# Vulnerabilities published in 2023


- [CVE-2023-51437](https://insights.sbomify.com/CVE-2023-51437/): Apache Pulsar: Timing attack in SASL token signature verification (high 7.4)
- [CVE-2023-51436](https://insights.sbomify.com/CVE-2023-51436/): Cross-site scripting in UNIVERSAL PASSPORT RX (medium 5.9)
- [CVE-2023-51435](https://insights.sbomify.com/CVE-2023-51435/): Privilege escalation in Magic UI (high 7.1)
- [CVE-2023-51434](https://insights.sbomify.com/CVE-2023-51434/): Memory corruption in Magic UI (critical 9.3)
- [CVE-2023-51433](https://insights.sbomify.com/CVE-2023-51433/): Privilege escalation in Magic UI (low 2.9)
- [CVE-2023-51432](https://insights.sbomify.com/CVE-2023-51432/): Memory corruption in Magic UI (low 3.2)
- [CVE-2023-51431](https://insights.sbomify.com/CVE-2023-51431/): Privilege escalation in com.hihonor.phoneservice (high 7.0)
- [CVE-2023-51430](https://insights.sbomify.com/CVE-2023-51430/): Privilege escalation in Magic UI (medium 4.4)
- [CVE-2023-5143](https://insights.sbomify.com/CVE-2023-5143/): D-Link DAR-7000 webmailattach.php Privilege Escalation (medium 6.3)
- [CVE-2023-51429](https://insights.sbomify.com/CVE-2023-51429/): Privilege escalation in Magic OS (medium 6.0)
- [CVE-2023-51428](https://insights.sbomify.com/CVE-2023-51428/): Memory corruption in Magic OS (medium 4.6)
- [CVE-2023-51427](https://insights.sbomify.com/CVE-2023-51427/): Memory corruption in Magic OS (medium 4.6)
- [CVE-2023-51426](https://insights.sbomify.com/CVE-2023-51426/): Memory corruption in Magic OS (medium 4.6)
- [CVE-2023-51425](https://insights.sbomify.com/CVE-2023-51425/): WordPress Rencontre plugin <= 3.10.1 - Unauthenticated Account Takeover vulnerability (critical 9.8)
- [CVE-2023-51424](https://insights.sbomify.com/CVE-2023-51424/): WordPress WebinarIgnition plugin <= 3.05.0 - Unauthenticated Privilege Escalation vulnerability (critical 9.8)
- [CVE-2023-51423](https://insights.sbomify.com/CVE-2023-51423/): WordPress WebinarIgnition Plugin <= 3.05.0 is vulnerable to SQL Injection (critical 9.3)
- [CVE-2023-51422](https://insights.sbomify.com/CVE-2023-51422/): WordPress WebinarIgnition Plugin <= 3.05.0 is vulnerable to PHP Object Injection (critical 9.9)
- [CVE-2023-51421](https://insights.sbomify.com/CVE-2023-51421/): WordPress Verge3D Plugin <= 4.5.2 is vulnerable to Arbitrary File Upload (critical 9.9)
- [CVE-2023-51420](https://insights.sbomify.com/CVE-2023-51420/): WordPress Verge3D Plugin <= 4.5.2 is vulnerable to Remote Code Execution (RCE) (critical 9.1)
- [CVE-2023-5142](https://insights.sbomify.com/CVE-2023-5142/): H3C ER6300G2 Config File userLogin.asp path traversal (low 3.7)
- [CVE-2023-51419](https://insights.sbomify.com/CVE-2023-51419/): WordPress BERTHA AI Plugin <= 1.11.10.7 is vulnerable to Arbitrary File Upload (critical 10.0)
- [CVE-2023-51418](https://insights.sbomify.com/CVE-2023-51418/): WordPress JVM rich text icons plugin <= 1.2.6 - Arbitrary File Deletion vulnerability (high 7.7)
- [CVE-2023-51417](https://insights.sbomify.com/CVE-2023-51417/): WordPress JVM rich text icons Plugin <= 1.2.3 is vulnerable to Arbitrary File Upload (critical 9.9)
- [CVE-2023-51416](https://insights.sbomify.com/CVE-2023-51416/): WordPress EnvíaloSimple plugin <= 2.2 - Cross Site Request Forgery (CSRF) vulnerability (medium 6.5)
- [CVE-2023-51415](https://insights.sbomify.com/CVE-2023-51415/): WordPress GiveWP Plugin <= 3.2.2 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-51414](https://insights.sbomify.com/CVE-2023-51414/): WordPress EnvíaloSimple Plugin <= 2.1 is vulnerable to PHP Object Injection (critical 9.6)
