# Vulnerabilities published in 2023


- [CVE-2023-28417](https://insights.sbomify.com/CVE-2023-28417/): WordPress Dynamics 365 Integration plugin <= 1.3.12 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-28416](https://insights.sbomify.com/CVE-2023-28416/): WordPress Chankhe theme <= 1.0.5 - Authenticated Arbitrary Plugin Activation vulnerability (medium 4.3)
- [CVE-2023-28415](https://insights.sbomify.com/CVE-2023-28415/): WordPress Side Cart Woocommerce (Ajax) Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-28414](https://insights.sbomify.com/CVE-2023-28414/): WordPress ApexChat Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-28413](https://insights.sbomify.com/CVE-2023-28413/): Path traversal in Snow Monkey Forms (critical 9.8)
- [CVE-2023-28412](https://insights.sbomify.com/CVE-2023-28412/): Information disclosure in OvrC Cloud (medium 5.3)
- [CVE-2023-28411](https://insights.sbomify.com/CVE-2023-28411/): Memory corruption in Intel(R) Server Board BMC firmware (medium 6.3)
- [CVE-2023-28410](https://insights.sbomify.com/CVE-2023-28410/): Memory corruption in Intel(R) i915 Graphics drivers for linux (high 8.8)
- [CVE-2023-2841](https://insights.sbomify.com/CVE-2023-2841/): Advanced Local Pickup for WooCommerce <= 1.5.5 - Authenticated (Administrator+) SQL Injection (high 7.2)
- [CVE-2023-28409](https://insights.sbomify.com/CVE-2023-28409/): File upload in MW WP Form (critical 9.8)
- [CVE-2023-28408](https://insights.sbomify.com/CVE-2023-28408/): Path traversal in MW WP Form (critical 9.8)
- [CVE-2023-28407](https://insights.sbomify.com/CVE-2023-28407/): Privilege escalation in Intel(R) XTU software (medium 6.7)
- [CVE-2023-28406](https://insights.sbomify.com/CVE-2023-28406/): BIG-IP Configuration utility vulnerability (medium 4.3)
- [CVE-2023-28405](https://insights.sbomify.com/CVE-2023-28405/): Privilege escalation in Intel(R) Distribution of OpenVINO(TM) Toolkit (medium 6.7)
- [CVE-2023-28404](https://insights.sbomify.com/CVE-2023-28404/): Memory corruption in Intel(R) Arc(TM) & Iris(R) Xe Graphics - WHQL - Windows drivers (low 3.8)
- [CVE-2023-28402](https://insights.sbomify.com/CVE-2023-28402/): Privilege escalation in Intel(R) BIOS Guard firmware (high 7.2)
- [CVE-2023-28401](https://insights.sbomify.com/CVE-2023-28401/): Memory corruption in Intel(R) Arc(TM) & Iris(R) Xe Graphics - WHQL - Windows drivers (medium 5.2)
- [CVE-2023-28400](https://insights.sbomify.com/CVE-2023-28400/): CVE-2023-28400 (high 8.8)
- [CVE-2023-2840](https://insights.sbomify.com/CVE-2023-2840/): NULL Pointer Dereference in gpac/gpac (medium 5.3)
- [CVE-2023-28399](https://insights.sbomify.com/CVE-2023-28399/): Misconfiguration in CONPROSYS HMI System (CHS) (high 7.8)
- [CVE-2023-28398](https://insights.sbomify.com/CVE-2023-28398/): CVE-2023-28398 (critical 9.8)
- [CVE-2023-28397](https://insights.sbomify.com/CVE-2023-28397/): Privilege escalation in Intel(R) Aptio* V UEFI Firmware Integrator Tools (high 7.8)
- [CVE-2023-28396](https://insights.sbomify.com/CVE-2023-28396/): Missing authorization in Intel(R) Thunderbol(TM) Controllers versions (medium 6.1)
- [CVE-2023-28395](https://insights.sbomify.com/CVE-2023-28395/): CVE-2023-28395 (high 8.3)
