# Vulnerabilities published in 2023 - [CVE-2023-28112](https://insights.sbomify.com/CVE-2023-28112/): Discourse's SSRF protection missing for some FastImage requests (medium 5.9) - [CVE-2023-28111](https://insights.sbomify.com/CVE-2023-28111/): Discourse vulnerable to SSRF protection bypass possible with IPv4-mapped IPv6 addresses (medium 5.7) - [CVE-2023-28110](https://insights.sbomify.com/CVE-2023-28110/): JumpServer Koko vulnerable to Command Injection for Kubernetes Connection (medium 5.7) - [CVE-2023-2811](https://insights.sbomify.com/CVE-2023-2811/): AI ChatBot < 4.5.6 - Admin+ Stored Cross-Site Scripting (medium 4.8) - [CVE-2023-28109](https://insights.sbomify.com/CVE-2023-28109/): Play With Docker vulnerable to Authorization Bypass Through User-Controlled Key (medium 6.5) - [CVE-2023-28108](https://insights.sbomify.com/CVE-2023-28108/): Pimcore has improper quoting of columns when calling methods "getByUuid" & "exists" on UUID Model (high 7.9) - [CVE-2023-28107](https://insights.sbomify.com/CVE-2023-28107/): Discourse vulnerable to multisite DoS by spamming backups (medium 4.5) - [CVE-2023-28106](https://insights.sbomify.com/CVE-2023-28106/): Pimcore vulnerable to Cross-site Scripting in UrlSlug Data type (medium 6.1) - [CVE-2023-28105](https://insights.sbomify.com/CVE-2023-28105/): Go-huge-util vulnerable to path traversal when unzipping files (high 8.8) - [CVE-2023-28104](https://insights.sbomify.com/CVE-2023-28104/): silverstripe/graphql Denial of Service vulnerability (high 7.5) - [CVE-2023-28103](https://insights.sbomify.com/CVE-2023-28103/): Prototype pollution in matrix-react-sdk (high 8.2) - [CVE-2023-28102](https://insights.sbomify.com/CVE-2023-28102/): Command injection in discordrb (high 8.4) - [CVE-2023-28101](https://insights.sbomify.com/CVE-2023-28101/): Flatpak metadata with ANSI control codes can cause misleading terminal output (medium 5.0) - [CVE-2023-28100](https://insights.sbomify.com/CVE-2023-28100/): TIOCLINUX can send commands outside sandbox if running on a virtual console (critical 10.0) - [CVE-2023-28099](https://insights.sbomify.com/CVE-2023-28099/): OpenSIPS has vulnerability in the ds_is_in_list() function (medium 5.9) - [CVE-2023-28098](https://insights.sbomify.com/CVE-2023-28098/): OpenSIPS has vulnerability in the Digest Authentication Parser (medium 5.9) - [CVE-2023-28097](https://insights.sbomify.com/CVE-2023-28097/): OpenSIPS has vulnerability in the Content-Length Parser (high 7.5) - [CVE-2023-28096](https://insights.sbomify.com/CVE-2023-28096/): OpenSIPS has memory leak in cJSON lib (medium 4.5) - [CVE-2023-28095](https://insights.sbomify.com/CVE-2023-28095/): OpenSIPS has vulnerability in the building the local negative replies (high 7.5) - [CVE-2023-28094](https://insights.sbomify.com/CVE-2023-28094/): Hardcoded credentials in Pega Platform (high 8.1) - [CVE-2023-28093](https://insights.sbomify.com/CVE-2023-28093/): Security feature bypass in RPA: Synchronization Engine (high 7.5) - [CVE-2023-28092](https://insights.sbomify.com/CVE-2023-28092/): Other in HPE ProLiant RL300 Gen11 (medium 6.1) - [CVE-2023-28091](https://insights.sbomify.com/CVE-2023-28091/): Information disclosure in HPE OneView (medium 5.5) - [CVE-2023-28090](https://insights.sbomify.com/CVE-2023-28090/): Information disclosure in HPE OneView (medium 5.5) - [CVE-2023-2809](https://insights.sbomify.com/CVE-2023-2809/): Use of Cleartext credentials in Sage 200 Spain (high 7.8) - [CVE-2023-28089](https://insights.sbomify.com/CVE-2023-28089/): Information disclosure in HPE OneView (high 7.1) - [CVE-2023-28088](https://insights.sbomify.com/CVE-2023-28088/): Information disclosure in HPE OneView (high 7.8) - [CVE-2023-28087](https://insights.sbomify.com/CVE-2023-28087/): Information disclosure in HPE OneView (medium 5.5) - [CVE-2023-28086](https://insights.sbomify.com/CVE-2023-28086/): Information disclosure in HPE OneView (medium 5.5) - [CVE-2023-28085](https://insights.sbomify.com/CVE-2023-28085/): Information disclosure in HPE OneView Global Dashboard (medium 5.5) - [CVE-2023-28084](https://insights.sbomify.com/CVE-2023-28084/): HPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokens (medium 5.5) - [CVE-2023-28083](https://insights.sbomify.com/CVE-2023-28083/): Cross-site scripting in Integrated Lights-Out (high 8.3) - [CVE-2023-28081](https://insights.sbomify.com/CVE-2023-28081/): Use after free in Hermes (critical 9.8) - [CVE-2023-28080](https://insights.sbomify.com/CVE-2023-28080/): Privilege escalation in PowerPath Windows (medium 6.7) - [CVE-2023-2808](https://insights.sbomify.com/CVE-2023-2808/): Lack of URL normalization allows rendering previews for disallowed domains (medium 4.3) - [CVE-2023-28079](https://insights.sbomify.com/CVE-2023-28079/): Misconfiguration in PowerPath Windows (high 7.0) - [CVE-2023-28078](https://insights.sbomify.com/CVE-2023-28078/): Information disclosure in Dell SmartFabric OS10 (critical 9.1) - [CVE-2023-28077](https://insights.sbomify.com/CVE-2023-28077/): Information disclosure in Dell BSAFE SSL-J (medium 4.4) - [CVE-2023-28076](https://insights.sbomify.com/CVE-2023-28076/): Weak cryptography in CloudLink (medium 5.9) - [CVE-2023-28075](https://insights.sbomify.com/CVE-2023-28075/): Race condition in CPG BIOS (medium 6.9) - [CVE-2023-28074](https://insights.sbomify.com/CVE-2023-28074/): Memory corruption in Dell BSAFE Crypto-C Micro Edition (medium 6.2) - [CVE-2023-28073](https://insights.sbomify.com/CVE-2023-28073/): Auth bypass in CPG BIOS (high 8.2) - [CVE-2023-28072](https://insights.sbomify.com/CVE-2023-28072/): Deserialization in Alienware Command Center (AWCC) (high 7.8) - [CVE-2023-28071](https://insights.sbomify.com/CVE-2023-28071/): Other in Dell Command Update (DCU) (medium 6.3) - [CVE-2023-28070](https://insights.sbomify.com/CVE-2023-28070/): Privilege escalation in Alienware Command Center (AWCC) (medium 6.7) - [CVE-2023-2807](https://insights.sbomify.com/CVE-2023-2807/): Authentication bypass in password reset process (medium 6.4) - [CVE-2023-28069](https://insights.sbomify.com/CVE-2023-28069/): Open redirect in Streaming Data Platform (medium 6.1) - [CVE-2023-28068](https://insights.sbomify.com/CVE-2023-28068/): Privilege escalation in Dell Command Monitor (DCM) (high 7.3) - [CVE-2023-28066](https://insights.sbomify.com/CVE-2023-28066/): Privilege escalation in Dell OS Recovery Tool (high 7.3) - [CVE-2023-28065](https://insights.sbomify.com/CVE-2023-28065/): Privilege escalation in Dell Command Update (DCU) (medium 6.7) - [CVE-2023-28064](https://insights.sbomify.com/CVE-2023-28064/): Memory corruption in CPG BIOS (low 3.5) - [CVE-2023-28063](https://insights.sbomify.com/CVE-2023-28063/): Integer overflow in CPG BIOS (medium 6.7) - [CVE-2023-28062](https://insights.sbomify.com/CVE-2023-28062/): Missing authorization in PPDM Reporting (PowerProtect Data Manager) (high 8.8) - [CVE-2023-28061](https://insights.sbomify.com/CVE-2023-28061/): Other in CPG BIOS (medium 5.1) - [CVE-2023-28060](https://insights.sbomify.com/CVE-2023-28060/): Other in CPG BIOS (medium 5.1) - [CVE-2023-2806](https://insights.sbomify.com/CVE-2023-2806/): Weaver e-cology API RequestInfoByXml xml external entity reference (medium 5.5) - [CVE-2023-28059](https://insights.sbomify.com/CVE-2023-28059/): Other in CPG BIOS (medium 5.1) - [CVE-2023-28058](https://insights.sbomify.com/CVE-2023-28058/): Other in CPG BIOS (medium 5.1) - [CVE-2023-28056](https://insights.sbomify.com/CVE-2023-28056/): Other in CPG BIOS (medium 5.1) - [CVE-2023-28055](https://insights.sbomify.com/CVE-2023-28055/): Missing authorization in NetWorker (high 8.8) - [CVE-2023-28054](https://insights.sbomify.com/CVE-2023-28054/): Other in CPG BIOS (medium 5.1) - [CVE-2023-28053](https://insights.sbomify.com/CVE-2023-28053/): Weak cryptography in NetWorker Virtual Edition (medium 5.3) - [CVE-2023-28052](https://insights.sbomify.com/CVE-2023-28052/): Other in CPG BIOS (medium 5.1) - [CVE-2023-28051](https://insights.sbomify.com/CVE-2023-28051/): Privilege escalation in Dell Power Manager (DPM) (high 7.8) - [CVE-2023-28050](https://insights.sbomify.com/CVE-2023-28050/): Other in CPG BIOS (medium 5.1) - [CVE-2023-2805](https://insights.sbomify.com/CVE-2023-2805/): SupportCandy < 3.1.7 - Admin+ SQLi (high 