# Vulnerabilities published in 2023


- [CVE-2023-3752](https://insights.sbomify.com/CVE-2023-3752/): Creativeitem Academy LMS courses cross site scripting (low 3.5)
- [CVE-2023-37519](https://insights.sbomify.com/CVE-2023-37519/): HCL BigFix Platform is affected by Unathenticated Stored Cross-Site Scripting (XSS) (high 7.7)
- [CVE-2023-37518](https://insights.sbomify.com/CVE-2023-37518/): A code injection vulnerability affects HCL BigFix ServiceNow Data Flow (medium 6.4)
- [CVE-2023-37517](https://insights.sbomify.com/CVE-2023-37517/): HCL Domino Volt and Domino Leap are affected by missing "no cache" headers (low 3.2)
- [CVE-2023-37516](https://insights.sbomify.com/CVE-2023-37516/): HCL Leap is affected by missing "no cache" headers (low 3.2)
- [CVE-2023-37513](https://insights.sbomify.com/CVE-2023-37513/): HCL Traveler To Do is vulnerable to revealing sensitive information via the task switcher (low 3.3)
- [CVE-2023-37512](https://insights.sbomify.com/CVE-2023-37512/): HCL Traveler Companion is vulnerable to revealing sensitive information via the task switcher (low 3.3)
- [CVE-2023-37511](https://insights.sbomify.com/CVE-2023-37511/): HCL Traveler To Do is affected by App Transport Security (ATS) settings allowing insecure loads in web content (low 3.5)
- [CVE-2023-3751](https://insights.sbomify.com/CVE-2023-3751/): Super Store Finder POST Parameter index.php sql injection (medium 6.3)
- [CVE-2023-37508](https://insights.sbomify.com/CVE-2023-37508/): HCL DevOps Plan is susceptible to a Cross-Site Scripting (XSS) vulnerability (low 2.3)
- [CVE-2023-37507](https://insights.sbomify.com/CVE-2023-37507/): An information disclosure vulnerability affects HCL DevOps Plan (medium 6.9)
- [CVE-2023-37504](https://insights.sbomify.com/CVE-2023-37504/): An insufficient session expiration vulnerability affects HCL Compass (high 7.1)
- [CVE-2023-37503](https://insights.sbomify.com/CVE-2023-37503/): A weak password requirements vulnerability affects HCL Compass (high 8.1)
- [CVE-2023-37502](https://insights.sbomify.com/CVE-2023-37502/): An unrestricted file upload vulnerability affects HCL Compass (critical 9.0)
- [CVE-2023-37501](https://insights.sbomify.com/CVE-2023-37501/): A Persistent Cross-site Scripting (XSS) vulnerability affects HCL Unica Campaign (high 8.1)
- [CVE-2023-37500](https://insights.sbomify.com/CVE-2023-37500/): A Persistent Cross-site Scripting (XSS) vulnerability affects HCL Unica Platform (high 8.1)
- [CVE-2023-3750](https://insights.sbomify.com/CVE-2023-3750/): Libvirt: improper locking in virstoragepoolobjlistsearch may lead to denial of service (medium 6.5)
- [CVE-2023-37499](https://insights.sbomify.com/CVE-2023-37499/): A Persistent Cross-site Scripting (XSS) vulnerability affects HCL Unica Platform (high 8.1)
- [CVE-2023-37498](https://insights.sbomify.com/CVE-2023-37498/): HCL Unica Platform is vulnerable to a privilege escalation by unauthorized group assignation (high 8.1)
- [CVE-2023-37497](https://insights.sbomify.com/CVE-2023-37497/): An XML External Entity (XXE) Injection Vulnerability affects HCL Unica Platform (high 8.1)
- [CVE-2023-37496](https://insights.sbomify.com/CVE-2023-37496/): HCL Verse is susceptible to a Stored Cross-Site Scripting (XSS) Vulnerability (high 8.3)
- [CVE-2023-37495](https://insights.sbomify.com/CVE-2023-37495/): HCL Domino is susceptible to a weak cryptography vulnerability (medium 5.9)
- [CVE-2023-37492](https://insights.sbomify.com/CVE-2023-37492/): Missing Authorization check in SAP NetWeaver AS ABAP and ABAP Platform (medium 4.9)
