# Vulnerabilities published in 2023


- [CVE-2023-28718](https://insights.sbomify.com/CVE-2023-28718/): CVE-2023-28718 (high 7.1)
- [CVE-2023-28716](https://insights.sbomify.com/CVE-2023-28716/): CVE-2023-28716 (high 8.8)
- [CVE-2023-28715](https://insights.sbomify.com/CVE-2023-28715/): Missing authorization in Intel(R) oneAPI Toolkit and component software installers (medium 5.0)
- [CVE-2023-28714](https://insights.sbomify.com/CVE-2023-28714/): Privilege escalation in Intel(R) PROSet/Wireless WiFi software for Windows (high 8.2)
- [CVE-2023-28713](https://insights.sbomify.com/CVE-2023-28713/): Information disclosure in CONPROSYS HMI System (CHS) (high 8.1)
- [CVE-2023-28712](https://insights.sbomify.com/CVE-2023-28712/): CVE-2023-28712 (high 8.2)
- [CVE-2023-28711](https://insights.sbomify.com/CVE-2023-28711/): Denial of service in Hyperscan Library maintained by Intel(R) (medium 5.5)
- [CVE-2023-28710](https://insights.sbomify.com/CVE-2023-28710/): Apache Airflow Spark Provider Arbitrary File Read via JDBC (high 7.5)
- [CVE-2023-2871](https://insights.sbomify.com/CVE-2023-2871/): FabulaTech USB for Remote Desktop IoControlCode 0x220408 null pointer dereference (low 3.3)
- [CVE-2023-28709](https://insights.sbomify.com/CVE-2023-28709/): Apache Tomcat: Fix for CVE-2023-24998 is incomplete (high 7.5)
- [CVE-2023-28708](https://insights.sbomify.com/CVE-2023-28708/): Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations (medium 4.3)
- [CVE-2023-28707](https://insights.sbomify.com/CVE-2023-28707/): Airflow Apache Drill Provider Arbitrary File Read Vulnerability (high 7.5)
- [CVE-2023-28706](https://insights.sbomify.com/CVE-2023-28706/): Apache Airflow Hive Provider Beeline Remote Command Execution (critical 9.8)
- [CVE-2023-28705](https://insights.sbomify.com/CVE-2023-28705/): Openfind Mail2000 - XSS (Reflected Cross-site scripting) (medium 5.4)
- [CVE-2023-28704](https://insights.sbomify.com/CVE-2023-28704/): Furbo dog camera - Command Injection (high 8.8)
- [CVE-2023-28703](https://insights.sbomify.com/CVE-2023-28703/): ASUS RT-AC86U - Buffer Overflow (high 7.2)
- [CVE-2023-28702](https://insights.sbomify.com/CVE-2023-28702/): ASUS RT-AC86U - Command Injection (high 8.8)
- [CVE-2023-28701](https://insights.sbomify.com/CVE-2023-28701/): ELITE Web Fax - SQL Injection (critical 9.8)
- [CVE-2023-28700](https://insights.sbomify.com/CVE-2023-28700/): ITPison OMICARD EDM - Arbitrary File Upload (medium 6.8)
- [CVE-2023-2870](https://insights.sbomify.com/CVE-2023-2870/): EnTech Monitor Asset Manager IoControlCode 0x80002014 denial of service (low 3.3)
- [CVE-2023-28699](https://insights.sbomify.com/CVE-2023-28699/): WADE DIGITAL DESIGN CO, LTD. FANTSY - Arbitrary File Upload (high 8.8)
- [CVE-2023-28698](https://insights.sbomify.com/CVE-2023-28698/): WADE DIGITAL DESIGN CO, LTD. FANTSY - Broken Acesss Control (critical 9.8)
- [CVE-2023-28697](https://insights.sbomify.com/CVE-2023-28697/): Moxa MiiNePort E1 - Broken Access Control (critical 9.8)
- [CVE-2023-28696](https://insights.sbomify.com/CVE-2023-28696/): WordPress I Recommend This Plugin <= 3.9.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-28695](https://insights.sbomify.com/CVE-2023-28695/): WordPress VigilanTor Plugin <= 1.3.10 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-28694](https://insights.sbomify.com/CVE-2023-28694/): Cross-site request forgery in Wbcom Designs – BuddyPress Activity Social Share (medium 5.4)
