# Vulnerabilities published in 2023


- [CVE-2023-38044](https://insights.sbomify.com/CVE-2023-38044/): Extension - hikashop.com - SQLi in HikaShop component for Joomla <= 4.7.2 (critical 9.8)
- [CVE-2023-38043](https://insights.sbomify.com/CVE-2023-38043/): Denial of service in Secure Access Client Windows (high 8.8)
- [CVE-2023-38042](https://insights.sbomify.com/CVE-2023-38042/): Privilege escalation in Secure Access Client (high 7.8)
- [CVE-2023-38041](https://insights.sbomify.com/CVE-2023-38041/): Race condition in Secure Access Client (high 7.8)
- [CVE-2023-38040](https://insights.sbomify.com/CVE-2023-38040/): Cross-site scripting in Revive Adserver (medium 6.1)
- [CVE-2023-3804](https://insights.sbomify.com/CVE-2023-3804/): Chengdu Flash Flood Disaster Monitoring and Warning System FileHandler.ashx unrestricted upload (medium 5.5)
- [CVE-2023-38039](https://insights.sbomify.com/CVE-2023-38039/): Denial of service in curl (high 7.5)
- [CVE-2023-38037](https://insights.sbomify.com/CVE-2023-38037/): Active Support Possibly Discloses Locally Encrypted Files (medium 5.5)
- [CVE-2023-38036](https://insights.sbomify.com/CVE-2023-38036/): Memory corruption in Avalanche (critical 9.8)
- [CVE-2023-38035](https://insights.sbomify.com/CVE-2023-38035/): Ivanti Sentry Authentication Bypass (critical 9.8, exploited in the wild)
- [CVE-2023-38034](https://insights.sbomify.com/CVE-2023-38034/): Command injection in UniFi Access Points (high 8.3)
- [CVE-2023-38033](https://insights.sbomify.com/CVE-2023-38033/): ASUS RT-AC86U - Command injection vulnerability - 3 (high 8.8)
- [CVE-2023-38032](https://insights.sbomify.com/CVE-2023-38032/): ASUS RT-AC86U - Command injection vulnerability - 2 (high 8.8)
- [CVE-2023-38031](https://insights.sbomify.com/CVE-2023-38031/): ASUS RT-AC86U - Command injection vulnerability - 1 (high 8.8)
- [CVE-2023-38030](https://insights.sbomify.com/CVE-2023-38030/): Saho ADM100&ADM-100FP - Execute Code (high 7.5)
- [CVE-2023-3803](https://insights.sbomify.com/CVE-2023-3803/): Chengdu Flash Flood Disaster Monitoring and Warning System File Name ImageStationDataService.asmx random values (low 2.6)
- [CVE-2023-38029](https://insights.sbomify.com/CVE-2023-38029/): Saho ADM100&ADM-100FP - Arbitrary File Upload (critical 9.8)
- [CVE-2023-38028](https://insights.sbomify.com/CVE-2023-38028/): Saho ADM100&ADM-100FP - Broken Access Control (critical 9.1)
- [CVE-2023-38027](https://insights.sbomify.com/CVE-2023-38027/): SpotCam Co., Ltd. SpotCam Sense - Command Injection (critical 9.8)
- [CVE-2023-38026](https://insights.sbomify.com/CVE-2023-38026/): SpotCam Co., Ltd. SpotCamFHD - Use of Hard-coded Cryptographic Key -2 (critical 9.8)
- [CVE-2023-38025](https://insights.sbomify.com/CVE-2023-38025/): SpotCam Co., Ltd. SpotCamFHD - Command Injection -1 (critical 9.8)
- [CVE-2023-38024](https://insights.sbomify.com/CVE-2023-38024/): SpotCam Co., Ltd. SpotCamFHD - Use of Hard-coded Cryptographic Key -1 (critical 9.8)
- [CVE-2023-38023](https://insights.sbomify.com/CVE-2023-38023/): Information disclosure in scontain:scone (medium 5.5)
- [CVE-2023-38022](https://insights.sbomify.com/CVE-2023-38022/): Information disclosure in fortanix:confidential computing manager (medium 5.5)
- [CVE-2023-38021](https://insights.sbomify.com/CVE-2023-38021/): Information disclosure in fortanix:confidential computing manager (medium 5.5)
- [CVE-2023-38020](https://insights.sbomify.com/CVE-2023-38020/): IBM SOAR QRadar Plugin App log injection (medium 4.3)
- [CVE-2023-3802](https://insights.sbomify.com/CVE-2023-3802/): Chengdu Flash Flood Disaster Monitoring and Warning System Ajaxfileupload.ashx unrestricted upload (medium 5.5)
