# Vulnerabilities published in 2023


- [CVE-2023-46847](https://insights.sbomify.com/CVE-2023-46847/): Squid: denial of service in http digest authentication (high 8.6)
- [CVE-2023-46846](https://insights.sbomify.com/CVE-2023-46846/): Squid: request/response smuggling in http/1.1 and icap (critical 9.3)
- [CVE-2023-46845](https://insights.sbomify.com/CVE-2023-46845/): Code injection in EC-CUBE 3 series (high 7.2)
- [CVE-2023-46842](https://insights.sbomify.com/CVE-2023-46842/): x86 HVM hypercalls may trigger Xen bug check (medium 6.5)
- [CVE-2023-46841](https://insights.sbomify.com/CVE-2023-46841/): x86: shadow stack vs exceptions from emulation stubs (medium 6.5)
- [CVE-2023-46840](https://insights.sbomify.com/CVE-2023-46840/): VT-d: Failure to quarantine devices in !HVM builds (medium 4.1)
- [CVE-2023-46839](https://insights.sbomify.com/CVE-2023-46839/): pci: phantom functions assigned to incorrect contexts (medium 5.3)
- [CVE-2023-46838](https://insights.sbomify.com/CVE-2023-46838/): Linux: netback processing of zero-length transmit fragment (high 7.5)
- [CVE-2023-46837](https://insights.sbomify.com/CVE-2023-46837/): arm32: The cache may not be properly cleaned/invalidated (take two) (low 3.3)
- [CVE-2023-46836](https://insights.sbomify.com/CVE-2023-46836/): x86: BTC/SRSO fixes not fully effective (medium 4.7)
- [CVE-2023-46835](https://insights.sbomify.com/CVE-2023-46835/): x86/AMD: mismatch in IOMMU quarantine page table levels (medium 5.5)
- [CVE-2023-4683](https://insights.sbomify.com/CVE-2023-4683/): NULL Pointer Dereference in gpac/gpac (medium 5.3)
- [CVE-2023-46824](https://insights.sbomify.com/CVE-2023-46824/): WordPress Slick Popup Plugin <= 1.7.14 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-46823](https://insights.sbomify.com/CVE-2023-46823/): WordPress ImageLinks Interactive Image Builder Plugin <= 1.5.4 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-46822](https://insights.sbomify.com/CVE-2023-46822/): WordPress WooCommerce – Store Exporter Plugin <= 2.7.2 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-46821](https://insights.sbomify.com/CVE-2023-46821/): WordPress GD Security Headers Plugin <= 1.7 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-46820](https://insights.sbomify.com/CVE-2023-46820/): WordPress Image Regenerate & Select Crop Plugin <= 7.3.0 is vulnerable to Sensitive Data Exposure (medium 5.3)
- [CVE-2023-4682](https://insights.sbomify.com/CVE-2023-4682/): Heap-based Buffer Overflow in gpac/gpac (medium 5.9)
- [CVE-2023-46819](https://insights.sbomify.com/CVE-2023-46819/): Apache OFBiz: Execution of Solr plugin queries without authentication (medium 5.3)
- [CVE-2023-46818](https://insights.sbomify.com/CVE-2023-46818/): Code injection in ispconfig:ispconfig (high 7.2)
- [CVE-2023-46817](https://insights.sbomify.com/CVE-2023-46817/): Deserialization in phpfox:phpfox (critical 9.8)
- [CVE-2023-46816](https://insights.sbomify.com/CVE-2023-46816/): Code injection in sugarcrm:sugarcrm (high 8.8)
- [CVE-2023-46815](https://insights.sbomify.com/CVE-2023-46815/): File upload in sugarcrm:sugarcrm (high 8.8)
- [CVE-2023-46814](https://insights.sbomify.com/CVE-2023-46814/): Privilege escalation in videolan:vlc media player (high 7.8)
- [CVE-2023-46813](https://insights.sbomify.com/CVE-2023-46813/): Race condition in linux:linux kernel (high 7.0)
- [CVE-2023-46810](https://insights.sbomify.com/CVE-2023-46810/): Privilege escalation in Secure Access Linux (high 7.3)
- [CVE-2023-4681](https://insights.sbomify.com/CVE-2023-4681/): NULL Pointer Dereference in gpac/gpac (medium 5.1)
- [CVE-2023-46809](https://insights.sbomify.com/CVE-2023-46809/): Weak cryptography in Node (high 7.4)
- [CVE-2023-46808](https://insights.sbomify.com/CVE-2023-46808/): File upload in ITSM (critical 9.9)
- [CVE-2023-46807](https://insights.sbomify.com/CVE-2023-46807/): SQL injection in EPMM (medium 6.7)
- [CVE-2023-46806](https://insights.sbomify.com/CVE-2023-46806/): SQL injection in EPMM (medium 6.7)
- [CVE-2023-46805](https://insights.sbomify.com/CVE-2023-46805/): Ivanti Connect Secure and Policy Secure Authentication Bypass (high 8.2, exploited in the wild)
- [CVE-2023-46804](https://insights.sbomify.com/CVE-2023-46804/): Memory corruption in Avalanche (high 7.5)
