# Vulnerabilities published in 2023


- [CVE-2023-6957](https://insights.sbomify.com/CVE-2023-6957/): Fluent Forms <= 5.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 4.9)
- [CVE-2023-6956](https://insights.sbomify.com/CVE-2023-6956/): EasyAzon – Amazon Associates Affiliate Plugin <= 5.1.0 - Reflected Cross-Site Scripting via easyazon-cloaking-locale (medium 6.1)
- [CVE-2023-6955](https://insights.sbomify.com/CVE-2023-6955/): Missing Authorization in GitLab (medium 6.6)
- [CVE-2023-6954](https://insights.sbomify.com/CVE-2023-6954/): Download Manager <= 3.2.85 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-6953](https://insights.sbomify.com/CVE-2023-6953/): PDF Generator For Fluent Forms <= 1.1.7 - Cross-Site Scripting (medium 4.9)
- [CVE-2023-6951](https://insights.sbomify.com/CVE-2023-6951/): Weak cryptography in Matrice 300 (medium 6.6)
- [CVE-2023-6950](https://insights.sbomify.com/CVE-2023-6950/): Denial of service in Mini 3 Pro (low 3.0)
- [CVE-2023-6949](https://insights.sbomify.com/CVE-2023-6949/): Missing authorization in Mini 3 Pro (medium 5.2)
- [CVE-2023-6948](https://insights.sbomify.com/CVE-2023-6948/): Memory corruption in Matrice 300 (low 3.0)
- [CVE-2023-6947](https://insights.sbomify.com/CVE-2023-6947/): Best WordPress Gallery Plugin – FooGallery <= 2.4.16 - Authenticated (Contributor+) Directory Traversal (high 7.7)
- [CVE-2023-6946](https://insights.sbomify.com/CVE-2023-6946/): Autotitle for WordPress <= 1.0.3 - Settings Update to Stored XSS via CSRF (high 8.8)
- [CVE-2023-6945](https://insights.sbomify.com/CVE-2023-6945/): SourceCodester Online Student Management System edit-student-detail.php cross site scripting (low 2.4)
- [CVE-2023-6944](https://insights.sbomify.com/CVE-2023-6944/): Rhdh: catalog-import function leaks credentials to frontend (medium 5.7)
- [CVE-2023-6943](https://insights.sbomify.com/CVE-2023-6943/): Code injection in EZSocket (critical 9.8)
- [CVE-2023-6942](https://insights.sbomify.com/CVE-2023-6942/): Auth bypass in EZSocket (high 7.5)
- [CVE-2023-6941](https://insights.sbomify.com/CVE-2023-6941/): Keap Official Opt-in Forms <= 1.0.11 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-6940](https://insights.sbomify.com/CVE-2023-6940/): Command Injection (critical 9.0)
- [CVE-2023-6939](https://insights.sbomify.com/CVE-2023-6939/): Memory corruption in Magic UI (medium 4.0)
- [CVE-2023-6938](https://insights.sbomify.com/CVE-2023-6938/): Oxygen Builder <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field (medium 6.4)
- [CVE-2023-6937](https://insights.sbomify.com/CVE-2023-6937/): Improper (D)TLS key boundary enforcement (medium 5.3)
- [CVE-2023-6936](https://insights.sbomify.com/CVE-2023-6936/): Heap-buffer over-read with WOLFSSL_CALLBACKS (medium 5.3)
- [CVE-2023-6935](https://insights.sbomify.com/CVE-2023-6935/): Marvin Attack vulnerability in SP Math All RSA (medium 5.9)
- [CVE-2023-6934](https://insights.sbomify.com/CVE-2023-6934/): Limit Login Attempts Reloaded <= 2.25.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-6933](https://insights.sbomify.com/CVE-2023-6933/): Better Search Replace <= 1.4.4 - Unauthenticated PHP Object Injection (high 8.8)
- [CVE-2023-6932](https://insights.sbomify.com/CVE-2023-6932/): Use-after-free in Linux kernel's ipv4: igmp component (high 7.8)
