# Vulnerabilities published in 2023


- [CVE-2023-0439](https://insights.sbomify.com/CVE-2023-0439/): NEX-Forms < 8.4.4 - Authenticated Stored XSS (medium 5.4)
- [CVE-2023-0438](https://insights.sbomify.com/CVE-2023-0438/): Cross-Site Request Forgery (CSRF) in modoboa/modoboa (medium 5.4)
- [CVE-2023-0437](https://insights.sbomify.com/CVE-2023-0437/): MongoDB client C Driver may infinitely loop when validating certain BSON input data (medium 5.3)
- [CVE-2023-0436](https://insights.sbomify.com/CVE-2023-0436/): Secret logging may occur in debug mode of Atlas Operator (medium 4.5)
- [CVE-2023-0435](https://insights.sbomify.com/CVE-2023-0435/): Excessive Attack Surface in pyload/pyload (medium 4.0)
- [CVE-2023-0434](https://insights.sbomify.com/CVE-2023-0434/): Improper Input Validation in pyload/pyload (medium 5.4)
- [CVE-2023-0433](https://insights.sbomify.com/CVE-2023-0433/): Heap-based Buffer Overflow in vim/vim (high 7.8)
- [CVE-2023-0432](https://insights.sbomify.com/CVE-2023-0432/): CVE-2023-0432 (critical 9.0)
- [CVE-2023-0431](https://insights.sbomify.com/CVE-2023-0431/): File Away <= 3.9.9.0.1 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2023-0430](https://insights.sbomify.com/CVE-2023-0430/): Security feature bypass in Thunderbird (medium 6.5)
- [CVE-2023-0429](https://insights.sbomify.com/CVE-2023-0429/): Watu Quiz < 3.3.8.3 - Admin+ Stored XSS (low 3.5)
- [CVE-2023-0428](https://insights.sbomify.com/CVE-2023-0428/): Watu Quiz < 3.3.8.2 - Reflected XSS (high 7.5)
- [CVE-2023-0426](https://insights.sbomify.com/CVE-2023-0426/): Stack overflow in filename or in boundary (high 8.6)
- [CVE-2023-0425](https://insights.sbomify.com/CVE-2023-0425/): Buffer overflow in global memory region (high 8.6)
- [CVE-2023-0424](https://insights.sbomify.com/CVE-2023-0424/): MS-Reviews <= 1.5 - Subscriber+ Stored XSS (medium 5.4)
- [CVE-2023-0423](https://insights.sbomify.com/CVE-2023-0423/): WordPress Amazon S3 Plugin < 1.6 - Reflected XSS (medium 4.8)
- [CVE-2023-0422](https://insights.sbomify.com/CVE-2023-0422/): Article Directory <= 1.3 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-0421](https://insights.sbomify.com/CVE-2023-0421/): Cloud Manager <= 1.0 - Reflected XSS (medium 6.1)
- [CVE-2023-0420](https://insights.sbomify.com/CVE-2023-0420/): Custom Post Type and Taxonomy GUI Manager <= 1.1 - Stored XSS via CSRF (medium 4.8)
- [CVE-2023-0419](https://insights.sbomify.com/CVE-2023-0419/): Shortcode for Font Awesome < 1.4.1 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0418](https://insights.sbomify.com/CVE-2023-0418/): Video Central for WordPress <= 1.3.0 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0417](https://insights.sbomify.com/CVE-2023-0417/): Denial of service in Wireshark (medium 6.3)
- [CVE-2023-0416](https://insights.sbomify.com/CVE-2023-0416/): Denial of service in Wireshark (medium 6.3)
- [CVE-2023-0415](https://insights.sbomify.com/CVE-2023-0415/): Denial of service in Wireshark (medium 6.3)
- [CVE-2023-0414](https://insights.sbomify.com/CVE-2023-0414/): Denial of service in Wireshark (medium 6.3)
- [CVE-2023-0413](https://insights.sbomify.com/CVE-2023-0413/): Denial of service in Wireshark (medium 6.3)
- [CVE-2023-0412](https://insights.sbomify.com/CVE-2023-0412/): Denial of service in Wireshark (medium 6.3)
- [CVE-2023-0411](https://insights.sbomify.com/CVE-2023-0411/): Denial of service in Wireshark (medium 6.3)
- [CVE-2023-0410](https://insights.sbomify.com/CVE-2023-0410/): Cross-site Scripting (XSS) - Generic in builderio/qwik (medium 6.1)
- [CVE-2023-0406](https://insights.sbomify.com/CVE-2023-0406/): Cross-Site Request Forgery (CSRF) in modoboa/modoboa (medium 5.4)
- [CVE-2023-0405](https://insights.sbomify.com/CVE-2023-0405/): GPT3 AI Content Writer < 1.4.38 - Subscriber+ Arbitrary Post Content Update (medium 5.4)
- [CVE-2023-0404](https://insights.sbomify.com/CVE-2023-0404/): Events Made Easy <= 2.3.16 - Missing Authorization (medium 5.4)
- [CVE-2023-0403](https://insights.sbomify.com/CVE-2023-0403/): Social Warfare <= 4.3.1 - Cross-Site Request Forgery (medium 5.4)