- [CVE-2023-38019](https://insights.sbomify.com/CVE-2023-38019/): IBM SOAR QRadar Plugin App directory traversal (high 8.1)
- [CVE-2023-38018](https://insights.sbomify.com/CVE-2023-38018/): IBM Aspera Shares session fixation (medium 6.3)
- [CVE-2023-38017](https://insights.sbomify.com/CVE-2023-38017/): Multiple Vulnerabilities in IBM Cloud Pak System (medium 5.3)
- [CVE-2023-38013](https://insights.sbomify.com/CVE-2023-38013/): IBM Cloud Pak System information disclosure (medium 5.3)
- [CVE-2023-38012](https://insights.sbomify.com/CVE-2023-38012/): IBM Cloud Pak System directory traversal (medium 5.3)
- [CVE-2023-38010](https://insights.sbomify.com/CVE-2023-38010/): Multiple Vulnerabilities in IBM Cloud Pak System (medium 5.3)
- [CVE-2023-3801](https://insights.sbomify.com/CVE-2023-3801/): IBOS OA Mobile Notification edit actionEdit sql injection (medium 5.5)
- [CVE-2023-38009](https://insights.sbomify.com/CVE-2023-38009/): IBM Cognos Analytics Mobile information disclosure (medium 4.2)
- [CVE-2023-38007](https://insights.sbomify.com/CVE-2023-38007/): IBM Cloud Pak System HTML injection (medium 5.4)
- [CVE-2023-38005](https://insights.sbomify.com/CVE-2023-38005/): Missing authorization in Cloud Pak System (medium 4.3)
- [CVE-2023-38003](https://insights.sbomify.com/CVE-2023-38003/): IBM Db2 command execution (high 7.2)
- [CVE-2023-38002](https://insights.sbomify.com/CVE-2023-38002/): IBM Storage Scale session fixation (medium 5.0)
- [CVE-2023-38001](https://insights.sbomify.com/CVE-2023-38001/): IBM Aspera Orchestrator cross-site request forgery (medium 6.5)
- [CVE-2023-38000](https://insights.sbomify.com/CVE-2023-38000/): Auth. Stored Cross-Site Scripting (XSS) vulnerability in WordPress core and Gutenberg plugin via Navigation Links Block (medium 6.5)
- [CVE-2023-3800](https://insights.sbomify.com/CVE-2023-3800/): EasyAdmin8 File Upload Module index.html unrestricted upload (low 3.9)
- [CVE-2023-37999](https://insights.sbomify.com/CVE-2023-37999/): WordPress HT Mega Absolute Addons for Elementor plugin <= 2.2.0 - Unauthenticated Privilege Escalation vulnerability (critical 9.8)
- [CVE-2023-37998](https://insights.sbomify.com/CVE-2023-37998/): WordPress Disabler Plugin <= 3.0.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-37997](https://insights.sbomify.com/CVE-2023-37997/): WordPress Post List With Featured Image Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-37996](https://insights.sbomify.com/CVE-2023-37996/): WordPress GTmetrix for WordPress Plugin <= 0.4.7 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-37995](https://insights.sbomify.com/CVE-2023-37995/): WordPress WP-CopyProtect [Protect your blog posts] Plugin <= 3.1.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-37994](https://insights.sbomify.com/CVE-2023-37994/): WordPress Art Decoration Shortcode Plugin <= 1.5.6 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-37993](https://insights.sbomify.com/CVE-2023-37993/): WordPress wpShopGermany IT-RECHT KANZLEI Plugin <= 1.7 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-37992](https://insights.sbomify.com/CVE-2023-37992/): WordPress Smarty for WordPress Plugin <= 3.1.35 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-37991](https://insights.sbomify.com/CVE-2023-37991/): WordPress WP Emoji One Plugin <= 0.6.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-37990](https://insights.sbomify.com/CVE-2023-37990/): WordPress Perelink Pro Plugin <= 2.1.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-3799](https://insights.sbomify.com/CVE-2023-3799/): IBOS OA Delete Category del sql injection (medium 6.3)
