Vulnerabilities published in 2023
42,916 vulnerabilities were published in 2023: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 239 of 430.
- CVE-2023-41451 Cross-site scripting in phpkobo:ajaxnewsticker
- CVE-2023-41450 Code injection in phpkobo:ajaxnewsticker
- CVE-2023-4145 Cross-site Scripting (XSS) - Stored in pimcore/customer-data-framework
- CVE-2023-41449 Server-side request forgery in phpkobo:ajaxnewsticker
- CVE-2023-41448 Cross-site scripting in phpkobo:ajaxnewsticker
- CVE-2023-41447 Cross-site scripting in phpkobo:ajaxnewsticker
- CVE-2023-41446 Cross-site scripting in phpkobo:ajaxnewsticker
- CVE-2023-41445 Cross-site scripting in phpkobo:ajaxnewsticker
- CVE-2023-41444 Code injection in binalyze:irec
- CVE-2023-41443 SQL injection in xxyopen:novel-plus
- CVE-2023-41442 Auth bypass in kloudq:tor equip gateway
- CVE-2023-41436 Cross-site scripting in cskaza:cszcms
- CVE-2023-41425 Cross-site scripting in wondercms:wondercms
- CVE-2023-41423 Cross-site scripting in terryl:wp githuber md
- CVE-2023-4142 WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) Remote Code Execution
- CVE-2023-41419 Gevent allows remote attacker to escalate privileges
- CVE-2023-4141 WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) PHP File Creation to Remote Code Execution
- CVE-2023-4140 WP Ultimate CSV Importer <= 7.9.8 - Arbitrary Usermeta Update to Authenticated (Author+) Privilege Escalation
- CVE-2023-4139 WP Ultimate CSV Importer <= 7.9.8 - Sensitive Information Exposure via Directory Listing
- CVE-2023-41387 SQL injection in patreon:flutter downloader
- CVE-2023-4138 Allocation of Resources Without Limits or Throttling in ikus060/rdiffweb
- CVE-2023-41378 Calico Typha hangs during unclean TLS handshake
- CVE-2023-41376 Other in nokia:service router linux
- CVE-2023-41375 Use after free in Kostac PLC Programming Software
- CVE-2023-41374 Memory corruption in Kostac PLC Programming Software
- CVE-2023-41373 BIG-IP Configuration Utility vulnerability
- CVE-2023-41372 Hardcoded credentials in ctrlX HMI Web Panel - WR21 (WR2107)
- CVE-2023-41369 External Entity Loop vulnerability in SAP S/4HANA (Create Single Payment application)
- CVE-2023-41368 Insecure Direct Object Reference (IDOR) vulnerability in S4 HANA (Manage checkbook apps)
- CVE-2023-41367 Missing Authentication check in SAP NetWeaver (Guided Procedures)
- CVE-2023-41366 Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform
- CVE-2023-41365 Information Disclosure vulnerability in SAP Business One (B1i)
- CVE-2023-41364 SQL injection in metaways:tine
- CVE-2023-41363 Missing authorization in cerebrate-project:cerebrate
- CVE-2023-41362 Code injection in mybb:mybb
- CVE-2023-41361 Memory corruption in debian:debian linux
- CVE-2023-41360 Memory corruption in debian:debian linux
- CVE-2023-4136 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafter Engine
- CVE-2023-41359 Memory corruption in fedoraproject:fedora
- CVE-2023-41358 Null dereference in debian:debian linux
- CVE-2023-41357 Galaxy Software Services Vitals ESP - Arbitrary File Upload
- CVE-2023-41356 WisdomGarden Tronclass ilearn - Path Traversal
- CVE-2023-41355 Chunghwa Telecom NOKIA G-040W-Q - Improper Input Validation
- CVE-2023-41354 Chunghwa Telecom NOKIA G-040W-Q - Exposure of Sensitive Information
- CVE-2023-41353 Chunghwa Telecom NOKIA G-040W-Q - Weak Password Requirements
- CVE-2023-41352 Chunghwa Telecom NOKIA G-040W-Q - Command Injection
