# Vulnerabilities published in 2023


- [CVE-2023-49964](https://insights.sbomify.com/CVE-2023-49964/): Code injection in hyland:alfresco content services (high 8.8)
- [CVE-2023-49963](https://insights.sbomify.com/CVE-2023-49963/): DYMO LabelWriter Print Server through 2.366 contains a backdoor hard-coded password that could allow an attacker to take control. (high 8.8)
- [CVE-2023-49961](https://insights.sbomify.com/CVE-2023-49961/): Missing authorization in wallix:bastion (high 7.5)
- [CVE-2023-49960](https://insights.sbomify.com/CVE-2023-49960/): Path traversal in indu-sol:profinet-inspektor nt firmware (high 7.5)
- [CVE-2023-4996](https://insights.sbomify.com/CVE-2023-4996/): Local privilege escalation (medium 6.6)
- [CVE-2023-49959](https://insights.sbomify.com/CVE-2023-49959/): Command injection in indu-sol:profinet-inspektor nt (critical 9.8)
- [CVE-2023-49958](https://insights.sbomify.com/CVE-2023-49958/): Business logic in dallmann-consulting:open charge point protocol (high 7.5)
- [CVE-2023-49957](https://insights.sbomify.com/CVE-2023-49957/): Business logic in dallmann-consulting:open charge point protocol (high 7.5)
- [CVE-2023-49956](https://insights.sbomify.com/CVE-2023-49956/): Denial of service in dallmann-consulting:open charge point protocol (high 7.5)
- [CVE-2023-49955](https://insights.sbomify.com/CVE-2023-49955/): Denial of service in dallmann-consulting:open charge point protocol (high 7.5)
- [CVE-2023-49954](https://insights.sbomify.com/CVE-2023-49954/): SQL injection in 3cx:3cx (critical 9.8)
- [CVE-2023-49952](https://insights.sbomify.com/CVE-2023-49952/): Security feature bypass in joinmastodon:mastodon (high 7.5)
- [CVE-2023-49950](https://insights.sbomify.com/CVE-2023-49950/): Cross-site scripting in logpoint:siem (medium 5.4)
- [CVE-2023-4995](https://insights.sbomify.com/CVE-2023-4995/): Embed Calendly <= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-49949](https://insights.sbomify.com/CVE-2023-49949/): Auth bypass in passwork:passwork (high 8.1)
- [CVE-2023-49948](https://insights.sbomify.com/CVE-2023-49948/): Information disclosure in forgejo:forgejo (medium 5.3)
- [CVE-2023-49947](https://insights.sbomify.com/CVE-2023-49947/): Auth bypass in forgejo:forgejo (high 7.5)
- [CVE-2023-49946](https://insights.sbomify.com/CVE-2023-49946/): Missing authorization in forgejo:forgejo (critical 9.1)
- [CVE-2023-49944](https://insights.sbomify.com/CVE-2023-49944/): Security feature bypass in beyondtrust:privilege management for windows (medium 6.7)
- [CVE-2023-49943](https://insights.sbomify.com/CVE-2023-49943/): Cross-site scripting in zohocorp:manageengine servicedesk plus msp (medium 5.4)
- [CVE-2023-4994](https://insights.sbomify.com/CVE-2023-4994/): Allow PHP in Posts and Pages <= 3.0.4 - Authenticated (Subscriber+) Remote Code Execution via Shortcode (critical 9.9)
- [CVE-2023-49938](https://insights.sbomify.com/CVE-2023-49938/): Missing authorization in schedmd:slurm (high 8.2)
- [CVE-2023-49937](https://insights.sbomify.com/CVE-2023-49937/): Memory corruption in schedmd:slurm (critical 9.8)
- [CVE-2023-49936](https://insights.sbomify.com/CVE-2023-49936/): Null dereference in schedmd:slurm (high 7.5)
- [CVE-2023-49935](https://insights.sbomify.com/CVE-2023-49935/): Auth bypass in schedmd:slurm (high 8.8)
- [CVE-2023-49934](https://insights.sbomify.com/CVE-2023-49934/): SQL injection in schedmd:slurm (critical 9.8)
- [CVE-2023-49933](https://insights.sbomify.com/CVE-2023-49933/): Security feature bypass in schedmd:slurm (high 7.5)
- [CVE-2023-49932](https://insights.sbomify.com/CVE-2023-49932/): Security feature bypass in couchbase:couchbase server (medium 5.4)
- [CVE-2023-49931](https://insights.sbomify.com/CVE-2023-49931/): Missing authorization in couchbase:couchbase server (critical 9.8)
- [CVE-2023-49930](https://insights.sbomify.com/CVE-2023-49930/): Missing authorization in couchbase:couchbase server (critical 9.8)
- [CVE-2023-4993](https://insights.sbomify.com/CVE-2023-4993/): Sensetive Data Exposure in Utarit's Soliclub (high 7.5)
- [CVE-2023-49928](https://insights.sbomify.com/CVE-2023-49928/): Information disclosure in samsung:exynos 1080 firmware (high 7.5)
- [CVE-2023-49927](https://insights.sbomify.com/CVE-2023-49927/): Weak cryptography in samsung:exynos 1080 firmware (medium 5.3)
- [CVE-2023-49926](https://insights.sbomify.com/CVE-2023-49926/): Cross-site scripting in misp-project:misp (medium 6.1)
- [CVE-2023-49923](https://insights.sbomify.com/CVE-2023-49923/): Enterprise Search Insertion of Sensitive Information into Log File (medium 6.8)
- [CVE-2023-49922](https://insights.sbomify.com/CVE-2023-49922/): Beats Insertion of Sensitive Information into Log File (medium 6.8)
