# Vulnerabilities published in 2023


- [CVE-2023-32686](https://insights.sbomify.com/CVE-2023-32686/): kiwitcms vulnerable to stored XSS via unrestricted files upload (high 8.1)
- [CVE-2023-32685](https://insights.sbomify.com/CVE-2023-32685/): Clipboard based cross-site scripting (blocked with default CSP) in Kanboard (medium 4.4)
- [CVE-2023-32684](https://insights.sbomify.com/CVE-2023-32684/): In Lima, a malicious disk image could read a single file on the host filesystem as a qcow2/vmdk backing file (low 2.7)
- [CVE-2023-32683](https://insights.sbomify.com/CVE-2023-32683/): URL deny list bypass via oEmbed and image URLs when generating previews in Synapse (low 3.5)
- [CVE-2023-32682](https://insights.sbomify.com/CVE-2023-32682/): Improper checks for deactivated users during login in synapse (medium 5.4)
- [CVE-2023-32681](https://insights.sbomify.com/CVE-2023-32681/): Unintended leak of Proxy-Authorization header in requests (medium 6.1)
- [CVE-2023-32680](https://insights.sbomify.com/CVE-2023-32680/): Missing SQL permissions check in metabase (medium 5.8)
- [CVE-2023-3268](https://insights.sbomify.com/CVE-2023-3268/): Memory corruption in kernel (high 7.1)
- [CVE-2023-32679](https://insights.sbomify.com/CVE-2023-32679/): Remote Code Execution via unrestricted file extension in Craft CMS (high 7.2)
- [CVE-2023-32678](https://insights.sbomify.com/CVE-2023-32678/): Missing authorization in zulip (medium 6.5)
- [CVE-2023-32677](https://insights.sbomify.com/CVE-2023-32677/): Users who can send invitations can erroneously add users to streams during invitation in Zulip (low 3.1)
- [CVE-2023-32676](https://insights.sbomify.com/CVE-2023-32676/): Autolab tar slip in Install Assessment functionality (`GHSL-2023-081`) (medium 6.7)
- [CVE-2023-32675](https://insights.sbomify.com/CVE-2023-32675/): Nonpayable default functions are sometimes payable in vyper (low 3.7)
- [CVE-2023-32674](https://insights.sbomify.com/CVE-2023-32674/): Memory corruption in HP PC Hardware Diagnostics Windows (critical 9.8)
- [CVE-2023-32673](https://insights.sbomify.com/CVE-2023-32673/): Privilege escalation in HP PC Hardware Diagnostics Windows, HP Image Assistant, and HP Thunderbolt Dock G2 Firmware (critical 9.8)
- [CVE-2023-32672](https://insights.sbomify.com/CVE-2023-32672/): Apache Superset: SQL parser edge case bypasses data access authorization (medium 4.3)
- [CVE-2023-32671](https://insights.sbomify.com/CVE-2023-32671/): BuddyBoss XSS vulnerability (medium 6.3)
- [CVE-2023-32670](https://insights.sbomify.com/CVE-2023-32670/): BuddyBoss XSS vulnerability (critical 9.0)
- [CVE-2023-3267](https://insights.sbomify.com/CVE-2023-3267/): Command injection in PowerPanel Enterprise (critical 9.1)
- [CVE-2023-32669](https://insights.sbomify.com/CVE-2023-32669/): Authorization Bypass on BuddyBoss (medium 5.4)
- [CVE-2023-32668](https://insights.sbomify.com/CVE-2023-32668/): Security feature bypass in luatex project:luatex (medium 5.5)
- [CVE-2023-32666](https://insights.sbomify.com/CVE-2023-32666/): Privilege escalation in 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or Intel(R) TDX (high 7.2)
- [CVE-2023-32665](https://insights.sbomify.com/CVE-2023-32665/): Gvariant deserialisation does not match spec for non-normal data (medium 5.5)
- [CVE-2023-32664](https://insights.sbomify.com/CVE-2023-32664/): Memory corruption in Foxit Reader (high 8.8)
