# Vulnerabilities published in 2023


- [CVE-2023-46233](https://insights.sbomify.com/CVE-2023-46233/): crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard (critical 9.1)
- [CVE-2023-46232](https://insights.sbomify.com/CVE-2023-46232/): era-compiler-vyper First Immutable Variable Initialization vulnerability (medium 5.3)
- [CVE-2023-46231](https://insights.sbomify.com/CVE-2023-46231/): Session Token Disclosure to Internal Log Files in Splunk Add-on Builder (high 8.8)
- [CVE-2023-46230](https://insights.sbomify.com/CVE-2023-46230/): Sensitive Information Disclosure to Internal Log Files in Splunk Add-on Builder (high 8.2)
- [CVE-2023-4623](https://insights.sbomify.com/CVE-2023-4623/): Use-after-free in Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component (high 7.8)
- [CVE-2023-46229](https://insights.sbomify.com/CVE-2023-46229/): LangChain Server Side Request Forgery vulnerability (high 8.8)
- [CVE-2023-46228](https://insights.sbomify.com/CVE-2023-46228/): Integer overflow in zchunk:zchunk (high 7.8)
- [CVE-2023-46227](https://insights.sbomify.com/CVE-2023-46227/): Apache inlong has an Arbitrary File Read Vulnerability (high 7.5)
- [CVE-2023-46226](https://insights.sbomify.com/CVE-2023-46226/): Apache IoTDB: Remote Code Execution (RCE) risk via the UDF (critical 9.8)
- [CVE-2023-46225](https://insights.sbomify.com/CVE-2023-46225/): Memory corruption in Avalanche (critical 9.8)
- [CVE-2023-46224](https://insights.sbomify.com/CVE-2023-46224/): Memory corruption in Avalanche (critical 9.8)
- [CVE-2023-46223](https://insights.sbomify.com/CVE-2023-46223/): Memory corruption in Avalanche (critical 9.8)
- [CVE-2023-46222](https://insights.sbomify.com/CVE-2023-46222/): Memory corruption in Avalanche (critical 9.8)
- [CVE-2023-46221](https://insights.sbomify.com/CVE-2023-46221/): Memory corruption in Avalanche (critical 9.8)
- [CVE-2023-46220](https://insights.sbomify.com/CVE-2023-46220/): Memory corruption in Avalanche (critical 9.8)
- [CVE-2023-4622](https://insights.sbomify.com/CVE-2023-4622/): Use-after-free in Linux kernel's af_unix component (high 7.8)
- [CVE-2023-46219](https://insights.sbomify.com/CVE-2023-46219/): Other in curl (medium 5.3)
- [CVE-2023-46218](https://insights.sbomify.com/CVE-2023-46218/): Security feature bypass in curl (medium 6.5)
- [CVE-2023-46217](https://insights.sbomify.com/CVE-2023-46217/): Memory corruption in Wavelink (critical 9.8)
- [CVE-2023-46216](https://insights.sbomify.com/CVE-2023-46216/): Memory corruption in Wavelink (critical 9.8)
- [CVE-2023-46215](https://insights.sbomify.com/CVE-2023-46215/): Apache Airflow Celery provider Insertion of Sensitive Information into Log File vulnerability (high 7.5)
- [CVE-2023-46214](https://insights.sbomify.com/CVE-2023-46214/): Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing (high 8.0)
- [CVE-2023-46213](https://insights.sbomify.com/CVE-2023-46213/): Cross-site Scripting (XSS) on “Show Syntax Highlighted” View in Search Page (medium 4.8)
- [CVE-2023-46212](https://insights.sbomify.com/CVE-2023-46212/): WordPress WP EXtra Plugin <= 6.2 is vulnerable to Broken Access Control (medium 6.3)
- [CVE-2023-46211](https://insights.sbomify.com/CVE-2023-46211/): WordPress Ultimate Addons for WPBakery Page Builder Plugin <= 3.19.14 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-46210](https://insights.sbomify.com/CVE-2023-46210/): WordPress WC Captcha Plugin <= 1.4 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-46209](https://insights.sbomify.com/CVE-2023-46209/): WordPress Grid Plus Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-46208](https://insights.sbomify.com/CVE-2023-46208/): WordPress Motors – Car Dealer & Classified Ads Plugin <= 1.4.6 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-46207](https://insights.sbomify.com/CVE-2023-46207/): WordPress Motors – Car Dealer & Classified Ads Plugin <= 1.4.6 is vulnerable to Server Side Request Forgery (SSRF) (medium 4.1)