- [CVE-2023-28394](https://insights.sbomify.com/CVE-2023-28394/): Command injection in Beekeeper Studio (high 8.8)
- [CVE-2023-28393](https://insights.sbomify.com/CVE-2023-28393/): Memory corruption in ImageGear (medium 5.6)
- [CVE-2023-28392](https://insights.sbomify.com/CVE-2023-28392/): Command injection in Wi-Fi AP UNIT (high 7.2)
- [CVE-2023-28391](https://insights.sbomify.com/CVE-2023-28391/): Memory corruption in Cesium NET (critical 9.0)
- [CVE-2023-28390](https://insights.sbomify.com/CVE-2023-28390/): Privilege escalation in SR-7100VN (medium 6.8)
- [CVE-2023-2839](https://insights.sbomify.com/CVE-2023-2839/): Divide By Zero in gpac/gpac (medium 6.8)
- [CVE-2023-28389](https://insights.sbomify.com/CVE-2023-28389/): Misconfiguration in Intel(R) CSME installer software (medium 6.7)
- [CVE-2023-28388](https://insights.sbomify.com/CVE-2023-28388/): Privilege escalation in Intel(R) Chipset Device Software (medium 6.7)
- [CVE-2023-28387](https://insights.sbomify.com/CVE-2023-28387/): Hardcoded credentials in "NewsPicks" App for Android (medium 5.5)
- [CVE-2023-28386](https://insights.sbomify.com/CVE-2023-28386/): Security feature bypass in OvrC Cloud (high 8.6)
- [CVE-2023-28385](https://insights.sbomify.com/CVE-2023-28385/): Privilege escalation in Intel(R) NUC Pro Software Suite for Windows (high 8.2)
- [CVE-2023-28384](https://insights.sbomify.com/CVE-2023-28384/): CVE-2023-28384 (high 8.8)
- [CVE-2023-28383](https://insights.sbomify.com/CVE-2023-28383/): Privilege escalation in Intel(R) BIOS PPAM firmware (medium 6.1)
- [CVE-2023-28382](https://insights.sbomify.com/CVE-2023-28382/): Path traversal in ESS REC Agent Server Edition series (high 8.1)
- [CVE-2023-28381](https://insights.sbomify.com/CVE-2023-28381/): Command injection in Surf SOHO HW1 (high 7.2)
- [CVE-2023-28380](https://insights.sbomify.com/CVE-2023-28380/): Privilege escalation in Intel(R) AI Hackathon software (high 8.8)
- [CVE-2023-2838](https://insights.sbomify.com/CVE-2023-2838/): Out-of-bounds Read in gpac/gpac (medium 6.1)
- [CVE-2023-28379](https://insights.sbomify.com/CVE-2023-28379/): Memory corruption in Cesium NET (critical 9.0)
- [CVE-2023-28378](https://insights.sbomify.com/CVE-2023-28378/): Privilege escalation in Intel(R) QAT drivers for Windows - HW Version 2.0 (medium 6.7)
- [CVE-2023-28377](https://insights.sbomify.com/CVE-2023-28377/): Auth bypass in Intel(R) NUC Kit NUC11PH USB firmware installation software (medium 6.7)
- [CVE-2023-28376](https://insights.sbomify.com/CVE-2023-28376/): Memory corruption in Intel(R) E810 Ethernet Controllers and Adapters (medium 6.5)
- [CVE-2023-28375](https://insights.sbomify.com/CVE-2023-28375/): CVE-2023-28375 (high 7.5)
- [CVE-2023-28374](https://insights.sbomify.com/CVE-2023-28374/): Denial of service in Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software (medium 6.1)
- [CVE-2023-28373](https://insights.sbomify.com/CVE-2023-28373/): FlashArray SafeMode Immutable Vulnerability (medium 4.4)
- [CVE-2023-28372](https://insights.sbomify.com/CVE-2023-28372/): FlashBlade Object Store Privileged Access (medium 6.5)
- [CVE-2023-28371](https://insights.sbomify.com/CVE-2023-28371/): Path traversal in stellarium:stellarium (critical 9.8)
