# Vulnerabilities published in 2023


- [CVE-2023-28936](https://insights.sbomify.com/CVE-2023-28936/): Apache OpenMeetings: insufficient check of invitation hash (medium 5.3)
- [CVE-2023-28935](https://insights.sbomify.com/CVE-2023-28935/): Apache UIMA DUCC: DUCC (EOL) allows RCE (high 8.8)
- [CVE-2023-28934](https://insights.sbomify.com/CVE-2023-28934/): WordPress WP Full Stripe Free Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-28933](https://insights.sbomify.com/CVE-2023-28933/): WordPress Call Now Accessibility Button Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-28932](https://insights.sbomify.com/CVE-2023-28932/): WordPress WPMobile.App Plugin <= 11.20 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-28931](https://insights.sbomify.com/CVE-2023-28931/): WordPress Post Connector Plugin <= 1.0.9 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-28930](https://insights.sbomify.com/CVE-2023-28930/): WordPress Mobile Banner Plugin <= 1.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-2893](https://insights.sbomify.com/CVE-2023-2893/): WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_deactivate_product (medium 4.3)
- [CVE-2023-28929](https://insights.sbomify.com/CVE-2023-28929/): Other in Trend Micro Security (Consumer) (high 7.8)
- [CVE-2023-2892](https://insights.sbomify.com/CVE-2023-2892/): WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_bulk_delete_product (medium 6.5)
- [CVE-2023-28912](https://insights.sbomify.com/CVE-2023-28912/): Cleartext Phonebook Information (medium 5.7)
- [CVE-2023-28911](https://insights.sbomify.com/CVE-2023-28911/): Arbitrary Channel Disconnection Resulting in Denial of Service (medium 6.5)
- [CVE-2023-28910](https://insights.sbomify.com/CVE-2023-28910/): Disabled Abortion Flag (high 8.0)
- [CVE-2023-2891](https://insights.sbomify.com/CVE-2023-2891/): WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_delete_product (medium 6.5)
- [CVE-2023-28909](https://insights.sbomify.com/CVE-2023-28909/): Integer Overflow Leading to MTU Bypass (high 8.0)
- [CVE-2023-28908](https://insights.sbomify.com/CVE-2023-28908/): Integer Overflow in Non-Fragmented Data Reception (medium 5.4)
- [CVE-2023-28907](https://insights.sbomify.com/CVE-2023-28907/): A lack of access restrictions on internal memory regions (medium 6.7)
- [CVE-2023-28906](https://insights.sbomify.com/CVE-2023-28906/): Command injection in networking service (high 7.8)
- [CVE-2023-28905](https://insights.sbomify.com/CVE-2023-28905/): Heap buffer overflow in picserver (high 8.0)
- [CVE-2023-28904](https://insights.sbomify.com/CVE-2023-28904/): Bypass of secure boot process (medium 5.2)
- [CVE-2023-28903](https://insights.sbomify.com/CVE-2023-28903/): Integer overflow in Volkswagen MIB3 infotainment system MIB3 OI MQB (low 3.3)
- [CVE-2023-28902](https://insights.sbomify.com/CVE-2023-28902/): Denial of Service via integer underflow in picserver (low 3.3)
- [CVE-2023-28901](https://insights.sbomify.com/CVE-2023-28901/): Trip Data Disclosure from Backend (medium 5.3)
- [CVE-2023-28900](https://insights.sbomify.com/CVE-2023-28900/): Nickname Disclosure on the Backend Automotive Server (medium 5.3)
- [CVE-2023-28899](https://insights.sbomify.com/CVE-2023-28899/): Denial of Service via ECU reset service (medium 4.7)
