# Vulnerabilities published in 2023


- [CVE-2023-27919](https://insights.sbomify.com/CVE-2023-27919/): Auth bypass in NEXT ENGINE Integration Plugin (for EC-CUBE 2.0 series) (medium 5.3)
- [CVE-2023-27918](https://insights.sbomify.com/CVE-2023-27918/): Cross-site scripting in Appointment and Event Booking Calendar for WordPress - Amelia (medium 6.1)
- [CVE-2023-27917](https://insights.sbomify.com/CVE-2023-27917/): Command injection in CONPROSYS IoT Gateway products (high 8.8)
- [CVE-2023-27916](https://insights.sbomify.com/CVE-2023-27916/): Memory corruption in Cscape (high 7.8)
- [CVE-2023-27915](https://insights.sbomify.com/CVE-2023-27915/): Memory corruption in Autodesk AutoCAD (high 7.8)
- [CVE-2023-27914](https://insights.sbomify.com/CVE-2023-27914/): Memory corruption in Autodesk AutoCAD (high 7.8)
- [CVE-2023-27913](https://insights.sbomify.com/CVE-2023-27913/): Integer overflow in Autodesk AutoCAD (high 7.8)
- [CVE-2023-27912](https://insights.sbomify.com/CVE-2023-27912/): Memory corruption in Autodesk AutoCAD (high 7.8)
- [CVE-2023-27911](https://insights.sbomify.com/CVE-2023-27911/): Memory corruption in Autodesk FBX SDK (high 7.8)
- [CVE-2023-27910](https://insights.sbomify.com/CVE-2023-27910/): Memory corruption in Autodesk FBX SDK (high 7.8)
- [CVE-2023-2791](https://insights.sbomify.com/CVE-2023-2791/): Playbooks lets you edit arbitrary posts (medium 4.3)
- [CVE-2023-27909](https://insights.sbomify.com/CVE-2023-27909/): Memory corruption in Autodesk FBX SDK (high 7.8)
- [CVE-2023-27908](https://insights.sbomify.com/CVE-2023-27908/): Memory corruption in Autodesk installer (high 7.8)
- [CVE-2023-27907](https://insights.sbomify.com/CVE-2023-27907/): Memory corruption in Autodesk Maya USD Plugin (high 7.8)
- [CVE-2023-27906](https://insights.sbomify.com/CVE-2023-27906/): Memory corruption in Autodesk Maya USD Plugin (high 7.8)
- [CVE-2023-27905](https://insights.sbomify.com/CVE-2023-27905/): Cross site scripting vulnerability in update-center2 (critical 9.6)
- [CVE-2023-27904](https://insights.sbomify.com/CVE-2023-27904/): Information disclosure through error stack traces related to agents (medium 5.3)
- [CVE-2023-27903](https://insights.sbomify.com/CVE-2023-27903/): Incorrect Authorization in Jenkins Core (medium 4.4)
- [CVE-2023-27902](https://insights.sbomify.com/CVE-2023-27902/): Incorrect Permission Preservation in Jenkins Core (medium 4.3)
- [CVE-2023-27901](https://insights.sbomify.com/CVE-2023-27901/): Denial of service in Jenkins Core (high 7.5)
- [CVE-2023-27900](https://insights.sbomify.com/CVE-2023-27900/): Denial of service in Jenkins Core (high 7.5)
- [CVE-2023-2790](https://insights.sbomify.com/CVE-2023-2790/): TOTOLINK N200RE Telnet Service custom.conf password in configuration file (low 2.3)
- [CVE-2023-27899](https://insights.sbomify.com/CVE-2023-27899/): Incorrect Authorization in Jenkins Core (high 7.0)
- [CVE-2023-27898](https://insights.sbomify.com/CVE-2023-27898/): Cross-site Scripting vulnerability in Jenkins (critical 9.6)
- [CVE-2023-27897](https://insights.sbomify.com/CVE-2023-27897/): Code Injection vulnerability in SAP CRM (medium 6.0)
- [CVE-2023-27896](https://insights.sbomify.com/CVE-2023-27896/): Server Side Request Forgery (SSRF) in the SAP BusinessObjects Business Intelligence platform (medium 6.5)
