# Vulnerabilities published in 2023


- [CVE-2023-26604](https://insights.sbomify.com/CVE-2023-26604/): Privilege escalation in debian:debian linux (high 7.8)
- [CVE-2023-26603](https://insights.sbomify.com/CVE-2023-26603/): JumpCloud Agent before 1.178.0 Creates a Temporary File in a Directory with Insecure Permissions. (medium 5.9)
- [CVE-2023-26602](https://insights.sbomify.com/CVE-2023-26602/): Command injection in asus:asmb8-ikvm firmware (critical 9.8)
- [CVE-2023-26601](https://insights.sbomify.com/CVE-2023-26601/): Denial of service in zohocorp:manageengine assetexplorer (high 7.5)
- [CVE-2023-26600](https://insights.sbomify.com/CVE-2023-26600/): Privilege escalation in zohocorp:manageengine assetexplorer (medium 6.5)
- [CVE-2023-2660](https://insights.sbomify.com/CVE-2023-2660/): SourceCodester Online Computer and Laptop Store view_categories.php sql injection (medium 6.3)
- [CVE-2023-26599](https://insights.sbomify.com/CVE-2023-26599/): Cross-site scripting in uniguest:tripleplay (medium 6.1)
- [CVE-2023-26597](https://insights.sbomify.com/CVE-2023-26597/): Controller DOS on sending error response (high 7.5)
- [CVE-2023-26596](https://insights.sbomify.com/CVE-2023-26596/): Missing authorization in Intel(R) Thunderbolt(TM) DCH drivers for Windows (low 2.5)
- [CVE-2023-26595](https://insights.sbomify.com/CVE-2023-26595/): Denial of service in Cybozu Garoon (medium 5.5)
- [CVE-2023-26593](https://insights.sbomify.com/CVE-2023-26593/): Information disclosure in CENTUM series (high 7.8)
- [CVE-2023-26592](https://insights.sbomify.com/CVE-2023-26592/): Deserialization in Intel(R) Thunderbolt(TM) DCH drivers for Windows (low 3.8)
- [CVE-2023-26591](https://insights.sbomify.com/CVE-2023-26591/): Denial of service in Intel(R) Thunderbolt(TM) DCH drivers for Windows (low 2.0)
- [CVE-2023-26590](https://insights.sbomify.com/CVE-2023-26590/): Floating point exception in src/aiff.c (medium 6.2)
- [CVE-2023-2659](https://insights.sbomify.com/CVE-2023-2659/): SourceCodester Online Computer and Laptop Store view_product.php sql injection (medium 6.3)
- [CVE-2023-26589](https://insights.sbomify.com/CVE-2023-26589/): Use after free in Intel(R) Aptio* V UEFI Firmware Integrator Tools (medium 6.5)
- [CVE-2023-26588](https://insights.sbomify.com/CVE-2023-26588/): Hardcoded credentials in BS-GSL and BS-GS series (high 7.5)
- [CVE-2023-26587](https://insights.sbomify.com/CVE-2023-26587/): Privilege escalation in Intel(R) Easy Streaming Wizard software (high 7.8)
- [CVE-2023-26586](https://insights.sbomify.com/CVE-2023-26586/): Denial of service in Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software (medium 4.3)
- [CVE-2023-26585](https://insights.sbomify.com/CVE-2023-26585/): Missing authorization in Intel(R) Thunderbolt(TM) DCH drivers for Windows (medium 5.0)
- [CVE-2023-26584](https://insights.sbomify.com/CVE-2023-26584/): Unauthenticated SQL Injection In IDAttend’s IDWeb Application (critical 9.8)
- [CVE-2023-26583](https://insights.sbomify.com/CVE-2023-26583/): Unauthenticated SQL Injection In IDAttend’s IDWeb Application (critical 9.8)
- [CVE-2023-26582](https://insights.sbomify.com/CVE-2023-26582/): Unauthenticated SQL Injection In IDAttend’s IDWeb Application (critical 9.8)
- [CVE-2023-26581](https://insights.sbomify.com/CVE-2023-26581/): Unauthenticated SQL Injection In IDAttend’s IDWeb Application (critical 9.8)
- [CVE-2023-26580](https://insights.sbomify.com/CVE-2023-26580/): Missing Authentication In IDAttend’s IDWeb Application (high 7.5)
