# Vulnerabilities published in 2023


- [CVE-2023-23985](https://insights.sbomify.com/CVE-2023-23985/): WordPress Quiz Maker plugin <= 6.3.9.4 - Content Spoofing (low 3.7)
- [CVE-2023-23984](https://insights.sbomify.com/CVE-2023-23984/): WordPress Bubble Menu – circle floating menu Plugin <= 3.0.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-23983](https://insights.sbomify.com/CVE-2023-23983/): WordPress Responsive Vertical Icon Menu Plugin <= 1.5.8 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-23982](https://insights.sbomify.com/CVE-2023-23982/): WordPress WPFrom Email Plugin <= 1.8.8 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-23981](https://insights.sbomify.com/CVE-2023-23981/): WordPress Conversational Forms for ChatBot Plugin <= 1.1.6 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-23980](https://insights.sbomify.com/CVE-2023-23980/): WordPress MailOptin Plugin <= 1.2.54.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-2398](https://insights.sbomify.com/CVE-2023-2398/): Icegram Engage < 3.1.12 - Reflected XSS (medium 6.1)
- [CVE-2023-23979](https://insights.sbomify.com/CVE-2023-23979/): WordPress Quick Event Manager Plugin <= 9.7.4 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-23978](https://insights.sbomify.com/CVE-2023-23978/): WordPress WP Client Reports Plugin <= 1.0.16 is vulnerable to Sensitive Data Exposure (medium 4.3)
- [CVE-2023-23977](https://insights.sbomify.com/CVE-2023-23977/): WordPress Heateor Social Comments Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-23976](https://insights.sbomify.com/CVE-2023-23976/): WordPress RegistrationMagic plugin <= 5.1.9.2 - Arbitrary Price Change (high 7.5)
- [CVE-2023-23975](https://insights.sbomify.com/CVE-2023-23975/): WordPress Quick Event Manager plugin <= 9.7.4 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-23974](https://insights.sbomify.com/CVE-2023-23974/): WordPress Quick Event Manager Plugin <= 9.7.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-23973](https://insights.sbomify.com/CVE-2023-23973/): WordPress Contact Us page - Contact people LITE Plugin <= 3.7.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-23972](https://insights.sbomify.com/CVE-2023-23972/): WordPress Social Like Box and Page by WpDevArt Plugin <= 0.8.39 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-23971](https://insights.sbomify.com/CVE-2023-23971/): WordPress WP Time Slots Booking Form Plugin <= 1.1.81 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-23970](https://insights.sbomify.com/CVE-2023-23970/): WordPress Corsa Theme <= 1.5 is vulnerable to Arbitrary File Upload (critical 9.9)
- [CVE-2023-2397](https://insights.sbomify.com/CVE-2023-2397/): SourceCodester Simple Mobile Comparison Website cross site scripting (low 2.4)
- [CVE-2023-23969](https://insights.sbomify.com/CVE-2023-23969/): Django contains Uncontrolled Resource Consumption via cached header (high 7.5)
- [CVE-2023-2396](https://insights.sbomify.com/CVE-2023-2396/): Netgear SRX5308 Web Management Interface cross site scripting (medium 4.3)
- [CVE-2023-23958](https://insights.sbomify.com/CVE-2023-23958/): Symantec Protection Engine Hash Leak Vulnerability (medium 6.8)
- [CVE-2023-23957](https://insights.sbomify.com/CVE-2023-23957/): Open Redirection Vulnerability in Symantec Identity Portal 14.4 (medium 5.4)
- [CVE-2023-23956](https://insights.sbomify.com/CVE-2023-23956/): Cross-site scripting in Symantec SiteMinder WebAgent (medium 6.1)
- [CVE-2023-23955](https://insights.sbomify.com/CVE-2023-23955/): Server-side request forgery in Advanced Secure Gateway, Content Analysis (high 8.1)
