# Vulnerabilities published in 2023


- [CVE-2023-6854](https://insights.sbomify.com/CVE-2023-6854/): Breakdance <= 1.7.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via custom postmeta (medium 6.4)
- [CVE-2023-6853](https://insights.sbomify.com/CVE-2023-6853/): kalcaddle KodExplorer app.php index server-side request forgery (medium 6.3)
- [CVE-2023-6852](https://insights.sbomify.com/CVE-2023-6852/): kalcaddle KodExplorer app.php server-side request forgery (medium 6.3)
- [CVE-2023-6851](https://insights.sbomify.com/CVE-2023-6851/): kalcaddle KodExplorer ZIP Archive app.php unzipList code injection (medium 6.3)
- [CVE-2023-6850](https://insights.sbomify.com/CVE-2023-6850/): kalcaddle KodExplorer API Endpoint unrestricted upload (medium 6.3)
- [CVE-2023-6849](https://insights.sbomify.com/CVE-2023-6849/): kalcaddle kodbox app.php cover server-side request forgery (high 7.3)
- [CVE-2023-6848](https://insights.sbomify.com/CVE-2023-6848/): kalcaddle kodbox index.class.php check command injection (high 7.3)
- [CVE-2023-6847](https://insights.sbomify.com/CVE-2023-6847/): Improper Authentication in GitHub Enterprise Server leading to Authentication Bypass for Public Repository Data (high 7.5)
- [CVE-2023-6846](https://insights.sbomify.com/CVE-2023-6846/): File Manager Pro <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Upload (high 8.8)
- [CVE-2023-6845](https://insights.sbomify.com/CVE-2023-6845/): CommentTweets <= 0.6 - Settings Update via CSRF (high 8.8)
- [CVE-2023-6844](https://insights.sbomify.com/CVE-2023-6844/): iframe <= 5.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode (medium 5.0)
- [CVE-2023-6843](https://insights.sbomify.com/CVE-2023-6843/): easy.jobs < 2.4.7 - Subscriber+ Arbitrary Settings Update (medium 4.3)
- [CVE-2023-6842](https://insights.sbomify.com/CVE-2023-6842/): Formidable Forms <= 6.7 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2023-6841](https://insights.sbomify.com/CVE-2023-6841/): Keycloak: amount of attributes per object is not limited and it may lead to dos (high 7.5)
- [CVE-2023-6840](https://insights.sbomify.com/CVE-2023-6840/): Missing Authorization in GitLab (medium 6.7)
- [CVE-2023-6839](https://insights.sbomify.com/CVE-2023-6839/): Information disclosure in WSO2 API Manager (medium 5.3)
- [CVE-2023-6838](https://insights.sbomify.com/CVE-2023-6838/): Cross-site scripting in WSO2 API Manager (medium 6.1)
- [CVE-2023-6837](https://insights.sbomify.com/CVE-2023-6837/): Multiple WSO2 products vulnerable to perform user impersonatoin using JIT provisioning (high 8.5)
- [CVE-2023-6836](https://insights.sbomify.com/CVE-2023-6836/): WSO2 products vulnerable to XML External Entity attack (medium 4.6)
- [CVE-2023-6835](https://insights.sbomify.com/CVE-2023-6835/): WSO2 API Manager allows attackers to change the API rating (medium 4.3)
- [CVE-2023-6833](https://insights.sbomify.com/CVE-2023-6833/): Information Exposure Vulnerability in Hitachi Ops Center Administrator (medium 4.4)
- [CVE-2023-6832](https://insights.sbomify.com/CVE-2023-6832/): Business Logic Errors in microweber/microweber (medium 6.0)
- [CVE-2023-6831](https://insights.sbomify.com/CVE-2023-6831/): Path Traversal: '\..\filename' in mlflow/mlflow (high 8.1)
- [CVE-2023-6830](https://insights.sbomify.com/CVE-2023-6830/): Formidable Forms <= 6.7 - HTML Injection (medium 6.5)
- [CVE-2023-6828](https://insights.sbomify.com/CVE-2023-6828/): ARForms <= 1.5.8 - Unauthenticated Stored Cross-Site Scripting via arf_http_referrer_url (high 7.2)
- [CVE-2023-6827](https://insights.sbomify.com/CVE-2023-6827/): Essential Real Estate <= 4.3.5 - Authenticated (Subscriber+) Arbitrary File Upload (high 7.5)
