Vulnerabilities published in 2023
42,916 vulnerabilities were published in 2023: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 251 of 430.
- CVE-2023-40017 Geonode Server Side Request Forgery vulnerability
- CVE-2023-40015 Vyper: reversed order of side effects for some operations
- CVE-2023-40014 OpenZeppelin Contracts's ERC2771Context with custom forwarder may lead to zero-valued _msgSender
- CVE-2023-40013 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in external-svg-loader
- CVE-2023-40012 uthenticode EKU validation bypass
- CVE-2023-40011 WordPress Cost Calculator Builder plugin <= 3.1.42 - Broken Access Control vulnerability
- CVE-2023-40010 WordPress HUSKY – Products Filter for WooCommerce (formerly WOOF) Plugin <= 1.3.4.2 is vulnerable to SQL Injection
- CVE-2023-4001 Grub2: bypass the grub password protection feature
- CVE-2023-40009 WordPress WP Pipes Plugin <= 1.4.0 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-40008 WordPress Simple Org Chart Plugin <= 2.3.4 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-40007 WordPress CT Commerce Plugin <= 2.0.1 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-40005 WordPress Easy Digital Downloads plugin <= 3.1.5 - Broken Access Control
- CVE-2023-40004 Unauth. Access Token Manipulation vulnerability in multiple ServMask WordPress plugins
- CVE-2023-40003 WordPress WP Project Manager plugin <= 2.6.7 - Broken Access Control vulnerability
- CVE-2023-40002 WordPress Booster for WooCommerce Plugin <= 7.1.1 is vulnerable to Sensitive Data Exposure
- CVE-2023-40001 WordPress iThemes Sync plugin <= 2.1.13 - Broken Access Control vulnerability
- CVE-2023-40000 WordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Site Wide Stored XSS vulnerability
- CVE-2023-4000 Waiting: One-click countdowns <= 0.6.2 - Cross-Site Request Forgery
- CVE-2023-39999 WordPress < 6.3.2 is vulnerable to Broken Access Control
- CVE-2023-39998 WordPress BeTheme theme <= 27.1.1 - Author+ Broken Access Control vulnerability
- CVE-2023-39997 WordPress Popup by Supsystic plugin <= 1.10.19 - Broken Access Control Vulnerability
- CVE-2023-39996 WordPress Accordion and Accordion Slider plugin <= 1.2.4 - Broken Access Control
- CVE-2023-39995 WordPress Portfolio and Projects plugin <= 1.3.7 - Broken Access Control vulnerability
- CVE-2023-39994 WordPress ARMember Premium plugin <= 5.9.2 - Broken Access Control
- CVE-2023-39993 WordPress ElementsKit Lite plugin <= 2.9.0 - Broken Access Control vulnerability
- CVE-2023-39992 Cross-site scripting in Online Booking & Scheduling Calendar for WordPress by vcita
- CVE-2023-39991 WordPress BigBlueButton Plugin <= 3.0.0-beta.4 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-39990 WordPress Paid Memberships Pro plugin <= 1.2.3 - Broken Access Control vulnerability
- CVE-2023-3999 Waiting: One-click countdowns <= 0.6.2 - Missing Authorization
- CVE-2023-39989 WordPress Header Footer Code Manager Plugin <= 1.1.34 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-39988 WordPress WxSync Plugin <= 2.7.23 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-39987 WordPress wSecure Lite Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-39986 Out-of-bounds Read Vulnerability in Hitachi EH-VIEW (Designer)
- CVE-2023-39985 Out-of-bounds Write Vulnerability in Hitachi EH-VIEW (Designer)
- CVE-2023-39984 Memory corruption in EH-VIEW
- CVE-2023-39983 MXsecurity Register Database Pollution
- CVE-2023-39982 MXsecurity Hardcoded Credential
- CVE-2023-39981 MXsecurity Device Information Disclosure
- CVE-2023-39980 MXsecurity Authenticated Information Disclosure Due to SQL Injection
- CVE-2023-3998 wpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Post Rating Increase/Decrease
- CVE-2023-39979 MXsecurity Authentication Bypass
- CVE-2023-39978 Denial of service in fedoraproject:fedora
- CVE-2023-39976 Memory corruption in clusterlabs:libqb
- CVE-2023-39975 Memory corruption in mit:kerberos 5
- CVE-2023-39974 Information disclosure in AcyMailing Enterprise component for Joomla
- CVE-2023-39973 Extension - acymailing.com - Improper Access Control in AcyMailing Enterprise component for Joomla 6.7.0-8.6.3
- CVE-2023-39972 Extension - acymailing.com - Improper Access Control in AcyMailing Enterprise component for Joomla 6.7.0-8.6.3