- [CVE-2023-51413](https://insights.sbomify.com/CVE-2023-51413/): WordPress Piotnet Forms plugin <= 1.0.29 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-51412](https://insights.sbomify.com/CVE-2023-51412/): WordPress Piotnet Forms Plugin <= 1.0.25 is vulnerable to Arbitrary File Upload (critical 9.0)
- [CVE-2023-51411](https://insights.sbomify.com/CVE-2023-51411/): WordPress Frontend Admin by DynamiApps Plugin <= 3.18.3 is vulnerable to Arbitrary File Upload (critical 10.0)
- [CVE-2023-51410](https://insights.sbomify.com/CVE-2023-51410/): WordPress WP Mail Log Plugin <= 1.1.2 is vulnerable to Arbitrary File Upload (critical 9.9)
- [CVE-2023-5141](https://insights.sbomify.com/CVE-2023-5141/): BSK Contact Form 7 Blacklist <= 1.0.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-51409](https://insights.sbomify.com/CVE-2023-51409/): WordPress AI Engine plugin <= 1.9.98 - Unauthenticated Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2023-51408](https://insights.sbomify.com/CVE-2023-51408/): WordPress WP Optin Wheel Plugin <= 1.4.3 is vulnerable to Sensitive Data Exposure (medium 5.3)
- [CVE-2023-51407](https://insights.sbomify.com/CVE-2023-51407/): WordPress Split Test For Elementor plugin <= 1.6.9 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2023-51406](https://insights.sbomify.com/CVE-2023-51406/): WordPress FastDup Plugin <= 2.1.7 is vulnerable to Sensitive Data Exposure (medium 5.3)
- [CVE-2023-51405](https://insights.sbomify.com/CVE-2023-51405/): WordPress BookingPress plugin <= 1.0.74 - Booking Price Manipulation vulnerability (high 8.2)
- [CVE-2023-51404](https://insights.sbomify.com/CVE-2023-51404/): WordPress My Agile Privacy Plugin <= 2.1.7 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-51403](https://insights.sbomify.com/CVE-2023-51403/): WordPress Restaurant Reservations Plugin <= 1.8 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-51402](https://insights.sbomify.com/CVE-2023-51402/): Cross-site request forgery in Ultimate Addons for WPBakery Page Builder (medium 4.3)
- [CVE-2023-51401](https://insights.sbomify.com/CVE-2023-51401/): WordPress Ultimate Addons for Beaver Builder Premium plugin <= 1.35.13 - Limited Arbitrary File Download vulnerability (medium 6.3)
- [CVE-2023-5140](https://insights.sbomify.com/CVE-2023-5140/): Bonus for Woo < 5.8.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-51399](https://insights.sbomify.com/CVE-2023-51399/): WordPress Back Button Widget Plugin <= 1.6.3 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-51398](https://insights.sbomify.com/CVE-2023-51398/): WordPress Ultimate Addons for Beaver Builder Premium plugin <= 1.35.14 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2023-51397](https://insights.sbomify.com/CVE-2023-51397/): WordPress WP Remote Site Search Plugin <= 1.0.4 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-51396](https://insights.sbomify.com/CVE-2023-51396/): WordPress Brizy – Page Builder Plugin <= 2.4.29 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-51395](https://insights.sbomify.com/CVE-2023-51395/): Z-Wave S0 Decryption Vulnerability in End Devices (high 8.8)
- [CVE-2023-51394](https://insights.sbomify.com/CVE-2023-51394/): Potential DoS for EFR32xxx parts in high traffic environments due to null buffer dereference / crash (medium 5.3)
- [CVE-2023-51393](https://insights.sbomify.com/CVE-2023-51393/): Potential DoS due to BusFault and Assert in Ember ZNet legacy packet buffer (medium 5.3)
- [CVE-2023-51392](https://insights.sbomify.com/CVE-2023-51392/): Silicon Labs EFR32xxx parts with classic key storage do not use hardware accelerated AES-CCM (medium 6.2)
