# Vulnerabilities published in 2023


- [CVE-2023-0650](https://insights.sbomify.com/CVE-2023-0650/): YAFNET Signature cross site scripting (low 3.5)
- [CVE-2023-0649](https://insights.sbomify.com/CVE-2023-0649/): dst-admin sendBroadcast command injection (medium 6.3)
- [CVE-2023-0648](https://insights.sbomify.com/CVE-2023-0648/): dst-admin masterConsole command injection (medium 6.3)
- [CVE-2023-0647](https://insights.sbomify.com/CVE-2023-0647/): dst-admin kickPlayer command injection (medium 6.3)
- [CVE-2023-0646](https://insights.sbomify.com/CVE-2023-0646/): dst-admin cavesConsole command injection (medium 6.3)
- [CVE-2023-0645](https://insights.sbomify.com/CVE-2023-0645/): Out of Bounds read in libjxl (medium 5.3)
- [CVE-2023-0644](https://insights.sbomify.com/CVE-2023-0644/): PushAssist <= 3.0.8 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-0643](https://insights.sbomify.com/CVE-2023-0643/): Improper Handling of Additional Special Element in squidex/squidex (medium 5.4)
- [CVE-2023-0642](https://insights.sbomify.com/CVE-2023-0642/): Cross-Site Request Forgery (CSRF) in squidex/squidex (medium 6.8)
- [CVE-2023-0641](https://insights.sbomify.com/CVE-2023-0641/): PHPGurukul Employee Leaves Management System changepassword.php weak password (low 3.7)
- [CVE-2023-0640](https://insights.sbomify.com/CVE-2023-0640/): TRENDnet TEW-652BRP Web Interface ping.ccp command injection (high 7.2)
- [CVE-2023-0639](https://insights.sbomify.com/CVE-2023-0639/): TRENDnet TEW-652BRP Web Management Interface get_set.ccp cross site scripting (low 2.4)
- [CVE-2023-0638](https://insights.sbomify.com/CVE-2023-0638/): TRENDnet TEW-811DRU Web Interface command injection (high 7.2)
- [CVE-2023-0637](https://insights.sbomify.com/CVE-2023-0637/): TRENDnet TEW-811DRU Web Management Interface wan.asp memory corruption (medium 6.5)
- [CVE-2023-0636](https://insights.sbomify.com/CVE-2023-0636/): Remote Code Execution via Command Injection (high 7.2)
- [CVE-2023-0635](https://insights.sbomify.com/CVE-2023-0635/): Privilege escalation to root (high 7.8)
- [CVE-2023-0633](https://insights.sbomify.com/CVE-2023-0633/): In Docker Desktop on Windows before 4.12.0 an argument injection to installer may result in LPE (high 7.2)
- [CVE-2023-0632](https://insights.sbomify.com/CVE-2023-0632/): Inefficient Regular Expression Complexity in GitLab (medium 6.5)
- [CVE-2023-0631](https://insights.sbomify.com/CVE-2023-0631/): Paid Memberships Pro < 2.9.12 - Subscriber+ SQL Injection (high 8.8)
- [CVE-2023-0630](https://insights.sbomify.com/CVE-2023-0630/): Slimstat Analytics < 4.9.3.3 - Subscriber+ SQL Injection (high 8.8)
- [CVE-2023-0629](https://insights.sbomify.com/CVE-2023-0629/): Security feature bypass in Docker Desktop (high 7.1)
- [CVE-2023-0628](https://insights.sbomify.com/CVE-2023-0628/): Command injection in Docker Desktop (medium 6.1)
- [CVE-2023-0627](https://insights.sbomify.com/CVE-2023-0627/): Docker Desktop 4.11.x allows --no-windows-containers flag bypass (medium 6.7)
- [CVE-2023-0626](https://insights.sbomify.com/CVE-2023-0626/): Docker Desktop before 4.12.0 is vulnerable to RCE via query parameters in message-box route (high 8.0)
- [CVE-2023-0625](https://insights.sbomify.com/CVE-2023-0625/): Docker Desktop before 4.12.0 is vulnerable to RCE via a crafted extension description or changelog (high 8.0)
