Vulnerabilities published in 2023
42,916 vulnerabilities were published in 2023: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 338 of 430.
- CVE-2023-28718 CVE-2023-28718
- CVE-2023-28716 CVE-2023-28716
- CVE-2023-28715 Missing authorization in Intel(R) oneAPI Toolkit and component software installers
- CVE-2023-28714 Privilege escalation in Intel(R) PROSet/Wireless WiFi software for Windows
- CVE-2023-28713 Information disclosure in CONPROSYS HMI System (CHS)
- CVE-2023-28712 CVE-2023-28712
- CVE-2023-28711 Denial of service in Hyperscan Library maintained by Intel(R)
- CVE-2023-28710 Apache Airflow Spark Provider Arbitrary File Read via JDBC
- CVE-2023-2871 FabulaTech USB for Remote Desktop IoControlCode 0x220408 null pointer dereference
- CVE-2023-28709 Apache Tomcat: Fix for CVE-2023-24998 is incomplete
- CVE-2023-28708 Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations
- CVE-2023-28707 Airflow Apache Drill Provider Arbitrary File Read Vulnerability
- CVE-2023-28706 Apache Airflow Hive Provider Beeline Remote Command Execution
- CVE-2023-28705 Openfind Mail2000 - XSS (Reflected Cross-site scripting)
- CVE-2023-28704 Furbo dog camera - Command Injection
- CVE-2023-28703 ASUS RT-AC86U - Buffer Overflow
- CVE-2023-28702 ASUS RT-AC86U - Command Injection
- CVE-2023-28701 ELITE Web Fax - SQL Injection
- CVE-2023-28700 ITPison OMICARD EDM - Arbitrary File Upload
- CVE-2023-2870 EnTech Monitor Asset Manager IoControlCode 0x80002014 denial of service
- CVE-2023-28699 WADE DIGITAL DESIGN CO, LTD. FANTSY - Arbitrary File Upload
- CVE-2023-28698 WADE DIGITAL DESIGN CO, LTD. FANTSY - Broken Acesss Control
- CVE-2023-28697 Moxa MiiNePort E1 - Broken Access Control
- CVE-2023-28696 WordPress I Recommend This Plugin <= 3.9.0 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-28695 WordPress VigilanTor Plugin <= 1.3.10 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-28694 Cross-site request forgery in Wbcom Designs – BuddyPress Activity Social Share
- CVE-2023-28693 WordPress Advanced Youtube Channel Pagination Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-28692 WordPress WP Abstracts Plugin <= 2.6.3 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-28690 WordPress WP BrowserUpdate Plugin <= 4.5 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-2869 WP-Members Membership <= 3.4.7.3 - Missing Authorization to Settings Update
- CVE-2023-28689 WordPress JS Job Manager plugin <= 2.0.0 - Broken Access Control vulnerability
- CVE-2023-28688 WordPress TH Variation Swatches plugin <= 1.2.7 - Cross-Site Request Forgery (CSRF) vulnerability
- CVE-2023-28687 Reflected Cross-Site Scripting (XSS) vulnerability in multiple WordPress themes
- CVE-2023-28686 Missing authorization in debian:debian linux
- CVE-2023-28685 Jenkins AbsInt a³ Plugin XML External Entity Reference vulnerability
- CVE-2023-28684 Jenkins remote-jobs-view-plugin vulnerable to XML external entity attacks
- CVE-2023-28683 Jenkins Phabricator Differential Plugin vulnerable to XML external entity (XXE) attacks
- CVE-2023-28682 Jenkins Performance Publisher Plugin vulnerable to XML external entity (XXE) attacks
- CVE-2023-28681 Jenkins Visual Studio Code Metrics Plugin vulnerable to XML external entity (XXE) attacks
- CVE-2023-28680 Jenkins Crap4J Plugin vulnerable to XML external entity (XXE) attacks
- CVE-2023-2868 Barracuda Networks ESG Appliance Improper Input Validation
- CVE-2023-28679 Jenkins Mashup Portlets Plugin vulnerable to stored cross-site scripting
- CVE-2023-28678 Jenkins Cppcheck Plugin vulnerable to stored cross-site scripting (XSS)
- CVE-2023-28677 Jenkins Convert To Pipeline Plugin vulnerable to command injection
- CVE-2023-28676 Jenkins Convert To Pipeline Plugin vulnerable to cross-site request forgery
- CVE-2023-28675 Jenkins OctoPerf Load Testing Plugin missing permission check allows for unauthorized server connections
- CVE-2023-28674 Jenkins OctoPerf Load Testing Plugin vulnerable to Cross-site Request Forgery
- CVE-2023-28673 Jenkins OctoPerf Load Testing Plugin missing permission check allows for ID enumeration
