# Vulnerabilities published in 2023


- [CVE-2023-27424](https://insights.sbomify.com/CVE-2023-27424/): WordPress Inactive User Deleter Plugin <= 1.59 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-27423](https://insights.sbomify.com/CVE-2023-27423/): WordPress Auto Prune Posts Plugin <= 1.8.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-27422](https://insights.sbomify.com/CVE-2023-27422/): WordPress NS Coupon to Become Customer Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-27421](https://insights.sbomify.com/CVE-2023-27421/): WordPress Everest News Theme <= 1.1.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-27420](https://insights.sbomify.com/CVE-2023-27420/): WordPress Arya Multipurpose Theme <= 1.0.5 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-2742](https://insights.sbomify.com/CVE-2023-2742/): AI ChatBot < 4.5.5 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2023-27419](https://insights.sbomify.com/CVE-2023-27419/): WordPress Viable blog Theme <= 1.1.4 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-27418](https://insights.sbomify.com/CVE-2023-27418/): WordPress Side Menu Lite Plugin <= 4.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-27417](https://insights.sbomify.com/CVE-2023-27417/): WordPress Affiliate Super Assistent Plugin <= 1.5.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-27416](https://insights.sbomify.com/CVE-2023-27416/): WordPress Decon WP SMS Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-27415](https://insights.sbomify.com/CVE-2023-27415/): WordPress LetterPress Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-27414](https://insights.sbomify.com/CVE-2023-27414/): WordPress Popup box Plugin <= 3.4.4 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-27413](https://insights.sbomify.com/CVE-2023-27413/): WordPress W4 Post List Plugin <= 2.4.4 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-27412](https://insights.sbomify.com/CVE-2023-27412/): WordPress Mocho Blog Theme <= 1.0.4 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-27411](https://insights.sbomify.com/CVE-2023-27411/): SQL injection in RUGGEDCOM CROSSBOW (high 8.8)
- [CVE-2023-27410](https://insights.sbomify.com/CVE-2023-27410/): Memory corruption in SCALANCE LPE9403 (low 2.7)
- [CVE-2023-27409](https://insights.sbomify.com/CVE-2023-27409/): Path traversal in SCALANCE LPE9403 (low 2.5)
- [CVE-2023-27408](https://insights.sbomify.com/CVE-2023-27408/): Misconfiguration in SCALANCE LPE9403 (low 3.3)
- [CVE-2023-27407](https://insights.sbomify.com/CVE-2023-27407/): Command injection in SCALANCE LPE9403 (critical 9.9)
- [CVE-2023-27406](https://insights.sbomify.com/CVE-2023-27406/): Memory corruption in Tecnomatix Plant Simulation (high 7.8)
- [CVE-2023-27405](https://insights.sbomify.com/CVE-2023-27405/): Memory corruption in Tecnomatix Plant Simulation (high 7.8)
- [CVE-2023-27404](https://insights.sbomify.com/CVE-2023-27404/): Memory corruption in Tecnomatix Plant Simulation (high 7.8)
- [CVE-2023-27403](https://insights.sbomify.com/CVE-2023-27403/): Memory corruption in Tecnomatix Plant Simulation (high 7.8)
- [CVE-2023-27402](https://insights.sbomify.com/CVE-2023-27402/): Memory corruption in Tecnomatix Plant Simulation (high 7.8)
- [CVE-2023-27401](https://insights.sbomify.com/CVE-2023-27401/): Memory corruption in Tecnomatix Plant Simulation (high 7.8)
- [CVE-2023-27400](https://insights.sbomify.com/CVE-2023-27400/): Memory corruption in Tecnomatix Plant Simulation (high 7.8)
- [CVE-2023-2740](https://insights.sbomify.com/CVE-2023-2740/): SourceCodester Guest Management System GET Parameter dateTest.php cross site scripting (low 3.5)
- [CVE-2023-27399](https://insights.sbomify.com/CVE-2023-27399/): Memory corruption in Tecnomatix Plant Simulation (high 7.8)
- [CVE-2023-27398](https://insights.sbomify.com/CVE-2023-27398/): Memory corruption in Tecnomatix Plant Simulation (high 7.8)
- [CVE-2023-27397](https://insights.sbomify.com/CVE-2023-27397/): File upload in MicroEngine Mailform (critical 9.8)
- [CVE-2023-27396](https://insights.sbomify.com/CVE-2023-27396/): Auth bypass in Multiple OMRON products which implement FINS protocol (critical 9.8)
- [CVE-2023-27395](https://insights.sbomify.com/CVE-2023-27395/): Memory corruption in SoftEther VPN (critical 9.0)
- [CVE-2023-27394](https://insights.sbomify.com/CVE-2023-27394/): CVE-2023-27394 (critical 9.8)
- [CVE-2023-27392](https://insights.sbomify.com/CVE-2023-27392/): Misconfiguration in Intel(R) Support android application (medium 4.4)
