Vulnerabilities published in 2023
42,916 vulnerabilities were published in 2023: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 296 of 430.
- CVE-2023-34090 Decidim vulnerable to sensitive data disclosure
- CVE-2023-3409 Bricks <= 1.8.1 - Cross-Site Request Forgery via reset_settings
- CVE-2023-34089 Decidim Cross-site Scripting vulnerability in the processes filter
- CVE-2023-34088 Collabora Online has Stored Cross-Site-Scripting vulnerability in admin interface
- CVE-2023-34087 Memory corruption in GTKWave
- CVE-2023-34086 Privilege escalation in Intel(R) NUC BIOS firmware
- CVE-2023-34085 User Attribute Disclosure via DynamoDB Data Stores
- CVE-2023-3408 Bricks <= 1.8.1 - Cross-Site Request Forgery via save_settings
- CVE-2023-3407 Subscribe2 <= 10.40 - Cross-Site Request Forgery
- CVE-2023-34064 Privilege Escalation Vulnerability
- CVE-2023-34063 Missing authorization in VMware Aria Automation, VMware Cloud Foundation
- CVE-2023-34062 In Reactor Netty HTTP Server a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack
- CVE-2023-34061 CVE-2023-34061 – Gorouter route pruning
- CVE-2023-34060 Auth bypass in VMware Cloud Director Appliance (VCD Appliance)
- CVE-2023-3406 Path traversal issue in M-Files Classic Web
- CVE-2023-34059 Privilege escalation in open-vm-tools
- CVE-2023-34058 Security feature bypass in VMware Tools
- CVE-2023-34057 Privilege escalation in VMware Tools
- CVE-2023-34056 VMware vCenter Server Partial Information Disclosure Vulnerability
- CVE-2023-34055 Spring Boot server Web Observations DoS Vulnerability
- CVE-2023-34054 Reactor Netty HTTP Server Metrics DoS Vulnerability
- CVE-2023-34053 Spring Framework server Web Observations DoS Vulnerability
- CVE-2023-34052 Deserialization in VMware Aria Operations for Logs
- CVE-2023-34051 Auth bypass in VMware Aria Operations for Logs
- CVE-2023-34050 Spring AMQP Deserialization Vulnerability
- CVE-2023-3405 Denial of service condition in M-Files Server
- CVE-2023-34049 Salt security advisory release - 2023-OCT-27
- CVE-2023-34048 VMware vCenter Server Out-of-Bounds Write
- CVE-2023-34047 Exposure of data and identity to wrong session in Spring for GraphQL
- CVE-2023-34046 VMware Fusion TOCTOU local privilege escalation vulnerability
- CVE-2023-34045 VMware Fusion installer local privilege escalation
- CVE-2023-34044 Information disclosure vulnerability in bluetooth device-sharing functionality
- CVE-2023-34043 Privilege escalation in VMware Aria Operations
- CVE-2023-34042 Spring Security's spring-security.xsd file is world writable
- CVE-2023-34041 CVE-2023-34041-Abuse of HTTP Hop-by-Hop Headers in Cloud Foundry Gorouter
- CVE-2023-34040 Java Deserialization vulnerability in Spring-Kafka When Improperly Configured
- CVE-2023-3404 ProfileGrid <= 5.5.0 - Hardcoded Encryption Key
- CVE-2023-34039 Auth bypass in Aria Operations for Networks
- CVE-2023-34038 Information disclosure in VMware Horizon Server
- CVE-2023-34037 Other in VMware Horizon Server
- CVE-2023-34036 Forwarded header exploit with Spring HATEOAS on WebFlux
- CVE-2023-34035 Spring Security's authorization rules can be misconfigured when using multiple servlets
- CVE-2023-34034 Access Control Bypass in Spring Security
- CVE-2023-34033 WordPress Ajax Pagination and Infinite Scroll Plugin <= 2.0.1 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-34032 WordPress bbPress Toolkit Plugin <= 1.0.12 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-34031 WordPress bbPress Toolkit Plugin <= 1.0.12 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-34030 WordPress Complianz and Complianz Premium plugins - Cross Site Request Forgery (CSRF)
- CVE-2023-3403 ProfileGrid <= 5.5.1 - Missing Authorization to User Import
- CVE-2023-34029 WordPress Disable WordPress Update Notifications Plugin <= 2.3.3 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-34028 WordPress WOLF Plugin <= 1.0.7 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-34027 WordPress Recently Viewed Products Plugin <= 1.0.0 is vulnerable to PHP Object Injection
