# Vulnerabilities published in 2023


- [CVE-2023-36683](https://insights.sbomify.com/CVE-2023-36683/): WordPress Schema Pro plugin <= 2.7.8 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-36682](https://insights.sbomify.com/CVE-2023-36682/): WordPress Schema Pro Plugin <= 2.7.7 is vulnerable to Cross Site Request Forgery (CSRF) (high 7.1)
- [CVE-2023-36681](https://insights.sbomify.com/CVE-2023-36681/): WordPress Cryptocurrency Widgets – Price Ticker & Coins List plugin <= 2.6.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-36680](https://insights.sbomify.com/CVE-2023-36680/): WordPress Image Regenerate & Select Crop plugin <= 7.1.0 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-3668](https://insights.sbomify.com/CVE-2023-3668/): Improper Encoding or Escaping of Output in froxlor/froxlor (critical 9.1)
- [CVE-2023-36679](https://insights.sbomify.com/CVE-2023-36679/): WordPress Spectra plugin <= 2.6.6 - Server Side Request Forgery (SSRF) vulnerability (high 7.1)
- [CVE-2023-36678](https://insights.sbomify.com/CVE-2023-36678/): WordPress WP Content Copy Protection & No Right Click Plugin <= 3.5.5 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-36677](https://insights.sbomify.com/CVE-2023-36677/): WordPress SP Project & Document Manager Plugin <= 4.67 is vulnerable to SQL Injection (high 8.3)
- [CVE-2023-36676](https://insights.sbomify.com/CVE-2023-36676/): WordPress Spectra plugin <= 2.6.6 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-36675](https://insights.sbomify.com/CVE-2023-36675/): Cross-site scripting in mediawiki:mediawiki (medium 6.1)
- [CVE-2023-36674](https://insights.sbomify.com/CVE-2023-36674/): Security feature bypass in mediawiki:mediawiki (medium 5.3)
- [CVE-2023-36673](https://insights.sbomify.com/CVE-2023-36673/): Information disclosure in avira:phantom vpn (high 7.3)
- [CVE-2023-36672](https://insights.sbomify.com/CVE-2023-36672/): Information disclosure in clario:vpn (medium 5.7)
- [CVE-2023-36671](https://insights.sbomify.com/CVE-2023-36671/): Information disclosure in clario:vpn (medium 6.3)
- [CVE-2023-36670](https://insights.sbomify.com/CVE-2023-36670/): Command injection in kratosdefense:ngc indoor unit firmware (critical 9.8)
- [CVE-2023-3667](https://insights.sbomify.com/CVE-2023-3667/): Bit Assist < 1.1.9 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2023-36669](https://insights.sbomify.com/CVE-2023-36669/): Auth bypass in kratosdefense:ngc indoor unit firmware (critical 9.8)
- [CVE-2023-36667](https://insights.sbomify.com/CVE-2023-36667/): Path traversal in couchbase:couchbase server (high 7.5)
- [CVE-2023-36666](https://insights.sbomify.com/CVE-2023-36666/): Cross-site scripting in inex:ixp manager (medium 6.1)
- [CVE-2023-36665](https://insights.sbomify.com/CVE-2023-36665/): protobufjs Prototype Pollution vulnerability (critical 9.8)
- [CVE-2023-36664](https://insights.sbomify.com/CVE-2023-36664/): Security feature bypass in artifex:ghostscript (high 7.8)
- [CVE-2023-36663](https://insights.sbomify.com/CVE-2023-36663/): SQL injection in it-novum:openitcockpit (high 8.8)
- [CVE-2023-36662](https://insights.sbomify.com/CVE-2023-36662/): Cross-site scripting in techtime:user management (medium 5.4)
- [CVE-2023-36661](https://insights.sbomify.com/CVE-2023-36661/): Server-side request forgery in debian:debian linux (high 7.5)
- [CVE-2023-36660](https://insights.sbomify.com/CVE-2023-36660/): Memory corruption in nettle project:nettle (critical 9.8)
- [CVE-2023-3666](https://insights.sbomify.com/CVE-2023-3666/): Sticky Side Buttons < 2.0.0 - Admin+ Stored XSS (low 3.3)
- [CVE-2023-36659](https://insights.sbomify.com/CVE-2023-36659/): Memory corruption in opswat:metadefender kiosk (critical 9.8)
- [CVE-2023-36658](https://insights.sbomify.com/CVE-2023-36658/): Privilege escalation in opswat:media validation agent (high 7.8)
- [CVE-2023-36657](https://insights.sbomify.com/CVE-2023-36657/): Privilege escalation in opswat:metadefender kiosk (critical 9.8)
- [CVE-2023-36656](https://insights.sbomify.com/CVE-2023-36656/): Cross-site scripting in jaegertracing:jaeger ui (medium 5.4)
- [CVE-2023-36655](https://insights.sbomify.com/CVE-2023-36655/): Auth bypass in prolion:cryptospike (critical 9.8)
- [CVE-2023-36654](https://insights.sbomify.com/CVE-2023-36654/): Path traversal in prolion:cryptospike (medium 6.5)
