# Vulnerabilities published in 2023


- [CVE-2023-2631](https://insights.sbomify.com/CVE-2023-2631/): CSRF vulnerability and missing permission checks in Code Dx Plugin (medium 4.3)
- [CVE-2023-26309](https://insights.sbomify.com/CVE-2023-26309/): A remote code execution vulnerability in the webview component (high 7.4)
- [CVE-2023-26303](https://insights.sbomify.com/CVE-2023-26303/): markdown-it-py crash on null assertions (low 3.3)
- [CVE-2023-26302](https://insights.sbomify.com/CVE-2023-26302/): markdown-it-py CLI crash on invalid UTF-8 characters (low 3.3)
- [CVE-2023-26301](https://insights.sbomify.com/CVE-2023-26301/): Missing authorization in HP LaserJet Pro (critical 9.8)
- [CVE-2023-26300](https://insights.sbomify.com/CVE-2023-26300/): Privilege escalation in HP PC products (high 7.8)
- [CVE-2023-2630](https://insights.sbomify.com/CVE-2023-2630/): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (medium 5.7)
- [CVE-2023-26299](https://insights.sbomify.com/CVE-2023-26299/): Race condition in HP PC products using AMI UEFI Firmware (high 7.0)
- [CVE-2023-26298](https://insights.sbomify.com/CVE-2023-26298/): Command injection in HP Device Manager (high 8.8)
- [CVE-2023-26297](https://insights.sbomify.com/CVE-2023-26297/): Command injection in HP Device Manager (high 8.8)
- [CVE-2023-26296](https://insights.sbomify.com/CVE-2023-26296/): Command injection in HP Device Manager (high 8.8)
- [CVE-2023-26295](https://insights.sbomify.com/CVE-2023-26295/): Command injection in HP Device Manager (critical 9.8)
- [CVE-2023-26294](https://insights.sbomify.com/CVE-2023-26294/): Command injection in HP Device Manager (high 7.8)
- [CVE-2023-26293](https://insights.sbomify.com/CVE-2023-26293/): Path traversal in Totally Integrated Automation Portal (TIA Portal) V15 (high 7.3)
- [CVE-2023-26292](https://insights.sbomify.com/CVE-2023-26292/): Cross-site scripting in Cloud Security Gateway (CSG) (medium 6.1)
- [CVE-2023-26291](https://insights.sbomify.com/CVE-2023-26291/): Cross-site scripting in Cloud Security Gateway (CSG) (medium 6.1)
- [CVE-2023-26290](https://insights.sbomify.com/CVE-2023-26290/): Cross-site scripting in Cloud Security Gateway (CSG) (medium 6.1)
- [CVE-2023-2629](https://insights.sbomify.com/CVE-2023-2629/): Improper Neutralization of Formula Elements in a CSV File in pimcore/customer-data-framework (medium 5.0)
- [CVE-2023-26289](https://insights.sbomify.com/CVE-2023-26289/): IBM Aspera Orchestrator HTTP header injection (medium 5.4)
- [CVE-2023-26288](https://insights.sbomify.com/CVE-2023-26288/): IBM Aspera Orchestrator session fixation (medium 5.5)
- [CVE-2023-26286](https://insights.sbomify.com/CVE-2023-26286/): IBM AIX privilege escalation (high 8.4)
- [CVE-2023-26285](https://insights.sbomify.com/CVE-2023-26285/): IBM MQ denial of service (medium 5.9)
- [CVE-2023-26284](https://insights.sbomify.com/CVE-2023-26284/): IBM MQ Certified Container improper access controls (high 7.5)
- [CVE-2023-26283](https://insights.sbomify.com/CVE-2023-26283/): IBM WebSphere Application Server cross-site scripting (medium 5.4)
- [CVE-2023-26282](https://insights.sbomify.com/CVE-2023-26282/): IBM Watson CP4D Data Stores file modificiation (medium 4.2)
