# Vulnerabilities published in 2023


- [CVE-2023-33364](https://insights.sbomify.com/CVE-2023-33364/): Command injection in supremainc:biostar 2 (high 8.8)
- [CVE-2023-33363](https://insights.sbomify.com/CVE-2023-33363/): Auth bypass in supremainc:biostar 2 (high 7.5)
- [CVE-2023-33362](https://insights.sbomify.com/CVE-2023-33362/): SQL injection in piwigo:piwigo (critical 9.8)
- [CVE-2023-33361](https://insights.sbomify.com/CVE-2023-33361/): SQL injection in piwigo:piwigo (critical 9.8)
- [CVE-2023-3336](https://insights.sbomify.com/CVE-2023-3336/): TN-5900 Series User Enumeration Vulnerability (medium 5.3)
- [CVE-2023-33359](https://insights.sbomify.com/CVE-2023-33359/): Cross-site request forgery in piwigo:piwigo (medium 4.3)
- [CVE-2023-33356](https://insights.sbomify.com/CVE-2023-33356/): Cross-site scripting in thecosy:icecms (medium 5.4)
- [CVE-2023-33355](https://insights.sbomify.com/CVE-2023-33355/): Missing authorization in thecosy:icecms (high 7.5)
- [CVE-2023-3335](https://insights.sbomify.com/CVE-2023-3335/): Information Exposure Vulnerability in Hitachi Ops Center Administrator (medium 6.5)
- [CVE-2023-33338](https://insights.sbomify.com/CVE-2023-33338/): SQL injection in phpgurukul:old age home management system (critical 9.8)
- [CVE-2023-33336](https://insights.sbomify.com/CVE-2023-33336/): Cross-site scripting in sophos:web appliance (medium 4.8)
- [CVE-2023-33335](https://insights.sbomify.com/CVE-2023-33335/): Cross-site scripting in sophos:iview (medium 6.1)
- [CVE-2023-33333](https://insights.sbomify.com/CVE-2023-33333/): Cross-site request forgery in Complianz (high 7.1)
- [CVE-2023-33332](https://insights.sbomify.com/CVE-2023-33332/): WordPress WooCommerce Product Vendors Plugin <= 2.1.76 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-33331](https://insights.sbomify.com/CVE-2023-33331/): WordPress WooCommerce Product Vendors Plugin <= 2.1.76 is vulnerable to SQL Injection (high 8.5)
- [CVE-2023-33330](https://insights.sbomify.com/CVE-2023-33330/): WordPress WooCommerce Follow-Up Emails Plugin <= 4.9.50 is vulnerable to SQL Injection (high 8.5)
- [CVE-2023-3333](https://insights.sbomify.com/CVE-2023-3333/): Command injection in Aterm WF300HP (high 7.2)
- [CVE-2023-33329](https://insights.sbomify.com/CVE-2023-33329/): WordPress Custom Post Type Generator Plugin <= 2.4.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-33328](https://insights.sbomify.com/CVE-2023-33328/): WordPress MailChimp Subscribe Forms Plugin <= 4.0.9.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-33327](https://insights.sbomify.com/CVE-2023-33327/): WordPress Leyka plugin <= 3.30.2 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2023-33326](https://insights.sbomify.com/CVE-2023-33326/): WordPress EventPrime Plugin <= 2.8.6 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-33325](https://insights.sbomify.com/CVE-2023-33325/): WordPress Leyka Plugin <= 3.30.1 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-33324](https://insights.sbomify.com/CVE-2023-33324/): WordPress Easy Captcha plugin <= 1.0 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-33323](https://insights.sbomify.com/CVE-2023-33323/): WordPress ARMember Plugin <= 4.0.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-33322](https://insights.sbomify.com/CVE-2023-33322/): WordPress Front End Users plugin < 3.2.25 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2023-33321](https://insights.sbomify.com/CVE-2023-33321/): WordPress EventPrime plugin <= 2.8.6 - Sensitive Data Exposure (medium 5.3)
- [CVE-2023-33320](https://insights.sbomify.com/CVE-2023-33320/): WordPress WP-Hijri Plugin <= 1.5.1 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-3332](https://insights.sbomify.com/CVE-2023-3332/): Cross-site scripting in Aterm WF300HP (medium 4.8)
- [CVE-2023-33319](https://insights.sbomify.com/CVE-2023-33319/): WordPress WooCommerce Follow-Up Emails Plugin <= 4.9.40 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-33318](https://insights.sbomify.com/CVE-2023-33318/): WordPress WooCommerce Follow-Up Emails Plugin <= 4.9.40 is vulnerable to Arbitrary File Upload (critical 9.9)
- [CVE-2023-33317](https://insights.sbomify.com/CVE-2023-33317/): WordPress WooCommerce Warranty Requests Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-33316](https://insights.sbomify.com/CVE-2023-33316/): Cross-site request forgery in WooCommerce Follow-Up Emails (AutomateWoo) (medium 5.4)
