# Vulnerabilities published in 2023


- [CVE-2023-50431](https://insights.sbomify.com/CVE-2023-50431/): Information disclosure in linux:linux kernel (medium 5.5)
- [CVE-2023-50430](https://insights.sbomify.com/CVE-2023-50430/): Auth bypass in goodix:fingerprint sensor firmware (medium 6.4)
- [CVE-2023-5043](https://insights.sbomify.com/CVE-2023-5043/): Ingress nginx annotation injection causes arbitrary command execution (high 7.6)
- [CVE-2023-50429](https://insights.sbomify.com/CVE-2023-50429/): SQL injection in izybat:orange casiers (critical 9.1)
- [CVE-2023-50428](https://insights.sbomify.com/CVE-2023-50428/): Security feature bypass in bitcoin:bitcoin core (medium 5.3)
- [CVE-2023-50424](https://insights.sbomify.com/CVE-2023-50424/): Privilege escalation in github.com/sap/cloud-security-client-go (critical 9.1)
- [CVE-2023-50423](https://insights.sbomify.com/CVE-2023-50423/): Escalation of Privileges in SAP BTP Security Services Integration Library ([Python] cloud-pysec) (critical 9.1)
- [CVE-2023-50422](https://insights.sbomify.com/CVE-2023-50422/): Privilege escalation in cloud-security-services-integration-library (critical 9.1)
- [CVE-2023-5042](https://insights.sbomify.com/CVE-2023-5042/): Misconfiguration in Acronis Cyber Protect Home Office (medium 5.5)
- [CVE-2023-5041](https://insights.sbomify.com/CVE-2023-5041/): Track The Click < 0.3.12 - Author+ Time-Based Blind SQL Injection (high 8.8)
- [CVE-2023-50395](https://insights.sbomify.com/CVE-2023-50395/): SQL Injection Remote Code Execution Vulnerability (high 8.0)
- [CVE-2023-50387](https://insights.sbomify.com/CVE-2023-50387/): Denial of service in fedoraproject:fedora (high 7.5)
- [CVE-2023-50386](https://insights.sbomify.com/CVE-2023-50386/): Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets (high 8.8)
- [CVE-2023-50383](https://insights.sbomify.com/CVE-2023-50383/): Command injection in WBR-6013 (high 7.2)
- [CVE-2023-50382](https://insights.sbomify.com/CVE-2023-50382/): Command injection in WBR-6013 (high 7.2)
- [CVE-2023-50381](https://insights.sbomify.com/CVE-2023-50381/): Command injection in WBR-6013 (high 7.2)
- [CVE-2023-50380](https://insights.sbomify.com/CVE-2023-50380/): Apache Ambari: authenticated users could perform XXE to read arbitrary files on the server (medium 6.5)
- [CVE-2023-5038](https://insights.sbomify.com/CVE-2023-5038/): Unauthenticated DoS (high 8.7)
- [CVE-2023-50379](https://insights.sbomify.com/CVE-2023-50379/): Apache Ambari: authenticated users could perform command injection to perform RCE (high 8.8)
- [CVE-2023-50378](https://insights.sbomify.com/CVE-2023-50378/): Apache Ambari: Various XSS problems (medium 6.1)
- [CVE-2023-50377](https://insights.sbomify.com/CVE-2023-50377/): WordPress Simple Counter Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-50376](https://insights.sbomify.com/CVE-2023-50376/): WordPress Simple Membership Plugin <= 4.3.8 is vulnerable to Unauth. Reflected Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-50375](https://insights.sbomify.com/CVE-2023-50375/): WordPress Translate WordPress – Google Language Translator plugin <= 6.0.19 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-50374](https://insights.sbomify.com/CVE-2023-50374/): Server-side request forgery in CMP – Coming Soon & Maintenance (medium 5.5)
