# Vulnerabilities published in 2023


- [CVE-2023-4938](https://insights.sbomify.com/CVE-2023-4938/): BEAR <= 1.1.3.3 - Missing Authorization to Product Manipulation (medium 4.3)
- [CVE-2023-49379](https://insights.sbomify.com/CVE-2023-49379/): Cross-Site Request Forgery in JFinalCMS via the component /admin/friend_link/save (high 8.8)
- [CVE-2023-49378](https://insights.sbomify.com/CVE-2023-49378/): Cross-Site Request Forgery in JFinalCMS via /admin/form/save (high 8.8)
- [CVE-2023-49377](https://insights.sbomify.com/CVE-2023-49377/): Cross-Site Request Forgery in JFinalCMS via /admin/tag/update (high 8.8)
- [CVE-2023-49376](https://insights.sbomify.com/CVE-2023-49376/): Cross-Site Request Forgery in JFinalCMS (high 8.8)
- [CVE-2023-49375](https://insights.sbomify.com/CVE-2023-49375/): Cross-Site Request Forgery in JFinalCMS via /admin/friend_link/update (high 8.8)
- [CVE-2023-49374](https://insights.sbomify.com/CVE-2023-49374/): Cross-Site Request Forgery in JFinalCMS via /admin/slide/update (high 8.8)
- [CVE-2023-49373](https://insights.sbomify.com/CVE-2023-49373/): Cross-Site Request Forgery in JFinalCMS (high 8.8)
- [CVE-2023-49372](https://insights.sbomify.com/CVE-2023-49372/): Cross-Site Request Forgery in JFinalCMS (high 8.8)
- [CVE-2023-49371](https://insights.sbomify.com/CVE-2023-49371/): RuoYi vulnerable to SQL injection vulnerability (critical 9.8)
- [CVE-2023-4937](https://insights.sbomify.com/CVE-2023-4937/): BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Manipulation (medium 4.3)
- [CVE-2023-49367](https://insights.sbomify.com/CVE-2023-49367/): An issue in user interface in Kyocera Command Center RX EXOSYS M5521cdn allows remote to obtain sensitive information via inspecting sent packages by user. (high 8.8)
- [CVE-2023-49363](https://insights.sbomify.com/CVE-2023-49363/): SQL injection in rockoa:rockoa (critical 9.8)
- [CVE-2023-4936](https://insights.sbomify.com/CVE-2023-4936/): Synaptics-DisplayLink-privilege escalation vulnerability via a dynamic library sideloading (medium 5.5)
- [CVE-2023-49356](https://insights.sbomify.com/CVE-2023-49356/): Memory corruption in glensawyer:mp3gain (high 7.5)
- [CVE-2023-49355](https://insights.sbomify.com/CVE-2023-49355/): Memory corruption in jqlang:jq (high 7.5)
- [CVE-2023-49351](https://insights.sbomify.com/CVE-2023-49351/): Memory corruption in edimax:br-6478ac firmware (critical 9.8)
- [CVE-2023-4935](https://insights.sbomify.com/CVE-2023-4935/): BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Profile Creation (medium 4.3)
- [CVE-2023-49347](https://insights.sbomify.com/CVE-2023-49347/): Information disclosure in Budgie Extras (medium 6.0)
- [CVE-2023-49346](https://insights.sbomify.com/CVE-2023-49346/): Other in Budgie Extras (medium 6.0)
- [CVE-2023-49345](https://insights.sbomify.com/CVE-2023-49345/): Other in Budgie Extras (medium 6.0)
- [CVE-2023-49344](https://insights.sbomify.com/CVE-2023-49344/): Information disclosure in Budgie Extras (medium 6.0)
- [CVE-2023-49343](https://insights.sbomify.com/CVE-2023-49343/): Other in Budgie Extras (medium 6.0)
- [CVE-2023-49342](https://insights.sbomify.com/CVE-2023-49342/): Other in Budgie Extras (medium 6.0)
- [CVE-2023-49341](https://insights.sbomify.com/CVE-2023-49341/): An issue was discovered in Newland Nquire 1000 Interactive Kiosk version NQ1000-II_G_V1.00.011, allows remote attackers to obtain sensitive (high 7.5)
