# Vulnerabilities published in 2023


- [CVE-2023-28517](https://insights.sbomify.com/CVE-2023-28517/): IBM Sterling Partner Engagement Manager cross-site scripting (medium 5.4)
- [CVE-2023-28514](https://insights.sbomify.com/CVE-2023-28514/): IBM MQ information disclosure (medium 6.2)
- [CVE-2023-28513](https://insights.sbomify.com/CVE-2023-28513/): IBM MQ denial of service (medium 5.9)
- [CVE-2023-28512](https://insights.sbomify.com/CVE-2023-28512/): IBM Watson CP4D Data Stores improper input validation (medium 5.9)
- [CVE-2023-2851](https://insights.sbomify.com/CVE-2023-2851/): SQLi in Ceppatron (critical 9.8)
- [CVE-2023-28509](https://insights.sbomify.com/CVE-2023-28509/): Weak encryption in UniRPC protocol (high 7.5)
- [CVE-2023-28508](https://insights.sbomify.com/CVE-2023-28508/): Heap corruption in UniRPC service (high 8.8)
- [CVE-2023-28507](https://insights.sbomify.com/CVE-2023-28507/): Memory exhaustion in LZ4 decompression in UniRPC daemon (critical 9.8)
- [CVE-2023-28506](https://insights.sbomify.com/CVE-2023-28506/): Stack buffer overflow in UniRPC service (high 8.8)
- [CVE-2023-28505](https://insights.sbomify.com/CVE-2023-28505/): Buffer overflow in UniRPC library function (high 8.1)
- [CVE-2023-28504](https://insights.sbomify.com/CVE-2023-28504/): Stack buffer overflow in UniRPC library function (critical 9.8)
- [CVE-2023-28503](https://insights.sbomify.com/CVE-2023-28503/): Authentication bypass in UniRPC's udadmin service (critical 9.8)
- [CVE-2023-28502](https://insights.sbomify.com/CVE-2023-28502/): Stack buffer overflow in UniRPC's udadmin_server service (critical 9.8)
- [CVE-2023-28501](https://insights.sbomify.com/CVE-2023-28501/): Heap buffer overflow in unirpcd (critical 9.8)
- [CVE-2023-28500](https://insights.sbomify.com/CVE-2023-28500/): Deserialization in adobe:livecycle es4 (critical 9.8)
- [CVE-2023-2850](https://insights.sbomify.com/CVE-2023-2850/): Unintentional leakage of private information via cross-origin websocket session hijacking (medium 4.7)
- [CVE-2023-28499](https://insights.sbomify.com/CVE-2023-28499/): WordPress Slide Anything Plugin <= 2.4.9 is vulnerable to Cross Site Scripting (XSS) (medium 5.4)
- [CVE-2023-28498](https://insights.sbomify.com/CVE-2023-28498/): WordPress Hotel Booking Lite Plugin <= 4.6.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-28497](https://insights.sbomify.com/CVE-2023-28497/): WordPress Slideshow Gallery Plugin <= 1.7.6 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-28496](https://insights.sbomify.com/CVE-2023-28496/): WordPress SMTP2GO Plugin <= 1.4.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-28495](https://insights.sbomify.com/CVE-2023-28495/): WordPress WP Shortcode by MyThemeShop Plugin <= 1.4.16 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-28494](https://insights.sbomify.com/CVE-2023-28494/): WordPress Contact Form Email plugin <= 1.3.31 - Missing Authorization Leading To Feedback Submission Vulnerability (medium 4.3)
- [CVE-2023-28493](https://insights.sbomify.com/CVE-2023-28493/): WordPress Newsmag Theme <= 2.4.4 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-28492](https://insights.sbomify.com/CVE-2023-28492/): Missing authorization in CP Multi View Event Calendar (medium 4.3)
- [CVE-2023-28491](https://insights.sbomify.com/CVE-2023-28491/): WordPress Slideshow Gallery Plugin <= 1.7.6 is vulnerable to SQL Injection (medium 6.7)