- [CVE-2023-46206](https://insights.sbomify.com/CVE-2023-46206/): WordPress MW WP Form plugin <= 4.4.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-46205](https://insights.sbomify.com/CVE-2023-46205/): WordPress Ultimate Addons for WPBakery Page Builder plugin <= 3.19.14 - Local File Inclusion vulnerability (high 7.1)
- [CVE-2023-46204](https://insights.sbomify.com/CVE-2023-46204/): WordPress Duplicate Theme Plugin <= 0.1.6 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-46203](https://insights.sbomify.com/CVE-2023-46203/): WordPress Just Custom Fields plugin <= 3.3.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-46202](https://insights.sbomify.com/CVE-2023-46202/): WordPress Auto Login New User After Registration Plugin <= 1.9.6 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-46201](https://insights.sbomify.com/CVE-2023-46201/): WordPress Auto Login New User After Registration Plugin <= 1.9.6 is vulnerable to Cross Site Request Forgery (CSRF) (high 7.1)
- [CVE-2023-46200](https://insights.sbomify.com/CVE-2023-46200/): WordPress Smart App Banner Plugin <= 1.1.3 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-4620](https://insights.sbomify.com/CVE-2023-4620/): Booking Calendar < 9.7.3.1 - Unauthenticated Stored XSS (medium 6.1)
- [CVE-2023-46199](https://insights.sbomify.com/CVE-2023-46199/): WordPress Triberr Plugin <= 4.1.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-46198](https://insights.sbomify.com/CVE-2023-46198/): WordPress Appointment Calendar Plugin <= 2.9.6 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-46197](https://insights.sbomify.com/CVE-2023-46197/): WordPress Popup by Supsystic plugin <= 1.10.19 - Unauthenticated Subscriber Email Addresses Disclosure (medium 5.3)
- [CVE-2023-46196](https://insights.sbomify.com/CVE-2023-46196/): WordPress Social proof testimonials and reviews by Repuso plugin <= 4.97 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-46195](https://insights.sbomify.com/CVE-2023-46195/): WordPress Headline Analyzer plugin <= 1.3.1 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-46194](https://insights.sbomify.com/CVE-2023-46194/): WordPress Archivist – Custom Archive Templates Plugin <= 1.7.5 is vulnerable to Cross Site Scripting (XSS) (medium 5.8)
- [CVE-2023-46193](https://insights.sbomify.com/CVE-2023-46193/): WordPress Internal Link Building Plugin <= 1.2.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-46192](https://insights.sbomify.com/CVE-2023-46192/): WordPress Internal Link Building Plugin <= 1.2.3 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-46191](https://insights.sbomify.com/CVE-2023-46191/): WordPress Open Graph Metabox Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-46190](https://insights.sbomify.com/CVE-2023-46190/): Cross-site request forgery in Novo-Map : your WP posts on custom google maps (medium 4.3)
- [CVE-2023-46189](https://insights.sbomify.com/CVE-2023-46189/): WordPress Google Calendar Events Plugin <= 3.2.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-46188](https://insights.sbomify.com/CVE-2023-46188/): WordPress Freesoul Deactivate Plugins plugin <= 2.1.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-46187](https://insights.sbomify.com/CVE-2023-46187/): IBM InfoSphere Master Data Management cross-site scripting (medium 5.4)
