# Vulnerabilities published in 2023


- [CVE-2023-4035](https://insights.sbomify.com/CVE-2023-4035/): Simple Blog Card < 1.31 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2023-40349](https://insights.sbomify.com/CVE-2023-40349/): Jenkins Gogs Plugin vulnerable to unsafe default behavior and information disclosure (medium 5.3)
- [CVE-2023-40348](https://insights.sbomify.com/CVE-2023-40348/): Jenkins Gogs Plugin vulnerable to unsafe default behavior and information disclosure (medium 5.3)
- [CVE-2023-40347](https://insights.sbomify.com/CVE-2023-40347/): Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin vulnerable to exposure of system-scoped credentials (medium 6.5)
- [CVE-2023-40346](https://insights.sbomify.com/CVE-2023-40346/): Jenkins Shortcut Job Plugin stored cross-site scripting vulnerability (medium 5.4)
- [CVE-2023-40345](https://insights.sbomify.com/CVE-2023-40345/): Jenkins Delphix Plugin vulnerable to exposure of system-scoped credentials (medium 6.5)
- [CVE-2023-40344](https://insights.sbomify.com/CVE-2023-40344/): Jenkins Delphix Plugin missing permission check (medium 4.3)
- [CVE-2023-40343](https://insights.sbomify.com/CVE-2023-40343/): Jenkins Tuleap Authentication Plugin non-constant time token comparison (medium 5.9)
- [CVE-2023-40342](https://insights.sbomify.com/CVE-2023-40342/): Jenkins Flaky Test Handler Plugin stored cross-site scripting vulnerability (medium 5.4)
- [CVE-2023-40341](https://insights.sbomify.com/CVE-2023-40341/): Jenkins Blue Ocean Plugin cross-site request forgery vulnerability (high 8.8)
- [CVE-2023-40340](https://insights.sbomify.com/CVE-2023-40340/): Jenkins NodeJS Plugin improper credential masking vulnerability (high 7.5)
- [CVE-2023-4034](https://insights.sbomify.com/CVE-2023-4034/): SQLi in Smartrise Document Management System (critical 9.8)
- [CVE-2023-40339](https://insights.sbomify.com/CVE-2023-40339/): Jenkins Config File Provider Plugin improper credential masking vulnerability (high 7.5)
- [CVE-2023-40338](https://insights.sbomify.com/CVE-2023-40338/): Jenkins Folders Plugin information disclosure vulnerability (medium 4.3)
- [CVE-2023-40337](https://insights.sbomify.com/CVE-2023-40337/): Jenkins Folders Plugin cross-site request forgery vulnerability (medium 4.3)
- [CVE-2023-40336](https://insights.sbomify.com/CVE-2023-40336/): Jenkins Folders Plugin cross-site request forgery vulnerability (high 8.8)
- [CVE-2023-40335](https://insights.sbomify.com/CVE-2023-40335/): WordPress Cleverwise Daily Quotes Plugin <= 3.2 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-40334](https://insights.sbomify.com/CVE-2023-40334/): WordPress HUSKY plugin <= 1.3.4.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-40333](https://insights.sbomify.com/CVE-2023-40333/): WordPress Bridge Core Plugin <= 3.0.9 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-40332](https://insights.sbomify.com/CVE-2023-40332/): WordPress WP-PostRatings plugin <= 1.91 - Rating limit Bypass vulnerability (medium 5.3)
- [CVE-2023-40331](https://insights.sbomify.com/CVE-2023-40331/): WordPress Accordion Slider plugin <= 1.9.6 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-40330](https://insights.sbomify.com/CVE-2023-40330/): WordPress GD Security Headers Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-4033](https://insights.sbomify.com/CVE-2023-4033/): OS Command Injection in mlflow/mlflow (high 8.8)
