# Vulnerabilities published in 2023


- [CVE-2023-0756](https://insights.sbomify.com/CVE-2023-0756/): Code injection in GitLab (medium 4.8)
- [CVE-2023-0755](https://insights.sbomify.com/CVE-2023-0755/): Memory corruption in .NET-SDK (critical 9.8)
- [CVE-2023-0754](https://insights.sbomify.com/CVE-2023-0754/): Integer overflow in .NET-SDK (critical 9.8)
- [CVE-2023-0751](https://insights.sbomify.com/CVE-2023-0751/): GELI silently omits the keyfile if read from stdin (medium 6.5)
- [CVE-2023-0750](https://insights.sbomify.com/CVE-2023-0750/): Yellowbrik PEC-1864 authentication bypass (critical 9.8)
- [CVE-2023-0749](https://insights.sbomify.com/CVE-2023-0749/): Ocean Extra < 2.1.3 - Subscriber+ Arbitrary Post Content Disclosure (medium 6.5)
- [CVE-2023-0748](https://insights.sbomify.com/CVE-2023-0748/): Open Redirect in btcpayserver/btcpayserver (medium 6.4)
- [CVE-2023-0747](https://insights.sbomify.com/CVE-2023-0747/): Cross-site Scripting (XSS) - Stored in btcpayserver/btcpayserver (medium 5.5)
- [CVE-2023-0746](https://insights.sbomify.com/CVE-2023-0746/): XSS Vulnerability in GigaVue-FM (medium 6.3)
- [CVE-2023-0745](https://insights.sbomify.com/CVE-2023-0745/): Arbitrary File Write in High Availability Backup Upload (medium 6.7)
- [CVE-2023-0744](https://insights.sbomify.com/CVE-2023-0744/): Improper Access Control in answerdev/answer (critical 9.8)
- [CVE-2023-0743](https://insights.sbomify.com/CVE-2023-0743/): Cross-site Scripting (XSS) - Generic in answerdev/answer (high 8.2)
- [CVE-2023-0742](https://insights.sbomify.com/CVE-2023-0742/): Cross-site Scripting (XSS) - Stored in answerdev/answer (high 8.0)
- [CVE-2023-0741](https://insights.sbomify.com/CVE-2023-0741/): Cross-site Scripting (XSS) - DOM in answerdev/answer (high 8.0)
- [CVE-2023-0740](https://insights.sbomify.com/CVE-2023-0740/): Cross-site Scripting (XSS) - Stored in answerdev/answer (high 8.2)
- [CVE-2023-0739](https://insights.sbomify.com/CVE-2023-0739/): Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in answerdev/answer (high 8.1)
- [CVE-2023-0738](https://insights.sbomify.com/CVE-2023-0738/): Cross-site scripting in OrangeScrum (medium 6.1)
- [CVE-2023-0737](https://insights.sbomify.com/CVE-2023-0737/): CSRF in wallabag/wallabag (medium 6.5)
- [CVE-2023-0736](https://insights.sbomify.com/CVE-2023-0736/): Cross-site Scripting (XSS) - Stored in wallabag/wallabag (medium 4.6)
- [CVE-2023-0735](https://insights.sbomify.com/CVE-2023-0735/): Cross-Site Request Forgery (CSRF) in wallabag/wallabag (medium 6.5)
- [CVE-2023-0734](https://insights.sbomify.com/CVE-2023-0734/): Improper Authorization in wallabag/wallabag (high 7.3)
- [CVE-2023-0733](https://insights.sbomify.com/CVE-2023-0733/): Newsletter Popup <= 1.2 - Unauthenticated Stored XSS (medium 6.1)
- [CVE-2023-0732](https://insights.sbomify.com/CVE-2023-0732/): SourceCodester Online Eyewear Shop POST Request Users.php registration cross site scripting (low 3.5)
- [CVE-2023-0731](https://insights.sbomify.com/CVE-2023-0731/): Interactive Geo Maps <= 1.5.9 - Authenticated (Editor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2023-0730](https://insights.sbomify.com/CVE-2023-0730/): Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_save_folder_order (medium 5.4)
- [CVE-2023-0729](https://insights.sbomify.com/CVE-2023-0729/): Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_save_sort_order (medium 5.4)
