Vulnerabilities published in 2023
42,916 vulnerabilities were published in 2023: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 364 of 430.
- CVE-2023-25648 Weak Folder Permission Vulnerability in ZTE ZXCLOUD iRAI
- CVE-2023-25647 Permission and Access Control Vulnerability in Some ZTE Mobile Phones
- CVE-2023-25646 Permission and Access Control Vulnerability in ZTE H388X
- CVE-2023-25645 Missing authorization in UP T2 4K, ZXV10 B866V2-H, ZXV10 B866V2, ZXV10 B860H V5D0, ZXV10 B866V2F
- CVE-2023-25644 Denial of Service Vulnerability in Some ZTE Mobile Internet Products
- CVE-2023-25643 Two Vulnerabilities in Some ZTE Mobile Internet Products
- CVE-2023-25642 Two Vulnerabilities in Some ZTE Mobile Internet Products
- CVE-2023-2564 OS Command Injection in sbs20/scanservjs
- CVE-2023-25632 Security feature bypass in NAVER Whale browser
- CVE-2023-2563 WordPress Contact Forms by Cimatti <= 1.5.7 - Cross-Site Request Forgery via _accua_forms_form_edit_action
- CVE-2023-25621 Apache Sling does not allow to handle i18n content in a secure way
- CVE-2023-25620 Denial of service in Legacy Modicon Premium CPUs (TSXP57*)
- CVE-2023-2562 Gallery Metabox <= 1.5 - Missing Authorization via refresh_metabox
- CVE-2023-25619 Denial of service in Legacy Modicon Premium CPUs (TSXP57*)
- CVE-2023-25618 Denial of Service (DoS) vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform
- CVE-2023-25617 OS Command Execution vulnerability in SAP Business Objects Business Intelligence Platform (Adaptive Job Server)
- CVE-2023-25616 Code Injection vulnerability in SAP Business Objects Business Intelligence Platform (CMC)
- CVE-2023-25615 SQL Injection vulnerability in SAP ABAP Platform
- CVE-2023-25614 Cross-site scripting in NetWeaver AS ABAP (BSP Framework)
- CVE-2023-25613 LDAP Injection Vulnerability in Apache Kerby
- CVE-2023-25611 Code injection in FortiAnalyzer
- CVE-2023-25610 Memory corruption in FortiAnalyzer
- CVE-2023-2561 Gallery Metabox <= 1.5 - Missing Authorization via gallery_remove
- CVE-2023-25609 Server-side request forgery in FortiAnalyzer
- CVE-2023-25608 Path traversal in FortiAP
- CVE-2023-25607 Command injection in FortiADC
- CVE-2023-25606 Path traversal in FortiAnalyzer
- CVE-2023-25605 Missing authorization in FortiSOAR
- CVE-2023-25604 Information disclosure in FortiGuest
- CVE-2023-25603 Misconfiguration in FortiADC
- CVE-2023-25602 Memory corruption in FortiWeb
- CVE-2023-25601 Apache DolphinScheduler 3.0.0 to 3.1.1 python gateway has improper authentication
- CVE-2023-25600 Memory corruption in insyde:insydecrpkg
- CVE-2023-2560 jja8 NewBingGoGo cross site scripting
- CVE-2023-25599 Cross-site scripting in mitel:mivoice connect
- CVE-2023-25598 Cross-site scripting in mitel:mivoice connect
- CVE-2023-25597 Auth bypass in mitel:micollab
- CVE-2023-25596 Authenticated Sensitive Information Disclosure in ClearPass Policy Manager
- CVE-2023-25595 Sensitive Information Disclosure in ClearPass OnGuard Ubuntu Agent
- CVE-2023-25594 Authorization Bypass Leading to Privilege Escalation in ClearPass Policy Manager Web-Based Management Interface
- CVE-2023-25593 Reflected Cross Site Scripting Vulnerabilities (XSS) in ClearPass Policy Manager Web-Based Management Interface
- CVE-2023-25592 Reflected Cross Site Scripting Vulnerabilities (XSS) in ClearPass Policy Manager Web-Based Management Interface
- CVE-2023-25591 Authenticated Information Disclosure in ClearPass Policy Manager Web-Based Management Interface
- CVE-2023-25590 Local Privilege Escalation in ClearPass OnGuard Linux Agent
- CVE-2023-25589 Unauthenticated Arbitrary User Creation Leads to Complete System Compromise
- CVE-2023-25588 Field `the_bfd` of `asymbol` is uninitialized in function `bfd_mach_o_get_synthetic_symtab`
- CVE-2023-25586 Local variable `ch_type` in function `bfd_init_section_decompress_status` can be uninitialized
