# Vulnerabilities published in 2023


- [CVE-2023-29489](https://insights.sbomify.com/CVE-2023-29489/): Cross-site scripting in cpanel:cpanel (medium 5.3)
- [CVE-2023-29487](https://insights.sbomify.com/CVE-2023-29487/): Denial of service in heimdalsecurity:thor (critical 9.1)
- [CVE-2023-29486](https://insights.sbomify.com/CVE-2023-29486/): Security feature bypass in heimdalsecurity:thor (critical 9.8)
- [CVE-2023-29485](https://insights.sbomify.com/CVE-2023-29485/): Security feature bypass in heimdalsecurity:thor (critical 9.8)
- [CVE-2023-29484](https://insights.sbomify.com/CVE-2023-29484/): Auth bypass in terminalfour:terminalfour (medium 6.5)
- [CVE-2023-29483](https://insights.sbomify.com/CVE-2023-29483/): Potential DoS via the Tudoor mechanism in eventlet and dnspython (high 7.0)
- [CVE-2023-29480](https://insights.sbomify.com/CVE-2023-29480/): Information disclosure in ribose:rnp (high 7.5)
- [CVE-2023-2948](https://insights.sbomify.com/CVE-2023-2948/): Cross-site Scripting (XSS) - Generic in openemr/openemr (high 8.3)
- [CVE-2023-29479](https://insights.sbomify.com/CVE-2023-29479/): Denial of service in ribose:rnp (medium 5.3)
- [CVE-2023-29478](https://insights.sbomify.com/CVE-2023-29478/): Path traversal in bibliocraftmod:bibliocraft (critical 9.8)
- [CVE-2023-29476](https://insights.sbomify.com/CVE-2023-29476/): In Menlo On-Premise Appliance before 2.88, web policy may not be consistently applied properly to intentionally malformed client requests. (critical 9.1)
- [CVE-2023-29475](https://insights.sbomify.com/CVE-2023-29475/): Command injection in atos:unify openscape 4000 (critical 9.8)
- [CVE-2023-29474](https://insights.sbomify.com/CVE-2023-29474/): Command injection in atos:unify openscape 4000 (critical 9.8)
- [CVE-2023-29473](https://insights.sbomify.com/CVE-2023-29473/): Command injection in atos:unify openscape 4000 (critical 9.8)
- [CVE-2023-29471](https://insights.sbomify.com/CVE-2023-29471/): Lightbend Alpakka Kafka logs credentials on debug level (medium 5.5)
- [CVE-2023-2947](https://insights.sbomify.com/CVE-2023-2947/): Cross-site Scripting (XSS) - Stored in openemr/openemr (medium 4.7)
- [CVE-2023-29469](https://insights.sbomify.com/CVE-2023-29469/): Memory corruption in debian:debian linux (medium 6.5)
- [CVE-2023-29468](https://insights.sbomify.com/CVE-2023-29468/): Memory corruption in ti:wilink8-wifi-mcp8 (critical 9.8)
- [CVE-2023-29465](https://insights.sbomify.com/CVE-2023-29465/): Other in sagemath:flintqs (medium 5.5)
- [CVE-2023-29464](https://insights.sbomify.com/CVE-2023-29464/): Rockwell Automation FactoryTalk Linx Vulnerable to Denial-of-Service and Information Disclosure (high 8.2)
- [CVE-2023-29463](https://insights.sbomify.com/CVE-2023-29463/): Pavilion8 Security Misconfiguration Vulnerability (high 8.8)
- [CVE-2023-29462](https://insights.sbomify.com/CVE-2023-29462/): Rockwell Automation Arena Simulation Software Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-29461](https://insights.sbomify.com/CVE-2023-29461/): Rockwell Automation Arena Simulation Software Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-29460](https://insights.sbomify.com/CVE-2023-29460/): Rockwell Automation Arena Simulation Software Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-2946](https://insights.sbomify.com/CVE-2023-2946/): Improper Access Control in openemr/openemr (medium 6.3)
- [CVE-2023-29459](https://insights.sbomify.com/CVE-2023-29459/): Missing authorization in redbull:fc red bull salzburg (medium 6.1)
