# Vulnerabilities published in 2023


- [CVE-2023-51723](https://insights.sbomify.com/CVE-2023-51723/): Stored Cross Site Scripting Vulnerability in Skyworth Router (medium 6.9)
- [CVE-2023-51722](https://insights.sbomify.com/CVE-2023-51722/): Stored Cross Site Scripting Vulnerability in Skyworth Router (medium 6.9)
- [CVE-2023-51721](https://insights.sbomify.com/CVE-2023-51721/): Stored Cross Site Scripting Vulnerability in Skyworth Router (medium 6.9)
- [CVE-2023-51720](https://insights.sbomify.com/CVE-2023-51720/): Stored Cross Site Scripting Vulnerability in Skyworth Router (medium 6.9)
- [CVE-2023-5172](https://insights.sbomify.com/CVE-2023-5172/): Use after free in Firefox (critical 9.8)
- [CVE-2023-51719](https://insights.sbomify.com/CVE-2023-51719/): Stored Cross Site Scripting Vulnerability in Skyworth Router (medium 6.9)
- [CVE-2023-51717](https://insights.sbomify.com/CVE-2023-51717/): Auth bypass in dataiku:data science studio (critical 9.8)
- [CVE-2023-51714](https://insights.sbomify.com/CVE-2023-51714/): Integer overflow in debian:debian linux (critical 9.8)
- [CVE-2023-51713](https://insights.sbomify.com/CVE-2023-51713/): Memory corruption in proftpd:proftpd (high 7.5)
- [CVE-2023-51712](https://insights.sbomify.com/CVE-2023-51712/): Information disclosure in trustedfirmware:trusted firmware-m (medium 4.7)
- [CVE-2023-51711](https://insights.sbomify.com/CVE-2023-51711/): Other in regify:regipay (high 7.8)
- [CVE-2023-51710](https://insights.sbomify.com/CVE-2023-51710/): EMS SQL Manager 3.6.2 (build 55333) for Oracle allows DLL hijacking: a user can trigger the execution of arbitrary code every time the product is executed. (medium 4.2)
- [CVE-2023-5171](https://insights.sbomify.com/CVE-2023-5171/): Use after free in Firefox (medium 6.5)
- [CVE-2023-51708](https://insights.sbomify.com/CVE-2023-51708/): Auth bypass in bentley:assetwise alim for transportation (high 8.6)
- [CVE-2023-51707](https://insights.sbomify.com/CVE-2023-51707/): Command injection in arraynetworks:arrayos ag (critical 9.8)
- [CVE-2023-51704](https://insights.sbomify.com/CVE-2023-51704/): Cross-site scripting in mediawiki:mediawiki (medium 6.1)
- [CVE-2023-51702](https://insights.sbomify.com/CVE-2023-51702/): Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service (medium 6.5)
- [CVE-2023-51701](https://insights.sbomify.com/CVE-2023-51701/): @fastify-reply-from JSON Content-Type parsing confusion (medium 5.3)
- [CVE-2023-51700](https://insights.sbomify.com/CVE-2023-51700/): WP-Mobile-BankID-Integration WordPress Database Deserialization: Potential for Object Injection (medium 6.4)
- [CVE-2023-5170](https://insights.sbomify.com/CVE-2023-5170/): Information disclosure in Firefox (high 7.4)
- [CVE-2023-51699](https://insights.sbomify.com/CVE-2023-51699/): OS Command Injection for Fluid Users with JuicefsRuntime (medium 4.0)
- [CVE-2023-51698](https://insights.sbomify.com/CVE-2023-51698/): Atril's CBT comic book parsing vulnerable to Remote Code Execution (critical 9.6)
- [CVE-2023-51697](https://insights.sbomify.com/CVE-2023-51697/): Audiobookshelf vulnerable to Blind SSRF in `podcastUtils.js` (medium 4.3)
- [CVE-2023-51696](https://insights.sbomify.com/CVE-2023-51696/): Cross-site request forgery in Spam protection, Anti-Spam, FireWall by CleanTalk (medium 4.3)
- [CVE-2023-51695](https://insights.sbomify.com/CVE-2023-51695/): WordPress Everest Forms Plugin <= 2.0.4.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-51694](https://insights.sbomify.com/CVE-2023-51694/): WordPress Embed Privacy Plugin <= 1.8.0 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-51693](https://insights.sbomify.com/CVE-2023-51693/): WordPress Themify Icons Plugin <= 2.0.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-51692](https://insights.sbomify.com/CVE-2023-51692/): WordPress Customer Reviews for WooCommerce Plugin <= 5.38.1 is vulnerable to Broken Access Control (medium 4.3)
