# Vulnerabilities published in 2023


- [CVE-2023-6740](https://insights.sbomify.com/CVE-2023-6740/): Privilege escalation in jar_signature (high 8.8)
- [CVE-2023-6738](https://insights.sbomify.com/CVE-2023-6738/): PageLayer <= 1.7.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via meta fields (medium 5.4)
- [CVE-2023-6737](https://insights.sbomify.com/CVE-2023-6737/): Enable Media Replace <= 4.1.4 - Reflected Cross-Site Scripting (medium 4.7)
- [CVE-2023-6736](https://insights.sbomify.com/CVE-2023-6736/): Inefficient Regular Expression Complexity in GitLab (medium 6.5)
- [CVE-2023-6735](https://insights.sbomify.com/CVE-2023-6735/): Privilege escalation in mk_tsm (high 8.8)
- [CVE-2023-6733](https://insights.sbomify.com/CVE-2023-6733/): WP-Members Membership Plugin <= 3.4.8 - Missing Authorization to Sensitive Information Exposure (medium 6.5)
- [CVE-2023-6732](https://insights.sbomify.com/CVE-2023-6732/): Ultimate Maps by Supsystic < 1.2.16 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-6731](https://insights.sbomify.com/CVE-2023-6731/): WP Show Posts <= 1.1.5 - Improper Authorization to Information Exposure (medium 4.3)
- [CVE-2023-6730](https://insights.sbomify.com/CVE-2023-6730/): Deserialization of Untrusted Data in huggingface/transformers (critical 9.0)
- [CVE-2023-6729](https://insights.sbomify.com/CVE-2023-6729/): Nokia SR OS: File Access Security Vulnerability (high 7.3)
- [CVE-2023-6728](https://insights.sbomify.com/CVE-2023-6728/): Nokia SR OS: BOF File Encryption Vulnerability (low 3.3)
- [CVE-2023-6727](https://insights.sbomify.com/CVE-2023-6727/): Leak Inaccessible Playbook Information via Channel Action IDOR (low 3.1)
- [CVE-2023-6725](https://insights.sbomify.com/CVE-2023-6725/): Tripleo-ansible: bind keys are world readable (medium 5.5)
- [CVE-2023-6724](https://insights.sbomify.com/CVE-2023-6724/): IDOR in Simgesel Software's Hearing Tracking System (Barosel) (high 8.8)
- [CVE-2023-6723](https://insights.sbomify.com/CVE-2023-6723/): Unrestricted Upload of File with Dangerous Type in Repox (critical 10.0)
- [CVE-2023-6722](https://insights.sbomify.com/CVE-2023-6722/): Relative Path Traversal in Repox (high 7.5)
- [CVE-2023-6721](https://insights.sbomify.com/CVE-2023-6721/): Improper Restriction of XML External Entity Reference in Repox (high 8.3)
- [CVE-2023-6720](https://insights.sbomify.com/CVE-2023-6720/): Cross-site Scripting in Repox (medium 5.5)
- [CVE-2023-6719](https://insights.sbomify.com/CVE-2023-6719/): Cross-site Scripting in Repox (medium 6.3)
- [CVE-2023-6718](https://insights.sbomify.com/CVE-2023-6718/): Authentication Bypass Using an Alternate Path or Channel in Repox (critical 9.4)
- [CVE-2023-6717](https://insights.sbomify.com/CVE-2023-6717/): Keycloak: xss via assertion consumer service url in saml post-binding flow (medium 6.0)
- [CVE-2023-6711](https://insights.sbomify.com/CVE-2023-6711/): Memory corruption in RTU500 series CMU Firmware (medium 5.9)
- [CVE-2023-6710](https://insights.sbomify.com/CVE-2023-6710/): Mod_cluster/mod_proxy_cluster: stored cross site scripting (medium 5.4)
- [CVE-2023-6709](https://insights.sbomify.com/CVE-2023-6709/): Improper Neutralization of Special Elements Used in a Template Engine in mlflow/mlflow (critical 10.0)
- [CVE-2023-6708](https://insights.sbomify.com/CVE-2023-6708/): SVG Support <= 2.5.7 - Authenticated (Author+) Cross-Site Scripting via SVG (medium 5.4)
- [CVE-2023-6707](https://insights.sbomify.com/CVE-2023-6707/): Use after free in Chrome (high 8.8)
