# Vulnerabilities published in 2023


- [CVE-2023-47689](https://insights.sbomify.com/CVE-2023-47689/): WordPress Animator plugin <= 3.0.10 - Unauthenticated Plugin Settings Change Vulnerability (medium 6.5)
- [CVE-2023-47688](https://insights.sbomify.com/CVE-2023-47688/): WordPress Youtube SpeedLoad Plugin <= 0.6.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-47687](https://insights.sbomify.com/CVE-2023-47687/): WordPress Woo Custom and Sequential Order Number Plugin <= 2.6.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-47686](https://insights.sbomify.com/CVE-2023-47686/): WordPress Arigato Autoresponder and Newsletter Plugin <= 2.7.2.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-47685](https://insights.sbomify.com/CVE-2023-47685/): WordPress Preloader Matrix Plugin <= 2.0.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-47684](https://insights.sbomify.com/CVE-2023-47684/): WordPress Essential Grid Plugin <= 3.1.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-47683](https://insights.sbomify.com/CVE-2023-47683/): WordPress Social Login, Social Sharing by miniOrange plugin <= 7.6.6 - Authenticated Privilege Escalation vulnerability (high 8.0)
- [CVE-2023-47682](https://insights.sbomify.com/CVE-2023-47682/): WordPress WP User Frontend plugin <= 3.6.5 - Authenticated Privilege Escalation vulnerability (high 7.2)
- [CVE-2023-47681](https://insights.sbomify.com/CVE-2023-47681/): WordPress WooCommerce Checkout Manager plugin <= 7.3.0 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-47680](https://insights.sbomify.com/CVE-2023-47680/): WordPress Qi Addons For Elementor Plugin <= 1.6.3 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-4768](https://insights.sbomify.com/CVE-2023-4768/): Improper Neutralization of CRLF Sequences in ManageEngine Desktop Central (medium 6.1)
- [CVE-2023-47679](https://insights.sbomify.com/CVE-2023-47679/): WordPress Qi Addons For Elementor plugin <= 1.6.3 - Local File Inclusion vulnerability (medium 6.4)
- [CVE-2023-47678](https://insights.sbomify.com/CVE-2023-47678/): Missing authorization in RT-AC87U (critical 9.1)
- [CVE-2023-47677](https://insights.sbomify.com/CVE-2023-47677/): Cross-site request forgery in WBR-6013 (high 8.8)
- [CVE-2023-47675](https://insights.sbomify.com/CVE-2023-47675/): Command injection in CubeCart (high 7.2)
- [CVE-2023-47674](https://insights.sbomify.com/CVE-2023-47674/): Missing authorization in CFR-1004EA, CFR-1008EA, CFR-1016EA (critical 9.8)
- [CVE-2023-47673](https://insights.sbomify.com/CVE-2023-47673/): WordPress Post Pay Counter Plugin <= 2.784 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-47672](https://insights.sbomify.com/CVE-2023-47672/): WordPress WP Category Post List Widget Plugin <= 2.0.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-47671](https://insights.sbomify.com/CVE-2023-47671/): WordPress Vertical scroll recent post Plugin <= 14.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-47670](https://insights.sbomify.com/CVE-2023-47670/): WordPress Korea SNS Plugin <= 1.6.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-4767](https://insights.sbomify.com/CVE-2023-4767/): Improper Neutralization of CRLF Sequences in ManageEngine Desktop Central (medium 6.1)
- [CVE-2023-47669](https://insights.sbomify.com/CVE-2023-47669/): WordPress Profile Builder Plugin <= 3.10.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-47668](https://insights.sbomify.com/CVE-2023-47668/): WordPress Restrict Content Plugin <= 3.2.7 is vulnerable to Sensitive Data Exposure (medium 5.3)