- [CVE-2023-51391](https://insights.sbomify.com/CVE-2023-51391/): Micrium OS Network uC-HTTP server header parsing invalid pointer dereference vulnerability (high 7.5)
- [CVE-2023-51390](https://insights.sbomify.com/CVE-2023-51390/): Information Disclosure Vulnerability in Journalpump (medium 6.5)
- [CVE-2023-5139](https://insights.sbomify.com/CVE-2023-5139/): Potential buffer overflow vulnerability in the Zephyr STM32 Crypto driver (medium 4.4)
- [CVE-2023-51389](https://insights.sbomify.com/CVE-2023-51389/): HertzBeat SnakeYAML Deser RCE (critical 9.8)
- [CVE-2023-51388](https://insights.sbomify.com/CVE-2023-51388/): HertzBeat AviatorScript Inject RCE (critical 9.8)
- [CVE-2023-51387](https://insights.sbomify.com/CVE-2023-51387/): Expression Injection Vulnerability in Hertzbeat (high 7.2)
- [CVE-2023-51386](https://insights.sbomify.com/CVE-2023-51386/): Sandbox Accounts for Events vulnerable to privilege escalation to read running events data (high 7.8)
- [CVE-2023-51385](https://insights.sbomify.com/CVE-2023-51385/): Command injection in debian:debian linux (medium 6.5)
- [CVE-2023-51384](https://insights.sbomify.com/CVE-2023-51384/): Security feature bypass in debian:debian linux (medium 5.5)
- [CVE-2023-51380](https://insights.sbomify.com/CVE-2023-51380/): Incorrect Authorization allows Read Access to Issue Comments in GitHub Enterprise Server (low 2.7)
- [CVE-2023-5138](https://insights.sbomify.com/CVE-2023-5138/): Glitch detection not active by default in Silicon Labs Secure Vault High devices (medium 6.8)
- [CVE-2023-51379](https://insights.sbomify.com/CVE-2023-51379/): Incorrect Authorization for Issue Comments in GitHub Enterprise Server (medium 4.9)
- [CVE-2023-51378](https://insights.sbomify.com/CVE-2023-51378/): WordPress Rise Blocks Plugin <= 3.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-51377](https://insights.sbomify.com/CVE-2023-51377/): WordPress Everest Forms plugin <= 2.0.3 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-51376](https://insights.sbomify.com/CVE-2023-51376/): WordPress ProjectHuddle Client Site plugin <= 1.0.34 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-51375](https://insights.sbomify.com/CVE-2023-51375/): WordPress EmbedPress plugin <= 3.8.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-51374](https://insights.sbomify.com/CVE-2023-51374/): WordPress ZeroBounce Email Verification & Validation Plugin <= 1.0.11 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-51373](https://insights.sbomify.com/CVE-2023-51373/): WordPress Google Photos Gallery with Shortcodes Plugin <= 4.0.2 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-51372](https://insights.sbomify.com/CVE-2023-51372/): WordPress HashBar – WordPress Notification Bar Plugin <= 1.4.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-51371](https://insights.sbomify.com/CVE-2023-51371/): WordPress Bit Assist Plugin <= 1.1.9 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-51370](https://insights.sbomify.com/CVE-2023-51370/): WordPress WP Chat App Plugin <= 3.4.4 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-5137](https://insights.sbomify.com/CVE-2023-5137/): Simply Excerpts <= 1.4 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-51369](https://insights.sbomify.com/CVE-2023-51369/): WordPress Customize My Account for WooCommerce plugin <= 1.8.3 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2023-51368](https://insights.sbomify.com/CVE-2023-51368/): QTS, QuTS hero (medium 5.4)
- [CVE-2023-51367](https://insights.sbomify.com/CVE-2023-51367/): QTS, QuTS hero (medium 5.4)
