Vulnerabilities published in 2023
42,916 vulnerabilities were published in 2023: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 268 of 430.
- CVE-2023-37946 Jenkins OpenShift Login Plugin session fixation vulnerability
- CVE-2023-37945 Jenkins SAML Single Sign On(SSO) Plugin missing permission check
- CVE-2023-37944 Jenkins Datadog Plugin does not perform a permission check in an HTTP endpoint.
- CVE-2023-37943 Jenkins Active Directory Plugin vulnerable to Active Directory credential disclosure
- CVE-2023-37942 Jenkins External Monitor Job Type Plugin XML external entity vulnerability
- CVE-2023-37941 Apache Superset: Metadata db write access can lead to remote code execution
- CVE-2023-37940 Liferay Portal and Liferay DXP have Cross-site Scripting vulnerability in edit Service Access Policy page
- CVE-2023-3794 Bug Finder ChainCity Real Estate Investment Platform New Ticket create cross site scripting
- CVE-2023-37939 Information disclosure in FortiClientLinux
- CVE-2023-37937 Command injection in FortiSwitch
- CVE-2023-37936 Hardcoded credentials in FortiSwitch
- CVE-2023-37935 Information disclosure in FortiOS
- CVE-2023-37934 Denial of service in FortiPAM
- CVE-2023-37933 Cross-site scripting in FortiADC
- CVE-2023-37932 Path traversal in FortiVoice
- CVE-2023-37931 SQL injection in FortiVoice
- CVE-2023-37930 Memory corruption in FortiOS
- CVE-2023-3793 Weaver e-cology HTTP POST Request filelFileDownloadForOutDoc.class sql injection
- CVE-2023-37929 Memory corruption in V5.50(ABPM.8)C0 firmware
- CVE-2023-37928 Command injection in NAS326 firmware
- CVE-2023-37927 Command injection in NAS326 firmware
- CVE-2023-37926 Memory corruption in ATP series firmware
- CVE-2023-37925 Privilege escalation in ATP series firmware
- CVE-2023-37924 Apache Submarine: SQL injection from unauthorized login
- CVE-2023-37923 Memory corruption in GTKWave
- CVE-2023-37922 Memory corruption in GTKWave
- CVE-2023-37921 Memory corruption in GTKWave
- CVE-2023-37920 Certifi's removal of e-Tugra root certificate
- CVE-2023-3792 Beijing Netcon NS-ASG test_status.php direct request
- CVE-2023-37919 Cal.com not expiring old sessions after enabling 2FA
- CVE-2023-37918 API token authentication bypass in HTTP endpoints in Dapr
- CVE-2023-37917 Privilege Escalation in kubepi
- CVE-2023-37916 Leak password hash of any user
- CVE-2023-37915 Malformed PID_PROPERTY_LIST parameter in DATA submessage remotely crashes OpenDDS
- CVE-2023-37914 Privilege escalation (PR)/RCE from account through Invitation subject/message
- CVE-2023-37913 org.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file writing from account through office converter
- CVE-2023-37912 XWiki Rendering's footnote macro vulnerable to privilege escalation via the footnote macro
- CVE-2023-37911 org.xwiki.platform:xwiki-platform-oldcore may leak data through deleted and re-created documents
- CVE-2023-37910 org.xwiki.platform:xwiki-platform-attachment-api vulnerable to Missing Authorization on Attachment Move
- CVE-2023-3791 IBOS OA Personal Office Address Book export actionExport sql injection
- CVE-2023-37909 Privilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheet
- CVE-2023-37908 org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability
- CVE-2023-37907 Cryptomator's MSI installer allows local privilege escalation
- CVE-2023-37906 Discourse vulnerable to DoS via post edit reason
- CVE-2023-37905 Cross-site Scripting (XSS) in Source Mode of Editor in ckeditor-wordcount-plugin
- CVE-2023-37904 Discourse Race Condition in Accept Invite
- CVE-2023-37903 Sandbox Escape in vm2
- CVE-2023-37902 Vyper's ecrecover can return undefined data if signature does not verify
- CVE-2023-37901 Cross-Site-Scripting via confirmation prompts
- CVE-2023-37900 Crossplane vulnerable to denial of service from large image
- CVE-2023-3790 Boom CMS assets-manager add cross site scripting
- CVE-2023-37899 feathersjs socket handler allows abusing implicit toString
- CVE-2023-37898 Safe mode Cross-site Scripting (XSS) vulnerability in Joplin
