# Vulnerabilities published in 2023


- [CVE-2023-2521](https://insights.sbomify.com/CVE-2023-2521/): NEXTU NEXT-7004N POST Request formFilter cross site scripting (low 3.5)
- [CVE-2023-25207](https://insights.sbomify.com/CVE-2023-25207/): SQL injection in prestashop:dpd france (critical 9.8)
- [CVE-2023-25206](https://insights.sbomify.com/CVE-2023-25206/): SQL injection in prestashop:advanced reviews (high 8.8)
- [CVE-2023-25201](https://insights.sbomify.com/CVE-2023-25201/): Cross-site request forgery in multitech:conduit ap mtcap2-l4e1-868-042a firmware (high 8.8)
- [CVE-2023-25200](https://insights.sbomify.com/CVE-2023-25200/): An HTML injection vulnerability exists in the MT Safeline X-Ray X3310 webserver version NXG 19.05 that enables a remote attacker to render m (medium 4.7)
- [CVE-2023-2520](https://insights.sbomify.com/CVE-2023-2520/): Caton Prime Ping command injection (high 8.8)
- [CVE-2023-25199](https://insights.sbomify.com/CVE-2023-25199/): A reflected cross-site scripting (XSS) vulnerability exists in the MT Safeline X-Ray X3310 webserver version NXG 19.05 that enables a remote (medium 5.4)
- [CVE-2023-25197](https://insights.sbomify.com/CVE-2023-25197/): apache fineract: SQL injection vulnerability in certain procedure calls (medium 6.3)
- [CVE-2023-25196](https://insights.sbomify.com/CVE-2023-25196/): Apache Fineract: SQL injection vulnerability (medium 4.3)
- [CVE-2023-25195](https://insights.sbomify.com/CVE-2023-25195/): Apache Fineract: SSRF template type vulnerability in certain authenticated users (high 8.1)
- [CVE-2023-25194](https://insights.sbomify.com/CVE-2023-25194/): Apache Kafka Connect vulnerable to Deserialization of Untrusted Data (high 8.8)
- [CVE-2023-25193](https://insights.sbomify.com/CVE-2023-25193/): Denial of service in fedoraproject:fedora (high 7.5)
- [CVE-2023-25192](https://insights.sbomify.com/CVE-2023-25192/): Information disclosure in ami:megarac sp-x (medium 5.3)
- [CVE-2023-25191](https://insights.sbomify.com/CVE-2023-25191/): Information disclosure in ami:megarac sp-x (high 7.5)
- [CVE-2023-2519](https://insights.sbomify.com/CVE-2023-2519/): Caton CTP Relay Server API login sql injection (high 7.3)
- [CVE-2023-25189](https://insights.sbomify.com/CVE-2023-25189/): BTS is affected by information disclosure vulnerability where mobile network operator personnel connected over BTS Web Element Manager, rega (low 3.3)
- [CVE-2023-25188](https://insights.sbomify.com/CVE-2023-25188/): Auth bypass in nokia:asika airscale firmware (medium 5.1)
- [CVE-2023-25187](https://insights.sbomify.com/CVE-2023-25187/): Hardcoded credentials in nokia:asika airscale firmware (medium 6.3)
- [CVE-2023-25186](https://insights.sbomify.com/CVE-2023-25186/): Path traversal in nokia:asika airscale firmware (medium 5.1)
- [CVE-2023-25185](https://insights.sbomify.com/CVE-2023-25185/): Privilege escalation in nokia:asika airscale firmware (low 3.8)
- [CVE-2023-25184](https://insights.sbomify.com/CVE-2023-25184/): Weak cryptography in SkyBridge MB-A200, SkyBridge BASIC MB-A130, and SkySpider MB-R210 (medium 5.3)
- [CVE-2023-25183](https://insights.sbomify.com/CVE-2023-25183/): Code injection in OvrC Cloud (high 8.3)
- [CVE-2023-25182](https://insights.sbomify.com/CVE-2023-25182/): Privilege escalation in Intel(R) Unite(R) Client software for Mac (medium 4.2)
