# Vulnerabilities published in 2023


- [CVE-2023-22624](https://insights.sbomify.com/CVE-2023-22624/): XML external entity in zohocorp:manageengine exchange reporter plus (high 7.5)
- [CVE-2023-22622](https://insights.sbomify.com/CVE-2023-22622/): Misconfiguration in wordpress:wordpress (medium 5.3)
- [CVE-2023-22621](https://insights.sbomify.com/CVE-2023-22621/): Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin (critical 10.0)
- [CVE-2023-22620](https://insights.sbomify.com/CVE-2023-22620/): Information disclosure in securepoint:unified threat management (high 7.5)
- [CVE-2023-2262](https://insights.sbomify.com/CVE-2023-2262/): Rockwell Automation Select Logix Communication Modules Vulnerable to Email Object Buffer Overflow (critical 9.8)
- [CVE-2023-22618](https://insights.sbomify.com/CVE-2023-22618/): Privilege escalation in nokia:wavelite metro 200 and f2b fans firmware (high 8.1)
- [CVE-2023-22617](https://insights.sbomify.com/CVE-2023-22617/): Denial of service in powerdns:recursor (high 7.5)
- [CVE-2023-22616](https://insights.sbomify.com/CVE-2023-22616/): Memory corruption in insyde:insydeh2o (high 7.8)
- [CVE-2023-22615](https://insights.sbomify.com/CVE-2023-22615/): Memory corruption in insyde:insydeh2o (high 8.4)
- [CVE-2023-22614](https://insights.sbomify.com/CVE-2023-22614/): Memory corruption in insyde:insydeh2o (high 8.8)
- [CVE-2023-22613](https://insights.sbomify.com/CVE-2023-22613/): Memory corruption in insyde:insydeh2o (high 8.8)
- [CVE-2023-22612](https://insights.sbomify.com/CVE-2023-22612/): Memory corruption in insyde:insydeh2o (high 8.8)
- [CVE-2023-22611](https://insights.sbomify.com/CVE-2023-22611/): Information disclosure in EcoStruxure Geo SCADA Expert 2019 - 2021 (formerly known as ClearSCADA) (high 7.5)
- [CVE-2023-22610](https://insights.sbomify.com/CVE-2023-22610/): Missing authorization in EcoStruxure Geo SCADA Expert 2019 - 2021 (formerly known as ClearSCADA) (critical 9.1)
- [CVE-2023-2261](https://insights.sbomify.com/CVE-2023-2261/): WP Activity Log <= 4.5.0 - Missing Capabilities Check to User Enumeration (medium 4.3)
- [CVE-2023-22602](https://insights.sbomify.com/CVE-2023-22602/): Apache Shiro Interpretation Conflict vulnerability (high 7.5)
- [CVE-2023-22601](https://insights.sbomify.com/CVE-2023-22601/): Weak cryptography in InRouter 302 (critical 10.0)
- [CVE-2023-22600](https://insights.sbomify.com/CVE-2023-22600/): Missing authorization in InRouter 302 (critical 10.0)
- [CVE-2023-2260](https://insights.sbomify.com/CVE-2023-2260/): Authorization Bypass Through User-Controlled Key in alfio-event/alf.io (high 8.8)
- [CVE-2023-22599](https://insights.sbomify.com/CVE-2023-22599/): Weak cryptography in InRouter 302 (high 7.0)
- [CVE-2023-22598](https://insights.sbomify.com/CVE-2023-22598/): Command injection in InRouter 302 (high 7.2)
- [CVE-2023-22597](https://insights.sbomify.com/CVE-2023-22597/): Information disclosure in InRouter 302 (medium 6.5)
- [CVE-2023-22595](https://insights.sbomify.com/CVE-2023-22595/): IBM B2B Advanced Communication cross-site scripting (medium 5.4)
- [CVE-2023-22594](https://insights.sbomify.com/CVE-2023-22594/): IBM Robotic Process Automation for Cloud Pak cross-site scripting (medium 4.6)
- [CVE-2023-22593](https://insights.sbomify.com/CVE-2023-22593/): IBM Robotic Process Automation for Cloud Pak security configuration (medium 4.0)