- [CVE-2023-27391](https://insights.sbomify.com/CVE-2023-27391/): Privilege escalation in Intel(R) oneAPI Toolkit and component software installers (medium 6.7)
- [CVE-2023-27390](https://insights.sbomify.com/CVE-2023-27390/): Memory corruption in Diagon (high 7.8)
- [CVE-2023-2739](https://insights.sbomify.com/CVE-2023-2739/): Gira HomeServer hslist cross site scripting (medium 4.3)
- [CVE-2023-27389](https://insights.sbomify.com/CVE-2023-27389/): Weak cryptography in CONPROSYS IoT Gateway products (high 7.2)
- [CVE-2023-27388](https://insights.sbomify.com/CVE-2023-27388/): Auth bypass in T&D Corporation and ESPEC MIC CORP. data logger products (critical 9.8)
- [CVE-2023-27387](https://insights.sbomify.com/CVE-2023-27387/): Cross-site request forgery in T&D Corporation and ESPEC MIC CORP. data logger products (high 8.8)
- [CVE-2023-27386](https://insights.sbomify.com/CVE-2023-27386/): Privilege escalation in Intel(R) Pathfinder for RISC-V software (medium 6.7)
- [CVE-2023-27385](https://insights.sbomify.com/CVE-2023-27385/): Memory corruption in CX-Drive All models (high 7.8)
- [CVE-2023-27384](https://insights.sbomify.com/CVE-2023-27384/): Missing authorization in Cybozu Garoon (medium 4.3)
- [CVE-2023-27383](https://insights.sbomify.com/CVE-2023-27383/): Security feature bypass in Intel(R) oneAPI HPC Toolkit 2023.1 and Intel(R)MPI Library software (medium 6.8)
- [CVE-2023-27382](https://insights.sbomify.com/CVE-2023-27382/): Misconfiguration in Intel(R) NUC P14E Laptop Element software for Windows 10 (medium 6.7)
- [CVE-2023-27380](https://insights.sbomify.com/CVE-2023-27380/): Command injection in Surf SOHO HW1 (high 7.2)
- [CVE-2023-2738](https://insights.sbomify.com/CVE-2023-2738/): Tongda OA GatewayController.php actionGetdata unrestricted upload (medium 6.3)
- [CVE-2023-27379](https://insights.sbomify.com/CVE-2023-27379/): Use after free in Foxit Reader (high 8.8)
- [CVE-2023-27378](https://insights.sbomify.com/CVE-2023-27378/): BIG-IP TMUI XSS vulnerability (high 7.5)
- [CVE-2023-27377](https://insights.sbomify.com/CVE-2023-27377/): Missing Authentication In IDAttend’s IDWeb Application (high 7.5)
- [CVE-2023-27376](https://insights.sbomify.com/CVE-2023-27376/): Missing Authentication In IDAttend’s IDWeb Application (high 7.5)
- [CVE-2023-27375](https://insights.sbomify.com/CVE-2023-27375/): Missing Authentication In IDAttend’s IDWeb Application (high 7.5)
- [CVE-2023-27373](https://insights.sbomify.com/CVE-2023-27373/): Other in insyde:insydeh2o (medium 5.5)
- [CVE-2023-27372](https://insights.sbomify.com/CVE-2023-27372/): Deserialization in debian:debian linux (critical 9.8)
- [CVE-2023-27371](https://insights.sbomify.com/CVE-2023-27371/): Memory corruption in gnu:libmicrohttpd (medium 5.9)
- [CVE-2023-27370](https://insights.sbomify.com/CVE-2023-27370/): NETGEAR RAX30 Device Configuration Cleartext Storage Information Disclosure Vulnerability (medium 5.7)
- [CVE-2023-2737](https://insights.sbomify.com/CVE-2023-2737/): Improper securing of log directory may allow a denial of service (medium 5.7)
- [CVE-2023-27369](https://insights.sbomify.com/CVE-2023-27369/): NETGEAR RAX30 soap_serverd Stack-based Buffer Overflow Authentication Bypass Vulnerability (high 8.8)
- [CVE-2023-27368](https://insights.sbomify.com/CVE-2023-27368/): NETGEAR RAX30 soap_serverd Stack-based Buffer Overflow Authentication Bypass Vulnerability (high 8.8)
- [CVE-2023-27367](https://insights.sbomify.com/CVE-2023-27367/): NETGEAR RAX30 libcms_cli Command Injection Remote Code Execution Vulnerability (high 8.0)
- [CVE-2023-27366](https://insights.sbomify.com/CVE-2023-27366/): Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-27365](https://insights.sbomify.com/CVE-2023-27365/): Foxit PDF Editor DOC File Parsing Exposed Dangerous Method Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-27364](https://insights.sbomify.com/CVE-2023-27364/): Foxit PDF Editor XLS File Parsing Exposed Dangerous Method Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-27363](https://insights.sbomify.com/CVE-2023-27363/): Foxit PDF Reader exportXFAData Exposed Dangerous Method Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-27362](https://insights.sbomify.com/CVE-2023-27362/): 3CX Uncontrolled Search Path Local Privilege Escalation Vulnerability (high 7.0)
- [CVE-2023-27361](https://insights.sbomify.com/CVE-2023-27361/): NETGEAR RAX30 rex_cgi JSON Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2023-27360](https://insights.sbomify.com/CVE-2023-27360/): NETGEAR RAX30 lighttpd Misconfiguration Remote Code Execution Vulnerability (high 7.5)
