# Vulnerabilities published in 2023


- [CVE-2023-40659](https://insights.sbomify.com/CVE-2023-40659/): Extension - joomboost.com - Reflected XSS in Easy Quick Contact module for Joomla 1.0.0-1.3.0 (medium 6.1)
- [CVE-2023-40658](https://insights.sbomify.com/CVE-2023-40658/): Extension - deconf.net - Reflected XSS in Clicky Analytics Dashboard module for Joomla 1.0.0-1.3.1 (medium 6.1)
- [CVE-2023-40657](https://insights.sbomify.com/CVE-2023-40657/): Extension - artio.net - Reflected XSS in Joomdoc component for Joomla 1.0.0-4.0.5 (medium 6.1)
- [CVE-2023-40656](https://insights.sbomify.com/CVE-2023-40656/): Extension - plasma-web.ru - Reflected XSS in Quickform component for Joomla 1.0.0-3.3.01 (medium 6.1)
- [CVE-2023-40655](https://insights.sbomify.com/CVE-2023-40655/): Extension - mooj.org - Reflected XSS in Proforms Basic component for Joomla <= 1.6.0 (medium 6.1)
- [CVE-2023-40654](https://insights.sbomify.com/CVE-2023-40654/): Missing authorization in SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 (medium 6.7)
- [CVE-2023-40653](https://insights.sbomify.com/CVE-2023-40653/): Missing authorization in SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 (medium 6.7)
- [CVE-2023-40652](https://insights.sbomify.com/CVE-2023-40652/): Memory corruption in T606/T612/T616 (medium 4.4)
- [CVE-2023-40651](https://insights.sbomify.com/CVE-2023-40651/): Memory corruption in SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 (medium 4.4)
- [CVE-2023-40650](https://insights.sbomify.com/CVE-2023-40650/): Missing authorization in SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-4065](https://insights.sbomify.com/CVE-2023-4065/): Operator: plaintext password in operator log (medium 5.5)
- [CVE-2023-40649](https://insights.sbomify.com/CVE-2023-40649/): Missing authorization in SC9863A (medium 5.5)
- [CVE-2023-40648](https://insights.sbomify.com/CVE-2023-40648/): Missing authorization in SC9863A (medium 5.5)
- [CVE-2023-40647](https://insights.sbomify.com/CVE-2023-40647/): Missing authorization in SC9863A (medium 5.5)
- [CVE-2023-40646](https://insights.sbomify.com/CVE-2023-40646/): Missing authorization in SC9863A (medium 5.5)
- [CVE-2023-40645](https://insights.sbomify.com/CVE-2023-40645/): Missing authorization in SC9863A (medium 5.5)
- [CVE-2023-40644](https://insights.sbomify.com/CVE-2023-40644/): Missing authorization in SC9863A (medium 5.5)
- [CVE-2023-40643](https://insights.sbomify.com/CVE-2023-40643/): Missing authorization in SC9863A (medium 5.5)
- [CVE-2023-40642](https://insights.sbomify.com/CVE-2023-40642/): Missing authorization in SC9863A (medium 5.5)
- [CVE-2023-40641](https://insights.sbomify.com/CVE-2023-40641/): Missing authorization in SC9863A (medium 5.5)
- [CVE-2023-40640](https://insights.sbomify.com/CVE-2023-40640/): Missing authorization in SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-40639](https://insights.sbomify.com/CVE-2023-40639/): Missing authorization in SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-40638](https://insights.sbomify.com/CVE-2023-40638/): Missing authorization in T760/T770/T820/S8000 (medium 4.4)
- [CVE-2023-40637](https://insights.sbomify.com/CVE-2023-40637/): Missing authorization in SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-40636](https://insights.sbomify.com/CVE-2023-40636/): Missing authorization in T760/T770/T820/S8000 (medium 4.4)
- [CVE-2023-40635](https://insights.sbomify.com/CVE-2023-40635/): Missing authorization in SC9863A/T606/T612/T616/T610/T618/T760/T770/T820/S8000 (high 7.8)