- [CVE-2023-51366](https://insights.sbomify.com/CVE-2023-51366/): QTS, QuTS hero (high 8.7)
- [CVE-2023-51365](https://insights.sbomify.com/CVE-2023-51365/): QTS, QuTS hero, QuTScloud (high 8.7)
- [CVE-2023-51364](https://insights.sbomify.com/CVE-2023-51364/): QTS, QuTS hero, QuTScloud (high 8.7)
- [CVE-2023-51363](https://insights.sbomify.com/CVE-2023-51363/): Information disclosure in VR-S1000 (medium 6.5)
- [CVE-2023-51362](https://insights.sbomify.com/CVE-2023-51362/): WordPress myStickyElements plugin <= 2.1.3 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-51361](https://insights.sbomify.com/CVE-2023-51361/): WordPress Sticky Chat Widget Plugin <= 1.1.8 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-51360](https://insights.sbomify.com/CVE-2023-51360/): WordPress Essential Blocks plugin <= 4.2.0 - Multiple Subscriber+ Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-5136](https://insights.sbomify.com/CVE-2023-5136/): Incorrect Permission Assignment in the TopoGrafix DataPlugin for GPX (medium 5.5)
- [CVE-2023-51359](https://insights.sbomify.com/CVE-2023-51359/): WordPress Essential Blocks plugin <= 4.2.0 - Multiple Contributor+ Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-51358](https://insights.sbomify.com/CVE-2023-51358/): WordPress Block IPs for Gravity Forms Plugin <= 1.0.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-51357](https://insights.sbomify.com/CVE-2023-51357/): Missing authorization in Conversios.io (medium 5.3)
- [CVE-2023-51356](https://insights.sbomify.com/CVE-2023-51356/): WordPress ARMember plugin <= 4.0.10 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2023-51355](https://insights.sbomify.com/CVE-2023-51355/): WordPress MultiVendorX plugin <= 4.0.23 - Broken Access Control vulnerability (high 8.2)
- [CVE-2023-51354](https://insights.sbomify.com/CVE-2023-51354/): WordPress Webba Booking Plugin <= 4.5.33 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-51353](https://insights.sbomify.com/CVE-2023-51353/): WordPress Popup by Supsystic plugin <= 1.10.19 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-51350](https://insights.sbomify.com/CVE-2023-51350/): Auth bypass in ujcms:ujcms (critical 9.8)
- [CVE-2023-5135](https://insights.sbomify.com/CVE-2023-5135/): Simple Cloudflare Turnstile <= 1.23.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5134](https://insights.sbomify.com/CVE-2023-5134/): Easy Registration Forms <= 2.1.1 - Authenticated (Subscriber+) Information Disclosure via Shortcode (medium 4.3)
- [CVE-2023-51339](https://insights.sbomify.com/CVE-2023-51339/): Denial of service in phpjabbers:event ticketing system (medium 6.5)
- [CVE-2023-51338](https://insights.sbomify.com/CVE-2023-51338/): Cross-site scripting in phpjabbers:meeting room booking system (medium 5.4)
- [CVE-2023-51337](https://insights.sbomify.com/CVE-2023-51337/): Cross-site scripting in phpjabbers:event ticketing system (medium 5.4)
- [CVE-2023-51336](https://insights.sbomify.com/CVE-2023-51336/): Code injection in phpjabbers:meeting room booking system (high 8.8)
- [CVE-2023-51335](https://insights.sbomify.com/CVE-2023-51335/): Cross-site scripting in phpjabbers:cinema booking system (medium 6.5)
- [CVE-2023-51334](https://insights.sbomify.com/CVE-2023-51334/): Denial of service in phpjabbers:cinema booking system (medium 5.3)
- [CVE-2023-51333](https://insights.sbomify.com/CVE-2023-51333/): Code injection in phpjabbers:cinema booking system (high 8.8)
- [CVE-2023-51332](https://insights.sbomify.com/CVE-2023-51332/): Denial of service in phpjabbers:meeting room booking system (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/169/