- [CVE-2023-40329](https://insights.sbomify.com/CVE-2023-40329/): WordPress Custom Admin Login Page | WPZest Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-40328](https://insights.sbomify.com/CVE-2023-40328/): WordPress Carrot Plugin <= 1.1.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-40327](https://insights.sbomify.com/CVE-2023-40327/): WordPress Putler Connector for WooCommerce plugin <= 2.12.0 - Unauthenticated Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-40315](https://insights.sbomify.com/CVE-2023-40315/): ROLE_FILESYSTEM_EDITOR Can Be Used To Escalate To ROLE_ADMIN (medium 5.3)
- [CVE-2023-40314](https://insights.sbomify.com/CVE-2023-40314/): Cross-site scripting in bootstrap.jsp (medium 5.8)
- [CVE-2023-40313](https://insights.sbomify.com/CVE-2023-40313/): Disable BeanShell Interpreter Remote Server Mode (high 7.1)
- [CVE-2023-40312](https://insights.sbomify.com/CVE-2023-40312/): Reflected XSS in multiple JSP files in opennms/opennms (medium 6.7)
- [CVE-2023-40311](https://insights.sbomify.com/CVE-2023-40311/): Stored XSS in multiple JSP files in opennms/opennms (medium 6.7)
- [CVE-2023-40310](https://insights.sbomify.com/CVE-2023-40310/): Missing XML Validation vulnerability in SAP PowerDesigner Client BPMN2 import (medium 6.5)
- [CVE-2023-40309](https://insights.sbomify.com/CVE-2023-40309/): Missing Authorization check in SAP CommonCryptoLib (critical 9.8)
- [CVE-2023-40308](https://insights.sbomify.com/CVE-2023-40308/): Memory Corruption vulnerability in SAP CommonCryptoLib (high 7.5)
- [CVE-2023-40307](https://insights.sbomify.com/CVE-2023-40307/): Privileges Memory Corruption (Out-of-bound write) (medium 6.3)
- [CVE-2023-40306](https://insights.sbomify.com/CVE-2023-40306/): URL Redirection vulnerability in SAP S/4HANA (Manage Catalog Items and Cross-Catalog search) (medium 6.1)
- [CVE-2023-40305](https://insights.sbomify.com/CVE-2023-40305/): Memory corruption in gnu:indent (medium 5.5)
- [CVE-2023-40303](https://insights.sbomify.com/CVE-2023-40303/): Privilege escalation in gnu:inetutils (high 7.8)
- [CVE-2023-40302](https://insights.sbomify.com/CVE-2023-40302/): Misconfiguration in netscout:ngeniuspulse (critical 9.1)
- [CVE-2023-40301](https://insights.sbomify.com/CVE-2023-40301/): Command injection in netscout:ngeniuspulse (critical 9.8)
- [CVE-2023-40300](https://insights.sbomify.com/CVE-2023-40300/): Hardcoded credentials in netscout:ngeniuspulse (critical 9.8)
- [CVE-2023-4030](https://insights.sbomify.com/CVE-2023-4030/): Security feature bypass in ThinkPad (high 8.4)
- [CVE-2023-40299](https://insights.sbomify.com/CVE-2023-40299/): Code injection in konghq:insomnia (high 7.8)
- [CVE-2023-40297](https://insights.sbomify.com/CVE-2023-40297/): Stakater Forecastle has a directory traversal vulnerability (high 7.5)
- [CVE-2023-40296](https://insights.sbomify.com/CVE-2023-40296/): Memory corruption in eminfedar:async-sockets-cpp (high 7.5)
- [CVE-2023-40295](https://insights.sbomify.com/CVE-2023-40295/): Memory corruption in 0branch:boron (high 8.8)
- [CVE-2023-40294](https://insights.sbomify.com/CVE-2023-40294/): Memory corruption in 0branch:boron (medium 6.5)
- [CVE-2023-40293](https://insights.sbomify.com/CVE-2023-40293/): Command injection in samsung:harman infotainment (medium 6.8)