- [CVE-2023-50373](https://insights.sbomify.com/CVE-2023-50373/): WordPress Alt Manager plugin <= 1.6.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-50372](https://insights.sbomify.com/CVE-2023-50372/): WordPress Custom Post Type Page Template Plugin <= 1.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-50371](https://insights.sbomify.com/CVE-2023-50371/): WordPress Advanced Page Visit Counter Plugin <= 8.0.6 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-50370](https://insights.sbomify.com/CVE-2023-50370/): WordPress Livemesh Addons for WPBakery Page Builder Plugin <= 3.5 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-5037](https://insights.sbomify.com/CVE-2023-5037/): Authenticated Command Injection (high 7.1)
- [CVE-2023-50369](https://insights.sbomify.com/CVE-2023-50369/): Cross-site scripting in Alma – Pay in installments or later for WooCommerce (medium 6.5)
- [CVE-2023-50368](https://insights.sbomify.com/CVE-2023-50368/): WordPress Shortcodes and extra features for Phlox theme Plugin <= 2.15.2 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-50366](https://insights.sbomify.com/CVE-2023-50366/): QTS, QuTS hero (medium 4.3)
- [CVE-2023-50364](https://insights.sbomify.com/CVE-2023-50364/): QTS, QuTS hero (medium 6.4)
- [CVE-2023-50363](https://insights.sbomify.com/CVE-2023-50363/): QTS, QuTS hero (high 7.4)
- [CVE-2023-50362](https://insights.sbomify.com/CVE-2023-50362/): QTS, QuTS hero (medium 5.0)
- [CVE-2023-50361](https://insights.sbomify.com/CVE-2023-50361/): QTS, QuTS hero (medium 5.0)
- [CVE-2023-50360](https://insights.sbomify.com/CVE-2023-50360/): Video Station (high 8.8)
- [CVE-2023-5036](https://insights.sbomify.com/CVE-2023-5036/): Cross-Site Request Forgery (CSRF) in usememos/memos (high 7.3)
- [CVE-2023-50359](https://insights.sbomify.com/CVE-2023-50359/): QTS, QuTS hero (low 3.4)
- [CVE-2023-50358](https://insights.sbomify.com/CVE-2023-50358/): QTS, QuTS hero, QuTScloud (medium 5.8)
- [CVE-2023-50357](https://insights.sbomify.com/CVE-2023-50357/): Cross site scripting vulnerability in AREAL SAS Webserv1 ASP Web Site (medium 5.4)
- [CVE-2023-50356](https://insights.sbomify.com/CVE-2023-50356/): Improper Certificate Validation in AREAL Topkapi Vision (Server) (medium 6.5)
- [CVE-2023-50355](https://insights.sbomify.com/CVE-2023-50355/): HCL Sametime is impacted by generation of error messages containing sensitive information (low 3.6)
- [CVE-2023-50351](https://insights.sbomify.com/CVE-2023-50351/): Insecure key rotation affects MyXalytics (high 8.2)
- [CVE-2023-50350](https://insights.sbomify.com/CVE-2023-50350/): A broken cryptographic algorithm impacts MyXalytics (high 8.2)
- [CVE-2023-5035](https://insights.sbomify.com/CVE-2023-5035/): Cookie Without Secure Flag (low 3.1)
- [CVE-2023-50349](https://insights.sbomify.com/CVE-2023-50349/): HCL Sametime is impacted by a Cross Site Request Forgery (CSRF) vulnerability (medium 5.9)
- [CVE-2023-50348](https://insights.sbomify.com/CVE-2023-50348/): Improper Error Handling affects DRYiCE MyXalytics (low 3.1)
- [CVE-2023-50347](https://insights.sbomify.com/CVE-2023-50347/): Insecure SQL Interface affects HCL DRYiCE MyXalytics (low 3.7)
- [CVE-2023-50346](https://insights.sbomify.com/CVE-2023-50346/): An information disclosure affects DRYiCE MyXalytics (low 3.1)
