Vulnerabilities published in 2023
42,916 vulnerabilities were published in 2023: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 380 of 430.
- CVE-2023-23688 WordPress Social Share Boost Plugin <= 4.4 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-23687 WordPress Youtube shortcode Plugin <= 1.8.5 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-23686 WordPress Simple Staff List Plugin <= 2.2.2 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-23685 WordPress Portfolio – WordPress Portfolio Plugin Plugin <= 2.8.10 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-23684 WordPress WPGraphQL Plugin <= 1.14.5 is vulnerable to Server Side Request Forgery (SSRF)
- CVE-2023-23683 WordPress White Label Branding for Elementor Page Builder Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-23682 WordPress EZP Maintenance Mode Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-23681 WordPress Image Hover Effects For WPBakery Page Builder Plugin <= 4.0 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-23680 WordPress WP TopBar Plugin <= 5.36 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-2368 SourceCodester Faculty Evaluation System sql injection
- CVE-2023-23679 Missing authorization in JS Help Desk
- CVE-2023-23678 WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent Plugin <= 2.2.5 is vulnerable to CSV Injection
- CVE-2023-23677 WordPress GTmetrix for WordPress Plugin <= 0.4.5 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-23676 WordPress File Gallery Plugin <= 1.8.5.3 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-23675 WordPress WP Smart Preloader Plugin <= 1.15 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-23674 WordPress WP Original Media Path Plugin <= 2.4.0 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-23673 WordPress I Recommend This Plugin <= 3.8.3 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-23672 WordPress GiveWP plugin <= 2.25.1 - Arbitrary Content Deletion vulnerability
- CVE-2023-23671 WordPress Layer Slider Plugin <= 1.1.9.7 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-23670 WordPress Fancy Comments WordPress Plugin <= 1.2.10 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-2367 SourceCodester Faculty Evaluation System manage_academic.php sql injection
- CVE-2023-23668 WordPress GiveWP Plugin <= 2.25.1 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-23667 WordPress Brands for WooCommerce Plugin <= 3.7.0.6 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-23664 WordPress ConvertBox Auto Embed WordPress plugin Plugin <= 1.0.19 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-23660 WordPress MainWP Maintenance Extension Plugin <= 4.1.1 is vulnerable to SQL Injection
- CVE-2023-2366 SourceCodester Faculty Evaluation System sql injection
- CVE-2023-23659 WordPress MainWP Matomo Extension Plugin <= 4.0.4 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-23657 WordPress Mail Subscribe List Plugin <= 2.1.9 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-23656 WordPress MainWP File Uploader Extension Plugin <= 4.1 - Unauthenticated Arbitrary File Upload Vulnerability
- CVE-2023-23654 WordPress SparkPost Plugin <= 3.2.5 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-23651 WordPress MainWP Google Analytics Extension Plugin <= 4.0.4 - SQL Injection vulnerability
- CVE-2023-23650 WordPress MainWP Code Snippets Extension Plugin <= 4.0.2 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-2365 SourceCodester Faculty Evaluation System sql injection
- CVE-2023-23649 WordPress MainWP Links Manager Extension Plugin <= 2.1 - Unauthenticated PHP Object Injection Vulnerability
- CVE-2023-23647 WordPress Team Member Plugin <= 4.4 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-23646 WordPress Album Gallery – WordPress Gallery Plugin <= 1.4.9 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-23645 Code injection in MainWP Code Snippets Extension
- CVE-2023-23641 WordPress Uji Popup Plugin <= 1.4.3 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-23640 WordPress MainWP UpdraftPlus Extension Plugin <= 4.0.6 - Subscriber+ Arbitrary Plugin Activation Vulnerability
- CVE-2023-2364 SourceCodester Resort Reservation System registration.php cross site scripting
- CVE-2023-23639 WordPress MainWP Staging Extension Plugin <= 4.0.3 - Subscriber+ Arbitrary Plugin Activation Vulnerability
- CVE-2023-23638 Apache Dubbo Deserialization Vulnerability Gadgets Bypass
- CVE-2023-23637 Cross-site scripting in unistra:impatient
