# Vulnerabilities published in 2023


- [CVE-2023-37946](https://insights.sbomify.com/CVE-2023-37946/): Jenkins OpenShift Login Plugin session fixation vulnerability (high 8.8)
- [CVE-2023-37945](https://insights.sbomify.com/CVE-2023-37945/): Jenkins SAML Single Sign On(SSO) Plugin missing permission check (medium 4.3)
- [CVE-2023-37944](https://insights.sbomify.com/CVE-2023-37944/): Jenkins Datadog Plugin does not perform a permission check in an HTTP endpoint. (medium 6.5)
- [CVE-2023-37943](https://insights.sbomify.com/CVE-2023-37943/): Jenkins Active Directory Plugin vulnerable to Active Directory credential disclosure (medium 5.9)
- [CVE-2023-37942](https://insights.sbomify.com/CVE-2023-37942/): Jenkins External Monitor Job Type Plugin XML external entity vulnerability (medium 6.5)
- [CVE-2023-37941](https://insights.sbomify.com/CVE-2023-37941/): Apache Superset: Metadata db write access can lead to remote code execution (medium 6.6)
- [CVE-2023-37940](https://insights.sbomify.com/CVE-2023-37940/): Liferay Portal and Liferay DXP have Cross-site Scripting vulnerability in edit Service Access Policy page (medium 4.8)
- [CVE-2023-3794](https://insights.sbomify.com/CVE-2023-3794/): Bug Finder ChainCity Real Estate Investment Platform New Ticket create cross site scripting (low 3.5)
- [CVE-2023-37939](https://insights.sbomify.com/CVE-2023-37939/): Information disclosure in FortiClientLinux (low 3.0)
- [CVE-2023-37937](https://insights.sbomify.com/CVE-2023-37937/): Command injection in FortiSwitch (high 7.6)
- [CVE-2023-37936](https://insights.sbomify.com/CVE-2023-37936/): Hardcoded credentials in FortiSwitch (critical 9.6)
- [CVE-2023-37935](https://insights.sbomify.com/CVE-2023-37935/): Information disclosure in FortiOS (medium 6.5)
- [CVE-2023-37934](https://insights.sbomify.com/CVE-2023-37934/): Denial of service in FortiPAM (medium 4.2)
- [CVE-2023-37933](https://insights.sbomify.com/CVE-2023-37933/): Cross-site scripting in FortiADC (high 8.6)
- [CVE-2023-37932](https://insights.sbomify.com/CVE-2023-37932/): Path traversal in FortiVoice (medium 6.2)
- [CVE-2023-37931](https://insights.sbomify.com/CVE-2023-37931/): SQL injection in FortiVoice (high 8.6)
- [CVE-2023-37930](https://insights.sbomify.com/CVE-2023-37930/): Memory corruption in FortiOS (medium 6.7)
- [CVE-2023-3793](https://insights.sbomify.com/CVE-2023-3793/): Weaver e-cology HTTP POST Request filelFileDownloadForOutDoc.class sql injection (medium 5.5)
- [CVE-2023-37929](https://insights.sbomify.com/CVE-2023-37929/): Memory corruption in V5.50(ABPM.8)C0 firmware (medium 6.5)
- [CVE-2023-37928](https://insights.sbomify.com/CVE-2023-37928/): Command injection in NAS326 firmware (high 8.8)
- [CVE-2023-37927](https://insights.sbomify.com/CVE-2023-37927/): Command injection in NAS326 firmware (high 8.8)
- [CVE-2023-37926](https://insights.sbomify.com/CVE-2023-37926/): Memory corruption in ATP series firmware (medium 5.5)
- [CVE-2023-37925](https://insights.sbomify.com/CVE-2023-37925/): Privilege escalation in ATP series firmware (medium 5.5)
- [CVE-2023-37924](https://insights.sbomify.com/CVE-2023-37924/): Apache Submarine: SQL injection from unauthorized login (critical 9.8)
- [CVE-2023-37923](https://insights.sbomify.com/CVE-2023-37923/): Memory corruption in GTKWave (high 7.8)
- [CVE-2023-37922](https://insights.sbomify.com/CVE-2023-37922/): Memory corruption in GTKWave (high 7.8)
- [CVE-2023-37921](https://insights.sbomify.com/CVE-2023-37921/): Memory corruption in GTKWave (high 7.8)
