# Vulnerabilities published in 2023


- [CVE-2023-50710](https://insights.sbomify.com/CVE-2023-50710/): Hono's named path parameters can be overridden in TrieRouter (medium 4.2)
- [CVE-2023-5071](https://insights.sbomify.com/CVE-2023-5071/): Sitekit <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sitekit_iframe' shortcode (medium 6.4)
- [CVE-2023-50709](https://insights.sbomify.com/CVE-2023-50709/): Denial of service attack on the cube-api endpoint (medium 6.5)
- [CVE-2023-50708](https://insights.sbomify.com/CVE-2023-50708/): yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementation (medium 6.1)
- [CVE-2023-50707](https://insights.sbomify.com/CVE-2023-50707/): Uncontrolled Resource Consumption in EFACEC BCU 500 (critical 9.6)
- [CVE-2023-50706](https://insights.sbomify.com/CVE-2023-50706/): Improper Access Control in EFACEC UC 500E (medium 4.1)
- [CVE-2023-50705](https://insights.sbomify.com/CVE-2023-50705/): Exposure of Sensitive Information to an Unauthorized Actor in EFACEC UC 500E (medium 5.3)
- [CVE-2023-50704](https://insights.sbomify.com/CVE-2023-50704/): URL Redirection to Untrusted Site ('Open Redirect') in EFACEC UC 500E (medium 4.3)
- [CVE-2023-50703](https://insights.sbomify.com/CVE-2023-50703/): Cleartext Transmission of Sensitive Information in EFACEC UC 500E (medium 6.3)
- [CVE-2023-50702](https://insights.sbomify.com/CVE-2023-50702/): Sikka SSCWindowsService 5 2023-09-14 executes a program as LocalSystem but allows full control by low-privileged users (and low-privileged u (high 8.8)
- [CVE-2023-50700](https://insights.sbomify.com/CVE-2023-50700/): Insecure Permissions vulnerability in Deepin dde-file-manager 6.0.54 and earlier allows privileged operations to be called by unprivileged u (high 7.8)
- [CVE-2023-5070](https://insights.sbomify.com/CVE-2023-5070/): Social Media Share Buttons & Social Sharing Icons <= 2.8.5 - Information Exposure (medium 6.5)
- [CVE-2023-50694](https://insights.sbomify.com/CVE-2023-50694/): Other in dom96:httpbeast (critical 9.8)
- [CVE-2023-50693](https://insights.sbomify.com/CVE-2023-50693/): Other in jester project:jester (critical 9.8)
- [CVE-2023-50692](https://insights.sbomify.com/CVE-2023-50692/): File upload in jizhicms:jizhicms (high 8.8)
- [CVE-2023-50685](https://insights.sbomify.com/CVE-2023-50685/): An issue in Hipcam Cameras RealServer v.1.0 allows a remote attacker to cause a denial of service via a crafted script to the client_port parameter. (high 7.5)
- [CVE-2023-5068](https://insights.sbomify.com/CVE-2023-5068/): Delta Electronics DIAScreen Out-of-bounds Write (high 7.8)
- [CVE-2023-50677](https://insights.sbomify.com/CVE-2023-50677/): Privilege escalation in netgear:dgnd4000 firmware (high 8.8)
- [CVE-2023-50671](https://insights.sbomify.com/CVE-2023-50671/): Memory corruption in aertherwide:exiftags (high 7.8)
- [CVE-2023-50658](https://insights.sbomify.com/CVE-2023-50658/): jose2go vulnerable to denial of service via large p2c value (high 7.5)
- [CVE-2023-50651](https://insights.sbomify.com/CVE-2023-50651/): Command injection in totolink:x6000r firmware (critical 9.8)
- [CVE-2023-50643](https://insights.sbomify.com/CVE-2023-50643/): Code injection in evernote:evernote (critical 9.8)
- [CVE-2023-50639](https://insights.sbomify.com/CVE-2023-50639/): Cross-site scripting in iscute:cute http file server (medium 5.4)
