# Vulnerabilities published in 2023


- [CVE-2023-24502](https://insights.sbomify.com/CVE-2023-24502/): Electra Central AC unit – Easily calculated password (high 7.5)
- [CVE-2023-24501](https://insights.sbomify.com/CVE-2023-24501/): Electra Central AC unit – Hardcoded Credentials (critical 9.8)
- [CVE-2023-24500](https://insights.sbomify.com/CVE-2023-24500/): Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW (high 7.5)
- [CVE-2023-2450](https://insights.sbomify.com/CVE-2023-2450/): Cross-site scripting in FiboSearch – Ajax Search for WooCommerce (medium 4.4)
- [CVE-2023-24499](https://insights.sbomify.com/CVE-2023-24499/): Butterfly Button plugin may leave traces of its use on user's device (medium 4.3)
- [CVE-2023-24498](https://insights.sbomify.com/CVE-2023-24498/): Netgear ProSAFE 24 Port 10/100 FS726TP - CWE-522: Insufficiently Protected Credentials. (high 7.5)
- [CVE-2023-24497](https://insights.sbomify.com/CVE-2023-24497/): Cross-site scripting in MilesightVPN (medium 4.7)
- [CVE-2023-24496](https://insights.sbomify.com/CVE-2023-24496/): Cross-site scripting in MilesightVPN (medium 4.7)
- [CVE-2023-24495](https://insights.sbomify.com/CVE-2023-24495/): Server-side request forgery in Tenable.sc (medium 6.5)
- [CVE-2023-24494](https://insights.sbomify.com/CVE-2023-24494/): Cross-site scripting in Tenable.sc (medium 5.4)
- [CVE-2023-24493](https://insights.sbomify.com/CVE-2023-24493/): Code injection in Tenable.sc (medium 5.7)
- [CVE-2023-24492](https://insights.sbomify.com/CVE-2023-24492/): Code injection in Citrix Secure Access client for Ubuntu (critical 9.6)
- [CVE-2023-24491](https://insights.sbomify.com/CVE-2023-24491/): Privilege escalation in Citrix Secure Access client for Windows (high 7.8)
- [CVE-2023-24490](https://insights.sbomify.com/CVE-2023-24490/): Users with only access to launch VDA applications can launch an unauthorized desktop (medium 6.3)
- [CVE-2023-2449](https://insights.sbomify.com/CVE-2023-2449/): UserPro <= 5.1.1 - Insecure Password Reset Mechanism (critical 9.8)
- [CVE-2023-24489](https://insights.sbomify.com/CVE-2023-24489/): Citrix Content Collaboration ShareFile Improper Access Control (critical 9.8, exploited in the wild)
- [CVE-2023-24488](https://insights.sbomify.com/CVE-2023-24488/): Cross site scripting (medium 6.1)
- [CVE-2023-24487](https://insights.sbomify.com/CVE-2023-24487/): Arbitrary file read (medium 6.3)
- [CVE-2023-24486](https://insights.sbomify.com/CVE-2023-24486/): Missing authorization in Citrix Workspace app for Linux (medium 5.5)
- [CVE-2023-24485](https://insights.sbomify.com/CVE-2023-24485/): Privilege Escalation on the system running a vulnerable version of Citrix Workspace app for Windows (high 7.8)
- [CVE-2023-24484](https://insights.sbomify.com/CVE-2023-24484/): A malicious user can cause log files to be written to a directory that they do not have permission to write to. (medium 5.5)
- [CVE-2023-24483](https://insights.sbomify.com/CVE-2023-24483/): Privilege Escalation to NT AUTHORITY\SYSTEM on the vulnerable VDA (high 7.8)
- [CVE-2023-24482](https://insights.sbomify.com/CVE-2023-24482/): Memory corruption in COMOS V10.2 (critical 10.0)
- [CVE-2023-24481](https://insights.sbomify.com/CVE-2023-24481/): Privilege escalation in Intel(R) Thunderbolt(TM) DCH drivers for Windows (medium 6.3)
- [CVE-2023-24480](https://insights.sbomify.com/CVE-2023-24480/): Controller stack overflow when decoding messages from the server (critical 9.8)
- [CVE-2023-2448](https://insights.sbomify.com/CVE-2023-2448/): UserPro <= 5.1.4 - Missing Authorization to Arbitrary Shortcode Execution via userpro_shortcode_template (medium 6.5)
