# Vulnerabilities published in 2023 - [CVE-2023-25648](https://insights.sbomify.com/CVE-2023-25648/): Weak Folder Permission Vulnerability in ZTE ZXCLOUD iRAI (medium 6.5) - [CVE-2023-25647](https://insights.sbomify.com/CVE-2023-25647/): Permission and Access Control Vulnerability in Some ZTE Mobile Phones (medium 4.7) - [CVE-2023-25646](https://insights.sbomify.com/CVE-2023-25646/): Permission and Access Control Vulnerability in ZTE H388X (high 7.1) - [CVE-2023-25645](https://insights.sbomify.com/CVE-2023-25645/): Missing authorization in UP T2 4K, ZXV10 B866V2-H, ZXV10 B866V2, ZXV10 B860H V5D0, ZXV10 B866V2F (high 7.7) - [CVE-2023-25644](https://insights.sbomify.com/CVE-2023-25644/): Denial of Service Vulnerability in Some ZTE Mobile Internet Products (medium 6.5) - [CVE-2023-25643](https://insights.sbomify.com/CVE-2023-25643/): Two Vulnerabilities in Some ZTE Mobile Internet Products (high 8.4) - [CVE-2023-25642](https://insights.sbomify.com/CVE-2023-25642/): Two Vulnerabilities in Some ZTE Mobile Internet Products (medium 5.9) - [CVE-2023-2564](https://insights.sbomify.com/CVE-2023-2564/): OS Command Injection in sbs20/scanservjs (critical 10.0) - [CVE-2023-25632](https://insights.sbomify.com/CVE-2023-25632/): Security feature bypass in NAVER Whale browser (medium 5.5) - [CVE-2023-2563](https://insights.sbomify.com/CVE-2023-2563/): WordPress Contact Forms by Cimatti <= 1.5.7 - Cross-Site Request Forgery via _accua_forms_form_edit_action (medium 4.3) - [CVE-2023-25621](https://insights.sbomify.com/CVE-2023-25621/): Apache Sling does not allow to handle i18n content in a secure way (medium 6.5) - [CVE-2023-25620](https://insights.sbomify.com/CVE-2023-25620/): Denial of service in Legacy Modicon Premium CPUs (TSXP57*) (medium 6.5) - [CVE-2023-2562](https://insights.sbomify.com/CVE-2023-2562/): Gallery Metabox <= 1.5 - Missing Authorization via refresh_metabox (medium 4.3) - [CVE-2023-25619](https://insights.sbomify.com/CVE-2023-25619/): Denial of service in Legacy Modicon Premium CPUs (TSXP57*) (high 7.5) - [CVE-2023-25618](https://insights.sbomify.com/CVE-2023-25618/): Denial of Service (DoS) vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform (medium 6.5) - [CVE-2023-25617](https://insights.sbomify.com/CVE-2023-25617/): OS Command Execution vulnerability in SAP Business Objects Business Intelligence Platform (Adaptive Job Server) (critical 9.0) - [CVE-2023-25616](https://insights.sbomify.com/CVE-2023-25616/): Code Injection vulnerability in SAP Business Objects Business Intelligence Platform (CMC) (critical 9.9) - [CVE-2023-25615](https://insights.sbomify.com/CVE-2023-25615/): SQL Injection vulnerability in SAP ABAP Platform (medium 6.8) - [CVE-2023-25614](https://insights.sbomify.com/CVE-2023-25614/): Cross-site scripting in NetWeaver AS ABAP (BSP Framework) (medium 6.1) - [CVE-2023-25613](https://insights.sbomify.com/CVE-2023-25613/): LDAP Injection Vulnerability in Apache Kerby (critical 9.8) - [CVE-2023-25611](https://insights.sbomify.com/CVE-2023-25611/): Code injection in FortiAnalyzer (medium 4.0) - [CVE-2023-25610](https://insights.sbomify.com/CVE-2023-25610/): Memory corruption in FortiAnalyzer (critical 9.3) - [CVE-2023-2561](https://insights.sbomify.com/CVE-2023-2561/): Gallery Metabox <= 1.5 - Missing Authorization via gallery_remove (medium 4.3) - [CVE-2023-25609](https://insights.sbomify.com/CVE-2023-25609/): Server-side request forgery in FortiAnalyzer (medium 