# Vulnerabilities published in 2023


- [CVE-2023-5607](https://insights.sbomify.com/CVE-2023-5607/): Path traversal in Trellix Application and Change Control (TACC) (high 8.4)
- [CVE-2023-5606](https://insights.sbomify.com/CVE-2023-5606/): Cross-site scripting in AI ChatBot (medium 4.4)
- [CVE-2023-5605](https://insights.sbomify.com/CVE-2023-5605/): URL Shortify < 1.7.9.1 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-5604](https://insights.sbomify.com/CVE-2023-5604/): Asgaros Forum < 2.7.1 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2023-5602](https://insights.sbomify.com/CVE-2023-5602/): Social Media Share Buttons & Social Sharing Icons <= 2.8.5 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2023-5601](https://insights.sbomify.com/CVE-2023-5601/): WooCommerce Ninja Forms Product Add-ons < 1.7.1 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2023-5600](https://insights.sbomify.com/CVE-2023-5600/): Missing Authorization in GitLab (low 3.1)
- [CVE-2023-5599](https://insights.sbomify.com/CVE-2023-5599/): Cross-site scripting in 3DSwymer (medium 5.4)
- [CVE-2023-5598](https://insights.sbomify.com/CVE-2023-5598/): Cross-site scripting in 3DSwymer (medium 5.4)
- [CVE-2023-5597](https://insights.sbomify.com/CVE-2023-5597/): Cross-site scripting in 3DSwymer (medium 5.4)
- [CVE-2023-5595](https://insights.sbomify.com/CVE-2023-5595/): Denial of Service in gpac/gpac (medium 5.1)
- [CVE-2023-5594](https://insights.sbomify.com/CVE-2023-5594/): Improper following of a certificate's chain of trust in ESET security products (high 7.5)
- [CVE-2023-5593](https://insights.sbomify.com/CVE-2023-5593/): Memory corruption in SecuExtender SSL VPN Client (high 7.8)
- [CVE-2023-5592](https://insights.sbomify.com/CVE-2023-5592/): Phoenix Contact: ProConOs prone to Download of Code Without Integrity Check (high 7.5)
- [CVE-2023-5591](https://insights.sbomify.com/CVE-2023-5591/): SQL Injection in librenms/librenms (high 7.8)
- [CVE-2023-5590](https://insights.sbomify.com/CVE-2023-5590/): NULL Pointer Dereference in seleniumhq/selenium (high 7.5)
- [CVE-2023-5589](https://insights.sbomify.com/CVE-2023-5589/): SourceCodester Judging Management System login.php sql injection (high 7.3)
- [CVE-2023-5588](https://insights.sbomify.com/CVE-2023-5588/): kphrx pleroma pack.ex Pleroma.Emoji.Pack path traversal (low 2.6)
- [CVE-2023-5587](https://insights.sbomify.com/CVE-2023-5587/): SourceCodester Free Hospital Management System for Small Practices Parameter doctors.php sql injection (medium 6.3)
- [CVE-2023-5586](https://insights.sbomify.com/CVE-2023-5586/): NULL Pointer Dereference in gpac/gpac (medium 4.4)
- [CVE-2023-5585](https://insights.sbomify.com/CVE-2023-5585/): SourceCodester Online Motorcycle Rental System Bike List cross site scripting (low 2.4)
- [CVE-2023-5583](https://insights.sbomify.com/CVE-2023-5583/): WP Simple Galleries <= 1.34 - Authenticated (Contributor+) PHP Object Injection (high 8.8)
- [CVE-2023-5582](https://insights.sbomify.com/CVE-2023-5582/): ZZZCMS Personal Profile Page cross site scripting (low 3.5)
- [CVE-2023-5581](https://insights.sbomify.com/CVE-2023-5581/): SourceCodester Medicine Tracker System index.php cross site scripting (low 3.5)
- [CVE-2023-5580](https://insights.sbomify.com/CVE-2023-5580/): SourceCodester Library System index.php sql injection (medium 6.3)
