# Vulnerabilities published in 2023


- [CVE-2023-2916](https://insights.sbomify.com/CVE-2023-2916/): InfiniteWP Client <= 1.11.1 - Authenticated (Subscriber+) Sensitive Information Exposure (high 7.5)
- [CVE-2023-29159](https://insights.sbomify.com/CVE-2023-29159/): Starlette has Path Traversal vulnerability in StaticFiles (high 7.5)
- [CVE-2023-29158](https://insights.sbomify.com/CVE-2023-29158/): SUBNET PowerSYSTEM Center Authentication Bypass by Capture-replay (medium 6.1)
- [CVE-2023-29157](https://insights.sbomify.com/CVE-2023-29157/): Privilege escalation in Intel(R) OFU software (high 8.4)
- [CVE-2023-29156](https://insights.sbomify.com/CVE-2023-29156/): Denial of Service due to loss of information in DroneScout ds230 Remote ID receiver from BlueMark Innovations (medium 4.7)
- [CVE-2023-29155](https://insights.sbomify.com/CVE-2023-29155/): INEA ME RTU Missing Authentication for Critical Function (critical 9.8)
- [CVE-2023-29154](https://insights.sbomify.com/CVE-2023-29154/): SQL injection in CONPROSYS HMI System (CHS) (high 7.2)
- [CVE-2023-29153](https://insights.sbomify.com/CVE-2023-29153/): Denial of service in Intel(R) SPS firmware (medium 4.9)
- [CVE-2023-29152](https://insights.sbomify.com/CVE-2023-29152/): PTC Vuforia Studio Improper Authorization (medium 6.2)
- [CVE-2023-29151](https://insights.sbomify.com/CVE-2023-29151/): Privilege escalation in Intel(R) PSR SDK (medium 6.7)
- [CVE-2023-29150](https://insights.sbomify.com/CVE-2023-29150/): CVE-2023-29150 (high 8.8)
- [CVE-2023-2915](https://insights.sbomify.com/CVE-2023-2915/): Rockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation Vulnerability (high 7.5)
- [CVE-2023-29147](https://insights.sbomify.com/CVE-2023-29147/): Security feature bypass in malwarebytes:endpoint detection and response (medium 5.5)
- [CVE-2023-29146](https://insights.sbomify.com/CVE-2023-29146/): The utility functions used by Malwarebytes EDR 1.0.11 on Linux for calculating a cryptographic hash of data bytes truncate the hashed data if it exceeds 4GB. (high 8.2)
- [CVE-2023-29145](https://insights.sbomify.com/CVE-2023-29145/): Security feature bypass in malwarebytes:endpoint detection and response (high 7.8)
- [CVE-2023-29144](https://insights.sbomify.com/CVE-2023-29144/): Integer overflow in malwarebytes:malwarebytes (low 3.3)
- [CVE-2023-29141](https://insights.sbomify.com/CVE-2023-29141/): X-Forwarded-For header allows brute-forcing autoblocked IP addresses (critical 9.8)
- [CVE-2023-29140](https://insights.sbomify.com/CVE-2023-29140/): Information disclosure in mediawiki:mediawiki (medium 5.3)
- [CVE-2023-2914](https://insights.sbomify.com/CVE-2023-2914/): Rockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation Vulnerabilitiy (high 7.5)
- [CVE-2023-29139](https://insights.sbomify.com/CVE-2023-29139/): Denial of service in mediawiki:mediawiki (medium 6.5)
- [CVE-2023-29137](https://insights.sbomify.com/CVE-2023-29137/): Information disclosure in mediawiki:mediawiki (medium 4.3)
- [CVE-2023-29134](https://insights.sbomify.com/CVE-2023-29134/): An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. (high 8.6)
- [CVE-2023-29132](https://insights.sbomify.com/CVE-2023-29132/): Use after free in irssi:irssi (medium 5.3)
- [CVE-2023-29131](https://insights.sbomify.com/CVE-2023-29131/): Misconfiguration in SIMATIC CN 4100 (high 7.4)