4.2) - [CVE-2023-25608](https://insights.sbomify.com/CVE-2023-25608/): Path traversal in FortiAP (medium 5.2) - [CVE-2023-25607](https://insights.sbomify.com/CVE-2023-25607/): Command injection in FortiADC (high 7.4) - [CVE-2023-25606](https://insights.sbomify.com/CVE-2023-25606/): Path traversal in FortiAnalyzer (medium 6.2) - [CVE-2023-25605](https://insights.sbomify.com/CVE-2023-25605/): Missing authorization in FortiSOAR (high 7.5) - [CVE-2023-25604](https://insights.sbomify.com/CVE-2023-25604/): Information disclosure in FortiGuest (medium 5.5) - [CVE-2023-25603](https://insights.sbomify.com/CVE-2023-25603/): Misconfiguration in FortiADC (medium 5.4) - [CVE-2023-25602](https://insights.sbomify.com/CVE-2023-25602/): Memory corruption in FortiWeb (high 7.4) - [CVE-2023-25601](https://insights.sbomify.com/CVE-2023-25601/): Apache DolphinScheduler 3.0.0 to 3.1.1 python gateway has improper authentication (medium 4.3) - [CVE-2023-25600](https://insights.sbomify.com/CVE-2023-25600/): Memory corruption in insyde:insydecrpkg (high 7.1) - [CVE-2023-2560](https://insights.sbomify.com/CVE-2023-2560/): jja8 NewBingGoGo cross site scripting (low 3.5) - [CVE-2023-25599](https://insights.sbomify.com/CVE-2023-25599/): Cross-site scripting in mitel:mivoice connect (high 7.4) - [CVE-2023-25598](https://insights.sbomify.com/CVE-2023-25598/): Cross-site scripting in mitel:mivoice connect (medium 6.1) - [CVE-2023-25597](https://insights.sbomify.com/CVE-2023-25597/): Auth bypass in mitel:micollab (medium 5.9) - [CVE-2023-25596](https://insights.sbomify.com/CVE-2023-25596/): Authenticated Sensitive Information Disclosure in ClearPass Policy Manager (medium 4.5) - [CVE-2023-25595](https://insights.sbomify.com/CVE-2023-25595/): Sensitive Information Disclosure in ClearPass OnGuard Ubuntu Agent (medium 5.5) - [CVE-2023-25594](https://insights.sbomify.com/CVE-2023-25594/): Authorization Bypass Leading to Privilege Escalation in ClearPass Policy Manager Web-Based Management Interface (medium 6.3) - [CVE-2023-25593](https://insights.sbomify.com/CVE-2023-25593/): Reflected Cross Site Scripting Vulnerabilities (XSS) in ClearPass Policy Manager Web-Based Management Interface (high 7.1) - [CVE-2023-25592](https://insights.sbomify.com/CVE-2023-25592/): Reflected Cross Site Scripting Vulnerabilities (XSS) in ClearPass Policy Manager Web-Based Management Interface (high 7.1) - [CVE-2023-25591](https://insights.sbomify.com/CVE-2023-25591/): Authenticated Information Disclosure in ClearPass Policy Manager Web-Based Management Interface (high 7.6) - [CVE-2023-25590](https://insights.sbomify.com/CVE-2023-25590/): Local Privilege Escalation in ClearPass OnGuard Linux Agent (high 7.8) - [CVE-2023-25589](https://insights.sbomify.com/CVE-2023-25589/): Unauthenticated Arbitrary User Creation Leads to Complete System Compromise (critical 9.8) - [CVE-2023-25588](https://insights.sbomify.com/CVE-2023-25588/): Field `the_bfd` of `asymbol` is uninitialized in function `bfd_mach_o_get_synthetic_symtab` (medium 4.7) - [CVE-2023-25586](https://insights.sbomify.com/CVE-2023-25586/): Local variable `ch_type` in function `bfd_init_section_decompress_status` can be uninitialized (medium 4.7) - [CVE-2023-25585](https://insights.sbomify.com/CVE-2023-25585/): Field `file_table` of `struct module *module` is uninitialized (medium 4.7) - [CVE-2023-25584](https://insights.sbomify.com/CVE-2023-25584/): Out of bounds read in parse_module function in