# Vulnerabilities published in 2023


- [CVE-2023-36575](https://insights.sbomify.com/CVE-2023-36575/): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (high 7.3)
- [CVE-2023-36574](https://insights.sbomify.com/CVE-2023-36574/): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (high 7.3)
- [CVE-2023-36573](https://insights.sbomify.com/CVE-2023-36573/): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (high 7.3)
- [CVE-2023-36572](https://insights.sbomify.com/CVE-2023-36572/): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (high 7.3)
- [CVE-2023-36571](https://insights.sbomify.com/CVE-2023-36571/): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (high 7.3)
- [CVE-2023-36570](https://insights.sbomify.com/CVE-2023-36570/): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (high 7.3)
- [CVE-2023-3657](https://insights.sbomify.com/CVE-2023-3657/): SourceCodester AC Repair and Services System HTTP POST Request sql injection (medium 6.3)
- [CVE-2023-36569](https://insights.sbomify.com/CVE-2023-36569/): Microsoft Office Elevation of Privilege Vulnerability (high 8.4)
- [CVE-2023-36568](https://insights.sbomify.com/CVE-2023-36568/): Microsoft Office Click-To-Run Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2023-36567](https://insights.sbomify.com/CVE-2023-36567/): Windows Deployment Services Information Disclosure Vulnerability (high 7.5)
- [CVE-2023-36566](https://insights.sbomify.com/CVE-2023-36566/): Microsoft Common Data Model SDK Denial of Service Vulnerability (medium 6.5)
- [CVE-2023-36565](https://insights.sbomify.com/CVE-2023-36565/): Microsoft Office Graphics Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2023-36564](https://insights.sbomify.com/CVE-2023-36564/): Windows Search Security Feature Bypass Vulnerability (medium 6.5)
- [CVE-2023-36563](https://insights.sbomify.com/CVE-2023-36563/): Microsoft WordPad Information Disclosure (medium 6.5, exploited in the wild)
- [CVE-2023-36562](https://insights.sbomify.com/CVE-2023-36562/): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (high 7.1)
- [CVE-2023-36561](https://insights.sbomify.com/CVE-2023-36561/): Azure DevOps Server Elevation of Privilege Vulnerability (high 7.3)
- [CVE-2023-36560](https://insights.sbomify.com/CVE-2023-36560/): ASP.NET Security Feature Bypass Vulnerability (high 8.8)
- [CVE-2023-3656](https://insights.sbomify.com/CVE-2023-3656/): Unauthenticated Remote Code Execution (critical 9.8)
- [CVE-2023-36559](https://insights.sbomify.com/CVE-2023-36559/): Microsoft Edge (Chromium-based) Spoofing Vulnerability (medium 4.2)
- [CVE-2023-36558](https://insights.sbomify.com/CVE-2023-36558/): ASP.NET Core Security Feature Bypass Vulnerability (medium 6.2)
- [CVE-2023-36557](https://insights.sbomify.com/CVE-2023-36557/): PrintHTML API Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-36556](https://insights.sbomify.com/CVE-2023-36556/): Auth bypass in FortiMail (high 8.6)
- [CVE-2023-36555](https://insights.sbomify.com/CVE-2023-36555/): Cross-site scripting in FortiOS (low 3.9)
- [CVE-2023-36554](https://insights.sbomify.com/CVE-2023-36554/): Missing authorization in FortiManager (high 7.7)
- [CVE-2023-36553](https://insights.sbomify.com/CVE-2023-36553/): Command injection in FortiSIEM (critical 9.3)
- [CVE-2023-36551](https://insights.sbomify.com/CVE-2023-36551/): Information disclosure in FortiSIEM (medium 4.2)