- [CVE-2023-24479](https://insights.sbomify.com/CVE-2023-24479/): Auth bypass in YF325 (critical 9.8)
- [CVE-2023-24478](https://insights.sbomify.com/CVE-2023-24478/): Weak cryptography in Intel Agilex(R) software included as part of Intel(R) Quartus(R) Prime Pro Edition for linux (medium 5.5)
- [CVE-2023-24477](https://insights.sbomify.com/CVE-2023-24477/): Session Fixation in Guardian/CMC before 22.6.2 (medium 5.4)
- [CVE-2023-24476](https://insights.sbomify.com/CVE-2023-24476/): PTC Vuforia Studio Improper Authorization (low 1.8)
- [CVE-2023-24475](https://insights.sbomify.com/CVE-2023-24475/): Memory corruption in Intel(R) Server Board BMC firmware (medium 6.0)
- [CVE-2023-24474](https://insights.sbomify.com/CVE-2023-24474/): Server deserialization missing boundary checks - heap overflow in communication between server and controller (high 7.5)
- [CVE-2023-24473](https://insights.sbomify.com/CVE-2023-24473/): Information disclosure in OpenImageIO (medium 5.3)
- [CVE-2023-24472](https://insights.sbomify.com/CVE-2023-24472/): Denial of service in OpenImageIO (high 7.5)
- [CVE-2023-24471](https://insights.sbomify.com/CVE-2023-24471/): Information disclosure via the debug function in assertions in Guardian/CMC before 22.6.2 (high 7.1)
- [CVE-2023-24470](https://insights.sbomify.com/CVE-2023-24470/): XML external entity in ArcSight Logger (critical 9.1)
- [CVE-2023-2447](https://insights.sbomify.com/CVE-2023-2447/): UserPro <= 5.1.1 - Cross-Site Request Forgery to Sensitive Information Exposure (medium 6.1)
- [CVE-2023-24469](https://insights.sbomify.com/CVE-2023-24469/): Cross-site scripting in ArcSight Logger (medium 6.1)
- [CVE-2023-24468](https://insights.sbomify.com/CVE-2023-24468/): Missing authorization in NetIQ Advanced Authentication (critical 9.8)
- [CVE-2023-24467](https://insights.sbomify.com/CVE-2023-24467/): Possible Command Injection in OpenText iManager (high 8.8)
- [CVE-2023-24466](https://insights.sbomify.com/CVE-2023-24466/): Possible XML External Entity Injection in OpenText iManager (high 7.5)
- [CVE-2023-24465](https://insights.sbomify.com/CVE-2023-24465/): Communication Wi-Fi subsystem has a null pointer reference vulnerability when receving external data. (medium 5.5)
- [CVE-2023-24464](https://insights.sbomify.com/CVE-2023-24464/): Cross-site scripting in BS-GS series (medium 5.4)
- [CVE-2023-24463](https://insights.sbomify.com/CVE-2023-24463/): Information disclosure in Intel(R) Thunderbolt(TM) DCH drivers for Windows (medium 4.3)
- [CVE-2023-24461](https://insights.sbomify.com/CVE-2023-24461/): BIG-IP Edge Client for Windows and macOS vulnerability (high 7.4)
- [CVE-2023-24460](https://insights.sbomify.com/CVE-2023-24460/): Misconfiguration in Intel(R) GPA software installers (high 8.2)
- [CVE-2023-2446](https://insights.sbomify.com/CVE-2023-2446/): UserPro <= 5.1.1 - Sensitive Information Disclosure via Shortcode (medium 6.5)
- [CVE-2023-24459](https://insights.sbomify.com/CVE-2023-24459/): Missing permission check in Jenkins BearyChat Plugin (medium 6.5)
- [CVE-2023-24458](https://insights.sbomify.com/CVE-2023-24458/): Cross-site request forgery vulnerability in Jenkins BearyChat Plugin (high 8.8)
- [CVE-2023-24457](https://insights.sbomify.com/CVE-2023-24457/): CSRF vulnerability in Jenkins Keycloak Authentication Plugin (medium 6.5)
- [CVE-2023-24456](https://insights.sbomify.com/CVE-2023-24456/): Session fixation vulnerability in Jenkins Keycloak Authentication Plugin (critical 9.8)
- [CVE-2023-24455](https://insights.sbomify.com/CVE-2023-24455/): Path Traversal in Jenkins visualexpert Plugin (medium 4.3)