- [CVE-2023-37989](https://insights.sbomify.com/CVE-2023-37989/): WordPress Easyship WooCommerce Shipping Rates plugin <= 0.9.0 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-37988](https://insights.sbomify.com/CVE-2023-37988/): WordPress Contact Form Generator Plugin <= 2.5.5 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-37987](https://insights.sbomify.com/CVE-2023-37987/): WordPress YourMembership Single Sign On plugin <= 1.1.3 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-37986](https://insights.sbomify.com/CVE-2023-37986/): WordPress YourMembership Single Sign On Plugin <= 1.1.3 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-37985](https://insights.sbomify.com/CVE-2023-37985/): WordPress Five Star Restaurant Menu Plugin <= 2.4.6 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-37984](https://insights.sbomify.com/CVE-2023-37984/): WordPress Quiz And Survey Master plugin <= 8.1.10 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-37983](https://insights.sbomify.com/CVE-2023-37983/): WordPress Art Direction Plugin <= 0.2.4 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-37982](https://insights.sbomify.com/CVE-2023-37982/): WordPress Integration for Contact Form 7 and Salesforce Plugin <= 1.3.3 is vulnerable to Open Redirection (medium 4.7)
- [CVE-2023-37981](https://insights.sbomify.com/CVE-2023-37981/): WordPress Authors List Plugin <= 2.0.2 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-37980](https://insights.sbomify.com/CVE-2023-37980/): WordPress Custom Field For WP Job Manager Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-3798](https://insights.sbomify.com/CVE-2023-3798/): Chengdu Flash Flood Disaster Monitoring and Warning System upload.aspx unrestricted upload (medium 5.5)
- [CVE-2023-37979](https://insights.sbomify.com/CVE-2023-37979/): WordPress Ninja Forms Plugin <= 3.6.25 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-37978](https://insights.sbomify.com/CVE-2023-37978/): WordPress HTTP Headers Plugin <= 1.18.11 is vulnerable to Server Side Request Forgery (SSRF) (medium 4.4)
- [CVE-2023-37977](https://insights.sbomify.com/CVE-2023-37977/): WordPress WPFunnels Plugin <= 2.7.16 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-37976](https://insights.sbomify.com/CVE-2023-37976/): WordPress Radio Forge Muses Player with Skins Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-37975](https://insights.sbomify.com/CVE-2023-37975/): WordPress Variation Swatches for WooCommerce Plugin <= 2.3.7 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-37974](https://insights.sbomify.com/CVE-2023-37974/): WordPress WP-FB-AutoConnect Plugin <= 4.6.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-37973](https://insights.sbomify.com/CVE-2023-37973/): WordPress Replace Word Plugin <= 2.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-37972](https://insights.sbomify.com/CVE-2023-37972/): WordPress WooCommerce Product Stock Alert Plugin <= 2.0.1 is vulnerable to Sensitive Data Exposure (medium 5.3)
- [CVE-2023-37971](https://insights.sbomify.com/CVE-2023-37971/): WordPress WooCommerce Product Stock Alert plugin <= 2.0.1 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-37970](https://insights.sbomify.com/CVE-2023-37970/): WordPress MF Gig Calendar Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-3797](https://insights.sbomify.com/CVE-2023-3797/): File upload in Four Mountain Torrent Disaster Prevention and Control of Monitoring and Early Warning System (medium 5.5)
