# Vulnerabilities published in 2023


- [CVE-2023-22942](https://insights.sbomify.com/CVE-2023-22942/): Cross-Site Request Forgery in the ‘ssg/kvstore_client’ REST Endpoint in Splunk Enterprise (medium 5.4)
- [CVE-2023-22941](https://insights.sbomify.com/CVE-2023-22941/): Improperly Formatted ‘INGEST_EVAL’ Parameter Crashes Splunk Daemon (medium 6.5)
- [CVE-2023-22940](https://insights.sbomify.com/CVE-2023-22940/): SPL Command Safeguards Bypass via the ‘collect’ SPL Command Aliases in Splunk Enterprise (medium 6.3)
- [CVE-2023-2294](https://insights.sbomify.com/CVE-2023-2294/): UCMS Column Configuration saddpost.php cross site scripting (low 3.5)
- [CVE-2023-22939](https://insights.sbomify.com/CVE-2023-22939/): SPL Command Safeguards Bypass via the ‘map’ SPL Command in Splunk Enterprise (high 8.1)
- [CVE-2023-22938](https://insights.sbomify.com/CVE-2023-22938/): Permissions Validation Failure in the ‘sendemail’ REST API Endpoint in Splunk Enterprise (medium 4.3)
- [CVE-2023-22937](https://insights.sbomify.com/CVE-2023-22937/): Unnecessary File Extensions Allowed by Lookup Table Uploads in Splunk Enterprise (medium 4.3)
- [CVE-2023-22936](https://insights.sbomify.com/CVE-2023-22936/): Authenticated Blind Server Side Request Forgery via the ‘search_listener’ Search Parameter in Splunk Enterprise (medium 6.3)
- [CVE-2023-22935](https://insights.sbomify.com/CVE-2023-22935/): SPL Command Safeguards Bypass via the ‘display.page.search.patterns.sensitivity’ Search Parameter in Splunk Enterprise (high 8.1)
- [CVE-2023-22934](https://insights.sbomify.com/CVE-2023-22934/): SPL Command Safeguards Bypass via the ‘pivot’ SPL Command in Splunk Enterprise (high 7.3)
- [CVE-2023-22933](https://insights.sbomify.com/CVE-2023-22933/): Persistent Cross-Site Scripting through the ‘module’ Tag in a View in Splunk Enterprise (high 8.0)
- [CVE-2023-22932](https://insights.sbomify.com/CVE-2023-22932/): Persistent Cross-Site Scripting through a Base64-encoded Image in a View in Splunk Enterprise (high 8.0)
- [CVE-2023-22931](https://insights.sbomify.com/CVE-2023-22931/): ‘createrss’ External Search Command Overwrites Existing RSS Feeds in Splunk Enterprise (medium 4.3)
- [CVE-2023-2293](https://insights.sbomify.com/CVE-2023-2293/): SourceCodester Purchase Order Management System cross site scripting (low 2.4)
- [CVE-2023-22924](https://insights.sbomify.com/CVE-2023-22924/): Memory corruption in NBG-418N v2 firmware (medium 4.9)
- [CVE-2023-22923](https://insights.sbomify.com/CVE-2023-22923/): Memory corruption in NBG-418N v2 firmware (medium 6.5)
- [CVE-2023-22922](https://insights.sbomify.com/CVE-2023-22922/): Memory corruption in NBG-418N v2 firmware (high 7.5)
- [CVE-2023-22921](https://insights.sbomify.com/CVE-2023-22921/): Cross-site scripting in NBG-418N v2 firmware (high 7.5)
- [CVE-2023-22920](https://insights.sbomify.com/CVE-2023-22920/): Misconfiguration in LTE3316-M604 (critical 9.8)
- [CVE-2023-22919](https://insights.sbomify.com/CVE-2023-22919/): Command injection in NBG6604 firmware (high 8.8)
- [CVE-2023-22918](https://insights.sbomify.com/CVE-2023-22918/): Information disclosure in ATP series firmware (medium 6.5)
- [CVE-2023-22917](https://insights.sbomify.com/CVE-2023-22917/): Memory corruption in ATP series firmware (high 7.5)
- [CVE-2023-22916](https://insights.sbomify.com/CVE-2023-22916/): Other in ATP series firmware (high 8.1)
