# Vulnerabilities published in 2023


- [CVE-2023-34090](https://insights.sbomify.com/CVE-2023-34090/): Decidim vulnerable to sensitive data disclosure (high 7.5)
- [CVE-2023-3409](https://insights.sbomify.com/CVE-2023-3409/): Bricks <= 1.8.1 - Cross-Site Request Forgery via reset_settings (medium 5.4)
- [CVE-2023-34089](https://insights.sbomify.com/CVE-2023-34089/): Decidim Cross-site Scripting vulnerability in the processes filter (high 8.1)
- [CVE-2023-34088](https://insights.sbomify.com/CVE-2023-34088/): Collabora Online has Stored Cross-Site-Scripting vulnerability in admin interface (high 8.7)
- [CVE-2023-34087](https://insights.sbomify.com/CVE-2023-34087/): Memory corruption in GTKWave (high 7.8)
- [CVE-2023-34086](https://insights.sbomify.com/CVE-2023-34086/): Privilege escalation in Intel(R) NUC BIOS firmware (high 8.2)
- [CVE-2023-34085](https://insights.sbomify.com/CVE-2023-34085/): User Attribute Disclosure via DynamoDB Data Stores (low 2.6)
- [CVE-2023-3408](https://insights.sbomify.com/CVE-2023-3408/): Bricks <= 1.8.1 - Cross-Site Request Forgery via save_settings (medium 4.3)
- [CVE-2023-3407](https://insights.sbomify.com/CVE-2023-3407/): Subscribe2 <= 10.40 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2023-34064](https://insights.sbomify.com/CVE-2023-34064/): Privilege Escalation Vulnerability (medium 4.6)
- [CVE-2023-34063](https://insights.sbomify.com/CVE-2023-34063/): Missing authorization in VMware Aria Automation, VMware Cloud Foundation (critical 9.9)
- [CVE-2023-34062](https://insights.sbomify.com/CVE-2023-34062/): In Reactor Netty HTTP Server a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack (high 7.5)
- [CVE-2023-34061](https://insights.sbomify.com/CVE-2023-34061/): CVE-2023-34061 – Gorouter route pruning (high 7.5)
- [CVE-2023-34060](https://insights.sbomify.com/CVE-2023-34060/): Auth bypass in VMware Cloud Director Appliance (VCD Appliance) (critical 9.8)
- [CVE-2023-3406](https://insights.sbomify.com/CVE-2023-3406/): Path traversal issue in M-Files Classic Web (high 7.7)
- [CVE-2023-34059](https://insights.sbomify.com/CVE-2023-34059/): Privilege escalation in open-vm-tools (high 7.4)
- [CVE-2023-34058](https://insights.sbomify.com/CVE-2023-34058/): Security feature bypass in VMware Tools (high 7.1)
- [CVE-2023-34057](https://insights.sbomify.com/CVE-2023-34057/): Privilege escalation in VMware Tools (high 7.8)
- [CVE-2023-34056](https://insights.sbomify.com/CVE-2023-34056/): VMware vCenter Server Partial Information Disclosure Vulnerability (medium 4.3)
- [CVE-2023-34055](https://insights.sbomify.com/CVE-2023-34055/): Spring Boot server Web Observations DoS Vulnerability (medium 5.3)
- [CVE-2023-34054](https://insights.sbomify.com/CVE-2023-34054/): Reactor Netty HTTP Server Metrics DoS Vulnerability (medium 5.3)
- [CVE-2023-34053](https://insights.sbomify.com/CVE-2023-34053/): Spring Framework server Web Observations DoS Vulnerability (medium 5.3)
- [CVE-2023-34052](https://insights.sbomify.com/CVE-2023-34052/): Deserialization in VMware Aria Operations for Logs (high 7.8)
- [CVE-2023-34051](https://insights.sbomify.com/CVE-2023-34051/): Auth bypass in VMware Aria Operations for Logs (critical 9.8)
- [CVE-2023-34050](https://insights.sbomify.com/CVE-2023-34050/): Spring AMQP Deserialization Vulnerability (medium 5.0)
- [CVE-2023-3405](https://insights.sbomify.com/CVE-2023-3405/): Denial of service condition in M-Files Server (high 7.5)
- [CVE-2023-34049](https://insights.sbomify.com/CVE-2023-34049/): Salt security advisory release - 2023-OCT-27 (medium 6.7)
