# Vulnerabilities published in 2023


- [CVE-2023-46733](https://insights.sbomify.com/CVE-2023-46733/): Symfony possible session fixation vulnerability (medium 6.5)
- [CVE-2023-46732](https://insights.sbomify.com/CVE-2023-46732/): Reflected Cross-site scripting through revision parameter in content menu in XWiki Platform (critical 9.7)
- [CVE-2023-46731](https://insights.sbomify.com/CVE-2023-46731/): Remote code execution through the section parameter in Administration as guest in XWiki Platform (critical 10.0)
- [CVE-2023-46730](https://insights.sbomify.com/CVE-2023-46730/): Server-Side Request Forgery in groupoffice (high 7.4)
- [CVE-2023-4673](https://insights.sbomify.com/CVE-2023-4673/): SQLi in Sanalogy's Turasistan (critical 9.8)
- [CVE-2023-46729](https://insights.sbomify.com/CVE-2023-46729/): Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint (critical 9.3)
- [CVE-2023-46728](https://insights.sbomify.com/CVE-2023-46728/): SQUID-2021:8 Denial of Service in Gopher gateway (high 7.5)
- [CVE-2023-46727](https://insights.sbomify.com/CVE-2023-46727/): GLPI SQL injection through inventory agent request (high 8.6)
- [CVE-2023-46726](https://insights.sbomify.com/CVE-2023-46726/): GLPI Remote code execution from LDAP server configuration form on PHP 7.4 (high 7.2)
- [CVE-2023-46725](https://insights.sbomify.com/CVE-2023-46725/): FoodCoopShop Server-Side Request Forgery vulnerability (high 8.1)
- [CVE-2023-46724](https://insights.sbomify.com/CVE-2023-46724/): SQUID-2023:4 Denial of Service in SSL Certificate validation (high 8.6)
- [CVE-2023-46723](https://insights.sbomify.com/CVE-2023-46723/): lte-pic32-writer's sendto.txt may disclose URL and the API key (high 8.9)
- [CVE-2023-46722](https://insights.sbomify.com/CVE-2023-46722/): Pimcore Admin Classic Bundle Cross-site Scripting (XSS) in PDF previews (medium 6.1)
- [CVE-2023-46720](https://insights.sbomify.com/CVE-2023-46720/): Memory corruption in FortiOS (medium 6.3)
- [CVE-2023-4672](https://insights.sbomify.com/CVE-2023-4672/): XSS in Talent Soft's ECOP (medium 6.1)
- [CVE-2023-46718](https://insights.sbomify.com/CVE-2023-46718/): Memory corruption in FortiOS (medium 6.3)
- [CVE-2023-46717](https://insights.sbomify.com/CVE-2023-46717/): Auth bypass in FortiOS (medium 6.7)
- [CVE-2023-46715](https://insights.sbomify.com/CVE-2023-46715/): Security feature bypass in FortiOS (medium 4.7)
- [CVE-2023-46714](https://insights.sbomify.com/CVE-2023-46714/): Memory corruption in FortiOS (medium 6.8)
- [CVE-2023-46713](https://insights.sbomify.com/CVE-2023-46713/): Other in FortiWeb (medium 4.9)
- [CVE-2023-46712](https://insights.sbomify.com/CVE-2023-46712/): Privilege escalation in FortiPortal (medium 6.3)
- [CVE-2023-46711](https://insights.sbomify.com/CVE-2023-46711/): Hardcoded credentials in VR-S1000 (medium 4.6)
- [CVE-2023-4671](https://insights.sbomify.com/CVE-2023-4671/): SQLi in Talent Soft's ECOP (critical 9.8)
- [CVE-2023-46708](https://insights.sbomify.com/CVE-2023-46708/): Wlan has a use after free vulnerability (medium 4.3)
- [CVE-2023-46706](https://insights.sbomify.com/CVE-2023-46706/): MachineSense FeverWarn Use of Hard-coded Credentials (critical 9.1)
- [CVE-2023-46705](https://insights.sbomify.com/CVE-2023-46705/): Arkruntime has a type confusion vulnerability (medium 6.2)
- [CVE-2023-46701](https://insights.sbomify.com/CVE-2023-46701/): Inaccessible Post Information Leak via Run Timeline IDOR (medium 6.5)