- [CVE-2023-27895](https://insights.sbomify.com/CVE-2023-27895/): Information Disclosure vulnerability in SAP Authenticator for Android (medium 6.1)
- [CVE-2023-27894](https://insights.sbomify.com/CVE-2023-27894/): Sensitive Information Disclosure in the SAP BusinessObjects Business Intelligence platform (medium 5.0)
- [CVE-2023-27893](https://insights.sbomify.com/CVE-2023-27893/): Arbitrary Code Execution in SAP Solution Manager and ABAP managed systems (ST-PI) (high 8.8)
- [CVE-2023-27892](https://insights.sbomify.com/CVE-2023-27892/): Memory corruption in shapeshift:keepkey firmware (low 3.8)
- [CVE-2023-27891](https://insights.sbomify.com/CVE-2023-27891/): Insufficient Session Expiration in pretix (high 7.5)
- [CVE-2023-27890](https://insights.sbomify.com/CVE-2023-27890/): Cross-site scripting in export user project:export user (medium 5.4)
- [CVE-2023-2789](https://insights.sbomify.com/CVE-2023-2789/): GNU cflow parser.c parse_variable_declaration denial of service (low 3.5)
- [CVE-2023-27889](https://insights.sbomify.com/CVE-2023-27889/): Cross-site request forgery in LIQUID SPEECH BALLOON (high 8.8)
- [CVE-2023-27888](https://insights.sbomify.com/CVE-2023-27888/): Cross-site scripting in Joruri Gw (medium 5.4)
- [CVE-2023-27887](https://insights.sbomify.com/CVE-2023-27887/): Information disclosure in Intel(R) NUCs (medium 6.1)
- [CVE-2023-27886](https://insights.sbomify.com/CVE-2023-27886/): CVE-2023-27886 (critical 9.8)
- [CVE-2023-27882](https://insights.sbomify.com/CVE-2023-27882/): Memory corruption in Cesium NET (critical 9.0)
- [CVE-2023-27881](https://insights.sbomify.com/CVE-2023-27881/): PTC Vuforia Studio Unrestricted Upload of File with Dangerous Type (high 8.0)
- [CVE-2023-2788](https://insights.sbomify.com/CVE-2023-2788/): Deactivated user can retain access using oauth2 api (medium 6.2)
- [CVE-2023-27879](https://insights.sbomify.com/CVE-2023-27879/): Missing authorization in Intel(R) Optane(TM) SSD products (medium 6.8)
- [CVE-2023-27877](https://insights.sbomify.com/CVE-2023-27877/): IBM Planning Analytics Cartridge for Cloud Pak for Data information disclosure (medium 5.3)
- [CVE-2023-27876](https://insights.sbomify.com/CVE-2023-27876/): IBM TRIRIGA Application Platform XML external entity injection (high 7.1)
- [CVE-2023-27875](https://insights.sbomify.com/CVE-2023-27875/): IBM Aspera Faspex improper access controls (high 7.5)
- [CVE-2023-27874](https://insights.sbomify.com/CVE-2023-27874/): IBM Aspera Faspex XML external entity injection (critical 9.9)
- [CVE-2023-27873](https://insights.sbomify.com/CVE-2023-27873/): IBM Aspera Faspex information disclosure (medium 6.5)
- [CVE-2023-27871](https://insights.sbomify.com/CVE-2023-27871/): IBM Aspera Faspex information disclosure (high 7.5)
- [CVE-2023-27870](https://insights.sbomify.com/CVE-2023-27870/): IBM Spectrum Virtualize information disclosure (medium 5.9)
- [CVE-2023-2787](https://insights.sbomify.com/CVE-2023-2787/): Collapsed Reply Threads APIs leak message contents from private channels (medium 6.5)
- [CVE-2023-27869](https://insights.sbomify.com/CVE-2023-27869/): IBM Db2 code execution (medium 6.3)
