# Vulnerabilities published in 2023


- [CVE-2023-32301](https://insights.sbomify.com/CVE-2023-32301/): Discourse's canonical url not being used for topic embeddings (low 3.1)
- [CVE-2023-32300](https://insights.sbomify.com/CVE-2023-32300/): WordPress Yoast SEO: Local Plugin <= 14.8 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-3230](https://insights.sbomify.com/CVE-2023-3230/): Missing Authorization in fossbilling/fossbilling (medium 4.6)
- [CVE-2023-32299](https://insights.sbomify.com/CVE-2023-32299/): WordPress Ni WooCommerce Sales Report plugin <= 3.7.3 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-32298](https://insights.sbomify.com/CVE-2023-32298/): WordPress Simple User Listing Plugin <= 1.9.2 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-32297](https://insights.sbomify.com/CVE-2023-32297/): WordPress LWS Affiliation plugin <= 2.2.6 - Local File Inclusion vulnerability (critical 9.0)
- [CVE-2023-32296](https://insights.sbomify.com/CVE-2023-32296/): WordPress Kangu para WooCommerce Plugin <= 2.2.9 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-32295](https://insights.sbomify.com/CVE-2023-32295/): WordPress Easy!Appointments plugin <= 1.3.3 - Arbitrary File Deletion vulnerability (medium 6.3)
- [CVE-2023-32294](https://insights.sbomify.com/CVE-2023-32294/): WordPress GDPR Cookie Consent Notice Box Plugin <= 1.1.6 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-32293](https://insights.sbomify.com/CVE-2023-32293/): WordPress WRC Pricing Tables plugin <= 2.3.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-32292](https://insights.sbomify.com/CVE-2023-32292/): WordPress Chat Button Plugin <= 1.8.9.4 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-32291](https://insights.sbomify.com/CVE-2023-32291/): WordPress MonsterInsights Pro Plugin <= 8.14.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-32290](https://insights.sbomify.com/CVE-2023-32290/): Information disclosure in vk.company:mymail (high 7.5)
- [CVE-2023-3229](https://insights.sbomify.com/CVE-2023-3229/): Business Logic Errors in fossbilling/fossbilling (medium 5.4)
- [CVE-2023-32289](https://insights.sbomify.com/CVE-2023-32289/): Memory corruption in Cscape (high 7.8)
- [CVE-2023-32288](https://insights.sbomify.com/CVE-2023-32288/): Memory corruption in TELLUS and TELLUS Lite (high 7.8)
- [CVE-2023-32285](https://insights.sbomify.com/CVE-2023-32285/): Missing authorization in Intel(R) NUC BIOS firmware (medium 6.0)
- [CVE-2023-32284](https://insights.sbomify.com/CVE-2023-32284/): Memory corruption in ImageGear (high 8.1)
- [CVE-2023-32283](https://insights.sbomify.com/CVE-2023-32283/): Information disclosure in Intel(R) On Demand software (medium 5.5)
- [CVE-2023-32282](https://insights.sbomify.com/CVE-2023-32282/): Race condition in Intel(R) Processors (high 7.2)
- [CVE-2023-32281](https://insights.sbomify.com/CVE-2023-32281/): Memory corruption in Cscape (high 7.8)
- [CVE-2023-32280](https://insights.sbomify.com/CVE-2023-32280/): Information disclosure in Intel(R) Server Product OpenBMC firmware (medium 5.3)
- [CVE-2023-3228](https://insights.sbomify.com/CVE-2023-3228/): Business Logic Errors in fossbilling/fossbilling (medium 5.4)
- [CVE-2023-32279](https://insights.sbomify.com/CVE-2023-32279/): Missing authorization in Intel(R) Connectivity Performance Suite (high 7.5)
- [CVE-2023-32278](https://insights.sbomify.com/CVE-2023-32278/): Path traversal in Intel(R) NUC Uniwill Service Driver for Intel(R) NUC M15 Laptop Kits - LAPRC510 & LAPRC710 Uniwill Service Driver installation software (medium 6.7)
