Vulnerabilities published in 2023
42,916 vulnerabilities were published in 2023: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 349 of 430.
- CVE-2023-27522 Apache HTTP Server: mod_proxy_uwsgi HTTP response splitting
- CVE-2023-27521 Command injection in SolarView Compact
- CVE-2023-27520 Cross-site request forgery in SEIKO EPSON printers/network interface Web Config
- CVE-2023-2752 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
- CVE-2023-27519 Other in Intel(R) Optane(TM) SSD products
- CVE-2023-27518 Memory corruption in SolarView Compact
- CVE-2023-27517 Privilege escalation in Intel(R) Optane(TM) PMem software
- CVE-2023-27516 Auth bypass in SoftEther VPN
- CVE-2023-27515 Cross-site scripting in Intel(R) DSA software
- CVE-2023-27514 Command injection in SolarView Compact
- CVE-2023-27513 Privilege escalation in Intel(R) Server Information Retrieval Utility software
- CVE-2023-27512 Hardcoded credentials in SolarView Compact
- CVE-2023-27510 Information disclosure in JB Inquiry form
- CVE-2023-2751 Upload Resume <= 1.2.0 - Captcha Bypass
- CVE-2023-27509 Privilege escalation in Intel(R) ISPC software installers
- CVE-2023-27507 Path traversal in MicroEngine Mailform
- CVE-2023-27506 Authenticated Local Privilege Escalation vulnerability in Intel Optimization for Tensorflow
- CVE-2023-27505 Misconfiguration in Intel(R) Advanced Link Analyzer Standard Edition software installers
- CVE-2023-27504 Privilege escalation in Intel(R) BIOS Guard firmware
- CVE-2023-27502 Information disclosure in Intel(R) Local Manageability Service software
- CVE-2023-27501 Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform
- CVE-2023-27500 Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform
- CVE-2023-2750 SQLi in Cityboss Software's E-municipality
- CVE-2023-27499 Cross-Site Scripting (XSS) vulnerability in SAP GUI for HTML
- CVE-2023-27498 Memory Corruption vulnerability in SAP Host Agent (SAPOSCOL)
- CVE-2023-27497 Multiple vulnerabilities in SAP Diagnostics Agent (EventLogServiceCollector)
- CVE-2023-27496 Envoy may crash when a redirect url without a state param is received in the oauth filter
- CVE-2023-27495 Bypass of CSRF protection in the presence of predictable userInfo in @fastify/csrf-protection
- CVE-2023-27494 Streamlit Cross-site Scripting vulnerability
- CVE-2023-27493 Envoy doesn't escape HTTP header values
- CVE-2023-27492 Envoy may crash when a large request body is processed in Lua filter
- CVE-2023-27491 Envoy forwards invalid Http2/Http3 downstream headers
- CVE-2023-27490 Missing proper state, nonce and PKCE checks for OAuth authentication in next-auth
- CVE-2023-2749 A Gain Information vulnerability was found on Download Center.
- CVE-2023-27489 Stored cross site scripting via SVG file upload in Kiwi TCMS
- CVE-2023-27488 Envoy gRPC client produces invalid protobuf when an HTTP header with non-UTF8 value is received.
