# Vulnerabilities published in 2023


- [CVE-2023-33240](https://insights.sbomify.com/CVE-2023-33240/): Misconfiguration in foxit:pdf editor (high 7.8)
- [CVE-2023-3324](https://insights.sbomify.com/CVE-2023-3324/): Insecure deserialization in zenon internal DLLs (medium 6.3)
- [CVE-2023-33239](https://insights.sbomify.com/CVE-2023-33239/): Second Order Command-injection Vulnerability in the Key-generation Function (high 8.8)
- [CVE-2023-33238](https://insights.sbomify.com/CVE-2023-33238/): Command-injection Vulnerability in Certificate Management (high 7.2)
- [CVE-2023-33237](https://insights.sbomify.com/CVE-2023-33237/): Authentication Bypass Without Administrator Privilege (high 8.8)
- [CVE-2023-33236](https://insights.sbomify.com/CVE-2023-33236/): MXsecurity Hardcoded Credential Vulnerability (critical 9.8)
- [CVE-2023-33235](https://insights.sbomify.com/CVE-2023-33235/): MXsecurity Command Injection Vulnerability (high 7.2)
- [CVE-2023-33234](https://insights.sbomify.com/CVE-2023-33234/): Apache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configuration (high 7.2)
- [CVE-2023-33231](https://insights.sbomify.com/CVE-2023-33231/): XSS in SolarWinds Database Performance Analyzer 2023.2 (medium 6.1)
- [CVE-2023-3323](https://insights.sbomify.com/CVE-2023-3323/): Code Execution through overwriting project file on zenon engineering studio system (medium 5.9)
- [CVE-2023-33229](https://insights.sbomify.com/CVE-2023-33229/): SolarWinds Platform Incorrect Input Neutralization Vulnerability (low 3.5)
- [CVE-2023-33228](https://insights.sbomify.com/CVE-2023-33228/): SolarWinds Network Configuration Manager Sensitive Information Disclosure Vulnerability (medium 4.5)
- [CVE-2023-33227](https://insights.sbomify.com/CVE-2023-33227/): Directory Traversal Remote Code Execution Vulnerability (high 8.0)
- [CVE-2023-33226](https://insights.sbomify.com/CVE-2023-33226/): Directory Traversal Remote Code Execution Vulnerability (high 8.0)
- [CVE-2023-33225](https://insights.sbomify.com/CVE-2023-33225/): SolarWinds Platform Deserialization of Untrusted Data Vulnerability (high 7.2)
- [CVE-2023-33224](https://insights.sbomify.com/CVE-2023-33224/): SolarWinds Platform Incorrect Behavior Order Vulnerability (high 7.2)
- [CVE-2023-33222](https://insights.sbomify.com/CVE-2023-33222/): Stack buffer overflow when reading DESFire card (medium 6.8)
- [CVE-2023-33221](https://insights.sbomify.com/CVE-2023-33221/): Heap Buffer Overflow when reading DESFire card (medium 6.8)
- [CVE-2023-33220](https://insights.sbomify.com/CVE-2023-33220/): Stack Buffer Overflow when checking some attributes during retrofit (critical 9.1)
- [CVE-2023-3322](https://insights.sbomify.com/CVE-2023-3322/): Code Execution through overwriting service executable in utilities directory (high 7.0)
- [CVE-2023-33219](https://insights.sbomify.com/CVE-2023-33219/): Stack Buffer Overflow when checking retrofit package (critical 9.1)
- [CVE-2023-33218](https://insights.sbomify.com/CVE-2023-33218/): Stack Buffer Overflow in a binary run at upgrade startup (critical 9.1)
- [CVE-2023-33217](https://insights.sbomify.com/CVE-2023-33217/): Missing integrity check on upgrade package (high 7.5)
- [CVE-2023-33216](https://insights.sbomify.com/CVE-2023-33216/): WordPress WooDiscuz – WooCommerce Comments Plugin <= 2.2.9 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-33215](https://insights.sbomify.com/CVE-2023-33215/): WordPress Taggbox plugin <= 3.3 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-33214](https://insights.sbomify.com/CVE-2023-33214/): WordPress Taggbox Plugin <= 3.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-33213](https://insights.sbomify.com/CVE-2023-33213/): WordPress wpView Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-33212](https://insights.sbomify.com/CVE-2023-33212/): WordPress JetFormBuilder Plugin <= 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-33211](https://insights.sbomify.com/CVE-2023-33211/): WordPress WP-Piwik Plugin <= 1.0.27 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-33210](https://insights.sbomify.com/CVE-2023-33210/): WordPress nuajik CDN Plugin <= 0.1.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-3321](https://insights.sbomify.com/CVE-2023-3321/): Code Execution through Writable Mosquitto Configuration File (high 7.0)
- [CVE-2023-33209](https://insights.sbomify.com/CVE-2023-33209/): WordPress SEO Change Monitor Plugin <= 1.2 is vulnerable to SQL Injection (high 8.5)
