# Vulnerabilities published in 2023


- [CVE-2023-25534](https://insights.sbomify.com/CVE-2023-25534/): Other in DGX H100 BMC (medium 5.7)
- [CVE-2023-25533](https://insights.sbomify.com/CVE-2023-25533/): Other in DGX H100 BMC (high 8.3)
- [CVE-2023-25532](https://insights.sbomify.com/CVE-2023-25532/): Information disclosure in DGX H100 BMC (medium 6.5)
- [CVE-2023-25531](https://insights.sbomify.com/CVE-2023-25531/): Information disclosure in DGX H100 BMC (high 7.6)
- [CVE-2023-25530](https://insights.sbomify.com/CVE-2023-25530/): Other in DGX H100 BMC (high 8.0)
- [CVE-2023-2553](https://insights.sbomify.com/CVE-2023-2553/): Cross-site Scripting (XSS) - Stored in unilogies/bumsys (medium 4.8)
- [CVE-2023-25529](https://insights.sbomify.com/CVE-2023-25529/): Information disclosure in DGX A100 BMC (high 8.0)
- [CVE-2023-25528](https://insights.sbomify.com/CVE-2023-25528/): Memory corruption in DGX H100 BMC (high 8.8)
- [CVE-2023-25527](https://insights.sbomify.com/CVE-2023-25527/): Memory corruption in DGX H100 BMC (high 7.8)
- [CVE-2023-25526](https://insights.sbomify.com/CVE-2023-25526/): Denial of service in Cumulus Linux (medium 6.5)
- [CVE-2023-25525](https://insights.sbomify.com/CVE-2023-25525/): Information disclosure in Cumulus Linux (high 7.5)
- [CVE-2023-25524](https://insights.sbomify.com/CVE-2023-25524/): Information disclosure in Omniverse Workstation Launcher (medium 4.0)
- [CVE-2023-25523](https://insights.sbomify.com/CVE-2023-25523/): Null dereference in CUDA Toolkit (low 3.3)
- [CVE-2023-25522](https://insights.sbomify.com/CVE-2023-25522/): Other in DGX A100/A800 (high 7.5)
- [CVE-2023-25521](https://insights.sbomify.com/CVE-2023-25521/): Privilege escalation in DGX A100/A800 (high 7.5)
- [CVE-2023-25520](https://insights.sbomify.com/CVE-2023-25520/): Denial of service in Jetson AGX Xavier series, Jetson Xavier NX, Jetson TX2 series, Jetson TX2 NX (medium 4.4)
- [CVE-2023-2552](https://insights.sbomify.com/CVE-2023-2552/): Cross-Site Request Forgery (CSRF) in unilogies/bumsys (high 8.8)
- [CVE-2023-25519](https://insights.sbomify.com/CVE-2023-25519/): Privilege escalation in BlueField 1 (high 7.8)
- [CVE-2023-25518](https://insights.sbomify.com/CVE-2023-25518/): Security feature bypass in Jetson AGX Xavier series, Jetson Xavier NX (high 7.1)
- [CVE-2023-25517](https://insights.sbomify.com/CVE-2023-25517/): Missing authorization in vGPU software (high 7.1)
- [CVE-2023-25516](https://insights.sbomify.com/CVE-2023-25516/): Integer overflow in GPU Display Driver for Linux (high 7.1)
- [CVE-2023-25515](https://insights.sbomify.com/CVE-2023-25515/): Memory corruption in GPU Display Driver for Windows and Linux (high 7.8)
- [CVE-2023-25514](https://insights.sbomify.com/CVE-2023-25514/): Memory corruption in NVIDIA CUDA Toolkit (medium 5.3)
- [CVE-2023-25513](https://insights.sbomify.com/CVE-2023-25513/): Memory corruption in NVIDIA CUDA Toolkit (medium 5.3)
- [CVE-2023-25512](https://insights.sbomify.com/CVE-2023-25512/): Memory corruption in NVIDIA CUDA Toolkit (medium 5.3)
- [CVE-2023-25511](https://insights.sbomify.com/CVE-2023-25511/): Denial of service in NVIDIA CUDA Toolkit (low 3.3)
- [CVE-2023-25510](https://insights.sbomify.com/CVE-2023-25510/): Null dereference in NVIDIA CUDA Toolkit (low 3.3)
- [CVE-2023-2551](https://insights.sbomify.com/CVE-2023-2551/): PHP Remote File Inclusion in unilogies/bumsys (high 7.2)
- [CVE-2023-25509](https://insights.sbomify.com/CVE-2023-25509/): Memory corruption in NVIDIA DGX servers (medium 6.0)
- [CVE-2023-25508](https://insights.sbomify.com/CVE-2023-25508/): Path traversal in NVIDIA DGX servers (medium 6.7)
- [CVE-2023-25507](https://insights.sbomify.com/CVE-2023-25507/): Command injection in NVIDIA DGX servers (high 7.2)
- [CVE-2023-25506](https://insights.sbomify.com/CVE-2023-25506/): Memory corruption in NVIDIA DGX servers (high 7.5)
- [CVE-2023-25505](https://insights.sbomify.com/CVE-2023-25505/): Memory corruption in NVIDIA DGX servers (high 7.8)
- [CVE-2023-25504](https://insights.sbomify.com/CVE-2023-25504/): Apache Superset: Possible SSRF on import datasets (medium 4.9)
- [CVE-2023-25500](https://insights.sbomify.com/CVE-2023-25500/): Vaadin vulnerable to possible information disclosure of class and method names in RPC response (low 3.5)
- [CVE-2023-2550](https://insights.sbomify.com/CVE-2023-2550/): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (high 8.2)
- [CVE-2023-25499](https://insights.sbomify.com/CVE-2023-25499/): Possible information disclosure in non visible components (medium 5.7)
- [CVE-2023-25496](https://insights.sbomify.com/CVE-2023-25496/): Privilege escalation in Lenovo Drivers Management (high 7.8)
