# Vulnerabilities published in 2023


- [CVE-2023-46353](https://insights.sbomify.com/CVE-2023-46353/): SQL injection in mypresta:product tag icons pro (critical 9.8)
- [CVE-2023-46352](https://insights.sbomify.com/CVE-2023-46352/): Missing authorization in smartmodules:facebookconversiontrackingplus (high 7.5)
- [CVE-2023-46351](https://insights.sbomify.com/CVE-2023-46351/): SQL injection in mypresta:manufacturers \(brands\) images block (critical 9.8)
- [CVE-2023-46350](https://insights.sbomify.com/CVE-2023-46350/): SQL injection in innovadeluxe:manufacturer or supplier alphabetical search (critical 9.8)
- [CVE-2023-4635](https://insights.sbomify.com/CVE-2023-4635/): EventON <= 2.2.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-46349](https://insights.sbomify.com/CVE-2023-46349/): SQL injection in myprestamodules:updateproducts (critical 9.8)
- [CVE-2023-46348](https://insights.sbomify.com/CVE-2023-46348/): SQL injection in sunnytoo:sturls (critical 9.8)
- [CVE-2023-46347](https://insights.sbomify.com/CVE-2023-46347/): SQL injection in ndkdesign:ndk steppingpack (critical 9.8)
- [CVE-2023-46346](https://insights.sbomify.com/CVE-2023-46346/): Path traversal in myprestamodules:exportproducts (high 7.5)
- [CVE-2023-46345](https://insights.sbomify.com/CVE-2023-46345/): Null dereference in fossies:catdoc (high 7.5)
- [CVE-2023-46344](https://insights.sbomify.com/CVE-2023-46344/): Cross-site scripting in solar-log:2000 pm\+ firmware (medium 5.4)
- [CVE-2023-46343](https://insights.sbomify.com/CVE-2023-46343/): Null dereference in linux:linux kernel (medium 5.5)
- [CVE-2023-4634](https://insights.sbomify.com/CVE-2023-4634/): Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution (critical 9.8)
- [CVE-2023-46332](https://insights.sbomify.com/CVE-2023-46332/): Memory corruption in webassembly:webassembly binary toolkit (medium 5.5)
- [CVE-2023-46331](https://insights.sbomify.com/CVE-2023-46331/): Memory corruption in webassembly:webassembly binary toolkit (medium 5.5)
- [CVE-2023-46327](https://insights.sbomify.com/CVE-2023-46327/): Weak cryptography in Apeos 1860 Japan Model (medium 5.9)
- [CVE-2023-46326](https://insights.sbomify.com/CVE-2023-46326/): Auth bypass in zstack:zstack (high 8.8)
- [CVE-2023-46324](https://insights.sbomify.com/CVE-2023-46324/): free5GC udm vulnerable to Invalid Curve Attack (high 7.5)
- [CVE-2023-46322](https://insights.sbomify.com/CVE-2023-46322/): Other in iterm2:iterm2 (critical 9.8)
- [CVE-2023-46321](https://insights.sbomify.com/CVE-2023-46321/): Command injection in iterm2:iterm2 (critical 9.8)
- [CVE-2023-4632](https://insights.sbomify.com/CVE-2023-4632/): Privilege escalation in Lenovo System Update (high 7.8)
- [CVE-2023-46319](https://insights.sbomify.com/CVE-2023-46319/): Auth bypass in wallix:bastion (high 7.5)
- [CVE-2023-46317](https://insights.sbomify.com/CVE-2023-46317/): Denial of service in nic:knot resolver (high 7.5)
- [CVE-2023-46316](https://insights.sbomify.com/CVE-2023-46316/): Command injection in buc:traceroute (medium 5.5)
- [CVE-2023-46315](https://insights.sbomify.com/CVE-2023-46315/): Path traversal in zanllp:stable diffusion webui infinite image browsing (high 7.5)