- [CVE-2023-6706](https://insights.sbomify.com/CVE-2023-6706/): Use after free in Chrome (high 8.8)
- [CVE-2023-6705](https://insights.sbomify.com/CVE-2023-6705/): Use after free in Chrome (high 8.8)
- [CVE-2023-6704](https://insights.sbomify.com/CVE-2023-6704/): Use after free in Chrome (high 8.8)
- [CVE-2023-6703](https://insights.sbomify.com/CVE-2023-6703/): Use after free in Chrome (high 8.8)
- [CVE-2023-6702](https://insights.sbomify.com/CVE-2023-6702/): Memory corruption in Chrome (high 8.8)
- [CVE-2023-6701](https://insights.sbomify.com/CVE-2023-6701/): Advanced Custom Fields <= 6.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field (medium 6.4)
- [CVE-2023-6700](https://insights.sbomify.com/CVE-2023-6700/): Cookie Information | Free GDPR Consent Solution <= 2.0.22 - Authenticated (Subscriber+) Arbitrary Options Update (high 8.8)
- [CVE-2023-6699](https://insights.sbomify.com/CVE-2023-6699/): WP Compress – Image Optimizer [All-In-One] <= 6.10.33 - Unauthenticated Directory Traversal via css (critical 9.1)
- [CVE-2023-6697](https://insights.sbomify.com/CVE-2023-6697/): WP Go Maps (formerly WP Google Maps) <= 9.0.28 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-6696](https://insights.sbomify.com/CVE-2023-6696/): Missing authorization in Popup Builder – Create highly converting, mobile friendly marketing popups. (high 8.1)
- [CVE-2023-6695](https://insights.sbomify.com/CVE-2023-6695/): Beaver Themer <= 1.4.9 - Authenticated (Contributor+) Sensitive Information Exposure via shortcode (medium 6.5)
- [CVE-2023-6694](https://insights.sbomify.com/CVE-2023-6694/): Beaver Themer <= 1.4.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode (medium 6.4)
- [CVE-2023-6693](https://insights.sbomify.com/CVE-2023-6693/): Qemu: virtio-net: stack buffer overflow in virtio_net_flush_tx() (medium 4.9)
- [CVE-2023-6692](https://insights.sbomify.com/CVE-2023-6692/): Cross-site scripting in Ultimate Blocks – 25+ Gutenberg Blocks for Block Editor (medium 6.4)
- [CVE-2023-6691](https://insights.sbomify.com/CVE-2023-6691/): Code Injection vulnerability in Cambium ePMP Force 300-25 (high 7.8)
- [CVE-2023-6690](https://insights.sbomify.com/CVE-2023-6690/): Race condition in Enterprise Server (low 3.9)
- [CVE-2023-6689](https://insights.sbomify.com/CVE-2023-6689/): Cross-Site Request Forgery in EFACEC BCU 500 (high 8.2)
- [CVE-2023-6688](https://insights.sbomify.com/CVE-2023-6688/): Inefficient Regular Expression Complexity in GitLab (medium 6.5)
- [CVE-2023-6687](https://insights.sbomify.com/CVE-2023-6687/): Elastic Agent Insertion of Sensitive Information into Log File (medium 6.8)
- [CVE-2023-6684](https://insights.sbomify.com/CVE-2023-6684/): Ibtana – WordPress Website Builder <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-6683](https://insights.sbomify.com/CVE-2023-6683/): Qemu: vnc: null pointer dereference in qemu_clipboard_request() (medium 6.5)
- [CVE-2023-6682](https://insights.sbomify.com/CVE-2023-6682/): Inefficient Regular Expression Complexity in GitLab (medium 6.5)
- [CVE-2023-6681](https://insights.sbomify.com/CVE-2023-6681/): Jwcrypto: denail of service via specifically crafted jwe (medium 5.3)
- [CVE-2023-6680](https://insights.sbomify.com/CVE-2023-6680/): Improper Certificate Validation in GitLab (high 7.4)
- [CVE-2023-6679](https://insights.sbomify.com/CVE-2023-6679/): Kernel: null pointer dereference in dpll_pin_parent_pin_set() in drivers/dpll/dpll_netlink.c (medium 5.5)
