# Vulnerabilities published in 2023


- [CVE-2023-22470](https://insights.sbomify.com/CVE-2023-22470/): Nextcloud Deck vulnerable to uncontrolled resource consumption (low 3.5)
- [CVE-2023-2247](https://insights.sbomify.com/CVE-2023-2247/): Information disclosure in Octopus Server (medium 5.3)
- [CVE-2023-22469](https://insights.sbomify.com/CVE-2023-22469/): Nextcloud Deck card vulnerable to data leak to unauthorized users via reference preview cache (medium 5.8)
- [CVE-2023-22468](https://insights.sbomify.com/CVE-2023-22468/): Discourse vulnerable to Cross-site Scripting in local oneboxes (high 8.8)
- [CVE-2023-22467](https://insights.sbomify.com/CVE-2023-22467/): luxon.js inefficient regular expression complexity vulnerability (high 7.5)
- [CVE-2023-22466](https://insights.sbomify.com/CVE-2023-22466/): Tokio's reject_remote_clients configuration may get dropped when creating a Windows named pipe (medium 5.4)
- [CVE-2023-22465](https://insights.sbomify.com/CVE-2023-22465/): Http4s has fatal error parsing User-Agent and Server headers (high 7.5)
- [CVE-2023-22464](https://insights.sbomify.com/CVE-2023-22464/): ViewVC XSS vulnerability in revision view changed path "copyfrom" locations (medium 5.4)
- [CVE-2023-22463](https://insights.sbomify.com/CVE-2023-22463/): KubePi's Hardcoded Jwtsigkeys allows malicious actor to login with a forged JWT token (critical 9.8)
- [CVE-2023-22462](https://insights.sbomify.com/CVE-2023-22462/): Stored XSS in Grafana Text plugin (medium 6.4)
- [CVE-2023-22461](https://insights.sbomify.com/CVE-2023-22461/): sanitize-svg Filter Bypass Allows Cross-Site Scripting (XSS) (high 7.6)
- [CVE-2023-22460](https://insights.sbomify.com/CVE-2023-22460/): go-ipld-prime json codec may panic if asked to encode bytes (high 7.5)
- [CVE-2023-2246](https://insights.sbomify.com/CVE-2023-2246/): SourceCodester Online Pizza Ordering System unrestricted upload (medium 6.3)
- [CVE-2023-22458](https://insights.sbomify.com/CVE-2023-22458/): Integer overflow in multiple Redis commands can lead to denial-of-service (medium 5.5)
- [CVE-2023-22457](https://insights.sbomify.com/CVE-2023-22457/): org.xwiki.contrib:application-ckeditor-ui vulnerable to Remote Code Execution via Cross-Site Request Forgery (critical 9.1)
- [CVE-2023-22456](https://insights.sbomify.com/CVE-2023-22456/): ViewVC XSS vulnerability in revision view changed paths (medium 6.1)
- [CVE-2023-22455](https://insights.sbomify.com/CVE-2023-22455/): Discourse vulnerable to Cross-site Scripting through tag descriptions (medium 6.8)
- [CVE-2023-22454](https://insights.sbomify.com/CVE-2023-22454/): Discourse vulnerable to Cross-site Scripting through pending post titles descriptions (high 8.0)
- [CVE-2023-22453](https://insights.sbomify.com/CVE-2023-22453/): Discourse vulnerable to exposure of user post counts per topic to unauthorized users (medium 5.3)
- [CVE-2023-22452](https://insights.sbomify.com/CVE-2023-22452/): Improper Input Validation in kenny2automate (medium 6.5)
- [CVE-2023-22451](https://insights.sbomify.com/CVE-2023-22451/): Weak password requirements in Kiwi TCMS (medium 6.5)
- [CVE-2023-22450](https://insights.sbomify.com/CVE-2023-22450/): File upload in WebAccess/SCADA (high 7.2)
- [CVE-2023-2245](https://insights.sbomify.com/CVE-2023-2245/): hansunCMS unrestricted upload (medium 6.3)
- [CVE-2023-22449](https://insights.sbomify.com/CVE-2023-22449/): Privilege escalation in Intel(R) NUC BIOS firmware (high 7.5)
- [CVE-2023-22448](https://insights.sbomify.com/CVE-2023-22448/): Missing authorization in Intel Unison software (medium 5.9)