- [CVE-2023-5579](https://insights.sbomify.com/CVE-2023-5579/): yhz66 Sandbox User Data information disclosure (low 3.5)
- [CVE-2023-5578](https://insights.sbomify.com/CVE-2023-5578/): Portábilis i-Educar HTTP GET Request agenda_imprimir.php cross site scripting (medium 5.1)
- [CVE-2023-5577](https://insights.sbomify.com/CVE-2023-5577/): Bitly's WordPress Plugin <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5576](https://insights.sbomify.com/CVE-2023-5576/): Migration, Backup, Staging – WPvivid <= 0.9.91 - Google Drive Client Secret Exposure (high 8.0)
- [CVE-2023-5575](https://insights.sbomify.com/CVE-2023-5575/): Missing authorization in Server (medium 6.5)
- [CVE-2023-5574](https://insights.sbomify.com/CVE-2023-5574/): Xorg-x11-server: use-after-free bug in damagedestroy (high 7.0)
- [CVE-2023-5573](https://insights.sbomify.com/CVE-2023-5573/): Allocation of Resources Without Limits or Throttling in vriteio/vrite (medium 4.7)
- [CVE-2023-5572](https://insights.sbomify.com/CVE-2023-5572/): Server-Side Request Forgery (SSRF) in vriteio/vrite (critical 10.0)
- [CVE-2023-5571](https://insights.sbomify.com/CVE-2023-5571/): Improper Input Validation in vriteio/vrite (medium 6.5)
- [CVE-2023-5570](https://insights.sbomify.com/CVE-2023-5570/): User Enumeration in Inohom's Home Manager Gateway (high 7.5)
- [CVE-2023-5568](https://insights.sbomify.com/CVE-2023-5568/): Samba: heap buffer overflow with freshness tokens in the heimdal kdc (medium 5.9)
- [CVE-2023-5567](https://insights.sbomify.com/CVE-2023-5567/): QR Code Tag <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5566](https://insights.sbomify.com/CVE-2023-5566/): Simple Shortcodes <= 1.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5565](https://insights.sbomify.com/CVE-2023-5565/): Shortcode Menu <= 3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5564](https://insights.sbomify.com/CVE-2023-5564/): Cross-site Scripting (XSS) - Stored in froxlor/froxlor (medium 5.2)
- [CVE-2023-5563](https://insights.sbomify.com/CVE-2023-5563/): Denial of service in Zephyr (high 7.1)
- [CVE-2023-5562](https://insights.sbomify.com/CVE-2023-5562/): Unsafe default allows for cross-site scripting attacks in KNIME Server and KNIME Business Hub (medium 6.1)
- [CVE-2023-5561](https://insights.sbomify.com/CVE-2023-5561/): WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure (medium 5.3)
- [CVE-2023-5560](https://insights.sbomify.com/CVE-2023-5560/): WP-UserOnline < 2.88.3 - Unauthenticated Stored XSS (medium 6.1)
- [CVE-2023-5559](https://insights.sbomify.com/CVE-2023-5559/): 10Web Booster < 2.24.18 - Unauthenticated Arbitrary Option Deletion (critical 9.1)
- [CVE-2023-5558](https://insights.sbomify.com/CVE-2023-5558/): LearnPress < 4.2.5.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-5557](https://insights.sbomify.com/CVE-2023-5557/): Tracker-miners: sandbox escape (high 7.5)
- [CVE-2023-5556](https://insights.sbomify.com/CVE-2023-5556/): Cross-site Scripting (XSS) - Reflected in structurizr/onpremises (medium 5.3)
- [CVE-2023-5555](https://insights.sbomify.com/CVE-2023-5555/): Cross-site Scripting (XSS) - Generic in frappe/lms (high 7.1)
- [CVE-2023-5554](https://insights.sbomify.com/CVE-2023-5554/): Security feature bypass in LINE client for iOS (medium 4.8)
- [CVE-2023-5553](https://insights.sbomify.com/CVE-2023-5553/): Security feature bypass in AXIS OS (high 7.6)
