# Vulnerabilities published in 2023 - [CVE-2023-46126](https://insights.sbomify.com/CVE-2023-46126/): Fides JavaScript Injection Vulnerability in Privacy Center URL (low 3.9) - [CVE-2023-46125](https://insights.sbomify.com/CVE-2023-46125/): Fides Information Disclosure Vulnerability in Config API Endpoint (medium 6.5) - [CVE-2023-46124](https://insights.sbomify.com/CVE-2023-46124/): Server-Side Request Forgery Vulnerability in Custom Integration Upload (high 8.2) - [CVE-2023-46123](https://insights.sbomify.com/CVE-2023-46123/): jumpserver is vulnerable to password brute-force protection bypass via arbitrary IP values (medium 5.3) - [CVE-2023-46122](https://insights.sbomify.com/CVE-2023-46122/): Arbitrary file write via archive extraction (Zip Slip) vulnerability in sbt (low 3.9) - [CVE-2023-46121](https://insights.sbomify.com/CVE-2023-46121/): Generic Extractor MITM Vulnerability in yt-dlp (medium 5.0) - [CVE-2023-46120](https://insights.sbomify.com/CVE-2023-46120/): RabbitMQ Java client's lack of message size limitation leads to remote DoS attack (medium 4.9) - [CVE-2023-4612](https://insights.sbomify.com/CVE-2023-4612/): MFA bypass in Apereo CAS (critical 9.8) - [CVE-2023-46119](https://insights.sbomify.com/CVE-2023-46119/): Parse Server may crash when uploading file without extension (high 7.5) - [CVE-2023-46118](https://insights.sbomify.com/CVE-2023-46118/): Denial of Service by publishing large messages over the HTTP API (medium 4.9) - [CVE-2023-46117](https://insights.sbomify.com/CVE-2023-46117/): Inadequate validation of retrieved subdomains may lead to a Remote Code Execution in reconFTW (critical 9.6) - [CVE-2023-46116](https://insights.sbomify.com/CVE-2023-46116/): Remote Code Execution via insufficiently sanitized call to shell.openExternal (critical 9.3) - [CVE-2023-46115](https://insights.sbomify.com/CVE-2023-46115/): Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli (high 8.4) - [CVE-2023-4611](https://insights.sbomify.com/CVE-2023-4611/): Use after free race between mbind() and vma-locked page fault (high 7.0) - [CVE-2023-46104](https://insights.sbomify.com/CVE-2023-46104/): Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb (medium 6.5) - [CVE-2023-46103](https://insights.sbomify.com/CVE-2023-46103/): Denial of service in Intel(R) Core(TM) Ultra Processors (medium 4.7) - [CVE-2023-46102](https://insights.sbomify.com/CVE-2023-46102/): Hardcoded credentials in ctrlX HMI Web Panel - WR21 (WR2107) (high 8.8) - [CVE-2023-46100](https://insights.sbomify.com/CVE-2023-46100/): Cert manager has a use of uninitialized resource vulnerability (medium 6.2) - [CVE-2023-46099](https://insights.sbomify.com/CVE-2023-46099/): Cross-site scripting in SIMATIC PCS neo (medium 5.4) - [CVE-2023-46098](https://insights.sbomify.com/CVE-2023-46098/): Misconfiguration in SIMATIC PCS neo (high 8.0) - [CVE-2023-46097](https://insights.sbomify.com/CVE-2023-46097/): SQL injection in SIMATIC PCS neo (medium 6.3) - [CVE-2023-46096](https://insights.sbomify.com/CVE-2023-46096/): Auth bypass in SIMATIC PCS neo (medium 6.5) - [CVE-2023-46095](https://insights.sbomify.com/CVE-2023-46095/): WordPress Smooth Scroll Links Plugin <= 1.1.