Vulnerabilities published in 2023
42,916 vulnerabilities were published in 2023: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 324 of 430.
- CVE-2023-30640 Missing authorization in Samsung Mobile Devices
- CVE-2023-3064 Mobatime mobile application - Sensitive information disclosure
- CVE-2023-30639 Cross-site scripting in archerirm:archer
- CVE-2023-30638 Command injection in atos:unify openscape bcf
- CVE-2023-30637 Denial of service in baidu:braft
- CVE-2023-30636 Denial of service in tikv:tikv
- CVE-2023-30635 Denial of service in tikv:tikv
- CVE-2023-30633 Security feature bypass in insyde:insydeh2o
- CVE-2023-30631 Apache Traffic Server: Configuration option to block the PUSH method in ATS didn't work
- CVE-2023-30630 Path traversal in nongnu:dmidecode
- CVE-2023-3063 Missing authorization in SP Project & Document Manager
- CVE-2023-30629 Vyper's raw_call with outsize=0 and revert_on_failure=False returns incorrect success value
- CVE-2023-30628 Kiwi TCMS has command injection vulnerability in changelog.yml CI workflow
- CVE-2023-30627 jellyfin-web has a stored cross-site scripting vulnerability in devices.js
- CVE-2023-30626 Jellyfin vulnerable to directory traversal and file write causing arbitrary code execution
- CVE-2023-30625 rudder-server vulnerable to SQL Injection
- CVE-2023-30624 Wasmtime has Undefined Behavior in Rust runtime functions
- CVE-2023-30623 Arbitrary command injection in embano1/wip
- CVE-2023-30622 Clusternet has potential risk which can be leveraged to make a cluster-level privilege escalation
- CVE-2023-30621 OS command injection in Gipsy
- CVE-2023-30620 Arbitrary File Write when Extracting a Remotely retrieved Tarball in mindsdb/mindsdb
- CVE-2023-3062 code-projects Agro-School Management System index.php sql injection
- CVE-2023-30619 XSS in the tooltip via an artifact title
- CVE-2023-30618 Sensitive Terraform Output Values Printed At Info Logging Level In Kitchen-Terraform
- CVE-2023-30617 Leverage the kruise-daemon pod to list all secrets in the entire cluster
- CVE-2023-30616 Cross Site Request Forgery due to missing nonce verification in form block
- CVE-2023-30615 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in iris-web
- CVE-2023-30614 Improper Neutralization of Script-Related HTML Tags in a Web Page in pay
- CVE-2023-30613 Kiwi TCMS unrestricted file upload vulnerability
- CVE-2023-30612 Malicious HTTP requests could close arbitrary opening file descriptors in cloud-hypervisor
- CVE-2023-30611 Reaction metadata exposed in private topics in Discourse-reactions
- CVE-2023-30610 AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending
- CVE-2023-3061 code-projects Agro-School Management System Attachment Image btn_functions.php unrestricted upload
- CVE-2023-30609 matrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlighting
- CVE-2023-30608 Parser contains an inefficient regular expression in sqlparse
- CVE-2023-30607 icingaweb2-module-jira template and field configuration are susceptible to CSRF
- CVE-2023-30606 Multisite denial of service through unsanitized dynamic dispatch to SiteSetting in Discourse
- CVE-2023-30605 Multiple SQL injections in sql/instance.py param_edit method in Archery - GHSL-2022-104
- CVE-2023-30604 Hitron Technologies Inc. CODA-5310 - Broken Access Control
- CVE-2023-30603 Hitron Technologies Inc. CODA-5310 - Using default credentials
- CVE-2023-30602 Hitron Technologies Inc. CODA-5310 - Insecure service Telnet
- CVE-2023-30601 Apache Cassandra: Privilege escalation when enabling FQL/Audit logs
- CVE-2023-3060 code-projects Agro-School Management System btn_functions.php doAddQuestion cross site scripting
- CVE-2023-30591 NodeBB Pre-Authentication Denial-of-Service
- CVE-2023-30590 Weak cryptography in Node
- CVE-2023-3059 SourceCodester Online Exam Form Submission update_s6.php sql injection
- CVE-2023-30589 llhttp vulnerable to HTTP request smuggling
