# Vulnerabilities published in 2023


- [CVE-2023-6383](https://insights.sbomify.com/CVE-2023-6383/): Debug Log Manager < 2.3.0 - Sensitive Logs Exposure (high 7.5)
- [CVE-2023-6382](https://insights.sbomify.com/CVE-2023-6382/): Master Slider - Responsive Touch Slider <= 3.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2023-6381](https://insights.sbomify.com/CVE-2023-6381/): Improper input validation in Newsletter Software SuperMailer (low 3.3)
- [CVE-2023-6380](https://insights.sbomify.com/CVE-2023-6380/): Open Redirect in Alkacon Software OpenCms (medium 6.1)
- [CVE-2023-6379](https://insights.sbomify.com/CVE-2023-6379/): Cross-site Scripting in Alkacon Software OpenCms (medium 5.4)
- [CVE-2023-6378](https://insights.sbomify.com/CVE-2023-6378/): Logback "receiver" DOS vulnerability (high 7.1)
- [CVE-2023-6377](https://insights.sbomify.com/CVE-2023-6377/): Xorg-x11-server: out-of-bounds memory reads/writes in xkb button actions (high 7.8)
- [CVE-2023-6376](https://insights.sbomify.com/CVE-2023-6376/): Henschen & Associates court document management software cache uses predictable file names (medium 5.3)
- [CVE-2023-6375](https://insights.sbomify.com/CVE-2023-6375/): Tyler Technologies Magistrate Court Case Management Plus stores backups insecurely (medium 5.3)
- [CVE-2023-6374](https://insights.sbomify.com/CVE-2023-6374/): Auth bypass in MELSEC WS Series WS0-GETH00200 (medium 5.9)
- [CVE-2023-6373](https://insights.sbomify.com/CVE-2023-6373/): ArtPlacer Widget < 2.20.7 - Editor+ SQLi (high 8.8)
- [CVE-2023-6371](https://insights.sbomify.com/CVE-2023-6371/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (high 8.7)
- [CVE-2023-6369](https://insights.sbomify.com/CVE-2023-6369/): Export WP Page to Static HTML/CSS <= 2.1.9 - Missing Authorization via Multiple AJAX Actions (medium 5.4)
- [CVE-2023-6368](https://insights.sbomify.com/CVE-2023-6368/): WhatsUp Gold Unauthenticated Access to an API Endpoint (medium 5.9)
- [CVE-2023-6367](https://insights.sbomify.com/CVE-2023-6367/): WhatsUp Gold Stored Cross-Site Scripting (XSS) via Roles (high 7.6)
- [CVE-2023-6366](https://insights.sbomify.com/CVE-2023-6366/): WhatsUp Gold Stored Cross-Site Scripting (XSS) via Alert Center (high 7.6)
- [CVE-2023-6365](https://insights.sbomify.com/CVE-2023-6365/): WhatsUp Gold Stored Cross-Site Scripting (XSS) via Device Groups (high 7.6)
- [CVE-2023-6364](https://insights.sbomify.com/CVE-2023-6364/): WhatsUp Gold Stored Cross-Site Scripting (XSS) via Dashboard (high 7.6)
- [CVE-2023-6363](https://insights.sbomify.com/CVE-2023-6363/): Mali GPU Kernel Driver allows improper GPU processing operations (medium 5.1)
- [CVE-2023-6362](https://insights.sbomify.com/CVE-2023-6362/): Memory corruption in WinHex (high 7.3)
- [CVE-2023-6361](https://insights.sbomify.com/CVE-2023-6361/): Memory corruption in WinHex (high 7.3)
- [CVE-2023-6360](https://insights.sbomify.com/CVE-2023-6360/): SQL injection in joedolson:my calendar (high 8.6)
- [CVE-2023-6359](https://insights.sbomify.com/CVE-2023-6359/): Cross-Site Scripting in Alumne LMS (medium 5.4)
- [CVE-2023-6357](https://insights.sbomify.com/CVE-2023-6357/): OS Command Injection in multiple CODESYS products (high 8.8)
- [CVE-2023-6356](https://insights.sbomify.com/CVE-2023-6356/): Kernel: null pointer dereference in nvmet_tcp_build_iovec (medium 6.5)
- [CVE-2023-6355](https://insights.sbomify.com/CVE-2023-6355/): Security feature bypass in Controller 7000 (medium 6.8)