- [CVE-2023-50630](https://insights.sbomify.com/CVE-2023-50630/): Cross-site scripting in teamwork management system project:teamwork management system (medium 6.1)
- [CVE-2023-5063](https://insights.sbomify.com/CVE-2023-5063/): Widget Responsive for Youtube <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-50628](https://insights.sbomify.com/CVE-2023-50628/): Memory corruption in libming:libming (critical 9.8)
- [CVE-2023-5062](https://insights.sbomify.com/CVE-2023-5062/): WordPress Charts <= 0.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-50614](https://insights.sbomify.com/CVE-2023-50614/): Information disclosure in cdebyte:e880-ir01 firmware (high 7.5)
- [CVE-2023-50612](https://insights.sbomify.com/CVE-2023-50612/): Privilege escalation in fit2cloud:cloudexplorer lite (high 7.8)
- [CVE-2023-5061](https://insights.sbomify.com/CVE-2023-5061/): Missing Authorization in GitLab (medium 4.3)
- [CVE-2023-50609](https://insights.sbomify.com/CVE-2023-50609/): Cross-site scripting in ava:teaching video application service platform (medium 6.1)
- [CVE-2023-5060](https://insights.sbomify.com/CVE-2023-5060/): Cross-site Scripting (XSS) - DOM in librenms/librenms (high 8.4)
- [CVE-2023-5059](https://insights.sbomify.com/CVE-2023-5059/): Santesoft Sante FFT Imaging Out-of-bounds Read (high 7.8)
- [CVE-2023-50589](https://insights.sbomify.com/CVE-2023-50589/): SQL injection in embras:geosiap erp (critical 9.8)
- [CVE-2023-50585](https://insights.sbomify.com/CVE-2023-50585/): Memory corruption in tenda:a18 firmware (critical 9.8)
- [CVE-2023-5058](https://insights.sbomify.com/CVE-2023-5058/): Other in SecureCore™ Technology™ 4 (high 7.8)
- [CVE-2023-50578](https://insights.sbomify.com/CVE-2023-50578/): Mingsoft MCMS SQL injection (critical 9.8)
- [CVE-2023-50572](https://insights.sbomify.com/CVE-2023-50572/): JLine vulnerable to out of memory error (medium 5.5)
- [CVE-2023-50571](https://insights.sbomify.com/CVE-2023-50571/): easy-rules-mvel vulnerable to remote code execution (high 7.8)
- [CVE-2023-50570](https://insights.sbomify.com/CVE-2023-50570/): Denial of service in seancfoley:ipaddress (medium 5.5)
- [CVE-2023-5057](https://insights.sbomify.com/CVE-2023-5057/): ActivityPub for WordPress < 1.0.0 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-50566](https://insights.sbomify.com/CVE-2023-50566/): Cross-site scripting in eyoucms:eyoucms (medium 5.4)
- [CVE-2023-50565](https://insights.sbomify.com/CVE-2023-50565/): Cross-site scripting in rpcms:rpcms (medium 5.4)
- [CVE-2023-50564](https://insights.sbomify.com/CVE-2023-50564/): File upload in pluck-cms:pluck (high 8.8)
- [CVE-2023-50563](https://insights.sbomify.com/CVE-2023-50563/): SQL injection in sem-cms:semcms (critical 9.8)
- [CVE-2023-5056](https://insights.sbomify.com/CVE-2023-5056/): Skupper-operator: privelege escalation via config map (medium 6.8)
- [CVE-2023-50559](https://insights.sbomify.com/CVE-2023-50559/): Information disclosure in openxiangshan:xiangshan (medium 5.5)
- [CVE-2023-50550](https://insights.sbomify.com/CVE-2023-50550/): Layui cross-site scripting (XSS) vulnerability (medium 5.4)
- [CVE-2023-5055](https://insights.sbomify.com/CVE-2023-5055/): L2CAP: Possible Stack based buffer overflow in le_ecred_reconf_req() (high 8.3)