- [CVE-2023-0624](https://insights.sbomify.com/CVE-2023-0624/): Cross-site scripting in OrangeScrum (medium 6.1)
- [CVE-2023-0623](https://insights.sbomify.com/CVE-2023-0623/): CVE-2023-0623 (high 7.8)
- [CVE-2023-0622](https://insights.sbomify.com/CVE-2023-0622/): CVE-2023-0622 (high 7.8)
- [CVE-2023-0621](https://insights.sbomify.com/CVE-2023-0621/): CVE-2023-0621 (high 7.8)
- [CVE-2023-0620](https://insights.sbomify.com/CVE-2023-0620/): Vault Vulnerable to SQL Injection When Configuring the Microsoft SQL Database Storage Backend (medium 6.5)
- [CVE-2023-0619](https://insights.sbomify.com/CVE-2023-0619/): Kraken.io Image Optimizer <= 2.6.8 - Missing Authorization to Authenticated (Subscriber+) Plugin Options Update (medium 6.5)
- [CVE-2023-0618](https://insights.sbomify.com/CVE-2023-0618/): TRENDnet TEW-652BRP Web Service cfg_op.ccp memory corruption (high 7.5)
- [CVE-2023-0617](https://insights.sbomify.com/CVE-2023-0617/): TRENDNet TEW-811DRU httpd guestnetwork.asp buffer overflow (high 7.5)
- [CVE-2023-0616](https://insights.sbomify.com/CVE-2023-0616/): Denial of service in Thunderbird (medium 6.5)
- [CVE-2023-0615](https://insights.sbomify.com/CVE-2023-0615/): Integer overflow in Kernel (medium 5.5)
- [CVE-2023-0614](https://insights.sbomify.com/CVE-2023-0614/): Information disclosure in Samba (high 7.7)
- [CVE-2023-0613](https://insights.sbomify.com/CVE-2023-0613/): TRENDnet TEW-811DRU httpd security.asp memory corruption (high 7.5)
- [CVE-2023-0612](https://insights.sbomify.com/CVE-2023-0612/): TRENDnet TEW-811DRU httpd basic.asp buffer overflow (high 7.5)
- [CVE-2023-0611](https://insights.sbomify.com/CVE-2023-0611/): TRENDnet TEW-652BRP Web Management Interface get_set.ccp command injection (high 8.8)
- [CVE-2023-0610](https://insights.sbomify.com/CVE-2023-0610/): Improper Authorization in wallabag/wallabag (medium 5.4)
- [CVE-2023-0609](https://insights.sbomify.com/CVE-2023-0609/): Improper Authorization in wallabag/wallabag (medium 6.5)
- [CVE-2023-0608](https://insights.sbomify.com/CVE-2023-0608/): Cross-site Scripting (XSS) - DOM in microweber/microweber (medium 6.3)
- [CVE-2023-0607](https://insights.sbomify.com/CVE-2023-0607/): Cross-site Scripting (XSS) - Stored in projectsend/projectsend (high 7.2)
- [CVE-2023-0606](https://insights.sbomify.com/CVE-2023-0606/): Cross-site Scripting (XSS) - Reflected in ampache/ampache (critical 9.3)
- [CVE-2023-0605](https://insights.sbomify.com/CVE-2023-0605/): Auto Rename Media On Upload < 1.1.0 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-0604](https://insights.sbomify.com/CVE-2023-0604/): WP Food Manager < 1.0.4 - Admin+ Stored XSS (medium 5.4)
- [CVE-2023-0603](https://insights.sbomify.com/CVE-2023-0603/): Sloth Logo Customizer <= 2.0.2 - Stored XSS via CSRF (high 8.8)
- [CVE-2023-0602](https://insights.sbomify.com/CVE-2023-0602/): Twittee Text Tweet <= 1.0.8 - Reflected XSS (medium 6.1)
- [CVE-2023-0600](https://insights.sbomify.com/CVE-2023-0600/): WP Visitor Statistics (Real Time Traffic) < 6.9 - Unauthenticated SQLi (critical 9.8)
- [CVE-2023-0599](https://insights.sbomify.com/CVE-2023-0599/): Rapid7 Metasploit Pro Stored XSS (medium 6.1)