- [CVE-2023-51691](https://insights.sbomify.com/CVE-2023-51691/): WordPress wpDiscuz Plugin <= 7.6.12 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-51690](https://insights.sbomify.com/CVE-2023-51690/): WordPress Advanced iFrame Plugin <= 2023.8 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-5169](https://insights.sbomify.com/CVE-2023-5169/): Memory corruption in Firefox (medium 6.5)
- [CVE-2023-51689](https://insights.sbomify.com/CVE-2023-51689/): WordPress Easy Video Player Plugin <= 1.2.2.10 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-51688](https://insights.sbomify.com/CVE-2023-51688/): WordPress eCommerce Product Catalog Plugin <= 3.3.26 is vulnerable to Sensitive Data Exposure (medium 5.3)
- [CVE-2023-51687](https://insights.sbomify.com/CVE-2023-51687/): WordPress Product Catalog Simple Plugin <= 1.7.6 is vulnerable to Sensitive Data Exposure (medium 5.3)
- [CVE-2023-51685](https://insights.sbomify.com/CVE-2023-51685/): WordPress WP Review Slider Plugin <= 12.7 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-51684](https://insights.sbomify.com/CVE-2023-51684/): WordPress Easy Digital Downloads Plugin <= 3.2.5 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-51683](https://insights.sbomify.com/CVE-2023-51683/): WordPress Easy PayPal Buy Now Button Plugin <= 1.8.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-51682](https://insights.sbomify.com/CVE-2023-51682/): WordPress MC4WP plugin <= 4.9.9 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-51681](https://insights.sbomify.com/CVE-2023-51681/): WordPress Duplicator Plugin <= 1.5.7 is vulnerable to Cross Site Request Forgery (CSRF) (medium 6.5)
- [CVE-2023-51680](https://insights.sbomify.com/CVE-2023-51680/): WordPress Quotes for WooCommerce plugin <= 2.0.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-5168](https://insights.sbomify.com/CVE-2023-5168/): Memory corruption in Firefox (critical 9.8)
- [CVE-2023-51679](https://insights.sbomify.com/CVE-2023-51679/): WordPress BulkGate SMS Plugin for WooCommerce plugin <= 3.0.2 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-51678](https://insights.sbomify.com/CVE-2023-51678/): WordPress Doofinder for WooCommerce Plugin <= 2.0.33 is vulnerable to Broken Access Control (medium 4.3)
- [CVE-2023-51677](https://insights.sbomify.com/CVE-2023-51677/): WordPress Schema & Structured Data for WP & AMP Plugin <= 1.23 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-51676](https://insights.sbomify.com/CVE-2023-51676/): WordPress Happy Addons for Elementor Plugin <= 3.9.1.1 is vulnerable to Server Side Request Forgery (SSRF) (medium 4.9)
- [CVE-2023-51675](https://insights.sbomify.com/CVE-2023-51675/): WordPress Advanced Access Manager Plugin <= 6.9.18 is vulnerable to Open Redirection (medium 4.7)
- [CVE-2023-51674](https://insights.sbomify.com/CVE-2023-51674/): WordPress Advanced Access Manager Plugin <= 6.9.18 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-51673](https://insights.sbomify.com/CVE-2023-51673/): WordPress Stylish Price List Plugin <= 7.0.17 is vulnerable to Broken Access Control (medium 5.4)
- [CVE-2023-51672](https://insights.sbomify.com/CVE-2023-51672/): WordPress FunnelKit Checkout plugin <= 3.10.3 - Unauthenticated Arbitrary Post/Page Deletion vulnerability (high 7.5)
- [CVE-2023-51671](https://insights.sbomify.com/CVE-2023-51671/): WordPress FunnelKit Checkout plugin <= 3.10.3 - Authenticated Plugin Settings Change vulnerability (medium 5.4)
- [CVE-2023-51670](https://insights.sbomify.com/CVE-2023-51670/): WordPress FunnelKit Checkout plugin <= 3.10.3 - Authenticated Arbitrary Plugin Activation vulnerability (medium 4.3)
