# Vulnerabilities published in 2023


- [CVE-2023-38543](https://insights.sbomify.com/CVE-2023-38543/): Denial of service in Secure Access Client Windows (high 8.8)
- [CVE-2023-38541](https://insights.sbomify.com/CVE-2023-38541/): Privilege escalation in Intel HID Event Filter drivers for Windows 10 for some Intel NUC laptop software installers (medium 6.7)
- [CVE-2023-3854](https://insights.sbomify.com/CVE-2023-3854/): phpscriptpoint BloodBank POST Parameter search sql injection (medium 6.3)
- [CVE-2023-38538](https://insights.sbomify.com/CVE-2023-38538/): Use after free in WhatsApp Business for Android (medium 5.0)
- [CVE-2023-38537](https://insights.sbomify.com/CVE-2023-38537/): Use after free in WhatsApp Business for Android (medium 5.6)
- [CVE-2023-38536](https://insights.sbomify.com/CVE-2023-38536/): Cross-site scripting in Exceed Turbo X (medium 6.4)
- [CVE-2023-38535](https://insights.sbomify.com/CVE-2023-38535/): Hardcoded credentials in Exceed Turbo X (medium 4.7)
- [CVE-2023-38534](https://insights.sbomify.com/CVE-2023-38534/): Auth bypass in Exceed Turbo X (high 8.6)
- [CVE-2023-38533](https://insights.sbomify.com/CVE-2023-38533/): Misconfiguration in TIA Administrator (medium 4.8)
- [CVE-2023-38532](https://insights.sbomify.com/CVE-2023-38532/): Denial of service in Parasolid V34.1 (medium 4.8)
- [CVE-2023-38531](https://insights.sbomify.com/CVE-2023-38531/): Memory corruption in Parasolid V34.1 (high 7.3)
- [CVE-2023-38530](https://insights.sbomify.com/CVE-2023-38530/): Memory corruption in Parasolid V34.1 (high 7.3)
- [CVE-2023-3853](https://insights.sbomify.com/CVE-2023-3853/): phpscriptpoint BloodBank page.php cross site scripting (low 3.5)
- [CVE-2023-38529](https://insights.sbomify.com/CVE-2023-38529/): Memory corruption in Parasolid V34.1 (high 7.3)
- [CVE-2023-38528](https://insights.sbomify.com/CVE-2023-38528/): Memory corruption in Parasolid V34.1 (high 7.3)
- [CVE-2023-38527](https://insights.sbomify.com/CVE-2023-38527/): Memory corruption in Parasolid V34.1 (high 7.3)
- [CVE-2023-38526](https://insights.sbomify.com/CVE-2023-38526/): Memory corruption in Parasolid V34.1 (high 7.3)
- [CVE-2023-38525](https://insights.sbomify.com/CVE-2023-38525/): Memory corruption in Parasolid V34.1 (high 7.3)
- [CVE-2023-38524](https://insights.sbomify.com/CVE-2023-38524/): Null dereference in Parasolid V34.1 (low 2.0)
- [CVE-2023-38523](https://insights.sbomify.com/CVE-2023-38523/): Information disclosure in samsung:fgn1115-wp-wh firmware (medium 5.3)
- [CVE-2023-38522](https://insights.sbomify.com/CVE-2023-38522/): Apache Traffic Server: Incomplete field name check allows request smuggling (high 7.5)
- [CVE-2023-38521](https://insights.sbomify.com/CVE-2023-38521/): WordPress Exifography Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-38520](https://insights.sbomify.com/CVE-2023-38520/): WordPress Pinpoint Booking System plugin <= 2.9.9.3.4 - Parameter Tampering (medium 6.5)
- [CVE-2023-3852](https://insights.sbomify.com/CVE-2023-3852/): OpenRapid RapidCMS upload.php unrestricted upload (medium 4.7)
- [CVE-2023-38519](https://insights.sbomify.com/CVE-2023-38519/): WordPress MainWP Plugin <= 4.4.3.3 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-38518](https://insights.sbomify.com/CVE-2023-38518/): WordPress Borderless Plugin <= 1.4.8 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-38517](https://insights.sbomify.com/CVE-2023-38517/): WordPress WRC Pricing Tables Plugin <= 2.3.7 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-38516](https://insights.sbomify.com/CVE-2023-38516/): WordPress Audio Player with Playlist Ultimate Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-38515](https://insights.sbomify.com/CVE-2023-38515/): WordPress Church Admin Plugin <= 3.7.56 is vulnerable to Server Side Request Forgery (SSRF) (medium 5.5)
