# Vulnerabilities published in 2023


- [CVE-2023-48023](https://insights.sbomify.com/CVE-2023-48023/): Server-side request forgery in anyscale:ray (critical 9.1)
- [CVE-2023-48022](https://insights.sbomify.com/CVE-2023-48022/): Ray has arbitrary code execution via jobs submission API (critical 9.8)
- [CVE-2023-48021](https://insights.sbomify.com/CVE-2023-48021/): Cross-site request forgery in iteachyou:dreamer cms (high 8.8)
- [CVE-2023-48020](https://insights.sbomify.com/CVE-2023-48020/): Cross-site request forgery in iteachyou:dreamer cms (high 8.8)
- [CVE-2023-4802](https://insights.sbomify.com/CVE-2023-4802/): ITM Server Cross-site Scripting in UpdateInstalledSoftware Endpoint (medium 4.8)
- [CVE-2023-48017](https://insights.sbomify.com/CVE-2023-48017/): Cross-site request forgery in iteachyou:dreamer cms (high 8.8)
- [CVE-2023-48016](https://insights.sbomify.com/CVE-2023-48016/): SQL injection in phpgurukul:restaurant table booking system (high 7.5)
- [CVE-2023-48014](https://insights.sbomify.com/CVE-2023-48014/): Memory corruption in gpac:gpac (high 7.8)
- [CVE-2023-48013](https://insights.sbomify.com/CVE-2023-48013/): Memory corruption in gpac:gpac (high 7.8)
- [CVE-2023-48011](https://insights.sbomify.com/CVE-2023-48011/): Use after free in gpac:gpac (high 7.8)
- [CVE-2023-48010](https://insights.sbomify.com/CVE-2023-48010/): STMicroelectronics SPC58 is vulnerable to Missing Protection Mechanism for Alternate Hardware Interface. (critical 9.8)
- [CVE-2023-4801](https://insights.sbomify.com/CVE-2023-4801/): ITM MacOS Agent Improper Certificate Validation (high 7.5)
- [CVE-2023-48003](https://insights.sbomify.com/CVE-2023-48003/): Open redirect in aspnetzero:asp.net zero (medium 6.1)
- [CVE-2023-4800](https://insights.sbomify.com/CVE-2023-4800/): DoLogin Security < 3.7.1 - Subscriber+ IP Address leak (medium 6.5)
- [CVE-2023-47997](https://insights.sbomify.com/CVE-2023-47997/): Denial of service in freeimage project:freeimage (medium 6.5)
- [CVE-2023-47996](https://insights.sbomify.com/CVE-2023-47996/): Integer overflow in freeimage project:freeimage (medium 6.5)
- [CVE-2023-47995](https://insights.sbomify.com/CVE-2023-47995/): Denial of service in freeimage project:freeimage (medium 6.5)
- [CVE-2023-47994](https://insights.sbomify.com/CVE-2023-47994/): Integer overflow in freeimage project:freeimage (high 8.8)
- [CVE-2023-47993](https://insights.sbomify.com/CVE-2023-47993/): Memory corruption in freeimage project:freeimage (medium 6.5)
- [CVE-2023-47992](https://insights.sbomify.com/CVE-2023-47992/): Integer overflow in freeimage project:freeimage (high 8.8)
- [CVE-2023-47990](https://insights.sbomify.com/CVE-2023-47990/): SQL injection in cuppacms:cuppacms (critical 9.8)
- [CVE-2023-4799](https://insights.sbomify.com/CVE-2023-4799/): Magic Embeds < 3.1.2 - Contributor+ Stored XSS via shortcode (medium 5.4)
- [CVE-2023-4798](https://insights.sbomify.com/CVE-2023-4798/): User Avatar - Reloaded < 1.2.2 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-4797](https://insights.sbomify.com/CVE-2023-4797/): Newsletter Lite < 4.9.3 - Admin+ Command Injection (high 7.2)
- [CVE-2023-4796](https://insights.sbomify.com/CVE-2023-4796/): Booster for WooCommerce <= 7.1.0 - Authenticated (Subscriber+) Information Disclosure via Shortcode (medium 4.3)
- [CVE-2023-4795](https://insights.sbomify.com/CVE-2023-4795/): Testimonial Slider Shortcode < 1.1.9 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-4792](https://insights.sbomify.com/CVE-2023-4792/): Duplicate Post Page Menu & Custom Post Type <= 2.3.1 - Missing Authorization to Post Duplication (medium 4.3)