- [CVE-2023-6931](https://insights.sbomify.com/CVE-2023-6931/): Out-of-bounds write in Linux kernel's Performance Events system component (high 7.8)
- [CVE-2023-6930](https://insights.sbomify.com/CVE-2023-6930/): Improper Access Control in EuroTel ETL3100 (critical 9.4)
- [CVE-2023-6929](https://insights.sbomify.com/CVE-2023-6929/): Authorization Bypass Through User-Controlled Key in EuroTel ETL3100 (high 7.5)
- [CVE-2023-6928](https://insights.sbomify.com/CVE-2023-6928/): Improper Restriction of Excessive Authentication Attempts (critical 9.8)
- [CVE-2023-6927](https://insights.sbomify.com/CVE-2023-6927/): Keycloak: open redirect via "form_post.jwt" jarm response mode (medium 4.6)
- [CVE-2023-6926](https://insights.sbomify.com/CVE-2023-6926/): Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Crestron AM-300 (high 8.4)
- [CVE-2023-6925](https://insights.sbomify.com/CVE-2023-6925/): Unlimited Addons for WPBakery Page Builder <= 1.0.42 - Authenticated (Editor+) Arbitrary File Upload (high 7.2)
- [CVE-2023-6924](https://insights.sbomify.com/CVE-2023-6924/): Photo Gallery by 10Web <= 1.8.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Widget (medium 4.4)
- [CVE-2023-6923](https://insights.sbomify.com/CVE-2023-6923/): Matomo <= 4.15.3 - Reflected Cross-Site Scripting via idsite (medium 6.1)
- [CVE-2023-6922](https://insights.sbomify.com/CVE-2023-6922/): Under Construction / Maintenance Mode from Acurax <= 2.6 - Authenticated (Subscriber+) Sensitive Information Exposure (medium 4.3)
- [CVE-2023-6921](https://insights.sbomify.com/CVE-2023-6921/): SQL Injection in PrestaShop Google Integrator (critical 9.8)
- [CVE-2023-6919](https://insights.sbomify.com/CVE-2023-6919/): Path Traversal in VGuard IP Camera Network Recorder (high 7.5)
- [CVE-2023-6918](https://insights.sbomify.com/CVE-2023-6918/): Libssh: missing checks for return values for digests (low 3.7)
- [CVE-2023-6917](https://insights.sbomify.com/CVE-2023-6917/): Pcp: unsafe use of directories allows pcp to root privilege escalation (medium 6.0)
- [CVE-2023-6916](https://insights.sbomify.com/CVE-2023-6916/): Information disclosure via audit records for OpenAPI requests in Guardian/CMC before 23.4.1 (high 7.5)
- [CVE-2023-6915](https://insights.sbomify.com/CVE-2023-6915/): Kernel: null pointer dereference vulnerability in ida_free in lib/idr.c (medium 6.2)
- [CVE-2023-6913](https://insights.sbomify.com/CVE-2023-6913/): Session Hijacking on Imou Life app (high 8.1)
- [CVE-2023-6912](https://insights.sbomify.com/CVE-2023-6912/): Brute force vulnerability in M-Files user authentication (high 7.5)
- [CVE-2023-6911](https://insights.sbomify.com/CVE-2023-6911/): WSO2 Registry Stored Cross Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2023-6910](https://insights.sbomify.com/CVE-2023-6910/): Uncontrolled Resource Consumption in M-Files Server (medium 6.5)
- [CVE-2023-6909](https://insights.sbomify.com/CVE-2023-6909/): Path Traversal: '\..\filename' in mlflow/mlflow (high 7.5)
- [CVE-2023-6908](https://insights.sbomify.com/CVE-2023-6908/): DFIRKuiper TAR Archive case_management.py unzip_file path traversal (low 3.1)
- [CVE-2023-6907](https://insights.sbomify.com/CVE-2023-6907/): codelyfe Stupid Simple CMS Deletion Interface delete.php improper authentication (medium 5.4)
- [CVE-2023-6906](https://insights.sbomify.com/CVE-2023-6906/): Totolink A7100RU HTTP POST Request main buffer overflow (critical 9.8)