- [CVE-2023-32663](https://insights.sbomify.com/CVE-2023-32663/): Misconfiguration in Intel(R) RealSense(TM) SDKs in version 2.53.1 (medium 6.7)
- [CVE-2023-32662](https://insights.sbomify.com/CVE-2023-32662/): Privilege escalation in Intel Battery Life Diagnostic Tool installation software (medium 6.7)
- [CVE-2023-32661](https://insights.sbomify.com/CVE-2023-32661/): Auth bypass in Intel(R) NUC Kits NUC7PJYH and NUC7CJYH Realtek* SD Card Reader Driver installation software (medium 6.7)
- [CVE-2023-32660](https://insights.sbomify.com/CVE-2023-32660/): Privilege escalation in Intel(R) NUC Kit NUC6i7KYK Thunderbolt(TM) 3 Firmware Update Tool installation software (medium 6.7)
- [CVE-2023-3266](https://insights.sbomify.com/CVE-2023-3266/): Auth bypass in PowerPanel Enterprise (critical 9.8)
- [CVE-2023-32659](https://insights.sbomify.com/CVE-2023-32659/): SUBNET PowerSYSTEM Center Cross-site Scripting (medium 6.5)
- [CVE-2023-32658](https://insights.sbomify.com/CVE-2023-32658/): Privilege escalation in Intel(R) NUC Kits NUC7i3DN, NUC7i5DN, NUC7i7DN HDMI firmware update tool software (medium 6.7)
- [CVE-2023-32657](https://insights.sbomify.com/CVE-2023-32657/): Weintek Weincloud Improper Restriction of Excessive Authentication Attempts (medium 5.3)
- [CVE-2023-32656](https://insights.sbomify.com/CVE-2023-32656/): Memory corruption in Intel(R) RealSense(TM) ID software for Intel(R) RealSense(TM) 450 FA (medium 5.3)
- [CVE-2023-32655](https://insights.sbomify.com/CVE-2023-32655/): Path traversal in Intel(R) NUC Kits & Mini PCs - NUC8i7HVK & NUC8HNK USB Type C power delivery controller installatio software (medium 6.7)
- [CVE-2023-32654](https://insights.sbomify.com/CVE-2023-32654/): Business logic in macOS (medium 6.5)
- [CVE-2023-32653](https://insights.sbomify.com/CVE-2023-32653/): Memory corruption in ImageGear (critical 9.8)
- [CVE-2023-32652](https://insights.sbomify.com/CVE-2023-32652/): PiiGAB M-Bus Cross-site Scripting (high 8.0)
- [CVE-2023-32651](https://insights.sbomify.com/CVE-2023-32651/): Denial of service in Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software (medium 4.3)
- [CVE-2023-32650](https://insights.sbomify.com/CVE-2023-32650/): Integer overflow in GTKWave (high 7.0)
- [CVE-2023-3265](https://insights.sbomify.com/CVE-2023-3265/): Auth bypass in PowerPanel Enterprise (critical 9.8)
- [CVE-2023-32649](https://insights.sbomify.com/CVE-2023-32649/): DoS on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0 (high 8.2)
- [CVE-2023-32647](https://insights.sbomify.com/CVE-2023-32647/): Privilege escalation in Intel(R) XTU software (medium 6.8)
- [CVE-2023-32646](https://insights.sbomify.com/CVE-2023-32646/): Privilege escalation in Intel(R) VROC software (medium 6.7)
- [CVE-2023-32645](https://insights.sbomify.com/CVE-2023-32645/): Auth bypass in YF325 (critical 9.8)
- [CVE-2023-32644](https://insights.sbomify.com/CVE-2023-32644/): Security feature bypass in Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software (medium 4.3)
- [CVE-2023-32643](https://insights.sbomify.com/CVE-2023-32643/): Memory corruption in glib (medium 5.3)
- [CVE-2023-32642](https://insights.sbomify.com/CVE-2023-32642/): Denial of service in Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software (medium 4.3)
- [CVE-2023-32641](https://insights.sbomify.com/CVE-2023-32641/): Other in Intel(R) QAT (high 7.3)