- [CVE-2023-46313](https://insights.sbomify.com/CVE-2023-46313/): WordPress Zotpress Plugin <= 7.3.4 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-46312](https://insights.sbomify.com/CVE-2023-46312/): WordPress Smart Online Order for Clover Plugin <= 1.5.4 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-46311](https://insights.sbomify.com/CVE-2023-46311/): WordPress wpDiscuz Plugin <= 7.6.3 is vulnerable to Insecure Direct Object References (IDOR) (low 2.7)
- [CVE-2023-46310](https://insights.sbomify.com/CVE-2023-46310/): WordPress wpDiscuz plugin <= 7.6.10 - Content Injection vulnerability (medium 5.3)
- [CVE-2023-4631](https://insights.sbomify.com/CVE-2023-4631/): DoLogin Security < 3.7 - IP Spoofing (medium 5.3)
- [CVE-2023-46309](https://insights.sbomify.com/CVE-2023-46309/): WordPress wpDiscuz plugin <= 7.6.10 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-46308](https://insights.sbomify.com/CVE-2023-46308/): plotly.js prototype pollution vulnerability (critical 9.8)
- [CVE-2023-46307](https://insights.sbomify.com/CVE-2023-46307/): Path traversal in buddho:etcd browser (high 7.5)
- [CVE-2023-46306](https://insights.sbomify.com/CVE-2023-46306/): Command injection in netmodule:netmodule router software (high 8.4)
- [CVE-2023-46304](https://insights.sbomify.com/CVE-2023-46304/): Code injection in vtiger:vtiger crm (high 8.1)
- [CVE-2023-46303](https://insights.sbomify.com/CVE-2023-46303/): Server-side request forgery in calibre-ebook:calibre (high 7.5)
- [CVE-2023-46302](https://insights.sbomify.com/CVE-2023-46302/): Apache Submarine: Fix CVE-2022-1471 SnakeYaml unsafe deserialization (critical 9.8)
- [CVE-2023-46301](https://insights.sbomify.com/CVE-2023-46301/): Code injection in iterm2:iterm2 (critical 9.8)
- [CVE-2023-46300](https://insights.sbomify.com/CVE-2023-46300/): Code injection in iterm2:iterm2 (critical 9.8)
- [CVE-2023-4630](https://insights.sbomify.com/CVE-2023-4630/): Missing Authorization in GitLab (medium 5.0)
- [CVE-2023-46298](https://insights.sbomify.com/CVE-2023-46298/): Next.js missing cache-control header may lead to CDN caching empty reply (high 7.5)
- [CVE-2023-46297](https://insights.sbomify.com/CVE-2023-46297/): An issue was discovered on Mercusys MW325R EU V3 MW325R(EU)_V3_1.11.0 221019 devices. (medium 5.1)
- [CVE-2023-46295](https://insights.sbomify.com/CVE-2023-46295/): An issue was discovered in Teledyne FLIR M300 2.00-19. (critical 9.8)
- [CVE-2023-46294](https://insights.sbomify.com/CVE-2023-46294/): An issue was discovered in Teledyne FLIR M300 2.00-19. (low 3.4)
- [CVE-2023-46290](https://insights.sbomify.com/CVE-2023-46290/): Rockwell Automation FactoryTalk Services Platform Elevated Privileges Vulnerability (high 8.1)
- [CVE-2023-4629](https://insights.sbomify.com/CVE-2023-4629/): LadiApp <= 4.4 - Cross-Site Request Forgery via save_config() (medium 4.3)
- [CVE-2023-46289](https://insights.sbomify.com/CVE-2023-46289/): Rockwell Automation FactoryTalk® View Site Edition Vulnerable to Improper Input Validation (high 7.5)
- [CVE-2023-46288](https://insights.sbomify.com/CVE-2023-46288/): Apache Airflow: Sensitive parameters exposed in API when "non-sensitive-only" configuration is set (medium 4.3)
- [CVE-2023-46287](https://insights.sbomify.com/CVE-2023-46287/): Cross-site scripting in nagvis:nagvis (medium 6.1)
- [CVE-2023-46285](https://insights.sbomify.com/CVE-2023-46285/): Denial of service in Opcenter Execution Foundation (high 7.5)