- [CVE-2023-36652](https://insights.sbomify.com/CVE-2023-36652/): SQL injection in prolion:cryptospike (medium 4.3)
- [CVE-2023-36651](https://insights.sbomify.com/CVE-2023-36651/): Hardcoded credentials in prolion:cryptospike (high 7.2)
- [CVE-2023-36650](https://insights.sbomify.com/CVE-2023-36650/): Security feature bypass in prolion:cryptospike (high 7.2)
- [CVE-2023-3665](https://insights.sbomify.com/CVE-2023-3665/): Code injection in Trellix Endpoint Security (medium 5.5)
- [CVE-2023-36649](https://insights.sbomify.com/CVE-2023-36649/): Information disclosure in prolion:cryptospike (critical 9.1)
- [CVE-2023-36648](https://insights.sbomify.com/CVE-2023-36648/): Auth bypass in prolion:cryptospike (high 8.2)
- [CVE-2023-36647](https://insights.sbomify.com/CVE-2023-36647/): Hardcoded credentials in prolion:cryptospike (high 7.5)
- [CVE-2023-36646](https://insights.sbomify.com/CVE-2023-36646/): Privilege escalation in prolion:cryptospike (high 8.8)
- [CVE-2023-36645](https://insights.sbomify.com/CVE-2023-36645/): SQL injection in itb-pim:tradepro (critical 9.1)
- [CVE-2023-36644](https://insights.sbomify.com/CVE-2023-36644/): Missing authorization in itb-pim:tradepro (high 7.5)
- [CVE-2023-36643](https://insights.sbomify.com/CVE-2023-36643/): Missing authorization in itb-pim:tradepro (high 7.5)
- [CVE-2023-36642](https://insights.sbomify.com/CVE-2023-36642/): Command injection in FortiTester (medium 6.5)
- [CVE-2023-36641](https://insights.sbomify.com/CVE-2023-36641/): Integer overflow in FortiOS (medium 6.2)
- [CVE-2023-36640](https://insights.sbomify.com/CVE-2023-36640/): Memory corruption in FortiOS (medium 6.2)
- [CVE-2023-3664](https://insights.sbomify.com/CVE-2023-3664/): FileOrganizer <= 1.0.2 - Admin+ Arbitrary File Access (high 7.2)
- [CVE-2023-36639](https://insights.sbomify.com/CVE-2023-36639/): Memory corruption in FortiOS (high 7.0)
- [CVE-2023-36638](https://insights.sbomify.com/CVE-2023-36638/): Privilege escalation in FortiAnalyzer (medium 4.2)
- [CVE-2023-36637](https://insights.sbomify.com/CVE-2023-36637/): Cross-site scripting in FortiMail (low 3.4)
- [CVE-2023-36635](https://insights.sbomify.com/CVE-2023-36635/): Missing authorization in FortiSwitchManager (medium 6.9)
- [CVE-2023-36634](https://insights.sbomify.com/CVE-2023-36634/): Path traversal in FortiAP-U (medium 6.5)
- [CVE-2023-36633](https://insights.sbomify.com/CVE-2023-36633/): Missing authorization in FortiMail (medium 5.3)
- [CVE-2023-36632](https://insights.sbomify.com/CVE-2023-36632/): Denial of service in python:python (high 7.5)
- [CVE-2023-36631](https://insights.sbomify.com/CVE-2023-36631/): Missing authorization in malwarebytes:binisoft windows firewall control (high 7.8)
- [CVE-2023-36630](https://insights.sbomify.com/CVE-2023-36630/): File upload in mgt-commerce:cloudpanel (high 8.8)
- [CVE-2023-3663](https://insights.sbomify.com/CVE-2023-3663/): CODESYS: Missing integrity check in CODESYS Development System (high 8.8)
- [CVE-2023-36629](https://insights.sbomify.com/CVE-2023-36629/): Memory corruption in st:st54-android-packages-apps-nfc (medium 5.5)
- [CVE-2023-36628](https://insights.sbomify.com/CVE-2023-36628/): Privilege Escalation in VASA (high 8.8)
- [CVE-2023-36627](https://insights.sbomify.com/CVE-2023-36627/): FlashBlade Snapshot Scheduler (high 7.7)
- [CVE-2023-36624](https://insights.sbomify.com/CVE-2023-36624/): Privilege escalation in loxone:miniserver go gen 2 firmware (high 7.8)
- [CVE-2023-36623](https://insights.sbomify.com/CVE-2023-36623/): Hardcoded credentials in loxone:miniserver go gen 2 firmware (high 7.8)
- [CVE-2023-36622](https://insights.sbomify.com/CVE-2023-36622/): Command injection in loxone:miniserver go gen 2 firmware (high 7.2)
- [CVE-2023-36621](https://insights.sbomify.com/CVE-2023-36621/): Missing authorization in nationaledtech:boomerang (critical 9.1)
- [CVE-2023-36620](https://insights.sbomify.com/CVE-2023-36620/): Information disclosure in nationaledtech:boomerang (medium 4.6)
- [CVE-2023-3662](https://insights.sbomify.com/CVE-2023-3662/): CODESYS: Vulnerability in CODESYS Development System allows for execution of binaries (high 7.3)
- [CVE-2023-36619](https://insights.sbomify.com/CVE-2023-36619/): Missing authorization in unify:session border controller (critical 9.8)