- [CVE-2023-24454](https://insights.sbomify.com/CVE-2023-24454/): Plaintext Storage of a Password in Jenkins TestQuality Updater Plugin (medium 5.5)
- [CVE-2023-24453](https://insights.sbomify.com/CVE-2023-24453/): Missing permission check in Jenkins TestQuality Updater Plugin (medium 6.5)
- [CVE-2023-24452](https://insights.sbomify.com/CVE-2023-24452/): CSRF vulnerability in Jenkins TestQuality Updater Plugin (high 8.8)
- [CVE-2023-24451](https://insights.sbomify.com/CVE-2023-24451/): Cisco Spark Notifier Jenkins Plugin contains Missing Authorization (medium 4.3)
- [CVE-2023-24450](https://insights.sbomify.com/CVE-2023-24450/): Passwords stored in plain text by Jenkins view-cloner Plugin (medium 6.5)
- [CVE-2023-2445](https://insights.sbomify.com/CVE-2023-2445/): Missing authorization in Devolutions Server (medium 4.9)
- [CVE-2023-24449](https://insights.sbomify.com/CVE-2023-24449/): Path traversal vulnerability in Jenkins PWauth Security Realm Plugin (medium 4.3)
- [CVE-2023-24448](https://insights.sbomify.com/CVE-2023-24448/): Missing permission check in Jenkins RabbitMQ Consumer Plugin (medium 6.5)
- [CVE-2023-24447](https://insights.sbomify.com/CVE-2023-24447/): Cross-site request forgery vulnerability in Jenkins RabbitMQ Consumer Plugin (high 8.8)
- [CVE-2023-24446](https://insights.sbomify.com/CVE-2023-24446/): Cross-site request forgery vulnerability in Jenkins OpenID Plugin (high 8.8)
- [CVE-2023-24445](https://insights.sbomify.com/CVE-2023-24445/): Open redirect vulnerability in Jenkins OpenID Plugin (medium 6.1)
- [CVE-2023-24444](https://insights.sbomify.com/CVE-2023-24444/): Session fixation vulnerability in Jenkins OpenID Plugin (critical 9.8)
- [CVE-2023-24443](https://insights.sbomify.com/CVE-2023-24443/): XML Entity Expansion in Jenkins TestComplete support Plugin (critical 9.8)
- [CVE-2023-24442](https://insights.sbomify.com/CVE-2023-24442/): Plaintext storage of Access Token in Jenkins GitHub Pull Request Coverage Status Plugin (medium 5.5)
- [CVE-2023-24441](https://insights.sbomify.com/CVE-2023-24441/): XML external entity vulnerability on agents in Jenkins MSTest Plugin (critical 9.8)
- [CVE-2023-24440](https://insights.sbomify.com/CVE-2023-24440/): Cleartext Transmission of Sensitive Information in Jenkins JIRA Pipeline Steps Plugin (medium 5.5)
- [CVE-2023-2444](https://insights.sbomify.com/CVE-2023-2444/): Cross-site request forgery in FactoryTalk Vantagepoint (high 7.1)
- [CVE-2023-24439](https://insights.sbomify.com/CVE-2023-24439/): Plaintext Storage of a Password in Jenkins JIRA Pipeline Steps Plugin (medium 5.5)
- [CVE-2023-24438](https://insights.sbomify.com/CVE-2023-24438/): Missing permissions check in Jenkins JIRA Pipeline Steps Plugin (medium 6.5)
- [CVE-2023-24437](https://insights.sbomify.com/CVE-2023-24437/): Cross-site request forgery vulnerability in Jenkins JIRA Pipeline Steps Plugin (high 8.8)
- [CVE-2023-24436](https://insights.sbomify.com/CVE-2023-24436/): Jenkins GitHub Pull Request Builder Plugin missing permission check allows enumerating credentials IDs (medium 4.3)
- [CVE-2023-24435](https://insights.sbomify.com/CVE-2023-24435/): Missing permission checks in Jenkins GitHub Pull Request Builder Plugin (medium 6.5)
- [CVE-2023-24434](https://insights.sbomify.com/CVE-2023-24434/): CSRF vulnerability in Jenkins GitHub Pull Request Builder Plugin (high 8.8)
- [CVE-2023-24433](https://insights.sbomify.com/CVE-2023-24433/): Missing permission checks in Jenkins Orka Plugin allow capturing credentials (medium 6.5)