- [CVE-2023-46186](https://insights.sbomify.com/CVE-2023-46186/): IBM Jazz for Service Management information disclosure (medium 5.3)
- [CVE-2023-46183](https://insights.sbomify.com/CVE-2023-46183/): IBM PowerVM Hypervisor information disclosure (medium 5.3)
- [CVE-2023-46182](https://insights.sbomify.com/CVE-2023-46182/): IBM Secure Proxy cross-site scripting (medium 5.4)
- [CVE-2023-46181](https://insights.sbomify.com/CVE-2023-46181/): IBM Secure Proxy information disclosure (medium 4.0)
- [CVE-2023-46179](https://insights.sbomify.com/CVE-2023-46179/): IBM Secure Proxy information disclosure (medium 4.3)
- [CVE-2023-46177](https://insights.sbomify.com/CVE-2023-46177/): IBM MQ Appliance information disclosure (medium 6.5)
- [CVE-2023-46176](https://insights.sbomify.com/CVE-2023-46176/): IBM MQ privilege escalation (medium 6.7)
- [CVE-2023-46175](https://insights.sbomify.com/CVE-2023-46175/): IBM Cloud Pak for Multicloud Management information disclosure (medium 4.4)
- [CVE-2023-46174](https://insights.sbomify.com/CVE-2023-46174/): IBM InfoSphere Information Server cross-site scripting (medium 5.4)
- [CVE-2023-46172](https://insights.sbomify.com/CVE-2023-46172/): IBM DS8900F security bypass (medium 5.6)
- [CVE-2023-46171](https://insights.sbomify.com/CVE-2023-46171/): IBM DS8900F information disclosure (medium 4.3)
- [CVE-2023-46170](https://insights.sbomify.com/CVE-2023-46170/): IBM DS8900F information disclosure (medium 6.5)
- [CVE-2023-4617](https://insights.sbomify.com/CVE-2023-4617/): Gaining remote control over Govee devices (critical 10.0)
- [CVE-2023-46169](https://insights.sbomify.com/CVE-2023-46169/): IBM DS8900F file manipulation (medium 6.5)
- [CVE-2023-46167](https://insights.sbomify.com/CVE-2023-46167/): IBM Db2 denial of service (medium 5.9)
- [CVE-2023-4616](https://insights.sbomify.com/CVE-2023-4616/): thumbnail Directory Path Traversal Allows Unauthenticated Arbitrary File Read Vulnerability (high 7.5)
- [CVE-2023-46159](https://insights.sbomify.com/CVE-2023-46159/): IBM Storage Ceph denial of service (low 2.6)
- [CVE-2023-46158](https://insights.sbomify.com/CVE-2023-46158/): IBM WebSphere Application Server session fixation (medium 4.9)
- [CVE-2023-46157](https://insights.sbomify.com/CVE-2023-46157/): Command injection in mgt-commerce:cloudpanel (high 8.8)
- [CVE-2023-46156](https://insights.sbomify.com/CVE-2023-46156/): Use after free in SIMATIC Drive Controller CPU 1504D TF (high 7.5)
- [CVE-2023-46154](https://insights.sbomify.com/CVE-2023-46154/): WordPress e2pdf Plugin <= 1.20.18 is vulnerable to PHP Object Injection (medium 6.6)
- [CVE-2023-46153](https://insights.sbomify.com/CVE-2023-46153/): WordPress User Feedback Plugin <= 1.0.9 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-46152](https://insights.sbomify.com/CVE-2023-46152/): WordPress WOLF Plugin <= 1.0.7.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-46151](https://insights.sbomify.com/CVE-2023-46151/): WordPress Product Category Tree Plugin <= 2.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-46150](https://insights.sbomify.com/CVE-2023-46150/): WordPress WP Radio plugin <= 3.1.9 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-4615](https://insights.sbomify.com/CVE-2023-4615/): updateFile Directory Path Traversal Allows Unauthenticated Arbitrary File Read Vulnerability (high 7.5)
