# Vulnerabilities published in 2023


- [CVE-2023-34381](https://insights.sbomify.com/CVE-2023-34381/): WordPress Zippy plugin <= 1.6.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-3438](https://insights.sbomify.com/CVE-2023-3438/): Privilege escalation in Trellix Move (medium 4.4)
- [CVE-2023-34379](https://insights.sbomify.com/CVE-2023-34379/): WordPress Cart2Cart: Magento to WooCommerce Migration Plugin <= 2.0.0 is vulnerable to Broken Access Control (medium 5.4)
- [CVE-2023-34378](https://insights.sbomify.com/CVE-2023-34378/): WordPress WP Hide Post Plugin <= 2.0.10 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-34377](https://insights.sbomify.com/CVE-2023-34377/): WordPress My Content Management Plugin <= 1.7.6 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-34376](https://insights.sbomify.com/CVE-2023-34376/): WordPress Change WooCommerce Add To Cart Button Text plugin <= 1.3 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-34375](https://insights.sbomify.com/CVE-2023-34375/): WordPress Seo By 10Web Plugin <= 1.2.9 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-34374](https://insights.sbomify.com/CVE-2023-34374/): WordPress AnsPress – Question and answer Plugin <= 4.3.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-34373](https://insights.sbomify.com/CVE-2023-34373/): WordPress Zephyr Project Manager Plugin <= 3.3.93 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-34372](https://insights.sbomify.com/CVE-2023-34372/): WordPress Download SpamReferrerBlock Plugin <= 2.22 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-34371](https://insights.sbomify.com/CVE-2023-34371/): WordPress Download SpamReferrerBlock Plugin <= 2.22 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-34370](https://insights.sbomify.com/CVE-2023-34370/): Server Side Request Forgery (SSRF) vulnerability in Starter Templates plugins (high 7.1)
- [CVE-2023-34369](https://insights.sbomify.com/CVE-2023-34369/): WordPress Login Configurator Plugin <= 2.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-34368](https://insights.sbomify.com/CVE-2023-34368/): WordPress Kanban Boards for WordPress Plugin <= 2.5.20 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-34367](https://insights.sbomify.com/CVE-2023-34367/): Auth bypass in microsoft:windows 7 (medium 6.5)
- [CVE-2023-34366](https://insights.sbomify.com/CVE-2023-34366/): Use after free in Ichitaro 2023 (high 7.8)
- [CVE-2023-34365](https://insights.sbomify.com/CVE-2023-34365/): Memory corruption in YF325 (critical 9.8)
- [CVE-2023-34364](https://insights.sbomify.com/CVE-2023-34364/): Memory corruption in progress:datadirect odbc oracle wire protocol driver (critical 9.8)
- [CVE-2023-34363](https://insights.sbomify.com/CVE-2023-34363/): Weak cryptography in progress:datadirect odbc oracle wire protocol driver (medium 5.9)
- [CVE-2023-34362](https://insights.sbomify.com/CVE-2023-34362/): Progress MOVEit Transfer SQL Injection (critical 9.8, exploited in the wild)
- [CVE-2023-34360](https://insights.sbomify.com/CVE-2023-34360/): ASUS RT-AX88U - Stored XSS (high 8.2)
- [CVE-2023-3436](https://insights.sbomify.com/CVE-2023-3436/): Deadlock in Xpdf 4.04 due to PDF object stream references (low 3.3)
- [CVE-2023-34359](https://insights.sbomify.com/CVE-2023-34359/): ASUS RT-AX88U - Out-of-bounds Read - 2 (high 7.5)
- [CVE-2023-34358](https://insights.sbomify.com/CVE-2023-34358/): ASUS RT-AX88U - Out-of-bounds Read - 1 (high 7.5)
- [CVE-2023-34357](https://insights.sbomify.com/CVE-2023-34357/): Soar Cloud Ltd. HR Portal - Weak Password Recovery Mechanism for Forgotten Password (high 7.8)
- [CVE-2023-34356](https://insights.sbomify.com/CVE-2023-34356/): Command injection in Surf SOHO HW1 (high 7.2)
- [CVE-2023-34355](https://insights.sbomify.com/CVE-2023-34355/): Privilege escalation in Intel(R) Server Board M10JNP2SB integrated BMC video drivers (medium 6.7)
- [CVE-2023-34354](https://insights.sbomify.com/CVE-2023-34354/): Cross-site scripting in Surf SOHO HW1 (low 3.4)
- [CVE-2023-34353](https://insights.sbomify.com/CVE-2023-34353/): Weak cryptography in OAS Platform (high 7.5)
- [CVE-2023-34352](https://insights.sbomify.com/CVE-2023-34352/): Information disclosure in iOS and iPadOS (medium 5.3)
- [CVE-2023-34351](https://insights.sbomify.com/CVE-2023-34351/): Memory corruption in Intel(R) PCM software (high 7.5)
- [CVE-2023-34350](https://insights.sbomify.com/CVE-2023-34350/): Privilege escalation in Intel(R) XTU software (medium 6.7)