- [CVE-2023-40634](https://insights.sbomify.com/CVE-2023-40634/): Missing authorization in SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 (high 7.8)
- [CVE-2023-40633](https://insights.sbomify.com/CVE-2023-40633/): Missing authorization in SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-40632](https://insights.sbomify.com/CVE-2023-40632/): Use after free in T606/T612/T616 (high 7.5)
- [CVE-2023-40631](https://insights.sbomify.com/CVE-2023-40631/): Missing authorization in SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 (medium 4.4)
- [CVE-2023-40630](https://insights.sbomify.com/CVE-2023-40630/): Extension - joomcode.com - Unauthenticated LFI/SSRF in JCDashboards component for Joomla 1.0.0-1.1.30 (critical 9.8)
- [CVE-2023-4063](https://insights.sbomify.com/CVE-2023-4063/): Denial of service in Certain HP OfficeJet Pro Printers (medium 5.3)
- [CVE-2023-40629](https://insights.sbomify.com/CVE-2023-40629/): Extension - king-products.net - SQLi vulnerability in LMS Lite component for Joomla 1.0.0-3.3.0.1 (critical 9.8)
- [CVE-2023-40628](https://insights.sbomify.com/CVE-2023-40628/): Extension - Extplorer.net - Reflected XSS in Extplorer component for Joomla 1.0.0-2.1.15 (medium 6.1)
- [CVE-2023-40627](https://insights.sbomify.com/CVE-2023-40627/): Extension - MLWebTechnologies - Reflected XSS in LivingWord component for Joomla 1.0.0-3.0.0 (medium 6.1)
- [CVE-2023-40626](https://insights.sbomify.com/CVE-2023-40626/): [20231101] - Core - Exposure of environment variables (high 7.5)
- [CVE-2023-40625](https://insights.sbomify.com/CVE-2023-40625/): Missing Authorization check in SAP Manage Purchase Contracts App (medium 5.4)
- [CVE-2023-40624](https://insights.sbomify.com/CVE-2023-40624/): Code Injection vulnerability in SAP NetWeaver AS ABAP (applications based on Unified Rendering) (medium 5.5)
- [CVE-2023-40623](https://insights.sbomify.com/CVE-2023-40623/): Arbitrary File Delete via Directory Junction in SAP BusinessObjects Suite(installer) (medium 6.2)
- [CVE-2023-40622](https://insights.sbomify.com/CVE-2023-40622/): Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management) (critical 9.9)
- [CVE-2023-40621](https://insights.sbomify.com/CVE-2023-40621/): Code Injection vulnerability in SAP PowerDesigner Client (medium 6.3)
- [CVE-2023-40619](https://insights.sbomify.com/CVE-2023-40619/): Deserialization in phppgadmin project:phppgadmin (critical 9.8)
- [CVE-2023-40618](https://insights.sbomify.com/CVE-2023-40618/): Cross-site scripting in openknowledgemaps:head start (medium 6.1)
- [CVE-2023-40617](https://insights.sbomify.com/CVE-2023-40617/): Cross-site scripting in openknowledgemaps:head start (medium 6.1)
- [CVE-2023-40612](https://insights.sbomify.com/CVE-2023-40612/): Authenticated XXE Injection Via The File Editor (medium 5.3)
- [CVE-2023-40611](https://insights.sbomify.com/CVE-2023-40611/): Apache Airflow Dag Runs Broken Access Control Vulnerability (medium 4.3)
- [CVE-2023-40610](https://insights.sbomify.com/CVE-2023-40610/): Apache Superset: Privilege escalation with default examples database (medium 6.3)
- [CVE-2023-4061](https://insights.sbomify.com/CVE-2023-4061/): Wildfly-core: management user rbac permission allows unexpected reading of system-properties to an unauthorized actor (medium 6.5)
- [CVE-2023-40609](https://insights.sbomify.com/CVE-2023-40609/): WordPress Contact form 7 Custom validation Plugin <= 1.1.3 is vulnerable to SQL Injection (high 8.2)
