Vulnerabilities published in 2023
42,916 vulnerabilities were published in 2023: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 335 of 430.
- CVE-2023-29051 Missing authorization in OX App Suite
- CVE-2023-29050 Other in OX App Suite
- CVE-2023-2905 Cesanta Mongoose MQTT Message Parsing Heap Overflow
- CVE-2023-29049 Cross-site scripting in OX App Suite
- CVE-2023-29048 Command injection in OX App Suite
- CVE-2023-29047 SQL injection in OX App Suite
- CVE-2023-29046 Denial of service in OX App Suite
- CVE-2023-29045 Cross-site scripting in OX App Suite
- CVE-2023-29044 Cross-site scripting in OX App Suite
- CVE-2023-29043 Cross-site scripting in OX App Suite
- CVE-2023-2904 CVE-2023-2904
- CVE-2023-29032 Apache OpenMeetings: allows bypass authentication
- CVE-2023-29031 Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting Attack
- CVE-2023-29030 Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting Attack
- CVE-2023-2903 NFine Rapid Development Platform access control
- CVE-2023-29029 Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting Attack
- CVE-2023-29028 Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting Attack
- CVE-2023-29027 Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting Attack
- CVE-2023-29026 Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting Attack
- CVE-2023-29025 Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting Attack
- CVE-2023-29024 Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting Attack
- CVE-2023-29023 Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting Attack
- CVE-2023-29022 Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting Attack
- CVE-2023-29020 Cross site request forgery token fixation in fastify-passport
- CVE-2023-2902 NFine Rapid Development Platform access control
- CVE-2023-29019 Session fixation in fastify-passport
- CVE-2023-29018 OpenFeature Operator vulnerable to Cluster-level Privilege Escalation
- CVE-2023-29017 vm2 Sandbox Escape vulnerability
- CVE-2023-29016 Goobi viewer Core has Cross-Site Scripting Vulnerability in User Nicknames
- CVE-2023-29015 Goobi viewer Core has Cross-Site Scripting Vulnerability in User Comments
- CVE-2023-29014 Goobi viewer Core Reflected Cross-Site Scripting Vulnerability Using LOGID Parameter
- CVE-2023-29013 HTTP header parsing could cause a deny of service
- CVE-2023-29012 Git CMD erroneously executes `doskey.exe` in the current directory, if it exists
- CVE-2023-29011 Git for Windows's config file of `connect.exe` is susceptible to malicious placing
- CVE-2023-29010 BudiBase Server-Side Request Forgery vulnerability
- CVE-2023-2901 NFine Rapid Development Platform access control
- CVE-2023-29009 basercms XSS Vulnerability via Favorites Feature
- CVE-2023-29008 SvelteKit framework has Insufficient CSRF protection for CORS requests
- CVE-2023-29007 Arbitrary configuration injection via `git submodule deinit`
- CVE-2023-29006 Order GLPI plugin vulnerable to remote code execution from authenticated user
- CVE-2023-29005 No Rate Limiting on Login AUTH DB
- CVE-2023-29004 Path Traversal Vulnerability in hap-wi/roxy-wi
- CVE-2023-29003 SvelteKit has Insufficient Cross-Site Request Forgery Protection
- CVE-2023-29002 Debug mode leaks confidential data in Cilium
- CVE-2023-29001 Uncontrolled recursion due to insufficient validation of the IPv6 source routing header in Contiki-NG
- CVE-2023-29000 Nextcloud Desktop client does not verify received singed certificate in end-to-end encryption
- CVE-2023-2900 NFine Rapid Development Platform CheckLogin weak hash
- CVE-2023-28999 Nextcloud: Lack of authenticity of metadata keys allows a malicious server to gain access to E2EE folders
- CVE-2023-28998 Nextcloud Desktop client misbehaves with E2EE when the server returns empty list of metadata keys
- CVE-2023-28997 Nextcloud Desktop: Initialization vector reuse in E2EE allows malicious server admin to break, manipulate, access files