bfd/vms-alpha.c (medium 6.3) - [CVE-2023-25583](https://insights.sbomify.com/CVE-2023-25583/): Command injection in UR32L (high 7.2) - [CVE-2023-25582](https://insights.sbomify.com/CVE-2023-25582/): Command injection in UR32L (high 7.2) - [CVE-2023-25581](https://insights.sbomify.com/CVE-2023-25581/): Deserialization of untrusted data in InternalAttributeHandler in pac4j (critical 9.2) - [CVE-2023-2558](https://insights.sbomify.com/CVE-2023-2558/): Cross-site scripting in WPCS – WordPress Currency Switcher Professional (medium 6.4) - [CVE-2023-25579](https://insights.sbomify.com/CVE-2023-25579/): Directory traversal in Nextcloud server (medium 6.0) - [CVE-2023-25578](https://insights.sbomify.com/CVE-2023-25578/): Starlite DoS vulnerability when parsing multipart request body (high 7.5) - [CVE-2023-25577](https://insights.sbomify.com/CVE-2023-25577/): Werkzeug may allow high resource usage when parsing multipart form data with many fields (high 7.5) - [CVE-2023-25576](https://insights.sbomify.com/CVE-2023-25576/): @fastify/multipart vulnerable to DoS due to unlimited number of parts (high 7.5) - [CVE-2023-25575](https://insights.sbomify.com/CVE-2023-25575/): Secured properties in API Platform Core may be accessible within collections (high 7.7) - [CVE-2023-25574](https://insights.sbomify.com/CVE-2023-25574/): JupyterHub's LTI13Authenticator: JWT signature not validated (critical 10.0) - [CVE-2023-25573](https://insights.sbomify.com/CVE-2023-25573/): Improper access control to download file in metersphere (high 8.6) - [CVE-2023-25572](https://insights.sbomify.com/CVE-2023-25572/): React-Admin vulnerable to Cross-Site-Scripting attack on `` (medium 5.4) - [CVE-2023-25571](https://insights.sbomify.com/CVE-2023-25571/): Backstage has XSS Vulnerability in Software Catalog (medium 6.8) - [CVE-2023-25570](https://insights.sbomify.com/CVE-2023-25570/): Apollo has potential access control security issue in eureka (high 7.5) - [CVE-2023-2557](https://insights.sbomify.com/CVE-2023-2557/): Missing authorization in WPCS – WordPress Currency Switcher Professional (medium 4.3) - [CVE-2023-25569](https://insights.sbomify.com/CVE-2023-25569/): apollo-portal has potential CSRF issue (medium 5.7) - [CVE-2023-25568](https://insights.sbomify.com/CVE-2023-25568/): Boxo bitswap/server: DOS unbounded persistent memory leak (high 8.2) - [CVE-2023-25567](https://insights.sbomify.com/CVE-2023-25567/): GSS-NTLMSSP vulnerable to out-of-bounds read when decoding target information (high 7.5) - [CVE-2023-25566](https://insights.sbomify.com/CVE-2023-25566/): GSS-NTLMSSP vulnerable to memory leak when parsing usernames (high 7.5) - [CVE-2023-25565](https://insights.sbomify.com/CVE-2023-25565/): GSS-NTLMSSP vulnerable to incorrect free when decoding target information (high 7.5) - [CVE-2023-25564](https://insights.sbomify.com/CVE-2023-25564/): GSS-NTLMSSP vulnerable to memory corruption when decoding UTF16 strings (medium 6.5) - [CVE-2023-25563](https://insights.sbomify.com/CVE-2023-25563/): GSS-NTLMSSP vulnerable to multiple out-of-bounds reads when decoding NTLM fields (medium 5.9) - [CVE-2023-25562](https://insights.sbomify.com/CVE-2023-25562/): Failure to Invalidate Session on Logout in DataHub (medium 6.9) - [CVE-2023-25561](https://insights.sbomify.com/CVE-2023-25561/): Login fail open on JAAS misconfiguration in DataHub (medium 5.7) - [CVE-2023-25560](https://insights.sbomify.com/CVE-2023-25560/): JSON Injection in DataHub (high 8.2) - [CVE-2023-2556](https://insights.sbomify.com/CVE-2023-2556/): Missing authorization in WPCS – WordPress Currency Switcher Professional (medium 4.3) - [CVE-2023-25559](https://insights.sbomify.com/CVE-2023-25559/): System account impersonation in DataHub (high 8.2) - [CVE-2023-25558](https://insights.sbomify.com/CVE-2023-25558/): Deserialization of untrusted data in DataHub (high 7.5) - [CVE-2023-25557](https://insights.sbomify.com/CVE-2023-25557/): Server-Side Request Forgery in DataHub (high 7.5) - [CVE-2023-25556](https://insights.sbomify.com/CVE-2023-25556/): Auth bypass in Merten INSTABUS Tastermodul 1fach System M 625199 (high 8.3) - [CVE-2023-25555](https://insights.sbomify.com/CVE-2023-25555/): Command injection in StruxureWare Data Center Expert (medium 5.6) - [CVE-2023-25554](https://insights.sbomify.com/CVE-2023-25554/): Command injection in StruxureWare Data Center Expert (high 7.8) - [CVE-2023-25553](https://insights.sbomify.com/CVE-2023-25553/): Cross-site scripting in StruxureWare Data Center Expert (medium 6.1) - [CVE-2023-25552](https://insights.sbomify.com/CVE-2023-25552/): Missing authorization in StruxureWare Data Center Expert (high 8.1) - [CVE-2023-25551](https://insights.sbomify.com/CVE-2023-25551/): Cross-site scripting in StruxureWare Data Center Expert (medium 6.1) - [CVE-2023-25550](https://insights.sbomify.com/CVE-2023-25550/): Code injection in StruxureWare Data Center Expert (high 7.2) - [CVE-2023-2555](https://insights.sbomify.com/CVE-2023-2555/): Missing authorization in WPCS – WordPress Currency Switcher Professional (medium 4.3) - [CVE-2023-25549](https://insights.sbomify.com/CVE-2023-25549/): Code injection in StruxureWare Data Center Expert (high 7.2) - [CVE-2023-25548](https://insights.sbomify.com/CVE-2023-25548/): Missing authorization in StruxureWare Data Center Expert (high 8.8) - [CVE-2023-25547](https://insights.sbomify.com/CVE-2023-25547/): Missing authorization in StruxureWare Data Center Expert (high 8.8) - [CVE-2023-25546](https://insights.sbomify.com/CVE-2023-25546/): Memory corruption in UEFI firmware for some Intel(R) Processors (low 1.8) - [CVE-2023-25545](https://insights.sbomify.com/CVE-2023-25545/): Memory corruption in Intel(R) Server Board BMC firmware (high 8.2) - [CVE-2023-25544](https://insights.sbomify.com/CVE-2023-25544/): Information disclosure in Dell NetWorker, NVE (high 7.5) - [CVE-2023-25543](https://insights.sbomify.com/CVE-2023-25543/): Privilege escalation in Dell Power Manager (DPM) (high 7.8) - [CVE-2023-25542](https://insights.sbomify.com/CVE-2023-25542/): Misconfiguration in Dell Trusted Device Client (high 7.0) - [CVE-2023-25540](https://insights.sbomify.com/CVE-2023-25540/): Misconfiguration in PowerScale OneFS (medium 6.0) - [CVE-2023-2554](https://insights.sbomify.com/CVE-2023-2554/): External Control of File Name or Path in unilogies/bumsys (high 7.2) - [CVE-2023-25539](https://insights.sbomify.com/CVE-2023-25539/): Command injection in NetWorker NVE (high 8.4) - [CVE-2023-25537](https://insights.sbomify.com/CVE-2023-25537/): Memory corruption in PowerEdge Platform (medium 6.1) - [CVE-2023-25536](https://insights.sbomify.com/CVE-2023-25536/): Information disclosure in PowerScale OneFS (medium 6.7) - [CVE-2023-25535](https://insights.sbomify.com/CVE-2023-25535/): Privilege escalation in SupportAssist Client Consumer (high 7.2) --- From sbomify Insights: https://insights.sbomify.com/years/2023/page/364/