- [CVE-2023-46700](https://insights.sbomify.com/CVE-2023-46700/): SQL injection in LuxCal Web Calendar (critical 9.8)
- [CVE-2023-4670](https://insights.sbomify.com/CVE-2023-4670/): SQLi in Innosa's Probbys (critical 9.8)
- [CVE-2023-46699](https://insights.sbomify.com/CVE-2023-46699/): Cross-site request forgery in GROWI (medium 4.3)
- [CVE-2023-46695](https://insights.sbomify.com/CVE-2023-46695/): Django potential denial of service vulnerability in UsernameField on Windows (high 7.5)
- [CVE-2023-46694](https://insights.sbomify.com/CVE-2023-46694/): Vtenext 21.02 allows an authenticated attacker to upload arbitrary files, potentially enabling them to execute remote commands. (high 8.1)
- [CVE-2023-46693](https://insights.sbomify.com/CVE-2023-46693/): Cross-site scripting in formalms:formalms (medium 6.1)
- [CVE-2023-46691](https://insights.sbomify.com/CVE-2023-46691/): Use after free in Intel(R) Power Gadget software for Windows (high 7.9)
- [CVE-2023-46690](https://insights.sbomify.com/CVE-2023-46690/): Delta Electronics InfraSuite Device Master Path Traversal (high 8.8)
- [CVE-2023-4669](https://insights.sbomify.com/CVE-2023-4669/): Authentication Bypass in Exagate SYSGuard 3001 (critical 9.8)
- [CVE-2023-46689](https://insights.sbomify.com/CVE-2023-46689/): Privilege escalation in Intel(R) Power Gadget software for macOS (high 8.8)
- [CVE-2023-46688](https://insights.sbomify.com/CVE-2023-46688/): Open redirect in Pleasanter (medium 6.1)
- [CVE-2023-46687](https://insights.sbomify.com/CVE-2023-46687/): Emerson Rosemount GC370XA, GC700XA, GC1500XA Command Injection (critical 9.8)
- [CVE-2023-46686](https://insights.sbomify.com/CVE-2023-46686/): Security feature bypass in Command Centre Diagnostics Service (medium 5.5)
- [CVE-2023-46685](https://insights.sbomify.com/CVE-2023-46685/): Hardcoded credentials in WBR-6013 (critical 9.8)
- [CVE-2023-46683](https://insights.sbomify.com/CVE-2023-46683/): Command injection in ER7206 Omada Gigabit VPN Router (high 7.2)
- [CVE-2023-46681](https://insights.sbomify.com/CVE-2023-46681/): Command injection in VR-S1000 (high 7.8)
- [CVE-2023-4668](https://insights.sbomify.com/CVE-2023-4668/): Ad Inserter <= 2.7.30 - Unauthenticated Sensitive Information Exposure via ai-debug-processing-fe (medium 5.3)
- [CVE-2023-46679](https://insights.sbomify.com/CVE-2023-46679/): Online Job Portal v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-46677](https://insights.sbomify.com/CVE-2023-46677/): Online Job Portal v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-46675](https://insights.sbomify.com/CVE-2023-46675/): Kibana Insertion of Sensitive Information into Log File (high 8.0)
- [CVE-2023-46674](https://insights.sbomify.com/CVE-2023-46674/): Elasticsearch-hadoop Unsafe Deserialization (medium 6.0)
- [CVE-2023-46673](https://insights.sbomify.com/CVE-2023-46673/): Elasticsearch Improper Handling of Exceptional Conditions (medium 6.5)
- [CVE-2023-46672](https://insights.sbomify.com/CVE-2023-46672/): Logstash Insertion of Sensitive Information into Log File (high 8.4)
- [CVE-2023-46671](https://insights.sbomify.com/CVE-2023-46671/): Kibana Insertion of Sensitive Information into Log File (high 8.0)
- [CVE-2023-4667](https://insights.sbomify.com/CVE-2023-4667/): Stored Cross Site Scripting in webserver administration (high 8.1)
- [CVE-2023-46669](https://insights.sbomify.com/CVE-2023-46669/): Elastic Agent / Elastic Endpoint Security local API key disclosure (medium 6.2)
