# Vulnerabilities published in 2023


- [CVE-2023-3259](https://insights.sbomify.com/CVE-2023-3259/): Auth bypass in iBoot PDU (critical 9.8)
- [CVE-2023-32589](https://insights.sbomify.com/CVE-2023-32589/): WordPress Dyslexiefont Free Plugin <= 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-32588](https://insights.sbomify.com/CVE-2023-32588/): WordPress Post State Tags Plugin <= 2.0.6 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-32587](https://insights.sbomify.com/CVE-2023-32587/): WordPress WP Reactions Lite Plugin <= 1.3.8 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-32586](https://insights.sbomify.com/CVE-2023-32586/): WordPress SoundCloud Is Gold plugin <= 2.5.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-32585](https://insights.sbomify.com/CVE-2023-32585/): WordPress Portfolio Gallery – Responsive Image Gallery plugin <= 1.4.6 - Broken Access Control vulnerability (high 7.5)
- [CVE-2023-32584](https://insights.sbomify.com/CVE-2023-32584/): WordPress eBecas Plugin <= 3.1.3 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-32583](https://insights.sbomify.com/CVE-2023-32583/): WordPress WP All Backup Plugin <= 2.4.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 6.3)
- [CVE-2023-32582](https://insights.sbomify.com/CVE-2023-32582/): WordPress Don8 Plugin <= 0.4 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-32581](https://insights.sbomify.com/CVE-2023-32581/): WordPress WP-Chatbot for Messenger plugin <= 4.7 - Broken Access Control (medium 5.4)
- [CVE-2023-32580](https://insights.sbomify.com/CVE-2023-32580/): WordPress Password Protected Plugin <= 2.6.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-32579](https://insights.sbomify.com/CVE-2023-32579/): WordPress Forget About Shortcode Buttons Plugin <= 2.1.2 is vulnerable to Broken Access Control (medium 5.3)
- [CVE-2023-32578](https://insights.sbomify.com/CVE-2023-32578/): WordPress Column-Matic Plugin <= 1.3.3 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-32577](https://insights.sbomify.com/CVE-2023-32577/): WordPress DevBuddy Twitter Feed Plugin <= 4.0.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-32576](https://insights.sbomify.com/CVE-2023-32576/): WordPress Locatoraid Store Locator Plugin <= 3.9.18 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-32575](https://insights.sbomify.com/CVE-2023-32575/): WordPress Product page shipping calculator for WooCommerce Plugin <= 1.3.25 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-32574](https://insights.sbomify.com/CVE-2023-32574/): WordPress Injection Guard plugin <= 1.2.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-32573](https://insights.sbomify.com/CVE-2023-32573/): Memory corruption in qt:qt (medium 6.5)
- [CVE-2023-32572](https://insights.sbomify.com/CVE-2023-32572/): FlashArray pgroup Retention Lock SafeMode Protection (medium 6.5)
- [CVE-2023-32571](https://insights.sbomify.com/CVE-2023-32571/): Dynamic Linq vulnerable to remote code execution (critical 9.8)
- [CVE-2023-32570](https://insights.sbomify.com/CVE-2023-32570/): Race condition in fedoraproject:fedora (medium 5.9)
- [CVE-2023-32569](https://insights.sbomify.com/CVE-2023-32569/): SQL injection in veritas:infoscale operations manager (high 7.2)
- [CVE-2023-32568](https://insights.sbomify.com/CVE-2023-32568/): Command injection in veritas:infoscale operations manager (high 7.2)
- [CVE-2023-32567](https://insights.sbomify.com/CVE-2023-32567/): XML external entity in Wavelink (medium 6.5)
- [CVE-2023-32566](https://insights.sbomify.com/CVE-2023-32566/): Information disclosure in Avalanche (medium 6.3)
- [CVE-2023-32565](https://insights.sbomify.com/CVE-2023-32565/): Information disclosure in Avalanche (medium 6.3)
- [CVE-2023-32564](https://insights.sbomify.com/CVE-2023-32564/): File upload in Avalanche (medium 6.8)
- [CVE-2023-32563](https://insights.sbomify.com/CVE-2023-32563/): Path traversal in Avalanche (high 8.8)
- [CVE-2023-32562](https://insights.sbomify.com/CVE-2023-32562/): File upload in Avalanche (medium 6.8)
- [CVE-2023-32561](https://insights.sbomify.com/CVE-2023-32561/): Information disclosure in Avalanche (high 7.1)
- [CVE-2023-32560](https://insights.sbomify.com/CVE-2023-32560/): Memory corruption in Avalanche (high 8.8)
- [CVE-2023-3256](https://insights.sbomify.com/CVE-2023-3256/): Advantech R-SeeNet External Control of File Name or Path (high 8.8)
- [CVE-2023-32559](https://insights.sbomify.com/CVE-2023-32559/): Privilege escalation in Node (high 7.5)
- [CVE-2023-32558](https://insights.sbomify.com/CVE-2023-32558/): Path traversal in Node (high 7.5)