- [CVE-2023-6354](https://insights.sbomify.com/CVE-2023-6354/): Tyler Technologies Magistrate Court Case Management Plus PDFViewer.aspx allows authentication bypass (medium 5.3)
- [CVE-2023-6353](https://insights.sbomify.com/CVE-2023-6353/): Tyler Technologies Civil and Criminal Electronic Filing Upload.aspx allows authentication bypass (medium 5.3)
- [CVE-2023-6352](https://insights.sbomify.com/CVE-2023-6352/): Aquaforest TIFF Server default configuration allows access to arbitrary files (medium 5.3)
- [CVE-2023-6351](https://insights.sbomify.com/CVE-2023-6351/): Use after free in Chrome (high 8.8)
- [CVE-2023-6350](https://insights.sbomify.com/CVE-2023-6350/): Use after free in Chrome (high 8.8)
- [CVE-2023-6349](https://insights.sbomify.com/CVE-2023-6349/): Heap overflow in libvpx (medium 5.7)
- [CVE-2023-6348](https://insights.sbomify.com/CVE-2023-6348/): Memory corruption in Chrome (high 8.8)
- [CVE-2023-6347](https://insights.sbomify.com/CVE-2023-6347/): Use after free in Chrome (high 8.8)
- [CVE-2023-6346](https://insights.sbomify.com/CVE-2023-6346/): Use after free in Chrome (high 8.8)
- [CVE-2023-6345](https://insights.sbomify.com/CVE-2023-6345/): Google Skia Integer Overflow (critical 9.6, exploited in the wild)
- [CVE-2023-6344](https://insights.sbomify.com/CVE-2023-6344/): Auth bypass in Court Case Management Plus (medium 5.3)
- [CVE-2023-6343](https://insights.sbomify.com/CVE-2023-6343/): Tyler Technologies Court Case Management Plus use of Aquaforest TIFF Server tssp.aspx allows authentication bypass (medium 5.3)
- [CVE-2023-6342](https://insights.sbomify.com/CVE-2023-6342/): Tyler Technologies Court Case Management Plus "pay for print" allows authentication bypass (medium 5.3)
- [CVE-2023-6341](https://insights.sbomify.com/CVE-2023-6341/): Catalis CM360 allows authentication bypass (medium 5.3)
- [CVE-2023-6340](https://insights.sbomify.com/CVE-2023-6340/): Memory corruption in Capture Client (medium 5.5)
- [CVE-2023-6339](https://insights.sbomify.com/CVE-2023-6339/): Google Nest WiFi Pro root code-execution & user-data compromise (critical 10.0)
- [CVE-2023-6338](https://insights.sbomify.com/CVE-2023-6338/): Privilege escalation in Universal Device Client (UDC) (high 7.8)
- [CVE-2023-6337](https://insights.sbomify.com/CVE-2023-6337/): Vault May be Vulnerable to a Denial of Service Through Memory Exhaustion When Handling Large HTTP Requests (high 7.5)
- [CVE-2023-6336](https://insights.sbomify.com/CVE-2023-6336/): Path traversal in Workforce Access (high 7.2)
- [CVE-2023-6335](https://insights.sbomify.com/CVE-2023-6335/): Path traversal in Workforce Access (medium 6.4)
- [CVE-2023-6334](https://insights.sbomify.com/CVE-2023-6334/): Memory corruption in Workforce Access (medium 5.3)
- [CVE-2023-6333](https://insights.sbomify.com/CVE-2023-6333/): Cross-site Scripting in ControlByWeb Relays (high 7.5)
- [CVE-2023-6329](https://insights.sbomify.com/CVE-2023-6329/): Control iD iDSecure passwordCustom Authentication Bypass (critical 9.8)
- [CVE-2023-6327](https://insights.sbomify.com/CVE-2023-6327/): ShopLentor (formerly WooLentor) <= 2.8.7 - Missing Authorization via purchased_new_products (medium 5.3)
- [CVE-2023-6326](https://insights.sbomify.com/CVE-2023-6326/): Master Slider - Responsive Touch Slider <= 3.9.10 - Cross-Site Request Forgery via process_bulk_action (medium 5.4)