- [CVE-2023-32277](https://insights.sbomify.com/CVE-2023-32277/): Memory corruption in Intel(R) QAT software (medium 4.3)
- [CVE-2023-32276](https://insights.sbomify.com/CVE-2023-32276/): Memory corruption in TELLUS and TELLUS Lite (high 7.8)
- [CVE-2023-32275](https://insights.sbomify.com/CVE-2023-32275/): Information disclosure in SoftEther VPN (medium 5.5)
- [CVE-2023-32274](https://insights.sbomify.com/CVE-2023-32274/): Enphase Installer Toolkit Android App Use of Hard-coded Credentials (high 8.6)
- [CVE-2023-32273](https://insights.sbomify.com/CVE-2023-32273/): Memory corruption in TELLUS and TELLUS Lite (high 7.8)
- [CVE-2023-32272](https://insights.sbomify.com/CVE-2023-32272/): Other in Intel NUC Pro Software Suite Configuration Tool software installers (high 7.9)
- [CVE-2023-32271](https://insights.sbomify.com/CVE-2023-32271/): Information disclosure in OAS Platform (medium 6.5)
- [CVE-2023-32270](https://insights.sbomify.com/CVE-2023-32270/): Memory corruption in TELLUS and TELLUS Lite (high 7.8)
- [CVE-2023-3227](https://insights.sbomify.com/CVE-2023-3227/): Insufficient Granularity of Access Control in fossbilling/fossbilling (medium 5.4)
- [CVE-2023-32269](https://insights.sbomify.com/CVE-2023-32269/): Use after free in linux:linux kernel (medium 6.7)
- [CVE-2023-32268](https://insights.sbomify.com/CVE-2023-32268/): Administrator equivalent Filr user can access proxy administrator credentials (high 7.2)
- [CVE-2023-32267](https://insights.sbomify.com/CVE-2023-32267/): OpenText / Micro Focus ArcSight Management Center Remote Vulnerability (medium 6.4)
- [CVE-2023-32266](https://insights.sbomify.com/CVE-2023-32266/): Code injection vulnerability found in OpenText Application Lifecycle Management (ALM),Quality Center. (medium 5.3)
- [CVE-2023-32265](https://insights.sbomify.com/CVE-2023-32265/): Mitigations and availability of updates relating to security vulnerability in ESCWA component CVE-2023-32265. (high 7.1)
- [CVE-2023-32264](https://insights.sbomify.com/CVE-2023-32264/): Security feature bypass in Documentum D2 (medium 5.8)
- [CVE-2023-32263](https://insights.sbomify.com/CVE-2023-32263/): Dimensions CM Plugin for Jenkins 0.8.17 – 0.9.3 (low 2.6)
- [CVE-2023-32262](https://insights.sbomify.com/CVE-2023-32262/): Dimensions CM Plugin for Jenkins 0.8.17 – 0.9.3 (medium 4.3)
- [CVE-2023-32261](https://insights.sbomify.com/CVE-2023-32261/): Dimensions CM Plugin for Jenkins 0.8.17 – 0.9.3 (medium 4.2)
- [CVE-2023-32260](https://insights.sbomify.com/CVE-2023-32260/): A potential Misinterpretation of Input vulnerability has been identified in SMAX, AMX, and HCMX products. (medium 6.5)
- [CVE-2023-3226](https://insights.sbomify.com/CVE-2023-3226/): Popup Builder < 4.2.0 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2023-32259](https://insights.sbomify.com/CVE-2023-32259/): Potential Insufficient Access Control vulnerability has been identified in OpenText™ SMAX/AMX products. (medium 6.5)
- [CVE-2023-32258](https://insights.sbomify.com/CVE-2023-32258/): Session race condition remote code execution vulnerability (high 8.1)
- [CVE-2023-32257](https://insights.sbomify.com/CVE-2023-32257/): Session race condition remote code execution vulnerability (high 8.1)
- [CVE-2023-32256](https://insights.sbomify.com/CVE-2023-32256/): Kernel: ksmbd race issue from smb2 close and logoff with multichannel (high 7.5)