- [CVE-2023-0598](https://insights.sbomify.com/CVE-2023-0598/): GE Digital Proficy Code Injection (high 7.8)
- [CVE-2023-0597](https://insights.sbomify.com/CVE-2023-0597/): Information disclosure in Kernel (medium 5.5)
- [CVE-2023-0595](https://insights.sbomify.com/CVE-2023-0595/): Other in ClearSCADA (medium 5.3)
- [CVE-2023-0594](https://insights.sbomify.com/CVE-2023-0594/): Grafana vulnerable to Cross-site Scripting (high 7.3)
- [CVE-2023-0593](https://insights.sbomify.com/CVE-2023-0593/): Path traversal in yaffshiv (medium 5.5)
- [CVE-2023-0592](https://insights.sbomify.com/CVE-2023-0592/): Path traversal in jefferson (medium 5.5)
- [CVE-2023-0591](https://insights.sbomify.com/CVE-2023-0591/): Path Traversal in ubi_reader (medium 5.5)
- [CVE-2023-0590](https://insights.sbomify.com/CVE-2023-0590/): Use after free in Kernel (medium 4.7)
- [CVE-2023-0589](https://insights.sbomify.com/CVE-2023-0589/): WP Image Carousel <= 1.0.2 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0588](https://insights.sbomify.com/CVE-2023-0588/): Catalyst Connect Zoho CRM Client Portal < 2.1.0 - Reflected XSS (medium 6.1)
- [CVE-2023-0587](https://insights.sbomify.com/CVE-2023-0587/): File upload in Trend Micro Apex One (critical 9.1)
- [CVE-2023-0586](https://insights.sbomify.com/CVE-2023-0586/): All in One SEO Pack <= 4.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2023-0585](https://insights.sbomify.com/CVE-2023-0585/): All in One SEO Pack <= 4.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2023-0584](https://insights.sbomify.com/CVE-2023-0584/): VK Blocks <= 1.57.0.5 - Authenticated(Contributor+) Settings Update (medium 4.3)
- [CVE-2023-0583](https://insights.sbomify.com/CVE-2023-0583/): VK Blocks <= 1.57.0.5 - Authenticated(Contributor+) Settings Update (medium 4.3)
- [CVE-2023-0582](https://insights.sbomify.com/CVE-2023-0582/): Path Traversal in ForgeRock Access Managment (high 8.1)
- [CVE-2023-0581](https://insights.sbomify.com/CVE-2023-0581/): PrivateContent <= 8.4.3 - Protection Mechanism Bypass (medium 5.3)
- [CVE-2023-0580](https://insights.sbomify.com/CVE-2023-0580/): Information Disclosure vulnerability in My Control System (on-premise) (medium 5.4)
- [CVE-2023-0579](https://insights.sbomify.com/CVE-2023-0579/): YARPP - Yet Another Related Posts Plugin < 5.30.3 - Subscriber+ SQLi (high 8.8)
- [CVE-2023-0578](https://insights.sbomify.com/CVE-2023-0578/): Multiple XSS in ASOS Information Technologies' Book Cites (medium 6.1)
- [CVE-2023-0577](https://insights.sbomify.com/CVE-2023-0577/): Multiple XSS in ASOS Information Technologies' Sobiad (medium 6.1)
- [CVE-2023-0575](https://insights.sbomify.com/CVE-2023-0575/): Remote Code Execution (high 7.2)
- [CVE-2023-0574](https://insights.sbomify.com/CVE-2023-0574/): Server-Side Request Forgery (medium 6.8)
- [CVE-2023-0572](https://insights.sbomify.com/CVE-2023-0572/): Unchecked Error Condition in froxlor/froxlor (medium 5.3)
- [CVE-2023-0571](https://insights.sbomify.com/CVE-2023-0571/): SourceCodester Canteen Management System Add Customer createcustomer.php cross site scripting (low 3.5)
- [CVE-2023-0570](https://insights.sbomify.com/CVE-2023-0570/): SourceCodester Online Tours & Travels Management System payment_operation.php sql injection (medium 6.3)