- [CVE-2023-22447](https://insights.sbomify.com/CVE-2023-22447/): Information disclosure in Open CAS software for Linux maintained by Intel (low 2.0)
- [CVE-2023-22444](https://insights.sbomify.com/CVE-2023-22444/): Information disclosure in Intel(R) NUC 13 Extreme Compute Element, Intel(R) NUC 13 Extreme Kit, Intel(R) NUC 11 Performance Kit, Intel(R) NUC 11 Performance Mini PC, Intel(R) NUC Compute Element, Intel(R) NUC Laptop Kit, Intel(R) NUC Pro Kit, Intel(R) NUC Pro Board and Intel(R) NUC Pro Mini PC BIOS firmware (medium 6.0)
- [CVE-2023-22443](https://insights.sbomify.com/CVE-2023-22443/): Integer overflow in Intel(R) Server Board BMC firmware (medium 6.0)
- [CVE-2023-22442](https://insights.sbomify.com/CVE-2023-22442/): Memory corruption in Intel(R) Server Board BMC firmware (high 7.9)
- [CVE-2023-22441](https://insights.sbomify.com/CVE-2023-22441/): Missing authorization in SkyBridge MB-A200 and SkyBridge BASIC MB-A130 (high 8.6)
- [CVE-2023-22440](https://insights.sbomify.com/CVE-2023-22440/): Misconfiguration in Intel(R) SCS Add-on software installer for Microsoft SCCM (medium 6.7)
- [CVE-2023-2244](https://insights.sbomify.com/CVE-2023-2244/): SourceCodester Online Eyewear Shop GET Parameter update_status.php sql injection (medium 6.3)
- [CVE-2023-22439](https://insights.sbomify.com/CVE-2023-22439/): Denial of service in Controller 6000/ Controller 7000 (low 3.1)
- [CVE-2023-22438](https://insights.sbomify.com/CVE-2023-22438/): Cross-site scripting in EC-CUBE 4 series, EC-CUBE 3 series, and EC-CUBE 2 series (medium 5.4)
- [CVE-2023-22436](https://insights.sbomify.com/CVE-2023-22436/): The kernel subsystem function check_permission_for_set_tokenid has an UAF vulnerability. (high 7.8)
- [CVE-2023-22435](https://insights.sbomify.com/CVE-2023-22435/): Server bad parsing implementation - stack overflow in server::get_db_path_for_driver (high 7.5)
- [CVE-2023-22432](https://insights.sbomify.com/CVE-2023-22432/): Open redirect in web2py (medium 6.1)
- [CVE-2023-2243](https://insights.sbomify.com/CVE-2023-2243/): SourceCodester Complaint Management System POST Parameter registration.php sql injection (medium 6.3)
- [CVE-2023-22429](https://insights.sbomify.com/CVE-2023-22429/): Hardcoded credentials in Wolt Delivery: Food and more (high 7.8)
- [CVE-2023-22428](https://insights.sbomify.com/CVE-2023-22428/): Missing authorization in Command Centre (high 7.6)
- [CVE-2023-22427](https://insights.sbomify.com/CVE-2023-22427/): Cross-site scripting in SHIRASAGI (medium 4.8)
- [CVE-2023-22425](https://insights.sbomify.com/CVE-2023-22425/): Cross-site scripting in SHIRASAGI (medium 5.4)
- [CVE-2023-22424](https://insights.sbomify.com/CVE-2023-22424/): Use after free in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) (high 7.8)
- [CVE-2023-22422](https://insights.sbomify.com/CVE-2023-22422/): HTTP profile vulnerability (high 7.5)
- [CVE-2023-22421](https://insights.sbomify.com/CVE-2023-22421/): Memory corruption in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) (high 7.8)
- [CVE-2023-2242](https://insights.sbomify.com/CVE-2023-2242/): SourceCodester Online Computer and Laptop Store GET Parameter sql injection (medium 6.3)
- [CVE-2023-22419](https://insights.sbomify.com/CVE-2023-22419/): Memory corruption in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) (high 7.8)
- [CVE-2023-22418](https://insights.sbomify.com/CVE-2023-22418/): BIG-IP APM virtual server vulnerability (medium 6.1)
