# Vulnerabilities published in 2023


- [CVE-2023-25841](https://insights.sbomify.com/CVE-2023-25841/): BUG-000158075 Stored XSS issue in ArcGIS Server (medium 6.1)
- [CVE-2023-25840](https://insights.sbomify.com/CVE-2023-25840/): BUG-000154070 Stored XSS issue in the ArcGIS REST Services directory (low 3.4)
- [CVE-2023-2584](https://insights.sbomify.com/CVE-2023-2584/): PixelYourSite <= 9.3.6 and PixelYourSite Pro <= 9.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2023-25839](https://insights.sbomify.com/CVE-2023-25839/): BUG-000157278 – ArcGIS Insights has a security vulnerability - desktop (high 7.0)
- [CVE-2023-25838](https://insights.sbomify.com/CVE-2023-25838/): BUG-000157278 – ArcGIS Insights has a security vulnerability. (high 7.5)
- [CVE-2023-25837](https://insights.sbomify.com/CVE-2023-25837/): BUG-000133088 - ArcGIS Enterprise site builder is subject to stored XSS. (high 8.4)
- [CVE-2023-25836](https://insights.sbomify.com/CVE-2023-25836/): BUG-000135364 XSS in 10.8.1 sites builder iframe source (medium 5.4)
- [CVE-2023-25835](https://insights.sbomify.com/CVE-2023-25835/): BUG-000153659 ArcGIS Enterprise Sites has a stored XSS vulnerability (high 8.4)
- [CVE-2023-25834](https://insights.sbomify.com/CVE-2023-25834/): BUG-000142922 Incomplete permission changes in specific cases. (medium 5.4)
- [CVE-2023-25833](https://insights.sbomify.com/CVE-2023-25833/): BUG-000155004 HTML injection issue in Portal for ArcGIS. (medium 5.4)
- [CVE-2023-25832](https://insights.sbomify.com/CVE-2023-25832/): BUG-000148346 There is a Cross-Site Request Forgery (CSRF) vulnerability in Portal for ArcGIS. (high 8.8)
- [CVE-2023-25831](https://insights.sbomify.com/CVE-2023-25831/): BUG-000154236 There is a reflected cross-site scripting (XSS) vulnerability in Portal for ArcGIS. (medium 6.1)
- [CVE-2023-25830](https://insights.sbomify.com/CVE-2023-25830/): BUG-000154662 Reflected XSS vulnerability in Portal for ArcGIS (medium 6.1)
- [CVE-2023-2583](https://insights.sbomify.com/CVE-2023-2583/): Code Injection in jsreport/jsreport (critical 10.0)
- [CVE-2023-25829](https://insights.sbomify.com/CVE-2023-25829/): BUG-000155001 - Unvalidated redirect in Portal for ArcGIS. (medium 6.1)
- [CVE-2023-25828](https://insights.sbomify.com/CVE-2023-25828/): Authenticate Remote Code Execution in Pluck CMS (high 7.2)
- [CVE-2023-25827](https://insights.sbomify.com/CVE-2023-25827/): Cross-site Scripting in OpenTSDB (high 8.2)
- [CVE-2023-25826](https://insights.sbomify.com/CVE-2023-25826/): Remote Code Execution in OpenTSDB (critical 9.8)
- [CVE-2023-25825](https://insights.sbomify.com/CVE-2023-25825/): ZoneMinder contains Cross-site Scripting via log viewing (high 7.7)
- [CVE-2023-25824](https://insights.sbomify.com/CVE-2023-25824/): mod_gnutls contains Infinite Loop on request read timeout (high 7.5)
- [CVE-2023-25823](https://insights.sbomify.com/CVE-2023-25823/): Gradio contains Use of Hard-coded Credentials (medium 5.4)
- [CVE-2023-25822](https://insights.sbomify.com/CVE-2023-25822/): ReportPortal DoS vulnerability on creating a Launch with too many recursively nested elements (medium 6.3)
- [CVE-2023-25821](https://insights.sbomify.com/CVE-2023-25821/): Nextcloud download permissions can be changed by resharer (medium 5.7)
- [CVE-2023-25820](https://insights.sbomify.com/CVE-2023-25820/): Nextcloud Server and Enterprise Server missing brute force protection on password confirmation modal (medium 4.2)