- [CVE-2023-5552](https://insights.sbomify.com/CVE-2023-5552/): Information disclosure in Sophos Firewall (high 7.1)
- [CVE-2023-5551](https://insights.sbomify.com/CVE-2023-5551/): Moodle: forum summary report shows students from other groups when in separate groups mode (low 3.3)
- [CVE-2023-5550](https://insights.sbomify.com/CVE-2023-5550/): Moodle: rce due to lfi risk in some misconfigured shared hosting environments (medium 6.5)
- [CVE-2023-5549](https://insights.sbomify.com/CVE-2023-5549/): Moodle: insufficient capability checks when updating the parent of a course category (low 3.3)
- [CVE-2023-5548](https://insights.sbomify.com/CVE-2023-5548/): Moodle: cache poisoning risk with endpoint revision numbers (low 3.3)
- [CVE-2023-5547](https://insights.sbomify.com/CVE-2023-5547/): Moodle: xss risk when previewing data in course upload tool (low 3.3)
- [CVE-2023-5546](https://insights.sbomify.com/CVE-2023-5546/): Moodle: stored xss in quiz grading report via user id number (medium 4.3)
- [CVE-2023-5545](https://insights.sbomify.com/CVE-2023-5545/): Moodle: auto-populated h5p author name causes a potential information leak (low 3.3)
- [CVE-2023-5544](https://insights.sbomify.com/CVE-2023-5544/): Moodle: stored xss and potential idor risk in wiki comments (medium 6.5)
- [CVE-2023-5543](https://insights.sbomify.com/CVE-2023-5543/): Moodle: duplicating a bigbluebutton activity assigns the same meeting id (low 3.3)
- [CVE-2023-5542](https://insights.sbomify.com/CVE-2023-5542/): Moodle: students can view other users in "only see own membership" groups (low 3.3)
- [CVE-2023-5541](https://insights.sbomify.com/CVE-2023-5541/): Moodle: xss risk when using csv grade import method (low 3.3)
- [CVE-2023-5540](https://insights.sbomify.com/CVE-2023-5540/): Moodle: authenticated remote code execution risk in imscp (medium 4.7)
- [CVE-2023-5539](https://insights.sbomify.com/CVE-2023-5539/): Moodle: authenticated remote code execution risk in lesson (medium 4.7)
- [CVE-2023-5538](https://insights.sbomify.com/CVE-2023-5538/): MpOperationLogs <= 1.0.1 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2023-5537](https://insights.sbomify.com/CVE-2023-5537/): Delete Usermetas <= 1.1.2 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2023-5536](https://insights.sbomify.com/CVE-2023-5536/): Privilege escalation in Ubuntu Server (medium 5.0)
- [CVE-2023-5535](https://insights.sbomify.com/CVE-2023-5535/): Use After Free in vim/vim (high 7.8)
- [CVE-2023-5534](https://insights.sbomify.com/CVE-2023-5534/): AI ChatBot <= 4.8.9 and 4.9.2 - Cross-Site Request Forgery on AJAX actions (medium 4.3)
- [CVE-2023-5533](https://insights.sbomify.com/CVE-2023-5533/): AI ChatBot <= 4.8.9 and 4.9.2 - Missing Authorization on AJAX actions (medium 5.3)
- [CVE-2023-5532](https://insights.sbomify.com/CVE-2023-5532/): ImageMapper <= 1.2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting via imgmap_save_area_title (medium 6.1)
- [CVE-2023-5531](https://insights.sbomify.com/CVE-2023-5531/): Thumbnail Slider With Lightbox <= 1.0 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2023-5530](https://insights.sbomify.com/CVE-2023-5530/): Ninja Forms < 3.6.34 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-5529](https://insights.sbomify.com/CVE-2023-5529/): Advanced Page Visit Counter <= 8.0.6 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-5528](https://insights.sbomify.com/CVE-2023-5528/): Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation (high 7.2)