7.2) - [CVE-2023-28049](https://insights.sbomify.com/CVE-2023-28049/): Privilege escalation in Dell Command Monitor (DCM) (medium 4.7) - [CVE-2023-28047](https://insights.sbomify.com/CVE-2023-28047/): Privilege escalation in Dell Display Manager (high 7.3) - [CVE-2023-28046](https://insights.sbomify.com/CVE-2023-28046/): Privilege escalation in Dell Display Manager (medium 6.6) - [CVE-2023-28045](https://insights.sbomify.com/CVE-2023-28045/): Information disclosure in CloudIQ Collector (medium 6.3) - [CVE-2023-28044](https://insights.sbomify.com/CVE-2023-28044/): Other in CPG BIOS (medium 5.1) - [CVE-2023-28043](https://insights.sbomify.com/CVE-2023-28043/): Weak cryptography in Secure Connect Gateway (medium 6.5) - [CVE-2023-28042](https://insights.sbomify.com/CVE-2023-28042/): Other in CPG BIOS (medium 5.1) - [CVE-2023-28041](https://insights.sbomify.com/CVE-2023-28041/): Other in CPG BIOS (medium 5.1) - [CVE-2023-28040](https://insights.sbomify.com/CVE-2023-28040/): Other in CPG BIOS (medium 5.1) - [CVE-2023-2804](https://insights.sbomify.com/CVE-2023-2804/): Memory corruption in libjpeg-turbo (medium 6.5) - [CVE-2023-28039](https://insights.sbomify.com/CVE-2023-28039/): Other in CPG BIOS (medium 5.1) - [CVE-2023-28036](https://insights.sbomify.com/CVE-2023-28036/): Other in CPG BIOS (medium 5.1) - [CVE-2023-28035](https://insights.sbomify.com/CVE-2023-28035/): Other in CPG BIOS (medium 5.1) - [CVE-2023-28034](https://insights.sbomify.com/CVE-2023-28034/): Other in CPG BIOS (medium 5.1) - [CVE-2023-28033](https://insights.sbomify.com/CVE-2023-28033/): Other in CPG BIOS (medium 5.1) - [CVE-2023-28032](https://insights.sbomify.com/CVE-2023-28032/): Other in CPG BIOS (medium 5.1) - [CVE-2023-28031](https://insights.sbomify.com/CVE-2023-28031/): Other in CPG BIOS (medium 5.1) - [CVE-2023-28030](https://insights.sbomify.com/CVE-2023-28030/): Other in CPG BIOS (medium 5.1) - [CVE-2023-2803](https://insights.sbomify.com/CVE-2023-2803/): Ultimate Addons for Contact Form 7 < 3.1.29 - Reflected XSS (medium 6.1) - [CVE-2023-28029](https://insights.sbomify.com/CVE-2023-28029/): Other in CPG BIOS (medium 5.1) - [CVE-2023-28028](https://insights.sbomify.com/CVE-2023-28028/): Other in CPG BIOS (medium 5.1) - [CVE-2023-28027](https://insights.sbomify.com/CVE-2023-28027/): Other in CPG BIOS (medium 5.1) - [CVE-2023-28026](https://insights.sbomify.com/CVE-2023-28026/): Other in CPG BIOS (medium 5.1) - [CVE-2023-28025](https://insights.sbomify.com/CVE-2023-28025/): An HTML injection vulnerability can affect HCL BigFix Mobile / Modern Client Management (medium 6.6) - [CVE-2023-28023](https://insights.sbomify.com/CVE-2023-28023/): HCL BigFix WebUI Software Distribution is affected by a cross site server request forgery vulnerability (medium 4.9) - [CVE-2023-28022](https://insights.sbomify.com/CVE-2023-28022/): HCL Connections is vulnerable to sensitive information disclosure (low 3.5) - [CVE-2023-28021](https://insights.sbomify.com/CVE-2023-28021/): BigFix WebUI is vulnerable to use of a risky cryptographic algorithm (medium 5.9) - [CVE-2023-28020](https://insights.sbomify.com/CVE-2023-28020/): URL redirection affects BigFix WebUI (medium 4.7) - [CVE-2023-2802](https://insights.sbomify.com/CVE-2023-2802/): Ultimate Addons for Contact Form 7 < 3.1.29 - Admin+ Stored XSS (medium 4.8) - [CVE-2023-28019](https://insights.sbomify.com/CVE-2023-28019/): An SQL injection affects BigFix WebUI API (medium 5.5) - [CVE-2023-28018](https://insights.sbomify.com/CVE-2023-28018/): HCL Connections s vulnerable to possible denial of service for certain users (medium 5.5) - [CVE-2023-28017](https://insights.sbomify.com/CVE-2023-28017/): HCL Connections is vulnerable to cross-site scripting (medium 5.4) - [CVE-2023-28016](https://insights.sbomify.com/CVE-2023-28016/): HCL BigFix OSD Bare Metal Server is affected by a host header injection vulnerability (low 3.1) - [CVE-2023-28015](https://insights.sbomify.com/CVE-2023-28015/): HCL Domino AppDev Pack is susceptible to a User Account Enumeration vulnerability (medium 5.3) --- From sbomify Insights: https://insights.sbomify.com/years/2023/page/344/