# Vulnerabilities published in 2023


- [CVE-2023-27628](https://insights.sbomify.com/CVE-2023-27628/): WordPress Sitekit Plugin <= 1.3 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-27627](https://insights.sbomify.com/CVE-2023-27627/): WordPress Woocommerce Email Report Plugin <= 2.4 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-27626](https://insights.sbomify.com/CVE-2023-27626/): WordPress Stock Ticker plugin <= 3.23.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-27625](https://insights.sbomify.com/CVE-2023-27625/): WordPress Site Reviews plugin <= 6.5.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-27624](https://insights.sbomify.com/CVE-2023-27624/): WordPress Redirect After Login Plugin <= 0.1.9 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-27623](https://insights.sbomify.com/CVE-2023-27623/): WordPress WP Page Numbers Plugin <= 0.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-27622](https://insights.sbomify.com/CVE-2023-27622/): WordPress GuruWalk Affiliates Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-27621](https://insights.sbomify.com/CVE-2023-27621/): WordPress Livestream Notice Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-27620](https://insights.sbomify.com/CVE-2023-27620/): WordPress Robo Gallery Plugin <= 3.2.12 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-2762](https://insights.sbomify.com/CVE-2023-2762/): Use after free in SOLIDWORKS Desktop (high 7.8)
- [CVE-2023-27619](https://insights.sbomify.com/CVE-2023-27619/): WordPress Regina Lite Theme <= 2.0.7 is vulnerable to Cross Site Scripting (XSS) (medium 5.4)
- [CVE-2023-27618](https://insights.sbomify.com/CVE-2023-27618/): WordPress Store Locator WordPress Plugin <= 1.4.9 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-27617](https://insights.sbomify.com/CVE-2023-27617/): WordPress RSVPMarker Plugin <= 10.6.6 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-27616](https://insights.sbomify.com/CVE-2023-27616/): WordPress RSVPMarker Plugin <= 10.6.6 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-27615](https://insights.sbomify.com/CVE-2023-27615/): WordPress WP Super Minify Plugin <= 1.5.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-27614](https://insights.sbomify.com/CVE-2023-27614/): WordPress Motor Racing League Plugin <= 1.9.9 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-27613](https://insights.sbomify.com/CVE-2023-27613/): WordPress Forms Ada Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-27612](https://insights.sbomify.com/CVE-2023-27612/): WordPress Site Reviews Plugin <= 6.5.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-27611](https://insights.sbomify.com/CVE-2023-27611/): WordPress Reusable Blocks Extended Plugin <= 0.9 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-27610](https://insights.sbomify.com/CVE-2023-27610/): WordPress Transbank Webpay REST Plugin <= 1.6.6 is vulnerable to SQL Injection (medium 5.5)
- [CVE-2023-2761](https://insights.sbomify.com/CVE-2023-2761/): User Activity Log < 1.6.3 - Admin+ SQL Injection (high 7.2)
- [CVE-2023-27609](https://insights.sbomify.com/CVE-2023-27609/): WordPress WP Roles at Registration plugin <= 0.23 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2023-27608](https://insights.sbomify.com/CVE-2023-27608/): WordPress Points and Rewards for WooCommerce plugin <= 1.5.0 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-27607](https://insights.sbomify.com/CVE-2023-27607/): WordPress Points and Rewards for WooCommerce plugin <= 1.5.0 - Settings Change vulnerability (medium 5.4)
