# Vulnerabilities published in 2023


- [CVE-2023-32114](https://insights.sbomify.com/CVE-2023-32114/): Denial of Service in SAP NetWeaver (low 2.7)
- [CVE-2023-32113](https://insights.sbomify.com/CVE-2023-32113/): Information Disclosure vulnerability in SAP GUI for Windows (high 7.5)
- [CVE-2023-32112](https://insights.sbomify.com/CVE-2023-32112/): Missing Authorization Check in Vendor Master Hierarchy (low 2.8)
- [CVE-2023-32111](https://insights.sbomify.com/CVE-2023-32111/): Memory Corruption vulnerability in SAP PowerDesigner (Proxy) (high 7.5)
- [CVE-2023-32110](https://insights.sbomify.com/CVE-2023-32110/): WordPress JupiterX theme <= 3.0.0 - Auth. Local File Inclusion vulnerability (high 7.6)
- [CVE-2023-3211](https://insights.sbomify.com/CVE-2023-3211/): WordPress Database Administrator <= 1.0.3 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2023-32109](https://insights.sbomify.com/CVE-2023-32109/): WordPress Albo Pretorio Online Plugin <= 4.6.3 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-32108](https://insights.sbomify.com/CVE-2023-32108/): WordPress Albo Pretorio Online Plugin <= 4.6.3 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-32107](https://insights.sbomify.com/CVE-2023-32107/): WordPress Photo Gallery by Ays Plugin <= 5.1.3 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-32106](https://insights.sbomify.com/CVE-2023-32106/): WordPress WP Docs Plugin <= 1.9.9 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-32105](https://insights.sbomify.com/CVE-2023-32105/): WordPress WPPizza Plugin <= 3.17.1 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-32104](https://insights.sbomify.com/CVE-2023-32104/): WordPress MyCurator Content Curation Plugin <= 3.74 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-32103](https://insights.sbomify.com/CVE-2023-32103/): WordPress TP Education Plugin <= 4.4 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-32102](https://insights.sbomify.com/CVE-2023-32102/): WordPress Library Viewer Plugin <= 2.0.6 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-32101](https://insights.sbomify.com/CVE-2023-32101/): WordPress Library Viewer Plugin <= 2.0.6 is vulnerable to Open Redirection (medium 4.7)
- [CVE-2023-32100](https://insights.sbomify.com/CVE-2023-32100/): Key duplication in GSDK (medium 5.3)
- [CVE-2023-3210](https://insights.sbomify.com/CVE-2023-3210/): Inefficient Regular Expression Complexity in GitLab (medium 6.5)
- [CVE-2023-32099](https://insights.sbomify.com/CVE-2023-32099/): Key duplication in GSDK (medium 5.3)
- [CVE-2023-32098](https://insights.sbomify.com/CVE-2023-32098/): Key duplication in GSDK (medium 5.3)
- [CVE-2023-32097](https://insights.sbomify.com/CVE-2023-32097/): Key duplication in GSDK (low 3.1)
- [CVE-2023-32096](https://insights.sbomify.com/CVE-2023-32096/): Key duplication in GSDK (low 3.1)
- [CVE-2023-32095](https://insights.sbomify.com/CVE-2023-32095/): WordPress Rename Media Files Plugin <= 1.0.1 is vulnerable to Remote Code Execution (RCE) (critical 9.9)
- [CVE-2023-32094](https://insights.sbomify.com/CVE-2023-32094/): WordPress Extended Post Status plugin <= 1.0.19 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-32093](https://insights.sbomify.com/CVE-2023-32093/): WordPress TPG Redirect Plugin <= 1.0.7 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-32092](https://insights.sbomify.com/CVE-2023-32092/): WordPress Community by PeepSo Plugin <= 6.0.9.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-32091](https://insights.sbomify.com/CVE-2023-32091/): WordPress POEditor Plugin <= 0.9.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-32090](https://insights.sbomify.com/CVE-2023-32090/): Hardcoded credentials in Pega Platform (critical 9.8)
- [CVE-2023-3209](https://insights.sbomify.com/CVE-2023-3209/): MStore API < 3.9.7 - Settings Update via CSRF (low 3.5)
- [CVE-2023-32089](https://insights.sbomify.com/CVE-2023-32089/): Cross-site scripting in Pega Platform (medium 4.6)
- [CVE-2023-32088](https://insights.sbomify.com/CVE-2023-32088/): Cross-site scripting in Pega Platform (medium 4.6)
- [CVE-2023-32087](https://insights.sbomify.com/CVE-2023-32087/): Cross-site scripting in Pega Platform (medium 4.6)
- [CVE-2023-32085](https://insights.sbomify.com/CVE-2023-32085/): Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-32084](https://insights.sbomify.com/CVE-2023-32084/): HTTP.sys Denial of Service Vulnerability (high 7.5)
