# Vulnerabilities published in 2023


- [CVE-2023-49733](https://insights.sbomify.com/CVE-2023-49733/): Apache Cocoon's StreamGenerator is vulnerable to XXE injection (critical 9.8)
- [CVE-2023-4973](https://insights.sbomify.com/CVE-2023-4973/): Academy LMS GET Parameter filter cross site scripting (low 3.5)
- [CVE-2023-49722](https://insights.sbomify.com/CVE-2023-49722/): Misconfiguration in BCC101 (high 8.3)
- [CVE-2023-49721](https://insights.sbomify.com/CVE-2023-49721/): Misconfiguration in LXD (medium 6.7)
- [CVE-2023-4972](https://insights.sbomify.com/CVE-2023-4972/): Information Disclosure in Digital Yepas (critical 9.8)
- [CVE-2023-49716](https://insights.sbomify.com/CVE-2023-49716/): Emerson Rosemount GC370XA, GC700XA, GC1500XA Command Injection (medium 6.9)
- [CVE-2023-49715](https://insights.sbomify.com/CVE-2023-49715/): File upload in AVideo (medium 4.3)
- [CVE-2023-49713](https://insights.sbomify.com/CVE-2023-49713/): Denial of service in GC-A22W-CW (high 7.5)
- [CVE-2023-4971](https://insights.sbomify.com/CVE-2023-4971/): Weaver Xtreme Theme Support < 6.3.1 - Admin+ PHP Object Injection (high 7.2)
- [CVE-2023-49708](https://insights.sbomify.com/CVE-2023-49708/): Extension - joomstar.com - SQLi vulnerability in Starshop component for Joomla 1.0.0-1.0.9 (critical 9.8)
- [CVE-2023-49707](https://insights.sbomify.com/CVE-2023-49707/): Extension - joomlart.com - SQLi vulnerability in S5 Register module for Joomla 1.0.0-3.0.0 (critical 9.8)
- [CVE-2023-49706](https://insights.sbomify.com/CVE-2023-49706/): Race condition in linotp:linotp (medium 6.8)
- [CVE-2023-49701](https://insights.sbomify.com/CVE-2023-49701/): Out-of-bounds access a buffer in SIM management (high 7.2)
- [CVE-2023-49700](https://insights.sbomify.com/CVE-2023-49700/): Buffer Copy Without Checking size of input in IMS (medium 6.7)
- [CVE-2023-4970](https://insights.sbomify.com/CVE-2023-4970/): PubyDoc <= 2.0.6 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-49699](https://insights.sbomify.com/CVE-2023-49699/): Out-of-bounds access a buffer in IMS (medium 6.7)
- [CVE-2023-49695](https://insights.sbomify.com/CVE-2023-49695/): Command injection in WRC-X3000GS (medium 6.8)
- [CVE-2023-49694](https://insights.sbomify.com/CVE-2023-49694/): NETGEAR ProSAFE Network Management System Privilege Escalation Via MySQL Server (high 7.8)
- [CVE-2023-49693](https://insights.sbomify.com/CVE-2023-49693/): NETGEAR ProSAFE Network Management System RCE via Unprotected Access to Java Debug Wire Protocol (critical 9.8)
- [CVE-2023-49692](https://insights.sbomify.com/CVE-2023-49692/): Command injection in RUGGEDCOM RM1224 LTE(4G) EU (high 7.2)
- [CVE-2023-49691](https://insights.sbomify.com/CVE-2023-49691/): Command injection in RUGGEDCOM RM1224 LTE(4G) EU (high 7.2)
- [CVE-2023-4969](https://insights.sbomify.com/CVE-2023-4969/): GPU kernel implementations susceptible to memory leak (medium 6.5)
- [CVE-2023-49689](https://insights.sbomify.com/CVE-2023-49689/): Job Portal v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-49688](https://insights.sbomify.com/CVE-2023-49688/): Job Portal v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-49681](https://insights.sbomify.com/CVE-2023-49681/): Job Portal v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-4968](https://insights.sbomify.com/CVE-2023-4968/): WPLegalPages <= 2.9.2 - Authenticated (Author+) Stored Cross-Site Scripting via Shortcode (medium 5.5)
- [CVE-2023-49677](https://insights.sbomify.com/CVE-2023-49677/): Job Portal v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-49676](https://insights.sbomify.com/CVE-2023-49676/): CODESYS: Use after free vulnerability through corrupted project files (medium 5.5)
- [CVE-2023-49675](https://insights.sbomify.com/CVE-2023-49675/): CODESYS: Out-of-bounds write through corrupted project files (high 7.8)
- [CVE-2023-49674](https://insights.sbomify.com/CVE-2023-49674/): Jenkins NeuVector Vulnerability Scanner Plugin missing permission check (medium 4.3)
- [CVE-2023-49673](https://insights.sbomify.com/CVE-2023-49673/): Jenkins NeuVector Vulnerability Scanner Plugin Cross-Site Request Forgery vulnerability (high 8.8)
- [CVE-2023-4967](https://insights.sbomify.com/CVE-2023-4967/): Denial of service (high 8.2)
- [CVE-2023-49666](https://insights.sbomify.com/CVE-2023-49666/): Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-49665](https://insights.sbomify.com/CVE-2023-49665/): Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-4966](https://insights.sbomify.com/CVE-2023-4966/): Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow (critical 9.4, exploited in the wild)
