# Vulnerabilities published in 2023


- [CVE-2023-6154](https://insights.sbomify.com/CVE-2023-6154/): Local privilege escalation in Bitdefender Total Security (VA-11168) (high 7.8)
- [CVE-2023-6153](https://insights.sbomify.com/CVE-2023-6153/): Authentication Bypass in TeoSOFT Software TeoBASE (critical 9.8)
- [CVE-2023-6152](https://insights.sbomify.com/CVE-2023-6152/): Email Validation Bypass And Preventing Sign Up From Email's Owner (medium 5.4)
- [CVE-2023-6151](https://insights.sbomify.com/CVE-2023-6151/): Information Disclosure in Eskom E-municipality (high 7.5)
- [CVE-2023-6150](https://insights.sbomify.com/CVE-2023-6150/): Information Disclosure in Eskom E-municipality (high 7.5)
- [CVE-2023-6149](https://insights.sbomify.com/CVE-2023-6149/): Possible XXE vulnerability in Jenkins Plugin for Qualys Web Application Security (medium 5.7)
- [CVE-2023-6148](https://insights.sbomify.com/CVE-2023-6148/): Possible XSS vulnerability in Jenkins Plugin for Qualys Policy Compliance (medium 5.7)
- [CVE-2023-6147](https://insights.sbomify.com/CVE-2023-6147/): Possible XXE vulnerability in Jenkins Plugin for Qualys Policy Compliance (medium 5.7)
- [CVE-2023-6146](https://insights.sbomify.com/CVE-2023-6146/): Stored XSS Vulnerability in QualysGuard VM/PC (medium 5.7)
- [CVE-2023-6145](https://insights.sbomify.com/CVE-2023-6145/): SQLi in Softomi E-commerce Software (critical 9.8)
- [CVE-2023-6144](https://insights.sbomify.com/CVE-2023-6144/): Dev Blog v1.0 - ATO (critical 9.1)
- [CVE-2023-6143](https://insights.sbomify.com/CVE-2023-6143/): Mali GPU Kernel Driver allows improper GPU memory processing operations (high 8.4)
- [CVE-2023-6142](https://insights.sbomify.com/CVE-2023-6142/): Dev Blog v1.0 - Stored XSS (medium 5.4)
- [CVE-2023-6141](https://insights.sbomify.com/CVE-2023-6141/): Essential Real Estate < 4.4.0 - Subscriber+ Stored XSS (medium 5.4)
- [CVE-2023-6140](https://insights.sbomify.com/CVE-2023-6140/): Essential Real Estate < 4.4 - Subscriber+ Arbitrary File Upload (high 8.8)
- [CVE-2023-6139](https://insights.sbomify.com/CVE-2023-6139/): Essential Real Estate < 4.4.0 - Subscriber+ Denial of Service via Arbitrary Option Update (medium 6.5)
- [CVE-2023-6138](https://insights.sbomify.com/CVE-2023-6138/): Other in Certain HP Workstation PCs (high 7.9)
- [CVE-2023-6137](https://insights.sbomify.com/CVE-2023-6137/): WordPress Frontier Post Plugin <= 6.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-6136](https://insights.sbomify.com/CVE-2023-6136/): WordPress Debug Log Manager Plugin <= 2.3.0 is vulnerable to Sensitive Data Exposure (medium 5.3)
- [CVE-2023-6135](https://insights.sbomify.com/CVE-2023-6135/): Weak cryptography in Firefox (medium 4.3)
- [CVE-2023-6134](https://insights.sbomify.com/CVE-2023-6134/): Keycloak: reflected xss via wildcard in oidc redirect_uri (medium 4.6)
- [CVE-2023-6133](https://insights.sbomify.com/CVE-2023-6133/): Forminator <= 1.27.0 - Authenticated (Administrator+) Arbitrary File Upload (medium 6.6)
- [CVE-2023-6132](https://insights.sbomify.com/CVE-2023-6132/): AVEVA Edge products Uncontrolled Search Path Element (high 7.3)
- [CVE-2023-6131](https://insights.sbomify.com/CVE-2023-6131/): Code Injection in salesagility/suitecrm (high 7.2)
- [CVE-2023-6130](https://insights.sbomify.com/CVE-2023-6130/): Path Traversal: '\..\filename' in salesagility/suitecrm (high 7.5)
- [CVE-2023-6129](https://insights.sbomify.com/CVE-2023-6129/): POLY1305 MAC implementation corrupts vector registers on PowerPC (medium 6.5)