- [CVE-2023-47667](https://insights.sbomify.com/CVE-2023-47667/): WordPress WP Full Stripe Free plugin <= 7.0.16 - Cross Site Request Forgery (CSRF) vulnerability on every Setting Save (medium 4.3)
- [CVE-2023-47666](https://insights.sbomify.com/CVE-2023-47666/): WordPress Code Snippets Plugin <= 3.5.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-47665](https://insights.sbomify.com/CVE-2023-47665/): WordPress Plainview Protect Passwords Plugin <= 1.4 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-47664](https://insights.sbomify.com/CVE-2023-47664/): WordPress Plainview Protect Passwords Plugin <= 1.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 6.5)
- [CVE-2023-47662](https://insights.sbomify.com/CVE-2023-47662/): WordPress Live Gold Price & Silver Price Charts Widgets Plugin <= 2.4 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-47661](https://insights.sbomify.com/CVE-2023-47661/): WordPress Dragfy Addons for Elementor plugin <= 1.0.2 - Broken Access Control + CSRF vulnerability (medium 5.4)
- [CVE-2023-47660](https://insights.sbomify.com/CVE-2023-47660/): WordPress Product Visibility by Country for WooCommerce Plugin <= 1.4.9 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-4766](https://insights.sbomify.com/CVE-2023-4766/): SQLi in Movus Admin Panel (critical 9.8)
- [CVE-2023-47659](https://insights.sbomify.com/CVE-2023-47659/): WordPress Lava Directory Manager Plugin <= 1.1.34 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-47658](https://insights.sbomify.com/CVE-2023-47658/): WordPress Extra Product Options for WooCommerce Plugin <= 3.0.3 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-47657](https://insights.sbomify.com/CVE-2023-47657/): Cross-site scripting in Direct Checkout – Quick View – Buy Now For WooCommerce (medium 5.9)
- [CVE-2023-47656](https://insights.sbomify.com/CVE-2023-47656/): WordPress ANAC XML Bandi di Gara Plugin <= 7.5 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-47655](https://insights.sbomify.com/CVE-2023-47655/): WordPress ANAC XML Bandi di Gara Plugin <= 7.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-47654](https://insights.sbomify.com/CVE-2023-47654/): WordPress BZScore – Live Score Plugin <= 1.03 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-47653](https://insights.sbomify.com/CVE-2023-47653/): WordPress TWB Woocommerce Reviews Plugin <= 1.7.5 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-47652](https://insights.sbomify.com/CVE-2023-47652/): WordPress Auto Affiliate Links Plugin <= 6.4.2.4 is vulnerable to Cross Site Request Forgery (CSRF) (high 7.1)
- [CVE-2023-47651](https://insights.sbomify.com/CVE-2023-47651/): WordPress WP Links Page Plugin <= 4.9.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-47650](https://insights.sbomify.com/CVE-2023-47650/): WordPress Add Local Avatar Plugin <= 12.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 6.5)
- [CVE-2023-47649](https://insights.sbomify.com/CVE-2023-47649/): WordPress Best Restaurant Menu by PriceListo Plugin <= 1.3.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-47648](https://insights.sbomify.com/CVE-2023-47648/): WordPress EazyDocs plugin <= 2.3.5 - Broken Access Control vulnerability (high 7.5)