- [CVE-2023-28490](https://insights.sbomify.com/CVE-2023-28490/): WordPress Mortgage Calculator Estatik Plugin <= 2.0.7 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-28489](https://insights.sbomify.com/CVE-2023-28489/): Command injection in CP-8031 MASTER MODULE (critical 9.8)
- [CVE-2023-28488](https://insights.sbomify.com/CVE-2023-28488/): Memory corruption in intel:connman (medium 6.5)
- [CVE-2023-28487](https://insights.sbomify.com/CVE-2023-28487/): Other in netapp:active iq unified manager (medium 5.3)
- [CVE-2023-28486](https://insights.sbomify.com/CVE-2023-28486/): Other in netapp:active iq unified manager (medium 5.3)
- [CVE-2023-28485](https://insights.sbomify.com/CVE-2023-28485/): Cross-site scripting in wekan project:wekan (medium 5.4)
- [CVE-2023-28484](https://insights.sbomify.com/CVE-2023-28484/): Null dereference in debian:debian linux (medium 6.5)
- [CVE-2023-28483](https://insights.sbomify.com/CVE-2023-28483/): Path traversal in tigergraph:tigergraph (high 8.8)
- [CVE-2023-28482](https://insights.sbomify.com/CVE-2023-28482/): Missing authorization in tigergraph:tigergraph (medium 6.5)
- [CVE-2023-28481](https://insights.sbomify.com/CVE-2023-28481/): Misconfiguration in tigergraph:tigergraph (high 8.8)
- [CVE-2023-28480](https://insights.sbomify.com/CVE-2023-28480/): File upload in tigergraph:tigergraph (medium 6.5)
- [CVE-2023-2848](https://insights.sbomify.com/CVE-2023-2848/): Cross-site request forgery in Movim (high 8.0)
- [CVE-2023-28479](https://insights.sbomify.com/CVE-2023-28479/): Misconfiguration in tigergraph:tigergraph (high 8.8)
- [CVE-2023-28478](https://insights.sbomify.com/CVE-2023-28478/): Memory corruption in tp-link:ec70 firmware (high 8.8)
- [CVE-2023-28477](https://insights.sbomify.com/CVE-2023-28477/): Stored cross site scripting on API integration (medium 5.5)
- [CVE-2023-28476](https://insights.sbomify.com/CVE-2023-28476/): Stored cross site scripting on tags (medium 5.4)
- [CVE-2023-28475](https://insights.sbomify.com/CVE-2023-28475/): Reflected cross site scripting (medium 6.1)
- [CVE-2023-28474](https://insights.sbomify.com/CVE-2023-28474/): Stored cross site scripting on saved presets (medium 5.4)
- [CVE-2023-28473](https://insights.sbomify.com/CVE-2023-28473/): Concrete CMS (previously concrete5) is vulnerable to possible auth bypass in the jobs section (low 3.3)
- [CVE-2023-28472](https://insights.sbomify.com/CVE-2023-28472/): Concrete CMS missing secure cookie parameters (medium 5.3)
- [CVE-2023-28471](https://insights.sbomify.com/CVE-2023-28471/): Stored cross site scripting via container name (medium 5.4)
- [CVE-2023-28470](https://insights.sbomify.com/CVE-2023-28470/): Missing authorization in couchbase:couchbase server (medium 5.3)
- [CVE-2023-2847](https://insights.sbomify.com/CVE-2023-2847/): Local privilege escalation in ESET products for Linux and MacOS (high 7.8)
- [CVE-2023-28469](https://insights.sbomify.com/CVE-2023-28469/): Use after free in arm:avalon gpu kernel driver (medium 5.5)
- [CVE-2023-28468](https://insights.sbomify.com/CVE-2023-28468/): Privilege escalation in insyde:kernel (medium 6.5)
- [CVE-2023-28467](https://insights.sbomify.com/CVE-2023-28467/): Cross-site scripting in mybb:mybb (medium 6.1)
- [CVE-2023-28466](https://insights.sbomify.com/CVE-2023-28466/): Race condition in debian:debian linux (high 7.0)
- [CVE-2023-28465](https://insights.sbomify.com/CVE-2023-28465/): HL7 FHIR Partial Path Zip Slip due to bypass of CVE-2023-24057 (high 7.5)
