# Vulnerabilities published in 2023


- [CVE-2023-49558](https://insights.sbomify.com/CVE-2023-49558/): Denial of service in yasm project:yasm (medium 5.5)
- [CVE-2023-49557](https://insights.sbomify.com/CVE-2023-49557/): Denial of service in yasm project:yasm (medium 5.5)
- [CVE-2023-49556](https://insights.sbomify.com/CVE-2023-49556/): Memory corruption in yasm project:yasm (medium 5.5)
- [CVE-2023-49555](https://insights.sbomify.com/CVE-2023-49555/): Denial of service in yasm project:yasm (medium 5.5)
- [CVE-2023-49554](https://insights.sbomify.com/CVE-2023-49554/): Use after free in yasm project:yasm (medium 5.5)
- [CVE-2023-49553](https://insights.sbomify.com/CVE-2023-49553/): Denial of service in cesanta:mjs (high 7.5)
- [CVE-2023-49552](https://insights.sbomify.com/CVE-2023-49552/): Memory corruption in cesanta:mjs (high 7.5)
- [CVE-2023-49551](https://insights.sbomify.com/CVE-2023-49551/): Denial of service in cesanta:mjs (high 7.5)
- [CVE-2023-49550](https://insights.sbomify.com/CVE-2023-49550/): Denial of service in cesanta:mjs (high 7.5)
- [CVE-2023-49549](https://insights.sbomify.com/CVE-2023-49549/): Denial of service in cesanta:mjs (high 7.5)
- [CVE-2023-49548](https://insights.sbomify.com/CVE-2023-49548/): SQL injection in oretnom23:customer support system (high 8.8)
- [CVE-2023-49547](https://insights.sbomify.com/CVE-2023-49547/): SQL injection in oretnom23:customer support system (critical 9.8)
- [CVE-2023-49546](https://insights.sbomify.com/CVE-2023-49546/): SQL injection in oretnom23:customer support system (high 8.8)
- [CVE-2023-49545](https://insights.sbomify.com/CVE-2023-49545/): Information disclosure in oretnom23:customer support system (high 7.5)
- [CVE-2023-49544](https://insights.sbomify.com/CVE-2023-49544/): Path traversal in oretnom23:customer support system (medium 4.9)
- [CVE-2023-49543](https://insights.sbomify.com/CVE-2023-49543/): Missing authorization in book store management system project:book store management system (critical 9.8)
- [CVE-2023-49540](https://insights.sbomify.com/CVE-2023-49540/): Cross-site scripting in oretnom23:book store management system (medium 6.1)
- [CVE-2023-49539](https://insights.sbomify.com/CVE-2023-49539/): Cross-site scripting in oretnom23:book store management system (medium 6.1)
- [CVE-2023-49528](https://insights.sbomify.com/CVE-2023-49528/): Memory corruption in fedoraproject:fedora (high 8.0)
- [CVE-2023-49515](https://insights.sbomify.com/CVE-2023-49515/): Information disclosure in tp-link:tapo c200 firmware (medium 4.6)
- [CVE-2023-4951](https://insights.sbomify.com/CVE-2023-4951/): Cross Site Scripting (XSS) Issue on "Client Based Authentication Policy Configuration" Screen (low 2.0)
- [CVE-2023-49508](https://insights.sbomify.com/CVE-2023-49508/): YetiForceCRM Directory Traversal vulnerability (medium 6.5)
- [CVE-2023-49502](https://insights.sbomify.com/CVE-2023-49502/): Memory corruption in fedoraproject:fedora (high 8.8)
- [CVE-2023-49501](https://insights.sbomify.com/CVE-2023-49501/): Memory corruption in fedoraproject:fedora (high 8.0)
- [CVE-2023-4950](https://insights.sbomify.com/CVE-2023-4950/): Funnelforms Free < 3.4 Unauthenticated Stored Cross-Site Scripting (medium 6.1)