- [CVE-2023-6905](https://insights.sbomify.com/CVE-2023-6905/): Jahastech NxFilter Bind Request ldap injection (medium 4.3)
- [CVE-2023-6904](https://insights.sbomify.com/CVE-2023-6904/): Jahastech NxFilter config,admin.jsp cross-site request forgery (medium 4.3)
- [CVE-2023-6903](https://insights.sbomify.com/CVE-2023-6903/): Netentsec NS-ASG Application Security Gateway sql injection (high 7.3)
- [CVE-2023-6902](https://insights.sbomify.com/CVE-2023-6902/): codelyfe Stupid Simple CMS upload.php unrestricted upload (medium 5.5)
- [CVE-2023-6901](https://insights.sbomify.com/CVE-2023-6901/): codelyfe Stupid Simple CMS HTTP POST Request handle-command.php os command injection (high 7.3)
- [CVE-2023-6900](https://insights.sbomify.com/CVE-2023-6900/): rmountjoy92 DashMachine delete_file path traversal (medium 4.6)
- [CVE-2023-6899](https://insights.sbomify.com/CVE-2023-6899/): rmountjoy92 DashMachine Config save_config code injection (medium 4.3)
- [CVE-2023-6898](https://insights.sbomify.com/CVE-2023-6898/): SourceCodester Best Courier Management System manage_user.php sql injection (medium 5.5)
- [CVE-2023-6897](https://insights.sbomify.com/CVE-2023-6897/): EAN for WooCommerce <= 4.9.2 - Insecure Direct Object Reference to Sensitve Information Exposure via Shortcode (medium 4.3)
- [CVE-2023-6896](https://insights.sbomify.com/CVE-2023-6896/): SourceCodester Simple Image Stack Website cross site scripting (low 3.5)
- [CVE-2023-6895](https://insights.sbomify.com/CVE-2023-6895/): Hikvision Intercom Broadcasting System ping.php os command injection (medium 6.3)
- [CVE-2023-6894](https://insights.sbomify.com/CVE-2023-6894/): Hikvision Intercom Broadcasting System Log File system.html information disclosure (medium 4.3)
- [CVE-2023-6893](https://insights.sbomify.com/CVE-2023-6893/): Hikvision Intercom Broadcasting System exportrecord.php path traversal (medium 4.3)
- [CVE-2023-6892](https://insights.sbomify.com/CVE-2023-6892/): Cross-site scripting in EAN Barcode Generator for WooCommerce: UPC, ISBN & GTIN Inventory (medium 6.4)
- [CVE-2023-6891](https://insights.sbomify.com/CVE-2023-6891/): PeaZip Library dragdropfilesdll.dll uncontrolled search path (medium 5.3)
- [CVE-2023-6890](https://insights.sbomify.com/CVE-2023-6890/): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (medium 5.4)
- [CVE-2023-6889](https://insights.sbomify.com/CVE-2023-6889/): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (medium 5.4)
- [CVE-2023-6888](https://insights.sbomify.com/CVE-2023-6888/): PHZ76 RtspServer RtspMesaage.cpp ParseRequestLine stack-based overflow (medium 6.3)
- [CVE-2023-6887](https://insights.sbomify.com/CVE-2023-6887/): saysky ForestBlog Image Upload img unrestricted upload (medium 6.3)
- [CVE-2023-6886](https://insights.sbomify.com/CVE-2023-6886/): xnx3 wangmarket Role Management Page code injection (medium 4.7)
- [CVE-2023-6885](https://insights.sbomify.com/CVE-2023-6885/): Tongda OA 2017 delete.php sql injection (medium 5.5)
- [CVE-2023-6884](https://insights.sbomify.com/CVE-2023-6884/): Plugin for Google Reviews <= 3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode (medium 6.4)
- [CVE-2023-6883](https://insights.sbomify.com/CVE-2023-6883/): Easy Social Feed <= 6.5.2 - Missing Authorization to Settings Modification (medium 4.3)
