# Vulnerabilities published in 2023 - [CVE-2023-49135](https://insights.sbomify.com/CVE-2023-49135/): multimedia player has a UAF vulnerability (medium 4.0) - [CVE-2023-49134](https://insights.sbomify.com/CVE-2023-49134/): Command injection in AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) (high 8.1) - [CVE-2023-49133](https://insights.sbomify.com/CVE-2023-49133/): Command injection in AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) (high 8.1) - [CVE-2023-49132](https://insights.sbomify.com/CVE-2023-49132/): Memory corruption in Solid Edge SE2023 (high 7.8) - [CVE-2023-49131](https://insights.sbomify.com/CVE-2023-49131/): Memory corruption in Solid Edge SE2023 (high 7.8) - [CVE-2023-49130](https://insights.sbomify.com/CVE-2023-49130/): Memory corruption in Solid Edge SE2023 (high 7.8) - [CVE-2023-4913](https://insights.sbomify.com/CVE-2023-4913/): Cross-site Scripting (XSS) - Reflected in cecilapp/cecil (medium 6.1) - [CVE-2023-49129](https://insights.sbomify.com/CVE-2023-49129/): Memory corruption in Solid Edge SE2023 (high 7.8) - [CVE-2023-49128](https://insights.sbomify.com/CVE-2023-49128/): Memory corruption in Solid Edge SE2023 (high 7.8) - [CVE-2023-49127](https://insights.sbomify.com/CVE-2023-49127/): Memory corruption in Solid Edge SE2023 (high 7.8) - [CVE-2023-49126](https://insights.sbomify.com/CVE-2023-49126/): Memory corruption in Solid Edge SE2023 (high 7.8) - [CVE-2023-49125](https://insights.sbomify.com/CVE-2023-49125/): Memory corruption in Parasolid V35.0 (high 7.8) - [CVE-2023-49124](https://insights.sbomify.com/CVE-2023-49124/): Memory corruption in Solid Edge SE2023 (high 7.8) - [CVE-2023-49123](https://insights.sbomify.com/CVE-2023-49123/): Memory corruption in Solid Edge SE2023 (high 7.8) - [CVE-2023-49122](https://insights.sbomify.com/CVE-2023-49122/): Memory corruption in Solid Edge SE2023 (high 7.8) - [CVE-2023-49121](https://insights.sbomify.com/CVE-2023-49121/): Memory corruption in Solid Edge SE2023 (high 7.8) - [CVE-2023-4912](https://insights.sbomify.com/CVE-2023-4912/): Allocation of Resources Without Limits or Throttling in GitLab (low 2.6) - [CVE-2023-49119](https://insights.sbomify.com/CVE-2023-49119/): Cross-site scripting in GROWI (medium 5.4) - [CVE-2023-49118](https://insights.sbomify.com/CVE-2023-49118/): Dsoftbus has an out-of-bounds read vulnerability (low 2.9) - [CVE-2023-49117](https://insights.sbomify.com/CVE-2023-49117/): Cross-site scripting in PowerCMS (PowerCMS 4 Series) (medium 5.4) - [CVE-2023-49115](https://insights.sbomify.com/CVE-2023-49115/): MachineSense FeverWarn Missing Authentication for Critical Function (high 7.5) - [CVE-2023-49114](https://insights.sbomify.com/CVE-2023-49114/): Local Privilege Escalation via DLL Hijacking (medium 6.7) - [CVE-2023-49113](https://insights.sbomify.com/CVE-2023-49113/): Sensitive Data Stored Insecurely in Kiuwan SAST Local Analyzer (high 7.8) - [CVE-2023-49112](https://insights.sbomify.com/CVE-2023-49112/): Insecure Direct Object Reference in Kiuwan SAST (medium 6.5) - [CVE-2023-49111](https://insights.sbomify.com/CVE-2023-49111/): Reflected Cross-Site-Scripting in Kiuwan SAST (medium 6.5) - [CVE-2023-49110](https://insights.sbomify.com/CVE-2023-49110/): XML External Entity Injection in Kiuwan SAST (high 