- [CVE-2023-32557](https://insights.sbomify.com/CVE-2023-32557/): Path traversal in Trend Micro Apex One (critical 9.8)
- [CVE-2023-32556](https://insights.sbomify.com/CVE-2023-32556/): Information disclosure in Trend Micro Apex One (medium 5.5)
- [CVE-2023-32555](https://insights.sbomify.com/CVE-2023-32555/): Race condition in Trend Micro Apex One (high 7.0)
- [CVE-2023-32554](https://insights.sbomify.com/CVE-2023-32554/): Race condition in Trend Micro Apex One (high 7.0)
- [CVE-2023-32553](https://insights.sbomify.com/CVE-2023-32553/): Missing authorization in Trend Micro Apex One (medium 5.3)
- [CVE-2023-32552](https://insights.sbomify.com/CVE-2023-32552/): Missing authorization in Trend Micro Apex One (medium 5.3)
- [CVE-2023-32551](https://insights.sbomify.com/CVE-2023-32551/): Landscape Open Redirect (medium 6.1)
- [CVE-2023-32550](https://insights.sbomify.com/CVE-2023-32550/): Landscape's Apache server-status is accessible by default (critical 9.3)
- [CVE-2023-3255](https://insights.sbomify.com/CVE-2023-3255/): Qemu: vnc: infinite loop in inflate_buffer() leads to denial of service (medium 6.5)
- [CVE-2023-32549](https://insights.sbomify.com/CVE-2023-32549/): Landscape insecure token generation (medium 6.8)
- [CVE-2023-32548](https://insights.sbomify.com/CVE-2023-32548/): Command injection in WPS Office (high 8.1)
- [CVE-2023-32547](https://insights.sbomify.com/CVE-2023-32547/): Misconfiguration in MAVinci Desktop Software for Intel(R) Falcon 8+ (medium 6.7)
- [CVE-2023-32546](https://insights.sbomify.com/CVE-2023-32546/): Code injection in Chatwork Desktop Application (Mac) (medium 4.4)
- [CVE-2023-32545](https://insights.sbomify.com/CVE-2023-32545/): Memory corruption in Cscape (high 7.8)
- [CVE-2023-32544](https://insights.sbomify.com/CVE-2023-32544/): Missing authorization in Intel HotKey Services for Windows 10 for Intel NUC P14E Laptop Element software installers (high 7.3)
- [CVE-2023-32543](https://insights.sbomify.com/CVE-2023-32543/): Misconfiguration in Intel(R) ITS sofware (medium 6.7)
- [CVE-2023-32542](https://insights.sbomify.com/CVE-2023-32542/): Memory corruption in TELLUS and TELLUS Lite (high 7.8)
- [CVE-2023-32541](https://insights.sbomify.com/CVE-2023-32541/): Use after free in Hancom Office 2020 (high 8.8)
- [CVE-2023-32540](https://insights.sbomify.com/CVE-2023-32540/): Code injection in WebAccess/SCADA (high 7.2)
- [CVE-2023-3254](https://insights.sbomify.com/CVE-2023-3254/): Widgets for Google Reviews <= 10.9 - Cross-Site Request Forgery to Plugin Settings Reset (medium 4.3)
- [CVE-2023-32539](https://insights.sbomify.com/CVE-2023-32539/): Horner Automation Cscape Out-of-bounds Write (high 7.8)
- [CVE-2023-32538](https://insights.sbomify.com/CVE-2023-32538/): Memory corruption in TELLUS and TELLUS Lite (high 7.8)
- [CVE-2023-32537](https://insights.sbomify.com/CVE-2023-32537/): Cross-site scripting in Trend Micro Apex Central (medium 5.4)
- [CVE-2023-32536](https://insights.sbomify.com/CVE-2023-32536/): Cross-site scripting in Trend Micro Apex Central (medium 5.4)
- [CVE-2023-32535](https://insights.sbomify.com/CVE-2023-32535/): Cross-site scripting in Trend Micro Apex Central (medium 6.1)
- [CVE-2023-32534](https://insights.sbomify.com/CVE-2023-32534/): Cross-site scripting in Trend Micro Apex Central (medium 6.1)
- [CVE-2023-32533](https://insights.sbomify.com/CVE-2023-32533/): Cross-site scripting in Trend Micro Apex Central (medium 6.1)
- [CVE-2023-32532](https://insights.sbomify.com/CVE-2023-32532/): Cross-site scripting in Trend Micro Apex Central (medium 6.1)
- [CVE-2023-32531](https://insights.sbomify.com/CVE-2023-32531/): Cross-site scripting in Trend Micro Apex Central (medium 6.1)
- [CVE-2023-32530](https://insights.sbomify.com/CVE-2023-32530/): SQL injection in Trend Micro Apex Central (high 8.8)
- [CVE-2023-3253](https://insights.sbomify.com/CVE-2023-3253/): Improper authorization in Nessus (medium 4.3)
- [CVE-2023-32529](https://insights.sbomify.com/CVE-2023-32529/): SQL injection in Trend Micro Apex Central (high 8.8)
- [CVE-2023-32528](https://insights.sbomify.com/CVE-2023-32528/): Code injection in Trend Micro Moibile Security for Enterprise (high 8.8)
- [CVE-2023-32527](https://insights.sbomify.com/CVE-2023-32527/): Code injection in Trend Micro Moibile Security for Enterprise (high 8.8)
- [CVE-2023-32526](https://insights.sbomify.com/CVE-2023-32526/): File upload in Trend Micro Moibile Security for Enterprise (medium 6.5)
- [CVE-2023-32525](https://insights.sbomify.com/CVE-2023-32525/): File upload in Trend Micro Moibile Security for Enterprise (medium 6.5)