- [CVE-2023-37920](https://insights.sbomify.com/CVE-2023-37920/): Certifi's removal of e-Tugra root certificate (high 7.5)
- [CVE-2023-3792](https://insights.sbomify.com/CVE-2023-3792/): Beijing Netcon NS-ASG test_status.php direct request (medium 4.3)
- [CVE-2023-37919](https://insights.sbomify.com/CVE-2023-37919/): Cal.com not expiring old sessions after enabling 2FA (medium 6.5)
- [CVE-2023-37918](https://insights.sbomify.com/CVE-2023-37918/): API token authentication bypass in HTTP endpoints in Dapr (medium 6.8)
- [CVE-2023-37917](https://insights.sbomify.com/CVE-2023-37917/): Privilege Escalation in kubepi (critical 9.1)
- [CVE-2023-37916](https://insights.sbomify.com/CVE-2023-37916/): Leak password hash of any user (medium 6.5)
- [CVE-2023-37915](https://insights.sbomify.com/CVE-2023-37915/): Malformed PID_PROPERTY_LIST parameter in DATA submessage remotely crashes OpenDDS (high 7.5)
- [CVE-2023-37914](https://insights.sbomify.com/CVE-2023-37914/): Privilege escalation (PR)/RCE from account through Invitation subject/message (critical 9.9)
- [CVE-2023-37913](https://insights.sbomify.com/CVE-2023-37913/): org.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file writing from account through office converter (critical 10.0)
- [CVE-2023-37912](https://insights.sbomify.com/CVE-2023-37912/): XWiki Rendering's footnote macro vulnerable to privilege escalation via the footnote macro (critical 10.0)
- [CVE-2023-37911](https://insights.sbomify.com/CVE-2023-37911/): org.xwiki.platform:xwiki-platform-oldcore may leak data through deleted and re-created documents (medium 6.5)
- [CVE-2023-37910](https://insights.sbomify.com/CVE-2023-37910/): org.xwiki.platform:xwiki-platform-attachment-api vulnerable to Missing Authorization on Attachment Move (high 8.1)
- [CVE-2023-3791](https://insights.sbomify.com/CVE-2023-3791/): IBOS OA Personal Office Address Book export actionExport sql injection (medium 6.3)
- [CVE-2023-37909](https://insights.sbomify.com/CVE-2023-37909/): Privilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheet (critical 10.0)
- [CVE-2023-37908](https://insights.sbomify.com/CVE-2023-37908/): org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability (critical 9.1)
- [CVE-2023-37907](https://insights.sbomify.com/CVE-2023-37907/): Cryptomator's MSI installer allows local privilege escalation (high 7.0)
- [CVE-2023-37906](https://insights.sbomify.com/CVE-2023-37906/): Discourse vulnerable to DoS via post edit reason (medium 4.3)
- [CVE-2023-37905](https://insights.sbomify.com/CVE-2023-37905/): Cross-site Scripting (XSS) in Source Mode of Editor in ckeditor-wordcount-plugin (medium 6.1)
- [CVE-2023-37904](https://insights.sbomify.com/CVE-2023-37904/): Discourse Race Condition in Accept Invite (low 2.6)
- [CVE-2023-37903](https://insights.sbomify.com/CVE-2023-37903/): Sandbox Escape in vm2 (critical 9.8)
- [CVE-2023-37902](https://insights.sbomify.com/CVE-2023-37902/): Vyper's ecrecover can return undefined data if signature does not verify (medium 5.3)
- [CVE-2023-37901](https://insights.sbomify.com/CVE-2023-37901/): Cross-Site-Scripting via confirmation prompts (medium 5.4)
- [CVE-2023-37900](https://insights.sbomify.com/CVE-2023-37900/): Crossplane vulnerable to denial of service from large image (low 3.4)
- [CVE-2023-3790](https://insights.sbomify.com/CVE-2023-3790/): Boom CMS assets-manager add cross site scripting (low 3.5)
- [CVE-2023-37899](https://insights.sbomify.com/CVE-2023-37899/): feathersjs socket handler allows abusing implicit toString (high 7.5)
