# Vulnerabilities published in 2023


- [CVE-2023-45244](https://insights.sbomify.com/CVE-2023-45244/): Missing authorization in Acronis Cyber Protect 16 (high 7.1)
- [CVE-2023-45243](https://insights.sbomify.com/CVE-2023-45243/): Missing authorization in Acronis Cyber Protect 17 (medium 5.5)
- [CVE-2023-45242](https://insights.sbomify.com/CVE-2023-45242/): Missing authorization in Acronis Cyber Protect 17 (medium 5.5)
- [CVE-2023-45241](https://insights.sbomify.com/CVE-2023-45241/): Information disclosure in Acronis Cyber Protect 16 (medium 4.4)
- [CVE-2023-45240](https://insights.sbomify.com/CVE-2023-45240/): Missing authorization in Acronis Agent (medium 5.5)
- [CVE-2023-45239](https://insights.sbomify.com/CVE-2023-45239/): Command injection in tac plus (critical 9.8)
- [CVE-2023-45237](https://insights.sbomify.com/CVE-2023-45237/): Use of a Weak PseudoRandom Number Generator in EDK II Network Package (medium 5.3)
- [CVE-2023-45236](https://insights.sbomify.com/CVE-2023-45236/): Predictable TCP ISNs in EDK II Network Package (medium 5.8)
- [CVE-2023-45235](https://insights.sbomify.com/CVE-2023-45235/): Buffer Overflow in EDK II Network Package (high 8.3)
- [CVE-2023-45234](https://insights.sbomify.com/CVE-2023-45234/): Buffer Overflow in EDK II Network Package (high 8.3)
- [CVE-2023-45233](https://insights.sbomify.com/CVE-2023-45233/): Infinite loop in EDK II Network Package (high 7.5)
- [CVE-2023-45232](https://insights.sbomify.com/CVE-2023-45232/): Infinite loop in EDK II Network Package (high 7.5)
- [CVE-2023-45231](https://insights.sbomify.com/CVE-2023-45231/): Out-of-Bounds Read in EDK II Network Package (medium 6.5)
- [CVE-2023-45230](https://insights.sbomify.com/CVE-2023-45230/): Buffer Overflow in EDK II Network Package (high 8.3)
- [CVE-2023-4523](https://insights.sbomify.com/CVE-2023-4523/): Real Time Automation 460 Series Cross-site Scripting (critical 9.4)
- [CVE-2023-45229](https://insights.sbomify.com/CVE-2023-45229/): Out-of-Bounds Read in EDK II Network Package (medium 6.5)
- [CVE-2023-45228](https://insights.sbomify.com/CVE-2023-45228/): Sielco Radio Link and Analog FM Transmitters Improper Access Control (medium 6.5)
- [CVE-2023-45227](https://insights.sbomify.com/CVE-2023-45227/): Westermo Lynx Cross-site Scripting (medium 5.4)
- [CVE-2023-45226](https://insights.sbomify.com/CVE-2023-45226/): BIG-IP Next SPK SSH vulnerability (high 7.4)
- [CVE-2023-45225](https://insights.sbomify.com/CVE-2023-45225/): Zavio IP Camera Stack-Based Buffer Overflow (critical 9.8)
- [CVE-2023-45223](https://insights.sbomify.com/CVE-2023-45223/): Users full name disclosure through Mattermost Boards with Show Full Name Option disabled (medium 4.3)
- [CVE-2023-45222](https://insights.sbomify.com/CVE-2023-45222/): Westermo Lynx Cross-site Scripting (medium 5.4)
- [CVE-2023-45221](https://insights.sbomify.com/CVE-2023-45221/): Memory corruption in Intel(R) Media SDK (medium 4.8)
- [CVE-2023-45220](https://insights.sbomify.com/CVE-2023-45220/): Weak cryptography in ctrlX HMI Web Panel - WR21 (WR2107) (high 8.8)
- [CVE-2023-4522](https://insights.sbomify.com/CVE-2023-4522/): Improper Validation of Specified Type of Input in GitLab (medium 4.3)
- [CVE-2023-45219](https://insights.sbomify.com/CVE-2023-45219/): BIG-IP tmsh vulnerability (medium 4.4)