7.2) - [CVE-2023-4911](https://insights.sbomify.com/CVE-2023-4911/): GNU C Library Buffer Overflow (high 7.8, exploited in the wild) - [CVE-2023-49109](https://insights.sbomify.com/CVE-2023-49109/): Remote Code Execution in Apache Dolphinscheduler (critical 9.8) - [CVE-2023-49108](https://insights.sbomify.com/CVE-2023-49108/): Path traversal in RakRak Document Plus (high 8.8) - [CVE-2023-49107](https://insights.sbomify.com/CVE-2023-49107/): Generation of Error Message Containing Sensitive Information Vulnerability in Hitachi Device Manager (medium 5.3) - [CVE-2023-49106](https://insights.sbomify.com/CVE-2023-49106/): Missing Password Field Masking Vulnerability in Hitachi Device Manager (medium 4.6) - [CVE-2023-49105](https://insights.sbomify.com/CVE-2023-49105/): ownCloud Improper Authentication (critical 9.8, exploited in the wild) - [CVE-2023-49104](https://insights.sbomify.com/CVE-2023-49104/): Open redirect in owncloud:oauth2 (high 8.7) - [CVE-2023-49103](https://insights.sbomify.com/CVE-2023-49103/): ownCloud graphapi Information Disclosure (critical 10.0, exploited in the wild) - [CVE-2023-49102](https://insights.sbomify.com/CVE-2023-49102/): Command injection in nzbget:nzbget (high 8.8) - [CVE-2023-49101](https://insights.sbomify.com/CVE-2023-49101/): Cross-site scripting in axigen:axigen mobile webmail (medium 6.1) - [CVE-2023-49100](https://insights.sbomify.com/CVE-2023-49100/): Trusted Firmware-A (TF-A) before 2.10 has a potential read out-of-bounds in the SDEI service. (medium 4.4) - [CVE-2023-4910](https://insights.sbomify.com/CVE-2023-4910/): 3scale-admin-portal: logged out users tokens can be accessed (medium 5.5) - [CVE-2023-49099](https://insights.sbomify.com/CVE-2023-49099/): Discourse secure uploads accessible to guests even when login is required (low 3.1) - [CVE-2023-49098](https://insights.sbomify.com/CVE-2023-49098/): Reaction data for user notifications exposed in Discourse-reactions (low 3.5) - [CVE-2023-49097](https://insights.sbomify.com/CVE-2023-49097/): ZITADEL vulnerable account takeover via malicious host header injection (high 8.1) - [CVE-2023-49096](https://insights.sbomify.com/CVE-2023-49096/): Argument Injection in FFmpeg codec parameters in Jellyfin (high 7.7) - [CVE-2023-49095](https://insights.sbomify.com/CVE-2023-49095/): nexkey allows arbitrary users to impersonate any remote user due to missing signature validation (high 8.6) - [CVE-2023-49094](https://insights.sbomify.com/CVE-2023-49094/): Symbolicator Server Side Request Forgery vulnerability (medium 4.3) - [CVE-2023-49093](https://insights.sbomify.com/CVE-2023-49093/): HtmlUnit vulnerable to Remote Code Execution (RCE) via XSTL (critical 9.8) - [CVE-2023-49092](https://insights.sbomify.com/CVE-2023-49092/): RustCrypto/RSA vulnerable to a Marvin Attack via key recovery through timing sidechannels (medium 5.9) - [CVE-2023-49091](https://insights.sbomify.com/CVE-2023-49091/): Jwttoken in Cosmos server never expires after password changed and logging out (high 8.8) - [CVE-2023-49090](https://insights.sbomify.com/CVE-2023-49090/): CarrierWave has a content-type allowlist bypass vulnerability, possibly leading to XSS (medium 6.8) - [CVE-2023-4909](https://insights.sbomify.com/CVE-2023-4909/): Security feature bypass in Chrome (medium 