# Vulnerabilities published in 2023


- [CVE-2023-45835](https://insights.sbomify.com/CVE-2023-45835/): WordPress Libsyn Publisher Hub Plugin <= 1.4.4 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-45834](https://insights.sbomify.com/CVE-2023-45834/): WordPress Libsyn Publisher Hub Plugin <= 1.4.4 is vulnerable to Sensitive Data Exposure (medium 5.3)
- [CVE-2023-45833](https://insights.sbomify.com/CVE-2023-45833/): WordPress LeadSquared Suite Plugin <= 0.7.4 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-45832](https://insights.sbomify.com/CVE-2023-45832/): WordPress WP GoToWebinar Plugin <= 14.45 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-45831](https://insights.sbomify.com/CVE-2023-45831/): WordPress AMP WP Plugin <= 1.5.15 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-45830](https://insights.sbomify.com/CVE-2023-45830/): WordPress Accessibility Suite by Online ADA Plugin <= 4.12 is vulnerable to SQL Injection (high 8.5)
- [CVE-2023-4583](https://insights.sbomify.com/CVE-2023-4583/): Browsing Context potentially not cleared when closing Private Window (high 7.5)
- [CVE-2023-45829](https://insights.sbomify.com/CVE-2023-45829/): WordPress Newsletter & Bulk Email Sender Plugin <= 2.0.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-45828](https://insights.sbomify.com/CVE-2023-45828/): WordPress RumbleTalk Live Group Chat plugin <= 6.2.5 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-45827](https://insights.sbomify.com/CVE-2023-45827/): Prototype Pollution vulnerability in @clickbar/dot-diver (high 7.3)
- [CVE-2023-45826](https://insights.sbomify.com/CVE-2023-45826/): Authenticated SQL Injection in leantime (medium 6.5)
- [CVE-2023-45825](https://insights.sbomify.com/CVE-2023-45825/): Token in custom credentials object can leak through logs in ydb-go-sdk (medium 5.5)
- [CVE-2023-45824](https://insights.sbomify.com/CVE-2023-45824/): OroPlatform's pinned entity creation form shows pages of other users (medium 4.3)
- [CVE-2023-45823](https://insights.sbomify.com/CVE-2023-45823/): Arbitrary file read in Artifact Hub (high 7.5)
- [CVE-2023-45822](https://insights.sbomify.com/CVE-2023-45822/): Unsafe rego built-in allowed in Artifact Hub (low 3.7)
- [CVE-2023-45821](https://insights.sbomify.com/CVE-2023-45821/): Incorrect Docker Hub registry check in Artifact Hub (medium 5.4)
- [CVE-2023-45820](https://insights.sbomify.com/CVE-2023-45820/): Directus crashes on invalid WebSocket message (medium 5.9)
- [CVE-2023-4582](https://insights.sbomify.com/CVE-2023-4582/): Buffer Overflow in WebGL glGetProgramiv (high 8.8)
- [CVE-2023-45819](https://insights.sbomify.com/CVE-2023-45819/): Cross-site Scripting vulnerability in TinyMCE notificationManager.open API (medium 6.1)
- [CVE-2023-45818](https://insights.sbomify.com/CVE-2023-45818/): Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave plugin (medium 6.1)
- [CVE-2023-45816](https://insights.sbomify.com/CVE-2023-45816/): Unread bookmark reminder notifications that the user cannot access can be seen (low 3.3)
- [CVE-2023-45815](https://insights.sbomify.com/CVE-2023-45815/): Viewing wget extractor output while logged in as an admin allows archived JS to execute in the admins context (medium 6.4)
- [CVE-2023-45814](https://insights.sbomify.com/CVE-2023-45814/): Tokens cached in the AuthenticationService are susceptible to reuse in Bunkum (medium 5.3)
- [CVE-2023-45813](https://insights.sbomify.com/CVE-2023-45813/): Inefficient Regular Expression Complexity in TorBot (medium 4.6)
- [CVE-2023-45812](https://insights.sbomify.com/CVE-2023-45812/): Improper Check or Handling of Exceptional Conditions in apollo-router (high 7.5)
- [CVE-2023-45811](https://insights.sbomify.com/CVE-2023-45811/): Prototype pollution vulnerability leading to arbitrary code execution in synchrony deobfuscator (high 8.2)
- [CVE-2023-45810](https://insights.sbomify.com/CVE-2023-45810/): OpenFGA denial of service (medium 5.3)
- [CVE-2023-4581](https://insights.sbomify.com/CVE-2023-4581/): XLL file extensions were downloadable without warnings (medium 4.3)
- [CVE-2023-45809](https://insights.sbomify.com/CVE-2023-45809/): Disclosure of user names via admin bulk action views in wagtail (low 2.7)
- [CVE-2023-45808](https://insights.sbomify.com/CVE-2023-45808/): iTop missing silo check on extkey in console and portal (medium 4.1)
- [CVE-2023-45807](https://insights.sbomify.com/CVE-2023-45807/): OpenSearch Issue with tenant read-only permissions (medium 5.4)
- [CVE-2023-45806](https://insights.sbomify.com/CVE-2023-45806/): Discourse vulnerable to DoS via Regexp Injection in Full Name (medium 4.3)
