# Vulnerabilities published in 2023


- [CVE-2023-50944](https://insights.sbomify.com/CVE-2023-50944/): Apache Airflow: Bypass permission verification to read code of other dags (medium 6.5)
- [CVE-2023-50943](https://insights.sbomify.com/CVE-2023-50943/): Apache Airflow: Potential pickle deserialization vulnerability in XComs (high 7.5)
- [CVE-2023-50941](https://insights.sbomify.com/CVE-2023-50941/): IBM PowerSC session fixation (medium 6.3)
- [CVE-2023-50940](https://insights.sbomify.com/CVE-2023-50940/): IBM PowerSC cross-resource origin sharing (medium 5.3)
- [CVE-2023-50939](https://insights.sbomify.com/CVE-2023-50939/): IBM PowerSC information Disclosure (medium 5.9)
- [CVE-2023-50938](https://insights.sbomify.com/CVE-2023-50938/): IBM PowerSC clickjacking (medium 6.5)
- [CVE-2023-50937](https://insights.sbomify.com/CVE-2023-50937/): IBM PowerSC information disclosure (medium 5.9)
- [CVE-2023-50936](https://insights.sbomify.com/CVE-2023-50936/): IBM PowerSC session fixation (medium 6.3)
- [CVE-2023-50935](https://insights.sbomify.com/CVE-2023-50935/): IBM PowerSC forced browsing (medium 6.5)
- [CVE-2023-50934](https://insights.sbomify.com/CVE-2023-50934/): IBM PowerSC improper authentication (medium 5.3)
- [CVE-2023-50933](https://insights.sbomify.com/CVE-2023-50933/): IBM PowerSC HTML injection (medium 6.1)
- [CVE-2023-50932](https://insights.sbomify.com/CVE-2023-50932/): Cross-site request forgery in savignano:s-notify (high 8.3)
- [CVE-2023-50931](https://insights.sbomify.com/CVE-2023-50931/): Cross-site request forgery in savignano:s-notify (high 8.3)
- [CVE-2023-50930](https://insights.sbomify.com/CVE-2023-50930/): Cross-site request forgery in savignano:s-notify (high 8.3)
- [CVE-2023-50928](https://insights.sbomify.com/CVE-2023-50928/): sandbox-accounts-for-events security misconfiguration leads to budget exceed (high 7.1)
- [CVE-2023-50927](https://insights.sbomify.com/CVE-2023-50927/): Insufficient boundary checks for DIO and DAO messages in RPL-Lite in Contiki-NG (high 8.6)
- [CVE-2023-50926](https://insights.sbomify.com/CVE-2023-50926/): Unvalidated DIO prefix info length in RPL-Lite in Contiki-NG (high 7.5)
- [CVE-2023-50924](https://insights.sbomify.com/CVE-2023-50924/): Stored XSS in Overview and Output fields (high 7.3)
- [CVE-2023-50923](https://insights.sbomify.com/CVE-2023-50923/): In QUIC in RFC 9000, the Latency Spin Bit specification (section 17.4) does not strictly constrain the bit value when the feature is disable (medium 4.3)
- [CVE-2023-50922](https://insights.sbomify.com/CVE-2023-50922/): File upload in gl-inet:gl-a1300 firmware (high 7.2)
- [CVE-2023-50921](https://insights.sbomify.com/CVE-2023-50921/): Privilege escalation in gl-inet:gl-a1300 firmware (critical 9.8)
- [CVE-2023-50920](https://insights.sbomify.com/CVE-2023-50920/): Auth bypass in gl-inet:gl-a1300 firmware (medium 5.5)
- [CVE-2023-50919](https://insights.sbomify.com/CVE-2023-50919/): Auth bypass in gl-inet:gl-a1300 firmware (critical 9.8)
- [CVE-2023-50918](https://insights.sbomify.com/CVE-2023-50918/): Missing authorization in misp-project:misp (critical 9.8)
- [CVE-2023-50917](https://insights.sbomify.com/CVE-2023-50917/): Command injection in mjdm:majordomo (critical 9.8)
- [CVE-2023-50916](https://insights.sbomify.com/CVE-2023-50916/): Information disclosure in kyocera:device manager (high 7.2)
- [CVE-2023-50915](https://insights.sbomify.com/CVE-2023-50915/): An issue exists in GalaxyClientService.exe in GOG Galaxy (Beta) 2.0.67.2 through 2.0.71.2 that could allow authenticated users to overwrite (medium 6.5)
- [CVE-2023-50914](https://insights.sbomify.com/CVE-2023-50914/): A Privilege Escalation issue in the inter-process communication procedure from GOG Galaxy (Beta) 2.0.67.2 through v2.0.71.2 allows authentic (medium 6.7)
- [CVE-2023-50913](https://insights.sbomify.com/CVE-2023-50913/): Oxide control plane software before 5 allows SSRF. (critical 9.1)
- [CVE-2023-5091](https://insights.sbomify.com/CVE-2023-5091/): Mali GPU Kernel Driver allows improper GPU processing operations (high 7.0)
- [CVE-2023-50905](https://insights.sbomify.com/CVE-2023-50905/): WordPress WP Activity Log Plugin <= 4.6.1 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-50904](https://insights.sbomify.com/CVE-2023-50904/): WordPress Poll Maker plugin <= 4.8.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-50903](https://insights.sbomify.com/CVE-2023-50903/): WordPress Metform Elementor Contact Form Builder plugin <= 3.4.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-50902](https://insights.sbomify.com/CVE-2023-50902/): WordPress New User Approve Plugin <= 2.5.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-50901](https://insights.sbomify.com/CVE-2023-50901/): WordPress HT Mega Plugin <= 2.3.8 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-50900](https://insights.sbomify.com/CVE-2023-50900/): WordPress Master Slider plugin <= 3.9.10 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2023-5090](https://insights.sbomify.com/CVE-2023-5090/): Kernel: kvm: svm: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic msrs (medium 6.0)