- [CVE-2023-3435](https://insights.sbomify.com/CVE-2023-3435/): User Activity Log < 1.6.5 - Unauthenticated SQLi (critical 9.8)
- [CVE-2023-34349](https://insights.sbomify.com/CVE-2023-34349/): Race condition in Intel(R) NUC BIOS firmware (medium 4.6)
- [CVE-2023-34348](https://insights.sbomify.com/CVE-2023-34348/): Improper Check or Handling of Exceptional Conditions in Aveva PI Server (high 7.5)
- [CVE-2023-34347](https://insights.sbomify.com/CVE-2023-34347/): ​Delta Electronics InfraSuite Device Master Deserialization of Untrusted Data (critical 9.8)
- [CVE-2023-34346](https://insights.sbomify.com/CVE-2023-34346/): Memory corruption in YF325 (critical 9.8)
- [CVE-2023-34345](https://insights.sbomify.com/CVE-2023-34345/): Path traversal in MegaRAC SPx (medium 6.5)
- [CVE-2023-34344](https://insights.sbomify.com/CVE-2023-34344/): A vulnerability in the IPMI handler, where an unauthorized attacker can use certain oracles to guess a valid username (medium 5.3)
- [CVE-2023-34343](https://insights.sbomify.com/CVE-2023-34343/): Command injection in MegaRAC SPx (high 7.2)
- [CVE-2023-34342](https://insights.sbomify.com/CVE-2023-34342/): Path traversal in MegaRAC SPx (medium 6.0)
- [CVE-2023-34341](https://insights.sbomify.com/CVE-2023-34341/): Memory corruption in MegaRAC SPx (high 7.2)
- [CVE-2023-34340](https://insights.sbomify.com/CVE-2023-34340/): Apache Accumulo: Accumulo 2.1.0 may incorrectly validate cached credentials (critical 9.8)
- [CVE-2023-3434](https://insights.sbomify.com/CVE-2023-3434/): QRC Handler without Input Validation in Jami (medium 4.4)
- [CVE-2023-34339](https://insights.sbomify.com/CVE-2023-34339/): Information disclosure in Ktor (low 3.3)
- [CVE-2023-34338](https://insights.sbomify.com/CVE-2023-34338/): hard coded cryptographic key (high 7.1)
- [CVE-2023-34337](https://insights.sbomify.com/CVE-2023-34337/): Inadequate Encryption Strength (high 7.6)
- [CVE-2023-34336](https://insights.sbomify.com/CVE-2023-34336/): Memory corruption in MegaRAC SPx (high 8.1)
- [CVE-2023-34335](https://insights.sbomify.com/CVE-2023-34335/): Auth bypass in MegaRAC SPx (high 7.7)
- [CVE-2023-34334](https://insights.sbomify.com/CVE-2023-34334/): Command injection in MegaRAC SPx (high 7.2)
- [CVE-2023-34333](https://insights.sbomify.com/CVE-2023-34333/): Untrusted Pointer Dereference (high 7.8)
- [CVE-2023-34332](https://insights.sbomify.com/CVE-2023-34332/): Untrusted Pointer Dereference in BMC (high 7.8)
- [CVE-2023-34330](https://insights.sbomify.com/CVE-2023-34330/): Code injection via Dynamic Redfish Extension interface (high 8.2)
- [CVE-2023-3433](https://insights.sbomify.com/CVE-2023-3433/): Local Denial of Service in Jami (medium 5.5)
- [CVE-2023-34329](https://insights.sbomify.com/CVE-2023-34329/): Authentication Bypass via HTTP Header Spoofing (critical 9.1)
- [CVE-2023-34328](https://insights.sbomify.com/CVE-2023-34328/): x86/AMD: Debug Mask handling (medium 5.5)
- [CVE-2023-34327](https://insights.sbomify.com/CVE-2023-34327/): x86/AMD: Debug Mask handling (medium 5.5)
- [CVE-2023-34326](https://insights.sbomify.com/CVE-2023-34326/): x86/AMD: missing IOMMU TLB flushing (high 7.8)
- [CVE-2023-34325](https://insights.sbomify.com/CVE-2023-34325/): Multiple vulnerabilities in libfsimage disk handling (high 7.8)
- [CVE-2023-34324](https://insights.sbomify.com/CVE-2023-34324/): Possible deadlock in Linux kernel event handling (medium 4.9)
- [CVE-2023-34323](https://insights.sbomify.com/CVE-2023-34323/): xenstored: A transaction conflict can crash C Xenstored (medium 5.5)
- [CVE-2023-34322](https://insights.sbomify.com/CVE-2023-34322/): top-level shadow reference dropped too early for 64-bit PV guests (high 7.8)
- [CVE-2023-34321](https://insights.sbomify.com/CVE-2023-34321/): arm32: The cache may not be properly cleaned/invalidated (low 3.3)
- [CVE-2023-34320](https://insights.sbomify.com/CVE-2023-34320/): arm: Guests can trigger a deadlock on Cortex-A77 (medium 5.5)
- [CVE-2023-3432](https://insights.sbomify.com/CVE-2023-3432/): Server-Side Request Forgery (SSRF) in plantuml/plantuml (high 7.2)
- [CVE-2023-34319](https://insights.sbomify.com/CVE-2023-34319/): Linux: buffer overrun in netback due to unusual packet (high 7.8)
- [CVE-2023-34318](https://insights.sbomify.com/CVE-2023-34318/): Heap-buffer-overflow in src/hcom.c (high 7.8)
- [CVE-2023-34317](https://insights.sbomify.com/CVE-2023-34317/): Other in OAS Platform (medium 6.5)
