# Vulnerabilities published in 2023


- [CVE-2023-1932](https://insights.sbomify.com/CVE-2023-1932/): Hibernate-validator: rendering of invalid html with safehtml leads to html injection and xss (medium 6.1)
- [CVE-2023-1931](https://insights.sbomify.com/CVE-2023-1931/): WP Fastest Cache <= 1.1.2 - Missing Authorization in 'deleteCssAndJsCacheToolbar' (medium 4.3)
- [CVE-2023-1930](https://insights.sbomify.com/CVE-2023-1930/): WP Fastest Cache <= 1.1.2 - Missing Authorization in 'wpfc_clear_cache_of_allsites_callback' (medium 4.3)
- [CVE-2023-1929](https://insights.sbomify.com/CVE-2023-1929/): WP Fastest Cache <= 1.1.2 - Missing Authorization in 'wpfc_purgecache_varnish_callback' (medium 4.3)
- [CVE-2023-1928](https://insights.sbomify.com/CVE-2023-1928/): WP Fastest Cache <= 1.1.2 - Missing Authorization in 'wpfc_preload_single_callback' (medium 4.3)
- [CVE-2023-1927](https://insights.sbomify.com/CVE-2023-1927/): WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'deleteCssAndJsCacheToolbar' (medium 4.3)
- [CVE-2023-1926](https://insights.sbomify.com/CVE-2023-1926/): WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'deleteCacheToolbar' (medium 4.3)
- [CVE-2023-1925](https://insights.sbomify.com/CVE-2023-1925/): WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'wpfc_clear_cache_of_allsites_callback' (medium 4.3)
- [CVE-2023-1924](https://insights.sbomify.com/CVE-2023-1924/): WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'wpfc_toolbar_save_settings_callback' (medium 4.3)
- [CVE-2023-1923](https://insights.sbomify.com/CVE-2023-1923/): WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'wpfc_remove_cdn_integration_ajax_request_callback' (medium 4.3)
- [CVE-2023-1922](https://insights.sbomify.com/CVE-2023-1922/): WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'wpfc_pause_cdn_integration_ajax_request_callback' (medium 4.3)
- [CVE-2023-1921](https://insights.sbomify.com/CVE-2023-1921/): WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'wpfc_start_cdn_integration_ajax_request_callback' (medium 4.3)
- [CVE-2023-1920](https://insights.sbomify.com/CVE-2023-1920/): WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'wpfc_purgecache_varnish_callback' (medium 4.3)
- [CVE-2023-1919](https://insights.sbomify.com/CVE-2023-1919/): WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'wpfc_preload_single_save_settings_callback' (medium 4.3)
- [CVE-2023-1918](https://insights.sbomify.com/CVE-2023-1918/): WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'wpfc_preload_single_callback' (medium 4.3)
- [CVE-2023-1917](https://insights.sbomify.com/CVE-2023-1917/): PowerPress <= 10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 5.4)
- [CVE-2023-1916](https://insights.sbomify.com/CVE-2023-1916/): Memory corruption in libtiff (medium 6.1)
- [CVE-2023-1915](https://insights.sbomify.com/CVE-2023-1915/): Thumbnail carousel slider < 1.1.10 - Reflected XSS (medium 6.1)
- [CVE-2023-1913](https://insights.sbomify.com/CVE-2023-1913/): Maps Widget for Google Maps <= 4.24 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2023-1912](https://insights.sbomify.com/CVE-2023-1912/): Limit Login Attempts <= 1.7.1 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2023-1911](https://insights.sbomify.com/CVE-2023-1911/): Blocksy Companion < 1.8.82 - Subscriber+ Draft Post Access (medium 4.3)
- [CVE-2023-1910](https://insights.sbomify.com/CVE-2023-1910/): Getwid – Gutenberg Blocks <= 1.8.3 - Improper Authorization via get_remote_templates REST endpoint (medium 4.3)