- [CVE-2023-6325](https://insights.sbomify.com/CVE-2023-6325/): RomethemeForm For Elementor <= 1.1.5 - Missing Authorization via export_entries, rtformnewform, and rtformupdate (medium 5.3)
- [CVE-2023-6324](https://insights.sbomify.com/CVE-2023-6324/): ThroughTek Kalay SDK error in handling the PSK identity (high 8.1)
- [CVE-2023-6323](https://insights.sbomify.com/CVE-2023-6323/): ThroughTek Kalay SDK insufficient verification of message authenticity (medium 4.3)
- [CVE-2023-6322](https://insights.sbomify.com/CVE-2023-6322/): Stack-based buffer overflow in message parser functionality (high 7.2)
- [CVE-2023-6321](https://insights.sbomify.com/CVE-2023-6321/): Owlet Camera OS command injection (high 7.2)
- [CVE-2023-6320](https://insights.sbomify.com/CVE-2023-6320/): Command injection in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint (critical 9.1)
- [CVE-2023-6319](https://insights.sbomify.com/CVE-2023-6319/): Command injection in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service (critical 9.1)
- [CVE-2023-6318](https://insights.sbomify.com/CVE-2023-6318/): Command injection in the processAnalyticsReport method from the com.webos.service.cloudupload service (critical 9.1)
- [CVE-2023-6317](https://insights.sbomify.com/CVE-2023-6317/): PIN/prompt bypass on the secondscreen.gateway service allows access to the SSAP API without user interaction (high 7.2)
- [CVE-2023-6316](https://insights.sbomify.com/CVE-2023-6316/): MW WP Form <= 5.0.1 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2023-6315](https://insights.sbomify.com/CVE-2023-6315/): Memory corruption in Control FPWIN Pro (high 7.8)
- [CVE-2023-6314](https://insights.sbomify.com/CVE-2023-6314/): Memory corruption in Control FPWIN Pro (high 7.8)
- [CVE-2023-6313](https://insights.sbomify.com/CVE-2023-6313/): SourceCodester URL Shortener Long URL cross site scripting (low 3.5)
- [CVE-2023-6312](https://insights.sbomify.com/CVE-2023-6312/): SourceCodester Loan Management System Users Page deleteUser.php delete_user sql injection (medium 4.7)
- [CVE-2023-6311](https://insights.sbomify.com/CVE-2023-6311/): SourceCodester Loan Management System Loan Type Page delete_ltype.php delete_ltype sql injection (medium 4.7)
- [CVE-2023-6310](https://insights.sbomify.com/CVE-2023-6310/): SourceCodester Loan Management System deleteBorrower.php delete_borrower sql injection (medium 4.7)
- [CVE-2023-6309](https://insights.sbomify.com/CVE-2023-6309/): moses-smt mosesdecoder trans_result.php os command injection (medium 5.5)
- [CVE-2023-6308](https://insights.sbomify.com/CVE-2023-6308/): Xiamen Four-Faith Video Surveillance Management System Apache Struts unrestricted upload (medium 6.3)
- [CVE-2023-6307](https://insights.sbomify.com/CVE-2023-6307/): jeecgboot JimuReport image path traversal (medium 6.3)
- [CVE-2023-6306](https://insights.sbomify.com/CVE-2023-6306/): SourceCodester Free and Open Source Inventory Management System member_data.php sql injection (medium 6.3)
- [CVE-2023-6305](https://insights.sbomify.com/CVE-2023-6305/): SourceCodester Free and Open Source Inventory Management System suppliar_data.php sql injection (medium 6.3)
- [CVE-2023-6304](https://insights.sbomify.com/CVE-2023-6304/): Tecno 4G Portable WiFi TR118 Ping Tool goform_get_cmd_process os command injection (high 7.2)
- [CVE-2023-6303](https://insights.sbomify.com/CVE-2023-6303/): CSZCMS Site Settings Page cross site scripting (low 2.4)
- [CVE-2023-6302](https://insights.sbomify.com/CVE-2023-6302/): CSZCMS File Manager Page templates permission (medium 4.7)