- [CVE-2023-38514](https://insights.sbomify.com/CVE-2023-38514/): WordPress Social Share Icons & Social Share Buttons plugin <= 3.5.7 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-38513](https://insights.sbomify.com/CVE-2023-38513/): WordPress Photo Engine Plugin <= 6.2.5 is vulnerable to Insecure Direct Object References (IDOR) (medium 5.4)
- [CVE-2023-38512](https://insights.sbomify.com/CVE-2023-38512/): WordPress WpStream plugin <= 4.5.4 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2023-38511](https://insights.sbomify.com/CVE-2023-38511/): iTop Dashboard editor vulnerable dashboard config file parameter (medium 5.0)
- [CVE-2023-38510](https://insights.sbomify.com/CVE-2023-38510/): Tolgee Lacks Permission Check for API Key for some endpoints (high 8.1)
- [CVE-2023-38509](https://insights.sbomify.com/CVE-2023-38509/): XWiki Platform's obfuscated email addresses should not be sorted (medium 4.3)
- [CVE-2023-38508](https://insights.sbomify.com/CVE-2023-38508/): Tuleap allows preview of a linked artifact with a type does not respect permissions (medium 6.5)
- [CVE-2023-38507](https://insights.sbomify.com/CVE-2023-38507/): Strapi Improper Rate Limiting vulnerability (high 7.3)
- [CVE-2023-38506](https://insights.sbomify.com/CVE-2023-38506/): Cross-site Scripting (XSS) when pasting HTML into the rich text editor in Joplin (high 8.2)
- [CVE-2023-38505](https://insights.sbomify.com/CVE-2023-38505/): DietPi-Dashboard Insufficient TLS Handshake Pool (high 7.5)
- [CVE-2023-38504](https://insights.sbomify.com/CVE-2023-38504/): Sails DoS vulnerability for apps with sockets enabled (high 7.5)
- [CVE-2023-38503](https://insights.sbomify.com/CVE-2023-38503/): Directus has Incorrect Permission Checking for GraphQL Subscriptions (medium 5.7)
- [CVE-2023-38502](https://insights.sbomify.com/CVE-2023-38502/): TDengine Database Denial-of-Service (medium 6.5)
- [CVE-2023-38501](https://insights.sbomify.com/CVE-2023-38501/): copyparty vulnerable to reflected cross-site scripting via k304 parameter (medium 6.3)
- [CVE-2023-38500](https://insights.sbomify.com/CVE-2023-38500/): By-passing Cross-Site Scripting Protection in HTML Sanitizer (medium 4.7)
- [CVE-2023-3850](https://insights.sbomify.com/CVE-2023-3850/): SourceCodester Lost and Found Information System HTTP POST Request sql injection (medium 6.3)
- [CVE-2023-38499](https://insights.sbomify.com/CVE-2023-38499/): typo3/cms-core Information Disclosure due to Out-of-scope Site Resolution (low 3.7)
- [CVE-2023-38498](https://insights.sbomify.com/CVE-2023-38498/): Discourse vulnerable to DoS via defer queue (medium 4.3)
- [CVE-2023-38497](https://insights.sbomify.com/CVE-2023-38497/): Cargo not respecting umask when extracting crate archives (high 7.8)
- [CVE-2023-38496](https://insights.sbomify.com/CVE-2023-38496/): Apptainer's ineffective privileges drop when requesting container network (medium 6.1)
- [CVE-2023-38495](https://insights.sbomify.com/CVE-2023-38495/): Crossplane vulnerable to possible image tampering from missing image validation for Packages (high 8.4)
- [CVE-2023-38494](https://insights.sbomify.com/CVE-2023-38494/): The cloud version of the MeterSphere interface leaks some sensitive data without authentication (medium 5.9)
- [CVE-2023-38493](https://insights.sbomify.com/CVE-2023-38493/): Paths contain matrix variables bypass decorators (high 7.5)
- [CVE-2023-38492](https://insights.sbomify.com/CVE-2023-38492/): Kirby vulnerable to denial of service from unlimited password lengths (medium 5.3)
