# Vulnerabilities published in 2023


- [CVE-2023-4822](https://insights.sbomify.com/CVE-2023-4822/): Grafana privilege escalation vulnerability (medium 6.7)
- [CVE-2023-48219](https://insights.sbomify.com/CVE-2023-48219/): Special characters in unescaped text nodes can trigger mXSS in TinyMCE (medium 6.1)
- [CVE-2023-48218](https://insights.sbomify.com/CVE-2023-48218/): Bypass of field access control in strapi-plugin-protected-populate (medium 5.3)
- [CVE-2023-48217](https://insights.sbomify.com/CVE-2023-48217/): Remote code execution via form uploads in statamic/cms (high 8.8)
- [CVE-2023-4821](https://insights.sbomify.com/CVE-2023-4821/): Drag and Drop Multiple File Upload < 1.1.1 - Unauthenticated Stored Cross-Site Scripting (medium 5.4)
- [CVE-2023-48208](https://insights.sbomify.com/CVE-2023-48208/): Cross-site scripting in phpjabbers:availability booking calendar (medium 6.1)
- [CVE-2023-48207](https://insights.sbomify.com/CVE-2023-48207/): Code injection in phpjabbers:availability booking calendar (high 8.8)
- [CVE-2023-48206](https://insights.sbomify.com/CVE-2023-48206/): Cross-site scripting in mayurik:courier management system (medium 6.1)
- [CVE-2023-48205](https://insights.sbomify.com/CVE-2023-48205/): Other in jorani:leave management system (medium 5.3)
- [CVE-2023-48204](https://insights.sbomify.com/CVE-2023-48204/): Server-side request forgery in publiccms:publiccms (medium 6.5)
- [CVE-2023-48202](https://insights.sbomify.com/CVE-2023-48202/): Cross-site scripting in sunlight-cms:sunlight cms (medium 5.4)
- [CVE-2023-48201](https://insights.sbomify.com/CVE-2023-48201/): Cross-site scripting in sunlight-cms:sunlight cms (medium 5.4)
- [CVE-2023-48200](https://insights.sbomify.com/CVE-2023-48200/): Cross-site scripting in grocy project:grocy (medium 5.4)
- [CVE-2023-4820](https://insights.sbomify.com/CVE-2023-4820/): PowerPress Podcasting < 11.0.12 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-48199](https://insights.sbomify.com/CVE-2023-48199/): Cross-site scripting in grocy project:grocy (high 7.8)
- [CVE-2023-48198](https://insights.sbomify.com/CVE-2023-48198/): Cross-site scripting in grocy project:grocy (medium 5.4)
- [CVE-2023-48197](https://insights.sbomify.com/CVE-2023-48197/): Cross-site scripting in grocy project:grocy (medium 5.4)
- [CVE-2023-48194](https://insights.sbomify.com/CVE-2023-48194/): Memory corruption in tenda:ac8 firmware (medium 6.3)
- [CVE-2023-48193](https://insights.sbomify.com/CVE-2023-48193/): Security feature bypass in fit2cloud:jumpserver (critical 9.8)
- [CVE-2023-48192](https://insights.sbomify.com/CVE-2023-48192/): Code injection in totolink:a3700r firmware (high 7.8)
- [CVE-2023-4819](https://insights.sbomify.com/CVE-2023-4819/): Shared Files < 1.7.6 - Unauthenticated Stored Cross-Site Scripting (medium 6.1)
- [CVE-2023-48188](https://insights.sbomify.com/CVE-2023-48188/): SQL injection in store-opart:op\'art devis (critical 9.8)
- [CVE-2023-48185](https://insights.sbomify.com/CVE-2023-48185/): Path traversal in terra-mater:terra-master (high 7.5)
- [CVE-2023-48184](https://insights.sbomify.com/CVE-2023-48184/): Use after free in quickjs project:quickjs (low 3.9)
