# Vulnerabilities published in 2023


- [CVE-2023-40219](https://insights.sbomify.com/CVE-2023-40219/): File upload in Welcart e-Commerce (high 7.2)
- [CVE-2023-40218](https://insights.sbomify.com/CVE-2023-40218/): Integer overflow in samsung:exynos 1280 firmware (low 2.0)
- [CVE-2023-40217](https://insights.sbomify.com/CVE-2023-40217/): Security feature bypass in python:python (medium 5.3)
- [CVE-2023-40216](https://insights.sbomify.com/CVE-2023-40216/): Memory corruption in openbsd:openbsd (medium 5.5)
- [CVE-2023-40215](https://insights.sbomify.com/CVE-2023-40215/): WordPress Demon image annotation Plugin <= 5.1 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-40214](https://insights.sbomify.com/CVE-2023-40214/): WordPress Business Pro Theme <= 1.10.4 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-40213](https://insights.sbomify.com/CVE-2023-40213/): WordPress Justified Gallery plugin <= 1.7.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-40212](https://insights.sbomify.com/CVE-2023-40212/): WordPress WooCommerce Product Attachment Plugin <= 2.1.8 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-40211](https://insights.sbomify.com/CVE-2023-40211/): WordPress Post Grid Plugin <= 2.2.50 is vulnerable to Sensitive Data Exposure (high 7.5)
- [CVE-2023-40210](https://insights.sbomify.com/CVE-2023-40210/): WordPress SB Child List Plugin <= 4.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-4021](https://insights.sbomify.com/CVE-2023-4021/): Modern Events Calendar lite < 7.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2023-40209](https://insights.sbomify.com/CVE-2023-40209/): WordPress Highcompress Image Compressor plugin <= 6.0.0 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-40208](https://insights.sbomify.com/CVE-2023-40208/): WordPress Stock Ticker Plugin <= 3.23.3 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-40207](https://insights.sbomify.com/CVE-2023-40207/): WordPress Donations Made Easy – Smart Donations Plugin <= 4.0.12 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-40206](https://insights.sbomify.com/CVE-2023-40206/): WordPress WP 404 Auto Redirect to Similar Post Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-40205](https://insights.sbomify.com/CVE-2023-40205/): WordPress PixTypes Plugin <= 1.4.15 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-40204](https://insights.sbomify.com/CVE-2023-40204/): WordPress Folders Plugin <= 2.9.2 is vulnerable to Arbitrary File Upload (critical 9.1)
- [CVE-2023-40203](https://insights.sbomify.com/CVE-2023-40203/): WordPress MailChimp Forms by MailMunch plugin <= 3.1.4 - Broken Access Control (medium 4.3)
- [CVE-2023-40202](https://insights.sbomify.com/CVE-2023-40202/): WordPress WP HTML Mail Plugin <= 3.4.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-40201](https://insights.sbomify.com/CVE-2023-40201/): WordPress Futurio Extra Plugin <= 1.8.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 6.5)
- [CVE-2023-40200](https://insights.sbomify.com/CVE-2023-40200/): WordPress WP Logo Showcase Responsive Slider and Carousel plugin <= 3.6 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-4020](https://insights.sbomify.com/CVE-2023-4020/): Unvalidated input in Silicon Labs PSA Attestation service leads to secure memory access from non-secure memory (critical 9.0)
