2023 CVE Vulnerabilities
31,509 CVEs published in 2023.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2023-4220 | MEDIUM | 6.1 | 76.1% | Nov 28, 2023 | Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in C... |
| CVE-2023-48023 | CRITICAL | 9.1 | 35.1% | Nov 28, 2023 | Anyscale Ray 2.6.3 and 2.8.0 allows /log_proxy SSRF. NOTE: the vendor's position is that this report is irrelevant becau... |
| CVE-2023-48022 | CRITICAL | 9.8 | 81.5% | Nov 28, 2023 | Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the ve... |
| CVE-2023-3545 | CRITICAL | 9.8 | 2.0% | Nov 28, 2023 | Improper sanitisation in `main/inc/lib/fileUpload.lib.php` in Chamilo LMS <= v1.11.20 on Windows and Apache installation... |
| CVE-2023-3533 | CRITICAL | 9.8 | 2.7% | Nov 28, 2023 | Path traversal in file upload functionality in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20... |
| CVE-2023-3368 | CRITICAL | 9.8 | 68.9% | Nov 28, 2023 | Command injection in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated at... |
| CVE-2023-24023 | MEDIUM | 6.8 | 1.3% | Nov 28, 2023 | Bluetooth BR/EDR devices with Secure Simple Pairing and Secure Connections pairing in Bluetooth Core Specification 4.2 t... |
| CVE-2023-6226 | MEDIUM | 4.3 | 0.5% | Nov 28, 2023 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Insecure Direct Object Reference in... |
| CVE-2023-6225 | MEDIUM | 5.4 | 0.5% | Nov 28, 2023 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the... |
| CVE-2023-49075 | HIGH | 7.2 | 1.4% | Nov 28, 2023 | The Admin Classic Bundle provides a Backend UI for Pimcore. `AdminBundle\Security\PimcoreUserTwoFactorCondition` introdu... |
| CVE-2023-48713 | MEDIUM | 5.3 | 0.9% | Nov 28, 2023 | Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless contai... |
| CVE-2023-32065 | MEDIUM | 5.8 | 0.5% | Nov 28, 2023 | OroCommerce is an open-source Business to Business Commerce application built with flexibility in mind. Detailed Order t... |
| CVE-2023-32064 | MEDIUM | 4.3 | 0.5% | Nov 28, 2023 | OroCommerce package with customer portal and non authenticated visitor website base features. Back-office users can acce... |
| CVE-2023-32063 | MEDIUM | 5 | 0.5% | Nov 28, 2023 | OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access... |
| CVE-2023-6219 | HIGH | 7.2 | 1.2% | Nov 28, 2023 | The BookingPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the... |
| CVE-2023-5960 | MEDIUM | 5.5 | 0.2% | Nov 28, 2023 | An improper privilege management vulnerability in the hotspot feature of the Zyxel USG FLEX series firmware versions 4.5... |
| CVE-2023-5797 | MEDIUM | 5.5 | 0.2% | Nov 28, 2023 | An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 t... |
| CVE-2023-5650 | MEDIUM | 5.5 | 0.2% | Nov 28, 2023 | An improper privilege management vulnerability in the ZySH of the Zyxel ATP series firmware versions 4.32 through 5.37, ... |
| CVE-2023-4398 | HIGH | 7.5 | 0.9% | Nov 28, 2023 | An integer overflow vulnerability in the source code of the QuickSec IPSec toolkit used in the VPN feature of the Zyxel ... |
| CVE-2023-4397 | MEDIUM | 4.4 | 0.2% | Nov 28, 2023 | A buffer overflow vulnerability in the Zyxel ATP series firmware version 5.37, USG FLEX series firmware version 5.37, US... |
| CVE-2023-47503 | CRITICAL | 9.8 | 1.3% | Nov 28, 2023 | An issue in jflyfox jfinalCMS v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the log... |
| CVE-2023-37926 | MEDIUM | 5.5 | 0.2% | Nov 28, 2023 | A buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware ve... |
| CVE-2023-37925 | MEDIUM | 5.5 | 0.2% | Nov 28, 2023 | An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 t... |
| CVE-2023-35139 | MEDIUM | 6.1 | 0.5% | Nov 28, 2023 | A cross-site scripting (XSS) vulnerability in the CGI program of the Zyxel ATP series firmware versions 5.10 through 5.3... |
| CVE-2023-35136 | MEDIUM | 5.5 | 0.2% | Nov 28, 2023 | An improper input validation vulnerability in the “Quagga” package of the Zyxel ATP series firmware versions 4.32 throug... |
Check if your code is affected by 2023 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now