# Vulnerabilities published in 2023


- [CVE-2023-44315](https://insights.sbomify.com/CVE-2023-44315/): Cross-site scripting in SINEC NMS (medium 4.7)
- [CVE-2023-44313](https://insights.sbomify.com/CVE-2023-44313/): Apache ServiceComb Service-Center: attacker can perform SSRF through the frontend API (high 7.6)
- [CVE-2023-44312](https://insights.sbomify.com/CVE-2023-44312/): Apache ServiceComb Service-Center: attacker can query all environment variables of the service-center server (medium 5.8)
- [CVE-2023-44311](https://insights.sbomify.com/CVE-2023-44311/): Liferay Portal and Liferay DXP Vulnerable to XSS via the OAuth2ProviderApplicationRedirect Class (critical 9.6)
- [CVE-2023-44310](https://insights.sbomify.com/CVE-2023-44310/): Liferay Portal and Liferay DXP Vulnerable to XSS via the Page Tree Menu (critical 9.0)
- [CVE-2023-4431](https://insights.sbomify.com/CVE-2023-4431/): Memory corruption in Chrome (high 8.1)
- [CVE-2023-44309](https://insights.sbomify.com/CVE-2023-44309/): Liferay Portal and Liferay DXP Vulnerable to XSS in the Fragment Components (critical 9.0)
- [CVE-2023-44308](https://insights.sbomify.com/CVE-2023-44308/): Liferay Vulnerable to Open Redirect via Adaptive Media Administration Page (medium 6.1)
- [CVE-2023-44306](https://insights.sbomify.com/CVE-2023-44306/): Path traversal in Dell PowerProtect Data Manager DM5500 Appliance (medium 6.5)
- [CVE-2023-44305](https://insights.sbomify.com/CVE-2023-44305/): Memory corruption in Dell PowerProtect Data Manager DM5500 Appliance (high 8.1)
- [CVE-2023-44304](https://insights.sbomify.com/CVE-2023-44304/): Command injection in Dell PowerProtect Data Manager DM5500 Appliance (high 8.8)
- [CVE-2023-44303](https://insights.sbomify.com/CVE-2023-44303/): Weak cryptography in RVTools (high 7.5)
- [CVE-2023-44302](https://insights.sbomify.com/CVE-2023-44302/): Auth bypass in Dell PowerProtect Data Manager DM5500 Appliance (high 8.1)
- [CVE-2023-44301](https://insights.sbomify.com/CVE-2023-44301/): Cross-site scripting in Dell PowerProtect Data Manager DM5500 Appliance (medium 5.4)
- [CVE-2023-44300](https://insights.sbomify.com/CVE-2023-44300/): Information disclosure in Dell PowerProtect Data Manager DM5500 Appliance (medium 5.5)
- [CVE-2023-4430](https://insights.sbomify.com/CVE-2023-4430/): Use after free in Chrome (high 8.8)
- [CVE-2023-44298](https://insights.sbomify.com/CVE-2023-44298/): Other in PowerEdge BIOS (low 3.6)
- [CVE-2023-44297](https://insights.sbomify.com/CVE-2023-44297/): Other in PowerEdge BIOS (high 7.1)
- [CVE-2023-44296](https://insights.sbomify.com/CVE-2023-44296/): Hardcoded credentials in Mobility - E-Lab Navigator (high 8.4)
- [CVE-2023-44295](https://insights.sbomify.com/CVE-2023-44295/): Information disclosure in PowerScale OneFS (medium 6.3)
- [CVE-2023-44294](https://insights.sbomify.com/CVE-2023-44294/): SQL injection in Secure Connect Gateway-Appliance (medium 5.4)
- [CVE-2023-44293](https://insights.sbomify.com/CVE-2023-44293/): SQL injection in Secure Connect Gateway-Appliance (medium 5.4)
- [CVE-2023-44292](https://insights.sbomify.com/CVE-2023-44292/): Privilege escalation in Dell Repository Manager (DRM) (medium 6.7)
- [CVE-2023-44291](https://insights.sbomify.com/CVE-2023-44291/): Command injection in Dell PowerProtect Data Manager DM5500 Appliance (high 7.2)
- [CVE-2023-44290](https://insights.sbomify.com/CVE-2023-44290/): Privilege escalation in Dell Command Monitor (DCM) (high 7.3)
- [CVE-2023-4429](https://insights.sbomify.com/CVE-2023-4429/): Use after free in Chrome (high 8.8)
- [CVE-2023-44289](https://insights.sbomify.com/CVE-2023-44289/): Privilege escalation in Dell Command Configure (DCC) (high 7.3)
- [CVE-2023-44288](https://insights.sbomify.com/CVE-2023-44288/): Denial of service in PowerScale OneFS (high 7.5)
- [CVE-2023-44286](https://insights.sbomify.com/CVE-2023-44286/): Cross-site scripting in PowerProtect DD (high 8.8)
- [CVE-2023-44285](https://insights.sbomify.com/CVE-2023-44285/): Privilege escalation in PowerProtect DD (high 7.8)
- [CVE-2023-44284](https://insights.sbomify.com/CVE-2023-44284/): SQL injection in PowerProtect DD (medium 4.3)
- [CVE-2023-44283](https://insights.sbomify.com/CVE-2023-44283/): Privilege escalation in SupportAssist for Business PCs (high 7.8)
- [CVE-2023-44282](https://insights.sbomify.com/CVE-2023-44282/): Privilege escalation in Dell Repository Manager (DRM) (medium 6.7)
- [CVE-2023-44281](https://insights.sbomify.com/CVE-2023-44281/): Privilege escalation in Dell Pair (medium 6.6)