- CVE-2023-27487 Envoy client may fake the header `x-envoy-original-path`
- CVE-2023-27486 Insufficient authorization validation between zones when xCAT zones are enabled
- CVE-2023-27485 Insufficient verification of authorisation when accessing subresults in thmmniii/fbs-core
- CVE-2023-27484 Unchecked fieldpath index in Composition's patches can lead to arbitrary memory allocation in crossplane
- CVE-2023-27483 fieldpath's Paved.SetValue allows growing arrays up to arbitrary sizes in crossplane-runtime
- CVE-2023-27482 Auth bypass in core
- CVE-2023-27481 Extract password hashes through export querying in directus
- CVE-2023-27480 Data leak through a XAR import XXE attack in xwiki-platform-xar-model
- CVE-2023-27479 Improper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-panels-ui
- CVE-2023-27478 Disclosure of unrelated data in libmemcached-awesome
- CVE-2023-27477 wasmtime vulnerable to miscompilation of `i8x16.select` with the same inputs on x86_64
- CVE-2023-27476 XML External Entity (XXE) Injection in OWSLib
- CVE-2023-27475 Goutil vulnerable to path traversal when unzipping files
- CVE-2023-27474 HTML Injection in Password Reset email to custom Reset URL in directus
- CVE-2023-27472 HTML tags in entity names in the tree view are not sanitised in quickentity-editor-next
- CVE-2023-27471 Other in insyde:insydeh2o
- CVE-2023-27470 Race condition in n-able:take control
- CVE-2023-2747 Uninitialized IV in Silicon Labs SE FW v2.0.0 through v 2.2.1 for internally stored data
- CVE-2023-27469 Path traversal in malwarebytes:anti-exploit
- CVE-2023-27465 Information disclosure in SIMOTION C240
- CVE-2023-27464 Information disclosure in Mendix Forgot Password (Mendix 7 compatible)
- CVE-2023-27463 SQL injection in RUGGEDCOM CROSSBOW
- CVE-2023-27462 Missing authorization in RUGGEDCOM CROSSBOW
- CVE-2023-27461 WordPress When Last Login Plugin <= 1.2.1 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-27460 Missing authorization in CP Contact Form with Paypal
- CVE-2023-2746 Rockwell Automation Enhanced HIM Vulnerable to Cross-Site Request Forgery Attack
- CVE-2023-27459 WordPress User Registration plugin <= 2.3.2.1 - Authenticated PHP Object Injection vulnerability
- CVE-2023-27458 Cross-site request forgery in WpStream
- CVE-2023-27457 WordPress Add Expires Headers & Optimized Minify Plugin <= 2.7 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-27456 WordPress Total theme <= 2.1.19 - Authenticated Arbitrary Plugin Activation
- CVE-2023-27455 WordPress Update Image Tag Alt Attribute Plugin <= 2.4.5 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-27454 WordPress Rife Elementor Extensions & Templates plugin <= 1.1.10 - Broken Access Control vulnerability
- CVE-2023-27453 WordPress LWS Tools Plugin <= 2.3.1 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-27452 WordPress Button Generator – easily Button Builder Plugin <= 2.3.3 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-27451 WordPress Instant Images Plugin <= 5.1.0.2 is vulnerable to Server Side Request Forgery (SSRF)
- CVE-2023-27450 WordPress Leyka Plugin <= 3.29.2 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-2745 WordPress Core < 6.2.1 - Directory Traversal
- CVE-2023-27449 WordPress Total Poll Lite plugin <= 4.8.6 - Broken Access Control vulnerability
- CVE-2023-27448 WordPress MakeStories (for Google Web Stories) Plugin <= 2.8.0 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-27447 WordPress WP SMS Plugin <= 6.0.4 is vulnerable to Sensitive Data Exposure
- CVE-2023-27446 WordPress DeepL Pro API translation Plugin <= 2.1.4 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-27445 WordPress Blog Floating Button Plugin <= 1.4.12 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-27444 WordPress DecaLog Plugin <= 3.7.0 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-27443 WordPress Simple Vimeo Shortcode Plugin <= 2.9.1 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-27442 WordPress Leyka Plugin <= 3.29.2 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-27441 WordPress New Adman Plugin <= 1.6.8 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-27440 WordPress Toolset Types plugin <= 3.4.17 - Authenticated Arbitrary File Upload Vulnerability
- CVE-2023-2744 WP ERP < 1.12.4 - Admin+ SQL Injection
- CVE-2023-27439 WordPress New Adman Plugin <= 1.6.8 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-27438 WordPress WP Translitera Plugin <= p1.2.5 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-27437 WordPress Event Espresso 4 Decaf plugin <= 4.10.44.decaf - Bypass vulnerability
- CVE-2023-27436 WordPress Elegant Custom Fonts Plugin <= 1.0 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-27435 WordPress HTTP Auth Plugin <= 0.3.2 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-27434 WordPress Classic Editor and Classic Widgets Plugin <= 1.2.5 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-27433 WordPress Make Paths Relative Plugin <= 1.3.0 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-27432 WordPress Manage Upload Limit Plugin <= 1.0.4 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-27431 WordPress Big Store Theme <= 1.9.3 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-27430 WordPress Mass Delete Unused Tags Plugin <= 2.0.0 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-2743 WP ERP < 1.12.4 - Reflected Cross-Site Scripting
- CVE-2023-27429 WordPress Jetpack CRM Plugin <= 5.4.4 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-27428 WordPress WP users media plugin <= 4.2.3 - Broken Access Control vulnerability
- CVE-2023-27427 WordPress CRM Memberships Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-27426 WordPress NotifyVisitors Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-27425 WordPress Electric Studio Client Login Plugin <= 0.8.1 is vulnerable to Cross Site Scripting (XSS)