# Vulnerabilities published in 2023


- [CVE-2023-47035](https://insights.sbomify.com/CVE-2023-47035/): Business logic in etherscan:reptilian coin (high 7.5)
- [CVE-2023-47034](https://insights.sbomify.com/CVE-2023-47034/): Business logic in uniswapfrontrunbot project:uniswapfrontrunbot (high 7.5)
- [CVE-2023-47033](https://insights.sbomify.com/CVE-2023-47033/): Race condition in multisigwallet project:multisigwallet (high 7.5)
- [CVE-2023-47032](https://insights.sbomify.com/CVE-2023-47032/): Code injection in ncr:terminal handler (critical 9.8)
- [CVE-2023-47031](https://insights.sbomify.com/CVE-2023-47031/): Privilege escalation in ncr:terminal handler (critical 9.8)
- [CVE-2023-47030](https://insights.sbomify.com/CVE-2023-47030/): Code injection in ncr:terminal handler (critical 9.8)
- [CVE-2023-4703](https://insights.sbomify.com/CVE-2023-4703/): All in One B2B for WooCommerce <= 1.0.3 - Unauthenticated Privilege Escalation (high 7.5)
- [CVE-2023-47029](https://insights.sbomify.com/CVE-2023-47029/): Information disclosure in ncr:terminal handler (critical 9.8)
- [CVE-2023-47025](https://insights.sbomify.com/CVE-2023-47025/): Free5gc allows a local attacker to cause a denial of service via the free5gc-compose component (medium 5.5)
- [CVE-2023-47024](https://insights.sbomify.com/CVE-2023-47024/): Cross-site request forgery in ncratleos:terminal handler (high 8.8)
- [CVE-2023-47022](https://insights.sbomify.com/CVE-2023-47022/): Missing authorization in ncr:terminal handler (medium 6.5)
- [CVE-2023-47020](https://insights.sbomify.com/CVE-2023-47020/): Cross-site request forgery in ncratleos:terminal handler (high 8.8)
- [CVE-2023-4702](https://insights.sbomify.com/CVE-2023-4702/): Authentication Bypass in Digital Yepas (critical 9.8)
- [CVE-2023-47016](https://insights.sbomify.com/CVE-2023-47016/): Memory corruption in radare:radare2 (high 7.5)
- [CVE-2023-47014](https://insights.sbomify.com/CVE-2023-47014/): Cross-site request forgery in remyandrade:sticky notes app (medium 6.5)
- [CVE-2023-47004](https://insights.sbomify.com/CVE-2023-47004/): Memory corruption in redislabs:redisgraph (high 8.8)
- [CVE-2023-47003](https://insights.sbomify.com/CVE-2023-47003/): Code injection in redislabs:redisgraph (critical 9.8)
- [CVE-2023-4700](https://insights.sbomify.com/CVE-2023-4700/): Missing Authorization in GitLab (low 3.5)
- [CVE-2023-46998](https://insights.sbomify.com/CVE-2023-46998/): Bootbox.js Cross Site Scripting vulnerability (medium 6.1)
- [CVE-2023-46993](https://insights.sbomify.com/CVE-2023-46993/): Command injection in totolink:a3300r firmware (critical 9.8)
- [CVE-2023-46992](https://insights.sbomify.com/CVE-2023-46992/): Missing authorization in totolink:a3300r firmware (high 7.5)
- [CVE-2023-46990](https://insights.sbomify.com/CVE-2023-46990/): Deserialization in publiccms:publiccms (critical 9.8)
- [CVE-2023-4699](https://insights.sbomify.com/CVE-2023-4699/): Auth bypass in MELSEC L Series LD77MS16 (critical 10.0)
- [CVE-2023-46989](https://insights.sbomify.com/CVE-2023-46989/): SQL injection in innovadeluxe:quick order (high 7.8)
