# Vulnerabilities published in 2023


- [CVE-2023-2411](https://insights.sbomify.com/CVE-2023-2411/): SourceCodester AC Repair and Services System view_inquiry.php sql injection (medium 6.3)
- [CVE-2023-24108](https://insights.sbomify.com/CVE-2023-24108/): Supply chain in zetacomponents:mvctools (critical 9.8)
- [CVE-2023-24107](https://insights.sbomify.com/CVE-2023-24107/): Supply chain in hour of code python 2015 project:hour of code python 2015 (critical 9.8)
- [CVE-2023-24104](https://insights.sbomify.com/CVE-2023-24104/): Security feature bypass in ui:unifi dream machine pro firmware (critical 9.8)
- [CVE-2023-2410](https://insights.sbomify.com/CVE-2023-2410/): SourceCodester AC Repair and Services System view_booking.php sql injection (medium 6.3)
- [CVE-2023-24099](https://insights.sbomify.com/CVE-2023-24099/): Memory corruption in trendnet:tew-820ap firmware (high 8.8)
- [CVE-2023-24098](https://insights.sbomify.com/CVE-2023-24098/): Memory corruption in trendnet:tew-820ap firmware (high 8.8)
- [CVE-2023-24097](https://insights.sbomify.com/CVE-2023-24097/): Memory corruption in trendnet:tew-820ap firmware (high 8.8)
- [CVE-2023-24096](https://insights.sbomify.com/CVE-2023-24096/): Memory corruption in trendnet:tew-820ap firmware (high 8.8)
- [CVE-2023-24095](https://insights.sbomify.com/CVE-2023-24095/): Memory corruption in trendnet:tew-820ap firmware (high 8.8)
- [CVE-2023-24094](https://insights.sbomify.com/CVE-2023-24094/): Memory corruption in mikrotik:routeros (high 7.5)
- [CVE-2023-24093](https://insights.sbomify.com/CVE-2023-24093/): Auth bypass in h3c:a210-g firmware (critical 9.8)
- [CVE-2023-2409](https://insights.sbomify.com/CVE-2023-2409/): SourceCodester AC Repair and Services System view_service.php sql injection (medium 6.3)
- [CVE-2023-24086](https://insights.sbomify.com/CVE-2023-24086/): Cross-site scripting in slims project:slims (medium 6.1)
- [CVE-2023-24084](https://insights.sbomify.com/CVE-2023-24084/): SQL injection in chikoi project:chikoi (critical 9.8)
- [CVE-2023-24081](https://insights.sbomify.com/CVE-2023-24081/): Cross-site scripting in go-redrock:tutortrac (medium 5.4)
- [CVE-2023-24080](https://insights.sbomify.com/CVE-2023-24080/): Auth bypass in chamberlain:myq (critical 9.8)
- [CVE-2023-2408](https://insights.sbomify.com/CVE-2023-2408/): SourceCodester AC Repair and Services System view.php sql injection (medium 6.3)
- [CVE-2023-24078](https://insights.sbomify.com/CVE-2023-24078/): Code injection in realtimelogic:fuguhub (high 8.8)
- [CVE-2023-24070](https://insights.sbomify.com/CVE-2023-24070/): Cross-site scripting in misp-project:misp (medium 6.1)
- [CVE-2023-2407](https://insights.sbomify.com/CVE-2023-2407/): Cross-site request forgery in Event Registration Calendar By vcita (medium 6.1)
- [CVE-2023-24069](https://insights.sbomify.com/CVE-2023-24069/): Information disclosure in signal:signal-desktop (low 3.3)
- [CVE-2023-24068](https://insights.sbomify.com/CVE-2023-24068/): Security feature bypass in signal:signal-desktop (high 7.8)
- [CVE-2023-24065](https://insights.sbomify.com/CVE-2023-24065/): Cross-site scripting in nosh chartingsystem project:nosh chartingsystem (medium 5.4)
- [CVE-2023-24064](https://insights.sbomify.com/CVE-2023-24064/): Security feature bypass in dieboldnixdorf:vynamic security suite (medium 6.8)
- [CVE-2023-24063](https://insights.sbomify.com/CVE-2023-24063/): Security feature bypass in dieboldnixdorf:vynamic security suite (medium 6.8)