- [CVE-2023-23954](https://insights.sbomify.com/CVE-2023-23954/): Cross-site scripting in Advanced Secure Gateway, Content Analysis (medium 5.4)
- [CVE-2023-23953](https://insights.sbomify.com/CVE-2023-23953/): Privilege escalation in Advanced Secure Gateway, Content Analysis (high 7.8)
- [CVE-2023-23952](https://insights.sbomify.com/CVE-2023-23952/): Command injection in Advanced Secure Gateway, Content Analysis (critical 9.8)
- [CVE-2023-23951](https://insights.sbomify.com/CVE-2023-23951/): Information disclosure in Symantec Identity Management And Governance (medium 6.1)
- [CVE-2023-23950](https://insights.sbomify.com/CVE-2023-23950/): Other in Symantec Identity Management And Governance (medium 6.1)
- [CVE-2023-2395](https://insights.sbomify.com/CVE-2023-2395/): Netgear SRX5308 Web Management Interface cross site scripting (medium 4.3)
- [CVE-2023-23949](https://insights.sbomify.com/CVE-2023-23949/): Cross-site scripting in Symantec Identity Management And Governance (high 8.1)
- [CVE-2023-23948](https://insights.sbomify.com/CVE-2023-23948/): ownCloud Android app vulnerable to SQL Injection (medium 6.2)
- [CVE-2023-23947](https://insights.sbomify.com/CVE-2023-23947/): Argo CD users with any cluster secret update access may update out-of-bounds cluster secrets (critical 9.1)
- [CVE-2023-23946](https://insights.sbomify.com/CVE-2023-23946/): Git's `git apply` overwriting paths outside the working tree (medium 6.2)
- [CVE-2023-23944](https://insights.sbomify.com/CVE-2023-23944/): Nexcloud Mail app temporarily stores cleartext password in database (low 2.0)
- [CVE-2023-23943](https://insights.sbomify.com/CVE-2023-23943/): Blind SSRF via server URL input in the Nextcloud Mail app (medium 5.0)
- [CVE-2023-23942](https://insights.sbomify.com/CVE-2023-23942/): Self reflected HTML injection in Desktop client (medium 5.4)
- [CVE-2023-23941](https://insights.sbomify.com/CVE-2023-23941/): SwagPayPal payment not sent to PayPal correctly (high 7.5)
- [CVE-2023-23940](https://insights.sbomify.com/CVE-2023-23940/): OpenZeppelin Contracts for Cairo is vulnerable to signature validation bypass (medium 6.4)
- [CVE-2023-2394](https://insights.sbomify.com/CVE-2023-2394/): Netgear SRX5308 Web Management Interface cross site scripting (low 2.4)
- [CVE-2023-23939](https://insights.sbomify.com/CVE-2023-23939/): Azure/setup-kubectl: Escalation of privilege vulnerability for v3 and lower (low 3.9)
- [CVE-2023-23938](https://insights.sbomify.com/CVE-2023-23938/): Cross-site Scripting (XSS) through the name of a color of select box values in tuleap (medium 5.9)
- [CVE-2023-23937](https://insights.sbomify.com/CVE-2023-23937/): Missing file upload type validation in pimcore/pimcore (high 8.2)
- [CVE-2023-23936](https://insights.sbomify.com/CVE-2023-23936/): CRLF Injection in Nodejs ‘undici’ via host (medium 6.5)
- [CVE-2023-23935](https://insights.sbomify.com/CVE-2023-23935/): Presence of restricted personal Discourse messages may be leaked if tagged with a tag (low 3.5)
- [CVE-2023-23934](https://insights.sbomify.com/CVE-2023-23934/): Wrkzeug's incorrect parsing of nameless cookies leads to __Host- cookies bypass (low 2.6)
- [CVE-2023-23933](https://insights.sbomify.com/CVE-2023-23933/): Issue in Anomaly Detection with document and field level rules in numerical feature aggregations (medium 5.7)
- [CVE-2023-23932](https://insights.sbomify.com/CVE-2023-23932/): Specially crafted RTPS message may cause an OpenDDS application to crash (medium 5.3)
- [CVE-2023-23931](https://insights.sbomify.com/CVE-2023-23931/): Cipher.update_into can corrupt memory in pyca cryptography (medium 4.8)