- [CVE-2023-4428](https://insights.sbomify.com/CVE-2023-4428/): Memory corruption in Chrome (high 8.1)
- [CVE-2023-44279](https://insights.sbomify.com/CVE-2023-44279/): Command injection in PowerProtect DD (medium 6.7)
- [CVE-2023-44278](https://insights.sbomify.com/CVE-2023-44278/): Path traversal in PowerProtect DD (medium 6.7)
- [CVE-2023-44277](https://insights.sbomify.com/CVE-2023-44277/): Command injection in PowerProtect DD (high 7.8)
- [CVE-2023-44276](https://insights.sbomify.com/CVE-2023-44276/): Cross-site scripting in opnsense:opnsense (medium 5.4)
- [CVE-2023-44275](https://insights.sbomify.com/CVE-2023-44275/): Cross-site scripting in opnsense:opnsense (medium 5.4)
- [CVE-2023-44273](https://insights.sbomify.com/CVE-2023-44273/): Duplicate Advisory: Consensys gnark-crypto allows Signature Malleability (critical 9.8)
- [CVE-2023-44272](https://insights.sbomify.com/CVE-2023-44272/): Cross-site scripting in Citadel (medium 5.4)
- [CVE-2023-44271](https://insights.sbomify.com/CVE-2023-44271/): Pillow Denial of Service vulnerability (high 7.5)
- [CVE-2023-44270](https://insights.sbomify.com/CVE-2023-44270/): PostCSS line return parsing error (medium 5.3)
- [CVE-2023-4427](https://insights.sbomify.com/CVE-2023-4427/): Memory corruption in Chrome (high 8.1)
- [CVE-2023-44267](https://insights.sbomify.com/CVE-2023-44267/): Online Art Gallery v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-44266](https://insights.sbomify.com/CVE-2023-44266/): WordPress WP Adminify Plugin <= 3.1.6 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-44265](https://insights.sbomify.com/CVE-2023-44265/): WordPress Popup contact form Plugin <= 7.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-44264](https://insights.sbomify.com/CVE-2023-44264/): WordPress The Awesome Feed – Custom Feed Plugin <= 2.2.5 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-44263](https://insights.sbomify.com/CVE-2023-44263/): WordPress Social Metrics Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-44262](https://insights.sbomify.com/CVE-2023-44262/): WordPress Blocks Plugin <= 1.6.41 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-44261](https://insights.sbomify.com/CVE-2023-44261/): WordPress Block Plugin Update Plugin <= 3.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-44260](https://insights.sbomify.com/CVE-2023-44260/): WordPress Woocommerce ESTO Plugin <= 2.23.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-44259](https://insights.sbomify.com/CVE-2023-44259/): WordPress Mediavine Control Panel Plugin <= 2.10.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-44258](https://insights.sbomify.com/CVE-2023-44258/): WordPress Schema App Structured Data plugin <= 1.23.1 - Broken Access Control + CSRF vulnerability (medium 5.3)
- [CVE-2023-44257](https://insights.sbomify.com/CVE-2023-44257/): WordPress Mang Board WP Plugin <= 1.7.6 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-44256](https://insights.sbomify.com/CVE-2023-44256/): Server-side request forgery in FortiAnalyzer (medium 6.4)
- [CVE-2023-44255](https://insights.sbomify.com/CVE-2023-44255/): Information disclosure in FortiAnalyzer (low 3.9)
- [CVE-2023-44254](https://insights.sbomify.com/CVE-2023-44254/): Missing authorization in FortiAnalyzer (medium 4.7)
- [CVE-2023-44253](https://insights.sbomify.com/CVE-2023-44253/): Information disclosure in FortiAnalyzer (medium 4.7)
- [CVE-2023-44252](https://insights.sbomify.com/CVE-2023-44252/): Auth bypass in FortiWAN (high 8.6)
- [CVE-2023-44251](https://insights.sbomify.com/CVE-2023-44251/): Path traversal in FortiWAN (high 8.1)
- [CVE-2023-44250](https://insights.sbomify.com/CVE-2023-44250/): Privilege escalation in FortiOS (high 8.3)
- [CVE-2023-44249](https://insights.sbomify.com/CVE-2023-44249/): Missing authorization in FortiAnalyzer (medium 4.1)
- [CVE-2023-44248](https://insights.sbomify.com/CVE-2023-44248/): Missing authorization in FortiEDR CollectorWindows (medium 4.0)
- [CVE-2023-44247](https://insights.sbomify.com/CVE-2023-44247/): Memory corruption in FortiOS (medium 6.5)