- [CVE-2023-5054](https://insights.sbomify.com/CVE-2023-5054/): Super Store Finder <= 6.9.3 - Unauthenticated Email Creation/Sending (medium 5.8)
- [CVE-2023-5053](https://insights.sbomify.com/CVE-2023-5053/): SQL Injection in hospital-management-system-in-php 378c157 in index.php (critical 9.8)
- [CVE-2023-5052](https://insights.sbomify.com/CVE-2023-5052/): Cross Site Scripting (XSS) in Servidor Uniforme Zero (medium 6.3)
- [CVE-2023-5051](https://insights.sbomify.com/CVE-2023-5051/): CallRail Phone Call Tracking <= 0.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-5050](https://insights.sbomify.com/CVE-2023-5050/): Leaflet Map <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-50495](https://insights.sbomify.com/CVE-2023-50495/): Memory corruption in invisible-island:ncurse (medium 6.5)
- [CVE-2023-5049](https://insights.sbomify.com/CVE-2023-5049/): Cross-site scripting in Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers (medium 6.4)
- [CVE-2023-50488](https://insights.sbomify.com/CVE-2023-50488/): Code injection in blurams:lumi security camera a31c firmware (critical 9.8)
- [CVE-2023-50481](https://insights.sbomify.com/CVE-2023-50481/): blinksocks has weak encryption algorithms (high 7.5)
- [CVE-2023-5048](https://insights.sbomify.com/CVE-2023-5048/): WDContactFormBuilder <= 1.0.72 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-50477](https://insights.sbomify.com/CVE-2023-50477/): Privilege escalation in nos:nos client (critical 9.8)
- [CVE-2023-50475](https://insights.sbomify.com/CVE-2023-50475/): bsock uses weak hashing algorithms (critical 9.1)
- [CVE-2023-50473](https://insights.sbomify.com/CVE-2023-50473/): Cross-site scripting in billahmed:qbit matui (medium 5.4)
- [CVE-2023-50472](https://insights.sbomify.com/CVE-2023-50472/): Null dereference in davegamble:cjson (high 7.5)
- [CVE-2023-50471](https://insights.sbomify.com/CVE-2023-50471/): Null dereference in davegamble:cjson (high 7.5)
- [CVE-2023-50470](https://insights.sbomify.com/CVE-2023-50470/): Cross-site scripting in seacms:seacms (medium 5.4)
- [CVE-2023-5047](https://insights.sbomify.com/CVE-2023-5047/): SQLi in DRDrive (critical 9.8)
- [CVE-2023-50469](https://insights.sbomify.com/CVE-2023-50469/): Memory corruption in szlbt:lbt-t300-t310 firmware (critical 9.8)
- [CVE-2023-50466](https://insights.sbomify.com/CVE-2023-50466/): Command injection in weintek:cmt2078x firmware (high 8.8)
- [CVE-2023-50465](https://insights.sbomify.com/CVE-2023-50465/): Cross-site scripting in monicahq:monica (medium 5.4)
- [CVE-2023-50463](https://insights.sbomify.com/CVE-2023-50463/): Header spoofing in caddy-geo-ip (medium 6.5)
- [CVE-2023-50462](https://insights.sbomify.com/CVE-2023-50462/): Insecure Direct Object Reference in extension "Content Consent" (content_consent) (medium 5.3)
- [CVE-2023-50461](https://insights.sbomify.com/CVE-2023-50461/): Configuration Injection in extension "Direct Mail" (direct_mail) (high 8.8)
- [CVE-2023-50460](https://insights.sbomify.com/CVE-2023-50460/): Missing authorization in femanager (medium 5.4)
- [CVE-2023-5046](https://insights.sbomify.com/CVE-2023-5046/): SQLi in Biltay's Procost (critical 9.8)
- [CVE-2023-50459](https://insights.sbomify.com/CVE-2023-50459/): Broken Access Control in extension "femanager" (medium 5.4)