- [CVE-2023-1909](https://insights.sbomify.com/CVE-2023-1909/): PHPGurukul BP Monitoring Management System User Profile Update profile.php sql injection (medium 4.7)
- [CVE-2023-1908](https://insights.sbomify.com/CVE-2023-1908/): SourceCodester Simple Mobile Comparison Website GET Parameter view_category.php sql injection (medium 6.3)
- [CVE-2023-1907](https://insights.sbomify.com/CVE-2023-1907/): Pgadmin: users authenticated simultaneously via ldap may be attached to the wrong session (high 8.0)
- [CVE-2023-1906](https://insights.sbomify.com/CVE-2023-1906/): Memory corruption in ImageMagick (medium 5.5)
- [CVE-2023-1905](https://insights.sbomify.com/CVE-2023-1905/): WP Popups < 2.1.5.1 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-1904](https://insights.sbomify.com/CVE-2023-1904/): Information disclosure in Octopus Server (medium 4.2)
- [CVE-2023-1903](https://insights.sbomify.com/CVE-2023-1903/): Missing Authorization check in SAP HCM Fiori App My Forms (Fiori 2.0) (medium 4.3)
- [CVE-2023-1902](https://insights.sbomify.com/CVE-2023-1902/): HCI Connection Creation Dangling State Reference Re-use (medium 5.9)
- [CVE-2023-1901](https://insights.sbomify.com/CVE-2023-1901/): HCI send_sync Dangling Semaphore Reference Re-use (medium 5.9)
- [CVE-2023-1900](https://insights.sbomify.com/CVE-2023-1900/): Integer overflow in Avira Antivirus (high 7.8)
- [CVE-2023-1899](https://insights.sbomify.com/CVE-2023-1899/): CVE-2023-1899 (critical 9.4)
- [CVE-2023-1898](https://insights.sbomify.com/CVE-2023-1898/): CVE-2023-1898 (critical 9.4)
- [CVE-2023-1897](https://insights.sbomify.com/CVE-2023-1897/): CVE-2023-1897 (critical 9.4)
- [CVE-2023-1895](https://insights.sbomify.com/CVE-2023-1895/): Getwid – Gutenberg Blocks <= 1.8.3 - Authenticated(Subscriber+) Server Side Request Forgery (high 8.5)
- [CVE-2023-1894](https://insights.sbomify.com/CVE-2023-1894/): Denial of service in Puppet Enterprise (medium 5.3)
- [CVE-2023-1893](https://insights.sbomify.com/CVE-2023-1893/): Login Configurator <= 2.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-1892](https://insights.sbomify.com/CVE-2023-1892/): Cross-site Scripting (XSS) - Reflected in sidekiq/sidekiq (high 8.3)
- [CVE-2023-1891](https://insights.sbomify.com/CVE-2023-1891/): Accordion & FAQ < 1.9.9 - Reflected XSS (medium 6.1)
- [CVE-2023-1890](https://insights.sbomify.com/CVE-2023-1890/): Tablesome < 1.0.9 - Reflected XSS (medium 6.1)
- [CVE-2023-1889](https://insights.sbomify.com/CVE-2023-1889/): Missing authorization in Directorist: AI-Powered Business Directory, Listings & Classified Ads (medium 6.5)
- [CVE-2023-1888](https://insights.sbomify.com/CVE-2023-1888/): Directorist <= 7.5.4 - Authenticated (Subscriber+) Arbitrary User Password Reset to Privilege Escalation (high 8.8)
- [CVE-2023-1887](https://insights.sbomify.com/CVE-2023-1887/): Business Logic Errors in thorsten/phpmyfaq (high 8.3)
- [CVE-2023-1886](https://insights.sbomify.com/CVE-2023-1886/): Authentication Bypass by Capture-replay in thorsten/phpmyfaq (high 7.3)
- [CVE-2023-1885](https://insights.sbomify.com/CVE-2023-1885/): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (medium 6.3)
- [CVE-2023-1884](https://insights.sbomify.com/CVE-2023-1884/): Cross-site Scripting (XSS) - Generic in thorsten/phpmyfaq (medium 4.7)
- [CVE-2023-1883](https://insights.sbomify.com/CVE-2023-1883/): Improper Access Control in thorsten/phpmyfaq (medium 5.4)
- [CVE-2023-1882](https://insights.sbomify.com/CVE-2023-1882/): Cross-site Scripting (XSS) - DOM in thorsten/phpmyfaq (high 8.1)