- [CVE-2023-6128](https://insights.sbomify.com/CVE-2023-6128/): Cross-site Scripting (XSS) - Reflected in salesagility/suitecrm (medium 6.8)
- [CVE-2023-6127](https://insights.sbomify.com/CVE-2023-6127/): Unrestricted Upload of File with Dangerous Type in salesagility/suitecrm (medium 5.4)
- [CVE-2023-6126](https://insights.sbomify.com/CVE-2023-6126/): Code Injection in salesagility/suitecrm (medium 4.3)
- [CVE-2023-6125](https://insights.sbomify.com/CVE-2023-6125/): Code Injection in salesagility/suitecrm (medium 5.4)
- [CVE-2023-6124](https://insights.sbomify.com/CVE-2023-6124/): Server-Side Request Forgery (SSRF) in salesagility/suitecrm (medium 5.0)
- [CVE-2023-6123](https://insights.sbomify.com/CVE-2023-6123/): Improper Neutralization vulnerability affects OpenText ALM Octane. (high 7.5)
- [CVE-2023-6122](https://insights.sbomify.com/CVE-2023-6122/): Reflected XSS in Softomi E-commerce Software (medium 6.1)
- [CVE-2023-6121](https://insights.sbomify.com/CVE-2023-6121/): Kernel: nvme: info leak due to out-of-bounds read in nvmet_ctrl_find_get (medium 4.3)
- [CVE-2023-6120](https://insights.sbomify.com/CVE-2023-6120/): Welcart e-Commerce <= 2.9.6 - Authenticated (Administrator+) Directory Traversal (medium 4.1)
- [CVE-2023-6119](https://insights.sbomify.com/CVE-2023-6119/): Privilege escalation in GetSusp (medium 6.5)
- [CVE-2023-6118](https://insights.sbomify.com/CVE-2023-6118/): Path Traversal in Neutron IP Camera (high 7.5)
- [CVE-2023-6117](https://insights.sbomify.com/CVE-2023-6117/): M-Files REST API allows Denial of Service (medium 5.7)
- [CVE-2023-6116](https://insights.sbomify.com/CVE-2023-6116/): Remote Code Execution without authentication using stack overflow (high 8.9)
- [CVE-2023-6114](https://insights.sbomify.com/CVE-2023-6114/): Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure (high 7.5)
- [CVE-2023-6113](https://insights.sbomify.com/CVE-2023-6113/): WP Staging (Free < 3.1.3, Pro < 5.1.3) - Unauthenticated Backup Download (high 7.5)
- [CVE-2023-6112](https://insights.sbomify.com/CVE-2023-6112/): Use after free in Chrome (high 8.8)
- [CVE-2023-6111](https://insights.sbomify.com/CVE-2023-6111/): Use-after-free in Linux kernel's netfilter: nf_tables component (high 7.8)
- [CVE-2023-6110](https://insights.sbomify.com/CVE-2023-6110/): Openstack: deleting a non existing access rule deletes another existing access rule in it's scope (medium 5.5)
- [CVE-2023-6109](https://insights.sbomify.com/CVE-2023-6109/): YOP Poll <= 6.5.26 - Race Condition to Vote Manipulation (medium 5.3)
- [CVE-2023-6105](https://insights.sbomify.com/CVE-2023-6105/): ManageEngine Information Disclosure in Multiple Products (medium 5.5)
- [CVE-2023-6103](https://insights.sbomify.com/CVE-2023-6103/): Intelbras RX 1500 SSID WiFi.html cross site scripting (low 2.4)
- [CVE-2023-6102](https://insights.sbomify.com/CVE-2023-6102/): Maiwei Safety Production Control Platform unrestricted upload (medium 5.3)
- [CVE-2023-6101](https://insights.sbomify.com/CVE-2023-6101/): Maiwei Safety Production Control Platform Intelligent Monitoring ha.html information disclosure (medium 5.3)
- [CVE-2023-6100](https://insights.sbomify.com/CVE-2023-6100/): Maiwei Safety Production Control Platform GetItemList information disclosure (medium 5.3)
- [CVE-2023-6099](https://insights.sbomify.com/CVE-2023-6099/): Shenzhen Youkate Industrial Facial Love Cloud Payment System Account SystemMng.ashx privileges management (high 7.3)