- [CVE-2023-49494](https://insights.sbomify.com/CVE-2023-49494/): Cross-site scripting in dedecms:dedecms (medium 6.1)
- [CVE-2023-49493](https://insights.sbomify.com/CVE-2023-49493/): Cross-site scripting in dedecms:dedecms (medium 6.1)
- [CVE-2023-49492](https://insights.sbomify.com/CVE-2023-49492/): Cross-site scripting in dedecms:dedecms (medium 6.1)
- [CVE-2023-49490](https://insights.sbomify.com/CVE-2023-49490/): Cross-site scripting in xunruicms:xunruicms (medium 6.1)
- [CVE-2023-4949](https://insights.sbomify.com/CVE-2023-4949/): Memory Corruption Vulnerability in Grub-Legacy's XFS Implementation (high 8.1)
- [CVE-2023-49489](https://insights.sbomify.com/CVE-2023-49489/): Cross-site scripting in kodcloud:kodexplorer (medium 6.1)
- [CVE-2023-49488](https://insights.sbomify.com/CVE-2023-49488/): Cross-site scripting in openfiler:openfiler (medium 6.1)
- [CVE-2023-49487](https://insights.sbomify.com/CVE-2023-49487/): Cross-site Scripting in JFinalCMS (medium 5.4)
- [CVE-2023-49486](https://insights.sbomify.com/CVE-2023-49486/): Cross-site Scripting in JFinalCMS (medium 5.4)
- [CVE-2023-49485](https://insights.sbomify.com/CVE-2023-49485/): Cross-site Scripting in JFinalCMS (medium 5.4)
- [CVE-2023-49484](https://insights.sbomify.com/CVE-2023-49484/): Cross-site scripting in iteachyou:dreamer cms (medium 5.4)
- [CVE-2023-4948](https://insights.sbomify.com/CVE-2023-4948/): WooCommerce CVR Payment Gateway < 6.1.0 - Missing Authorization to Authenticated (Contributor+) CVR Update (medium 4.3)
- [CVE-2023-49473](https://insights.sbomify.com/CVE-2023-49473/): Shenzhen JF6000 Cloud Media Collaboration Processing Platform firmware version V1.2.0 and software version V2.0.0 build 6245 is vulnerable t (critical 9.8)
- [CVE-2023-49471](https://insights.sbomify.com/CVE-2023-49471/): Server-side request forgery in barassistant:bar assistant (high 8.8)
- [CVE-2023-4947](https://insights.sbomify.com/CVE-2023-4947/): WooCommerce EAN Payment Gateway < 6.1.0 - Missing Authorization to Authenticated (Contributor+) EAN Update (medium 4.3)
- [CVE-2023-49469](https://insights.sbomify.com/CVE-2023-49469/): Cross-site scripting in shaarli project:shaarli (medium 6.1)
- [CVE-2023-49468](https://insights.sbomify.com/CVE-2023-49468/): Memory corruption in struktur:libde265 (high 8.8)
- [CVE-2023-49467](https://insights.sbomify.com/CVE-2023-49467/): Memory corruption in struktur:libde265 (high 8.8)
- [CVE-2023-49465](https://insights.sbomify.com/CVE-2023-49465/): Memory corruption in struktur:libde265 (high 8.8)
- [CVE-2023-49464](https://insights.sbomify.com/CVE-2023-49464/): Memory corruption in struktur:libheif (high 8.8)
- [CVE-2023-49463](https://insights.sbomify.com/CVE-2023-49463/): Memory corruption in struktur:libheif (high 8.8)
- [CVE-2023-49462](https://insights.sbomify.com/CVE-2023-49462/): Memory corruption in struktur:libheif (high 8.8)
- [CVE-2023-49460](https://insights.sbomify.com/CVE-2023-49460/): Memory corruption in struktur:libheif (high 8.8)
- [CVE-2023-49453](https://insights.sbomify.com/CVE-2023-49453/): Cross-site scripting in racktables project:racktables (medium 6.1)