- [CVE-2023-37898](https://insights.sbomify.com/CVE-2023-37898/): Safe mode Cross-site Scripting (XSS) vulnerability in Joplin (high 8.2)
- [CVE-2023-37897](https://insights.sbomify.com/CVE-2023-37897/): Server-side Template Injection (SSTI) in grav (high 7.2)
- [CVE-2023-37896](https://insights.sbomify.com/CVE-2023-37896/): Nuclei Path Traversal vulnerability (high 7.5)
- [CVE-2023-37895](https://insights.sbomify.com/CVE-2023-37895/): Apache Jackrabbit RMI access can lead to RCE (critical 9.8)
- [CVE-2023-37894](https://insights.sbomify.com/CVE-2023-37894/): WordPress Variation Images Gallery for WooCommerce Plugin <= 2.3.3 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-37893](https://insights.sbomify.com/CVE-2023-37893/): WordPress Coming Soon Chop Chop Plugin <= 2.2.4 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-37892](https://insights.sbomify.com/CVE-2023-37892/): WordPress Shortcode IMDB Plugin <= 6.0.8 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-37891](https://insights.sbomify.com/CVE-2023-37891/): Cross-site request forgery in OptiMonk: Popups, Personalization & A/B Testing (medium 4.3)
- [CVE-2023-37890](https://insights.sbomify.com/CVE-2023-37890/): WordPress KB Support Plugin <= 1.5.88 is vulnerable to Broken Access Control (medium 4.3)
- [CVE-2023-3789](https://insights.sbomify.com/CVE-2023-3789/): PaulPrinting CMS Search delivery cross site scripting (low 3.5)
- [CVE-2023-37889](https://insights.sbomify.com/CVE-2023-37889/): WordPress WPAdmin AWS CDN Plugin <= 2.0.13 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-37888](https://insights.sbomify.com/CVE-2023-37888/): WordPress Phlox Core Elements plugin <= 2.14.0 - Unauthenticated Local File Inclusion vulnerability (high 7.6)
- [CVE-2023-37887](https://insights.sbomify.com/CVE-2023-37887/): WordPress WPSchoolPress plugin <= 2.2.7 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-37886](https://insights.sbomify.com/CVE-2023-37886/): WordPress RealHomes theme <= 4.0.2 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-37885](https://insights.sbomify.com/CVE-2023-37885/): WordPress RealHomes theme <= 4.0.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-37881](https://insights.sbomify.com/CVE-2023-37881/): Weak Access Control between Domains in Wing FTP Server <= 7.2.0 (medium 4.9)
- [CVE-2023-3788](https://insights.sbomify.com/CVE-2023-3788/): ActiveITzone Active Super Shop CMS Manage Details Page cross site scripting (low 3.5)
- [CVE-2023-37879](https://insights.sbomify.com/CVE-2023-37879/): Exposed Session Variable in Wing FTP Server <= 7.2.0 (medium 6.5)
- [CVE-2023-37878](https://insights.sbomify.com/CVE-2023-37878/): Insecure Default Permissions in Wing FTP Server <= 7.2.0 (medium 6.1)
- [CVE-2023-37875](https://insights.sbomify.com/CVE-2023-37875/): Cross-Site Scripting Vulnerability in Wing FTP Server <= 7.2.0 (low 3.0)
- [CVE-2023-37874](https://insights.sbomify.com/CVE-2023-37874/): WordPress HTTP Headers Plugin <= 1.18.11 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-37873](https://insights.sbomify.com/CVE-2023-37873/): WordPress WooCommerce Ship to Multiple Addresses Plugin <= 3.8.5 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-37872](https://insights.sbomify.com/CVE-2023-37872/): WordPress WooCommerce Ship to Multiple Addresses plugin <= 3.8.5 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-37871](https://insights.sbomify.com/CVE-2023-37871/): WordPress WooCommerce GoCardless Gateway Plugin <= 2.5.6 is vulnerable to Insecure Direct Object References (IDOR) (high 8.2)
