# Vulnerabilities published in 2023


- [CVE-2023-25747](https://insights.sbomify.com/CVE-2023-25747/): Use after free in Firefox for Android (high 7.5)
- [CVE-2023-25746](https://insights.sbomify.com/CVE-2023-25746/): Memory corruption in Firefox ESR (high 8.8)
- [CVE-2023-25745](https://insights.sbomify.com/CVE-2023-25745/): Memory corruption in Firefox (high 8.8)
- [CVE-2023-25744](https://insights.sbomify.com/CVE-2023-25744/): Memory corruption in Firefox (high 8.8)
- [CVE-2023-25743](https://insights.sbomify.com/CVE-2023-25743/): Security feature bypass in Firefox (high 7.5)
- [CVE-2023-25742](https://insights.sbomify.com/CVE-2023-25742/): Denial of service in Firefox (medium 6.5)
- [CVE-2023-25741](https://insights.sbomify.com/CVE-2023-25741/): Information disclosure in Firefox (medium 6.5)
- [CVE-2023-25740](https://insights.sbomify.com/CVE-2023-25740/): Information disclosure in Firefox (high 8.8)
- [CVE-2023-2574](https://insights.sbomify.com/CVE-2023-2574/): Authenticated Command Injection (high 8.8)
- [CVE-2023-25739](https://insights.sbomify.com/CVE-2023-25739/): Use after free in Firefox (high 8.8)
- [CVE-2023-25738](https://insights.sbomify.com/CVE-2023-25738/): Memory corruption in Firefox (medium 6.5)
- [CVE-2023-25737](https://insights.sbomify.com/CVE-2023-25737/): Memory corruption in Firefox (high 8.8)
- [CVE-2023-25736](https://insights.sbomify.com/CVE-2023-25736/): Memory corruption in Firefox (critical 9.8)
- [CVE-2023-25735](https://insights.sbomify.com/CVE-2023-25735/): Use after free in Firefox (high 8.8)
- [CVE-2023-25734](https://insights.sbomify.com/CVE-2023-25734/): Server-side request forgery in Firefox (high 8.1)
- [CVE-2023-25733](https://insights.sbomify.com/CVE-2023-25733/): Null dereference in Firefox (high 7.5)
- [CVE-2023-25732](https://insights.sbomify.com/CVE-2023-25732/): Memory corruption in Firefox (high 8.8)
- [CVE-2023-25731](https://insights.sbomify.com/CVE-2023-25731/): Code injection in Firefox (high 8.8)
- [CVE-2023-25730](https://insights.sbomify.com/CVE-2023-25730/): Other in Firefox (medium 5.4)
- [CVE-2023-2573](https://insights.sbomify.com/CVE-2023-2573/): Authenticated Command Injection (high 8.8)
- [CVE-2023-25729](https://insights.sbomify.com/CVE-2023-25729/): Security feature bypass in Firefox (high 8.8)
- [CVE-2023-25728](https://insights.sbomify.com/CVE-2023-25728/): Information disclosure in Firefox (medium 6.5)
- [CVE-2023-25727](https://insights.sbomify.com/CVE-2023-25727/): Cross-site Scripting vulnerability in drag-and-drop upload of phpMyAdmin (medium 5.4)
- [CVE-2023-25725](https://insights.sbomify.com/CVE-2023-25725/): Security feature bypass in debian:debian linux (critical 9.1)
- [CVE-2023-25722](https://insights.sbomify.com/CVE-2023-25722/): Veracode Scan Jenkins Plugin vulnerable to information disclosure (medium 5.5)
- [CVE-2023-25721](https://insights.sbomify.com/CVE-2023-25721/): Veracode Scan Jenkins Plugin vulnerable to information disclosure (medium 6.5)
- [CVE-2023-2572](https://insights.sbomify.com/CVE-2023-2572/): Survey Maker < 3.4.7 - Reflected XSS (medium 6.1)
- [CVE-2023-25719](https://insights.sbomify.com/CVE-2023-25719/): Code injection in connectwise:control (high 8.8)
- [CVE-2023-25718](https://insights.sbomify.com/CVE-2023-25718/): Security feature bypass in connectwise:control (critical 9.8)