- [CVE-2023-48183](https://insights.sbomify.com/CVE-2023-48183/): Null dereference in quickjs project:quickjs (high 7.5)
- [CVE-2023-4818](https://insights.sbomify.com/CVE-2023-4818/): Security feature bypass in A920 (high 7.6)
- [CVE-2023-48176](https://insights.sbomify.com/CVE-2023-48176/): Privilege escalation in mizhexiaoxiao:websiteguide (critical 9.8)
- [CVE-2023-48172](https://insights.sbomify.com/CVE-2023-48172/): Cross-site scripting in phpjabbers:shuttle booking software (medium 5.4)
- [CVE-2023-48171](https://insights.sbomify.com/CVE-2023-48171/): Privilege escalation in owasp:defectdojo (high 8.8)
- [CVE-2023-4817](https://insights.sbomify.com/CVE-2023-4817/): Unrestricted file upload vulnerability in ICP DAS ET-7060 (high 7.2)
- [CVE-2023-48166](https://insights.sbomify.com/CVE-2023-48166/): Path traversal in unify:openscape voice (high 7.5)
- [CVE-2023-48161](https://insights.sbomify.com/CVE-2023-48161/): Memory corruption in giflib project:giflib (high 7.1)
- [CVE-2023-4816](https://insights.sbomify.com/CVE-2023-4816/): Auth bypass in Asset Suite 9 (medium 6.9)
- [CVE-2023-4815](https://insights.sbomify.com/CVE-2023-4815/): Missing Authentication for Critical Function in answerdev/answer (high 8.3)
- [CVE-2023-4814](https://insights.sbomify.com/CVE-2023-4814/): Privilege escalation in Data Loss Prevention Endpoint for Windows (high 7.1)
- [CVE-2023-48135](https://insights.sbomify.com/CVE-2023-48135/): Information disclosure in linecorp:line (medium 5.4)
- [CVE-2023-48134](https://insights.sbomify.com/CVE-2023-48134/): Information disclosure in linecorp:line (high 7.5)
- [CVE-2023-48133](https://insights.sbomify.com/CVE-2023-48133/): Information disclosure in linecorp:line (medium 5.4)
- [CVE-2023-48132](https://insights.sbomify.com/CVE-2023-48132/): Information disclosure in linecorp:line (medium 5.4)
- [CVE-2023-48131](https://insights.sbomify.com/CVE-2023-48131/): Information disclosure in linecorp:line (medium 5.4)
- [CVE-2023-48130](https://insights.sbomify.com/CVE-2023-48130/): Information disclosure in linecorp:line (medium 5.4)
- [CVE-2023-4813](https://insights.sbomify.com/CVE-2023-4813/): Glibc: potential use-after-free in gaih_inet() (medium 5.9)
- [CVE-2023-48129](https://insights.sbomify.com/CVE-2023-48129/): Information disclosure in linecorp:line (medium 5.4)
- [CVE-2023-48128](https://insights.sbomify.com/CVE-2023-48128/): Information disclosure in linecorp:line (medium 5.4)
- [CVE-2023-48127](https://insights.sbomify.com/CVE-2023-48127/): Hardcoded credentials in linecorp:line (medium 5.4)
- [CVE-2023-48126](https://insights.sbomify.com/CVE-2023-48126/): Information disclosure in linecorp:line (medium 5.4)
- [CVE-2023-48124](https://insights.sbomify.com/CVE-2023-48124/): Cross-site scripting in nayem-howlader:sup online shopping (medium 5.4)
- [CVE-2023-48123](https://insights.sbomify.com/CVE-2023-48123/): Code injection in netgate:pfsense (high 8.8)
- [CVE-2023-48122](https://insights.sbomify.com/CVE-2023-48122/): Microweber allows a remote attacker to obtain sensitive information via the HTTP GET method (high 7.5)
- [CVE-2023-48121](https://insights.sbomify.com/CVE-2023-48121/): Auth bypass in ezviz:cs-c3n-a0-3h2wfrl firmware (medium 5.3)