- CVE-2023-25585 Field `file_table` of `struct module *module` is uninitialized
- CVE-2023-25584 Out of bounds read in parse_module function in bfd/vms-alpha.c
- CVE-2023-25583 Command injection in UR32L
- CVE-2023-25582 Command injection in UR32L
- CVE-2023-25581 Deserialization of untrusted data in InternalAttributeHandler in pac4j
- CVE-2023-2558 Cross-site scripting in WPCS – WordPress Currency Switcher Professional
- CVE-2023-25579 Directory traversal in Nextcloud server
- CVE-2023-25578 Starlite DoS vulnerability when parsing multipart request body
- CVE-2023-25577 Werkzeug may allow high resource usage when parsing multipart form data with many fields
- CVE-2023-25576 @fastify/multipart vulnerable to DoS due to unlimited number of parts
- CVE-2023-25575 Secured properties in API Platform Core may be accessible within collections
- CVE-2023-25574 JupyterHub's LTI13Authenticator: JWT signature not validated
- CVE-2023-25573 Improper access control to download file in metersphere
- CVE-2023-25572 React-Admin vulnerable to Cross-Site-Scripting attack on `<RichTextField>`
- CVE-2023-25571 Backstage has XSS Vulnerability in Software Catalog
- CVE-2023-25570 Apollo has potential access control security issue in eureka
- CVE-2023-2557 Missing authorization in WPCS – WordPress Currency Switcher Professional
- CVE-2023-25569 apollo-portal has potential CSRF issue
- CVE-2023-25568 Boxo bitswap/server: DOS unbounded persistent memory leak
- CVE-2023-25567 GSS-NTLMSSP vulnerable to out-of-bounds read when decoding target information
- CVE-2023-25566 GSS-NTLMSSP vulnerable to memory leak when parsing usernames
- CVE-2023-25565 GSS-NTLMSSP vulnerable to incorrect free when decoding target information
- CVE-2023-25564 GSS-NTLMSSP vulnerable to memory corruption when decoding UTF16 strings
- CVE-2023-25563 GSS-NTLMSSP vulnerable to multiple out-of-bounds reads when decoding NTLM fields
- CVE-2023-25562 Failure to Invalidate Session on Logout in DataHub
- CVE-2023-25561 Login fail open on JAAS misconfiguration in DataHub
- CVE-2023-25560 JSON Injection in DataHub
- CVE-2023-2556 Missing authorization in WPCS – WordPress Currency Switcher Professional
- CVE-2023-25559 System account impersonation in DataHub
- CVE-2023-25558 Deserialization of untrusted data in DataHub
- CVE-2023-25557 Server-Side Request Forgery in DataHub
- CVE-2023-25556 Auth bypass in Merten INSTABUS Tastermodul 1fach System M 625199
- CVE-2023-25555 Command injection in StruxureWare Data Center Expert
- CVE-2023-25554 Command injection in StruxureWare Data Center Expert
- CVE-2023-25553 Cross-site scripting in StruxureWare Data Center Expert
- CVE-2023-25552 Missing authorization in StruxureWare Data Center Expert
- CVE-2023-25551 Cross-site scripting in StruxureWare Data Center Expert
- CVE-2023-25550 Code injection in StruxureWare Data Center Expert
- CVE-2023-2555 Missing authorization in WPCS – WordPress Currency Switcher Professional
- CVE-2023-25549 Code injection in StruxureWare Data Center Expert
- CVE-2023-25548 Missing authorization in StruxureWare Data Center Expert
- CVE-2023-25547 Missing authorization in StruxureWare Data Center Expert
- CVE-2023-25546 Memory corruption in UEFI firmware for some Intel(R) Processors
- CVE-2023-25545 Memory corruption in Intel(R) Server Board BMC firmware
- CVE-2023-25544 Information disclosure in Dell NetWorker, NVE
- CVE-2023-25543 Privilege escalation in Dell Power Manager (DPM)
- CVE-2023-25542 Misconfiguration in Dell Trusted Device Client
- CVE-2023-25540 Misconfiguration in PowerScale OneFS
- CVE-2023-2554 External Control of File Name or Path in unilogies/bumsys
- CVE-2023-25539 Command injection in NetWorker NVE
- CVE-2023-25537 Memory corruption in PowerEdge Platform
- CVE-2023-25536 Information disclosure in PowerScale OneFS
- CVE-2023-25535 Privilege escalation in SupportAssist Client Consumer