- [CVE-2023-28898](https://insights.sbomify.com/CVE-2023-28898/): Head Unit Denial-of-Service via Apple CarPlay service (medium 5.3)
- [CVE-2023-28897](https://insights.sbomify.com/CVE-2023-28897/): Hard-coded password for UDS services (medium 4.0)
- [CVE-2023-28896](https://insights.sbomify.com/CVE-2023-28896/): Weak encoding for password in UDS services (low 3.3)
- [CVE-2023-28895](https://insights.sbomify.com/CVE-2023-28895/): Hard-coded password for access to power controller chip memory (low 3.5)
- [CVE-2023-28892](https://insights.sbomify.com/CVE-2023-28892/): Privilege escalation in malwarebytes:adwcleaner (high 7.8)
- [CVE-2023-2889](https://insights.sbomify.com/CVE-2023-2889/): SQLi in Veon Computer's Service Tracking Software (critical 9.8)
- [CVE-2023-28885](https://insights.sbomify.com/CVE-2023-28885/): Memory corruption in gm:mylink infotainment system (medium 6.8)
- [CVE-2023-28884](https://insights.sbomify.com/CVE-2023-28884/): Cross-site scripting in misp-project:misp (medium 6.1)
- [CVE-2023-28883](https://insights.sbomify.com/CVE-2023-28883/): SQL injection in cerebrate-project:cerebrate (critical 9.8)
- [CVE-2023-28882](https://insights.sbomify.com/CVE-2023-28882/): Denial of service in owasp:modsecurity (high 7.5)
- [CVE-2023-2888](https://insights.sbomify.com/CVE-2023-2888/): PHPOK unrestricted upload (medium 4.7)
- [CVE-2023-28879](https://insights.sbomify.com/CVE-2023-28879/): Memory corruption in artifex:ghostscript (critical 9.8)
- [CVE-2023-28877](https://insights.sbomify.com/CVE-2023-28877/): Missing authorization in vtex:apps-graphql (high 7.5)
- [CVE-2023-28876](https://insights.sbomify.com/CVE-2023-28876/): Missing authorization in afian:filerun (medium 4.3)
- [CVE-2023-28875](https://insights.sbomify.com/CVE-2023-28875/): Cross-site scripting in afian:filerun (medium 5.4)
- [CVE-2023-28874](https://insights.sbomify.com/CVE-2023-28874/): Open redirect in seafile:seafile (medium 6.1)
- [CVE-2023-28873](https://insights.sbomify.com/CVE-2023-28873/): Cross-site scripting in seafile:seafile (medium 5.4)
- [CVE-2023-28872](https://insights.sbomify.com/CVE-2023-28872/): Privilege escalation in ncp-e:secure enterprise client (high 8.8)
- [CVE-2023-28871](https://insights.sbomify.com/CVE-2023-28871/): Path traversal in ncp-e:secure enterprise client (medium 4.3)
- [CVE-2023-28870](https://insights.sbomify.com/CVE-2023-28870/): Misconfiguration in ncp-e:secure enterprise client (medium 6.5)
- [CVE-2023-2887](https://insights.sbomify.com/CVE-2023-2887/): User Authentication Bypass in CBOT's Chatbot (critical 9.8)
- [CVE-2023-28869](https://insights.sbomify.com/CVE-2023-28869/): Path traversal in ncp-e:secure enterprise client (medium 6.5)
- [CVE-2023-28868](https://insights.sbomify.com/CVE-2023-28868/): Path traversal in ncp-e:secure enterprise client (high 8.1)
- [CVE-2023-28867](https://insights.sbomify.com/CVE-2023-28867/): GraphQL Java vulnerable to stack consumption (high 7.5)
- [CVE-2023-28866](https://insights.sbomify.com/CVE-2023-28866/): Memory corruption in linux:linux kernel (medium 5.3)
- [CVE-2023-28865](https://insights.sbomify.com/CVE-2023-28865/): Security feature bypass in dieboldnixdorf:vynamic security suite (medium 6.6)
- [CVE-2023-28864](https://insights.sbomify.com/CVE-2023-28864/): Information disclosure in progress:chef infra server (medium 5.5)
