# Vulnerabilities published in 2023


- [CVE-2023-49244](https://insights.sbomify.com/CVE-2023-49244/): Missing authorization in EMUI (high 7.5)
- [CVE-2023-49243](https://insights.sbomify.com/CVE-2023-49243/): Missing authorization in EMUI (high 7.5)
- [CVE-2023-49242](https://insights.sbomify.com/CVE-2023-49242/): Information disclosure in EMUI (high 7.5)
- [CVE-2023-49241](https://insights.sbomify.com/CVE-2023-49241/): Missing authorization in EMUI (high 7.5)
- [CVE-2023-49240](https://insights.sbomify.com/CVE-2023-49240/): Missing authorization in EMUI (high 7.5)
- [CVE-2023-4924](https://insights.sbomify.com/CVE-2023-4924/): BEAR <= 1.1.3.3 - Missing Authorization to Product Deletion (medium 5.4)
- [CVE-2023-49239](https://insights.sbomify.com/CVE-2023-49239/): Missing authorization in EMUI (high 7.5)
- [CVE-2023-49238](https://insights.sbomify.com/CVE-2023-49238/): Auth bypass in gradle:enterprise (critical 9.8)
- [CVE-2023-49237](https://insights.sbomify.com/CVE-2023-49237/): Command injection in trendnet:tv-ip1314pi firmware (critical 9.8)
- [CVE-2023-49236](https://insights.sbomify.com/CVE-2023-49236/): Memory corruption in trendnet:tv-ip1314pi firmware (critical 9.8)
- [CVE-2023-49235](https://insights.sbomify.com/CVE-2023-49235/): Command injection in trendnet:tv-ip1314pi firmware (critical 9.8)
- [CVE-2023-49234](https://insights.sbomify.com/CVE-2023-49234/): An XML external entity (XXE) vulnerability was found in Stilog Visual Planning 8. (medium 6.3)
- [CVE-2023-49233](https://insights.sbomify.com/CVE-2023-49233/): Insufficient access checks in Visual Planning Admin Center 8 before v.1 Build 240207 allow attackers in possession of a non-administrative V (high 8.8)
- [CVE-2023-49232](https://insights.sbomify.com/CVE-2023-49232/): An authentication bypass vulnerability was found in Stilog Visual Planning 8. (critical 9.8)
- [CVE-2023-49231](https://insights.sbomify.com/CVE-2023-49231/): An authentication bypass vulnerability was found in Stilog Visual Planning 8. (critical 9.8)
- [CVE-2023-49230](https://insights.sbomify.com/CVE-2023-49230/): Missing authorization in peplink:balance two firmware (high 8.8)
- [CVE-2023-4923](https://insights.sbomify.com/CVE-2023-4923/): BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Deletion (medium 5.4)
- [CVE-2023-49229](https://insights.sbomify.com/CVE-2023-49229/): Missing authorization in peplink:balance two firmware (medium 4.3)
- [CVE-2023-49228](https://insights.sbomify.com/CVE-2023-49228/): Hardcoded credentials in peplink:balance two firmware (medium 6.4)
- [CVE-2023-49226](https://insights.sbomify.com/CVE-2023-49226/): Command injection in peplink:balance two firmware (high 7.2)
- [CVE-2023-49225](https://insights.sbomify.com/CVE-2023-49225/): Cross-site scripting in AP Solo C110 (medium 6.1)
- [CVE-2023-49224](https://insights.sbomify.com/CVE-2023-49224/): Precor touchscreen console P62, P80, and P82 contains a default SSH public key in the authorized_keys file. (high 8.0)
- [CVE-2023-49223](https://insights.sbomify.com/CVE-2023-49223/): Precor touchscreen console P62, P80, and P82 could allow a remote attacker to obtain sensitive information because the root password is stored in /etc/passwd. (high 8.8)
- [CVE-2023-49222](https://insights.sbomify.com/CVE-2023-49222/): Precor touchscreen console P82 contains a private SSH key that corresponds to a default public key. (high 8.8)
- [CVE-2023-49221](https://insights.sbomify.com/CVE-2023-49221/): Precor touchscreen console P62, P80, and P82 could allow a remote attacker (within the local network) to bypass security restrictions, and a (high 7.8)
- [CVE-2023-4922](https://insights.sbomify.com/CVE-2023-4922/): WPB Show Core <= 2.2 - Unauthenticated Local File Inclusion (critical 9.8)
- [CVE-2023-49216](https://insights.sbomify.com/CVE-2023-49216/): Cross-site scripting in usedesk:usedesk (medium 5.4)
- [CVE-2023-49215](https://insights.sbomify.com/CVE-2023-49215/): Cross-site scripting in usedesk:usedesk (medium 6.1)
- [CVE-2023-49214](https://insights.sbomify.com/CVE-2023-49214/): Code injection in usedesk:usedesk (critical 9.8)
- [CVE-2023-49213](https://insights.sbomify.com/CVE-2023-49213/): Command injection in ironmansoftware:powershell universal (high 8.8)
- [CVE-2023-49210](https://insights.sbomify.com/CVE-2023-49210/): openssl npm package vulnerable to command execution (critical 9.8)
- [CVE-2023-4921](https://insights.sbomify.com/CVE-2023-4921/): Use-after-free in Linux kernel's net/sched: sch_qfq component (high 7.8)
- [CVE-2023-49208](https://insights.sbomify.com/CVE-2023-49208/): Memory corruption in glewlwyd sso server project:glewlwyd sso server (critical 9.8)
- [CVE-2023-49203](https://insights.sbomify.com/CVE-2023-49203/): Denial of service in technitium:dnsserver (high 7.5)
- [CVE-2023-4920](https://insights.sbomify.com/CVE-2023-4920/): BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 4.3)
