# Vulnerabilities published in 2023


- [CVE-2023-28814](https://insights.sbomify.com/CVE-2023-28814/): File upload in iSecure Center (critical 9.8)
- [CVE-2023-28813](https://insights.sbomify.com/CVE-2023-28813/): Other in LocalServiceComponents (high 8.1)
- [CVE-2023-28812](https://insights.sbomify.com/CVE-2023-28812/): Memory corruption in LocalServiceComponents (critical 9.1)
- [CVE-2023-28811](https://insights.sbomify.com/CVE-2023-28811/): Memory corruption in DS-71XXHGH-K(S) (high 7.4)
- [CVE-2023-28810](https://insights.sbomify.com/CVE-2023-28810/): Missing authorization in DS-K1T320XXX (medium 4.3)
- [CVE-2023-2881](https://insights.sbomify.com/CVE-2023-2881/): Storing Passwords in a Recoverable Format in pimcore/customer-data-framework (medium 6.7)
- [CVE-2023-28809](https://insights.sbomify.com/CVE-2023-28809/): Auth bypass in DS-K1T320XXX (high 7.5)
- [CVE-2023-28808](https://insights.sbomify.com/CVE-2023-28808/): Missing authorization in DS-A71024/48/72R,DS-A80624S,DS-A81016S,DS-A72024/72R,DS-A80316S,DS-A82024D (critical 9.1)
- [CVE-2023-28807](https://insights.sbomify.com/CVE-2023-28807/): Bypass of ZIA domain fronting detection module through evasion technique (medium 5.1)
- [CVE-2023-28806](https://insights.sbomify.com/CVE-2023-28806/): Signature validation error in DLL allows disabling anti-tampering protection (medium 5.7)
- [CVE-2023-28805](https://insights.sbomify.com/CVE-2023-28805/): ZCC on Linux privilege escalation (medium 6.7)
- [CVE-2023-28804](https://insights.sbomify.com/CVE-2023-28804/): Linux ZCC allows unsigned updates, allowing elevated Code Execution (high 8.2)
- [CVE-2023-28803](https://insights.sbomify.com/CVE-2023-28803/): Traffic being bypassed by ZCC by configuring synthetic IP range as local network (medium 5.9)
- [CVE-2023-28802](https://insights.sbomify.com/CVE-2023-28802/): Disable Zscaler using machine tunnel restart (medium 4.9)
- [CVE-2023-28801](https://insights.sbomify.com/CVE-2023-28801/): Improper SAML signature verification (critical 9.6)
- [CVE-2023-28800](https://insights.sbomify.com/CVE-2023-28800/): Output encoding missing in redrurl parameter (high 8.1)
- [CVE-2023-2880](https://insights.sbomify.com/CVE-2023-2880/): Frauscher Sensortechnik Diagnostic System FDS001 for FAdC/FAdCi Path Traversal vulnerability (high 7.5)
- [CVE-2023-28799](https://insights.sbomify.com/CVE-2023-28799/): Open redirect in Client Connector (high 8.2)
- [CVE-2023-28798](https://insights.sbomify.com/CVE-2023-28798/): Out-of-bounds write to heap in pacparser (medium 6.5)
- [CVE-2023-28797](https://insights.sbomify.com/CVE-2023-28797/): LPE using arbitrary file delete with Symlinks (medium 6.3)
- [CVE-2023-28796](https://insights.sbomify.com/CVE-2023-28796/): IPC Bypass Through PLT Section in ELF (high 7.1)
- [CVE-2023-28795](https://insights.sbomify.com/CVE-2023-28795/): Client IPC validation bypass (high 7.8)
- [CVE-2023-28794](https://insights.sbomify.com/CVE-2023-28794/): PAC Files Exposed to Internet Websites (medium 4.3)
- [CVE-2023-28793](https://insights.sbomify.com/CVE-2023-28793/): Heap Based Buffer Overflow in Library (high 7.8)
- [CVE-2023-28792](https://insights.sbomify.com/CVE-2023-28792/): WordPress Continuous Image Carousel With Lightbox Plugin <= 1.0.15 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-28791](https://insights.sbomify.com/CVE-2023-28791/): WordPress Simple Org Chart Plugin <= 2.3.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-28790](https://insights.sbomify.com/CVE-2023-28790/): WordPress Simple Staff List Plugin <= 2.2.3 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-2879](https://insights.sbomify.com/CVE-2023-2879/): Denial of service in Wireshark (medium 6.3)