- [CVE-2023-3264](https://insights.sbomify.com/CVE-2023-3264/): Hardcoded credentials in iBoot PDU (medium 6.7)
- [CVE-2023-32639](https://insights.sbomify.com/CVE-2023-32639/): XML external entity in Applicant Programme (medium 5.5)
- [CVE-2023-32638](https://insights.sbomify.com/CVE-2023-32638/): Misconfiguration in Intel Arc RGB Controller software (medium 6.7)
- [CVE-2023-32637](https://insights.sbomify.com/CVE-2023-32637/): File upload in GBrowse (critical 9.8)
- [CVE-2023-32636](https://insights.sbomify.com/CVE-2023-32636/): Denial of service in glib (medium 4.7)
- [CVE-2023-32635](https://insights.sbomify.com/CVE-2023-32635/): XML external entity in XBRL data create application (medium 5.5)
- [CVE-2023-32634](https://insights.sbomify.com/CVE-2023-32634/): Auth bypass in SoftEther VPN (high 7.8)
- [CVE-2023-32633](https://insights.sbomify.com/CVE-2023-32633/): Privilege escalation in Intel(R) CSME installer software (medium 6.7)
- [CVE-2023-32632](https://insights.sbomify.com/CVE-2023-32632/): Command injection in YF325 (high 8.8)
- [CVE-2023-3263](https://insights.sbomify.com/CVE-2023-3263/): Auth bypass in iBoot PDU (high 7.5)
- [CVE-2023-32629](https://insights.sbomify.com/CVE-2023-32629/): Privilege escalation in Ubuntu Kernel (high 7.8)
- [CVE-2023-32628](https://insights.sbomify.com/CVE-2023-32628/): File upload in WebAccess/SCADA (high 7.2)
- [CVE-2023-32627](https://insights.sbomify.com/CVE-2023-32627/): Floating point exception in src/voc.c (medium 6.2)
- [CVE-2023-32626](https://insights.sbomify.com/CVE-2023-32626/): Command injection in LAN-W300N/PR5 (critical 9.8)
- [CVE-2023-32625](https://insights.sbomify.com/CVE-2023-32625/): Cross-site request forgery in TS Webfonts for SAKURA (medium 4.3)
- [CVE-2023-32624](https://insights.sbomify.com/CVE-2023-32624/): Cross-site scripting in TS Webfonts for SAKURA (medium 6.1)
- [CVE-2023-32623](https://insights.sbomify.com/CVE-2023-32623/): Path traversal in Snow Monkey Forms (critical 9.1)
- [CVE-2023-32622](https://insights.sbomify.com/CVE-2023-32622/): Command injection in WL-WN531AX2 (high 7.2)
- [CVE-2023-32621](https://insights.sbomify.com/CVE-2023-32621/): File upload in WL-WN531AX2 (high 7.2)
- [CVE-2023-32620](https://insights.sbomify.com/CVE-2023-32620/): Auth bypass in WL-WN531AX2 (medium 6.5)
- [CVE-2023-3262](https://insights.sbomify.com/CVE-2023-3262/): Hardcoded credentials in iBoot PDU (medium 6.7)
- [CVE-2023-32619](https://insights.sbomify.com/CVE-2023-32619/): Hardcoded credentials in Archer C50 (high 8.8)
- [CVE-2023-32618](https://insights.sbomify.com/CVE-2023-32618/): Privilege escalation in Intel(R) oneAPI Toolkit and component software installers (medium 6.7)
- [CVE-2023-32617](https://insights.sbomify.com/CVE-2023-32617/): Privilege escalation in Intel(R) NUC Rugged Kit, Intel(R) NUC Kit and Intel(R) Compute Element BIOS firmware (high 8.2)
- [CVE-2023-32616](https://insights.sbomify.com/CVE-2023-32616/): Use after free in Foxit Reader (high 8.8)
- [CVE-2023-32615](https://insights.sbomify.com/CVE-2023-32615/): Path traversal in OAS Platform (medium 6.5)
- [CVE-2023-32614](https://insights.sbomify.com/CVE-2023-32614/): Memory corruption in ImageGear (high 7.0)
- [CVE-2023-32613](https://insights.sbomify.com/CVE-2023-32613/): Auth bypass in WL-WN531AX2 (high 8.1)
- [CVE-2023-32612](https://insights.sbomify.com/CVE-2023-32612/): Command injection in WL-WN531AX2 (high 7.2)