- [CVE-2023-2582](https://insights.sbomify.com/CVE-2023-2582/): Cross-site scripting in Strikingly (medium 6.1)
- [CVE-2023-25819](https://insights.sbomify.com/CVE-2023-25819/): Discourse tags with no visibility are leaking into og:article:tag (medium 5.3)
- [CVE-2023-25818](https://insights.sbomify.com/CVE-2023-25818/): Missing brute force protection on password reset token in Nextcloud Server (medium 5.3)
- [CVE-2023-25817](https://insights.sbomify.com/CVE-2023-25817/): Delete permissions are not saved when creating public share in Nextcloud server (low 3.5)
- [CVE-2023-25816](https://insights.sbomify.com/CVE-2023-25816/): nextcloud vulnerable to Uncontrolled Resource Consumption (medium 4.3)
- [CVE-2023-25815](https://insights.sbomify.com/CVE-2023-25815/): Git looks for localized messages in the wrong place (low 3.3)
- [CVE-2023-25814](https://insights.sbomify.com/CVE-2023-25814/): Arbitrary File Read Vulnerability in metersphere (high 7.1)
- [CVE-2023-25813](https://insights.sbomify.com/CVE-2023-25813/): SQL Injection via replacements in sequelize (critical 10.0)
- [CVE-2023-25812](https://insights.sbomify.com/CVE-2023-25812/): Allowed DELETE on resources on object locked buckets under Governance mode in Minio (medium 6.5)
- [CVE-2023-25811](https://insights.sbomify.com/CVE-2023-25811/): Persistent Cross site scripting (XSS) in Uptime Kuma (medium 6.3)
- [CVE-2023-25810](https://insights.sbomify.com/CVE-2023-25810/): Persistent Cross site scripting (XSS) through description in status page in Uptime Kuma (medium 6.3)
- [CVE-2023-25809](https://insights.sbomify.com/CVE-2023-25809/): rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc (medium 5.0)
- [CVE-2023-25807](https://insights.sbomify.com/CVE-2023-25807/): DataEase dashboard has a stored XSS vulnerability (high 7.2)
- [CVE-2023-25806](https://insights.sbomify.com/CVE-2023-25806/): Time discrepancy in authentication responses in OpenSearch (medium 5.3)
- [CVE-2023-25805](https://insights.sbomify.com/CVE-2023-25805/): versionn Command Injection Vulnerability (critical 9.8)
- [CVE-2023-25804](https://insights.sbomify.com/CVE-2023-25804/): Roxy-WI vulnerable to Limited Path Traversal in name parameter (high 7.5)
- [CVE-2023-25803](https://insights.sbomify.com/CVE-2023-25803/): Path traversal in roxy-wi (high 7.5)
- [CVE-2023-25802](https://insights.sbomify.com/CVE-2023-25802/): Roxy-WI has Path Traversal vulnerability (high 7.5)
- [CVE-2023-25801](https://insights.sbomify.com/CVE-2023-25801/): TensorFlow has double free in Fractional(Max/Avg)Pool (high 8.0)
- [CVE-2023-25800](https://insights.sbomify.com/CVE-2023-25800/): WordPress Tutor LMS Plugin <= 2.2.0 is vulnerable to SQL Injection (high 8.1)
- [CVE-2023-2580](https://insights.sbomify.com/CVE-2023-2580/): AI-Engine < 1.6.83 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-25799](https://insights.sbomify.com/CVE-2023-25799/): WordPress Tutor LMS plugin <= 2.1.8 - Multiple Broken Access Control vulnerabilities (high 8.3)
