Vulnerabilities published in 2023
42,916 vulnerabilities were published in 2023: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 336 of 430.
- CVE-2023-28936 Apache OpenMeetings: insufficient check of invitation hash
- CVE-2023-28935 Apache UIMA DUCC: DUCC (EOL) allows RCE
- CVE-2023-28934 WordPress WP Full Stripe Free Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-28933 WordPress Call Now Accessibility Button Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-28932 WordPress WPMobile.App Plugin <= 11.20 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-28931 WordPress Post Connector Plugin <= 1.0.9 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-28930 WordPress Mobile Banner Plugin <= 1.5 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-2893 WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_deactivate_product
- CVE-2023-28929 Other in Trend Micro Security (Consumer)
- CVE-2023-2892 WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_bulk_delete_product
- CVE-2023-28912 Cleartext Phonebook Information
- CVE-2023-28911 Arbitrary Channel Disconnection Resulting in Denial of Service
- CVE-2023-28910 Disabled Abortion Flag
- CVE-2023-2891 WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_delete_product
- CVE-2023-28909 Integer Overflow Leading to MTU Bypass
- CVE-2023-28908 Integer Overflow in Non-Fragmented Data Reception
- CVE-2023-28907 A lack of access restrictions on internal memory regions
- CVE-2023-28906 Command injection in networking service
- CVE-2023-28905 Heap buffer overflow in picserver
- CVE-2023-28904 Bypass of secure boot process
- CVE-2023-28903 Integer overflow in Volkswagen MIB3 infotainment system MIB3 OI MQB
- CVE-2023-28902 Denial of Service via integer underflow in picserver
- CVE-2023-28901 Trip Data Disclosure from Backend
- CVE-2023-28900 Nickname Disclosure on the Backend Automotive Server
- CVE-2023-28899 Denial of Service via ECU reset service
- CVE-2023-28898 Head Unit Denial-of-Service via Apple CarPlay service
- CVE-2023-28897 Hard-coded password for UDS services
- CVE-2023-28896 Weak encoding for password in UDS services
- CVE-2023-28895 Hard-coded password for access to power controller chip memory
- CVE-2023-28892 Privilege escalation in malwarebytes:adwcleaner
- CVE-2023-2889 SQLi in Veon Computer's Service Tracking Software
- CVE-2023-28885 Memory corruption in gm:mylink infotainment system
- CVE-2023-28884 Cross-site scripting in misp-project:misp
- CVE-2023-28883 SQL injection in cerebrate-project:cerebrate
- CVE-2023-28882 Denial of service in owasp:modsecurity
- CVE-2023-2888 PHPOK unrestricted upload
- CVE-2023-28879 Memory corruption in artifex:ghostscript
- CVE-2023-28877 Missing authorization in vtex:apps-graphql
- CVE-2023-28876 Missing authorization in afian:filerun
- CVE-2023-28875 Cross-site scripting in afian:filerun
- CVE-2023-28874 Open redirect in seafile:seafile
- CVE-2023-28873 Cross-site scripting in seafile:seafile
- CVE-2023-28872 Privilege escalation in ncp-e:secure enterprise client
- CVE-2023-28871 Path traversal in ncp-e:secure enterprise client
- CVE-2023-28870 Misconfiguration in ncp-e:secure enterprise client
- CVE-2023-2887 User Authentication Bypass in CBOT's Chatbot
- CVE-2023-28869 Path traversal in ncp-e:secure enterprise client
- CVE-2023-28868 Path traversal in ncp-e:secure enterprise client
- CVE-2023-28867 GraphQL Java vulnerable to stack consumption
- CVE-2023-28866 Memory corruption in linux:linux kernel
- CVE-2023-28865 Security feature bypass in dieboldnixdorf:vynamic security suite
- CVE-2023-28864 Information disclosure in progress:chef infra server
- CVE-2023-28863 Security feature bypass in ami:megarac sp-x