- [CVE-2023-25717](https://insights.sbomify.com/CVE-2023-25717/): Multiple Ruckus Wireless Products CSRF and RCE (critical 9.8, exploited in the wild)
- [CVE-2023-25716](https://insights.sbomify.com/CVE-2023-25716/): WordPress Announce from the Dashboard Plugin <= 1.5.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25715](https://insights.sbomify.com/CVE-2023-25715/): WordPress GamiPress Plugin <= 2.5.6 is vulnerable to Broken Access Control (medium 5.4)
- [CVE-2023-25714](https://insights.sbomify.com/CVE-2023-25714/): WordPress Quick Paypal Payments plugin <= 5.7.25 - Broken Access Control vulnerability (high 7.5)
- [CVE-2023-25713](https://insights.sbomify.com/CVE-2023-25713/): WordPress Quick Paypal Payments Plugin <= 5.7.25 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-25712](https://insights.sbomify.com/CVE-2023-25712/): WordPress Opt-Out for Google Analytics Plugin <= 2.3.4 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25711](https://insights.sbomify.com/CVE-2023-25711/): WordPress WPGlobus Translate Options Plugin <= 2.1.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.8)
- [CVE-2023-25710](https://insights.sbomify.com/CVE-2023-25710/): WordPress Click to Call or Chat Buttons Plugin <= 1.4.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-2571](https://insights.sbomify.com/CVE-2023-2571/): Quiz Maker < 6.4.2.7 - Reflected XSS (medium 6.1)
- [CVE-2023-25709](https://insights.sbomify.com/CVE-2023-25709/): WordPress Locatoraid Store Locator Plugin <= 3.9.11 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-25708](https://insights.sbomify.com/CVE-2023-25708/): Cross-site request forgery in WP VR – 360 Panorama and Virtual Tour Builder For WordPress (medium 4.3)
- [CVE-2023-25707](https://insights.sbomify.com/CVE-2023-25707/): WordPress VikBooking Hotel Booking Engine & PMS Plugin <= 1.5.12 is vulnerable to Cross Site Request Forgery (CSRF) (medium 6.3)
- [CVE-2023-25706](https://insights.sbomify.com/CVE-2023-25706/): WordPress Robots.txt optimization plugin <= 1.4.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-25705](https://insights.sbomify.com/CVE-2023-25705/): WordPress WP Prayer Plugin <= 1.9.6 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25704](https://insights.sbomify.com/CVE-2023-25704/): WordPress Interactive SVG Image Map Builder Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25703](https://insights.sbomify.com/CVE-2023-25703/): WordPress Meta slider and carousel with lightbox plugin <= 1.6.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-25702](https://insights.sbomify.com/CVE-2023-25702/): WordPress Quick Paypal Payments Plugin <= 5.7.25 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25701](https://insights.sbomify.com/CVE-2023-25701/): WordPress WatchTowerHQ plugin <= 3.6.16 - Privilege Escalation (critical 9.8)
- [CVE-2023-25700](https://insights.sbomify.com/CVE-2023-25700/): WordPress Tutor LMS Plugin <= 2.1.10 is vulnerable to SQL Injection (high 8.2)
- [CVE-2023-2570](https://insights.sbomify.com/CVE-2023-2570/): Memory corruption in EcoStruxure Foxboro DCS Control Core Services (high 7.0)
- [CVE-2023-25699](https://insights.sbomify.com/CVE-2023-25699/): WordPress VideoWhisper Live Streaming Integration plugin <= 5.5.15 - Remote Code Execution (RCE) (critical 9.0)
- [CVE-2023-25698](https://insights.sbomify.com/CVE-2023-25698/): WordPress Shoppable Images Lite Plugin <= 1.2.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-25697](https://insights.sbomify.com/CVE-2023-25697/): WordPress GamiPress plugin <= 2.5.6 - CSRF Leading to Settings Change Vulnerability (medium 5.4)