- [CVE-2023-47890](https://insights.sbomify.com/CVE-2023-47890/): Download to arbitrary folder can lead to RCE (high 8.8)
- [CVE-2023-47889](https://insights.sbomify.com/CVE-2023-47889/): Missing authorization in binhdrm26:super reboot (high 7.8)
- [CVE-2023-47883](https://insights.sbomify.com/CVE-2023-47883/): Code injection in vladymix:tv browser (critical 9.8)
- [CVE-2023-47882](https://insights.sbomify.com/CVE-2023-47882/): Code injection in kamivision:yi iot (high 7.1)
- [CVE-2023-47877](https://insights.sbomify.com/CVE-2023-47877/): WordPress Perfmatters Plugin < 2.2.0 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-47876](https://insights.sbomify.com/CVE-2023-47876/): WordPress Perfmatters Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-47875](https://insights.sbomify.com/CVE-2023-47875/): WordPress Perfmatters Plugin <= 2.1.6 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-47874](https://insights.sbomify.com/CVE-2023-47874/): WordPress Perfmatters Plugin <= 2.1.6 is vulnerable to Broken Access Control (medium 5.4)
- [CVE-2023-47873](https://insights.sbomify.com/CVE-2023-47873/): WordPress WP Child Theme Generator plugin <= 1.0.9 - Arbitrary File Upload vulnerability (critical 9.1)
- [CVE-2023-47872](https://insights.sbomify.com/CVE-2023-47872/): WordPress wpForo Forum Plugin <= 2.2.3 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-47871](https://insights.sbomify.com/CVE-2023-47871/): WordPress Contact Form to Any API plugin <= 1.1.6 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-47870](https://insights.sbomify.com/CVE-2023-47870/): WordPress wpForo Forum Plugin <= 2.2.6 is vulnerable to Broken Access Control and Cross Site Request Forgery (CSRF) (high 7.1)
- [CVE-2023-47869](https://insights.sbomify.com/CVE-2023-47869/): WordPress wpForo plugin <= 2.2.5 - Broken Access Control + CSRF vulnerability (medium 4.3)
- [CVE-2023-47868](https://insights.sbomify.com/CVE-2023-47868/): WordPress wpForo plugin <= 2.2.3 - Privilege Escalation vulnerability (high 7.3)
- [CVE-2023-47867](https://insights.sbomify.com/CVE-2023-47867/): MachineSense FeverWarn Improper Access Control (high 8.8)
- [CVE-2023-47865](https://insights.sbomify.com/CVE-2023-47865/): Username and Icon override can be used by members when Hardened Mode is enabled (medium 4.3)
- [CVE-2023-47862](https://insights.sbomify.com/CVE-2023-47862/): Path traversal in AVideo (critical 9.8)
- [CVE-2023-47861](https://insights.sbomify.com/CVE-2023-47861/): Cross-site scripting in AVideo (critical 9.0)
- [CVE-2023-47859](https://insights.sbomify.com/CVE-2023-47859/): Missing authorization in Intel(R) Wireless Bluetooth products for Windows (medium 5.5)
- [CVE-2023-47858](https://insights.sbomify.com/CVE-2023-47858/): Details of archived public channels are leaked to members of another team (medium 4.3)
- [CVE-2023-47857](https://insights.sbomify.com/CVE-2023-47857/): multimedia camera has a UAF vulnerability (medium 4.0)
- [CVE-2023-47856](https://insights.sbomify.com/CVE-2023-47856/): Memory corruption in WBR-6013 (high 7.2)
- [CVE-2023-47855](https://insights.sbomify.com/CVE-2023-47855/): Privilege escalation in Intel(R) TDX module software (medium 6.0)
- [CVE-2023-47854](https://insights.sbomify.com/CVE-2023-47854/): WordPress Parallax Image Plugin <= 1.7.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-47853](https://insights.sbomify.com/CVE-2023-47853/): WordPress myCred Plugin <= 2.6.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-47852](https://insights.sbomify.com/CVE-2023-47852/): WordPress Link Whisper Free Plugin <= 0.6.5 is vulnerable to SQL Injection (high 8.5)