- [CVE-2023-50345](https://insights.sbomify.com/CVE-2023-50345/): Open Redirect affects DRYiCE MyXalytics (low 3.7)
- [CVE-2023-50344](https://insights.sbomify.com/CVE-2023-50344/): Unauthenticated File Downloads affect DRYiCE MyXalytics (medium 5.4)
- [CVE-2023-50343](https://insights.sbomify.com/CVE-2023-50343/): Improper Access Control (Controller APIs) affects DRYiCE MyXalytics (high 8.3)
- [CVE-2023-50342](https://insights.sbomify.com/CVE-2023-50342/): Insecure Direct Object Reference (IDOR) affects DRYiCE MyXalytics (high 7.1)
- [CVE-2023-50341](https://insights.sbomify.com/CVE-2023-50341/): Improper Access Control affects DRYiCE MyXalytics (high 7.6)
- [CVE-2023-5034](https://insights.sbomify.com/CVE-2023-5034/): SourceCodester My Food Recipe Image Upload index.php unrestricted upload (medium 6.3)
- [CVE-2023-50339](https://insights.sbomify.com/CVE-2023-50339/): Cross-site scripting in GROWI (medium 5.4)
- [CVE-2023-50333](https://insights.sbomify.com/CVE-2023-50333/): Lack of restriction to manage group names for freshly demoted guests (low 3.7)
- [CVE-2023-50332](https://insights.sbomify.com/CVE-2023-50332/): Missing authorization in GROWI (medium 6.5)
- [CVE-2023-50330](https://insights.sbomify.com/CVE-2023-50330/): Memory corruption in WBR-6013 (high 7.2)
- [CVE-2023-5033](https://insights.sbomify.com/CVE-2023-5033/): OpenRapid RapidCMS cate-edit-run.php sql injection (medium 6.3)
- [CVE-2023-50328](https://insights.sbomify.com/CVE-2023-50328/): IBM PowerSC information disclosure (low 3.7)
- [CVE-2023-50327](https://insights.sbomify.com/CVE-2023-50327/): IBM PowerSC weak security (medium 5.3)
- [CVE-2023-50326](https://insights.sbomify.com/CVE-2023-50326/): IBM PowerSC information Disclosure (high 7.5)
- [CVE-2023-50324](https://insights.sbomify.com/CVE-2023-50324/): IBM Cognos Command Center information disclosure (medium 5.3)
- [CVE-2023-5032](https://insights.sbomify.com/CVE-2023-5032/): OpenRapid RapidCMS article-edit-run.php sql injection (medium 6.3)
- [CVE-2023-50316](https://insights.sbomify.com/CVE-2023-50316/): IBM Sterling B2B Integrator information disclosure (medium 6.3)
- [CVE-2023-50315](https://insights.sbomify.com/CVE-2023-50315/): IBM WebSphere Application Server information disclosure (medium 5.3)
- [CVE-2023-50314](https://insights.sbomify.com/CVE-2023-50314/): IBM WebSphere Application Server Libery information disclosure (medium 5.3)
- [CVE-2023-50313](https://insights.sbomify.com/CVE-2023-50313/): IBM WebSphere Application Server information disclosure (medium 5.3)
- [CVE-2023-50312](https://insights.sbomify.com/CVE-2023-50312/): IBM WebSphere Application Server Liberty information disclosure (medium 5.3)
- [CVE-2023-50311](https://insights.sbomify.com/CVE-2023-50311/): IBM CICS Transaction Gateway for Multiplatforms information disclosure (low 3.1)
- [CVE-2023-50310](https://insights.sbomify.com/CVE-2023-50310/): IBM CICS Transaction Gateway for Multiplatforms information disclosure (medium 4.9)
- [CVE-2023-5031](https://insights.sbomify.com/CVE-2023-5031/): OpenRapid RapidCMS article-add.php sql injection (medium 6.3)
- [CVE-2023-50309](https://insights.sbomify.com/CVE-2023-50309/): IBM Sterling B2B Integrator cross-site scripting (medium 6.4)
- [CVE-2023-50308](https://insights.sbomify.com/CVE-2023-50308/): IBM Db2 denial of service (medium 6.5)