- [CVE-2023-5167](https://insights.sbomify.com/CVE-2023-5167/): User Activity Log Pro < 2.3.4 - Unauthenticated Stored Cross-Site Scripting via User Agent (medium 5.4)
- [CVE-2023-51669](https://insights.sbomify.com/CVE-2023-51669/): WordPress Product Code for WooCommerce Plugin <= 1.4.4 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-51668](https://insights.sbomify.com/CVE-2023-51668/): WordPress Inline Image Upload for BBPress Plugin <= 1.1.18 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-51667](https://insights.sbomify.com/CVE-2023-51667/): WordPress Rate my Post – WP Rating System plugin <= 3.4.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-51666](https://insights.sbomify.com/CVE-2023-51666/): WordPress Related Post Plugin <= 2.0.53 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-51665](https://insights.sbomify.com/CVE-2023-51665/): Audiobookshelf vulnerable to Blind SSRF in `Auth.js` (medium 4.3)
- [CVE-2023-51664](https://insights.sbomify.com/CVE-2023-51664/): tj-actions/changed-files command injection in output filenames (high 7.3)
- [CVE-2023-51663](https://insights.sbomify.com/CVE-2023-51663/): Hail authentication can be bypassed by changing email address (medium 5.3)
- [CVE-2023-51662](https://insights.sbomify.com/CVE-2023-51662/): Snowflake Connector .NET does not properly check the Certificate Revocation List (CRL) (medium 6.0)
- [CVE-2023-51661](https://insights.sbomify.com/CVE-2023-51661/): Filesystem sandbox not enforced in wasmer-cli (high 8.4)
- [CVE-2023-5166](https://insights.sbomify.com/CVE-2023-5166/): Docker Desktop before 4.23.0 allows Access Token theft via a crafted extension icon URL (high 8.0)
- [CVE-2023-51656](https://insights.sbomify.com/CVE-2023-51656/): Apache IoTDB: Unsafe deserialize map in Sync Tool (critical 9.8)
- [CVE-2023-51655](https://insights.sbomify.com/CVE-2023-51655/): Code injection in IntelliJ IDEA (medium 6.3)
- [CVE-2023-51654](https://insights.sbomify.com/CVE-2023-51654/): Denial of service in iPrint&Scan Desktop for Windows (medium 5.5)
- [CVE-2023-51653](https://insights.sbomify.com/CVE-2023-51653/): Hertzbeat JMX JNDI RCE (critical 9.8)
- [CVE-2023-51652](https://insights.sbomify.com/CVE-2023-51652/): OWASP.AntiSamy mXSS when preserving comments (medium 6.1)
- [CVE-2023-51651](https://insights.sbomify.com/CVE-2023-51651/): Potential URI resolution path traversal in the AWS SDK for PHP (medium 6.0)
- [CVE-2023-51650](https://insights.sbomify.com/CVE-2023-51650/): Unauthorized access vulnerability on three interfaces (high 7.5)
- [CVE-2023-5165](https://insights.sbomify.com/CVE-2023-5165/): Docker Desktop before 4.23.0 allows Enhanced Container Isolation bypass via debug shell (high 7.1)
- [CVE-2023-51649](https://insights.sbomify.com/CVE-2023-51649/): Nautobot missing object-level permissions enforcement when running Job Buttons (low 3.5)
- [CVE-2023-51648](https://insights.sbomify.com/CVE-2023-51648/): Allegra getFileContentAsString Directory Traversal Information Disclosure Vulnerability (high 7.5)
- [CVE-2023-51647](https://insights.sbomify.com/CVE-2023-51647/): Allegra saveInlineEdit Directory Traversal Remote Code Execution Vulnerability (high 7.2)
- [CVE-2023-51646](https://insights.sbomify.com/CVE-2023-51646/): Allegra uploadSimpleFile Directory Traversal Remote Code Execution Vulnerability (high 7.2)
- [CVE-2023-51645](https://insights.sbomify.com/CVE-2023-51645/): Allegra unzipFile Directory Traversal Remote Code Execution Vulnerability (high 7.2)
- [CVE-2023-51644](https://insights.sbomify.com/CVE-2023-51644/): Allegra SiteConfigAction Improper Access Control Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2023-51643](https://insights.sbomify.com/CVE-2023-51643/): Allegra uploadFile Directory Traversal Remote Code Execution Vulnerability (high 7.2)
