# Vulnerabilities published in 2023


- [CVE-2023-6271](https://insights.sbomify.com/CVE-2023-6271/): Backup Migration Staging < 1.3.6 - Sensitive Data Exposure (high 7.5)
- [CVE-2023-6270](https://insights.sbomify.com/CVE-2023-6270/): Kernel: aoe: improper reference count leads to use-after-free vulnerability (high 7.0)
- [CVE-2023-6269](https://insights.sbomify.com/CVE-2023-6269/): Command injection in OpenScape BCF (critical 10.0)
- [CVE-2023-6268](https://insights.sbomify.com/CVE-2023-6268/): JSON Content Importer < 1.5.4 - Reflected XSS (medium 6.1)
- [CVE-2023-6267](https://insights.sbomify.com/CVE-2023-6267/): Quarkus: json payload getting processed prior to security checks when rest resources are used with annotations. (high 8.6)
- [CVE-2023-6266](https://insights.sbomify.com/CVE-2023-6266/): Backup Migration <= 1.3.6 - Unauthenticated Arbitrary Backup Download to Sensitive Information Exposure (high 7.5)
- [CVE-2023-6265](https://insights.sbomify.com/CVE-2023-6265/): DrayTek Vigor2960 mainfunction.cgi dumpSyslog 'option' directory traversal (medium 6.5)
- [CVE-2023-6264](https://insights.sbomify.com/CVE-2023-6264/): Information disclosure in Server (medium 5.3)
- [CVE-2023-6263](https://insights.sbomify.com/CVE-2023-6263/): Server Spoofing Vulnerability in NxCloud (high 8.3)
- [CVE-2023-6260](https://insights.sbomify.com/CVE-2023-6260/): Web UI OS Command Injection in Brivo ACS100, ACS300 (high 7.4)
- [CVE-2023-6259](https://insights.sbomify.com/CVE-2023-6259/): Local Access to Sensitive Data in Brivo ACS100 and ACS300 (high 7.1)
- [CVE-2023-6258](https://insights.sbomify.com/CVE-2023-6258/): Pkcs11-provider: side-channel proofing pkcs#1 1.5 paths (high 8.1)
- [CVE-2023-6257](https://insights.sbomify.com/CVE-2023-6257/): Inline Related Posts < 3.6.0 - Subscriber+ Password Protected Post Read (medium 4.3)
- [CVE-2023-6255](https://insights.sbomify.com/CVE-2023-6255/): Hardcoded Credentals in SoliClub Mobile App (high 7.5)
- [CVE-2023-6254](https://insights.sbomify.com/CVE-2023-6254/): Password is send back to client (high 8.1)
- [CVE-2023-6253](https://insights.sbomify.com/CVE-2023-6253/): Saved Uninstall Key in Digital Guardian Agent Uninstaller (medium 6.0)
- [CVE-2023-6252](https://insights.sbomify.com/CVE-2023-6252/): Path traversal vulnerability in Chameleon Power products (high 7.5)
- [CVE-2023-6251](https://insights.sbomify.com/CVE-2023-6251/): CSRF in delete_user_message (low 3.5)
- [CVE-2023-6250](https://insights.sbomify.com/CVE-2023-6250/): BestWebSoft's Like & Share < 2.74 - Unauthenticated Password Protected Post Read (high 7.5)
- [CVE-2023-6249](https://insights.sbomify.com/CVE-2023-6249/): ipm: signed to unsigned conversion problem in esp32_ipm_send (high 8.0)
- [CVE-2023-6248](https://insights.sbomify.com/CVE-2023-6248/): Data leakage and arbitrary remote code execution in Syrus cloud devices (critical 10.0)
- [CVE-2023-6247](https://insights.sbomify.com/CVE-2023-6247/): Null dereference in OpenVPN 3 Core Library (medium 6.5)
- [CVE-2023-6246](https://insights.sbomify.com/CVE-2023-6246/): Glibc: heap-based buffer overflow in __vsyslog_internal() (high 8.4)
- [CVE-2023-6245](https://insights.sbomify.com/CVE-2023-6245/): Infinite decoding loop through specially crafted payload (high 7.5)
