# Vulnerabilities published in 2023


- [CVE-2023-3508](https://insights.sbomify.com/CVE-2023-3508/): WooCommerce Pre-Orders < 2.0.3 - Unauthorised Actions via CSRF (medium 6.5)
- [CVE-2023-35078](https://insights.sbomify.com/CVE-2023-35078/): Ivanti Endpoint Manager Mobile Authentication Bypass (critical 10.0, exploited in the wild)
- [CVE-2023-35077](https://insights.sbomify.com/CVE-2023-35077/): Memory corruption in Endpoint Manager (high 8.1)
- [CVE-2023-35075](https://insights.sbomify.com/CVE-2023-35075/): HTML injection via channel autocomplete (low 3.1)
- [CVE-2023-35074](https://insights.sbomify.com/CVE-2023-35074/): Memory corruption in Safari (high 8.8)
- [CVE-2023-35072](https://insights.sbomify.com/CVE-2023-35072/): SQLi in Coyav Travels Proagent (critical 9.8)
- [CVE-2023-35071](https://insights.sbomify.com/CVE-2023-35071/): SQLi in MRV Tech's Logging Administration Panel (critical 9.8)
- [CVE-2023-35070](https://insights.sbomify.com/CVE-2023-35070/): SQL in VegaGroup Web Collection (critical 9.8)
- [CVE-2023-3507](https://insights.sbomify.com/CVE-2023-3507/): WooCommerce Pre-Orders < 2.0.3 - Arbitrary Pre-Order Canceling via CSRF (medium 6.5)
- [CVE-2023-35069](https://insights.sbomify.com/CVE-2023-35069/): Path Traversal in Bullwark (high 7.5)
- [CVE-2023-35068](https://insights.sbomify.com/CVE-2023-35068/): SQLi in BMAs Personnel Tracking System (critical 9.8)
- [CVE-2023-35067](https://insights.sbomify.com/CVE-2023-35067/): Plaintext Storage of a Password in Infodrom Sofwares E-Invoice Approval System (high 7.5)
- [CVE-2023-35066](https://insights.sbomify.com/CVE-2023-35066/): SQLi in Infodrom Sofwares E-Invoice Approval System (critical 9.8)
- [CVE-2023-35065](https://insights.sbomify.com/CVE-2023-35065/): SQLi in Osofts Paint Production Management (critical 9.8)
- [CVE-2023-35064](https://insights.sbomify.com/CVE-2023-35064/): SQLi in Satos Mobile (critical 9.8)
- [CVE-2023-35062](https://insights.sbomify.com/CVE-2023-35062/): Privilege escalation in Intel(R) DSA software (medium 6.3)
- [CVE-2023-35061](https://insights.sbomify.com/CVE-2023-35061/): Information disclosure in Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software (low 2.3)
- [CVE-2023-35060](https://insights.sbomify.com/CVE-2023-35060/): Privilege escalation in Intel(R) Battery Life Diagnostic Tool software (medium 6.7)
- [CVE-2023-3506](https://insights.sbomify.com/CVE-2023-3506/): Active It Zone Active eCommerce CMS Create Ticket Page support_ticket cross site scripting (low 3.5)
- [CVE-2023-35057](https://insights.sbomify.com/CVE-2023-35057/): Integer overflow in GTKWave (high 7.8)
- [CVE-2023-35056](https://insights.sbomify.com/CVE-2023-35056/): Memory corruption in YF325 (high 8.8)
- [CVE-2023-35055](https://insights.sbomify.com/CVE-2023-35055/): Memory corruption in YF325 (high 8.8)
- [CVE-2023-35054](https://insights.sbomify.com/CVE-2023-35054/): Cross-site scripting in YouTrack (medium 4.6)
- [CVE-2023-35053](https://insights.sbomify.com/CVE-2023-35053/): Denial of service in YouTrack (high 7.5)
- [CVE-2023-35052](https://insights.sbomify.com/CVE-2023-35052/): WordPress Directorist plugin <= 7.5.4 - Arbitrary Content Deletion vulnerability (medium 4.3)
- [CVE-2023-35051](https://insights.sbomify.com/CVE-2023-35051/): WordPress Contact Forms by Cimatti plugin <= 1.5.7 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-35050](https://insights.sbomify.com/CVE-2023-35050/): WordPress Elementor Pro plugin <= 3.13.0 - Auth. Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-3505](https://insights.sbomify.com/CVE-2023-3505/): Onest CRM Project List 2 cross site scripting (low 3.5)
- [CVE-2023-35049](https://insights.sbomify.com/CVE-2023-35049/): WordPress WooCommerce Stripe Payment Gateway plugin <= 7.4.0 - Unauthenticated Broken Access Control vulnerability (high 7.5)