- [CVE-2023-1881](https://insights.sbomify.com/CVE-2023-1881/): Cross-site Scripting (XSS) - Stored in microweber/microweber (high 7.4)
- [CVE-2023-1880](https://insights.sbomify.com/CVE-2023-1880/): Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq (high 8.3)
- [CVE-2023-1879](https://insights.sbomify.com/CVE-2023-1879/): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (medium 4.7)
- [CVE-2023-1878](https://insights.sbomify.com/CVE-2023-1878/): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (high 8.3)
- [CVE-2023-1877](https://insights.sbomify.com/CVE-2023-1877/): Command Injection in microweber/microweber (medium 6.1)
- [CVE-2023-1875](https://insights.sbomify.com/CVE-2023-1875/): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (medium 5.4)
- [CVE-2023-1874](https://insights.sbomify.com/CVE-2023-1874/): WP Data Access <= 5.3.7 - Authenticated (Subscriber+) Privilege Escalation (high 7.5)
- [CVE-2023-1873](https://insights.sbomify.com/CVE-2023-1873/): SQLi in Bircard (critical 9.8)
- [CVE-2023-1872](https://insights.sbomify.com/CVE-2023-1872/): Use-after-free in Linux kernel's io_uring subsystem (high 7.8)
- [CVE-2023-1871](https://insights.sbomify.com/CVE-2023-1871/): YourChannel <= 1.2.4 - Cross-Site Request Forgery to Plugin Language Translation Reset (medium 5.4)
- [CVE-2023-1870](https://insights.sbomify.com/CVE-2023-1870/): YourChannel <= 1.2.4 - Cross-Site Request Forgery to Plugin Language Translation Update (medium 4.3)
- [CVE-2023-1869](https://insights.sbomify.com/CVE-2023-1869/): YourChannel <= 1.2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 5.5)
- [CVE-2023-1868](https://insights.sbomify.com/CVE-2023-1868/): YourChannel <= 1.2.3 - Missing Authorization to Plugin Cache Reset (medium 6.5)
- [CVE-2023-1867](https://insights.sbomify.com/CVE-2023-1867/): YourChannel <= 1.2.4 - Cross-Site Request Forgery to Plugin Settings Change (medium 5.4)
- [CVE-2023-1866](https://insights.sbomify.com/CVE-2023-1866/): YourChannel <= 1.2.4 - Cross-Site Request Forgery to Plugin Channel Reset (medium 5.4)
- [CVE-2023-1865](https://insights.sbomify.com/CVE-2023-1865/): YourChannel <= 1.2.3 - Missing Authorization to Plugin Settings Reset (medium 6.5)
- [CVE-2023-1864](https://insights.sbomify.com/CVE-2023-1864/): FANUC ROBOGUIDE-HandlingPRO Path Traversal (medium 6.8)
- [CVE-2023-1863](https://insights.sbomify.com/CVE-2023-1863/): SQLi in Eskom Computer Water Metering Software (critical 9.8)
- [CVE-2023-1862](https://insights.sbomify.com/CVE-2023-1862/): Remote access to warp-svc.exe in Cloudflare WARP (high 7.3)
- [CVE-2023-1861](https://insights.sbomify.com/CVE-2023-1861/): Limit Login Attempts < 1.7.2 - Subscriber+ Stored XSS (medium 5.4)
- [CVE-2023-1860](https://insights.sbomify.com/CVE-2023-1860/): Keysight IXIA Hawkeye licenses cross site scripting (low 3.5)
- [CVE-2023-1859](https://insights.sbomify.com/CVE-2023-1859/): Use after free in Kernel (medium 4.7)
- [CVE-2023-1858](https://insights.sbomify.com/CVE-2023-1858/): SourceCodester Earnings and Expense Tracker App index.php information disclosure (medium 4.3)
- [CVE-2023-1857](https://insights.sbomify.com/CVE-2023-1857/): SourceCodester Online Computer and Laptop Store cross site scripting (low 2.4)
- [CVE-2023-1856](https://insights.sbomify.com/CVE-2023-1856/): SourceCodester Air Cargo Management System GET Parameter track_shipment.php sql injection (medium 6.3)
- [CVE-2023-1855](https://insights.sbomify.com/CVE-2023-1855/): Use after free in Kernel (medium 6.3)
