token comparison
- CVE-2023-41935 Non-constant time nonce comparison in Jenkins Microsoft Entra ID (previously Azure AD) Plugin
- CVE-2023-41934 Improper masking of credentials in Jenkins Pipeline Maven Integration Plugin
- CVE-2023-41933 Job Configuration History Plugin's path traversal allows exploiting XXE vulnerability
- CVE-2023-41932 Path traversal allows exploiting XXE vulnerability in Jenkins Job Configuration History Plugin
- CVE-2023-41931 XSS vulnerability in Jenkins Job Configuration History Plugin
- CVE-2023-41930 Path traversal in Jenkins Job Configuration History Plugin
- CVE-2023-4193 SourceCodester Resort Reservation System view_fee.php sql injection
- CVE-2023-41929 Privilege escalation in samsung:memory card \& ufd authentication
- CVE-2023-41928 Remote server offers deprecated TLS protocol in Kiloview P1/P2 devices
- CVE-2023-41927 Weak TLS Cipher Suites Supported in Kiloview P1/P2 devices
- CVE-2023-41926 Insufficiently protected credentials in Kiloview P1/P2 devices
- CVE-2023-41923 Weak Password Requirements in Kiloview P1/P2 devices
- CVE-2023-41922 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Kiloview P1/P2 devices
- CVE-2023-41921 Download of Code Without Integrity Check in Kiloview P1/P2 devices
- CVE-2023-41920 Authentication Bypass by Primary Weakness in Kiloview P1/P2 devices
- CVE-2023-4192 SourceCodester Resort Reservation System manage_user.php sql injection
- CVE-2023-41919 Use of Hard-coded Credentials in Kiloview P1/P2 devices
- CVE-2023-41918 Missing Authentication for Critical Function in Kiloview P1/P2 devices
- CVE-2023-41917 Improper input validation in Kiloview P1/P2 devices allows for remote code execution
- CVE-2023-41916 Apache Linkis DataSource allows arbitrary file reading
- CVE-2023-41915 Race condition in debian:debian linux
- CVE-2023-41914 Race condition in fedoraproject:fedora
- CVE-2023-41913 Memory corruption in strongswan:strongswan
- CVE-2023-41911 Memory corruption in samsung:exynos 2200 firmware
- CVE-2023-41910 Memory corruption in lldpd project:lldpd
- CVE-2023-4191 SourceCodester Resort Reservation System index.php file inclusion
- CVE-2023-41909 Null dereference in debian:debian linux
- CVE-2023-41908 Misconfiguration in cerebrate-project:cerebrate
- CVE-2023-41905 Cross-site scripting in netscout:ngeniusone
- CVE-2023-41904 Auth bypass in zohocorp:manageengine admanager plus
- CVE-2023-41902 Privilege escalation in corecode:macupdater
- CVE-2023-41900 Jetty's OpenId Revoked authentication allows one request
- CVE-2023-4190 Insufficient Session Expiration in admidio/admidio
- CVE-2023-41899 Partial Server-Side Request Forgery in Home Assistant Core
- CVE-2023-41898 Arbitrary URL load in Android WebView in `MyActivity.kt` in Home Assistant Companion for Android
- CVE-2023-41897 Lack of XFO header allows clickjacking in Home Assistant Core
- CVE-2023-41896 Fake websocket server installation permits full takeover in Home Assistant Core
- CVE-2023-41895 Cross-site Scripting via auth_callback login in Home Assistant Core
- CVE-2023-41894 Local-only webhooks externally accessible via SniTun in Home Assistant Core
- CVE-2023-41893 Account takeover via auth_callback login in Home Assistant Core
- CVE-2023-41892 Craft CMS Remote Code Execution vulnerability
- CVE-2023-41891 FlyteAdmin SQL Injection in List Filters
- CVE-2023-41890 Sustainsys.Saml2 Insufficient Identity Provider Issuer Validation
- CVE-2023-4189 Cross-site Scripting (XSS) - Reflected in instantsoft/icms2
- CVE-2023-41889 Late-Unicode normalization vulnerability in SHIRASAGI
- CVE-2023-41888 Phishing through a login page malicious URL in GLPI
- CVE-2023-41887 Remote Code exec in project import with mysql jdbc url attack
- CVE-2023-41886 OpenRefine vulnerable to arbitrary file read in project import with mysql jdbc url attack
- CVE-2023-41885 Piccolo's current `BaseUser.login` implementation is vulnerable to time based user enumeration
- CVE-2023-41884 ZoneMinder Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in watch.php
- CVE-2023-41882 vantage6 Improper Access Control vulnerability
- CVE-2023-41881 Deleting a collaboration should also delete linked resources
- CVE-2023-41880 Miscompilation of wasm `i64x2.shr_s` instruction with constant input on x86_64
- CVE-2023-4188 SQL Injection in instantsoft/icms2
- CVE-2023-41879 Magento LTS's guest order "protect code" can be brute-forced too easily
- CVE-2023-41878 Weak password of selenium VNC in MeterSphere
- CVE-2023-41877 GeoServer log file path traversal vulnerability
- CVE-2023-41876 WordPress WP Gallery Metabox Plugin <= 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-41875 WordPress WP Directory Kit plugin <= 1.2.6 - Broken Access Control vulnerability
- CVE-2023-41874 WordPress Order Delivery Date for WooCommerce Plugin <= 3.20.0 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-41873 WordPress SAML Single Sign On – SSO Login plugin <= 5.0.4 - Broken Access Control vulnerability
- CVE-2023-41872 WordPress WoodMart Theme <= 7.2.4 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-41871 WordPress Poll Maker Plugin <= 4.7.0 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-41870 WordPress WP Crowdfunding plugin <= 2.1.5 - Broken Access Control vulnerability
- CVE-2023-4187 Cross-site Scripting (XSS) - Stored in instantsoft/icms2
- CVE-2023-41869 WordPress WP Accessibility Helper (WAH) plugin <= 0.6.2.4 - Broken Access Control vulnerability
- CVE-2023-41868 WordPress Stagtools Plugin <= 2.3.7 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-41867 WordPress AcyMailing SMTP Newsletter Plugin <= 8.6.2 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-41866 WordPress Automatic YouTube Gallery plugin <= 2.3.3 - Broken Access Control vulnerability
- CVE-2023-41865 WordPress Slider Pro plugin <= 4.8.6 - Broken Access Control vulnerability
- CVE-2023-41864 WordPress PeproDev CF7 Database plugin <= 1.8.0 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2023-41863 WordPress PeproDev CF7 Database Plugin <= 1.7.0 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-41862 WordPress VS Contact Form plugin <= 14.0 - Sum Captcha Bypass vulnerability
- CVE-2023-41861 WordPress Restrict Plugin <= 2.2.4 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-41860 WordPress Travel Map Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-4186 SourceCodester Pharmacy Management System manage_website.php unrestricted upload
- CVE-2023-41859 WordPress Order Delivery Date for WP e-Commerce Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-41858 WordPress Order Delivery Date for WP e-Commerce Plugin <= 1.2 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-41857 WordPress Click To Tweet plugin <= 2.0.14 - Broken Access Control vulnerability
- CVE-2023-41856 WordPress Click To Tweet Plugin <= 2.0.14 is vulnerable to Cross Site Scripting (XSS)