4.3) - [CVE-2023-49089](https://insights.sbomify.com/CVE-2023-49089/): Umbraco CMS possible path traversal when creating packages from backoffice (high 7.7) - [CVE-2023-49088](https://insights.sbomify.com/CVE-2023-49088/): Cacti has incomplete fix for CVE-2023-39515 (medium 6.1) - [CVE-2023-49087](https://insights.sbomify.com/CVE-2023-49087/): Validation of SignedInfo (medium 6.8) - [CVE-2023-49086](https://insights.sbomify.com/CVE-2023-49086/): Cacti is vulnerable to cross-Site scripting (XSS) DOM (medium 5.4) - [CVE-2023-49085](https://insights.sbomify.com/CVE-2023-49085/): Cacti SQL Injection vulnerability (high 8.8) - [CVE-2023-49084](https://insights.sbomify.com/CVE-2023-49084/): Local File Inclusion (RCE) in Cacti (high 8.1) - [CVE-2023-49083](https://insights.sbomify.com/CVE-2023-49083/): cryptography vulnerable to NULL-dereference when loading PKCS7 certificates (medium 5.9) - [CVE-2023-49082](https://insights.sbomify.com/CVE-2023-49082/): aiohttp's ClientSession is vulnerable to CRLF injection via method (medium 5.3) - [CVE-2023-49081](https://insights.sbomify.com/CVE-2023-49081/): aiohttp's ClientSession is vulnerable to CRLF injection via version (high 7.2) - [CVE-2023-49080](https://insights.sbomify.com/CVE-2023-49080/): Jupyter Server errors include tracebacks with path information (low 3.5) - [CVE-2023-4908](https://insights.sbomify.com/CVE-2023-4908/): Security feature bypass in Chrome (medium 4.3) - [CVE-2023-49079](https://insights.sbomify.com/CVE-2023-49079/): Misskey's missing signature validation allows arbitrary users to impersonate any remote user. (critical 9.3) - [CVE-2023-49078](https://insights.sbomify.com/CVE-2023-49078/): Cross-Site Scripting vulnerability in raptor-web 0.4.4 (medium 5.4) - [CVE-2023-49077](https://insights.sbomify.com/CVE-2023-49077/): mailcow-dockerized XSS Vulnerability in Quarantine UI Allows Unauthorized Access and Data Manipulation (high 8.3) - [CVE-2023-49076](https://insights.sbomify.com/CVE-2023-49076/): Pimcore missing token/header to prevent CSRF (medium 4.3) - [CVE-2023-49075](https://insights.sbomify.com/CVE-2023-49075/): Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls (high 8.5) - [CVE-2023-49074](https://insights.sbomify.com/CVE-2023-49074/): Denial of service in AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) (high 7.4) - [CVE-2023-49073](https://insights.sbomify.com/CVE-2023-49073/): Memory corruption in WBR-6013 (high 7.2) - [CVE-2023-49070](https://insights.sbomify.com/CVE-2023-49070/): Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still present (critical 9.8) - [CVE-2023-4907](https://insights.sbomify.com/CVE-2023-4907/): Security feature bypass in Chrome (medium 4.3) - [CVE-2023-49069](https://insights.sbomify.com/CVE-2023-49069/): Information disclosure in Mendix Runtime V10 (medium 6.9) - [CVE-2023-49068](https://insights.sbomify.com/CVE-2023-49068/): Apache DolphinScheduler: Information Leakage Vulnerability (high 7.5) - [CVE-2023-49062](https://insights.sbomify.com/CVE-2023-49062/): Information disclosure in Katran (high 7.5) - [CVE-2023-49061](https://insights.sbomify.com/CVE-2023-49061/): Cross-site scripting in Firefox for iOS (medium 6.1) - [CVE-2023-49060](https://insights.sbomify.com/CVE-2023-49060/): Information disclosure in