- [CVE-2023-25495](https://insights.sbomify.com/CVE-2023-25495/): Information disclosure in XClarity Controller (medium 4.9)
- [CVE-2023-25494](https://insights.sbomify.com/CVE-2023-25494/): Memory corruption in Desktop BIOS, Smart Edge BIOS, ThinkStation BIOS (medium 6.7)
- [CVE-2023-25493](https://insights.sbomify.com/CVE-2023-25493/): Privilege escalation in BIOS (medium 6.7)
- [CVE-2023-25492](https://insights.sbomify.com/CVE-2023-25492/): Denial of service in XClarity Controller (medium 6.3)
- [CVE-2023-25491](https://insights.sbomify.com/CVE-2023-25491/): WordPress JCH Optimize Plugin <= 3.2.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25490](https://insights.sbomify.com/CVE-2023-25490/): WordPress Archivist – Custom Archive Templates Plugin <= 1.7.4 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-2549](https://insights.sbomify.com/CVE-2023-2549/): Cross-site request forgery in Custom Login Page | Temporary Users | Rebrand Login | Login Captcha (high 8.8)
- [CVE-2023-25489](https://insights.sbomify.com/CVE-2023-25489/): WordPress Update Theme and Plugins from Zip File Plugin <= 2.0.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-25488](https://insights.sbomify.com/CVE-2023-25488/): WordPress WP Default Feature Image Plugin <= 1.0.1.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25487](https://insights.sbomify.com/CVE-2023-25487/): WordPress PixTypes Plugin <= 1.4.14 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-25486](https://insights.sbomify.com/CVE-2023-25486/): WordPress Clone plugin <= 2.3.7 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-25485](https://insights.sbomify.com/CVE-2023-25485/): WordPress JSON Content Importer Plugin <= 1.3.15 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25484](https://insights.sbomify.com/CVE-2023-25484/): WordPress Simple Yearly Archive Plugin <= 2.1.8 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25483](https://insights.sbomify.com/CVE-2023-25483/): WordPress Easy Coming Soon Plugin <= 2.3 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25482](https://insights.sbomify.com/CVE-2023-25482/): WordPress WP Tiles Plugin <= 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-25481](https://insights.sbomify.com/CVE-2023-25481/): WordPress Podlove Subscribe button Plugin <= 1.3.7 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-25480](https://insights.sbomify.com/CVE-2023-25480/): Cross-site request forgery in Post and Page Builder by BoldGrid – Visual Drag and Drop Editor (medium 4.3)
- [CVE-2023-2548](https://insights.sbomify.com/CVE-2023-2548/): Missing authorization in RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login (medium 6.6)
- [CVE-2023-25479](https://insights.sbomify.com/CVE-2023-25479/): WordPress Podlove Subscribe button Plugin <= 1.3.7 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25478](https://insights.sbomify.com/CVE-2023-25478/): WordPress Weather Station Plugin <= 3.8.12 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-25477](https://insights.sbomify.com/CVE-2023-25477/): WordPress Video Gallery Plugin <= 1.3.12 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25476](https://insights.sbomify.com/CVE-2023-25476/): WordPress AmpedSense – AdSense Split Tester Plugin <= 4.68 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-25475](https://insights.sbomify.com/CVE-2023-25475/): WordPress Smart YouTube PRO Plugin <= 4.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-25474](https://insights.sbomify.com/CVE-2023-25474/): WordPress About Me 3000 widget Plugin <= 2.2.6 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-25473](https://insights.sbomify.com/CVE-2023-25473/): WordPress Flickr Justified Gallery Plugin <= 3.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-25472](https://insights.sbomify.com/CVE-2023-25472/): WordPress Podlove Podcast Publisher Plugin <= 3.8.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-25471](https://insights.sbomify.com/CVE-2023-25471/): WordPress WCP OpenWeather Plugin <= 2.5.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-25470](https://insights.sbomify.com/CVE-2023-25470/): WordPress Rus-To-Lat Plugin <= 0.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-2547](https://insights.sbomify.com/CVE-2023-2547/): Missing authorization in Custom Login Page | Temporary Users | Rebrand Login | Login Captcha (medium 5.4)
- [CVE-2023-25469](https://insights.sbomify.com/CVE-2023-25469/): WordPress Easy Table of Contents plugin <= 2.0.45.2 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-25468](https://insights.sbomify.com/CVE-2023-25468/): WordPress Reservation.Studio widget Plugin <= 1.0.11 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-25467](https://insights.sbomify.com/CVE-2023-25467/): WordPress Resize at Upload Plus Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-25466](https://insights.sbomify.com/CVE-2023-25466/): WordPress Who Hit The Page – Hit Counter Plugin <= 1.4.14.3 is vulnerable to Cross Site Scripting (XSS) (medium 5.8)