- [CVE-2023-6244](https://insights.sbomify.com/CVE-2023-6244/): Cross-site request forgery in EventON (Pro) - WordPress Virtual Event Calendar Plugin (medium 6.5)
- [CVE-2023-6243](https://insights.sbomify.com/CVE-2023-6243/): EventON PRO - WordPress Virtual Event Calendar Plugin <= 4.6.8 - Cross-Site Request Forgery via admin_test_email (medium 4.3)
- [CVE-2023-6242](https://insights.sbomify.com/CVE-2023-6242/): Cross-site request forgery in EventON (Pro) - WordPress Virtual Event Calendar Plugin (medium 6.5)
- [CVE-2023-6241](https://insights.sbomify.com/CVE-2023-6241/): Mali GPU Kernel Driver allows improper GPU memory processing operations (high 7.8)
- [CVE-2023-6240](https://insights.sbomify.com/CVE-2023-6240/): Kernel: marvin vulnerability side-channel leakage in the rsa decryption operation (medium 6.5)
- [CVE-2023-6239](https://insights.sbomify.com/CVE-2023-6239/): Incorrect calculation of effective permissions (medium 5.4)
- [CVE-2023-6238](https://insights.sbomify.com/CVE-2023-6238/): Kernel: nvme: memory corruption via unprivileged user passthrough (medium 6.7)
- [CVE-2023-6237](https://insights.sbomify.com/CVE-2023-6237/): Excessive time spent checking invalid RSA public keys (medium 5.9)
- [CVE-2023-6236](https://insights.sbomify.com/CVE-2023-6236/): Eap: oidc app attempting to access the second tenant, the user should be prompted to log (high 7.3)
- [CVE-2023-6235](https://insights.sbomify.com/CVE-2023-6235/): Arbitrary code execution in Duet Display (high 7.8)
- [CVE-2023-6234](https://insights.sbomify.com/CVE-2023-6234/): Memory corruption in C1333P (critical 9.8)
- [CVE-2023-6233](https://insights.sbomify.com/CVE-2023-6233/): Memory corruption in C1333P (critical 9.8)
- [CVE-2023-6232](https://insights.sbomify.com/CVE-2023-6232/): Memory corruption in C1333P (critical 9.8)
- [CVE-2023-6231](https://insights.sbomify.com/CVE-2023-6231/): Memory corruption in C1333P (critical 9.8)
- [CVE-2023-6230](https://insights.sbomify.com/CVE-2023-6230/): Memory corruption in C1333P (critical 9.8)
- [CVE-2023-6229](https://insights.sbomify.com/CVE-2023-6229/): Memory corruption in C1333P (critical 9.8)
- [CVE-2023-6228](https://insights.sbomify.com/CVE-2023-6228/): Libtiff: heap-based buffer overflow in cpstriptotile() in tools/tiffcp.c (low 3.3)
- [CVE-2023-6226](https://insights.sbomify.com/CVE-2023-6226/): WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Insecure Direct Object Reference to Information Disclosure (medium 4.3)
- [CVE-2023-6225](https://insights.sbomify.com/CVE-2023-6225/): WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2023-6223](https://insights.sbomify.com/CVE-2023-6223/): LearnPress <= 4.2.5.7 - Insecure Direct Object Reference to Information Disclosure (medium 4.3)
- [CVE-2023-6222](https://insights.sbomify.com/CVE-2023-6222/): Quttera Web Malware Scanner < 3.4.2.1 - Admin+ Path Traversal (high 7.2)
- [CVE-2023-6221](https://insights.sbomify.com/CVE-2023-6221/): MachineSense FeverWarn Missing Authentication for Critical Function (high 7.7)
- [CVE-2023-6220](https://insights.sbomify.com/CVE-2023-6220/): Piotnet Forms <= 1.0.28 - Unauthenticated Arbitrary File Upload (high 8.1)
- [CVE-2023-6219](https://insights.sbomify.com/CVE-2023-6219/): BookingPress <= 1.0.76 - Authenticated (Administrator+) Arbitrary File Upload (high 7.2)
- [CVE-2023-6218](https://insights.sbomify.com/CVE-2023-6218/): MOVEit Transfer Group Admin Privilege Escalation (high 7.2)
