Vulnerabilities published in 2023
42,916 vulnerabilities were published in 2023: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 249 of 430.
- CVE-2023-40219 File upload in Welcart e-Commerce
- CVE-2023-40218 Integer overflow in samsung:exynos 1280 firmware
- CVE-2023-40217 Security feature bypass in python:python
- CVE-2023-40216 Memory corruption in openbsd:openbsd
- CVE-2023-40215 WordPress Demon image annotation Plugin <= 5.1 is vulnerable to SQL Injection
- CVE-2023-40214 WordPress Business Pro Theme <= 1.10.4 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-40213 WordPress Justified Gallery plugin <= 1.7.3 - Broken Access Control vulnerability
- CVE-2023-40212 WordPress WooCommerce Product Attachment Plugin <= 2.1.8 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-40211 WordPress Post Grid Plugin <= 2.2.50 is vulnerable to Sensitive Data Exposure
- CVE-2023-40210 WordPress SB Child List Plugin <= 4.5 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-4021 Modern Events Calendar lite < 7.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting
- CVE-2023-40209 WordPress Highcompress Image Compressor plugin <= 6.0.0 - Broken Access Control vulnerability
- CVE-2023-40208 WordPress Stock Ticker Plugin <= 3.23.3 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-40207 WordPress Donations Made Easy – Smart Donations Plugin <= 4.0.12 is vulnerable to SQL Injection
- CVE-2023-40206 WordPress WP 404 Auto Redirect to Similar Post Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-40205 WordPress PixTypes Plugin <= 1.4.15 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-40204 WordPress Folders Plugin <= 2.9.2 is vulnerable to Arbitrary File Upload
- CVE-2023-40203 WordPress MailChimp Forms by MailMunch plugin <= 3.1.4 - Broken Access Control
- CVE-2023-40202 WordPress WP HTML Mail Plugin <= 3.4.1 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-40201 WordPress Futurio Extra Plugin <= 1.8.4 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-40200 WordPress WP Logo Showcase Responsive Slider and Carousel plugin <= 3.6 - Broken Access Control vulnerability
- CVE-2023-4020 Unvalidated input in Silicon Labs PSA Attestation service leads to secure memory access from non-secure memory
- CVE-2023-40199 WordPress WP Like Button Plugin <= 1.7.0 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-40198 WordPress Easy Cookie Law Plugin <= 3.1 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-40197 WordPress flowpaper Plugin <= 1.9.9 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-40196 WordPress ImageRecycle pdf & image compression Plugin <= 3.1.11 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-40195 Apache Airflow Spark Provider Deserialization Vulnerability RCE
- CVE-2023-40194 Path traversal in Foxit Reader
- CVE-2023-40193 Command injection in Deco M4
- CVE-2023-40191 Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting
- CVE-2023-4019 Media from FTP < 11.17 - Author+ Arbitrary File Access
- CVE-2023-40188 Out-Of-Bounds Read in FreeRDP
- CVE-2023-40187 Use-After-Free in FreeRDP
- CVE-2023-40186 IntegerOverflow leading to Out-Of-Bound Write Vulnerability in FreeRDP
- CVE-2023-40185 Shescape on Windows escaping may be bypassed in threaded context
- CVE-2023-40184 Improper handling of session establishment errors in xrdp
- CVE-2023-40183 DataEase has a vulnerability to obtain user cookies
- CVE-2023-40182 Information disclosure in silverwaregames-io-issue-tracker
- CVE-2023-40181 Integer-Underflow leading to Out-Of-Bound Read in FreeRDP
- CVE-2023-40180 Denial of service vulnerability in silverstripe-graphql via recursive queries
- CVE-2023-4018 Direct Request ('Forced Browsing') in GitLab
- CVE-2023-40179 Silverware Games vulnerable to account enumeration via inconsistent responses