- [CVE-2023-28370](https://insights.sbomify.com/CVE-2023-28370/): Open redirect in Tornado (medium 6.1)
- [CVE-2023-2837](https://insights.sbomify.com/CVE-2023-2837/): Stack-based Buffer Overflow in gpac/gpac (medium 5.5)
- [CVE-2023-28369](https://insights.sbomify.com/CVE-2023-28369/): Missing authorization in Brother iPrint&Scan (low 3.3)
- [CVE-2023-28368](https://insights.sbomify.com/CVE-2023-28368/): Hardcoded credentials in T2600G-28SQ (medium 5.7)
- [CVE-2023-28367](https://insights.sbomify.com/CVE-2023-28367/): Cross-site scripting in VK All in One Expansion Unit (medium 5.4)
- [CVE-2023-28366](https://insights.sbomify.com/CVE-2023-28366/): Denial of service in eclipse:mosquitto (high 7.5)
- [CVE-2023-28365](https://insights.sbomify.com/CVE-2023-28365/): Command injection in UniFi Network application (critical 9.1)
- [CVE-2023-28364](https://insights.sbomify.com/CVE-2023-28364/): Open redirect in Brave Browser Android (medium 6.1)
- [CVE-2023-28362](https://insights.sbomify.com/CVE-2023-28362/): Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to (medium 4.0)
- [CVE-2023-28361](https://insights.sbomify.com/CVE-2023-28361/): Cross-site request forgery in UniFi OS (medium 6.5)
- [CVE-2023-28360](https://insights.sbomify.com/CVE-2023-28360/): Security feature bypass in https://laptop-updates.brave.com/latest/winx64 (medium 4.3)
- [CVE-2023-2836](https://insights.sbomify.com/CVE-2023-2836/): CRM Perks Forms <= 1.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2023-28359](https://insights.sbomify.com/CVE-2023-28359/): SQL injection in Rocket.Chat (medium 5.3)
- [CVE-2023-28358](https://insights.sbomify.com/CVE-2023-28358/): Cross-site scripting in Rocket.Chat (medium 6.1)
- [CVE-2023-28357](https://insights.sbomify.com/CVE-2023-28357/): Information disclosure in Rocket.Chat (medium 4.3)
- [CVE-2023-28356](https://insights.sbomify.com/CVE-2023-28356/): Denial of service in Rocket.Chat (high 7.5)
- [CVE-2023-28354](https://insights.sbomify.com/CVE-2023-28354/): An issue was discovered in Opsview Monitor Agent 6.8. (critical 9.8)
- [CVE-2023-28353](https://insights.sbomify.com/CVE-2023-28353/): File upload in faronics:insight (high 8.8)
- [CVE-2023-28352](https://insights.sbomify.com/CVE-2023-28352/): Auth bypass in faronics:insight (high 7.4)
- [CVE-2023-28351](https://insights.sbomify.com/CVE-2023-28351/): Information disclosure in faronics:insight (low 3.3)
- [CVE-2023-28350](https://insights.sbomify.com/CVE-2023-28350/): Cross-site scripting in faronics:insight (medium 6.1)
- [CVE-2023-2835](https://insights.sbomify.com/CVE-2023-2835/): WP Directory Kit <= 1.2.3 - Reflected Cross-Site Scripting via 'search' (medium 6.1)
- [CVE-2023-28349](https://insights.sbomify.com/CVE-2023-28349/): Privilege escalation in faronics:insight (high 8.8)
- [CVE-2023-28348](https://insights.sbomify.com/CVE-2023-28348/): Weak cryptography in faronics:insight (high 7.4)
- [CVE-2023-28347](https://insights.sbomify.com/CVE-2023-28347/): Cross-site scripting in faronics:insight (critical 9.6)
- [CVE-2023-28346](https://insights.sbomify.com/CVE-2023-28346/): Security feature bypass in faronics:insight (high 7.3)