- [CVE-2023-49340](https://insights.sbomify.com/CVE-2023-49340/): An issue was discovered in Newland Nquire 1000 Interactive Kiosk version NQ1000-II_G_V1.00.011, allows remote attackers to escalate privileg (critical 9.8)
- [CVE-2023-4934](https://insights.sbomify.com/CVE-2023-4934/): IDOR in Usta AYBS (high 8.8)
- [CVE-2023-49339](https://insights.sbomify.com/CVE-2023-49339/): Missing authorization in ellucian:banner (medium 6.5)
- [CVE-2023-49338](https://insights.sbomify.com/CVE-2023-49338/): Missing authorization in couchbase:couchbase server (high 7.5)
- [CVE-2023-49337](https://insights.sbomify.com/CVE-2023-49337/): Concrete CMS Stored XSS (low 2.4)
- [CVE-2023-49335](https://insights.sbomify.com/CVE-2023-49335/): SQL injection in ADAudit Plus (high 8.3)
- [CVE-2023-49334](https://insights.sbomify.com/CVE-2023-49334/): SQL injection in ADAudit Plus (high 8.3)
- [CVE-2023-49333](https://insights.sbomify.com/CVE-2023-49333/): SQL injection in ADAudit Plus (high 8.3)
- [CVE-2023-49332](https://insights.sbomify.com/CVE-2023-49332/): SQL injection in ADAudit Plus (high 8.3)
- [CVE-2023-49331](https://insights.sbomify.com/CVE-2023-49331/): SQL injection in ADAudit Plus (high 8.3)
- [CVE-2023-49330](https://insights.sbomify.com/CVE-2023-49330/): SQL injection in ADAudit Plus (high 8.3)
- [CVE-2023-4933](https://insights.sbomify.com/CVE-2023-4933/): WP Job Openings < 3.4.3 - Sensitive Data Exposure via Directory Listing (medium 5.3)
- [CVE-2023-49329](https://insights.sbomify.com/CVE-2023-49329/): Command injection in anomali:match (high 7.2)
- [CVE-2023-49328](https://insights.sbomify.com/CVE-2023-49328/): Command injection in wolterskluwer:b.point (high 7.2)
- [CVE-2023-49322](https://insights.sbomify.com/CVE-2023-49322/): Denial of service in f-secure:atlant (high 7.5)
- [CVE-2023-49321](https://insights.sbomify.com/CVE-2023-49321/): Denial of service in f-secure:atlant (medium 5.3)
- [CVE-2023-4932](https://insights.sbomify.com/CVE-2023-4932/): Reflected Cross-Site Scripting in SAS 9.4 (medium 6.3)
- [CVE-2023-49316](https://insights.sbomify.com/CVE-2023-49316/): Phpseclib needs guardrails on large binaryfield integers (high 7.5)
- [CVE-2023-49314](https://insights.sbomify.com/CVE-2023-49314/): Code injection in asana:desktop (high 7.8)
- [CVE-2023-49313](https://insights.sbomify.com/CVE-2023-49313/): Code injection in horsicq:xmachoviewer (critical 9.8)
- [CVE-2023-49312](https://insights.sbomify.com/CVE-2023-49312/): Security feature bypass in precisionbridge:precision bridge (critical 9.1)
- [CVE-2023-4931](https://insights.sbomify.com/CVE-2023-4931/): Uncontrolled search path element vulnerability in Plesk (medium 6.3)
- [CVE-2023-4930](https://insights.sbomify.com/CVE-2023-4930/): Front End PM < 11.4.3 - Sensitive Data Exposure via Directory Listing (medium 6.5)
- [CVE-2023-49299](https://insights.sbomify.com/CVE-2023-49299/): Apache DolphinScheduler: Arbitrary js execute as root for authenticated users (high 8.8)
- [CVE-2023-49298](https://insights.sbomify.com/CVE-2023-49298/): Security feature bypass in openzfs:openzfs (high 7.5)
- [CVE-2023-49297](https://insights.sbomify.com/CVE-2023-49297/): Unsafe YAML deserialization in PyDrive2 (low 3.3)