- [CVE-2023-6826](https://insights.sbomify.com/CVE-2023-6826/): E2Pdf <= 1.20.25 - Authenticated (Administrator+) Arbitrary File Upload (high 7.2)
- [CVE-2023-6825](https://insights.sbomify.com/CVE-2023-6825/): File Manager And File Manager Pro (Multiple Versions) - Directory Traversal (critical 9.9)
- [CVE-2023-6824](https://insights.sbomify.com/CVE-2023-6824/): WP Customer Area < 8.2.1 - Subscriber+ Account Address Leak (medium 6.5)
- [CVE-2023-6821](https://insights.sbomify.com/CVE-2023-6821/): Error Log Viewer < 1.1.3 - Directory Listing to Sensitive Data Exposure (medium 6.5)
- [CVE-2023-6817](https://insights.sbomify.com/CVE-2023-6817/): Use-after-free in Linux kernel's netfilter: nf_tables component (high 7.8)
- [CVE-2023-6816](https://insights.sbomify.com/CVE-2023-6816/): Xorg-x11-server: heap buffer overflow in devicefocusevent and procxiquerypointer (critical 9.8)
- [CVE-2023-6815](https://insights.sbomify.com/CVE-2023-6815/): Privilege escalation in MELSEC iQ-R Series SIL2 Process CPU R08PSFCPU (medium 6.5)
- [CVE-2023-6814](https://insights.sbomify.com/CVE-2023-6814/): Information Exposure Vulnerability in Cosminexus Component Container (medium 5.6)
- [CVE-2023-6813](https://insights.sbomify.com/CVE-2023-6813/): Login by Auth0 <= 4.6.0 - Reflected Cross-Site Scripting via wle (medium 6.1)
- [CVE-2023-6812](https://insights.sbomify.com/CVE-2023-6812/): WP Compress – Image Optimizer [All-In-One] <= 6.20.01 - Open Redirect via css (medium 4.3)
- [CVE-2023-6811](https://insights.sbomify.com/CVE-2023-6811/): Language Translate Widget for WordPress – ConveyThis <= 223 - Unauthenticated Stored Cross-Site Scripting via api_key (high 7.2)
- [CVE-2023-6810](https://insights.sbomify.com/CVE-2023-6810/): ClickCease Click Fraud Protection <= 3.2.4 - Improper Authorization to sensitive information exposure via get_settings (medium 4.3)
- [CVE-2023-6809](https://insights.sbomify.com/CVE-2023-6809/): Custom fields shortcode <= 0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode (medium 6.4)
- [CVE-2023-6808](https://insights.sbomify.com/CVE-2023-6808/): Cross-site scripting in Booking for Appointments and Events Calendar – Amelia (medium 6.4)
- [CVE-2023-6807](https://insights.sbomify.com/CVE-2023-6807/): GeneratePress Premium <= 2.3.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Custom Meta (medium 6.4)
- [CVE-2023-6806](https://insights.sbomify.com/CVE-2023-6806/): Starbox <= 3.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Job Settings (medium 6.4)
- [CVE-2023-6805](https://insights.sbomify.com/CVE-2023-6805/): Server-side request forgery in RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator (medium 6.4)
- [CVE-2023-6804](https://insights.sbomify.com/CVE-2023-6804/): Improper Privilege Management allows for arbitrary workflows to be run (medium 6.5)
- [CVE-2023-6803](https://insights.sbomify.com/CVE-2023-6803/): Race Condition allows Unauthorized Outside Collaborator (medium 5.8)
- [CVE-2023-6802](https://insights.sbomify.com/CVE-2023-6802/): Sensitive Information in Log File in GitHub Enterprise Server (high 7.2)
- [CVE-2023-6801](https://insights.sbomify.com/CVE-2023-6801/): Cross-site scripting in RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator (medium 6.4)
- [CVE-2023-6799](https://insights.sbomify.com/CVE-2023-6799/): WP Reset <= 2.0 - Sensitive Information Exposure due to Insufficient Randomness (medium 5.9)
- [CVE-2023-6798](https://insights.sbomify.com/CVE-2023-6798/): Missing authorization in RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator (medium 5.4)