- [CVE-2023-4945](https://insights.sbomify.com/CVE-2023-4945/): Booster for WooCommerce <= 7.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-49448](https://insights.sbomify.com/CVE-2023-49448/): Cross-Site Request Forgery in JFinalCMS via admin/nav/delete (high 8.8)
- [CVE-2023-49447](https://insights.sbomify.com/CVE-2023-49447/): Cross-Site Request Forgery in JFinalCMS via /admin/nav/update (high 8.8)
- [CVE-2023-49446](https://insights.sbomify.com/CVE-2023-49446/): Cross-Site Request Forgery in JFinalCMS via /admin/nav/save (high 8.8)
- [CVE-2023-49444](https://insights.sbomify.com/CVE-2023-49444/): File upload in html-js:doracms (medium 5.4)
- [CVE-2023-49443](https://insights.sbomify.com/CVE-2023-49443/): Auth bypass in html-js:doracms (critical 9.8)
- [CVE-2023-49442](https://insights.sbomify.com/CVE-2023-49442/): Deserialization in jeecg:jeecg (critical 9.8)
- [CVE-2023-49441](https://insights.sbomify.com/CVE-2023-49441/): Integer overflow in thekelleys:dnsmasq (high 7.5)
- [CVE-2023-49440](https://insights.sbomify.com/CVE-2023-49440/): AhnLab EPP 1.0.15 is vulnerable to SQL Injection via the "preview parameter." (high 8.8)
- [CVE-2023-4944](https://insights.sbomify.com/CVE-2023-4944/): Awesome Weather Widget <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-49438](https://insights.sbomify.com/CVE-2023-49438/): Open redirect vulnerability in Flask-Security-Too (medium 6.1)
- [CVE-2023-49437](https://insights.sbomify.com/CVE-2023-49437/): Command injection in tenda:ax12 firmware (critical 9.8)
- [CVE-2023-49436](https://insights.sbomify.com/CVE-2023-49436/): Command injection in tenda:ax9 firmware (critical 9.8)
- [CVE-2023-49435](https://insights.sbomify.com/CVE-2023-49435/): Command injection in tenda:ax9 firmware (critical 9.8)
- [CVE-2023-49434](https://insights.sbomify.com/CVE-2023-49434/): Memory corruption in tenda:ax9 firmware (critical 9.8)
- [CVE-2023-49433](https://insights.sbomify.com/CVE-2023-49433/): Memory corruption in tenda:ax9 firmware (critical 9.8)
- [CVE-2023-49432](https://insights.sbomify.com/CVE-2023-49432/): Memory corruption in tenda:ax9 firmware (critical 9.8)
- [CVE-2023-49431](https://insights.sbomify.com/CVE-2023-49431/): Command injection in tenda:ax9 firmware (critical 9.8)
- [CVE-2023-49430](https://insights.sbomify.com/CVE-2023-49430/): Memory corruption in tenda:ax9 firmware (critical 9.8)
- [CVE-2023-4943](https://insights.sbomify.com/CVE-2023-4943/): BEAR <= 1.1.3.3 - Missing Authorization to Product Manipulation (medium 4.3)
- [CVE-2023-49429](https://insights.sbomify.com/CVE-2023-49429/): SQL injection in tenda:ax9 firmware (critical 9.8)
- [CVE-2023-49428](https://insights.sbomify.com/CVE-2023-49428/): Command injection in tenda:ax12 firmware (high 8.8)
- [CVE-2023-49427](https://insights.sbomify.com/CVE-2023-49427/): Memory corruption in tenda:ax12 firmware (high 7.5)
- [CVE-2023-49426](https://insights.sbomify.com/CVE-2023-49426/): Memory corruption in tenda:ax12 firmware (critical 9.8)
- [CVE-2023-49425](https://insights.sbomify.com/CVE-2023-49425/): Memory corruption in tenda:ax12 firmware (critical 9.8)
- [CVE-2023-49424](https://insights.sbomify.com/CVE-2023-49424/): Memory corruption in tenda:ax12 firmware (high 8.8)
- [CVE-2023-4942](https://insights.sbomify.com/CVE-2023-4942/): BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Manipulation (medium 4.3)