- [CVE-2023-2658](https://insights.sbomify.com/CVE-2023-2658/): SourceCodester Online Computer and Laptop Store products.php sql injection (medium 6.3)
- [CVE-2023-26579](https://insights.sbomify.com/CVE-2023-26579/): Missing Authentication In IDAttend’s IDWeb Application (medium 5.3)
- [CVE-2023-26578](https://insights.sbomify.com/CVE-2023-26578/): Arbitrary File Upload to Web Root In IDAttend’s IDWeb Application (high 8.8)
- [CVE-2023-26577](https://insights.sbomify.com/CVE-2023-26577/): Stored Cross-site Scripting In IDAttend’s IDWeb Application (high 7.5)
- [CVE-2023-26576](https://insights.sbomify.com/CVE-2023-26576/): Missing Authentication In IDAttend’s IDWeb Application (high 7.5)
- [CVE-2023-26575](https://insights.sbomify.com/CVE-2023-26575/): Missing Authentication In IDAttend’s IDWeb Application (high 7.5)
- [CVE-2023-26574](https://insights.sbomify.com/CVE-2023-26574/): Missing Authentication In IDAttend’s IDWeb Application (high 7.5)
- [CVE-2023-26573](https://insights.sbomify.com/CVE-2023-26573/): Missing Authentication In IDAttend’s IDWeb Application (high 8.2)
- [CVE-2023-26572](https://insights.sbomify.com/CVE-2023-26572/): Unauthenticated SQL Injection In IDAttend’s IDWeb Application (critical 9.8)
- [CVE-2023-26571](https://insights.sbomify.com/CVE-2023-26571/): Missing Authentication In IDAttend’s IDWeb Application (high 7.5)
- [CVE-2023-26570](https://insights.sbomify.com/CVE-2023-26570/): Missing Authentication In IDAttend’s IDWeb Application (high 7.5)
- [CVE-2023-2657](https://insights.sbomify.com/CVE-2023-2657/): SourceCodester Online Computer and Laptop Store products.php cross site scripting (low 3.5)
- [CVE-2023-26569](https://insights.sbomify.com/CVE-2023-26569/): Unauthenticated SQL Injection In IDAttend’s IDWeb Application (critical 9.8)
- [CVE-2023-26568](https://insights.sbomify.com/CVE-2023-26568/): Unauthenticated SQL Injection In IDAttend’s IDWeb Application (critical 9.8)
- [CVE-2023-26567](https://insights.sbomify.com/CVE-2023-26567/): Information disclosure in sangoma:freepbx linux 7 (high 8.1)
- [CVE-2023-26566](https://insights.sbomify.com/CVE-2023-26566/): Sangoma FreePBX 1805 through 2203 on Linux contains hardcoded credentials for the Asterisk REST Interface (ARI), which allows remote attacke (high 8.6)
- [CVE-2023-26564](https://insights.sbomify.com/CVE-2023-26564/): Path traversal in syncfusion:ej2 aspcore file provider (critical 9.8)
- [CVE-2023-26563](https://insights.sbomify.com/CVE-2023-26563/): Path traversal in syncfusion:nodejs file system provider (critical 9.8)
- [CVE-2023-26562](https://insights.sbomify.com/CVE-2023-26562/): Missing authorization in zimbra:collaboration (medium 6.5)
- [CVE-2023-26560](https://insights.sbomify.com/CVE-2023-26560/): Information disclosure in northern.tech:cfengine (medium 6.5)
- [CVE-2023-2656](https://insights.sbomify.com/CVE-2023-2656/): SourceCodester AC Repair and Services System sql injection (medium 6.3)
- [CVE-2023-26559](https://insights.sbomify.com/CVE-2023-26559/): Path traversal in sync:oxygen content fusion (medium 5.3)
- [CVE-2023-26557](https://insights.sbomify.com/CVE-2023-26557/): IO FinNet tss-lib vulnerable to timing attack from non-constant time scalar arithmetic (high 7.5)
- [CVE-2023-26556](https://insights.sbomify.com/CVE-2023-26556/): IO FinNet tss-lib vulnerable to timing attack from non-constant time scalar multiplication (critical 9.1)
- [CVE-2023-26555](https://insights.sbomify.com/CVE-2023-26555/): Memory corruption in ntp:ntp (medium 6.4)