- [CVE-2023-49658](https://insights.sbomify.com/CVE-2023-49658/): Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-49657](https://insights.sbomify.com/CVE-2023-49657/): Apache Superset: Stored XSS in Dashboard Title and Chart Title (critical 9.6)
- [CVE-2023-49656](https://insights.sbomify.com/CVE-2023-49656/): Jenkins MATLAB Plugin XML External Entity vulnerability (critical 9.8)
- [CVE-2023-49655](https://insights.sbomify.com/CVE-2023-49655/): Jenkins MATLAB Plugin cross-site request forgery vulnerability (high 8.8)
- [CVE-2023-49654](https://insights.sbomify.com/CVE-2023-49654/): Jenkins MATLAB Plugin missing permission checks (critical 9.8)
- [CVE-2023-49653](https://insights.sbomify.com/CVE-2023-49653/): Jenkins Jira Plugin vulnerable to exposure of system-scoped credentials (medium 6.5)
- [CVE-2023-49652](https://insights.sbomify.com/CVE-2023-49652/): Jenkins Google Compute Engine Plugin has incorrect permission checks (low 2.7)
- [CVE-2023-4965](https://insights.sbomify.com/CVE-2023-4965/): phpipam Header redirect (low 2.7)
- [CVE-2023-49647](https://insights.sbomify.com/CVE-2023-49647/): Zoom Desktop Client for Windows - Improper Access Control (high 8.8)
- [CVE-2023-49646](https://insights.sbomify.com/CVE-2023-49646/): Auth bypass in Zoom Clients (medium 6.4)
- [CVE-2023-49641](https://insights.sbomify.com/CVE-2023-49641/): Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-4964](https://insights.sbomify.com/CVE-2023-4964/): Potential open redirect vulnerability in opentext SMAX and AMX product. (high 8.2)
- [CVE-2023-49639](https://insights.sbomify.com/CVE-2023-49639/): Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-49633](https://insights.sbomify.com/CVE-2023-49633/): Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-4963](https://insights.sbomify.com/CVE-2023-4963/): WS Facebook Like Box Widget <= 5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-49625](https://insights.sbomify.com/CVE-2023-49625/): Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-49624](https://insights.sbomify.com/CVE-2023-49624/): Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-49622](https://insights.sbomify.com/CVE-2023-49622/): Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-49621](https://insights.sbomify.com/CVE-2023-49621/): Hardcoded credentials in SIMATIC CN 4100 (critical 9.8)
- [CVE-2023-49620](https://insights.sbomify.com/CVE-2023-49620/): Apache DolphinScheduler: Authenticated users could delete UDFs in resource center they were not authorized for (medium 6.5)
- [CVE-2023-4962](https://insights.sbomify.com/CVE-2023-4962/): Video PopUp <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-49619](https://insights.sbomify.com/CVE-2023-49619/): Apache Answer: Repeated submissions using scripts resulted in an abnormal number of collections for questions. (low 3.1)
- [CVE-2023-49618](https://insights.sbomify.com/CVE-2023-49618/): Memory corruption in Intel(R) System Security Report and System Resources Defense firmware (high 8.7)
- [CVE-2023-49617](https://insights.sbomify.com/CVE-2023-49617/): MachineSense FeverWarn Missing Authentication for Critical Function (critical 10.0)
- [CVE-2023-49615](https://insights.sbomify.com/CVE-2023-49615/): Privilege escalation in Intel(R) System Security Report and System Resources Defense firmware (high 8.7)
- [CVE-2023-49614](https://insights.sbomify.com/CVE-2023-49614/): Memory corruption in Intel(R) FPGA products (medium 5.7)
- [CVE-2023-49610](https://insights.sbomify.com/CVE-2023-49610/): MachineSense FeverWarn Improper Input Validation (high 8.1)
- [CVE-2023-4961](https://insights.sbomify.com/CVE-2023-4961/): Poptin <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-49607](https://insights.sbomify.com/CVE-2023-49607/): Playbook plugin crash via missing interface type assertion (medium 4.3)
- [CVE-2023-49606](https://insights.sbomify.com/CVE-2023-49606/): Use after free in Tinyproxy (critical 9.8)
- [CVE-2023-49603](https://insights.sbomify.com/CVE-2023-49603/): Race condition in Intel(R) System Security Report and System Resources Defense firmware (high 8.7)
- [CVE-2023-49602](https://insights.sbomify.com/CVE-2023-49602/): Arkui has a type confusion vulnerability (low 2.9)
