# Vulnerabilities published in 2023


- [CVE-2023-5084](https://insights.sbomify.com/CVE-2023-5084/): Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp (low 3.9)
- [CVE-2023-50839](https://insights.sbomify.com/CVE-2023-50839/): WordPress JS Help Desk – Best Help Desk & Support Plugin <= 2.8.1 is vulnerable to SQL Injection (critical 9.3)
- [CVE-2023-50838](https://insights.sbomify.com/CVE-2023-50838/): WordPress NEX-Forms – Ultimate Form Builder Plugin <= 8.5.5 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-50837](https://insights.sbomify.com/CVE-2023-50837/): WordPress Login Lockdown Plugin <= 2.06 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-50836](https://insights.sbomify.com/CVE-2023-50836/): WordPress HTML Forms Plugin <= 1.3.28 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-50835](https://insights.sbomify.com/CVE-2023-50835/): WordPress Advanced Category Template Plugin <= 0.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-50834](https://insights.sbomify.com/CVE-2023-50834/): WordPress WooCommerce Menu Extension Plugin <= 1.6.2 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-50833](https://insights.sbomify.com/CVE-2023-50833/): WordPress Colibri Page Builder Plugin <= 1.0.239 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-50832](https://insights.sbomify.com/CVE-2023-50832/): WordPress Multi Step Form Plugin <= 1.7.13 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-50831](https://insights.sbomify.com/CVE-2023-50831/): WordPress CURCY Plugin <= 2.2.0 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-50830](https://insights.sbomify.com/CVE-2023-50830/): WordPress Seos Contact Form Plugin <= 1.8.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-50829](https://insights.sbomify.com/CVE-2023-50829/): WordPress Loan Repayment Calculator and Application Form Plugin <= 2.9.3 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-50828](https://insights.sbomify.com/CVE-2023-50828/): WordPress Ultimate Dashboard Plugin <= 3.7.11 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-50827](https://insights.sbomify.com/CVE-2023-50827/): WordPress Accredible Certificates & Open Badges Plugin <= 1.4.8 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-50826](https://insights.sbomify.com/CVE-2023-50826/): WordPress Menu Image, Icons made easy Plugin <= 3.10 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-50825](https://insights.sbomify.com/CVE-2023-50825/): WordPress iframe Shortcode Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-50824](https://insights.sbomify.com/CVE-2023-50824/): Cross-site scripting in Insert or Embed Articulate Content into WordPress (medium 6.5)
- [CVE-2023-50823](https://insights.sbomify.com/CVE-2023-50823/): WordPress CSS & JavaScript Toolbox Plugin <= 11.7 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-50822](https://insights.sbomify.com/CVE-2023-50822/): WordPress Currency Converter Widget Plugin <= 3.0.2 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-50821](https://insights.sbomify.com/CVE-2023-50821/): Memory corruption in SIMATIC PCS 7 V9.1 (medium 6.9)
- [CVE-2023-5082](https://insights.sbomify.com/CVE-2023-5082/): History Log by click5 < 1.0.13 - Admin+ Time-Based Blind SQL Injection (high 7.2)
- [CVE-2023-50811](https://insights.sbomify.com/CVE-2023-50811/): Missing authorization in seling:visual access manager (medium 6.5)
- [CVE-2023-50810](https://insights.sbomify.com/CVE-2023-50810/): In certain Sonos products before Sonos S1 Release 11.12 and S2 release 15.9, a vulnerability exists in the U-Boot component of the firmware (medium 6.0)
- [CVE-2023-5081](https://insights.sbomify.com/CVE-2023-5081/): Information disclosure in Tablet (low 3.3)