- [CVE-2023-28789](https://insights.sbomify.com/CVE-2023-28789/): WordPress Contact Forms by Cimatti Plugin <= 1.5.4 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-28788](https://insights.sbomify.com/CVE-2023-28788/): WordPress Advanced Page Visit Counter Plugin <= 6.4.2 is vulnerable to SQL Injection (high 7.1)
- [CVE-2023-28787](https://insights.sbomify.com/CVE-2023-28787/): WordPress Quiz And Survey Master plugin <= 8.1.4 - Unauthenticated SQL Injection vulnerability (critical 9.3)
- [CVE-2023-28786](https://insights.sbomify.com/CVE-2023-28786/): WordPress Solid Security Plugin <= 8.1.4 is vulnerable to Open Redirection (low 3.7)
- [CVE-2023-28785](https://insights.sbomify.com/CVE-2023-28785/): WordPress Yoast SEO: Local Plugin <= 14.9 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-28784](https://insights.sbomify.com/CVE-2023-28784/): WordPress Contest Gallery Plugin <= 21.1.2 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-28783](https://insights.sbomify.com/CVE-2023-28783/): WordPress Woocommerce Tip/Donation Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-28782](https://insights.sbomify.com/CVE-2023-28782/): WordPress Gravity Forms Plugin <= 2.7.3 is vulnerable to PHP Object Injection (high 8.3)
- [CVE-2023-28781](https://insights.sbomify.com/CVE-2023-28781/): WordPress Contact Forms by Cimatti Plugin <= 1.5.4 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-28780](https://insights.sbomify.com/CVE-2023-28780/): WordPress Yoast SEO: Local Plugin <= 14.8 is vulnerable to Cross Site Request Forgery (CSRF) (medium 6.5)
- [CVE-2023-2878](https://insights.sbomify.com/CVE-2023-2878/): Kubernetes secrets-store-csi-driver discloses service account tokens in logs (medium 6.5)
- [CVE-2023-28779](https://insights.sbomify.com/CVE-2023-28779/): WordPress Terms descriptions Plugin <= 3.4.4 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-28778](https://insights.sbomify.com/CVE-2023-28778/): WordPress Pagination by BestWebSoft Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-28777](https://insights.sbomify.com/CVE-2023-28777/): WordPress LearnDash LMS Plugin <= 4.5.3 is vulnerable to SQL Injection (high 8.5)
- [CVE-2023-28776](https://insights.sbomify.com/CVE-2023-28776/): WordPress Continuous Image Carousel With Lightbox Plugin <= 1.0.15 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-28775](https://insights.sbomify.com/CVE-2023-28775/): WordPress Yoast SEO Premium plugin <= 20.4 - Unauthenticated Zapier API Key Reset vulnerability (medium 5.3)
- [CVE-2023-28774](https://insights.sbomify.com/CVE-2023-28774/): WordPress Review Stream Plugin <= 1.6.5 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-28773](https://insights.sbomify.com/CVE-2023-28773/): WordPress Secondary Title Plugin <= 2.0.9.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-28772](https://insights.sbomify.com/CVE-2023-28772/): Memory corruption in linux:linux kernel (medium 6.7)
- [CVE-2023-28771](https://insights.sbomify.com/CVE-2023-28771/): Zyxel Multiple Firewalls OS Command Injection (critical 9.8, exploited in the wild)
- [CVE-2023-28770](https://insights.sbomify.com/CVE-2023-28770/): Information disclosure in DX5401-B0 firmware (high 7.5)