- [CVE-2023-25181](https://insights.sbomify.com/CVE-2023-25181/): Memory corruption in Cesium NET (critical 9.0)
- [CVE-2023-2518](https://insights.sbomify.com/CVE-2023-2518/): Easy Forms for Mailchimp < 6.8.9 - Reflected XSS (medium 6.1)
- [CVE-2023-25179](https://insights.sbomify.com/CVE-2023-25179/): Denial of service in Intel(R) Unite(R) android application (medium 5.0)
- [CVE-2023-25178](https://insights.sbomify.com/CVE-2023-25178/): Controller design flaw - unsigned firmware (critical 9.8)
- [CVE-2023-25177](https://insights.sbomify.com/CVE-2023-25177/): Delta Electronics CNCSoft-B DOPSoft Stack-based buffer overflow (high 7.8)
- [CVE-2023-25176](https://insights.sbomify.com/CVE-2023-25176/): Pasteboard has an out-of-bounds read vulnerability (low 2.9)
- [CVE-2023-25175](https://insights.sbomify.com/CVE-2023-25175/): Information disclosure in Intel(R) Server Board BMC firmware (medium 6.1)
- [CVE-2023-25174](https://insights.sbomify.com/CVE-2023-25174/): Privilege escalation in Intel(R) Chipset Driver Software (medium 6.7)
- [CVE-2023-25173](https://insights.sbomify.com/CVE-2023-25173/): containerd supplementary groups are not set up properly (medium 5.3)
- [CVE-2023-25172](https://insights.sbomify.com/CVE-2023-25172/): Discourse vulnerable to Cross-site Scripting - user name displayed on post (medium 4.4)
- [CVE-2023-25171](https://insights.sbomify.com/CVE-2023-25171/): Kiwi TCMS has denial of service vulnerability on Password reset page (high 7.5)
- [CVE-2023-25170](https://insights.sbomify.com/CVE-2023-25170/): PrestaShop has possible CSRF token fixation (medium 5.0)
- [CVE-2023-2517](https://insights.sbomify.com/CVE-2023-2517/): Metform Elementor Contact Form Builder <= 3.3.2 - Cross-Site Request Forgery via permalink_setup (medium 5.4)
- [CVE-2023-25169](https://insights.sbomify.com/CVE-2023-25169/): Yearly Review Plugin leaking anonymised users data in discourse-yearly-review (low 3.1)
- [CVE-2023-25168](https://insights.sbomify.com/CVE-2023-25168/): Symbolic Link (Symlink) Following allowing the deletion of files and directories on the host system in wings (critical 9.6)
- [CVE-2023-25167](https://insights.sbomify.com/CVE-2023-25167/): Regular expression denial of service via installing themes via git in discourse (medium 6.5)
- [CVE-2023-25166](https://insights.sbomify.com/CVE-2023-25166/): Regular Expression Denial of Service (ReDoS) Vulnerability (medium 5.5)
- [CVE-2023-25165](https://insights.sbomify.com/CVE-2023-25165/): getHostByName Function Information Disclosure (medium 4.3)
- [CVE-2023-25164](https://insights.sbomify.com/CVE-2023-25164/): Sensitive Information leak via Script File in TinaCMS (high 8.6)
- [CVE-2023-25163](https://insights.sbomify.com/CVE-2023-25163/): Argo CD leaks repository credentials in user-facing error messages and in logs (medium 6.3)
- [CVE-2023-25162](https://insights.sbomify.com/CVE-2023-25162/): Nextcloud Server vulnerable to SSRF via filter bypass due to lax checking on IPs (medium 5.3)
- [CVE-2023-25161](https://insights.sbomify.com/CVE-2023-25161/): Nextcloud Server's missing rate limiting on password reset functionality allows sending lots of emails (low 3.7)