- [CVE-2023-34048](https://insights.sbomify.com/CVE-2023-34048/): VMware vCenter Server Out-of-Bounds Write (critical 9.8, exploited in the wild)
- [CVE-2023-34047](https://insights.sbomify.com/CVE-2023-34047/): Exposure of data and identity to wrong session in Spring for GraphQL (low 3.1)
- [CVE-2023-34046](https://insights.sbomify.com/CVE-2023-34046/): VMware Fusion TOCTOU local privilege escalation vulnerability (medium 6.7)
- [CVE-2023-34045](https://insights.sbomify.com/CVE-2023-34045/): VMware Fusion installer local privilege escalation (medium 6.6)
- [CVE-2023-34044](https://insights.sbomify.com/CVE-2023-34044/): Information disclosure vulnerability in bluetooth device-sharing functionality (high 7.1)
- [CVE-2023-34043](https://insights.sbomify.com/CVE-2023-34043/): Privilege escalation in VMware Aria Operations (medium 6.7)
- [CVE-2023-34042](https://insights.sbomify.com/CVE-2023-34042/): Spring Security's spring-security.xsd file is world writable (medium 4.1)
- [CVE-2023-34041](https://insights.sbomify.com/CVE-2023-34041/): CVE-2023-34041-Abuse of HTTP Hop-by-Hop Headers in Cloud Foundry Gorouter (medium 5.3)
- [CVE-2023-34040](https://insights.sbomify.com/CVE-2023-34040/): Java Deserialization vulnerability in Spring-Kafka When Improperly Configured (medium 5.3)
- [CVE-2023-3404](https://insights.sbomify.com/CVE-2023-3404/): ProfileGrid <= 5.5.0 - Hardcoded Encryption Key (medium 4.9)
- [CVE-2023-34039](https://insights.sbomify.com/CVE-2023-34039/): Auth bypass in Aria Operations for Networks (critical 9.8)
- [CVE-2023-34038](https://insights.sbomify.com/CVE-2023-34038/): Information disclosure in VMware Horizon Server (medium 5.3)
- [CVE-2023-34037](https://insights.sbomify.com/CVE-2023-34037/): Other in VMware Horizon Server (medium 5.3)
- [CVE-2023-34036](https://insights.sbomify.com/CVE-2023-34036/): Forwarded header exploit with Spring HATEOAS on WebFlux (medium 5.3)
- [CVE-2023-34035](https://insights.sbomify.com/CVE-2023-34035/): Spring Security's authorization rules can be misconfigured when using multiple servlets (high 7.3)
- [CVE-2023-34034](https://insights.sbomify.com/CVE-2023-34034/): Access Control Bypass in Spring Security (critical 9.1)
- [CVE-2023-34033](https://insights.sbomify.com/CVE-2023-34033/): WordPress Ajax Pagination and Infinite Scroll Plugin <= 2.0.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-34032](https://insights.sbomify.com/CVE-2023-34032/): WordPress bbPress Toolkit Plugin <= 1.0.12 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-34031](https://insights.sbomify.com/CVE-2023-34031/): WordPress bbPress Toolkit Plugin <= 1.0.12 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-34030](https://insights.sbomify.com/CVE-2023-34030/): WordPress Complianz and Complianz Premium plugins - Cross Site Request Forgery (CSRF) (medium 6.5)
- [CVE-2023-3403](https://insights.sbomify.com/CVE-2023-3403/): ProfileGrid <= 5.5.1 - Missing Authorization to User Import (medium 5.4)
- [CVE-2023-34029](https://insights.sbomify.com/CVE-2023-34029/): WordPress Disable WordPress Update Notifications Plugin <= 2.3.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-34028](https://insights.sbomify.com/CVE-2023-34028/): WordPress WOLF Plugin <= 1.0.7 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-34027](https://insights.sbomify.com/CVE-2023-34027/): WordPress Recently Viewed Products Plugin <= 1.0.0 is vulnerable to PHP Object Injection (high 8.3)