- [CVE-2023-36550](https://insights.sbomify.com/CVE-2023-36550/): Command injection in FortiWLM (critical 9.6)
- [CVE-2023-3655](https://insights.sbomify.com/CVE-2023-3655/): Unauthenticated Remote Database Exfiltration (high 7.5)
- [CVE-2023-36549](https://insights.sbomify.com/CVE-2023-36549/): Command injection in FortiWLM (high 8.6)
- [CVE-2023-36548](https://insights.sbomify.com/CVE-2023-36548/): Command injection in FortiWLM (critical 9.6)
- [CVE-2023-36547](https://insights.sbomify.com/CVE-2023-36547/): Command injection in FortiWLM (critical 9.6)
- [CVE-2023-36543](https://insights.sbomify.com/CVE-2023-36543/): Apache Airflow: ReDoS via dags function (medium 6.5)
- [CVE-2023-36542](https://insights.sbomify.com/CVE-2023-36542/): Apache NiFi: Potential Code Injection with Properties Referencing Remote Resources (high 8.8)
- [CVE-2023-36541](https://insights.sbomify.com/CVE-2023-36541/): Privilege escalation in Zoom Desktop Client for Windows (high 8.0)
- [CVE-2023-36540](https://insights.sbomify.com/CVE-2023-36540/): Privilege escalation in Zoom Desktop Client for Windows (high 7.3)
- [CVE-2023-3654](https://insights.sbomify.com/CVE-2023-3654/): Origin Check Bypass (critical 9.4)
- [CVE-2023-36539](https://insights.sbomify.com/CVE-2023-36539/): Weak cryptography in Zoom clients (medium 5.3)
- [CVE-2023-36538](https://insights.sbomify.com/CVE-2023-36538/): Privilege escalation in Zoom Rooms for Windows (high 8.4)
- [CVE-2023-36537](https://insights.sbomify.com/CVE-2023-36537/): Privilege escalation in Zoom Rooms for Windows (high 7.3)
- [CVE-2023-36536](https://insights.sbomify.com/CVE-2023-36536/): Privilege escalation in Zoom Rooms for Windows (high 8.2)
- [CVE-2023-36535](https://insights.sbomify.com/CVE-2023-36535/): Security feature bypass in Zoom Clients (high 7.1)
- [CVE-2023-36534](https://insights.sbomify.com/CVE-2023-36534/): Path traversal in Zoom Desktop Client for Windows (critical 9.3)
- [CVE-2023-36533](https://insights.sbomify.com/CVE-2023-36533/): Denial of service in Zoom SDK's (high 7.1)
- [CVE-2023-36532](https://insights.sbomify.com/CVE-2023-36532/): Memory corruption in Zoom Clients (medium 5.9)
- [CVE-2023-36531](https://insights.sbomify.com/CVE-2023-36531/): WordPress LiquidPoll plugin <= 3.3.68 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-36530](https://insights.sbomify.com/CVE-2023-36530/): WordPress SP Project & Document Manager Plugin <= 4.67 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-3653](https://insights.sbomify.com/CVE-2023-3653/): Stored XSS in Digital Ant E-Commerce Software (medium 5.4)
- [CVE-2023-36529](https://insights.sbomify.com/CVE-2023-36529/): WordPress Houzez CRM Plugin <= 1.3.4 is vulnerable to SQL Injection (critical 9.9)
- [CVE-2023-36528](https://insights.sbomify.com/CVE-2023-36528/): WordPress kk Star Ratings plugin <= 5.4.3 - Rate Manipulation due to IP Spoofing Vulnerability (medium 5.3)
- [CVE-2023-36527](https://insights.sbomify.com/CVE-2023-36527/): WordPress Post to CSV by BestWebSoft Plugin <= 1.4.0 is vulnerable to CSV Injection (medium 4.7)
- [CVE-2023-36526](https://insights.sbomify.com/CVE-2023-36526/): WordPress Duplicate Post Page Menu & Custom Post Type plugin <= 2.4.1 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-36525](https://insights.sbomify.com/CVE-2023-36525/): WordPress WPJobBoard plugin <= 5.9.0 - Unauth. Blind SQL Injection (SQLi) vulnerability (high 8.6)