- [CVE-2023-33315](https://insights.sbomify.com/CVE-2023-33315/): WordPress Smart App Banner Plugin <= 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-33314](https://insights.sbomify.com/CVE-2023-33314/): WordPress BEAR Plugin <= 1.1.3.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-33313](https://insights.sbomify.com/CVE-2023-33313/): WordPress WIP Custom Login Plugin <= 1.2.9 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-33312](https://insights.sbomify.com/CVE-2023-33312/): WordPress Easy Captcha Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-33311](https://insights.sbomify.com/CVE-2023-33311/): WordPress Contact Form Entries Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-33310](https://insights.sbomify.com/CVE-2023-33310/): WordPress Unite Gallery Lite plugin <= 1.7.59 - Local File Inclusion vulnerability (medium 6.0)
- [CVE-2023-3331](https://insights.sbomify.com/CVE-2023-3331/): Path traversal in Aterm WF300HP (medium 5.4)
- [CVE-2023-33309](https://insights.sbomify.com/CVE-2023-33309/): WordPress Duplicator Pro Plugin <= 4.5.11 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-33308](https://insights.sbomify.com/CVE-2023-33308/): Memory corruption in FortiOS (critical 9.8)
- [CVE-2023-33307](https://insights.sbomify.com/CVE-2023-33307/): Null dereference in FortiOS (medium 6.4)
- [CVE-2023-33306](https://insights.sbomify.com/CVE-2023-33306/): Null dereference in FortiOS (medium 6.2)
- [CVE-2023-33305](https://insights.sbomify.com/CVE-2023-33305/): Denial of service in FortiOS (medium 4.9)
- [CVE-2023-33304](https://insights.sbomify.com/CVE-2023-33304/): Hardcoded credentials in FortiClientWindows (medium 4.4)
- [CVE-2023-33303](https://insights.sbomify.com/CVE-2023-33303/): Auth bypass in FortiEDR (high 7.7)
- [CVE-2023-33302](https://insights.sbomify.com/CVE-2023-33302/): Memory corruption in FortiMail (medium 4.5)
- [CVE-2023-33301](https://insights.sbomify.com/CVE-2023-33301/): Missing authorization in FortiOS (medium 6.5)
- [CVE-2023-33300](https://insights.sbomify.com/CVE-2023-33300/): Command injection in FortiNAC (medium 4.8)
- [CVE-2023-3330](https://insights.sbomify.com/CVE-2023-3330/): Path traversal in Aterm WF300HP (medium 4.3)
- [CVE-2023-33299](https://insights.sbomify.com/CVE-2023-33299/): Deserialization in FortiNAC (critical 9.6)
- [CVE-2023-33298](https://insights.sbomify.com/CVE-2023-33298/): Command injection in perimeter81:xpc helpertool (high 7.8)
- [CVE-2023-33297](https://insights.sbomify.com/CVE-2023-33297/): Denial of service in bitcoin:bitcoin core (high 7.5)
- [CVE-2023-33295](https://insights.sbomify.com/CVE-2023-33295/): Security feature bypass in cohesity:cohesity dataplatform (medium 6.5)
- [CVE-2023-33294](https://insights.sbomify.com/CVE-2023-33294/): Command injection in kaiostech:kaios (critical 9.8)
- [CVE-2023-33293](https://insights.sbomify.com/CVE-2023-33293/): Information disclosure in kaiostech:kaios (medium 5.3)
- [CVE-2023-33291](https://insights.sbomify.com/CVE-2023-33291/): Business logic in ebankit:ebankit (high 7.4)
- [CVE-2023-33290](https://insights.sbomify.com/CVE-2023-33290/): git-url-parse crate vulnerable to Regular Expression Denial of Service (high 7.5)
- [CVE-2023-3329](https://insights.sbomify.com/CVE-2023-3329/): CVE-2023-3329 (medium 6.5)
- [CVE-2023-33289](https://insights.sbomify.com/CVE-2023-33289/): Denial of service in urlnorm project:urlnorm (high 7.5)
- [CVE-2023-33288](https://insights.sbomify.com/CVE-2023-33288/): Use after free in linux:linux kernel (medium 4.7)
- [CVE-2023-33287](https://insights.sbomify.com/CVE-2023-33287/): Cross-site scripting in actonic:inline table editing (medium 5.4)
- [CVE-2023-33285](https://insights.sbomify.com/CVE-2023-33285/): Memory corruption in qt:qt (medium 5.3)
- [CVE-2023-33284](https://insights.sbomify.com/CVE-2023-33284/): Deserialization in marvalglobal:msm (high 8.8)
- [CVE-2023-33283](https://insights.sbomify.com/CVE-2023-33283/): Hardcoded credentials in marvalglobal:msm (medium 5.5)
- [CVE-2023-33282](https://insights.sbomify.com/CVE-2023-33282/): Hardcoded credentials in marvalglobal:msm (critical 9.1)