- [CVE-2023-22915](https://insights.sbomify.com/CVE-2023-22915/): Memory corruption in USG FLEX 50(W) firmware (high 7.5)
- [CVE-2023-22914](https://insights.sbomify.com/CVE-2023-22914/): Path traversal in USG FLEX series firmware (high 7.2)
- [CVE-2023-22913](https://insights.sbomify.com/CVE-2023-22913/): Command injection in USG FLEX series firmware (high 8.1)
- [CVE-2023-22912](https://insights.sbomify.com/CVE-2023-22912/): Weak cryptography in mediawiki:mediawiki (medium 5.3)
- [CVE-2023-22911](https://insights.sbomify.com/CVE-2023-22911/): Cross-site scripting in fedoraproject:fedora (medium 6.1)
- [CVE-2023-22910](https://insights.sbomify.com/CVE-2023-22910/): Cross-site scripting in mediawiki:mediawiki (medium 5.4)
- [CVE-2023-2291](https://insights.sbomify.com/CVE-2023-2291/): Hardcoded credentials in Zoho ManageEngine Multiple Products (high 7.8)
- [CVE-2023-22909](https://insights.sbomify.com/CVE-2023-22909/): Denial of service in fedoraproject:fedora (medium 5.3)
- [CVE-2023-22906](https://insights.sbomify.com/CVE-2023-22906/): Auth bypass in heroelectronix:qubo hcd01 firmware (high 8.8)
- [CVE-2023-22903](https://insights.sbomify.com/CVE-2023-22903/): Missing authorization in librephotos project:librephotos (critical 9.8)
- [CVE-2023-22902](https://insights.sbomify.com/CVE-2023-22902/): Openfind Mail2000 - XSS (medium 5.4)
- [CVE-2023-22901](https://insights.sbomify.com/CVE-2023-22901/): ChangingTec MOTP - Path Traversal (medium 4.9)
- [CVE-2023-22900](https://insights.sbomify.com/CVE-2023-22900/): Thinking Software Technology Co., Ltd. Efence - SQL Injection (critical 9.8)
- [CVE-2023-2290](https://insights.sbomify.com/CVE-2023-2290/): Memory corruption in ThinkPad (medium 6.4)
- [CVE-2023-22899](https://insights.sbomify.com/CVE-2023-22899/): Zip4j Origin Validation Error (medium 5.9)
- [CVE-2023-22898](https://insights.sbomify.com/CVE-2023-22898/): Denial of service in circl:pandora (medium 6.5)
- [CVE-2023-22897](https://insights.sbomify.com/CVE-2023-22897/): Information disclosure in securepoint:unified threat management (medium 6.5)
- [CVE-2023-22895](https://insights.sbomify.com/CVE-2023-22895/): bzip2 allows attackers to cause a denial of service via a large file that triggers an integer overflow (high 7.5)
- [CVE-2023-22894](https://insights.sbomify.com/CVE-2023-22894/): Strapi Cleartext Storage of Sensitive Information (high 7.2, exploited in the wild)
- [CVE-2023-22893](https://insights.sbomify.com/CVE-2023-22893/): Strapi does not verify the access or ID tokens issued during the OAuth flow (high 8.2)
- [CVE-2023-22892](https://insights.sbomify.com/CVE-2023-22892/): Information disclosure in smartbear:zephyr enterprise (high 7.5)
- [CVE-2023-22891](https://insights.sbomify.com/CVE-2023-22891/): Privilege escalation in smartbear:zephyr enterprise (high 8.1)
- [CVE-2023-22890](https://insights.sbomify.com/CVE-2023-22890/): Denial of service in smartbear:zephyr enterprise (high 7.5)
- [CVE-2023-2289](https://insights.sbomify.com/CVE-2023-2289/): wordpress vertical image slider plugin <= 1.2.16 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-22889](https://insights.sbomify.com/CVE-2023-22889/): Code injection in smartbear:zephyr enterprise (critical 9.8)
- [CVE-2023-22888](https://insights.sbomify.com/CVE-2023-22888/): Apache Airflow: Scheduler remote DoS (medium 6.5)
