# Vulnerabilities published in 2023


- [CVE-2023-35907](https://insights.sbomify.com/CVE-2023-35907/): IBM Aspera Faspex information disclosure (medium 5.9)
- [CVE-2023-35906](https://insights.sbomify.com/CVE-2023-35906/): IBM Aspera Faspex security bypass (medium 5.3)
- [CVE-2023-35905](https://insights.sbomify.com/CVE-2023-35905/): IBM FileNet Content Manager cross-site scripting (medium 4.6)
- [CVE-2023-35901](https://insights.sbomify.com/CVE-2023-35901/): IBM Robotic Process Automation security bypass (low 2.7)
- [CVE-2023-35900](https://insights.sbomify.com/CVE-2023-35900/): IBM Robotic Process Automation information disclosure (medium 4.3)
- [CVE-2023-3590](https://insights.sbomify.com/CVE-2023-3590/): Deleted attachments in Boards remain accessible (low 3.1)
- [CVE-2023-35899](https://insights.sbomify.com/CVE-2023-35899/): IBM Cloud Pak for Automation CSV injection (high 7.0)
- [CVE-2023-35898](https://insights.sbomify.com/CVE-2023-35898/): IBM InfoSphere Information Server information disclosure (medium 4.3)
- [CVE-2023-35897](https://insights.sbomify.com/CVE-2023-35897/): IBM Spectrum Protect code execution (high 8.4)
- [CVE-2023-35896](https://insights.sbomify.com/CVE-2023-35896/): IBM Content Navigator server-side request forgery (medium 5.4)
- [CVE-2023-35895](https://insights.sbomify.com/CVE-2023-35895/): IBM Informix JDBC code execution (medium 6.3)
- [CVE-2023-35894](https://insights.sbomify.com/CVE-2023-35894/): IBM Control Center HOST header injection (medium 5.4)
- [CVE-2023-35893](https://insights.sbomify.com/CVE-2023-35893/): IBM Security Guardium command execution (critical 9.9)
- [CVE-2023-35892](https://insights.sbomify.com/CVE-2023-35892/): IBM Financial Transaction Manager for SWIFT Services XML external entity injection (high 7.1)
- [CVE-2023-35890](https://insights.sbomify.com/CVE-2023-35890/): IBM WebSphere Application Server information disclosure (medium 5.1)
- [CVE-2023-3589](https://insights.sbomify.com/CVE-2023-3589/): Cross-site request forgery in Teamwork Cloud - Business Edition (medium 6.8)
- [CVE-2023-35888](https://insights.sbomify.com/CVE-2023-35888/): IBM Security Verify Governance information disclosure (medium 5.9)
- [CVE-2023-35887](https://insights.sbomify.com/CVE-2023-35887/): Apache MINA SSHD: Information disclosure bugs with RootedFilesystem (medium 5.0)
- [CVE-2023-35885](https://insights.sbomify.com/CVE-2023-35885/): Auth bypass in mgt-commerce:cloudpanel (critical 9.8)
- [CVE-2023-35884](https://insights.sbomify.com/CVE-2023-35884/): WordPress EventPrime Plugin <= 3.0.5 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-35883](https://insights.sbomify.com/CVE-2023-35883/): WordPress Core Web Vitals & PageSpeed Booster Plugin <= 1.0.12 is vulnerable to Open Redirection (medium 4.7)
- [CVE-2023-35882](https://insights.sbomify.com/CVE-2023-35882/): WordPress Super Socializer Plugin <= 7.13.52 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-35881](https://insights.sbomify.com/CVE-2023-35881/): WordPress WooCommerce One Page Checkout plugin <= 2.3.0 - Local File Inclusion vulnerability (high 7.6)
- [CVE-2023-35880](https://insights.sbomify.com/CVE-2023-35880/): WordPress WooCommerce Brands Plugin <= 1.6.49 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-3588](https://insights.sbomify.com/CVE-2023-3588/): Cross-site scripting in Teamwork Cloud - Business Edition (medium 5.4)