- [CVE-2023-6301](https://insights.sbomify.com/CVE-2023-6301/): SourceCodester Best Courier Management System GET Parameter parcel_list.php cross site scripting (low 3.5)
- [CVE-2023-6300](https://insights.sbomify.com/CVE-2023-6300/): SourceCodester Best Courier Management System cross site scripting (low 3.5)
- [CVE-2023-6299](https://insights.sbomify.com/CVE-2023-6299/): Apryse iText Reference Table PdfDocument.java memory leak (medium 4.3)
- [CVE-2023-6298](https://insights.sbomify.com/CVE-2023-6298/): Apryse iText PdfDocument.java main array index (medium 4.3)
- [CVE-2023-6297](https://insights.sbomify.com/CVE-2023-6297/): PHPGurukul Nipah Virus Testing Management System Search Report Page patient-search-report.php cross site scripting (medium 4.3)
- [CVE-2023-6296](https://insights.sbomify.com/CVE-2023-6296/): osCommerce Instant Message compare cross site scripting (medium 4.3)
- [CVE-2023-6295](https://insights.sbomify.com/CVE-2023-6295/): so-widgets-bundle < 1.51.0 - Admin+ Local File Inclusion (high 7.2)
- [CVE-2023-6294](https://insights.sbomify.com/CVE-2023-6294/): popup-builder < 4.2.6 - Admin+ SSRF & File Read (high 7.5)
- [CVE-2023-6293](https://insights.sbomify.com/CVE-2023-6293/): Prototype Pollution in robinbuschmann/sequelize-typescript (high 7.5)
- [CVE-2023-6292](https://insights.sbomify.com/CVE-2023-6292/): Ecwid Ecommerce Shopping Cart < 6.12.5 - Arbitrary Plugin Settings Change via CSRF (medium 4.3)
- [CVE-2023-6291](https://insights.sbomify.com/CVE-2023-6291/): Keycloak: redirect_uri validation bypass (high 7.1)
- [CVE-2023-6290](https://insights.sbomify.com/CVE-2023-6290/): WP SEO Press < 7.3 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-6289](https://insights.sbomify.com/CVE-2023-6289/): Swift Performance Lite <= 2.3.6.14 - Unauthenticated Configuration Export (medium 4.3)
- [CVE-2023-6288](https://insights.sbomify.com/CVE-2023-6288/): Code injection in Remote Desktop Manager (high 7.8)
- [CVE-2023-6287](https://insights.sbomify.com/CVE-2023-6287/): Backup password in GET parameter (low 3.3)
- [CVE-2023-6282](https://insights.sbomify.com/CVE-2023-6282/): Cross-Site Scripting vulnerability in IceHrm (medium 5.4)
- [CVE-2023-6280](https://insights.sbomify.com/CVE-2023-6280/): XML External Entity Reference on 52North WPS (high 7.2)
- [CVE-2023-6279](https://insights.sbomify.com/CVE-2023-6279/): Woostify Sites Library < 1.4.8 - Subscriber+ Arbitrary Options Update to DoS (high 7.1)
- [CVE-2023-6278](https://insights.sbomify.com/CVE-2023-6278/): Biteship for WooCommerce < 2.2.25 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-6277](https://insights.sbomify.com/CVE-2023-6277/): Libtiff: out-of-memory in tiffopen via a craft file (medium 6.5)
- [CVE-2023-6276](https://insights.sbomify.com/CVE-2023-6276/): Tongda OA 2017 delete.php sql injection (medium 6.3)
- [CVE-2023-6275](https://insights.sbomify.com/CVE-2023-6275/): TOTVS Fluig Platform mobileredir openApp.jsp cross site scripting (low 3.5)
- [CVE-2023-6274](https://insights.sbomify.com/CVE-2023-6274/): Byzoro Smart S80 PHP File updatelib.php unrestricted upload (medium 6.3)
- [CVE-2023-6273](https://insights.sbomify.com/CVE-2023-6273/): Misconfiguration in EMUI (medium 5.3)
- [CVE-2023-6272](https://insights.sbomify.com/CVE-2023-6272/): Theme My Login 2FA < 1.2 - Lack of Rate Limiting (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/132/