- [CVE-2023-26554](https://insights.sbomify.com/CVE-2023-26554/): Memory corruption in ntp:ntp (medium 5.6)
- [CVE-2023-26553](https://insights.sbomify.com/CVE-2023-26553/): Memory corruption in ntp:ntp (medium 5.6)
- [CVE-2023-26552](https://insights.sbomify.com/CVE-2023-26552/): Memory corruption in ntp:ntp (medium 5.6)
- [CVE-2023-26551](https://insights.sbomify.com/CVE-2023-26551/): Memory corruption in ntp:ntp (medium 5.6)
- [CVE-2023-26550](https://insights.sbomify.com/CVE-2023-26550/): SQL injection in bmc:control-m (critical 9.8)
- [CVE-2023-2655](https://insights.sbomify.com/CVE-2023-2655/): Contact Form by WD <= 1.13.23 - Admin+ SQLi (high 7.2)
- [CVE-2023-26549](https://insights.sbomify.com/CVE-2023-26549/): Other in EMUI (high 7.5)
- [CVE-2023-26548](https://insights.sbomify.com/CVE-2023-26548/): Deserialization in EMUI (high 7.5)
- [CVE-2023-26547](https://insights.sbomify.com/CVE-2023-26547/): Deserialization in EMUI (high 7.8)
- [CVE-2023-26546](https://insights.sbomify.com/CVE-2023-26546/): Code injection in echa.europa:iuclid (high 8.8)
- [CVE-2023-26545](https://insights.sbomify.com/CVE-2023-26545/): Memory corruption in debian:debian linux (medium 4.7)
- [CVE-2023-26544](https://insights.sbomify.com/CVE-2023-26544/): Use after free in linux:linux kernel (high 7.8)
- [CVE-2023-26543](https://insights.sbomify.com/CVE-2023-26543/): WordPress WP Meteor Page Speed Optimization Topping Plugin <= 3.1.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-26542](https://insights.sbomify.com/CVE-2023-26542/): WordPress phpinfo() WP Plugin <= 4.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-26541](https://insights.sbomify.com/CVE-2023-26541/): WordPress asMember Plugin <= 1.5.4 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-26540](https://insights.sbomify.com/CVE-2023-26540/): WordPress Houzez theme <= 2.7.1 - Privilege Escalation (critical 9.8)
- [CVE-2023-2654](https://insights.sbomify.com/CVE-2023-2654/): Conditional Menus < 1.2.1 - Reflected XSS (medium 6.1)
- [CVE-2023-26539](https://insights.sbomify.com/CVE-2023-26539/): WordPress Advanced Text Widget Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-26538](https://insights.sbomify.com/CVE-2023-26538/): WordPress Chat Bee Plugin <= 1.1.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-26537](https://insights.sbomify.com/CVE-2023-26537/): WordPress WP No External Links Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-26536](https://insights.sbomify.com/CVE-2023-26536/): WordPress Sp*tify Play Button for WordPress Plugin <= 2.05 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-26535](https://insights.sbomify.com/CVE-2023-26535/): WordPress Sheets To WP Table Live Sync Plugin <= 2.12.15 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-26534](https://insights.sbomify.com/CVE-2023-26534/): WordPress WP Repost Plugin <= 0.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-26533](https://insights.sbomify.com/CVE-2023-26533/): WordPress Zippy Plugin <= 1.6.1 is vulnerable to Sensitive Data Exposure (medium 6.5)
- [CVE-2023-26532](https://insights.sbomify.com/CVE-2023-26532/): WordPress Social Auto Poster Plugin <= 2.1.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-26531](https://insights.sbomify.com/CVE-2023-26531/): Cross-site request forgery in 多合一搜索自动推送管理插件-支持Baidu/Google/Bing/IndexNow/Yandex/头条 (medium 5.4)
- [CVE-2023-26530](https://insights.sbomify.com/CVE-2023-26530/): WordPress Updraft Plugin <= 0.6.1 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-2653](https://insights.sbomify.com/CVE-2023-2653/): SourceCodester Lost and Found Information System index.php sql injection (medium 6.3)