- [CVE-2023-22887](https://insights.sbomify.com/CVE-2023-22887/): Apache Airflow path traversal by authenticated user (medium 6.5)
- [CVE-2023-22886](https://insights.sbomify.com/CVE-2023-22886/): Apache Airflow JDBC Provider: RCE Vulnerability (high 8.8)
- [CVE-2023-22884](https://insights.sbomify.com/CVE-2023-22884/): Apache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache Airflow (critical 9.8)
- [CVE-2023-22883](https://insights.sbomify.com/CVE-2023-22883/): Local Privilege Escalation in Zoom for Windows Installers (high 7.2)
- [CVE-2023-22882](https://insights.sbomify.com/CVE-2023-22882/): Denial of Service in Zoom Clients (medium 6.5)
- [CVE-2023-22881](https://insights.sbomify.com/CVE-2023-22881/): Denial of Service in Zoom Clients (medium 6.5)
- [CVE-2023-22880](https://insights.sbomify.com/CVE-2023-22880/): Information Disclosure in Zoom for Windows Clients (medium 6.8)
- [CVE-2023-2288](https://insights.sbomify.com/CVE-2023-2288/): Otter - Gutenberg Blocks < 2.2.6 - Author+ PHAR Deserialization (high 8.8)
- [CVE-2023-22878](https://insights.sbomify.com/CVE-2023-22878/): IBM InfoSphere Information Server information disclosure (medium 6.2)
- [CVE-2023-22877](https://insights.sbomify.com/CVE-2023-22877/): IBM InfoSphere Information Server CSV injection (high 7.0)
- [CVE-2023-22876](https://insights.sbomify.com/CVE-2023-22876/): IBM Sterling B2B Integrator information disclosure (medium 4.3)
- [CVE-2023-22875](https://insights.sbomify.com/CVE-2023-22875/): IBM Security QRadar SIEM information disclosure (high 8.4)
- [CVE-2023-22874](https://insights.sbomify.com/CVE-2023-22874/): IBM MQ denial of service (medium 5.5)
- [CVE-2023-22870](https://insights.sbomify.com/CVE-2023-22870/): IBM Aspera Faspex information disclosure (medium 5.9)
- [CVE-2023-2287](https://insights.sbomify.com/CVE-2023-2287/): Orbit Fox < 2.10.24 - Author+ Server-Side Request Forgery (medium 4.3)
- [CVE-2023-22869](https://insights.sbomify.com/CVE-2023-22869/): IBM Aspera Faspex information disclosure (medium 5.5)
- [CVE-2023-22868](https://insights.sbomify.com/CVE-2023-22868/): IBM Aspera Faspex cross-site scripting (medium 5.4)
- [CVE-2023-22863](https://insights.sbomify.com/CVE-2023-22863/): IBM Robotic Process Automation information disclosure (medium 5.9)
- [CVE-2023-22862](https://insights.sbomify.com/CVE-2023-22862/): IBM Aspera information disclosure (medium 5.9)
- [CVE-2023-22860](https://insights.sbomify.com/CVE-2023-22860/): IBM Cloud Pak for Business Automation cross-site scripting (medium 5.4)
- [CVE-2023-2286](https://insights.sbomify.com/CVE-2023-2286/): WP Activity Log <= 4.5.0 - Cross-Site Request Forgery via ajax_run_cleanup (medium 4.3)
- [CVE-2023-22858](https://insights.sbomify.com/CVE-2023-22858/): Stored cross-site scripting in BlogEngine.NET version 3.3.8.0 (medium 5.3)
- [CVE-2023-22857](https://insights.sbomify.com/CVE-2023-22857/): Stored cross-site scripting in BlogEngine.NET version 3.3.8.0 (high 8.5)
- [CVE-2023-22856](https://insights.sbomify.com/CVE-2023-22856/): Stored cross-site scripting in BlogEngine.NET version 3.3.8.0 (high 8.5)
- [CVE-2023-22855](https://insights.sbomify.com/CVE-2023-22855/): Code injection in kardex:kardex control center (critical 9.8)
- [CVE-2023-22854](https://insights.sbomify.com/CVE-2023-22854/): Path traversal in mitel:micontact center business (critical 9.1)