- [CVE-2023-37969](https://insights.sbomify.com/CVE-2023-37969/): WordPress Checkout with Zelle on Woocommerce plugin <= 3.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-37968](https://insights.sbomify.com/CVE-2023-37968/): WordPress Falang multilanguage Plugin <= 1.3.39 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-37967](https://insights.sbomify.com/CVE-2023-37967/): WordPress DirectoryPress plugin <= 3.6.2 - Unauthenticated Broken Access Control Vulnerability (medium 6.5)
- [CVE-2023-37966](https://insights.sbomify.com/CVE-2023-37966/): WordPress User Activity Log Plugin <= 1.6.2 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-37965](https://insights.sbomify.com/CVE-2023-37965/): Jenkins ElasticBox CI Plugin missing permission check (high 7.1)
- [CVE-2023-37964](https://insights.sbomify.com/CVE-2023-37964/): Jenkins ElasticBox CI Plugin vulnerable to cross-site request forgery (high 8.8)
- [CVE-2023-37963](https://insights.sbomify.com/CVE-2023-37963/): Jenkins Benchmark Evaluator Plugin missing permission check (medium 5.4)
- [CVE-2023-37962](https://insights.sbomify.com/CVE-2023-37962/): Jenkins Benchmark Evaluator Plugin vulnerable to cross-site request forgery (high 8.8)
- [CVE-2023-37961](https://insights.sbomify.com/CVE-2023-37961/): Jenkins Assembla Auth Plugin vulnerable to cross-site request forgery (high 8.8)
- [CVE-2023-37960](https://insights.sbomify.com/CVE-2023-37960/): Jenkins MathWorks Polyspace Plugin vulnerable to arbitrary file read (medium 6.5)
- [CVE-2023-3796](https://insights.sbomify.com/CVE-2023-3796/): Bug Finder Foody Friend Profile Picture profile unrestricted upload (medium 4.3)
- [CVE-2023-37959](https://insights.sbomify.com/CVE-2023-37959/): Jenkins Sumologic Publisher Plugin missing permission check (medium 6.5)
- [CVE-2023-37958](https://insights.sbomify.com/CVE-2023-37958/): Jenkins Sumologic Publisher Plugin vulnerable to cross-site request forgery (high 8.8)
- [CVE-2023-37957](https://insights.sbomify.com/CVE-2023-37957/): Jenkins Pipeline restFul API Plugin vulnerable to Cross Site Request Forgery (high 8.8)
- [CVE-2023-37956](https://insights.sbomify.com/CVE-2023-37956/): Jenkins Test Results Aggregator Plugin missing permission check (medium 6.5)
- [CVE-2023-37955](https://insights.sbomify.com/CVE-2023-37955/): Jenkins Test Results Aggregator Plugin vulnerable to Cross Site Request Forgery (medium 6.5)
- [CVE-2023-37954](https://insights.sbomify.com/CVE-2023-37954/): Jenkins Rebuilder Plugin vulnerable to Cross Site Request Forgery (medium 4.3)
- [CVE-2023-37953](https://insights.sbomify.com/CVE-2023-37953/): Jenkins mabl Plugin missing permission check (medium 6.5)
- [CVE-2023-37952](https://insights.sbomify.com/CVE-2023-37952/): Jenkins mabl Plugin vulnerable to cross-site request forgery (medium 6.5)
- [CVE-2023-37951](https://insights.sbomify.com/CVE-2023-37951/): Jenkins mabl Plugin vulnerable to exposure of system-scooped credentials (medium 6.5)
- [CVE-2023-37950](https://insights.sbomify.com/CVE-2023-37950/): Jenkins mabl Plugin missing permission check (medium 4.3)
- [CVE-2023-3795](https://insights.sbomify.com/CVE-2023-3795/): Bug Finder ChainCity Real Estate Investment Platform GET Parameter property sql injection (medium 5.5)
- [CVE-2023-37949](https://insights.sbomify.com/CVE-2023-37949/): Jenkins Orka by MacStadium Plugin missing permission check (high 7.1)
- [CVE-2023-37948](https://insights.sbomify.com/CVE-2023-37948/): Jenkins Oracle Cloud Infrastructure Compute Plugin missing SSH host key validation (low 3.7)
- [CVE-2023-37947](https://insights.sbomify.com/CVE-2023-37947/): Jenkins OpenShift Login Plugin vulnerable to Open Redirect (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/267/