- [CVE-2023-28693](https://insights.sbomify.com/CVE-2023-28693/): WordPress Advanced Youtube Channel Pagination Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-28692](https://insights.sbomify.com/CVE-2023-28692/): WordPress WP Abstracts Plugin <= 2.6.3 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-28690](https://insights.sbomify.com/CVE-2023-28690/): WordPress WP BrowserUpdate Plugin <= 4.5 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-2869](https://insights.sbomify.com/CVE-2023-2869/): WP-Members Membership <= 3.4.7.3 - Missing Authorization to Settings Update (medium 4.3)
- [CVE-2023-28689](https://insights.sbomify.com/CVE-2023-28689/): WordPress JS Job Manager plugin <= 2.0.0 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-28688](https://insights.sbomify.com/CVE-2023-28688/): WordPress TH Variation Swatches plugin <= 1.2.7 - Cross-Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2023-28687](https://insights.sbomify.com/CVE-2023-28687/): Reflected Cross-Site Scripting (XSS) vulnerability in multiple WordPress themes (high 7.1)
- [CVE-2023-28686](https://insights.sbomify.com/CVE-2023-28686/): Missing authorization in debian:debian linux (medium 5.3)
- [CVE-2023-28685](https://insights.sbomify.com/CVE-2023-28685/): Jenkins AbsInt a³ Plugin XML External Entity Reference vulnerability (high 7.1)
- [CVE-2023-28684](https://insights.sbomify.com/CVE-2023-28684/): Jenkins remote-jobs-view-plugin vulnerable to XML external entity attacks (medium 6.5)
- [CVE-2023-28683](https://insights.sbomify.com/CVE-2023-28683/): Jenkins Phabricator Differential Plugin vulnerable to XML external entity (XXE) attacks (high 8.2)
- [CVE-2023-28682](https://insights.sbomify.com/CVE-2023-28682/): Jenkins Performance Publisher Plugin vulnerable to XML external entity (XXE) attacks (high 8.2)
- [CVE-2023-28681](https://insights.sbomify.com/CVE-2023-28681/): Jenkins Visual Studio Code Metrics Plugin vulnerable to XML external entity (XXE) attacks (high 8.2)
- [CVE-2023-28680](https://insights.sbomify.com/CVE-2023-28680/): Jenkins Crap4J Plugin vulnerable to XML external entity (XXE) attacks (high 7.5)
- [CVE-2023-2868](https://insights.sbomify.com/CVE-2023-2868/): Barracuda Networks ESG Appliance Improper Input Validation (critical 9.4, exploited in the wild)
- [CVE-2023-28679](https://insights.sbomify.com/CVE-2023-28679/): Jenkins Mashup Portlets Plugin vulnerable to stored cross-site scripting (medium 5.4)
- [CVE-2023-28678](https://insights.sbomify.com/CVE-2023-28678/): Jenkins Cppcheck Plugin vulnerable to stored cross-site scripting (XSS) (medium 5.4)
- [CVE-2023-28677](https://insights.sbomify.com/CVE-2023-28677/): Jenkins Convert To Pipeline Plugin vulnerable to command injection (critical 9.8)
- [CVE-2023-28676](https://insights.sbomify.com/CVE-2023-28676/): Jenkins Convert To Pipeline Plugin vulnerable to cross-site request forgery (high 8.8)
- [CVE-2023-28675](https://insights.sbomify.com/CVE-2023-28675/): Jenkins OctoPerf Load Testing Plugin missing permission check allows for unauthorized server connections (medium 4.3)
- [CVE-2023-28674](https://insights.sbomify.com/CVE-2023-28674/): Jenkins OctoPerf Load Testing Plugin vulnerable to Cross-site Request Forgery (high 8.8)
- [CVE-2023-28673](https://insights.sbomify.com/CVE-2023-28673/): Jenkins OctoPerf Load Testing Plugin missing permission check allows for ID enumeration (medium 4.3)
- [CVE-2023-28672](https://insights.sbomify.com/CVE-2023-28672/): Jenkins OctoPerf Load Testing Plugin vulnerable to credential capture (medium 6.5)
- [CVE-2023-28671](https://insights.sbomify.com/CVE-2023-28671/): Jenkins OctoPerf Load Testing Plugin vulnerable to Cross-site Request Forgery (medium 4.3)