- CVE-2023-34026 WordPress This Day In History Plugin <= 3.10.1 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-34025 WordPress LWS Hide Login Plugin <= 2.1.6 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-34024 WordPress WP Full Auto Tags Manager Plugin <= 2.2 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-34023 WordPress WordPress Social Login Plugin <= 3.0.4 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-34022 WordPress Dynamic QR Code Generator Plugin <= 0.0.5 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-34021 WordPress Church Admin Plugin <= 3.7.29 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-34020 WordPress Uncanny Toolkit for LearnDash plugin <= 3.6.4.3 - Open Redirection vulnerability
- CVE-2023-34019 WordPress Uncanny Toolkit for LearnDash plugin <= 3.6.4.3 - Broken Access Control vulnerability
- CVE-2023-34018 WordPress SoundCloud Shortcode Plugin <= 3.1.0 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-34017 WordPress Five Star Restaurant Reservations Plugin <= 2.6.7 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-34015 WordPress Advanced Flat rate shipping Woocommerce Plugin <= 1.6.4.4 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-34014 WordPress Grid Plus plugin <= 1.3.2 - Broken Access Control vulnerability
- CVE-2023-34013 WordPress Poll Maker Plugin <= 4.6.2 is vulnerable to Server Side Request Forgery (SSRF)
- CVE-2023-34012 WordPress Premium Addons PRO Plugin <= 2.8.24 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-34011 WordPress ShopConstruct Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-34010 WordPress Media Library Assistant Plugin <= 3.0.7 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-3401 Improper Control of Generation of Code ('Code Injection') in GitLab
- CVE-2023-34009 WordPress Social Media Share Buttons & Social Sharing Icons plugin <= 2.8.1 - Broken Access Control + CSRF
- CVE-2023-34008 WordPress WP ERP Plugin <= 1.12.3 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-34007 WordPress Download Monitor Plugin <= 4.8.3 is vulnerable to Arbitrary File Upload
- CVE-2023-34006 WordPress Telegram Bot & Channel Plugin <= 3.6.2 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-34005 WordPress Front End Users Plugin <= 3.2.24 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-34004 WordPress WooCommerce Box Office Plugin <= 1.1.50 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-34003 WordPress WooCommerce Box Office plugin <= 1.1.51 - Unauthenticated Save Ticket Barcode vulnerability
- CVE-2023-34002 WordPress WP Inventory Manager Plugin <= 2.1.0.13 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-34001 WordPress Hide My WP Ghost – Security Plugin plugin <= 5.0.25 - Captcha Bypass vulnerability
- CVE-2023-34000 WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.4.0 is vulnerable to Insecure Direct Object References (IDOR)
- CVE-2023-33999 WordPress WP Mail Log plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2023-33998 WordPress Easy Social Icons plugin <= 3.2.5 - Broken Access Control vulnerability
- CVE-2023-33997 WordPress bbp style pack Plugin <= 5.5.5 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-33996 WordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin <= 6.10 - Broken Access Control vulnerability
- CVE-2023-33995 WordPress Photo Gallery by 10Web plugin <= 1.8.15 - Broken Access Control vulnerability
- CVE-2023-33994 WordPress Slimstat Analytics plugin <= 5.0.5.1 - Broken Access Control vulnerability
- CVE-2023-33993 SQL Injection vulnerability in SAP Business One B1i Layer
- CVE-2023-33992 Missing Authorization Check in SAP Business Warehouse and SAP BW/4HANA
- CVE-2023-33991 Stored Cross-Site Scripting (Stored XSS) vulnerability in SAP UI5 Variant Management
- CVE-2023-33990 Denial of Service (DoS) vulnerability in SAP SQL Anywhere
- CVE-2023-3399 Insertion of Sensitive Information Into Sent Data in GitLab
- CVE-2023-33989 Directory Traversal vulnerability in SAP NetWeaver (BI CONT ADD ON)
- CVE-2023-33988 Cross-Site Scripting vulnerability in SAP Enable Now
- CVE-2023-33987 Request smuggling and request concatenation in SAP Web Dispatcher
- CVE-2023-33986 Cross-Site Scripting (XSS) vulnerability in SAP CRM ABAP (Grantor Management)
- CVE-2023-33985 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal
- CVE-2023-33984 Cross-Site Scripting (XSS) vulnerability in NetWeaver (Design Time Repository)
- CVE-2023-33983 Security feature bypass in briarproject:briar
- CVE-2023-33982 Weak cryptography in briarproject:briar
- CVE-2023-33981 Security feature bypass in briarproject:briar
- CVE-2023-33980 Denial of service in briarproject:briar
- CVE-2023-3398 Denial of Service in jgraph/drawio