# Vulnerabilities published in 2023


- [CVE-2023-41953](https://insights.sbomify.com/CVE-2023-41953/): WordPress ProfilePress plugin <= 4.13.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-41952](https://insights.sbomify.com/CVE-2023-41952/): WordPress Fluent Forms plugin <= 5.0.8 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-41951](https://insights.sbomify.com/CVE-2023-41951/): WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.6.14 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-41950](https://insights.sbomify.com/CVE-2023-41950/): WordPress Laposta Signup Basic Plugin <= 1.4.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-4195](https://insights.sbomify.com/CVE-2023-4195/): PHP Remote File Inclusion in cockpit-hq/cockpit (critical 9.9)
- [CVE-2023-41949](https://insights.sbomify.com/CVE-2023-41949/): WordPress iFolders Plugin <= 1.5.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-41948](https://insights.sbomify.com/CVE-2023-41948/): WordPress Cookie Notice & Consent Plugin <= 1.6.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-41947](https://insights.sbomify.com/CVE-2023-41947/): Missing permission checks in Jenkins Frugal Testing Plugin (medium 4.3)
- [CVE-2023-41946](https://insights.sbomify.com/CVE-2023-41946/): CSRF vulnerability in Jenkins Frugal Testing Plugin (low 3.5)
- [CVE-2023-41945](https://insights.sbomify.com/CVE-2023-41945/): Disabled permissions granted by Jenkins Assembla Auth Plugin (high 8.8)
- [CVE-2023-41944](https://insights.sbomify.com/CVE-2023-41944/): HTML injection vulnerability in Jenkins AWS CodeCommit Trigger Plugin (medium 6.1)
- [CVE-2023-41943](https://insights.sbomify.com/CVE-2023-41943/): Missing permission check in Jenkins AWS CodeCommit Trigger Plugin (medium 6.5)
- [CVE-2023-41942](https://insights.sbomify.com/CVE-2023-41942/): CSRF vulnerability in Jenkins AWS CodeCommit Trigger Plugin (medium 4.3)
- [CVE-2023-41941](https://insights.sbomify.com/CVE-2023-41941/): Missing permission check in Jenkins AWS CodeCommit Trigger Plugin allows enumerating credentials IDs (medium 4.3)
- [CVE-2023-41940](https://insights.sbomify.com/CVE-2023-41940/): Stored XSS vulnerability in Jenkins TAP Plugin (medium 5.4)
- [CVE-2023-4194](https://insights.sbomify.com/CVE-2023-4194/): Kernel: tap: tap_open(): correctly initialize socket uid next fix of i_uid to current_fsuid (medium 5.5)
- [CVE-2023-41939](https://insights.sbomify.com/CVE-2023-41939/): Disabled permissions can be granted by Jenkins SSH2 Easy Plugin (high 8.8)
- [CVE-2023-41938](https://insights.sbomify.com/CVE-2023-41938/): CSRF vulnerability in Jenkins Ivy Plugin (medium 6.5)
- [CVE-2023-41937](https://insights.sbomify.com/CVE-2023-41937/): SSRF vulnerability in Jenkins Bitbucket Push and Pull Request Plugin allows capturing credentials (high 7.5)
- [CVE-2023-41936](https://insights.sbomify.com/CVE-2023-41936/): Jenkins Google Login Plugin non-constant time token comparison (high 7.5)
- [CVE-2023-41935](https://insights.sbomify.com/CVE-2023-41935/): Non-constant time nonce comparison in Jenkins Microsoft Entra ID (previously Azure AD) Plugin (high 7.5)
- [CVE-2023-41934](https://insights.sbomify.com/CVE-2023-41934/): Improper masking of credentials in Jenkins Pipeline Maven Integration Plugin (medium 5.3)
- [CVE-2023-41933](https://insights.sbomify.com/CVE-2023-41933/): Job Configuration History Plugin's path traversal allows exploiting XXE vulnerability (high 8.8)
- [CVE-2023-41932](https://insights.sbomify.com/CVE-2023-41932/): Path traversal allows exploiting XXE vulnerability in Jenkins Job Configuration History Plugin (medium 6.5)