- [CVE-2023-6678](https://insights.sbomify.com/CVE-2023-6678/): Inefficient Regular Expression Complexity in GitLab (medium 4.3)
- [CVE-2023-6677](https://insights.sbomify.com/CVE-2023-6677/): SQLi in Oduyo Online Collection Software (critical 9.8)
- [CVE-2023-6676](https://insights.sbomify.com/CVE-2023-6676/): Cross Site Request Forgery in National Keep's CyberMath (high 8.8)
- [CVE-2023-6675](https://insights.sbomify.com/CVE-2023-6675/): Malicious File Upload in National Keep's CyberMath (critical 9.8)
- [CVE-2023-6673](https://insights.sbomify.com/CVE-2023-6673/): Reflected XSS in National Keep's CyberMath (medium 6.1)
- [CVE-2023-6672](https://insights.sbomify.com/CVE-2023-6672/): Stored XSS in National Keep's CyberMath (medium 5.4)
- [CVE-2023-6671](https://insights.sbomify.com/CVE-2023-6671/): Cross-Site Request Forgery on OPEN JOURNAL SYSTEMS (medium 6.3)
- [CVE-2023-6660](https://insights.sbomify.com/CVE-2023-6660/): NFS client data corruption and kernel memory disclosure (medium 6.5)
- [CVE-2023-6659](https://insights.sbomify.com/CVE-2023-6659/): Campcodes Web-Based Student Clearance System login.php sql injection (medium 6.3)
- [CVE-2023-6658](https://insights.sbomify.com/CVE-2023-6658/): SourceCodester Simple Student Attendance System sql injection (medium 5.5)
- [CVE-2023-6657](https://insights.sbomify.com/CVE-2023-6657/): SourceCodester Simple Student Attendance System student_form.php sql injection (medium 5.5)
- [CVE-2023-6656](https://insights.sbomify.com/CVE-2023-6656/): DeepFaceLab DFLJPG.py deserialization (medium 5.0)
- [CVE-2023-6655](https://insights.sbomify.com/CVE-2023-6655/): Hongjing e-HR Login Interface loadhistroyorgtree sql injection (high 7.3)
- [CVE-2023-6654](https://insights.sbomify.com/CVE-2023-6654/): PHPEMS Session Data session.cls.php deserialization (medium 6.3)
- [CVE-2023-6653](https://insights.sbomify.com/CVE-2023-6653/): PHPGurukul Teacher Subject Allocation Management System Create a new Subject subject.php cross-site request forgery (medium 4.3)
- [CVE-2023-6652](https://insights.sbomify.com/CVE-2023-6652/): code-projects Matrimonial Site register.php register sql injection (high 7.3)
- [CVE-2023-6651](https://insights.sbomify.com/CVE-2023-6651/): code-projects Matrimonial Site sql injection (high 7.3)
- [CVE-2023-6650](https://insights.sbomify.com/CVE-2023-6650/): SourceCodester Simple Invoice Generator System login.php cross site scripting (medium 4.3)
- [CVE-2023-6649](https://insights.sbomify.com/CVE-2023-6649/): PHPGurukul Teacher Subject Allocation Management System index.php cross site scripting (medium 4.3)
- [CVE-2023-6648](https://insights.sbomify.com/CVE-2023-6648/): PHPGurukul Nipah Virus Testing Management System password-recovery.php sql injection (medium 6.9)
- [CVE-2023-6647](https://insights.sbomify.com/CVE-2023-6647/): AMTT HiBOS sql injection (high 7.3)
- [CVE-2023-6646](https://insights.sbomify.com/CVE-2023-6646/): linkding cross site scripting (low 3.5)
- [CVE-2023-6645](https://insights.sbomify.com/CVE-2023-6645/): Post Grid Combo – 36+ Gutenberg Blocks <= 2.2.64 - Authenticated (Contributor+) Cross-Site Scripting (medium 6.4)
- [CVE-2023-6640](https://insights.sbomify.com/CVE-2023-6640/): Silicon Labs PC Controller v5.54.0 and Earlier Denial of Service Vulnerability (medium 6.5)
- [CVE-2023-6638](https://insights.sbomify.com/CVE-2023-6638/): GTG Product Feed for Shopping <= 1.2.4 - Missing Authorization to Unauthenticated Plugin Settings Update (medium 6.5)
