# Vulnerabilities published in 2023


- [CVE-2023-22819](https://insights.sbomify.com/CVE-2023-22819/): Uncontrolled resource consumption vulnerability in Western Digital My Cloud, My Cloud Home and SanDisk ibi products (medium 4.9)
- [CVE-2023-22818](https://insights.sbomify.com/CVE-2023-22818/): Multiple DLL Search Order hijacking Vulnerabilities in SanDisk Security Installer for Windows (high 7.3)
- [CVE-2023-22817](https://insights.sbomify.com/CVE-2023-22817/): Server-side Request Forgery vulnerability in Western Digital My Cloud, My Cloud Home and SanDisk ibi products (medium 5.5)
- [CVE-2023-22816](https://insights.sbomify.com/CVE-2023-22816/): Limited Post-Authentication Remote Command Injection in My Cloud Products (medium 6.0)
- [CVE-2023-22815](https://insights.sbomify.com/CVE-2023-22815/): Post-authentication remote command injection vulnerability on Western Digital My Cloud OS 5 devices (medium 6.2)
- [CVE-2023-22814](https://insights.sbomify.com/CVE-2023-22814/): Authentication Bypass issue in My Cloud OS 5 devices (critical 10.0)
- [CVE-2023-22813](https://insights.sbomify.com/CVE-2023-22813/): Device API endpoint missing access controls on Western Digital Mobile and Web Apps (low 3.3)
- [CVE-2023-22812](https://insights.sbomify.com/CVE-2023-22812/): SanDisk PrivateAccess Deprecated TLS protocol versions supported (high 7.4)
- [CVE-2023-2281](https://insights.sbomify.com/CVE-2023-2281/): Archiving a team broadcasts unsanitized data over WebSockets (low 3.1)
- [CVE-2023-22809](https://insights.sbomify.com/CVE-2023-22809/): Privilege escalation in apple:macos (high 7.8)
- [CVE-2023-22808](https://insights.sbomify.com/CVE-2023-22808/): Information disclosure in arm:avalon android gralloc module (low 3.3)
- [CVE-2023-22807](https://insights.sbomify.com/CVE-2023-22807/): CVE-2023-22807 (critical 9.8)
- [CVE-2023-22806](https://insights.sbomify.com/CVE-2023-22806/): CVE-2023-22806 (high 7.5)
- [CVE-2023-22805](https://insights.sbomify.com/CVE-2023-22805/): CVE-2023-22805 (medium 6.5)
- [CVE-2023-22804](https://insights.sbomify.com/CVE-2023-22804/): CVE-2023-22804 (critical 9.1)
- [CVE-2023-22803](https://insights.sbomify.com/CVE-2023-22803/): CVE-2023-22803 (high 7.5)
- [CVE-2023-2280](https://insights.sbomify.com/CVE-2023-2280/): Missing authorization in WP Directory Kit (medium 6.5)
- [CVE-2023-22799](https://insights.sbomify.com/CVE-2023-22799/): ReDoS based DoS vulnerability in GlobalID (high 7.5)
- [CVE-2023-22798](https://insights.sbomify.com/CVE-2023-22798/): Open redirect in https://github.com/brave/adblock-lists (medium 6.1)
- [CVE-2023-22797](https://insights.sbomify.com/CVE-2023-22797/): Open Redirect Vulnerability in Action Pack (medium 6.1)
- [CVE-2023-22796](https://insights.sbomify.com/CVE-2023-22796/): ReDoS based DoS vulnerability in Active Support's underscore (high 7.5)
- [CVE-2023-22795](https://insights.sbomify.com/CVE-2023-22795/): ReDoS based DoS vulnerability in Action Dispatch (high 7.5)
- [CVE-2023-22794](https://insights.sbomify.com/CVE-2023-22794/): SQL Injection Vulnerability via ActiveRecord comments (high 8.8)
- [CVE-2023-22793](https://insights.sbomify.com/CVE-2023-22793/): Deserialization in Management Pack for Microsoft System Center (critical 9.3)
- [CVE-2023-22792](https://insights.sbomify.com/CVE-2023-22792/): ReDoS based DoS vulnerability in Action Dispatch (high 7.5)
- [CVE-2023-22791](https://insights.sbomify.com/CVE-2023-22791/): Aruba InstantOS and ArubaOS 10 Sensitive Information Disclosure (medium 5.4)
- [CVE-2023-22790](https://insights.sbomify.com/CVE-2023-22790/): Authenticated Remote Command Execution in Aruba InstantOS or ArubaOS 10 Command Line Interface (high 7.2)
