# Vulnerabilities published in 2023


- [CVE-2023-0121](https://insights.sbomify.com/CVE-2023-0121/): Allocation of Resources Without Limits or Throttling in GitLab (medium 6.5)
- [CVE-2023-0120](https://insights.sbomify.com/CVE-2023-0120/): Incorrect Authorization in GitLab (low 3.5)
- [CVE-2023-0119](https://insights.sbomify.com/CVE-2023-0119/): Foreman: stored cross-site scripting in host tab (medium 5.4)
- [CVE-2023-0118](https://insights.sbomify.com/CVE-2023-0118/): Foreman: arbitrary code execution through templates (critical 9.1)
- [CVE-2023-0117](https://insights.sbomify.com/CVE-2023-0117/): Auth bypass in EMUI (medium 5.3)
- [CVE-2023-0116](https://insights.sbomify.com/CVE-2023-0116/): Missing authorization in EMUI (high 7.5)
- [CVE-2023-0114](https://insights.sbomify.com/CVE-2023-0114/): Netis Netcore Router Backup param.file.tgz cleartext storage in a file or on disk (low 3.3)
- [CVE-2023-0113](https://insights.sbomify.com/CVE-2023-0113/): Netis Netcore Router Backup param.file.tgz information disclosure (medium 5.3)
- [CVE-2023-0112](https://insights.sbomify.com/CVE-2023-0112/): Cross-site Scripting (XSS) - Stored in usememos/memos (high 7.6)
- [CVE-2023-0111](https://insights.sbomify.com/CVE-2023-0111/): Cross-site Scripting (XSS) - Stored in usememos/memos (medium 5.4)
- [CVE-2023-0110](https://insights.sbomify.com/CVE-2023-0110/): Cross-site Scripting (XSS) - Stored in usememos/memos (high 7.1)
- [CVE-2023-0109](https://insights.sbomify.com/CVE-2023-0109/): Stored XSS in usememos/memos (critical 9.8)
- [CVE-2023-0108](https://insights.sbomify.com/CVE-2023-0108/): Cross-site Scripting (XSS) - Stored in usememos/memos (high 7.1)
- [CVE-2023-0107](https://insights.sbomify.com/CVE-2023-0107/): Cross-site Scripting (XSS) - Stored in usememos/memos (medium 6.5)
- [CVE-2023-0106](https://insights.sbomify.com/CVE-2023-0106/): Cross-site Scripting (XSS) - Stored in usememos/memos (critical 9.0)
- [CVE-2023-0105](https://insights.sbomify.com/CVE-2023-0105/): Keycloak: Impersonation and lockout possible through incorrect handling of email trust (medium 6.5)
- [CVE-2023-0104](https://insights.sbomify.com/CVE-2023-0104/): Path traversal in EasyBuilder Pro cMT (critical 9.3)
- [CVE-2023-0103](https://insights.sbomify.com/CVE-2023-0103/): CVE-2023-0103 (high 7.5)
- [CVE-2023-0102](https://insights.sbomify.com/CVE-2023-0102/): CVE-2023-0102 (critical 9.1)
- [CVE-2023-0101](https://insights.sbomify.com/CVE-2023-0101/): Privilege escalation in Nessus (high 8.8)
- [CVE-2023-0100](https://insights.sbomify.com/CVE-2023-0100/): Improper Input Validation In Eclipse BIRT (high 8.8)
- [CVE-2023-0099](https://insights.sbomify.com/CVE-2023-0099/): Simple URLs < 115 - Multiple Reflected XSS (medium 6.1)
- [CVE-2023-0098](https://insights.sbomify.com/CVE-2023-0098/): Simple URLs < 115 - Subscriber+ SQLi (high 7.7)
- [CVE-2023-0097](https://insights.sbomify.com/CVE-2023-0097/): Post Grid, Post Carousel, & List Category Posts < 2.4.19 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0096](https://insights.sbomify.com/CVE-2023-0096/): Happyforms < 1.22.0 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0095](https://insights.sbomify.com/CVE-2023-0095/): Page View Count < 2.6.1 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0094](https://insights.sbomify.com/CVE-2023-0094/): UpQode Google Maps <= 1.0.5 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0093](https://insights.sbomify.com/CVE-2023-0093/): Command injection in Advanced Server Access (high 8.8)
- [CVE-2023-0092](https://insights.sbomify.com/CVE-2023-0092/): Juju controller - Arbitrary file reading vulnerability (medium 4.9)
- [CVE-2023-0091](https://insights.sbomify.com/CVE-2023-0091/): Keycloak has lack of validation of access token on client registrations endpoint (low 3.8)
- [CVE-2023-0090](https://insights.sbomify.com/CVE-2023-0090/): Proofpoint Enterprise Protection webservices unauthenticated RCE (critical 9.8)
- [CVE-2023-0089](https://insights.sbomify.com/CVE-2023-0089/): Proofpoint Enterprise Protection webutils authenticated RCE (high 8.8)
- [CVE-2023-0088](https://insights.sbomify.com/CVE-2023-0088/): Swifty Page Manager <= 3.0.1 - Cross-Site Request Forgery (high 8.8)
- [CVE-2023-0087](https://insights.sbomify.com/CVE-2023-0087/): Swifty Page Manager <= 3.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 5.5)
- [CVE-2023-0086](https://insights.sbomify.com/CVE-2023-0086/): JetWidgets for Elementor <= 1.0.12 - Cross-Site Request Forgery to Settings Update (medium 5.4)