- [CVE-2023-40199](https://insights.sbomify.com/CVE-2023-40199/): WordPress WP Like Button Plugin <= 1.7.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-40198](https://insights.sbomify.com/CVE-2023-40198/): WordPress Easy Cookie Law Plugin <= 3.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-40197](https://insights.sbomify.com/CVE-2023-40197/): WordPress flowpaper Plugin <= 1.9.9 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-40196](https://insights.sbomify.com/CVE-2023-40196/): WordPress ImageRecycle pdf & image compression Plugin <= 3.1.11 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-40195](https://insights.sbomify.com/CVE-2023-40195/): Apache Airflow Spark Provider Deserialization Vulnerability RCE (high 8.8)
- [CVE-2023-40194](https://insights.sbomify.com/CVE-2023-40194/): Path traversal in Foxit Reader (high 8.8)
- [CVE-2023-40193](https://insights.sbomify.com/CVE-2023-40193/): Command injection in Deco M4 (high 8.0)
- [CVE-2023-40191](https://insights.sbomify.com/CVE-2023-40191/): Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting (critical 9.0)
- [CVE-2023-4019](https://insights.sbomify.com/CVE-2023-4019/): Media from FTP < 11.17 - Author+ Arbitrary File Access (high 8.8)
- [CVE-2023-40188](https://insights.sbomify.com/CVE-2023-40188/): Out-Of-Bounds Read in FreeRDP (medium 5.3)
- [CVE-2023-40187](https://insights.sbomify.com/CVE-2023-40187/): Use-After-Free in FreeRDP (high 7.3)
- [CVE-2023-40186](https://insights.sbomify.com/CVE-2023-40186/): IntegerOverflow leading to Out-Of-Bound Write Vulnerability in FreeRDP (medium 6.5)
- [CVE-2023-40185](https://insights.sbomify.com/CVE-2023-40185/): Shescape on Windows escaping may be bypassed in threaded context (medium 6.5)
- [CVE-2023-40184](https://insights.sbomify.com/CVE-2023-40184/): Improper handling of session establishment errors in xrdp (low 2.6)
- [CVE-2023-40183](https://insights.sbomify.com/CVE-2023-40183/): DataEase has a vulnerability to obtain user cookies (high 7.5)
- [CVE-2023-40182](https://insights.sbomify.com/CVE-2023-40182/): Information disclosure in silverwaregames-io-issue-tracker (low 3.7)
- [CVE-2023-40181](https://insights.sbomify.com/CVE-2023-40181/): Integer-Underflow leading to Out-Of-Bound Read in FreeRDP (medium 5.3)
- [CVE-2023-40180](https://insights.sbomify.com/CVE-2023-40180/): Denial of service vulnerability in silverstripe-graphql via recursive queries (high 7.5)
- [CVE-2023-4018](https://insights.sbomify.com/CVE-2023-4018/): Direct Request ('Forced Browsing') in GitLab (medium 4.3)
- [CVE-2023-40179](https://insights.sbomify.com/CVE-2023-40179/): Silverware Games vulnerable to account enumeration via inconsistent responses (medium 5.3)
- [CVE-2023-40178](https://insights.sbomify.com/CVE-2023-40178/): @node-saml/node-saml's validatePostRequestAsync does not include checkTimestampsValidityError (medium 5.3)
- [CVE-2023-40177](https://insights.sbomify.com/CVE-2023-40177/): XWiki Platform privilege escalation (PR) from account through AWM content fields (critical 9.9)
- [CVE-2023-40176](https://insights.sbomify.com/CVE-2023-40176/): SXSS in the user profile via the timezone displayer (critical 9.1)
- [CVE-2023-40175](https://insights.sbomify.com/CVE-2023-40175/): Inconsistent Interpretation of HTTP Requests in puma (high 7.3)