- [CVE-2023-27606](https://insights.sbomify.com/CVE-2023-27606/): WordPress WP Reroute Email Plugin <= 1.4.6 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-27605](https://insights.sbomify.com/CVE-2023-27605/): WordPress WP Reroute Email Plugin <= 1.4.6 is vulnerable to SQL Injection (medium 5.5)
- [CVE-2023-27604](https://insights.sbomify.com/CVE-2023-27604/): Apache Airflow Sqoop Provider: Airflow Sqoop Provider RCE Vulnerability (high 8.8)
- [CVE-2023-27603](https://insights.sbomify.com/CVE-2023-27603/): Apache Linkis Mangaer module engineConn material upload exists Zip Slip issue (critical 9.8)
- [CVE-2023-27602](https://insights.sbomify.com/CVE-2023-27602/): Apache Linkis publicsercice module unrestricted upload of file (critical 9.8)
- [CVE-2023-27601](https://insights.sbomify.com/CVE-2023-27601/): OpenSIPS has vulnerability in the codec_delete_XX() functions (high 7.5)
- [CVE-2023-27600](https://insights.sbomify.com/CVE-2023-27600/): OpenSIPS has vulnerability in the codec_delete_XX() functions (high 7.5)
- [CVE-2023-2760](https://insights.sbomify.com/CVE-2023-2760/): TAPHOME SQL Injection in Core Platform (high 7.6)
- [CVE-2023-27599](https://insights.sbomify.com/CVE-2023-27599/): OpenSIPS has vulnerability in the parse_to_param() function (high 7.5)
- [CVE-2023-27598](https://insights.sbomify.com/CVE-2023-27598/): OpenSIPS has vulnerability in the parse_via() function (high 7.5)
- [CVE-2023-27597](https://insights.sbomify.com/CVE-2023-27597/): OpenSIPS has vulnerability in the parse_uri() function (high 7.5)
- [CVE-2023-27596](https://insights.sbomify.com/CVE-2023-27596/): OpenSIPS has vulnerability in the codec_delete_XX() functions (high 7.5)
- [CVE-2023-27595](https://insights.sbomify.com/CVE-2023-27595/): Cilium eBPF filters may be temporarily removed during agent restart (medium 6.5)
- [CVE-2023-27594](https://insights.sbomify.com/CVE-2023-27594/): Cilium vulnerable to potential network policy bypass when routing IPv6 traffic (medium 4.2)
- [CVE-2023-27593](https://insights.sbomify.com/CVE-2023-27593/): cilium-agent container can access the host via `hostPath` mount (medium 4.4)
- [CVE-2023-27592](https://insights.sbomify.com/CVE-2023-27592/): Stored XSS in Miniflux when opening a broken image due to unescaped ServerError in proxy handler (medium 4.8)
- [CVE-2023-27591](https://insights.sbomify.com/CVE-2023-27591/): Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics (high 7.5)
- [CVE-2023-27590](https://insights.sbomify.com/CVE-2023-27590/): Rizin has stack-based buffer overflow when parsing GDB registers profile files (high 7.8)
- [CVE-2023-2759](https://insights.sbomify.com/CVE-2023-2759/): TAPHOME Improper Authentication in Core Platform (high 8.8)
- [CVE-2023-27589](https://insights.sbomify.com/CVE-2023-27589/): Minio vulnerable to denial of access by an admin privileged user for root credential (medium 6.5)
- [CVE-2023-27588](https://insights.sbomify.com/CVE-2023-27588/): Unauthenticated path traversal vulnerability in Hasura GraphQL Engine (high 7.5)
- [CVE-2023-27587](https://insights.sbomify.com/CVE-2023-27587/): Information disclosure in readtomyshoe (high 7.4)
- [CVE-2023-27586](https://insights.sbomify.com/CVE-2023-27586/): CairoSVG improperly processes SVG files loaded from external resources (critical 9.9)