- [CVE-2023-25798](https://insights.sbomify.com/CVE-2023-25798/): WordPress Olevmedia Shortcodes Plugin <= 1.1.9 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-25797](https://insights.sbomify.com/CVE-2023-25797/): WordPress vSlider Multi Image Slider for WordPress Plugin <= 4.1.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25796](https://insights.sbomify.com/CVE-2023-25796/): WordPress WP BaiDu Submit Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25795](https://insights.sbomify.com/CVE-2023-25795/): WordPress Feed Changer Plugin <= 0.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25794](https://insights.sbomify.com/CVE-2023-25794/): WordPress Nooz Plugin <= 1.6.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25793](https://insights.sbomify.com/CVE-2023-25793/): WordPress Link Juice Keeper Plugin <= 2.0.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25792](https://insights.sbomify.com/CVE-2023-25792/): WordPress WP Open Social Plugin <= 5.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25791](https://insights.sbomify.com/CVE-2023-25791/): WordPress Fontiran plugin <= 2.1 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-25790](https://insights.sbomify.com/CVE-2023-25790/): WordPress WoodMart theme <= 7.0.4 - Unauth Arbitrary Shortcodes Injection (medium 5.3)
- [CVE-2023-2579](https://insights.sbomify.com/CVE-2023-2579/): InventoryPress <= 1.7 - Author+ Stored XSS (medium 5.4)
- [CVE-2023-25789](https://insights.sbomify.com/CVE-2023-25789/): WordPress Tapfiliate Plugin <= 3.0.12 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25788](https://insights.sbomify.com/CVE-2023-25788/): WordPress Saphali Woocommerce Lite Plugin <= 1.8.13 is vulnerable to Cross Site Request Forgery (CSRF) (medium 6.3)
- [CVE-2023-25787](https://insights.sbomify.com/CVE-2023-25787/): WordPress WP资源下载管理 Plugin <= 1.3.9 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25786](https://insights.sbomify.com/CVE-2023-25786/): WordPress Eyes Only: User Access Shortcode Plugin <= 1.8.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25785](https://insights.sbomify.com/CVE-2023-25785/): WordPress WP Post Rating plugin <= 2.5 - Vote Manipulation Vulnerability (medium 5.3)
- [CVE-2023-25784](https://insights.sbomify.com/CVE-2023-25784/): WordPress Sticky Ad Bar Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25783](https://insights.sbomify.com/CVE-2023-25783/): WordPress FireCask Like & Share Button Plugin <= 1.1.5 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25782](https://insights.sbomify.com/CVE-2023-25782/): WordPress Service Area Postcode Checker Plugin <= 2.0.8 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25781](https://insights.sbomify.com/CVE-2023-25781/): WordPress Upload File Type Settings Plugin Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25780](https://insights.sbomify.com/CVE-2023-25780/): Status Internet Co.,Ltd. PowerBPM - Broken Access Control (medium 5.7)
- [CVE-2023-2578](https://insights.sbomify.com/CVE-2023-2578/): Buy Me a Coffee < 3.7 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-25779](https://insights.sbomify.com/CVE-2023-25779/): Privilege escalation in Intel(R) Thunderbolt(TM) DCH drivers for Windows (medium 6.7)
- [CVE-2023-25777](https://insights.sbomify.com/CVE-2023-25777/): Privilege escalation in Intel(R) Thunderbolt(TM) DCH drivers for Windows (high 7.9)
- [CVE-2023-25776](https://insights.sbomify.com/CVE-2023-25776/): Information disclosure in Intel(R) Server Board BMC firmware (medium 6.3)
- [CVE-2023-25775](https://insights.sbomify.com/CVE-2023-25775/): Missing authorization in Intel(R) Ethernet Controller RDMA driver for linux (medium 5.6)
- [CVE-2023-25774](https://insights.sbomify.com/CVE-2023-25774/): Denial of service in SoftEther VPN (high 7.5)
- [CVE-2023-25773](https://insights.sbomify.com/CVE-2023-25773/): Privilege escalation in Intel(R) Unite(R) Hub software installer for Windows (high 7.5)