- [CVE-2023-49296](https://insights.sbomify.com/CVE-2023-49296/): Arduino Create Agent vulnerable to Reflected Cross-Site Scripting (medium 6.3)
- [CVE-2023-49295](https://insights.sbomify.com/CVE-2023-49295/): quic-go's path validation mechanism can cause denial of service (medium 6.4)
- [CVE-2023-49294](https://insights.sbomify.com/CVE-2023-49294/): Asterisk Path Traversal vulnerability (medium 4.9)
- [CVE-2023-49293](https://insights.sbomify.com/CVE-2023-49293/): Cross-site Scripting in `server.transformIndexHtml` via URL payload in vite (medium 6.1)
- [CVE-2023-49292](https://insights.sbomify.com/CVE-2023-49292/): Possible private key restoration in go package github.com/ecies/go (medium 4.9)
- [CVE-2023-49291](https://insights.sbomify.com/CVE-2023-49291/): Improper Sanitization of Branch Name Leads to Arbitrary Code Injection (critical 9.3)
- [CVE-2023-49290](https://insights.sbomify.com/CVE-2023-49290/): Malicious parameters can cause a denial of service in lestrrat-go/jwx (medium 5.3)
- [CVE-2023-4929](https://insights.sbomify.com/CVE-2023-4929/): NPort 5000 Series Firmware Improper Validation of Integrity Check Vulnerability (medium 6.5)
- [CVE-2023-49289](https://insights.sbomify.com/CVE-2023-49289/): Cross-site Scripting in Ajax.NET Professional (medium 6.3)
- [CVE-2023-49288](https://insights.sbomify.com/CVE-2023-49288/): Denial of Service in HTTP Collapsed Forwarding in Squid (high 8.6)
- [CVE-2023-49287](https://insights.sbomify.com/CVE-2023-49287/): Buffer overflow vulnerabilities in tinydir (high 7.7)
- [CVE-2023-49286](https://insights.sbomify.com/CVE-2023-49286/): Denial of Service in Helper Process management (high 8.6)
- [CVE-2023-49285](https://insights.sbomify.com/CVE-2023-49285/): Denial of Service in HTTP Message Processing in Squid (high 8.6)
- [CVE-2023-49284](https://insights.sbomify.com/CVE-2023-49284/): Command substitution output can trigger shell expansion in fish shell (low 3.9)
- [CVE-2023-49283](https://insights.sbomify.com/CVE-2023-49283/): Test code in published microsoft-graph-core package exposes phpinfo() (medium 5.4)
- [CVE-2023-49282](https://insights.sbomify.com/CVE-2023-49282/): Test code in published microsoft-graph package exposes phpinfo() (medium 5.4)
- [CVE-2023-49281](https://insights.sbomify.com/CVE-2023-49281/): Open Redirect in Login Function of Calendarinho (medium 4.7)
- [CVE-2023-49280](https://insights.sbomify.com/CVE-2023-49280/): Data leak of password hash through xwiki change request (high 7.7)
- [CVE-2023-4928](https://insights.sbomify.com/CVE-2023-4928/): SQL Injection in instantsoft/icms2 (high 7.2)
- [CVE-2023-49279](https://insights.sbomify.com/CVE-2023-49279/): Umbraco CMS vulnerable to stored XSS via SVG File Upload (low 3.7)
- [CVE-2023-49278](https://insights.sbomify.com/CVE-2023-49278/): Umbraco CMS brute force exploit can be used to collect valid usernames (medium 5.3)
- [CVE-2023-49277](https://insights.sbomify.com/CVE-2023-49277/): Reflected Cross-site Scripting Vulnerability in dpaste (high 8.3)
- [CVE-2023-49276](https://insights.sbomify.com/CVE-2023-49276/): Attribute Injection leading to XSS(Cross-Site-Scripting) in uptime-kuma (medium 6.3)
- [CVE-2023-49275](https://insights.sbomify.com/CVE-2023-49275/): Wazuh vulnerable to NULL Pointer Dereference in wazuh-analysisd (medium 6.5)