- [CVE-2023-2279](https://insights.sbomify.com/CVE-2023-2279/): Cross-site request forgery in WP Directory Kit (medium 5.4)
- [CVE-2023-22789](https://insights.sbomify.com/CVE-2023-22789/): Authenticated Remote Command Execution in Aruba InstantOS or ArubaOS 10 Command Line Interface (high 7.2)
- [CVE-2023-22788](https://insights.sbomify.com/CVE-2023-22788/): Authenticated Remote Command Execution in Aruba InstantOS or ArubaOS 10 Command Line Interface (high 7.2)
- [CVE-2023-22787](https://insights.sbomify.com/CVE-2023-22787/): Unauthenticated Denial of Service (DoS) in Aruba InstantOS or ArubaOS 10 Service Accessed via the PAPI Protocol (high 7.5)
- [CVE-2023-22786](https://insights.sbomify.com/CVE-2023-22786/): Unauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI Protocol (critical 9.8)
- [CVE-2023-22785](https://insights.sbomify.com/CVE-2023-22785/): Unauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI Protocol (critical 9.8)
- [CVE-2023-22784](https://insights.sbomify.com/CVE-2023-22784/): Unauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI Protocol (critical 9.8)
- [CVE-2023-22783](https://insights.sbomify.com/CVE-2023-22783/): Unauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI Protocol (critical 9.8)
- [CVE-2023-22782](https://insights.sbomify.com/CVE-2023-22782/): Unauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI Protocol (critical 9.8)
- [CVE-2023-22781](https://insights.sbomify.com/CVE-2023-22781/): Unauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI Protocol (critical 9.8)
- [CVE-2023-22780](https://insights.sbomify.com/CVE-2023-22780/): Unauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI Protocol (critical 9.8)
- [CVE-2023-2278](https://insights.sbomify.com/CVE-2023-2278/): WP Directory Kit <= 1.1.9 - Unauthenticated Local File Inclusion via wdk_public_action (critical 9.8)
- [CVE-2023-22779](https://insights.sbomify.com/CVE-2023-22779/): Unauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI Protocol (critical 9.8)
- [CVE-2023-22778](https://insights.sbomify.com/CVE-2023-22778/): Authenticated Stored Cross-Site Scripting (medium 4.8)
- [CVE-2023-22777](https://insights.sbomify.com/CVE-2023-22777/): Authenticated Information Disclosure in ArubaOS Web-based Management Interface (medium 4.9)
- [CVE-2023-22776](https://insights.sbomify.com/CVE-2023-22776/): Authenticated Remote Path Traversal in ArubaOS Command Line Interface Allows for Arbitrary File Read (medium 4.9)
- [CVE-2023-22775](https://insights.sbomify.com/CVE-2023-22775/): Authenticated Sensitive Information Disclosure in ArubaOS Command Line Interface (medium 6.5)
- [CVE-2023-22774](https://insights.sbomify.com/CVE-2023-22774/): Authenticated Path Traversal in ArubaOS Command Line Interface Allows for Arbitrary File Deletion. (high 7.2)
- [CVE-2023-22773](https://insights.sbomify.com/CVE-2023-22773/): Authenticated Path Traversal in ArubaOS Command Line Interface Allows for Arbitrary File Deletion. (high 7.2)
- [CVE-2023-22772](https://insights.sbomify.com/CVE-2023-22772/): Authenticated Path Traversal in ArubaOS Web-based Management Interface Allows for Arbitrary File Deletion (medium 6.5)
- [CVE-2023-22771](https://insights.sbomify.com/CVE-2023-22771/): Insufficient Session Expiration in ArubaOS Command Line Interface (medium 6.8)
- [CVE-2023-22770](https://insights.sbomify.com/CVE-2023-22770/): Authenticated Remote Command Execution in the ArubaOS Command Line Interface (high 7.2)
- [CVE-2023-2277](https://insights.sbomify.com/CVE-2023-2277/): WP Directory Kit <= 1.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting via wdk_resultitem (medium 6.1)
