# Vulnerabilities published in 2023


- [CVE-2023-45383](https://insights.sbomify.com/CVE-2023-45383/): Path traversal in common-services:sonice etiquetage (high 7.5)
- [CVE-2023-45382](https://insights.sbomify.com/CVE-2023-45382/): Path traversal in common-services:sonice retour (high 7.5)
- [CVE-2023-45381](https://insights.sbomify.com/CVE-2023-45381/): SQL injection in webshopworks:creativepopup (critical 9.8)
- [CVE-2023-45380](https://insights.sbomify.com/CVE-2023-45380/): Missing authorization in silbersaiten:order duplicator (critical 9.1)
- [CVE-2023-4538](https://insights.sbomify.com/CVE-2023-4538/): Shared Key in Comarch ERP XL (medium 6.2)
- [CVE-2023-45379](https://insights.sbomify.com/CVE-2023-45379/): SQL injection in posthemes:posrotatorimg (critical 9.8)
- [CVE-2023-45378](https://insights.sbomify.com/CVE-2023-45378/): SQL injection in hdclic:prestablog (critical 9.8)
- [CVE-2023-45377](https://insights.sbomify.com/CVE-2023-45377/): SQL injection in chronopost:chronopost (critical 9.8)
- [CVE-2023-45376](https://insights.sbomify.com/CVE-2023-45376/): SQL injection in hipresta:carousels pack (critical 9.8)
- [CVE-2023-45375](https://insights.sbomify.com/CVE-2023-45375/): SQL injection in 01generator:pireospay (high 8.8)
- [CVE-2023-45374](https://insights.sbomify.com/CVE-2023-45374/): Cross-site request forgery in mediawiki:mediawiki (medium 5.3)
- [CVE-2023-45373](https://insights.sbomify.com/CVE-2023-45373/): Cross-site scripting in mediawiki:mediawiki (medium 6.1)
- [CVE-2023-45372](https://insights.sbomify.com/CVE-2023-45372/): Security feature bypass in mediawiki:mediawiki (medium 5.3)
- [CVE-2023-45371](https://insights.sbomify.com/CVE-2023-45371/): Denial of service in mediawiki:mediawiki (high 7.5)
- [CVE-2023-45370](https://insights.sbomify.com/CVE-2023-45370/): Missing authorization in mediawiki:mediawiki (medium 5.3)
- [CVE-2023-4537](https://insights.sbomify.com/CVE-2023-4537/): Protocol Downgrade in Comarch ERP XL (high 7.4)
- [CVE-2023-45369](https://insights.sbomify.com/CVE-2023-45369/): Information disclosure in mediawiki:mediawiki (medium 4.3)
- [CVE-2023-45367](https://insights.sbomify.com/CVE-2023-45367/): Denial of service in mediawiki:mediawiki (medium 6.5)
- [CVE-2023-45364](https://insights.sbomify.com/CVE-2023-45364/): Information disclosure in debian:debian linux (medium 5.3)
- [CVE-2023-45363](https://insights.sbomify.com/CVE-2023-45363/): MediaWiki Denial of Service vulnerability (high 7.5)
- [CVE-2023-45362](https://insights.sbomify.com/CVE-2023-45362/): Information disclosure in mediawiki:mediawiki (medium 4.3)
- [CVE-2023-45361](https://insights.sbomify.com/CVE-2023-45361/): An issue was discovered in VectorComponentUserLinks.php in the Vector Skin component in MediaWiki before 1.39.5 and 1.40.x before 1.40.1. (medium 6.1)
- [CVE-2023-45360](https://insights.sbomify.com/CVE-2023-45360/): Cross-site scripting in mediawiki:mediawiki (medium 5.4)
- [CVE-2023-4536](https://insights.sbomify.com/CVE-2023-4536/): My Account Page Editor < 1.3.2 - Subscriber+ Arbitrary File Upload (high 8.8)
- [CVE-2023-45359](https://insights.sbomify.com/CVE-2023-45359/): An issue was discovered in the Vector Skin component for MediaWiki before 1.39.5 and 1.40.x before 1.40.1. (medium 6.5)
- [CVE-2023-45358](https://insights.sbomify.com/CVE-2023-45358/): Cross-site scripting in archerirm:archer (high 8.5)
- [CVE-2023-45357](https://insights.sbomify.com/CVE-2023-45357/): Information disclosure in archerirm:archer (medium 4.3)
- [CVE-2023-45356](https://insights.sbomify.com/CVE-2023-45356/): Command injection in atos:unify openscape 4000 assistant (high 8.8)
- [CVE-2023-45355](https://insights.sbomify.com/CVE-2023-45355/): Command injection in atos:unify openscape 4000 assistant (high 8.8)
- [CVE-2023-45354](https://insights.sbomify.com/CVE-2023-45354/): Code injection in atos:unify openscape common management (high 8.8)
- [CVE-2023-45353](https://insights.sbomify.com/CVE-2023-45353/): File upload in atos:unify openscape common management (high 8.8)
- [CVE-2023-45352](https://insights.sbomify.com/CVE-2023-45352/): Path traversal in atos:unify openscape common management (high 8.8)
- [CVE-2023-45351](https://insights.sbomify.com/CVE-2023-45351/): Command injection in atos:unify openscape 4000 assistant (high 8.8)
- [CVE-2023-45350](https://insights.sbomify.com/CVE-2023-45350/): Privilege escalation in atos:unify openscape 4000 manager (high 8.8)