- [CVE-2023-0728](https://insights.sbomify.com/CVE-2023-0728/): Wicked Folders <= 2.18.16 - Cross-Site Request Forgery on ajax_save_folder (medium 5.4)
- [CVE-2023-0727](https://insights.sbomify.com/CVE-2023-0727/): Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_delete_folder (medium 5.4)
- [CVE-2023-0726](https://insights.sbomify.com/CVE-2023-0726/): Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_edit_folder (medium 5.4)
- [CVE-2023-0725](https://insights.sbomify.com/CVE-2023-0725/): Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_clone_folder (medium 5.4)
- [CVE-2023-0724](https://insights.sbomify.com/CVE-2023-0724/): Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_add_folder (medium 5.4)
- [CVE-2023-0723](https://insights.sbomify.com/CVE-2023-0723/): Wicked Folders <= 2.18.16 - Cross-Site Request Forgery on ajax_move_object (medium 5.4)
- [CVE-2023-0722](https://insights.sbomify.com/CVE-2023-0722/): Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_save_state (medium 5.4)
- [CVE-2023-0721](https://insights.sbomify.com/CVE-2023-0721/): Metform Elementor Contact Form Builder <= 3.3.0 - Unauthenticated CSV Injection (high 8.3)
- [CVE-2023-0720](https://insights.sbomify.com/CVE-2023-0720/): Wicked Folders <= 2.18.16 - Missing Authorization on ajax_save_folder_order (medium 5.4)
- [CVE-2023-0719](https://insights.sbomify.com/CVE-2023-0719/): Wicked Folders <= 2.18.16 - Missing Authorization on ajax_save_sort_order (medium 5.4)
- [CVE-2023-0718](https://insights.sbomify.com/CVE-2023-0718/): Wicked Folders <= 2.18.16 - Missing Authorization on ajax_save_folder (medium 5.4)
- [CVE-2023-0717](https://insights.sbomify.com/CVE-2023-0717/): Wicked Folders <= 2.18.16 - Missing Authorization via ajax_delete_folder (medium 5.4)
- [CVE-2023-0716](https://insights.sbomify.com/CVE-2023-0716/): Wicked Folders <= 2.18.16 - Missing Authorization on ajax_edit_folder (medium 5.4)
- [CVE-2023-0715](https://insights.sbomify.com/CVE-2023-0715/): Wicked Folders <= 2.18.16 - Missing Authorization on ajax_clone_folder (medium 5.4)
- [CVE-2023-0714](https://insights.sbomify.com/CVE-2023-0714/): Metform Elementor Contact Form Builder <= 3.2.4 - Unauthenticated Double-Extension Arbitrary File Upload (high 8.1)
- [CVE-2023-0713](https://insights.sbomify.com/CVE-2023-0713/): Wicked Folders <= 2.18.16 - Missing Authorization on ajax_add_folder (medium 5.4)
- [CVE-2023-0712](https://insights.sbomify.com/CVE-2023-0712/): Wicked Folders <= 2.18.16 - Missing Authorization on ajax_move_object (medium 5.4)
- [CVE-2023-0711](https://insights.sbomify.com/CVE-2023-0711/): Wicked Folders <= 2.18.16 - Missing Authorization via ajax_save_state (medium 5.4)
- [CVE-2023-0710](https://insights.sbomify.com/CVE-2023-0710/): Cross-site scripting in MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor (medium 4.9)
- [CVE-2023-0709](https://insights.sbomify.com/CVE-2023-0709/): Cross-site scripting in MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor (medium 5.4)
- [CVE-2023-0708](https://insights.sbomify.com/CVE-2023-0708/): Cross-site scripting in MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor (medium 5.4)
- [CVE-2023-0707](https://insights.sbomify.com/CVE-2023-0707/): SourceCodester Medical Certificate Generator App function.php delete_record sql injection (medium 5.5)