- [CVE-2023-29458](https://insights.sbomify.com/CVE-2023-29458/): Duktape 2.6 bug crashes JavaScript putting too many values in valstack. (medium 5.9)
- [CVE-2023-29457](https://insights.sbomify.com/CVE-2023-29457/): Insufficient validation of Action form input fields (medium 6.3)
- [CVE-2023-29456](https://insights.sbomify.com/CVE-2023-29456/): Inefficient URL schema validation (medium 5.7)
- [CVE-2023-29455](https://insights.sbomify.com/CVE-2023-29455/): Reflected XSS in several fields of graph form (medium 5.4)
- [CVE-2023-29454](https://insights.sbomify.com/CVE-2023-29454/): Persistent XSS in the user form (medium 5.4)
- [CVE-2023-29453](https://insights.sbomify.com/CVE-2023-29453/): Agent 2 package are built with Go version affected by CVE-2023-24538 (critical 9.8)
- [CVE-2023-29452](https://insights.sbomify.com/CVE-2023-29452/): Remove possibility to add html into Geomap attribution field (medium 5.5)
- [CVE-2023-29451](https://insights.sbomify.com/CVE-2023-29451/): Denial of service caused by a bug in the JSON parser (medium 4.7)
- [CVE-2023-29450](https://insights.sbomify.com/CVE-2023-29450/): Unauthorized limited filesystem access from preprocessing (high 8.5)
- [CVE-2023-2945](https://insights.sbomify.com/CVE-2023-2945/): Missing Authorization in openemr/openemr (medium 4.3)
- [CVE-2023-29449](https://insights.sbomify.com/CVE-2023-29449/): Limited control of resource utilization in JS preprocessing (medium 5.9)
- [CVE-2023-29447](https://insights.sbomify.com/CVE-2023-29447/): Insufficiently Protected Credentials in PTC's Kepware KEPServerEX (medium 5.7)
- [CVE-2023-29446](https://insights.sbomify.com/CVE-2023-29446/): Improper Input Validation in PTC's Kepware KEPServerEX (medium 4.7)
- [CVE-2023-29445](https://insights.sbomify.com/CVE-2023-29445/): Uncontrolled Search Path Element in PTC's Kepware KEPServerEX (high 7.8)
- [CVE-2023-29444](https://insights.sbomify.com/CVE-2023-29444/): Uncontrolled Search Path Element in PTC's Kepware KEPServerEX (medium 6.3)
- [CVE-2023-29443](https://insights.sbomify.com/CVE-2023-29443/): XML external entity in zohocorp:manageengine assetexplorer (medium 4.9)
- [CVE-2023-29442](https://insights.sbomify.com/CVE-2023-29442/): Cross-site scripting in zohocorp:manageengine applications manager (medium 6.1)
- [CVE-2023-29441](https://insights.sbomify.com/CVE-2023-29441/): WordPress WebLibrarian Plugin <= 3.5.8.1 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-29440](https://insights.sbomify.com/CVE-2023-29440/): WordPress Simple Job Board Plugin <= 2.10.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-2944](https://insights.sbomify.com/CVE-2023-2944/): Improper Access Control in openemr/openemr (medium 6.3)
- [CVE-2023-29439](https://insights.sbomify.com/CVE-2023-29439/): WordPress FooGallery Plugin <= 2.2.35 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-29438](https://insights.sbomify.com/CVE-2023-29438/): WordPress SimpleModal Contact Form (SMCF) Plugin <= 1.2.9 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-29437](https://insights.sbomify.com/CVE-2023-29437/): WordPress Connections Business Directory Plugin <= 10.4.36 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-29436](https://insights.sbomify.com/CVE-2023-29436/): WordPress IFrame Shortcode Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-29435](https://insights.sbomify.com/CVE-2023-29435/): WordPress Cryptocurrency All-in-One Plugin <= 3.0.19 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-29434](https://insights.sbomify.com/CVE-2023-29434/): WordPress Optin Forms Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-29433](https://insights.sbomify.com/CVE-2023-29433/): WordPress tencentcloud-cos plugin <= 1.0.7 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-29432](https://insights.sbomify.com/CVE-2023-29432/): WordPress Houzez Theme < 2.8.3 is vulnerable to SQL Injection (high 8.2)