- [CVE-2023-6217](https://insights.sbomify.com/CVE-2023-6217/): MOVEit Transfer XSS via MOVEit Gateway (high 7.1)
- [CVE-2023-6215](https://insights.sbomify.com/CVE-2023-6215/): HP Sure Start IFD Protection - BIOS Security Update (high 7.2)
- [CVE-2023-6214](https://insights.sbomify.com/CVE-2023-6214/): HT Mega – Absolute Addons For Elementor <= 2.4.6 - Sensitive Information Exposure via purchased_products (high 7.5)
- [CVE-2023-6213](https://insights.sbomify.com/CVE-2023-6213/): Memory corruption in Firefox (high 8.8)
- [CVE-2023-6212](https://insights.sbomify.com/CVE-2023-6212/): Memory corruption in Firefox (high 8.8)
- [CVE-2023-6211](https://insights.sbomify.com/CVE-2023-6211/): Security feature bypass in Firefox (medium 6.5)
- [CVE-2023-6210](https://insights.sbomify.com/CVE-2023-6210/): Security feature bypass in Firefox (medium 6.5)
- [CVE-2023-6209](https://insights.sbomify.com/CVE-2023-6209/): Path traversal in Firefox (medium 6.5)
- [CVE-2023-6208](https://insights.sbomify.com/CVE-2023-6208/): Information disclosure in Firefox (high 8.8)
- [CVE-2023-6207](https://insights.sbomify.com/CVE-2023-6207/): Use after free in Firefox (high 8.8)
- [CVE-2023-6206](https://insights.sbomify.com/CVE-2023-6206/): Security feature bypass in Firefox (medium 5.4)
- [CVE-2023-6205](https://insights.sbomify.com/CVE-2023-6205/): Use after free in Firefox (medium 6.5)
- [CVE-2023-6204](https://insights.sbomify.com/CVE-2023-6204/): Memory corruption in Firefox (medium 6.5)
- [CVE-2023-6203](https://insights.sbomify.com/CVE-2023-6203/): The Events Calendar < 6.2.8.1 - Unauthenticated Arbitrary Password Protected Post Read (high 7.5)
- [CVE-2023-6202](https://insights.sbomify.com/CVE-2023-6202/): Insecure Direct Object Reference in /plugins/focalboard/ api/v2/users of Mattermost Boards (medium 4.3)
- [CVE-2023-6201](https://insights.sbomify.com/CVE-2023-6201/): Command Injection in Univera Panorama Framework (high 8.8)
- [CVE-2023-6200](https://insights.sbomify.com/CVE-2023-6200/): Kernel: icmpv6 router advertisement packets, aka linux tcp/ip remote code execution vulnerability (high 7.5)
- [CVE-2023-6199](https://insights.sbomify.com/CVE-2023-6199/): Book Stack v23.10.2 - LFR via Blind SSRF (medium 6.5)
- [CVE-2023-6198](https://insights.sbomify.com/CVE-2023-6198/): Hard Coded Credential (critical 9.3)
- [CVE-2023-6197](https://insights.sbomify.com/CVE-2023-6197/): Audio Merchant <= 5.0.4 - Cross-Site Request Forgery to Settings Modifcation and Stored Cross-Site Scripting (medium 5.4)
- [CVE-2023-6196](https://insights.sbomify.com/CVE-2023-6196/): Audio Merchant <= 5.0.4 - Cross-Site Request Forgery to Arbitrary File Upload (high 8.8)
- [CVE-2023-6195](https://insights.sbomify.com/CVE-2023-6195/): Server-Side Request Forgery (SSRF) in GitLab (low 2.6)
- [CVE-2023-6194](https://insights.sbomify.com/CVE-2023-6194/): XML external entity in Eclipse Memory Analyzer (tools.mat) (low 2.8)
- [CVE-2023-6193](https://insights.sbomify.com/CVE-2023-6193/): Unbounded queuing of path validation messages in cloudflare-quiche (medium 5.3)
- [CVE-2023-6191](https://insights.sbomify.com/CVE-2023-6191/): SQLi in WebPDKS (critical 9.8)
- [CVE-2023-6190](https://insights.sbomify.com/CVE-2023-6190/): Authenicated Path Traversal in İzmir Katip Çelebi University (critical 9.8)