- [CVE-2023-37491](https://insights.sbomify.com/CVE-2023-37491/): Improper Authorization check vulnerability in SAP Message Server (high 7.5)
- [CVE-2023-37490](https://insights.sbomify.com/CVE-2023-37490/): Binary hijack in SAP BusinessObjects Business Intelligence (Installer) (high 7.6)
- [CVE-2023-3749](https://insights.sbomify.com/CVE-2023-3749/): VideoEdge config (high 7.1)
- [CVE-2023-37489](https://insights.sbomify.com/CVE-2023-37489/): Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Version Management System) (medium 5.3)
- [CVE-2023-37488](https://insights.sbomify.com/CVE-2023-37488/): Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Process Integration (medium 6.1)
- [CVE-2023-37487](https://insights.sbomify.com/CVE-2023-37487/): Security misconfiguration vulnerability in SAP Business One (Service Layer) (medium 5.3)
- [CVE-2023-37486](https://insights.sbomify.com/CVE-2023-37486/): Information Disclosure vulnerability in SAP Commerce (OCC API) (medium 5.9)
- [CVE-2023-37484](https://insights.sbomify.com/CVE-2023-37484/): Information Disclosure Vulnerabilities in SAP PowerDesigner (medium 5.3)
- [CVE-2023-37483](https://insights.sbomify.com/CVE-2023-37483/): Improper Access Control Vulnerabilities in SAP PowerDesigner (critical 9.8)
- [CVE-2023-37482](https://insights.sbomify.com/CVE-2023-37482/): Information disclosure in SIMATIC Drive Controller CPU 1504D TF (medium 6.9)
- [CVE-2023-37481](https://insights.sbomify.com/CVE-2023-37481/): Fides Webserver Vulnerable to SVG Bomb File Uploads (low 2.7)
- [CVE-2023-37480](https://insights.sbomify.com/CVE-2023-37480/): Fides Webserver Vulnerable to Zip Bomb File Uploads (low 2.7)
- [CVE-2023-3748](https://insights.sbomify.com/CVE-2023-3748/): Inifinite loop in babld message parsing may cause dos (low 3.5)
- [CVE-2023-37479](https://insights.sbomify.com/CVE-2023-37479/): Improper sanitization of MXCSR and RFLAGS in OpenEnclave (medium 5.3)
- [CVE-2023-37478](https://insights.sbomify.com/CVE-2023-37478/): pnpm incorrectly parses tar archives relative to specification (high 7.5)
- [CVE-2023-37477](https://insights.sbomify.com/CVE-2023-37477/): Command injection in firewall ip functionality in 1Panel (high 7.2)
- [CVE-2023-37476](https://insights.sbomify.com/CVE-2023-37476/): Zip slip in OpenRefine (medium 5.5)
- [CVE-2023-37475](https://insights.sbomify.com/CVE-2023-37475/): Attacker-controlled parameter can cause denial of service in hamba avro (high 7.5)
- [CVE-2023-37474](https://insights.sbomify.com/CVE-2023-37474/): Path traversal in copyparty (high 7.5)
- [CVE-2023-37473](https://insights.sbomify.com/CVE-2023-37473/): Limited code execution in zenstruck/collections (high 8.6)
- [CVE-2023-37472](https://insights.sbomify.com/CVE-2023-37472/): Query injection in Knowage server (high 7.7)
- [CVE-2023-37471](https://insights.sbomify.com/CVE-2023-37471/): User impersonation using SAMLv1.x SSO in Open Access Management (critical 9.1)
- [CVE-2023-37470](https://insights.sbomify.com/CVE-2023-37470/): Metabase vulnerable to remote code execution via POST /api/setup/validate API endpoint (critical 10.0)
- [CVE-2023-3747](https://insights.sbomify.com/CVE-2023-3747/): Insufficient Validation on Override Codes for Always-Enabled WARP Mode (medium 5.5)
- [CVE-2023-37469](https://insights.sbomify.com/CVE-2023-37469/): CasaOS Command Injection vulnerability (high 8.8)
- [CVE-2023-37468](https://insights.sbomify.com/CVE-2023-37468/): Storing unencrypted LDAP passwords in feedbacksystem (medium 6.0)
- [CVE-2023-37467](https://insights.sbomify.com/CVE-2023-37467/): Discourse CSP nonce reuse vulnerability for anonymous users (medium 6.8)