- [CVE-2023-32611](https://insights.sbomify.com/CVE-2023-32611/): G_variant_byteswap() can take a long time with some non-normal inputs (medium 5.5)
- [CVE-2023-32610](https://insights.sbomify.com/CVE-2023-32610/): Denial of service in Mailform Pro CGI (high 7.5)
- [CVE-2023-3261](https://insights.sbomify.com/CVE-2023-3261/): Memory corruption in iBoot PDU (high 7.5)
- [CVE-2023-32609](https://insights.sbomify.com/CVE-2023-32609/): Missing authorization in Intel Unite(R) android application (medium 5.0)
- [CVE-2023-32608](https://insights.sbomify.com/CVE-2023-32608/): Path traversal in Pleasanter (Community Edition and Enterprise Edition) (medium 6.5)
- [CVE-2023-32607](https://insights.sbomify.com/CVE-2023-32607/): Cross-site scripting in Pleasanter (Community Edition and Enterprise Edition) (medium 5.4)
- [CVE-2023-32605](https://insights.sbomify.com/CVE-2023-32605/): Cross-site scripting in Trend Micro Apex Central (medium 5.4)
- [CVE-2023-32604](https://insights.sbomify.com/CVE-2023-32604/): Cross-site scripting in Trend Micro Apex Central (medium 5.4)
- [CVE-2023-32603](https://insights.sbomify.com/CVE-2023-32603/): WordPress Donations Made Easy – Smart Donations Plugin <= 4.0.12 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-32602](https://insights.sbomify.com/CVE-2023-32602/): WordPress CALL ME NOW Plugin <= 3.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-32601](https://insights.sbomify.com/CVE-2023-32601/): WordPress Booking Ultra Pro Appointments Booking Calendar Plugin plugin <= 1.1.12 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-32600](https://insights.sbomify.com/CVE-2023-32600/): WordPress Rank Math SEO Plugin <= 1.0.119 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-3260](https://insights.sbomify.com/CVE-2023-3260/): Command injection in iBoot PDU (high 7.2)
- [CVE-2023-32599](https://insights.sbomify.com/CVE-2023-32599/): WordPress reCAPTCHA for all plugin <= 1.22 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-32598](https://insights.sbomify.com/CVE-2023-32598/): WordPress Featured Image Pro Post Grid Plugin <= 5.14 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-32597](https://insights.sbomify.com/CVE-2023-32597/): WordPress Video Gallery Plugin <= 1.0.10 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-32596](https://insights.sbomify.com/CVE-2023-32596/): WordPress weebotLite Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-32595](https://insights.sbomify.com/CVE-2023-32595/): WordPress Sunny Search Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-32594](https://insights.sbomify.com/CVE-2023-32594/): WordPress Hyphenator Plugin <= 5.1.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-32593](https://insights.sbomify.com/CVE-2023-32593/): WordPress GS Pins for Pinterest plugin <= 1.6.7 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-32592](https://insights.sbomify.com/CVE-2023-32592/): WordPress Sunny Search Plugin <= 1.0.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-32591](https://insights.sbomify.com/CVE-2023-32591/): WordPress DBargain Plugin <= 3.0.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-32590](https://insights.sbomify.com/CVE-2023-32590/): WordPress Subscribe to Category Plugin <= 2.7.4 is vulnerable to SQL Injection (critical 9.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/307/