# Vulnerabilities published in 2023


- [CVE-2023-3053](https://insights.sbomify.com/CVE-2023-3053/): Page Builder by AZEXO <= 1.27.133 - Missing Authorization to Post Creation (medium 5.4)
- [CVE-2023-30529](https://insights.sbomify.com/CVE-2023-30529/): Jenkins Lucene-Search Plugin vulnerable to Cross-Site Request Forgery (medium 4.3)
- [CVE-2023-30528](https://insights.sbomify.com/CVE-2023-30528/): Jenkins WSO2 Oauth Plugin does not mask the WSO2 Oauth client secret on the global configuration form (medium 6.5)
- [CVE-2023-30527](https://insights.sbomify.com/CVE-2023-30527/): Jenkins WSO2 Oauth Plugin stores WSO2 Oauth client secret unencrypted in global config.xml file on Jenkins controller (medium 4.3)
- [CVE-2023-30526](https://insights.sbomify.com/CVE-2023-30526/): Jenkins Report Portal Plugin missing permissions check (medium 6.5)
- [CVE-2023-30525](https://insights.sbomify.com/CVE-2023-30525/): Jenkins Report Portal Plugin Cross-Site Request Forgery vulnerability (high 8.8)
- [CVE-2023-30524](https://insights.sbomify.com/CVE-2023-30524/): Jenkins Report Portal Plugin configuration form does not mask tokens (medium 4.3)
- [CVE-2023-30523](https://insights.sbomify.com/CVE-2023-30523/): Jenkins Report Portal Plugin allows users with Item/Extended Read permission to view tokens on Jenkins controller (medium 4.3)
- [CVE-2023-30522](https://insights.sbomify.com/CVE-2023-30522/): Jenkins Fogbugz Plugin has missing permissions check (medium 4.3)
- [CVE-2023-30521](https://insights.sbomify.com/CVE-2023-30521/): Jenkins Assembla merge request builder Plugin missing authentication to access endpoint (medium 5.3)
- [CVE-2023-30520](https://insights.sbomify.com/CVE-2023-30520/): Jenkins Quay.io trigger Plugin Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2023-3052](https://insights.sbomify.com/CVE-2023-3052/): Page Builder by AZEXO <= 1.27.133 - Cross-Site Request Forgery to Post Creation/Modification/Deletion (medium 6.3)
- [CVE-2023-30519](https://insights.sbomify.com/CVE-2023-30519/): Jenkins Quay.io trigger Plugin webhook endpoint can be accessed without authentication (medium 5.3)
- [CVE-2023-30518](https://insights.sbomify.com/CVE-2023-30518/): Jenkins Thycotic Secret Server Plugin missing permissions check (medium 4.3)
- [CVE-2023-30517](https://insights.sbomify.com/CVE-2023-30517/): Jenkins NeuVector Vulnerability Scanner Plugin disables SSL/TLS certificate and hostname validation (medium 5.3)
- [CVE-2023-30516](https://insights.sbomify.com/CVE-2023-30516/): Jenkins Image Tag Parameter Plugin improperly introduces option to opt out of SSL/TLS certificate validation (medium 6.5)
- [CVE-2023-30515](https://insights.sbomify.com/CVE-2023-30515/): Jenkins Thycotic DevOps Secrets Vault Plugin does not properly mask credentials (high 7.5)
- [CVE-2023-30514](https://insights.sbomify.com/CVE-2023-30514/): Jenkins Azure Key Vault Plugin does not properly mask credentials (high 7.5)
- [CVE-2023-30513](https://insights.sbomify.com/CVE-2023-30513/): Jenkins Kubernetes Plugin does not properly mask credentials (high 7.5)
- [CVE-2023-30512](https://insights.sbomify.com/CVE-2023-30512/): CubeFS allows Kubernetes cluster-level privilege escalation (medium 6.5)
- [CVE-2023-30510](https://insights.sbomify.com/CVE-2023-30510/): Authenticated Server-side Request Forgery in Aruba EdgeConnect Enterprise Web Management Interface (medium 4.1)
- [CVE-2023-3051](https://insights.sbomify.com/CVE-2023-3051/): Page Builder by AZEXO <= 1.27.133 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-30509](https://insights.sbomify.com/CVE-2023-30509/): Authenticated Remote Path Traversal in Aruba EdgeConnect Enterprise Command Line Interface (medium 4.9)