- [CVE-2023-46284](https://insights.sbomify.com/CVE-2023-46284/): Memory corruption in Opcenter Execution Foundation (high 7.5)
- [CVE-2023-46283](https://insights.sbomify.com/CVE-2023-46283/): Memory corruption in Opcenter Execution Foundation (high 7.5)
- [CVE-2023-46282](https://insights.sbomify.com/CVE-2023-46282/): Cross-site scripting in Opcenter Execution Foundation (high 7.1)
- [CVE-2023-46281](https://insights.sbomify.com/CVE-2023-46281/): Misconfiguration in Opcenter Execution Foundation (high 7.1)
- [CVE-2023-46280](https://insights.sbomify.com/CVE-2023-46280/): Memory corruption in SIMATIC Automation Tool (high 8.2)
- [CVE-2023-4628](https://insights.sbomify.com/CVE-2023-4628/): LadiApp <= 4.4 - Cross-Site Request Forgery via ladiflow_save_hook() (medium 4.3)
- [CVE-2023-46279](https://insights.sbomify.com/CVE-2023-46279/): Apache Dubbo: Bypass deny serialize list check in Apache Dubbo (critical 9.8)
- [CVE-2023-46278](https://insights.sbomify.com/CVE-2023-46278/): Denial of service in Cybozu Remote Service (medium 6.5)
- [CVE-2023-46277](https://insights.sbomify.com/CVE-2023-46277/): Pleaser privilege escalation vulnerability (high 7.8)
- [CVE-2023-46273](https://insights.sbomify.com/CVE-2023-46273/): Memory corruption in IQ Engine (high 8.8)
- [CVE-2023-46272](https://insights.sbomify.com/CVE-2023-46272/): Buffer Overflow vulnerability in Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, allows an attacker to execute (high 8.8)
- [CVE-2023-46271](https://insights.sbomify.com/CVE-2023-46271/): Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, has a buffer overflow. (critical 9.8)
- [CVE-2023-46270](https://insights.sbomify.com/CVE-2023-46270/): MacPaw The Unarchiver before 4.3.6 contains vulnerability related to missing quarantine attributes for extracted items. (low 3.3)
- [CVE-2023-4627](https://insights.sbomify.com/CVE-2023-4627/): LadiApp <= 4.4 - Missing Authorization via save_config() (medium 4.3)
- [CVE-2023-46266](https://insights.sbomify.com/CVE-2023-46266/): Information disclosure in Avalanche (high 7.3)
- [CVE-2023-46265](https://insights.sbomify.com/CVE-2023-46265/): XML external entity in Avalanche (medium 6.5)
- [CVE-2023-46264](https://insights.sbomify.com/CVE-2023-46264/): File upload in Avalanche (high 7.2)
- [CVE-2023-46263](https://insights.sbomify.com/CVE-2023-46263/): File upload in Avalanche (high 7.2)
- [CVE-2023-46262](https://insights.sbomify.com/CVE-2023-46262/): Server-side request forgery in Avalanche (high 7.5)
- [CVE-2023-46261](https://insights.sbomify.com/CVE-2023-46261/): Memory corruption in Avalanche (critical 9.8)
- [CVE-2023-46260](https://insights.sbomify.com/CVE-2023-46260/): Memory corruption in Avalanche (high 7.5)
- [CVE-2023-4626](https://insights.sbomify.com/CVE-2023-4626/): Missing authorization in LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… (medium 4.3)
- [CVE-2023-46259](https://insights.sbomify.com/CVE-2023-46259/): Memory corruption in Avalanche (critical 9.8)
- [CVE-2023-46258](https://insights.sbomify.com/CVE-2023-46258/): Memory corruption in Avalanche (critical 9.8)
- [CVE-2023-46257](https://insights.sbomify.com/CVE-2023-46257/): Memory corruption in Avalanche (critical 9.8)
- [CVE-2023-46256](https://insights.sbomify.com/CVE-2023-46256/): PX4-Autopilot Heap Buffer Overflow Bug (medium 4.4)
