# Vulnerabilities published in 2023


- [CVE-2023-47440](https://insights.sbomify.com/CVE-2023-47440/): Directory Traversal in Gladys Assistant (medium 6.5)
- [CVE-2023-4744](https://insights.sbomify.com/CVE-2023-4744/): Tenda AC8 formSetDeviceName stack-based overflow (critical 9.8)
- [CVE-2023-47438](https://insights.sbomify.com/CVE-2023-47438/): SQL Injection vulnerability in Reportico Till (medium 6.5)
- [CVE-2023-47437](https://insights.sbomify.com/CVE-2023-47437/): Cross-site scripting in pachno:pachno (medium 5.4)
- [CVE-2023-47435](https://insights.sbomify.com/CVE-2023-47435/): An issue in the verifyPassword function of hexo-theme-matery v2.0.0 allows attackers to bypass authentication and access password protected pages. (critical 9.8)
- [CVE-2023-47430](https://insights.sbomify.com/CVE-2023-47430/): Memory corruption in readymedia project:readymedia (medium 6.5)
- [CVE-2023-4743](https://insights.sbomify.com/CVE-2023-4743/): Dreamer CMS file access (low 3.1)
- [CVE-2023-47422](https://insights.sbomify.com/CVE-2023-47422/): Auth bypass in tenda:ax12 firmware (high 8.8)
- [CVE-2023-4742](https://insights.sbomify.com/CVE-2023-4742/): IBOS OA export&uid=X sql injection (medium 6.3)
- [CVE-2023-47418](https://insights.sbomify.com/CVE-2023-47418/): Code injection in zoneland:o2oa (critical 9.8)
- [CVE-2023-47417](https://insights.sbomify.com/CVE-2023-47417/): Cross-site scripting in paulrouget:dzslides (medium 6.1)
- [CVE-2023-47415](https://insights.sbomify.com/CVE-2023-47415/): Command injection in cypress:ctm-200 firmware (high 7.5)
- [CVE-2023-4741](https://insights.sbomify.com/CVE-2023-4741/): IBOS OA Delete Logs del sql injection (medium 6.3)
- [CVE-2023-4740](https://insights.sbomify.com/CVE-2023-4740/): IBOS OA Delete Draft delDraft&archiveId=0 sql injection (medium 6.3)
- [CVE-2023-47397](https://insights.sbomify.com/CVE-2023-47397/): Code injection in webidsupport:webid (critical 9.8)
- [CVE-2023-47393](https://insights.sbomify.com/CVE-2023-47393/): Missing authorization in mercedes-benz:mercedes me (medium 5.3)
- [CVE-2023-47392](https://insights.sbomify.com/CVE-2023-47392/): Missing authorization in mercedes-benz:mercedes me (medium 5.3)
- [CVE-2023-47390](https://insights.sbomify.com/CVE-2023-47390/): Headscale writes bearer tokens to info-level logs (high 7.5)
- [CVE-2023-4739](https://insights.sbomify.com/CVE-2023-4739/): Byzoro Smart S85F Management Platform updateos.php unrestricted upload (medium 6.3)
- [CVE-2023-47384](https://insights.sbomify.com/CVE-2023-47384/): Denial of service in gpac:gpac (medium 5.5)
- [CVE-2023-47380](https://insights.sbomify.com/CVE-2023-47380/): Cross-site Scripting in Admidio (medium 6.1)
- [CVE-2023-4738](https://insights.sbomify.com/CVE-2023-4738/): Heap-based Buffer Overflow in vim/vim (high 7.8)
- [CVE-2023-47379](https://insights.sbomify.com/CVE-2023-47379/): Microweber Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2023-47373](https://insights.sbomify.com/CVE-2023-47373/): Information disclosure in linecorp:line (medium 6.5)
- [CVE-2023-47372](https://insights.sbomify.com/CVE-2023-47372/): Information disclosure in linecorp:line (medium 6.5)
- [CVE-2023-47370](https://insights.sbomify.com/CVE-2023-47370/): Information disclosure in linecorp:line (medium 6.5)
- [CVE-2023-4737](https://insights.sbomify.com/CVE-2023-4737/): SQLi in Hedef Trackings Admin Panel (critical 9.8)
- [CVE-2023-47369](https://insights.sbomify.com/CVE-2023-47369/): Information disclosure in linecorp:line (medium 6.5)
- [CVE-2023-47368](https://insights.sbomify.com/CVE-2023-47368/): Information disclosure in linecorp:line (medium 6.5)
- [CVE-2023-47367](https://insights.sbomify.com/CVE-2023-47367/): Information disclosure in linecorp:line (medium 6.5)
- [CVE-2023-47366](https://insights.sbomify.com/CVE-2023-47366/): Information disclosure in linecorp:line (medium 6.5)
- [CVE-2023-47365](https://insights.sbomify.com/CVE-2023-47365/): Information disclosure in linecorp:line (medium 6.5)
- [CVE-2023-47364](https://insights.sbomify.com/CVE-2023-47364/): Information disclosure in linecorp:line (medium 6.5)
- [CVE-2023-47363](https://insights.sbomify.com/CVE-2023-47363/): Information disclosure in linecorp:line (medium 6.5)