- [CVE-2023-28345](https://insights.sbomify.com/CVE-2023-28345/): Information disclosure in faronics:insight (medium 4.6)
- [CVE-2023-28344](https://insights.sbomify.com/CVE-2023-28344/): Missing authorization in faronics:insight (high 7.1)
- [CVE-2023-28343](https://insights.sbomify.com/CVE-2023-28343/): Command injection in apsystems:energy communication unit firmware (critical 9.8)
- [CVE-2023-28342](https://insights.sbomify.com/CVE-2023-28342/): Denial of service in zohocorp:manageengine adselfservice plus (high 7.5)
- [CVE-2023-28341](https://insights.sbomify.com/CVE-2023-28341/): Cross-site scripting in zohocorp:manageengine applications manager (medium 6.1)
- [CVE-2023-28340](https://insights.sbomify.com/CVE-2023-28340/): XML external entity in zohocorp:manageengine applications manager (medium 6.5)
- [CVE-2023-2834](https://insights.sbomify.com/CVE-2023-2834/): BookIt <= 2.3.7 - Authentication Bypass (critical 9.8)
- [CVE-2023-28339](https://insights.sbomify.com/CVE-2023-28339/): Privilege escalation in opendoas project:opendoas (high 8.8)
- [CVE-2023-28338](https://insights.sbomify.com/CVE-2023-28338/): Denial of service in NETGEAR Nighthawk WiFi6 Router (RAX30) (high 7.5)
- [CVE-2023-28337](https://insights.sbomify.com/CVE-2023-28337/): File upload in NETGEAR Nighthawk WiFi6 Router (RAX30) (high 8.8)
- [CVE-2023-28336](https://insights.sbomify.com/CVE-2023-28336/): Moodle: teacher can access names of users they do not have permission to access (medium 4.3)
- [CVE-2023-28335](https://insights.sbomify.com/CVE-2023-28335/): Moodle: csrf risk in resetting all templates of a database activity (high 8.8)
- [CVE-2023-28334](https://insights.sbomify.com/CVE-2023-28334/): Moodle: users' name enumeration possible via idor on learning plans page (medium 4.3)
- [CVE-2023-28333](https://insights.sbomify.com/CVE-2023-28333/): Moodle: pix helper potential mustache code injection risk (critical 9.8)
- [CVE-2023-28332](https://insights.sbomify.com/CVE-2023-28332/): Moodle: algebra filter xss when filter is misconfigured (medium 6.1)
- [CVE-2023-28331](https://insights.sbomify.com/CVE-2023-28331/): Moodle: xss risk when outputting database activity filter data (medium 6.1)
- [CVE-2023-28330](https://insights.sbomify.com/CVE-2023-28330/): Moodle: authenticated arbitrary file read through malformed backup file (medium 6.5)
- [CVE-2023-2833](https://insights.sbomify.com/CVE-2023-2833/): ReviewX <= 1.6.13 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation (high 8.8)
- [CVE-2023-28329](https://insights.sbomify.com/CVE-2023-28329/): Moodle: authenticated sql injection via availability check (medium 6.3)
- [CVE-2023-28328](https://insights.sbomify.com/CVE-2023-28328/): Null dereference in Linux (medium 5.5)
- [CVE-2023-28327](https://insights.sbomify.com/CVE-2023-28327/): Null dereference in Linux (medium 5.5)
- [CVE-2023-28326](https://insights.sbomify.com/CVE-2023-28326/): Apache OpenMeetings: allows user impersonation (critical 9.8)
- [CVE-2023-28325](https://insights.sbomify.com/CVE-2023-28325/): Missing authorization in Rocket.Chat (medium 6.5)
- [CVE-2023-28324](https://insights.sbomify.com/CVE-2023-28324/): Other in Ivanti Endpoint Manager (high 8.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/341/