- [CVE-2023-49198](https://insights.sbomify.com/CVE-2023-49198/): Apache SeaTunnel Web: Arbitrary file read vulnerability (high 7.5)
- [CVE-2023-49197](https://insights.sbomify.com/CVE-2023-49197/): WordPress DoFollow Case by Case Plugin <= 3.4.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-49196](https://insights.sbomify.com/CVE-2023-49196/): WordPress Pagelayer plugin <= 1.7.7 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-49195](https://insights.sbomify.com/CVE-2023-49195/): WordPress Nested Pages Plugin <= 3.2.6 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-49194](https://insights.sbomify.com/CVE-2023-49194/): WordPress Importify (Dropshipping WooCommerce) plugin <= 1.0.4 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2023-49193](https://insights.sbomify.com/CVE-2023-49193/): WordPress Grow Social plugin <= 1.30.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-49192](https://insights.sbomify.com/CVE-2023-49192/): WordPress Enhanced Text Widget plugin <= 1.6.3 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-49191](https://insights.sbomify.com/CVE-2023-49191/): WordPress GDPR Cookie Consent by Supsystic Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-49190](https://insights.sbomify.com/CVE-2023-49190/): WordPress Site Offline Plugin <= 1.5.6 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-4919](https://insights.sbomify.com/CVE-2023-4919/): iframe <= 4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'iframe' Shortcode (medium 6.4)
- [CVE-2023-49189](https://insights.sbomify.com/CVE-2023-49189/): Cross-site scripting in Social Share Buttons & Analytics Plugin – GetSocial.io (medium 5.9)
- [CVE-2023-49188](https://insights.sbomify.com/CVE-2023-49188/): WordPress Track Geolocation Of Users Using Contact Form 7 Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-49187](https://insights.sbomify.com/CVE-2023-49187/): WordPress Adifier System Plugin < 3.1.4 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-49186](https://insights.sbomify.com/CVE-2023-49186/): WordPress Machic Core plugin <= 1.2.6 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2023-49185](https://insights.sbomify.com/CVE-2023-49185/): WordPress Doofinder for WooCommerce Plugin <= 2.1.7 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-49184](https://insights.sbomify.com/CVE-2023-49184/): WordPress Parallax Slider Block Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-49183](https://insights.sbomify.com/CVE-2023-49183/): WordPress NextScripts Plugin <= 4.4.2 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-49182](https://insights.sbomify.com/CVE-2023-49182/): Cross-site scripting in List all posts by Authors, nested Categories and Titles (high 7.1)
- [CVE-2023-49181](https://insights.sbomify.com/CVE-2023-49181/): WordPress WP Event Manager Plugin <= 3.1.40 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-49180](https://insights.sbomify.com/CVE-2023-49180/): WordPress Automatic Youtube Video Posts Plugin Plugin <= 5.2.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-4918](https://insights.sbomify.com/CVE-2023-4918/): Plaintext storage of user password (high 8.8)
- [CVE-2023-49179](https://insights.sbomify.com/CVE-2023-49179/): WordPress Event post Plugin <= 5.8.6 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-49178](https://insights.sbomify.com/CVE-2023-49178/): WordPress HDW Player Plugin (Video Player & Video Gallery) Plugin <= 5.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-49177](https://insights.sbomify.com/CVE-2023-49177/): WordPress which template file Plugin <= 4.9.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-49176](https://insights.sbomify.com/CVE-2023-49176/): WordPress WP Pocket URLs Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-49175](https://insights.sbomify.com/CVE-2023-49175/): WordPress KP Fastest Tawk.to Chat Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-49174](https://insights.sbomify.com/CVE-2023-49174/): WordPress Responsive Lightbox Plugin <= 2.4.5 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-49173](https://insights.sbomify.com/CVE-2023-49173/): WordPress 10to8 Online Appointment Booking System Plugin <= 1.0.9 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-49172](https://insights.sbomify.com/CVE-2023-49172/): WordPress BrainCert – HTML5 Virtual Classroom Plugin <= 1.30 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-49171](https://insights.sbomify.com/CVE-2023-49171/): WordPress Innovs HR Plugin <= 1.0.3.4 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-49170](https://insights.sbomify.com/CVE-2023-49170/): WordPress Forms by CaptainForm Plugin <= 2.5.3 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-4917](https://insights.sbomify.com/CVE-2023-4917/): Leyka <= 3.30.7 - Authenticated (Subscriber+) Sensitive Information Exposure (medium 5.3)