- [CVE-2023-49600](https://insights.sbomify.com/CVE-2023-49600/): Memory corruption in libigl (high 8.1)
- [CVE-2023-4960](https://insights.sbomify.com/CVE-2023-4960/): WCFM Marketplace <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-49599](https://insights.sbomify.com/CVE-2023-49599/): WWBN AVideo Insufficient Entropy vulnerbaility (critical 9.8)
- [CVE-2023-49598](https://insights.sbomify.com/CVE-2023-49598/): Cross-site scripting in GROWI (medium 5.4)
- [CVE-2023-49595](https://insights.sbomify.com/CVE-2023-49595/): Memory corruption in WBR-6013 (high 7.2)
- [CVE-2023-49594](https://insights.sbomify.com/CVE-2023-49594/): Information disclosure in DuoUniversalKeycloakAuthenticator (medium 4.5)
- [CVE-2023-49593](https://insights.sbomify.com/CVE-2023-49593/): Command injection in WBR-6013 (high 7.2)
- [CVE-2023-4959](https://insights.sbomify.com/CVE-2023-4959/): Quay: cross-site request forgery (csrf) on config-editor page (medium 6.5)
- [CVE-2023-49589](https://insights.sbomify.com/CVE-2023-49589/): Weak cryptography in AVideo (high 8.8)
- [CVE-2023-49587](https://insights.sbomify.com/CVE-2023-49587/): Command Injection vulnerability in SAP Solution Manager (medium 6.4)
- [CVE-2023-49584](https://insights.sbomify.com/CVE-2023-49584/): Client-Side Desynchronization vulnerability in SAP Fiori Launchpad (medium 4.3)
- [CVE-2023-49583](https://insights.sbomify.com/CVE-2023-49583/): Escalation of Privileges in SAP BTP Security Services Integration Library ([Node.js] @sap/xssec) (critical 9.1)
- [CVE-2023-49582](https://insights.sbomify.com/CVE-2023-49582/): Apache Portable Runtime (APR): Unexpected lax shared memory permissions (medium 5.5)
- [CVE-2023-49581](https://insights.sbomify.com/CVE-2023-49581/): SQL Injection vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform (medium 4.1)
- [CVE-2023-49580](https://insights.sbomify.com/CVE-2023-49580/): Information disclosure in SAP GUI for Windows and SAP GUI for Java (high 7.3)
- [CVE-2023-4958](https://insights.sbomify.com/CVE-2023-4958/): Stackrox: missing http security headers allows for clickjacking in web ui (medium 6.1)
- [CVE-2023-49578](https://insights.sbomify.com/CVE-2023-49578/): Denial of service (DOS) in SAP Cloud Connector (low 3.5)
- [CVE-2023-49577](https://insights.sbomify.com/CVE-2023-49577/): Cross-Site Scripting (XSS) vulnerability in the SAP HCM (SMART PAYE solution) (medium 6.1)
- [CVE-2023-49575](https://insights.sbomify.com/CVE-2023-49575/): XSS vulnerability in VX Search Enterprise (high 7.1)
- [CVE-2023-49574](https://insights.sbomify.com/CVE-2023-49574/): XSS vulnerability in VX Search Enterprise (high 7.1)
- [CVE-2023-49573](https://insights.sbomify.com/CVE-2023-49573/): XSS vulnerability in VX Search Enterprise (high 7.1)
- [CVE-2023-49572](https://insights.sbomify.com/CVE-2023-49572/): XSS vulnerability in VX Search Enterprise (high 7.1)
- [CVE-2023-49570](https://insights.sbomify.com/CVE-2023-49570/): Insecure Trust of Basic Constraints certificate in Bitdefender Total Security HTTPS Scanning (VA-11210) (high 8.6)
- [CVE-2023-4957](https://insights.sbomify.com/CVE-2023-4957/): Authentication Bypass on Zebra ZTC (medium 5.4)
- [CVE-2023-49569](https://insights.sbomify.com/CVE-2023-49569/): Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients (critical 9.8)
- [CVE-2023-49568](https://insights.sbomify.com/CVE-2023-49568/): Maliciously crafted Git server replies can cause DoS on go-git clients (high 7.5)
- [CVE-2023-49567](https://insights.sbomify.com/CVE-2023-49567/): Insecure Trust of certificates using collision hash functions in Bitdefender Total Security HTTPS Scanning (VA-11239) (high 8.6)
- [CVE-2023-49566](https://insights.sbomify.com/CVE-2023-49566/): Apache Linkis DataSource: JDBC Datasource Module with DB2 has JNDI Injection vulnerability (high 8.8)
- [CVE-2023-49565](https://insights.sbomify.com/CVE-2023-49565/): Remote Code Execution (high 8.4)
- [CVE-2023-49564](https://insights.sbomify.com/CVE-2023-49564/): Authentication Bypass (high 8.8)
- [CVE-2023-49563](https://insights.sbomify.com/CVE-2023-49563/): Cross-site scripting in voltronicpower:snmp web pro (medium 6.1)
- [CVE-2023-4956](https://insights.sbomify.com/CVE-2023-4956/): Quay: clickjacking on config-editor page severity (medium 6.5)
- [CVE-2023-49559](https://insights.sbomify.com/CVE-2023-49559/): gqlparser denial of service vulnerability via the parserDirectives function (low 3.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/180/