- [CVE-2023-6189](https://insights.sbomify.com/CVE-2023-6189/): Improper Permission Handling in M-Files Server (medium 4.3)
- [CVE-2023-6188](https://insights.sbomify.com/CVE-2023-6188/): GetSimpleCMS theme-edit.php code injection (medium 4.7)
- [CVE-2023-6187](https://insights.sbomify.com/CVE-2023-6187/): Paid Memberships Pro <= 2.12.3 - Authenticated (Subscriber+) Arbitrary File Upload (high 7.5)
- [CVE-2023-6186](https://insights.sbomify.com/CVE-2023-6186/): Link targets allow arbitrary script execution (high 8.3)
- [CVE-2023-6185](https://insights.sbomify.com/CVE-2023-6185/): Improper input validation enabling arbitrary Gstreamer pipeline injection (high 8.3)
- [CVE-2023-6184](https://insights.sbomify.com/CVE-2023-6184/): Cross-site scripting in Citrix Session Recording (medium 5.0)
- [CVE-2023-6181](https://insights.sbomify.com/CVE-2023-6181/): Other in Android (critical 9.8)
- [CVE-2023-6180](https://insights.sbomify.com/CVE-2023-6180/): Resource exhaustion via memory leak in tokio-boring (medium 5.3)
- [CVE-2023-6179](https://insights.sbomify.com/CVE-2023-6179/): Incorrect Permission assignment to program executable folders (high 7.8)
- [CVE-2023-6178](https://insights.sbomify.com/CVE-2023-6178/): Path traversal in Nessus Agent (medium 6.8)
- [CVE-2023-6176](https://insights.sbomify.com/CVE-2023-6176/): Kernel: local dos vulnerability in scatterwalk_copychunks (medium 4.7)
- [CVE-2023-6175](https://insights.sbomify.com/CVE-2023-6175/): Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in Wireshark (high 7.8)
- [CVE-2023-6174](https://insights.sbomify.com/CVE-2023-6174/): Out-of-bounds Read in Wireshark (medium 6.3)
- [CVE-2023-6173](https://insights.sbomify.com/CVE-2023-6173/): SQLi in TeoSOFT Software TeoBASE (critical 9.8)
- [CVE-2023-6166](https://insights.sbomify.com/CVE-2023-6166/): Quiz Maker < 6.4.9.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-6165](https://insights.sbomify.com/CVE-2023-6165/): Restrict Usernames Emails Characters Plugin < 3.1.4 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-6164](https://insights.sbomify.com/CVE-2023-6164/): MainWP Dashboard <= 4.5.1.2 - Authenticated(Administrator+) CSS Injection (low 2.2)
- [CVE-2023-6163](https://insights.sbomify.com/CVE-2023-6163/): WP Crowdfunding < 2.1.10 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-6161](https://insights.sbomify.com/CVE-2023-6161/): WP Crowdfunding < 2.1.9 - Reflected XSS (medium 6.1)
- [CVE-2023-6160](https://insights.sbomify.com/CVE-2023-6160/): LifterLMS <= 7.4.2 - Authenticated(Administrator+) Directory Traversal to Arbitrary CSV File Deletion (low 3.3)
- [CVE-2023-6159](https://insights.sbomify.com/CVE-2023-6159/): Inefficient Regular Expression Complexity in GitLab (medium 6.5)
- [CVE-2023-6158](https://insights.sbomify.com/CVE-2023-6158/): Missing authorization in EventON (Pro) - WordPress Virtual Event Calendar Plugin (medium 6.5)
- [CVE-2023-6157](https://insights.sbomify.com/CVE-2023-6157/): Livestatus injection in ajax_search (high 7.6)
- [CVE-2023-6156](https://insights.sbomify.com/CVE-2023-6156/): Livestatus injection in availability timeline (high 7.6)
- [CVE-2023-6155](https://insights.sbomify.com/CVE-2023-6155/): Quiz Maker < 6.4.9.5 - Unauthenticated Email Address Disclosure (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/133/