- [CVE-2023-4812](https://insights.sbomify.com/CVE-2023-4812/): Incorrect Authorization in GitLab (high 7.6)
- [CVE-2023-48118](https://insights.sbomify.com/CVE-2023-48118/): SQL injection in quest-analytics:iqcrm (critical 9.8)
- [CVE-2023-48116](https://insights.sbomify.com/CVE-2023-48116/): Cross-site scripting in smartertools:smartermail (medium 5.4)
- [CVE-2023-48115](https://insights.sbomify.com/CVE-2023-48115/): Cross-site scripting in smartertools:smartermail (medium 5.4)
- [CVE-2023-48114](https://insights.sbomify.com/CVE-2023-48114/): Cross-site scripting in smartertools:smartermail (medium 5.4)
- [CVE-2023-48111](https://insights.sbomify.com/CVE-2023-48111/): Memory corruption in tenda:ax1803 firmware (high 7.5)
- [CVE-2023-48110](https://insights.sbomify.com/CVE-2023-48110/): Memory corruption in tenda:ax1803 firmware (high 7.5)
- [CVE-2023-4811](https://insights.sbomify.com/CVE-2023-4811/): WordPress File Upload < 4.23.3 - Author+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2023-48109](https://insights.sbomify.com/CVE-2023-48109/): Memory corruption in tenda:ax1803 firmware (high 7.5)
- [CVE-2023-48107](https://insights.sbomify.com/CVE-2023-48107/): Memory corruption in zlib-ng:minizip-ng (high 8.8)
- [CVE-2023-48106](https://insights.sbomify.com/CVE-2023-48106/): Memory corruption in zlib-ng:minizip-ng (high 8.8)
- [CVE-2023-48105](https://insights.sbomify.com/CVE-2023-48105/): Memory corruption in bytecodealliance:webassembly micro runtime (high 7.5)
- [CVE-2023-48104](https://insights.sbomify.com/CVE-2023-48104/): Cross-site scripting in alinto:sogo (medium 6.1)
- [CVE-2023-4810](https://insights.sbomify.com/CVE-2023-4810/): Responsive Pricing Table < 5.1.8 - Admin+ Stored Cross-Site Scriping (medium 4.8)
- [CVE-2023-48094](https://insights.sbomify.com/CVE-2023-48094/): Cross-site scripting in cesium:cesiumjs (medium 6.1)
- [CVE-2023-48090](https://insights.sbomify.com/CVE-2023-48090/): Denial of service in gpac:gpac (high 7.1)
- [CVE-2023-4809](https://insights.sbomify.com/CVE-2023-4809/): pf incorrectly handles multiple IPv6 fragment headers (high 7.5)
- [CVE-2023-48089](https://insights.sbomify.com/CVE-2023-48089/): xxl-job-admin vulnerable to Remote Code Execution (high 8.8)
- [CVE-2023-48088](https://insights.sbomify.com/CVE-2023-48088/): xxl-job-admin vulnerable to Cross Site Scripting (medium 5.4)
- [CVE-2023-48087](https://insights.sbomify.com/CVE-2023-48087/): xxl-job-admin vulnerable to Insecure Permissions (medium 5.4)
- [CVE-2023-48085](https://insights.sbomify.com/CVE-2023-48085/): Code injection in nagios:nagios xi (critical 9.8)
- [CVE-2023-48084](https://insights.sbomify.com/CVE-2023-48084/): SQL injection in nagios:nagios xi (critical 9.8)
- [CVE-2023-48082](https://insights.sbomify.com/CVE-2023-48082/): Weak cryptography in nagios:nagios xi (critical 9.1)
- [CVE-2023-4808](https://insights.sbomify.com/CVE-2023-4808/): WP Post Popup <= 3.7.3 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-48078](https://insights.sbomify.com/CVE-2023-48078/): SQL injection in code-projects:simple crud functionality (critical 9.8)
