# Vulnerabilities published in 2023


- [CVE-2023-45724](https://insights.sbomify.com/CVE-2023-45724/): Unauthenticated File Upload affects DRYiCE MyXalytics (high 8.2)
- [CVE-2023-45723](https://insights.sbomify.com/CVE-2023-45723/): Path Traversal which allows file upload capability affects DRYiCE MyXalytics (high 7.6)
- [CVE-2023-45722](https://insights.sbomify.com/CVE-2023-45722/): Path Traversal Arbitrary File Read affects DRYiCE MyXalytics (high 8.8)
- [CVE-2023-45721](https://insights.sbomify.com/CVE-2023-45721/): HCL Domino Volt and Domino Leap are affected by a disclosure of private personal information vulnerability (medium 5.3)
- [CVE-2023-45720](https://insights.sbomify.com/CVE-2023-45720/): HCL Leap is affected by a disclosure of private personal information vulnerability (medium 5.3)
- [CVE-2023-4572](https://insights.sbomify.com/CVE-2023-4572/): Use after free in Chrome (high 8.8)
- [CVE-2023-45718](https://insights.sbomify.com/CVE-2023-45718/): HCL Sametime is impacted by a failure to invalidate sessions (low 3.9)
- [CVE-2023-45716](https://insights.sbomify.com/CVE-2023-45716/): HCL Sametime is impacted by a sensitive information disclosure (low 1.7)
- [CVE-2023-45715](https://insights.sbomify.com/CVE-2023-45715/): HCL BigFix Platform is susceptible to a Denial of Service attack (low 3.5)
- [CVE-2023-4571](https://insights.sbomify.com/CVE-2023-4571/): Unauthenticated Log Injection in Splunk IT Service Intelligence (ITSI) (high 8.6)
- [CVE-2023-45707](https://insights.sbomify.com/CVE-2023-45707/): HCL Connections Docs is vulnerable to Cross-Site Scripting (XSS) (medium 4.4)
- [CVE-2023-45706](https://insights.sbomify.com/CVE-2023-45706/): HCL BigFix Platform is susceptible to Cross Site Scripting (XSS) and/or Man in the Middle (MITM) attack (low 2.0)
- [CVE-2023-45705](https://insights.sbomify.com/CVE-2023-45705/): HCL BigFix Platform is susceptible to Server Side Request Forgery (SSRF) (low 3.5)
- [CVE-2023-45703](https://insights.sbomify.com/CVE-2023-45703/): HCL Launch is susceptible to a Denial of Service vulnerability (medium 5.3)
- [CVE-2023-45702](https://insights.sbomify.com/CVE-2023-45702/): HCL Launch Agent as a Windows service is vulnerable to a Denial of Service (medium 6.2)
- [CVE-2023-45701](https://insights.sbomify.com/CVE-2023-45701/): HCL Launch is susceptible to sensitive information disclosure (medium 4.3)
- [CVE-2023-45700](https://insights.sbomify.com/CVE-2023-45700/): HCL Launch is susceptible to an HTML injection vulnerability (medium 4.3)
- [CVE-2023-4570](https://insights.sbomify.com/CVE-2023-4570/): Improper Restriction in NI MeasurementLink Python Services (high 8.8)
- [CVE-2023-45698](https://insights.sbomify.com/CVE-2023-45698/): HCL Sametime is impacted by clickjacking (medium 4.8)
- [CVE-2023-45696](https://insights.sbomify.com/CVE-2023-45696/): HCL Sametime is impacted by an autocomplete enabled vulnerability (medium 4.0)
- [CVE-2023-45690](https://insights.sbomify.com/CVE-2023-45690/): Information leak via default file permissions on Titan MFT and Titan SFTP servers (medium 4.9)
- [CVE-2023-4569](https://insights.sbomify.com/CVE-2023-4569/): Kernel: information leak in nft_set_catchall_flush in net/netfilter/nf_tables_api.c (medium 5.5)
- [CVE-2023-45689](https://insights.sbomify.com/CVE-2023-45689/): Arbitrary file read via path traversal in Titan MFT and Titan SFTP servers (medium 6.5)
- [CVE-2023-45688](https://insights.sbomify.com/CVE-2023-45688/): Information leak via path traversal in Titan MFT and Titan SFTP servers (medium 4.3)
- [CVE-2023-45687](https://insights.sbomify.com/CVE-2023-45687/): Authentication bypass via session fixation in Titan MFT and Titan SFTP servers (high 8.8)