- [CVE-2023-45217](https://insights.sbomify.com/CVE-2023-45217/): Privilege escalation in Intel(R) Power Gadget software for Windows (high 8.8)
- [CVE-2023-45215](https://insights.sbomify.com/CVE-2023-45215/): Memory corruption in WBR-6013 (high 7.2)
- [CVE-2023-45213](https://insights.sbomify.com/CVE-2023-45213/): Westermo Lynx Permissive Cross-domain Policy with Untrusted Domains (medium 6.6)
- [CVE-2023-45210](https://insights.sbomify.com/CVE-2023-45210/): Missing authorization in Pleasanter (medium 4.3)
- [CVE-2023-4521](https://insights.sbomify.com/CVE-2023-4521/): Import XML and RSS Feeds < 2.1.5 - Unauthenticated RCE (critical 9.8)
- [CVE-2023-45209](https://insights.sbomify.com/CVE-2023-45209/): Information disclosure in Smart Reader (medium 5.3)
- [CVE-2023-45208](https://insights.sbomify.com/CVE-2023-45208/): Command injection in dlink:dap-1860 firmware (high 8.8)
- [CVE-2023-45207](https://insights.sbomify.com/CVE-2023-45207/): Cross-site scripting in zimbra:collaboration (medium 6.1)
- [CVE-2023-45206](https://insights.sbomify.com/CVE-2023-45206/): Cross-site scripting in zimbra:collaboration (medium 6.1)
- [CVE-2023-45205](https://insights.sbomify.com/CVE-2023-45205/): Misconfiguration in SICAM PAS/PQS (high 7.8)
- [CVE-2023-45204](https://insights.sbomify.com/CVE-2023-45204/): Memory corruption in Tecnomatix Plant Simulation V2201 (high 7.8)
- [CVE-2023-45203](https://insights.sbomify.com/CVE-2023-45203/): Online Examination System v1.0 - Multiple Open Redirects (medium 6.1)
- [CVE-2023-45202](https://insights.sbomify.com/CVE-2023-45202/): Online Examination System v1.0 - Multiple Open Redirects (medium 6.1)
- [CVE-2023-45201](https://insights.sbomify.com/CVE-2023-45201/): Online Examination System v1.0 - Multiple Open Redirects (medium 6.1)
- [CVE-2023-4520](https://insights.sbomify.com/CVE-2023-4520/): Cross-site scripting in FV Flowplayer Video Player (medium 5.4)
- [CVE-2023-45199](https://insights.sbomify.com/CVE-2023-45199/): Memory corruption in trustedfirmware:mbed tls (critical 9.8)
- [CVE-2023-45198](https://insights.sbomify.com/CVE-2023-45198/): Information disclosure in netbsd:ftpd (high 7.5)
- [CVE-2023-45197](https://insights.sbomify.com/CVE-2023-45197/): Adminer and AdminerEvo vulnerable to directory traversal and file upload (critical 9.2)
- [CVE-2023-45196](https://insights.sbomify.com/CVE-2023-45196/): Adminer and AdminerEvo denial of service via HTTP redirect (medium 6.9)
- [CVE-2023-45195](https://insights.sbomify.com/CVE-2023-45195/): Adminer and AdminerEvo SSRF (medium 6.9)
- [CVE-2023-45194](https://insights.sbomify.com/CVE-2023-45194/): Hardcoded credentials in MR-GM2 (medium 4.3)
- [CVE-2023-45193](https://insights.sbomify.com/CVE-2023-45193/): IBM Db2 denial of service (medium 5.9)
- [CVE-2023-45192](https://insights.sbomify.com/CVE-2023-45192/): IBM Engineering Requirements Management DOORS Next XML external entity injection (high 8.2)
- [CVE-2023-45191](https://insights.sbomify.com/CVE-2023-45191/): IBM Engineering Lifecycle Optimization information disclosure (high 7.5)
- [CVE-2023-45190](https://insights.sbomify.com/CVE-2023-45190/): IBM Engineering Lifecycle Optimization HTTP header injection (medium 5.1)