- [CVE-2023-30508](https://insights.sbomify.com/CVE-2023-30508/): Authenticated Remote Path Traversal in Aruba EdgeConnect Enterprise Command Line Interface (medium 4.9)
- [CVE-2023-30507](https://insights.sbomify.com/CVE-2023-30507/): Authenticated Remote Path Traversal in Aruba EdgeConnect Enterprise Command Line Interface (medium 4.9)
- [CVE-2023-30506](https://insights.sbomify.com/CVE-2023-30506/): Authenticated Remote Code Execution in Aruba EdgeConnect Enterprise Command Line Interface (high 7.2)
- [CVE-2023-30505](https://insights.sbomify.com/CVE-2023-30505/): Authenticated Remote Code Execution in Aruba EdgeConnect Enterprise Command Line Interface (high 7.2)
- [CVE-2023-30504](https://insights.sbomify.com/CVE-2023-30504/): Authenticated Remote Code Execution in Aruba EdgeConnect Enterprise Command Line Interface (high 7.2)
- [CVE-2023-30503](https://insights.sbomify.com/CVE-2023-30503/): Authenticated Remote Code Execution in Aruba EdgeConnect Enterprise Command Line Interface (high 7.2)
- [CVE-2023-30502](https://insights.sbomify.com/CVE-2023-30502/): Authenticated Remote Code Execution in Aruba EdgeConnect Enterprise Command Line Interface (high 7.2)
- [CVE-2023-30501](https://insights.sbomify.com/CVE-2023-30501/): Authenticated Remote Code Execution in Aruba EdgeConnect Enterprise Command Line Interface (high 7.2)
- [CVE-2023-30500](https://insights.sbomify.com/CVE-2023-30500/): WordPress WPForms plugins - Reflected Cross Site Scripting (XSS) vulnerability (medium 5.8)
- [CVE-2023-3050](https://insights.sbomify.com/CVE-2023-3050/): Authentication Bypass in TMT's Lockcell (critical 9.8)
- [CVE-2023-30499](https://insights.sbomify.com/CVE-2023-30499/): WordPress FV Flowplayer Video Player Plugin <= 7.5.32.7212 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-30498](https://insights.sbomify.com/CVE-2023-30498/): WordPress Vimeotheque Plugin <= 2.2.1 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-30497](https://insights.sbomify.com/CVE-2023-30497/): WordPress LINE Notify Plugin <= 1.4.4 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-30496](https://insights.sbomify.com/CVE-2023-30496/): WordPress Bus Ticket Booking with Seat Reservation Plugin <= 5.2.5 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-30495](https://insights.sbomify.com/CVE-2023-30495/): WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.1.23 is vulnerable to SQL Injection (high 8.5)
- [CVE-2023-30494](https://insights.sbomify.com/CVE-2023-30494/): WordPress ImageRecycle pdf & image compression Plugin <= 3.1.10 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-30493](https://insights.sbomify.com/CVE-2023-30493/): WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-30492](https://insights.sbomify.com/CVE-2023-30492/): WordPress Minimum Purchase for WooCommerce Plugin <= 2.0.0.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-30491](https://insights.sbomify.com/CVE-2023-30491/): WordPress CodeBard's Patron Button and Widgets for Patreon Plugin <= 2.1.8 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-30490](https://insights.sbomify.com/CVE-2023-30490/): WordPress Easing Slider plugin <= 3.0.8 - Plugin Settings Reset Vulnerability (high 7.5)
- [CVE-2023-3049](https://insights.sbomify.com/CVE-2023-3049/): File Upload in TMT's Lockcell (critical 9.8)