- [CVE-2023-29431](https://insights.sbomify.com/CVE-2023-29431/): WordPress qTranslate X Cleanup and WPML Import plugin <= 3.0.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-29430](https://insights.sbomify.com/CVE-2023-29430/): WordPress TheRoof Theme <= 1.0.3 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-2943](https://insights.sbomify.com/CVE-2023-2943/): Code Injection in openemr/openemr (medium 4.6)
- [CVE-2023-29429](https://insights.sbomify.com/CVE-2023-29429/): WordPress User Registration plugin <= 2.3.2.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-29428](https://insights.sbomify.com/CVE-2023-29428/): WordPress Superb Social Media Share Buttons and Follow Buttons Plugin <= 1.1.3 is vulnerable to Broken Access Control (medium 5.3)
- [CVE-2023-29427](https://insights.sbomify.com/CVE-2023-29427/): WordPress Amelia Plugin <= 1.0.75 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-29426](https://insights.sbomify.com/CVE-2023-29426/): WordPress Spreadshop Plugin Plugin <= 1.6.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-29425](https://insights.sbomify.com/CVE-2023-29425/): WordPress ShiftController Employee Shift Scheduling Plugin <= 4.9.23 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-29424](https://insights.sbomify.com/CVE-2023-29424/): WordPress ShiftController Employee Shift Scheduling Plugin <= 4.9.23 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-29423](https://insights.sbomify.com/CVE-2023-29423/): WordPress Cancel order request WooCommerce Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-29422](https://insights.sbomify.com/CVE-2023-29422/): WordPress Dynamics 365 Integration plugin <= 1.3.13 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-29421](https://insights.sbomify.com/CVE-2023-29421/): Memory corruption in bzip3 project:bzip3 (high 8.8)
- [CVE-2023-29420](https://insights.sbomify.com/CVE-2023-29420/): Memory corruption in bzip3 project:bzip3 (medium 6.5)
- [CVE-2023-2942](https://insights.sbomify.com/CVE-2023-2942/): Improper Input Validation in openemr/openemr (high 8.1)
- [CVE-2023-29419](https://insights.sbomify.com/CVE-2023-29419/): Memory corruption in bzip3 project:bzip3 (medium 6.5)
- [CVE-2023-29418](https://insights.sbomify.com/CVE-2023-29418/): Memory corruption in bzip3 project:bzip3 (medium 6.5)
- [CVE-2023-29417](https://insights.sbomify.com/CVE-2023-29417/): Memory corruption in bzip3 project:bzip3 (medium 6.5)
- [CVE-2023-29416](https://insights.sbomify.com/CVE-2023-29416/): Memory corruption in bzip3 project:bzip3 (medium 6.5)
- [CVE-2023-29415](https://insights.sbomify.com/CVE-2023-29415/): Denial of service in bzip3 project:bzip3 (medium 6.5)
- [CVE-2023-29414](https://insights.sbomify.com/CVE-2023-29414/): Memory corruption in Accutech Manager (high 7.8)
- [CVE-2023-29413](https://insights.sbomify.com/CVE-2023-29413/): Missing authorization in APC Easy UPS Online Monitoring Software (Windows 10, 11 Windows Server 2016, 2019, 2022) (high 7.5)