- [CVE-2023-32083](https://insights.sbomify.com/CVE-2023-32083/): Microsoft Failover Cluster Information Disclosure Vulnerability (medium 6.5)
- [CVE-2023-32082](https://insights.sbomify.com/CVE-2023-32082/): etcd key name can be accessed via LeaseTimeToLive API (low 3.1)
- [CVE-2023-32081](https://insights.sbomify.com/CVE-2023-32081/): Vert.x STOMP server process client frames that would not send initially a connect frame (medium 6.5)
- [CVE-2023-32080](https://insights.sbomify.com/CVE-2023-32080/): Wings vulnerable to escape to host from installation container (critical 9.1)
- [CVE-2023-3208](https://insights.sbomify.com/CVE-2023-3208/): RoadFlow Visual Process Engine .NET Core Mvc Login sql injection (medium 6.3)
- [CVE-2023-32079](https://insights.sbomify.com/CVE-2023-32079/): Netmaker Privilige Escalation Vulnerability (high 8.8)
- [CVE-2023-32078](https://insights.sbomify.com/CVE-2023-32078/): Netmaker IDOR Vulnerability Allows User to Update Other User's Password (high 7.5)
- [CVE-2023-32077](https://insights.sbomify.com/CVE-2023-32077/): Netmaker has Hardcoded DNS Secret Key (high 7.5)
- [CVE-2023-32076](https://insights.sbomify.com/CVE-2023-32076/): in-toto vulnerable to Configuration Read From Local Directory (medium 5.5)
- [CVE-2023-32075](https://insights.sbomify.com/CVE-2023-32075/): Pimcore vulnerable to Business Logic Errors in Customer automation rules (medium 4.3)
- [CVE-2023-32074](https://insights.sbomify.com/CVE-2023-32074/): Nextcloud user_oidc app is missing brute force protection (high 8.0)
- [CVE-2023-32073](https://insights.sbomify.com/CVE-2023-32073/): AVideo command injection vulnerability (high 8.8)
- [CVE-2023-32072](https://insights.sbomify.com/CVE-2023-32072/): Tuleap vulnerable toXSS via the triggered job URL of a Jenkins job (medium 4.8)
- [CVE-2023-32071](https://insights.sbomify.com/CVE-2023-32071/): XWiki Platform vulnerable to RXSS via editor parameter - importinline template (critical 9.1)
- [CVE-2023-32070](https://insights.sbomify.com/CVE-2023-32070/): Improper Neutralization of Script in Attributes in XWiki (X)HTML renderers (critical 9.1)
- [CVE-2023-32069](https://insights.sbomify.com/CVE-2023-32069/): XWiki Platform privilege escalation (PR)/RCE from account through class sheet (critical 10.0)
- [CVE-2023-32068](https://insights.sbomify.com/CVE-2023-32068/): URL Redirection to Untrusted Site in XWiki (medium 4.7)
- [CVE-2023-32067](https://insights.sbomify.com/CVE-2023-32067/): 0-byte UDP payload DoS in c-ares (high 7.5)
- [CVE-2023-32066](https://insights.sbomify.com/CVE-2023-32066/): Time Tracker has Stored XSS vulnerability in Week View plugin (medium 5.4)
- [CVE-2023-32065](https://insights.sbomify.com/CVE-2023-32065/): OroCommerce get-totals-for-checkout API endpoint returns unwanted data (medium 5.8)
- [CVE-2023-32064](https://insights.sbomify.com/CVE-2023-32064/): OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility (medium 5.0)
- [CVE-2023-32063](https://insights.sbomify.com/CVE-2023-32063/): OroCRMCallBundle has incorrect call view page visibility (medium 5.0)
- [CVE-2023-32062](https://insights.sbomify.com/CVE-2023-32062/): OroCalendarBundle has incorrect system calendar events visibility (medium 5.0)
- [CVE-2023-32061](https://insights.sbomify.com/CVE-2023-32061/): Discourse Topic Creation Page Allows iFrame Tag without Restrictions (medium 5.4)
- [CVE-2023-32060](https://insights.sbomify.com/CVE-2023-32060/): Missing authorization in dhis2-core (medium 6.5)
- [CVE-2023-3206](https://insights.sbomify.com/CVE-2023-3206/): Chengdu VEC40G denial of service (medium 5.3)
- [CVE-2023-32059](https://insights.sbomify.com/CVE-2023-32059/): Vyper vulnerable to incorrect ordering of arguments for kwargs passed to internal calls (high 7.5)
- [CVE-2023-32058](https://insights.sbomify.com/CVE-2023-32058/): Vyper vulnerable to integer overflow in loop (high 7.5)
- [CVE-2023-32057](https://insights.sbomify.com/CVE-2023-32057/): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2023-32056](https://insights.sbomify.com/CVE-2023-32056/): Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2023-32055](https://insights.sbomify.com/CVE-2023-32055/): Active Template Library Elevation of Privilege Vulnerability (medium 6.7)
- [CVE-2023-32054](https://insights.sbomify.com/CVE-2023-32054/): Volume Shadow Copy Elevation of Privilege Vulnerability (high 7.3)
- [CVE-2023-32053](https://insights.sbomify.com/CVE-2023-32053/): Windows Installer Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2023-32052](https://insights.sbomify.com/CVE-2023-32052/): Microsoft Power Apps (online) Spoofing Vulnerability (medium 5.4)
