# Vulnerabilities published in 2023 - [CVE-2023-50267](https://insights.sbomify.com/CVE-2023-50267/): MeterSphere horizontal privilege escalation vulnerability of resources in project scope. (medium 4.3) - [CVE-2023-50266](https://insights.sbomify.com/CVE-2023-50266/): Bazarr Blind Server-Side Request Forgery (SSRF) in the /test// endpoint (medium 5.3) - [CVE-2023-50265](https://insights.sbomify.com/CVE-2023-50265/): Bazarr Arbitrary file read in /api/swaggerui/static endpoint (high 7.5) - [CVE-2023-50264](https://insights.sbomify.com/CVE-2023-50264/): Bazarr Arbitrary file read in /system/backup/download/ endpoint (high 7.5) - [CVE-2023-50263](https://insights.sbomify.com/CVE-2023-50263/): Nautobot allows unauthenticated db-file-storage views (low 3.7) - [CVE-2023-50262](https://insights.sbomify.com/CVE-2023-50262/): Dompdf possible DoS caused by infinite recursion when parsing SVG images (medium 5.3) - [CVE-2023-50260](https://insights.sbomify.com/CVE-2023-50260/): Wazuh's vulnerability in host_deny AR script allows arbitrary command execution (high 8.8) - [CVE-2023-5026](https://insights.sbomify.com/CVE-2023-5026/): Tongda OA cross site scripting (low 3.5) - [CVE-2023-50259](https://insights.sbomify.com/CVE-2023-50259/): Blind SSRF in /home/testslack endpoint (medium 5.3) - [CVE-2023-50258](https://insights.sbomify.com/CVE-2023-50258/): Blind SSRF in `/home/testdiscord` endpoint (medium 5.3) - [CVE-2023-50257](https://insights.sbomify.com/CVE-2023-50257/): Disconnect Vulnerability in RTPS Packets Used by SROS2 (critical 9.7) - [CVE-2023-50256](https://insights.sbomify.com/CVE-2023-50256/): Froxlor username/surname AND company field Bypass (high 7.5) - [CVE-2023-50255](https://insights.sbomify.com/CVE-2023-50255/): Zip Path Traversal in Deepin-Compressor (critical 9.3) - [CVE-2023-50254](https://insights.sbomify.com/CVE-2023-50254/): Deepin Reader RCE vulnerability due to a design flaw (critical 9.3) - [CVE-2023-50253](https://insights.sbomify.com/CVE-2023-50253/): laf logs leak (critical 9.7) - [CVE-2023-50252](https://insights.sbomify.com/CVE-2023-50252/): php-svg-lib unsafe attributes merge when parsing `use` tag (high 8.3) - [CVE-2023-50251](https://insights.sbomify.com/CVE-2023-50251/): php-svg-lib possible DoS caused by infinite recursion when parsing SVG document (medium 5.3) - [CVE-2023-50250](https://insights.sbomify.com/CVE-2023-50250/): Cross-Site Scripting vulnerability when Import xml template file (medium 5.4) - [CVE-2023-5025](https://insights.sbomify.com/CVE-2023-5025/): KOHA MARC search.pl cross site scripting (low 3.5) - [CVE-2023-50249](https://insights.sbomify.com/CVE-2023-50249/): Sentry's Astro SDK vulnerable to ReDoS (high 7.5) - [CVE-2023-50248](https://insights.sbomify.com/CVE-2023-50248/): CKAN out of memory error when submitting the dataset form with a specially-crafted field (medium 4.5) - [CVE-2023-50247](https://insights.sbomify.com/CVE-2023-50247/): h2o QUIC state exhaustion DoS (low 3.7) - [CVE-2023-50246](https://insights.sbomify.com/CVE-2023-50246/): jq has heap-buffer-overflow vulnerability in the function decToString in decNumber.c (medium 6.2) - [CVE-2023-50245](https://insights.sbomify.com/CVE-2023-50245/): OpenEXR-viewer memory overflow vulnerability (critical 9.8) - [CVE-2023-50244](https://insights.sbomify.com/CVE-2023-50244/): Memory corruption in WBR-6013 (high 7.2) - [CVE-2023-50243](https://insights.sbomify.com/CVE-2023-50243/): Memory corruption in WBR-6013 (high 7.2) - [CVE-2023-50240](https://insights.sbomify.com/CVE-2023-50240/): Memory