- [CVE-2023-50899](https://insights.sbomify.com/CVE-2023-50899/): WordPress Product Catalog Enquiry for WooCommerce by MultiVendorX plugin <= 5.0.2 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-50898](https://insights.sbomify.com/CVE-2023-50898/): WordPress Image Optimizer, Resizer and CDN – Sirv plugin <= 7.1.2 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-50897](https://insights.sbomify.com/CVE-2023-50897/): WordPress Media File Renamer plugin <= 5.7.7 - Arbitrary File Rename lead to RCE vulnerability (critical 9.1)
- [CVE-2023-50896](https://insights.sbomify.com/CVE-2023-50896/): WordPress weForms Plugin <= 1.6.17 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-50895](https://insights.sbomify.com/CVE-2023-50895/): Code injection in janitza:gridvis (high 7.2)
- [CVE-2023-50894](https://insights.sbomify.com/CVE-2023-50894/): Hardcoded credentials in janitza:gridvis (high 8.8)
- [CVE-2023-50893](https://insights.sbomify.com/CVE-2023-50893/): WordPress UpSolution Core Plugin <= 8.17.4 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-50892](https://insights.sbomify.com/CVE-2023-50892/): WordPress TheGem Theme <= 5.9.1 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-50891](https://insights.sbomify.com/CVE-2023-50891/): WordPress Zoho Forms Plugin <= 3.0.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-50890](https://insights.sbomify.com/CVE-2023-50890/): WordPress Ultimate Addons for Elementor plugin <= 1.36.20 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2023-5089](https://insights.sbomify.com/CVE-2023-5089/): Defender Security < 4.1.0 - Protection Bypass (Hidden Login Page) (medium 5.3)
- [CVE-2023-50889](https://insights.sbomify.com/CVE-2023-50889/): WordPress Beaver Builder Plugin <= 2.7.2 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-50887](https://insights.sbomify.com/CVE-2023-50887/): WordPress User Feedback plugin <= 1.0.10 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-50886](https://insights.sbomify.com/CVE-2023-50886/): WordPress Legal Pages plugin <= 1.3.7 - CSRF + Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-50885](https://insights.sbomify.com/CVE-2023-50885/): WordPress Store Locator WordPress Plugin <= 1.4.14 is vulnerable to Arbitrary File Deletion (medium 6.8)
- [CVE-2023-50884](https://insights.sbomify.com/CVE-2023-50884/): WordPress LA-Studio Element Kit for Elementor plugin <= 1.1.5 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-50883](https://insights.sbomify.com/CVE-2023-50883/): Cross-site scripting in onlyoffice:document server (medium 6.1)
- [CVE-2023-50882](https://insights.sbomify.com/CVE-2023-50882/): WordPress ProfilePress plugin <= 4.13.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-50881](https://insights.sbomify.com/CVE-2023-50881/): WordPress Advanced Access Manager Plugin <= 6.9.15 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-50880](https://insights.sbomify.com/CVE-2023-50880/): WordPress BuddyPress Plugin <= 11.3.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-5088](https://insights.sbomify.com/CVE-2023-5088/): Qemu: improper ide controller reset can lead to mbr overwrite (medium 6.4)
- [CVE-2023-50879](https://insights.sbomify.com/CVE-2023-50879/): WordPress WordPress.com Editing Toolkit Plugin <= 3.78784 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-50878](https://insights.sbomify.com/CVE-2023-50878/): WordPress MStore API Plugin <= 4.10.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-50877](https://insights.sbomify.com/CVE-2023-50877/): WordPress Product Filter by WBW plugin <= 2.5.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-50876](https://insights.sbomify.com/CVE-2023-50876/): WordPress Molongui plugin <= 4.7.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-50875](https://insights.sbomify.com/CVE-2023-50875/): WordPress Sensei LMS Plugin <= 4.17.0 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-50874](https://insights.sbomify.com/CVE-2023-50874/): WordPress Ajax Load More Plugin <= 6.1.0.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-50873](https://insights.sbomify.com/CVE-2023-50873/): WordPress Add Any Extension to Pages Plugin <= 1.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-50872](https://insights.sbomify.com/CVE-2023-50872/): The API in Accredible Credential.net December 6th, 2023 allows an Insecure Direct Object Reference attack that discloses partial information (high 7.5)