- [CVE-2023-25696](https://insights.sbomify.com/CVE-2023-25696/): Apache Airflow Hive Provider Beeline RCE (critical 9.8)
- [CVE-2023-25695](https://insights.sbomify.com/CVE-2023-25695/): Information disclosure in Apache Airflow (medium 5.3)
- [CVE-2023-25693](https://insights.sbomify.com/CVE-2023-25693/): Sqoop Apache Airflow Provider Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2023-25692](https://insights.sbomify.com/CVE-2023-25692/): Apache Airflow Google Provider: Google Cloud Sql Provider Denial Of Service (high 7.5)
- [CVE-2023-25691](https://insights.sbomify.com/CVE-2023-25691/): Apache Airflow Google Provider: Google Cloud Sql Provider Remote Command Execution (critical 9.8)
- [CVE-2023-25690](https://insights.sbomify.com/CVE-2023-25690/): Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy (critical 9.8)
- [CVE-2023-2569](https://insights.sbomify.com/CVE-2023-2569/): Memory corruption in EcoStruxure Foxboro DCS Control Core Services (high 7.8)
- [CVE-2023-25689](https://insights.sbomify.com/CVE-2023-25689/): IBM Security Key Lifecycle Manager information disclosure (low 2.7)
- [CVE-2023-25688](https://insights.sbomify.com/CVE-2023-25688/): IBM Security Key Lifecycle Manager information disclosure (medium 4.3)
- [CVE-2023-25687](https://insights.sbomify.com/CVE-2023-25687/): IBM Security Key Lifecycle Manager information disclosure (medium 4.3)
- [CVE-2023-25686](https://insights.sbomify.com/CVE-2023-25686/): IBM Security Key Lifecycle Manager information disclosure (medium 6.2)
- [CVE-2023-25684](https://insights.sbomify.com/CVE-2023-25684/): IBM Security Key Lifecycle Manager SQL injection (medium 6.5)
- [CVE-2023-25683](https://insights.sbomify.com/CVE-2023-25683/): IBM PowerVM Hypervisor information disclosure (medium 5.9)
- [CVE-2023-25682](https://insights.sbomify.com/CVE-2023-25682/): IBM Sterling B2B Integrator information disclosure (medium 6.2)
- [CVE-2023-25681](https://insights.sbomify.com/CVE-2023-25681/): IBM Spectrum Virtualize security bypass (medium 5.3)
- [CVE-2023-25680](https://insights.sbomify.com/CVE-2023-25680/): IBM Robotic Process Automation information disclosure (medium 4.2)
- [CVE-2023-2568](https://insights.sbomify.com/CVE-2023-2568/): Photo Gallery by Ays < 5.1.7 - Reflected XSS (medium 6.1)
- [CVE-2023-25676](https://insights.sbomify.com/CVE-2023-25676/): TensorFlow has null dereference on ParallelConcat with XLA (high 7.5)
- [CVE-2023-25675](https://insights.sbomify.com/CVE-2023-25675/): TensorFlow has Segfault in Bincount with XLA (high 7.5)
- [CVE-2023-25674](https://insights.sbomify.com/CVE-2023-25674/): TensorFlow has Null Pointer Error in RandomShuffle with XLA enable (high 7.5)
- [CVE-2023-25673](https://insights.sbomify.com/CVE-2023-25673/): TensorFlow has Floating Point Exception in TensorListSplit with XLA (high 7.5)
- [CVE-2023-25672](https://insights.sbomify.com/CVE-2023-25672/): TensorFlow has Null Pointer Error in LookupTableImportV2 (high 7.5)
- [CVE-2023-25671](https://insights.sbomify.com/CVE-2023-25671/): TensorFlow has segmentation fault in tfg-translate (high 7.5)
- [CVE-2023-25670](https://insights.sbomify.com/CVE-2023-25670/): TensorFlow has Null Pointer Error in QuantizedMatMulWithBiasAndDequantize (high 7.5)