- [CVE-2023-30489](https://insights.sbomify.com/CVE-2023-30489/): WordPress Email Subscription Popup Plugin <= 1.2.16 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-30488](https://insights.sbomify.com/CVE-2023-30488/): WordPress Featured Post Creative plugin <= 1.2.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-30487](https://insights.sbomify.com/CVE-2023-30487/): WordPress LearnPress Export Import Plugin <= 4.0.2 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-30486](https://insights.sbomify.com/CVE-2023-30486/): WordPress Square theme <= 2.0.0 - Broken Access Control (medium 4.3)
- [CVE-2023-30485](https://insights.sbomify.com/CVE-2023-30485/): WordPress Avartan Slider Lite Plugin <= 1.5.3 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-30484](https://insights.sbomify.com/CVE-2023-30484/): WordPress Enable Accessibility Plugin <= 1.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-30483](https://insights.sbomify.com/CVE-2023-30483/): WordPress Watu Quiz Plugin <= 3.3.9.2 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-30482](https://insights.sbomify.com/CVE-2023-30482/): WordPress WPBulky Plugin < 1.0.10 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-30481](https://insights.sbomify.com/CVE-2023-30481/): WordPress AGP Font Awesome Collection Plugin <= 3.2.4 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-30480](https://insights.sbomify.com/CVE-2023-30480/): WordPress Educenter theme <= 1.5.5 - Broken Access Control (medium 4.3)
- [CVE-2023-3048](https://insights.sbomify.com/CVE-2023-3048/): IDOR in TMT's Lockcell (critical 9.8)
- [CVE-2023-30479](https://insights.sbomify.com/CVE-2023-30479/): WordPress Stamped.io Product Reviews & UGC for WooCommerce plugin <= 2.3.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-30478](https://insights.sbomify.com/CVE-2023-30478/): WordPress Newsletters Plugin <= 4.8.8 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-30477](https://insights.sbomify.com/CVE-2023-30477/): WordPress AFFILIATE Solution Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-30476](https://insights.sbomify.com/CVE-2023-30476/): WordPress Blogger Buzz theme <= 1.2.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-30475](https://insights.sbomify.com/CVE-2023-30475/): WordPress Coupon Affiliates Plugin <= 5.4.5 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-30474](https://insights.sbomify.com/CVE-2023-30474/): WordPress Ultimate Noindex Nofollow Tool II Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-30473](https://insights.sbomify.com/CVE-2023-30473/): WordPress YML for Yandex Market Plugin <= 3.10.7 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-30472](https://insights.sbomify.com/CVE-2023-30472/): WordPress URL Shortener by MyThemeShop Plugin <= 1.0.17 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-30471](https://insights.sbomify.com/CVE-2023-30471/): WordPress WP Search Analytics Plugin <= 1.4.7 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-30470](https://insights.sbomify.com/CVE-2023-30470/): Use after free in Hermes (critical 9.8)
- [CVE-2023-3047](https://insights.sbomify.com/CVE-2023-3047/): SQLi in TMT's Lockcell (critical 9.8)
- [CVE-2023-30469](https://insights.sbomify.com/CVE-2023-30469/): Reflrected Cross Site Scripting Vulnerability in Hitachi Ops Center Analyzer (high 7.6)
- [CVE-2023-30467](https://insights.sbomify.com/CVE-2023-30467/): Improper Authorization Vulnerability in Milesight Network Video Recorder (NVR) (high 7.5)
- [CVE-2023-30466](https://insights.sbomify.com/CVE-2023-30466/): Authentication Bypass Vulnerability in Milesight Network Video Recorder (NVR) (critical 9.8)
- [CVE-2023-30465](https://insights.sbomify.com/CVE-2023-30465/): Apache InLong: SQL injection in apache inLong 1.5.0 (medium 5.3)