- [CVE-2023-0085](https://insights.sbomify.com/CVE-2023-0085/): Metform Elementor Contact Form Builder <= 3.2.1 - reCaptcha Protection Bypass (medium 5.3)
- [CVE-2023-0084](https://insights.sbomify.com/CVE-2023-0084/): Metform Elementor Contact Form Builder <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2023-0083](https://insights.sbomify.com/CVE-2023-0083/): The ArkUI framework subsystem doesn't check the input parameter,causing type confusion and invalid memory access. (medium 4.0)
- [CVE-2023-0082](https://insights.sbomify.com/CVE-2023-0082/): ExactMetrics < 7.12.1 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0081](https://insights.sbomify.com/CVE-2023-0081/): MonsterInsights < 8.12.1 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0080](https://insights.sbomify.com/CVE-2023-0080/): Customer Reviews for WooCommerce < 5.16.0 - Contributor+ LFI (high 8.8)
- [CVE-2023-0079](https://insights.sbomify.com/CVE-2023-0079/): Customer Reviews for WooCommerce < 5.17.0 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0078](https://insights.sbomify.com/CVE-2023-0078/): Resume Builder <= 3.1.1 - Subscriber+ Stored XSS (medium 5.4)
- [CVE-2023-0077](https://insights.sbomify.com/CVE-2023-0077/): Integer overflow in Synology Router Manager (SRM) (medium 6.5)
- [CVE-2023-0076](https://insights.sbomify.com/CVE-2023-0076/): Download Attachments < 1.3 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0075](https://insights.sbomify.com/CVE-2023-0075/): Amazon JS <= 0.10 - Contributor+ Stored XSS (medium 6.8)
- [CVE-2023-0074](https://insights.sbomify.com/CVE-2023-0074/): WP Social Widget < 2.2.4 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0073](https://insights.sbomify.com/CVE-2023-0073/): Client Logo Carousel <= 3.0.0 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0072](https://insights.sbomify.com/CVE-2023-0072/): WC Vendors Marketplace < 2.4.5 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0071](https://insights.sbomify.com/CVE-2023-0071/): WP Tabs < 2.1.17 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0070](https://insights.sbomify.com/CVE-2023-0070/): ResponsiveVoice Text To Speech < 1.7.7 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0069](https://insights.sbomify.com/CVE-2023-0069/): WPaudio MP3 Player <= 4.0.2 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0068](https://insights.sbomify.com/CVE-2023-0068/): Product GTIN (EAN, UPC, ISBN) for WooCommerce <= 1.1.1 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0067](https://insights.sbomify.com/CVE-2023-0067/): Timed Content < 2.73 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0066](https://insights.sbomify.com/CVE-2023-0066/): Companion Sitemap Generator <= 4.5.1.1 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0065](https://insights.sbomify.com/CVE-2023-0065/): i2 Pros & Cons <= 1.3.1 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0064](https://insights.sbomify.com/CVE-2023-0064/): eVision Responsive Column Layout Shortcodes <= 2.3 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0063](https://insights.sbomify.com/CVE-2023-0063/): Synved Shortcodes <= 1.6.36 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0062](https://insights.sbomify.com/CVE-2023-0062/): EAN for WooCommerce < 4.4.3 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0061](https://insights.sbomify.com/CVE-2023-0061/): Judge.me Product Reviews for WooCommerce < 1.3.21 - Contributor+ Stored XSS (medium 6.8)
- [CVE-2023-0060](https://insights.sbomify.com/CVE-2023-0060/): Responsive Gallery Grid < 2.3.9 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0059](https://insights.sbomify.com/CVE-2023-0059/): Youzify < 1.2.2 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0058](https://insights.sbomify.com/CVE-2023-0058/): Tiempo.com <= 0.1.2 - Stored XSS via CSRF (medium 6.1)
- [CVE-2023-0057](https://insights.sbomify.com/CVE-2023-0057/): Improper Restriction of Rendered UI Layers or Frames in pyload/pyload (low 3.1)
- [CVE-2023-0056](https://insights.sbomify.com/CVE-2023-0056/): Denial of service in haproxy (medium 6.5)
- [CVE-2023-0055](https://insights.sbomify.com/CVE-2023-0055/): Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in pyload/pyload (low 3.1)
- [CVE-2023-0054](https://insights.sbomify.com/CVE-2023-0054/): Out-of-bounds Write in vim/vim (high 7.3)