- [CVE-2023-29130](https://insights.sbomify.com/CVE-2023-29130/): Privilege escalation in SIMATIC CN 4100 (critical 9.9)
- [CVE-2023-2913](https://insights.sbomify.com/CVE-2023-2913/): Rockwell Automation ThinManager ThinServer Path Traversal Vulnerability (high 7.5)
- [CVE-2023-29129](https://insights.sbomify.com/CVE-2023-29129/): Auth bypass in Mendix SAML (Mendix 7 compatible) (critical 9.1)
- [CVE-2023-29128](https://insights.sbomify.com/CVE-2023-29128/): Path traversal in SIMATIC Cloud Connect 7 CC712 (low 3.8)
- [CVE-2023-29126](https://insights.sbomify.com/CVE-2023-29126/): Insecure loose comparison in Enel X JuiceBox (medium 4.2)
- [CVE-2023-29125](https://insights.sbomify.com/CVE-2023-29125/): Heap overflow in CM_main.exe binary in Enel X JuiceBox (critical 9.0)
- [CVE-2023-29122](https://insights.sbomify.com/CVE-2023-29122/): Incorrect file ownership of privileged service's libraries in Enel X JuiceBox (medium 6.7)
- [CVE-2023-29121](https://insights.sbomify.com/CVE-2023-29121/): Exposed TCF agent service in Enel X Juicebox (critical 9.6)
- [CVE-2023-29120](https://insights.sbomify.com/CVE-2023-29120/): Unauthorized Remote Command Execution in Enel X Juicebox (critical 9.6)
- [CVE-2023-2912](https://insights.sbomify.com/CVE-2023-2912/): SiteManager Embedded service disruption (medium 5.9)
- [CVE-2023-29119](https://insights.sbomify.com/CVE-2023-29119/): Unauthorized SQLite Injection (critical 9.6)
- [CVE-2023-29118](https://insights.sbomify.com/CVE-2023-29118/): Unauthorized SQLite Injection in Enel X Juicebox (critical 9.6)
- [CVE-2023-29117](https://insights.sbomify.com/CVE-2023-29117/): Authentication Bypass in JuiceBox Web Manager interface (high 8.8)
- [CVE-2023-29116](https://insights.sbomify.com/CVE-2023-29116/): PHP Information Disclosure in Enel X JuiceBox (medium 4.3)
- [CVE-2023-29115](https://insights.sbomify.com/CVE-2023-29115/): Denial of Service via Web Management interface in Enel X JuiceBox (medium 6.5)
- [CVE-2023-29114](https://insights.sbomify.com/CVE-2023-29114/): Unauthorized System Log Disclosure in Enel X JuiceBox (medium 5.7)
- [CVE-2023-29113](https://insights.sbomify.com/CVE-2023-29113/): A lack of access control in custom IPC mechanism (medium 6.3)
- [CVE-2023-29112](https://insights.sbomify.com/CVE-2023-29112/): Code Injection vulnerability in SAP Application Interface Framework (Message Monitoring) (low 3.7)
- [CVE-2023-29111](https://insights.sbomify.com/CVE-2023-29111/): Information Disclosure vulnerability in SAP Application Interface Framework (ODATA service) (low 3.1)
- [CVE-2023-29110](https://insights.sbomify.com/CVE-2023-29110/): Code Injection vulnerability in SAP Application Interface Framework (Message Dashboard) (low 3.7)
- [CVE-2023-2911](https://insights.sbomify.com/CVE-2023-2911/): Denial of service in BIND 9 (high 7.5)
- [CVE-2023-29109](https://insights.sbomify.com/CVE-2023-29109/): Code Injection vulnerability in SAP Application Interface Framework (Message Dashboard) (medium 4.4)
- [CVE-2023-29108](https://insights.sbomify.com/CVE-2023-29108/): IP filter vulnerability in ABAP Platform and SAP Web Dispatcher (medium 5.0)
- [CVE-2023-29107](https://insights.sbomify.com/CVE-2023-29107/): Information disclosure in SIMATIC Cloud Connect 7 CC712 (medium 5.3)
- [CVE-2023-29106](https://insights.sbomify.com/CVE-2023-29106/): Missing authorization in SIMATIC Cloud Connect 7 CC712 (medium 5.3)