- [CVE-2023-0706](https://insights.sbomify.com/CVE-2023-0706/): SourceCodester Medical Certificate Generator App manage_record.php sql injection (medium 6.3)
- [CVE-2023-0705](https://insights.sbomify.com/CVE-2023-0705/): Integer overflow in Chrome (high 7.5)
- [CVE-2023-0704](https://insights.sbomify.com/CVE-2023-0704/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2023-0703](https://insights.sbomify.com/CVE-2023-0703/): Memory corruption in Chrome (high 8.8)
- [CVE-2023-0702](https://insights.sbomify.com/CVE-2023-0702/): Memory corruption in Chrome (high 8.8)
- [CVE-2023-0701](https://insights.sbomify.com/CVE-2023-0701/): Memory corruption in Chrome (high 8.8)
- [CVE-2023-0700](https://insights.sbomify.com/CVE-2023-0700/): Other in Chrome (medium 6.5)
- [CVE-2023-0699](https://insights.sbomify.com/CVE-2023-0699/): Use after free in Chrome (high 8.8)
- [CVE-2023-0698](https://insights.sbomify.com/CVE-2023-0698/): Memory corruption in Chrome (high 8.8)
- [CVE-2023-0697](https://insights.sbomify.com/CVE-2023-0697/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2023-0696](https://insights.sbomify.com/CVE-2023-0696/): Memory corruption in Chrome (high 8.8)
- [CVE-2023-0695](https://insights.sbomify.com/CVE-2023-0695/): Cross-site scripting in MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor (medium 5.4)
- [CVE-2023-0694](https://insights.sbomify.com/CVE-2023-0694/): Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf shortcode (medium 6.5)
- [CVE-2023-0693](https://insights.sbomify.com/CVE-2023-0693/): Information disclosure in MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor (medium 6.5)
- [CVE-2023-0692](https://insights.sbomify.com/CVE-2023-0692/): Information disclosure in MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor (medium 4.3)
- [CVE-2023-0691](https://insights.sbomify.com/CVE-2023-0691/): Information disclosure in MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor (medium 4.3)
- [CVE-2023-0690](https://insights.sbomify.com/CVE-2023-0690/): Boundary Workers Store Rotated Credentials in Plaintext Even When a Key Management Service Configured (medium 5.0)
- [CVE-2023-0689](https://insights.sbomify.com/CVE-2023-0689/): Information disclosure in MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor (medium 4.3)
- [CVE-2023-0688](https://insights.sbomify.com/CVE-2023-0688/): Information disclosure in MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor (medium 6.5)
- [CVE-2023-0687](https://insights.sbomify.com/CVE-2023-0687/): Memory corruption in C Library (medium 4.6)
- [CVE-2023-0686](https://insights.sbomify.com/CVE-2023-0686/): SourceCodester Online Eyewear Shop HTTP POST Request update_cart sql injection (medium 5.0)
- [CVE-2023-0685](https://insights.sbomify.com/CVE-2023-0685/): Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_unassign_folders (medium 5.4)
- [CVE-2023-0684](https://insights.sbomify.com/CVE-2023-0684/): Wicked Folders <= 2.18.16 - Missing Authorization via ajax_unassign_folders (medium 5.4)
- [CVE-2023-0683](https://insights.sbomify.com/CVE-2023-0683/): Privilege escalation in XClarity Controller (high 8.3)
- [CVE-2023-0681](https://insights.sbomify.com/CVE-2023-0681/): Rapid7 Nexpose Uncontrolled URL Redirect (medium 4.3)
- [CVE-2023-0679](https://insights.sbomify.com/CVE-2023-0679/): SourceCodester Canteen Management System removeUser.php sql injection (medium 5.0)