corruption in WBR-6013 (high 7.2) - [CVE-2023-5024](https://insights.sbomify.com/CVE-2023-5024/): Planno Comment cross site scripting (low 3.5) - [CVE-2023-50239](https://insights.sbomify.com/CVE-2023-50239/): Memory corruption in WBR-6013 (high 7.2) - [CVE-2023-50236](https://insights.sbomify.com/CVE-2023-50236/): Misconfiguration in Polarion ALM (high 7.8) - [CVE-2023-50235](https://insights.sbomify.com/CVE-2023-50235/): Hancom Office Show PPT File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8) - [CVE-2023-50234](https://insights.sbomify.com/CVE-2023-50234/): Hancom Office Cell XLS File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8) - [CVE-2023-50233](https://insights.sbomify.com/CVE-2023-50233/): Inductive Automation Ignition getJavaExecutable Directory Traversal Remote Code Execution Vulnerability (high 8.8) - [CVE-2023-50232](https://insights.sbomify.com/CVE-2023-50232/): Inductive Automation Ignition getParams Argument Injection Remote Code Execution Vulnerability (high 8.8) - [CVE-2023-50231](https://insights.sbomify.com/CVE-2023-50231/): NETGEAR ProSAFE Network Management System saveNodeLabel Cross-Site Scripting Privilege Escalation Vulnerability (high 8.0) - [CVE-2023-50230](https://insights.sbomify.com/CVE-2023-50230/): BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.1) - [CVE-2023-5023](https://insights.sbomify.com/CVE-2023-5023/): Tongda OA delete.php sql injection (medium 5.5) - [CVE-2023-50229](https://insights.sbomify.com/CVE-2023-50229/): BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.1) - [CVE-2023-50228](https://insights.sbomify.com/CVE-2023-50228/): Parallels Desktop Updater Improper Verification of Cryptographic Signature Local Privilege Escalation Vulnerability (high 7.8) - [CVE-2023-50227](https://insights.sbomify.com/CVE-2023-50227/): Parallels Desktop virtio-gpu Out-Of-Bounds Write Remote Code Execution Vulnerability (high 8.3) - [CVE-2023-50226](https://insights.sbomify.com/CVE-2023-50226/): Parallels Desktop Updater Link Following Local Privilege Escalation Vulnerability (high 7.8) - [CVE-2023-50225](https://insights.sbomify.com/CVE-2023-50225/): TP-Link TL-WR902AC dm_fillObjByStr Stack-based Buffer Overflow Remote Code Execution Vulnerability (medium 6.8) - [CVE-2023-50224](https://insights.sbomify.com/CVE-2023-50224/): TP-Link TL-WR841N Authentication Bypass by Spoofing (medium 6.5, exploited in the wild) - [CVE-2023-50223](https://insights.sbomify.com/CVE-2023-50223/): Deserialization in Ignition (high 8.8) - [CVE-2023-50222](https://insights.sbomify.com/CVE-2023-50222/): Deserialization in Ignition (high 8.8) - [CVE-2023-50221](https://insights.sbomify.com/CVE-2023-50221/): Deserialization in Ignition (high 8.8) - [CVE-2023-50220](https://insights.sbomify.com/CVE-2023-50220/): Inductive Automation Ignition Base64Element Deserialization of Untrusted Data Remote Code Execution Vulnerability (high 7.2) - [CVE-2023-5022](https://insights.sbomify.com/CVE-2023-5022/): DedeCMS select_templets_post.php absolute path traversal (medium 5.5) - [CVE-2023-50219](https://insights.sbomify.com/CVE-2023-50219/): Inductive Automation Ignition RunQuery Deserialization of Untrusted Data Remote Code Execution Vulnerability (high 8.8) - [CVE-2023-50218](https://insights.sbomify.com/CVE-2023-50218/): Inductive Automation Ignition ModuleInvoke Deserialization of Untrusted Data Remote Code Execution Vulnerability (high 8.8) - [CVE-2023-50217](https://insights.sbomify.com/CVE-2023-50217/): D-Link G416 awsfile rm Command Injection Remote Code Execution