- [CVE-2023-6098](https://insights.sbomify.com/CVE-2023-6098/): Cross-site Scripting on ICSSolution ICS Business Manager (medium 6.3)
- [CVE-2023-6097](https://insights.sbomify.com/CVE-2023-6097/): SQL Injection on ICSSolution ICS Business Manager (critical 9.4)
- [CVE-2023-6096](https://insights.sbomify.com/CVE-2023-6096/): using a inappropriate encryption logic (high 7.4)
- [CVE-2023-6095](https://insights.sbomify.com/CVE-2023-6095/): Remote Code Execution without authentication using memory overflow (high 8.9)
- [CVE-2023-6094](https://insights.sbomify.com/CVE-2023-6094/): OnCell G3150A-LTE Series: Web Server Transmits Cleartext Credentials (medium 5.3)
- [CVE-2023-6093](https://insights.sbomify.com/CVE-2023-6093/): OnCell G3150A-LTE Series: Clickjacking Vulnerability (medium 5.3)
- [CVE-2023-6091](https://insights.sbomify.com/CVE-2023-6091/): WordPress Theme Editor plugin <= 2.7.1 - Arbitrary File Upload vulnerability (high 7.2)
- [CVE-2023-6090](https://insights.sbomify.com/CVE-2023-6090/): WordPress Mollie Payments for WooCommerce Plugin <= 7.3.11 is vulnerable to Arbitrary File Upload (critical 9.1)
- [CVE-2023-6084](https://insights.sbomify.com/CVE-2023-6084/): Tongda OA 2017 delete.php sql injection (medium 6.3)
- [CVE-2023-6082](https://insights.sbomify.com/CVE-2023-6082/): Chart.js for WordPress <= 2023.2 - Editor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2023-6081](https://insights.sbomify.com/CVE-2023-6081/): Chart.js for WordPress <= 2023.2 - Editor+ Stored Cross-Site Scripting in New Chart (medium 5.4)
- [CVE-2023-6080](https://insights.sbomify.com/CVE-2023-6080/): Privilege Escalation to SYSTEM in Lakeside Software Installer (high 7.8)
- [CVE-2023-6078](https://insights.sbomify.com/CVE-2023-6078/): Command injection in BIOVIA Materials Studio products (high 8.8)
- [CVE-2023-6077](https://insights.sbomify.com/CVE-2023-6077/): Slider - Ultimate Responsive Image Slider < 3.5.12 - Subscriber+ Arbitrary Post Access (medium 6.5)
- [CVE-2023-6076](https://insights.sbomify.com/CVE-2023-6076/): PHPGurukul Restaurant Table Booking System Reservation Status booking-details.php information disclosure (medium 5.3)
- [CVE-2023-6075](https://insights.sbomify.com/CVE-2023-6075/): PHPGurukul Restaurant Table Booking System Reservation Request index.php cross site scripting (low 3.5)
- [CVE-2023-6074](https://insights.sbomify.com/CVE-2023-6074/): PHPGurukul Restaurant Table Booking System Booking Reservation check-status.php sql injection (medium 6.3)
- [CVE-2023-6073](https://insights.sbomify.com/CVE-2023-6073/): DoS and Control of Volume Settings for VW ID.3 ICAS3 IVI ECU (medium 5.7)
- [CVE-2023-6072](https://insights.sbomify.com/CVE-2023-6072/): Cross-site scripting in Trellix Central Management (CM) (medium 4.6)
- [CVE-2023-6071](https://insights.sbomify.com/CVE-2023-6071/): Command injection in ESM (high 8.4)
- [CVE-2023-6070](https://insights.sbomify.com/CVE-2023-6070/): Server-side request forgery in Trellix Enterprise Security Manager (ESM) (medium 4.3)
- [CVE-2023-6069](https://insights.sbomify.com/CVE-2023-6069/): Improper Link Resolution Before File Access in froxlor/froxlor (critical 9.9)
- [CVE-2023-6068](https://insights.sbomify.com/CVE-2023-6068/): Security feature bypass in MOS (low 3.1)