- [CVE-2023-50809](https://insights.sbomify.com/CVE-2023-50809/): In certain Sonos products before S1 Release 11.12 and S2 release 15.9, the mt_7615.ko wireless driver does not properly validate an informat (high 7.8)
- [CVE-2023-50808](https://insights.sbomify.com/CVE-2023-50808/): Cross-site scripting in zimbra:collaboration (critical 9.1)
- [CVE-2023-50807](https://insights.sbomify.com/CVE-2023-50807/): Memory corruption in samsung:exynos 9110 firmware (high 8.1)
- [CVE-2023-50806](https://insights.sbomify.com/CVE-2023-50806/): Memory corruption in samsung:exynos 1080 firmware (high 8.4)
- [CVE-2023-50805](https://insights.sbomify.com/CVE-2023-50805/): Memory corruption in samsung:exynos 1080 firmware (high 8.1)
- [CVE-2023-50804](https://insights.sbomify.com/CVE-2023-50804/): Auth bypass in samsung:exynos 1080 firmware (low 3.7)
- [CVE-2023-50803](https://insights.sbomify.com/CVE-2023-50803/): Security feature bypass in samsung:exynos 1080 firmware (low 3.7)
- [CVE-2023-5080](https://insights.sbomify.com/CVE-2023-5080/): Privilege escalation in Tablet (medium 6.8)
- [CVE-2023-5079](https://insights.sbomify.com/CVE-2023-5079/): Other in LeCloud Application (high 7.5)
- [CVE-2023-50786](https://insights.sbomify.com/CVE-2023-50786/): Information disclosure in Dradis (medium 4.1)
- [CVE-2023-50785](https://insights.sbomify.com/CVE-2023-50785/): Path traversal in zohocorp:manageengine adaudit plus (low 2.7)
- [CVE-2023-50784](https://insights.sbomify.com/CVE-2023-50784/): Memory corruption in unrealircd:unrealircd (high 7.5)
- [CVE-2023-50783](https://insights.sbomify.com/CVE-2023-50783/): Apache Airflow: Improper access control vulnerability on the "varimport" endpoint (medium 6.5)
- [CVE-2023-50782](https://insights.sbomify.com/CVE-2023-50782/): Python-cryptography: bleichenbacher timing oracle attack against rsa decryption - incomplete fix for cve-2020-25659 (high 7.5)
- [CVE-2023-50781](https://insights.sbomify.com/CVE-2023-50781/): M2crypto: bleichenbacher timing attacks in the rsa decryption api - incomplete fix for cve-2020-25657 (high 7.5)
- [CVE-2023-50780](https://insights.sbomify.com/CVE-2023-50780/): Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans (high 8.8)
- [CVE-2023-5078](https://insights.sbomify.com/CVE-2023-5078/): Security feature bypass in ThinkPad BIOS (medium 6.7)
- [CVE-2023-50779](https://insights.sbomify.com/CVE-2023-50779/): Missing permission check in Jenkins PaaSLane Estimate Plugin (medium 4.3)
- [CVE-2023-50778](https://insights.sbomify.com/CVE-2023-50778/): Cross-Site Request Forgery in Jenkins PaaSLane Estimate Plugin (high 8.8)
- [CVE-2023-50777](https://insights.sbomify.com/CVE-2023-50777/): Tokens stored in plain text by PaaSLane Estimate Plugin (medium 4.3)
- [CVE-2023-50776](https://insights.sbomify.com/CVE-2023-50776/): Tokens stored in plain text by PaaSLane Estimate Plugin (medium 4.3)
- [CVE-2023-50775](https://insights.sbomify.com/CVE-2023-50775/): Cross-site request forgery vulnerability in Jenkins Deployment Dashboard Plugin (medium 4.3)
- [CVE-2023-50774](https://insights.sbomify.com/CVE-2023-50774/): Cross-site request forgery vulnerability in Jenkins HTMLResource Plugin (high 8.1)
- [CVE-2023-50773](https://insights.sbomify.com/CVE-2023-50773/): Displayed in plain text by Dingding JSON Pusher Plugin (medium 4.3)
- [CVE-2023-50772](https://insights.sbomify.com/CVE-2023-50772/): Tokens stored in plain text by Dingding JSON Pusher Plugin (medium 4.3)
- [CVE-2023-50771](https://insights.sbomify.com/CVE-2023-50771/): Open redirect vulnerability in Jenkins OpenId Connect Authentication Plugin (medium 6.1)
