# Vulnerabilities published in 2023


- [CVE-2023-4870](https://insights.sbomify.com/CVE-2023-4870/): SourceCodester Contact Manager App Contact Information index.php cross site scripting (low 3.5)
- [CVE-2023-48699](https://insights.sbomify.com/CVE-2023-48699/): fastbots Eval Injection vulnerability (high 8.4)
- [CVE-2023-48698](https://insights.sbomify.com/CVE-2023-48698/): Azure RTOS USBX Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2023-48697](https://insights.sbomify.com/CVE-2023-48697/): Azure RTOS USBX Remote Code Execution Vulnerability (medium 6.4)
- [CVE-2023-48696](https://insights.sbomify.com/CVE-2023-48696/): Azure RTOS USBX Remote Code Execution Vulnerability (medium 6.7)
- [CVE-2023-48695](https://insights.sbomify.com/CVE-2023-48695/): Azure RTOS USBX Remote Code Execution Vulnerability (high 7.2)
- [CVE-2023-48694](https://insights.sbomify.com/CVE-2023-48694/): Azure RTOS USBX Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2023-48693](https://insights.sbomify.com/CVE-2023-48693/): Azure RTOS ThreadX Remote Code Execution Vulnerability (high 8.7)
- [CVE-2023-48692](https://insights.sbomify.com/CVE-2023-48692/): Azure RTOS NetX Duo Remote Code Execution Vulnerability (critical 9.1)
- [CVE-2023-48691](https://insights.sbomify.com/CVE-2023-48691/): Azure RTOS NetX Duo Remote Code Execution Vulnerability (high 8.1)
- [CVE-2023-4869](https://insights.sbomify.com/CVE-2023-4869/): SourceCodester Contact Manager App update.php cross-site request forgery (medium 4.3)
- [CVE-2023-48689](https://insights.sbomify.com/CVE-2023-48689/): Railway Reservation System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-48687](https://insights.sbomify.com/CVE-2023-48687/): Railway Reservation System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-48685](https://insights.sbomify.com/CVE-2023-48685/): Railway Reservation System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-48684](https://insights.sbomify.com/CVE-2023-48684/): Missing authorization in Acronis Cyber Protect 17 (high 7.1)
- [CVE-2023-48683](https://insights.sbomify.com/CVE-2023-48683/): Missing authorization in Acronis Cyber Protect 16 (high 7.1)
- [CVE-2023-48682](https://insights.sbomify.com/CVE-2023-48682/): Cross-site scripting in Acronis Cyber Protect 16 (medium 6.1)
- [CVE-2023-48681](https://insights.sbomify.com/CVE-2023-48681/): Cross-site scripting in Acronis Cyber Protect 16 (low 1.9)
- [CVE-2023-48680](https://insights.sbomify.com/CVE-2023-48680/): Information disclosure in Acronis Cyber Protect 16 (low 3.3)
- [CVE-2023-4868](https://insights.sbomify.com/CVE-2023-4868/): SourceCodester Contact Manager App add.php cross-site request forgery (medium 4.3)
- [CVE-2023-48679](https://insights.sbomify.com/CVE-2023-48679/): Cross-site scripting in Acronis Cyber Protect 16 (low 3.1)
- [CVE-2023-48678](https://insights.sbomify.com/CVE-2023-48678/): Misconfiguration in Acronis Cyber Protect 16 (medium 5.5)
- [CVE-2023-48677](https://insights.sbomify.com/CVE-2023-48677/): Privilege escalation in Acronis Cyber Protect 16 (high 7.3)
- [CVE-2023-48676](https://insights.sbomify.com/CVE-2023-48676/): Missing authorization in Acronis Cyber Protect Cloud Agent (low 3.3)
- [CVE-2023-48674](https://insights.sbomify.com/CVE-2023-48674/): Denial of service in CPG BIOS (medium 6.8)
- [CVE-2023-48671](https://insights.sbomify.com/CVE-2023-48671/): Information disclosure in vApp Manager (high 7.5)
- [CVE-2023-48670](https://insights.sbomify.com/CVE-2023-48670/): Privilege escalation in SupportAssist Client Consumer (high 7.3)
- [CVE-2023-4867](https://insights.sbomify.com/CVE-2023-4867/): Xintian Smart Table Integrated Management System Added Site Page AddUpdateSites.aspx sql injection (medium 6.3)
- [CVE-2023-48668](https://insights.sbomify.com/CVE-2023-48668/): Command injection in PowerProtect DD (high 8.2)
- [CVE-2023-48667](https://insights.sbomify.com/CVE-2023-48667/): Command injection in PowerProtect DD (high 7.2)
- [CVE-2023-48665](https://insights.sbomify.com/CVE-2023-48665/): Command injection in vApp Manager, (high 7.2)
- [CVE-2023-48664](https://insights.sbomify.com/CVE-2023-48664/): Command injection in vApp Manager (high 7.2)