- [CVE-2023-22769](https://insights.sbomify.com/CVE-2023-22769/): Authenticated Remote Command Execution in the ArubaOS Command Line Interface (high 7.2)
- [CVE-2023-22768](https://insights.sbomify.com/CVE-2023-22768/): Authenticated Remote Command Execution in the ArubaOS Command Line Interface (high 7.2)
- [CVE-2023-22767](https://insights.sbomify.com/CVE-2023-22767/): Authenticated Remote Command Execution in the ArubaOS Command Line Interface (high 7.2)
- [CVE-2023-22766](https://insights.sbomify.com/CVE-2023-22766/): Authenticated Remote Command Execution in the ArubaOS Command Line Interface (high 7.2)
- [CVE-2023-22765](https://insights.sbomify.com/CVE-2023-22765/): Authenticated Remote Command Execution in the ArubaOS Command Line Interface (high 7.2)
- [CVE-2023-22764](https://insights.sbomify.com/CVE-2023-22764/): Authenticated Remote Command Execution in the ArubaOS Command Line Interface (high 7.2)
- [CVE-2023-22763](https://insights.sbomify.com/CVE-2023-22763/): Authenticated Remote Command Execution in the ArubaOS Command Line Interface (high 7.2)
- [CVE-2023-22762](https://insights.sbomify.com/CVE-2023-22762/): Authenticated Remote Command Execution in the ArubaOS Command Line Interface (high 7.2)
- [CVE-2023-22761](https://insights.sbomify.com/CVE-2023-22761/): Authenticated Remote Command Execution in ArubaOS Web-based Management Interface (high 7.2)
- [CVE-2023-22760](https://insights.sbomify.com/CVE-2023-22760/): Authenticated Remote Command Execution in ArubaOS Web-based Management Interface (high 7.2)
- [CVE-2023-2276](https://insights.sbomify.com/CVE-2023-2276/): Missing authorization in WCFM Membership – WooCommerce Memberships for Multivendor Marketplace (critical 9.8)
- [CVE-2023-22759](https://insights.sbomify.com/CVE-2023-22759/): Authenticated Remote Command Execution in ArubaOS Web-based Management Interface (high 7.2)
- [CVE-2023-22758](https://insights.sbomify.com/CVE-2023-22758/): Authenticated Remote Command Execution in ArubaOS Web-based Management Interface (high 7.2)
- [CVE-2023-22757](https://insights.sbomify.com/CVE-2023-22757/): Unauthenticated Buffer Overflow Vulnerabilities in ArubaOS Processes (high 8.1)
- [CVE-2023-22756](https://insights.sbomify.com/CVE-2023-22756/): Unauthenticated Buffer Overflow Vulnerabilities in ArubaOS Processes (high 8.1)
- [CVE-2023-22755](https://insights.sbomify.com/CVE-2023-22755/): Unauthenticated Buffer Overflow Vulnerabilities in ArubaOS Processes (high 8.1)
- [CVE-2023-22754](https://insights.sbomify.com/CVE-2023-22754/): Unauthenticated Buffer Overflow Vulnerabilities in ArubaOS Processes (high 8.1)
- [CVE-2023-22753](https://insights.sbomify.com/CVE-2023-22753/): Unauthenticated Buffer Overflow Vulnerabilities in ArubaOS Processes (high 8.1)
- [CVE-2023-22752](https://insights.sbomify.com/CVE-2023-22752/): Unauthenticated Stack-Based Buffer Overflow Vulnerabilities in the PAPI Protocol (critical 9.8)
- [CVE-2023-22751](https://insights.sbomify.com/CVE-2023-22751/): Unauthenticated Stack-Based Buffer Overflow Vulnerabilities in the PAPI Protocol (critical 9.8)
- [CVE-2023-22750](https://insights.sbomify.com/CVE-2023-22750/): Multiple Unauthenticated Command Injections in the PAPI Protocol (critical 9.8)
- [CVE-2023-2275](https://insights.sbomify.com/CVE-2023-2275/): Missing authorization in WCFM – Multivendor Marketplace REST API for WooCommerce (medium 4.3)
- [CVE-2023-22749](https://insights.sbomify.com/CVE-2023-22749/): Multiple Unauthenticated Command Injections in the PAPI Protocol (critical 9.8)
- [CVE-2023-22748](https://insights.sbomify.com/CVE-2023-22748/): Multiple Unauthenticated Command Injections in the PAPI Protocol (critical 9.8)