- [CVE-2023-41931](https://insights.sbomify.com/CVE-2023-41931/): XSS vulnerability in Jenkins Job Configuration History Plugin (medium 5.4)
- [CVE-2023-41930](https://insights.sbomify.com/CVE-2023-41930/): Path traversal in Jenkins Job Configuration History Plugin (medium 4.3)
- [CVE-2023-4193](https://insights.sbomify.com/CVE-2023-4193/): SourceCodester Resort Reservation System view_fee.php sql injection (medium 6.3)
- [CVE-2023-41929](https://insights.sbomify.com/CVE-2023-41929/): Privilege escalation in samsung:memory card \& ufd authentication (high 7.3)
- [CVE-2023-41928](https://insights.sbomify.com/CVE-2023-41928/): Remote server offers deprecated TLS protocol in Kiloview P1/P2 devices (medium 5.3)
- [CVE-2023-41927](https://insights.sbomify.com/CVE-2023-41927/): Weak TLS Cipher Suites Supported in Kiloview P1/P2 devices (medium 5.3)
- [CVE-2023-41926](https://insights.sbomify.com/CVE-2023-41926/): Insufficiently protected credentials in Kiloview P1/P2 devices (high 8.8)
- [CVE-2023-41923](https://insights.sbomify.com/CVE-2023-41923/): Weak Password Requirements in Kiloview P1/P2 devices (high 7.2)
- [CVE-2023-41922](https://insights.sbomify.com/CVE-2023-41922/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Kiloview P1/P2 devices (high 7.2)
- [CVE-2023-41921](https://insights.sbomify.com/CVE-2023-41921/): Download of Code Without Integrity Check in Kiloview P1/P2 devices (critical 9.8)
- [CVE-2023-41920](https://insights.sbomify.com/CVE-2023-41920/): Authentication Bypass by Primary Weakness in Kiloview P1/P2 devices (critical 9.8)
- [CVE-2023-4192](https://insights.sbomify.com/CVE-2023-4192/): SourceCodester Resort Reservation System manage_user.php sql injection (medium 6.3)
- [CVE-2023-41919](https://insights.sbomify.com/CVE-2023-41919/): Use of Hard-coded Credentials in Kiloview P1/P2 devices (critical 9.8)
- [CVE-2023-41918](https://insights.sbomify.com/CVE-2023-41918/): Missing Authentication for Critical Function in Kiloview P1/P2 devices (critical 10.0)
- [CVE-2023-41917](https://insights.sbomify.com/CVE-2023-41917/): Improper input validation in Kiloview P1/P2 devices allows for remote code execution (critical 10.0)
- [CVE-2023-41916](https://insights.sbomify.com/CVE-2023-41916/): Apache Linkis DataSource allows arbitrary file reading (medium 6.5)
- [CVE-2023-41915](https://insights.sbomify.com/CVE-2023-41915/): Race condition in debian:debian linux (high 8.1)
- [CVE-2023-41914](https://insights.sbomify.com/CVE-2023-41914/): Race condition in fedoraproject:fedora (high 7.0)
- [CVE-2023-41913](https://insights.sbomify.com/CVE-2023-41913/): Memory corruption in strongswan:strongswan (critical 9.8)
- [CVE-2023-41911](https://insights.sbomify.com/CVE-2023-41911/): Memory corruption in samsung:exynos 2200 firmware (medium 4.7)
- [CVE-2023-41910](https://insights.sbomify.com/CVE-2023-41910/): Memory corruption in lldpd project:lldpd (critical 9.8)
- [CVE-2023-4191](https://insights.sbomify.com/CVE-2023-4191/): SourceCodester Resort Reservation System index.php file inclusion (medium 6.3)
- [CVE-2023-41909](https://insights.sbomify.com/CVE-2023-41909/): Null dereference in debian:debian linux (high 7.5)
- [CVE-2023-41908](https://insights.sbomify.com/CVE-2023-41908/): Misconfiguration in cerebrate-project:cerebrate (medium 5.3)
- [CVE-2023-41905](https://insights.sbomify.com/CVE-2023-41905/): Cross-site scripting in netscout:ngeniusone (medium 5.4)
- [CVE-2023-41904](https://insights.sbomify.com/CVE-2023-41904/): Auth bypass in zohocorp:manageengine admanager plus (medium 5.4)
- [CVE-2023-41902](https://insights.sbomify.com/CVE-2023-41902/): Privilege escalation in corecode:macupdater (high 7.8)