- [CVE-2023-49921](https://insights.sbomify.com/CVE-2023-49921/): Elasticsearch Insertion of Sensitive Information into Log File (medium 5.2)
- [CVE-2023-49920](https://insights.sbomify.com/CVE-2023-49920/): Apache Airflow: Missing CSRF protection on DAG/trigger (medium 6.5)
- [CVE-2023-49914](https://insights.sbomify.com/CVE-2023-49914/): Other in choosemuse:muse 2 firmware (medium 6.5)
- [CVE-2023-49913](https://insights.sbomify.com/CVE-2023-49913/): Memory corruption in AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) (high 7.2)
- [CVE-2023-49912](https://insights.sbomify.com/CVE-2023-49912/): Memory corruption in AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) (high 7.2)
- [CVE-2023-49911](https://insights.sbomify.com/CVE-2023-49911/): Memory corruption in AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) (high 7.2)
- [CVE-2023-49910](https://insights.sbomify.com/CVE-2023-49910/): Memory corruption in AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) (high 7.2)
- [CVE-2023-4991](https://insights.sbomify.com/CVE-2023-4991/): NextBX QWAlerter QWAlerter.exe unquoted search path (high 7.8)
- [CVE-2023-49909](https://insights.sbomify.com/CVE-2023-49909/): Memory corruption in AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) (high 7.2)
- [CVE-2023-49908](https://insights.sbomify.com/CVE-2023-49908/): Memory corruption in AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) (high 7.2)
- [CVE-2023-49907](https://insights.sbomify.com/CVE-2023-49907/): Memory corruption in AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) (high 7.2)
- [CVE-2023-49906](https://insights.sbomify.com/CVE-2023-49906/): Memory corruption in AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) (high 7.2)
- [CVE-2023-49900](https://insights.sbomify.com/CVE-2023-49900/): Origin Validation Error in X-Rite MA-T6 (critical 9.8)
- [CVE-2023-4990](https://insights.sbomify.com/CVE-2023-4990/): Path traversal in MCL-Net (high 8.3)
- [CVE-2023-49899](https://insights.sbomify.com/CVE-2023-49899/): Origin Validation Error in X-Rite MA-T6 (critical 9.8)
- [CVE-2023-49898](https://insights.sbomify.com/CVE-2023-49898/): Apache StreamPark (incubating): Authenticated system users could trigger remote command execution (high 7.2)
- [CVE-2023-49897](https://insights.sbomify.com/CVE-2023-49897/): FXC AE1021, AE1021PE OS Command Injection (high 8.8, exploited in the wild)
- [CVE-2023-49886](https://insights.sbomify.com/CVE-2023-49886/): IBM Transformation Extender Advanced code execution (critical 9.8)
- [CVE-2023-49883](https://insights.sbomify.com/CVE-2023-49883/): IBM Transformation Extender Advanced information disclosure (medium 5.9)
- [CVE-2023-49881](https://insights.sbomify.com/CVE-2023-49881/): IBM Transformation Extender Advanced session fixation (medium 6.3)
- [CVE-2023-49880](https://insights.sbomify.com/CVE-2023-49880/): IBM Financial Transaction Manager for SWIFT Services data manipulation (high 7.5)
- [CVE-2023-4988](https://insights.sbomify.com/CVE-2023-4988/): Bettershop LaikeTui unrestricted upload (medium 6.3)
- [CVE-2023-49878](https://insights.sbomify.com/CVE-2023-49878/): IBM System Storage Virtualization Engine information disclosure (medium 4.3)
- [CVE-2023-49877](https://insights.sbomify.com/CVE-2023-49877/): IBM System Storage Virtualization Engine information disclosure (medium 4.3)
- [CVE-2023-49874](https://insights.sbomify.com/CVE-2023-49874/): IDOR when updating the tasks of a private playbook run (medium 4.3)
- [CVE-2023-4987](https://insights.sbomify.com/CVE-2023-4987/): infinitietech taskhub GET Parameter get_tasks_list sql injection (medium 5.5)
- [CVE-2023-49867](https://insights.sbomify.com/CVE-2023-49867/): Memory corruption in WBR-6013 (high 7.2)
- [CVE-2023-49864](https://insights.sbomify.com/CVE-2023-49864/): Path traversal in AVideo (medium 6.5)
- [CVE-2023-49863](https://insights.sbomify.com/CVE-2023-49863/): Path traversal in AVideo (medium 6.5)
- [CVE-2023-49862](https://insights.sbomify.com/CVE-2023-49862/): Path traversal in AVideo (medium 6.5)
- [CVE-2023-49861](https://insights.sbomify.com/CVE-2023-49861/): WordPress Social Media Feather plugin <= 2.1.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-49860](https://insights.sbomify.com/CVE-2023-49860/): WordPress WP Project Manager Plugin <= 2.6.7 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-4986](https://insights.sbomify.com/CVE-2023-4986/): Supcon InPlant SCADA Project.xml unknown vulnerability (low 2.5)
