# Vulnerabilities published in 2023


- [CVE-2023-40771](https://insights.sbomify.com/CVE-2023-40771/): DataEase vulnerable to SQL injection (high 7.5)
- [CVE-2023-4077](https://insights.sbomify.com/CVE-2023-4077/): Cross-site scripting in Chrome (high 8.8)
- [CVE-2023-40767](https://insights.sbomify.com/CVE-2023-40767/): Information disclosure in phpjabbers:make an offer widget (critical 9.8)
- [CVE-2023-40766](https://insights.sbomify.com/CVE-2023-40766/): Information disclosure in phpjabbers:ticket support script (critical 9.8)
- [CVE-2023-40765](https://insights.sbomify.com/CVE-2023-40765/): Information disclosure in phpjabbers:event booking calendar (critical 9.8)
- [CVE-2023-40764](https://insights.sbomify.com/CVE-2023-40764/): Information disclosure in phpjabbers:car rental script (critical 9.8)
- [CVE-2023-40763](https://insights.sbomify.com/CVE-2023-40763/): Information disclosure in phpjabbers:taxi booking script (critical 9.8)
- [CVE-2023-40762](https://insights.sbomify.com/CVE-2023-40762/): Information disclosure in phpjabbers:fundraising script (critical 9.8)
- [CVE-2023-40761](https://insights.sbomify.com/CVE-2023-40761/): Information disclosure in phpjabbers:yacht listing script (critical 9.8)
- [CVE-2023-40760](https://insights.sbomify.com/CVE-2023-40760/): Information disclosure in phpjabbers:hotel booking system (critical 9.8)
- [CVE-2023-4076](https://insights.sbomify.com/CVE-2023-4076/): Use after free in Chrome (high 8.8)
- [CVE-2023-40759](https://insights.sbomify.com/CVE-2023-40759/): Information disclosure in phpjabbers:restaurant booking script (critical 9.8)
- [CVE-2023-40758](https://insights.sbomify.com/CVE-2023-40758/): Information disclosure in phpjabbers:document creator (critical 9.8)
- [CVE-2023-40757](https://insights.sbomify.com/CVE-2023-40757/): Information disclosure in phpjabbers:food delivery script (critical 9.8)
- [CVE-2023-40756](https://insights.sbomify.com/CVE-2023-40756/): Information disclosure in phpjabbers:callback widget (critical 9.8)
- [CVE-2023-40755](https://insights.sbomify.com/CVE-2023-40755/): Cross-site scripting in phpjabbers:callback widget (medium 6.1)
- [CVE-2023-40754](https://insights.sbomify.com/CVE-2023-40754/): Business logic in phpjabbers:car rental script (high 8.8)
- [CVE-2023-40753](https://insights.sbomify.com/CVE-2023-40753/): Cross-site scripting in phpjabbers:ticket support script (medium 5.4)
- [CVE-2023-40752](https://insights.sbomify.com/CVE-2023-40752/): Cross-site scripting in phpjabbers:make an offer widget (medium 6.1)
- [CVE-2023-40751](https://insights.sbomify.com/CVE-2023-40751/): Cross-site scripting in phpjabbers:fundraising script (medium 6.1)
- [CVE-2023-40750](https://insights.sbomify.com/CVE-2023-40750/): Cross-site scripting in phpjabbers:yacht listing script (medium 6.1)
- [CVE-2023-4075](https://insights.sbomify.com/CVE-2023-4075/): Use after free in Chrome (high 8.8)
- [CVE-2023-40749](https://insights.sbomify.com/CVE-2023-40749/): SQL injection in phpjabbers:food delivery script (critical 9.8)
- [CVE-2023-40748](https://insights.sbomify.com/CVE-2023-40748/): SQL injection in phpjabbers:food delivery script (critical 9.8)
- [CVE-2023-40747](https://insights.sbomify.com/CVE-2023-40747/): Path traversal in pmman.exe (Enterprise edition) (high 7.5)
- [CVE-2023-40745](https://insights.sbomify.com/CVE-2023-40745/): Libtiff: integer overflow in tiffcp.c (medium 6.5)
- [CVE-2023-40743](https://insights.sbomify.com/CVE-2023-40743/): Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getService (critical 9.8)
- [CVE-2023-4074](https://insights.sbomify.com/CVE-2023-4074/): Use after free in Chrome (high 8.8)
- [CVE-2023-40735](https://insights.sbomify.com/CVE-2023-40735/): Butterfly Button Project - Sensitive Information Disclosure (high 7.5)
- [CVE-2023-40732](https://insights.sbomify.com/CVE-2023-40732/): Auth bypass in QMS Automotive (low 3.9)
- [CVE-2023-40731](https://insights.sbomify.com/CVE-2023-40731/): File upload in QMS Automotive (medium 5.7)
- [CVE-2023-40730](https://insights.sbomify.com/CVE-2023-40730/): Missing authorization in QMS Automotive (high 7.1)
- [CVE-2023-4073](https://insights.sbomify.com/CVE-2023-4073/): Memory corruption in Chrome (high 8.8)
- [CVE-2023-40729](https://insights.sbomify.com/CVE-2023-40729/): Weak cryptography in QMS Automotive (high 7.3)