- [CVE-2023-29412](https://insights.sbomify.com/CVE-2023-29412/): Command injection in APC Easy UPS Online Monitoring Software (Windows 10, 11 Windows Server 2016, 2019, 2022) (critical 9.8)
- [CVE-2023-29411](https://insights.sbomify.com/CVE-2023-29411/): Auth bypass in APC Easy UPS Online Monitoring Software (Windows 10, 11 Windows Server 2016, 2019, 2022) (critical 9.8)
- [CVE-2023-29410](https://insights.sbomify.com/CVE-2023-29410/): Code injection in Conext Gateway (high 7.2)
- [CVE-2023-2941](https://insights.sbomify.com/CVE-2023-2941/): Other in Chrome (medium 4.3)
- [CVE-2023-29409](https://insights.sbomify.com/CVE-2023-29409/): Large RSA keys can cause high CPU usage in crypto/tls (medium 5.3)
- [CVE-2023-29408](https://insights.sbomify.com/CVE-2023-29408/): Excessive resource consumption in golang.org/x/image/tiff (medium 6.5)
- [CVE-2023-29407](https://insights.sbomify.com/CVE-2023-29407/): Excessive CPU consumption when decoding 0-height images in golang.org/x/image/tiff (medium 6.5)
- [CVE-2023-29406](https://insights.sbomify.com/CVE-2023-29406/): Insufficient sanitization of Host header in net/http (medium 6.5)
- [CVE-2023-29405](https://insights.sbomify.com/CVE-2023-29405/): Improper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/go (critical 9.8)
- [CVE-2023-29404](https://insights.sbomify.com/CVE-2023-29404/): Improper handling of non-optional LDFLAGS in go command with cgo in cmd/go (critical 9.8)
- [CVE-2023-29403](https://insights.sbomify.com/CVE-2023-29403/): Unsafe behavior in setuid/setgid binaries in runtime (high 7.8)
- [CVE-2023-29402](https://insights.sbomify.com/CVE-2023-29402/): Code injection via go command with cgo in cmd/go (critical 9.8)
- [CVE-2023-29401](https://insights.sbomify.com/CVE-2023-29401/): Improper handling of filenames in Content-Disposition HTTP header in github.com/gin-gonic/gin (medium 4.3)
- [CVE-2023-29400](https://insights.sbomify.com/CVE-2023-29400/): Improper handling of empty HTML attributes in html/template (high 7.3)
- [CVE-2023-2940](https://insights.sbomify.com/CVE-2023-2940/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2023-2939](https://insights.sbomify.com/CVE-2023-2939/): Privilege escalation in Chrome (high 7.8)
- [CVE-2023-29389](https://insights.sbomify.com/CVE-2023-29389/): Auth bypass in toyota:rav4 firmware (medium 6.8)
- [CVE-2023-29388](https://insights.sbomify.com/CVE-2023-29388/): WordPress Product Catalog Simple Plugin <= 1.6.17 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-29387](https://insights.sbomify.com/CVE-2023-29387/): WordPress Manager for Icomoon Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-29386](https://insights.sbomify.com/CVE-2023-29386/): WordPress Manager for Icomoon plugin <= 2.0 - Arbitrary File Upload vulnerability (critical 9.1)
- [CVE-2023-29385](https://insights.sbomify.com/CVE-2023-29385/): WordPress WP Abstracts Plugin <= 2.6.2 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-29384](https://insights.sbomify.com/CVE-2023-29384/): WordPress WordPress Job Board and Recruitment Plugin – JobWP Plugin <= 2.0 is vulnerable to Arbitrary File Upload (critical 10.0)
- [CVE-2023-29383](https://insights.sbomify.com/CVE-2023-29383/): Other in shadow project:shadow (low 3.3)
- [CVE-2023-29382](https://insights.sbomify.com/CVE-2023-29382/): Code injection in zimbra:collaboration (critical 9.8)
- [CVE-2023-29381](https://insights.sbomify.com/CVE-2023-29381/): Privilege escalation in zimbra:collaboration (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/331/