- [CVE-2023-6637](https://insights.sbomify.com/CVE-2023-6637/): CAOS | Host Google Analytics Locally <= 4.7.14 - Missing Authorization to Unauthenticated Plugin Settings Update (medium 6.5)
- [CVE-2023-6636](https://insights.sbomify.com/CVE-2023-6636/): Greenshift – animation and page builder blocks <= 7.6.2 - Authenticated (Administrator+) Arbitrary File Upload (high 7.2)
- [CVE-2023-6635](https://insights.sbomify.com/CVE-2023-6635/): EditorsKit <= 1.40.3 - Authenticated (Administrator+) Arbitrary File Upload (high 7.2)
- [CVE-2023-6634](https://insights.sbomify.com/CVE-2023-6634/): LearnPress <= 4.2.5.7 - Command Injection (high 8.1)
- [CVE-2023-6633](https://insights.sbomify.com/CVE-2023-6633/): Site Notes <= 2.0.0 - Admin Note Deletion via CSRF (medium 4.3)
- [CVE-2023-6632](https://insights.sbomify.com/CVE-2023-6632/): Happy Addons for Elementor <= 3.9.1.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-6631](https://insights.sbomify.com/CVE-2023-6631/): Subnet Solutions Inc. PowerSYSTEM Center Unquoted Search Path or Element (high 7.8)
- [CVE-2023-6630](https://insights.sbomify.com/CVE-2023-6630/): Contact Form 7 – Dynamic Text Extension <= 4.1.0 - Insecure Direct Object Reference (medium 4.3)
- [CVE-2023-6629](https://insights.sbomify.com/CVE-2023-6629/): POST SMTP Mailer <= 2.8.6 - Reflected Cross-Site Scripting via msg (medium 6.1)
- [CVE-2023-6627](https://insights.sbomify.com/CVE-2023-6627/): WP Go Maps < 9.0.28 - Unauthenticated Stored XSS (medium 6.1)
- [CVE-2023-6626](https://insights.sbomify.com/CVE-2023-6626/): Product Enquiry for WooCommerce < 3.1 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-6625](https://insights.sbomify.com/CVE-2023-6625/): Product Enquiry for WooCommerce < 3.1 - Arbitrary Enquiry Deletion via CSRF (medium 4.3)
- [CVE-2023-6624](https://insights.sbomify.com/CVE-2023-6624/): Cross-site scripting in Import and export users and customers (medium 4.9)
- [CVE-2023-6623](https://insights.sbomify.com/CVE-2023-6623/): Essential Blocks < 4.4.3 - Unauthenticated Local File Inclusion (critical 9.8)
- [CVE-2023-6622](https://insights.sbomify.com/CVE-2023-6622/): Kernel: null pointer dereference vulnerability in nft_dynset_init() (medium 5.5)
- [CVE-2023-6621](https://insights.sbomify.com/CVE-2023-6621/): Post SMTP < 2.8.7 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-6620](https://insights.sbomify.com/CVE-2023-6620/): Post SMTP < 2.8.7 - Admin+ SQL Injection (high 7.2)
- [CVE-2023-6619](https://insights.sbomify.com/CVE-2023-6619/): SourceCodester Simple Student Attendance System class_form.php sql injection (medium 5.5)
- [CVE-2023-6618](https://insights.sbomify.com/CVE-2023-6618/): SourceCodester Simple Student Attendance System index.php file inclusion (medium 5.5)
- [CVE-2023-6617](https://insights.sbomify.com/CVE-2023-6617/): SourceCodester Simple Student Attendance System attendance.php sql injection (medium 5.5)
- [CVE-2023-6616](https://insights.sbomify.com/CVE-2023-6616/): SourceCodester Simple Student Attendance System index.php cross site scripting (low 3.5)
- [CVE-2023-6615](https://insights.sbomify.com/CVE-2023-6615/): Typecho manage-users.php information disclosure (low 3.5)
- [CVE-2023-6614](https://insights.sbomify.com/CVE-2023-6614/): Typecho Page manage-pages.php backdoor (low 2.7)
- [CVE-2023-6613](https://insights.sbomify.com/CVE-2023-6613/): Typecho Logo options-theme.php cross site scripting (low 2.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/129/