- [CVE-2023-23930](https://insights.sbomify.com/CVE-2023-23930/): vantage6's Pickle serialization is insecure (medium 5.5)
- [CVE-2023-2393](https://insights.sbomify.com/CVE-2023-2393/): Netgear SRX5308 Web Management Interface cross site scripting (low 2.4)
- [CVE-2023-23929](https://insights.sbomify.com/CVE-2023-23929/): Refresh tokens do not expire in Vantage6 (high 8.8)
- [CVE-2023-23928](https://insights.sbomify.com/CVE-2023-23928/): reason-jose ignores signature checks (medium 5.9)
- [CVE-2023-23927](https://insights.sbomify.com/CVE-2023-23927/): Craft CMS stored cross-site scripting vulnerability (medium 6.1)
- [CVE-2023-23926](https://insights.sbomify.com/CVE-2023-23926/): XML External Entity (XXE) vulnerability in apoc.import.graphml (medium 5.9)
- [CVE-2023-23925](https://insights.sbomify.com/CVE-2023-23925/): Switcher Client contains Regular Expression Denial of Service (ReDoS) (high 8.6)
- [CVE-2023-23924](https://insights.sbomify.com/CVE-2023-23924/): URI validation failure on SVG parsing in Dompdf (critical 10.0)
- [CVE-2023-23923](https://insights.sbomify.com/CVE-2023-23923/): Moodle: possible to set the preferred "start page" of other users (high 8.2)
- [CVE-2023-23922](https://insights.sbomify.com/CVE-2023-23922/): Moodle: reflected xss risk in blog search (medium 6.1)
- [CVE-2023-23921](https://insights.sbomify.com/CVE-2023-23921/): Moodle: reflected xss risk in some returnurl parameters (medium 6.1)
- [CVE-2023-23920](https://insights.sbomify.com/CVE-2023-23920/): Other in Node (medium 4.2)
- [CVE-2023-2392](https://insights.sbomify.com/CVE-2023-2392/): Netgear SRX5308 Web Management Interface cross site scripting (low 2.4)
- [CVE-2023-23919](https://insights.sbomify.com/CVE-2023-23919/): Other in Node (high 7.5)
- [CVE-2023-23918](https://insights.sbomify.com/CVE-2023-23918/): Security feature bypass in Node (high 7.5)
- [CVE-2023-23917](https://insights.sbomify.com/CVE-2023-23917/): Code injection in Rocket.chat (high 8.8)
- [CVE-2023-23916](https://insights.sbomify.com/CVE-2023-23916/): Denial of service in https://github.com/curl/curl (medium 6.5)
- [CVE-2023-23915](https://insights.sbomify.com/CVE-2023-23915/): Race condition in https://github.com/curl/curl (medium 6.5)
- [CVE-2023-23914](https://insights.sbomify.com/CVE-2023-23914/): Security feature bypass in https://github.com/curl/curl (critical 9.1)
- [CVE-2023-23913](https://insights.sbomify.com/CVE-2023-23913/): rails-ujs vulnerable to DOM Based Cross-site Scripting contenteditable HTML Elements (medium 6.3)
- [CVE-2023-23912](https://insights.sbomify.com/CVE-2023-23912/): Code injection in Ubiquiti EdgeRouter(s) and USG(s) (high 8.8)
- [CVE-2023-23911](https://insights.sbomify.com/CVE-2023-23911/): Missing authorization in Rocket.Chat (high 7.5)
- [CVE-2023-23910](https://insights.sbomify.com/CVE-2023-23910/): Memory corruption in Intel(R) Trace Analyzer and Collector software (low 3.9)
- [CVE-2023-2391](https://insights.sbomify.com/CVE-2023-2391/): Netgear SRX5308 Web Management Interface cross site scripting (low 2.4)
- [CVE-2023-23909](https://insights.sbomify.com/CVE-2023-23909/): Memory corruption in Intel(R) Trace Analyzer and Collector software (low 2.8)
- [CVE-2023-23908](https://insights.sbomify.com/CVE-2023-23908/): Missing authorization in 3rd Generation Intel(R) Xeon(R) Scalable processors (medium 6.0)
- [CVE-2023-23907](https://insights.sbomify.com/CVE-2023-23907/): Path traversal in MilesightVPN (high 7.5)
- [CVE-2023-23906](https://insights.sbomify.com/CVE-2023-23906/): Missing authorization in SkyBridge MB-A100/110 (high 7.5)