- [CVE-2023-25772](https://insights.sbomify.com/CVE-2023-25772/): Denial of service in Intel(R) Retail Edge Mobile Android application (medium 5.0)
- [CVE-2023-25771](https://insights.sbomify.com/CVE-2023-25771/): Missing authorization in Intel(R) NUC BIOS firmware (medium 5.8)
- [CVE-2023-25770](https://insights.sbomify.com/CVE-2023-25770/): Controller stack overflow on decoding messages from the server (critical 9.8)
- [CVE-2023-25769](https://insights.sbomify.com/CVE-2023-25769/): Denial of service in Intel(R) Thunderbolt(TM) DCH drivers for Windows (medium 5.5)
- [CVE-2023-25768](https://insights.sbomify.com/CVE-2023-25768/): Missing Authorization in Jenkins Azure Credentials Plugin (medium 6.5)
- [CVE-2023-25767](https://insights.sbomify.com/CVE-2023-25767/): Cross-Site Request Forgery in Jenkins Azure Credentials Plugin (high 8.8)
- [CVE-2023-25766](https://insights.sbomify.com/CVE-2023-25766/): Missing Authorization in Jenkins Azure Credentials Plugin (medium 4.3)
- [CVE-2023-25765](https://insights.sbomify.com/CVE-2023-25765/): Sandbox escape in Jenkins Email Extension Plugin (critical 9.9)
- [CVE-2023-25764](https://insights.sbomify.com/CVE-2023-25764/): Cross-site Scripting in Jenkins Email Extension Plugin (medium 5.4)
- [CVE-2023-25763](https://insights.sbomify.com/CVE-2023-25763/): Cross-site Scripting in Jenkins Email Extension Plugin (medium 5.4)
- [CVE-2023-25762](https://insights.sbomify.com/CVE-2023-25762/): Cross-site Scripting in Jenkins Pipeline: Build Step Plugin (medium 5.4)
- [CVE-2023-25761](https://insights.sbomify.com/CVE-2023-25761/): Cross-site Scripting in Jenkins JUnit Plugin (medium 5.4)
- [CVE-2023-25760](https://insights.sbomify.com/CVE-2023-25760/): Missing authorization in uniguest:tripleplay (high 8.8)
- [CVE-2023-2576](https://insights.sbomify.com/CVE-2023-2576/): Incorrect Authorization in GitLab (medium 4.3)
- [CVE-2023-25759](https://insights.sbomify.com/CVE-2023-25759/): Command injection in uniguest:tripleplay (medium 5.3)
- [CVE-2023-25758](https://insights.sbomify.com/CVE-2023-25758/): Weak cryptography in onekey:onekey mini firmware (medium 4.2)
- [CVE-2023-25757](https://insights.sbomify.com/CVE-2023-25757/): Privilege escalation in Intel(R) Unison(TM) software (high 7.3)
- [CVE-2023-25756](https://insights.sbomify.com/CVE-2023-25756/): Memory corruption in Intel(R) Processors (medium 4.6)
- [CVE-2023-25755](https://insights.sbomify.com/CVE-2023-25755/): Memory corruption in Screen Creator Advance 2 (high 7.8)
- [CVE-2023-25754](https://insights.sbomify.com/CVE-2023-25754/): Apache Airflow: Privilege escalation using airflow logs (critical 9.8)
- [CVE-2023-25753](https://insights.sbomify.com/CVE-2023-25753/): Server-Side Request Forgery in Apache ShenYu (medium 6.5)
- [CVE-2023-25752](https://insights.sbomify.com/CVE-2023-25752/): Memory corruption in Firefox (medium 6.5)
- [CVE-2023-25751](https://insights.sbomify.com/CVE-2023-25751/): Memory corruption in Firefox (medium 6.5)
- [CVE-2023-25750](https://insights.sbomify.com/CVE-2023-25750/): Information disclosure in Firefox (medium 4.3)
- [CVE-2023-2575](https://insights.sbomify.com/CVE-2023-2575/): Authenticated Buffer Overflow (high 8.8)
- [CVE-2023-25749](https://insights.sbomify.com/CVE-2023-25749/): Security feature bypass in Firefox (medium 4.3)
- [CVE-2023-25748](https://insights.sbomify.com/CVE-2023-25748/): Other in Firefox (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/362/