- [CVE-2023-32524](https://insights.sbomify.com/CVE-2023-32524/): Auth bypass in Trend Micro Moibile Security for Enterprise (high 8.8)
- [CVE-2023-32523](https://insights.sbomify.com/CVE-2023-32523/): Auth bypass in Trend Micro Moibile Security for Enterprise (high 8.8)
- [CVE-2023-32522](https://insights.sbomify.com/CVE-2023-32522/): Path traversal in Trend Micro Moibile Security for Enterprise (high 8.1)
- [CVE-2023-32521](https://insights.sbomify.com/CVE-2023-32521/): Path traversal in Trend Micro Moibile Security for Enterprise (critical 9.1)
- [CVE-2023-32520](https://insights.sbomify.com/CVE-2023-32520/): WordPress WCP Contact Form plugin <= 3.1.0 - Broken Access Control vulnerability (high 7.5)
- [CVE-2023-3252](https://insights.sbomify.com/CVE-2023-3252/): Arbitrary File Write (medium 6.8)
- [CVE-2023-32519](https://insights.sbomify.com/CVE-2023-32519/): WordPress WCP Contact Form plugin <= 3.1.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-32518](https://insights.sbomify.com/CVE-2023-32518/): WordPress WP Chinese Conversion Plugin <= 1.1.16 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-32517](https://insights.sbomify.com/CVE-2023-32517/): WordPress MailChimp Subscribe Forms Plugin <= 4.0.9.3 is vulnerable to Open Redirection (medium 4.7)
- [CVE-2023-32516](https://insights.sbomify.com/CVE-2023-32516/): Cross-site scripting in Restaurant Menu – Food Ordering System – Table Reservation (high 7.1)
- [CVE-2023-32515](https://insights.sbomify.com/CVE-2023-32515/): WordPress Custom Field Suite Plugin <= 2.6.2.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-32514](https://insights.sbomify.com/CVE-2023-32514/): Cross-site request forgery in Google Site Verification plugin using Meta Tag (medium 5.4)
- [CVE-2023-32513](https://insights.sbomify.com/CVE-2023-32513/): WordPress GiveWP Plugin <= 2.25.3 is vulnerable to PHP Object Injection (high 7.5)
- [CVE-2023-32512](https://insights.sbomify.com/CVE-2023-32512/): WordPress ShortPixel Adaptive Images Plugin <= 3.7.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-32511](https://insights.sbomify.com/CVE-2023-32511/): WordPress Booking Ultra Pro Plugin <= 1.1.8 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-32510](https://insights.sbomify.com/CVE-2023-32510/): WordPress Order Your Posts Manually Plugin <= 2.2.5 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-3251](https://insights.sbomify.com/CVE-2023-3251/): Pass-back vulnerability in Nessus (medium 4.1)
- [CVE-2023-32509](https://insights.sbomify.com/CVE-2023-32509/): WordPress Order Your Posts Manually Plugin <= 2.2.5 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-32508](https://insights.sbomify.com/CVE-2023-32508/): WordPress Order Your Posts Manually Plugin <= 2.2.5 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-32507](https://insights.sbomify.com/CVE-2023-32507/): WordPress Woo Custom Emails plugin <= 2.2 - Broken Access Control vulnerability (high 7.3)
- [CVE-2023-32506](https://insights.sbomify.com/CVE-2023-32506/): WordPress Link Whisper Free plugin <= 0.6.3 - Unauthenticated Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-32505](https://insights.sbomify.com/CVE-2023-32505/): WordPress Easy Hide Login Plugin <= 1.0.7 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-32504](https://insights.sbomify.com/CVE-2023-32504/): WordPress Wise Chat Plugin <= 3.1.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-32503](https://insights.sbomify.com/CVE-2023-32503/): WordPress GTmetrix for WordPress Plugin <= 0.4.6 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-32502](https://insights.sbomify.com/CVE-2023-32502/): WordPress Pro Mime Types Plugin <= 1.0.7 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-32501](https://insights.sbomify.com/CVE-2023-32501/): WordPress VikBooking Hotel Booking Engine & PMS Plugin <= 1.6.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-32500](https://insights.sbomify.com/CVE-2023-32500/): WordPress WoodMart Theme <= 7.1.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-32499](https://insights.sbomify.com/CVE-2023-32499/): WordPress Radio Station Plugin <= 2.4.0.9 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-32498](https://insights.sbomify.com/CVE-2023-32498/): WordPress Easy Form by AYS Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-32497](https://insights.sbomify.com/CVE-2023-32497/): WordPress Block Referer Spam Plugin <= 1.1.9.4 is vulnerable to Cross Site Scripting (XSS) (medium 5.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/308/