- [CVE-2023-29105](https://insights.sbomify.com/CVE-2023-29105/): Denial of service in SIMATIC Cloud Connect 7 CC712 (medium 5.9)
- [CVE-2023-29104](https://insights.sbomify.com/CVE-2023-29104/): Path traversal in SIMATIC Cloud Connect 7 CC712 (medium 6.0)
- [CVE-2023-29103](https://insights.sbomify.com/CVE-2023-29103/): Hardcoded credentials in SIMATIC Cloud Connect 7 CC712 (medium 4.3)
- [CVE-2023-29102](https://insights.sbomify.com/CVE-2023-29102/): WordPress Olive One Click Demo Import Plugin <= 1.1.1 is vulnerable to Arbitrary File Upload (critical 9.1)
- [CVE-2023-29101](https://insights.sbomify.com/CVE-2023-29101/): WordPress Betheme Theme <= 26.7.5 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-29100](https://insights.sbomify.com/CVE-2023-29100/): WordPress The7 Theme <= 11.6.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-2910](https://insights.sbomify.com/CVE-2023-2910/): A Command injection vulnerability was found on Printer service of ADM (high 8.8)
- [CVE-2023-29099](https://insights.sbomify.com/CVE-2023-29099/): WordPress Divi Theme <= 4.20.2 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-29098](https://insights.sbomify.com/CVE-2023-29098/): WordPress CopySafe Web Protection Plugin <= 3.13 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-29097](https://insights.sbomify.com/CVE-2023-29097/): WordPress a3 Portfolio Plugin <= 3.1.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-29096](https://insights.sbomify.com/CVE-2023-29096/): WordPress Contact Form to DB by BestWebSoft Plugin <= 1.7.0 is vulnerable to SQL Injection (high 8.5)
- [CVE-2023-29095](https://insights.sbomify.com/CVE-2023-29095/): WordPress RSVPMarker Plugin < 10.5.5 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-29094](https://insights.sbomify.com/CVE-2023-29094/): WordPress Product page shipping calculator for WooCommerce Plugin <= 1.3.20 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-29093](https://insights.sbomify.com/CVE-2023-29093/): WordPress Conditional extra fees for woocommerce Plugin <= 1.0.96 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-29092](https://insights.sbomify.com/CVE-2023-29092/): Other in samsung:exynos 1080 firmware (low 3.1)
- [CVE-2023-29091](https://insights.sbomify.com/CVE-2023-29091/): Memory corruption in samsung:exynos 1080 firmware (medium 6.8)
- [CVE-2023-29090](https://insights.sbomify.com/CVE-2023-29090/): Memory corruption in samsung:exynos 1080 firmware (medium 6.8)
- [CVE-2023-2909](https://insights.sbomify.com/CVE-2023-2909/): A Directory traversal vulnerability was found on EZ Sync service of ADM (high 8.5)
- [CVE-2023-29089](https://insights.sbomify.com/CVE-2023-29089/): Memory corruption in samsung:exynos 1080 firmware (medium 6.8)
- [CVE-2023-29088](https://insights.sbomify.com/CVE-2023-29088/): Memory corruption in samsung:exynos 1080 firmware (medium 6.8)
- [CVE-2023-29087](https://insights.sbomify.com/CVE-2023-29087/): Memory corruption in samsung:exynos 1080 firmware (medium 6.8)
- [CVE-2023-29086](https://insights.sbomify.com/CVE-2023-29086/): Memory corruption in samsung:exynos 1080 firmware (medium 6.8)
- [CVE-2023-29085](https://insights.sbomify.com/CVE-2023-29085/): Memory corruption in samsung:exynos 1080 firmware (medium 6.8)