- [CVE-2023-4535](https://insights.sbomify.com/CVE-2023-4535/): Opensc: out-of-bounds read in myeid driver handling encryption using symmetric keys (medium 4.5)
- [CVE-2023-45349](https://insights.sbomify.com/CVE-2023-45349/): Information disclosure in atos:unify openscape 4000 assistant (high 7.5)
- [CVE-2023-45348](https://insights.sbomify.com/CVE-2023-45348/): Apache Airflow: Configuration information leakage vulnerability (medium 4.3)
- [CVE-2023-45347](https://insights.sbomify.com/CVE-2023-45347/): Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-45346](https://insights.sbomify.com/CVE-2023-45346/): Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-45345](https://insights.sbomify.com/CVE-2023-45345/): Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-45344](https://insights.sbomify.com/CVE-2023-45344/): Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-45343](https://insights.sbomify.com/CVE-2023-45343/): Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-45342](https://insights.sbomify.com/CVE-2023-45342/): Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-45341](https://insights.sbomify.com/CVE-2023-45341/): Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-45340](https://insights.sbomify.com/CVE-2023-45340/): Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-4534](https://insights.sbomify.com/CVE-2023-4534/): NeoMind Fusion Platform Link cross site scripting (low 3.5)
- [CVE-2023-45338](https://insights.sbomify.com/CVE-2023-45338/): Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-45336](https://insights.sbomify.com/CVE-2023-45336/): Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-45334](https://insights.sbomify.com/CVE-2023-45334/): Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-45325](https://insights.sbomify.com/CVE-2023-45325/): Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-45323](https://insights.sbomify.com/CVE-2023-45323/): Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (critical 9.8)
- [CVE-2023-45322](https://insights.sbomify.com/CVE-2023-45322/): Use after free in xmlsoft:libxml2 (medium 6.5)
- [CVE-2023-45321](https://insights.sbomify.com/CVE-2023-45321/): Weak cryptography in ctrlX HMI Web Panel - WR21 (WR2107) (high 8.3)
- [CVE-2023-45320](https://insights.sbomify.com/CVE-2023-45320/): Privilege escalation in Intel(R) VTune(TM) Profiler software (medium 6.7)
- [CVE-2023-4532](https://insights.sbomify.com/CVE-2023-4532/): Incorrect Authorization in GitLab (medium 4.3)
- [CVE-2023-45319](https://insights.sbomify.com/CVE-2023-45319/): Unauthenticated Remote Denial-of-Service (Commit) in Helix Core (high 7.5)
- [CVE-2023-45318](https://insights.sbomify.com/CVE-2023-45318/): Memory corruption in Gecko Platform (critical 10.0)
- [CVE-2023-45317](https://insights.sbomify.com/CVE-2023-45317/): Sielco Radio Link and Analog FM Transmitters Cross-Site Request Forgery (high 8.8)
- [CVE-2023-45316](https://insights.sbomify.com/CVE-2023-45316/): Reflected client side path traversal leading to CSRF in Playbooks (high 7.3)
- [CVE-2023-45315](https://insights.sbomify.com/CVE-2023-45315/): Denial of service in Intel(R) Power Gadget software for Windwos (medium 5.5)
- [CVE-2023-45312](https://insights.sbomify.com/CVE-2023-45312/): MTProto proxy remote code execution vulnerability (high 8.8)
- [CVE-2023-45311](https://insights.sbomify.com/CVE-2023-45311/): Code injection in fsevents (critical 9.8)
- [CVE-2023-4531](https://insights.sbomify.com/CVE-2023-4531/): SQLi in Mestavs E-commerce Software (critical 9.8)
- [CVE-2023-45303](https://insights.sbomify.com/CVE-2023-45303/): ThingsBoard Server-Side Template Injection (high 8.4)
- [CVE-2023-4530](https://insights.sbomify.com/CVE-2023-4530/): SQLi in Turna Media's Advertising Administration Panel (critical 9.8)
- [CVE-2023-45292](https://insights.sbomify.com/CVE-2023-45292/): Captcha verification bypass in github.com/mojocn/base64Captcha (medium 5.3)
- [CVE-2023-45290](https://insights.sbomify.com/CVE-2023-45290/): Memory exhaustion in multipart form parsing in net/textproto and net/http (medium 6.5)
- [CVE-2023-45289](https://insights.sbomify.com/CVE-2023-45289/): Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http (medium 4.3)
- [CVE-2023-45288](https://insights.sbomify.com/CVE-2023-45288/): HTTP/2 CONTINUATION flood in net/http (high 7.5)