- [CVE-2023-24432](https://insights.sbomify.com/CVE-2023-24432/): CSRF vulnerability in Jenkins Orka Plugin allow capturing credentials (high 8.8)
- [CVE-2023-24431](https://insights.sbomify.com/CVE-2023-24431/): Missing permission checks in Jenkins Orka Plugin allow enumerating credentials IDs (medium 4.3)
- [CVE-2023-24430](https://insights.sbomify.com/CVE-2023-24430/): XML external entity reference vulnerability on agents in Jenkins Semantic Versioning Plugin (critical 9.8)
- [CVE-2023-2443](https://insights.sbomify.com/CVE-2023-2443/): Weak cryptography in ThinManager (high 7.5)
- [CVE-2023-24429](https://insights.sbomify.com/CVE-2023-24429/): Agent-to-controller security bypass in Jenkins Semantic Versioning Plugin (critical 9.8)
- [CVE-2023-24428](https://insights.sbomify.com/CVE-2023-24428/): Cross-site request forgery vulnerability in Jenkins Bitbucket OAuth Plugin (medium 5.7)
- [CVE-2023-24427](https://insights.sbomify.com/CVE-2023-24427/): Session fixation vulnerability in Jenkins Bitbucket OAuth Plugin (critical 9.8)
- [CVE-2023-24426](https://insights.sbomify.com/CVE-2023-24426/): Insufficient Session Expiration in Jenkins Azure AD Plugin (high 8.8)
- [CVE-2023-24425](https://insights.sbomify.com/CVE-2023-24425/): Exposure of system-scoped Kubernetes credentials in Jenkins Kubernetes Credentials Provider Plugin (medium 6.5)
- [CVE-2023-24424](https://insights.sbomify.com/CVE-2023-24424/): Session fixation vulnerability in Jenkins OpenId Connect Authentication Plugin (high 8.8)
- [CVE-2023-24423](https://insights.sbomify.com/CVE-2023-24423/): Cross-site request forgery in Jenkins Gerrit Trigger Plugin (medium 6.5)
- [CVE-2023-24422](https://insights.sbomify.com/CVE-2023-24422/): Sandbox bypass in Jenkins Script Security Plugin (high 8.8)
- [CVE-2023-24421](https://insights.sbomify.com/CVE-2023-24421/): WordPress PHP Compatibility Checker Plugin <= 1.5.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-24420](https://insights.sbomify.com/CVE-2023-24420/): WordPress Admin side data storage for Contact Form 7 Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-2442](https://insights.sbomify.com/CVE-2023-2442/): Cross-site scripting in GitLab (high 8.7)
- [CVE-2023-24419](https://insights.sbomify.com/CVE-2023-24419/): WordPress Formidable Forms Plugin <= 5.5.6 is vulnerable to Cross Site Request Forgery (CSRF) (high 7.1)
- [CVE-2023-24418](https://insights.sbomify.com/CVE-2023-24418/): WordPress Tiny carousel horizontal slider plus Plugin <= 3.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-24417](https://insights.sbomify.com/CVE-2023-24417/): Cross-site request forgery in Worthy (medium 4.3)
- [CVE-2023-24416](https://insights.sbomify.com/CVE-2023-24416/): WordPress All In One Favicon Plugin <= 4.7 is vulnerable to Arbitrary File Deletion (medium 6.8)
- [CVE-2023-24415](https://insights.sbomify.com/CVE-2023-24415/): WordPress AI ChatBot plugin <= 4.2.8 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-24414](https://insights.sbomify.com/CVE-2023-24414/): WordPress Robo Gallery Plugin <= 3.2.11 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-24413](https://insights.sbomify.com/CVE-2023-24413/): WordPress wordpress vertical image slider plugin Plugin <= 1.2.16 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-24412](https://insights.sbomify.com/CVE-2023-24412/): WordPress Image Social Feed Plugin Plugin <= 1.7.6 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-24411](https://insights.sbomify.com/CVE-2023-24411/): WordPress BNE Testimonials Plugin <= 2.0.7 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/373/