Vulnerabilities published in 2023
42,916 vulnerabilities were published in 2023: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 288 of 430.
- CVE-2023-3520 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in it-novum/openitcockpit
- CVE-2023-35194 Command injection in Surf SOHO HW1
- CVE-2023-35193 Command injection in Surf SOHO HW1
- CVE-2023-35192 Privilege escalation in Intel(R) GPA Framework software
- CVE-2023-35191 Denial of service in Intel(R) SPS firmware versions
- CVE-2023-3519 Citrix NetScaler ADC and NetScaler Gateway Code Injection
- CVE-2023-35189 Iagona ScrutisWeb Unrestricted Upload of File with Dangerous Type
- CVE-2023-35188 SQL Injection Remote Code Execution Vulnerability
- CVE-2023-35187 SolarWinds Access Rights Manager Directory Traversal Remote Code Execution Vulnerability
- CVE-2023-35186 SolarWinds Access Rights Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability
- CVE-2023-35185 SolarWinds Access Rights Manager OpenFile Directory Traversal Remote Code Execution Vulnerability
- CVE-2023-35184 SolarWinds Access Rights Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability
- CVE-2023-35183 SolarWinds Access Rights Manager Incorrect Default Permissions Local Privilege Escalation Vulnerability
- CVE-2023-35182 SolarWinds Access Rights Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability
- CVE-2023-35181 SolarWinds Access Rights Manager Incorrect Default Permissions Local Privilege Escalation Vulnerability
- CVE-2023-35180 SolarWinds Access Rights Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability
- CVE-2023-3518 JWT Auth in L7 Intentions Allow For Mismatched Service Identity and JWT Providers for Access
- CVE-2023-35179 2FA/MFA Bypass Vulnerability in Serv-U 15.4
- CVE-2023-35178 Memory corruption in HP LaserJet Pro
- CVE-2023-35177 Memory corruption in HP LaserJet Pro
- CVE-2023-35176 Memory corruption in HP LaserJet Pro
- CVE-2023-35175 Server-side request forgery in HP LaserJet Pro
- CVE-2023-35174 Livebook Desktop's protocol handler can be exploited to execute arbitrary command on Windows
- CVE-2023-35173 End-to-End encrypted file-drops can be made inaccessible
- CVE-2023-35172 Nextcloud Server password reset endpoint is not brute force protected
- CVE-2023-35171 Nextcloud Server vulnerable to open redirect on "Unsupported browser" warning
- CVE-2023-3517 Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection')
- CVE-2023-35169 php-imap vulnerable to RCE through a directory traversal vulnerability
- CVE-2023-35168 DataEase has a privilege bypass vulnerability
- CVE-2023-35167 When setting EntityOptions.apiPrefilter to a function, the filter is not applied to API requests for a resource by Id
- CVE-2023-35166 Privilege escalation (PR) from account through TipsPanel
- CVE-2023-35165 AWS CDK EKS overly permissive trust policies
- CVE-2023-35164 Unauthorized users can manipulate a dashboard created by an administrator in DataEase
- CVE-2023-35163 Vega's validators able to submit duplicate transactions
- CVE-2023-35162 XPlatform Wiki vulnerable to cross-site scripting via xcontinue parameter in preview actions template
- CVE-2023-35161 XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in DeleteApplication page
- CVE-2023-35160 XWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit template
- CVE-2023-35159 XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template
- CVE-2023-35158 XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in restore template
- CVE-2023-35157 XWiki Platform vulnerable to reflected cross-site scripting via delattachment action
- CVE-2023-35156 XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in delete template
- CVE-2023-35155 XWiki Platform vulnerable to cross-site scripting in target parameter via share page by email
- CVE-2023-35154 Knowage-Server vulnerable to account validation bypass
- CVE-2023-35153 XWiki Platform vulnerable to stored cross-site scripting in ClassEditSheet page via name parameters
- CVE-2023-35152 XWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResults
- CVE-2023-35151 XWiki Platform may show email addresses in clear in REST results
