# Vulnerabilities published in 2023


- [CVE-2023-3280](https://insights.sbomify.com/CVE-2023-3280/): Cortex XDR Agent: Local Windows User Can Disable the Agent (medium 5.5)
- [CVE-2023-32799](https://insights.sbomify.com/CVE-2023-32799/): Missing authorization in Shipping Multiple Addresses (medium 6.5)
- [CVE-2023-32798](https://insights.sbomify.com/CVE-2023-32798/): WordPress Simple Page Ordering plugin <= 2.5.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-32797](https://insights.sbomify.com/CVE-2023-32797/): WordPress video carousel slider with lightbox Plugin <= 1.0.22 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-32796](https://insights.sbomify.com/CVE-2023-32796/): WordPress WooCommerce Product Enquiry Plugin <= 2.3.4 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-32795](https://insights.sbomify.com/CVE-2023-32795/): WordPress WooCommerce Product Add-ons Plugin <= 6.1.3 is vulnerable to PHP Object Injection (high 8.2)
- [CVE-2023-32794](https://insights.sbomify.com/CVE-2023-32794/): WordPress WooCommerce Product Add-ons Plugin <= 6.1.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-32793](https://insights.sbomify.com/CVE-2023-32793/): WordPress WooCommerce Pre-Orders Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-32792](https://insights.sbomify.com/CVE-2023-32792/): Cross-Site Request Forgery on NXLog Manager (medium 6.5)
- [CVE-2023-32791](https://insights.sbomify.com/CVE-2023-32791/): Cross-Site Request Forgery on NXLog Manager (medium 6.5)
- [CVE-2023-32790](https://insights.sbomify.com/CVE-2023-32790/): XSS on NXLog Manager (medium 4.6)
- [CVE-2023-3279](https://insights.sbomify.com/CVE-2023-3279/): NextGEN Gallery < 3.39 - Admin+ Local File Inclusion (medium 4.9)
- [CVE-2023-32789](https://insights.sbomify.com/CVE-2023-32789/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-32788](https://insights.sbomify.com/CVE-2023-32788/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-32787](https://insights.sbomify.com/CVE-2023-32787/): Denial of service in opcfoundation:ua java legacy (high 7.5)
- [CVE-2023-32786](https://insights.sbomify.com/CVE-2023-32786/): Langchain Server-Side Request Forgery vulnerability (high 7.5)
- [CVE-2023-32784](https://insights.sbomify.com/CVE-2023-32784/): Information disclosure in keepass:keepass (high 7.5)
- [CVE-2023-32783](https://insights.sbomify.com/CVE-2023-32783/): Security feature bypass in zohocorp:manageengine adaudit plus (high 7.5)
- [CVE-2023-32782](https://insights.sbomify.com/CVE-2023-32782/): Command injection in paessler:prtg network monitor (high 7.2)
- [CVE-2023-32781](https://insights.sbomify.com/CVE-2023-32781/): Command injection in paessler:prtg network monitor (high 7.2)
- [CVE-2023-32778](https://insights.sbomify.com/CVE-2023-32778/): Path traversal in ILIAS (low 3.3)
- [CVE-2023-3277](https://insights.sbomify.com/CVE-2023-3277/): MStore API <= 4.10.7 - Unauthorized Account Access and Privilege Escalation (critical 9.8)
- [CVE-2023-32767](https://insights.sbomify.com/CVE-2023-32767/): Path traversal in symcon:ip symcon (high 7.5)
- [CVE-2023-32766](https://insights.sbomify.com/CVE-2023-32766/): Gitpod vulnerable to Cross-site Scripting (medium 6.1)
- [CVE-2023-32764](https://insights.sbomify.com/CVE-2023-32764/): Privilege escalation in fabasoft:cloud (high 7.8)
- [CVE-2023-32763](https://insights.sbomify.com/CVE-2023-32763/): Memory corruption in qt:qt (high 7.5)