- [CVE-2023-2877](https://insights.sbomify.com/CVE-2023-2877/): Formidable Forms < 6.3.1 - Subscriber+ Remote Code Execution (high 8.8)
- [CVE-2023-28769](https://insights.sbomify.com/CVE-2023-28769/): Memory corruption in DX5401-B0 firmware (critical 9.8)
- [CVE-2023-28768](https://insights.sbomify.com/CVE-2023-28768/): Denial of service in XGS2220-30 firmware (medium 6.5)
- [CVE-2023-28767](https://insights.sbomify.com/CVE-2023-28767/): Command injection in ATP series firmware (high 8.8)
- [CVE-2023-28766](https://insights.sbomify.com/CVE-2023-28766/): Null dereference in SIPROTEC 5 6MD85 (CP300) (high 7.5)
- [CVE-2023-28765](https://insights.sbomify.com/CVE-2023-28765/): Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management ) (critical 9.8)
- [CVE-2023-28764](https://insights.sbomify.com/CVE-2023-28764/): Information Disclosure vulnerability in SAP BusinessObjects Platform (low 3.7)
- [CVE-2023-28763](https://insights.sbomify.com/CVE-2023-28763/): Denial of Service in SAP NetWeaver AS for ABAP and ABAP Platform (medium 6.5)
- [CVE-2023-28762](https://insights.sbomify.com/CVE-2023-28762/): Information Disclosure in SAP BusinessObjects Intelligence Platform (critical 9.1)
- [CVE-2023-28761](https://insights.sbomify.com/CVE-2023-28761/): Missing Authentication check in SAP NetWeaver Enterprise Portal (medium 6.5)
- [CVE-2023-28760](https://insights.sbomify.com/CVE-2023-28760/): TP-Link AX1800 WiFi 6 Router (Archer AX21) devices allow unauthenticated attackers (on the LAN) to execute arbitrary code as root via the db (high 7.5)
- [CVE-2023-2876](https://insights.sbomify.com/CVE-2023-2876/): Session cookie exposure for client side script (low 3.1)
- [CVE-2023-28759](https://insights.sbomify.com/CVE-2023-28759/): Privilege escalation in veritas:netbackup (high 7.8)
- [CVE-2023-28758](https://insights.sbomify.com/CVE-2023-28758/): Privilege escalation in veritas:netbackup (high 7.1)
- [CVE-2023-28756](https://insights.sbomify.com/CVE-2023-28756/): Ruby Time component ReDoS issue (medium 5.3)
- [CVE-2023-28755](https://insights.sbomify.com/CVE-2023-28755/): Ruby URI component ReDoS issue (medium 5.3)
- [CVE-2023-28754](https://insights.sbomify.com/CVE-2023-28754/): ShardingSphere-Agent: Deserialization vulnerability in ShardingSphere Agent (high 8.8)
- [CVE-2023-28753](https://insights.sbomify.com/CVE-2023-28753/): Integer overflow in netconsd (critical 9.8)
- [CVE-2023-28751](https://insights.sbomify.com/CVE-2023-28751/): WordPress Wp Ultimate Review Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-28750](https://insights.sbomify.com/CVE-2023-28750/): WordPress Albo Pretorio Online Plugin <= 4.6 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-2875](https://insights.sbomify.com/CVE-2023-2875/): eScan Antivirus IoControlCode PROCOBSRVESX.SYS 0x22E008u null pointer dereference (medium 5.5)
- [CVE-2023-28749](https://insights.sbomify.com/CVE-2023-28749/): WordPress CM On Demand Search And Replace Plugin <= 1.3.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-28748](https://insights.sbomify.com/CVE-2023-28748/): WordPress Copy Or Move Comments Plugin <= 5.0.4 is vulnerable to SQL Injection (high 8.5)
- [CVE-2023-28747](https://insights.sbomify.com/CVE-2023-28747/): WordPress CBX Currency Converter Plugin <= 3.0.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-28746](https://insights.sbomify.com/CVE-2023-28746/): Information disclosure in Intel(R) Atom(R) Processors (medium 6.5)