- [CVE-2023-50871](https://insights.sbomify.com/CVE-2023-50871/): Missing authorization in YouTrack (medium 4.3)
- [CVE-2023-50870](https://insights.sbomify.com/CVE-2023-50870/): Cross-site request forgery in TeamCity (medium 4.3)
- [CVE-2023-5087](https://insights.sbomify.com/CVE-2023-5087/): PageLayer < 1.7.8 - Author+ Stored XSS (medium 5.4)
- [CVE-2023-50868](https://insights.sbomify.com/CVE-2023-50868/): Denial of service in debian:debian linux (high 7.5)
- [CVE-2023-50867](https://insights.sbomify.com/CVE-2023-50867/): Travel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-50866](https://insights.sbomify.com/CVE-2023-50866/): Travel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-50865](https://insights.sbomify.com/CVE-2023-50865/): Travel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-50864](https://insights.sbomify.com/CVE-2023-50864/): Travel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-50863](https://insights.sbomify.com/CVE-2023-50863/): Travel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-50862](https://insights.sbomify.com/CVE-2023-50862/): Travel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-50861](https://insights.sbomify.com/CVE-2023-50861/): WordPress HUSKY plugin <= 1.3.4.3 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2023-50860](https://insights.sbomify.com/CVE-2023-50860/): WordPress Amelia Plugin <= 1.0.85 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-5086](https://insights.sbomify.com/CVE-2023-5086/): Copy Anything to Clipboard <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-50859](https://insights.sbomify.com/CVE-2023-50859/): WordPress WP Crowdfunding Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-50858](https://insights.sbomify.com/CVE-2023-50858/): WordPress Anti Hacker Plugin <= 4.34 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-50857](https://insights.sbomify.com/CVE-2023-50857/): WordPress Automation By Autonami Plugin <= 2.6.1 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-50856](https://insights.sbomify.com/CVE-2023-50856/): WordPress Funnel Builder for WordPress by FunnelKit Plugin <= 2.14.3 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-50855](https://insights.sbomify.com/CVE-2023-50855/): WordPress Pre* Party Resource Hints Plugin <= 1.8.18 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-50854](https://insights.sbomify.com/CVE-2023-50854/): WordPress Squirrly SEO - Advanced Pack Plugin <= 2.3.8 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-50853](https://insights.sbomify.com/CVE-2023-50853/): SQL injection in Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms (high 7.6)
- [CVE-2023-50852](https://insights.sbomify.com/CVE-2023-50852/): WordPress BookIt Plugin <= 2.4.3 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-50851](https://insights.sbomify.com/CVE-2023-50851/): WordPress Simply Schedule Appointments Plugin < 1.6.6.1 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-50850](https://insights.sbomify.com/CVE-2023-50850/): WordPress Woo Subscriptions plugin < 5.8.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-5085](https://insights.sbomify.com/CVE-2023-5085/): Advanced Menu Widget <= 0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-50849](https://insights.sbomify.com/CVE-2023-50849/): WordPress e2pdf Plugin <= 1.20.23 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-50848](https://insights.sbomify.com/CVE-2023-50848/): WordPress 404 Solution Plugin <= 2.34.0 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-50847](https://insights.sbomify.com/CVE-2023-50847/): WordPress Welcart e-Commerce Plugin <= 2.9.3 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-50846](https://insights.sbomify.com/CVE-2023-50846/): WordPress RegistrationMagic Plugin <= 5.2.4.5 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-50845](https://insights.sbomify.com/CVE-2023-50845/): WordPress GeoDirectory Plugin <= 2.3.28 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-50844](https://insights.sbomify.com/CVE-2023-50844/): WordPress WP Mail Catcher Plugin <= 2.1.3 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-50843](https://insights.sbomify.com/CVE-2023-50843/): WordPress Clockwork SMS Notfications Plugin <= 3.0.4 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-50842](https://insights.sbomify.com/CVE-2023-50842/): WordPress MF Gig Calendar Plugin <= 1.2.1 is vulnerable to SQL Injection (high 8.5)
- [CVE-2023-50841](https://insights.sbomify.com/CVE-2023-50841/): WordPress BookingPress Plugin <= 1.0.72 is vulnerable to SQL Injection (high 8.5)
- [CVE-2023-50840](https://insights.sbomify.com/CVE-2023-50840/): WordPress Booking Manager Plugin <= 2.1.5 is vulnerable to SQL Injection (high 8.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/172/