- [CVE-2023-48663](https://insights.sbomify.com/CVE-2023-48663/): Command injection in vApp Manager (high 7.2)
- [CVE-2023-48662](https://insights.sbomify.com/CVE-2023-48662/): Command injection in vApp Manager (high 7.2)
- [CVE-2023-48661](https://insights.sbomify.com/CVE-2023-48661/): Path traversal in vApp Manager (medium 4.9)
- [CVE-2023-48660](https://insights.sbomify.com/CVE-2023-48660/): Path traversal in vApp Manger (high 7.5)
- [CVE-2023-4866](https://insights.sbomify.com/CVE-2023-4866/): SourceCodester Online Tours & Travels Management System booking.php exec sql injection (medium 6.3)
- [CVE-2023-48659](https://insights.sbomify.com/CVE-2023-48659/): Other in misp-project:misp (critical 9.8)
- [CVE-2023-48658](https://insights.sbomify.com/CVE-2023-48658/): Other in misp-project:misp (critical 9.8)
- [CVE-2023-48657](https://insights.sbomify.com/CVE-2023-48657/): Other in misp-project:misp (critical 9.8)
- [CVE-2023-48656](https://insights.sbomify.com/CVE-2023-48656/): SQL injection in misp-project:misp (critical 9.8)
- [CVE-2023-48655](https://insights.sbomify.com/CVE-2023-48655/): Other in misp-project:misp (critical 9.8)
- [CVE-2023-48654](https://insights.sbomify.com/CVE-2023-48654/): Security feature bypass in oneidentity:password manager (critical 9.8)
- [CVE-2023-48653](https://insights.sbomify.com/CVE-2023-48653/): Concrete CMS Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2023-48652](https://insights.sbomify.com/CVE-2023-48652/): Concrete CMS Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-48651](https://insights.sbomify.com/CVE-2023-48651/): Concrete CMS Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2023-48650](https://insights.sbomify.com/CVE-2023-48650/): Concrete CMS Stored XSS in Layout Preset Name (medium 4.8)
- [CVE-2023-4865](https://insights.sbomify.com/CVE-2023-4865/): SourceCodester Take-Note App cross-site request forgery (medium 4.3)
- [CVE-2023-48649](https://insights.sbomify.com/CVE-2023-48649/): Concrete CMS Cross-site Scripting vulnerability (low 3.5)
- [CVE-2023-48648](https://insights.sbomify.com/CVE-2023-48648/): Concrete CMS allows unauthorized access because directories can be created with insecure permissions (critical 9.8)
- [CVE-2023-48646](https://insights.sbomify.com/CVE-2023-48646/): Command injection in zohocorp:manageengine recoverymanager plus (high 7.2)
- [CVE-2023-48645](https://insights.sbomify.com/CVE-2023-48645/): SQL injection in eptura:archibus (high 7.8)
- [CVE-2023-48644](https://insights.sbomify.com/CVE-2023-48644/): Cross-site scripting in eptura:archibus (medium 6.1)
- [CVE-2023-48643](https://insights.sbomify.com/CVE-2023-48643/): Shrubbery tac_plus 2.x, 3.x. (critical 9.8)
- [CVE-2023-48642](https://insights.sbomify.com/CVE-2023-48642/): Cross-site scripting in archerirm:archer (medium 5.4)
- [CVE-2023-48641](https://insights.sbomify.com/CVE-2023-48641/): Missing authorization in archerirm:archer (high 7.5)
- [CVE-2023-4864](https://insights.sbomify.com/CVE-2023-4864/): SourceCodester Take-Note App index.php cross site scripting (low 3.5)
- [CVE-2023-48639](https://insights.sbomify.com/CVE-2023-48639/): Adobe Substance 3D Designer 13.0.2 build 6942 Vulnerability I (high 7.8)
- [CVE-2023-48638](https://insights.sbomify.com/CVE-2023-48638/): Adobe Substance 3D Designer 13.0.2 build 6942 Vulnerability III (medium 5.5)
- [CVE-2023-48637](https://insights.sbomify.com/CVE-2023-48637/): Adobe Substance 3D Designer 13.0.2 build 6942 Vulnerability II (medium 5.5)
- [CVE-2023-48636](https://insights.sbomify.com/CVE-2023-48636/): Adobe Substance 3D Designer 13.0.2 build 6942 Vulnerability IV (medium 5.5)
- [CVE-2023-48635](https://insights.sbomify.com/CVE-2023-48635/): ZDI-CAN-22174: Adobe After Effects AEP File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-48634](https://insights.sbomify.com/CVE-2023-48634/): ZDI-CAN-22175: Adobe After Effects AEP File Parsing Memory Corruption Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-48633](https://insights.sbomify.com/CVE-2023-48633/): ZDI-CAN-22173: Adobe After Effects AEP File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-48632](https://insights.sbomify.com/CVE-2023-48632/): ZDI-CAN-22172: Adobe After Effects AEP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-48631](https://insights.sbomify.com/CVE-2023-48631/): Denial of Service of regular expression in package @adobe/css-tools (medium 5.3)
