# Vulnerabilities published in 2023


- [CVE-2023-34185](https://insights.sbomify.com/CVE-2023-34185/): WordPress NextGen GalleryView Plugin <= 0.5.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-34184](https://insights.sbomify.com/CVE-2023-34184/): WordPress Woocommerce Order address Print Plugin <= 3.2 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-34183](https://insights.sbomify.com/CVE-2023-34183/): WordPress Unite Gallery Lite Plugin <= 1.7.61 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-34182](https://insights.sbomify.com/CVE-2023-34182/): WordPress LH Password Changer Plugin <= 1.55 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-34181](https://insights.sbomify.com/CVE-2023-34181/): WordPress WP-Cirrus Plugin <= 0.6.11 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-34180](https://insights.sbomify.com/CVE-2023-34180/): WordPress Google Fonts For WordPress Plugin <= 3.0.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-34179](https://insights.sbomify.com/CVE-2023-34179/): WordPress Groundhogg Plugin <= 2.7.11 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-34178](https://insights.sbomify.com/CVE-2023-34178/): WordPress Groundhogg Plugin <= 2.7.11 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-34177](https://insights.sbomify.com/CVE-2023-34177/): WordPress WP-Cache.com Plugin <= 1.1.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-34176](https://insights.sbomify.com/CVE-2023-34176/): WordPress Chilexpress woo oficial Plugin <= 1.2.9 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-34175](https://insights.sbomify.com/CVE-2023-34175/): WordPress Login Configurator Plugin <= 2.1 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-34174](https://insights.sbomify.com/CVE-2023-34174/): WordPress BBS e-Popup Plugin <= 2.4.5 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-34173](https://insights.sbomify.com/CVE-2023-34173/): WordPress Yandex Metrica Counter Plugin <= 1.4.3 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-34172](https://insights.sbomify.com/CVE-2023-34172/): WordPress WordPress Social Login Plugin <= 3.0.4 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-34171](https://insights.sbomify.com/CVE-2023-34171/): WordPress WP Report Post Plugin <= 2.1.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-34170](https://insights.sbomify.com/CVE-2023-34170/): WordPress Quick/Bulk Order Form for WooCommerce Plugin <= 3.5.7 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-3417](https://insights.sbomify.com/CVE-2023-3417/): File Extension Spoofing using the Text Direction Override Character (high 7.5)
- [CVE-2023-34169](https://insights.sbomify.com/CVE-2023-34169/): WordPress TS Webfonts for さくらのレンタルサーバ Plugin <= 3.1.2 is vulnerable to Broken Access Control (medium 6.5)
- [CVE-2023-34168](https://insights.sbomify.com/CVE-2023-34168/): WordPress WP Report Post Plugin <= 2.1.2 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-34167](https://insights.sbomify.com/CVE-2023-34167/): Security feature bypass in EMUI (medium 5.3)
- [CVE-2023-34166](https://insights.sbomify.com/CVE-2023-34166/): Denial of service in EMUI (high 7.5)
- [CVE-2023-34165](https://insights.sbomify.com/CVE-2023-34165/): Missing authorization in HarmonyOS (medium 5.3)
- [CVE-2023-34164](https://insights.sbomify.com/CVE-2023-34164/): Null dereference in EMUI (high 7.5)
- [CVE-2023-34163](https://insights.sbomify.com/CVE-2023-34163/): Missing authorization in EMUI (high 7.5)
- [CVE-2023-34162](https://insights.sbomify.com/CVE-2023-34162/): Denial of service in EMUI (high 7.5)
- [CVE-2023-34161](https://insights.sbomify.com/CVE-2023-34161/): Missing authorization in EMUI (high 7.5)
- [CVE-2023-34160](https://insights.sbomify.com/CVE-2023-34160/): Security feature bypass in EMUI (medium 5.3)
- [CVE-2023-3416](https://insights.sbomify.com/CVE-2023-3416/): tagDiv Opt-In Builder <= 1.4.4 - Authenticated (Admin+) SQL Injection (high 7.2)
- [CVE-2023-34159](https://insights.sbomify.com/CVE-2023-34159/): Privilege escalation in EMUI (critical 9.8)
- [CVE-2023-34158](https://insights.sbomify.com/CVE-2023-34158/): Security feature bypass in EMUI (medium 5.3)
- [CVE-2023-34157](https://insights.sbomify.com/CVE-2023-34157/): Other in HarmonyOS (critical 10.0)
- [CVE-2023-34156](https://insights.sbomify.com/CVE-2023-34156/): Denial of service in EMUI (medium 5.3)