- CVE-2023-39971 Extension - acymailing.com - XSS in AcyMailing Enterprise component for Joomla 6.7.0-8.6.3
- CVE-2023-39970 Extension - acymailing.com - RCE in AcyMailing component for Joomla 6.7.0-8.5.0
- CVE-2023-3997 Unauthenticated Log Injection In Splunk SOAR
- CVE-2023-39969 uthenticode signature validation bypass vulnerability
- CVE-2023-39968 Open Redirect Vulnerability in jupyter-server
- CVE-2023-39967 Full read and controlled SSRF through URL parameter when testing a request inside wiremock-studio
- CVE-2023-39966 1Panel arbitrary file write vulnerability exists in the background
- CVE-2023-39965 1Panel Unauthorized access in Backend
- CVE-2023-39964 1Panel O&M management panel has a background arbitrary file reading vulnerability
- CVE-2023-39963 Missing password confirmation when creating app passwords
- CVE-2023-39962 Users can delete external storage mount points
- CVE-2023-39961 Text does not respect "Allow download" permissions
- CVE-2023-39960 Nextcloud Server has improper restriction of excessive authentication attempts on WebDAV endpoint
- CVE-2023-3996 ARMember Lite - Membership Plugin <= 4.0.16 - Authenticated (Administrator+) Stored Cross-Site Scripting
- CVE-2023-39959 Existence of calendars and address books can be checked by unauthenticated users
- CVE-2023-39958 Missing brute force protection on password reset token OAuth2 API controller
- CVE-2023-39957 Path traversal allows tricking the Talk Android app into writing files into it's root directory
- CVE-2023-39956 Electron: Out-of-package code execution when launched with arbitrary cwd
- CVE-2023-39955 Notes attachment render HTML in preview mode
- CVE-2023-39954 user_oidc app stores client secret unencrypted in database
- CVE-2023-39953 Issuer not verified from obtained token in user_oidc
- CVE-2023-39952 Advanced permissions not respected when copying entire group folders
- CVE-2023-39951 Information disclosure in opentelemetry-java-instrumentation
- CVE-2023-39950 Insufficient input validation in efibootguard
- CVE-2023-39949 Improper validation of sequence numbers leading to remotely reachable assertion failure
- CVE-2023-39948 Uncaught fastcdr exception (Unexpected CDR type received) crashing fastdds
- CVE-2023-39947 Another heap overflow in push_back_helper
- CVE-2023-39946 Heap overflow in push_back_helper due to a CDR message
- CVE-2023-39945 Malformed serialized data in a data submessage leads to unhandled exception
- CVE-2023-39944 Command injection in WRC-1750GHBK
- CVE-2023-39943 Ashlar-Vellum Cobalt, Xenon, Argon, Lithium Out-of-bounds Write
- CVE-2023-39941 Missing authorization in Intel(R) SUR software
- CVE-2023-3994 Inefficient Regular Expression Complexity in GitLab
- CVE-2023-39939 SQL injection in LuxCal Web Calendar
- CVE-2023-39938 Cross-site scripting in VI Web Client
- CVE-2023-39936 Ashlar-Vellum Graphite Out-of-bounds Read
- CVE-2023-39935 Command injection in Archer C5400
- CVE-2023-39933 File upload in pmc.exe
- CVE-2023-39932 Privilege escalation in Intel(R) SUR for Gameplay Software
- CVE-2023-39930 PingFederate PingID Radius PCV Authentication Bypass
- CVE-2023-3993 Insertion of Sensitive Information into Log File in GitLab
- CVE-2023-39929 Privilege escalation in Libva software maintained by Intel(R)
- CVE-2023-39928 Use after free in Webkit
- CVE-2023-39926 WordPress Under Construction / Maintenance Mode from Acurax Plugin <= 2.6 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-39925 WordPress Community by PeepSo Plugin <= 6.1.6.0 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-39924 WordPress Simple File List Plugin <= 6.1.9 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-39923 WordPress The Post Grid Plugin <= 7.2.7 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-39922 WordPress Avada theme <= 7.11.1 - Authenticated Broken Access Control vulnerability
- CVE-2023-39921 WordPress Molongui Plugin <= 4.6.19 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-39920 WordPress Redirection for Contact Form 7 plugin <= 2.9.2 - Broken Access Control vulnerability
- CVE-2023-3992 PostX - Gutenberg Post Grid Blocks < 3.0.6 - Reflected Cross-Site Scripting
- CVE-2023-39919 WordPress wpShopGermany – Protected Shops Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-39918 WordPress Booking Package Plugin <= 1.6.01 is vulnerable to Cross Site Scripting (XSS)