- [CVE-2023-41900](https://insights.sbomify.com/CVE-2023-41900/): Jetty's OpenId Revoked authentication allows one request (low 3.5)
- [CVE-2023-4190](https://insights.sbomify.com/CVE-2023-4190/): Insufficient Session Expiration in admidio/admidio (medium 6.5)
- [CVE-2023-41899](https://insights.sbomify.com/CVE-2023-41899/): Partial Server-Side Request Forgery in Home Assistant Core (medium 6.6)
- [CVE-2023-41898](https://insights.sbomify.com/CVE-2023-41898/): Arbitrary URL load in Android WebView in `MyActivity.kt` in Home Assistant Companion for Android (high 8.6)
- [CVE-2023-41897](https://insights.sbomify.com/CVE-2023-41897/): Lack of XFO header allows clickjacking in Home Assistant Core (high 8.8)
- [CVE-2023-41896](https://insights.sbomify.com/CVE-2023-41896/): Fake websocket server installation permits full takeover in Home Assistant Core (high 7.1)
- [CVE-2023-41895](https://insights.sbomify.com/CVE-2023-41895/): Cross-site Scripting via auth_callback login in Home Assistant Core (high 8.8)
- [CVE-2023-41894](https://insights.sbomify.com/CVE-2023-41894/): Local-only webhooks externally accessible via SniTun in Home Assistant Core (medium 5.3)
- [CVE-2023-41893](https://insights.sbomify.com/CVE-2023-41893/): Account takeover via auth_callback login in Home Assistant Core (medium 4.3)
- [CVE-2023-41892](https://insights.sbomify.com/CVE-2023-41892/): Craft CMS Remote Code Execution vulnerability (critical 10.0)
- [CVE-2023-41891](https://insights.sbomify.com/CVE-2023-41891/): FlyteAdmin SQL Injection in List Filters (low 3.5)
- [CVE-2023-41890](https://insights.sbomify.com/CVE-2023-41890/): Sustainsys.Saml2 Insufficient Identity Provider Issuer Validation (high 7.5)
- [CVE-2023-4189](https://insights.sbomify.com/CVE-2023-4189/): Cross-site Scripting (XSS) - Reflected in instantsoft/icms2 (medium 4.8)
- [CVE-2023-41889](https://insights.sbomify.com/CVE-2023-41889/): Late-Unicode normalization vulnerability in SHIRASAGI (medium 5.3)
- [CVE-2023-41888](https://insights.sbomify.com/CVE-2023-41888/): Phishing through a login page malicious URL in GLPI (medium 5.3)
- [CVE-2023-41887](https://insights.sbomify.com/CVE-2023-41887/): Remote Code exec in project import with mysql jdbc url attack (critical 9.8)
- [CVE-2023-41886](https://insights.sbomify.com/CVE-2023-41886/): OpenRefine vulnerable to arbitrary file read in project import with mysql jdbc url attack (high 7.5)
- [CVE-2023-41885](https://insights.sbomify.com/CVE-2023-41885/): Piccolo's current `BaseUser.login` implementation is vulnerable to time based user enumeration (medium 5.3)
- [CVE-2023-41884](https://insights.sbomify.com/CVE-2023-41884/): ZoneMinder Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in watch.php (high 7.1)
- [CVE-2023-41882](https://insights.sbomify.com/CVE-2023-41882/): vantage6 Improper Access Control vulnerability (medium 5.4)
- [CVE-2023-41881](https://insights.sbomify.com/CVE-2023-41881/): Deleting a collaboration should also delete linked resources (low 3.7)
- [CVE-2023-41880](https://insights.sbomify.com/CVE-2023-41880/): Miscompilation of wasm `i64x2.shr_s` instruction with constant input on x86_64 (low 2.2)
- [CVE-2023-4188](https://insights.sbomify.com/CVE-2023-4188/): SQL Injection in instantsoft/icms2 (critical 9.8)
- [CVE-2023-41879](https://insights.sbomify.com/CVE-2023-41879/): Magento LTS's guest order "protect code" can be brute-forced too easily (high 7.5)
- [CVE-2023-41878](https://insights.sbomify.com/CVE-2023-41878/): Weak password of selenium VNC in MeterSphere (medium 4.6)