- [CVE-2023-32762](https://insights.sbomify.com/CVE-2023-32762/): Security feature bypass in debian:debian linux (medium 5.3)
- [CVE-2023-32761](https://insights.sbomify.com/CVE-2023-32761/): Cross-site request forgery in archerirm:archer (high 8.1)
- [CVE-2023-32760](https://insights.sbomify.com/CVE-2023-32760/): Information disclosure in archerirm:archer (high 7.7)
- [CVE-2023-3276](https://insights.sbomify.com/CVE-2023-3276/): Dromara HuTool XML Parsing Module XmlUtil.java readBySax xml external entity reference (medium 5.5)
- [CVE-2023-32759](https://insights.sbomify.com/CVE-2023-32759/): Information disclosure in archerirm:archer (high 7.5)
- [CVE-2023-32758](https://insights.sbomify.com/CVE-2023-32758/): git-url-parse Regular Expression Denial of Service (high 7.5)
- [CVE-2023-32757](https://insights.sbomify.com/CVE-2023-32757/): e-Excellence U-Office Force - Arbitrary File Upload (critical 9.8)
- [CVE-2023-32756](https://insights.sbomify.com/CVE-2023-32756/): e-Excellence U-Office Force - Path Traversal (high 7.5)
- [CVE-2023-32755](https://insights.sbomify.com/CVE-2023-32755/): e-Excellence U-Office Force - Error Message Leakage (medium 5.3)
- [CVE-2023-32754](https://insights.sbomify.com/CVE-2023-32754/): Thinking Software Efence - SQL injection (critical 9.8)
- [CVE-2023-32753](https://insights.sbomify.com/CVE-2023-32753/): ITPison OMICARD EDM - Arbitrary File Upload (critical 9.8)
- [CVE-2023-32752](https://insights.sbomify.com/CVE-2023-32752/): L7 Networks InstantScan & InstantQoS - Arbitrary File Upload (critical 9.8)
- [CVE-2023-32751](https://insights.sbomify.com/CVE-2023-32751/): Hardcoded credentials in pydio:cells (medium 5.4)
- [CVE-2023-32750](https://insights.sbomify.com/CVE-2023-32750/): Server-side request forgery in pydio:cells (medium 6.5)
- [CVE-2023-3275](https://insights.sbomify.com/CVE-2023-3275/): PHPGurukul Rail Pass Management System POST Request view-pass-detail.php sql injection (medium 6.3)
- [CVE-2023-32749](https://insights.sbomify.com/CVE-2023-32749/): Privilege escalation in pydio:cells (high 8.8)
- [CVE-2023-32748](https://insights.sbomify.com/CVE-2023-32748/): Missing authorization in mitel:mivoice connect (critical 9.8)
- [CVE-2023-32747](https://insights.sbomify.com/CVE-2023-32747/): WordPress WooCommerce Bookings Plugin <= 1.15.78 is vulnerable to Insecure Direct Object References (IDOR) (medium 5.4)
- [CVE-2023-32746](https://insights.sbomify.com/CVE-2023-32746/): WordPress WooCommerce Brands Plugin <= 1.6.45 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-32745](https://insights.sbomify.com/CVE-2023-32745/): WordPress AutomateWoo Plugin <= 5.7.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-32744](https://insights.sbomify.com/CVE-2023-32744/): WordPress WooCommerce Product Recommendations Plugin < 2.3.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-32743](https://insights.sbomify.com/CVE-2023-32743/): WordPress AutomateWoo Plugin <= 5.7.1 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-32742](https://insights.sbomify.com/CVE-2023-32742/): WordPress WP SMS Plugin <= 6.1.4 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-32741](https://insights.sbomify.com/CVE-2023-32741/): WordPress Contact Form to Any API Plugin <= 1.1.2 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-32740](https://insights.sbomify.com/CVE-2023-32740/): WordPress Custom 404 Pro Plugin <= 3.8.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.8)