- [CVE-2023-30464](https://insights.sbomify.com/CVE-2023-30464/): CoreDNS Cache Poisoning via a birthday attack (high 7.5)
- [CVE-2023-30463](https://insights.sbomify.com/CVE-2023-30463/): Integer overflow in altran:picotcp (high 7.5)
- [CVE-2023-3046](https://insights.sbomify.com/CVE-2023-3046/): SQLi in Biltay Technlogys Scienta (critical 9.8)
- [CVE-2023-30459](https://insights.sbomify.com/CVE-2023-30459/): Code injection in smartptt:smartptt scada (high 7.2)
- [CVE-2023-30458](https://insights.sbomify.com/CVE-2023-30458/): Information disclosure in medicine tracker system project:medicine tracker system (medium 5.3)
- [CVE-2023-30456](https://insights.sbomify.com/CVE-2023-30456/): Other in linux:linux kernel (medium 6.5)
- [CVE-2023-30455](https://insights.sbomify.com/CVE-2023-30455/): Denial of service in ebankit:ebankit (high 7.5)
- [CVE-2023-30454](https://insights.sbomify.com/CVE-2023-30454/): Cross-site scripting in ebankit:ebankit (medium 6.1)
- [CVE-2023-30453](https://insights.sbomify.com/CVE-2023-30453/): Cross-site scripting in teamlead:reminder (medium 5.4)
- [CVE-2023-30452](https://insights.sbomify.com/CVE-2023-30452/): Cross-site scripting in morosystems:easymind (medium 5.4)
- [CVE-2023-30451](https://insights.sbomify.com/CVE-2023-30451/): Path Traversal in TYPO3 File Abstraction Layer Storages (medium 4.9)
- [CVE-2023-30450](https://insights.sbomify.com/CVE-2023-30450/): Misconfiguration in redpanda:redpanda (medium 4.3)
- [CVE-2023-3045](https://insights.sbomify.com/CVE-2023-3045/): SQLi in Tise Technology's Parking Web Report (critical 9.8)
- [CVE-2023-30449](https://insights.sbomify.com/CVE-2023-30449/): IBM Db2 denial of service (high 7.5)
- [CVE-2023-30448](https://insights.sbomify.com/CVE-2023-30448/): IBM Db2 denial of service (medium 5.9)
- [CVE-2023-30447](https://insights.sbomify.com/CVE-2023-30447/): IBM Db2 denial of service (medium 5.9)
- [CVE-2023-30446](https://insights.sbomify.com/CVE-2023-30446/): IBM Db2 denial of service (medium 5.9)
- [CVE-2023-30445](https://insights.sbomify.com/CVE-2023-30445/): IBM Db2 denial of service (high 7.5)
- [CVE-2023-30444](https://insights.sbomify.com/CVE-2023-30444/): IBM Watson Machine Learning on Cloud Pak for Data server-side request forgery (high 7.1)
- [CVE-2023-30443](https://insights.sbomify.com/CVE-2023-30443/): IBM Db2 denial of service (medium 5.3)
- [CVE-2023-30442](https://insights.sbomify.com/CVE-2023-30442/): IBM Db2 denial of service (medium 5.9)
- [CVE-2023-30441](https://insights.sbomify.com/CVE-2023-30441/): IBM Java information disclosure (high 7.5)
- [CVE-2023-30440](https://insights.sbomify.com/CVE-2023-30440/): IBM PowerVM Hypervisor denial of service (medium 6.7)
- [CVE-2023-3044](https://insights.sbomify.com/CVE-2023-3044/): Divide-by-zero in Xpdf 4.04 due to very large page size (low 3.3)
- [CVE-2023-30438](https://insights.sbomify.com/CVE-2023-30438/): IBM PowerVM gain access (critical 9.3)
- [CVE-2023-30437](https://insights.sbomify.com/CVE-2023-30437/): IBM Security Guardium information disclosure (medium 5.3)
- [CVE-2023-30436](https://insights.sbomify.com/CVE-2023-30436/): IBM Security Guardium cross-site scripting (medium 5.5)
- [CVE-2023-30435](https://insights.sbomify.com/CVE-2023-30435/): IBM Security Guardium cross-site scripting (high 8.9)
- [CVE-2023-30434](https://insights.sbomify.com/CVE-2023-30434/): IBM Storage Scale denial of service (medium 6.2)
- [CVE-2023-30433](https://insights.sbomify.com/CVE-2023-30433/): IBM Security Verify Access HTTP open redirect (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/325/