- [CVE-2023-45287](https://insights.sbomify.com/CVE-2023-45287/): Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel (high 7.5)
- [CVE-2023-45286](https://insights.sbomify.com/CVE-2023-45286/): HTTP request body disclosure in github.com/go-resty/resty/v2 (medium 5.9)
- [CVE-2023-45285](https://insights.sbomify.com/CVE-2023-45285/): Command 'go get' may unexpectedly fallback to insecure git in cmd/go (high 7.5)
- [CVE-2023-45284](https://insights.sbomify.com/CVE-2023-45284/): Incorrect detection of reserved device names on Windows in path/filepath (medium 5.3)
- [CVE-2023-45283](https://insights.sbomify.com/CVE-2023-45283/): Insecure parsing of Windows paths with a \??\ prefix in path/filepath (high 7.5)
- [CVE-2023-45282](https://insights.sbomify.com/CVE-2023-45282/): Prototype Pollution in NASA Open MCT (high 7.5)
- [CVE-2023-45281](https://insights.sbomify.com/CVE-2023-45281/): Cross-site scripting in spaceapplications:yamcs (medium 6.1)
- [CVE-2023-45280](https://insights.sbomify.com/CVE-2023-45280/): Yamcs Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2023-4528](https://insights.sbomify.com/CVE-2023-4528/): JSCAPE MFT Server Unsafe Deserialization on Management Port (high 7.2)
- [CVE-2023-45279](https://insights.sbomify.com/CVE-2023-45279/): Yamcs Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2023-45278](https://insights.sbomify.com/CVE-2023-45278/): Yamcs API Directory Traversal vulnerability (critical 9.1)
- [CVE-2023-45277](https://insights.sbomify.com/CVE-2023-45277/): Yamcs Path Traversal vulnerability (high 7.5)
- [CVE-2023-45276](https://insights.sbomify.com/CVE-2023-45276/): WordPress Automated Editor Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-45275](https://insights.sbomify.com/CVE-2023-45275/): WordPress Contact Form builder with drag & drop plugin <= 2.3.28 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-45274](https://insights.sbomify.com/CVE-2023-45274/): WordPress SendPulse Free Web Push Plugin <= 1.3.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-45273](https://insights.sbomify.com/CVE-2023-45273/): WordPress Stout Google Calendar Plugin <= 1.2.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-45272](https://insights.sbomify.com/CVE-2023-45272/): WordPress 10Web Map Builder for Google Maps plugin <= 1.0.73 - Notice Dismissal Vulnerability (medium 5.4)
- [CVE-2023-45271](https://insights.sbomify.com/CVE-2023-45271/): WordPress ProductX – Gutenberg WooCommerce Blocks plugin <= 2.7.8 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-45270](https://insights.sbomify.com/CVE-2023-45270/): WordPress Pinpoint Booking System Plugin <= 2.9.9.4.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-4527](https://insights.sbomify.com/CVE-2023-4527/): Glibc: stack read overflow in getaddrinfo in no-aaaa mode (medium 6.5)
- [CVE-2023-45269](https://insights.sbomify.com/CVE-2023-45269/): WordPress Simple SEO Plugin <= 2.0.25 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-45268](https://insights.sbomify.com/CVE-2023-45268/): WordPress Hitsteps Web Analytics Plugin <= 5.86 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-45267](https://insights.sbomify.com/CVE-2023-45267/): WordPress IRivYou Plugin <= 2.2.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-45256](https://insights.sbomify.com/CVE-2023-45256/): Multiple SQL injection vulnerabilities in the EuroInformation MoneticoPaiement module before 1.1.1 for PrestaShop allow remote attackers to (medium 5.4)
- [CVE-2023-45253](https://insights.sbomify.com/CVE-2023-45253/): Privilege escalation in huddly:huddlycameraservices (high 7.8)
- [CVE-2023-45252](https://insights.sbomify.com/CVE-2023-45252/): Privilege escalation in huddly:huddlycameraservice (high 7.8)
- [CVE-2023-45249](https://insights.sbomify.com/CVE-2023-45249/): Acronis Cyber Infrastructure (ACI) Insecure Default Password (critical 9.8, exploited in the wild)
- [CVE-2023-45248](https://insights.sbomify.com/CVE-2023-45248/): Privilege escalation in Acronis Cyber Protect 16 (medium 6.6)
- [CVE-2023-45247](https://insights.sbomify.com/CVE-2023-45247/): Missing authorization in Acronis Cyber Protect 16 (high 7.1)
- [CVE-2023-45246](https://insights.sbomify.com/CVE-2023-45246/): Missing authorization in Acronis Cyber Protect 16 (high 7.1)
- [CVE-2023-45245](https://insights.sbomify.com/CVE-2023-45245/): Missing authorization in Acronis Agent (low 3.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/212/