- [CVE-2023-25160](https://insights.sbomify.com/CVE-2023-25160/): IDOR Vulnerability in Nextcloud Mail (medium 4.1)
- [CVE-2023-2516](https://insights.sbomify.com/CVE-2023-2516/): Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass (medium 5.4)
- [CVE-2023-25159](https://insights.sbomify.com/CVE-2023-25159/): Nextcloud Server previews are accessible without a watermark (low 2.3)
- [CVE-2023-25158](https://insights.sbomify.com/CVE-2023-25158/): Unfiltered SQL Injection in Geotools (critical 9.8)
- [CVE-2023-25157](https://insights.sbomify.com/CVE-2023-25157/): Unfiltered SQL Injection Vulnerabilities in Geoserver (critical 9.8)
- [CVE-2023-25156](https://insights.sbomify.com/CVE-2023-25156/): Kiwi TCMS has no protection against brute-force attacks on login page (high 7.5)
- [CVE-2023-25155](https://insights.sbomify.com/CVE-2023-25155/): Integer Overflow in several Redis commands can lead to denial of service. (medium 5.5)
- [CVE-2023-25154](https://insights.sbomify.com/CVE-2023-25154/): Cross site scripting (XSS) of ActivityPub URI in misskey (high 7.1)
- [CVE-2023-25153](https://insights.sbomify.com/CVE-2023-25153/): containerd OCI image importer memory exhaustion (medium 6.2)
- [CVE-2023-25152](https://insights.sbomify.com/CVE-2023-25152/): Symbolic Link (Symlink) Following in github.com/pterodactyl/wings (high 8.4)
- [CVE-2023-25151](https://insights.sbomify.com/CVE-2023-25151/): DoS vulnerability for high cardinality metrics in opentelemetry-go-contrib (high 7.5)
- [CVE-2023-25150](https://insights.sbomify.com/CVE-2023-25150/): Document content of files can be obtained through Collabora for files of other users (medium 5.8)
- [CVE-2023-2515](https://insights.sbomify.com/CVE-2023-2515/): Privilege escalation to system admin via personal access tokens (medium 4.7)
- [CVE-2023-25149](https://insights.sbomify.com/CVE-2023-25149/): TimescaleDB has incorrect access control (high 8.8)
- [CVE-2023-25148](https://insights.sbomify.com/CVE-2023-25148/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2023-25147](https://insights.sbomify.com/CVE-2023-25147/): Security feature bypass in Trend Micro Apex One (medium 6.7)
- [CVE-2023-25146](https://insights.sbomify.com/CVE-2023-25146/): Path traversal in Trend Micro Apex One (high 7.8)
- [CVE-2023-25145](https://insights.sbomify.com/CVE-2023-25145/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2023-25144](https://insights.sbomify.com/CVE-2023-25144/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2023-25143](https://insights.sbomify.com/CVE-2023-25143/): Other in Trend Micro Apex One (critical 9.8)
- [CVE-2023-25141](https://insights.sbomify.com/CVE-2023-25141/): JNDI injection into Apache sling-org-apache-sling-jcr-base (high 7.5)
- [CVE-2023-25140](https://insights.sbomify.com/CVE-2023-25140/): Memory corruption in Parasolid V34.0 (high 7.8)
- [CVE-2023-2514](https://insights.sbomify.com/CVE-2023-2514/): DB username/password revealed in application logs (medium 6.7)
- [CVE-2023-25139](https://insights.sbomify.com/CVE-2023-25139/): Memory corruption in gnu:glibc (critical 9.8)
- [CVE-2023-25136](https://insights.sbomify.com/CVE-2023-25136/): Memory corruption in fedoraproject:fedora (medium 6.5)
- [CVE-2023-25135](https://insights.sbomify.com/CVE-2023-25135/): Deserialization in vbulletin:vbulletin (critical 9.8)