- [CVE-2023-46803](https://insights.sbomify.com/CVE-2023-46803/): Memory corruption in Avalanche (high 7.5)
- [CVE-2023-46802](https://insights.sbomify.com/CVE-2023-46802/): XML external entity in e-Tax software (medium 5.5)
- [CVE-2023-46801](https://insights.sbomify.com/CVE-2023-46801/): Apache Linkis DataSource: DataSource Remote code execution vulnerability (high 8.8)
- [CVE-2023-46800](https://insights.sbomify.com/CVE-2023-46800/): Online Matrimonial Project v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-4680](https://insights.sbomify.com/CVE-2023-4680/): Vault's Transit Secrets Engine Allowed Nonce Specified without Convergent Encryption (medium 6.8)
- [CVE-2023-46793](https://insights.sbomify.com/CVE-2023-46793/): Online Matrimonial Project v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-4679](https://insights.sbomify.com/CVE-2023-4679/): Use After Free in gpac/gpac (medium 5.9)
- [CVE-2023-46789](https://insights.sbomify.com/CVE-2023-46789/): Online Matrimonial Project v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-46788](https://insights.sbomify.com/CVE-2023-46788/): Online Matrimonial Project v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-46787](https://insights.sbomify.com/CVE-2023-46787/): Online Matrimonial Project v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-46785](https://insights.sbomify.com/CVE-2023-46785/): Online Matrimonial Project v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-46784](https://insights.sbomify.com/CVE-2023-46784/): WordPress ICS Calendar plugin <= 10.12.0.3 - SSRF and Arbitrary File Read vulnerability (high 8.2)
- [CVE-2023-46783](https://insights.sbomify.com/CVE-2023-46783/): WordPress Pre-Orders for WooCommerce Plugin <= 1.2.13 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-46782](https://insights.sbomify.com/CVE-2023-46782/): WordPress MomentoPress for Momento360 Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-46781](https://insights.sbomify.com/CVE-2023-46781/): WordPress Current Menu Item for Custom Post Types Plugin <= 1.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-46780](https://insights.sbomify.com/CVE-2023-46780/): WordPress Alter Plugin <= 1.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-4678](https://insights.sbomify.com/CVE-2023-4678/): Divide By Zero in gpac/gpac (medium 5.1)
- [CVE-2023-46779](https://insights.sbomify.com/CVE-2023-46779/): WordPress EasyRecipe Plugin <= 3.5.3251 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-46778](https://insights.sbomify.com/CVE-2023-46778/): WordPress Auto Limit Posts Reloaded Plugin <= 2.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-46777](https://insights.sbomify.com/CVE-2023-46777/): WordPress Feather Login Page Plugin <= 1.1.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-46776](https://insights.sbomify.com/CVE-2023-46776/): WordPress Auto Excerpt everywhere Plugin <= 1.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-46775](https://insights.sbomify.com/CVE-2023-46775/): WordPress Original texts Yandex WebMaster Plugin <= 1.18 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-46774](https://insights.sbomify.com/CVE-2023-46774/): Denial of service in EMUI (high 7.5)
- [CVE-2023-46773](https://insights.sbomify.com/CVE-2023-46773/): Privilege escalation in EMUI (critical 9.8)
- [CVE-2023-46772](https://insights.sbomify.com/CVE-2023-46772/): Memory corruption in EMUI (high 7.5)
- [CVE-2023-46771](https://insights.sbomify.com/CVE-2023-46771/): Privilege escalation in EMUI (high 7.5)
- [CVE-2023-46770](https://insights.sbomify.com/CVE-2023-46770/): Memory corruption in EMUI (high 7.5)
- [CVE-2023-4677](https://insights.sbomify.com/CVE-2023-4677/): Unauthenticated Admin Account Takeover Via Cron Log File Backups (high 7.0)
- [CVE-2023-46769](https://insights.sbomify.com/CVE-2023-46769/): Use after free in EMUI (high 7.5)
- [CVE-2023-46768](https://insights.sbomify.com/CVE-2023-46768/): Use after free in EMUI (high 7.5)
- [CVE-2023-46767](https://insights.sbomify.com/CVE-2023-46767/): Memory corruption in EMUI (high 7.5)
- [CVE-2023-46766](https://insights.sbomify.com/CVE-2023-46766/): Memory corruption in EMUI (high 7.5)