- [CVE-2023-26281](https://insights.sbomify.com/CVE-2023-26281/): IBM HTTP Server denial of service (medium 5.9)
- [CVE-2023-26280](https://insights.sbomify.com/CVE-2023-26280/): IBM Jazz Foundation improper access control (medium 5.3)
- [CVE-2023-2628](https://insights.sbomify.com/CVE-2023-2628/): KiviCare Management System < 3.2.1 - Multiple CSRF (high 8.8)
- [CVE-2023-26279](https://insights.sbomify.com/CVE-2023-26279/): IBM QRadar WinCollect Agent improper output encoding (low 3.3)
- [CVE-2023-26278](https://insights.sbomify.com/CVE-2023-26278/): IBM QRadar WinCollect Agent privilege escalation (high 8.2)
- [CVE-2023-26277](https://insights.sbomify.com/CVE-2023-26277/): IBM QRadar WinCollect Agent privilege escalation (high 7.8)
- [CVE-2023-26276](https://insights.sbomify.com/CVE-2023-26276/): IBM QRadar information disclosure (medium 5.9)
- [CVE-2023-26274](https://insights.sbomify.com/CVE-2023-26274/): IBM QRadar cross-site scripting (medium 4.6)
- [CVE-2023-26273](https://insights.sbomify.com/CVE-2023-26273/): IBM QRadar security bypass (medium 4.3)
- [CVE-2023-26272](https://insights.sbomify.com/CVE-2023-26272/): IBM Security Guardium Data Encryption information disclosure (medium 5.3)
- [CVE-2023-26271](https://insights.sbomify.com/CVE-2023-26271/): IBM Security Guardium Data Encryption information disclosure (medium 5.3)
- [CVE-2023-26270](https://insights.sbomify.com/CVE-2023-26270/): IBM Security Guardium Data Encryption code execution (medium 6.5)
- [CVE-2023-2627](https://insights.sbomify.com/CVE-2023-2627/): KiviCare Management System < 3.2.1 - Subscriber+ Unauthorised AJAX Calls (medium 4.3)
- [CVE-2023-26269](https://insights.sbomify.com/CVE-2023-26269/): Apache James server: Privilege escalation through unauthenticated JMX (high 7.8)
- [CVE-2023-26268](https://insights.sbomify.com/CVE-2023-26268/): Apache CouchDB, IBM Cloudant: Information sharing via couchjs processes (medium 4.4)
- [CVE-2023-26267](https://insights.sbomify.com/CVE-2023-26267/): XML external entity in php-saml-sp project:php-saml-sp (medium 6.5)
- [CVE-2023-26266](https://insights.sbomify.com/CVE-2023-26266/): Code injection in afl\+\+ project:afl\+\+ (high 7.3)
- [CVE-2023-26265](https://insights.sbomify.com/CVE-2023-26265/): Path traversal in borg project:borg (medium 5.3)
- [CVE-2023-26264](https://insights.sbomify.com/CVE-2023-26264/): XML external entity in talend:data catalog (medium 5.5)
- [CVE-2023-26263](https://insights.sbomify.com/CVE-2023-26263/): XML external entity in talend:data catalog (medium 5.5)
- [CVE-2023-26262](https://insights.sbomify.com/CVE-2023-26262/): File upload in sitecore:experience manager (high 7.2)
- [CVE-2023-26261](https://insights.sbomify.com/CVE-2023-26261/): Auth bypass in ubikasec:waap cloud (critical 9.8)
- [CVE-2023-26260](https://insights.sbomify.com/CVE-2023-26260/): Auth bypass in oxidforge:oxid eshop (medium 5.4)
- [CVE-2023-2626](https://insights.sbomify.com/CVE-2023-2626/): Authentication Bypass in OpenThread Boarder Router devices (high 7.5)
- [CVE-2023-26258](https://insights.sbomify.com/CVE-2023-26258/): Auth bypass in arcserve:udp (critical 9.8)
- [CVE-2023-26257](https://insights.sbomify.com/CVE-2023-26257/): Denial of service in covesa:dlt-daemon (high 7.5)