- [CVE-2023-33208](https://insights.sbomify.com/CVE-2023-33208/): WordPress Cookie Monster Plugin <= 1.51 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-33207](https://insights.sbomify.com/CVE-2023-33207/): WordPress Stop Referrer Spam Plugin <= 1.3.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-33206](https://insights.sbomify.com/CVE-2023-33206/): Security feature bypass in dieboldnixdorf:vynamic security suite (high 7.5)
- [CVE-2023-33204](https://insights.sbomify.com/CVE-2023-33204/): Integer overflow in debian:debian linux (high 7.8)
- [CVE-2023-33203](https://insights.sbomify.com/CVE-2023-33203/): Use after free in linux:linux kernel (medium 6.4)
- [CVE-2023-33202](https://insights.sbomify.com/CVE-2023-33202/): Bouncy Castle Denial of Service (DoS) (medium 5.5)
- [CVE-2023-33201](https://insights.sbomify.com/CVE-2023-33201/): Bouncy Castle For Java LDAP injection vulnerability (medium 5.3)
- [CVE-2023-33200](https://insights.sbomify.com/CVE-2023-33200/): Mali GPU Kernel Driver Allows Improper GPU Memory Processing Operations (medium 4.7)
- [CVE-2023-3320](https://insights.sbomify.com/CVE-2023-3320/): Cross-site request forgery in WP Sticky Social (medium 6.1)
- [CVE-2023-33199](https://insights.sbomify.com/CVE-2023-33199/): malformed proposed intoto v0.0.2 entries can cause a panic in Rekor (medium 5.3)
- [CVE-2023-33198](https://insights.sbomify.com/CVE-2023-33198/): Incorrectly Specified Chat Message Destinations in tgstation-server and DreamMaker API (medium 6.1)
- [CVE-2023-33197](https://insights.sbomify.com/CVE-2023-33197/): Craft CMS stored XSS in indexedVolumes (medium 5.5)
- [CVE-2023-33196](https://insights.sbomify.com/CVE-2023-33196/): Craft CMS stored XSS in review volume (medium 5.5)
- [CVE-2023-33195](https://insights.sbomify.com/CVE-2023-33195/): Craft CMS XSS in RSS widget feed (medium 5.0)
- [CVE-2023-33194](https://insights.sbomify.com/CVE-2023-33194/): CraftCMS stored XSS in Quick Post widget error message (low 3.7)
- [CVE-2023-33193](https://insights.sbomify.com/CVE-2023-33193/): Emby Server Proxy Header Spoofing Vulnerability (critical 9.1)
- [CVE-2023-33192](https://insights.sbomify.com/CVE-2023-33192/): Improper handling of NTS cookie length that could crash the ntpd-rs server (high 7.5)
- [CVE-2023-33191](https://insights.sbomify.com/CVE-2023-33191/): kyverno seccomp control can be circumvented (medium 4.6)
- [CVE-2023-33190](https://insights.sbomify.com/CVE-2023-33190/): Improperly configured permissions in Sealos (critical 10.0)
- [CVE-2023-3319](https://insights.sbomify.com/CVE-2023-3319/): XSS in iDisplays PlatPlay DS (medium 5.4)
- [CVE-2023-33189](https://insights.sbomify.com/CVE-2023-33189/): Incorrect Authorization with specially crafted requests (critical 10.0)
- [CVE-2023-33188](https://insights.sbomify.com/CVE-2023-33188/): Uncontrolled data used in content resolution (medium 6.3)
- [CVE-2023-33187](https://insights.sbomify.com/CVE-2023-33187/): highlight vulnerable to cleartext transmission of sensitive information (medium 5.4)
- [CVE-2023-33186](https://insights.sbomify.com/CVE-2023-33186/): Cross-site scripting vulnerability in Zulip Server development branch via topic tooltip (high 8.2)
- [CVE-2023-33185](https://insights.sbomify.com/CVE-2023-33185/): Incorrect signature verification in django-ses (medium 4.6)
- [CVE-2023-33184](https://insights.sbomify.com/CVE-2023-33184/): Blind SSRF in the Nextcloud Mail app on avatar endpoint (low 3.5)
- [CVE-2023-33183](https://insights.sbomify.com/CVE-2023-33183/): Error in calendar when booking an appointment reveals the full path of the website (low 2.6)
- [CVE-2023-33182](https://insights.sbomify.com/CVE-2023-33182/): Nextcloud Contacts photos only sanitized if mime type is all lower case (not scored)
- [CVE-2023-33181](https://insights.sbomify.com/CVE-2023-33181/): Sensitive Information Disclosure abusing Stack Trace in Xibo CMS (medium 4.3)
- [CVE-2023-33180](https://insights.sbomify.com/CVE-2023-33180/): Sensitive Information Disclosure abusing SQL Injection in Xibo CMS display map (medium 6.5)
- [CVE-2023-3318](https://insights.sbomify.com/CVE-2023-3318/): SourceCodester Resort Management System cross site scripting (low 3.5)
- [CVE-2023-33179](https://insights.sbomify.com/CVE-2023-33179/): Sensitive Information Disclosure abusing SQL Injection in Xibo CMS nameFilter (medium 6.5)
- [CVE-2023-33178](https://insights.sbomify.com/CVE-2023-33178/): Sensitive Information Disclosure abusing SQL Injection in Xibo CMS dataset filter (medium 6.5)
- [CVE-2023-33177](https://insights.sbomify.com/CVE-2023-33177/): Xibo CMS vulnerable to Remote Code Execution through Zip Slip (high 8.8)