- [CVE-2023-46668](https://insights.sbomify.com/CVE-2023-46668/): Elastic Endpoint Insertion of Sensitive Information into Log File (medium 4.6)
- [CVE-2023-46667](https://insights.sbomify.com/CVE-2023-46667/): Fleet Server Insertion of Sensitive Information into Log File (high 8.1)
- [CVE-2023-46666](https://insights.sbomify.com/CVE-2023-46666/): Elastic Sharepoint Online Python Connector Improper Access Control (medium 5.3)
- [CVE-2023-46665](https://insights.sbomify.com/CVE-2023-46665/): Improper Access Control in Sielco PolyEco1000 (critical 9.8)
- [CVE-2023-46664](https://insights.sbomify.com/CVE-2023-46664/): Improper Access Control in Sielco PolyEco1000 (high 7.5)
- [CVE-2023-46663](https://insights.sbomify.com/CVE-2023-46663/): Improper Access Control in Sielco PolyEco1000 (high 7.5)
- [CVE-2023-46662](https://insights.sbomify.com/CVE-2023-46662/): Improper Access Control in Sielco PolyEco1000 (high 7.5)
- [CVE-2023-46661](https://insights.sbomify.com/CVE-2023-46661/): Improper Access Control in Sielco PolyEco1000 (critical 9.8)
- [CVE-2023-46660](https://insights.sbomify.com/CVE-2023-46660/): Non-constant time webhook token hash comparison in Jenkins Zanata Plugin (medium 5.3)
- [CVE-2023-4666](https://insights.sbomify.com/CVE-2023-4666/): Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2023-46659](https://insights.sbomify.com/CVE-2023-46659/): Jenkins Edgewall Trac Plugin vulnerable to Stored XSS (medium 5.4)
- [CVE-2023-46658](https://insights.sbomify.com/CVE-2023-46658/): Jenkins MSTeams Webhook Trigger Plugin uses non-constant time webhook token comparison (medium 5.3)
- [CVE-2023-46657](https://insights.sbomify.com/CVE-2023-46657/): Jenkins Gogs Plugin uses non-constant time webhook token comparison (medium 5.3)
- [CVE-2023-46656](https://insights.sbomify.com/CVE-2023-46656/): Jenkins Multibranch Scan Webhook Trigger Plugin uses non-constant time webhook token comparison (medium 5.3)
- [CVE-2023-46655](https://insights.sbomify.com/CVE-2023-46655/): Jenkins CloudBees CD Plugin vulnerable to arbitrary file read (medium 6.5)
- [CVE-2023-46654](https://insights.sbomify.com/CVE-2023-46654/): Jenkins CloudBees CD Plugin vulnerable to arbitrary file deletion (high 8.1)
- [CVE-2023-46653](https://insights.sbomify.com/CVE-2023-46653/): Jenkins lambdatest-automation Plugin may expose Credentials access token (medium 6.5)
- [CVE-2023-46652](https://insights.sbomify.com/CVE-2023-46652/): Jenkins lambdatest-automation Plugin missing permission check (medium 4.3)
- [CVE-2023-46651](https://insights.sbomify.com/CVE-2023-46651/): Jenkins Warnings Plugin exposures system-scoped credentials (medium 6.5)
- [CVE-2023-46650](https://insights.sbomify.com/CVE-2023-46650/): Stored XSS vulnerability in Jenkins GitHub Plugin (medium 5.4)
- [CVE-2023-4665](https://insights.sbomify.com/CVE-2023-4665/): Privilage Escalation in Saphira Connect (high 8.8)
- [CVE-2023-46649](https://insights.sbomify.com/CVE-2023-46649/): Race Condition allows Administrative Access on Organization Repositories (medium 6.3)
- [CVE-2023-46648](https://insights.sbomify.com/CVE-2023-46648/): Insufficient Entropy in GitHub Enterprise Server Management Console Invitation Token (high 8.3)
- [CVE-2023-46647](https://insights.sbomify.com/CVE-2023-46647/): Improper Privilege Management in GitHub Enterprise Server management console leads to privilege escalation (high 8.0)