- [CVE-2023-22592](https://insights.sbomify.com/CVE-2023-22592/): IBM Robotic Process Automation for Cloud Pak insufficient permission settings (medium 4.0)
- [CVE-2023-22591](https://insights.sbomify.com/CVE-2023-22591/): IBM Robotic Process Automation session fixation (low 3.9)
- [CVE-2023-2259](https://insights.sbomify.com/CVE-2023-2259/): Improper Neutralization of Special Elements Used in a Template Engine in alfio-event/alf.io (critical 9.1)
- [CVE-2023-22586](https://insights.sbomify.com/CVE-2023-22586/): Local File Inclusion in Danfoss AK-EM100 (high 7.7)
- [CVE-2023-22585](https://insights.sbomify.com/CVE-2023-22585/): Reflected Cross-Site Scripting in Danfoss AK-EM100 (critical 9.0)
- [CVE-2023-22584](https://insights.sbomify.com/CVE-2023-22584/): Cleartext credentials in Danfoss AK-EM100 (high 7.5)
- [CVE-2023-22583](https://insights.sbomify.com/CVE-2023-22583/): SQL Injection in Danfoss AK-EM100 (critical 10.0)
- [CVE-2023-22582](https://insights.sbomify.com/CVE-2023-22582/): Reflected Cross-Site Scripting in Danfoss AK-EM100 (critical 9.0)
- [CVE-2023-22581](https://insights.sbomify.com/CVE-2023-22581/): White Rabbit Switch - Unauthenticated remote code execution (critical 9.8)
- [CVE-2023-22580](https://insights.sbomify.com/CVE-2023-22580/): Sequalize - Bad query filtering leading to SQL errors (medium 5.3)
- [CVE-2023-2258](https://insights.sbomify.com/CVE-2023-2258/): Improper Neutralization of Formula Elements in a CSV File in alfio-event/alf.io (high 8.8)
- [CVE-2023-22579](https://insights.sbomify.com/CVE-2023-22579/): Sequalize - Unsafe fall-through in getWhereConditions (critical 9.9)
- [CVE-2023-22578](https://insights.sbomify.com/CVE-2023-22578/): Sequalize - Default support for “raw attributes” when using parentheses (critical 10.0)
- [CVE-2023-22577](https://insights.sbomify.com/CVE-2023-22577/): White Rabbit Switch - Password Disclosure Vulnerability (critical 9.8)
- [CVE-2023-22576](https://insights.sbomify.com/CVE-2023-22576/): Privilege escalation in Dell Repository Manager (DRM) (high 7.0)
- [CVE-2023-22575](https://insights.sbomify.com/CVE-2023-22575/): Information disclosure in PowerScale OneFS (high 8.7)
- [CVE-2023-22574](https://insights.sbomify.com/CVE-2023-22574/): Information disclosure in PowerScale OneFS (high 8.1)
- [CVE-2023-22573](https://insights.sbomify.com/CVE-2023-22573/): Information disclosure in PowerScale OneFS (high 7.9)
- [CVE-2023-22572](https://insights.sbomify.com/CVE-2023-22572/): Information disclosure in PowerScale OneFS (high 7.8)
- [CVE-2023-2257](https://insights.sbomify.com/CVE-2023-2257/): Auth bypass in Workspace Desktop (medium 6.1)
- [CVE-2023-2256](https://insights.sbomify.com/CVE-2023-2256/): Product Addons & Fields for WooCommerce < 32.0.7 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-22551](https://insights.sbomify.com/CVE-2023-22551/): Denial of service in ftp project:ftp (high 7.5)
- [CVE-2023-2255](https://insights.sbomify.com/CVE-2023-2255/): Remote documents loaded without prompt via IFrame (medium 5.3)
- [CVE-2023-2254](https://insights.sbomify.com/CVE-2023-2254/): Ko-fi Button < 1.3.3 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-2253](https://insights.sbomify.com/CVE-2023-2253/): distribution catalog API endpoint can lead to OOM via malicious user input (medium 6.5)