- [CVE-2023-37466](https://insights.sbomify.com/CVE-2023-37466/): vm2 Sandbox Escape vulnerability (critical 9.8)
- [CVE-2023-37464](https://insights.sbomify.com/CVE-2023-37464/): Incorrect Authentication Tag length usage in AES GCM decryption in OpenIDC/cjose (high 8.6)
- [CVE-2023-37463](https://insights.sbomify.com/CVE-2023-37463/): Quadratic complexity bugs may lead to a denial of service (medium 6.4)
- [CVE-2023-37462](https://insights.sbomify.com/CVE-2023-37462/): org.xwiki.platform:xwiki-platform-skin-ui Eval Injection vulnerability (critical 10.0)
- [CVE-2023-37461](https://insights.sbomify.com/CVE-2023-37461/): Path traversal in metersphere (medium 5.6)
- [CVE-2023-37460](https://insights.sbomify.com/CVE-2023-37460/): Plexus Archiver vulnerable to Arbitrary File Creation in AbstractUnArchiver (high 8.1)
- [CVE-2023-3746](https://insights.sbomify.com/CVE-2023-3746/): ActivityPub for WordPress < 1.0.1 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-37459](https://insights.sbomify.com/CVE-2023-37459/): Out-of-bounds read when processing a received IPv6 packet (medium 5.3)
- [CVE-2023-37457](https://insights.sbomify.com/CVE-2023-37457/): Asterisk's PJSIP_HEADER dialplan function can overwrite memory/cause crash when using 'update' (high 7.5)
- [CVE-2023-37456](https://insights.sbomify.com/CVE-2023-37456/): Null dereference in Firefox for iOS (medium 6.5)
- [CVE-2023-37455](https://insights.sbomify.com/CVE-2023-37455/): Security feature bypass in Firefox for iOS (medium 5.4)
- [CVE-2023-37454](https://insights.sbomify.com/CVE-2023-37454/): Use after free in linux:linux kernel (medium 5.5)
- [CVE-2023-37453](https://insights.sbomify.com/CVE-2023-37453/): Memory corruption in linux:linux kernel (medium 4.6)
- [CVE-2023-37450](https://insights.sbomify.com/CVE-2023-37450/): Apple Multiple Products WebKit Code Execution (high 8.8, exploited in the wild)
- [CVE-2023-3745](https://insights.sbomify.com/CVE-2023-3745/): Imagemagick: heap-buffer-overflow in pushcharpixel() in quantum-private.h (medium 5.5)
- [CVE-2023-37448](https://insights.sbomify.com/CVE-2023-37448/): Security feature bypass in macOS (low 3.3)
- [CVE-2023-37447](https://insights.sbomify.com/CVE-2023-37447/): Memory corruption in GTKWave (high 7.8)
- [CVE-2023-37446](https://insights.sbomify.com/CVE-2023-37446/): Memory corruption in GTKWave (high 7.8)
- [CVE-2023-37445](https://insights.sbomify.com/CVE-2023-37445/): Memory corruption in GTKWave (high 7.8)
- [CVE-2023-37444](https://insights.sbomify.com/CVE-2023-37444/): Memory corruption in GTKWave (high 7.8)
- [CVE-2023-37443](https://insights.sbomify.com/CVE-2023-37443/): Memory corruption in GTKWave (high 7.8)
- [CVE-2023-37442](https://insights.sbomify.com/CVE-2023-37442/): Memory corruption in GTKWave (high 7.8)
- [CVE-2023-37440](https://insights.sbomify.com/CVE-2023-37440/): Authenticated Server-Side Request Forgery (SSRF) Leading to Information Disclosure (medium 5.5)
- [CVE-2023-3744](https://insights.sbomify.com/CVE-2023-3744/): Server-Side Request Forgery in SLiMS (critical 9.9)
- [CVE-2023-37439](https://insights.sbomify.com/CVE-2023-37439/): Reflected Cross Site Scripting in EdgeConnect SD-WAN Orchestrator Web Management Interface (medium 6.1)
- [CVE-2023-37438](https://insights.sbomify.com/CVE-2023-37438/): Authenticated SQL Injection Vulnerabilities in EdgeConnect SD-WAN Orchestrator Web-based Management Interface (medium 6.5)
- [CVE-2023-37437](https://insights.sbomify.com/CVE-2023-37437/): Authenticated SQL Injection Vulnerabilities in EdgeConnect SD-WAN Orchestrator Web-based Management Interface (medium 6.5)