- [CVE-2023-0402](https://insights.sbomify.com/CVE-2023-0402/): Social Warfare <= 4.3.0 - Missing Authorization (medium 5.4)
- [CVE-2023-0401](https://insights.sbomify.com/CVE-2023-0401/): NULL dereference during PKCS7 data verification (high 7.5)
- [CVE-2023-0400](https://insights.sbomify.com/CVE-2023-0400/): Security feature bypass in Data Loss Prevention (DLP) (medium 5.9)
- [CVE-2023-0399](https://insights.sbomify.com/CVE-2023-0399/): Image Over Image For WPBakery Page Builder < 3.0 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0398](https://insights.sbomify.com/CVE-2023-0398/): Cross-Site Request Forgery (CSRF) in modoboa/modoboa (medium 5.4)
- [CVE-2023-0397](https://insights.sbomify.com/CVE-2023-0397/): DoS: Invalid Initialization in le_read_buffer_size_complete (critical 9.6)
- [CVE-2023-0396](https://insights.sbomify.com/CVE-2023-0396/): Buffer Overreads in Bluetooth HCI (medium 6.8)
- [CVE-2023-0395](https://insights.sbomify.com/CVE-2023-0395/): menu shortcode <= 1.0 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2023-0394](https://insights.sbomify.com/CVE-2023-0394/): Null dereference in Kernel (medium 5.5)
- [CVE-2023-0392](https://insights.sbomify.com/CVE-2023-0392/): Privilege escalation in LDAP Agent (low 3.9)
- [CVE-2023-0391](https://insights.sbomify.com/CVE-2023-0391/): MGT-COMMERCE CloudPanel Shared Certificate (high 8.1)
- [CVE-2023-0389](https://insights.sbomify.com/CVE-2023-0389/): Calculated Fields Form < 1.1.151 - Admin+ Stored Cross-Site Scripting via Dropdown Fields (medium 4.8)
- [CVE-2023-0388](https://insights.sbomify.com/CVE-2023-0388/): Random Text <= 0.3.0 - Subscriber+ SQLi (high 8.8)
- [CVE-2023-0386](https://insights.sbomify.com/CVE-2023-0386/): Linux Kernel Improper Ownership Management (high 7.8, exploited in the wild)
- [CVE-2023-0385](https://insights.sbomify.com/CVE-2023-0385/): Custom 404 Pro <= 3.7.1 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2023-0384](https://insights.sbomify.com/CVE-2023-0384/): Uncontrolled Resource Consuption in M-Files Server (medium 6.5)
- [CVE-2023-0383](https://insights.sbomify.com/CVE-2023-0383/): Uncontrolled Resource Consuption in M-Files Server (high 7.5)
- [CVE-2023-0382](https://insights.sbomify.com/CVE-2023-0382/): Uncontrolled Resource Consumption in M-Files Server (medium 6.5)
- [CVE-2023-0381](https://insights.sbomify.com/CVE-2023-0381/): GigPress <= 2.3.28 - Subscriber+ SQLi (high 8.8)
- [CVE-2023-0380](https://insights.sbomify.com/CVE-2023-0380/): Easy Digital Downloads < 3.1.0.5 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0379](https://insights.sbomify.com/CVE-2023-0379/): Spotlight Social Feeds < 1.4.3 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0378](https://insights.sbomify.com/CVE-2023-0378/): Greenshift < 5.0 - Contributor+ Stored XSS (medium 6.8)
- [CVE-2023-0377](https://insights.sbomify.com/CVE-2023-0377/): Scriptless Social Sharing < 3.2.2 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0376](https://insights.sbomify.com/CVE-2023-0376/): Qubely < 1.8.5 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0375](https://insights.sbomify.com/CVE-2023-0375/): Easy Affiliate Links < 3.7.1 - Contributor+ Stored XSS (medium 6.8)
- [CVE-2023-0374](https://insights.sbomify.com/CVE-2023-0374/): W4 Post List < 2.4.6 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0373](https://insights.sbomify.com/CVE-2023-0373/): Lightweight Accordion < 1.5.15 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0372](https://insights.sbomify.com/CVE-2023-0372/): EmbedStories < 0.7.5 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0371](https://insights.sbomify.com/CVE-2023-0371/): EmbedSocial < 1.1.28 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0370](https://insights.sbomify.com/CVE-2023-0370/): WPB Advanced FAQ <= 1.0.6 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0369](https://insights.sbomify.com/CVE-2023-0369/): GoToWP <= 5.1.1 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0368](https://insights.sbomify.com/CVE-2023-0368/): Responsive Tabs For WPBakery Page Builder <= 1.1 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0367](https://insights.sbomify.com/CVE-2023-0367/): Pricing Tables For WPBakery Page Builder < 3.0 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0366](https://insights.sbomify.com/CVE-2023-0366/): Loan Comparison < 1.5.3 - Contributor+ Stored XSS via shortcode (medium 5.4)