Firefox for iOS (critical 9.8) - [CVE-2023-4906](https://insights.sbomify.com/CVE-2023-4906/): Security feature bypass in Chrome (medium 4.3) - [CVE-2023-49058](https://insights.sbomify.com/CVE-2023-49058/): Directory Traversal vulnerability in SAP Master Data Governance (low 3.5) - [CVE-2023-49052](https://insights.sbomify.com/CVE-2023-49052/): Microweber file upload vulnerability (high 8.8) - [CVE-2023-4905](https://insights.sbomify.com/CVE-2023-4905/): Security feature bypass in Chrome (medium 4.3) - [CVE-2023-49047](https://insights.sbomify.com/CVE-2023-49047/): Memory corruption in tenda:ax1803 firmware (high 7.5) - [CVE-2023-49046](https://insights.sbomify.com/CVE-2023-49046/): Memory corruption in tenda:ax1803 firmware (critical 9.8) - [CVE-2023-49044](https://insights.sbomify.com/CVE-2023-49044/): Memory corruption in tenda:ax1803 firmware (critical 9.8) - [CVE-2023-49043](https://insights.sbomify.com/CVE-2023-49043/): Memory corruption in tenda:ax1803 firmware (critical 9.8) - [CVE-2023-49042](https://insights.sbomify.com/CVE-2023-49042/): Memory corruption in tenda:ax1803 firmware (critical 9.8) - [CVE-2023-49040](https://insights.sbomify.com/CVE-2023-49040/): Command injection in tenda:ax1803 firmware (critical 9.8) - [CVE-2023-4904](https://insights.sbomify.com/CVE-2023-4904/): Security feature bypass in Chrome (medium 4.3) - [CVE-2023-49038](https://insights.sbomify.com/CVE-2023-49038/): Command injection in buffalo:ls210d firmware (high 7.2) - [CVE-2023-49034](https://insights.sbomify.com/CVE-2023-49034/): Cross-site scripting in projeqtor:projeqtor (medium 6.1) - [CVE-2023-49032](https://insights.sbomify.com/CVE-2023-49032/): Business logic in ltb-project:self service password (critical 9.8) - [CVE-2023-49031](https://insights.sbomify.com/CVE-2023-49031/): Path traversal in oneadvanced:tikit emarketing (medium 5.1) - [CVE-2023-49030](https://insights.sbomify.com/CVE-2023-49030/): SQL injection in 32ns:klive (high 7.5) - [CVE-2023-4903](https://insights.sbomify.com/CVE-2023-4903/): Security feature bypass in Chrome (medium 4.3) - [CVE-2023-49029](https://insights.sbomify.com/CVE-2023-49029/): Cross-site scripting in smpn1smg:absis (medium 6.1) - [CVE-2023-49028](https://insights.sbomify.com/CVE-2023-49028/): Cross-site scripting in absis:absis (medium 5.4) - [CVE-2023-4902](https://insights.sbomify.com/CVE-2023-4902/): Security feature bypass in Chrome (medium 4.3) - [CVE-2023-4901](https://insights.sbomify.com/CVE-2023-4901/): Security feature bypass in Chrome (medium 4.3) - [CVE-2023-49007](https://insights.sbomify.com/CVE-2023-49007/): Memory corruption in netgear:rbr750 firmware (critical 9.8) - [CVE-2023-49006](https://insights.sbomify.com/CVE-2023-49006/): Phpsysinfo Cross Site Request Forgery (CSRF) vulnerability (medium 6.5) - [CVE-2023-49004](https://insights.sbomify.com/CVE-2023-49004/): Code injection in dlink:dir-850l firmware (critical 9.8) - [CVE-2023-49003](https://insights.sbomify.com/CVE-2023-49003/): Missing authorization in simplemobiletools:simple dialer (medium 5.3) - [CVE-2023-49002](https://insights.sbomify.com/CVE-2023-49002/): Missing authorization in xenomtechnologies:phone dialer-voice call dialer (high 7.5) --- From sbomify Insights: https://insights.sbomify.com/years/2023/page/184/