# Vulnerabilities published in 2023


- [CVE-2023-47251](https://insights.sbomify.com/CVE-2023-47251/): Path traversal in m-privacy:mprivacy-tools (medium 6.5)
- [CVE-2023-47250](https://insights.sbomify.com/CVE-2023-47250/): Missing authorization in m-privacy:mprivacy-tools (high 8.8)
- [CVE-2023-4725](https://insights.sbomify.com/CVE-2023-4725/): Simple Posts Ticker < 1.1.6 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-47249](https://insights.sbomify.com/CVE-2023-47249/): Memory corruption in color:demoiccmax (medium 6.5)
- [CVE-2023-47248](https://insights.sbomify.com/CVE-2023-47248/): PyArrow, PyArrow: Arbitrary code execution when loading a malicious data file (critical 9.8)
- [CVE-2023-47247](https://insights.sbomify.com/CVE-2023-47247/): Missing authorization in sysaid:sysaid (medium 4.3)
- [CVE-2023-47246](https://insights.sbomify.com/CVE-2023-47246/): SysAid Server Path Traversal (critical 9.8, exploited in the wild)
- [CVE-2023-47245](https://insights.sbomify.com/CVE-2023-47245/): WordPress ANAC XML Viewer Plugin <= 1.7 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-47244](https://insights.sbomify.com/CVE-2023-47244/): WordPress Email Marketing for WooCommerce by Omnisend Plugin <= 1.13.8 is vulnerable to Sensitive Data Exposure (medium 5.3)
- [CVE-2023-47243](https://insights.sbomify.com/CVE-2023-47243/): WordPress MSHOP MY SITE Plugin <= 1.1.6 is vulnerable to Broken Access Control (medium 5.4)
- [CVE-2023-47242](https://insights.sbomify.com/CVE-2023-47242/): WordPress ANAC XML Bandi di Gara Plugin <= 7.5 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-47241](https://insights.sbomify.com/CVE-2023-47241/): WordPress CoCart – Headless ecommerce plugin <= 3.11.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-47240](https://insights.sbomify.com/CVE-2023-47240/): WordPress CBX Map for Google Map & OpenStreetMap Plugin <= 1.1.11 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-4724](https://insights.sbomify.com/CVE-2023-4724/): WP All Export (Free < 1.4.0, Pro < 1.8.6) - Admin+ RCE (high 7.2)
- [CVE-2023-47239](https://insights.sbomify.com/CVE-2023-47239/): WordPress Easy PayPal Shopping Cart Plugin <= 1.1.10 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-47238](https://insights.sbomify.com/CVE-2023-47238/): WordPress Top 10 Plugin <= 3.3.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-47237](https://insights.sbomify.com/CVE-2023-47237/): WordPress WP Google My Business Auto Publish Plugin <= 3.7 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-47236](https://insights.sbomify.com/CVE-2023-47236/): WordPress iPages Flipbook Plugin <= 1.4.8 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-47235](https://insights.sbomify.com/CVE-2023-47235/): Denial of service in frrouting:frrouting (medium 6.8)
- [CVE-2023-47234](https://insights.sbomify.com/CVE-2023-47234/): Denial of service in frrouting:frrouting (high 7.5)
- [CVE-2023-47233](https://insights.sbomify.com/CVE-2023-47233/): Use after free in linux:linux kernel (medium 4.3)
- [CVE-2023-47232](https://insights.sbomify.com/CVE-2023-47232/): WordPress WP Affiliate Disclosure plugin <= 1.2.6 - Broken Access Control + CSRF vulnerability (medium 4.3)
- [CVE-2023-47231](https://insights.sbomify.com/CVE-2023-47231/): WordPress ShortCodes UI Plugin <= 1.9.8 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-47230](https://insights.sbomify.com/CVE-2023-47230/): WordPress Contact Forms by Cimatti Plugin <= 1.6.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-4723](https://insights.sbomify.com/CVE-2023-4723/): Elementor Addon Elements <= 1.12.7 - Missing Authorization to Sensitive Information Exposure (medium 5.3)
- [CVE-2023-47229](https://insights.sbomify.com/CVE-2023-47229/): WordPress Download Top 25 Social Icons Plugin <= 3.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-47228](https://insights.sbomify.com/CVE-2023-47228/): WordPress Layer Slider Plugin <= 1.1.9.7 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-47227](https://insights.sbomify.com/CVE-2023-47227/): WordPress Social Feed | All social media in one place Plugin <= 1.5.4.6 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-47226](https://insights.sbomify.com/CVE-2023-47226/): WordPress Post Sliders & Post Grids Plugin <= 1.0.20 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-47225](https://insights.sbomify.com/CVE-2023-47225/): WordPress Short URL plugin <= 1.6.8 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-47224](https://insights.sbomify.com/CVE-2023-47224/): WordPress WP Travel plugin <= 7.8.0 - Broken Access Control vulnerability (high 7.5)