- [CVE-2023-32051](https://insights.sbomify.com/CVE-2023-32051/): Raw Image Extension Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-32050](https://insights.sbomify.com/CVE-2023-32050/): Windows Installer Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2023-3205](https://insights.sbomify.com/CVE-2023-3205/): Inefficient Regular Expression Complexity in GitLab (medium 6.5)
- [CVE-2023-32049](https://insights.sbomify.com/CVE-2023-32049/): Microsoft Windows Defender SmartScreen Security Feature Bypass (high 8.8, exploited in the wild)
- [CVE-2023-32047](https://insights.sbomify.com/CVE-2023-32047/): Paint 3D Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-32046](https://insights.sbomify.com/CVE-2023-32046/): Microsoft Windows MSHTML Platform Privilege Escalation (high 7.8, exploited in the wild)
- [CVE-2023-32045](https://insights.sbomify.com/CVE-2023-32045/): Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability (high 7.5)
- [CVE-2023-32044](https://insights.sbomify.com/CVE-2023-32044/): Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability (high 7.5)
- [CVE-2023-32043](https://insights.sbomify.com/CVE-2023-32043/): Windows Remote Desktop Security Feature Bypass Vulnerability (medium 6.8)
- [CVE-2023-32042](https://insights.sbomify.com/CVE-2023-32042/): OLE Automation Information Disclosure Vulnerability (medium 6.5)
- [CVE-2023-32041](https://insights.sbomify.com/CVE-2023-32041/): Windows Update Orchestrator Service Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-32040](https://insights.sbomify.com/CVE-2023-32040/): Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-3204](https://insights.sbomify.com/CVE-2023-3204/): Materialis <= 1.1.24 - Missing Authorization to Limited Arbitrary Options Update (medium 6.5)
- [CVE-2023-32039](https://insights.sbomify.com/CVE-2023-32039/): Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-32038](https://insights.sbomify.com/CVE-2023-32038/): Microsoft ODBC Driver Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-32037](https://insights.sbomify.com/CVE-2023-32037/): Windows Layer-2 Bridge Network Driver Information Disclosure Vulnerability (medium 6.5)
- [CVE-2023-32035](https://insights.sbomify.com/CVE-2023-32035/): Remote Procedure Call Runtime Denial of Service Vulnerability (medium 6.5)
- [CVE-2023-32034](https://insights.sbomify.com/CVE-2023-32034/): Remote Procedure Call Runtime Denial of Service Vulnerability (medium 6.5)
- [CVE-2023-32033](https://insights.sbomify.com/CVE-2023-32033/): Microsoft Failover Cluster Remote Code Execution Vulnerability (medium 6.6)
- [CVE-2023-32032](https://insights.sbomify.com/CVE-2023-32032/): .NET and Visual Studio Elevation of Privilege Vulnerability (medium 6.5)
- [CVE-2023-32031](https://insights.sbomify.com/CVE-2023-32031/): Microsoft Exchange Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-32030](https://insights.sbomify.com/CVE-2023-32030/): .NET and Visual Studio Denial of Service Vulnerability (high 7.5)
- [CVE-2023-3203](https://insights.sbomify.com/CVE-2023-3203/): MStore API <= 3.9.6 - Cross-Site Request Forgery to Product Limit Update (medium 4.3)
- [CVE-2023-32029](https://insights.sbomify.com/CVE-2023-32029/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-32028](https://insights.sbomify.com/CVE-2023-32028/): Microsoft SQL OLE DB Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-32027](https://insights.sbomify.com/CVE-2023-32027/): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-32026](https://insights.sbomify.com/CVE-2023-32026/): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-32025](https://insights.sbomify.com/CVE-2023-32025/): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-32024](https://insights.sbomify.com/CVE-2023-32024/): Microsoft Power Apps Spoofing Vulnerability (low 3.0)
- [CVE-2023-32022](https://insights.sbomify.com/CVE-2023-32022/): Windows Server Service Security Feature Bypass Vulnerability (high 7.6)
- [CVE-2023-32021](https://insights.sbomify.com/CVE-2023-32021/): Windows SMB Witness Service Security Feature Bypass Vulnerability (high 7.1)
- [CVE-2023-32020](https://insights.sbomify.com/CVE-2023-32020/): Windows DNS Spoofing Vulnerability (medium 5.6)
- [CVE-2023-3202](https://insights.sbomify.com/CVE-2023-3202/): MStore API <= 3.9.6 - Cross-Site Request Forgery to Firebase Server Key Update (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/313/