- CVE-2023-28995 WordPress Configurable Tag Cloud Plugin <= 5.2 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-28994 WordPress Flatsome Theme <= 3.16.8 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-28993 WordPress Albo Pretorio Online Plugin <= 4.6.1 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-28992 WordPress Coupon Affiliates Plugin <= 5.4.3 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-28991 WordPress Order date time for WooCommerce Plugin <= 3.0.19 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-28990 WordPress Viral Mag theme <= 1.0.9 - Authenticated Arbitrary Plugin Activation Vulnerability
- CVE-2023-2899 Google Map Shortcode <= 3.1.2 - Contributor+ Stored XSS
- CVE-2023-28989 WordPress Happy Addons for Elementor Plugin <= 3.8.2 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-28988 Cross-site scripting in Direct checkout, Add to cart redirect, Quick purchase button, Buy now button, Quick View button for WooCommerce
- CVE-2023-28987 WordPress Wp Ultimate Review Plugin <= 2.0.3 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-28986 WordPress Affiliates Manager Plugin <= 2.9.20 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-28985 Denial of service in Junos OS
- CVE-2023-28984 Junos OS: QFX Series: The PFE may crash when a lot of MAC addresses are being learned and aged
- CVE-2023-28983 Junos OS Evolved: Shell Injection vulnerability in the gNOI server
- CVE-2023-28982 Denial of service in Junos OS
- CVE-2023-28981 Memory corruption in Junos OS
- CVE-2023-28980 Use after free in Junos OS
- CVE-2023-2898 Null dereference in Kernel
- CVE-2023-28979 Junos OS: In a 6PE scenario upon receipt of a specific IPv6 packet an integrity check fails
- CVE-2023-28978 Junos OS Evolved: Read access to some confidential user information is possible
- CVE-2023-28976 Junos OS: MX Series: If a specific traffic rate goes above the DDoS threshold it will lead to an FPC crash
- CVE-2023-28975 Junos OS: The kernel will crash when certain USB devices are inserted
- CVE-2023-28974 Denial of service in Junos OS
- CVE-2023-28973 Junos OS Evolved: The 'sysmanctl' shell command allows a local user to gain access to some administrative actions
- CVE-2023-28972 Junos OS: NFX Series: 'set system ports console insecure' allows root password recovery
- CVE-2023-28971 Paragon Active Assurance: Enabling the timescaledb enables IP forwarding
- CVE-2023-28970 Junos OS: JRR200: Kernel crash upon receipt of a specific packet
- CVE-2023-2897 Brizy Page Builder <= 2.4.18 - IP Address Spoofing to Protection Mechanism Bypass
- CVE-2023-28968 Junos OS: SRX Series: Policies that rely on JDPI-Decoder actions may fail open
- CVE-2023-28967 Junos OS and Junos OS Evolved: An attacker sending genuine BGP packets causes an RPD crash
- CVE-2023-28966 Junos OS Evolved: Local low-privileged user with shell access can execute CLI commands as root
- CVE-2023-28965 Junos OS: QFX10002: Failure of storm control feature may lead to Denial of Service
- CVE-2023-28964 Junos OS and Junos OS Evolved: Malformed BGP flowspec update causes RPD crash
- CVE-2023-28963 Junos OS: User-controlled input vulnerability in J-Web
- CVE-2023-28962 Junos OS: Unauthenticated access vulnerability in J-Web
- CVE-2023-28961 Junos OS: ACX Series: IPv6 firewall filter is not installed in PFE when "from next-header ah" is used
- CVE-2023-28960 Misconfiguration in Junos OS Evolved
- CVE-2023-2896 WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_duplicate_product
- CVE-2023-28959 Junos OS: QFX10002: PFE wedges and restarts upon receipt of specific malformed packets
- CVE-2023-28958 IBM Watson Knowledge Catalog CSV injection
- CVE-2023-28956 IBM Spectrum Protect Backup-Archive Client privilege escalation
- CVE-2023-28955 IBM Watson Knowledge Catalog denial of service
- CVE-2023-28953 IBM Cognos Analytics on Cloud Pak for Data improper access control
- CVE-2023-28952 IBM Cognos Controller log injection
- CVE-2023-28950 IBM MQ information disclosure
- CVE-2023-2895 WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_bulk_activate_product
- CVE-2023-28949 IBM Engineering Requirements Management cross-site request forgery
- CVE-2023-2894 WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_bulk_deactivate_product
- CVE-2023-28938 Denial of service in Intel(R) SSD Tools software
- CVE-2023-28937 Hardcoded credentials in DataSpider Servista