- [CVE-2023-40292](https://insights.sbomify.com/CVE-2023-40292/): Information disclosure in samsung:harman infotainment (medium 4.3)
- [CVE-2023-40291](https://insights.sbomify.com/CVE-2023-40291/): Hardcoded credentials in samsung:harman infotainment (medium 6.8)
- [CVE-2023-40290](https://insights.sbomify.com/CVE-2023-40290/): Cross-site scripting in supermicro:x11sae-f firmware (high 8.3)
- [CVE-2023-4029](https://insights.sbomify.com/CVE-2023-4029/): Memory corruption in ThinkPad (medium 6.7)
- [CVE-2023-40289](https://insights.sbomify.com/CVE-2023-40289/): Command injection in supermicro:x11sae-f firmware (high 7.2)
- [CVE-2023-40288](https://insights.sbomify.com/CVE-2023-40288/): Cross-site scripting in supermicro:x11sae-f firmware (high 8.3)
- [CVE-2023-40287](https://insights.sbomify.com/CVE-2023-40287/): Cross-site scripting in supermicro:x11sae-f firmware (high 8.3)
- [CVE-2023-40286](https://insights.sbomify.com/CVE-2023-40286/): Cross-site scripting in supermicro:x11sae-f firmware (high 8.3)
- [CVE-2023-40285](https://insights.sbomify.com/CVE-2023-40285/): Cross-site scripting in supermicro:x11sae-f firmware (medium 6.5)
- [CVE-2023-40284](https://insights.sbomify.com/CVE-2023-40284/): Cross-site scripting in supermicro:x11sae-f firmware (high 8.3)
- [CVE-2023-40283](https://insights.sbomify.com/CVE-2023-40283/): Use after free in canonical:ubuntu linux (high 7.8)
- [CVE-2023-40282](https://insights.sbomify.com/CVE-2023-40282/): Auth bypass in Rakuten WiFi Pocket (medium 5.4)
- [CVE-2023-40281](https://insights.sbomify.com/CVE-2023-40281/): Cross-site scripting in EC-CUBE 2 series (medium 4.8)
- [CVE-2023-40280](https://insights.sbomify.com/CVE-2023-40280/): Path traversal in openclinic ga project:openclinic ga (high 7.5)
- [CVE-2023-4028](https://insights.sbomify.com/CVE-2023-4028/): Memory corruption in Lenovo Notebook (medium 6.7)
- [CVE-2023-40279](https://insights.sbomify.com/CVE-2023-40279/): Path traversal in openclinic ga project:openclinic ga (high 7.5)
- [CVE-2023-40278](https://insights.sbomify.com/CVE-2023-40278/): Information disclosure in openclinic ga project:openclinic ga (high 7.5)
- [CVE-2023-40277](https://insights.sbomify.com/CVE-2023-40277/): Cross-site scripting in openclinic ga project:openclinic ga (medium 6.1)
- [CVE-2023-40276](https://insights.sbomify.com/CVE-2023-40276/): Missing authorization in openclinic ga project:openclinic ga (critical 9.1)
- [CVE-2023-40275](https://insights.sbomify.com/CVE-2023-40275/): Information disclosure in openclinic ga project:openclinic ga (critical 9.1)
- [CVE-2023-40274](https://insights.sbomify.com/CVE-2023-40274/): zola Path Traversal vulnerability (high 7.5)
- [CVE-2023-40273](https://insights.sbomify.com/CVE-2023-40273/): Session fixation in Apache Airflow web interface (high 8.0)
- [CVE-2023-40272](https://insights.sbomify.com/CVE-2023-40272/): Apache Airflow Spark Provider Arbitrary File Read via JDBC (high 7.5)
- [CVE-2023-40271](https://insights.sbomify.com/CVE-2023-40271/): Weak cryptography in trustedfirmware:trusted firmware-m (high 7.5)
- [CVE-2023-4027](https://insights.sbomify.com/CVE-2023-4027/): Radio Player <= 2.0.73 - Missing Authorization to Settings Update (medium 5.3)
- [CVE-2023-40267](https://insights.sbomify.com/CVE-2023-40267/): GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments (critical 9.8)