- [CVE-2023-27585](https://insights.sbomify.com/CVE-2023-27585/): Memory corruption in pjproject (high 7.5)
- [CVE-2023-27584](https://insights.sbomify.com/CVE-2023-27584/): Dragonfly2 vulnerable to hard coded cyptographic key (critical 9.8)
- [CVE-2023-27583](https://insights.sbomify.com/CVE-2023-27583/): Panindex uses hard coded cyptographic key (critical 9.8)
- [CVE-2023-27582](https://insights.sbomify.com/CVE-2023-27582/): Full authentication bypass if SASL authorization username is specified (critical 9.1)
- [CVE-2023-27581](https://insights.sbomify.com/CVE-2023-27581/): github-slug-action vulnerable to arbitrary code execution (high 8.8)
- [CVE-2023-27580](https://insights.sbomify.com/CVE-2023-27580/): CodeIgniter Shield Password Shucking Vulnerability (high 7.5)
- [CVE-2023-2758](https://insights.sbomify.com/CVE-2023-2758/): Contec CONPROSYS HMI System (CHS) v3.5.2 Denial of Service (low 3.7)
- [CVE-2023-27579](https://insights.sbomify.com/CVE-2023-27579/): TensorFlow has Floating Point Exception in TFLite in conv kernel (high 7.5)
- [CVE-2023-27578](https://insights.sbomify.com/CVE-2023-27578/): Galaxy vulnerable to unauthorized modification of pages/visualizations due to insufficient permission check (critical 9.1)
- [CVE-2023-27577](https://insights.sbomify.com/CVE-2023-27577/): Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files in flarum (medium 6.6)
- [CVE-2023-27576](https://insights.sbomify.com/CVE-2023-27576/): Missing authorization in phplist:phplist (medium 6.7)
- [CVE-2023-27574](https://insights.sbomify.com/CVE-2023-27574/): Security feature bypass in shadowsocks:shadowsocksx-ng (critical 9.8)
- [CVE-2023-27573](https://insights.sbomify.com/CVE-2023-27573/): Hardcoded credentials in netbox-docker (critical 9.0)
- [CVE-2023-27572](https://insights.sbomify.com/CVE-2023-27572/): Cross-site scripting in commscope:dg3450 firmware (medium 6.1)
- [CVE-2023-27571](https://insights.sbomify.com/CVE-2023-27571/): Missing authorization in commscope:dg3450 firmware (medium 5.3)
- [CVE-2023-27570](https://insights.sbomify.com/CVE-2023-27570/): SQL injection in prestashop:eo tags (critical 9.8)
- [CVE-2023-2757](https://insights.sbomify.com/CVE-2023-2757/): Missing authorization in Waiting: One-click countdowns (high 7.4)
- [CVE-2023-27569](https://insights.sbomify.com/CVE-2023-27569/): SQL injection in prestashop:eo tags (critical 9.8)
- [CVE-2023-27568](https://insights.sbomify.com/CVE-2023-27568/): SQL injection in spryker:commerce os (high 8.8)
- [CVE-2023-27567](https://insights.sbomify.com/CVE-2023-27567/): Denial of service in openbsd:openbsd (high 7.5)
- [CVE-2023-27566](https://insights.sbomify.com/CVE-2023-27566/): Memory corruption in live2d:cubism editor (high 7.8)
- [CVE-2023-27564](https://insights.sbomify.com/CVE-2023-27564/): n8n Information Disclosure vulnerability (high 7.5)
- [CVE-2023-27563](https://insights.sbomify.com/CVE-2023-27563/): n8n Privilege Escalation vulnerability (high 8.8)
- [CVE-2023-27562](https://insights.sbomify.com/CVE-2023-27562/): n8n Directory Traversal vulnerability (medium 6.5)
- [CVE-2023-27561](https://insights.sbomify.com/CVE-2023-27561/): Opencontainers runc Incorrect Authorization vulnerability (high 7.0)
- [CVE-2023-27560](https://insights.sbomify.com/CVE-2023-27560/): phpseclib Infinite Loop vulnerability (high 7.5)
- [CVE-2023-2756](https://insights.sbomify.com/CVE-2023-2756/): SQL Injection in pimcore/customer-data-framework (medium 6.5)
