Vulnerabilities published in 2023
42,916 vulnerabilities were published in 2023: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 295 of 430.
- CVE-2023-34185 WordPress NextGen GalleryView Plugin <= 0.5.5 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-34184 WordPress Woocommerce Order address Print Plugin <= 3.2 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-34183 WordPress Unite Gallery Lite Plugin <= 1.7.61 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-34182 WordPress LH Password Changer Plugin <= 1.55 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-34181 WordPress WP-Cirrus Plugin <= 0.6.11 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-34180 WordPress Google Fonts For WordPress Plugin <= 3.0.0 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-34179 WordPress Groundhogg Plugin <= 2.7.11 is vulnerable to SQL Injection
- CVE-2023-34178 WordPress Groundhogg Plugin <= 2.7.11 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-34177 WordPress WP-Cache.com Plugin <= 1.1.1 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-34176 WordPress Chilexpress woo oficial Plugin <= 1.2.9 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-34175 WordPress Login Configurator Plugin <= 2.1 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-34174 WordPress BBS e-Popup Plugin <= 2.4.5 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-34173 WordPress Yandex Metrica Counter Plugin <= 1.4.3 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-34172 WordPress WordPress Social Login Plugin <= 3.0.4 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-34171 WordPress WP Report Post Plugin <= 2.1.2 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-34170 WordPress Quick/Bulk Order Form for WooCommerce Plugin <= 3.5.7 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-3417 File Extension Spoofing using the Text Direction Override Character
- CVE-2023-34169 WordPress TS Webfonts for さくらのレンタルサーバ Plugin <= 3.1.2 is vulnerable to Broken Access Control
- CVE-2023-34168 WordPress WP Report Post Plugin <= 2.1.2 is vulnerable to SQL Injection
- CVE-2023-34167 Security feature bypass in EMUI
- CVE-2023-34166 Denial of service in EMUI
- CVE-2023-34165 Missing authorization in HarmonyOS
- CVE-2023-34164 Null dereference in EMUI
- CVE-2023-34163 Missing authorization in EMUI
- CVE-2023-34162 Denial of service in EMUI
- CVE-2023-34161 Missing authorization in EMUI
- CVE-2023-34160 Security feature bypass in EMUI
- CVE-2023-3416 tagDiv Opt-In Builder <= 1.4.4 - Authenticated (Admin+) SQL Injection
- CVE-2023-34159 Privilege escalation in EMUI
- CVE-2023-34158 Security feature bypass in EMUI
- CVE-2023-34157 Other in HarmonyOS
- CVE-2023-34156 Denial of service in EMUI
- CVE-2023-34155 Missing authorization in EMUI
- CVE-2023-34154 Misconfiguration in HarmonyOS
- CVE-2023-34153 Command injection in ImageMagick
- CVE-2023-34152 Command injection in ImageMagick
- CVE-2023-34151 Integer overflow in ImageMagick
- CVE-2023-34150 Apache Any23: Possible excessive allocation of resources reading input.