- [CVE-2023-22747](https://insights.sbomify.com/CVE-2023-22747/): Multiple Unauthenticated Command Injections in the PAPI Protocol (critical 9.8)
- [CVE-2023-22746](https://insights.sbomify.com/CVE-2023-22746/): CKAN is vulnerable to session secret shared across instances using Docker images (high 8.6)
- [CVE-2023-22745](https://insights.sbomify.com/CVE-2023-22745/): Buffer Overlow in TSS2_RC_Decode in tpm2-tss (medium 6.4)
- [CVE-2023-22743](https://insights.sbomify.com/CVE-2023-22743/): Git for Windows' installer is susceptible to DLL side loading attacks (high 7.3)
- [CVE-2023-22742](https://insights.sbomify.com/CVE-2023-22742/): libgit2 fails to verify SSH keys by default (medium 5.3)
- [CVE-2023-22741](https://insights.sbomify.com/CVE-2023-22741/): heap-over-flow in stun_parse_attribute in sofia-sip (critical 9.8)
- [CVE-2023-22740](https://insights.sbomify.com/CVE-2023-22740/): Discourse vulnerable to Allocation of Resources Without Limits via Chat drafts (medium 4.3)
- [CVE-2023-22739](https://insights.sbomify.com/CVE-2023-22739/): Discourse subject to Allocation of Resources Without Limits or Throttling (medium 6.5)
- [CVE-2023-22738](https://insights.sbomify.com/CVE-2023-22738/): Improper Preservation of Permissions in vantage6 (medium 6.3)
- [CVE-2023-22737](https://insights.sbomify.com/CVE-2023-22737/): wire-server vulnerable to unauthorized removal of Bots from Conversations (medium 6.5)
- [CVE-2023-22736](https://insights.sbomify.com/CVE-2023-22736/): argo-cd Controller reconciles apps outside configured namespaces when sharding is enabled (high 8.6)
- [CVE-2023-22735](https://insights.sbomify.com/CVE-2023-22735/): Cross-site scripting in zulip (medium 4.4)
- [CVE-2023-22734](https://insights.sbomify.com/CVE-2023-22734/): Improper Input Newsletter subscription option validation in shopware (medium 4.3)
- [CVE-2023-22733](https://insights.sbomify.com/CVE-2023-22733/): Improper Output Neutralization in Log Module in shopware (low 2.7)
- [CVE-2023-22732](https://insights.sbomify.com/CVE-2023-22732/): Insufficient Session Expiration in Administration in shopware (low 3.7)
- [CVE-2023-22731](https://insights.sbomify.com/CVE-2023-22731/): Improper Control of Generation of Code in Twig rendered views in shopware (critical 10.0)
- [CVE-2023-22730](https://insights.sbomify.com/CVE-2023-22730/): Improper Input Validation of Clearance sale in cart (medium 5.3)
- [CVE-2023-2273](https://insights.sbomify.com/CVE-2023-2273/): Rapid7 Insight Agent Directory Traversal (medium 5.8)
- [CVE-2023-22729](https://insights.sbomify.com/CVE-2023-22729/): Silverstripe Framework has open redirect vulnerability on CMSSecurity relogin screen (medium 5.4)
- [CVE-2023-22728](https://insights.sbomify.com/CVE-2023-22728/): Silverstripe Framework has missing permission check of canView in GridFieldPrintButton (medium 4.3)
- [CVE-2023-22727](https://insights.sbomify.com/CVE-2023-22727/): Database Query::offset() and limit() vulnerable to SQL injection in cakephp (critical 9.8)
- [CVE-2023-22726](https://insights.sbomify.com/CVE-2023-22726/): Unrestricted file upload leading to privilege escalation in act (high 8.0)
- [CVE-2023-22725](https://insights.sbomify.com/CVE-2023-22725/): glpi vulnerable to XSS on external links (medium 6.2)
- [CVE-2023-22724](https://insights.sbomify.com/CVE-2023-22724/): glpi contains XSS in RSS Description Link (medium 6.2)
- [CVE-2023-22722](https://insights.sbomify.com/CVE-2023-22722/): glpi subject to Cross-site Scripting (XSS) - Reflected (medium 6.8)
- [CVE-2023-22721](https://insights.sbomify.com/CVE-2023-22721/): WordPress Oi Yandex.Maps for WordPress Plugin <= 3.2.7 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/386/