- [CVE-2023-49169](https://insights.sbomify.com/CVE-2023-49169/): WordPress Ads by datafeedr.com Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-49168](https://insights.sbomify.com/CVE-2023-49168/): WordPress BP Better Messages Plugin <= 2.4.0 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-49167](https://insights.sbomify.com/CVE-2023-49167/): WordPress Database for CF7 plugin <= 1.2.4 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-49166](https://insights.sbomify.com/CVE-2023-49166/): WordPress MSync Plugin <= 1.0.0 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-49165](https://insights.sbomify.com/CVE-2023-49165/): WordPress Client Dash Plugin <= 2.2.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-49164](https://insights.sbomify.com/CVE-2023-49164/): WordPress Ocean Extra Plugin <= 2.2.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-49163](https://insights.sbomify.com/CVE-2023-49163/): WordPress teachPress Plugin <= 9.0.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-49162](https://insights.sbomify.com/CVE-2023-49162/): WordPress BigCommerce Plugin <= 5.0.6 is vulnerable to Sensitive Data Exposure (medium 5.3)
- [CVE-2023-49161](https://insights.sbomify.com/CVE-2023-49161/): WordPress Bravo Translate Plugin <= 1.2 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-49160](https://insights.sbomify.com/CVE-2023-49160/): WordPress Formzu WP Plugin <= 1.6.6 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-4916](https://insights.sbomify.com/CVE-2023-4916/): Login with phone number <= 1.5.6 - Cross-Site Request Forgery to User Password Change (high 8.8)
- [CVE-2023-49159](https://insights.sbomify.com/CVE-2023-49159/): WordPress CommentLuv Plugin <= 3.0.4 is vulnerable to Server Side Request Forgery (SSRF) (high 7.2)
- [CVE-2023-49158](https://insights.sbomify.com/CVE-2023-49158/): WordPress LadiApp plugin <= 4.4 - Broken Access Control lead to XSS vulnerability (high 7.1)
- [CVE-2023-49157](https://insights.sbomify.com/CVE-2023-49157/): WordPress Multiple Post Passwords Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-49156](https://insights.sbomify.com/CVE-2023-49156/): WordPress GoDaddy Email Marketing plugin <= 1.4.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-49155](https://insights.sbomify.com/CVE-2023-49155/): WordPress Button Generator – easily Button Builder Plugin <= 2.3.8 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-49154](https://insights.sbomify.com/CVE-2023-49154/): WordPress Button Generator – easily Button Builder plugin <= 2.3.8 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-49153](https://insights.sbomify.com/CVE-2023-49153/): Cross-site request forgery in Add to Cart Text Changer and Customize Button, Add Custom Icon (medium 4.3)
- [CVE-2023-49152](https://insights.sbomify.com/CVE-2023-49152/): WordPress Credit Tracker Plugin <= 1.1.17 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-49151](https://insights.sbomify.com/CVE-2023-49151/): WordPress Google Calendar Events Plugin <= 3.2.6 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-49150](https://insights.sbomify.com/CVE-2023-49150/): WordPress Crypto Converter Widget Plugin <= 1.8.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-4915](https://insights.sbomify.com/CVE-2023-4915/): WP User Control <= 1.5.3 - Insecure Password Reset Mechanism (medium 5.3)
- [CVE-2023-49149](https://insights.sbomify.com/CVE-2023-49149/): WordPress Currency Converter Calculator Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-49148](https://insights.sbomify.com/CVE-2023-49148/): Cross-site request forgery in Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates (medium 5.4)
- [CVE-2023-49147](https://insights.sbomify.com/CVE-2023-49147/): Privilege escalation in pdf24:pdf24 creator (high 7.8)
- [CVE-2023-49146](https://insights.sbomify.com/CVE-2023-49146/): Cross-site Scripting in DOMSanitizer (medium 6.1)
- [CVE-2023-49145](https://insights.sbomify.com/CVE-2023-49145/): Apache NiFi: Improper Neutralization of Input in Advanced User Interface for Jolt (high 7.9)
- [CVE-2023-49144](https://insights.sbomify.com/CVE-2023-49144/): Memory corruption in Intel(R) Server Platforms (high 8.1)
- [CVE-2023-49143](https://insights.sbomify.com/CVE-2023-49143/): Denial of service in GC-A22W-CW (high 7.5)
- [CVE-2023-49142](https://insights.sbomify.com/CVE-2023-49142/): multimedia audio has a UAF vulnerability (medium 4.0)
- [CVE-2023-49141](https://insights.sbomify.com/CVE-2023-49141/): Privilege escalation in Intel(R) Processors stream cache mechanism (high 7.3)
- [CVE-2023-49140](https://insights.sbomify.com/CVE-2023-49140/): Denial of service in GC-A22W-CW (high 7.5)
- [CVE-2023-4914](https://insights.sbomify.com/CVE-2023-4914/): Relative Path Traversal in cecilapp/cecil (medium 5.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/183/