- [CVE-2023-6795](https://insights.sbomify.com/CVE-2023-6795/): PAN-OS: OS Command Injection Vulnerability in the Web Interface (medium 5.5)
- [CVE-2023-6794](https://insights.sbomify.com/CVE-2023-6794/): PAN-OS: File Upload Vulnerability in the Web Interface (medium 5.5)
- [CVE-2023-6793](https://insights.sbomify.com/CVE-2023-6793/): PAN-OS: XML API Keys Revoked by Read-Only PAN-OS Administrator (low 2.7)
- [CVE-2023-6792](https://insights.sbomify.com/CVE-2023-6792/): PAN-OS: OS Command Injection Vulnerability in the XML API (medium 5.5)
- [CVE-2023-6791](https://insights.sbomify.com/CVE-2023-6791/): PAN-OS: Plaintext Disclosure of External System Integration Credentials (medium 4.9)
- [CVE-2023-6790](https://insights.sbomify.com/CVE-2023-6790/): PAN-OS: DOM-Based Cross-Site Scripting (XSS) Vulnerability in the Web Interface (high 8.8)
- [CVE-2023-6789](https://insights.sbomify.com/CVE-2023-6789/): PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface (medium 4.3)
- [CVE-2023-6788](https://insights.sbomify.com/CVE-2023-6788/): Metform Elementor Contact Form Builder <= 3.8.1 - Cross-Site Request Forgery (medium 5.4)
- [CVE-2023-6787](https://insights.sbomify.com/CVE-2023-6787/): Keycloak: session hijacking via re-authentication (medium 6.5)
- [CVE-2023-6786](https://insights.sbomify.com/CVE-2023-6786/): Payment Gateway for Telcell <= 2.0.1 - Unauthenticated Open Redirect (medium 6.1)
- [CVE-2023-6785](https://insights.sbomify.com/CVE-2023-6785/): Download Manager <= 3.2.84 - Missing Authorization (medium 5.3)
- [CVE-2023-6784](https://insights.sbomify.com/CVE-2023-6784/): Potential Use of the Sitefinity System for Distribution of Phishing Emails (medium 4.7)
- [CVE-2023-6783](https://insights.sbomify.com/CVE-2023-6783/): WolfNet IDX for WordPress <= 1.19.1 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-6782](https://insights.sbomify.com/CVE-2023-6782/): AMP for WP – Accelerated Mobile Pages <= 1.0.92 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-6781](https://insights.sbomify.com/CVE-2023-6781/): Orbit Fox Companion <= 2.10.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via custom fields (medium 6.4)
- [CVE-2023-6780](https://insights.sbomify.com/CVE-2023-6780/): Glibc: integer overflow in __vsyslog_internal() (medium 5.3)
- [CVE-2023-6779](https://insights.sbomify.com/CVE-2023-6779/): Glibc: off-by-one heap-based buffer overflow in __vsyslog_internal() (high 8.2)
- [CVE-2023-6778](https://insights.sbomify.com/CVE-2023-6778/): Cross-site Scripting (XSS) - Stored in allegroai/clearml-server (medium 5.4)
- [CVE-2023-6777](https://insights.sbomify.com/CVE-2023-6777/): WP Go Maps (formerly WP Google Maps) <= 9.0.34 - Information Exposure to Potential Denial of Service (medium 5.3)
- [CVE-2023-6776](https://insights.sbomify.com/CVE-2023-6776/): 3D Flipbook <= 1.15.2 - Authenticated (Contributor+) Cross-Site Scripting via Ready Function (medium 6.4)
- [CVE-2023-6775](https://insights.sbomify.com/CVE-2023-6775/): CodeAstro POS and Inventory Management System item_con cross site scripting (low 3.5)
- [CVE-2023-6774](https://insights.sbomify.com/CVE-2023-6774/): CodeAstro POS and Inventory Management System register_account cross site scripting (medium 4.3)
- [CVE-2023-6773](https://insights.sbomify.com/CVE-2023-6773/): CodeAstro POS and Inventory Management System User Creation register_account access control (medium 4.3)
- [CVE-2023-6772](https://insights.sbomify.com/CVE-2023-6772/): OTCMS ind_backstage.php sql injection (medium 4.7)
- [CVE-2023-6771](https://insights.sbomify.com/CVE-2023-6771/): SourceCodester Simple Student Attendance System actions.class.php save_attendance sql injection (medium 5.5)