- [CVE-2023-28670](https://insights.sbomify.com/CVE-2023-28670/): Jenkins Pipeline Aggregator View Plugin vulnerable to Cross-site Scripting (medium 5.4)
- [CVE-2023-28669](https://insights.sbomify.com/CVE-2023-28669/): Jenkins JaCoCo Plugin vulnerable to Stored Cross-site Scripting (medium 5.4)
- [CVE-2023-28668](https://insights.sbomify.com/CVE-2023-28668/): Jenkins Role-based Authorization Strategy Plugin grants permissions even after they’ve been disabled (critical 9.8)
- [CVE-2023-28667](https://insights.sbomify.com/CVE-2023-28667/): Deserialization in Lead Generated WordPress Plugin (critical 9.8)
- [CVE-2023-28666](https://insights.sbomify.com/CVE-2023-28666/): Cross-site scripting in InPost Gallery WordPress Plugin (medium 5.4)
- [CVE-2023-28665](https://insights.sbomify.com/CVE-2023-28665/): Cross-site scripting in Woo Bulk Price Update WordPress Plugin (medium 5.4)
- [CVE-2023-28664](https://insights.sbomify.com/CVE-2023-28664/): Cross-site scripting in Meta Data and Taxonomies Filter WordPress Plugin (medium 5.4)
- [CVE-2023-28663](https://insights.sbomify.com/CVE-2023-28663/): SQL injection in Formidable PRO2PDF WordPress Plugin (high 8.8)
- [CVE-2023-28662](https://insights.sbomify.com/CVE-2023-28662/): SQL injection in Gift Cards (Gift Vouchers and Packages) WordPress Plugin (critical 9.8)
- [CVE-2023-28661](https://insights.sbomify.com/CVE-2023-28661/): SQL injection in WP Popup Banners WordPress Plugin (high 8.8)
- [CVE-2023-28660](https://insights.sbomify.com/CVE-2023-28660/): SQL injection in Events Made Easy WordPress Plugin (high 8.8)
- [CVE-2023-2866](https://insights.sbomify.com/CVE-2023-2866/): Advantech WebAccess Insufficient Type Distinction (high 7.3)
- [CVE-2023-28659](https://insights.sbomify.com/CVE-2023-28659/): SQL injection in Waiting: One-click Countdowns WordPress Plugin (high 8.8)
- [CVE-2023-28658](https://insights.sbomify.com/CVE-2023-28658/): Privilege escalation in Intel(R) oneMKL software (medium 6.7)
- [CVE-2023-28657](https://insights.sbomify.com/CVE-2023-28657/): Missing authorization in CONPROSYS HMI System (CHS) (high 8.8)
- [CVE-2023-28656](https://insights.sbomify.com/CVE-2023-28656/): NGINX Management Suite vulnerability (high 8.1)
- [CVE-2023-28655](https://insights.sbomify.com/CVE-2023-28655/): CVE-2023-28655 (medium 5.4)
- [CVE-2023-28654](https://insights.sbomify.com/CVE-2023-28654/): CVE-2023-28654 (critical 9.8)
- [CVE-2023-28653](https://insights.sbomify.com/CVE-2023-28653/): Use after free in Cscape (high 7.8)
- [CVE-2023-28652](https://insights.sbomify.com/CVE-2023-28652/): CVE-2023-28652 (medium 6.5)
- [CVE-2023-28651](https://insights.sbomify.com/CVE-2023-28651/): Cross-site scripting in CONPROSYS HMI System (CHS) (medium 4.8)
- [CVE-2023-28650](https://insights.sbomify.com/CVE-2023-28650/): CVE-2023-28650 (medium 6.1)
- [CVE-2023-2865](https://insights.sbomify.com/CVE-2023-2865/): SourceCodester Theme Park Ticketing System GET Parameter print_ticket.php sql injection (medium 6.3)
- [CVE-2023-28649](https://insights.sbomify.com/CVE-2023-28649/): Business logic in OvrC Cloud (high 8.6)
- [CVE-2023-28648](https://insights.sbomify.com/CVE-2023-28648/): CVE-2023-28648 (high 7.5)
- [CVE-2023-28647](https://insights.sbomify.com/CVE-2023-28647/): App pin of the iOS app can be bypassed in Nextcloud iOS (medium 4.4)
- [CVE-2023-28646](https://insights.sbomify.com/CVE-2023-28646/): App lockout in nextcloud Android app can be bypassed via thirdparty apps (medium 4.4)