- [CVE-2023-44246](https://insights.sbomify.com/CVE-2023-44246/): WordPress Shockingly Simple Favicon Plugin <= 1.8.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-44245](https://insights.sbomify.com/CVE-2023-44245/): WordPress Contractor Contact Form Website to Workflow Tool Plugin <= 4.0.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-44244](https://insights.sbomify.com/CVE-2023-44244/): WordPress FooGallery Plugin <= 2.2.44 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-44243](https://insights.sbomify.com/CVE-2023-44243/): WordPress Instant CSS Plugin <= 1.2.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-44242](https://insights.sbomify.com/CVE-2023-44242/): WordPress Images Slideshow by 2J Plugin <= 1.3.54 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-44241](https://insights.sbomify.com/CVE-2023-44241/): WordPress Keap Landing Pages Plugin <= 1.4.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-44240](https://insights.sbomify.com/CVE-2023-44240/): WordPress Timthumb Vulnerability Scanner Plugin <= 1.54 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-4424](https://insights.sbomify.com/CVE-2023-4424/): bt: hci: DoS and possible RCE (high 8.3)
- [CVE-2023-44239](https://insights.sbomify.com/CVE-2023-44239/): WordPress WWM Social Share On Image Hover Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-44238](https://insights.sbomify.com/CVE-2023-44238/): WordPress Remove slug from custom post type Plugin <= 1.0.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-44237](https://insights.sbomify.com/CVE-2023-44237/): WordPress WP Site Protector Plugin <= 2.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-44236](https://insights.sbomify.com/CVE-2023-44236/): WordPress WP Captcha Plugin <= 2.0.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-44235](https://insights.sbomify.com/CVE-2023-44235/): WordPress WP Captcha plugin <= 2.0.0 - Captcha Bypass vulnerability (medium 5.3)
- [CVE-2023-44234](https://insights.sbomify.com/CVE-2023-44234/): WordPress WP GPX Maps plugin <= 1.7.08 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-44233](https://insights.sbomify.com/CVE-2023-44233/): WordPress FooGallery Plugin <= 2.2.44 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-44232](https://insights.sbomify.com/CVE-2023-44232/): WordPress WP Hide Pages Plugin <= 1.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-44231](https://insights.sbomify.com/CVE-2023-44231/): WordPress Contact Form Plugin <= 2.0.10 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-44230](https://insights.sbomify.com/CVE-2023-44230/): WordPress Popup contact form Plugin <= 7.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-4423](https://insights.sbomify.com/CVE-2023-4423/): Cross-site scripting in WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce (medium 4.4)
- [CVE-2023-44229](https://insights.sbomify.com/CVE-2023-44229/): WordPress Tiny Carousel Horizontal Slider Plugin <= 8.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-44228](https://insights.sbomify.com/CVE-2023-44228/): WordPress Onclick Show Popup Plugin <= 8.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-44227](https://insights.sbomify.com/CVE-2023-44227/): WordPress Simple File List Plugin <= 6.1.9 is vulnerable to Arbitrary File Deletion (high 7.5)
- [CVE-2023-44221](https://insights.sbomify.com/CVE-2023-44221/): SonicWall SMA100 Appliances OS Command Injection (high 7.2, exploited in the wild)
- [CVE-2023-44220](https://insights.sbomify.com/CVE-2023-44220/): Other in NetExtender (high 7.3)
- [CVE-2023-4422](https://insights.sbomify.com/CVE-2023-4422/): Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit (medium 6.8)
- [CVE-2023-44219](https://insights.sbomify.com/CVE-2023-44219/): Privilege escalation in Directory Services Connector (high 7.8)
- [CVE-2023-44218](https://insights.sbomify.com/CVE-2023-44218/): Privilege escalation in NetExtender (high 8.8)
- [CVE-2023-44217](https://insights.sbomify.com/CVE-2023-44217/): Privilege escalation in NetExtender (high 7.8)
- [CVE-2023-44216](https://insights.sbomify.com/CVE-2023-44216/): Information disclosure in amd:ryzen 5 7600x (medium 5.3)
- [CVE-2023-44214](https://insights.sbomify.com/CVE-2023-44214/): Missing authorization in Acronis Agent (medium 5.5)
- [CVE-2023-44213](https://insights.sbomify.com/CVE-2023-44213/): Information disclosure in Acronis Cyber Protect 16 (low 3.3)
- [CVE-2023-44212](https://insights.sbomify.com/CVE-2023-44212/): Missing authorization in Acronis Agent (high 7.3)
- [CVE-2023-44211](https://insights.sbomify.com/CVE-2023-44211/): Missing authorization in Acronis Cyber Protect 16 (high 7.1)
- [CVE-2023-44210](https://insights.sbomify.com/CVE-2023-44210/): Missing authorization in Acronis Cyber Protect 17 (high 7.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/218/