- [CVE-2023-0365](https://insights.sbomify.com/CVE-2023-0365/): React Webcam <= 1.2.0 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0364](https://insights.sbomify.com/CVE-2023-0364/): real.Kit < 5.1.1 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0363](https://insights.sbomify.com/CVE-2023-0363/): Scheduled Announcements Widget < 1.0 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0362](https://insights.sbomify.com/CVE-2023-0362/): Themify Portfolio Post < 1.2.2 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0361](https://insights.sbomify.com/CVE-2023-0361/): Weak cryptography in gnutls (high 7.4)
- [CVE-2023-0360](https://insights.sbomify.com/CVE-2023-0360/): Location Weather < 1.3.4 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0359](https://insights.sbomify.com/CVE-2023-0359/): ipv6: Missing ipv6 nullptr-check in handle_ra_input (medium 5.9)
- [CVE-2023-0358](https://insights.sbomify.com/CVE-2023-0358/): Use After Free in gpac/gpac (high 7.8)
- [CVE-2023-0357](https://insights.sbomify.com/CVE-2023-0357/): Cross-site scripting in Helpy (medium 6.1)
- [CVE-2023-0356](https://insights.sbomify.com/CVE-2023-0356/): Weak cryptography in MODULYS GP (medium 5.7)
- [CVE-2023-0355](https://insights.sbomify.com/CVE-2023-0355/): CVE-2023-0355 (medium 6.5)
- [CVE-2023-0354](https://insights.sbomify.com/CVE-2023-0354/): CVE-2023-0354 (critical 9.1)
- [CVE-2023-0353](https://insights.sbomify.com/CVE-2023-0353/): CVE-2023-0353 (high 7.2)
- [CVE-2023-0352](https://insights.sbomify.com/CVE-2023-0352/): CVE-2023-0352 (critical 9.1)
- [CVE-2023-0351](https://insights.sbomify.com/CVE-2023-0351/): CVE-2023-0351 (high 8.8)
- [CVE-2023-0350](https://insights.sbomify.com/CVE-2023-0350/): CVE-2023-0350 (medium 6.5)
- [CVE-2023-0349](https://insights.sbomify.com/CVE-2023-0349/): CVE-2023-0349 (high 7.5)
- [CVE-2023-0348](https://insights.sbomify.com/CVE-2023-0348/): CVE-2023-0348 (high 7.5)
- [CVE-2023-0347](https://insights.sbomify.com/CVE-2023-0347/): CVE-2023-0347 (high 7.5)
- [CVE-2023-0346](https://insights.sbomify.com/CVE-2023-0346/): CVE-2023-0346 (high 7.5)
- [CVE-2023-0345](https://insights.sbomify.com/CVE-2023-0345/): CVE-2023-0345 (critical 9.8)
- [CVE-2023-0344](https://insights.sbomify.com/CVE-2023-0344/): CVE-2023-0344 (critical 9.1)
- [CVE-2023-0343](https://insights.sbomify.com/CVE-2023-0343/): CVE-2023-0343 (medium 6.5)
- [CVE-2023-0342](https://insights.sbomify.com/CVE-2023-0342/): MongoDB Ops Manager may disclose sensitive information in Diagnostic Archive (low 3.1)
- [CVE-2023-0341](https://insights.sbomify.com/CVE-2023-0341/): Stack Buffer Overflow in editorconfig-core-c (high 7.8)
- [CVE-2023-0340](https://insights.sbomify.com/CVE-2023-0340/): Custom Content Shortcode <= 4.0.2 - Contributor+ LFI (high 8.8)
- [CVE-2023-0339](https://insights.sbomify.com/CVE-2023-0339/): AM Web Policy Agent path traversal (critical 9.1)
- [CVE-2023-0338](https://insights.sbomify.com/CVE-2023-0338/): Cross-site Scripting (XSS) - Reflected in lirantal/daloradius (medium 5.8)
- [CVE-2023-0337](https://insights.sbomify.com/CVE-2023-0337/): Cross-site Scripting (XSS) - Reflected in lirantal/daloradius (medium 5.8)
- [CVE-2023-0336](https://insights.sbomify.com/CVE-2023-0336/): OoohBoi Steroids for Elementor < 2.1.5 - Subscriber+ Attachment Deletion (medium 6.5)
- [CVE-2023-0335](https://insights.sbomify.com/CVE-2023-0335/): WP Shamsi <= 4.3.3 - Subscriber+ Attachment Deletion (medium 6.5)
- [CVE-2023-0334](https://insights.sbomify.com/CVE-2023-0334/): ShortPixel Adaptive Images < 3.6.3 - Reflected XSS (medium 6.1)
- [CVE-2023-0333](https://insights.sbomify.com/CVE-2023-0333/): TemplatesNext ToolKit < 3.2.9 - Contributor+ Stored XSS (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/426/