- [CVE-2023-25134](https://insights.sbomify.com/CVE-2023-25134/): Other in mcafee:total protection (medium 6.7)
- [CVE-2023-25133](https://insights.sbomify.com/CVE-2023-25133/): Improper privilege management vulnerability in CyberPower PowerPanel Business (critical 9.1)
- [CVE-2023-25132](https://insights.sbomify.com/CVE-2023-25132/): Unrestricted upload of file with dangerous type vulnerability in CyberPower PowerPanel Business (critical 9.1)
- [CVE-2023-25131](https://insights.sbomify.com/CVE-2023-25131/): Use of default password vulnerability in CyberPower PowerPanel Business (critical 9.4)
- [CVE-2023-2513](https://insights.sbomify.com/CVE-2023-2513/): Use after free in Linux kernel ext4 filesystem (medium 6.7)
- [CVE-2023-25124](https://insights.sbomify.com/CVE-2023-25124/): Memory corruption in UR32L (high 7.2)
- [CVE-2023-25123](https://insights.sbomify.com/CVE-2023-25123/): Memory corruption in UR32L (high 7.2)
- [CVE-2023-25122](https://insights.sbomify.com/CVE-2023-25122/): Memory corruption in UR32L (high 7.2)
- [CVE-2023-25121](https://insights.sbomify.com/CVE-2023-25121/): Memory corruption in UR32L (high 7.2)
- [CVE-2023-25120](https://insights.sbomify.com/CVE-2023-25120/): Memory corruption in UR32L (high 7.2)
- [CVE-2023-2512](https://insights.sbomify.com/CVE-2023-2512/): Buffer under-read in workerd (medium 6.5)
- [CVE-2023-25119](https://insights.sbomify.com/CVE-2023-25119/): Memory corruption in UR32L (high 7.2)
- [CVE-2023-25118](https://insights.sbomify.com/CVE-2023-25118/): Memory corruption in UR32L (high 7.2)
- [CVE-2023-25117](https://insights.sbomify.com/CVE-2023-25117/): Memory corruption in UR32L (high 7.2)
- [CVE-2023-25116](https://insights.sbomify.com/CVE-2023-25116/): Memory corruption in UR32L (high 7.2)
- [CVE-2023-25115](https://insights.sbomify.com/CVE-2023-25115/): Memory corruption in UR32L (high 7.2)
- [CVE-2023-25114](https://insights.sbomify.com/CVE-2023-25114/): Memory corruption in UR32L (high 7.2)
- [CVE-2023-25113](https://insights.sbomify.com/CVE-2023-25113/): Memory corruption in UR32L (high 7.2)
- [CVE-2023-25112](https://insights.sbomify.com/CVE-2023-25112/): Memory corruption in UR32L (high 7.2)
- [CVE-2023-25111](https://insights.sbomify.com/CVE-2023-25111/): Memory corruption in UR32L (high 7.2)
- [CVE-2023-25110](https://insights.sbomify.com/CVE-2023-25110/): Memory corruption in UR32L (high 7.2)
- [CVE-2023-25109](https://insights.sbomify.com/CVE-2023-25109/): Memory corruption in UR32L (high 7.2)
- [CVE-2023-25108](https://insights.sbomify.com/CVE-2023-25108/): Memory corruption in UR32L (high 7.2)
- [CVE-2023-25107](https://insights.sbomify.com/CVE-2023-25107/): Memory corruption in UR32L (high 7.2)
- [CVE-2023-25106](https://insights.sbomify.com/CVE-2023-25106/): Memory corruption in UR32L (high 7.2)
- [CVE-2023-25105](https://insights.sbomify.com/CVE-2023-25105/): Memory corruption in UR32L (high 7.2)
- [CVE-2023-25104](https://insights.sbomify.com/CVE-2023-25104/): Memory corruption in UR32L (high 7.2)
- [CVE-2023-25103](https://insights.sbomify.com/CVE-2023-25103/): Memory corruption in UR32L (high 7.2)
- [CVE-2023-25102](https://insights.sbomify.com/CVE-2023-25102/): Memory corruption in UR32L (high 7.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/367/