- [CVE-2023-35048](https://insights.sbomify.com/CVE-2023-35048/): WordPress Booking and Rental Manager Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-35047](https://insights.sbomify.com/CVE-2023-35047/): WordPress All Bootstrap Blocks Plugin <= 1.3.6 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-35046](https://insights.sbomify.com/CVE-2023-35046/): WordPress Dynamic Visibility for Elementor plugin <= 5.0.5 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-35045](https://insights.sbomify.com/CVE-2023-35045/): WordPress Fat Rat Collect plugin <= 2.6.7 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-35044](https://insights.sbomify.com/CVE-2023-35044/): WordPress Securimage-WP Plugin <= 3.6.16 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-35043](https://insights.sbomify.com/CVE-2023-35043/): WordPress Recent Posts Slider Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-35042](https://insights.sbomify.com/CVE-2023-35042/): GeoServer RCE due to improper control of generation of code in jai-ext`Jiffle` map algebra language (critical 9.8)
- [CVE-2023-35041](https://insights.sbomify.com/CVE-2023-35041/): WordPress Webpushr Plugin <= 4.34.0 is vulnerable to Cross Site Request Forgery (CSRF) (high 8.8)
- [CVE-2023-35040](https://insights.sbomify.com/CVE-2023-35040/): WordPress SendPress Newsletters plugin <= 1.23.11.6 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-3504](https://insights.sbomify.com/CVE-2023-3504/): SmartWeb Infotech Job Board My Profile Page account unrestricted upload (medium 6.3)
- [CVE-2023-35039](https://insights.sbomify.com/CVE-2023-35039/): WordPress Password Reset with Code for WordPress REST API Plugin <= 0.0.15 is vulnerable to Broken Authentication (critical 9.8)
- [CVE-2023-35038](https://insights.sbomify.com/CVE-2023-35038/): WordPress WP PDF Generator Plugin <= 1.2.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-35037](https://insights.sbomify.com/CVE-2023-35037/): WordPress Surfer plugin <= 1.3.2.357 - Broken Access Control vulnerability (high 7.6)
- [CVE-2023-35036](https://insights.sbomify.com/CVE-2023-35036/): SQL injection in progress:moveit transfer (critical 9.1)
- [CVE-2023-35035](https://insights.sbomify.com/CVE-2023-35035/): Command injection in atos:unify openscape 4000 assistant (high 8.8)
- [CVE-2023-35034](https://insights.sbomify.com/CVE-2023-35034/): Code injection in atos:unify openscape 4000 assistant (critical 9.8)
- [CVE-2023-35033](https://insights.sbomify.com/CVE-2023-35033/): Command injection in atos:unify openscape 4000 assistant (high 8.8)
- [CVE-2023-35032](https://insights.sbomify.com/CVE-2023-35032/): Command injection in atos:unify openscape 4000 assistant (high 8.8)
- [CVE-2023-35031](https://insights.sbomify.com/CVE-2023-35031/): Command injection in atos:unify openscape 4000 assistant (high 8.8)
- [CVE-2023-35030](https://insights.sbomify.com/CVE-2023-35030/): Liferay Portal and Liferay DXP Vulnerable to CSRF via the Layout Module (high 8.8)
- [CVE-2023-3503](https://insights.sbomify.com/CVE-2023-3503/): SourceCodester Shopping Website insert-product.php unrestricted upload (medium 6.3)
- [CVE-2023-35029](https://insights.sbomify.com/CVE-2023-35029/): Liferay Portal and Liferay DXP Vulnerable to Open Redirect via the Layout Module (medium 6.1)
- [CVE-2023-35024](https://insights.sbomify.com/CVE-2023-35024/): IBM Cloud Pak for Business Automation cross-site scripting (medium 4.6)
- [CVE-2023-35022](https://insights.sbomify.com/CVE-2023-35022/): IBM InfoSphere Information Server improper authentication (low 3.3)
- [CVE-2023-35020](https://insights.sbomify.com/CVE-2023-35020/): IBM Sterling Control Center directory traversal (medium 5.4)
- [CVE-2023-3502](https://insights.sbomify.com/CVE-2023-3502/): SourceCodester Shopping Website search-result.php sql injection (medium 6.3)
- [CVE-2023-35019](https://insights.sbomify.com/CVE-2023-35019/): IBM Security Verify Governance command execution (high 7.2)
- [CVE-2023-35018](https://insights.sbomify.com/CVE-2023-35018/): IBM Security Verify Governance file upload (low 3.3)
- [CVE-2023-35017](https://insights.sbomify.com/CVE-2023-35017/): IBM Security Verify Governance information (medium 5.9)
- [CVE-2023-35016](https://insights.sbomify.com/CVE-2023-35016/): IBM Security Verify Governance path traversal (medium 6.5)
- [CVE-2023-35013](https://insights.sbomify.com/CVE-2023-35013/): IBM Security Verify Governance information disclosure (low 2.3)
- [CVE-2023-35012](https://insights.sbomify.com/CVE-2023-35012/): IBM Db2 code execution (medium 6.7)
- [CVE-2023-35011](https://insights.sbomify.com/CVE-2023-35011/): IBM Cognos Analytics server-side request forgey (medium 5.4)