- [CVE-2023-47647](https://insights.sbomify.com/CVE-2023-47647/): WordPress BadgeOS plugin <= 3.7.1.6 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-47646](https://insights.sbomify.com/CVE-2023-47646/): WordPress Recently viewed and most viewed products Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-47645](https://insights.sbomify.com/CVE-2023-47645/): WordPress RegistrationMagic Plugin <= 5.2.2.6 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-47644](https://insights.sbomify.com/CVE-2023-47644/): WordPress ProfileGrid Plugin <= 5.6.6 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-47643](https://insights.sbomify.com/CVE-2023-47643/): SuiteCRM has Unauthenticated Graphql Introspection Enabled (low 3.1)
- [CVE-2023-47642](https://insights.sbomify.com/CVE-2023-47642/): Stream description leaks to ex-subscribers in Zulip (medium 4.3)
- [CVE-2023-47641](https://insights.sbomify.com/CVE-2023-47641/): Inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` in aiohttp (low 3.4)
- [CVE-2023-47640](https://insights.sbomify.com/CVE-2023-47640/): Insecure Use of HMAC-SHA1 For Session Signing in datahub (medium 6.4)
- [CVE-2023-4764](https://insights.sbomify.com/CVE-2023-4764/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2023-47639](https://insights.sbomify.com/CVE-2023-47639/): API Platform Core can leak exceptions message that may contain sensitive information (medium 5.3)
- [CVE-2023-47637](https://insights.sbomify.com/CVE-2023-47637/): SQL Injection in Admin Grid Filter API in Pimcore (high 8.8)
- [CVE-2023-47636](https://insights.sbomify.com/CVE-2023-47636/): Full Path Disclosure via re-export document in pimcore/admin-ui-classic-bundle (medium 5.3)
- [CVE-2023-47635](https://insights.sbomify.com/CVE-2023-47635/): Decidim vulnerable to possible CSRF attack at questionnaire templates preview (medium 4.5)
- [CVE-2023-47634](https://insights.sbomify.com/CVE-2023-47634/): Decidim has race condition in Endorsements (low 3.1)
- [CVE-2023-47633](https://insights.sbomify.com/CVE-2023-47633/): Uncontrolled Resource Consumption in Traefik (high 7.5)
- [CVE-2023-47631](https://insights.sbomify.com/CVE-2023-47631/): vantage6 Node accepts non-whitelisted algorithms from malicious server (high 7.2)
- [CVE-2023-47630](https://insights.sbomify.com/CVE-2023-47630/): Attacker can cause Kyverno user to unintentionally consume insecure image (high 7.1)
- [CVE-2023-4763](https://insights.sbomify.com/CVE-2023-4763/): Use after free in Chrome (high 8.8)
- [CVE-2023-47629](https://insights.sbomify.com/CVE-2023-47629/): Privilege escalation through email sign-up in datahub (high 7.1)
- [CVE-2023-47628](https://insights.sbomify.com/CVE-2023-47628/): Session Expiration Misconfiguration in datahub (medium 4.2)
- [CVE-2023-47627](https://insights.sbomify.com/CVE-2023-47627/): Request smuggling in aiohttp (medium 5.3)
- [CVE-2023-47626](https://insights.sbomify.com/CVE-2023-47626/): iTop vulnerable to XSS vulnerability in authent-token (high 8.8)
- [CVE-2023-47625](https://insights.sbomify.com/CVE-2023-47625/): Global Buffer Overflow leading to denial of service in PX4-Autopilot (low 2.9)
- [CVE-2023-47624](https://insights.sbomify.com/CVE-2023-47624/): Audiobookshelf Arbitrary File Read Vulnerability (high 7.5)
- [CVE-2023-47623](https://insights.sbomify.com/CVE-2023-47623/): Scrypted reflected Cross-site Scripting vulnerability (medium 6.1)
- [CVE-2023-47622](https://insights.sbomify.com/CVE-2023-47622/): iTop vulnerable to XSS vulnerability in dashlet refresh (high 8.8)
- [CVE-2023-47621](https://insights.sbomify.com/CVE-2023-47621/): Remote code execution via file uploads in guest-entries (high 8.8)
- [CVE-2023-47620](https://insights.sbomify.com/CVE-2023-47620/): Scrypted reflected Cross-site Scripting vulnerability (medium 6.1)