- [CVE-2023-6882](https://insights.sbomify.com/CVE-2023-6882/): Simple Membership <= 4.3.8 - Reflected Cross-Site Scripting Vulnerability via environment_mode (medium 6.1)
- [CVE-2023-6881](https://insights.sbomify.com/CVE-2023-6881/): fs: fuse: buffer overflow vulnerability in the Zephyr FS (high 7.3)
- [CVE-2023-6880](https://insights.sbomify.com/CVE-2023-6880/): Visual Composer Premium <= 45.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2023-6879](https://insights.sbomify.com/CVE-2023-6879/): heap buffer overflow in libaom (critical 9.0)
- [CVE-2023-6878](https://insights.sbomify.com/CVE-2023-6878/): Slick Social Share Buttons <= 2.4.11 - Authenticated (Subscriber+) Arbitrary Option Update (high 8.8)
- [CVE-2023-6877](https://insights.sbomify.com/CVE-2023-6877/): Cross-site scripting in RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator (medium 6.4)
- [CVE-2023-6876](https://insights.sbomify.com/CVE-2023-6876/): Missing authorization in Clever Fox (medium 5.4)
- [CVE-2023-6875](https://insights.sbomify.com/CVE-2023-6875/): Auth bypass in Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App (critical 9.8)
- [CVE-2023-6874](https://insights.sbomify.com/CVE-2023-6874/): Zigbee Unauthenticated DoS via NWK Sequence number manipulation (high 7.5)
- [CVE-2023-6873](https://insights.sbomify.com/CVE-2023-6873/): Memory corruption in Firefox (high 8.8)
- [CVE-2023-6872](https://insights.sbomify.com/CVE-2023-6872/): Information disclosure in Firefox (medium 6.5)
- [CVE-2023-6871](https://insights.sbomify.com/CVE-2023-6871/): Security feature bypass in Firefox (medium 4.3)
- [CVE-2023-6870](https://insights.sbomify.com/CVE-2023-6870/): Security feature bypass in Firefox (medium 4.3)
- [CVE-2023-6869](https://insights.sbomify.com/CVE-2023-6869/): Security feature bypass in Firefox (medium 6.5)
- [CVE-2023-6868](https://insights.sbomify.com/CVE-2023-6868/): Security feature bypass in Firefox (medium 4.3)
- [CVE-2023-6867](https://insights.sbomify.com/CVE-2023-6867/): Security feature bypass in Firefox (medium 6.1)
- [CVE-2023-6866](https://insights.sbomify.com/CVE-2023-6866/): Other in Firefox (high 8.8)
- [CVE-2023-6865](https://insights.sbomify.com/CVE-2023-6865/): Information disclosure in Firefox (medium 6.5)
- [CVE-2023-6864](https://insights.sbomify.com/CVE-2023-6864/): Memory corruption in Firefox (high 8.8)
- [CVE-2023-6863](https://insights.sbomify.com/CVE-2023-6863/): Memory corruption in Firefox (high 8.8)
- [CVE-2023-6862](https://insights.sbomify.com/CVE-2023-6862/): Use after free in Firefox ESR (high 8.8)
- [CVE-2023-6861](https://insights.sbomify.com/CVE-2023-6861/): Memory corruption in Firefox (high 8.8)
- [CVE-2023-6860](https://insights.sbomify.com/CVE-2023-6860/): Security feature bypass in Firefox (medium 6.5)
- [CVE-2023-6859](https://insights.sbomify.com/CVE-2023-6859/): Use after free in Firefox (high 8.8)
- [CVE-2023-6858](https://insights.sbomify.com/CVE-2023-6858/): Memory corruption in Firefox (high 8.8)
- [CVE-2023-6857](https://insights.sbomify.com/CVE-2023-6857/): Race condition in Firefox (medium 5.3)
- [CVE-2023-6856](https://insights.sbomify.com/CVE-2023-6856/): Memory corruption in Firefox (high 8.8)
- [CVE-2023-6855](https://insights.sbomify.com/CVE-2023-6855/): Paid Memberships Pro <= 2.12.5 - Missing Authorization via API (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/127/