- [CVE-2023-34026](https://insights.sbomify.com/CVE-2023-34026/): WordPress This Day In History Plugin <= 3.10.1 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-34025](https://insights.sbomify.com/CVE-2023-34025/): WordPress LWS Hide Login Plugin <= 2.1.6 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-34024](https://insights.sbomify.com/CVE-2023-34024/): WordPress WP Full Auto Tags Manager Plugin <= 2.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-34023](https://insights.sbomify.com/CVE-2023-34023/): WordPress WordPress Social Login Plugin <= 3.0.4 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-34022](https://insights.sbomify.com/CVE-2023-34022/): WordPress Dynamic QR Code Generator Plugin <= 0.0.5 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-34021](https://insights.sbomify.com/CVE-2023-34021/): WordPress Church Admin Plugin <= 3.7.29 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-34020](https://insights.sbomify.com/CVE-2023-34020/): WordPress Uncanny Toolkit for LearnDash plugin <= 3.6.4.3 - Open Redirection vulnerability (medium 4.7)
- [CVE-2023-34019](https://insights.sbomify.com/CVE-2023-34019/): WordPress Uncanny Toolkit for LearnDash plugin <= 3.6.4.3 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-34018](https://insights.sbomify.com/CVE-2023-34018/): WordPress SoundCloud Shortcode Plugin <= 3.1.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-34017](https://insights.sbomify.com/CVE-2023-34017/): WordPress Five Star Restaurant Reservations Plugin <= 2.6.7 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-34015](https://insights.sbomify.com/CVE-2023-34015/): WordPress Advanced Flat rate shipping Woocommerce Plugin <= 1.6.4.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-34014](https://insights.sbomify.com/CVE-2023-34014/): WordPress Grid Plus plugin <= 1.3.2 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-34013](https://insights.sbomify.com/CVE-2023-34013/): WordPress Poll Maker Plugin <= 4.6.2 is vulnerable to Server Side Request Forgery (SSRF) (medium 4.4)
- [CVE-2023-34012](https://insights.sbomify.com/CVE-2023-34012/): WordPress Premium Addons PRO Plugin <= 2.8.24 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-34011](https://insights.sbomify.com/CVE-2023-34011/): WordPress ShopConstruct Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-34010](https://insights.sbomify.com/CVE-2023-34010/): WordPress Media Library Assistant Plugin <= 3.0.7 is vulnerable to Cross Site Scripting (XSS) (medium 5.8)
- [CVE-2023-3401](https://insights.sbomify.com/CVE-2023-3401/): Improper Control of Generation of Code ('Code Injection') in GitLab (medium 4.8)
- [CVE-2023-34009](https://insights.sbomify.com/CVE-2023-34009/): WordPress Social Media Share Buttons & Social Sharing Icons plugin <= 2.8.1 - Broken Access Control + CSRF (medium 4.3)
- [CVE-2023-34008](https://insights.sbomify.com/CVE-2023-34008/): WordPress WP ERP Plugin <= 1.12.3 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-34007](https://insights.sbomify.com/CVE-2023-34007/): WordPress Download Monitor Plugin <= 4.8.3 is vulnerable to Arbitrary File Upload (critical 9.9)
- [CVE-2023-34006](https://insights.sbomify.com/CVE-2023-34006/): WordPress Telegram Bot & Channel Plugin <= 3.6.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-34005](https://insights.sbomify.com/CVE-2023-34005/): WordPress Front End Users Plugin <= 3.2.24 is vulnerable to Cross Site Request Forgery (CSRF) (medium 6.5)
- [CVE-2023-34004](https://insights.sbomify.com/CVE-2023-34004/): WordPress WooCommerce Box Office Plugin <= 1.1.50 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-34003](https://insights.sbomify.com/CVE-2023-34003/): WordPress WooCommerce Box Office plugin <= 1.1.51 - Unauthenticated Save Ticket Barcode vulnerability (medium 6.5)