- [CVE-2023-35879](https://insights.sbomify.com/CVE-2023-35879/): WordPress WooCommerce Product Vendors Plugin <= 2.1.78 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-35878](https://insights.sbomify.com/CVE-2023-35878/): WordPress Extra User Details Plugin <= 0.5 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-35877](https://insights.sbomify.com/CVE-2023-35877/): WordPress Extra User Details Plugin <= 0.5 is vulnerable to Cross Site Request Forgery (CSRF) (high 7.1)
- [CVE-2023-35876](https://insights.sbomify.com/CVE-2023-35876/): WordPress WooCommerce Square Plugin <= 3.8.1 is vulnerable to Insecure Direct Object References (IDOR) (high 8.1)
- [CVE-2023-35875](https://insights.sbomify.com/CVE-2023-35875/): Missing authorization in Gutenverse (medium 5.3)
- [CVE-2023-35874](https://insights.sbomify.com/CVE-2023-35874/): Improper authentication vulnerability in SAP NetWeaver AS ABAP and ABAP Platform (medium 6.0)
- [CVE-2023-35873](https://insights.sbomify.com/CVE-2023-35873/): Missing Authentication check in SAP NetWeaver Process Integration (Runtime Workbench) (medium 6.5)
- [CVE-2023-35872](https://insights.sbomify.com/CVE-2023-35872/): Missing Authentication check in SAP NetWeaver Process Integration (Message Display Tool) (medium 6.5)
- [CVE-2023-35871](https://insights.sbomify.com/CVE-2023-35871/): Memory Corruption vulnerability in SAP Web Dispatcher (high 7.7)
- [CVE-2023-35870](https://insights.sbomify.com/CVE-2023-35870/): Improper Access Control in SAP S/4HANA (Manage Journal Entry Template) (medium 6.3)
- [CVE-2023-3587](https://insights.sbomify.com/CVE-2023-3587/): Inconsistent state in UI after boards permission change by system admin (low 2.7)
- [CVE-2023-35867](https://insights.sbomify.com/CVE-2023-35867/): Denial of service in BIS Video Engine (medium 5.9)
- [CVE-2023-35866](https://insights.sbomify.com/CVE-2023-35866/): Security feature bypass in keepassxc:keepassxc (medium 5.5)
- [CVE-2023-35863](https://insights.sbomify.com/CVE-2023-35863/): Race condition in madefornet:http debugger (medium 5.3)
- [CVE-2023-35862](https://insights.sbomify.com/CVE-2023-35862/): Memory corruption in libcoap:libcoap (medium 6.5)
- [CVE-2023-35861](https://insights.sbomify.com/CVE-2023-35861/): Command injection in supermicro:h12dgo-6 firmware (critical 9.8)
- [CVE-2023-35860](https://insights.sbomify.com/CVE-2023-35860/): Path traversal in moderncampus:omni cms (medium 5.3)
- [CVE-2023-3586](https://insights.sbomify.com/CVE-2023-3586/): Disabling publicly-shared boards does not disable existing publicly available board links (medium 4.2)
- [CVE-2023-35859](https://insights.sbomify.com/CVE-2023-35859/): Cross-site scripting in moderncampus:omni cms (medium 6.1)
- [CVE-2023-35858](https://insights.sbomify.com/CVE-2023-35858/): Code injection in moderncampus:omni cms (medium 5.3)
- [CVE-2023-35857](https://insights.sbomify.com/CVE-2023-35857/): Auth bypass in siren:investigate (critical 9.8)
- [CVE-2023-35856](https://insights.sbomify.com/CVE-2023-35856/): Memory corruption in nintendo:mario kart wii (critical 9.8)