- [CVE-2023-40608](https://insights.sbomify.com/CVE-2023-40608/): WordPress Paid Memberships Pro CCBill Gateway plugin <= 0.3 - Unauthenticated Broken Access Control vulnerability (high 8.2)
- [CVE-2023-40607](https://insights.sbomify.com/CVE-2023-40607/): WordPress CLUEVO LMS, E-Learning Platform Plugin <= 1.10.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-40606](https://insights.sbomify.com/CVE-2023-40606/): WordPress Kanban Boards for WordPress Plugin <= 2.5.21 is vulnerable to Arbitrary Code Execution (critical 9.1)
- [CVE-2023-40605](https://insights.sbomify.com/CVE-2023-40605/): WordPress Typing Effect Plugin <= 1.3.6 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-40604](https://insights.sbomify.com/CVE-2023-40604/): WordPress Cookies by JM Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-40603](https://insights.sbomify.com/CVE-2023-40603/): WordPress Simple Org Chart plugin <= 2.3.4 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-40602](https://insights.sbomify.com/CVE-2023-40602/): WordPress Doofinder for WooCommerce Plugin <= 1.5.49 is vulnerable to Open Redirection (medium 4.7)
- [CVE-2023-40601](https://insights.sbomify.com/CVE-2023-40601/): WordPress Mortgage Calculator Estatik Plugin <= 2.0.7 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-40600](https://insights.sbomify.com/CVE-2023-40600/): WordPress EWWW Image Optimizer Plugin <= 7.2.0 is vulnerable to Sensitive Data Exposure (medium 5.3)
- [CVE-2023-4060](https://insights.sbomify.com/CVE-2023-4060/): WP Adminify < 3.1.6 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-40599](https://insights.sbomify.com/CVE-2023-40599/): Denial of service in Mailform Pro CGI (high 7.5)
- [CVE-2023-40598](https://insights.sbomify.com/CVE-2023-40598/): Command Injection in Splunk Enterprise Using External Lookups (high 8.5)
- [CVE-2023-40597](https://insights.sbomify.com/CVE-2023-40597/): Absolute Path Traversal in Splunk Enterprise Using runshellscript.py (high 7.8)
- [CVE-2023-40596](https://insights.sbomify.com/CVE-2023-40596/): Splunk Enterprise on Windows Privilege Escalation due to Insecure OPENSSLDIR Build Definition Reference in DLL (high 7.0)
- [CVE-2023-40595](https://insights.sbomify.com/CVE-2023-40595/): Remote Code Execution via Serialized Session Payload (high 8.8)
- [CVE-2023-40594](https://insights.sbomify.com/CVE-2023-40594/): Denial of Service (DoS) via the ‘printf’ Search Function (medium 6.5)
- [CVE-2023-40593](https://insights.sbomify.com/CVE-2023-40593/): Denial of Service (DoS) in Splunk Enterprise Using a Malformed SAML Request (medium 6.3)
- [CVE-2023-40592](https://insights.sbomify.com/CVE-2023-40592/): Reflected Cross-site Scripting (XSS) on "/app/search/table" web endpoint (high 8.4)
- [CVE-2023-40591](https://insights.sbomify.com/CVE-2023-40591/): Denial of service via malicious p2p message in go-ethereum (high 7.5)
- [CVE-2023-40590](https://insights.sbomify.com/CVE-2023-40590/): Untrusted search path on Windows systems leading to arbitrary code execution (high 7.8)
- [CVE-2023-4059](https://insights.sbomify.com/CVE-2023-4059/): Profile Builder < 3.9.8 - Unauthenticated Plugin's Pages Creation (medium 4.3)
- [CVE-2023-40589](https://insights.sbomify.com/CVE-2023-40589/): FreeRDP Global-Buffer-Overflow in ncrush_decompress (medium 4.3)
- [CVE-2023-40588](https://insights.sbomify.com/CVE-2023-40588/): Discourse DoS via 2FA and Security Key Names (medium 6.5)
- [CVE-2023-40587](https://insights.sbomify.com/CVE-2023-40587/): Pyramid static view path traversal up one directory (medium 4.3)