- [CVE-2023-34155](https://insights.sbomify.com/CVE-2023-34155/): Missing authorization in EMUI (high 7.5)
- [CVE-2023-34154](https://insights.sbomify.com/CVE-2023-34154/): Misconfiguration in HarmonyOS (high 8.2)
- [CVE-2023-34153](https://insights.sbomify.com/CVE-2023-34153/): Command injection in ImageMagick (high 7.8)
- [CVE-2023-34152](https://insights.sbomify.com/CVE-2023-34152/): Command injection in ImageMagick (critical 9.8)
- [CVE-2023-34151](https://insights.sbomify.com/CVE-2023-34151/): Integer overflow in ImageMagick (medium 5.5)
- [CVE-2023-34150](https://insights.sbomify.com/CVE-2023-34150/): Apache Any23: Possible excessive allocation of resources reading input. (medium 6.5)
- [CVE-2023-34149](https://insights.sbomify.com/CVE-2023-34149/): Apache Struts: DoS via OOM owing to not properly checking of list bounds (medium 4.3)
- [CVE-2023-34148](https://insights.sbomify.com/CVE-2023-34148/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2023-34147](https://insights.sbomify.com/CVE-2023-34147/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2023-34146](https://insights.sbomify.com/CVE-2023-34146/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2023-34145](https://insights.sbomify.com/CVE-2023-34145/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2023-34144](https://insights.sbomify.com/CVE-2023-34144/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2023-34143](https://insights.sbomify.com/CVE-2023-34143/): Improper Validation of Certificate Vulnerability in Hitachi Device Manager (medium 5.6)
- [CVE-2023-34142](https://insights.sbomify.com/CVE-2023-34142/): Cleartext Transmission Vulnerability in Hitachi Device Manager (critical 9.0)
- [CVE-2023-34141](https://insights.sbomify.com/CVE-2023-34141/): Command injection in ATP series firmware (high 8.0)
- [CVE-2023-34140](https://insights.sbomify.com/CVE-2023-34140/): Memory corruption in ATP series firmware (medium 6.5)
- [CVE-2023-3414](https://insights.sbomify.com/CVE-2023-3414/): Cross-Site Request Forgery (CSRF) in Jenkins Plug-in for ServiceNow DevOps (medium 6.1)
- [CVE-2023-34139](https://insights.sbomify.com/CVE-2023-34139/): Command injection in USG FLEX series firmware (high 8.8)
- [CVE-2023-34138](https://insights.sbomify.com/CVE-2023-34138/): Command injection in ATP series firmware (high 8.0)
- [CVE-2023-34137](https://insights.sbomify.com/CVE-2023-34137/): Auth bypass in Analytics (critical 9.8)
- [CVE-2023-34136](https://insights.sbomify.com/CVE-2023-34136/): File upload in Analytics (critical 9.8)
- [CVE-2023-34135](https://insights.sbomify.com/CVE-2023-34135/): Path traversal in Analytics (medium 6.5)
- [CVE-2023-34134](https://insights.sbomify.com/CVE-2023-34134/): Information disclosure in Analytics (medium 6.5)
- [CVE-2023-34133](https://insights.sbomify.com/CVE-2023-34133/): SQL injection in Analytics (high 7.5)
- [CVE-2023-34132](https://insights.sbomify.com/CVE-2023-34132/): Auth bypass in Analytics (critical 9.8)
- [CVE-2023-34131](https://insights.sbomify.com/CVE-2023-34131/): Information disclosure in Analytics (medium 5.3)
- [CVE-2023-34130](https://insights.sbomify.com/CVE-2023-34130/): Weak cryptography in Analytics (critical 9.8)
- [CVE-2023-3413](https://insights.sbomify.com/CVE-2023-3413/): Insertion of Sensitive Information Into Sent Data in GitLab (medium 6.5)
- [CVE-2023-34129](https://insights.sbomify.com/CVE-2023-34129/): Path traversal in Analytics (high 8.8)
- [CVE-2023-34128](https://insights.sbomify.com/CVE-2023-34128/): Hardcoded credentials in Analytics (critical 9.8)
- [CVE-2023-34127](https://insights.sbomify.com/CVE-2023-34127/): Command injection in Analytics (high 8.8)
- [CVE-2023-34126](https://insights.sbomify.com/CVE-2023-34126/): File upload in Analytics (high 8.8)
- [CVE-2023-34125](https://insights.sbomify.com/CVE-2023-34125/): Path traversal in Analytics (medium 6.5)
- [CVE-2023-34124](https://insights.sbomify.com/CVE-2023-34124/): Auth bypass in Analytics (critical 9.8)
- [CVE-2023-34123](https://insights.sbomify.com/CVE-2023-34123/): Hardcoded credentials in Analytics (high 7.5)
- [CVE-2023-34121](https://insights.sbomify.com/CVE-2023-34121/): Cross-site scripting in Zoom Rooms Client for Windows (medium 4.1)
- [CVE-2023-34120](https://insights.sbomify.com/CVE-2023-34120/): Privilege escalation in Zoom Rooms Client for Windows (high 8.7)