- [CVE-2023-24062](https://insights.sbomify.com/CVE-2023-24062/): Security feature bypass in dieboldnixdorf:vynamic security suite (medium 6.8)
- [CVE-2023-24060](https://insights.sbomify.com/CVE-2023-24060/): Server-side request forgery in havenweb:haven (medium 5.0)
- [CVE-2023-2406](https://insights.sbomify.com/CVE-2023-2406/): Cross-site scripting in Event Registration Calendar By vcita (medium 6.4)
- [CVE-2023-24059](https://insights.sbomify.com/CVE-2023-24059/): Code injection in rockstargames:grand theft auto v (high 7.3)
- [CVE-2023-24058](https://insights.sbomify.com/CVE-2023-24058/): Missing authorization in twinkletoessoftware:booked (medium 4.3)
- [CVE-2023-24057](https://insights.sbomify.com/CVE-2023-24057/): MITM based Zip Slip in `ca.uhn.hapi.fhir:org.hl7.fhir.core` (high 8.1)
- [CVE-2023-24056](https://insights.sbomify.com/CVE-2023-24056/): Denial of service in pkgconf:pkgconf (medium 5.5)
- [CVE-2023-24055](https://insights.sbomify.com/CVE-2023-24055/): Information disclosure in keepass:keepass (medium 5.5)
- [CVE-2023-24052](https://insights.sbomify.com/CVE-2023-24052/): Auth bypass in connectize:ac21000 g6 firmware (high 8.8)
- [CVE-2023-24051](https://insights.sbomify.com/CVE-2023-24051/): Auth bypass in connectize:ac21000 g6 firmware (high 8.8)
- [CVE-2023-24050](https://insights.sbomify.com/CVE-2023-24050/): Cross-site scripting in connectize:ac21000 g6 firmware (medium 5.4)
- [CVE-2023-2405](https://insights.sbomify.com/CVE-2023-2405/): CRM and Lead Management by vcita <= 2.7.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 6.1)
- [CVE-2023-24049](https://insights.sbomify.com/CVE-2023-24049/): Privilege escalation in connectize:ac21000 g6 firmware (critical 9.8)
- [CVE-2023-24048](https://insights.sbomify.com/CVE-2023-24048/): Cross-site request forgery in connectize:ac21000 g6 firmware (high 8.8)
- [CVE-2023-24047](https://insights.sbomify.com/CVE-2023-24047/): Weak cryptography in connectize:ac21000 g6 firmware (high 8.0)
- [CVE-2023-24046](https://insights.sbomify.com/CVE-2023-24046/): Command injection in connectize:ac21000 g6 firmware (high 8.8)
- [CVE-2023-24045](https://insights.sbomify.com/CVE-2023-24045/): Missing authorization in dataiku:data science studio (medium 6.5)
- [CVE-2023-24044](https://insights.sbomify.com/CVE-2023-24044/): Open redirect in plesk:obsidian (medium 6.1)
- [CVE-2023-24042](https://insights.sbomify.com/CVE-2023-24042/): Race condition in hfiref0x:lightftp (high 7.5)
- [CVE-2023-24040](https://insights.sbomify.com/CVE-2023-24040/): Other in opengroup:common desktop environment (high 7.1)
- [CVE-2023-2404](https://insights.sbomify.com/CVE-2023-2404/): CRM and Lead Management by vcita <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2023-24039](https://insights.sbomify.com/CVE-2023-24039/): Memory corruption in opengroup:common desktop environment (high 7.8)
- [CVE-2023-24038](https://insights.sbomify.com/CVE-2023-24038/): Denial of service in debian:debian linux (high 7.5)
- [CVE-2023-24035](https://insights.sbomify.com/CVE-2023-24035/): Weak cryptography in Nagios XI (low 3.5)
- [CVE-2023-24034](https://insights.sbomify.com/CVE-2023-24034/): Open redirect in Nagios XI (low 3.1)
- [CVE-2023-24033](https://insights.sbomify.com/CVE-2023-24033/): Denial of service in samsung:exynos 1080 firmware (high 7.5)