- [CVE-2023-2567](https://insights.sbomify.com/CVE-2023-2567/): Authenticated SQL Injection on Query functionality in Guardian/CMC before 22.6.3 and 23.1.0 (high 8.7)
- [CVE-2023-25669](https://insights.sbomify.com/CVE-2023-25669/): TensorFlow has Floating Point Exception in AvgPoolGrad with XLA (high 7.5)
- [CVE-2023-25668](https://insights.sbomify.com/CVE-2023-25668/): TensorFlow vulnerable to heap out-of-buffer read in the QuantizeAndDequantize operation (critical 9.8)
- [CVE-2023-25667](https://insights.sbomify.com/CVE-2023-25667/): TensorFlow vulnerable to segfault when opening multiframe gif (medium 6.5)
- [CVE-2023-25666](https://insights.sbomify.com/CVE-2023-25666/): TensorFlow has Floating Point Exception in AudioSpectrogram (high 7.5)
- [CVE-2023-25665](https://insights.sbomify.com/CVE-2023-25665/): TensorFlow has Null Pointer Error in SparseSparseMaximum (high 7.5)
- [CVE-2023-25664](https://insights.sbomify.com/CVE-2023-25664/): TensorFlow vulnerable to Heap Buffer Overflow in AvgPoolGrad (high 7.5)
- [CVE-2023-25663](https://insights.sbomify.com/CVE-2023-25663/): TensorFlow has Null Pointer Error in TensorArrayConcatV2 (high 7.5)
- [CVE-2023-25662](https://insights.sbomify.com/CVE-2023-25662/): TensorFlow vulnerable to integer overflow in EditDistance (high 7.5)
- [CVE-2023-25661](https://insights.sbomify.com/CVE-2023-25661/): Denial of Service in TensorFlow (medium 6.5)
- [CVE-2023-25660](https://insights.sbomify.com/CVE-2023-25660/): TensorFlow vulnerable to seg fault in `tf.raw_ops.Print` (high 7.5)
- [CVE-2023-2566](https://insights.sbomify.com/CVE-2023-2566/): Cross-site Scripting (XSS) - Stored in openemr/openemr (high 7.5)
- [CVE-2023-25659](https://insights.sbomify.com/CVE-2023-25659/): TensorFlow vulnerable to Out-of-Bounds Read in DynamicStitch (high 7.5)
- [CVE-2023-25658](https://insights.sbomify.com/CVE-2023-25658/): TensorFlow vulnerable to Out-of-Bounds Read in GRUBlockCellGrad (high 7.5)
- [CVE-2023-25657](https://insights.sbomify.com/CVE-2023-25657/): Remote code execution in Jinja2 template rendering in Nautobot (high 7.5)
- [CVE-2023-25656](https://insights.sbomify.com/CVE-2023-25656/): notation-go has excessive memory allocation on verification (high 7.5)
- [CVE-2023-25655](https://insights.sbomify.com/CVE-2023-25655/): baserCMS allows any file to be uploaded (critical 9.8)
- [CVE-2023-25654](https://insights.sbomify.com/CVE-2023-25654/): baserCMS File Uploader Remote Code Execution (RCE) vulnerability (critical 9.8)
- [CVE-2023-25653](https://insights.sbomify.com/CVE-2023-25653/): Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS) (high 7.5)
- [CVE-2023-25652](https://insights.sbomify.com/CVE-2023-25652/): "git apply --reject" partially-controlled arbitrary file write (high 7.5)
- [CVE-2023-25651](https://insights.sbomify.com/CVE-2023-25651/): SQL Injection Vulnerability in Some ZTE Mobile Internet Products (medium 4.3)
- [CVE-2023-25650](https://insights.sbomify.com/CVE-2023-25650/): Arbitrary File Download Vulnerability in ZTE ZXCLOUD iRAI (medium 6.5)
- [CVE-2023-2565](https://insights.sbomify.com/CVE-2023-2565/): SourceCodester Multi Language Hotel Management Software POST Parameter ajax.php cross site scripting (low 3.5)
- [CVE-2023-25649](https://insights.sbomify.com/CVE-2023-25649/): OS Command Injection Vulnerability in a Mobile Internet Product of ZTE (medium 6.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/363/