- [CVE-2023-38491](https://insights.sbomify.com/CVE-2023-38491/): Kirby vulnerable to Cross-site scripting (XSS) from MIME type auto-detection of uploaded files (medium 5.7)
- [CVE-2023-38490](https://insights.sbomify.com/CVE-2023-38490/): Kirby XML External Entity (XXE) vulnerability in the XML data handler (medium 6.8)
- [CVE-2023-3849](https://insights.sbomify.com/CVE-2023-3849/): mooSocial mooDating URL find-a-match cross site scripting (low 3.5)
- [CVE-2023-38489](https://insights.sbomify.com/CVE-2023-38489/): Kirby vulnerable to Insufficient Session Expiration after a password change (high 7.3)
- [CVE-2023-38488](https://insights.sbomify.com/CVE-2023-38488/): Kirby vulnerable to field injection in the KirbyData text storage handler (high 7.1)
- [CVE-2023-38487](https://insights.sbomify.com/CVE-2023-38487/): HedgeDoc API allows to hide existing notes (medium 6.5)
- [CVE-2023-38486](https://insights.sbomify.com/CVE-2023-38486/): Hardware Root of Trust Bypass in 9200 and 9000 Series Controllers and Gateways (high 7.7)
- [CVE-2023-38485](https://insights.sbomify.com/CVE-2023-38485/): Multiple Buffer Overflow Vulnerabilities in BIOS Implementation of 9200 and 9000 Series Controllers and Gateways (high 8.0)
- [CVE-2023-38484](https://insights.sbomify.com/CVE-2023-38484/): Multiple Buffer Overflow Vulnerabilities in BIOS Implementation of 9200 and 9000 Series Controllers and Gateways (high 8.0)
- [CVE-2023-38483](https://insights.sbomify.com/CVE-2023-38483/): WordPress Instant CSS plugin <= 1.1.4 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-38482](https://insights.sbomify.com/CVE-2023-38482/): WordPress Post Affiliate Pro Plugin <= 1.25.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-38481](https://insights.sbomify.com/CVE-2023-38481/): WordPress Integration for WooCommerce and Zoho CRM Plugin < 1.3.7 is vulnerable to Open Redirection (medium 4.7)
- [CVE-2023-38480](https://insights.sbomify.com/CVE-2023-38480/): WordPress Booster Elementor Addons plugin <= 1.4.9 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-3848](https://insights.sbomify.com/CVE-2023-3848/): mooSocial mooDating URL view cross site scripting (low 3.5)
- [CVE-2023-38479](https://insights.sbomify.com/CVE-2023-38479/): WordPress Simple Googlebot Visit plugin <= 1.2.4 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-38478](https://insights.sbomify.com/CVE-2023-38478/): WordPress Integration for WooCommerce and QuickBooks Plugin <= 1.2.3 is vulnerable to Open Redirection (medium 4.7)
- [CVE-2023-38477](https://insights.sbomify.com/CVE-2023-38477/): WordPress QR code MeCard/vCard generator plugin <= 1.6.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-38476](https://insights.sbomify.com/CVE-2023-38476/): WordPress Client Portal : SuiteDash Direct Login Plugin <= 1.7.6 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-38475](https://insights.sbomify.com/CVE-2023-38475/): WordPress Donations Made Easy – Smart Donations plugin <= 4.0.12 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-38474](https://insights.sbomify.com/CVE-2023-38474/): WordPress Campaign Monitor for WordPress Plugin <= 2.8.12 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-38473](https://insights.sbomify.com/CVE-2023-38473/): Reachable assertion in avahi_alternative_host_name (medium 6.2)
- [CVE-2023-38472](https://insights.sbomify.com/CVE-2023-38472/): Reachable assertion in avahi_rdata_parse (medium 6.2)
- [CVE-2023-38471](https://insights.sbomify.com/CVE-2023-38471/): Reachable assertion in dbus_set_host_name (medium 6.2)