- [CVE-2023-37870](https://insights.sbomify.com/CVE-2023-37870/): WordPress WooCommerce Warranty Requests plugin <= 2.1.9 - Broken Access Control vulnerability (high 8.1)
- [CVE-2023-3787](https://insights.sbomify.com/CVE-2023-3787/): Codecanyon Tiva Events Calender cross site scripting (low 3.5)
- [CVE-2023-37869](https://insights.sbomify.com/CVE-2023-37869/): WordPress Premium Addons PRO plugin <= 2.9.0 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-37868](https://insights.sbomify.com/CVE-2023-37868/): WordPress Premium Addons PRO Plugin <= 2.9.0 is vulnerable to Sensitive Data Exposure (medium 6.5)
- [CVE-2023-37867](https://insights.sbomify.com/CVE-2023-37867/): WordPress Yet Another Stars Rating Plugin <= 3.3.8 is vulnerable to Race Condition (low 3.7)
- [CVE-2023-37866](https://insights.sbomify.com/CVE-2023-37866/): WordPress JetFormBuilder plugin <= 3.0.8 - Authenticated Privilege Escalation vulnerability (high 7.2)
- [CVE-2023-37865](https://insights.sbomify.com/CVE-2023-37865/): WordPress IP2Location Country Blocker plugin <= 2.29.1 - IP Bypass Vulnerability vulnerability (medium 5.3)
- [CVE-2023-37864](https://insights.sbomify.com/CVE-2023-37864/): PHOENIX CONTACT: WP 6xxx Web panels prone to download code without integrity check (high 7.2)
- [CVE-2023-37863](https://insights.sbomify.com/CVE-2023-37863/): PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panels (high 7.2)
- [CVE-2023-37862](https://insights.sbomify.com/CVE-2023-37862/): PHOENIX CONTACT: Missing Authorization in WP 6xxx Web panels (high 8.2)
- [CVE-2023-37861](https://insights.sbomify.com/CVE-2023-37861/): PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panels (high 8.8)
- [CVE-2023-37860](https://insights.sbomify.com/CVE-2023-37860/): PHOENIX CONTACT: Missing Authorization in WP 6xxx Web panels (high 7.5)
- [CVE-2023-3786](https://insights.sbomify.com/CVE-2023-3786/): Aures Komet Kiosk Mode access control (medium 4.3)
- [CVE-2023-37859](https://insights.sbomify.com/CVE-2023-37859/): PHOENIX CONTACT: Improper Privilege Management in WP 6xxx Web panels (high 7.2)
- [CVE-2023-37858](https://insights.sbomify.com/CVE-2023-37858/): PHOENIX CONTACT: Use of Hard-coded Credentials in WP 6xxx Web panels (medium 4.9)
- [CVE-2023-37857](https://insights.sbomify.com/CVE-2023-37857/): PHOENIX CONTACT: Use of Hard-coded Credentials in WP 6xxx Web panels (low 3.8)
- [CVE-2023-37856](https://insights.sbomify.com/CVE-2023-37856/): PHOENIX CONTACT: Unauthorized read-access of root filesystem in WP 6xxx Web panels (medium 4.3)
- [CVE-2023-37855](https://insights.sbomify.com/CVE-2023-37855/): PHOENIX CONTACT: Unauthorized read-access of root filesystem in WP 6xxx Web panels (medium 4.3)
- [CVE-2023-3785](https://insights.sbomify.com/CVE-2023-3785/): PaulPrinting CMS cross site scripting (low 3.5)
- [CVE-2023-37849](https://insights.sbomify.com/CVE-2023-37849/): Other in watchguard:panda security vpn (medium 6.5)
- [CVE-2023-37847](https://insights.sbomify.com/CVE-2023-37847/): SQL injection in xxyopen:novel-plus (critical 9.8)
- [CVE-2023-3784](https://insights.sbomify.com/CVE-2023-3784/): Dooblou WiFi File Explorer cross site scripting (low 3.5)
- [CVE-2023-37839](https://insights.sbomify.com/CVE-2023-37839/): File upload in dedecms:dedecms (critical 9.8)
- [CVE-2023-37837](https://insights.sbomify.com/CVE-2023-37837/): Memory corruption in jpeg:libjpeg (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/268/