- [CVE-2023-37436](https://insights.sbomify.com/CVE-2023-37436/): Authenticated SQL Injection Vulnerabilities in EdgeConnect SD-WAN Orchestrator Web-based Management Interface (medium 6.5)
- [CVE-2023-37435](https://insights.sbomify.com/CVE-2023-37435/): Authenticated SQL Injection Vulnerabilities in EdgeConnect SD-WAN Orchestrator Web-based Management Interface (medium 6.5)
- [CVE-2023-37434](https://insights.sbomify.com/CVE-2023-37434/): Authenticated SQL Injection Vulnerabilities in EdgeConnect SD-WAN Orchestrator Web-based Management Interface (medium 6.5)
- [CVE-2023-37433](https://insights.sbomify.com/CVE-2023-37433/): Authenticated SQL Injection Vulnerabilities in EdgeConnect SD-WAN Orchestrator Web-based Management Interface (medium 6.5)
- [CVE-2023-37432](https://insights.sbomify.com/CVE-2023-37432/): Authenticated SQL Injection Vulnerabilities in EdgeConnect SD-WAN Orchestrator Web-based Management Interface (medium 6.5)
- [CVE-2023-37431](https://insights.sbomify.com/CVE-2023-37431/): Authenticated SQL Injection Vulnerabilities in EdgeConnect SD-WAN Orchestrator Web-based Management Interface (medium 6.5)
- [CVE-2023-37430](https://insights.sbomify.com/CVE-2023-37430/): Authenticated SQL Injection Vulnerabilities in EdgeConnect SD-WAN Orchestrator Web-based Management Interface (medium 6.5)
- [CVE-2023-3743](https://insights.sbomify.com/CVE-2023-3743/): SQL injection vulnerability in LeoTheme's Ap Page Builder (high 7.5)
- [CVE-2023-37429](https://insights.sbomify.com/CVE-2023-37429/): Authenticated SQL Injection Vulnerabilities in EdgeConnect SD-WAN Orchestrator Web-based Management Interface (medium 6.5)
- [CVE-2023-37428](https://insights.sbomify.com/CVE-2023-37428/): Path traversal in EdgeConnect SD-WAN Orchestrator (high 7.2)
- [CVE-2023-37427](https://insights.sbomify.com/CVE-2023-37427/): Authenticated Remote Code Execution in EdgeConnect SD-WAN Orchestrator Web-Based Management Interface (high 7.2)
- [CVE-2023-37426](https://insights.sbomify.com/CVE-2023-37426/): Shared SSH Static Host Keys in EdgeConnect SD-WAN Orchestrator (high 7.4)
- [CVE-2023-37425](https://insights.sbomify.com/CVE-2023-37425/): Cross-site scripting in EdgeConnect SD-WAN Orchestrator (high 8.0)
- [CVE-2023-37424](https://insights.sbomify.com/CVE-2023-37424/): Unauthenticated Remote Code Execution in EdgeConnect SD-WAN Orchestrator Web-Based Management Interface (high 8.1)
- [CVE-2023-37423](https://insights.sbomify.com/CVE-2023-37423/): Cross-site scripting in EdgeConnect SD-WAN Orchestrator (high 8.1)
- [CVE-2023-37422](https://insights.sbomify.com/CVE-2023-37422/): Cross-site scripting in EdgeConnect SD-WAN Orchestrator (high 8.1)
- [CVE-2023-37421](https://insights.sbomify.com/CVE-2023-37421/): Cross-site scripting in EdgeConnect SD-WAN Orchestrator (high 8.1)
- [CVE-2023-37420](https://insights.sbomify.com/CVE-2023-37420/): Memory corruption in GTKWave (high 7.8)
- [CVE-2023-3742](https://insights.sbomify.com/CVE-2023-3742/): Security feature bypass in Chrome (medium 6.8)
- [CVE-2023-37419](https://insights.sbomify.com/CVE-2023-37419/): Memory corruption in GTKWave (high 7.8)
- [CVE-2023-37418](https://insights.sbomify.com/CVE-2023-37418/): Memory corruption in GTKWave (high 7.8)
- [CVE-2023-37417](https://insights.sbomify.com/CVE-2023-37417/): Memory corruption in GTKWave (high 7.8)
- [CVE-2023-37416](https://insights.sbomify.com/CVE-2023-37416/): Memory corruption in GTKWave (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/271/