- [CVE-2023-36523](https://insights.sbomify.com/CVE-2023-36523/): WordPress Email download link Plugin <= 3.7 is vulnerable to Sensitive Data Exposure (medium 5.3)
- [CVE-2023-36522](https://insights.sbomify.com/CVE-2023-36522/): Cross-site request forgery in Quiz Expert (medium 4.3)
- [CVE-2023-36521](https://insights.sbomify.com/CVE-2023-36521/): Denial of service in SIMATIC MV540 H (high 8.6)
- [CVE-2023-36520](https://insights.sbomify.com/CVE-2023-36520/): WordPress Editorial Calendar Plugin <= 3.7.12 is vulnerable to Insecure Direct Object References (IDOR) (medium 5.4)
- [CVE-2023-3652](https://insights.sbomify.com/CVE-2023-3652/): Reflected XSS in Digital Ant E-Commerce Software (medium 6.1)
- [CVE-2023-36519](https://insights.sbomify.com/CVE-2023-36519/): WordPress SW Product Bundles plugin <= 2.0.15 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-36518](https://insights.sbomify.com/CVE-2023-36518/): WordPress Post Hit Counter plugin <= 1.3.2 - Broken Access Control (medium 4.3)
- [CVE-2023-36517](https://insights.sbomify.com/CVE-2023-36517/): WordPress WP Abstracts Plugin <= 2.6.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-36516](https://insights.sbomify.com/CVE-2023-36516/): WordPress LearnPress plugin <= 4.2.3 - Authenticated Broken Access Control vulnerability (high 7.6)
- [CVE-2023-36515](https://insights.sbomify.com/CVE-2023-36515/): WordPress LearnPress plugin <= 4.2.3 - Unauthenticated Broken Access Control vulnerability (high 7.3)
- [CVE-2023-36514](https://insights.sbomify.com/CVE-2023-36514/): WordPress WooCommerce Ship to Multiple Addresses Plugin <= 3.8.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 6.5)
- [CVE-2023-36513](https://insights.sbomify.com/CVE-2023-36513/): WordPress AutomateWoo Plugin <= 5.7.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-36512](https://insights.sbomify.com/CVE-2023-36512/): WordPress AutomateWoo plugin <= 5.7.5 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-36511](https://insights.sbomify.com/CVE-2023-36511/): WordPress WooCommerce Order Barcodes Plugin <= 1.6.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-36510](https://insights.sbomify.com/CVE-2023-36510/): WordPress ReDi Restaurant Reservation plugin <= 23.0211 - Broken Access Control vulnerability (high 7.3)
- [CVE-2023-3651](https://insights.sbomify.com/CVE-2023-3651/): SQLi in Digital Ant E-Commerce Software (critical 9.8)
- [CVE-2023-36509](https://insights.sbomify.com/CVE-2023-36509/): WordPress CHP Ads Block Detector plugin <= 3.9.5 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-36508](https://insights.sbomify.com/CVE-2023-36508/): WordPress Contact Form to DB by BestWebSoft Plugin <= 1.7.1 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-36507](https://insights.sbomify.com/CVE-2023-36507/): WordPress BookingPress Plugin <= 1.0.64 is vulnerable to Sensitive Data Exposure (medium 5.3)
- [CVE-2023-36506](https://insights.sbomify.com/CVE-2023-36506/): WordPress YITH WooCommerce Waitlist plugin <= 2.13.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-36505](https://insights.sbomify.com/CVE-2023-36505/): WordPress Ninja Forms Plugin <= 3.6.24 is vulnerable to Arbitrary File Deletion (medium 6.8)