- [CVE-2023-47851](https://insights.sbomify.com/CVE-2023-47851/): WordPress Bootstrap Shortcodes Ultimate Plugin <= 4.3.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-47850](https://insights.sbomify.com/CVE-2023-47850/): WordPress Community by PeepSo Plugin <= 6.2.2.0 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-4785](https://insights.sbomify.com/CVE-2023-4785/): Denial of Service in gRPC Core (high 7.5)
- [CVE-2023-47849](https://insights.sbomify.com/CVE-2023-47849/): WordPress BlossomThemes Email Newsletter plugin <= 2.2.4 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-47848](https://insights.sbomify.com/CVE-2023-47848/): WordPress Tainacan Plugin <= 0.20.4 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-47847](https://insights.sbomify.com/CVE-2023-47847/): WordPress PayTR Taksit Tablosu plugin <= 1.3.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-47846](https://insights.sbomify.com/CVE-2023-47846/): WordPress WP Githuber MD plugin <= 1.16.2 - Arbitrary File Upload vulnerability (critical 9.1)
- [CVE-2023-47845](https://insights.sbomify.com/CVE-2023-47845/): WordPress Grab & Save plugin <= 1.0.4 - Cross-Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2023-47844](https://insights.sbomify.com/CVE-2023-47844/): WordPress Grab & Save Plugin <= 1.0.4 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-47843](https://insights.sbomify.com/CVE-2023-47843/): WordPress CataBlog Plugin <= 1.7.0 is vulnerable to Arbitrary File Deletion (high 7.6)
- [CVE-2023-47842](https://insights.sbomify.com/CVE-2023-47842/): WordPress CataBlog plugin <= 1.7.0 - Arbitrary File Upload vulnerability (critical 9.1)
- [CVE-2023-47841](https://insights.sbomify.com/CVE-2023-47841/): WordPress Analytify plugin <= 5.1.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-47840](https://insights.sbomify.com/CVE-2023-47840/): WordPress Qode Essential Addons Plugin <= 1.5.2 is vulnerable to Remote Code Execution (RCE) (critical 9.9)
- [CVE-2023-47839](https://insights.sbomify.com/CVE-2023-47839/): WordPress eCommerce Product Catalog Plugin <= 3.3.26 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-47838](https://insights.sbomify.com/CVE-2023-47838/): WordPress Conditional Fields for Contact Form 7 plugin <= 2.4.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-47837](https://insights.sbomify.com/CVE-2023-47837/): WordPress ARMember plugin <= 4.0.10 - Membership Plan Bypass vulnerability (high 8.3)
- [CVE-2023-47836](https://insights.sbomify.com/CVE-2023-47836/): WordPress WP Meta and Date Remover plugin <= 2.3.0 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-47835](https://insights.sbomify.com/CVE-2023-47835/): WordPress ARI Stream Quiz Plugin <= 1.2.32 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-47834](https://insights.sbomify.com/CVE-2023-47834/): WordPress Quiz And Survey Master Plugin <= 8.1.13 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-47833](https://insights.sbomify.com/CVE-2023-47833/): WordPress Theater for WordPress Plugin <= 0.18.3 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-47832](https://insights.sbomify.com/CVE-2023-47832/): WordPress SearchIQ plugin <= 4.4 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-47831](https://insights.sbomify.com/CVE-2023-47831/): WordPress DrawIt (draw.io) Plugin <= 1.1.3 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-47830](https://insights.sbomify.com/CVE-2023-47830/): WordPress Live Preview for Contact Form 7 plugin <= 1.2.0 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-4783](https://insights.sbomify.com/CVE-2023-4783/): Magee Shortcodes <= 2.1.1 - Contributor+ Stored XSS via shortcode (medium 5.4)