- [CVE-2023-47223](https://insights.sbomify.com/CVE-2023-47223/): WordPress Basic Interactive World Map Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-47222](https://insights.sbomify.com/CVE-2023-47222/): Media Streaming add-on (critical 9.6)
- [CVE-2023-47221](https://insights.sbomify.com/CVE-2023-47221/): Photo Station (medium 5.5)
- [CVE-2023-47220](https://insights.sbomify.com/CVE-2023-47220/): Media Streaming add-on (medium 6.6)
- [CVE-2023-4722](https://insights.sbomify.com/CVE-2023-4722/): Integer Overflow or Wraparound in gpac/gpac (medium 5.9)
- [CVE-2023-47219](https://insights.sbomify.com/CVE-2023-47219/): QuMagie (low 3.5)
- [CVE-2023-47218](https://insights.sbomify.com/CVE-2023-47218/): QTS, QuTS hero, QuTScloud (medium 5.8)
- [CVE-2023-47217](https://insights.sbomify.com/CVE-2023-47217/): Arkruntime has a buffer overflow vulnerability (medium 4.0)
- [CVE-2023-47216](https://insights.sbomify.com/CVE-2023-47216/): Liteos-A has a missing release of resource vulnerability (low 2.9)
- [CVE-2023-47215](https://insights.sbomify.com/CVE-2023-47215/): Cross-site scripting in GROWI (medium 5.4)
- [CVE-2023-47213](https://insights.sbomify.com/CVE-2023-47213/): Hardcoded credentials in CFR-1004EA, CFR-1008EA, CFR-1016EA (critical 9.8)
- [CVE-2023-47212](https://insights.sbomify.com/CVE-2023-47212/): Memory corruption in stb vorbis.c (critical 9.8)
- [CVE-2023-47211](https://insights.sbomify.com/CVE-2023-47211/): Path traversal in OpManager (critical 9.1)
- [CVE-2023-47210](https://insights.sbomify.com/CVE-2023-47210/): Denial of service in Intel(R) PROSet/Wireless WiFi software for linux (medium 4.7)
- [CVE-2023-4721](https://insights.sbomify.com/CVE-2023-4721/): Out-of-bounds Read in gpac/gpac (medium 5.9)
- [CVE-2023-47209](https://insights.sbomify.com/CVE-2023-47209/): Command injection in ER7206 Omada Gigabit VPN Router (high 7.2)
- [CVE-2023-47207](https://insights.sbomify.com/CVE-2023-47207/): Delta Electronics InfraSuite Device Master Deserialization of Untrusted Data (critical 9.8)
- [CVE-2023-47204](https://insights.sbomify.com/CVE-2023-47204/): transmute-core unsafe YAML deserialization vulnerability (critical 9.8)
- [CVE-2023-47202](https://insights.sbomify.com/CVE-2023-47202/): Path traversal in Trend Micro Apex One (high 7.8)
- [CVE-2023-47201](https://insights.sbomify.com/CVE-2023-47201/): Privilege escalation in Trend Micro Apex One (medium 6.7)
- [CVE-2023-47200](https://insights.sbomify.com/CVE-2023-47200/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2023-4720](https://insights.sbomify.com/CVE-2023-4720/): Floating Point Comparison with Incorrect Operator in gpac/gpac (medium 4.0)
- [CVE-2023-47199](https://insights.sbomify.com/CVE-2023-47199/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2023-47198](https://insights.sbomify.com/CVE-2023-47198/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2023-47197](https://insights.sbomify.com/CVE-2023-47197/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2023-47196](https://insights.sbomify.com/CVE-2023-47196/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2023-47195](https://insights.sbomify.com/CVE-2023-47195/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2023-47194](https://insights.sbomify.com/CVE-2023-47194/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2023-47193](https://insights.sbomify.com/CVE-2023-47193/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2023-47192](https://insights.sbomify.com/CVE-2023-47192/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2023-47191](https://insights.sbomify.com/CVE-2023-47191/): WordPress Youzify Plugin <= 1.2.2 is vulnerable to Insecure Direct Object References (IDOR) (medium 6.5)
- [CVE-2023-47190](https://insights.sbomify.com/CVE-2023-47190/): WordPress Apollo13 Framework Extensions Plugin <= 1.9.0 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-4719](https://insights.sbomify.com/CVE-2023-4719/): Simple Membership <= 4.3.5 - Reflected Cross-Site Scripting (high 7.2)
- [CVE-2023-47189](https://insights.sbomify.com/CVE-2023-47189/): WordPress Defender Security plugin <= 4.2.0 - Masked Login Area View Bypass vulnerability (medium 5.3)