- CVE-2023-37897 Server-side Template Injection (SSTI) in grav
- CVE-2023-37896 Nuclei Path Traversal vulnerability
- CVE-2023-37895 Apache Jackrabbit RMI access can lead to RCE
- CVE-2023-37894 WordPress Variation Images Gallery for WooCommerce Plugin <= 2.3.3 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-37893 WordPress Coming Soon Chop Chop Plugin <= 2.2.4 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-37892 WordPress Shortcode IMDB Plugin <= 6.0.8 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-37891 Cross-site request forgery in OptiMonk: Popups, Personalization & A/B Testing
- CVE-2023-37890 WordPress KB Support Plugin <= 1.5.88 is vulnerable to Broken Access Control
- CVE-2023-3789 PaulPrinting CMS Search delivery cross site scripting
- CVE-2023-37889 WordPress WPAdmin AWS CDN Plugin <= 2.0.13 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-37888 WordPress Phlox Core Elements plugin <= 2.14.0 - Unauthenticated Local File Inclusion vulnerability
- CVE-2023-37887 WordPress WPSchoolPress plugin <= 2.2.7 - Broken Access Control vulnerability
- CVE-2023-37886 WordPress RealHomes theme <= 4.0.2 - Broken Access Control vulnerability
- CVE-2023-37885 WordPress RealHomes theme <= 4.0.2 - Broken Access Control vulnerability
- CVE-2023-37881 Weak Access Control between Domains in Wing FTP Server <= 7.2.0
- CVE-2023-3788 ActiveITzone Active Super Shop CMS Manage Details Page cross site scripting
- CVE-2023-37879 Exposed Session Variable in Wing FTP Server <= 7.2.0
- CVE-2023-37878 Insecure Default Permissions in Wing FTP Server <= 7.2.0
- CVE-2023-37875 Cross-Site Scripting Vulnerability in Wing FTP Server <= 7.2.0
- CVE-2023-37874 WordPress HTTP Headers Plugin <= 1.18.11 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-37873 WordPress WooCommerce Ship to Multiple Addresses Plugin <= 3.8.5 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-37872 WordPress WooCommerce Ship to Multiple Addresses plugin <= 3.8.5 - Broken Access Control vulnerability
- CVE-2023-37871 WordPress WooCommerce GoCardless Gateway Plugin <= 2.5.6 is vulnerable to Insecure Direct Object References (IDOR)
- CVE-2023-37870 WordPress WooCommerce Warranty Requests plugin <= 2.1.9 - Broken Access Control vulnerability
- CVE-2023-3787 Codecanyon Tiva Events Calender cross site scripting
- CVE-2023-37869 WordPress Premium Addons PRO plugin <= 2.9.0 - Broken Access Control vulnerability
- CVE-2023-37868 WordPress Premium Addons PRO Plugin <= 2.9.0 is vulnerable to Sensitive Data Exposure
- CVE-2023-37867 WordPress Yet Another Stars Rating Plugin <= 3.3.8 is vulnerable to Race Condition
- CVE-2023-37866 WordPress JetFormBuilder plugin <= 3.0.8 - Authenticated Privilege Escalation vulnerability
- CVE-2023-37865 WordPress IP2Location Country Blocker plugin <= 2.29.1 - IP Bypass Vulnerability vulnerability
- CVE-2023-37864 PHOENIX CONTACT: WP 6xxx Web panels prone to download code without integrity check
- CVE-2023-37863 PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panels
- CVE-2023-37862 PHOENIX CONTACT: Missing Authorization in WP 6xxx Web panels
- CVE-2023-37861 PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panels
- CVE-2023-37860 PHOENIX CONTACT: Missing Authorization in WP 6xxx Web panels
- CVE-2023-3786 Aures Komet Kiosk Mode access control
- CVE-2023-37859 PHOENIX CONTACT: Improper Privilege Management in WP 6xxx Web panels
- CVE-2023-37858 PHOENIX CONTACT: Use of Hard-coded Credentials in WP 6xxx Web panels
- CVE-2023-37857 PHOENIX CONTACT: Use of Hard-coded Credentials in WP 6xxx Web panels
- CVE-2023-37856 PHOENIX CONTACT: Unauthorized read-access of root filesystem in WP 6xxx Web panels
- CVE-2023-37855 PHOENIX CONTACT: Unauthorized read-access of root filesystem in WP 6xxx Web panels
- CVE-2023-3785 PaulPrinting CMS cross site scripting
- CVE-2023-37849 Other in watchguard:panda security vpn
- CVE-2023-37847 SQL injection in xxyopen:novel-plus
- CVE-2023-3784 Dooblou WiFi File Explorer cross site scripting
- CVE-2023-37839 File upload in dedecms:dedecms
- CVE-2023-37837 Memory corruption in jpeg:libjpeg