Vulnerability (high 8.8) - [CVE-2023-50216](https://insights.sbomify.com/CVE-2023-50216/): D-Link G416 awsfile tar File Handling Command Injection Remote Code Execution Vulnerability (high 8.8) - [CVE-2023-50215](https://insights.sbomify.com/CVE-2023-50215/): D-Link G416 nodered gz File Handling Command Injection Remote Code Execution Vulnerability (high 8.8) - [CVE-2023-50214](https://insights.sbomify.com/CVE-2023-50214/): D-Link G416 nodered tar File Handling Command Injection Remote Code Execution Vulnerability (high 8.8) - [CVE-2023-50213](https://insights.sbomify.com/CVE-2023-50213/): D-Link G416 nodered File Handling Command Injection Remote Code Execution Vulnerability (high 8.8) - [CVE-2023-50212](https://insights.sbomify.com/CVE-2023-50212/): D-Link G416 httpd Improper Handling of Exceptional Conditions Information Disclosure Vulnerability (medium 4.3) - [CVE-2023-50211](https://insights.sbomify.com/CVE-2023-50211/): D-Link G416 httpd API-AUTH Timestamp Processing Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 8.8) - [CVE-2023-50210](https://insights.sbomify.com/CVE-2023-50210/): D-Link G416 httpd API-AUTH Digest Processing Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 8.8) - [CVE-2023-5021](https://insights.sbomify.com/CVE-2023-5021/): SourceCodester AC Repair and Services System cross site scripting (low 3.5) - [CVE-2023-50209](https://insights.sbomify.com/CVE-2023-50209/): D-Link G416 cfgsave Stack-Based Buffer Overflow Remote Code Execution Vulnerability (high 8.8) - [CVE-2023-50208](https://insights.sbomify.com/CVE-2023-50208/): D-Link G416 ovpncfg Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 8.8) - [CVE-2023-50207](https://insights.sbomify.com/CVE-2023-50207/): D-Link G416 flupl filename Command Injection Remote Code Execution Vulnerability (high 8.8) - [CVE-2023-50206](https://insights.sbomify.com/CVE-2023-50206/): D-Link G416 flupl query_type edit Command Injection Remote Code Execution Vulnerability (high 8.8) - [CVE-2023-50205](https://insights.sbomify.com/CVE-2023-50205/): D-Link G416 awsfile chmod Command Injection Remote Code Execution Vulnerability (high 8.8) - [CVE-2023-50204](https://insights.sbomify.com/CVE-2023-50204/): D-Link G416 flupl pythonapp Command Injection Remote Code Execution Vulnerability (high 8.8) - [CVE-2023-50203](https://insights.sbomify.com/CVE-2023-50203/): D-Link G416 nodered chmod Command Injection Remote Code Execution Vulnerability (high 8.8) - [CVE-2023-50202](https://insights.sbomify.com/CVE-2023-50202/): D-Link G416 flupl pythonmodules Command Injection Remote Code Execution Vulnerability (high 8.8) - [CVE-2023-50201](https://insights.sbomify.com/CVE-2023-50201/): D-Link G416 cfgsave upusb Command Injection Remote Code Execution Vulnerability (high 8.8) - [CVE-2023-50200](https://insights.sbomify.com/CVE-2023-50200/): D-Link G416 cfgsave backusb Command Injection Remote Code Execution Vulnerability (high 8.8) - [CVE-2023-5020](https://insights.sbomify.com/CVE-2023-5020/): 07FLY CRM Administrator Login Page sql injection (high 7.3) - [CVE-2023-50199](https://insights.sbomify.com/CVE-2023-50199/): D-Link G416 httpd Missing Authentication for Critical Function Remote Code Execution Vulnerability (high 8.8) - [CVE-2023-50198](https://insights.sbomify.com/CVE-2023-50198/): D-Link G416 cfgsave Command Injection Remote Code Execution Vulnerability (high 8.8) - [CVE-2023-50197](https://insights.sbomify.com/CVE-2023-50197/): Intel Driver & Support Assistant Link Following Local Privilege Escalation Vulnerability (high 