- [CVE-2023-46988](https://insights.sbomify.com/CVE-2023-46988/): Path traversal in onlyoffice:document server (medium 6.7)
- [CVE-2023-46987](https://insights.sbomify.com/CVE-2023-46987/): Code injection in seacms:seacms (high 8.8)
- [CVE-2023-46981](https://insights.sbomify.com/CVE-2023-46981/): SQL injection in xxyopen:novel-plus (critical 9.8)
- [CVE-2023-46980](https://insights.sbomify.com/CVE-2023-46980/): Code injection in mayurik:best courier management system (critical 9.8)
- [CVE-2023-4698](https://insights.sbomify.com/CVE-2023-4698/): Improper Input Validation in usememos/memos (high 7.5)
- [CVE-2023-46979](https://insights.sbomify.com/CVE-2023-46979/): Command injection in totolink:x6000r firmware (critical 9.8)
- [CVE-2023-46978](https://insights.sbomify.com/CVE-2023-46978/): Auth bypass in totolink:x6000r firmware (high 7.5)
- [CVE-2023-46977](https://insights.sbomify.com/CVE-2023-46977/): Memory corruption in totolink:lr1200gb firmware (critical 9.8)
- [CVE-2023-46976](https://insights.sbomify.com/CVE-2023-46976/): Command injection in totolink:a3300r firmware (critical 9.8)
- [CVE-2023-46974](https://insights.sbomify.com/CVE-2023-46974/): Cross-site scripting in mayurik:courier management system (medium 5.4)
- [CVE-2023-4697](https://insights.sbomify.com/CVE-2023-4697/): Improper Privilege Management in usememos/memos (high 8.8)
- [CVE-2023-46967](https://insights.sbomify.com/CVE-2023-46967/): Cross-site scripting in enhancesoft:osticket (medium 6.1)
- [CVE-2023-46964](https://insights.sbomify.com/CVE-2023-46964/): Cross-site scripting in Next Generation FireWall SG-6000-E3960 (medium 6.1)
- [CVE-2023-46963](https://insights.sbomify.com/CVE-2023-46963/): Auth bypass in kaoshifeng:yunfan learning examination system (medium 5.3)
- [CVE-2023-46960](https://insights.sbomify.com/CVE-2023-46960/): PyPXE Buffer Overflow vulnerability (high 8.6)
- [CVE-2023-4696](https://insights.sbomify.com/CVE-2023-4696/): Improper Access Control in usememos/memos (critical 9.8)
- [CVE-2023-46958](https://insights.sbomify.com/CVE-2023-46958/): Code injection in lmxcms:lmxcms (critical 9.8)
- [CVE-2023-46956](https://insights.sbomify.com/CVE-2023-46956/): SQL injection in oretnom23:packers and movers management system (high 7.2)
- [CVE-2023-46954](https://insights.sbomify.com/CVE-2023-46954/): SQL injection in relativity:relativityone (critical 9.8)
- [CVE-2023-46953](https://insights.sbomify.com/CVE-2023-46953/): SQL injection in abocms:abo.cms (critical 9.8)
- [CVE-2023-46952](https://insights.sbomify.com/CVE-2023-46952/): Cross-site scripting in abocms:abo.cms (medium 6.1)
- [CVE-2023-46951](https://insights.sbomify.com/CVE-2023-46951/): Cross-site scripting in contribsys:sidekiq (medium 6.1)
- [CVE-2023-46950](https://insights.sbomify.com/CVE-2023-46950/): Cross-site scripting in contribsys:sidekiq (medium 6.1)
- [CVE-2023-4695](https://insights.sbomify.com/CVE-2023-4695/): Use of Predictable Algorithm in Random Number Generator in pkp/pkp-lib (critical 9.6)
- [CVE-2023-46948](https://insights.sbomify.com/CVE-2023-46948/): A reflected Cross-Site Scripting (XSS) vulnerability was found on Temenos T24 Browser R19.40 that enables a remote attacker to execute arbit (medium 5.4)