- [CVE-2023-45189](https://insights.sbomify.com/CVE-2023-45189/): IBM Robotic Process Automation information disclosure (medium 6.5)
- [CVE-2023-45188](https://insights.sbomify.com/CVE-2023-45188/): IBM Engineering Lifecycle Optimization Publishing file upload (medium 6.5)
- [CVE-2023-45187](https://insights.sbomify.com/CVE-2023-45187/): IBM Engineering Lifecycle Optimization - Publishing session fixation (medium 6.3)
- [CVE-2023-45186](https://insights.sbomify.com/CVE-2023-45186/): IBM Sterling B2B Integrator cross-site scripting (medium 4.8)
- [CVE-2023-45185](https://insights.sbomify.com/CVE-2023-45185/): IBM i Access Client Solutions code execution (high 7.4)
- [CVE-2023-45184](https://insights.sbomify.com/CVE-2023-45184/): IBM i Access Client Solutions (medium 6.2)
- [CVE-2023-45182](https://insights.sbomify.com/CVE-2023-45182/): IBM i Access Client Solutions information disclosure (high 7.4)
- [CVE-2023-45181](https://insights.sbomify.com/CVE-2023-45181/): IBM Jazz Foundation cross-site scripting (medium 6.1)
- [CVE-2023-4518](https://insights.sbomify.com/CVE-2023-4518/): Denial of service in Relion670 (medium 6.5)
- [CVE-2023-45178](https://insights.sbomify.com/CVE-2023-45178/): IBM Db2 denial of service (medium 6.5)
- [CVE-2023-45177](https://insights.sbomify.com/CVE-2023-45177/): IBM MQ denial of service (medium 5.3)
- [CVE-2023-45176](https://insights.sbomify.com/CVE-2023-45176/): IBM App Connect Enterprise and IBM Integration Bus denial of service (medium 6.2)
- [CVE-2023-45175](https://insights.sbomify.com/CVE-2023-45175/): IBM AIX denial of service (medium 6.2)
- [CVE-2023-45174](https://insights.sbomify.com/CVE-2023-45174/): IBM AIX privilege escalation (high 8.4)
- [CVE-2023-45173](https://insights.sbomify.com/CVE-2023-45173/): IBM AIX denial of service (medium 6.2)
- [CVE-2023-45172](https://insights.sbomify.com/CVE-2023-45172/): IBM AIX denial of service (medium 6.2)
- [CVE-2023-45171](https://insights.sbomify.com/CVE-2023-45171/): IBM AIX denial of service (medium 6.2)
- [CVE-2023-45170](https://insights.sbomify.com/CVE-2023-45170/): IBM AIX privilege escalation (high 8.4)
- [CVE-2023-4517](https://insights.sbomify.com/CVE-2023-4517/): Cross-site Scripting (XSS) - Stored in hestiacp/hestiacp (low 3.2)
- [CVE-2023-45169](https://insights.sbomify.com/CVE-2023-45169/): IBM AIX denial of service (medium 6.2)
- [CVE-2023-45168](https://insights.sbomify.com/CVE-2023-45168/): IBM AIX command execution (high 8.4)
- [CVE-2023-45167](https://insights.sbomify.com/CVE-2023-45167/): IBM AIX denial of service (medium 6.2)
- [CVE-2023-45166](https://insights.sbomify.com/CVE-2023-45166/): IBM AIX privilege escalation (high 8.4)
- [CVE-2023-45165](https://insights.sbomify.com/CVE-2023-45165/): IBM AIX denial of service (medium 6.2)
- [CVE-2023-45163](https://insights.sbomify.com/CVE-2023-45163/): 1E-Exchange-CommandLinePing instruction before v18.1 allows for arbitrary code execution (critical 9.9)
- [CVE-2023-45162](https://insights.sbomify.com/CVE-2023-45162/): Blind SQL vulnerability in 1E platform (critical 9.9)
- [CVE-2023-45161](https://insights.sbomify.com/CVE-2023-45161/): 1E-Exchange-URLResponseTime instruction before v20.1 allows arbitrary code execution (critical 9.9)