- [CVE-2023-40728](https://insights.sbomify.com/CVE-2023-40728/): Information disclosure in QMS Automotive (high 7.3)
- [CVE-2023-40727](https://insights.sbomify.com/CVE-2023-40727/): Weak cryptography in QMS Automotive (high 7.8)
- [CVE-2023-40726](https://insights.sbomify.com/CVE-2023-40726/): Information disclosure in QMS Automotive (high 8.8)
- [CVE-2023-40725](https://insights.sbomify.com/CVE-2023-40725/): Information disclosure in QMS Automotive (medium 4.0)
- [CVE-2023-40724](https://insights.sbomify.com/CVE-2023-40724/): Information disclosure in QMS Automotive (high 7.3)
- [CVE-2023-40723](https://insights.sbomify.com/CVE-2023-40723/): Information disclosure in FortiSIEM (high 7.7)
- [CVE-2023-40721](https://insights.sbomify.com/CVE-2023-40721/): Memory corruption in FortiOS (medium 6.3)
- [CVE-2023-40720](https://insights.sbomify.com/CVE-2023-40720/): Missing authorization in FortiVoice (medium 6.7)
- [CVE-2023-4072](https://insights.sbomify.com/CVE-2023-4072/): Memory corruption in Chrome (high 8.8)
- [CVE-2023-40719](https://insights.sbomify.com/CVE-2023-40719/): Hardcoded credentials in FortiAnalyzer (medium 4.1)
- [CVE-2023-40718](https://insights.sbomify.com/CVE-2023-40718/): Security feature bypass in IPS Engine (medium 6.7)
- [CVE-2023-40717](https://insights.sbomify.com/CVE-2023-40717/): Hardcoded credentials in FortiTester (medium 5.0)
- [CVE-2023-40716](https://insights.sbomify.com/CVE-2023-40716/): Command injection in FortiTester (medium 6.5)
- [CVE-2023-40715](https://insights.sbomify.com/CVE-2023-40715/): Information disclosure in FortiTester (medium 5.2)
- [CVE-2023-40714](https://insights.sbomify.com/CVE-2023-40714/): Path traversal in FortiSIEM (critical 9.7)
- [CVE-2023-40712](https://insights.sbomify.com/CVE-2023-40712/): Apache Airflow: Secrets can be unmasked in the "Rendered Template" (medium 6.5)
- [CVE-2023-40711](https://insights.sbomify.com/CVE-2023-40711/): Denial of service in veilid:veilid (high 7.5)
- [CVE-2023-40710](https://insights.sbomify.com/CVE-2023-40710/): Denial of service in SNAP PAC S1 (medium 6.8)
- [CVE-2023-4071](https://insights.sbomify.com/CVE-2023-4071/): Memory corruption in Chrome (high 8.8)
- [CVE-2023-40709](https://insights.sbomify.com/CVE-2023-40709/): Uncontrolled Resource Consumption in OPTO 22 SNAP PAC S1 Built-In Web Server (medium 6.8)
- [CVE-2023-40708](https://insights.sbomify.com/CVE-2023-40708/): Improper Access Control in OPTO 22 SNAP PAC S1 (medium 5.8)
- [CVE-2023-40707](https://insights.sbomify.com/CVE-2023-40707/): Weak password requirements in OPTO 22 SNAP PAC S1 Built-in Web Server (high 8.6)
- [CVE-2023-40706](https://insights.sbomify.com/CVE-2023-40706/): Improper Restriction of Excessive Authentication Attempts in OPTO 22 SNAP PAC S1 Built-in Web Server (high 8.6)
- [CVE-2023-40705](https://insights.sbomify.com/CVE-2023-40705/): Cross-site scripting in VI Web Client (medium 5.4)
- [CVE-2023-40704](https://insights.sbomify.com/CVE-2023-40704/): Philips Vue PACS Use of Default Credentials (medium 5.7)
- [CVE-2023-40703](https://insights.sbomify.com/CVE-2023-40703/): Denial of Service via specially crafted block fields in Mattermost Boards (medium 4.3)
- [CVE-2023-40702](https://insights.sbomify.com/CVE-2023-40702/): PingOne MFA Integration Kit MFA bypass (high 7.7)
- [CVE-2023-4070](https://insights.sbomify.com/CVE-2023-4070/): Memory corruption in Chrome (high 8.1)
- [CVE-2023-40699](https://insights.sbomify.com/CVE-2023-40699/): IBM InfoSphere Information Server denial of service (high 7.5)
- [CVE-2023-40696](https://insights.sbomify.com/CVE-2023-40696/): IBM Cognos Controller information disclosure (medium 5.9)
- [CVE-2023-40695](https://insights.sbomify.com/CVE-2023-40695/): IBM Cognos Controller session fixation (medium 6.3)
- [CVE-2023-40694](https://insights.sbomify.com/CVE-2023-40694/): IBM Watson CP4D Data Stores information disclosure (medium 6.2)
- [CVE-2023-40693](https://insights.sbomify.com/CVE-2023-40693/): IBM Sterling B2B Integrator and IBM Sterling File Gateway Cross-Site Scripting (medium 5.4)
- [CVE-2023-40692](https://insights.sbomify.com/CVE-2023-40692/): IBM Db2 denial of service (medium 5.9)
- [CVE-2023-40691](https://insights.sbomify.com/CVE-2023-40691/): IBM Cloud Pak for Business Automation information disclosure (medium 4.9)
- [CVE-2023-4069](https://insights.sbomify.com/CVE-2023-4069/): Memory corruption in Chrome (high 8.8)