- [CVE-2023-49274](https://insights.sbomify.com/CVE-2023-49274/): Umbraco CMS SMTP misconfiguration exposes potential registered user email (low 3.7)
- [CVE-2023-49273](https://insights.sbomify.com/CVE-2023-49273/): Umbraco CMS vulnerable to Privilege Escalation using Spoofing (medium 5.4)
- [CVE-2023-49272](https://insights.sbomify.com/CVE-2023-49272/): Hotel Management v1.0 - Multiple Reflected Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2023-49271](https://insights.sbomify.com/CVE-2023-49271/): Hotel Management v1.0 - Multiple Reflected Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2023-49270](https://insights.sbomify.com/CVE-2023-49270/): Hotel Management v1.0 - Multiple Reflected Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2023-49269](https://insights.sbomify.com/CVE-2023-49269/): Hotel Management v1.0 - Multiple Reflected Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2023-49262](https://insights.sbomify.com/CVE-2023-49262/): Buffer overflow vulnerability in Cookie authentication field (critical 9.8)
- [CVE-2023-49261](https://insights.sbomify.com/CVE-2023-49261/): Sensitive authentication-related value accessible publicly (high 7.5)
- [CVE-2023-49260](https://insights.sbomify.com/CVE-2023-49260/): Stored cross-site scripting vulnerability (medium 6.1)
- [CVE-2023-4926](https://insights.sbomify.com/CVE-2023-4926/): BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Deletion (medium 5.4)
- [CVE-2023-49259](https://insights.sbomify.com/CVE-2023-49259/): Bruteforcing authentication cookie for a given user (high 7.5)
- [CVE-2023-49258](https://insights.sbomify.com/CVE-2023-49258/): Reflected cross-site scripting vulnerability (medium 6.1)
- [CVE-2023-49257](https://insights.sbomify.com/CVE-2023-49257/): Command execution using the certificate upload utility (high 8.8)
- [CVE-2023-49256](https://insights.sbomify.com/CVE-2023-49256/): Predictable encryption passphrase used in publicly accessible configuration file (high 7.5)
- [CVE-2023-49255](https://insights.sbomify.com/CVE-2023-49255/): Router console accessible without authentication (critical 9.8)
- [CVE-2023-49254](https://insights.sbomify.com/CVE-2023-49254/): Command injection in the network test tools (high 8.8)
- [CVE-2023-49253](https://insights.sbomify.com/CVE-2023-49253/): Predefined root password (critical 9.8)
- [CVE-2023-49252](https://insights.sbomify.com/CVE-2023-49252/): Missing authorization in SIMATIC CN 4100 (high 7.5)
- [CVE-2023-49251](https://insights.sbomify.com/CVE-2023-49251/): Auth bypass in SIMATIC CN 4100 (high 8.8)
- [CVE-2023-49250](https://insights.sbomify.com/CVE-2023-49250/): Apache DolphinScheduler: Insecure TLS TrustManager used in HttpUtil (high 7.3)
- [CVE-2023-4925](https://insights.sbomify.com/CVE-2023-4925/): Easy Forms for Mailchimp <= 6.8.10 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2023-49248](https://insights.sbomify.com/CVE-2023-49248/): Missing authorization in EMUI (medium 5.5)
- [CVE-2023-49247](https://insights.sbomify.com/CVE-2023-49247/): Security feature bypass in EMUI (high 7.5)
- [CVE-2023-49246](https://insights.sbomify.com/CVE-2023-49246/): Missing authorization in EMUI (high 7.5)
- [CVE-2023-49245](https://insights.sbomify.com/CVE-2023-49245/): Missing authorization in EMUI (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/182/