- [CVE-2023-40174](https://insights.sbomify.com/CVE-2023-40174/): Insufficient Session Expiration in fobybus/social-media-skeleton (medium 6.8)
- [CVE-2023-40173](https://insights.sbomify.com/CVE-2023-40173/): Unsalted passwords in fobybus/social-media-skeleton (high 7.5)
- [CVE-2023-40172](https://insights.sbomify.com/CVE-2023-40172/): Cross-Site Request Forgery (CSRF) in fobybus/social-media-skeleton (medium 6.5)
- [CVE-2023-40171](https://insights.sbomify.com/CVE-2023-40171/): Dispatch writes JWT tokens in error message (critical 9.1)
- [CVE-2023-40170](https://insights.sbomify.com/CVE-2023-40170/): cross-site inclusion (XSSI) of files in jupyter-server (medium 4.6)
- [CVE-2023-4017](https://insights.sbomify.com/CVE-2023-4017/): Goya <= 1.0.8.7 - Unauthenticated Reflected Cross-Site Scripting via Multiple Parameters (medium 6.1)
- [CVE-2023-40168](https://insights.sbomify.com/CVE-2023-40168/): Malicious projects can read and upload arbitrary files from disk in TurboWarp Desktop (high 7.4)
- [CVE-2023-40167](https://insights.sbomify.com/CVE-2023-40167/): Jetty accepts "+" prefixed value in Content-Length (medium 5.3)
- [CVE-2023-40166](https://insights.sbomify.com/CVE-2023-40166/): Notepad++ heap buffer read overflow in FileManager::detectLanguageFromTextBegining (medium 5.5)
- [CVE-2023-40165](https://insights.sbomify.com/CVE-2023-40165/): Unauthorized gem replacement for full names ending in numbers on rubygems.org (high 7.4)
- [CVE-2023-40164](https://insights.sbomify.com/CVE-2023-40164/): Notepad++ global buffer read overflow in nsCodingStateMachine::NextState (medium 5.5)
- [CVE-2023-40163](https://insights.sbomify.com/CVE-2023-40163/): Memory corruption in ImageGear (critical 9.8)
- [CVE-2023-40161](https://insights.sbomify.com/CVE-2023-40161/): Privilege escalation in Intel Unite(R) Client software (medium 6.6)
- [CVE-2023-40160](https://insights.sbomify.com/CVE-2023-40160/): Path traversal in pmmls.exe (low 3.7)
- [CVE-2023-4016](https://insights.sbomify.com/CVE-2023-4016/): Memory corruption in Linux Kernal (low 2.5)
- [CVE-2023-40158](https://insights.sbomify.com/CVE-2023-40158/): Command injection in DR-16F, DR-8F, DR-4F, DR-16H, DR-8H, DR-4H, DR-4M41 series (high 8.8)
- [CVE-2023-40156](https://insights.sbomify.com/CVE-2023-40156/): Privilege escalation in Intel(R) SSU software (medium 6.7)
- [CVE-2023-40155](https://insights.sbomify.com/CVE-2023-40155/): Privilege escalation in Intel(R) CST software (medium 6.7)
- [CVE-2023-40154](https://insights.sbomify.com/CVE-2023-40154/): Misconfiguration in Intel(R) SUR for Gameplay Software (medium 6.7)
- [CVE-2023-40153](https://insights.sbomify.com/CVE-2023-40153/): Cross-site Scripting in DEXMA DEXGate (medium 5.4)
- [CVE-2023-40152](https://insights.sbomify.com/CVE-2023-40152/): Fuji Electric Tellus Lite V-Simulator Out-of-bounds Write (high 7.8)
- [CVE-2023-40151](https://insights.sbomify.com/CVE-2023-40151/): Red Lion Controls Sixnet RTU Exposed Dangerous Method Or Function (critical 10.0)
- [CVE-2023-40150](https://insights.sbomify.com/CVE-2023-40150/): Softneta MedDream PACS Exposed Dangerous Method or Function (critical 9.8)
- [CVE-2023-4015](https://insights.sbomify.com/CVE-2023-4015/): Use-after-free in Linux kernel's netfilter: nf_tables component (high 7.8)
- [CVE-2023-40148](https://insights.sbomify.com/CVE-2023-40148/): PingFederate Server Side Request Forgery vulnerability (medium 6.5)