- CVE-2023-35150 XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application
- CVE-2023-3515 Open Redirect in go-gitea/gitea
- CVE-2023-35149 Jenkins Digital.ai App Management Publisher Plugin missing permission checks
- CVE-2023-35148 Jenkins Digital.ai App Management Publisher Plugin vulnerable to Cross-Site Request Forgery
- CVE-2023-35147 Arbitrary file read vulnerability in Jenkins AWS CodeCommit Trigger Plugin
- CVE-2023-35146 Jenkins Template Workflows Plugin vulnerable to Stored Cross-site Scripting
- CVE-2023-35145 Jenkins Sonargraph Integration Plugin vulnerable to Stored Cross-site Scripting
- CVE-2023-35144 Stored XSS vulnerability in Jenkins Maven Repository Server Plugin
- CVE-2023-35143 Stored XSS vulnerability in Jenkins Maven Repository Server Plugin
- CVE-2023-35142 SSL/TLS certificate validation disabled by default in Jenkins Checkmarx Plugin
- CVE-2023-35141 Jenkins CSRF protection bypass vulnerability
- CVE-2023-35140 Privilege escalation in GS1900-24EP firmware
- CVE-2023-3514 RazerCentralSerivce Unsafe Named Pipe Permission Escalation of Privilege Vulnerability
- CVE-2023-35139 Cross-site scripting in USG FLEX 50(W) series firmware
- CVE-2023-35138 Command injection in NAS326 firmware
- CVE-2023-35137 Auth bypass in NAS326 firmware
- CVE-2023-35136 Other in ATP series firmware
- CVE-2023-35134 Weintek Weincloud Weak Password Recovery Mechanism for Forgotten Password
- CVE-2023-35133 Moodle: ssrf risk due to insufficient check on the curl blocked hosts
- CVE-2023-35132 Moodle: minor sql injection risk on mnet sso access control page
- CVE-2023-35131 Moodle: xss risk on groups page
- CVE-2023-3513 RazerCentralService Unsafe Deserialization Escalation of Privilege
- CVE-2023-35128 Integer overflow in GTKWave
- CVE-2023-35127 Fuji Electric Tellus Lite V-Simulator Stack-based Buffer Overflow
- CVE-2023-35126 Memory corruption in Ichitaro 2023
- CVE-2023-35124 Information disclosure in OAS Platform
- CVE-2023-35123 Denial of service in Intel(R) Server Platforms
- CVE-2023-35121 Privilege escalation in Intel(R) oneAPI DPC++/C++ Compiler software
- CVE-2023-35120 PiiGAB M-Bus Cross-Site Request Forgery
- CVE-2023-3512 Relative path traversal in Setelsa Security ConacWin CB
- CVE-2023-35116 Denial of service in fasterxml:jackson-databind
- CVE-2023-35110 jjson vulnerable to stack exhaustion
- CVE-2023-3511 Incorrect Authorization in GitLab
- CVE-2023-3510 FTP Access <= 1.0 - Subscriber+ Stored XSS
- CVE-2023-35098 WordPress NextGen GalleryView Plugin <= 0.5.5 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-35097 WordPress WP Affiliate Links Plugin <= 0.1.1 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-35096 WordPress myCred Plugin <= 2.5 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-35095 WordPress Flo Forms Plugin <= 1.0.40 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-35094 WordPress WP Matterport Shortcode Plugin <= 2.1.4 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-35093 WordPress MasterStudy LMS Plugin <= 3.0.8 is vulnerable to Broken Access Control
- CVE-2023-35092 WordPress breadcrumb simple Plugin <= 1.3 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-35091 WordPress WooCommerce Stock Manager Plugin <= 2.10.0 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-35090 WordPress MasterStudy LMS Plugin <= 3.0.8 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-3509 Incorrect Authorization in GitLab
- CVE-2023-35089 Cross-site request forgery in Recipe Maker For Your Food Blog from Zip Recipes
- CVE-2023-35088 Apache InLong: SQL injection in audit endpoint
- CVE-2023-35087 ASUS RT-AX56U V2 & RT-AC86U - Format String - 2
- CVE-2023-35086 ASUS RT-AX56U V2 & RT-AC86U - Format String -1
- CVE-2023-35085 Integer overflow in UniFi Access Points
- CVE-2023-35084 Deserialization in Endpoint Manager
- CVE-2023-35083 Path traversal in Endpoint Manager
- CVE-2023-35082 Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass
- CVE-2023-35081 Ivanti Endpoint Manager Mobile (EPMM) Path Traversal
- CVE-2023-35080 Misconfiguration in Secure Access Client