- [CVE-2023-45805](https://insights.sbomify.com/CVE-2023-45805/): Trojan Lockfilein pdm (high 7.8)
- [CVE-2023-45803](https://insights.sbomify.com/CVE-2023-45803/): Request body not stripped after redirect in urllib3 (medium 4.2)
- [CVE-2023-45802](https://insights.sbomify.com/CVE-2023-45802/): Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST (medium 5.9)
- [CVE-2023-45801](https://insights.sbomify.com/CVE-2023-45801/): Auth bypass in DVR (high 7.5)
- [CVE-2023-45800](https://insights.sbomify.com/CVE-2023-45800/): SQL injection in Hanbiro groupware (high 7.5)
- [CVE-2023-4580](https://insights.sbomify.com/CVE-2023-4580/): Push notifications saved to disk unencrypted (medium 6.5)
- [CVE-2023-45799](https://insights.sbomify.com/CVE-2023-45799/): MLSoft TCO!stream Remote Code Execution Vulnerability (high 7.2)
- [CVE-2023-45798](https://insights.sbomify.com/CVE-2023-45798/): Yettiesoft VestCert Remote Code Execution Vulnerability (high 8.4)
- [CVE-2023-45797](https://insights.sbomify.com/CVE-2023-45797/): DreamSecurity MagicLine Buffer Overflow Vulnerability (critical 9.8)
- [CVE-2023-45796](https://insights.sbomify.com/CVE-2023-45796/): XSS vulnerability in Pilz PASvisu and PMI v8xx (high 8.1)
- [CVE-2023-45795](https://insights.sbomify.com/CVE-2023-45795/): Pilz: XSS vulnerability in Pilz PASvisu and PMI v8xx (high 7.8)
- [CVE-2023-45794](https://insights.sbomify.com/CVE-2023-45794/): Auth bypass in Mendix Applications using Mendix 10 (medium 6.8)
- [CVE-2023-45793](https://insights.sbomify.com/CVE-2023-45793/): Missing authorization in Siveillance Control (medium 5.5)
- [CVE-2023-4579](https://insights.sbomify.com/CVE-2023-4579/): Persisted search terms were formatted as URLs (low 3.1)
- [CVE-2023-45781](https://insights.sbomify.com/CVE-2023-45781/): Memory corruption in Android (medium 5.5)
- [CVE-2023-45780](https://insights.sbomify.com/CVE-2023-45780/): Privilege escalation in Android (high 7.3)
- [CVE-2023-4578](https://insights.sbomify.com/CVE-2023-4578/): Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception (medium 6.5)
- [CVE-2023-45779](https://insights.sbomify.com/CVE-2023-45779/): Weak cryptography in Android (high 7.8)
- [CVE-2023-45777](https://insights.sbomify.com/CVE-2023-45777/): Privilege escalation in Android (high 7.8)
- [CVE-2023-45776](https://insights.sbomify.com/CVE-2023-45776/): Memory corruption in Android (high 7.8)
- [CVE-2023-45775](https://insights.sbomify.com/CVE-2023-45775/): Memory corruption in Android (high 7.8)
- [CVE-2023-45774](https://insights.sbomify.com/CVE-2023-45774/): Missing authorization in Android (high 7.8)
- [CVE-2023-45773](https://insights.sbomify.com/CVE-2023-45773/): Memory corruption in Android (high 7.8)
- [CVE-2023-45772](https://insights.sbomify.com/CVE-2023-45772/): WordPress Proofreading Plugin <= 1.0.11 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-45771](https://insights.sbomify.com/CVE-2023-45771/): WordPress Contact Form With Captcha plugin <= 1.6.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2023-45770](https://insights.sbomify.com/CVE-2023-45770/): WordPress Fast WP Speed Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-4577](https://insights.sbomify.com/CVE-2023-4577/): Memory corruption in JIT UpdateRegExpStatics (medium 6.5)
- [CVE-2023-45769](https://insights.sbomify.com/CVE-2023-45769/): WordPress WP Report Post Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-45768](https://insights.sbomify.com/CVE-2023-45768/): WordPress Next Page Plugin <= 1.5.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-45767](https://insights.sbomify.com/CVE-2023-45767/): WordPress Simple Tweet Plugin <= 1.4.0.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-45766](https://insights.sbomify.com/CVE-2023-45766/): WordPress Poll Maker plugin <= 4.7.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-45765](https://insights.sbomify.com/CVE-2023-45765/): WordPress WP ERP plugin <= 1.12.6 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-45764](https://insights.sbomify.com/CVE-2023-45764/): WordPress Scroll post excerpt Plugin <= 8.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-45763](https://insights.sbomify.com/CVE-2023-45763/): WordPress Taggbox Plugin <= 2.9 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-45762](https://insights.sbomify.com/CVE-2023-45762/): WordPress Responsive Column Widgets Plugin <= 1.2.7 is vulnerable to Open Redirection (medium 4.7)