- [CVE-2023-27868](https://insights.sbomify.com/CVE-2023-27868/): IBM Db2 code execution (medium 6.3)
- [CVE-2023-27867](https://insights.sbomify.com/CVE-2023-27867/): IBM Db2 code execution (medium 6.3)
- [CVE-2023-27866](https://insights.sbomify.com/CVE-2023-27866/): IBM Informix JDBC code execution (medium 6.3)
- [CVE-2023-27864](https://insights.sbomify.com/CVE-2023-27864/): IBM Maximo Asset Management HTML injection (medium 5.4)
- [CVE-2023-27863](https://insights.sbomify.com/CVE-2023-27863/): IBM Spectrum Protect Plus Server information disclosure (medium 4.4)
- [CVE-2023-27861](https://insights.sbomify.com/CVE-2023-27861/): IBM Maximo Application Suite information disclosure (medium 5.9)
- [CVE-2023-27860](https://insights.sbomify.com/CVE-2023-27860/): IBM Maximo Asset Management information disclosure (medium 5.3)
- [CVE-2023-2786](https://insights.sbomify.com/CVE-2023-2786/): Channel commands execution doesn't properly verify permissions (medium 4.3)
- [CVE-2023-27859](https://insights.sbomify.com/CVE-2023-27859/): IBM Db2 code execution (medium 6.5)
- [CVE-2023-27858](https://insights.sbomify.com/CVE-2023-27858/): Rockwell Automation Arena® Simulation Uninitialized Pointer Vulnerability (high 7.8)
- [CVE-2023-27857](https://insights.sbomify.com/CVE-2023-27857/): Rockwell Automation ThinManager ThinServer Heap-Based Buffer Overflow (high 7.5)
- [CVE-2023-27856](https://insights.sbomify.com/CVE-2023-27856/): Rockwell Automation ThinManager ThinServer Path Traversal Download (high 7.5)
- [CVE-2023-27855](https://insights.sbomify.com/CVE-2023-27855/): Rockwell Automation ThinManager ThinServer Path Traversal Upload (critical 9.8)
- [CVE-2023-27854](https://insights.sbomify.com/CVE-2023-27854/): Rockwell Automation Arena® Simulation Out of Bounds Read Vulnerability (high 7.8)
- [CVE-2023-27853](https://insights.sbomify.com/CVE-2023-27853/): Memory corruption in NETGEAR Nighthawk WiFi6 Router (critical 9.8)
- [CVE-2023-27852](https://insights.sbomify.com/CVE-2023-27852/): Memory corruption in NETGEAR Nighthawk WiFi6 Router (critical 9.8)
- [CVE-2023-27851](https://insights.sbomify.com/CVE-2023-27851/): File upload in NETGEAR Nighthawk WiFi6 Router (high 8.8)
- [CVE-2023-27850](https://insights.sbomify.com/CVE-2023-27850/): Path traversal in NETGEAR Nighthawk WiFi6 Router (medium 6.8)
- [CVE-2023-2785](https://insights.sbomify.com/CVE-2023-2785/): Specially crafted search query can cause large log entries in postgres (medium 4.3)
- [CVE-2023-27849](https://insights.sbomify.com/CVE-2023-27849/): Command injection in rails-routes-to-json project:rails-routes-to-json (critical 9.8)
- [CVE-2023-27848](https://insights.sbomify.com/CVE-2023-27848/): Remote code execution in broccoli-compass (critical 9.8)
- [CVE-2023-27847](https://insights.sbomify.com/CVE-2023-27847/): SQL injection in xipblog project:xipblog (critical 9.8)
- [CVE-2023-27846](https://insights.sbomify.com/CVE-2023-27846/): SQL injection in themevolty:theme volty cms blog (critical 9.8)
- [CVE-2023-27845](https://insights.sbomify.com/CVE-2023-27845/): SQL injection in kerawen:omnichannel stocks (critical 9.8)
- [CVE-2023-27844](https://insights.sbomify.com/CVE-2023-27844/): SQL injection in litextension:leurlrewrite (critical 9.8)