- [CVE-2023-24032](https://insights.sbomify.com/CVE-2023-24032/): Command injection in zimbra:collaboration (high 7.8)
- [CVE-2023-24031](https://insights.sbomify.com/CVE-2023-24031/): Cross-site scripting in zimbra:collaboration (medium 6.1)
- [CVE-2023-24030](https://insights.sbomify.com/CVE-2023-24030/): Open redirect in zimbra:collaboration (medium 6.1)
- [CVE-2023-24029](https://insights.sbomify.com/CVE-2023-24029/): Privilege escalation in progress:ws ftp server (high 7.2)
- [CVE-2023-24028](https://insights.sbomify.com/CVE-2023-24028/): Missing authorization in misp-project:misp (critical 9.8)
- [CVE-2023-24027](https://insights.sbomify.com/CVE-2023-24027/): Cross-site scripting in misp-project:misp (medium 6.1)
- [CVE-2023-24026](https://insights.sbomify.com/CVE-2023-24026/): Cross-site scripting in misp-project:misp (medium 6.1)
- [CVE-2023-24025](https://insights.sbomify.com/CVE-2023-24025/): Weak cryptography in pqclean project:pqclean (high 7.5)
- [CVE-2023-24023](https://insights.sbomify.com/CVE-2023-24023/): Weak cryptography in bluetooth:bluetooth core specification (medium 6.4)
- [CVE-2023-24022](https://insights.sbomify.com/CVE-2023-24022/): Hard Coded Credential Crypt Vulnerability (critical 10.0)
- [CVE-2023-24021](https://insights.sbomify.com/CVE-2023-24021/): Security feature bypass in debian:debian linux (high 7.5)
- [CVE-2023-24020](https://insights.sbomify.com/CVE-2023-24020/): Security feature bypass in Wattbox WB-300-IP-3 (high 7.5)
- [CVE-2023-2402](https://insights.sbomify.com/CVE-2023-2402/): Photo Gallery Slideshow & Masonry Tiled Gallery <= 1.0.13 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-24019](https://insights.sbomify.com/CVE-2023-24019/): Memory corruption in UR32L (high 8.1)
- [CVE-2023-24018](https://insights.sbomify.com/CVE-2023-24018/): Memory corruption in UR32L (high 8.8)
- [CVE-2023-24016](https://insights.sbomify.com/CVE-2023-24016/): Privilege escalation in Intel(R) Quartus(R) Prime Pro and Standard edition software for linux (medium 6.7)
- [CVE-2023-24015](https://insights.sbomify.com/CVE-2023-24015/): Partial DoS on Reports section due to null report name in Guardian/CMC before 22.6.2 (medium 5.3)
- [CVE-2023-24014](https://insights.sbomify.com/CVE-2023-24014/): Delta Electronics CNCSoft-B DOPSoft Heap-based buffer overflow (high 7.8)
- [CVE-2023-24012](https://insights.sbomify.com/CVE-2023-24012/): Data Distribution Service (DDS) Chain of Trust (CoT) violation vulnerability in Open DDS (high 8.2)
- [CVE-2023-24011](https://insights.sbomify.com/CVE-2023-24011/): Data Distribution Service (DDS) Chain of Trust (CoT) violation vulnerability in Cyclone DDS (high 8.2)
- [CVE-2023-24010](https://insights.sbomify.com/CVE-2023-24010/): Data Distribution Service (DDS) Chain of Trust (CoT) violation in Fast DDS (high 8.2)
- [CVE-2023-2401](https://insights.sbomify.com/CVE-2023-2401/): Qubotchat < 1.1.6 – Admin+ Stored XSS (medium 4.8)
- [CVE-2023-24009](https://insights.sbomify.com/CVE-2023-24009/): WordPress Upfrontwp Theme <= 1.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-24008](https://insights.sbomify.com/CVE-2023-24008/): WordPress Maspik – Spam blacklist Plugin <= 0.7.8 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-24007](https://insights.sbomify.com/CVE-2023-24007/): WordPress Admin Block Country Plugin <= 7.1.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-24006](https://insights.sbomify.com/CVE-2023-24006/): Cross-site scripting in WP Terms Popup (medium 5.9)