- [CVE-2023-40586](https://insights.sbomify.com/CVE-2023-40586/): go package github.com/corazawaf/coraza is vulnerable to denial of service (high 7.5)
- [CVE-2023-40585](https://insights.sbomify.com/CVE-2023-40585/): Unauthenticated access to Ironic API (high 7.3)
- [CVE-2023-40584](https://insights.sbomify.com/CVE-2023-40584/): Denial of Service to Argo CD repo-server (medium 6.5)
- [CVE-2023-40583](https://insights.sbomify.com/CVE-2023-40583/): libp2p nodes vulnerable to OOM attack (high 7.5)
- [CVE-2023-40582](https://insights.sbomify.com/CVE-2023-40582/): Command Injection Vulnerability in find-exec (critical 9.8)
- [CVE-2023-40581](https://insights.sbomify.com/CVE-2023-40581/): yt-dlp command injection when using `%q` in `--exec` on Windows (high 8.4)
- [CVE-2023-40580](https://insights.sbomify.com/CVE-2023-40580/): Freighter mnemonic phrase may be accessed by Javascript through a private API (high 8.1)
- [CVE-2023-4058](https://insights.sbomify.com/CVE-2023-4058/): Memory corruption in Firefox (critical 9.8)
- [CVE-2023-40579](https://insights.sbomify.com/CVE-2023-40579/): OpenFGA Authorization Bypass (medium 6.5)
- [CVE-2023-40577](https://insights.sbomify.com/CVE-2023-40577/): Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint (high 7.5)
- [CVE-2023-40576](https://insights.sbomify.com/CVE-2023-40576/): Out-Of-Bounds Read in FreeRDP (medium 5.3)
- [CVE-2023-40575](https://insights.sbomify.com/CVE-2023-40575/): Out-Of-Bounds Read in FreeRDP (medium 5.3)
- [CVE-2023-40574](https://insights.sbomify.com/CVE-2023-40574/): Out-Of-Bounds Write in FreeRDP (medium 6.5)
- [CVE-2023-40573](https://insights.sbomify.com/CVE-2023-40573/): XWiki Platform's Groovy jobs check the wrong author, allowing remote code execution (critical 9.1)
- [CVE-2023-40572](https://insights.sbomify.com/CVE-2023-40572/): XWiki Platform vulnerable to CSRF privilege escalation/RCE via the create action (critical 9.1)
- [CVE-2023-40571](https://insights.sbomify.com/CVE-2023-40571/): weblogic-framework Deserialization of Untrusted Data vulnerability (critical 9.8)
- [CVE-2023-40570](https://insights.sbomify.com/CVE-2023-40570/): Datasette 1.0 alpha series leaks names of databases and tables to unauthenticated users (medium 5.3)
- [CVE-2023-4057](https://insights.sbomify.com/CVE-2023-4057/): Memory corruption in Firefox (critical 9.8)
- [CVE-2023-40569](https://insights.sbomify.com/CVE-2023-40569/): Out-Of-Bounds Write in FreeRDP (medium 6.5)
- [CVE-2023-40567](https://insights.sbomify.com/CVE-2023-40567/): Out-Of-Bounds Write in FreeRDP (medium 6.5)
- [CVE-2023-40561](https://insights.sbomify.com/CVE-2023-40561/): Enhanced Ecommerce Google Analytics for WooCommerce (medium 5.4)
- [CVE-2023-40560](https://insights.sbomify.com/CVE-2023-40560/): WordPress Schedule Posts Calendar Plugin <= 5.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-4056](https://insights.sbomify.com/CVE-2023-4056/): Memory corruption in Firefox (critical 9.8)
- [CVE-2023-40559](https://insights.sbomify.com/CVE-2023-40559/): Cross-site request forgery in Dynamic Pricing and Discount Rules for WooCommerce (medium 4.3)
- [CVE-2023-40558](https://insights.sbomify.com/CVE-2023-40558/): WordPress Video Gallery & Management Plugin <= 3.3.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-40557](https://insights.sbomify.com/CVE-2023-40557/): WordPress Tabs & Accordion plugin <= 1.3.10 - Content Injection vulnerability (medium 5.4)
- [CVE-2023-40556](https://insights.sbomify.com/CVE-2023-40556/): WordPress Schedule Posts Calendar Plugin <= 5.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/245/