- [CVE-2023-40687](https://insights.sbomify.com/CVE-2023-40687/): IBM Db2 denial of service (medium 5.3)
- [CVE-2023-40686](https://insights.sbomify.com/CVE-2023-40686/): IBM i privilege escalation (medium 4.9)
- [CVE-2023-40685](https://insights.sbomify.com/CVE-2023-40685/): IBM i privilege escalation (high 7.4)
- [CVE-2023-40684](https://insights.sbomify.com/CVE-2023-40684/): IBM Content Navigator cross-site scripting (medium 4.6)
- [CVE-2023-40683](https://insights.sbomify.com/CVE-2023-40683/): IBM OpenPages with Watson privilege escalation (high 8.8)
- [CVE-2023-40682](https://insights.sbomify.com/CVE-2023-40682/): IBM App Connect Enterprise information disclosure (medium 4.4)
- [CVE-2023-40681](https://insights.sbomify.com/CVE-2023-40681/): WordPress Groundhogg Plugin <= 2.7.11.10 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-40680](https://insights.sbomify.com/CVE-2023-40680/): WordPress Yoast SEO Plugin <= 21.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-4068](https://insights.sbomify.com/CVE-2023-4068/): Memory corruption in Chrome (high 8.1)
- [CVE-2023-40679](https://insights.sbomify.com/CVE-2023-40679/): WordPress Master Elementor Addons plugin <= 2.0.5.3 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-40678](https://insights.sbomify.com/CVE-2023-40678/): WordPress Simple URLs plugin <= 117 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-40677](https://insights.sbomify.com/CVE-2023-40677/): WordPress Vertical Marquee Plugin Plugin <= 7.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-40676](https://insights.sbomify.com/CVE-2023-40676/): WordPress Slimstat Analytics Plugin <= 5.0.8 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-40675](https://insights.sbomify.com/CVE-2023-40675/): WordPress Landing Page Builder Plugin <= 1.5.1.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-40674](https://insights.sbomify.com/CVE-2023-40674/): WordPress Simple URLs Plugin <= 118 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-40673](https://insights.sbomify.com/CVE-2023-40673/): WordPress Cartpauj Register Captcha plugin <= 1.0.02 - Captcha Bypass vulnerability (medium 6.5)
- [CVE-2023-40672](https://insights.sbomify.com/CVE-2023-40672/): WordPress Sticky Social Media Icons plugin <= 2.1 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-40671](https://insights.sbomify.com/CVE-2023-40671/): WordPress DX-auto-save-images Plugin <= 1.4.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-40670](https://insights.sbomify.com/CVE-2023-40670/): WordPress ReviewX plugin <= 1.6.17 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-4067](https://insights.sbomify.com/CVE-2023-4067/): Bus Ticket Booking with Seat Reservation <= 5.2.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-40669](https://insights.sbomify.com/CVE-2023-40669/): WordPress Collapse-O-Matic Plugin <= 1.8.5.5 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-40668](https://insights.sbomify.com/CVE-2023-40668/): WordPress Save as PDF plugin by Pdfcrowd Plugin <= 2.16.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-40667](https://insights.sbomify.com/CVE-2023-40667/): WordPress Simple URLs Plugin <= 117 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-40665](https://insights.sbomify.com/CVE-2023-40665/): WordPress Save as Image plugin by Pdfcrowd Plugin <= 2.16.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-40664](https://insights.sbomify.com/CVE-2023-40664/): WordPress Donations Made Easy – Smart Donations Plugin <= 4.0.12 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-40663](https://insights.sbomify.com/CVE-2023-40663/): WordPress WP VR Plugin <= 8.3.4 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-40662](https://insights.sbomify.com/CVE-2023-40662/): WordPress Cookies and Content Security Policy Plugin <= 2.15 is vulnerable to Sensitive Data Exposure (medium 5.3)
- [CVE-2023-40661](https://insights.sbomify.com/CVE-2023-40661/): Opensc: multiple memory issues with pkcs15-init (enrollment tool) (medium 5.4)
- [CVE-2023-40660](https://insights.sbomify.com/CVE-2023-40660/): Opensc: potential pin bypass when card tracks its own login state (medium 6.6)
- [CVE-2023-4066](https://insights.sbomify.com/CVE-2023-4066/): Operator: passwords defined in secrets shown in statefulset yaml (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/244/