- [CVE-2023-45761](https://insights.sbomify.com/CVE-2023-45761/): WordPress Sendle Shipping Plugin <= 5.13 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-45760](https://insights.sbomify.com/CVE-2023-45760/): WordPress wpDiscuz plugin <= 7.6.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-4576](https://insights.sbomify.com/CVE-2023-4576/): Integer Overflow in RecordedSourceSurfaceCreation (high 8.6)
- [CVE-2023-45759](https://insights.sbomify.com/CVE-2023-45759/): WordPress Peter’s Custom Anti-Spam Plugin <= 3.2.2 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-45758](https://insights.sbomify.com/CVE-2023-45758/): WordPress Amministrazione Trasparente Plugin <= 8.0.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-45757](https://insights.sbomify.com/CVE-2023-45757/): Apache bRPC: The builtin service rpcz page has an XSS attack vulnerability (medium 6.1)
- [CVE-2023-45756](https://insights.sbomify.com/CVE-2023-45756/): Cross-site scripting in ApplyOnline – Application Form Builder and Manager (high 7.1)
- [CVE-2023-45755](https://insights.sbomify.com/CVE-2023-45755/): WordPress BuddyPress Global Search Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-45754](https://insights.sbomify.com/CVE-2023-45754/): WordPress Easy Testimonial Slider and Form Plugin <= 1.0.18 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-45753](https://insights.sbomify.com/CVE-2023-45753/): WordPress which template file Plugin <= 4.6.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-45752](https://insights.sbomify.com/CVE-2023-45752/): WordPress Post Gallery Plugin <= 2.3.12 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-45751](https://insights.sbomify.com/CVE-2023-45751/): WordPress Nexter Extension Plugin <= 2.0.3 is vulnerable to Remote Code Execution (RCE) (critical 9.1)
- [CVE-2023-45750](https://insights.sbomify.com/CVE-2023-45750/): WordPress Nexter Extension Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-4575](https://insights.sbomify.com/CVE-2023-4575/): Memory corruption in IPC FilePickerShownCallback (medium 6.5)
- [CVE-2023-45749](https://insights.sbomify.com/CVE-2023-45749/): WordPress AGP Font Awesome Collection Plugin <= 3.2.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-45748](https://insights.sbomify.com/CVE-2023-45748/): WordPress MailChimp Forms by MailMunch Plugin <= 3.1.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-45747](https://insights.sbomify.com/CVE-2023-45747/): WordPress WP Lightbox 2 Plugin <= 3.0.6.5 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-45746](https://insights.sbomify.com/CVE-2023-45746/): Cross-site scripting in Movable Type 7 (Movable Type 7 Series) (medium 5.4)
- [CVE-2023-45745](https://insights.sbomify.com/CVE-2023-45745/): Privilege escalation in Intel(R) TDX module software (high 7.9)
- [CVE-2023-45744](https://insights.sbomify.com/CVE-2023-45744/): Missing authorization in Smart Reader (high 8.3)
- [CVE-2023-45743](https://insights.sbomify.com/CVE-2023-45743/): Privilege escalation in Intel(R) DSA software uninstallers (medium 6.7)
- [CVE-2023-45742](https://insights.sbomify.com/CVE-2023-45742/): Integer overflow in WBR-6013 (high 7.2)
- [CVE-2023-45741](https://insights.sbomify.com/CVE-2023-45741/): Command injection in VR-S1000 (medium 6.8)
- [CVE-2023-45740](https://insights.sbomify.com/CVE-2023-45740/): Cross-site scripting in GROWI (medium 5.4)
- [CVE-2023-4574](https://insights.sbomify.com/CVE-2023-4574/): Memory corruption in IPC ColorPickerShownCallback (medium 6.5)
- [CVE-2023-45737](https://insights.sbomify.com/CVE-2023-45737/): Cross-site scripting in GROWI (medium 5.4)
- [CVE-2023-45736](https://insights.sbomify.com/CVE-2023-45736/): Privilege escalation in Intel(R) Power Gadget software for Windows (medium 6.7)
- [CVE-2023-45735](https://insights.sbomify.com/CVE-2023-45735/): Westermo Lynx Code Injection (high 8.0)
- [CVE-2023-45734](https://insights.sbomify.com/CVE-2023-45734/): Dsoftbus has an out-of-bounds write vulnerability (medium 4.2)
- [CVE-2023-45733](https://insights.sbomify.com/CVE-2023-45733/): Race condition in Intel(R) Processors (low 2.8)
- [CVE-2023-4573](https://insights.sbomify.com/CVE-2023-4573/): Memory corruption in IPC CanvasTranslator (medium 6.5)
- [CVE-2023-45727](https://insights.sbomify.com/CVE-2023-45727/): North Grid Proself Improper Restriction of XML External Entity (XXE) Reference (high 7.5, exploited in the wild)
- [CVE-2023-45725](https://insights.sbomify.com/CVE-2023-45725/): Apache CouchDB, IBM Cloudant: Privilege Escalation Using _design Documents (medium 5.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/209/