- [CVE-2023-1854](https://insights.sbomify.com/CVE-2023-1854/): SourceCodester Online Graduate Tracer System session expiration (medium 4.7)
- [CVE-2023-1853](https://insights.sbomify.com/CVE-2023-1853/): SourceCodester Online Payroll System employee_edit.php cross site scripting (low 3.5)
- [CVE-2023-1852](https://insights.sbomify.com/CVE-2023-1852/): SourceCodester Online Payroll System deduction_edit.php cross site scripting (low 3.5)
- [CVE-2023-1851](https://insights.sbomify.com/CVE-2023-1851/): SourceCodester Online Payroll System employee_add.php cross site scripting (low 3.5)
- [CVE-2023-1850](https://insights.sbomify.com/CVE-2023-1850/): SourceCodester Online Payroll System login.php sql injection (medium 6.3)
- [CVE-2023-1849](https://insights.sbomify.com/CVE-2023-1849/): SourceCodester Online Payroll System cashadvance_row.php sql injection (medium 6.3)
- [CVE-2023-1848](https://insights.sbomify.com/CVE-2023-1848/): SourceCodester Online Payroll System attendance_row.php sql injection (medium 6.3)
- [CVE-2023-1847](https://insights.sbomify.com/CVE-2023-1847/): SourceCodester Online Payroll System attendance.php sql injection (medium 6.3)
- [CVE-2023-1846](https://insights.sbomify.com/CVE-2023-1846/): SourceCodester Online Payroll System deduction_row.php sql injection (medium 6.3)
- [CVE-2023-1845](https://insights.sbomify.com/CVE-2023-1845/): SourceCodester Online Payroll System employee_row.php sql injection (medium 6.3)
- [CVE-2023-1844](https://insights.sbomify.com/CVE-2023-1844/): Subscribe2 <= 10.40 - Missing Authorization (medium 4.3)
- [CVE-2023-1843](https://insights.sbomify.com/CVE-2023-1843/): Metform Elementor Contact Form Builder <= 3.3.0 - Missing Authorization (medium 6.5)
- [CVE-2023-1841](https://insights.sbomify.com/CVE-2023-1841/): Honeywell MPA2 Web Application XSS vulnerability (high 8.1)
- [CVE-2023-1840](https://insights.sbomify.com/CVE-2023-1840/): Sp*tify Play Button for WordPress <= 2.07 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2023-1839](https://insights.sbomify.com/CVE-2023-1839/): Product Addons & Fields for WooCommerce < 32.0.6 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2023-1838](https://insights.sbomify.com/CVE-2023-1838/): Use after free in Kernel (high 7.1)
- [CVE-2023-1837](https://insights.sbomify.com/CVE-2023-1837/): Auth bypass in HYPR Server (high 8.5)
- [CVE-2023-1836](https://insights.sbomify.com/CVE-2023-1836/): Cross-site scripting in GitLab (medium 4.4)
- [CVE-2023-1835](https://insights.sbomify.com/CVE-2023-1835/): Ninja Forms < 3.6.22 - Reflected XSS (medium 6.1)
- [CVE-2023-1834](https://insights.sbomify.com/CVE-2023-1834/): Rockwell Automation Kinetix 5500 Vulnerable to Open Port Exploitation (critical 9.4)
- [CVE-2023-1833](https://insights.sbomify.com/CVE-2023-1833/): Authentication Bypass in Redline Router (critical 9.8)
- [CVE-2023-1832](https://insights.sbomify.com/CVE-2023-1832/): Improper authorization check in the server component (medium 6.8)
- [CVE-2023-1831](https://insights.sbomify.com/CVE-2023-1831/): User password logged in audit logs (high 7.2)
- [CVE-2023-1829](https://insights.sbomify.com/CVE-2023-1829/): Use-after-free in tcindex (traffic control index filter) in the Linux Kernel (high 7.8)
- [CVE-2023-1827](https://insights.sbomify.com/CVE-2023-1827/): SourceCodester Centralized Covid Vaccination Records System GET Parameter manage_location.php sql injection (medium 6.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/412/