- [CVE-2023-24005](https://insights.sbomify.com/CVE-2023-24005/): WordPress Inline Tweet Sharer – Twitter Sharing Plugin Plugin <= 2.5.3 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-24004](https://insights.sbomify.com/CVE-2023-24004/): WordPress Image and Video Lightbox, Image PopUp Plugin <= 2.1.5 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-24003](https://insights.sbomify.com/CVE-2023-24003/): WordPress WP Popups Plugin <= 2.1.4.8 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-24002](https://insights.sbomify.com/CVE-2023-24002/): WordPress YouTube Embed, Playlist and Popup by WpDevArt Plugin <= 2.6.3 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-24001](https://insights.sbomify.com/CVE-2023-24001/): WordPress Modal Dialog Plugin <= 3.5.9 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-24000](https://insights.sbomify.com/CVE-2023-24000/): WordPress GamiPress Plugin <= 2.5.7 is vulnerable to SQL Injection (high 8.2)
- [CVE-2023-2400](https://insights.sbomify.com/CVE-2023-2400/): Information disclosure in Server (low 2.7)
- [CVE-2023-23999](https://insights.sbomify.com/CVE-2023-23999/): WordPress Google Analytics by Monster Insights Plugin <= 8.14.0 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-23998](https://insights.sbomify.com/CVE-2023-23998/): WordPress VikRentCar Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-23997](https://insights.sbomify.com/CVE-2023-23997/): WordPress Database Collation Fix Plugin <= 1.2.7 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-23996](https://insights.sbomify.com/CVE-2023-23996/): WordPress ProfilePress Plugin <= 4.5.3 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-23995](https://insights.sbomify.com/CVE-2023-23995/): WordPress TinyMCE Custom Styles Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-23994](https://insights.sbomify.com/CVE-2023-23994/): WordPress Auto Hide Admin Bar Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-23993](https://insights.sbomify.com/CVE-2023-23993/): WordPress IP Blocker Lite Plugin <= 11.1.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-23992](https://insights.sbomify.com/CVE-2023-23992/): WordPress AutomatorWP Plugin <= 2.5.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-23991](https://insights.sbomify.com/CVE-2023-23991/): WordPress Booking Calendar plugin <= 9.4.3 - SQL Injection (high 7.6)
- [CVE-2023-23990](https://insights.sbomify.com/CVE-2023-23990/): WordPress Redirection for Contact Form 7 plugin <= 2.7.0 - Privilege Escalation vulnerability (high 7.6)
- [CVE-2023-2399](https://insights.sbomify.com/CVE-2023-2399/): qubotchat < 1.1.6 - Unauthenticated Stored XSS (medium 6.1)
- [CVE-2023-23989](https://insights.sbomify.com/CVE-2023-23989/): WordPress RegistrationMagic plugin <= 5.1.9.2 - Content Injection (medium 5.3)
- [CVE-2023-23988](https://insights.sbomify.com/CVE-2023-23988/): WordPress My Tickets plugin <= 1.9.11 - Payment Bypass Vulnerability (high 7.5)
- [CVE-2023-23987](https://insights.sbomify.com/CVE-2023-23987/): WordPress User Registration Plugin <= 2.3.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-23986](https://insights.sbomify.com/CVE-2023-23986/): WordPress Reviews and Rating – Google My Business plugin <= 4.14 - Broken Access Control vulnerability (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/376/