- [CVE-2023-51642](https://insights.sbomify.com/CVE-2023-51642/): Allegra loadFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2023-51641](https://insights.sbomify.com/CVE-2023-51641/): Allegra renderFieldMatch Deserialization of Unstrusted Data Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2023-51640](https://insights.sbomify.com/CVE-2023-51640/): Allegra extarctZippedFile Directory Traversal Remote Code Execution Vulnerability (high 7.2)
- [CVE-2023-5164](https://insights.sbomify.com/CVE-2023-5164/): Bellows Accordion Menu <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-51639](https://insights.sbomify.com/CVE-2023-51639/): Allegra downloadExportedChart Directory Traversal Authentication Bypass Vulnerability (critical 9.8)
- [CVE-2023-51638](https://insights.sbomify.com/CVE-2023-51638/): Allegra Hard-coded Credentials Authentication Bypass Vulnerability (critical 9.8)
- [CVE-2023-51637](https://insights.sbomify.com/CVE-2023-51637/): Sante PACS Server PG Patient Query SQL Injection Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2023-51636](https://insights.sbomify.com/CVE-2023-51636/): Avira Prime Link Following Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2023-51635](https://insights.sbomify.com/CVE-2023-51635/): NETGEAR RAX30 fing_dil Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-51634](https://insights.sbomify.com/CVE-2023-51634/): NETGEAR RAX30 Improper Certificate Validation Remote Code Execution Vulnerability (high 7.5)
- [CVE-2023-51633](https://insights.sbomify.com/CVE-2023-51633/): Centreon sysName Cross-Site Scripting Remote Code Execution Vulnerability (high 7.5)
- [CVE-2023-51631](https://insights.sbomify.com/CVE-2023-51631/): D-Link DIR-X3260 prog.cgi SetUsersSettings Stack-based Buffer Overflow Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2023-51630](https://insights.sbomify.com/CVE-2023-51630/): Paessler PRTG Network Monitor Cross-Site Scripting Authentication Bypass Vulnerability (high 8.8)
- [CVE-2023-5163](https://insights.sbomify.com/CVE-2023-5163/): Weather Atlas Widget <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-51629](https://insights.sbomify.com/CVE-2023-51629/): D-Link DCS-8300LHV2 ONVIF Hardcoded PIN Authentication Bypass Vulnerability (medium 6.3)
- [CVE-2023-51628](https://insights.sbomify.com/CVE-2023-51628/): D-Link DCS-8300LHV2 ONVIF SetHostName Stack-Based Buffer Overflow Remote Code Execution Vulnerability (high 8.0)
- [CVE-2023-51627](https://insights.sbomify.com/CVE-2023-51627/): D-Link DCS-8300LHV2 ONVIF Duration Stack-Based Buffer Overflow Remote Code Execution Vulnerability (high 8.0)
- [CVE-2023-51626](https://insights.sbomify.com/CVE-2023-51626/): Memory corruption in DCS-8300LHV2 (high 8.8)
- [CVE-2023-51625](https://insights.sbomify.com/CVE-2023-51625/): D-Link DCS-8300LHV2 ONVIF SetSystemDateAndTime Command Injection Remote Code Execution Vulnerability (high 8.0)
- [CVE-2023-51624](https://insights.sbomify.com/CVE-2023-51624/): Memory corruption in DCS-8300LHV2 (high 8.8)
- [CVE-2023-51623](https://insights.sbomify.com/CVE-2023-51623/): D-Link DIR-X3260 prog.cgi SetAPClientSettings Stack-based Buffer Overflow Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2023-51622](https://insights.sbomify.com/CVE-2023-51622/): D-Link DIR-X3260 prog.cgi SetTriggerPPPoEValidate Stack-based Buffer Overflow Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2023-51621](https://insights.sbomify.com/CVE-2023-51621/): D-Link DIR-X3260 prog.cgi SetDeviceSettings Stack-based Buffer Overflow Remote Code Execution Vulnerability (medium 6.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/166/