- [CVE-2023-0569](https://insights.sbomify.com/CVE-2023-0569/): Weak Password Requirements in publify/publify (high 8.1)
- [CVE-2023-0568](https://insights.sbomify.com/CVE-2023-0568/): Array overrun in common path resolve code (high 7.5)
- [CVE-2023-0567](https://insights.sbomify.com/CVE-2023-0567/): password_verify() always returns true for some invalid hashes (high 7.7)
- [CVE-2023-0566](https://insights.sbomify.com/CVE-2023-0566/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in froxlor/froxlor (medium 6.2)
- [CVE-2023-0565](https://insights.sbomify.com/CVE-2023-0565/): Business Logic Errors in froxlor/froxlor (medium 5.5)
- [CVE-2023-0564](https://insights.sbomify.com/CVE-2023-0564/): Weak Password Requirements in froxlor/froxlor (medium 5.4)
- [CVE-2023-0563](https://insights.sbomify.com/CVE-2023-0563/): PHPGurukul Bank Locker Management System Assign Locker add-locker-form.php cross site scripting (low 3.5)
- [CVE-2023-0562](https://insights.sbomify.com/CVE-2023-0562/): PHPGurukul Bank Locker Management System Login index.php sql injection (high 7.3)
- [CVE-2023-0561](https://insights.sbomify.com/CVE-2023-0561/): SourceCodester Online Tours & Travels Management System s.php sql injection (medium 6.3)
- [CVE-2023-0560](https://insights.sbomify.com/CVE-2023-0560/): SourceCodester Online Tours & Travels Management System practice_pdf.php sql injection (medium 4.7)
- [CVE-2023-0559](https://insights.sbomify.com/CVE-2023-0559/): GS Portfolio for Envato < 1.4.0 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0558](https://insights.sbomify.com/CVE-2023-0558/): ContentStudio <= 1.2.5 - Authorization Bypass (high 8.2)
- [CVE-2023-0557](https://insights.sbomify.com/CVE-2023-0557/): ContentStudio <= 1.2.5 - Information Exposure (high 7.5)
- [CVE-2023-0556](https://insights.sbomify.com/CVE-2023-0556/): ContentStudio <= 1.2.5 - Missing Authorization (critical 9.8)
- [CVE-2023-0555](https://insights.sbomify.com/CVE-2023-0555/): Quick Restaurant Menu <= 2.0.2 - Missing Authorization (high 8.1)
- [CVE-2023-0554](https://insights.sbomify.com/CVE-2023-0554/): Quick Restaurant Menu <= 2.0.2 - Cross-Site Request Forgery (high 8.1)
- [CVE-2023-0553](https://insights.sbomify.com/CVE-2023-0553/): Quick Restaurant Menu <= 2.0.2 - Authenticated (Administrator+) Cross-Site Scripting (medium 4.4)
- [CVE-2023-0552](https://insights.sbomify.com/CVE-2023-0552/): Pie Register < 3.8.2.3 - Open Redirect (medium 5.4)
- [CVE-2023-0551](https://insights.sbomify.com/CVE-2023-0551/): REST API TO MiniProgram <= 4.6.1 - Subscriber+ Attachment Deletion (medium 5.4)
- [CVE-2023-0550](https://insights.sbomify.com/CVE-2023-0550/): Quick Restaurant Menu <= 2.0.2 - Insecure Direct Object Reference (high 8.1)
- [CVE-2023-0549](https://insights.sbomify.com/CVE-2023-0549/): YAFNET Private Message PostPrivateMessage cross site scripting (low 3.5)
- [CVE-2023-0548](https://insights.sbomify.com/CVE-2023-0548/): Namaste! LMS < 2.5.9.4 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-0547](https://insights.sbomify.com/CVE-2023-0547/): Security feature bypass in Thunderbird (medium 6.5)
- [CVE-2023-0546](https://insights.sbomify.com/CVE-2023-0546/): FluentForms < 4.3.25 - Contributor+ Stored XSS via Custom HTML Form Field (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/424/