- [CVE-2023-33281](https://insights.sbomify.com/CVE-2023-33281/): Auth bypass in nissan:sylphy classic 2021 firmware (medium 6.5)
- [CVE-2023-33280](https://insights.sbomify.com/CVE-2023-33280/): SQL injection in storecommander:quickaccounting (critical 9.8)
- [CVE-2023-3328](https://insights.sbomify.com/CVE-2023-3328/): Custom Field For WP Job Manager < 1.2 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-33279](https://insights.sbomify.com/CVE-2023-33279/): SQL injection in scfixmyprestashop project:scfixmyprestashop (critical 9.8)
- [CVE-2023-33278](https://insights.sbomify.com/CVE-2023-33278/): SQL injection in storecommander:customers export (critical 9.8)
- [CVE-2023-33277](https://insights.sbomify.com/CVE-2023-33277/): Path traversal in gira:knx ip router firmware (high 7.5)
- [CVE-2023-33276](https://insights.sbomify.com/CVE-2023-33276/): Cross-site scripting in gira:knx ip router firmware (medium 6.1)
- [CVE-2023-33274](https://insights.sbomify.com/CVE-2023-33274/): Auth bypass in voltronicpower:snmp web pro (critical 9.8)
- [CVE-2023-33273](https://insights.sbomify.com/CVE-2023-33273/): Command injection in dts:monitoring (critical 9.8)
- [CVE-2023-33272](https://insights.sbomify.com/CVE-2023-33272/): Command injection in dts:monitoring (critical 9.8)
- [CVE-2023-33271](https://insights.sbomify.com/CVE-2023-33271/): Command injection in dts:monitoring (critical 9.8)
- [CVE-2023-33270](https://insights.sbomify.com/CVE-2023-33270/): Command injection in dts:monitoring (critical 9.8)
- [CVE-2023-33269](https://insights.sbomify.com/CVE-2023-33269/): Command injection in dts:monitoring (critical 9.8)
- [CVE-2023-33268](https://insights.sbomify.com/CVE-2023-33268/): Command injection in dts:monitoring (critical 9.8)
- [CVE-2023-33265](https://insights.sbomify.com/CVE-2023-33265/): Hazelcast Executor Services don't check client permissions properly (high 8.8)
- [CVE-2023-33264](https://insights.sbomify.com/CVE-2023-33264/): Hazelcast vulnerable to unmasked password exposure (medium 4.3)
- [CVE-2023-33263](https://insights.sbomify.com/CVE-2023-33263/): Information disclosure in wftpd project:wftpd (high 7.5)
- [CVE-2023-3326](https://insights.sbomify.com/CVE-2023-3326/): Network authentication attack via pam_krb5 (critical 9.8)
- [CVE-2023-33257](https://insights.sbomify.com/CVE-2023-33257/): Cross-site scripting in verint:engagement management (medium 5.4)
- [CVE-2023-33255](https://insights.sbomify.com/CVE-2023-33255/): Cross-site scripting in uthscsa:papaya viewer (medium 6.1)
- [CVE-2023-33254](https://insights.sbomify.com/CVE-2023-33254/): Information disclosure in quest:kace systems deployment appliance (medium 6.5)
- [CVE-2023-33253](https://insights.sbomify.com/CVE-2023-33253/): File upload in agilebio:labcollector (high 8.8)
- [CVE-2023-33252](https://insights.sbomify.com/CVE-2023-33252/): Double spend in snarkjs (high 7.5)
- [CVE-2023-33251](https://insights.sbomify.com/CVE-2023-33251/): Information disclosure in lightbend:akka http (medium 4.7)
- [CVE-2023-33250](https://insights.sbomify.com/CVE-2023-33250/): Use after free in linux:linux kernel (medium 4.4)
- [CVE-2023-3325](https://insights.sbomify.com/CVE-2023-3325/): CMS Commander <= 2.287 - Authorization Bypass through Use of Insufficiently Unique Cryptographic Signature (high 8.1)
- [CVE-2023-33248](https://insights.sbomify.com/CVE-2023-33248/): Security feature bypass in amazon:alexa (high 7.6)
- [CVE-2023-33247](https://insights.sbomify.com/CVE-2023-33247/): Missing authorization in talend:data catalog (high 7.5)
- [CVE-2023-33246](https://insights.sbomify.com/CVE-2023-33246/): Apache RocketMQ Command Execution (critical 9.8, exploited in the wild)
- [CVE-2023-33245](https://insights.sbomify.com/CVE-2023-33245/): Path traversal in minecraft:minecraft (high 8.8)
- [CVE-2023-33244](https://insights.sbomify.com/CVE-2023-33244/): Security feature bypass in obsidian:obsidian (high 8.2)
- [CVE-2023-33243](https://insights.sbomify.com/CVE-2023-33243/): Auth bypass in starface:starface (high 8.1)
- [CVE-2023-33242](https://insights.sbomify.com/CVE-2023-33242/): Lindell17 TSS Abort Mishandling (critical 9.6)
- [CVE-2023-33241](https://insights.sbomify.com/CVE-2023-33241/): GG18 / GG20 TSS Beta Parameter Vulnerability (critical 9.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/301/