CVE-2023-1892

CriticalCVSS 9.6/10Last modified Jun 17, 2026

Description

Cross-site Scripting (XSS) - Reflected in GitHub repository sidekiq/sidekiq prior to 7.0.8.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Apr 21, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-18936.1The Login Configurator WordPress plugin through 2.1 does not properly escape a URL parameter before outputting it to the page, leading to a CVE-2023-18945.3A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation. An issue related to speciCVE-2023-18959.6The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Server Side Request Forgery via the get_remote_content REST API endpointCVE-2023-18977.5Atlas Copco Power Focus 6000 web server does not sanitize the login information stored by the authenticated user’s browser, which could alloCVE-2023-18987.5Atlas Copco Power Focus 6000 web server uses a small amount of session ID numbers. An attacker could enter a session ID number to retrieve dCVE-2023-18997.5Atlas Copco Power Focus 6000 web server is not a secure connection by default, which could allow an attacker to gain sensitive information bCVE-2023-19005.5A vulnerability within the Avira network protection feature allowed an attacker with local execution rights to cause an overflow. This couldCVE-2023-19018.0The bluetooth HCI host layer logic not clearing a global reference to a semaphore after synchronously sending HCI commands may allow a malicCVE-2023-19028.0The bluetooth HCI host layer logic not clearing a global reference to a state pointer after handling connection events may allow a maliciousCVE-2023-19034.3SAP HCM Fiori App My Forms (Fiori 2.0) - version 605, does not perform necessary authorization checks for an authenticated user exposing theCVE-2023-19047.5In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of OcCVE-2023-19055.4The WP Popups WordPress plugin before 2.1.5.1 does not properly escape the href attribute of its spu-facebook-page shortcode before outputti