- [CVE-2023-3274](https://insights.sbomify.com/CVE-2023-3274/): code-projects Supplier Management System Picture btn_functions.php unrestricted upload (medium 6.3)
- [CVE-2023-32739](https://insights.sbomify.com/CVE-2023-32739/): WordPress WP Custom Cursors Plugin < 3.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-32738](https://insights.sbomify.com/CVE-2023-32738/): WordPress Eonet Manual User Approve Plugin <= 2.1.3 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-32737](https://insights.sbomify.com/CVE-2023-32737/): Deserialization in SIMATIC STEP 7 Safety V18 (high 7.0)
- [CVE-2023-32736](https://insights.sbomify.com/CVE-2023-32736/): Deserialization in SIMATIC S7-PLCSIM V16 (high 7.0)
- [CVE-2023-32735](https://insights.sbomify.com/CVE-2023-32735/): Deserialization in SIMATIC STEP 7 Safety V16 (high 7.0)
- [CVE-2023-32734](https://insights.sbomify.com/CVE-2023-32734/): Memory corruption in iOS and iPadOS (high 7.8)
- [CVE-2023-32732](https://insights.sbomify.com/CVE-2023-32732/): Denial-of-Service in gRPC (medium 5.3)
- [CVE-2023-32731](https://insights.sbomify.com/CVE-2023-32731/): Information leak in gRPC (high 7.4)
- [CVE-2023-3273](https://insights.sbomify.com/CVE-2023-3273/): Missing authorization in ICR890-4 (high 7.5)
- [CVE-2023-32728](https://insights.sbomify.com/CVE-2023-32728/): Code injection in zabbix_agent2 smart.disk.get caused by smartctl plugin (medium 4.6)
- [CVE-2023-32727](https://insights.sbomify.com/CVE-2023-32727/): Code execution vulnerability in icmpping (medium 6.8)
- [CVE-2023-32726](https://insights.sbomify.com/CVE-2023-32726/): Possible buffer overread from reading DNS responses (low 3.9)
- [CVE-2023-32725](https://insights.sbomify.com/CVE-2023-32725/): Leak of zbx_session cookie when using a scheduled report that includes a dashboard with a URL widget. (critical 9.6)
- [CVE-2023-32724](https://insights.sbomify.com/CVE-2023-32724/): JavaScript engine memory pointers are directly available for Zabbix users for modification (critical 9.1)
- [CVE-2023-32723](https://insights.sbomify.com/CVE-2023-32723/): Inefficient permission check in class CControllerAuthenticationUpdate (high 8.5)
- [CVE-2023-32722](https://insights.sbomify.com/CVE-2023-32722/): Stack-buffer Overflow in library module zbxjson (critical 9.6)
- [CVE-2023-32721](https://insights.sbomify.com/CVE-2023-32721/): Stored XSS in Maps element (high 7.6)
- [CVE-2023-3272](https://insights.sbomify.com/CVE-2023-3272/): Information disclosure in ICR890-4 (high 7.5)
- [CVE-2023-32717](https://insights.sbomify.com/CVE-2023-32717/): Role-based Access Control (RBAC) Bypass on '/services/indexing/preview' REST Endpoint Can Overwrite Search Results (medium 4.3)
- [CVE-2023-32716](https://insights.sbomify.com/CVE-2023-32716/): Denial of Service via the 'dump' SPL command (medium 6.5)
- [CVE-2023-32715](https://insights.sbomify.com/CVE-2023-32715/): Self Cross-Site Scripting (XSS) on Splunk App for Lookup File Editing (medium 4.7)
- [CVE-2023-32714](https://insights.sbomify.com/CVE-2023-32714/): Path Traversal in Splunk App for Lookup File Editing (high 8.1)
- [CVE-2023-32713](https://insights.sbomify.com/CVE-2023-32713/): Local Privilege Escalation via the ‘streamfwd’ program in Splunk App for Stream (high 7.8)
- [CVE-2023-32712](https://insights.sbomify.com/CVE-2023-32712/): Unauthenticated Log Injection in Splunk Enterprise (high 8.6)