- [CVE-2023-22853](https://insights.sbomify.com/CVE-2023-22853/): Deserialization in tiki:tiki (high 8.8)
- [CVE-2023-22852](https://insights.sbomify.com/CVE-2023-22852/): Cross-site request forgery in tiki:tiki (medium 6.5)
- [CVE-2023-22851](https://insights.sbomify.com/CVE-2023-22851/): Deserialization in tiki:tiki (high 7.2)
- [CVE-2023-22850](https://insights.sbomify.com/CVE-2023-22850/): Deserialization in tiki:tiki (high 8.8)
- [CVE-2023-2285](https://insights.sbomify.com/CVE-2023-2285/): WP Activity Log Premium <= 4.5.0 - Cross-Site Request Forgery via ajax_switch_db (medium 4.3)
- [CVE-2023-22849](https://insights.sbomify.com/CVE-2023-22849/): Apache Sling App CMS: XSS in CMS Reference / UI Components (medium 6.1)
- [CVE-2023-22848](https://insights.sbomify.com/CVE-2023-22848/): Missing authorization in Intel(R) Thunderbolt(TM) DCH drivers for Windows (medium 5.5)
- [CVE-2023-22847](https://insights.sbomify.com/CVE-2023-22847/): Information disclosure in pg ivm (medium 4.3)
- [CVE-2023-22846](https://insights.sbomify.com/CVE-2023-22846/): Datakit CrossCAD/Ware (low 3.3)
- [CVE-2023-22845](https://insights.sbomify.com/CVE-2023-22845/): Memory corruption in OpenImageIO (high 7.5)
- [CVE-2023-22844](https://insights.sbomify.com/CVE-2023-22844/): Auth bypass in MilesightVPN (high 7.3)
- [CVE-2023-22843](https://insights.sbomify.com/CVE-2023-22843/): Stored Cross-Site Scripting (XSS) in Threat Intelligence rules in Guardian/CMC before 22.6.2 (high 7.3)
- [CVE-2023-22842](https://insights.sbomify.com/CVE-2023-22842/): BIG-IP SIP profile vulnerability (high 7.5)
- [CVE-2023-22841](https://insights.sbomify.com/CVE-2023-22841/): Privilege escalation in System Firmware Update Utility (SysFwUpdt) for some Intel(R) Server Boards and Intel(R) Server Systems Based on Intel(R) 621A Chipset (medium 6.7)
- [CVE-2023-22840](https://insights.sbomify.com/CVE-2023-22840/): Denial of service in Intel(R) oneVPL GPU software (low 3.3)
- [CVE-2023-2284](https://insights.sbomify.com/CVE-2023-2284/): WP Activity Log Premium <= 4.5.0 - Missing Authorization via ajax_switch_db (medium 4.3)
- [CVE-2023-22839](https://insights.sbomify.com/CVE-2023-22839/): BIG-IP DNS profile vulnerability (high 7.5)
- [CVE-2023-22838](https://insights.sbomify.com/CVE-2023-22838/): Cross-site scripting in EC-CUBE 4 series (medium 5.4)
- [CVE-2023-22836](https://insights.sbomify.com/CVE-2023-22836/): Missing authorization in com.palantir.skywise:guardian (low 3.5)
- [CVE-2023-22835](https://insights.sbomify.com/CVE-2023-22835/): Denial of Service in Foundry Issues (high 7.7)
- [CVE-2023-22834](https://insights.sbomify.com/CVE-2023-22834/): The contour service was not checking that users had permission to create an analysis for a given dataset (low 2.7)
- [CVE-2023-22833](https://insights.sbomify.com/CVE-2023-22833/): Mandatory control bypass in Lime2 (high 7.6)
- [CVE-2023-22832](https://insights.sbomify.com/CVE-2023-22832/): Apache NiFi: Improper Restriction of XML External Entity References in ExtractCCDAAttributes (high 7.5)
- [CVE-2023-2283](https://insights.sbomify.com/CVE-2023-2283/): Auth bypass in libssh (medium 6.5)
- [CVE-2023-2282](https://insights.sbomify.com/CVE-2023-2282/): Auth bypass in Remote Desktop Manager (low 3.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/385/