- [CVE-2023-4807](https://insights.sbomify.com/CVE-2023-4807/): POLY1305 MAC implementation corrupts XMM registers on Windows (high 7.8)
- [CVE-2023-48068](https://insights.sbomify.com/CVE-2023-48068/): Cross-site scripting in dedecms:dedecms (medium 5.4)
- [CVE-2023-48063](https://insights.sbomify.com/CVE-2023-48063/): Cross-site request forgery in iteachyou:dreamer cms (medium 4.3)
- [CVE-2023-48060](https://insights.sbomify.com/CVE-2023-48060/): Cross-site request forgery in iteachyou:dreamer cms (high 8.8)
- [CVE-2023-4806](https://insights.sbomify.com/CVE-2023-4806/): Glibc: potential use-after-free in getaddrinfo() (medium 5.9)
- [CVE-2023-48058](https://insights.sbomify.com/CVE-2023-48058/): Cross-site request forgery in iteachyou:dreamer cms (high 8.8)
- [CVE-2023-48056](https://insights.sbomify.com/CVE-2023-48056/): PyPinkSign uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption (high 7.5)
- [CVE-2023-48055](https://insights.sbomify.com/CVE-2023-48055/): Hardcoded credentials in superagi:superagi (high 7.5)
- [CVE-2023-48054](https://insights.sbomify.com/CVE-2023-48054/): Missing SSL certificate validation in localstack (high 7.4)
- [CVE-2023-48053](https://insights.sbomify.com/CVE-2023-48053/): Weak cryptography in archerydms:archery (high 7.5)
- [CVE-2023-48052](https://insights.sbomify.com/CVE-2023-48052/): HTTPie allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack (high 7.4)
- [CVE-2023-48051](https://insights.sbomify.com/CVE-2023-48051/): upydev has weak encryption padding (high 7.5)
- [CVE-2023-48050](https://insights.sbomify.com/CVE-2023-48050/): SQL injection in camsbiometrics:zkteco\, essl\, cams biometrics integration module (critical 9.8)
- [CVE-2023-4805](https://insights.sbomify.com/CVE-2023-4805/): Tutor LMS < 2.3.0 - Subscriber+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2023-48049](https://insights.sbomify.com/CVE-2023-48049/): SQL injection in cybrosys:website blog search (critical 9.8)
- [CVE-2023-48042](https://insights.sbomify.com/CVE-2023-48042/): Cross-site scripting in communitydeveloper:amazzing filter (medium 6.1)
- [CVE-2023-4804](https://insights.sbomify.com/CVE-2023-4804/): Quantum HD Unity (critical 10.0)
- [CVE-2023-48039](https://insights.sbomify.com/CVE-2023-48039/): Denial of service in gpac:gpac (medium 5.5)
- [CVE-2023-48034](https://insights.sbomify.com/CVE-2023-48034/): Weak cryptography in acer:sk-9662 firmware (medium 6.1)
- [CVE-2023-48031](https://insights.sbomify.com/CVE-2023-48031/): File upload in opensupports:opensupports (critical 9.8)
- [CVE-2023-4803](https://insights.sbomify.com/CVE-2023-4803/): ITM Server Cross-site Scripting in WriteWindowTitle Endpoint (medium 4.8)
- [CVE-2023-48029](https://insights.sbomify.com/CVE-2023-48029/): Code injection in corebos:corebos (high 8.0)
- [CVE-2023-48028](https://insights.sbomify.com/CVE-2023-48028/): Information disclosure in kodcloud:kodbox (critical 9.8)
- [CVE-2023-48025](https://insights.sbomify.com/CVE-2023-48025/): Memory corruption in howerj:liblisp (high 8.1)
- [CVE-2023-48024](https://insights.sbomify.com/CVE-2023-48024/): Use after free in howerj:liblisp (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/192/