- [CVE-2023-32711](https://insights.sbomify.com/CVE-2023-32711/): Persistent Cross-Site Scripting (XSS) through a URL Validation Bypass within a Dashboard View (medium 5.4)
- [CVE-2023-32710](https://insights.sbomify.com/CVE-2023-32710/): Information Disclosure via the ‘copyresults’ SPL Command (medium 4.8)
- [CVE-2023-3271](https://insights.sbomify.com/CVE-2023-3271/): Missing authorization in ICR890-4 (high 8.2)
- [CVE-2023-32709](https://insights.sbomify.com/CVE-2023-32709/): Low-privileged User can View Hashed Default Splunk Password (medium 4.3)
- [CVE-2023-32708](https://insights.sbomify.com/CVE-2023-32708/): HTTP Response Splitting via the ‘rest’ SPL Command (high 7.2)
- [CVE-2023-32707](https://insights.sbomify.com/CVE-2023-32707/): ‘edit_user’ Capability Privilege Escalation (high 8.8)
- [CVE-2023-32706](https://insights.sbomify.com/CVE-2023-32706/): Denial Of Service due to Untrusted XML Tag in XML Parser within SAML Authentication (high 7.7)
- [CVE-2023-32701](https://insights.sbomify.com/CVE-2023-32701/): Vulnerability in Networking Stack Impacts QNX Software Development Platform (SDP) (high 7.1)
- [CVE-2023-32700](https://insights.sbomify.com/CVE-2023-32700/): Command injection in luatex project:luatex (high 8.8)
- [CVE-2023-3270](https://insights.sbomify.com/CVE-2023-3270/): Information disclosure in ICR890-4 (high 8.6)
- [CVE-2023-32699](https://insights.sbomify.com/CVE-2023-32699/): MeterSphere denial of service vulnerability (medium 6.5)
- [CVE-2023-32698](https://insights.sbomify.com/CVE-2023-32698/): nfpm vulnerable to Incorrect Default Permissions (high 7.1)
- [CVE-2023-32697](https://insights.sbomify.com/CVE-2023-32697/): Sqlite-jdbc vulnerable to remote code execution when JDBC url is attacker controlled (high 8.8)
- [CVE-2023-32696](https://insights.sbomify.com/CVE-2023-32696/): Excessive permissions for ckan user (high 8.8)
- [CVE-2023-32695](https://insights.sbomify.com/CVE-2023-32695/): Insufficient validation when decoding a Socket.IO packet (high 7.3)
- [CVE-2023-32694](https://insights.sbomify.com/CVE-2023-32694/): Non-constant time HMAC comparison in Adyen plugin in Saleor (medium 4.8)
- [CVE-2023-32693](https://insights.sbomify.com/CVE-2023-32693/): Decidim Cross-site Scripting vulnerability in the external link redirections (high 8.1)
- [CVE-2023-32692](https://insights.sbomify.com/CVE-2023-32692/): Remote Code Execution Vulnerability in Validation Placeholders (critical 9.8)
- [CVE-2023-32691](https://insights.sbomify.com/CVE-2023-32691/): ginuerzh/gost vulnerable to Timing Attack (medium 5.9)
- [CVE-2023-32690](https://insights.sbomify.com/CVE-2023-32690/): Responder can Invoke Undefined Behavior in libspdm Requester (medium 5.7)
- [CVE-2023-3269](https://insights.sbomify.com/CVE-2023-3269/): Distros-[dirtyvma] privilege escalation via non-rcu-protected vma traversal (high 7.8)
- [CVE-2023-32689](https://insights.sbomify.com/CVE-2023-32689/): Parse Server vulnerable to phishing attack vulnerability that involves uploading malicious HTML file (medium 6.3)
- [CVE-2023-32688](https://insights.sbomify.com/CVE-2023-32688/): Invalid push request payload crashes Parse Server (medium 4.9)
- [CVE-2023-32687](https://insights.sbomify.com/CVE-2023-32687/): Insufficiently Protected ChatBot Credentials in tgstation-server (high 7.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/306/