- [CVE-2023-22417](https://insights.sbomify.com/CVE-2023-22417/): Junos OS: SRX Series: A memory leak might be observed in IPsec VPN scenario leading to an FPC crash (high 7.5)
- [CVE-2023-22416](https://insights.sbomify.com/CVE-2023-22416/): Memory corruption in Junos OS (high 7.5)
- [CVE-2023-22415](https://insights.sbomify.com/CVE-2023-22415/): Memory corruption in Junos OS (high 7.5)
- [CVE-2023-22414](https://insights.sbomify.com/CVE-2023-22414/): Denial of service in Junos OS (medium 6.5)
- [CVE-2023-22413](https://insights.sbomify.com/CVE-2023-22413/): Denial of service in Junos OS (high 7.5)
- [CVE-2023-22412](https://insights.sbomify.com/CVE-2023-22412/): Denial of service in Junos OS (high 7.5)
- [CVE-2023-22411](https://insights.sbomify.com/CVE-2023-22411/): Memory corruption in Junos OS (high 7.5)
- [CVE-2023-22410](https://insights.sbomify.com/CVE-2023-22410/): Denial of service in Junos OS (high 7.5)
- [CVE-2023-2241](https://insights.sbomify.com/CVE-2023-2241/): PoDoFo PdfXRefStreamParserObject.cpp readXRefStreamEntry heap-based overflow (medium 5.3)
- [CVE-2023-22409](https://insights.sbomify.com/CVE-2023-22409/): Denial of service in Junos OS (medium 5.5)
- [CVE-2023-22408](https://insights.sbomify.com/CVE-2023-22408/): Junos OS: SRX 5000 Series: Upon processing of a specific SIP packet an FPC can crash (high 7.5)
- [CVE-2023-22407](https://insights.sbomify.com/CVE-2023-22407/): Denial of service in Junos OS (medium 6.5)
- [CVE-2023-22406](https://insights.sbomify.com/CVE-2023-22406/): Denial of service in Junos OS (medium 6.5)
- [CVE-2023-22405](https://insights.sbomify.com/CVE-2023-22405/): Junos OS: QFX5k Series, EX46xx Series: MAC limiting feature stops working after PFE restart or device reboot (medium 6.5)
- [CVE-2023-22404](https://insights.sbomify.com/CVE-2023-22404/): Memory corruption in Junos OS (medium 6.5)
- [CVE-2023-22403](https://insights.sbomify.com/CVE-2023-22403/): Junos OS: QFX10K Series: An ICCP flap will be observed due to excessive specific traffic (high 7.5)
- [CVE-2023-22402](https://insights.sbomify.com/CVE-2023-22402/): Use after free in Junos OS Evolved (medium 5.9)
- [CVE-2023-22401](https://insights.sbomify.com/CVE-2023-22401/): Junos OS and Junos OS Evolved: PTX10008, PTX10016: When a specific SNMP MIB is queried the FPC will crash (high 7.5)
- [CVE-2023-22400](https://insights.sbomify.com/CVE-2023-22400/): Denial of service in Junos OS Evolved (high 7.5)
- [CVE-2023-2240](https://insights.sbomify.com/CVE-2023-2240/): Improper Privilege Management in microweber/microweber (high 8.8)
- [CVE-2023-22399](https://insights.sbomify.com/CVE-2023-22399/): Junos OS: QFX10K Series: PFE crash upon receipt of specific genuine packets when sFlow is enabled (high 7.5)
- [CVE-2023-22398](https://insights.sbomify.com/CVE-2023-22398/): Junos OS and Junos OS Evolved: RPD might crash when MPLS ping is performed on BGP LSPs (medium 5.3)
- [CVE-2023-22397](https://insights.sbomify.com/CVE-2023-22397/): Denial of service in Junos OS Evolved (medium 6.1)
- [CVE-2023-22396](https://insights.sbomify.com/CVE-2023-22396/): Denial of service in Junos OS (high 7.5)
- [CVE-2023-22395](https://insights.sbomify.com/CVE-2023-22395/): Denial of service in Junos OS (medium 6.5)
- [CVE-2023-22394](https://insights.sbomify.com/CVE-2023-22394/): Junos OS: SRX Series and MX Series: Memory leak due to receipt of specially crafted SIP calls (high 7.5)
- [CVE-2023-22393](https://insights.sbomify.com/CVE-2023-22393/): Junos OS and Junos OS Evolved: RPD crash upon receipt of BGP route with invalid next-hop (high 7.5)