- [CVE-2023-3412](https://insights.sbomify.com/CVE-2023-3412/): Missing authorization in Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite (medium 6.4)
- [CVE-2023-34119](https://insights.sbomify.com/CVE-2023-34119/): Privilege escalation in Zoom Rooms for Windows (high 8.2)
- [CVE-2023-34118](https://insights.sbomify.com/CVE-2023-34118/): Privilege escalation in Zoom Rooms for Windows (high 7.3)
- [CVE-2023-34117](https://insights.sbomify.com/CVE-2023-34117/): Path traversal in Zoom Client SDK (low 3.3)
- [CVE-2023-34116](https://insights.sbomify.com/CVE-2023-34116/): Command injection in Zoom Desktop Client for Windows (high 8.2)
- [CVE-2023-34115](https://insights.sbomify.com/CVE-2023-34115/): Memory corruption in Zoom Meeting SDK (medium 4.3)
- [CVE-2023-34114](https://insights.sbomify.com/CVE-2023-34114/): Information disclosure in Zoom for MacOS Client (high 7.4)
- [CVE-2023-34112](https://insights.sbomify.com/CVE-2023-34112/): JavaCPP project actions vulnerable to code injection (medium 4.3)
- [CVE-2023-34111](https://insights.sbomify.com/CVE-2023-34111/): Command Injection Vulnerability in `Release PR Merged` Workflow in taosdata/grafanaplugin (high 8.1)
- [CVE-2023-34110](https://insights.sbomify.com/CVE-2023-34110/): Flask-AppBuilder vulnerable to possible disclosure of sensitive information on user error (low 2.7)
- [CVE-2023-3411](https://insights.sbomify.com/CVE-2023-3411/): Cross-site request forgery in Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite (medium 6.1)
- [CVE-2023-34109](https://insights.sbomify.com/CVE-2023-34109/): User input results in Unbounded resource consumption in @zxcvbn-ts/core (medium 6.5)
- [CVE-2023-34108](https://insights.sbomify.com/CVE-2023-34108/): Manipulation of Internal Dovecot Variables in mailcow via crafted Passwords (high 8.8)
- [CVE-2023-34107](https://insights.sbomify.com/CVE-2023-34107/): GLPI vulnerable to unauthorized access to KnowbaseItem data (medium 6.5)
- [CVE-2023-34106](https://insights.sbomify.com/CVE-2023-34106/): GLPI vulnerable to unauthorized access to User data (medium 6.5)
- [CVE-2023-34105](https://insights.sbomify.com/CVE-2023-34105/): SRS has command injection vulnerability in demonstration api-server for HTTP callback. (high 7.5)
- [CVE-2023-34104](https://insights.sbomify.com/CVE-2023-34104/): Regex Injection via Doctype Entities (high 7.5)
- [CVE-2023-34103](https://insights.sbomify.com/CVE-2023-34103/): Stored XSS (Cross Site Scripting) in html content based fields of avo (high 7.3)
- [CVE-2023-34102](https://insights.sbomify.com/CVE-2023-34102/): Possible unsafe reflection / partial denial of service in avo (high 8.3)
- [CVE-2023-34101](https://insights.sbomify.com/CVE-2023-34101/): Contiki-NG vulnerable to out-of-bounds read when processing ICMP DAO input (high 7.3)
- [CVE-2023-34100](https://insights.sbomify.com/CVE-2023-34100/): Out-of-Bounds Read in contiki-ng (high 7.3)
- [CVE-2023-3410](https://insights.sbomify.com/CVE-2023-3410/): Bricks <= 1.10.1 - Authenticated (Bricks Page Builder Access+) Stored Cross-Site Scripting (medium 5.4)
- [CVE-2023-34099](https://insights.sbomify.com/CVE-2023-34099/): Improper mail validation in Shopware (medium 5.3)
- [CVE-2023-34098](https://insights.sbomify.com/CVE-2023-34098/): Dependency configuration exposed in Shopware (medium 5.3)
- [CVE-2023-34097](https://insights.sbomify.com/CVE-2023-34097/): Database password exposed in logs in hoppscotch (high 7.8)
- [CVE-2023-34096](https://insights.sbomify.com/CVE-2023-34096/): Thruk has Path Traversal Vulnerability in panorama.pm (medium 6.5)
- [CVE-2023-34095](https://insights.sbomify.com/CVE-2023-34095/): cpdb-libs vulnerable to buffer overflows via scanf (critical 9.8)
- [CVE-2023-34094](https://insights.sbomify.com/CVE-2023-34094/): ChuanhuChatGPT vulnerable to unauthorized configuration file access (high 7.5)
- [CVE-2023-34093](https://insights.sbomify.com/CVE-2023-34093/): Strapi allows actors to make all attributes on a content-type public without noticing it (medium 4.8)
- [CVE-2023-34092](https://insights.sbomify.com/CVE-2023-34092/): Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) (high 7.5)
- [CVE-2023-34091](https://insights.sbomify.com/CVE-2023-34091/): Kyverno resource with a deletionTimestamp may allow policy circumvention (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/295/