Vulnerabilities published in 2023
42,916 vulnerabilities were published in 2023: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 306 of 430.
- CVE-2023-3280 Cortex XDR Agent: Local Windows User Can Disable the Agent
- CVE-2023-32799 Missing authorization in Shipping Multiple Addresses
- CVE-2023-32798 WordPress Simple Page Ordering plugin <= 2.5.0 - Broken Access Control vulnerability
- CVE-2023-32797 WordPress video carousel slider with lightbox Plugin <= 1.0.22 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-32796 WordPress WooCommerce Product Enquiry Plugin <= 2.3.4 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-32795 WordPress WooCommerce Product Add-ons Plugin <= 6.1.3 is vulnerable to PHP Object Injection
- CVE-2023-32794 WordPress WooCommerce Product Add-ons Plugin <= 6.1.3 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-32793 WordPress WooCommerce Pre-Orders Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-32792 Cross-Site Request Forgery on NXLog Manager
- CVE-2023-32791 Cross-Site Request Forgery on NXLog Manager
- CVE-2023-32790 XSS on NXLog Manager
- CVE-2023-3279 NextGEN Gallery < 3.39 - Admin+ Local File Inclusion
- CVE-2023-32789 Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- CVE-2023-32788 Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- CVE-2023-32787 Denial of service in opcfoundation:ua java legacy
- CVE-2023-32786 Langchain Server-Side Request Forgery vulnerability
- CVE-2023-32784 Information disclosure in keepass:keepass
- CVE-2023-32783 Security feature bypass in zohocorp:manageengine adaudit plus
- CVE-2023-32782 Command injection in paessler:prtg network monitor
- CVE-2023-32781 Command injection in paessler:prtg network monitor
- CVE-2023-32778 Path traversal in ILIAS
- CVE-2023-3277 MStore API <= 4.10.7 - Unauthorized Account Access and Privilege Escalation
- CVE-2023-32767 Path traversal in symcon:ip symcon
- CVE-2023-32766 Gitpod vulnerable to Cross-site Scripting
- CVE-2023-32764 Privilege escalation in fabasoft:cloud
- CVE-2023-32763 Memory corruption in qt:qt
- CVE-2023-32762 Security feature bypass in debian:debian linux
- CVE-2023-32761 Cross-site request forgery in archerirm:archer
- CVE-2023-32760 Information disclosure in archerirm:archer
- CVE-2023-3276 Dromara HuTool XML Parsing Module XmlUtil.java readBySax xml external entity reference
- CVE-2023-32759 Information disclosure in archerirm:archer
- CVE-2023-32758 git-url-parse Regular Expression Denial of Service
- CVE-2023-32757 e-Excellence U-Office Force - Arbitrary File Upload
- CVE-2023-32756 e-Excellence U-Office Force - Path Traversal
- CVE-2023-32755 e-Excellence U-Office Force - Error Message Leakage
- CVE-2023-32754 Thinking Software Efence - SQL injection
- CVE-2023-32753 ITPison OMICARD EDM - Arbitrary File Upload
- CVE-2023-32752 L7 Networks InstantScan & InstantQoS - Arbitrary File Upload
- CVE-2023-32751 Hardcoded credentials in pydio:cells
- CVE-2023-32750 Server-side request forgery in pydio:cells
- CVE-2023-3275 PHPGurukul Rail Pass Management System POST Request view-pass-detail.php sql injection
- CVE-2023-32749 Privilege escalation in pydio:cells
- CVE-2023-32748 Missing authorization in mitel:mivoice connect
- CVE-2023-32747 WordPress WooCommerce Bookings Plugin <= 1.15.78 is vulnerable to Insecure Direct Object References (IDOR)
- CVE-2023-32746 WordPress WooCommerce Brands Plugin <= 1.6.45 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-32745 WordPress AutomateWoo Plugin <= 5.7.1 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-32744 WordPress WooCommerce Product Recommendations Plugin < 2.3.0 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-32743 WordPress AutomateWoo Plugin <= 5.7.1 is vulnerable to SQL Injection
- CVE-2023-32742 WordPress WP SMS Plugin <= 6.1.4 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-32741 WordPress Contact Form to Any API Plugin <= 1.1.2 is vulnerable to SQL Injection
- CVE-2023-32740 WordPress Custom 404 Pro Plugin <= 3.8.1 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-3274 code-projects Supplier Management System Picture btn_functions.php unrestricted upload
- CVE-2023-32739 WordPress WP Custom Cursors Plugin < 3.2 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-32738 WordPress Eonet Manual User Approve Plugin <= 2.1.3 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-32737 Deserialization in SIMATIC STEP 7 Safety V18
- CVE-2023-32736 Deserialization in SIMATIC S7-PLCSIM V16
- CVE-2023-32735 Deserialization in SIMATIC STEP 7 Safety V16
- CVE-2023-32734 Memory corruption in iOS and iPadOS
- CVE-2023-32732 Denial-of-Service in gRPC
- CVE-2023-32731 Information leak in gRPC
- CVE-2023-3273 Missing authorization in ICR890-4
- CVE-2023-32728 Code injection in zabbix_agent2 smart.disk.get caused by smartctl plugin
- CVE-2023-32727 Code execution vulnerability in icmpping
- CVE-2023-32726 Possible buffer overread from reading DNS responses
- CVE-2023-32725 Leak of zbx_session cookie when using a scheduled report that includes a dashboard with a URL widget.