- [CVE-2023-50307](https://insights.sbomify.com/CVE-2023-50307/): IBM Sterling B2B Integrator cross-site scripting (medium 5.4)
- [CVE-2023-50306](https://insights.sbomify.com/CVE-2023-50306/): IBM Common Licensing information disclosure (medium 4.0)
- [CVE-2023-50305](https://insights.sbomify.com/CVE-2023-50305/): IBM Engineering Requirements Management information disclosure (medium 5.1)
- [CVE-2023-50304](https://insights.sbomify.com/CVE-2023-50304/): IBM Engineering Requirements Management DOORS XML external entity injection (high 7.1)
- [CVE-2023-50303](https://insights.sbomify.com/CVE-2023-50303/): IBM InfoSphere Information Server cross-site scripting (medium 6.1)
- [CVE-2023-50301](https://insights.sbomify.com/CVE-2023-50301/): IBM Transformation Extender Advanced information disclosure (low 1.9)
- [CVE-2023-50300](https://insights.sbomify.com/CVE-2023-50300/): IBM Transformation Extender Advanced improper access control (medium 5.1)
- [CVE-2023-5030](https://insights.sbomify.com/CVE-2023-5030/): Tongda OA delete.php sql injection (medium 5.5)
- [CVE-2023-50298](https://insights.sbomify.com/CVE-2023-50298/): Apache Solr: Solr can expose ZooKeeper credentials via Streaming Expressions (high 7.5)
- [CVE-2023-50297](https://insights.sbomify.com/CVE-2023-50297/): Open redirect in PowerCMS (PowerCMS 4 Series) (medium 6.1)
- [CVE-2023-50294](https://insights.sbomify.com/CVE-2023-50294/): Information disclosure in GROWI (medium 6.5)
- [CVE-2023-50292](https://insights.sbomify.com/CVE-2023-50292/): Apache Solr: Solr Schema Designer blindly "trusts" all configsets, possibly leading to RCE by unauthenticated users (high 7.5)
- [CVE-2023-50291](https://insights.sbomify.com/CVE-2023-50291/): Apache Solr: System Property redaction logic inconsistency can lead to leaked passwords (high 7.5)
- [CVE-2023-50290](https://insights.sbomify.com/CVE-2023-50290/): Apache Solr: Host environment variables are published via the Metrics API (medium 6.5)
- [CVE-2023-5029](https://insights.sbomify.com/CVE-2023-5029/): mccms 1 sql injection (medium 5.5)
- [CVE-2023-5028](https://insights.sbomify.com/CVE-2023-5028/): China Unicom TEWA-800G debug log file (low 2.0)
- [CVE-2023-50275](https://insights.sbomify.com/CVE-2023-50275/): Auth bypass in HPE OneView (high 7.5)
- [CVE-2023-50274](https://insights.sbomify.com/CVE-2023-50274/): Command injection in HPE OneView (high 7.8)
- [CVE-2023-50272](https://insights.sbomify.com/CVE-2023-50272/): Auth bypass in HPE Integrated Lights-out 5 (iLO 5), HPE Integrated Lights-out 6 (iLO 6), (high 7.5)
- [CVE-2023-50271](https://insights.sbomify.com/CVE-2023-50271/): HP-UX System Management Homepage, Disclosure of Information (high 7.2)
- [CVE-2023-50270](https://insights.sbomify.com/CVE-2023-50270/): Apache DolphinScheduler: Session do not expire after password change (medium 6.5)
- [CVE-2023-5027](https://insights.sbomify.com/CVE-2023-5027/): SourceCodester Simple Membership System club_validator.php sql injection (medium 6.3)
- [CVE-2023-50269](https://insights.sbomify.com/CVE-2023-50269/): SQUID-2023:10 Denial of Service in HTTP Request parsing (high 8.6)
- [CVE-2023-50268](https://insights.sbomify.com/CVE-2023-50268/): jq has stack-based buffer overflow in decNaNs (medium 6.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/175/