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4) - [CVE-2023-46094](https://insights.sbomify.com/CVE-2023-46094/): WordPress Conversios.io Plugin <= 6.5.3 is vulnerable to Cross Site Scripting (XSS) (high 7.1) - [CVE-2023-46093](https://insights.sbomify.com/CVE-2023-46093/): WordPress Webmaster Tools Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9) - [CVE-2023-46092](https://insights.sbomify.com/CVE-2023-46092/): WordPress Webmaster Tools Plugin <= 2.0 is vulnerable to Cross Site Request Forgery (CSRF) (high 7.1) - [CVE-2023-46091](https://insights.sbomify.com/CVE-2023-46091/): WordPress Category SEO Meta Tags Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS) (medium 5.9) - [CVE-2023-46090](https://insights.sbomify.com/CVE-2023-46090/): WordPress Spider Facebook Plugin <= 1.0.15 is vulnerable to Cross Site Scripting (XSS) (high 7.1) - [CVE-2023-46089](https://insights.sbomify.com/CVE-2023-46089/): WordPress Userback Plugin <= 1.0.13 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3) - [CVE-2023-46088](https://insights.sbomify.com/CVE-2023-46088/): WordPress WP Full Stripe Free Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9) - [CVE-2023-46087](https://insights.sbomify.com/CVE-2023-46087/): WordPress Who Hit The Page – Hit Counter Plugin <= 1.4.14.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3) - [CVE-2023-46086](https://insights.sbomify.com/CVE-2023-46086/): WordPress affiliate-toolkit – WordPress Affiliate Plugin Plugin <= 3.4.3 is vulnerable to Cross Site Scripting (XSS) (high 7.1) - [CVE-2023-46085](https://insights.sbomify.com/CVE-2023-46085/): WordPress Wp Ultimate Review Plugin <= 2.2.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3) - [CVE-2023-46084](https://insights.sbomify.com/CVE-2023-46084/): WordPress Icons Font Loader Plugin <= 1.1.2 is vulnerable to SQL Injection (high 8.5) - [CVE-2023-46083](https://insights.sbomify.com/CVE-2023-46083/): WordPress Kali Forms plugin <= 2.3.27 - Broken Access Control vulnerability (medium 5.3) - [CVE-2023-46082](https://insights.sbomify.com/CVE-2023-46082/): WordPress Broken Link Checker | Finder plugin <= 2.4.2 - Broken Access Control vulnerability (medium 5.3) - [CVE-2023-46081](https://insights.sbomify.com/CVE-2023-46081/): WordPress Lava Directory Manager Plugin <= 1.1.34 is vulnerable to Cross Site Scripting (XSS) (high 7.1) - [CVE-2023-46080](https://insights.sbomify.com/CVE-2023-46080/): WordPress ApplyOnline – Application Form Builder and Manager plugin <= 2.5.3 - Broken Access Control vulnerability (medium 4.3) - [CVE-2023-4608](https://insights.sbomify.com/CVE-2023-4608/): SQL injection in Lenovo XClarity Controller (XCC) (medium 4.1) - [CVE-2023-46079](https://insights.sbomify.com/CVE-2023-46079/): WordPress Ashe Extra plugin <= 1.2.9 - Broken Access Control + CSRF vulnerability (medium 5.4) - [CVE-2023-46078](https://insights.sbomify.com/CVE-2023-46078/): Cross-site request forgery in WC Serial Numbers (medium 5.4) - [CVE-2023-46077](https://insights.sbomify.com/CVE-2023-46077/): WordPress The Awesome Feed – Custom Feed Plugin <= 2.2.5 is vulnerable to Cross Site Scripting (XSS) (high 7.1) - [CVE-2023-46076](https://insights.sbomify.com/CVE-2023-46076/): WordPress WooCommerce PDF Invoice Builder Plugin <= 1.2.102 is vulnerable to Cross Site Scripting (XSS) (high 7.1) - [CVE-2023-46075](https://insights.sbomify.com/CVE-2023-46075/): WordPress Contact Form Builder, Contact Widget Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS) (high 7.1) - [CVE-2023-46074](https://insights.sbomify.com/CVE-2023-46074/): WordPress FreshMail For WordPress Plugin <= 2.3.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.8) - [CVE-2023-46073](https://insights.sbomify.com/CVE-2023-46073/): WordPress DX Delete Attached Media plugin <= 2.0.5.1 - Broken Access Control vulnerability + CSRF (medium 5.3) - [CVE-2023-46072](https://insights.sbomify.com/CVE-2023-46072/): WordPress Add Shortcodes Actions And Filters Plugin <= 2.0.9 is vulnerable to Cross Site Scripting (XSS) (high 7.1) - [CVE-2023-46071](https://insights.sbomify.com/CVE-2023-46071/): WordPress Protección de Datos RGPD Plugin <= 3.1.