- [CVE-2023-27559](https://insights.sbomify.com/CVE-2023-27559/): IBM Db2 denial of service (medium 5.3)
- [CVE-2023-27558](https://insights.sbomify.com/CVE-2023-27558/): IBM Db2 privilege escalation (high 8.4)
- [CVE-2023-27557](https://insights.sbomify.com/CVE-2023-27557/): IBM Safter Payments information disclosure (medium 5.9)
- [CVE-2023-27556](https://insights.sbomify.com/CVE-2023-27556/): IBM Safer Payments denial of service (medium 6.5)
- [CVE-2023-27555](https://insights.sbomify.com/CVE-2023-27555/): IBM Db2 denial of service (medium 5.1)
- [CVE-2023-27554](https://insights.sbomify.com/CVE-2023-27554/): IBM WebSphere Application Server XML external entity injection (medium 6.3)
- [CVE-2023-27545](https://insights.sbomify.com/CVE-2023-27545/): IBM Watson CloudPak for Data Data Stores information disclosure (medium 4.0)
- [CVE-2023-27540](https://insights.sbomify.com/CVE-2023-27540/): IBM Watson CP4D Data Stores denial of service (medium 5.9)
- [CVE-2023-2754](https://insights.sbomify.com/CVE-2023-2754/): Plaintext transmission of DNS requests in Windows 1.1.1.1 WARP client (high 7.4)
- [CVE-2023-27539](https://insights.sbomify.com/CVE-2023-27539/): Possible Denial of Service Vulnerability in Rack's header parsing (medium 5.3)
- [CVE-2023-27538](https://insights.sbomify.com/CVE-2023-27538/): Auth bypass in https://github.com/curl/curl (high 7.7)
- [CVE-2023-27537](https://insights.sbomify.com/CVE-2023-27537/): Memory corruption in https://github.com/curl/curl (medium 5.9)
- [CVE-2023-27536](https://insights.sbomify.com/CVE-2023-27536/): Auth bypass in https://github.com/curl/curl (medium 5.9)
- [CVE-2023-27535](https://insights.sbomify.com/CVE-2023-27535/): Auth bypass in https://github.com/curl/curl (medium 5.9)
- [CVE-2023-27534](https://insights.sbomify.com/CVE-2023-27534/): Path traversal in https://github.com/curl/curl (high 8.8)
- [CVE-2023-27533](https://insights.sbomify.com/CVE-2023-27533/): Command injection in https://github.com/curl/curl (critical 9.8)
- [CVE-2023-27532](https://insights.sbomify.com/CVE-2023-27532/): Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function (high 7.5, exploited in the wild)
- [CVE-2023-27531](https://insights.sbomify.com/CVE-2023-27531/): Kredis JSON Possible Deserialization of Untrusted Data Vulnerability (medium 5.3)
- [CVE-2023-27530](https://insights.sbomify.com/CVE-2023-27530/): Rack has possible DoS Vulnerability in Multipart MIME parsing (high 7.5)
- [CVE-2023-2753](https://insights.sbomify.com/CVE-2023-2753/): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (high 7.2)
- [CVE-2023-27529](https://insights.sbomify.com/CVE-2023-27529/): Privilege escalation in Wacom Tablet Driver installer (high 7.8)
- [CVE-2023-27527](https://insights.sbomify.com/CVE-2023-27527/): XML external entity in Shinseiyo Sogo Soft (low 2.5)
- [CVE-2023-27526](https://insights.sbomify.com/CVE-2023-27526/): Apache Superset: Improper Authorization check on import charts (medium 4.3)
- [CVE-2023-27525](https://insights.sbomify.com/CVE-2023-27525/): Apache Superset: Incorrect default permissions for Gamma role (low 3.1)
- [CVE-2023-27524](https://insights.sbomify.com/CVE-2023-27524/): Apache Superset Insecure Default Initialization of Resource (high 8.9, exploited in the wild)
- [CVE-2023-27523](https://insights.sbomify.com/CVE-2023-27523/): Apache Superset: Improper data permission validation on Jinja templated queries (medium 5.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/348/