- [CVE-2023-6067](https://insights.sbomify.com/CVE-2023-6067/): WP User Profile Avatar <= 1.0.1 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-6066](https://insights.sbomify.com/CVE-2023-6066/): WP Custom Widget Area <= 1.2.5 - Subscriber+ Menus Creation/Deletion/Update (medium 4.3)
- [CVE-2023-6065](https://insights.sbomify.com/CVE-2023-6065/): Quttera Web Malware Scanner < 3.4.2.1 - Directory Listing to Sensitive Data Exposure (medium 5.3)
- [CVE-2023-6064](https://insights.sbomify.com/CVE-2023-6064/): PayHere Payment Gateway < 2.2.12 - Unauthenticated Log Data Disclosure (high 7.5)
- [CVE-2023-6063](https://insights.sbomify.com/CVE-2023-6063/): WP Fastest Cache < 1.2.2 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2023-6062](https://insights.sbomify.com/CVE-2023-6062/): Arbitrary File Write (medium 6.8)
- [CVE-2023-6058](https://insights.sbomify.com/CVE-2023-6058/): HTTPS Certificate Validation Issue in Bitdefender Safepay (VA-11167) (high 8.6)
- [CVE-2023-6057](https://insights.sbomify.com/CVE-2023-6057/): Insecure Trust of DSA-Signed Certificates in Bitdefender Total Security HTTPS Scanning (VA-11166) (high 8.6)
- [CVE-2023-6056](https://insights.sbomify.com/CVE-2023-6056/): Insecure Trust of Self-Signed Certificates in Bitdefender Total Security HTTPS Scanning (VA-11164) (high 8.6)
- [CVE-2023-6055](https://insights.sbomify.com/CVE-2023-6055/): Improper Certificate Validation in Bitdefender Total Security HTTPS Scanning (VA-11158) (high 8.6)
- [CVE-2023-6054](https://insights.sbomify.com/CVE-2023-6054/): Tongda OA 2017 lock.php sql injection (medium 5.5)
- [CVE-2023-6053](https://insights.sbomify.com/CVE-2023-6053/): Tongda OA 2017 delete.php sql injection (medium 6.3)
- [CVE-2023-6052](https://insights.sbomify.com/CVE-2023-6052/): Tongda OA 2017 delete.php sql injection (medium 6.3)
- [CVE-2023-6051](https://insights.sbomify.com/CVE-2023-6051/): Improper Control of Generation of Code ('Code Injection') in GitLab (medium 5.7)
- [CVE-2023-6050](https://insights.sbomify.com/CVE-2023-6050/): Estatik Real Estate Plugin < 4.1.1 - Reflected XSS (medium 6.1)
- [CVE-2023-6049](https://insights.sbomify.com/CVE-2023-6049/): Estatik Real Estate Plugin < 4.1.1 - Unauthenticated PHP Object Injection (critical 9.8)
- [CVE-2023-6048](https://insights.sbomify.com/CVE-2023-6048/): Estatik Real Estate Plugin < 4.1.1 - Subscriber+ Arbitrary Option Update (medium 6.5)
- [CVE-2023-6047](https://insights.sbomify.com/CVE-2023-6047/): Reflected XSS in Algoritim E-commerce Software (medium 6.1)
- [CVE-2023-6046](https://insights.sbomify.com/CVE-2023-6046/): EventON < 2.2 - Admin+ Stored HTML Injection (medium 4.8)
- [CVE-2023-6045](https://insights.sbomify.com/CVE-2023-6045/): Arkruntime has a type confusion vulnerability (medium 5.9)
- [CVE-2023-6044](https://insights.sbomify.com/CVE-2023-6044/): Privilege escalation in Vantage (medium 6.3)
- [CVE-2023-6043](https://insights.sbomify.com/CVE-2023-6043/): Privilege escalation in Vantage (high 7.8)
- [CVE-2023-6042](https://insights.sbomify.com/CVE-2023-6042/): Getwid < 2.0.3 - Unauthenticated Arbitrary Email Sending to Admin (high 7.5)
- [CVE-2023-6040](https://insights.sbomify.com/CVE-2023-6040/): Memory corruption in linux (high 7.8)
- [CVE-2023-6039](https://insights.sbomify.com/CVE-2023-6039/): Kernel: use-after-free in drivers/net/usb/lan78xx.c in lan78xx_disconnect (medium 5.5)
- [CVE-2023-6038](https://insights.sbomify.com/CVE-2023-6038/): Local File Inclusion in h2oai/h2o-3 (critical 9.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/134/