- [CVE-2023-28863](https://insights.sbomify.com/CVE-2023-28863/): Security feature bypass in ami:megarac sp-x (critical 9.1)
- [CVE-2023-28862](https://insights.sbomify.com/CVE-2023-28862/): Auth bypass in lemonldap-ng:lemonldap\ (critical 9.8)
- [CVE-2023-2886](https://insights.sbomify.com/CVE-2023-2886/): Cross-Site WebSocket Hijacking in CBOT's Chatbot (medium 4.3)
- [CVE-2023-28859](https://insights.sbomify.com/CVE-2023-28859/): redis-py Race Condition due to incomplete fix (medium 6.5)
- [CVE-2023-28858](https://insights.sbomify.com/CVE-2023-28858/): redis-py Race Condition vulnerability (low 3.7)
- [CVE-2023-28857](https://insights.sbomify.com/CVE-2023-28857/): LDAP password leak in Apereo CAS - GHSL-2023-009 (medium 4.0)
- [CVE-2023-28856](https://insights.sbomify.com/CVE-2023-28856/): `HINCRBYFLOAT` can be used to crash a redis-server process (medium 5.5)
- [CVE-2023-28855](https://insights.sbomify.com/CVE-2023-28855/): Fields GLPI plugin vulnerable to unauthorized write access to additional fields (medium 6.5)
- [CVE-2023-28854](https://insights.sbomify.com/CVE-2023-28854/): nophp vulnerable to shell command injection on httpd user when sending a password-setting mail or mail-login mail (high 8.0)
- [CVE-2023-28853](https://insights.sbomify.com/CVE-2023-28853/): Mastodon's blind LDAP injection in login allows the attacker to leak arbitrary attributes from LDAP database (high 7.7)
- [CVE-2023-28852](https://insights.sbomify.com/CVE-2023-28852/): GLPI vulnerable to stored Cross-site Scripting through dashboard administration (medium 4.8)
- [CVE-2023-28851](https://insights.sbomify.com/CVE-2023-28851/): Silverstripe Form Capture vulnerable to Stored Cross-Site Scripting (medium 6.1)
- [CVE-2023-28850](https://insights.sbomify.com/CVE-2023-28850/): Pimcore Perspective Editor vulnerable to Cross-site Scripting in perspective name (medium 6.1)
- [CVE-2023-2885](https://insights.sbomify.com/CVE-2023-2885/): Channel Accessible by Non-Endpoint in CBOT's Chatbot (high 8.1)
- [CVE-2023-28849](https://insights.sbomify.com/CVE-2023-28849/): GLPI vulnerable to SQL injection and Stored XSS via inventory agent request (critical 10.0)
- [CVE-2023-28848](https://insights.sbomify.com/CVE-2023-28848/): CSRF protection on user_oidc login returned the expected token in case of an error (medium 4.8)
- [CVE-2023-28847](https://insights.sbomify.com/CVE-2023-28847/): Nextcloud Server missing brute force protection for passwords of password protected share links (low 3.1)
- [CVE-2023-28846](https://insights.sbomify.com/CVE-2023-28846/): Denial of Service in unpoly-rails (medium 5.9)
- [CVE-2023-28845](https://insights.sbomify.com/CVE-2023-28845/): Chat room membership disclosed via autocompletion in Nextcloud talk (low 3.5)
- [CVE-2023-28844](https://insights.sbomify.com/CVE-2023-28844/): User without download rights can download older version of that file in nextcloud server (medium 5.7)
- [CVE-2023-28843](https://insights.sbomify.com/CVE-2023-28843/): Improper neutralization of SQL parameter in PayPal module for PrestaShop (critical 9.8)
- [CVE-2023-28842](https://insights.sbomify.com/CVE-2023-28842/): moby/moby's dockerd daemon encrypted overlay network with a single endpoint is unauthenticated (medium 6.8)
- [CVE-2023-28841](https://insights.sbomify.com/CVE-2023-28841/): moby/moby's dockerd daemon encrypted overlay network traffic may be unencrypted (medium 6.8)