- [CVE-2023-48630](https://insights.sbomify.com/CVE-2023-48630/): Adobe Substance 3D Sampler v4.2.1Build3527 OOBW Vulnerability I (high 7.8)
- [CVE-2023-4863](https://insights.sbomify.com/CVE-2023-4863/): Google Chromium WebP Heap-Based Buffer Overflow (high 8.8, exploited in the wild)
- [CVE-2023-48629](https://insights.sbomify.com/CVE-2023-48629/): Adobe Substance 3D Sampler v4.2.1Build3527 OOBW Vulnerability II (high 7.8)
- [CVE-2023-48628](https://insights.sbomify.com/CVE-2023-48628/): Adobe Substance 3D Sampler v4.2.1Build3527 OOBW Vulnerability III (high 7.8)
- [CVE-2023-48627](https://insights.sbomify.com/CVE-2023-48627/): Adobe Substance 3D Sampler v4.2.1Build3527 OOBW Vulnerability IV (high 7.8)
- [CVE-2023-48626](https://insights.sbomify.com/CVE-2023-48626/): Adobe Substance 3D Sampler v4.2.1Build3527 OOBW Vulnerability V (high 7.8)
- [CVE-2023-48625](https://insights.sbomify.com/CVE-2023-48625/): Adobe Substance 3D Sampler v4.2.1Build3527 OOBW Vulnerability VI (high 7.8)
- [CVE-2023-48624](https://insights.sbomify.com/CVE-2023-48624/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2023-48623](https://insights.sbomify.com/CVE-2023-48623/): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 5.4)
- [CVE-2023-48622](https://insights.sbomify.com/CVE-2023-48622/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2023-48621](https://insights.sbomify.com/CVE-2023-48621/): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 5.4)
- [CVE-2023-48620](https://insights.sbomify.com/CVE-2023-48620/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2023-4862](https://insights.sbomify.com/CVE-2023-4862/): File Manager Pro < 1.8.1 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2023-48619](https://insights.sbomify.com/CVE-2023-48619/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2023-48618](https://insights.sbomify.com/CVE-2023-48618/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2023-48617](https://insights.sbomify.com/CVE-2023-48617/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2023-48616](https://insights.sbomify.com/CVE-2023-48616/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2023-48615](https://insights.sbomify.com/CVE-2023-48615/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2023-48614](https://insights.sbomify.com/CVE-2023-48614/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2023-48613](https://insights.sbomify.com/CVE-2023-48613/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2023-48612](https://insights.sbomify.com/CVE-2023-48612/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2023-48611](https://insights.sbomify.com/CVE-2023-48611/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2023-48610](https://insights.sbomify.com/CVE-2023-48610/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2023-4861](https://insights.sbomify.com/CVE-2023-4861/): File Manager Pro < 1.8.1 - Admin+ Remote Code Execution (high 7.2)
- [CVE-2023-48609](https://insights.sbomify.com/CVE-2023-48609/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2023-48608](https://insights.sbomify.com/CVE-2023-48608/): Adobe Experience Manager | Improper Input Validation (CWE-20) (low 3.5)
- [CVE-2023-48607](https://insights.sbomify.com/CVE-2023-48607/): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 5.4)
- [CVE-2023-48606](https://insights.sbomify.com/CVE-2023-48606/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2023-48605](https://insights.sbomify.com/CVE-2023-48605/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2023-48604](https://insights.sbomify.com/CVE-2023-48604/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2023-48603](https://insights.sbomify.com/CVE-2023-48603/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2023-48602](https://insights.sbomify.com/CVE-2023-48602/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2023-48601](https://insights.sbomify.com/CVE-2023-48601/): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 5.4)
- [CVE-2023-48600](https://insights.sbomify.com/CVE-2023-48600/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/187/