- CVE-2023-28672 Jenkins OctoPerf Load Testing Plugin vulnerable to credential capture
- CVE-2023-28671 Jenkins OctoPerf Load Testing Plugin vulnerable to Cross-site Request Forgery
- CVE-2023-28670 Jenkins Pipeline Aggregator View Plugin vulnerable to Cross-site Scripting
- CVE-2023-28669 Jenkins JaCoCo Plugin vulnerable to Stored Cross-site Scripting
- CVE-2023-28668 Jenkins Role-based Authorization Strategy Plugin grants permissions even after they’ve been disabled
- CVE-2023-28667 Deserialization in Lead Generated WordPress Plugin
- CVE-2023-28666 Cross-site scripting in InPost Gallery WordPress Plugin
- CVE-2023-28665 Cross-site scripting in Woo Bulk Price Update WordPress Plugin
- CVE-2023-28664 Cross-site scripting in Meta Data and Taxonomies Filter WordPress Plugin
- CVE-2023-28663 SQL injection in Formidable PRO2PDF WordPress Plugin
- CVE-2023-28662 SQL injection in Gift Cards (Gift Vouchers and Packages) WordPress Plugin
- CVE-2023-28661 SQL injection in WP Popup Banners WordPress Plugin
- CVE-2023-28660 SQL injection in Events Made Easy WordPress Plugin
- CVE-2023-2866 Advantech WebAccess Insufficient Type Distinction
- CVE-2023-28659 SQL injection in Waiting: One-click Countdowns WordPress Plugin
- CVE-2023-28658 Privilege escalation in Intel(R) oneMKL software
- CVE-2023-28657 Missing authorization in CONPROSYS HMI System (CHS)
- CVE-2023-28656 NGINX Management Suite vulnerability
- CVE-2023-28655 CVE-2023-28655
- CVE-2023-28654 CVE-2023-28654
- CVE-2023-28653 Use after free in Cscape
- CVE-2023-28652 CVE-2023-28652
- CVE-2023-28651 Cross-site scripting in CONPROSYS HMI System (CHS)
- CVE-2023-28650 CVE-2023-28650
- CVE-2023-2865 SourceCodester Theme Park Ticketing System GET Parameter print_ticket.php sql injection
- CVE-2023-28649 Business logic in OvrC Cloud
- CVE-2023-28648 CVE-2023-28648
- CVE-2023-28647 App pin of the iOS app can be bypassed in Nextcloud iOS
- CVE-2023-28646 App lockout in nextcloud Android app can be bypassed via thirdparty apps
- CVE-2023-28645 Secure view can be bypassed by using internal API endpoint in Nextcloud richdocuments
- CVE-2023-28644 Reference fetch can saturate the server bandwidth for 10 seconds in nextcloud server
- CVE-2023-28643 Potential share collision for recipients when caching is enabled in nextcloud server
- CVE-2023-28642 AppArmor bypass with symlinked /proc in runc
- CVE-2023-28640 Permissions bypass in Apiman could enable authenticated attacker to unpermitted API Key
- CVE-2023-2864 SourceCodester Online Jewelry Store POST Parameter customer.php cross site scripting
- CVE-2023-28639 GLPI vulnerable to reflected Cross-site Scripting in search pages
- CVE-2023-28638 Stack references to locations outside buffers may become invalid if they exist during a GC compaction in Snappier
- CVE-2023-28637 DataEase AWS redshift data source exists for remote code execution vulnerability
- CVE-2023-28636 GLPI vulnerable to stored Cross-site Scripting in external links
- CVE-2023-28635 Defining resource name as integer in vantage6 may give unintended access
- CVE-2023-28634 GLPI vulnerable to Privilege Escalation from Technician to Super-Admin
- CVE-2023-28633 GLPI vulnerable to Blind Server-Side Request Forgery (SSRF) in RSS feeds
- CVE-2023-28632 GLPI vulnerable to account takeover by authenticated user
- CVE-2023-28631 Attacker controlled data in AST nodes is not validated in comrak
- CVE-2023-28630 Sensitive information disclosure possible on misconfigured failed backups of non-H2 databases in gocd
- CVE-2023-2863 Simple Design Daily Journal SQLite Database cleartext storage in a file or on disk
- CVE-2023-28629 Stored XSS possible on VSM and Job Details pages via malicious pipeline label configuration in gocd
- CVE-2023-28628 `authority-regex` returns the wrong authority in lambdaisland/uri
- CVE-2023-28627 OS Command Injection via GIT_PATH in pymedusa
- CVE-2023-28626 Quadratic runtime when parsing Markdown in comrak
- CVE-2023-28625 mod_auth_openidc core dump when OIDCStripCookies is set and an empty Cookie header is supplied
- CVE-2023-28623 Unauthorized user can register an account in specific configurations in Zulip