- [CVE-2023-22392](https://insights.sbomify.com/CVE-2023-22392/): Denial of service in Junos OS (medium 6.5)
- [CVE-2023-22391](https://insights.sbomify.com/CVE-2023-22391/): Junos OS: ACX2K Series: Receipt of a high rate of specific traffic will lead to a Denial of Service (DoS) (high 7.5)
- [CVE-2023-22390](https://insights.sbomify.com/CVE-2023-22390/): Memory corruption in Intel(R) Thunderbolt(TM) DCH drivers for Windows (medium 6.5)
- [CVE-2023-2239](https://insights.sbomify.com/CVE-2023-2239/): Exposure of Private Personal Information to an Unauthorized Actor in microweber/microweber (high 7.1)
- [CVE-2023-22389](https://insights.sbomify.com/CVE-2023-22389/): Information disclosure in Wattbox WB-300-IP-3 (medium 5.7)
- [CVE-2023-22388](https://insights.sbomify.com/CVE-2023-22388/): Use of Out-of-range Pointer Offset in Multi-mode Call Processor (critical 9.8)
- [CVE-2023-22387](https://insights.sbomify.com/CVE-2023-22387/): Use of Out-of-range Pointer Offset in Qualcomm IPC (high 7.8)
- [CVE-2023-22386](https://insights.sbomify.com/CVE-2023-22386/): Buffer Copy Without Checking Size of Input in WLAN HOST (high 7.8)
- [CVE-2023-22385](https://insights.sbomify.com/CVE-2023-22385/): Buffer Over-read in Data Modem (high 8.2)
- [CVE-2023-22384](https://insights.sbomify.com/CVE-2023-22384/): Buffer Copy Without Checking Size of Input in VR Service (medium 6.7)
- [CVE-2023-22383](https://insights.sbomify.com/CVE-2023-22383/): Use After Free in Camera (medium 6.7)
- [CVE-2023-22382](https://insights.sbomify.com/CVE-2023-22382/): Improper Input Validation in Automotive (high 7.4)
- [CVE-2023-22381](https://insights.sbomify.com/CVE-2023-22381/): Code injection in GitHub Enterprise Server leading to arbitrary environment variables in GitHub Actions (medium 4.1)
- [CVE-2023-22380](https://insights.sbomify.com/CVE-2023-22380/): Path traversal in GitHub Enterprise Server leading to arbitrary file reading when building a GitHub Pages site (medium 6.5)
- [CVE-2023-22379](https://insights.sbomify.com/CVE-2023-22379/): Information disclosure in Intel(R) Server Board BMC firmware (medium 6.7)
- [CVE-2023-22378](https://insights.sbomify.com/CVE-2023-22378/): Authenticated Blind SQL Injection on sorting in Guardian/CMC before 22.6.2 (high 8.7)
- [CVE-2023-22377](https://insights.sbomify.com/CVE-2023-22377/): XML external entity in tsClinical Define.xml Generator and tsClinical Metadata Desktop Tools (high 7.4)
- [CVE-2023-22376](https://insights.sbomify.com/CVE-2023-22376/): Cross-site scripting in Wired/Wireless LAN Pan/Tilt Network Camera CS-WMV02G (medium 6.1)
- [CVE-2023-22375](https://insights.sbomify.com/CVE-2023-22375/): Cross-site request forgery in Wired/Wireless LAN Pan/Tilt Network Camera CS-WMV02G (high 8.8)
- [CVE-2023-22374](https://insights.sbomify.com/CVE-2023-22374/): iControl SOAP vulnerability (high 7.5)
- [CVE-2023-22373](https://insights.sbomify.com/CVE-2023-22373/): Cross-site scripting in CONPROSYS HMI System (CHS) (medium 5.4)
- [CVE-2023-22372](https://insights.sbomify.com/CVE-2023-22372/): BIG-IP Edge Client for Windows and Mac OS vulnerability (medium 5.9)
- [CVE-2023-22371](https://insights.sbomify.com/CVE-2023-22371/): Command injection in MilesightVPN (high 8.1)
- [CVE-2023-22370](https://insights.sbomify.com/CVE-2023-22370/): Cross-site scripting in Wired/Wireless LAN Pan/Tilt Network Camera CS-WMV02G (medium 5.2)
- [CVE-2023-2237](https://insights.sbomify.com/CVE-2023-2237/): WP Replicate Post <= 4.0.2 - Authenticated (Contributor+) SQL Injection (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/389/