- CVE-2023-41351 Chunghwa Telecom NOKIA G-040W-Q - Broken Access Control
- CVE-2023-41350 Chunghwa Telecom NOKIA G-040W-Q - Excessive Authentication Attempts
- CVE-2023-4135 Out-of-bounds read information disclosure vulnerability
- CVE-2023-41349 ASUS RT-AX88U - externally-controlled format string
- CVE-2023-41348 ASUS RT-AX55 - command injection - 4
- CVE-2023-41347 ASUS RT-AX55 - command injection - 3
- CVE-2023-41346 ASUS RT-AX55 - command injection - 2
- CVE-2023-41345 ASUS RT-AX55 - command injection - 1
- CVE-2023-41344 NCSIST ManageEngine MDM - Path Traversal
- CVE-2023-41343 Ragic No-Code Database Builder - Stored XSS
- CVE-2023-4134 Kernel: cyttsp4_core: use-after-free in cyttsp4_watchdog_work()
- CVE-2023-41339 Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF in GeoServer
- CVE-2023-41338 Vulnerability in Ctx.IsFromLocal() in gofiber
- CVE-2023-41337 h2o vulnerable to TLS session resumption misdirection
- CVE-2023-41336 Prevent injection of invalid entity ids for "autocomplete" fields in symfony ux-autocomplete
- CVE-2023-41335 Temporary storage of plaintext passwords during password changes in matrix synapse
- CVE-2023-41334 astropy vulnerable to RCE in TranformGraph().to_dot_graph function
- CVE-2023-41333 Bypass of namespace restrictions in CiliumNetworkPolicy
- CVE-2023-41332 Denial of service via Kubernetes annotations in specific Cilium configurations
- CVE-2023-41331 SOFARPC Remote Command Execution (RCE) Vulnerability
- CVE-2023-41330 Unsafe deserialization in knplabs/knp-snappy
- CVE-2023-4133 Kernel: cxgb4: use-after-free in ch_flower_stats_cb()
- CVE-2023-41329 Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio
- CVE-2023-41328 Possibility limited SQL injection due to insufficient validation in Frappe
- CVE-2023-41327 Controlled SSRF through URL in the WireMock
- CVE-2023-41326 Account takeover via Kanban feature in GLPI
- CVE-2023-41325 OP-TEE double free in shdr_verify_signature
- CVE-2023-41324 Account takeover through API in GLPI
- CVE-2023-41323 Users login enumeration by unauthenticated user in GLPI
- CVE-2023-41322 Privilege Escalation from technician to super-admin in GLPI
- CVE-2023-41321 Sensitive fields enumeration through API in GLPI
- CVE-2023-41320 Account takeover via SQL Injection in UI layout preferences in GLPI
- CVE-2023-4132 Kernel: smsusb: use-after-free caused by do_submit_urb()
- CVE-2023-41319 Remote Code Execution in Custom Integration Upload in Fides
- CVE-2023-41318 Unsafe media served inline on download endpoints in matrix-media-repo
- CVE-2023-41317 Unnamed "Subscription" operation results in Denial-of-Service in apollographql/router
- CVE-2023-41316 HTML Injection with email in Tolgee
- CVE-2023-41314 Apache Doris: Missing API authentication allowed DoS
- CVE-2023-41313 Apache Doris: Timing Attack weakness
- CVE-2023-41312 Missing authorization in EMUI
- CVE-2023-41311 Missing authorization in EMUI
- CVE-2023-41310 Denial of service in EMUI
- CVE-2023-41309 Missing authorization in EMUI
- CVE-2023-41308 Information disclosure in EMUI
- CVE-2023-41307 Memory corruption in EMUI
- CVE-2023-41306 Race condition in EMUI
- CVE-2023-41305 Weak cryptography in EMUI
- CVE-2023-41304 Other in EMUI
- CVE-2023-41303 Command injection in EMUI
- CVE-2023-41302 Path traversal in EMUI
- CVE-2023-41301 Missing authorization in EMUI
- CVE-2023-41300 Denial of service in EMUI
- CVE-2023-4130 ksmbd: fix wrong next length validation of ea buffer in smb2_set_ea()
- CVE-2023-41299 Memory corruption in EMUI