- [CVE-2023-49418](https://insights.sbomify.com/CVE-2023-49418/): Memory corruption in totolink:a7000r firmware (critical 9.8)
- [CVE-2023-49417](https://insights.sbomify.com/CVE-2023-49417/): Memory corruption in totolink:a7000r firmware (critical 9.8)
- [CVE-2023-49411](https://insights.sbomify.com/CVE-2023-49411/): Memory corruption in tenda:w30e firmware (critical 9.8)
- [CVE-2023-49410](https://insights.sbomify.com/CVE-2023-49410/): Memory corruption in tenda:w30e firmware (critical 9.8)
- [CVE-2023-4941](https://insights.sbomify.com/CVE-2023-4941/): BEAR <= 1.1.3.3 - Missing Authorization to Product Manipulation (medium 4.3)
- [CVE-2023-49409](https://insights.sbomify.com/CVE-2023-49409/): Command injection in tenda:ax3 firmware (critical 9.8)
- [CVE-2023-49408](https://insights.sbomify.com/CVE-2023-49408/): Memory corruption in tenda:ax3 firmware (critical 9.8)
- [CVE-2023-49406](https://insights.sbomify.com/CVE-2023-49406/): Command injection in tenda:w30e firmware (critical 9.8)
- [CVE-2023-49405](https://insights.sbomify.com/CVE-2023-49405/): Memory corruption in tenda:w30e firmware (critical 9.8)
- [CVE-2023-49404](https://insights.sbomify.com/CVE-2023-49404/): Memory corruption in tenda:w30e firmware (critical 9.8)
- [CVE-2023-49403](https://insights.sbomify.com/CVE-2023-49403/): Command injection in tenda:w30e firmware (critical 9.8)
- [CVE-2023-49402](https://insights.sbomify.com/CVE-2023-49402/): Memory corruption in tenda:w30e firmware (critical 9.8)
- [CVE-2023-4940](https://insights.sbomify.com/CVE-2023-4940/): BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Manipulation (medium 4.3)
- [CVE-2023-49398](https://insights.sbomify.com/CVE-2023-49398/): Cross-Site Request Forgery in JFinalCMS via /admin/category/delete (high 8.8)
- [CVE-2023-49397](https://insights.sbomify.com/CVE-2023-49397/): Cross-Site Request Forgery in JFinalCMS via /admin/category/updateStatus (high 8.8)
- [CVE-2023-49396](https://insights.sbomify.com/CVE-2023-49396/): Cross-Site Request Forgery in JFinalCMS via /admin/category/save (high 8.8)
- [CVE-2023-49395](https://insights.sbomify.com/CVE-2023-49395/): Cross-Site Request Forgery in JFinalCMS via /admin/category/update (high 8.8)
- [CVE-2023-49394](https://insights.sbomify.com/CVE-2023-49394/): Open redirect in easycorp:zentao (medium 6.1)
- [CVE-2023-49391](https://insights.sbomify.com/CVE-2023-49391/): free5GC AMF denial of service vulnerability (high 7.5)
- [CVE-2023-4939](https://insights.sbomify.com/CVE-2023-4939/): SALESmanago <= 3.2.4 - Log Injection via Weak Authentication Token (medium 5.3)
- [CVE-2023-49383](https://insights.sbomify.com/CVE-2023-49383/): Cross-Site Request Forgery in JFinalCMS via /admin/tag/save (high 8.8)
- [CVE-2023-49382](https://insights.sbomify.com/CVE-2023-49382/): Cross-Site Request Forgery in JFinalCMS via /admin/div/delete (high 8.8)
- [CVE-2023-49381](https://insights.sbomify.com/CVE-2023-49381/): Cross-Site Request Forgery in JFinalCMS via /admin/div/update (high 8.8)
- [CVE-2023-49380](https://insights.sbomify.com/CVE-2023-49380/): Cross-Site Request Forgery in JFinalCMS via /admin/friend_link/delete (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/181/