- [CVE-2023-36504](https://insights.sbomify.com/CVE-2023-36504/): WordPress BBS e-Popup plugin <= 2.4.5 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-36503](https://insights.sbomify.com/CVE-2023-36503/): WordPress MaxButtons Plugin <= 9.5.3 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-36502](https://insights.sbomify.com/CVE-2023-36502/): WordPress Balkon Theme <= 1.3.2 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-36501](https://insights.sbomify.com/CVE-2023-36501/): WordPress teachPress Plugin <= 9.0.2 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-3650](https://insights.sbomify.com/CVE-2023-3650/): Bubble Menu < 3.0.5 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-36499](https://insights.sbomify.com/CVE-2023-36499/): Memory corruption in netgear:xr300 firmware (high 8.8)
- [CVE-2023-36498](https://insights.sbomify.com/CVE-2023-36498/): Command injection in ER7206 Omada Gigabit VPN Router (high 7.2)
- [CVE-2023-36497](https://insights.sbomify.com/CVE-2023-36497/): Dover Fueling Solutions MAGLINK LX Web Console Authentication Bypass by Primary Weakness (high 8.8)
- [CVE-2023-36496](https://insights.sbomify.com/CVE-2023-36496/): Delegated Admin Virtual Attribute Provider Privilege Escalation (high 7.7)
- [CVE-2023-36495](https://insights.sbomify.com/CVE-2023-36495/): Integer overflow in iOS and iPadOS (critical 9.8)
- [CVE-2023-36494](https://insights.sbomify.com/CVE-2023-36494/): F5OS-A vulnerability (medium 4.4)
- [CVE-2023-36493](https://insights.sbomify.com/CVE-2023-36493/): Privilege escalation in Intel(R) SDK for OpenCL(TM) Applications software (medium 6.7)
- [CVE-2023-36492](https://insights.sbomify.com/CVE-2023-36492/): Cross-site scripting in SHIRASAGI (medium 6.1)
- [CVE-2023-36490](https://insights.sbomify.com/CVE-2023-36490/): Denial of service in Intel(R) MAS software (medium 5.0)
- [CVE-2023-3649](https://insights.sbomify.com/CVE-2023-3649/): Buffer Over-read in Wireshark (medium 5.3)
- [CVE-2023-36489](https://insights.sbomify.com/CVE-2023-36489/): Command injection in TL-WR802N (high 8.8)
- [CVE-2023-36488](https://insights.sbomify.com/CVE-2023-36488/): Cross-site scripting in ilias:ilias (medium 5.4)
- [CVE-2023-36487](https://insights.sbomify.com/CVE-2023-36487/): Auth bypass in ilias:ilias (critical 9.8)
- [CVE-2023-36486](https://insights.sbomify.com/CVE-2023-36486/): Command injection in ilias:ilias (high 7.2)
- [CVE-2023-36485](https://insights.sbomify.com/CVE-2023-36485/): Command injection in ilias:ilias (high 7.2)
- [CVE-2023-36484](https://insights.sbomify.com/CVE-2023-36484/): Cross-site scripting in ilias:ilias (medium 6.1)
- [CVE-2023-36483](https://insights.sbomify.com/CVE-2023-36483/): MAS (a Carrier brand) MASmobile Classic Authorization Bypass (medium 6.5)
- [CVE-2023-36482](https://insights.sbomify.com/CVE-2023-36482/): Memory corruption in samsung:s3nrn4v firmware (medium 4.3)
- [CVE-2023-36481](https://insights.sbomify.com/CVE-2023-36481/): Denial of service in samsung:exynos 1080 firmware (high 7.5)
- [CVE-2023-36480](https://insights.sbomify.com/CVE-2023-36480/): Aerospike Java Client vulnerable to unsafe deserialization of server responses (critical 9.8)
- [CVE-2023-3648](https://insights.sbomify.com/CVE-2023-3648/): Mismatched Memory Management Routines in Wireshark (medium 5.3)
- [CVE-2023-36479](https://insights.sbomify.com/CVE-2023-36479/): Jetty vulnerable to errant command quoting in CGI Servlet (low 3.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/279/