- [CVE-2023-34316](https://insights.sbomify.com/CVE-2023-34316/): Delta Electronics InfraSuite Device Master Improper Access Control (medium 6.5)
- [CVE-2023-34315](https://insights.sbomify.com/CVE-2023-34315/): Misconfiguration in Intel(R) VROC software (medium 6.7)
- [CVE-2023-34314](https://insights.sbomify.com/CVE-2023-34314/): Privilege escalation in Intel(R) Simics Simulator software (medium 6.7)
- [CVE-2023-34312](https://insights.sbomify.com/CVE-2023-34312/): Memory corruption in tencent:qq (high 7.8)
- [CVE-2023-34311](https://insights.sbomify.com/CVE-2023-34311/): Ashlar-Vellum Cobalt Untrusted Pointer Dereference Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-34310](https://insights.sbomify.com/CVE-2023-34310/): Ashlar-Vellum Cobalt Uninitialized Memory Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-3431](https://insights.sbomify.com/CVE-2023-3431/): Improper Access Control in plantuml/plantuml (medium 5.3)
- [CVE-2023-34309](https://insights.sbomify.com/CVE-2023-34309/): Ashlar-Vellum Cobalt Untrusted Pointer Dereference Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-34308](https://insights.sbomify.com/CVE-2023-34308/): Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-34307](https://insights.sbomify.com/CVE-2023-34307/): Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-34306](https://insights.sbomify.com/CVE-2023-34306/): Ashlar-Vellum Graphite VC6 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-34305](https://insights.sbomify.com/CVE-2023-34305/): Ashlar-Vellum Cobalt Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.0)
- [CVE-2023-34304](https://insights.sbomify.com/CVE-2023-34304/): Ashlar-Vellum Cobalt Out-Of-Bounds Access Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-34303](https://insights.sbomify.com/CVE-2023-34303/): Ashlar-Vellum Cobalt Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-34302](https://insights.sbomify.com/CVE-2023-34302/): Ashlar-Vellum Cobalt CO File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-34301](https://insights.sbomify.com/CVE-2023-34301/): Ashlar-Vellum Cobalt CO File Parsing Untrusted Pointer Dereference Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-34300](https://insights.sbomify.com/CVE-2023-34300/): Ashlar-Vellum Cobalt XE File Parsing Untrusted Pointer Dereference Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-3430](https://insights.sbomify.com/CVE-2023-3430/): Openimageio: heap-buffer-overflow in file src/gif.imageio/gifinput.cpp (high 7.5)
- [CVE-2023-34299](https://insights.sbomify.com/CVE-2023-34299/): Ashlar-Vellum Cobalt CO File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-34298](https://insights.sbomify.com/CVE-2023-34298/): Pulse Secure Client SetupService Directory Traversal Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2023-34297](https://insights.sbomify.com/CVE-2023-34297/): Sante DICOM Viewer Pro JP2 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-34296](https://insights.sbomify.com/CVE-2023-34296/): Sante DICOM Viewer Pro DCM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-34295](https://insights.sbomify.com/CVE-2023-34295/): Sante DICOM Viewer Pro DCM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-34294](https://insights.sbomify.com/CVE-2023-34294/): Sante DICOM Viewer Pro DCM File Parsing Use-After-Free Information Disclosure Vulnerability (low 3.3)
- [CVE-2023-34293](https://insights.sbomify.com/CVE-2023-34293/): Ashlar-Vellum Cobalt Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.0)
- [CVE-2023-34292](https://insights.sbomify.com/CVE-2023-34292/): Ashlar-Vellum Cobalt Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-34291](https://insights.sbomify.com/CVE-2023-34291/): Ashlar-Vellum Cobalt Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-34290](https://insights.sbomify.com/CVE-2023-34290/): Ashlar-Vellum Cobalt Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-34289](https://insights.sbomify.com/CVE-2023-34289/): Ashlar-Vellum Cobalt Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-34288](https://insights.sbomify.com/CVE-2023-34288/): Ashlar-Vellum Cobalt XE File Parsing Uninitialized Pointer Remote Code Execution Vulnerability (high 7.0)
- [CVE-2023-34287](https://insights.sbomify.com/CVE-2023-34287/): Ashlar-Vellum Cobalt CO File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-34286](https://insights.sbomify.com/CVE-2023-34286/): Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/293/