- [CVE-2023-45160](https://insights.sbomify.com/CVE-2023-45160/): Elevated Temp Directory Execution in 1E Client (high 8.8)
- [CVE-2023-4516](https://insights.sbomify.com/CVE-2023-4516/): Missing authorization in IGSS Update Service (IGSSupdateservice.exe) (high 7.8)
- [CVE-2023-45159](https://insights.sbomify.com/CVE-2023-45159/): 1E Client installer can perform arbitrary file deletion on protected files (high 8.4)
- [CVE-2023-45158](https://insights.sbomify.com/CVE-2023-45158/): Command injection in web2py (critical 9.8)
- [CVE-2023-45152](https://insights.sbomify.com/CVE-2023-45152/): Blind Server Side Request Forgery (SSRF) in remote schedule import feature in Engelsystem (low 2.0)
- [CVE-2023-45151](https://insights.sbomify.com/CVE-2023-45151/): OAuth2 client_secret stored in plain text in the Nextcloud database (medium 6.5)
- [CVE-2023-45150](https://insights.sbomify.com/CVE-2023-45150/): Inviting excessive long email addresses to a calendar event makes the Nextcloud server unresponsive (medium 4.3)
- [CVE-2023-4515](https://insights.sbomify.com/CVE-2023-4515/): ksmbd: validate command request size (critical 9.1)
- [CVE-2023-45149](https://insights.sbomify.com/CVE-2023-45149/): Password of talk conversations can be bruteforced in Nextcloud (medium 4.3)
- [CVE-2023-45148](https://insights.sbomify.com/CVE-2023-45148/): Rate limiter not working reliable when Memcached is installed in Nextcloud (medium 4.3)
- [CVE-2023-45147](https://insights.sbomify.com/CVE-2023-45147/): Arbitrary keys can be added to a topic's custom fields by any user in Discourse (medium 4.9)
- [CVE-2023-45146](https://insights.sbomify.com/CVE-2023-45146/): Remote code execution in XXL-RPC (critical 9.1)
- [CVE-2023-45145](https://insights.sbomify.com/CVE-2023-45145/): Redis Unix-domain socket may have be exposed with the wrong permissions for a short time window. (low 3.6)
- [CVE-2023-45144](https://insights.sbomify.com/CVE-2023-45144/): Remote code execution from login screen through unescaped URL parameter in OAuth Identity XWiki App (critical 10.0)
- [CVE-2023-45143](https://insights.sbomify.com/CVE-2023-45143/): Undici's cookie header not cleared on cross-origin redirect in fetch (low 3.9)
- [CVE-2023-45142](https://insights.sbomify.com/CVE-2023-45142/): OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics (high 7.5)
- [CVE-2023-45141](https://insights.sbomify.com/CVE-2023-45141/): CSRF Token Validation Vulnerability in fiber (high 8.6)
- [CVE-2023-45140](https://insights.sbomify.com/CVE-2023-45140/): Group-based JIT MFA bypass on scp and sftp in The Bastion (medium 4.8)
- [CVE-2023-4514](https://insights.sbomify.com/CVE-2023-4514/): Mmm Simple File List <= 2.3 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-45139](https://insights.sbomify.com/CVE-2023-45139/): fonttools XML External Entity Injection (XXE) Vulnerability (high 7.5)
- [CVE-2023-45138](https://insights.sbomify.com/CVE-2023-45138/): Change Request Application vulnerable to XSS and remote code execution through change request title (critical 10.0)
- [CVE-2023-45137](https://insights.sbomify.com/CVE-2023-45137/): XWiki Platform XSS with edit right in the create document form for existing pages (critical 9.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/213/