- [CVE-2023-50458](https://insights.sbomify.com/CVE-2023-50458/): Information disclosure in Dradis (low 3.5)
- [CVE-2023-50457](https://insights.sbomify.com/CVE-2023-50457/): Missing authorization in zammad:zammad (medium 4.3)
- [CVE-2023-50456](https://insights.sbomify.com/CVE-2023-50456/): Open redirect in zammad:zammad (medium 5.3)
- [CVE-2023-50455](https://insights.sbomify.com/CVE-2023-50455/): Denial of service in zammad:zammad (high 7.5)
- [CVE-2023-50454](https://insights.sbomify.com/CVE-2023-50454/): Weak cryptography in zammad:zammad (medium 5.9)
- [CVE-2023-50453](https://insights.sbomify.com/CVE-2023-50453/): Information disclosure in zammad:zammad (medium 5.3)
- [CVE-2023-50450](https://insights.sbomify.com/CVE-2023-50450/): Privilege escalation in sensopart:visor vision sensors firmware (high 8.4)
- [CVE-2023-5045](https://insights.sbomify.com/CVE-2023-5045/): SQLi in Biltay's Kayısı (critical 9.8)
- [CVE-2023-50449](https://insights.sbomify.com/CVE-2023-50449/): Directory Traversal in JFinalCMS (high 7.5)
- [CVE-2023-50448](https://insights.sbomify.com/CVE-2023-50448/): Potential CSV export data leak (medium 6.5)
- [CVE-2023-50447](https://insights.sbomify.com/CVE-2023-50447/): Arbitrary Code Execution in Pillow (high 8.1)
- [CVE-2023-50446](https://insights.sbomify.com/CVE-2023-50446/): Privilege escalation in mullvad:mullvad vpn (high 7.8)
- [CVE-2023-50445](https://insights.sbomify.com/CVE-2023-50445/): Command injection in gl-inet:gl-a1300 firmware (high 7.8)
- [CVE-2023-50444](https://insights.sbomify.com/CVE-2023-50444/): Weak cryptography in primx:zed\! (high 7.5)
- [CVE-2023-50443](https://insights.sbomify.com/CVE-2023-50443/): Other in primx:cryhod (medium 4.6)
- [CVE-2023-50442](https://insights.sbomify.com/CVE-2023-50442/): Security feature bypass in primx:zonecentral (medium 5.5)
- [CVE-2023-50441](https://insights.sbomify.com/CVE-2023-50441/): Other in primx:zonecentral (medium 5.5)
- [CVE-2023-50440](https://insights.sbomify.com/CVE-2023-50440/): Other in primx:zed\! (medium 5.5)
- [CVE-2023-5044](https://insights.sbomify.com/CVE-2023-5044/): Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation (high 7.6)
- [CVE-2023-50439](https://insights.sbomify.com/CVE-2023-50439/): Information disclosure in primx:zed\! (medium 5.3)
- [CVE-2023-50437](https://insights.sbomify.com/CVE-2023-50437/): Information disclosure in couchbase:couchbase server (high 8.6)
- [CVE-2023-50436](https://insights.sbomify.com/CVE-2023-50436/): Information disclosure in couchbase:couchbase server (medium 5.3)
- [CVE-2023-50434](https://insights.sbomify.com/CVE-2023-50434/): emdns_resolve_raw in emdns.c in emdns through fbd1eef calls strlen with an input that may not be '\0' terminated, leading to a stack-based buffer over-read. (critical 9.8)
- [CVE-2023-50433](https://insights.sbomify.com/CVE-2023-50433/): marshall in dhcp_packet.c in simple-dhcp-server through ec976d2 allows remote attackers to cause a denial of service by sending a malicious DHCP packet. (medium 6.5)
- [CVE-2023-50432](https://insights.sbomify.com/CVE-2023-50432/): simple-dhcp-server through ec976d2 allows remote attackers to cause a denial of service (daemon crash) by sending a DHCP packet without any (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/174/