- [CVE-2023-47360](https://insights.sbomify.com/CVE-2023-47360/): Integer overflow in videolan:vlc media player (high 7.5)
- [CVE-2023-4736](https://insights.sbomify.com/CVE-2023-4736/): Untrusted Search Path in vim/vim (high 7.8)
- [CVE-2023-47359](https://insights.sbomify.com/CVE-2023-47359/): Memory corruption in videolan:vlc media player (critical 9.8)
- [CVE-2023-47356](https://insights.sbomify.com/CVE-2023-47356/): Mingyu Security Gateway before v3.0-5.3p was discovered to contain a remote command execution (RCE) vulnerability via the log_type parameter (high 8.8)
- [CVE-2023-47355](https://insights.sbomify.com/CVE-2023-47355/): Missing authorization in eyuepcanyilmaz:root quick reboot (high 7.5)
- [CVE-2023-47354](https://insights.sbomify.com/CVE-2023-47354/): Missing authorization in binhdrm26:super reboot (high 7.8)
- [CVE-2023-47353](https://insights.sbomify.com/CVE-2023-47353/): Other in imoulife:imou go (high 8.8)
- [CVE-2023-47352](https://insights.sbomify.com/CVE-2023-47352/): Weak cryptography in technicolor:tc8715d firmware (high 8.8)
- [CVE-2023-47350](https://insights.sbomify.com/CVE-2023-47350/): Cross Site Request Forgery in SwiftyEdit (high 8.8)
- [CVE-2023-4735](https://insights.sbomify.com/CVE-2023-4735/): Out-of-bounds Write in vim/vim (medium 4.8)
- [CVE-2023-47347](https://insights.sbomify.com/CVE-2023-47347/): Memory corruption in free5gc:free5gc (high 7.5)
- [CVE-2023-47346](https://insights.sbomify.com/CVE-2023-47346/): Memory corruption in free5gc:free5gc (high 7.5)
- [CVE-2023-47345](https://insights.sbomify.com/CVE-2023-47345/): free5gc Buffer Overflow vulnerability (high 7.5)
- [CVE-2023-4734](https://insights.sbomify.com/CVE-2023-4734/): Integer Overflow or Wraparound in vim/vim (high 7.8)
- [CVE-2023-47335](https://insights.sbomify.com/CVE-2023-47335/): Security feature bypass in autelrobotics:evo nano drone firmware (medium 6.5)
- [CVE-2023-4733](https://insights.sbomify.com/CVE-2023-4733/): Use After Free in vim/vim (high 7.3)
- [CVE-2023-47327](https://insights.sbomify.com/CVE-2023-47327/): Broken access control in Silverpeas (medium 4.3)
- [CVE-2023-47326](https://insights.sbomify.com/CVE-2023-47326/): Cross Site Request Forgery in Silverpeas (high 8.8)
- [CVE-2023-47325](https://insights.sbomify.com/CVE-2023-47325/): Broken access control in Silverpeas (medium 5.4)
- [CVE-2023-47324](https://insights.sbomify.com/CVE-2023-47324/): Cross-site Scripting in silverpeas (medium 5.4)
- [CVE-2023-47323](https://insights.sbomify.com/CVE-2023-47323/): Missing access control in Silverpeas (high 7.5)
- [CVE-2023-47322](https://insights.sbomify.com/CVE-2023-47322/): Cross Site Request Forgery in Silverpeas (high 8.8)
- [CVE-2023-47321](https://insights.sbomify.com/CVE-2023-47321/): Broken access control in Silverpeas (medium 4.9)
- [CVE-2023-47320](https://insights.sbomify.com/CVE-2023-47320/): Broken access control in Silverpeas (high 8.1)
- [CVE-2023-4732](https://insights.sbomify.com/CVE-2023-4732/): Race condition in Red Hat Enterprise Linux 6 (medium 4.7)
- [CVE-2023-47316](https://insights.sbomify.com/CVE-2023-47316/): Missing authorization in h-mdm:headwind mdm (medium 5.4)
- [CVE-2023-47315](https://insights.sbomify.com/CVE-2023-47315/): Hardcoded credentials in h-mdm:headwind mdm (high 8.8)
- [CVE-2023-47314](https://insights.sbomify.com/CVE-2023-47314/): Cross-site scripting in h-mdm:headwind mdm (medium 5.4)
- [CVE-2023-47313](https://insights.sbomify.com/CVE-2023-47313/): Path traversal in h-mdm:headwind mdm (medium 5.4)
- [CVE-2023-47312](https://insights.sbomify.com/CVE-2023-47312/): Information disclosure in h-mdm:headwind mdm (medium 6.5)
- [CVE-2023-47311](https://insights.sbomify.com/CVE-2023-47311/): Other in spaceapplications:yacms (medium 6.1)
- [CVE-2023-47310](https://insights.sbomify.com/CVE-2023-47310/): A misconfiguration in the default settings of MikroTik RouterOS 7 and fixed in v7.14 allows incoming IPv6 UDP traceroute packets. (medium 6.5)
- [CVE-2023-4731](https://insights.sbomify.com/CVE-2023-4731/): Cross-site request forgery in LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… (medium 4.3)