- [CVE-2023-5527](https://insights.sbomify.com/CVE-2023-5527/): Business Directory Plugin <= 6.4.3 - Authenticated (Author+) CSV Injection (high 7.4)
- [CVE-2023-5525](https://insights.sbomify.com/CVE-2023-5525/): Limit Login Attempts Reloaded < 2.25.26 - Admin+ Missing Authorization to Toggle Plugin Auto-Update (medium 4.3)
- [CVE-2023-5524](https://insights.sbomify.com/CVE-2023-5524/): M-Files Web Companion allows Remote Code Execution for some filetypes (high 8.2)
- [CVE-2023-5523](https://insights.sbomify.com/CVE-2023-5523/): M-Files Web Companion allows Remote Code Execution (high 8.6)
- [CVE-2023-5522](https://insights.sbomify.com/CVE-2023-5522/): Mobile app freezes when receiving a post with hundreds of emojis (medium 4.3)
- [CVE-2023-5521](https://insights.sbomify.com/CVE-2023-5521/): Incorrect Authorization in tiann/kernelsu (high 7.3)
- [CVE-2023-5520](https://insights.sbomify.com/CVE-2023-5520/): Out-of-bounds Read in gpac/gpac (medium 4.0)
- [CVE-2023-5519](https://insights.sbomify.com/CVE-2023-5519/): EventPrime < 3.2.0 - Booking Creation via CSRF (medium 4.3)
- [CVE-2023-5517](https://insights.sbomify.com/CVE-2023-5517/): Querying RFC 1918 reverse zones may cause an assertion failure when "nxdomain-redirect" is enabled (high 7.5)
- [CVE-2023-5516](https://insights.sbomify.com/CVE-2023-5516/): Information disclosure in eSOMS (medium 5.3)
- [CVE-2023-5515](https://insights.sbomify.com/CVE-2023-5515/): Information disclosure in eSOMS (medium 5.3)
- [CVE-2023-5514](https://insights.sbomify.com/CVE-2023-5514/): Information disclosure in eSOMS (medium 5.3)
- [CVE-2023-5512](https://insights.sbomify.com/CVE-2023-5512/): Improper Control of Generation of Code ('Code Injection') in GitLab (medium 4.8)
- [CVE-2023-5511](https://insights.sbomify.com/CVE-2023-5511/): Cross-Site Request Forgery (CSRF) in snipe/snipe-it (medium 6.3)
- [CVE-2023-5509](https://insights.sbomify.com/CVE-2023-5509/): myStickymenu < 2.6.5 - Subscriber+ Arbitrary Form Leads Deletion (medium 5.4)
- [CVE-2023-5507](https://insights.sbomify.com/CVE-2023-5507/): ImageMapper <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5506](https://insights.sbomify.com/CVE-2023-5506/): Missing authorization in ImageMapper (medium 5.4)
- [CVE-2023-5505](https://insights.sbomify.com/CVE-2023-5505/): BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal (medium 6.8)
- [CVE-2023-5504](https://insights.sbomify.com/CVE-2023-5504/): BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal (high 8.7)
- [CVE-2023-5502](https://insights.sbomify.com/CVE-2023-5502/): Auth bypass in EOS (high 8.2)
- [CVE-2023-5500](https://insights.sbomify.com/CVE-2023-5500/): Frauscher: FDS102 for FAdC/FAdCi remote code execution vulnerability (high 8.8)
- [CVE-2023-5499](https://insights.sbomify.com/CVE-2023-5499/): Shenzhen Reachfar v28 information exposure (high 7.5)
- [CVE-2023-5498](https://insights.sbomify.com/CVE-2023-5498/): Cross-Site Request Forgery (CSRF) in chiefonboarding/chiefonboarding (medium 4.3)
- [CVE-2023-5497](https://insights.sbomify.com/CVE-2023-5497/): Tongda OA 2017 delete.php sql injection (medium 6.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/139/