Vulnerabilities published in 2023
42,916 vulnerabilities were published in 2023: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 360 of 430.
- CVE-2023-26056 XWiki Platform allows macro execution as any user without programming rights through the context macro
- CVE-2023-26055 XWiki Commons may allow privilege escalation to programming rights via user's first name
- CVE-2023-26054 Credentials inlined to Git URLs could end up in provenance attestation in BuildKit
- CVE-2023-26053 Gradle usage of long IDs for PGP keys opens potential for collision attacks
- CVE-2023-26052 Saleor is vulnerable to unauthenticated information disclosure via Python exceptions
- CVE-2023-26051 Saleor is vulnerable to staff-authenticated error message information disclosure vulnerability via Python exceptions
- CVE-2023-2605 WP Brutal AI < 2.0.1 - Admin+ Reflected XSS
- CVE-2023-26049 Cookie parsing of quoted values can exfiltrate values from other cookies in Eclipse Jetty
- CVE-2023-26048 OutOfMemoryError for large multipart without filename in Eclipse Jetty
- CVE-2023-26047 teler-waf contains detection rule bypass via entities payload
- CVE-2023-26046 teler-waf subject to bypass of common web attack threat rule with HTML entities payload
- CVE-2023-26045 NodeBB vulnerable to path traversal and code execution via prototype vulnerability
- CVE-2023-26044 ReactPHP's HTTP server continues parsing unused multipart parts after reaching limits
- CVE-2023-26043 XML External Entity (XXE) injection in GeoServer style upload functionality
- CVE-2023-26042 HTML/XSS injection possibilities in Part-DB
- CVE-2023-26041 Nextcloud Talk messages can still be seen on conversation after expiring when cron is misconfigured
- CVE-2023-26040 Discourse chat messages susceptible to Cross-site Scripting through chat excerpts
- CVE-2023-2604 Team Circle Image Slider With Lightbox <= 1.0.17 - Reflected Cross-Site Scripting
- CVE-2023-26039 ZoneMinder vulnerable to OS Command injection in daemonControl() API
- CVE-2023-26038 ZoneMinder contains Local File Inclusion vulnerability via `web/ajax/modal.php`
- CVE-2023-26037 ZoneMinder contains SQL Injection via report_event_audit
- CVE-2023-26036 ZoneMinder contains Local File Inclusion vulnerability
- CVE-2023-26035 ZoneMinder vulnerable to Missing Authorization
- CVE-2023-26034 ZoneMinder SQL Injection
- CVE-2023-26033 Gentoo soko contains DoS attack based on SQL Injection
- CVE-2023-26032 ZoneMinder contains SQL injection via malicious Jason Web Token
- CVE-2023-26031 Privilege escalation in Apache Hadoop Yarn container-executor binary on Linux systems
- CVE-2023-2603 Integer overflow in libcap
- CVE-2023-26026 IBM Planning Analytics Cartridge for Cloud Pak for Data information disclosure
- CVE-2023-26024 IBM Planning Analytics on Cloud Pak for Data information disclosure
- CVE-2023-26023 IBM Planning Analytics Cartridge for Cloud Pak for Data information disclosure
- CVE-2023-26022 IBM Db2 denial of service
- CVE-2023-26021 IBM Db2 denial of service
- CVE-2023-26020 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Crafter Studio
- CVE-2023-2602 Denial of service in libcap
- CVE-2023-26017 WordPress Jobs for WordPress Plugin <= 2.5.10.2 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-26016 WordPress Simple Portfolio Gallery Plugin <= 0.1 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-26015 WordPress MapPress Maps for WordPress Plugin <= 2.85.4 is vulnerable to SQL Injection
- CVE-2023-26014 WordPress Minify HTML Plugin <= 2.1.7 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-26013 WordPress Strong Testimonials Plugin <= 3.0.2 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-26012 WordPress Custom Login Page Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-26011 WordPress Read More Excerpt Link Plugin <= 1.6 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-26010 WordPress WPMobile.App Plugin <= 11.18 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-2601 WP Brutal AI < 2.0.0 - SQL Injection via CSRF
- CVE-2023-26009 WordPress Houzez Login Register plugin <= 2.6.3 - Privilege Escalation
- CVE-2023-26008 WordPress Top 10 Plugin <= 3.2.4 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-26005 WordPress Fitrush <= 1.3.4 - Local File Inclusion Vulnerability
- CVE-2023-26003 WordPress WP Post Corrector <= 1.0.2 - SQL Injection Vulnerability
- CVE-2023-26002 WordPress 6Storage Rentals <= 2.19.5 - Broken Access Control Vulnerability
- CVE-2023-26001 WordPress Next Event Calendar <= 1.2 - Cross Site Scripting (XSS) Vulnerability
- CVE-2023-26000 WordPress Bang tinh vay <= 1.0.1 - Cross Site Scripting (XSS) Vulnerability
- CVE-2023-2600 Custom Base Terms < 1.0.3 - Admin+ Stored XSS