- [CVE-2023-28464](https://insights.sbomify.com/CVE-2023-28464/): Use after free in linux:linux kernel (high 7.8)
- [CVE-2023-28462](https://insights.sbomify.com/CVE-2023-28462/): Payara Server allows remote attackers to load malicious code on the server once a JNDI directory scan is performed (critical 9.8)
- [CVE-2023-28461](https://insights.sbomify.com/CVE-2023-28461/): Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function (critical 9.8, exploited in the wild)
- [CVE-2023-28460](https://insights.sbomify.com/CVE-2023-28460/): Command injection in arraynetworks:array os (high 7.2)
- [CVE-2023-2846](https://insights.sbomify.com/CVE-2023-2846/): Authentication Bypass Vulnerability in MELSEC-F Series main module (high 7.5)
- [CVE-2023-28459](https://insights.sbomify.com/CVE-2023-28459/): pretalx vulnerable to path traversal in HTML export (medium 6.5)
- [CVE-2023-28458](https://insights.sbomify.com/CVE-2023-28458/): pretalx allows path traversal in HTML export (medium 4.3)
- [CVE-2023-28457](https://insights.sbomify.com/CVE-2023-28457/): Other in technitium:dnsserver (high 7.5)
- [CVE-2023-28456](https://insights.sbomify.com/CVE-2023-28456/): Denial of service in technitium:dnsserver (high 7.5)
- [CVE-2023-28455](https://insights.sbomify.com/CVE-2023-28455/): Denial of service in technitium:dnsserver (high 7.5)
- [CVE-2023-28452](https://insights.sbomify.com/CVE-2023-28452/): CoreDNS vulnerable to TuDoor Attacks (high 7.5)
- [CVE-2023-28451](https://insights.sbomify.com/CVE-2023-28451/): Denial of service in technitium:dnsserver (high 7.5)
- [CVE-2023-28450](https://insights.sbomify.com/CVE-2023-28450/): Memory corruption in thekelleys:dnsmasq (high 7.5)
- [CVE-2023-2845](https://insights.sbomify.com/CVE-2023-2845/): Improper Access Control in cloudexplorer-dev/cloudexplorer-lite (high 8.8)
- [CVE-2023-28448](https://insights.sbomify.com/CVE-2023-28448/): Versionize is lacking bound checks, potentially leading to out of bounds memory access (medium 5.7)
- [CVE-2023-28447](https://insights.sbomify.com/CVE-2023-28447/): Cross site scripting vulnerability in Javascript escaping in smarty/smarty (high 7.1)
- [CVE-2023-28446](https://insights.sbomify.com/CVE-2023-28446/): Deno is vulnerable to interactive `run` permission prompt spoofing via improper ANSI neutralization (high 8.8)
- [CVE-2023-28445](https://insights.sbomify.com/CVE-2023-28445/): Deno improperly handles resizable ArrayBuffer (critical 10.0)
- [CVE-2023-28444](https://insights.sbomify.com/CVE-2023-28444/): angular-server-side-configuration information disclosure vulnerability in monorepo with node.js backend (critical 9.9)
- [CVE-2023-28443](https://insights.sbomify.com/CVE-2023-28443/): directus vulnerable to Insertion of Sensitive Information into Log File (medium 4.2)
- [CVE-2023-28442](https://insights.sbomify.com/CVE-2023-28442/): Geoserver for GeoNode sensitive information leak (high 7.5)
- [CVE-2023-28441](https://insights.sbomify.com/CVE-2023-28441/): smartCARS 3 Password Stored as plain text in Error Log (high 8.0)
- [CVE-2023-28440](https://insights.sbomify.com/CVE-2023-28440/): Denial of service via admin theme import route in Discourse (low 2.7)
- [CVE-2023-2844](https://insights.sbomify.com/CVE-2023-2844/): Authorization Bypass Through User-Controlled Key in cloudexplorer-dev/cloudexplorer-lite (high 7.2)