- [CVE-2023-26256](https://insights.sbomify.com/CVE-2023-26256/): Path traversal in stagil:stagil navigation (high 7.5)
- [CVE-2023-26255](https://insights.sbomify.com/CVE-2023-26255/): Path traversal in stagil:stagil navigation (high 7.5)
- [CVE-2023-26253](https://insights.sbomify.com/CVE-2023-26253/): Memory corruption in gluster:glusterfs (high 7.5)
- [CVE-2023-2625](https://insights.sbomify.com/CVE-2023-2625/): Command injection in TXpert Hub CoreTec 4 (critical 9.0)
- [CVE-2023-26249](https://insights.sbomify.com/CVE-2023-26249/): Denial of service in nic:knot resolver (high 7.5)
- [CVE-2023-26248](https://insights.sbomify.com/CVE-2023-26248/): Content Censorship in the InterPlanetary File System (IPFS) via Kademlia DHT abuse (medium 5.3)
- [CVE-2023-26246](https://insights.sbomify.com/CVE-2023-26246/): Security feature bypass in hyundai:gen5w l firmware (high 7.8)
- [CVE-2023-26245](https://insights.sbomify.com/CVE-2023-26245/): Security feature bypass in hyundai:gen5w l firmware (high 7.8)
- [CVE-2023-26244](https://insights.sbomify.com/CVE-2023-26244/): Security feature bypass in hyundai:gen5w l firmware (high 7.8)
- [CVE-2023-26243](https://insights.sbomify.com/CVE-2023-26243/): Information disclosure in hyundai:gen5w l firmware (high 7.8)
- [CVE-2023-26242](https://insights.sbomify.com/CVE-2023-26242/): Integer overflow in linux:linux kernel (high 7.8)
- [CVE-2023-2624](https://insights.sbomify.com/CVE-2023-2624/): KiviCare Management System < 3.2.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-26239](https://insights.sbomify.com/CVE-2023-26239/): Auth bypass in watchguard:edr firmware (medium 5.5)
- [CVE-2023-26238](https://insights.sbomify.com/CVE-2023-26238/): Security feature bypass in watchguard:edr firmware (medium 5.5)
- [CVE-2023-26237](https://insights.sbomify.com/CVE-2023-26237/): Security feature bypass in watchguard:edr firmware (medium 6.7)
- [CVE-2023-26236](https://insights.sbomify.com/CVE-2023-26236/): Privilege escalation in watchguard:edr firmware (high 7.8)
- [CVE-2023-26235](https://insights.sbomify.com/CVE-2023-26235/): Cross-site scripting in jd-gui project:jd-gui (medium 6.1)
- [CVE-2023-26234](https://insights.sbomify.com/CVE-2023-26234/): Deserialization in jd-gui project:jd-gui (medium 6.6)
- [CVE-2023-2623](https://insights.sbomify.com/CVE-2023-2623/): KiviCare Management System < 3.2.1 - Subscriber+ Sensitive Information Disclosure (medium 6.5)
- [CVE-2023-26226](https://insights.sbomify.com/CVE-2023-26226/): A use after free memory corruption issue exists in Yandex Browser for Desktop prior to version 24.4.0.682 (high 7.4)
- [CVE-2023-26222](https://insights.sbomify.com/CVE-2023-26222/): TIBCO EBX Cross-site Scripting (XXS) Vulnerability (high 8.7)
- [CVE-2023-26221](https://insights.sbomify.com/CVE-2023-26221/): TIBCO Spotfire Insufficiently Protected Credential vulnerability (medium 5.0)
- [CVE-2023-26220](https://insights.sbomify.com/CVE-2023-26220/): TIBCO Spotfire Stored Cross-site Scripting (XSS) vulnerability (medium 5.4)
- [CVE-2023-2622](https://insights.sbomify.com/CVE-2023-2622/): Path traversal in MACH System Software (low 2.7)