- [CVE-2023-36618](https://insights.sbomify.com/CVE-2023-36618/): Command injection in unify:session border controller (high 8.8)
- [CVE-2023-36617](https://insights.sbomify.com/CVE-2023-36617/): URI gem has ReDoS vulnerability (medium 5.3)
- [CVE-2023-36612](https://insights.sbomify.com/CVE-2023-36612/): Path traversal in basecamp:basecamp (high 7.5)
- [CVE-2023-36611](https://insights.sbomify.com/CVE-2023-36611/): Privilege escalation in TBox LT2 (medium 6.5)
- [CVE-2023-36610](https://insights.sbomify.com/CVE-2023-36610/): Weak cryptography in TBox LT2 (medium 5.9)
- [CVE-2023-3661](https://insights.sbomify.com/CVE-2023-3661/): SourceCodester AC Repair and Services System sql injection (medium 6.3)
- [CVE-2023-36609](https://insights.sbomify.com/CVE-2023-36609/): Privilege escalation in TBox LT2 (high 7.2)
- [CVE-2023-36608](https://insights.sbomify.com/CVE-2023-36608/): Weak cryptography in TBox LT2 (medium 6.5)
- [CVE-2023-36607](https://insights.sbomify.com/CVE-2023-36607/): CVE-2023-36607 (medium 5.3)
- [CVE-2023-36606](https://insights.sbomify.com/CVE-2023-36606/): Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability (high 7.5)
- [CVE-2023-36605](https://insights.sbomify.com/CVE-2023-36605/): Windows Named Pipe Filesystem Elevation of Privilege Vulnerability (high 7.4)
- [CVE-2023-36603](https://insights.sbomify.com/CVE-2023-36603/): Windows TCP/IP Denial of Service Vulnerability (high 7.5)
- [CVE-2023-36602](https://insights.sbomify.com/CVE-2023-36602/): Windows TCP/IP Denial of Service Vulnerability (high 7.5)
- [CVE-2023-3660](https://insights.sbomify.com/CVE-2023-3660/): Campcodes Retro Cellphone Online Store add_user_modal.php cross site scripting (low 2.4)
- [CVE-2023-36598](https://insights.sbomify.com/CVE-2023-36598/): Microsoft WDAC ODBC Driver Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-36596](https://insights.sbomify.com/CVE-2023-36596/): Remote Procedure Call Information Disclosure Vulnerability (high 7.5)
- [CVE-2023-36594](https://insights.sbomify.com/CVE-2023-36594/): Windows Graphics Component Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2023-36593](https://insights.sbomify.com/CVE-2023-36593/): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-36592](https://insights.sbomify.com/CVE-2023-36592/): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (high 7.3)
- [CVE-2023-36591](https://insights.sbomify.com/CVE-2023-36591/): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (high 7.3)
- [CVE-2023-36590](https://insights.sbomify.com/CVE-2023-36590/): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (high 7.3)
- [CVE-2023-3659](https://insights.sbomify.com/CVE-2023-3659/): SourceCodester AC Repair and Services System cross site scripting (low 3.5)
- [CVE-2023-36589](https://insights.sbomify.com/CVE-2023-36589/): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (high 7.3)
- [CVE-2023-36585](https://insights.sbomify.com/CVE-2023-36585/): Windows upnphost.dll Denial of Service Vulnerability (high 7.5)
- [CVE-2023-36584](https://insights.sbomify.com/CVE-2023-36584/): Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass (medium 5.4, exploited in the wild)
- [CVE-2023-36583](https://insights.sbomify.com/CVE-2023-36583/): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (high 7.3)
- [CVE-2023-36582](https://insights.sbomify.com/CVE-2023-36582/): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (high 7.3)
- [CVE-2023-36581](https://insights.sbomify.com/CVE-2023-36581/): Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability (high 7.5)
- [CVE-2023-3658](https://insights.sbomify.com/CVE-2023-3658/): SourceCodester AC Repair and Services System HTTP POST Request sql injection (medium 6.3)
- [CVE-2023-36579](https://insights.sbomify.com/CVE-2023-36579/): Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability (high 7.5)
- [CVE-2023-36578](https://insights.sbomify.com/CVE-2023-36578/): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (high 7.3)
- [CVE-2023-36577](https://insights.sbomify.com/CVE-2023-36577/): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-36576](https://insights.sbomify.com/CVE-2023-36576/): Windows Kernel Information Disclosure Vulnerability (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/278/