- [CVE-2023-50770](https://insights.sbomify.com/CVE-2023-50770/): Password stored in a recoverable format by Jenkins OpenId Connect Authentication Plugin (medium 6.7)
- [CVE-2023-5077](https://insights.sbomify.com/CVE-2023-5077/): Vault's Google Cloud Secrets Engine Removed Existing IAM Conditions When Creating / Updating Rolesets (high 7.6)
- [CVE-2023-50769](https://insights.sbomify.com/CVE-2023-50769/): Jenkins Nexus Platform Plugin missing permission check (medium 4.3)
- [CVE-2023-50768](https://insights.sbomify.com/CVE-2023-50768/): Jenkins Nexus Platform Plugin Cross-Site Request Forgery vulnerability (high 8.8)
- [CVE-2023-50767](https://insights.sbomify.com/CVE-2023-50767/): Jenkins Nexus Platform Plugin missing permission check (medium 5.4)
- [CVE-2023-50766](https://insights.sbomify.com/CVE-2023-50766/): Jenkins Nexus Platform Plugin Cross-Site Request Forgery vulnerability (high 8.8)
- [CVE-2023-50765](https://insights.sbomify.com/CVE-2023-50765/): Missing permission check in Jenkins Scriptler Plugin (medium 4.3)
- [CVE-2023-50764](https://insights.sbomify.com/CVE-2023-50764/): Arbitrary file deletion vulnerability in Jenkins Scriptler Plugin (high 8.1)
- [CVE-2023-50763](https://insights.sbomify.com/CVE-2023-50763/): Denial of service in SIMATIC CP 1542SP-1 (medium 6.9)
- [CVE-2023-50762](https://insights.sbomify.com/CVE-2023-50762/): Security feature bypass in Thunderbird (medium 4.3)
- [CVE-2023-50761](https://insights.sbomify.com/CVE-2023-50761/): Security feature bypass in Thunderbird (medium 4.3)
- [CVE-2023-50760](https://insights.sbomify.com/CVE-2023-50760/): Online Notice Board System v1.0 - Insecure File Upload (high 8.8)
- [CVE-2023-5076](https://insights.sbomify.com/CVE-2023-5076/): Ziteboard Online Whiteboard <= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via ziteboard Shortcode (medium 6.4)
- [CVE-2023-50753](https://insights.sbomify.com/CVE-2023-50753/): Online Notice Board System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-50752](https://insights.sbomify.com/CVE-2023-50752/): Online Notice Board System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-5075](https://insights.sbomify.com/CVE-2023-5075/): Memory corruption in IdeaPad Duet 3-10IGL5 (medium 6.7)
- [CVE-2023-50743](https://insights.sbomify.com/CVE-2023-50743/): Online Notice Board System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-50740](https://insights.sbomify.com/CVE-2023-50740/): Apache Linkis DataSource: DataSource module Oracle SQL Database Password Logged (medium 5.3)
- [CVE-2023-5074](https://insights.sbomify.com/CVE-2023-5074/): Authentication Bypass in D-Link D-View 8 (critical 9.8)
- [CVE-2023-50739](https://insights.sbomify.com/CVE-2023-50739/): A buffer overflow vulnerability has been identified in the Internet Printing Protocol (IPP) in various Lexmark devices. (high 8.8)
- [CVE-2023-50738](https://insights.sbomify.com/CVE-2023-50738/): A firmware downgrade prevention vulnerability has been identified in newer Lexmark devices. (medium 4.3)
- [CVE-2023-50737](https://insights.sbomify.com/CVE-2023-50737/): An input validation vulnerability in the SE Menu allows an attacker to execute arbitrary code. (critical 9.1)
- [CVE-2023-50736](https://insights.sbomify.com/CVE-2023-50736/): A vulnerability has been identified in the PostScript interpreter in various Lexmark devices. (critical 9.0)
- [CVE-2023-50735](https://insights.sbomify.com/CVE-2023-50735/): A vulnerability has been identified in the PostScript interpreter in various Lexmark devices. (critical 9.0)
- [CVE-2023-50734](https://insights.sbomify.com/CVE-2023-50734/): A vulnerability has been identified in the PostScript interpreter in various Lexmark devices. (critical 9.0)