- [CVE-2023-41877](https://insights.sbomify.com/CVE-2023-41877/): GeoServer log file path traversal vulnerability (high 7.2)
- [CVE-2023-41876](https://insights.sbomify.com/CVE-2023-41876/): WordPress WP Gallery Metabox Plugin <= 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-41875](https://insights.sbomify.com/CVE-2023-41875/): WordPress WP Directory Kit plugin <= 1.2.6 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-41874](https://insights.sbomify.com/CVE-2023-41874/): WordPress Order Delivery Date for WooCommerce Plugin <= 3.20.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-41873](https://insights.sbomify.com/CVE-2023-41873/): WordPress SAML Single Sign On – SSO Login plugin <= 5.0.4 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-41872](https://insights.sbomify.com/CVE-2023-41872/): WordPress WoodMart Theme <= 7.2.4 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-41871](https://insights.sbomify.com/CVE-2023-41871/): WordPress Poll Maker Plugin <= 4.7.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-41870](https://insights.sbomify.com/CVE-2023-41870/): WordPress WP Crowdfunding plugin <= 2.1.5 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-4187](https://insights.sbomify.com/CVE-2023-4187/): Cross-site Scripting (XSS) - Stored in instantsoft/icms2 (low 3.5)
- [CVE-2023-41869](https://insights.sbomify.com/CVE-2023-41869/): WordPress WP Accessibility Helper (WAH) plugin <= 0.6.2.4 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-41868](https://insights.sbomify.com/CVE-2023-41868/): WordPress Stagtools Plugin <= 2.3.7 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-41867](https://insights.sbomify.com/CVE-2023-41867/): WordPress AcyMailing SMTP Newsletter Plugin <= 8.6.2 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-41866](https://insights.sbomify.com/CVE-2023-41866/): WordPress Automatic YouTube Gallery plugin <= 2.3.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-41865](https://insights.sbomify.com/CVE-2023-41865/): WordPress Slider Pro plugin <= 4.8.6 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-41864](https://insights.sbomify.com/CVE-2023-41864/): WordPress PeproDev CF7 Database plugin <= 1.8.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2023-41863](https://insights.sbomify.com/CVE-2023-41863/): WordPress PeproDev CF7 Database Plugin <= 1.7.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-41862](https://insights.sbomify.com/CVE-2023-41862/): WordPress VS Contact Form plugin <= 14.0 - Sum Captcha Bypass vulnerability (medium 5.3)
- [CVE-2023-41861](https://insights.sbomify.com/CVE-2023-41861/): WordPress Restrict Plugin <= 2.2.4 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-41860](https://insights.sbomify.com/CVE-2023-41860/): WordPress Travel Map Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.8)
- [CVE-2023-4186](https://insights.sbomify.com/CVE-2023-4186/): SourceCodester Pharmacy Management System manage_website.php unrestricted upload (medium 6.3)
- [CVE-2023-41859](https://insights.sbomify.com/CVE-2023-41859/): WordPress Order Delivery Date for WP e-Commerce Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-41858](https://insights.sbomify.com/CVE-2023-41858/): WordPress Order Delivery Date for WP e-Commerce Plugin <= 1.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-41857](https://insights.sbomify.com/CVE-2023-41857/): WordPress Click To Tweet plugin <= 2.0.14 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-41856](https://insights.sbomify.com/CVE-2023-41856/): WordPress Click To Tweet Plugin <= 2.0.14 is vulnerable to Cross Site Scripting (XSS) (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/235/