- [CVE-2023-29084](https://insights.sbomify.com/CVE-2023-29084/): Command injection in zohocorp:manageengine admanager plus (high 7.2)
- [CVE-2023-29081](https://insights.sbomify.com/CVE-2023-29081/): InstallShield Symlink Vulnerability Affecting Suite Project Setups (medium 5.5)
- [CVE-2023-29080](https://insights.sbomify.com/CVE-2023-29080/): Privilege escalation in InstallShield (high 8.5)
- [CVE-2023-2908](https://insights.sbomify.com/CVE-2023-2908/): Libtiff: null pointer dereference in tif_dir.c (medium 5.5)
- [CVE-2023-29076](https://insights.sbomify.com/CVE-2023-29076/): Memory corruption in AutoCAD, Advance Steel and Civil 3D (critical 9.8)
- [CVE-2023-29075](https://insights.sbomify.com/CVE-2023-29075/): Memory corruption in AutoCAD, Advance Steel and Civil 3D (critical 9.8)
- [CVE-2023-29074](https://insights.sbomify.com/CVE-2023-29074/): Memory corruption in AutoCAD, Advance Steel and Civil 3D (critical 9.8)
- [CVE-2023-29073](https://insights.sbomify.com/CVE-2023-29073/): Memory corruption in AutoCAD, Advance Steel and Civil 3D (critical 9.8)
- [CVE-2023-2907](https://insights.sbomify.com/CVE-2023-2907/): SQLi in Marksoft (critical 9.8)
- [CVE-2023-29069](https://insights.sbomify.com/CVE-2023-29069/): Privilege escalation in Desktop Connector (high 7.8)
- [CVE-2023-29068](https://insights.sbomify.com/CVE-2023-29068/): Memory corruption in Autodesk products (high 7.8)
- [CVE-2023-29067](https://insights.sbomify.com/CVE-2023-29067/): Memory corruption in Autodesk AutoCAD (high 7.8)
- [CVE-2023-29066](https://insights.sbomify.com/CVE-2023-29066/): Incorrect User Management (low 3.2)
- [CVE-2023-29065](https://insights.sbomify.com/CVE-2023-29065/): Overly Permissive Access Policy (medium 4.1)
- [CVE-2023-29064](https://insights.sbomify.com/CVE-2023-29064/): Hardcoded Secrets (medium 4.1)
- [CVE-2023-29063](https://insights.sbomify.com/CVE-2023-29063/): Lack of DMA Access Protections (low 2.4)
- [CVE-2023-29062](https://insights.sbomify.com/CVE-2023-29062/): Unsecure Identity Verification (low 3.8)
- [CVE-2023-29061](https://insights.sbomify.com/CVE-2023-29061/): Lack of Adequate BIOS Authentication (medium 5.2)
- [CVE-2023-29060](https://insights.sbomify.com/CVE-2023-29060/): Lack of USB Whitelisting (medium 5.4)
- [CVE-2023-2906](https://insights.sbomify.com/CVE-2023-2906/): Wireshark CP2179 divide by zero (medium 6.5)
- [CVE-2023-29059](https://insights.sbomify.com/CVE-2023-29059/): Supply chain in 3cx:3cx (high 7.8)
- [CVE-2023-29058](https://insights.sbomify.com/CVE-2023-29058/): Missing authorization in XClarity Controller (medium 6.4)
- [CVE-2023-29057](https://insights.sbomify.com/CVE-2023-29057/): Privilege escalation in XClarity Controller (high 7.3)
- [CVE-2023-29056](https://insights.sbomify.com/CVE-2023-29056/): Privilege escalation in XClarity Controller (medium 5.3)
- [CVE-2023-29055](https://insights.sbomify.com/CVE-2023-29055/): Apache Kylin: Insufficiently protected credentials in config file (high 7.5)
- [CVE-2023-29054](https://insights.sbomify.com/CVE-2023-29054/): Weak cryptography in SCALANCE X200-4P IRT (medium 6.7)
- [CVE-2023-29053](https://insights.sbomify.com/CVE-2023-29053/): Memory corruption in JT Open (high 7.8)
- [CVE-2023-29052](https://insights.sbomify.com/CVE-2023-29052/): Cross-site scripting in OX App Suite (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/334/