- [CVE-2023-47309](https://insights.sbomify.com/CVE-2023-47309/): Cross-site scripting in nukium:gls (medium 5.4)
- [CVE-2023-47308](https://insights.sbomify.com/CVE-2023-47308/): SQL injection in activedesign:newsletterpop (critical 9.8)
- [CVE-2023-47307](https://insights.sbomify.com/CVE-2023-47307/): Memory corruption in szlbt:lbt-t300-t310 firmware (high 7.5)
- [CVE-2023-47304](https://insights.sbomify.com/CVE-2023-47304/): Auth bypass in vonage:vdv23 firmware (high 7.8)
- [CVE-2023-4730](https://insights.sbomify.com/CVE-2023-4730/): Missing authorization in LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… (medium 5.3)
- [CVE-2023-47298](https://insights.sbomify.com/CVE-2023-47298/): Information disclosure in ncr:terminal handler (medium 4.3)
- [CVE-2023-47297](https://insights.sbomify.com/CVE-2023-47297/): Missing authorization in ncr:terminal handler (critical 9.8)
- [CVE-2023-47295](https://insights.sbomify.com/CVE-2023-47295/): Code injection in ncr:terminal handler (critical 9.8)
- [CVE-2023-47294](https://insights.sbomify.com/CVE-2023-47294/): Missing authorization in ncr:terminal handler (high 8.1)
- [CVE-2023-4729](https://insights.sbomify.com/CVE-2023-4729/): Cross-site request forgery in LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… (medium 4.3)
- [CVE-2023-47283](https://insights.sbomify.com/CVE-2023-47283/): Path traversal in CubeCart (medium 4.9)
- [CVE-2023-47282](https://insights.sbomify.com/CVE-2023-47282/): Memory corruption in Intel(R) oneVPL software (low 3.9)
- [CVE-2023-4728](https://insights.sbomify.com/CVE-2023-4728/): Missing authorization in LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… (medium 4.3)
- [CVE-2023-47279](https://insights.sbomify.com/CVE-2023-47279/): Delta Electronics InfraSuite Device Master Path Traversal (high 7.5)
- [CVE-2023-47272](https://insights.sbomify.com/CVE-2023-47272/): Cross-site scripting in debian:debian linux (medium 6.1)
- [CVE-2023-47271](https://insights.sbomify.com/CVE-2023-47271/): File upload in sfu:pkp web application library (medium 5.3)
- [CVE-2023-4727](https://insights.sbomify.com/CVE-2023-4727/): Ca: token authentication bypass vulnerability (high 7.5)
- [CVE-2023-47268](https://insights.sbomify.com/CVE-2023-47268/): Command injection in prusa3d:prusaslicer (medium 5.3)
- [CVE-2023-47267](https://insights.sbomify.com/CVE-2023-47267/): Privilege escalation in thegreenbow:thegreenbow vpn client (critical 9.8)
- [CVE-2023-47265](https://insights.sbomify.com/CVE-2023-47265/): Apache Airflow: DAG Params alllow to embed unchecked Javascript (medium 5.4)
- [CVE-2023-47264](https://insights.sbomify.com/CVE-2023-47264/): Memory corruption in withsecure:atlant (high 7.5)
- [CVE-2023-47263](https://insights.sbomify.com/CVE-2023-47263/): Denial of service in withsecure:atlant (high 7.5)
- [CVE-2023-47262](https://insights.sbomify.com/CVE-2023-47262/): Security feature bypass in abbott:id now firmware (medium 5.2)
- [CVE-2023-47261](https://insights.sbomify.com/CVE-2023-47261/): Information disclosure in dokmee:enterprise content management (critical 9.8)
- [CVE-2023-47260](https://insights.sbomify.com/CVE-2023-47260/): Cross-site scripting in redmine:redmine (medium 6.1)
- [CVE-2023-4726](https://insights.sbomify.com/CVE-2023-4726/): Ultimate Dashboard <= 3.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings (medium 4.4)
- [CVE-2023-47259](https://insights.sbomify.com/CVE-2023-47259/): Cross-site scripting in redmine:redmine (medium 6.1)
- [CVE-2023-47258](https://insights.sbomify.com/CVE-2023-47258/): Cross-site scripting in redmine:redmine (medium 6.1)
- [CVE-2023-47257](https://insights.sbomify.com/CVE-2023-47257/): Code injection in connectwise:automate (high 8.1)
- [CVE-2023-47256](https://insights.sbomify.com/CVE-2023-47256/): Auth bypass in connectwise:automate (medium 5.5)
- [CVE-2023-47254](https://insights.sbomify.com/CVE-2023-47254/): Command injection in draytek:vigor167 firmware (critical 9.8)
- [CVE-2023-47253](https://insights.sbomify.com/CVE-2023-47253/): Code injection in qualitor:qualitor (critical 9.8)
- [CVE-2023-47252](https://insights.sbomify.com/CVE-2023-47252/): Memory corruption in insyde:kernel (medium 6.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/197/