- [CVE-2023-32255](https://insights.sbomify.com/CVE-2023-32255/): Kernel: memory leak via ksmbd session setup request with unknown ntlmssp message type (medium 5.3)
- [CVE-2023-32254](https://insights.sbomify.com/CVE-2023-32254/): Tree connection race condition remote code execution vulnerability (critical 9.8)
- [CVE-2023-32253](https://insights.sbomify.com/CVE-2023-32253/): Kernel: deadlock in ksmbd_find_crypto_ctx() (medium 5.9)
- [CVE-2023-32252](https://insights.sbomify.com/CVE-2023-32252/): Session null pointer dereference denial-of-service vulnerability (high 7.5)
- [CVE-2023-32251](https://insights.sbomify.com/CVE-2023-32251/): Kernel: ksmbd brute force delay bypass via asynchronous requests (low 3.7)
- [CVE-2023-32250](https://insights.sbomify.com/CVE-2023-32250/): Session race condition remote code execution vulnerability (critical 9.0)
- [CVE-2023-3225](https://insights.sbomify.com/CVE-2023-3225/): Float menu < 5.0.3 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2023-32249](https://insights.sbomify.com/CVE-2023-32249/): ksmbd: not allow guest user on multichannel (critical 9.1)
- [CVE-2023-32248](https://insights.sbomify.com/CVE-2023-32248/): Tree connection null pointer dereference denial-of-service vulnerability (high 7.5)
- [CVE-2023-32247](https://insights.sbomify.com/CVE-2023-32247/): Session setup memory exhaustion denial-of-service vulnerability (high 7.5)
- [CVE-2023-32246](https://insights.sbomify.com/CVE-2023-32246/): ksmbd: call rcu_barrier() in ksmbd_server_exit() (medium 5.5)
- [CVE-2023-32245](https://insights.sbomify.com/CVE-2023-32245/): WordPress Essential Addons for Elementor Pro Plugin <= 5.4.8 is vulnerable to Server Side Request Forgery (SSRF) (medium 5.4)
- [CVE-2023-32244](https://insights.sbomify.com/CVE-2023-32244/): WordPress Woodmart Core plugin <= 1.0.36 - Privilege Escalation (critical 9.8)
- [CVE-2023-32243](https://insights.sbomify.com/CVE-2023-32243/): WordPress Essential Addons for Elementor Plugin 5.4.0-5.7.1 is vulnerable to Privilege Escalation (critical 9.8)
- [CVE-2023-32242](https://insights.sbomify.com/CVE-2023-32242/): WordPress Woodmart Core Plugin <= 1.0.36 is vulnerable to PHP Object Injection (critical 9.8)
- [CVE-2023-32241](https://insights.sbomify.com/CVE-2023-32241/): WordPress Essential Addons for Elementor Pro Plugin <= 5.4.8 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-32240](https://insights.sbomify.com/CVE-2023-32240/): WordPress Woodmart theme <= 7.2.1 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-3224](https://insights.sbomify.com/CVE-2023-3224/): Code Injection in nuxt/nuxt (high 8.1)
- [CVE-2023-32239](https://insights.sbomify.com/CVE-2023-32239/): WordPress WoodMart Theme <= 7.2.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.4)
- [CVE-2023-32238](https://insights.sbomify.com/CVE-2023-32238/): WordPress TheGem theme < 5.8.1.1 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-32237](https://insights.sbomify.com/CVE-2023-32237/): Auth. Stored Cross-Site Scripting (XSS) vulnerability in TheGem theme by CodexThemes (medium 5.4)
- [CVE-2023-32236](https://insights.sbomify.com/CVE-2023-32236/): WordPress Booking Ultra Pro Plugin <= 1.1.8 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-32235](https://insights.sbomify.com/CVE-2023-32235/): Path Traversal in Ghost (high 7.5)
- [CVE-2023-32233](https://insights.sbomify.com/CVE-2023-32233/): Use after free in linux:linux kernel (high 7.8)