- [CVE-2023-0678](https://insights.sbomify.com/CVE-2023-0678/): Missing Authorization in phpipam/phpipam (high 7.5)
- [CVE-2023-0677](https://insights.sbomify.com/CVE-2023-0677/): Cross-site Scripting (XSS) - Reflected in phpipam/phpipam (medium 4.4)
- [CVE-2023-0676](https://insights.sbomify.com/CVE-2023-0676/): Cross-site Scripting (XSS) - Reflected in phpipam/phpipam (low 2.4)
- [CVE-2023-0675](https://insights.sbomify.com/CVE-2023-0675/): Calendar Event Management System sql injection (medium 6.3)
- [CVE-2023-0674](https://insights.sbomify.com/CVE-2023-0674/): XXL-JOB New Password updatePwd cross-site request forgery (medium 4.3)
- [CVE-2023-0673](https://insights.sbomify.com/CVE-2023-0673/): SourceCodester Online Eyewear Shop sql injection (medium 5.0)
- [CVE-2023-0671](https://insights.sbomify.com/CVE-2023-0671/): Code Injection in froxlor/froxlor (critical 9.9)
- [CVE-2023-0670](https://insights.sbomify.com/CVE-2023-0670/): File upload in Ulearn (high 7.2)
- [CVE-2023-0669](https://insights.sbomify.com/CVE-2023-0669/): Fortra GoAnywhere MFT Remote Code Execution (high 7.2, exploited in the wild)
- [CVE-2023-0668](https://insights.sbomify.com/CVE-2023-0668/): Wireshark IEEE-C37.118 parsing buffer overflow (medium 6.5)
- [CVE-2023-0667](https://insights.sbomify.com/CVE-2023-0667/): Wireshark MSMMS parsing buffer overflow (medium 6.5)
- [CVE-2023-0666](https://insights.sbomify.com/CVE-2023-0666/): Wireshark RTPS Parsing Buffer Overflow (medium 6.5)
- [CVE-2023-0665](https://insights.sbomify.com/CVE-2023-0665/): Vault PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata (medium 6.5)
- [CVE-2023-0664](https://insights.sbomify.com/CVE-2023-0664/): Privilege escalation in QEMU (high 7.8)
- [CVE-2023-0663](https://insights.sbomify.com/CVE-2023-0663/): Calendar Event Management System Login Page sql injection (high 7.3)
- [CVE-2023-0662](https://insights.sbomify.com/CVE-2023-0662/): DoS vulnerability when parsing multipart request body (high 7.5)
- [CVE-2023-0661](https://insights.sbomify.com/CVE-2023-0661/): Missing authorization in Devolutions Server (medium 6.5)
- [CVE-2023-0660](https://insights.sbomify.com/CVE-2023-0660/): Smart Slider 3 < 3.5.1.14 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0659](https://insights.sbomify.com/CVE-2023-0659/): BDCOM 1704-WGL Backup File param.file.tgz information disclosure (medium 5.3)
- [CVE-2023-0658](https://insights.sbomify.com/CVE-2023-0658/): Multilaser RE057/RE170 Backup File param.file.tgz information disclosure (medium 5.3)
- [CVE-2023-0657](https://insights.sbomify.com/CVE-2023-0657/): Keycloak: impersonation via logout token exchange (low 3.4)
- [CVE-2023-0656](https://insights.sbomify.com/CVE-2023-0656/): Memory corruption in SonicOS (high 7.5)
- [CVE-2023-0655](https://insights.sbomify.com/CVE-2023-0655/): Information disclosure in SonicWall Email Security (medium 5.3)
- [CVE-2023-0654](https://insights.sbomify.com/CVE-2023-0654/): Spoofing User's Activity Loads in WARP Mobile Client (Android) (low 3.9)
- [CVE-2023-0652](https://insights.sbomify.com/CVE-2023-0652/): Local Privilege Escalation in Cloudflare WARP Installer (Windows) (high 7.0)
- [CVE-2023-0651](https://insights.sbomify.com/CVE-2023-0651/): FastCMS Template Management unrestricted upload (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/423/