- [CVE-2023-28840](https://insights.sbomify.com/CVE-2023-28840/): moby/moby's dockerd daemon encrypted overlay network may be unauthenticated (high 7.5)
- [CVE-2023-2884](https://insights.sbomify.com/CVE-2023-2884/): Insecure Randomness in CBOT's Chatbot (critical 9.8)
- [CVE-2023-28839](https://insights.sbomify.com/CVE-2023-28839/): Improper neutralization in an SQL query in Shoppingfeed (critical 9.4)
- [CVE-2023-28838](https://insights.sbomify.com/CVE-2023-28838/): GLPI vulnerable to SQL injection through dynamic reports (critical 9.6)
- [CVE-2023-28837](https://insights.sbomify.com/CVE-2023-28837/): Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large files (medium 4.9)
- [CVE-2023-28836](https://insights.sbomify.com/CVE-2023-28836/): Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views (medium 6.4)
- [CVE-2023-28835](https://insights.sbomify.com/CVE-2023-28835/): Insecure randomness for default password in nextcloud (low 3.5)
- [CVE-2023-28834](https://insights.sbomify.com/CVE-2023-28834/): Full path of data directory exposed to Nextcloud server users (low 3.5)
- [CVE-2023-28833](https://insights.sbomify.com/CVE-2023-28833/): Unrestricted filenames for logo or favicon as admin in the theming settings in nextcloud server (low 2.4)
- [CVE-2023-28832](https://insights.sbomify.com/CVE-2023-28832/): Command injection in SIMATIC Cloud Connect 7 CC712 (high 7.2)
- [CVE-2023-28831](https://insights.sbomify.com/CVE-2023-28831/): Integer overflow in SIMATIC BRAUMAT (high 8.7)
- [CVE-2023-28830](https://insights.sbomify.com/CVE-2023-28830/): Use after free in JT2Go (high 7.8)
- [CVE-2023-2883](https://insights.sbomify.com/CVE-2023-2883/): IDOR in CBOT's Chatbot (high 8.8)
- [CVE-2023-28829](https://insights.sbomify.com/CVE-2023-28829/): Weak cryptography in SIMATIC NET PC Software V14 (low 3.9)
- [CVE-2023-28828](https://insights.sbomify.com/CVE-2023-28828/): XML external entity in Polarion ALM (medium 5.9)
- [CVE-2023-28827](https://insights.sbomify.com/CVE-2023-28827/): Null dereference in SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) (high 8.2)
- [CVE-2023-28826](https://insights.sbomify.com/CVE-2023-28826/): Information disclosure in iOS and iPadOS (medium 5.5)
- [CVE-2023-28824](https://insights.sbomify.com/CVE-2023-28824/): Server-side request forgery in CONPROSYS HMI System (CHS) (medium 4.9)
- [CVE-2023-28823](https://insights.sbomify.com/CVE-2023-28823/): Privilege escalation in Intel(R) oneAPI Toolkit and component software installers (medium 6.7)
- [CVE-2023-28821](https://insights.sbomify.com/CVE-2023-28821/): Missing rate limit for password resets (medium 5.3)
- [CVE-2023-28820](https://insights.sbomify.com/CVE-2023-28820/): Stored cross site scripting in RSS displayer (low 2.0)
- [CVE-2023-2882](https://insights.sbomify.com/CVE-2023-2882/): Privilege Escalation in CBOT's Chatbot (critical 9.8)
- [CVE-2023-28819](https://insights.sbomify.com/CVE-2023-28819/): Concrete CMS (previously concrete5) is vulnerable to stored XSS in uploaded file and folder names (low 3.5)
- [CVE-2023-28818](https://insights.sbomify.com/CVE-2023-28818/): Supply chain in veritas:aptare it analytics (medium 5.3)
- [CVE-2023-28815](https://insights.sbomify.com/CVE-2023-28815/): Command injection in iSecure Center (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/336/