- [CVE-2023-35855](https://insights.sbomify.com/CVE-2023-35855/): Memory corruption in valvesoftware:counter-strike (critical 9.8)
- [CVE-2023-35854](https://insights.sbomify.com/CVE-2023-35854/): Auth bypass in zohocorp:manageengine adselfservice plus (critical 9.8)
- [CVE-2023-35853](https://insights.sbomify.com/CVE-2023-35853/): Code injection in oisf:suricata (critical 9.8)
- [CVE-2023-35852](https://insights.sbomify.com/CVE-2023-35852/): Path traversal in oisf:suricata (high 7.5)
- [CVE-2023-35851](https://insights.sbomify.com/CVE-2023-35851/): SUNNET WMPro - SQL Injection (high 7.5)
- [CVE-2023-35850](https://insights.sbomify.com/CVE-2023-35850/): SUNNET WMPro - Command Injection (high 7.2)
- [CVE-2023-3585](https://insights.sbomify.com/CVE-2023-3585/): channel DoS by sharing a boards link (medium 4.3)
- [CVE-2023-35849](https://insights.sbomify.com/CVE-2023-35849/): Memory corruption in virtualsquare:picotcp (high 7.5)
- [CVE-2023-35848](https://insights.sbomify.com/CVE-2023-35848/): Memory corruption in virtualsquare:picotcp (high 7.5)
- [CVE-2023-35847](https://insights.sbomify.com/CVE-2023-35847/): Other in virtualsquare:picotcp (high 7.5)
- [CVE-2023-35846](https://insights.sbomify.com/CVE-2023-35846/): Memory corruption in virtualsquare:picotcp (high 7.5)
- [CVE-2023-35845](https://insights.sbomify.com/CVE-2023-35845/): Misconfiguration in anaconda:anaconda3 (medium 4.7)
- [CVE-2023-35844](https://insights.sbomify.com/CVE-2023-35844/): Path traversal in lightdash:lightdash (high 7.5)
- [CVE-2023-35843](https://insights.sbomify.com/CVE-2023-35843/): Path traversal in nocodb:nocodb (high 7.5)
- [CVE-2023-35841](https://insights.sbomify.com/CVE-2023-35841/): WinFlash Driver Permissions Issue (high 7.8)
- [CVE-2023-35840](https://insights.sbomify.com/CVE-2023-35840/): elFinder vulnerable to path traversal in LocalVolumeDriver connector (medium 6.5)
- [CVE-2023-3584](https://insights.sbomify.com/CVE-2023-3584/): Member can create team with team override scheme (low 3.1)
- [CVE-2023-35839](https://insights.sbomify.com/CVE-2023-35839/): Solon vulnerable to deserialization of untrusted data (critical 9.8)
- [CVE-2023-35838](https://insights.sbomify.com/CVE-2023-35838/): Security feature bypass in wireguard:wireguard (medium 5.7)
- [CVE-2023-35837](https://insights.sbomify.com/CVE-2023-35837/): Hardcoded credentials in solax:pocket wifi 3 firmware (critical 9.8)
- [CVE-2023-35836](https://insights.sbomify.com/CVE-2023-35836/): Information disclosure in solax:pocket wifi 3 firmware (medium 6.5)
- [CVE-2023-35835](https://insights.sbomify.com/CVE-2023-35835/): Misconfiguration in solax:pocket wifi 3 firmware (critical 9.8)
- [CVE-2023-35833](https://insights.sbomify.com/CVE-2023-35833/): Information disclosure in ysoft:safeq server (medium 6.5)
- [CVE-2023-35830](https://insights.sbomify.com/CVE-2023-35830/): Auth bypass in stw-mobile-machines:tcg-4 firmware (critical 9.8)
- [CVE-2023-35829](https://insights.sbomify.com/CVE-2023-35829/): Use after free in linux:linux kernel (high 7.0)
- [CVE-2023-35828](https://insights.sbomify.com/CVE-2023-35828/): Use after free in linux:linux kernel (high 7.0)
- [CVE-2023-35827](https://insights.sbomify.com/CVE-2023-35827/): Use after free in linux:linux kernel (high 7.0)
- [CVE-2023-35826](https://insights.sbomify.com/CVE-2023-35826/): Use after free in linux:linux kernel (high 7.0)