- [CVE-2023-47188](https://insights.sbomify.com/CVE-2023-47188/): WordPress Simple Job Board plugin <= 2.10.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-47187](https://insights.sbomify.com/CVE-2023-47187/): WordPress Animated Rotating Words plugin <= 5.4 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-47186](https://insights.sbomify.com/CVE-2023-47186/): WordPress Kadence WooCommerce Email Designer Plugin <= 1.5.11 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-47185](https://insights.sbomify.com/CVE-2023-47185/): WordPress wpDiscuz Plugin <= 7.6.11 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-47184](https://insights.sbomify.com/CVE-2023-47184/): WordPress Admin Bar & Dashboard Access Control Plugin <= 1.2.8 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-47183](https://insights.sbomify.com/CVE-2023-47183/): WordPress GiveWP plugin <= 2.33.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-47182](https://insights.sbomify.com/CVE-2023-47182/): WordPress Login Screen Manager Plugin <= 3.5.2 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-47181](https://insights.sbomify.com/CVE-2023-47181/): WordPress IdeaPush Plugin <= 8.52 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-47180](https://insights.sbomify.com/CVE-2023-47180/): Missing authorization in Finale Lite (medium 6.5)
- [CVE-2023-4718](https://insights.sbomify.com/CVE-2023-4718/): Font Awesome 4 Menus <= 4.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-47179](https://insights.sbomify.com/CVE-2023-47179/): WordPress WooODT Lite plugin <= 2.4.6 - Arbitrary Site Option Update vulnerability (high 8.8)
- [CVE-2023-47178](https://insights.sbomify.com/CVE-2023-47178/): WordPress The Plus Addons for Elementor Pro plugin <= 5.2.8 - Unauthenticated Local File Inclusion vulnerability (high 8.6)
- [CVE-2023-47177](https://insights.sbomify.com/CVE-2023-47177/): WordPress Linker Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-47175](https://insights.sbomify.com/CVE-2023-47175/): Cross-site scripting in LuxCal Web Calendar (medium 6.1)
- [CVE-2023-47174](https://insights.sbomify.com/CVE-2023-47174/): Deserialization in thorntech:sftp gateway firmware (critical 9.8)
- [CVE-2023-47172](https://insights.sbomify.com/CVE-2023-47172/): Privilege escalation in withsecure:client security (high 7.8)
- [CVE-2023-47171](https://insights.sbomify.com/CVE-2023-47171/): Path traversal in AVideo (medium 6.5)
- [CVE-2023-47169](https://insights.sbomify.com/CVE-2023-47169/): Memory corruption in Intel(R) Media SDK software (low 3.3)
- [CVE-2023-47168](https://insights.sbomify.com/CVE-2023-47168/): Open redirect in /oauth/<service>/mobile_login?redirect_to= (medium 4.3)
- [CVE-2023-47167](https://insights.sbomify.com/CVE-2023-47167/): Command injection in ER7206 Omada Gigabit VPN Router (high 7.2)
- [CVE-2023-47166](https://insights.sbomify.com/CVE-2023-47166/): Missing authorization in UR32L (high 8.8)
- [CVE-2023-47165](https://insights.sbomify.com/CVE-2023-47165/): Denial of service in Intel(R) Data Center GPU Max Series 1100 and 1550 products (medium 6.0)
- [CVE-2023-47164](https://insights.sbomify.com/CVE-2023-47164/): Cross-site scripting in HOTELDRUID (medium 6.1)
- [CVE-2023-47163](https://insights.sbomify.com/CVE-2023-47163/): Remarshal expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack (high 7.5)
- [CVE-2023-47162](https://insights.sbomify.com/CVE-2023-47162/): IBM Secure Proxy cross-site scripting (medium 6.1)
- [CVE-2023-47161](https://insights.sbomify.com/CVE-2023-47161/): IBM UrbanCode Deploy denial of service (medium 5.3)
- [CVE-2023-47160](https://insights.sbomify.com/CVE-2023-47160/): IBM Cognos Controller XML external entity injection (high 8.2)
- [CVE-2023-4716](https://insights.sbomify.com/CVE-2023-4716/): Media Library Assistant <= 3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-47159](https://insights.sbomify.com/CVE-2023-47159/): IBM Sterling File Gateway information disclosure (medium 4.3)
- [CVE-2023-47158](https://insights.sbomify.com/CVE-2023-47158/): IBM Db2 denial of service (medium 5.3)
- [CVE-2023-47152](https://insights.sbomify.com/CVE-2023-47152/): IBM Db2 information disclosure (medium 5.9)
- [CVE-2023-47150](https://insights.sbomify.com/CVE-2023-47150/): IBM Common Cryptographic Architecture denial of service (high 7.5)
- [CVE-2023-47148](https://insights.sbomify.com/CVE-2023-47148/): IBM Storage Protect Plus Server information disclosure (medium 5.3)
- [CVE-2023-47147](https://insights.sbomify.com/CVE-2023-47147/): IBM Secure Proxy file manipulation (medium 5.9)
- [CVE-2023-47146](https://insights.sbomify.com/CVE-2023-47146/): IBM QRadar SIEM information disclosure (medium 4.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/198/