- [CVE-2023-23904](https://insights.sbomify.com/CVE-2023-23904/): Null dereference in UEFI firmware for some Intel(R) Processors (medium 6.9)
- [CVE-2023-23903](https://insights.sbomify.com/CVE-2023-23903/): DoS via SAML configuration in Guardian/CMC before 22.6.2 (medium 6.9)
- [CVE-2023-23902](https://insights.sbomify.com/CVE-2023-23902/): Memory corruption in UR32L (critical 9.8)
- [CVE-2023-23901](https://insights.sbomify.com/CVE-2023-23901/): Security feature bypass in SkyBridge MB-A200 and SkyBridge BASIC MB-A130 (medium 4.8)
- [CVE-2023-23900](https://insights.sbomify.com/CVE-2023-23900/): WordPress Easy Forms for Mailchimp Plugin <= 6.8.8 is vulnerable to Cross Site Scripting (XSS) (medium 5.8)
- [CVE-2023-2390](https://insights.sbomify.com/CVE-2023-2390/): Netgear SRX5308 Web Management Interface cross site scripting (low 2.4)
- [CVE-2023-23899](https://insights.sbomify.com/CVE-2023-23899/): WordPress Extensions For CF7 Plugin <= 2.0.8 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-23898](https://insights.sbomify.com/CVE-2023-23898/): WordPress Blocksy Companion Plugin <= 1.8.67 is vulnerable to Cross Site Scripting (XSS) (medium 5.5)
- [CVE-2023-23897](https://insights.sbomify.com/CVE-2023-23897/): WordPress Simple Mobile URL Redirect Plugin <= 1.7.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-23896](https://insights.sbomify.com/CVE-2023-23896/): WordPress URL Shortener by MyThemeShop Plugin <= 1.0.17 is vulnerable to Broken Access Control (medium 5.4)
- [CVE-2023-23895](https://insights.sbomify.com/CVE-2023-23895/): WordPress WP Time Slots Booking Form plugin <= 1.1.82 - Broken Access Control vulnerability (medium 4.7)
- [CVE-2023-23894](https://insights.sbomify.com/CVE-2023-23894/): WordPress Surbma | GDPR Proof Cookie Consent & Notice Bar Plugin <= 17.5.3 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-23893](https://insights.sbomify.com/CVE-2023-23893/): WordPress Simple Giveaways plugin <= 2.48.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-23892](https://insights.sbomify.com/CVE-2023-23892/): WordPress M Chart Plugin <= 1.9.4 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-23891](https://insights.sbomify.com/CVE-2023-23891/): WordPress Ocean Extra Plugin <= 2.1.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.5)
- [CVE-2023-23890](https://insights.sbomify.com/CVE-2023-23890/): WordPress WP Airbnb Review Slider Plugin <= 3.2 is vulnerable to Cross Site Request Forgery (CSRF) (high 7.1)
- [CVE-2023-2389](https://insights.sbomify.com/CVE-2023-2389/): Netgear SRX5308 Web Management Interface cross site scripting (low 2.4)
- [CVE-2023-23889](https://insights.sbomify.com/CVE-2023-23889/): WordPress Quick Paypal Payments Plugin <= 5.7.25 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-23888](https://insights.sbomify.com/CVE-2023-23888/): WordPress Rank Math SEO plugin <= 1.0.107.2 - Local File Inclusion vulnerability (high 7.6)
- [CVE-2023-23887](https://insights.sbomify.com/CVE-2023-23887/): WordPress Easy Google Analytics for WordPress plugin <= 1.6.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-23886](https://insights.sbomify.com/CVE-2023-23886/): WordPress WP-RecentComments plugin <= 2.2.7 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-23885](https://insights.sbomify.com/CVE-2023-23885/): WordPress Quick Contact Form Plugin <= 8.0.3.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-23884](https://insights.sbomify.com/CVE-2023-23884/): WordPress Kanban Boards for WordPress Plugin <= 2.5.20 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/377/