- [CVE-2023-46149](https://insights.sbomify.com/CVE-2023-46149/): WordPress Themify Ultra Theme <= 7.3.5 is vulnerable to Arbitrary File Upload (critical 9.9)
- [CVE-2023-46148](https://insights.sbomify.com/CVE-2023-46148/): WordPress Themify Ultra theme <= 7.3.5 - Authenticated Arbitrary Settings Change vulnerability (high 8.8)
- [CVE-2023-46147](https://insights.sbomify.com/CVE-2023-46147/): WordPress Themify Ultra Theme <= 7.3.5 is vulnerable to PHP Object Injection (high 7.4)
- [CVE-2023-46146](https://insights.sbomify.com/CVE-2023-46146/): WordPress Themify Ultra theme <= 7.3.5 - Multiple Broken Access Control vulnerability (high 8.3)
- [CVE-2023-46145](https://insights.sbomify.com/CVE-2023-46145/): WordPress Themify Ultra theme <= 7.3.5 - Authenticated Privilege Escalation vulnerability (high 8.8)
- [CVE-2023-46144](https://insights.sbomify.com/CVE-2023-46144/): PHOENIX CONTACT: PLCnext Control prone to download of code without integrity check (medium 6.5)
- [CVE-2023-46143](https://insights.sbomify.com/CVE-2023-46143/): Phoenix Contact: Classic line industrial controllers prone to inadequate integrity check of PLC (high 7.5)
- [CVE-2023-46142](https://insights.sbomify.com/CVE-2023-46142/): PHOENIX CONTACT: Insufficient Read and Write Protection to Logic and Runtime Data in PLCnext Control (high 8.8)
- [CVE-2023-46141](https://insights.sbomify.com/CVE-2023-46141/): Misconfiguration in AXC 1050 (critical 9.8)
- [CVE-2023-4614](https://insights.sbomify.com/CVE-2023-4614/): setThumbnailRC Directory Path Traversal Allows Unauthenticated Arbitrary File Read Vulnerability (critical 9.8)
- [CVE-2023-46139](https://insights.sbomify.com/CVE-2023-46139/): KernelSU signature validation mismatch (medium 5.0)
- [CVE-2023-46138](https://insights.sbomify.com/CVE-2023-46138/): JumpServer default admin user email leak password reset (low 3.7)
- [CVE-2023-46137](https://insights.sbomify.com/CVE-2023-46137/): twisted.web has disordered HTTP pipeline response (medium 5.3)
- [CVE-2023-46136](https://insights.sbomify.com/CVE-2023-46136/): Werkzeug DoS: High resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning (high 8.0)
- [CVE-2023-46135](https://insights.sbomify.com/CVE-2023-46135/): Panic in SignedPayload::from_payload (medium 5.3)
- [CVE-2023-46134](https://insights.sbomify.com/CVE-2023-46134/): D-Tale vulnerable to Remote Code Execution through the Custom Filter Input (medium 6.1)
- [CVE-2023-46133](https://insights.sbomify.com/CVE-2023-46133/): crypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard (critical 9.1)
- [CVE-2023-46132](https://insights.sbomify.com/CVE-2023-46132/): Crosslinking transaction attack in hyperledger/fabric (high 7.1)
- [CVE-2023-46131](https://insights.sbomify.com/CVE-2023-46131/): Grails® data binding causes JVM crash and/or DoS (medium 6.5)
- [CVE-2023-46130](https://insights.sbomify.com/CVE-2023-46130/): Bypassing height value allowed in some theme components (medium 4.3)
- [CVE-2023-4613](https://insights.sbomify.com/CVE-2023-4613/): Upload Directory Path Traversal Allows Unauthenticated Arbitrary File Read Vulnerability (critical 9.8)
- [CVE-2023-46129](https://insights.sbomify.com/CVE-2023-46129/): xkeys Seal encryption used fixed key for all encryption (high 7.5)
- [CVE-2023-46128](https://insights.sbomify.com/CVE-2023-46128/): Exposure of hashed user passwords via REST API in Nautobot (medium 6.5)
- [CVE-2023-46127](https://insights.sbomify.com/CVE-2023-46127/): Frappe vulnerable to HTML injection by any Desk user (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/206/