- [CVE-2023-2736](https://insights.sbomify.com/CVE-2023-2736/): Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Privilege Escalation (high 7.5)
- [CVE-2023-27359](https://insights.sbomify.com/CVE-2023-27359/): TP-Link AX1800 hotplugd Firewall Rule Race Condition Vulnerability (critical 9.8)
- [CVE-2023-27358](https://insights.sbomify.com/CVE-2023-27358/): NETGEAR RAX30 SOAP Request SQL Injection Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-27357](https://insights.sbomify.com/CVE-2023-27357/): NETGEAR RAX30 GetInfo Missing Authentication Information Disclosure Vulnerability (medium 6.5)
- [CVE-2023-27356](https://insights.sbomify.com/CVE-2023-27356/): NETGEAR RAX30 logCtrl Command Injection Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2023-27355](https://insights.sbomify.com/CVE-2023-27355/): Memory corruption in One Speaker (high 8.8)
- [CVE-2023-27354](https://insights.sbomify.com/CVE-2023-27354/): Integer overflow in One Speaker (medium 5.4)
- [CVE-2023-27353](https://insights.sbomify.com/CVE-2023-27353/): Memory corruption in One Speaker (medium 5.4)
- [CVE-2023-27352](https://insights.sbomify.com/CVE-2023-27352/): Use after free in One Speaker (high 8.8)
- [CVE-2023-27351](https://insights.sbomify.com/CVE-2023-27351/): PaperCut NG/MF Improper Authentication (high 8.2, exploited in the wild)
- [CVE-2023-27350](https://insights.sbomify.com/CVE-2023-27350/): PaperCut MF/NG Improper Access Control (critical 9.8, exploited in the wild)
- [CVE-2023-2735](https://insights.sbomify.com/CVE-2023-2735/): Groundhogg <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 4.9)
- [CVE-2023-27349](https://insights.sbomify.com/CVE-2023-27349/): BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability (high 7.1)
- [CVE-2023-27348](https://insights.sbomify.com/CVE-2023-27348/): PDF-XChange Editor TIF File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-27347](https://insights.sbomify.com/CVE-2023-27347/): G DATA Total Security Link Following Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2023-27346](https://insights.sbomify.com/CVE-2023-27346/): TP-Link AX1800 Firmware Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-27345](https://insights.sbomify.com/CVE-2023-27345/): PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-27344](https://insights.sbomify.com/CVE-2023-27344/): PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-27343](https://insights.sbomify.com/CVE-2023-27343/): PDF-XChange Editor EMF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-27342](https://insights.sbomify.com/CVE-2023-27342/): PDF-XChange Editor EMF File Parsing Untrusted Pointer Dereference Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-27341](https://insights.sbomify.com/CVE-2023-27341/): PDF-XChange Editor TIF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-27340](https://insights.sbomify.com/CVE-2023-27340/): PDF-XChange Editor PNG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-2734](https://insights.sbomify.com/CVE-2023-2734/): MStore API <= 3.9.1 - Authentication Bypass (critical 9.8)
- [CVE-2023-27339](https://insights.sbomify.com/CVE-2023-27339/): PDF-XChange Editor PNG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-27338](https://insights.sbomify.com/CVE-2023-27338/): PDF-XChange Editor TIF File Parsing Use-After-Free Information Disclosure Vulnerability (low 3.3)
- [CVE-2023-27337](https://insights.sbomify.com/CVE-2023-27337/): PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-27336](https://insights.sbomify.com/CVE-2023-27336/): Softing edgeConnector Siemens OPC UA Server Null Pointer Dereference Denial-of-Service Vulnerability (high 7.5)
- [CVE-2023-27335](https://insights.sbomify.com/CVE-2023-27335/): Softing edgeAggregator Client Cross-Site Scripting Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-27334](https://insights.sbomify.com/CVE-2023-27334/): Softing edgeConnector Siemens ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability (high 7.5)
- [CVE-2023-27333](https://insights.sbomify.com/CVE-2023-27333/): TP-Link Archer AX21 tmpServer Command 0x422 Stack-based Buffer Overflow Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2023-27332](https://insights.sbomify.com/CVE-2023-27332/): TP-Link Archer AX21 tdpServer Logging Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-27331](https://insights.sbomify.com/CVE-2023-27331/): Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-27330](https://insights.sbomify.com/CVE-2023-27330/): Foxit PDF Reader XFA Annotation Use-After-Free Remote Code Execution Vulnerability (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/350/