- CVE-2023-30588 Denial of service in Node
- CVE-2023-30587 Security feature bypass in Node
- CVE-2023-30586 Security feature bypass in Node
- CVE-2023-30585 Privilege escalation in Node
- CVE-2023-30584 Path traversal in Node
- CVE-2023-30583 Security feature bypass in Node
- CVE-2023-30582 Security feature bypass in Node
- CVE-2023-30581 Security feature bypass in Node
- CVE-2023-3058 07FLY CRM User Profile cross site scripting
- CVE-2023-30577 Command injection in zmanda:amanda
- CVE-2023-30576 Apache Guacamole: Use-after-free in handling of RDP audio input buffer
- CVE-2023-30575 Apache Guacamole: Incorrect calculation of Guacamole protocol element lengths
- CVE-2023-30571 Race condition in libarchive:libarchive
- CVE-2023-30570 Denial of service in libreswan:libreswan
- CVE-2023-3057 YFCMF Ajax.php path traversal
- CVE-2023-30565 CQI Data Sniffing
- CVE-2023-30564 Stored Cross-Site Scripting on Device Import Functionality
- CVE-2023-30563 Stored Cross-Site Scripting on User Import Functionality
- CVE-2023-30562 Lack of Dataset Integrity Checking
- CVE-2023-30561 Lack of Cryptographic Security of IUI Bus
- CVE-2023-30560 PCU Configuration Lacks Authentication
- CVE-2023-3056 YFCMF index.php path traversal
- CVE-2023-30559 Wireless Card Firmware Improperly Signed
- CVE-2023-30558 Multiple SQL injections in sql/data_dictionary.py table_list method in Archery - GHSL-2022-105
- CVE-2023-30557 SQL injection in data_dictionary.py table_info method in Archery - GHSL-2022-106
- CVE-2023-30556 SQL injection in sql_optimize.py optimize_sqltuningadvisor method in Archery - GHSL-2022-107
- CVE-2023-30555 SQL injection in sql_optimize.py explain method in Archery - GHSL-2022-108
- CVE-2023-30554 SQL injection in sql_api/api_workflow.py endpoint in Archery - GHSL-2022-103
- CVE-2023-30553 Multiple SQL injections in sql_api/api_workflow.py endpoint in Archery - GHSL-2022-102
- CVE-2023-30552 SQL injection in sql/instance.py endpoint in Archery - GHSL-2022-101
- CVE-2023-30551 Rekor's compressed archives can result in OOM conditions
- CVE-2023-30550 IDOR vulnerability exists in metersphere
- CVE-2023-3055 Page Builder by AZEXO <= 1.27.133 - Cross-Site Request Forgery to Stored Cross-Site Scripting via azh_save
- CVE-2023-30549 Unpatched extfs vulnerabilities are exploitable through suid-mode Apptainer
- CVE-2023-30548 Path traversal vulnerability in gatsby-plugin-sharp
- CVE-2023-30547 Sandbox Escape in vm2
- CVE-2023-30546 Contiki-NG has off-by-one error in Antelope DBMS
- CVE-2023-30545 PrestaShop arbitrary file read vulnerability
- CVE-2023-30544 Kiwi TCMS may allow user to update email address to unverified one
- CVE-2023-30543 `chainId` may be outdated if user changes chains as part of connection in @web3-react
- CVE-2023-30542 GovernorCompatibilityBravo may trim proposal calldata
- CVE-2023-30541 TransparentUpgradeableProxy clashing selector calls may not be delegated in @openzeppelin/contracts
- CVE-2023-30540 Chat poll data can still be queried from API after purging history in Nextcloud talk
- CVE-2023-30539 Users can set up workflows using restricted and invisible system tags in Nextcloud
- CVE-2023-30538 Stored Cross-site Scripting via improper sanitization of svg files in Discourse
- CVE-2023-30537 org.xwiki.platform:xwiki-platform-flamingo-theme-ui vulnerable to privilege escalation
- CVE-2023-30536 Insecure header validation in slim/psr7
- CVE-2023-30535 Snowflake JDBC vulnerable to command injection via SSO URL authentication
- CVE-2023-30534 Insecure Deserialization in Cacti
- CVE-2023-30533 Prototype Pollution in sheetJS
- CVE-2023-30532 Lack of authentication mechanism in Jenkins TurboScript Plugin webhook
- CVE-2023-30531 Jenkins Consul KV Builder Plugin stores HashiCorp Consul ACL Token unencrypted
- CVE-2023-30530 Jenkins Consul KV Builder Plugin stores HashiCorp Consul ACL Token unencrypted