- CVE-2023-32724 JavaScript engine memory pointers are directly available for Zabbix users for modification
- CVE-2023-32723 Inefficient permission check in class CControllerAuthenticationUpdate
- CVE-2023-32722 Stack-buffer Overflow in library module zbxjson
- CVE-2023-32721 Stored XSS in Maps element
- CVE-2023-3272 Information disclosure in ICR890-4
- CVE-2023-32717 Role-based Access Control (RBAC) Bypass on '/services/indexing/preview' REST Endpoint Can Overwrite Search Results
- CVE-2023-32716 Denial of Service via the 'dump' SPL command
- CVE-2023-32715 Self Cross-Site Scripting (XSS) on Splunk App for Lookup File Editing
- CVE-2023-32714 Path Traversal in Splunk App for Lookup File Editing
- CVE-2023-32713 Local Privilege Escalation via the ‘streamfwd’ program in Splunk App for Stream
- CVE-2023-32712 Unauthenticated Log Injection in Splunk Enterprise
- CVE-2023-32711 Persistent Cross-Site Scripting (XSS) through a URL Validation Bypass within a Dashboard View
- CVE-2023-32710 Information Disclosure via the ‘copyresults’ SPL Command
- CVE-2023-3271 Missing authorization in ICR890-4
- CVE-2023-32709 Low-privileged User can View Hashed Default Splunk Password
- CVE-2023-32708 HTTP Response Splitting via the ‘rest’ SPL Command
- CVE-2023-32707 ‘edit_user’ Capability Privilege Escalation
- CVE-2023-32706 Denial Of Service due to Untrusted XML Tag in XML Parser within SAML Authentication
- CVE-2023-32701 Vulnerability in Networking Stack Impacts QNX Software Development Platform (SDP)
- CVE-2023-32700 Command injection in luatex project:luatex
- CVE-2023-3270 Information disclosure in ICR890-4
- CVE-2023-32699 MeterSphere denial of service vulnerability
- CVE-2023-32698 nfpm vulnerable to Incorrect Default Permissions
- CVE-2023-32697 Sqlite-jdbc vulnerable to remote code execution when JDBC url is attacker controlled
- CVE-2023-32696 Excessive permissions for ckan user
- CVE-2023-32695 Insufficient validation when decoding a Socket.IO packet
- CVE-2023-32694 Non-constant time HMAC comparison in Adyen plugin in Saleor
- CVE-2023-32693 Decidim Cross-site Scripting vulnerability in the external link redirections
- CVE-2023-32692 Remote Code Execution Vulnerability in Validation Placeholders
- CVE-2023-32691 ginuerzh/gost vulnerable to Timing Attack
- CVE-2023-32690 Responder can Invoke Undefined Behavior in libspdm Requester
- CVE-2023-3269 Distros-[dirtyvma] privilege escalation via non-rcu-protected vma traversal
- CVE-2023-32689 Parse Server vulnerable to phishing attack vulnerability that involves uploading malicious HTML file
- CVE-2023-32688 Invalid push request payload crashes Parse Server
- CVE-2023-32687 Insufficiently Protected ChatBot Credentials in tgstation-server