- [CVE-2023-35824](https://insights.sbomify.com/CVE-2023-35824/): Use after free in debian:debian linux (high 7.0)
- [CVE-2023-35823](https://insights.sbomify.com/CVE-2023-35823/): Use after free in debian:debian linux (high 7.0)
- [CVE-2023-3582](https://insights.sbomify.com/CVE-2023-3582/): Lack of channel membership check when linking a board to a channel (medium 4.3)
- [CVE-2023-35818](https://insights.sbomify.com/CVE-2023-35818/): Security feature bypass in espressif:esp-eye firmware (medium 6.8)
- [CVE-2023-35817](https://insights.sbomify.com/CVE-2023-35817/): Server-side request forgery in DevExpress (medium 5.0)
- [CVE-2023-35816](https://insights.sbomify.com/CVE-2023-35816/): Deserialization in DevExpress (low 3.5)
- [CVE-2023-35815](https://insights.sbomify.com/CVE-2023-35815/): Deserialization in DevExpress (low 3.5)
- [CVE-2023-35814](https://insights.sbomify.com/CVE-2023-35814/): Deserialization in DevExpress (low 3.5)
- [CVE-2023-35813](https://insights.sbomify.com/CVE-2023-35813/): Code injection in sitecore:experience commerce (critical 9.8)
- [CVE-2023-35812](https://insights.sbomify.com/CVE-2023-35812/): An issue was discovered in the Amazon Linux packages of OpenSSH 7.4 for Amazon Linux 1 and 2, because of an incomplete fix for CVE-2019-6111 (medium 5.3)
- [CVE-2023-35811](https://insights.sbomify.com/CVE-2023-35811/): SQL injection in sugarcrm:sugarcrm (high 8.8)
- [CVE-2023-35810](https://insights.sbomify.com/CVE-2023-35810/): Deserialization in sugarcrm:sugarcrm (high 7.2)
- [CVE-2023-3581](https://insights.sbomify.com/CVE-2023-3581/): WebSockets accept connections from HTTPS origin (medium 6.2)
- [CVE-2023-35809](https://insights.sbomify.com/CVE-2023-35809/): Code injection in sugarcrm:sugarcrm (high 8.8)
- [CVE-2023-35808](https://insights.sbomify.com/CVE-2023-35808/): File upload in sugarcrm:sugarcrm (high 8.8)
- [CVE-2023-35803](https://insights.sbomify.com/CVE-2023-35803/): Memory corruption in extremenetworks:iq engine (critical 9.8)
- [CVE-2023-35802](https://insights.sbomify.com/CVE-2023-35802/): Memory corruption in extremenetworks:iq engine (critical 9.8)
- [CVE-2023-35801](https://insights.sbomify.com/CVE-2023-35801/): Path traversal in safe:fme server (high 8.1)
- [CVE-2023-35800](https://insights.sbomify.com/CVE-2023-35800/): Misconfiguration in stormshield:endpoint security (medium 4.3)
- [CVE-2023-3580](https://insights.sbomify.com/CVE-2023-3580/): Improper Handling of Additional Special Element in squidex/squidex (medium 5.4)
- [CVE-2023-35799](https://insights.sbomify.com/CVE-2023-35799/): Privilege escalation in stormshield:endpoint security (medium 5.5)
- [CVE-2023-35798](https://insights.sbomify.com/CVE-2023-35798/): Airflow Apache ODBC and MSSQL Providers Arbitrary File Read Vulnerability (medium 4.3)
- [CVE-2023-35797](https://insights.sbomify.com/CVE-2023-35797/): Apache Airflow Hive Provider Beeline RCE with Principal (critical 9.8)
- [CVE-2023-35796](https://insights.sbomify.com/CVE-2023-35796/): Cross-site scripting in SINEMA Server V14 (high 8.3)
- [CVE-2023-35794](https://insights.sbomify.com/CVE-2023-35794/): Auth bypass in cassianetworks:access controller (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/284/