- [CVE-2023-46255](https://insights.sbomify.com/CVE-2023-46255/): `SPICEDB_DATASTORE_CONN_URI` is leaked when URI cannot be parsed (medium 4.2)
- [CVE-2023-46254](https://insights.sbomify.com/CVE-2023-46254/): Service accounts can see namespaces of other tenants in capsule-proxy (medium 4.3)
- [CVE-2023-46253](https://insights.sbomify.com/CVE-2023-46253/): Remote code execution in Squidex (critical 9.1)
- [CVE-2023-46252](https://insights.sbomify.com/CVE-2023-46252/): Cross-Site Scripting (XSS) via postMessage Handler in Squidex (medium 6.8)
- [CVE-2023-46251](https://insights.sbomify.com/CVE-2023-46251/): Visual editor persistent Cross-site Scripting (XSS) in MyBB (high 7.5)
- [CVE-2023-46250](https://insights.sbomify.com/CVE-2023-46250/): pypdf possible Infinite Loop when PdfWriter(clone_from) is used with a PDF (medium 5.1)
- [CVE-2023-4625](https://insights.sbomify.com/CVE-2023-4625/): Denial-of-Service（DoS） Vulnerability in Web server function on MELSEC Series CPU module (medium 5.3)
- [CVE-2023-46249](https://insights.sbomify.com/CVE-2023-46249/): authentik potential installation takeover when default admin user is deleted (critical 9.7)
- [CVE-2023-46248](https://insights.sbomify.com/CVE-2023-46248/): Overwrite of builtin Cody commands facilitates RCE (critical 9.1)
- [CVE-2023-46247](https://insights.sbomify.com/CVE-2023-46247/): Vyper has incorrect storage layout for contracts containing large arrays (high 7.5)
- [CVE-2023-46246](https://insights.sbomify.com/CVE-2023-46246/): Integer Overflow in :history command in Vim (medium 4.0)
- [CVE-2023-46245](https://insights.sbomify.com/CVE-2023-46245/): Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File (high 7.2)
- [CVE-2023-46244](https://insights.sbomify.com/CVE-2023-46244/): Privilege escalation in Xwiki platform (critical 9.1)
- [CVE-2023-46243](https://insights.sbomify.com/CVE-2023-46243/): Code execution via the edit action in XWiki platform (critical 10.0)
- [CVE-2023-46242](https://insights.sbomify.com/CVE-2023-46242/): Code injection in XWiki Platform (critical 9.7)
- [CVE-2023-46241](https://insights.sbomify.com/CVE-2023-46241/): Potential account take over due to unverified emails from Microsoft Identity Platform (critical 9.1)
- [CVE-2023-46240](https://insights.sbomify.com/CVE-2023-46240/): CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment (high 7.5)
- [CVE-2023-4624](https://insights.sbomify.com/CVE-2023-4624/): Server-Side Request Forgery (SSRF) in bookstackapp/bookstack (low 2.4)
- [CVE-2023-46239](https://insights.sbomify.com/CVE-2023-46239/): quic-go vulnerable to pointer dereference that can lead to panic (high 7.5)
- [CVE-2023-46238](https://insights.sbomify.com/CVE-2023-46238/): XSS with User Avatar image in ZITADEL (high 8.7)
- [CVE-2023-46237](https://insights.sbomify.com/CVE-2023-46237/): FOG path traversal via unauthenticated endpoint (medium 5.8)
- [CVE-2023-46236](https://insights.sbomify.com/CVE-2023-46236/): FOG SSRF via unauthenticated endpoint(s) (high 8.6)
- [CVE-2023-46235](https://insights.sbomify.com/CVE-2023-46235/): FOG stored XSS on log screen via unsanitized request logging (medium 5.4)
- [CVE-2023-46234](https://insights.sbomify.com/CVE-2023-46234/): browserify-sign vulnerable via an upper bound check issue in `dsaVerify` that leads to a signature forgery attack (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/205/