- [CVE-2023-33176](https://insights.sbomify.com/CVE-2023-33176/): Blind SSRF When Uploading Presentation in BigBlueButton (medium 4.8)
- [CVE-2023-33175](https://insights.sbomify.com/CVE-2023-33175/): ToUI allows user-specific variables to be shared between users (critical 9.1)
- [CVE-2023-33174](https://insights.sbomify.com/CVE-2023-33174/): Windows Cryptographic Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-33173](https://insights.sbomify.com/CVE-2023-33173/): Remote Procedure Call Runtime Denial of Service Vulnerability (medium 6.5)
- [CVE-2023-33172](https://insights.sbomify.com/CVE-2023-33172/): Remote Procedure Call Runtime Denial of Service Vulnerability (medium 6.5)
- [CVE-2023-33171](https://insights.sbomify.com/CVE-2023-33171/): Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability (high 8.2)
- [CVE-2023-33170](https://insights.sbomify.com/CVE-2023-33170/): ASP.NET and Visual Studio Security Feature Bypass Vulnerability (high 8.1)
- [CVE-2023-3317](https://insights.sbomify.com/CVE-2023-3317/): Use after free in Kernel (high 7.1)
- [CVE-2023-33169](https://insights.sbomify.com/CVE-2023-33169/): Remote Procedure Call Runtime Denial of Service Vulnerability (medium 6.5)
- [CVE-2023-33168](https://insights.sbomify.com/CVE-2023-33168/): Remote Procedure Call Runtime Denial of Service Vulnerability (medium 6.5)
- [CVE-2023-33167](https://insights.sbomify.com/CVE-2023-33167/): Remote Procedure Call Runtime Denial of Service Vulnerability (medium 6.5)
- [CVE-2023-33166](https://insights.sbomify.com/CVE-2023-33166/): Remote Procedure Call Runtime Denial of Service Vulnerability (medium 6.5)
- [CVE-2023-33165](https://insights.sbomify.com/CVE-2023-33165/): Microsoft SharePoint Server Security Feature Bypass Vulnerability (medium 4.3)
- [CVE-2023-33164](https://insights.sbomify.com/CVE-2023-33164/): Remote Procedure Call Runtime Denial of Service Vulnerability (medium 6.5)
- [CVE-2023-33163](https://insights.sbomify.com/CVE-2023-33163/): Windows Network Load Balancing Remote Code Execution Vulnerability (high 7.5)
- [CVE-2023-33162](https://insights.sbomify.com/CVE-2023-33162/): Microsoft Excel Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-33161](https://insights.sbomify.com/CVE-2023-33161/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-33160](https://insights.sbomify.com/CVE-2023-33160/): Microsoft SharePoint Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-3316](https://insights.sbomify.com/CVE-2023-3316/): Null dereference in libtiff (medium 5.9)
- [CVE-2023-33159](https://insights.sbomify.com/CVE-2023-33159/): Microsoft SharePoint Server Spoofing Vulnerability (high 8.8)
- [CVE-2023-33158](https://insights.sbomify.com/CVE-2023-33158/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-33157](https://insights.sbomify.com/CVE-2023-33157/): Microsoft SharePoint Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-33156](https://insights.sbomify.com/CVE-2023-33156/): Microsoft Defender Elevation of Privilege Vulnerability (medium 6.3)
- [CVE-2023-33155](https://insights.sbomify.com/CVE-2023-33155/): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2023-33154](https://insights.sbomify.com/CVE-2023-33154/): Windows Partition Management Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2023-33153](https://insights.sbomify.com/CVE-2023-33153/): Microsoft Outlook Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2023-33152](https://insights.sbomify.com/CVE-2023-33152/): Microsoft ActiveX Remote Code Execution Vulnerability (high 7.0)
- [CVE-2023-33151](https://insights.sbomify.com/CVE-2023-33151/): Microsoft Outlook Spoofing Vulnerability (medium 6.5)
- [CVE-2023-33150](https://insights.sbomify.com/CVE-2023-33150/): Microsoft Office Security Feature Bypass Vulnerability (critical 9.6)
- [CVE-2023-3315](https://insights.sbomify.com/CVE-2023-3315/): Jenkins Team Concert Plugin does not perform permission checks in methods implementing form validation (medium 4.3)
- [CVE-2023-33149](https://insights.sbomify.com/CVE-2023-33149/): Microsoft Office Graphics Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-33148](https://insights.sbomify.com/CVE-2023-33148/): Microsoft Office Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2023-33146](https://insights.sbomify.com/CVE-2023-33146/): Microsoft Office Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-33145](https://insights.sbomify.com/CVE-2023-33145/): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/302/