7.8) - [CVE-2023-50196](https://insights.sbomify.com/CVE-2023-50196/): Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8) - [CVE-2023-50195](https://insights.sbomify.com/CVE-2023-50195/): Trimble SketchUp Viewer SKP File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8) - [CVE-2023-50194](https://insights.sbomify.com/CVE-2023-50194/): Trimble SketchUp Viewer SKP File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8) - [CVE-2023-50193](https://insights.sbomify.com/CVE-2023-50193/): Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8) - [CVE-2023-50192](https://insights.sbomify.com/CVE-2023-50192/): Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8) - [CVE-2023-50191](https://insights.sbomify.com/CVE-2023-50191/): Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8) - [CVE-2023-50190](https://insights.sbomify.com/CVE-2023-50190/): Trimble SketchUp Viewer SKP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8) - [CVE-2023-5019](https://insights.sbomify.com/CVE-2023-5019/): Tongda OA delete.php sql injection (medium 6.3) - [CVE-2023-50189](https://insights.sbomify.com/CVE-2023-50189/): Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8) - [CVE-2023-50188](https://insights.sbomify.com/CVE-2023-50188/): Trimble SketchUp Viewer SKP File Parsing Uninitialized Variable Remote Code Execution Vulnerability (high 7.8) - [CVE-2023-50187](https://insights.sbomify.com/CVE-2023-50187/): Trimble SketchUp Viewer SKP File Parsing Memory Corruption Remote Code Execution Vulnerability (high 7.8) - [CVE-2023-50186](https://insights.sbomify.com/CVE-2023-50186/): GStreamer AV1 Video Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 7.5) - [CVE-2023-50181](https://insights.sbomify.com/CVE-2023-50181/): Missing authorization in FortiADC (medium 4.8) - [CVE-2023-50180](https://insights.sbomify.com/CVE-2023-50180/): Information disclosure in FortiADC (medium 5.2) - [CVE-2023-5018](https://insights.sbomify.com/CVE-2023-5018/): SourceCodester Lost and Found Information System POST Parameter sql injection (medium 6.3) - [CVE-2023-50179](https://insights.sbomify.com/CVE-2023-50179/): Security feature bypass in FortiADC (medium 4.7) - [CVE-2023-50178](https://insights.sbomify.com/CVE-2023-50178/): Security feature bypass in FortiADC (high 7.2) - [CVE-2023-50176](https://insights.sbomify.com/CVE-2023-50176/): Auth bypass in FortiOS (medium 4.0) - [CVE-2023-50175](https://insights.sbomify.com/CVE-2023-50175/): Cross-site scripting in GROWI (medium 5.4) - [CVE-2023-50172](https://insights.sbomify.com/CVE-2023-50172/): WWBN AVideo recovery notification bypass vulnerability (medium 5.3) - [CVE-2023-5017](https://insights.sbomify.com/CVE-2023-5017/): lmxcms admin.php sql injection (medium 5.5) - [CVE-2023-50168](https://insights.sbomify.com/CVE-2023-50168/): XML external entity in Pega Platform (high 7.7) - [CVE-2023-50167](https://insights.sbomify.com/CVE-2023-50167/): Cross-site scripting in Pega Platform (medium 5.4) - [CVE-2023-50166](https://insights.sbomify.com/CVE-2023-50166/): Cross-site scripting in Pega Platform (medium 6.1) - [CVE-2023-50165](https://insights.sbomify.com/CVE-2023-50165/): Server-side request forgery in Pega Platform (high 8.5) - [CVE-2023-50164](https://insights.sbomify.com/CVE-2023-50164/): Apache Struts: File upload component had a directory traversal vulnerability (critical 9.8) - [CVE-2023-50162](https://insights.sbomify.com/CVE-2023-50162/): SQL injection in phome:empirecms (high 7.2) --- From sbomify Insights: https://insights.sbomify.com/years/2023/page/176/