- [CVE-2023-38470](https://insights.sbomify.com/CVE-2023-38470/): Reachable assertion in avahi_escape_label (medium 6.2)
- [CVE-2023-3847](https://insights.sbomify.com/CVE-2023-3847/): mooSocial mooDating URL users cross site scripting (low 3.5)
- [CVE-2023-38469](https://insights.sbomify.com/CVE-2023-38469/): Reachable assertion in avahi_dns_packet_append_record (medium 6.2)
- [CVE-2023-38468](https://insights.sbomify.com/CVE-2023-38468/): Memory corruption in SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 (medium 4.4)
- [CVE-2023-38467](https://insights.sbomify.com/CVE-2023-38467/): Memory corruption in SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 (medium 4.4)
- [CVE-2023-38466](https://insights.sbomify.com/CVE-2023-38466/): Missing authorization in SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-38465](https://insights.sbomify.com/CVE-2023-38465/): Missing authorization in SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-38464](https://insights.sbomify.com/CVE-2023-38464/): Missing authorization in SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618 (high 7.8)
- [CVE-2023-38463](https://insights.sbomify.com/CVE-2023-38463/): Missing authorization in SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618 (medium 5.5)
- [CVE-2023-38462](https://insights.sbomify.com/CVE-2023-38462/): Missing authorization in SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618 (medium 5.5)
- [CVE-2023-38461](https://insights.sbomify.com/CVE-2023-38461/): Missing authorization in SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618 (medium 5.5)
- [CVE-2023-38460](https://insights.sbomify.com/CVE-2023-38460/): Missing authorization in SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618 (high 7.8)
- [CVE-2023-3846](https://insights.sbomify.com/CVE-2023-3846/): mooSocial mooDating URL pages cross site scripting (low 3.5)
- [CVE-2023-38459](https://insights.sbomify.com/CVE-2023-38459/): Missing authorization in SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618 (high 7.8)
- [CVE-2023-38458](https://insights.sbomify.com/CVE-2023-38458/): Missing authorization in SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618 (high 7.8)
- [CVE-2023-38457](https://insights.sbomify.com/CVE-2023-38457/): Missing authorization in SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618 (medium 5.5)
- [CVE-2023-38456](https://insights.sbomify.com/CVE-2023-38456/): Missing authorization in SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618 (high 7.8)
- [CVE-2023-38455](https://insights.sbomify.com/CVE-2023-38455/): Missing authorization in SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618 (high 7.8)
- [CVE-2023-38454](https://insights.sbomify.com/CVE-2023-38454/): Missing authorization in SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618 (medium 5.5)
- [CVE-2023-38453](https://insights.sbomify.com/CVE-2023-38453/): Missing authorization in SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618 (high 7.8)
- [CVE-2023-38452](https://insights.sbomify.com/CVE-2023-38452/): Missing authorization in SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618 (high 7.8)
- [CVE-2023-38451](https://insights.sbomify.com/CVE-2023-38451/): Missing authorization in SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618 (high 7.8)
- [CVE-2023-38450](https://insights.sbomify.com/CVE-2023-38450/): Missing authorization in SC9832E/SC9863A/T606/T612/T616/T610/T618 (high 7.8)
- [CVE-2023-3845](https://insights.sbomify.com/CVE-2023-3845/): mooSocial mooDating URL ajax_invite cross site scripting (low 3.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/262/