- [CVE-2023-0053](https://insights.sbomify.com/CVE-2023-0053/): SAUTER Controls Nova 200–220 Series Cleartext Transmission of Sensitive Information (high 7.5)
- [CVE-2023-0052](https://insights.sbomify.com/CVE-2023-0052/): SAUTER Controls Nova 200–220 Series Missing Authentication for Critical Function (critical 9.8)
- [CVE-2023-0051](https://insights.sbomify.com/CVE-2023-0051/): Heap-based Buffer Overflow in vim/vim (high 7.3)
- [CVE-2023-0050](https://insights.sbomify.com/CVE-2023-0050/): Cross-site scripting in GitLab (high 8.7)
- [CVE-2023-0049](https://insights.sbomify.com/CVE-2023-0049/): Out-of-bounds Read in vim/vim (high 7.3)
- [CVE-2023-0048](https://insights.sbomify.com/CVE-2023-0048/): Code Injection in lirantal/daloradius (high 7.2)
- [CVE-2023-0046](https://insights.sbomify.com/CVE-2023-0046/): Improper Restriction of Names for Files and Other Resources in lirantal/daloradius (high 7.2)
- [CVE-2023-0045](https://insights.sbomify.com/CVE-2023-0045/): Incorrect indirect branch prediction barrier in the Linux Kernel (medium 4.7)
- [CVE-2023-0044](https://insights.sbomify.com/CVE-2023-0044/): Cross-site Scripting in Quarkus (medium 6.1)
- [CVE-2023-0043](https://insights.sbomify.com/CVE-2023-0043/): Custom Add User <= 2.0.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-0042](https://insights.sbomify.com/CVE-2023-0042/): Open redirect in GitLab (medium 6.1)
- [CVE-2023-0041](https://insights.sbomify.com/CVE-2023-0041/): IBM Security Guardium session fixation (medium 6.3)
- [CVE-2023-0040](https://insights.sbomify.com/CVE-2023-0040/): Async HTTP Client has CRLF Injection vulnerability in HTTP request headers (high 7.5)
- [CVE-2023-0038](https://insights.sbomify.com/CVE-2023-0038/): Survey Maker – Best WordPress Survey Plugin <= 3.1.3 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2023-0037](https://insights.sbomify.com/CVE-2023-0037/): 10WebMapBuilder < 1.0.73 - Unauthenticated SQLi (critical 9.8)
- [CVE-2023-0036](https://insights.sbomify.com/CVE-2023-0036/): platform_callback_stub in misc subsystem has an authentication bypass vulnerability which allows an "SA relay attack". (medium 6.5)
- [CVE-2023-0035](https://insights.sbomify.com/CVE-2023-0035/): Auth bypass in OpenHarmony (medium 6.5)
- [CVE-2023-0034](https://insights.sbomify.com/CVE-2023-0034/): JetWidgets For Elementor < 1.0.14 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2023-0033](https://insights.sbomify.com/CVE-2023-0033/): PDF Viewer < 1.0.0 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2023-0030](https://insights.sbomify.com/CVE-2023-0030/): Use after free in kernel (high 7.8)
- [CVE-2023-0029](https://insights.sbomify.com/CVE-2023-0029/): Multilaser RE708 Telnet Service denial of service (medium 5.3)
- [CVE-2023-0028](https://insights.sbomify.com/CVE-2023-0028/): Cross-site Scripting (XSS) - Stored in linagora/twake (medium 5.7)
- [CVE-2023-0027](https://insights.sbomify.com/CVE-2023-0027/): Rockwell Automation Modbus TCP AOI Server Could Leak Sensitive Information (medium 5.3)
- [CVE-2023-0026](https://insights.sbomify.com/CVE-2023-0026/): Denial of service in Junos OS (high 7.5)
- [CVE-2023-0025](https://insights.sbomify.com/CVE-2023-0025/): Cross-site scripting in Solution Manager (BSP Application) (medium 6.5)
- [CVE-2023-0024](https://insights.sbomify.com/CVE-2023-0024/): Cross-site scripting in Solution Manager (BSP Application) (medium 6.5)
- [CVE-2023-0023](https://insights.sbomify.com/CVE-2023-0023/): Information Disclosure in SAP Bank Account Management (Manage Banks) (medium 4.5)
- [CVE-2023-0022](https://insights.sbomify.com/CVE-2023-0022/): Code Injection vulnerability in SAP BusinessObjects Business Intelligence platform (Analysis edition for OLAP) (critical 9.9)
- [CVE-2023-0021](https://insights.sbomify.com/CVE-2023-0021/): Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver (medium 6.1)
- [CVE-2023-0020](https://insights.sbomify.com/CVE-2023-0020/): Information disclosure in SAP BusinessObjects Business Intelligence Platform (high 8.5)
- [CVE-2023-0019](https://insights.sbomify.com/CVE-2023-0019/): Missing authorization in SAP GRC (Process Control) (medium 6.5)
- [CVE-2023-0018](https://insights.sbomify.com/CVE-2023-0018/): Cross-site scripting in BusinessObjects Business Intelligence Platform (Central management console) (critical 10.0)
- [CVE-2023-0017](https://insights.sbomify.com/CVE-2023-0017/): Improper access control in SAP NetWeaver AS for Java (critical 9.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/429/