- [CVE-2023-28439](https://insights.sbomify.com/CVE-2023-28439/): ckeditor4 plugins vulnerable to cross-site scripting caused by the editor instance destroying process (medium 4.7)
- [CVE-2023-28438](https://insights.sbomify.com/CVE-2023-28438/): Pimcore vulnerable to improper quoting of filters in Custom Reports (medium 6.2)
- [CVE-2023-28437](https://insights.sbomify.com/CVE-2023-28437/): SQL injection vulnerability due to the keyword blacklist for defending against SQL injection will be bypassed (critical 9.8)
- [CVE-2023-28436](https://insights.sbomify.com/CVE-2023-28436/): Non-interactive Tailscale SSH sessions on FreeBSD may use the effective group ID of the tailscaled process (medium 5.7)
- [CVE-2023-28435](https://insights.sbomify.com/CVE-2023-28435/): Dataease file upload interface does not verify permission or file type (medium 6.5)
- [CVE-2023-28434](https://insights.sbomify.com/CVE-2023-28434/): MinIO Security Feature Bypass (high 8.8, exploited in the wild)
- [CVE-2023-28433](https://insights.sbomify.com/CVE-2023-28433/): Minio Privilege Escalation on Windows via Path separator manipulation (high 8.8)
- [CVE-2023-28432](https://insights.sbomify.com/CVE-2023-28432/): MinIO Information Disclosure (high 7.5, exploited in the wild)
- [CVE-2023-28431](https://insights.sbomify.com/CVE-2023-28431/): Frontier's modexp precompile is slow for even modulus (high 7.5)
- [CVE-2023-28430](https://insights.sbomify.com/CVE-2023-28430/): OneSignal repository github action command injection (high 7.3)
- [CVE-2023-2843](https://insights.sbomify.com/CVE-2023-2843/): MultiParcels Shipping For WooCommerce < 1.14.15 - Subscribers+ SQLi (high 8.8)
- [CVE-2023-28429](https://insights.sbomify.com/CVE-2023-28429/): Pimcore has Cross-site Scripting vulnerability in DataObject tooltip field (medium 6.1)
- [CVE-2023-28428](https://insights.sbomify.com/CVE-2023-28428/): PDFio vulnerable to Denial Of Service when opening a corrupt PDF file (medium 6.2)
- [CVE-2023-28427](https://insights.sbomify.com/CVE-2023-28427/): Prototype pollution in matrix-js-sdk (high 8.2)
- [CVE-2023-28425](https://insights.sbomify.com/CVE-2023-28425/): Specially crafted MSETNX command can lead to denial-of-service (medium 5.5)
- [CVE-2023-28424](https://insights.sbomify.com/CVE-2023-28424/): Soko SQL Injection vulnerability (critical 9.1)
- [CVE-2023-28423](https://insights.sbomify.com/CVE-2023-28423/): WordPress Modern Footnotes Plugin <= 1.4.15 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-28422](https://insights.sbomify.com/CVE-2023-28422/): WordPress Event Manager for WooCommerce Plugin <= 3.8.6 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-28421](https://insights.sbomify.com/CVE-2023-28421/): WordPress WordPress Email Marketing Plugin – WP Email Capture Plugin <= 3.10 is vulnerable to Sensitive Data Exposure (medium 5.3)
- [CVE-2023-28420](https://insights.sbomify.com/CVE-2023-28420/): WordPress Custom Options Plus Plugin <= 1.8.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-2842](https://insights.sbomify.com/CVE-2023-2842/): WP Inventory Manager < 2.1.0.14 - Inventory Items Deletion via CSRF (high 8.1)
- [CVE-2023-28419](https://insights.sbomify.com/CVE-2023-28419/): WordPress Force First and Last Name as Display Name Plugin <= 1.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-28418](https://insights.sbomify.com/CVE-2023-28418/): WordPress Mediciti Lite Theme <= 1.3.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/340/