- [CVE-2023-6769](https://insights.sbomify.com/CVE-2023-6769/): Stored XSS vulnerability in Amazing Little Poll (medium 6.5)
- [CVE-2023-6768](https://insights.sbomify.com/CVE-2023-6768/): Authentication bypass vulnerability in Amazing Little Poll (critical 9.4)
- [CVE-2023-6767](https://insights.sbomify.com/CVE-2023-6767/): SourceCodester Wedding Guest e-Book add-guest.php cross site scripting (medium 4.3)
- [CVE-2023-6766](https://insights.sbomify.com/CVE-2023-6766/): PHPGurukul Teacher Subject Allocation Management System Delete Course course.php cross-site request forgery (medium 4.3)
- [CVE-2023-6765](https://insights.sbomify.com/CVE-2023-6765/): SourceCodester Online Tours & Travels Management System email_setup.php prepare sql injection (medium 5.5)
- [CVE-2023-6764](https://insights.sbomify.com/CVE-2023-6764/): Memory corruption in ATP series firmware (high 8.1)
- [CVE-2023-6762](https://insights.sbomify.com/CVE-2023-6762/): Thecosy IceCMS Article permission (medium 5.4)
- [CVE-2023-6761](https://insights.sbomify.com/CVE-2023-6761/): Thecosy IceCMS User Data access control (medium 4.3)
- [CVE-2023-6760](https://insights.sbomify.com/CVE-2023-6760/): Thecosy IceCMS user session (medium 6.3)
- [CVE-2023-6759](https://insights.sbomify.com/CVE-2023-6759/): Thecosy IceCMS Love resource improper enforcement of a single, unique action (medium 5.3)
- [CVE-2023-6758](https://insights.sbomify.com/CVE-2023-6758/): Thecosy IceCMS API PlanetCommentList access control (medium 5.3)
- [CVE-2023-6757](https://insights.sbomify.com/CVE-2023-6757/): Thecosy IceCMS API PlanetUser information disclosure (medium 5.3)
- [CVE-2023-6756](https://insights.sbomify.com/CVE-2023-6756/): Thecosy IceCMS Captcha login excessive authentication (medium 5.3)
- [CVE-2023-6755](https://insights.sbomify.com/CVE-2023-6755/): DedeBIZ content_batchup_action.php sql injection (medium 4.7)
- [CVE-2023-6753](https://insights.sbomify.com/CVE-2023-6753/): Path Traversal in mlflow/mlflow (critical 9.6)
- [CVE-2023-6751](https://insights.sbomify.com/CVE-2023-6751/): Hostinger <= 1.9.7 - Missing Authorization to Maintenance Mode Activation (high 7.3)
- [CVE-2023-6750](https://insights.sbomify.com/CVE-2023-6750/): Clone < 2.4.3 - Unauthenticated Backup Download (high 7.5)
- [CVE-2023-6749](https://insights.sbomify.com/CVE-2023-6749/): Unchecked user input length in the Zephyr Settings Shell (high 8.0)
- [CVE-2023-6748](https://insights.sbomify.com/CVE-2023-6748/): Custom Field Template <= 2.6.1 - Authenticated(Contributor+) Information Exposure (medium 4.3)
- [CVE-2023-6747](https://insights.sbomify.com/CVE-2023-6747/): FooGallery Premium <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2023-6746](https://insights.sbomify.com/CVE-2023-6746/): Sensitive Information in Log File in GitHub Enterprise Server (high 8.1)
- [CVE-2023-6745](https://insights.sbomify.com/CVE-2023-6745/): Custom Field Template <= 2.6.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode (medium 6.4)
- [CVE-2023-6744](https://insights.sbomify.com/CVE-2023-6744/): Divi <= 4.23.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-6743](https://insights.sbomify.com/CVE-2023-6743/): Unlimited Elements for Elementor <= 1.5.89 - Authenticated(Contributor+) Remote Code Execution via template import (high 8.8)
- [CVE-2023-6742](https://insights.sbomify.com/CVE-2023-6742/): Envira Gallery Lite <= 1.8.7.2 - Missing Authorization to Gallery Modification via envira_gallery_insert_images (medium 4.3)
- [CVE-2023-6741](https://insights.sbomify.com/CVE-2023-6741/): WP Customer Area < 8.2.1 - Subscriber+ Account Address Update (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/128/