- [CVE-2023-26529](https://insights.sbomify.com/CVE-2023-26529/): WordPress DupeOff Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-26528](https://insights.sbomify.com/CVE-2023-26528/): WordPress Shipyaari Shipping Management Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-26527](https://insights.sbomify.com/CVE-2023-26527/): WordPress Debug Assistant Plugin <= 1.4 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-26526](https://insights.sbomify.com/CVE-2023-26526/): WordPress Bookly plugin <= 21.7.1 - Authenticated Arbitrary File Deletion vulnerability (high 7.7)
- [CVE-2023-26525](https://insights.sbomify.com/CVE-2023-26525/): WordPress Dokan Plugin <= 3.7.12 is vulnerable to SQL Injection (high 7.1)
- [CVE-2023-26524](https://insights.sbomify.com/CVE-2023-26524/): WordPress Quiz And Survey Master Plugin <= 8.0.10 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-26523](https://insights.sbomify.com/CVE-2023-26523/): WordPress Calculated Fields Form plugin <= 1.1.120 - Missing Authorization Leading To Feedback Submission Vulnerability (medium 4.3)
- [CVE-2023-26522](https://insights.sbomify.com/CVE-2023-26522/): WordPress WP Repost plugin <= 0.1 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-26521](https://insights.sbomify.com/CVE-2023-26521/): WordPress Search in Place plugin <= 1.0.104 - Missing Authorization Leading To Feedback Submission vulnerability (medium 4.3)
- [CVE-2023-26520](https://insights.sbomify.com/CVE-2023-26520/): WordPress Advanced Text Widget plugin <= 2.1.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-2652](https://insights.sbomify.com/CVE-2023-2652/): SourceCodester Lost and Found Information System sql injection (medium 6.3)
- [CVE-2023-26519](https://insights.sbomify.com/CVE-2023-26519/): WordPress Publish to Schedule Plugin <= 4.5.4 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-26518](https://insights.sbomify.com/CVE-2023-26518/): WordPress WP TFeed Plugin <= 1.6.9 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-26517](https://insights.sbomify.com/CVE-2023-26517/): WordPress Dashboard Widgets Suite Plugin <= 3.2.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-26516](https://insights.sbomify.com/CVE-2023-26516/): WordPress Debug Assistant Plugin <= 1.4 is vulnerable to Cross Site Request Forgery (CSRF) (high 8.8)
- [CVE-2023-26515](https://insights.sbomify.com/CVE-2023-26515/): WordPress Simple Slug Translate Plugin <= 2.7.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-26514](https://insights.sbomify.com/CVE-2023-26514/): WordPress XML Sitemap Generator for Google Plugin <= 1.3.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-26513](https://insights.sbomify.com/CVE-2023-26513/): Apache Sling Resource Merger: Requests to certain paths managed by the Apache Sling Resource Merger can lead to DoS (high 7.5)
- [CVE-2023-26512](https://insights.sbomify.com/CVE-2023-26512/): Apache EventMesh RabbitMQ-Connector plugin allows RCE through deserialization of untrusted data (critical 9.8)
- [CVE-2023-26511](https://insights.sbomify.com/CVE-2023-26511/): Hardcoded credentials in propius:machineselector (critical 9.8)
- [CVE-2023-26510](https://insights.sbomify.com/CVE-2023-26510/): Missing authorization in ghost:ghost (medium 5.7)
- [CVE-2023-26509](https://insights.sbomify.com/CVE-2023-26509/): Denial of service in anydesk:anydesk (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/355/