- CVE-2023-34149 Apache Struts: DoS via OOM owing to not properly checking of list bounds
- CVE-2023-34148 Privilege escalation in Trend Micro Apex One
- CVE-2023-34147 Privilege escalation in Trend Micro Apex One
- CVE-2023-34146 Privilege escalation in Trend Micro Apex One
- CVE-2023-34145 Privilege escalation in Trend Micro Apex One
- CVE-2023-34144 Privilege escalation in Trend Micro Apex One
- CVE-2023-34143 Improper Validation of Certificate Vulnerability in Hitachi Device Manager
- CVE-2023-34142 Cleartext Transmission Vulnerability in Hitachi Device Manager
- CVE-2023-34141 Command injection in ATP series firmware
- CVE-2023-34140 Memory corruption in ATP series firmware
- CVE-2023-3414 Cross-Site Request Forgery (CSRF) in Jenkins Plug-in for ServiceNow DevOps
- CVE-2023-34139 Command injection in USG FLEX series firmware
- CVE-2023-34138 Command injection in ATP series firmware
- CVE-2023-34137 Auth bypass in Analytics
- CVE-2023-34136 File upload in Analytics
- CVE-2023-34135 Path traversal in Analytics
- CVE-2023-34134 Information disclosure in Analytics
- CVE-2023-34133 SQL injection in Analytics
- CVE-2023-34132 Auth bypass in Analytics
- CVE-2023-34131 Information disclosure in Analytics
- CVE-2023-34130 Weak cryptography in Analytics
- CVE-2023-3413 Insertion of Sensitive Information Into Sent Data in GitLab
- CVE-2023-34129 Path traversal in Analytics
- CVE-2023-34128 Hardcoded credentials in Analytics
- CVE-2023-34127 Command injection in Analytics
- CVE-2023-34126 File upload in Analytics
- CVE-2023-34125 Path traversal in Analytics
- CVE-2023-34124 Auth bypass in Analytics
- CVE-2023-34123 Hardcoded credentials in Analytics
- CVE-2023-34121 Cross-site scripting in Zoom Rooms Client for Windows
- CVE-2023-34120 Privilege escalation in Zoom Rooms Client for Windows
- CVE-2023-3412 Missing authorization in Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite
- CVE-2023-34119 Privilege escalation in Zoom Rooms for Windows
- CVE-2023-34118 Privilege escalation in Zoom Rooms for Windows
- CVE-2023-34117 Path traversal in Zoom Client SDK
- CVE-2023-34116 Command injection in Zoom Desktop Client for Windows
- CVE-2023-34115 Memory corruption in Zoom Meeting SDK
- CVE-2023-34114 Information disclosure in Zoom for MacOS Client
- CVE-2023-34112 JavaCPP project actions vulnerable to code injection
- CVE-2023-34111 Command Injection Vulnerability in `Release PR Merged` Workflow in taosdata/grafanaplugin
- CVE-2023-34110 Flask-AppBuilder vulnerable to possible disclosure of sensitive information on user error
- CVE-2023-3411 Cross-site request forgery in Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite
- CVE-2023-34109 User input results in Unbounded resource consumption in @zxcvbn-ts/core
- CVE-2023-34108 Manipulation of Internal Dovecot Variables in mailcow via crafted Passwords
- CVE-2023-34107 GLPI vulnerable to unauthorized access to KnowbaseItem data
- CVE-2023-34106 GLPI vulnerable to unauthorized access to User data
- CVE-2023-34105 SRS has command injection vulnerability in demonstration api-server for HTTP callback.
- CVE-2023-34104 Regex Injection via Doctype Entities
- CVE-2023-34103 Stored XSS (Cross Site Scripting) in html content based fields of avo
- CVE-2023-34102 Possible unsafe reflection / partial denial of service in avo
- CVE-2023-34101 Contiki-NG vulnerable to out-of-bounds read when processing ICMP DAO input
- CVE-2023-34100 Out-of-Bounds Read in contiki-ng
- CVE-2023-3410 Bricks <= 1.10.1 - Authenticated (Bricks Page Builder Access+) Stored Cross-Site Scripting
- CVE-2023-34099 Improper mail validation in Shopware
- CVE-2023-34098 Dependency configuration exposed in Shopware
- CVE-2023-34097 Database password exposed in logs in hoppscotch
- CVE-2023-34096 Thruk has Path Traversal Vulnerability in panorama.pm
- CVE-2023-34095 cpdb-libs vulnerable to buffer overflows via scanf
- CVE-2023-34094 ChuanhuChatGPT vulnerable to unauthorized configuration file access
- CVE-2023-34093 Strapi allows actors to make all attributes on a content-type public without noticing it
- CVE-2023-34092 Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)
- CVE-2023-34091 Kyverno resource with a deletionTimestamp may allow policy circumvention