- [CVE-2023-50733](https://insights.sbomify.com/CVE-2023-50733/): A Server-Side Request Forgery (SSRF) vulnerability exists in newer Lexmark devices. (high 8.6)
- [CVE-2023-50732](https://insights.sbomify.com/CVE-2023-50732/): Velocity execution without script right through tree macro (high 8.3)
- [CVE-2023-50731](https://insights.sbomify.com/CVE-2023-50731/): MindsDB has arbitrary file write in file.py (critical 9.1)
- [CVE-2023-50730](https://insights.sbomify.com/CVE-2023-50730/): Grackle has StackOverflowError in GraphQL query processing (high 7.5)
- [CVE-2023-5073](https://insights.sbomify.com/CVE-2023-5073/): iframe forms <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via iframe Shortcode (medium 6.4)
- [CVE-2023-50729](https://insights.sbomify.com/CVE-2023-50729/): An unrestricted file upload vulnerability in traccar leads to RCE (high 8.5)
- [CVE-2023-50728](https://insights.sbomify.com/CVE-2023-50728/): Unauthenticated Denial of Service in the octokit/webhooks library (medium 5.4)
- [CVE-2023-50727](https://insights.sbomify.com/CVE-2023-50727/): Resque vulnerable to reflected XSS in Queue Endpoint (medium 6.3)
- [CVE-2023-50726](https://insights.sbomify.com/CVE-2023-50726/): Users with `create` but not `override` privileges can perform local sync in argo-cd (medium 6.4)
- [CVE-2023-50725](https://insights.sbomify.com/CVE-2023-50725/): Resque vulnerable to reflected XSS in resque-web failed and queues lists (medium 6.3)
- [CVE-2023-50724](https://insights.sbomify.com/CVE-2023-50724/): Resque vulnerable to reflected cross site scripting through pathname (medium 6.3)
- [CVE-2023-50723](https://insights.sbomify.com/CVE-2023-50723/): XWiki Platform remote code execution/programming rights with configuration section from any user account (critical 10.0)
- [CVE-2023-50722](https://insights.sbomify.com/CVE-2023-50722/): XWiki Platform XSS/CSRF Remote Code Execution in XWiki.ConfigurableClass (critical 9.7)
- [CVE-2023-50721](https://insights.sbomify.com/CVE-2023-50721/): XWiki Platform RCE from account through SearchAdmin (critical 10.0)
- [CVE-2023-50720](https://insights.sbomify.com/CVE-2023-50720/): XWiki Platform Solr search discloses email addresses of users (medium 5.3)
- [CVE-2023-5072](https://insights.sbomify.com/CVE-2023-5072/): DoS Vulnerability in JSON-Java (high 7.5)
- [CVE-2023-50719](https://insights.sbomify.com/CVE-2023-50719/): XWiki Platform Solr search discloses password hashes of all users (high 7.5)
- [CVE-2023-50718](https://insights.sbomify.com/CVE-2023-50718/): NocoDB SQL Injection vulnerability (medium 6.5)
- [CVE-2023-50717](https://insights.sbomify.com/CVE-2023-50717/): NocoDB Allows Preview of File with Dangerous Content (medium 5.7)
- [CVE-2023-50716](https://insights.sbomify.com/CVE-2023-50716/): Invalid DATA_FRAG Submessage causes a bad-free error (critical 9.7)
- [CVE-2023-50715](https://insights.sbomify.com/CVE-2023-50715/): User accounts disclosed to unauthenticated actors on the LAN (medium 4.3)
- [CVE-2023-50714](https://insights.sbomify.com/CVE-2023-50714/): The Oauth2 PKCE implementation is vulnerable (medium 6.8)
- [CVE-2023-50713](https://insights.sbomify.com/CVE-2023-50713/): Speckle Server API Token Privilege Escalation (medium 6.5)
- [CVE-2023-50712](https://insights.sbomify.com/CVE-2023-50712/): Improper Neutralization of Alternate XSS Syntax in iris-web (medium 4.6)
- [CVE-2023-50711](https://insights.sbomify.com/CVE-2023-50711/): `serde` deserialization for `FamStructWrapper` lacks bound checks that could potentially lead to out-of-bounds memory access (medium 5.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/173/