- [CVE-2023-22527](https://insights.sbomify.com/CVE-2023-22527/): Atlassian Confluence Data Center and Server Template Injection (critical 10.0, exploited in the wild)
- [CVE-2023-22526](https://insights.sbomify.com/CVE-2023-22526/): Code injection in Confluence Data Center (high 7.2)
- [CVE-2023-22524](https://insights.sbomify.com/CVE-2023-22524/): Security feature bypass in Companion for Mac (critical 9.6)
- [CVE-2023-22523](https://insights.sbomify.com/CVE-2023-22523/): Other in Assets Discovery Cloud (critical 9.8)
- [CVE-2023-22522](https://insights.sbomify.com/CVE-2023-22522/): Code injection in Confluence Data Center (critical 9.0)
- [CVE-2023-22521](https://insights.sbomify.com/CVE-2023-22521/): Code injection in Crowd Data Center (high 8.0)
- [CVE-2023-2252](https://insights.sbomify.com/CVE-2023-2252/): Directorist < 7.5.4 - Admin+ LFI (low 2.7)
- [CVE-2023-22518](https://insights.sbomify.com/CVE-2023-22518/): Atlassian Confluence Data Center and Server Improper Authorization (critical 10.0, exploited in the wild)
- [CVE-2023-22516](https://insights.sbomify.com/CVE-2023-22516/): Code injection in Bamboo Data Center (high 8.5)
- [CVE-2023-22515](https://insights.sbomify.com/CVE-2023-22515/): Atlassian Confluence Data Center and Server Broken Access Control (critical 10.0, exploited in the wild)
- [CVE-2023-22514](https://insights.sbomify.com/CVE-2023-22514/): Code injection in Sourcetree for Mac (high 7.8)
- [CVE-2023-22513](https://insights.sbomify.com/CVE-2023-22513/): Code injection in Bitbucket Data Center (high 8.5)
- [CVE-2023-22512](https://insights.sbomify.com/CVE-2023-22512/): Denial of service in Confluence Data Center (high 7.5)
- [CVE-2023-2251](https://insights.sbomify.com/CVE-2023-2251/): Uncaught Exception in eemeli/yaml (high 7.5)
- [CVE-2023-22508](https://insights.sbomify.com/CVE-2023-22508/): Code injection in Confluence Data Center (high 8.5)
- [CVE-2023-22506](https://insights.sbomify.com/CVE-2023-22506/): Code injection in Bamboo Data Center (high 7.5)
- [CVE-2023-22505](https://insights.sbomify.com/CVE-2023-22505/): Code injection in Confluence Data Center (high 8.0)
- [CVE-2023-22504](https://insights.sbomify.com/CVE-2023-22504/): Missing authorization in Confluence Data Center (medium 4.3)
- [CVE-2023-22503](https://insights.sbomify.com/CVE-2023-22503/): Information disclosure in Confluence Data Center (medium 5.3)
- [CVE-2023-22501](https://insights.sbomify.com/CVE-2023-22501/): Auth bypass in Jira Service Management Data Center (critical 9.4)
- [CVE-2023-22500](https://insights.sbomify.com/CVE-2023-22500/): glpi Unauthorized access to inventory files (high 7.5)
- [CVE-2023-2250](https://insights.sbomify.com/CVE-2023-2250/): Privilege escalation in MCE (medium 6.7)
- [CVE-2023-22499](https://insights.sbomify.com/CVE-2023-22499/): Interactive permission prompt spoofing in Deno (high 7.5)
- [CVE-2023-22497](https://insights.sbomify.com/CVE-2023-22497/): Netdata is vulnerable to improper authentication (medium 6.5)
- [CVE-2023-22496](https://insights.sbomify.com/CVE-2023-22496/): Netdata vulnerable to command injection (high 8.1)
- [CVE-2023-22495](https://insights.sbomify.com/CVE-2023-22495/): Izanami is vulnerable to Authorization Bypass (critical 9.8)