- CVE-2023-40178 @node-saml/node-saml's validatePostRequestAsync does not include checkTimestampsValidityError
- CVE-2023-40177 XWiki Platform privilege escalation (PR) from account through AWM content fields
- CVE-2023-40176 SXSS in the user profile via the timezone displayer
- CVE-2023-40175 Inconsistent Interpretation of HTTP Requests in puma
- CVE-2023-40174 Insufficient Session Expiration in fobybus/social-media-skeleton
- CVE-2023-40173 Unsalted passwords in fobybus/social-media-skeleton
- CVE-2023-40172 Cross-Site Request Forgery (CSRF) in fobybus/social-media-skeleton
- CVE-2023-40171 Dispatch writes JWT tokens in error message
- CVE-2023-40170 cross-site inclusion (XSSI) of files in jupyter-server
- CVE-2023-4017 Goya <= 1.0.8.7 - Unauthenticated Reflected Cross-Site Scripting via Multiple Parameters
- CVE-2023-40168 Malicious projects can read and upload arbitrary files from disk in TurboWarp Desktop
- CVE-2023-40167 Jetty accepts "+" prefixed value in Content-Length
- CVE-2023-40166 Notepad++ heap buffer read overflow in FileManager::detectLanguageFromTextBegining
- CVE-2023-40165 Unauthorized gem replacement for full names ending in numbers on rubygems.org
- CVE-2023-40164 Notepad++ global buffer read overflow in nsCodingStateMachine::NextState
- CVE-2023-40163 Memory corruption in ImageGear
- CVE-2023-40161 Privilege escalation in Intel Unite(R) Client software
- CVE-2023-40160 Path traversal in pmmls.exe
- CVE-2023-4016 Memory corruption in Linux Kernal
- CVE-2023-40158 Command injection in DR-16F, DR-8F, DR-4F, DR-16H, DR-8H, DR-4H, DR-4M41 series
- CVE-2023-40156 Privilege escalation in Intel(R) SSU software
- CVE-2023-40155 Privilege escalation in Intel(R) CST software
- CVE-2023-40154 Misconfiguration in Intel(R) SUR for Gameplay Software
- CVE-2023-40153 Cross-site Scripting in DEXMA DEXGate
- CVE-2023-40152 Fuji Electric Tellus Lite V-Simulator Out-of-bounds Write
- CVE-2023-40151 Red Lion Controls Sixnet RTU Exposed Dangerous Method Or Function
- CVE-2023-40150 Softneta MedDream PACS Exposed Dangerous Method or Function
- CVE-2023-4015 Use-after-free in Linux kernel's netfilter: nf_tables component
- CVE-2023-40148 PingFederate Server Side Request Forgery vulnerability
- CVE-2023-40146 Command injection in Smart Reader
- CVE-2023-40145 Weintek cMT3000 HMI Web CGI OS Command Injection
- CVE-2023-40144 Command injection in DR-16F, DR-8F, DR-4F, DR-16H, DR-8H, DR-4H, DR-4M41 series
- CVE-2023-40143 Westermo Lynx
- CVE-2023-40142 Security feature bypass in Android
- CVE-2023-40141 Memory corruption in Android
- CVE-2023-40140 Use after free in Android
- CVE-2023-40139 Information disclosure in Android
- CVE-2023-40138 Information disclosure in Android
- CVE-2023-40137 Information disclosure in Android
- CVE-2023-40136 Information disclosure in Android
- CVE-2023-40135 Information disclosure in Android
- CVE-2023-40134 Information disclosure in Android
- CVE-2023-40133 Information disclosure in Android
- CVE-2023-40132 Missing authorization in Android
- CVE-2023-40131 Use after free in Android
- CVE-2023-40130 Privilege escalation in Android
- CVE-2023-4013 GDPR Cookie Compliance < 4.12.5 - License Update/Deactivation via CSRF
- CVE-2023-40129 Memory corruption in Android
- CVE-2023-40128 Memory corruption in Android
- CVE-2023-40127 Information disclosure in Android
- CVE-2023-40125 Privilege escalation in Android
- CVE-2023-40124 Information disclosure in Android
- CVE-2023-40123 Security feature bypass in Android
- CVE-2023-40122 Information disclosure in Android
- CVE-2023-40121 Deserialization in Android
- CVE-2023-40120 Security feature bypass in Android
- CVE-2023-4012 Incomplete Internal State Distinction in ntpsec
- CVE-2023-40117 Security feature bypass in Android