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1) - [CVE-2023-46070](https://insights.sbomify.com/CVE-2023-46070/): WordPress EG-Attachments Plugin <= 2.1.3 is vulnerable to Cross Site Scripting (XSS) (high 7.1) - [CVE-2023-4607](https://insights.sbomify.com/CVE-2023-4607/): Privilege escalation in Lenovo XClarity Controller (XCC) (high 7.5) - [CVE-2023-46069](https://insights.sbomify.com/CVE-2023-46069/): WordPress Ajax Archive Calendar Plugin <= 2.6.7 is vulnerable to Cross Site Scripting (XSS) (medium 6.5) - [CVE-2023-46068](https://insights.sbomify.com/CVE-2023-46068/): WordPress Maileon Plugin <= 2.16.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9) - [CVE-2023-46067](https://insights.sbomify.com/CVE-2023-46067/): WordPress Rocket Font Plugin <= 1.2.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3) - [CVE-2023-46066](https://insights.sbomify.com/CVE-2023-46066/): WordPress Mediabay Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS) (medium 5.9) - [CVE-2023-46060](https://insights.sbomify.com/CVE-2023-46060/): Memory corruption in tenda:ac500 firmware (high 7.5) - [CVE-2023-4606](https://insights.sbomify.com/CVE-2023-4606/): Missing authorization in Lenovo XClarity Controller (XCC) (high 8.1) - [CVE-2023-46059](https://insights.sbomify.com/CVE-2023-46059/): Cross-site scripting in geeklog:geeklog (medium 4.8) - [CVE-2023-46058](https://insights.sbomify.com/CVE-2023-46058/): Cross-site scripting in geeklog:geeklog (medium 4.8) - [CVE-2023-46055](https://insights.sbomify.com/CVE-2023-46055/): Code injection in thingnario:photon (high 8.8) - [CVE-2023-46054](https://insights.sbomify.com/CVE-2023-46054/): Cross-site scripting in wbce:wbce cms (medium 5.4) - [CVE-2023-46052](https://insights.sbomify.com/CVE-2023-46052/): Memory corruption in sane-project:sane backends (high 7.1) - [CVE-2023-46051](https://insights.sbomify.com/CVE-2023-46051/): TeX Live 944e257 allows a NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c. (low 3.3) - [CVE-2023-4605](https://insights.sbomify.com/CVE-2023-4605/): Information disclosure in XClarity Administrator (medium 6.5) - [CVE-2023-46049](https://insights.sbomify.com/CVE-2023-46049/): LLVM 15.0.0 has a NULL pointer dereference in the parseOneMetadata() function via a crafted pdflatex.fmt file (or perhaps a crafted .o file) to llvm-lto. (medium 5.3) - [CVE-2023-46048](https://insights.sbomify.com/CVE-2023-46048/): Tex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. (medium 6.2) - [CVE-2023-46047](https://insights.sbomify.com/CVE-2023-46047/): Code injection in sane-project:sane backends (high 7.3) - [CVE-2023-46046](https://insights.sbomify.com/CVE-2023-46046/): An issue in MiniZinc before 2.8.0 allows a NULL pointer dereference via ti_expr in a crafted .mzn file. (medium 5.5) - [CVE-2023-46045](https://insights.sbomify.com/CVE-2023-46045/): Memory corruption in graphviz:graphviz (high 7.8) - [CVE-2023-46042](https://insights.sbomify.com/CVE-2023-46042/): Code injection in get-simple:getsimplecms (critical 9.8) - [CVE-2023-46040](https://insights.sbomify.com/CVE-2023-46040/): Cross-site scripting in get-simple:getsimplecms (medium 5.4) - [CVE-2023-4604](https://insights.sbomify.com/CVE-2023-4604/): Slideshow, Image Slider by 2J <= 1.3.54 - Reflected Cross-Site Scripting via 'post' (medium 6.1) - [CVE-2023-46035](https://insights.sbomify.com/CVE-2023-46035/): svg_optimizer rubygem external XML entity (XXE) vulnerability (medium 5.9) - [CVE-2023-46033](https://insights.sbomify.com/CVE-2023-46033/): Auth