- [CVE-2023-28645](https://insights.sbomify.com/CVE-2023-28645/): Secure view can be bypassed by using internal API endpoint in Nextcloud richdocuments (medium 5.7)
- [CVE-2023-28644](https://insights.sbomify.com/CVE-2023-28644/): Reference fetch can saturate the server bandwidth for 10 seconds in nextcloud server (medium 5.7)
- [CVE-2023-28643](https://insights.sbomify.com/CVE-2023-28643/): Potential share collision for recipients when caching is enabled in nextcloud server (medium 5.5)
- [CVE-2023-28642](https://insights.sbomify.com/CVE-2023-28642/): AppArmor bypass with symlinked /proc in runc (medium 6.1)
- [CVE-2023-28640](https://insights.sbomify.com/CVE-2023-28640/): Permissions bypass in Apiman could enable authenticated attacker to unpermitted API Key (medium 6.4)
- [CVE-2023-2864](https://insights.sbomify.com/CVE-2023-2864/): SourceCodester Online Jewelry Store POST Parameter customer.php cross site scripting (low 3.5)
- [CVE-2023-28639](https://insights.sbomify.com/CVE-2023-28639/): GLPI vulnerable to reflected Cross-site Scripting in search pages (medium 6.1)
- [CVE-2023-28638](https://insights.sbomify.com/CVE-2023-28638/): Stack references to locations outside buffers may become invalid if they exist during a GC compaction in Snappier (high 7.0)
- [CVE-2023-28637](https://insights.sbomify.com/CVE-2023-28637/): DataEase AWS redshift data source exists for remote code execution vulnerability (high 8.0)
- [CVE-2023-28636](https://insights.sbomify.com/CVE-2023-28636/): GLPI vulnerable to stored Cross-site Scripting in external links (medium 4.5)
- [CVE-2023-28635](https://insights.sbomify.com/CVE-2023-28635/): Defining resource name as integer in vantage6 may give unintended access (medium 5.4)
- [CVE-2023-28634](https://insights.sbomify.com/CVE-2023-28634/): GLPI vulnerable to Privilege Escalation from Technician to Super-Admin (high 8.8)
- [CVE-2023-28633](https://insights.sbomify.com/CVE-2023-28633/): GLPI vulnerable to Blind Server-Side Request Forgery (SSRF) in RSS feeds (low 3.5)
- [CVE-2023-28632](https://insights.sbomify.com/CVE-2023-28632/): GLPI vulnerable to account takeover by authenticated user (high 8.1)
- [CVE-2023-28631](https://insights.sbomify.com/CVE-2023-28631/): Attacker controlled data in AST nodes is not validated in comrak (medium 5.3)
- [CVE-2023-28630](https://insights.sbomify.com/CVE-2023-28630/): Sensitive information disclosure possible on misconfigured failed backups of non-H2 databases in gocd (medium 4.2)
- [CVE-2023-2863](https://insights.sbomify.com/CVE-2023-2863/): Simple Design Daily Journal SQLite Database cleartext storage in a file or on disk (low 2.3)
- [CVE-2023-28629](https://insights.sbomify.com/CVE-2023-28629/): Stored XSS possible on VSM and Job Details pages via malicious pipeline label configuration in gocd (medium 5.4)
- [CVE-2023-28628](https://insights.sbomify.com/CVE-2023-28628/): `authority-regex` returns the wrong authority in lambdaisland/uri (medium 5.4)
- [CVE-2023-28627](https://insights.sbomify.com/CVE-2023-28627/): OS Command Injection via GIT_PATH in pymedusa (high 8.3)
- [CVE-2023-28626](https://insights.sbomify.com/CVE-2023-28626/): Quadratic runtime when parsing Markdown in comrak (medium 5.3)
- [CVE-2023-28625](https://insights.sbomify.com/CVE-2023-28625/): mod_auth_openidc core dump when OIDCStripCookies is set and an empty Cookie header is supplied (high 7.5)
- [CVE-2023-28623](https://insights.sbomify.com/CVE-2023-28623/): Unauthorized user can register an account in specific configurations in Zulip (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/338/