- [CVE-2023-22493](https://insights.sbomify.com/CVE-2023-22493/): RSSHub is vulnerable to SSRF (Server-Side Request Forgery) (high 8.8)
- [CVE-2023-22492](https://insights.sbomify.com/CVE-2023-22492/): RefreshToken invalidation vulnerability (medium 5.9)
- [CVE-2023-22491](https://insights.sbomify.com/CVE-2023-22491/): gatsby-transformer-remark vulnerable to unsanitized JavaScript code injection (high 8.1)
- [CVE-2023-22490](https://insights.sbomify.com/CVE-2023-22490/): Git vulnerable to local clone-based data exfiltration with non-local transports (medium 5.5)
- [CVE-2023-2249](https://insights.sbomify.com/CVE-2023-2249/): Path traversal in wpForo Forum (high 8.8)
- [CVE-2023-22489](https://insights.sbomify.com/CVE-2023-22489/): Flarum is missing authorization in discussion replies (low 3.5)
- [CVE-2023-22488](https://insights.sbomify.com/CVE-2023-22488/): Missing authorization in Flarum (medium 6.8)
- [CVE-2023-22487](https://insights.sbomify.com/CVE-2023-22487/): Post mentions can be used to read any post on the forum without access control (high 7.7)
- [CVE-2023-22486](https://insights.sbomify.com/CVE-2023-22486/): cmark-gfm Quadratic complexity bug in handle_close_bracket may lead to a denial of service (low 3.5)
- [CVE-2023-22485](https://insights.sbomify.com/CVE-2023-22485/): cmark-gfm out-of-bounds read in validate_protocol (medium 5.3)
- [CVE-2023-22484](https://insights.sbomify.com/CVE-2023-22484/): Inefficient Quadratic complexity bug in handle_pointy_brace may lead to a denial of service (low 3.5)
- [CVE-2023-22483](https://insights.sbomify.com/CVE-2023-22483/): cmark-gfm Quadratic complexity bugs may lead to a denial of service (low 3.5)
- [CVE-2023-22482](https://insights.sbomify.com/CVE-2023-22482/): JWT audience claim is not verified (critical 9.1)
- [CVE-2023-22481](https://insights.sbomify.com/CVE-2023-22481/): Sensitive information exposure in the logs of greader API in FreshRSS (medium 4.0)
- [CVE-2023-22480](https://insights.sbomify.com/CVE-2023-22480/): KubeOperator is vulnerable to unauthorized access to system API (high 7.3)
- [CVE-2023-22479](https://insights.sbomify.com/CVE-2023-22479/): KubePi vulnerable to session fixation attack (high 7.5)
- [CVE-2023-22478](https://insights.sbomify.com/CVE-2023-22478/): KubePi is vulnerable to missing authorization (high 7.3)
- [CVE-2023-22477](https://insights.sbomify.com/CVE-2023-22477/): Mercurius is vulnerable to denial of service (DoS) when using subscriptions (medium 5.3)
- [CVE-2023-22476](https://insights.sbomify.com/CVE-2023-22476/): MantisBT: Exposure of Private issues' summary to unauthorized users (medium 4.3)
- [CVE-2023-22475](https://insights.sbomify.com/CVE-2023-22475/): Cross-Site Scripting in Canarytoken history (medium 6.3)
- [CVE-2023-22474](https://insights.sbomify.com/CVE-2023-22474/): Parse Server is vulnerable to authentication bypass via spoofing (high 8.7)
- [CVE-2023-22473](https://insights.sbomify.com/CVE-2023-22473/): Passcode bypass on Talk-Android app (low 2.1)
- [CVE-2023-22472](https://insights.sbomify.com/CVE-2023-22472/): Nextcloud Deck Desktop Client is vulnerable to Cross-Site Request Forgery (CSRF) via malicious link (medium 5.3)
- [CVE-2023-22471](https://insights.sbomify.com/CVE-2023-22471/): Nextcloud Deck vulnerable to authorization bypass (low 3.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/388/