- [CVE-2023-32232](https://insights.sbomify.com/CVE-2023-32232/): Privilege escalation in vasion:printerlogic client (critical 9.9)
- [CVE-2023-32231](https://insights.sbomify.com/CVE-2023-32231/): Privilege escalation in vasion:printerlogic client (critical 9.9)
- [CVE-2023-32230](https://insights.sbomify.com/CVE-2023-32230/): Denial of service in Monitorwall (high 7.5)
- [CVE-2023-3223](https://insights.sbomify.com/CVE-2023-3223/): Undertow: outofmemoryerror due to @multipartconfig handling (high 7.5)
- [CVE-2023-32229](https://insights.sbomify.com/CVE-2023-32229/): Denial of service in Camera Firmware (medium 4.9)
- [CVE-2023-32228](https://insights.sbomify.com/CVE-2023-32228/): Auth bypass in AMS (medium 4.6)
- [CVE-2023-32227](https://insights.sbomify.com/CVE-2023-32227/): Synel SYnergy Fingerprint Terminals - CWE-798: Use of Hard-coded Credentials (critical 9.8)
- [CVE-2023-32226](https://insights.sbomify.com/CVE-2023-32226/): Sysaid - CWE-552: Files or Directories Accessible to External Parties (high 8.3)
- [CVE-2023-32225](https://insights.sbomify.com/CVE-2023-32225/): Sysaid - CWE-434: Unrestricted Upload of File with Dangerous Type (critical 9.8)
- [CVE-2023-32224](https://insights.sbomify.com/CVE-2023-32224/): D-Link DSL-224 firmware version 3.0.10 CWE-307: Improper Restriction of Excessive Authentication Attempts (critical 9.8)
- [CVE-2023-32223](https://insights.sbomify.com/CVE-2023-32223/): D-Link DSL-224 firmware version 3.0.10 post authentication command execution (high 8.8)
- [CVE-2023-32222](https://insights.sbomify.com/CVE-2023-32222/): D-Link DSL-G256DG firmware version vBZ_1.00.27 Authentication Bypass (critical 9.8)
- [CVE-2023-32221](https://insights.sbomify.com/CVE-2023-32221/): EaseUS Todo Backup may allow local privilege escalation (high 8.8)
- [CVE-2023-32220](https://insights.sbomify.com/CVE-2023-32220/): Milesight NCR/Camera Authentication Bypass (high 8.2)
- [CVE-2023-3222](https://insights.sbomify.com/CVE-2023-3222/): Vulnerability in the password recovery mechanism of Roundcube Password Recovery Plugin (high 7.5)
- [CVE-2023-32219](https://insights.sbomify.com/CVE-2023-32219/): Mazda cars unlocking (medium 6.5)
- [CVE-2023-32218](https://insights.sbomify.com/CVE-2023-32218/): Avaya IX Workforce Engagement - CWE-601: URL Redirection to Untrusted Site ('Open Redirect') (medium 6.1)
- [CVE-2023-32217](https://insights.sbomify.com/CVE-2023-32217/): SailPoint IdentityIQ Unsafe use of Reflection Vulnerability (critical 9.0)
- [CVE-2023-32216](https://insights.sbomify.com/CVE-2023-32216/): Memory corruption in Firefox (critical 9.8)
- [CVE-2023-32215](https://insights.sbomify.com/CVE-2023-32215/): Memory corruption in Firefox (high 8.8)
- [CVE-2023-32214](https://insights.sbomify.com/CVE-2023-32214/): Denial of service in Firefox (high 7.5)
- [CVE-2023-32213](https://insights.sbomify.com/CVE-2023-32213/): Memory corruption in Firefox (high 8.8)
- [CVE-2023-32212](https://insights.sbomify.com/CVE-2023-32212/): Other in Firefox (medium 4.3)
- [CVE-2023-32211](https://insights.sbomify.com/CVE-2023-32211/): Memory corruption in Firefox (medium 6.5)
- [CVE-2023-32210](https://insights.sbomify.com/CVE-2023-32210/): Privilege escalation in Firefox (medium 6.5)
- [CVE-2023-3221](https://insights.sbomify.com/CVE-2023-3221/): User enumeration vulnerability in Roundcube Password Recovery Plugin (medium 5.3)
- [CVE-2023-32209](https://insights.sbomify.com/CVE-2023-32209/): Memory corruption in Firefox (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/311/