- CVE-2023-23636 Jellyfin Web Cross-Site Scripting (XSS) via Playlist Name
- CVE-2023-23635 Jellyfin Web Cross-Site Scripting (XSS) via Collection Name
- CVE-2023-23634 SQL injection in documize:documize
- CVE-2023-23632 Auth bypass in beyondtrust:privileged remote access
- CVE-2023-23631 HAMT Decoding Panics in github.com/ipfs/go-unixfsnode
- CVE-2023-23630 Cross-site (XSS) vulnerability with Express API in Eta
- CVE-2023-2363 SourceCodester Resort Reservation System view_room.php sql injection
- CVE-2023-23629 Metabase subject to Improper Privilege Management
- CVE-2023-23628 Metabase subject to Exposure of Sensitive Information to an Unauthorized Actor
- CVE-2023-23627 Sanitize vulnerable to Cross-site Scripting via Improper neutralization of `noscript` element
- CVE-2023-23626 Denial of service when feeding malformed size arguments in go-bitfield
- CVE-2023-23625 Denial of service in HAMT Decoding in go-unixfs
- CVE-2023-23624 Discourse's exclude_tags param could leak which topics had a specific hidden tag
- CVE-2023-23623 Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled in Electron
- CVE-2023-23622 Discourse: Presence of read restricted topics may be leaked if tagged with a tag that is visible to all users
- CVE-2023-23621 Discourse vulnerable to ReDoS in user agent parsing
- CVE-2023-23620 Discourse restricted tag routes leak topic information
- CVE-2023-2362 Multiple Plugins from Wow-Company - Reflected XSS
- CVE-2023-23619 Improper Control of Generation of Code ('Code Injection') in @asyncapi/modelina
- CVE-2023-23618 gitk can inadvertently call executables in the worktree
- CVE-2023-23617 OpenMage LTS has DoS vulnerability in MaliciousCode filter
- CVE-2023-23616 Discourse membership requests lack character limit
- CVE-2023-23615 Malicious users in Discourse can create spam topics as any user due to improper access control
- CVE-2023-23614 Improper session handling of "Remember me for 7 days" functionality
- CVE-2023-23613 Field-level security issue with .keyword fields in OpenSearch
- CVE-2023-23612 Issue with whitespace in JWT roles in OpenSearch
- CVE-2023-23611 xblock-lti-consumer contain Missing Authorization in Grade Pass Back Implementation
- CVE-2023-23610 glpi vulnerable to Unauthorized access to data export
- CVE-2023-2361 Cross-site Scripting (XSS) - Stored in pimcore/pimcore
- CVE-2023-23609 contiki-ng BLE-L2CAP contains Improper size validation of L2CAP frames
- CVE-2023-23608 spotipy Path traversal vulnerability that may lead to type confusion in URI handling code
- CVE-2023-23607 Unrestricted file upload leads to Remote Code Execution in erohtar/Dasherr
- CVE-2023-23606 Memory safety bugs fixed in Firefox 109
- CVE-2023-23605 Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7
- CVE-2023-23604 Creation of duplicate SystemPrincipal from less secure contexts
- CVE-2023-23603 Calls to console.log allowed bypassing Content Security Policy via format directive
- CVE-2023-23602 Content Security Policy wasn't being correctly applied to WebSockets in WebWorkers
- CVE-2023-23601 URL being dragged from cross-origin iframe into same tab triggers navigation
- CVE-2023-23600 Notification permissions persisted between Normal and Private Browsing on Android
- CVE-2023-2360 Misconfiguration in Acronis Cyber Infrastructure
- CVE-2023-23599 Malicious command could be hidden in devtools output on Windows
- CVE-2023-23598 Arbitrary file read from GTK drag and drop on Linux
- CVE-2023-23597 Logic bug in process allocation allowed to read arbitrary files
- CVE-2023-23596 Command injection in jc21:nginx proxy manager
- CVE-2023-23595 XML external entity in bluecatnetworks:device registration portal
- CVE-2023-23594 Auth bypass in sato-global:cl4nx plus firmware
- CVE-2023-23592 Information disclosure in wallix:bastion access manager
- CVE-2023-23591 Information disclosure in terminalfour:terminalfour
- CVE-2023-23590 Denial of service in mercedes-benz:xentry retail data storage firmware
- CVE-2023-2359 Revolution Slider <= 6.6.12 - Author+ Remote Code Execution
- CVE-2023-23589 Security feature bypass in debian:debian linux
- CVE-2023-23588 Weak cryptography in SIMATIC IPC1047
- CVE-2023-23586 Use after free in io_uring in the Linux Kernel
- CVE-2023-23585 Server DoS due to heap overflow
- CVE-2023-23584 Information disclosure in Command Centre Server
- CVE-2023-23583 Privilege escalation in Intel(R) Processors
- CVE-2023-23582 Memory corruption in Wattbox WB-300-IP-3