- [CVE-2023-3501](https://insights.sbomify.com/CVE-2023-3501/): FormCraft < 1.2.7 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-35009](https://insights.sbomify.com/CVE-2023-35009/): IBM Cognos Analytics information disclosure (medium 5.3)
- [CVE-2023-35006](https://insights.sbomify.com/CVE-2023-35006/): IBM Security ReaQta HTML injection (medium 5.4)
- [CVE-2023-35005](https://insights.sbomify.com/CVE-2023-35005/): Apache Airflow: Information disclosure on configuration view (medium 6.5)
- [CVE-2023-35004](https://insights.sbomify.com/CVE-2023-35004/): Integer overflow in GTKWave (high 7.8)
- [CVE-2023-35003](https://insights.sbomify.com/CVE-2023-35003/): Path traversal in Intel(R) VROC software (medium 6.7)
- [CVE-2023-35002](https://insights.sbomify.com/CVE-2023-35002/): Memory corruption in ImageGear (critical 9.8)
- [CVE-2023-35001](https://insights.sbomify.com/CVE-2023-35001/): Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability (high 7.8)
- [CVE-2023-3500](https://insights.sbomify.com/CVE-2023-3500/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (medium 4.8)
- [CVE-2023-34999](https://insights.sbomify.com/CVE-2023-34999/): Command injection in VLink Virtual Matrix Software (high 8.4)
- [CVE-2023-34998](https://insights.sbomify.com/CVE-2023-34998/): Auth bypass in OAS Platform (high 8.1)
- [CVE-2023-34997](https://insights.sbomify.com/CVE-2023-34997/): Privilege escalation in Intel Server Configuration Utility software (medium 6.7)
- [CVE-2023-34995](https://insights.sbomify.com/CVE-2023-34995/): PiiGAB M-Bus Weak Password Requirements (high 7.5)
- [CVE-2023-34994](https://insights.sbomify.com/CVE-2023-34994/): Denial of service in OAS Platform (low 3.1)
- [CVE-2023-34993](https://insights.sbomify.com/CVE-2023-34993/): Command injection in FortiWLM (critical 9.6)
- [CVE-2023-34992](https://insights.sbomify.com/CVE-2023-34992/): Command injection in FortiSIEM (critical 9.7)
- [CVE-2023-34991](https://insights.sbomify.com/CVE-2023-34991/): SQL injection in FortiWLM (critical 9.3)
- [CVE-2023-34990](https://insights.sbomify.com/CVE-2023-34990/): Path traversal in FortiWLM (critical 9.6)
- [CVE-2023-3499](https://insights.sbomify.com/CVE-2023-3499/): Robo Gallery < 3.2.16 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-34989](https://insights.sbomify.com/CVE-2023-34989/): Command injection in FortiWLM (high 8.6)
- [CVE-2023-34988](https://insights.sbomify.com/CVE-2023-34988/): Command injection in FortiWLM (high 8.6)
- [CVE-2023-34987](https://insights.sbomify.com/CVE-2023-34987/): Command injection in FortiWLM (high 8.6)
- [CVE-2023-34986](https://insights.sbomify.com/CVE-2023-34986/): Command injection in FortiWLM (high 8.6)
- [CVE-2023-34985](https://insights.sbomify.com/CVE-2023-34985/): Command injection in FortiWLM (high 8.6)
- [CVE-2023-34984](https://insights.sbomify.com/CVE-2023-34984/): Security feature bypass in FortiWeb (high 7.1)
- [CVE-2023-34983](https://insights.sbomify.com/CVE-2023-34983/): Denial of service in Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software (medium 4.3)
- [CVE-2023-34982](https://insights.sbomify.com/CVE-2023-34982/): AVEVA Operations Control Logger External Control of File Name or Path (medium 5.5)
- [CVE-2023-34981](https://insights.sbomify.com/CVE-2023-34981/): Apache Tomcat: AJP response header mix-up (high 7.5)
- [CVE-2023-34980](https://insights.sbomify.com/CVE-2023-34980/): QTS, QuTS hero (medium 5.9)
- [CVE-2023-34979](https://insights.sbomify.com/CVE-2023-34979/): QTS, QuTS hero (medium 6.6)
- [CVE-2023-34977](https://insights.sbomify.com/CVE-2023-34977/): Video Station (medium 4.6)
- [CVE-2023-34976](https://insights.sbomify.com/CVE-2023-34976/): Video Station (critical 10.0)
- [CVE-2023-34975](https://insights.sbomify.com/CVE-2023-34975/): QTS, QuTS hero, QuTScloud (medium 6.6)
- [CVE-2023-34974](https://insights.sbomify.com/CVE-2023-34974/): QTS, QuTS hero, QuTScloud, QVR, QES (high 8.8)
- [CVE-2023-34973](https://insights.sbomify.com/CVE-2023-34973/): QTS, QuTS hero (low 3.1)
- [CVE-2023-34972](https://insights.sbomify.com/CVE-2023-34972/): QTS, QuTS hero and QuTScloud (low 3.5)
- [CVE-2023-34971](https://insights.sbomify.com/CVE-2023-34971/): QTS, QuTS hero (high 7.1)
- [CVE-2023-34970](https://insights.sbomify.com/CVE-2023-34970/): Mali GPU Kernel Driver Allows Improper GPU Memory Processing Operations (medium 4.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/289/