- [CVE-2023-25465](https://insights.sbomify.com/CVE-2023-25465/): WordPress wp tell a friend popup form Plugin <= 7.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25464](https://insights.sbomify.com/CVE-2023-25464/): WordPress Twitch Player Plugin <= 2.1.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25463](https://insights.sbomify.com/CVE-2023-25463/): WordPress wp tell a friend popup form Plugin <= 7.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-25462](https://insights.sbomify.com/CVE-2023-25462/): WordPress WP htaccess Control Plugin <= 3.5.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25461](https://insights.sbomify.com/CVE-2023-25461/): WordPress Wp-Insert Plugin <= 2.5.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25460](https://insights.sbomify.com/CVE-2023-25460/): WordPress Easy Ad Manager Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-2546](https://insights.sbomify.com/CVE-2023-2546/): WP User Switch <= 1.0.2 - Authenticated (Subscriber+) Authentication Bypass via Cookie (high 8.8)
- [CVE-2023-25459](https://insights.sbomify.com/CVE-2023-25459/): WordPress Post Snippets Plugin <= 4.0.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25458](https://insights.sbomify.com/CVE-2023-25458/): WordPress TypeSquare Webfonts for ConoHa Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25457](https://insights.sbomify.com/CVE-2023-25457/): WordPress Slider Carousel – Responsive Image Slider plugin <=1.5.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-25456](https://insights.sbomify.com/CVE-2023-25456/): WordPress Klaviyo Plugin <= 3.0.7 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25455](https://insights.sbomify.com/CVE-2023-25455/): Missing authorization in WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) (medium 5.3)
- [CVE-2023-25454](https://insights.sbomify.com/CVE-2023-25454/): WordPress Protected Posts Logout Button plugin <= 1.4.5 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-25453](https://insights.sbomify.com/CVE-2023-25453/): WordPress WordPress Tables Plugin <= 1.3.9 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-25452](https://insights.sbomify.com/CVE-2023-25452/): WordPress CMS Press Plugin <= 0.2.3 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25451](https://insights.sbomify.com/CVE-2023-25451/): WordPress CPO Content Types Plugin <= 1.1.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25450](https://insights.sbomify.com/CVE-2023-25450/): WordPress GiveWP Plugin <= 2.25.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-2545](https://insights.sbomify.com/CVE-2023-2545/): Missing authorization in Custom Login Page | Temporary Users | Rebrand Login | Login Captcha (high 8.1)
- [CVE-2023-25449](https://insights.sbomify.com/CVE-2023-25449/): WordPress CformsII Plugin <=15.0.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-25448](https://insights.sbomify.com/CVE-2023-25448/): WordPress Archivist – Custom Archive Templates Plugin <= 1.7.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-25447](https://insights.sbomify.com/CVE-2023-25447/): WordPress ColorWay Theme <= 4.2.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-25446](https://insights.sbomify.com/CVE-2023-25446/): WordPress HappyFiles Pro plugin <= 1.8.1 - Broken Access Control vulnerability (high 7.7)
- [CVE-2023-25445](https://insights.sbomify.com/CVE-2023-25445/): WordPress HappyFiles Pro plugin <= 1.8.1 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-25444](https://insights.sbomify.com/CVE-2023-25444/): WordPress JS Help Desk – Best Help Desk & Support Plugin plugin <= 2.7.7 - Arbitrary File Upload vulnerability (critical 9.1)
- [CVE-2023-25443](https://insights.sbomify.com/CVE-2023-25443/): WordPress Button Generator – easily Button Builder Plugin <= 2.3.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-25442](https://insights.sbomify.com/CVE-2023-25442/): WordPress Zeno Font Resizer Plugin <= 1.7.9 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-25440](https://insights.sbomify.com/CVE-2023-25440/): Cross-site scripting in civicrm:civicrm (medium 5.4)
- [CVE-2023-2544](https://insights.sbomify.com/CVE-2023-2544/): Authorization Bypass on UPV PEIX (medium 5.3)
- [CVE-2023-25439](https://insights.sbomify.com/CVE-2023-25439/): Cross-site scripting in squarepiginteractive:fusioninvoice (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/365/