- CVE-2023-28862 Auth bypass in lemonldap-ng:lemonldap\
- CVE-2023-2886 Cross-Site WebSocket Hijacking in CBOT's Chatbot
- CVE-2023-28859 redis-py Race Condition due to incomplete fix
- CVE-2023-28858 redis-py Race Condition vulnerability
- CVE-2023-28857 LDAP password leak in Apereo CAS - GHSL-2023-009
- CVE-2023-28856 `HINCRBYFLOAT` can be used to crash a redis-server process
- CVE-2023-28855 Fields GLPI plugin vulnerable to unauthorized write access to additional fields
- CVE-2023-28854 nophp vulnerable to shell command injection on httpd user when sending a password-setting mail or mail-login mail
- CVE-2023-28853 Mastodon's blind LDAP injection in login allows the attacker to leak arbitrary attributes from LDAP database
- CVE-2023-28852 GLPI vulnerable to stored Cross-site Scripting through dashboard administration
- CVE-2023-28851 Silverstripe Form Capture vulnerable to Stored Cross-Site Scripting
- CVE-2023-28850 Pimcore Perspective Editor vulnerable to Cross-site Scripting in perspective name
- CVE-2023-2885 Channel Accessible by Non-Endpoint in CBOT's Chatbot
- CVE-2023-28849 GLPI vulnerable to SQL injection and Stored XSS via inventory agent request
- CVE-2023-28848 CSRF protection on user_oidc login returned the expected token in case of an error
- CVE-2023-28847 Nextcloud Server missing brute force protection for passwords of password protected share links
- CVE-2023-28846 Denial of Service in unpoly-rails
- CVE-2023-28845 Chat room membership disclosed via autocompletion in Nextcloud talk
- CVE-2023-28844 User without download rights can download older version of that file in nextcloud server
- CVE-2023-28843 Improper neutralization of SQL parameter in PayPal module for PrestaShop
- CVE-2023-28842 moby/moby's dockerd daemon encrypted overlay network with a single endpoint is unauthenticated
- CVE-2023-28841 moby/moby's dockerd daemon encrypted overlay network traffic may be unencrypted
- CVE-2023-28840 moby/moby's dockerd daemon encrypted overlay network may be unauthenticated
- CVE-2023-2884 Insecure Randomness in CBOT's Chatbot
- CVE-2023-28839 Improper neutralization in an SQL query in Shoppingfeed
- CVE-2023-28838 GLPI vulnerable to SQL injection through dynamic reports
- CVE-2023-28837 Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large files
- CVE-2023-28836 Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views
- CVE-2023-28835 Insecure randomness for default password in nextcloud
- CVE-2023-28834 Full path of data directory exposed to Nextcloud server users
- CVE-2023-28833 Unrestricted filenames for logo or favicon as admin in the theming settings in nextcloud server
- CVE-2023-28832 Command injection in SIMATIC Cloud Connect 7 CC712
- CVE-2023-28831 Integer overflow in SIMATIC BRAUMAT
- CVE-2023-28830 Use after free in JT2Go
- CVE-2023-2883 IDOR in CBOT's Chatbot
- CVE-2023-28829 Weak cryptography in SIMATIC NET PC Software V14
- CVE-2023-28828 XML external entity in Polarion ALM
- CVE-2023-28827 Null dereference in SIMATIC CP 1242-7 V2 (incl. SIPLUS variants)
- CVE-2023-28826 Information disclosure in iOS and iPadOS
- CVE-2023-28824 Server-side request forgery in CONPROSYS HMI System (CHS)
- CVE-2023-28823 Privilege escalation in Intel(R) oneAPI Toolkit and component software installers
- CVE-2023-28821 Missing rate limit for password resets
- CVE-2023-28820 Stored cross site scripting in RSS displayer
- CVE-2023-2882 Privilege Escalation in CBOT's Chatbot
- CVE-2023-28819 Concrete CMS (previously concrete5) is vulnerable to stored XSS in uploaded file and folder names
- CVE-2023-28818 Supply chain in veritas:aptare it analytics
- CVE-2023-28815 Command injection in iSecure Center