- [CVE-2023-4762](https://insights.sbomify.com/CVE-2023-4762/): Google Chromium V8 Type Confusion (high 8.8, exploited in the wild)
- [CVE-2023-47619](https://insights.sbomify.com/CVE-2023-47619/): Audiobookshelf Server-Side Request Forgery and Arbitrary File Read Vulnerability (high 8.1)
- [CVE-2023-47618](https://insights.sbomify.com/CVE-2023-47618/): Command injection in ER7206 Omada Gigabit VPN Router (high 7.2)
- [CVE-2023-47617](https://insights.sbomify.com/CVE-2023-47617/): Command injection in ER7206 Omada Gigabit VPN Router (high 7.2)
- [CVE-2023-47616](https://insights.sbomify.com/CVE-2023-47616/): Information disclosure in BGS5 (low 2.4)
- [CVE-2023-47615](https://insights.sbomify.com/CVE-2023-47615/): Information disclosure in BGS5 (low 3.3)
- [CVE-2023-47614](https://insights.sbomify.com/CVE-2023-47614/): Information disclosure in BGS5 (low 3.3)
- [CVE-2023-47613](https://insights.sbomify.com/CVE-2023-47613/): Path traversal in BGS5 (medium 4.4)
- [CVE-2023-47612](https://insights.sbomify.com/CVE-2023-47612/): Information disclosure in BGS5 (medium 6.8)
- [CVE-2023-47611](https://insights.sbomify.com/CVE-2023-47611/): Privilege escalation in BGS5 (high 7.8)
- [CVE-2023-47610](https://insights.sbomify.com/CVE-2023-47610/): Memory corruption in EHS5 (high 8.1)
- [CVE-2023-4761](https://insights.sbomify.com/CVE-2023-4761/): Memory corruption in Chrome (high 8.1)
- [CVE-2023-47609](https://insights.sbomify.com/CVE-2023-47609/): SQL injection in OSS Calendar (high 8.8)
- [CVE-2023-4760](https://insights.sbomify.com/CVE-2023-4760/): Remote Code Execution in Eclipse RAP on Windows (high 7.6)
- [CVE-2023-4759](https://insights.sbomify.com/CVE-2023-4759/): Improper handling of case insensitive filesystems in Eclipse JGit allows arbitrary file write (high 8.8)
- [CVE-2023-47586](https://insights.sbomify.com/CVE-2023-47586/): Memory corruption in V-Server (high 7.8)
- [CVE-2023-47585](https://insights.sbomify.com/CVE-2023-47585/): Memory corruption in V-Server (high 7.8)
- [CVE-2023-47584](https://insights.sbomify.com/CVE-2023-47584/): Memory corruption in V-Server (high 7.8)
- [CVE-2023-47583](https://insights.sbomify.com/CVE-2023-47583/): Memory corruption in TELLUS Simulator (high 7.8)
- [CVE-2023-47582](https://insights.sbomify.com/CVE-2023-47582/): Memory corruption in TELLUS (high 7.8)
- [CVE-2023-47581](https://insights.sbomify.com/CVE-2023-47581/): Memory corruption in TELLUS (high 7.8)
- [CVE-2023-47580](https://insights.sbomify.com/CVE-2023-47580/): Memory corruption in TELLUS (high 7.8)
- [CVE-2023-4758](https://insights.sbomify.com/CVE-2023-4758/): Buffer Over-read in gpac/gpac (medium 5.9)
- [CVE-2023-47579](https://insights.sbomify.com/CVE-2023-47579/): Misconfiguration in relyum:rely-pcie firmware (high 7.5)
- [CVE-2023-47578](https://insights.sbomify.com/CVE-2023-47578/): Cross-site request forgery in relyum:rely-pcie firmware (high 8.8)
- [CVE-2023-47577](https://insights.sbomify.com/CVE-2023-47577/): Auth bypass in relyum:rely-pcie firmware (critical 9.8)
- [CVE-2023-47576](https://insights.sbomify.com/CVE-2023-47576/): Command injection in relyum:rely-pcie firmware (high 8.8)
- [CVE-2023-47575](https://insights.sbomify.com/CVE-2023-47575/): Cross-site scripting in relyum:rely-pcie firmware (medium 6.1)
- [CVE-2023-47574](https://insights.sbomify.com/CVE-2023-47574/): Misconfiguration in relyum:rely-pcie firmware (medium 5.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/195/