bypass in dlink:dsl-2730u firmware (medium 6.8) - [CVE-2023-4603](https://insights.sbomify.com/CVE-2023-4603/): Star CloudPRNT for WooCommerce <= 2.0.3 - Reflected Cross-Site Scripting (medium 6.1) - [CVE-2023-46026](https://insights.sbomify.com/CVE-2023-46026/): Cross-site scripting in phpgurukul:teacher subject allocation management system (medium 4.8) - [CVE-2023-46025](https://insights.sbomify.com/CVE-2023-46025/): SQL injection in phpgurukul:teacher subject allocation management system (medium 4.9) - [CVE-2023-46024](https://insights.sbomify.com/CVE-2023-46024/): SQL injection in phpgurukul:teacher subject allocation management system (high 7.5) - [CVE-2023-46023](https://insights.sbomify.com/CVE-2023-46023/): SQL injection in code-projects:simple task list (medium 6.5) - [CVE-2023-46022](https://insights.sbomify.com/CVE-2023-46022/): SQL injection in code-projects:blood bank (high 7.8) - [CVE-2023-46021](https://insights.sbomify.com/CVE-2023-46021/): SQL injection in code-projects:blood bank (medium 5.5) - [CVE-2023-46020](https://insights.sbomify.com/CVE-2023-46020/): Cross-site scripting in code-projects:blood bank (medium 6.1) - [CVE-2023-4602](https://insights.sbomify.com/CVE-2023-4602/): Namaste! LMS <= 2.6.1.1 - Reflected Cross-Site Scripting (medium 6.1) - [CVE-2023-46019](https://insights.sbomify.com/CVE-2023-46019/): Cross-site scripting in code-projects:blood bank (medium 6.1) - [CVE-2023-46018](https://insights.sbomify.com/CVE-2023-46018/): SQL injection in code-projects:blood bank (medium 5.5) - [CVE-2023-46017](https://insights.sbomify.com/CVE-2023-46017/): SQL injection in code-projects:blood bank (medium 5.5) - [CVE-2023-46016](https://insights.sbomify.com/CVE-2023-46016/): Cross-site scripting in code-projects:blood bank (medium 6.1) - [CVE-2023-46015](https://insights.sbomify.com/CVE-2023-46015/): Cross-site scripting in code-projects:blood bank (medium 6.1) - [CVE-2023-46014](https://insights.sbomify.com/CVE-2023-46014/): SQL injection in code-projects:blood bank (medium 5.5) - [CVE-2023-46012](https://insights.sbomify.com/CVE-2023-46012/): Memory corruption in linksys:ea7500 firmware (critical 9.8) - [CVE-2023-46010](https://insights.sbomify.com/CVE-2023-46010/): Code injection in seacms:seacms (critical 9.8) - [CVE-2023-4601](https://insights.sbomify.com/CVE-2023-4601/): Stack-based Buffer Overflow in NI System Configuration Software (high 8.1) - [CVE-2023-46009](https://insights.sbomify.com/CVE-2023-46009/): Denial of service in lcdf:gifsicle (high 7.8) - [CVE-2023-46007](https://insights.sbomify.com/CVE-2023-46007/): SQL injection in mayurik:best courier management system (critical 9.8) - [CVE-2023-46006](https://insights.sbomify.com/CVE-2023-46006/): SQL injection in mayurik:best courier management system (critical 9.8) - [CVE-2023-46005](https://insights.sbomify.com/CVE-2023-46005/): SQL injection in mayurik:best courier management system (critical 9.8) - [CVE-2023-46004](https://insights.sbomify.com/CVE-2023-46004/): File upload in mayurik:best courier management system (high 7.2) - [CVE-2023-46003](https://insights.sbomify.com/CVE-2023-46003/): Cross-site scripting in i-doit:i-doit (medium 5.4) - [CVE-2023-46001](https://insights.sbomify.com/CVE-2023-46001/): Memory corruption in gpac:gpac (medium 5.5) - [CVE-2023-4600](https://insights.sbomify.com/CVE-2023-4600/): Missing authorization in AffiliateWP (medium 4.3) - [CVE-2023-45998](https://insights.sbomify.com/CVE-2023-45998/): Cross-site scripting in kodcloud:kodbox (medium 5.4) --- From sbomify Insights: https://insights.sbomify.com/years/2023/page/207/