- [CVE-2023-34002](https://insights.sbomify.com/CVE-2023-34002/): WordPress WP Inventory Manager Plugin <= 2.1.0.13 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-34001](https://insights.sbomify.com/CVE-2023-34001/): WordPress Hide My WP Ghost – Security Plugin plugin <= 5.0.25 - Captcha Bypass vulnerability (medium 5.3)
- [CVE-2023-34000](https://insights.sbomify.com/CVE-2023-34000/): WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.4.0 is vulnerable to Insecure Direct Object References (IDOR) (high 7.5)
- [CVE-2023-33999](https://insights.sbomify.com/CVE-2023-33999/): WordPress WP Mail Log plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2023-33998](https://insights.sbomify.com/CVE-2023-33998/): WordPress Easy Social Icons plugin <= 3.2.5 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-33997](https://insights.sbomify.com/CVE-2023-33997/): WordPress bbp style pack Plugin <= 5.5.5 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-33996](https://insights.sbomify.com/CVE-2023-33996/): WordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin <= 6.10 - Broken Access Control vulnerability (high 8.8)
- [CVE-2023-33995](https://insights.sbomify.com/CVE-2023-33995/): WordPress Photo Gallery by 10Web plugin <= 1.8.15 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-33994](https://insights.sbomify.com/CVE-2023-33994/): WordPress Slimstat Analytics plugin <= 5.0.5.1 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-33993](https://insights.sbomify.com/CVE-2023-33993/): SQL Injection vulnerability in SAP Business One B1i Layer (high 7.1)
- [CVE-2023-33992](https://insights.sbomify.com/CVE-2023-33992/): Missing Authorization Check in SAP Business Warehouse and SAP BW/4HANA (medium 4.5)
- [CVE-2023-33991](https://insights.sbomify.com/CVE-2023-33991/): Stored Cross-Site Scripting (Stored XSS) vulnerability in SAP UI5 Variant Management (high 8.2)
- [CVE-2023-33990](https://insights.sbomify.com/CVE-2023-33990/): Denial of Service (DoS) vulnerability in SAP SQL Anywhere (high 7.8)
- [CVE-2023-3399](https://insights.sbomify.com/CVE-2023-3399/): Insertion of Sensitive Information Into Sent Data in GitLab (high 8.5)
- [CVE-2023-33989](https://insights.sbomify.com/CVE-2023-33989/): Directory Traversal vulnerability in SAP NetWeaver (BI CONT ADD ON) (high 8.7)
- [CVE-2023-33988](https://insights.sbomify.com/CVE-2023-33988/): Cross-Site Scripting vulnerability in SAP Enable Now (medium 6.1)
- [CVE-2023-33987](https://insights.sbomify.com/CVE-2023-33987/): Request smuggling and request concatenation in SAP Web Dispatcher (high 8.6)
- [CVE-2023-33986](https://insights.sbomify.com/CVE-2023-33986/): Cross-Site Scripting (XSS) vulnerability in SAP CRM ABAP (Grantor Management) (medium 6.1)
- [CVE-2023-33985](https://insights.sbomify.com/CVE-2023-33985/): Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal (medium 6.1)
- [CVE-2023-33984](https://insights.sbomify.com/CVE-2023-33984/): Cross-Site Scripting (XSS) vulnerability in NetWeaver (Design Time Repository) (medium 6.4)
- [CVE-2023-33983](https://insights.sbomify.com/CVE-2023-33983/): Security feature bypass in briarproject:briar (high 7.4)
- [CVE-2023-33982](https://insights.sbomify.com/CVE-2023-33982/): Weak cryptography in briarproject:briar (medium 5.9)
- [CVE-2023-33981](https://insights.sbomify.com/CVE-2023-33981/): Security feature bypass in briarproject:briar (medium 6.5)
- [CVE-2023-33980](https://insights.sbomify.com/CVE-2023-33980/): Denial of service in briarproject:briar (high 7.5)
- [CVE-2023-3398](https://insights.sbomify.com/CVE-2023-3398/): Denial of Service in jgraph/drawio (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/296/