- [CVE-2023-47829](https://insights.sbomify.com/CVE-2023-47829/): WordPress Quick Call Button Plugin <= 1.2.9 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-47828](https://insights.sbomify.com/CVE-2023-47828/): WordPress wpMandrill plugin <= 1.33 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-47827](https://insights.sbomify.com/CVE-2023-47827/): WordPress Events Addon for Elementor Plugin <= 2.1.3 is vulnerable to Broken Access Control (medium 6.5)
- [CVE-2023-47826](https://insights.sbomify.com/CVE-2023-47826/): WordPress Restaurant & Cafe Addon for Elementor plugin <= 1.5.3 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-47825](https://insights.sbomify.com/CVE-2023-47825/): WordPress WP EXtra Plugin <= 6.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-47824](https://insights.sbomify.com/CVE-2023-47824/): WordPress Legal Pages Plugin <= 1.3.8 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-47823](https://insights.sbomify.com/CVE-2023-47823/): WordPress FormCraft – Contact Form Builder for WordPress plugin <= 1.2.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-47822](https://insights.sbomify.com/CVE-2023-47822/): WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 4.10 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-47821](https://insights.sbomify.com/CVE-2023-47821/): WordPress Email Encoder Bundle Plugin <= 2.1.8 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-47820](https://insights.sbomify.com/CVE-2023-47820/): WordPress WP Like Button plugin <= 1.7.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-4782](https://insights.sbomify.com/CVE-2023-4782/): Terraform Allows Arbitrary File Write During Init Operation (medium 6.3)
- [CVE-2023-47819](https://insights.sbomify.com/CVE-2023-47819/): WordPress Easy Call Now by ThikShare Plugin <= 1.1.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-47818](https://insights.sbomify.com/CVE-2023-47818/): WordPress LWS Hide Login plugin <= 2.1.8 - Secret Login Page Location Disclosure on Multisites vulnerability (low 3.7)
- [CVE-2023-47817](https://insights.sbomify.com/CVE-2023-47817/): WordPress Daily Prayer Time Plugin <= 2023.10.13 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-47816](https://insights.sbomify.com/CVE-2023-47816/): WordPress Charitable Plugin <= 1.7.0.13 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-47815](https://insights.sbomify.com/CVE-2023-47815/): WordPress BP Profile Shortcodes Extra Plugin <= 2.5.2 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-47814](https://insights.sbomify.com/CVE-2023-47814/): WordPress BMI Calculator Plugin Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-47813](https://insights.sbomify.com/CVE-2023-47813/): WordPress Better RSS Widget Plugin <= 2.8.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-47812](https://insights.sbomify.com/CVE-2023-47812/): WordPress Bamboo Columns Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-47811](https://insights.sbomify.com/CVE-2023-47811/): WordPress Anywhere Flash Embed Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-47810](https://insights.sbomify.com/CVE-2023-47810/): WordPress Ajax Domain Checker Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-4781](https://insights.sbomify.com/CVE-2023-4781/): Heap-based Buffer Overflow in vim/vim (high 7.8)
- [CVE-2023-47809](https://insights.sbomify.com/CVE-2023-47809/): WordPress Accordion Plugin <= 2.6 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/193/