- [CVE-2023-49859](https://insights.sbomify.com/CVE-2023-49859/): WordPress Login With Ajax plugin <= 4.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-49858](https://insights.sbomify.com/CVE-2023-49858/): WordPress Custom Login plugin <= 4.1.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-49857](https://insights.sbomify.com/CVE-2023-49857/): WordPress Awesome Support plugin <= 6.1.7 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-49856](https://insights.sbomify.com/CVE-2023-49856/): WordPress Smart Forms plugin <= 2.6.84 - Authenticated Arbitrary Options Change Vulnerability (high 8.1)
- [CVE-2023-49855](https://insights.sbomify.com/CVE-2023-49855/): Cross-site request forgery in Menu Bar Cart Icon For WooCommerce By Binary Carpenter (medium 6.5)
- [CVE-2023-49854](https://insights.sbomify.com/CVE-2023-49854/): WordPress Caddy Plugin <= 1.9.7 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-49853](https://insights.sbomify.com/CVE-2023-49853/): WordPress PayTR Taksit Tablosu Plugin <= 1.3.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-49852](https://insights.sbomify.com/CVE-2023-49852/): WordPress Responsive Slick Slider WordPress plugin <= 1.4 - Content Injection vulnerability (medium 6.5)
- [CVE-2023-49851](https://insights.sbomify.com/CVE-2023-49851/): WordPress Square Thumbnails plugin <= 1.1.1 - Broken Access Control + CSRF vulnerability (medium 5.3)
- [CVE-2023-49850](https://insights.sbomify.com/CVE-2023-49850/): WordPress WP Simple HTML Sitemap plugin <= 2.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-4985](https://insights.sbomify.com/CVE-2023-4985/): Supcon InPlant SCADA Project.xml improper authentication (medium 5.9)
- [CVE-2023-49849](https://insights.sbomify.com/CVE-2023-49849/): WordPress Shortcoder plugin <= 6.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-49848](https://insights.sbomify.com/CVE-2023-49848/): Missing authorization in Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy (medium 6.5)
- [CVE-2023-49847](https://insights.sbomify.com/CVE-2023-49847/): WordPress Annual Archive Plugin <= 1.6.0 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-49846](https://insights.sbomify.com/CVE-2023-49846/): WordPress Author Avatars List/Block Plugin <= 2.1.17 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-49845](https://insights.sbomify.com/CVE-2023-49845/): WordPress Redirects plugin <= 1.2.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-49844](https://insights.sbomify.com/CVE-2023-49844/): WordPress WPPerformanceTester Plugin <= 2.0.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-49843](https://insights.sbomify.com/CVE-2023-49843/): WordPress First Order Discount Woocommerce Plugin <= 1.21 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-49842](https://insights.sbomify.com/CVE-2023-49842/): WordPress Rocket Maintenance Mode & Coming Soon Page Plugin <= 4.3 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-49841](https://insights.sbomify.com/CVE-2023-49841/): WordPress Optin Forms Plugin <= 1.3.3 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-49840](https://insights.sbomify.com/CVE-2023-49840/): WordPress Multi Currency For WooCommerce Plugin <= 1.5.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-4984](https://insights.sbomify.com/CVE-2023-4984/): didi KnowSearch 1 credentials storage (medium 4.3)
- [CVE-2023-49839](https://insights.sbomify.com/CVE-2023-49839/): Reflected Cross-Site Scripting vulnerability in multiple WordPress components by KlbTheme (high 7.1)
- [CVE-2023-49838](https://insights.sbomify.com/CVE-2023-49838/): Cross-Site Request Forgery (CSRF) vulnerability in multiple themes by KlbTheme (medium 4.3)
- [CVE-2023-49837](https://insights.sbomify.com/CVE-2023-49837/): WordPress embed-code plugin <= 2.3.6 - Denial of Service Attack vulnerability (medium 6.5)
- [CVE-2023-49836](https://insights.sbomify.com/CVE-2023-49836/): WordPress Cookie Bar Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-49835](https://insights.sbomify.com/CVE-2023-49835/): WordPress Post Duplicator plugin <= 2.31 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-49834](https://insights.sbomify.com/CVE-2023-49834/): WordPress WOOCS – WooCommerce Currency Switcher Plugin <= 1.4.1.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-49833](https://insights.sbomify.com/CVE-2023-49833/): WordPress Spectra Plugin <= 2.7.9 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-49832](https://insights.sbomify.com/CVE-2023-49832/): WordPress Site Reviews plugin <= 6.10.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-49831](https://insights.sbomify.com/CVE-2023-49831/): WordPress RegistrationMagic plugin <= 5.2.3.0 - Broken Access Control vulnerability (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/178/