- [CVE-2023-45686](https://insights.sbomify.com/CVE-2023-45686/): Arbitrary file write via WebDAV path traversal in Titan MFT and Titan SFTP servers (high 7.2)
- [CVE-2023-45685](https://insights.sbomify.com/CVE-2023-45685/): Arbitrary file write via "zip slip" in Titan MFT and Titan SFTP servers (critical 9.1)
- [CVE-2023-45684](https://insights.sbomify.com/CVE-2023-45684/): SQL injection in northern.tech:cfengine (high 7.5)
- [CVE-2023-45683](https://insights.sbomify.com/CVE-2023-45683/): Cross site scripting via missing binding syntax validation In ACS location in github.com/crewjam/saml (high 7.1)
- [CVE-2023-45682](https://insights.sbomify.com/CVE-2023-45682/): Wild address read in vorbis_decode_packet_rest in stb_vorbis (medium 5.3)
- [CVE-2023-45681](https://insights.sbomify.com/CVE-2023-45681/): Out of bounds heap buffer write in stb_vorbis (high 7.3)
- [CVE-2023-45680](https://insights.sbomify.com/CVE-2023-45680/): Null pointer dereference in vorbis_deinit in stb_vorbis (medium 5.3)
- [CVE-2023-4568](https://insights.sbomify.com/CVE-2023-4568/): PaperCut NG Unauthenticated XMLRPC (medium 6.5)
- [CVE-2023-45679](https://insights.sbomify.com/CVE-2023-45679/): Attempt to free an uninitialized memory pointer in vorbis_deinit in stb_vorbis (high 7.3)
- [CVE-2023-45678](https://insights.sbomify.com/CVE-2023-45678/): Off-by-one heap buffer write in start_decoder in stb_vorbis (medium 6.5)
- [CVE-2023-45677](https://insights.sbomify.com/CVE-2023-45677/): Heap buffer out of bounds write in start_decoder in stb_vorbis (high 7.3)
- [CVE-2023-45676](https://insights.sbomify.com/CVE-2023-45676/): Multi-byte write heap buffer overflow in start_decoder in stb_vorbis (high 7.3)
- [CVE-2023-45675](https://insights.sbomify.com/CVE-2023-45675/): 0 byte write heap buffer overflow in start_decoder in stb_vorbis (medium 6.5)
- [CVE-2023-45674](https://insights.sbomify.com/CVE-2023-45674/): SQL injection vulnerability in Farmbot-Web-App (high 7.7)
- [CVE-2023-45673](https://insights.sbomify.com/CVE-2023-45673/): Arbitrary code execution on click of PDF links in Joplin (high 8.9)
- [CVE-2023-45672](https://insights.sbomify.com/CVE-2023-45672/): Frigate unsafe deserialization in `load_config_with_no_duplicates` of `frigate/util/builtin.py` (high 7.5)
- [CVE-2023-45671](https://insights.sbomify.com/CVE-2023-45671/): Frigate reflected XSS through `/<camera_name>` API endpoints (medium 4.7)
- [CVE-2023-45670](https://insights.sbomify.com/CVE-2023-45670/): Frigate cross-site request forgery in `config_save` and `config_set` request handlers (high 7.5)
- [CVE-2023-45669](https://insights.sbomify.com/CVE-2023-45669/): Improper signature counter value handling in webauthn4j-spring-security (medium 4.8)
- [CVE-2023-45667](https://insights.sbomify.com/CVE-2023-45667/): Null pointer dereference because of an uninitialized variable in stb_image (medium 5.3)
- [CVE-2023-45666](https://insights.sbomify.com/CVE-2023-45666/): Possible double-free or memory leak in stbi__load_gif_main in stb_image (high 7.3)
- [CVE-2023-45664](https://insights.sbomify.com/CVE-2023-45664/): Double-free in stbi__load_gif_main_outofmem in stb_image (high 7.3)
- [CVE-2023-45663](https://insights.sbomify.com/CVE-2023-45663/): Disclosure of uninitialized memory in stbi__tga_load in stb_image (medium 5.3)
- [CVE-2023-45662](https://insights.sbomify.com/CVE-2023-45662/): Multi-byte read heap buffer overflow in stbi__vertical_flip in stb_image (medium 6.5)
- [CVE-2023-45661](https://insights.sbomify.com/CVE-2023-45661/): Wild address read in stbi__gif_load_next in stb_image (medium 6.5)
- [CVE-2023-45660](https://insights.sbomify.com/CVE-2023-45660/): Require strict cookies for image proxy requests in Nextcloud Mail (medium 4.3)