- [CVE-2023-46646](https://insights.sbomify.com/CVE-2023-46646/): Missing authorization in Enterprise Server (medium 5.3)
- [CVE-2023-46645](https://insights.sbomify.com/CVE-2023-46645/): Path traversal in GitHub Enterprise Server leading to arbitrary file reading when building a GitHub Pages site (medium 6.8)
- [CVE-2023-46644](https://insights.sbomify.com/CVE-2023-46644/): WordPress WordPress CTA plugin <= 1.5.8 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-46643](https://insights.sbomify.com/CVE-2023-46643/): WordPress Download CloudNet360 Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-46642](https://insights.sbomify.com/CVE-2023-46642/): WordPress SAHU TikTok Pixel for E-Commerce Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-46641](https://insights.sbomify.com/CVE-2023-46641/): WordPress 12 Step Meeting List Plugin <= 3.14.24 is vulnerable to Server Side Request Forgery (SSRF) (medium 4.9)
- [CVE-2023-46640](https://insights.sbomify.com/CVE-2023-46640/): WordPress Medialist Plugin <= 1.3.9 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-4664](https://insights.sbomify.com/CVE-2023-4664/): Privilage Escalation in Saphira Connect (high 8.8)
- [CVE-2023-46639](https://insights.sbomify.com/CVE-2023-46639/): WordPress kk Star Ratings plugin <= 5.4.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-46638](https://insights.sbomify.com/CVE-2023-46638/): WordPress WCP OpenWeather Plugin <= 2.5.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-46637](https://insights.sbomify.com/CVE-2023-46637/): WordPress Generate Dummy Posts plugin <= 1.0.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-46636](https://insights.sbomify.com/CVE-2023-46636/): WordPress Custom Header Images Plugin <= 1.2.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-46635](https://insights.sbomify.com/CVE-2023-46635/): WordPress YITH WooCommerce Product Add-Ons plugin <= 4.2.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-46634](https://insights.sbomify.com/CVE-2023-46634/): WordPress Custom My Account for Woocommerce Plugin <= 2.1 is vulnerable to Cross Site Request Forgery (CSRF) (high 7.1)
- [CVE-2023-46633](https://insights.sbomify.com/CVE-2023-46633/): WordPress WP Glossary plugin <= 3.1.2 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-46632](https://insights.sbomify.com/CVE-2023-46632/): WordPress My Shortcodes plugin <= 2.3 - Broken Access Control vulnerability (high 7.1)
- [CVE-2023-46631](https://insights.sbomify.com/CVE-2023-46631/): WordPress Product Recommendation Quiz for eCommerce plugin <= 2.1.2 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-46630](https://insights.sbomify.com/CVE-2023-46630/): Auth bypass in Admin and Site Enhancements (ASE) (high 7.5)
- [CVE-2023-4663](https://insights.sbomify.com/CVE-2023-4663/): XSS in Saphira Connect (medium 6.1)
- [CVE-2023-46629](https://insights.sbomify.com/CVE-2023-46629/): WordPress Remove Add to Cart WooCommerce Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-46628](https://insights.sbomify.com/CVE-2023-46628/): WordPress WP Word Count plugin <= 3.2.4 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-46627](https://insights.sbomify.com/CVE-2023-46627/): WordPress WP Simple HTML Sitemap Plugin <= 2.1 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-46626](https://insights.sbomify.com/CVE-2023-46626/): WordPress FLOWFACT WP Connector Plugin <= 2.1.7 is vulnerable to Cross Site Scripting (XSS) (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/202/