- [CVE-2023-27843](https://insights.sbomify.com/CVE-2023-27843/): SQL injection in ask for a quote project:ask for a quote (critical 9.8)
- [CVE-2023-27842](https://insights.sbomify.com/CVE-2023-27842/): Misconfiguration in extplorer:extplorer (high 8.8)
- [CVE-2023-2784](https://insights.sbomify.com/CVE-2023-2784/): Apps Framework allows install requests from regular members via an internal path (medium 4.2)
- [CVE-2023-27837](https://insights.sbomify.com/CVE-2023-27837/): Command injection in tp-link:tl-wpa8630p firmware (critical 9.8)
- [CVE-2023-27836](https://insights.sbomify.com/CVE-2023-27836/): Command injection in tp-link:tl-wpa8630p firmware (critical 9.8)
- [CVE-2023-27830](https://insights.sbomify.com/CVE-2023-27830/): Privilege escalation in tightvnc:tightvnc (critical 9.0)
- [CVE-2023-2783](https://insights.sbomify.com/CVE-2023-2783/): App Framework does not checks for the secret provided in the incoming webhook request (medium 4.3)
- [CVE-2023-27826](https://insights.sbomify.com/CVE-2023-27826/): Command injection in seowonintech:swc-5100w firmware (high 8.8)
- [CVE-2023-27823](https://insights.sbomify.com/CVE-2023-27823/): Auth bypass in optoma:1080pstx (critical 9.8)
- [CVE-2023-27821](https://insights.sbomify.com/CVE-2023-27821/): Code injection in databasir:databasir (critical 9.8)
- [CVE-2023-2782](https://insights.sbomify.com/CVE-2023-2782/): Missing authorization in Acronis Cyber Infrastructure (medium 5.5)
- [CVE-2023-27812](https://insights.sbomify.com/CVE-2023-27812/): Path traversal in bloofox:bloofoxcms (critical 9.1)
- [CVE-2023-27810](https://insights.sbomify.com/CVE-2023-27810/): Memory corruption in h3c:magic r100 firmware (medium 4.9)
- [CVE-2023-2781](https://insights.sbomify.com/CVE-2023-2781/): User Email Verification for WooCommerce <= 3.5.0 - Authentication Bypass (high 8.1)
- [CVE-2023-27808](https://insights.sbomify.com/CVE-2023-27808/): Memory corruption in h3c:magic r100 firmware (medium 4.9)
- [CVE-2023-27807](https://insights.sbomify.com/CVE-2023-27807/): Memory corruption in h3c:magic r100 firmware (medium 4.9)
- [CVE-2023-27806](https://insights.sbomify.com/CVE-2023-27806/): Memory corruption in h3c:magic r100 firmware (medium 4.9)
- [CVE-2023-27805](https://insights.sbomify.com/CVE-2023-27805/): Memory corruption in h3c:magic r100 firmware (medium 4.9)
- [CVE-2023-27804](https://insights.sbomify.com/CVE-2023-27804/): Memory corruption in h3c:magic r100 firmware (medium 4.9)
- [CVE-2023-27803](https://insights.sbomify.com/CVE-2023-27803/): Memory corruption in h3c:magic r100 firmware (medium 4.9)
- [CVE-2023-27802](https://insights.sbomify.com/CVE-2023-27802/): Memory corruption in h3c:magic r100 firmware (medium 4.9)
- [CVE-2023-27801](https://insights.sbomify.com/CVE-2023-27801/): Memory corruption in h3c:magic r100 firmware (medium 4.9)
- [CVE-2023-2780](https://insights.sbomify.com/CVE-2023-2780/): Path Traversal: '\..\filename' in mlflow/mlflow (critical 9.8)
- [CVE-2023-27796](https://insights.sbomify.com/CVE-2023-27796/): Command injection in ruijienetworks:rg-ew1200g pro firmware (high 8.8)
- [CVE-2023-27795](https://insights.sbomify.com/CVE-2023-27795/): Weak cryptography in ixpdata:easyinstall (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/346/