Total
403696 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-4320 | 1 Redhat | 1 Satellite | 2026-06-17 | N/A | 7.6 HIGH |
| An arithmetic overflow flaw was found in Satellite when creating a new personal access token. This flaw allows an attacker who uses this arithmetic overflow to create personal access tokens that are valid indefinitely, resulting in damage to the system's integrity. | |||||
| CVE-2023-4318 | 1 Wow-company | 1 Herd Effects | 2026-06-17 | N/A | 4.3 MEDIUM |
| The Herd Effects WordPress plugin before 5.2.4 does not have CSRF when deleting its items, which could allow attackers to make logged in admins delete arbitrary effects via a CSRF attack | |||||
| CVE-2023-4317 | 1 Gitlab | 1 Gitlab | 2026-06-17 | N/A | 4.3 MEDIUM |
| An issue has been discovered in GitLab affecting all versions starting from 9.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for a user with the Developer role to update a pipeline schedule from an unprotected branch to a protected branch. | |||||
| CVE-2023-4316 | 1 Zod | 1 Zod | 2026-06-17 | N/A | 7.5 HIGH |
| Zod in versions 3.21.0 up to and including 3.22.3 allows an attacker to perform a denial of service while validating emails. | |||||
| CVE-2023-4315 | 1 Wp3sixty | 1 Woo Custom Emails | 2026-06-17 | N/A | 6.1 MEDIUM |
| The Woo Custom Emails for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wcemails_edit' parameter in versions up to, and including, 2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2023-45004 appears to be a duplicate of this issue. | |||||
| CVE-2023-4314 | 1 Tms-outsource | 1 Wpdatatables | 2026-06-17 | N/A | 7.2 HIGH |
| The wpDataTables WordPress plugin before 2.1.66 does not validate the "Serialized PHP array" input data before deserializing the data. This allows admins to deserialize arbitrary data which may lead to remote code execution if a suitable gadget chain is present on the server. This is impactful in environments where admin users should not be allowed to execute arbitrary code, such as multisite. | |||||
| CVE-2023-4311 | 1 Maurice | 1 Vrm360 | 2026-06-17 | N/A | 8.8 HIGH |
| The Vrm 360 3D Model Viewer WordPress plugin through 1.2.1 is vulnerable to arbitrary file upload due to insufficient checks in a plugin shortcode. | |||||
| CVE-2023-4310 | 1 Beyondtrust | 2 Privileged Remote Access, Remote Support | 2026-06-17 | N/A | 9.8 CRITICAL |
| BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) versions 23.2.1 and 23.2.2 contain a command injection vulnerability which can be exploited through a malicious HTTP request. Successful exploitation of this vulnerability can allow an unauthenticated remote attacker to execute underlying operating system commands within the context of the site user. This issue is fixed in version 23.2.3. | |||||
| CVE-2023-4309 | 1 Electionservicesco | 1 Internet Election Service | 2026-06-17 | N/A | 10.0 CRITICAL |
| Election Services Co. (ESC) Internet Election Service is vulnerable to SQL injection in multiple pages and parameters. These vulnerabilities allow an unauthenticated, remote attacker to read or modify data for any elections that share the same backend database. ESC deactivated older and unused elections and enabled web application firewall (WAF) protection for current and future elections on or around 2023-08-12. | |||||
| CVE-2023-4308 | 1 Plugin-planet | 1 User Submitted Posts | 2026-06-17 | N/A | 7.2 HIGH |
| The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user-submitted-content’ parameter in versions up to, and including, 20230809 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2023-4307 | 1 Teknigar | 1 Lock User Account | 2026-06-17 | N/A | 4.3 MEDIUM |
| The Lock User Account WordPress plugin through 1.0.3 does not have CSRF check when bulk locking and unlocking accounts, which could allow attackers to make logged in admins lock and unlock arbitrary users via a CSRF attack | |||||
| CVE-2023-4304 | 1 Froxlor | 1 Froxlor | 2026-06-17 | N/A | 3.8 LOW |
| Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.22,2.1.0. | |||||
| CVE-2023-4303 | 1 Jenkins | 1 Fortify | 2026-06-17 | N/A | 4.3 MEDIUM |
| Jenkins Fortify Plugin 22.1.38 and earlier does not escape the error message for a form validation method, resulting in an HTML injection vulnerability. | |||||
| CVE-2023-4302 | 1 Jenkins | 1 Fortify | 2026-06-17 | N/A | 4.2 MEDIUM |
| A missing permission check in Jenkins Fortify Plugin 22.1.38 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. | |||||
| CVE-2023-4301 | 1 Jenkins | 1 Fortify | 2026-06-17 | N/A | 4.2 MEDIUM |
| A cross-site request forgery (CSRF) vulnerability in Jenkins Fortify Plugin 22.1.38 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. | |||||
| CVE-2023-4300 | 1 Mooveagency | 1 Import Xml And Rss Feeds | 2026-06-17 | N/A | 7.2 HIGH |
| The Import XML and RSS Feeds WordPress plugin before 2.1.4 does not filter file extensions for uploaded files, allowing an attacker to upload a malicious PHP file, leading to Remote Code Execution. | |||||
| CVE-2023-4299 | 1 Digi | 39 Cm, Cm Firmware, Connect Es and 36 more | 2026-06-17 | N/A | 9.0 CRITICAL |
| Digi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass authentication to access connected equipment. | |||||
| CVE-2023-4298 | 1 123.chat | 1 123.chat | 2026-06-17 | N/A | 4.8 MEDIUM |
| The 123.chat WordPress plugin before 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2023-4297 | 1 Mediamanifesto | 1 Mmm Simple File List | 2026-06-17 | N/A | 4.3 MEDIUM |
| The Mmm Simple File List WordPress plugin through 2.3 does not validate the generated path to list files from, allowing any authenticated users, such as subscribers, to list the content of arbitrary directories. | |||||
| CVE-2023-4296 | 1 Intland | 1 Codebeamer | 2026-06-17 | N/A | 8.8 HIGH |
| If an attacker tricks an admin user of PTC Codebeamer into clicking on a malicious link, it may allow the attacker to inject arbitrary code to be executed in the browser on the target device. | |||||