- [CVE-2023-4566](https://insights.sbomify.com/CVE-2023-4566/): Security feature bypass in EMUI (high 7.5)
- [CVE-2023-45659](https://insights.sbomify.com/CVE-2023-45659/): Session is not expiring after password reset in Engelsystem (low 3.6)
- [CVE-2023-45658](https://insights.sbomify.com/CVE-2023-45658/): WordPress Nexter theme <= 2.0.3 - Broken Access Control vulnerability (high 7.6)
- [CVE-2023-45657](https://insights.sbomify.com/CVE-2023-45657/): WordPress Nexter Theme <= 2.0.3 is vulnerable to SQL Injection (high 8.5)
- [CVE-2023-45656](https://insights.sbomify.com/CVE-2023-45656/): WordPress Lazy Load for Videos Plugin <= 2.18.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-45655](https://insights.sbomify.com/CVE-2023-45655/): WordPress PixFields Plugin <= 0.7.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-45654](https://insights.sbomify.com/CVE-2023-45654/): WordPress Comments Ratings Plugin <= 1.1.7 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-45653](https://insights.sbomify.com/CVE-2023-45653/): WordPress Video Playlist For YouTube Plugin <= 6.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-45652](https://insights.sbomify.com/CVE-2023-45652/): WordPress Remote Content Shortcode plugin <= 1.5 - Local File Inclusion vulnerability (medium 6.5)
- [CVE-2023-45651](https://insights.sbomify.com/CVE-2023-45651/): WordPress WP Attachments Plugin <= 5.0.11 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-45650](https://insights.sbomify.com/CVE-2023-45650/): WordPress HTML5 Maps Plugin <= 1.7.1.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-4565](https://insights.sbomify.com/CVE-2023-4565/): Missing authorization in EMUI (medium 5.3)
- [CVE-2023-45649](https://insights.sbomify.com/CVE-2023-45649/): WordPress Appointment Hour Booking plugin <= 1.4.23 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-45648](https://insights.sbomify.com/CVE-2023-45648/): Apache Tomcat: Trailer header parsing too lenient (medium 5.3)
- [CVE-2023-45647](https://insights.sbomify.com/CVE-2023-45647/): WordPress Constant Contact Forms by MailMunch Plugin <= 2.0.10 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-45646](https://insights.sbomify.com/CVE-2023-45646/): WordPress PDF Block Plugin <= 1.1.0 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-45645](https://insights.sbomify.com/CVE-2023-45645/): WordPress WP Open Street Map Plugin <= 1.25 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-45644](https://insights.sbomify.com/CVE-2023-45644/): WordPress CPT Shortcode Generator Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-45643](https://insights.sbomify.com/CVE-2023-45643/): WordPress CPT Shortcode Generator Plugin <= 1.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-45642](https://insights.sbomify.com/CVE-2023-45642/): WordPress Snap Pixel Plugin <= 1.5.7 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-45641](https://insights.sbomify.com/CVE-2023-45641/): WordPress Caret Country Access Limit Plugin <= 1.0.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-45640](https://insights.sbomify.com/CVE-2023-45640/): WordPress WP ULike Plugin <= 4.6.8 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-4564](https://insights.sbomify.com/CVE-2023-4564/): Multiple vulnerabilities in Canopsis of Capensis (medium 4.7)
- [CVE-2023-45639](https://insights.sbomify.com/CVE-2023-45639/): WordPress Sort SearchResult By Title Plugin <= 10.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-45638](https://insights.sbomify.com/CVE-2023-45638/): WordPress Eupago Gateway For Woocommerce Plugin <= 3.1.9 is vulnerable to Cross Site Request Forgery (CSRF) (medium 6.5)