- [CVE-2023-46765](https://insights.sbomify.com/CVE-2023-46765/): Denial of service in EMUI (high 7.5)
- [CVE-2023-46764](https://insights.sbomify.com/CVE-2023-46764/): Other in EMUI (medium 5.3)
- [CVE-2023-46763](https://insights.sbomify.com/CVE-2023-46763/): Missing authorization in EMUI (medium 5.3)
- [CVE-2023-46762](https://insights.sbomify.com/CVE-2023-46762/): Memory corruption in EMUI (high 7.5)
- [CVE-2023-46761](https://insights.sbomify.com/CVE-2023-46761/): Memory corruption in EMUI (high 7.5)
- [CVE-2023-46760](https://insights.sbomify.com/CVE-2023-46760/): Memory corruption in EMUI (high 7.5)
- [CVE-2023-4676](https://insights.sbomify.com/CVE-2023-4676/): XSS in Yordams MedasPro (medium 6.1)
- [CVE-2023-46759](https://insights.sbomify.com/CVE-2023-46759/): Missing authorization in EMUI (high 7.5)
- [CVE-2023-46758](https://insights.sbomify.com/CVE-2023-46758/): Privilege escalation in EMUI (high 7.5)
- [CVE-2023-46757](https://insights.sbomify.com/CVE-2023-46757/): Information disclosure in HarmonyOS (high 7.5)
- [CVE-2023-46756](https://insights.sbomify.com/CVE-2023-46756/): Privilege escalation in EMUI (medium 5.3)
- [CVE-2023-46755](https://insights.sbomify.com/CVE-2023-46755/): Denial of service in EMUI (medium 5.3)
- [CVE-2023-46754](https://insights.sbomify.com/CVE-2023-46754/): Auth bypass in obl.ong:admin (medium 5.3)
- [CVE-2023-46753](https://insights.sbomify.com/CVE-2023-46753/): Denial of service in frrouting:frrouting (medium 5.9)
- [CVE-2023-46752](https://insights.sbomify.com/CVE-2023-46752/): Denial of service in frrouting:frrouting (medium 5.9)
- [CVE-2023-46751](https://insights.sbomify.com/CVE-2023-46751/): Use after free in artifex:ghostscript (high 7.5)
- [CVE-2023-46750](https://insights.sbomify.com/CVE-2023-46750/): Open redirect in Apache Shiro (medium 4.7)
- [CVE-2023-4675](https://insights.sbomify.com/CVE-2023-4675/): SQLi i GM Informatics MDO (critical 9.8)
- [CVE-2023-46749](https://insights.sbomify.com/CVE-2023-46749/): Apache Shiro vulnerable to path traversal (medium 6.5)
- [CVE-2023-46748](https://insights.sbomify.com/CVE-2023-46748/): F5 BIG-IP Configuration Utility SQL Injection (high 8.8, exploited in the wild)
- [CVE-2023-46747](https://insights.sbomify.com/CVE-2023-46747/): F5 BIG-IP Configuration Utility Authentication Bypass (critical 9.8, exploited in the wild)
- [CVE-2023-46746](https://insights.sbomify.com/CVE-2023-46746/): Authenticated PostHog users vulnerable to SSRF (medium 4.8)
- [CVE-2023-46745](https://insights.sbomify.com/CVE-2023-46745/): Rate limiting Bypass on login page in libreNMS (medium 5.3)
- [CVE-2023-46744](https://insights.sbomify.com/CVE-2023-46744/): Stored Cross-site Scripting in Squidex (medium 5.4)
- [CVE-2023-46743](https://insights.sbomify.com/CVE-2023-46743/): The same file cannot be opened with different rights (high 7.4)
- [CVE-2023-46742](https://insights.sbomify.com/CVE-2023-46742/): CubeFS leaks users key in logs (medium 4.8)
- [CVE-2023-46741](https://insights.sbomify.com/CVE-2023-46741/): CubeFS leaks magic secret key when starting Blobstore access service (medium 4.8)
- [CVE-2023-46740](https://insights.sbomify.com/CVE-2023-46740/): Insecure random string generator used for sensitive data (medium 6.5)
- [CVE-2023-4674](https://insights.sbomify.com/CVE-2023-4674/): SQLi in Yazteks E-Commerce Software (not scored)
- [CVE-2023-46739](https://insights.sbomify.com/CVE-2023-46739/): Timing attack can leak user passwords (medium 6.5)
- [CVE-2023-46738](https://insights.sbomify.com/CVE-2023-46738/): Authenticated users can crash the CubeFS servers with maliciously crafted requests (medium 6.5)
- [CVE-2023-46737](https://insights.sbomify.com/CVE-2023-46737/): Possible endless data attack from attacker-controlled registry in cosign (low 3.1)
- [CVE-2023-46736](https://insights.sbomify.com/CVE-2023-46736/): Server-Side Request Forgery in espocrm (medium 5.3)
- [CVE-2023-46735](https://insights.sbomify.com/CVE-2023-46735/): Symfony potential Cross-site Scripting in WebhookController (medium 6.1)
- [CVE-2023-46734](https://insights.sbomify.com/CVE-2023-46734/): Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filters (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/201/