- [CVE-2023-40146](https://insights.sbomify.com/CVE-2023-40146/): Command injection in Smart Reader (medium 6.8)
- [CVE-2023-40145](https://insights.sbomify.com/CVE-2023-40145/): Weintek cMT3000 HMI Web CGI OS Command Injection (high 8.8)
- [CVE-2023-40144](https://insights.sbomify.com/CVE-2023-40144/): Command injection in DR-16F, DR-8F, DR-4F, DR-16H, DR-8H, DR-4H, DR-4M41 series (high 8.8)
- [CVE-2023-40143](https://insights.sbomify.com/CVE-2023-40143/): Westermo Lynx (medium 5.4)
- [CVE-2023-40142](https://insights.sbomify.com/CVE-2023-40142/): Security feature bypass in Android (high 7.8)
- [CVE-2023-40141](https://insights.sbomify.com/CVE-2023-40141/): Memory corruption in Android (high 7.8)
- [CVE-2023-40140](https://insights.sbomify.com/CVE-2023-40140/): Use after free in Android (high 7.8)
- [CVE-2023-40139](https://insights.sbomify.com/CVE-2023-40139/): Information disclosure in Android (medium 5.5)
- [CVE-2023-40138](https://insights.sbomify.com/CVE-2023-40138/): Information disclosure in Android (low 3.3)
- [CVE-2023-40137](https://insights.sbomify.com/CVE-2023-40137/): Information disclosure in Android (low 3.3)
- [CVE-2023-40136](https://insights.sbomify.com/CVE-2023-40136/): Information disclosure in Android (low 3.3)
- [CVE-2023-40135](https://insights.sbomify.com/CVE-2023-40135/): Information disclosure in Android (low 3.3)
- [CVE-2023-40134](https://insights.sbomify.com/CVE-2023-40134/): Information disclosure in Android (low 3.3)
- [CVE-2023-40133](https://insights.sbomify.com/CVE-2023-40133/): Information disclosure in Android (medium 5.5)
- [CVE-2023-40132](https://insights.sbomify.com/CVE-2023-40132/): Missing authorization in Android (high 7.8)
- [CVE-2023-40131](https://insights.sbomify.com/CVE-2023-40131/): Use after free in Android (high 7.0)
- [CVE-2023-40130](https://insights.sbomify.com/CVE-2023-40130/): Privilege escalation in Android (high 7.8)
- [CVE-2023-4013](https://insights.sbomify.com/CVE-2023-4013/): GDPR Cookie Compliance < 4.12.5 - License Update/Deactivation via CSRF (medium 6.5)
- [CVE-2023-40129](https://insights.sbomify.com/CVE-2023-40129/): Memory corruption in Android (high 8.8)
- [CVE-2023-40128](https://insights.sbomify.com/CVE-2023-40128/): Memory corruption in Android (high 7.8)
- [CVE-2023-40127](https://insights.sbomify.com/CVE-2023-40127/): Information disclosure in Android (low 3.3)
- [CVE-2023-40125](https://insights.sbomify.com/CVE-2023-40125/): Privilege escalation in Android (high 7.8)
- [CVE-2023-40124](https://insights.sbomify.com/CVE-2023-40124/): Information disclosure in Android (medium 5.5)
- [CVE-2023-40123](https://insights.sbomify.com/CVE-2023-40123/): Security feature bypass in Android (medium 5.5)
- [CVE-2023-40122](https://insights.sbomify.com/CVE-2023-40122/): Information disclosure in Android (medium 5.3)
- [CVE-2023-40121](https://insights.sbomify.com/CVE-2023-40121/): Deserialization in Android (medium 5.5)
- [CVE-2023-40120](https://insights.sbomify.com/CVE-2023-40120/): Security feature bypass in Android (high 7.8)
- [CVE-2023-4012](https://insights.sbomify.com/CVE-2023-4012/): Incomplete Internal State Distinction in ntpsec (high 7.5)
- [CVE-2023-40117](https://insights.sbomify.com/CVE-2023-40117/): Security feature bypass in Android (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/249/