- [CVE-2023-28745](https://insights.sbomify.com/CVE-2023-28745/): Privilege escalation in Intel(R) QSFP+ Configuration Utility software (medium 6.7)
- [CVE-2023-28744](https://insights.sbomify.com/CVE-2023-28744/): Use after free in Foxit Reader (high 8.8)
- [CVE-2023-28743](https://insights.sbomify.com/CVE-2023-28743/): Privilege escalation in Intel NUC BIOS firmware (high 7.5)
- [CVE-2023-28742](https://insights.sbomify.com/CVE-2023-28742/): BIG-IP iQuery mesh vulnerability (high 7.2)
- [CVE-2023-28741](https://insights.sbomify.com/CVE-2023-28741/): Memory corruption in Intel(R) QAT drivers for Windows - HW Version 1.0 (high 7.9)
- [CVE-2023-28740](https://insights.sbomify.com/CVE-2023-28740/): Privilege escalation in Intel(R) QAT drivers for Windows - HW Version 2.0 (medium 6.7)
- [CVE-2023-2874](https://insights.sbomify.com/CVE-2023-2874/): Twister Antivirus IoControlCode filppd.sys 0x804f2140 denial of service (medium 5.5)
- [CVE-2023-28739](https://insights.sbomify.com/CVE-2023-28739/): Misconfiguration in Intel(R) Chipset Driver Software (medium 6.7)
- [CVE-2023-28738](https://insights.sbomify.com/CVE-2023-28738/): Privilege escalation in Intel NUC BIOS firmware (high 7.5)
- [CVE-2023-28737](https://insights.sbomify.com/CVE-2023-28737/): Privilege escalation in Intel(R) Aptio* V UEFI Firmware Integrator Tools (high 8.8)
- [CVE-2023-28736](https://insights.sbomify.com/CVE-2023-28736/): Memory corruption in Intel(R) SSD Tools software (medium 5.7)
- [CVE-2023-28733](https://insights.sbomify.com/CVE-2023-28733/): Stored XSS affecting the AcyMailing plugin for Joomla (high 7.2)
- [CVE-2023-28732](https://insights.sbomify.com/CVE-2023-28732/): Missing access control affecting the AcyMailing plugin for Joomla (medium 6.5)
- [CVE-2023-28731](https://insights.sbomify.com/CVE-2023-28731/): Unauthenticated RCE affecting the AcyMailing plugin for Joomla (critical 9.8)
- [CVE-2023-28730](https://insights.sbomify.com/CVE-2023-28730/): Memory corruption in Control FPWIN Pro (high 7.8)
- [CVE-2023-2873](https://insights.sbomify.com/CVE-2023-2873/): Twister Antivirus IoControlCode filppd.sys 0x80800043 memory corruption (medium 5.3)
- [CVE-2023-28729](https://insights.sbomify.com/CVE-2023-28729/): Memory corruption in Control FPWIN Pro (high 7.8)
- [CVE-2023-28728](https://insights.sbomify.com/CVE-2023-28728/): Memory corruption in Control FPWIN Pro (high 7.8)
- [CVE-2023-28727](https://insights.sbomify.com/CVE-2023-28727/): Auth bypass in AiSEG2 (critical 9.6)
- [CVE-2023-28726](https://insights.sbomify.com/CVE-2023-28726/): Command injection in AiSEG2 (high 7.5)
- [CVE-2023-28725](https://insights.sbomify.com/CVE-2023-28725/): File upload in generalbytes:crypto application server (critical 9.1)
- [CVE-2023-28724](https://insights.sbomify.com/CVE-2023-28724/): NGINX Management Suite vulnerability (high 7.1)
- [CVE-2023-28723](https://insights.sbomify.com/CVE-2023-28723/): Information disclosure in Intel(R) Aptio* V UEFI Firmware Integrator Tools (low 3.3)
- [CVE-2023-28722](https://insights.sbomify.com/CVE-2023-28722/): Memory corruption in Intel NUC BIOS firmware (medium 6.7)
- [CVE-2023-28720](https://insights.sbomify.com/CVE-2023-28720/): Denial of service in Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software (medium 6.1)
- [CVE-2023-2872](https://insights.sbomify.com/CVE-2023-2872/): FlexiHub IoControlCode fusbhub.sys 0x220088 null pointer dereference (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/337/