- [CVE-2023-40266](https://insights.sbomify.com/CVE-2023-40266/): Path traversal in mitel:unify openscape xpressions webassistant (critical 9.8)
- [CVE-2023-40265](https://insights.sbomify.com/CVE-2023-40265/): File upload in mitel:unify openscape xpressions webassistant (high 8.8)
- [CVE-2023-40264](https://insights.sbomify.com/CVE-2023-40264/): Path traversal in unify:openscape voice trace manager (medium 4.3)
- [CVE-2023-40263](https://insights.sbomify.com/CVE-2023-40263/): Command injection in unify:openscape voice trace manager (high 8.8)
- [CVE-2023-40262](https://insights.sbomify.com/CVE-2023-40262/): Cross-site scripting in unify:openscape voice trace manager (medium 6.1)
- [CVE-2023-40261](https://insights.sbomify.com/CVE-2023-40261/): Security feature bypass in dieboldnixdorf:vynamic security suite (medium 4.6)
- [CVE-2023-40260](https://insights.sbomify.com/CVE-2023-40260/): Auth bypass in empowerid:empowerid (critical 9.1)
- [CVE-2023-40256](https://insights.sbomify.com/CVE-2023-40256/): Security feature bypass in veritas:netbackup snapshot manager (critical 9.8)
- [CVE-2023-40254](https://insights.sbomify.com/CVE-2023-40254/): Supply chain in Genian NAC Suite V5.0 (high 7.5)
- [CVE-2023-40253](https://insights.sbomify.com/CVE-2023-40253/): Auth bypass in Genian NAC Suite V5.0 (medium 6.0)
- [CVE-2023-40252](https://insights.sbomify.com/CVE-2023-40252/): Code injection in Genian NAC Suite V5.0 (medium 6.0)
- [CVE-2023-40251](https://insights.sbomify.com/CVE-2023-40251/): Weak cryptography in Genian NAC Suite V5.0 (medium 5.2)
- [CVE-2023-40250](https://insights.sbomify.com/CVE-2023-40250/): Memory corruption in HCell (high 8.8)
- [CVE-2023-4025](https://insights.sbomify.com/CVE-2023-4025/): Radio Player <= 2.0.73 - Missing Authorization to Player Update (medium 5.3)
- [CVE-2023-4024](https://insights.sbomify.com/CVE-2023-4024/): Radio Player <= 2.0.73 - Missing Authorization to Player Deletion (medium 5.3)
- [CVE-2023-40239](https://insights.sbomify.com/CVE-2023-40239/): XML external entity in lexmark:c2132 firmware (high 7.5)
- [CVE-2023-40238](https://insights.sbomify.com/CVE-2023-40238/): Integer overflow in fujitsu:celsius c780 firmware (medium 5.5)
- [CVE-2023-40236](https://insights.sbomify.com/CVE-2023-40236/): Hardcoded credentials in pexip:virtual meeting rooms (medium 5.3)
- [CVE-2023-40235](https://insights.sbomify.com/CVE-2023-40235/): Information disclosure in opengroup:archi (medium 6.5)
- [CVE-2023-4023](https://insights.sbomify.com/CVE-2023-4023/): All Users Messenger <= 1.24 - Subscriber+ Message Deletion via IDOR (medium 4.3)
- [CVE-2023-40225](https://insights.sbomify.com/CVE-2023-40225/): Other in haproxy:haproxy (high 7.2)
- [CVE-2023-40224](https://insights.sbomify.com/CVE-2023-40224/): Cross-site scripting in misp-project:misp (medium 6.1)
- [CVE-2023-40222](https://insights.sbomify.com/CVE-2023-40222/): Ashlar-Vellum Cobalt, Xenon, Argon, Lithium Heap-based Buffer Overflow (high 8.4)
- [CVE-2023-40221](https://insights.sbomify.com/CVE-2023-40221/): Socomec MOD3GP-SY-120K Code Injection (high 8.8)
- [CVE-2023-40220](https://insights.sbomify.com/CVE-2023-40220/): Memory corruption in Intel(R) NUC BIOS firmware (medium 5.3)
- [CVE-2023-4022](https://insights.sbomify.com/CVE-2023-4022/): Herd Effects < 5.2.3 - Admin+ Stored XSS (medium 4.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/248/