- CVE-2023-25999 WordPress BodyCenter - Gym, Fitness WooCommerce WordPress Theme <= 2.4 - Local File Inclusion Vulnerability
- CVE-2023-25998 WordPress Samex - Clean, Minimal Shop WooCommerce WordPress Theme <= 2.6 - Local File Inclusion Vulnerability
- CVE-2023-25997 WordPress Sola Support Ticket <= 3.17 - Arbitrary Content Deletion Vulnerability
- CVE-2023-25996 Information disclosure in Booster Elite for WooCommerce
- CVE-2023-25995 WordPress AI Mortgage Calculator <= 1.0.1 - Local File Inclusion Vulnerability
- CVE-2023-25994 WordPress Publish to Schedule Plugin <= 4.4.2 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-25993 WordPress Top 10 – Popular posts plugin for WordPress plugin <= 3.2.3 - Broken Access Control vulnerability
- CVE-2023-25992 WordPress CM Answers Plugin <= 3.1.9 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-25991 WordPress RegistrationMagic Plugin <= 5.1.9.2 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-25990 WordPress Tutor LMS Plugin <= 2.1.10 is vulnerable to SQL Injection
- CVE-2023-2599 Active Directory Integration / LDAP Integration <= 4.1.4 - Cross-Site Request Forgery to SQL Injection
- CVE-2023-25989 Cross-Site Request Forgery (CSRF) vulnerability in multiple WordPress plugins by Meks
- CVE-2023-25988 WordPress Video Gallery – YouTube Gallery plugin <= 1.7.6 - Broken Access Control vulnerability
- CVE-2023-25987 WordPress YouTube Channel Plugin <= 3.23.3 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-25986 WordPress PayGreen Plugin <= 4.10.2 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-25985 WordPress WordPress Tooltips Plugin <= 8.2.5 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-25984 WordPress Dovetail Plugin <= 1.2.13 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-25983 WordPress KB Support Plugin <= 1.5.84 is vulnerable to CSV Injection
- CVE-2023-25982 WordPress Simple YouTube Responsive Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-25981 WordPress BuddyForms Plugin <= 2.8.1 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-25980 WordPress Optimize Database after Deleting Revisions Plugin <= 5.1 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-2598 Memory corruption in Kernel
- CVE-2023-25979 WordPress Video Gallery – YouTube Gallery Plugin <= 1.7.6 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-25978 WordPress Protected Posts Logout Button Plugin <= 1.4.5 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-25977 WordPress CPT – Speakers Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-25976 Cross-site request forgery in Integration for Contact Form 7 and Zoho CRM, Bigin
- CVE-2023-25975 WordPress Etsy Shop Plugin <= 3.0.3 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-25974 WordPress wp2syslog Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-25973 WordPress Auto Affiliate Links Plugin <= 6.3.0.2 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-25972 WordPress Старт Plugin <= 3.7 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-25971 Cross-site request forgery in Educare
- CVE-2023-25970 WordPress Zendrop – Global Dropshipping Plugin <= 1.0.0 is vulnerable to Arbitrary File Upload
- CVE-2023-2597 Memory corruption in Eclipse OpenJ9
- CVE-2023-25969 WordPress Contact Form & Lead Form Elementor Builder plugin <= 1.8.4 - Broken Access Control vulnerability
- CVE-2023-25968 Cross-site request forgery in Client Portal – Private user pages and login
- CVE-2023-25967 WordPress Community by PeepSo Plugin <= 6.0.2.0 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-25966 WordPress FileBird plugin <= 5.1.4 - Broken Access Control vulnerability
- CVE-2023-25965 WordPress Upload Resume plugin <= 1.2.0 - Sensitive Data Exposure vulnerability
- CVE-2023-25964 WordPress We’re Open! Plugin <= 1.46 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-25963 WordPress JS Job Manager Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-25962 WordPress Accordions Plugin <= 2.3.0 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-25961 WordPress Darcie Theme <= 1.1.5 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-25960 WordPress Zendrop – Global Dropshipping Plugin <= 1.0.0 is vulnerable to SQL Injection
- CVE-2023-2596 SourceCodester Online Reviewer System GET Parameter user-update.php sql injection
- CVE-2023-25959 WordPress Apollo13 Framework Extensions plugin <= 1.8.10 - Broken Access Control
- CVE-2023-25958 WordPress Simple Tooltips Plugin <= 2.1.4 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-25957 Auth bypass in Mendix SAML (Mendix 7 compatible)
- CVE-2023-25956 Apache Airflow AWS Provider: Arbitrary file read via AWS provider