- [CVE-2023-45637](https://insights.sbomify.com/CVE-2023-45637/): WordPress EventPrime Plugin <= 3.1.5 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-45636](https://insights.sbomify.com/CVE-2023-45636/): WordPress Backup & Migration plugin <= 1.4.1 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-45635](https://insights.sbomify.com/CVE-2023-45635/): WordPress Responsive Tabs plugin < 4.0.6 - HTML Content Injection vulnerability (medium 5.4)
- [CVE-2023-45634](https://insights.sbomify.com/CVE-2023-45634/): WordPress Copy Or Move Comments Plugin <= 5.0.4 is vulnerable to Cross Site Scripting (XSS) (medium 5.8)
- [CVE-2023-45633](https://insights.sbomify.com/CVE-2023-45633/): WordPress IMPress Listings plugin <= 2.6.2 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-45632](https://insights.sbomify.com/CVE-2023-45632/): WordPress Video Player Plugin <= 1.5.22 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-45631](https://insights.sbomify.com/CVE-2023-45631/): WordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-45630](https://insights.sbomify.com/CVE-2023-45630/): WordPress Responsive Image Gallery, Gallery Album Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-45629](https://insights.sbomify.com/CVE-2023-45629/): WordPress Responsive Image Gallery, Gallery Album Plugin <= 2.0.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-45628](https://insights.sbomify.com/CVE-2023-45628/): WordPress QR Twitter Widget Plugin <= 0.2.3 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-45627](https://insights.sbomify.com/CVE-2023-45627/): Denial of service in Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series; (medium 4.3)
- [CVE-2023-45626](https://insights.sbomify.com/CVE-2023-45626/): Privilege escalation in Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series; (medium 5.5)
- [CVE-2023-45625](https://insights.sbomify.com/CVE-2023-45625/): Command injection in Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series; (high 7.2)
- [CVE-2023-45624](https://insights.sbomify.com/CVE-2023-45624/): Denial of service in Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series; (high 7.5)
- [CVE-2023-45623](https://insights.sbomify.com/CVE-2023-45623/): Denial of service in Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series; (high 7.5)
- [CVE-2023-45622](https://insights.sbomify.com/CVE-2023-45622/): Denial of service in Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series; (high 7.5)
- [CVE-2023-45621](https://insights.sbomify.com/CVE-2023-45621/): Denial of service in Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series; (high 7.5)
- [CVE-2023-45620](https://insights.sbomify.com/CVE-2023-45620/): Denial of service in Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series; (high 7.5)
- [CVE-2023-4562](https://insights.sbomify.com/CVE-2023-4562/): Information Disclosure, Information Tampering and Authentication Bypass Vulnerability in MELSEC-F Series main module (critical 9.1)
- [CVE-2023-45619](https://insights.sbomify.com/CVE-2023-45619/): Path traversal in Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series; (high 8.2)
- [CVE-2023-45618](https://insights.sbomify.com/CVE-2023-45618/): Path traversal in Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series; (high 8.2)
- [CVE-2023-45617](https://insights.sbomify.com/CVE-2023-45617/): Path traversal in Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series; (high 8.2)
- [CVE-2023-45616](https://insights.sbomify.com/CVE-2023-45616/): Memory corruption in Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series; (critical 9.8)
- [CVE-2023-45615](https://insights.sbomify.com/CVE-2023-45615/): Memory corruption in Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series; (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/210/