- [CVE-2023-26219](https://insights.sbomify.com/CVE-2023-26219/): TIBCO Operational Intelligence Hawk RedTail Credential Exposure Vulnerability (high 7.4)
- [CVE-2023-26218](https://insights.sbomify.com/CVE-2023-26218/): TIBCO Nimbus Reflected Cross-site Scripting (XSS) vulnerabilities (high 8.0)
- [CVE-2023-26217](https://insights.sbomify.com/CVE-2023-26217/): TIBCO EBX Add-ons SQL Injection Vulnerability (high 8.8)
- [CVE-2023-26216](https://insights.sbomify.com/CVE-2023-26216/): TIBCO EBX Add-ons Arbitrary File Write (critical 9.1)
- [CVE-2023-26215](https://insights.sbomify.com/CVE-2023-26215/): TIBCO EBX® Add-ons Path Traversal (high 7.7)
- [CVE-2023-26214](https://insights.sbomify.com/CVE-2023-26214/): TIBCO BusinessConnect Reflected XSS Vulnerability (high 7.3)
- [CVE-2023-26213](https://insights.sbomify.com/CVE-2023-26213/): Command injection in barracuda:t100b firmware (high 7.2)
- [CVE-2023-26211](https://insights.sbomify.com/CVE-2023-26211/): Cross-site scripting in FortiSOAR (medium 6.4)
- [CVE-2023-26210](https://insights.sbomify.com/CVE-2023-26210/): Command injection in FortiADC (high 7.8)
- [CVE-2023-2621](https://insights.sbomify.com/CVE-2023-2621/): Path traversal in MACH System Software (medium 6.5)
- [CVE-2023-26209](https://insights.sbomify.com/CVE-2023-26209/): Denial of service in FortiDeceptor (low 3.5)
- [CVE-2023-26208](https://insights.sbomify.com/CVE-2023-26208/): Denial of service in FortiAuthenticator (low 3.5)
- [CVE-2023-26207](https://insights.sbomify.com/CVE-2023-26207/): Information disclosure in FortiOS (low 3.3)
- [CVE-2023-26206](https://insights.sbomify.com/CVE-2023-26206/): Cross-site scripting in FortiNAC (medium 6.8)
- [CVE-2023-26205](https://insights.sbomify.com/CVE-2023-26205/): Privilege escalation in FortiADC (high 7.9)
- [CVE-2023-26204](https://insights.sbomify.com/CVE-2023-26204/): Information disclosure in FortiSIEM (low 3.6)
- [CVE-2023-26203](https://insights.sbomify.com/CVE-2023-26203/): Hardcoded credentials in FortiNAC (medium 6.1)
- [CVE-2023-2620](https://insights.sbomify.com/CVE-2023-2620/): Insertion of Sensitive Information Into Sent Data in GitLab (medium 5.5)
- [CVE-2023-2619](https://insights.sbomify.com/CVE-2023-2619/): SourceCodester Online Tours & Travels Management System disapprove_delete.php exec sql injection (medium 6.3)
- [CVE-2023-2618](https://insights.sbomify.com/CVE-2023-2618/): OpenCV wechat_qrcode Module decoded_bit_stream_parser.cpp decodeHanziSegment memory leak (medium 5.3)
- [CVE-2023-2617](https://insights.sbomify.com/CVE-2023-2617/): OpenCV wechat_qrcode Module decoded_bit_stream_parser.cpp decodeByteSegment null pointer dereference (medium 5.3)
- [CVE-2023-2616](https://insights.sbomify.com/CVE-2023-2616/): Cross-site Scripting (XSS) - Generic in pimcore/pimcore (medium 6.8)
- [CVE-2023-26159](https://insights.sbomify.com/CVE-2023-26159/): Follow Redirects improperly handles URLs in the url.parse() function (high 7.3)
- [CVE-2023-26158](https://insights.sbomify.com/CVE-2023-26158/): mockjs vulnerable to Prototype Pollution via the Util.extend function (high 8.2)
- [CVE-2023-26157](https://insights.sbomify.com/CVE-2023-26157/): Memory corruption in libredwg (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/358/