- [CVE-2023-46947](https://insights.sbomify.com/CVE-2023-46947/): Subrion remote command execution vulnerability (high 8.8)
- [CVE-2023-46945](https://insights.sbomify.com/CVE-2023-46945/): Server-side request forgery in qd-today:qd (critical 9.1)
- [CVE-2023-46944](https://insights.sbomify.com/CVE-2023-46944/): Code injection in gitkraken:gitlens (high 7.8)
- [CVE-2023-46943](https://insights.sbomify.com/CVE-2023-46943/): EverShop at risk to unauthorized access via weak HMAC secret (critical 9.1)
- [CVE-2023-46942](https://insights.sbomify.com/CVE-2023-46942/): EverShop vulnerable to improper authorization in GraphQL endpoints (high 7.5)
- [CVE-2023-4694](https://insights.sbomify.com/CVE-2023-4694/): Denial of service in HP OfficeJet Pro Printers (high 7.5)
- [CVE-2023-46935](https://insights.sbomify.com/CVE-2023-46935/): Cross-site scripting in eyoucms:eyoucms (medium 5.4)
- [CVE-2023-46932](https://insights.sbomify.com/CVE-2023-46932/): Memory corruption in gpac:gpac (critical 9.8)
- [CVE-2023-46931](https://insights.sbomify.com/CVE-2023-46931/): Memory corruption in gpac:gpac (medium 5.5)
- [CVE-2023-46930](https://insights.sbomify.com/CVE-2023-46930/): Memory corruption in gpac:gpac (medium 5.5)
- [CVE-2023-4693](https://insights.sbomify.com/CVE-2023-4693/): Grub2: out-of-bounds read at fs/ntfs.c (medium 5.3)
- [CVE-2023-46929](https://insights.sbomify.com/CVE-2023-46929/): Denial of service in gpac:gpac (high 7.5)
- [CVE-2023-46928](https://insights.sbomify.com/CVE-2023-46928/): Memory corruption in gpac:gpac (medium 5.5)
- [CVE-2023-46927](https://insights.sbomify.com/CVE-2023-46927/): Memory corruption in gpac:gpac (medium 5.5)
- [CVE-2023-46925](https://insights.sbomify.com/CVE-2023-46925/): Reportico Cross-site Scripting vulnerability (medium 4.8)
- [CVE-2023-4692](https://insights.sbomify.com/CVE-2023-4692/): Grub2: out-of-bounds write at fs/ntfs.c may lead to unsigned code execution (high 7.5)
- [CVE-2023-46919](https://insights.sbomify.com/CVE-2023-46919/): Hardcoded credentials in fedirtsapana:simple http server (medium 6.3)
- [CVE-2023-46918](https://insights.sbomify.com/CVE-2023-46918/): Misconfiguration in fedirtsapana:simple http server plus (medium 4.6)
- [CVE-2023-46916](https://insights.sbomify.com/CVE-2023-46916/): Auth bypass in maximawatches:maxima max pro power firmware (medium 4.3)
- [CVE-2023-46914](https://insights.sbomify.com/CVE-2023-46914/): SQL injection in bookingcalendar project:bookingcalendar (critical 9.8)
- [CVE-2023-46911](https://insights.sbomify.com/CVE-2023-46911/): Cross-site scripting in jspxcms:jspxcms (medium 6.1)
- [CVE-2023-4691](https://insights.sbomify.com/CVE-2023-4691/): Bookly < 22.4 - Admin+ SQLi (high 7.2)
- [CVE-2023-46906](https://insights.sbomify.com/CVE-2023-46906/): juzawebCMS Incorrect Access Control vulnerability (medium 4.9)
- [CVE-2023-4690](https://insights.sbomify.com/CVE-2023-4690/): Elementor Addon Elements <= 1.12.7 - Cross-Site Request Forgery (medium 5.4)
- [CVE-2023-46894](https://insights.sbomify.com/CVE-2023-46894/): esptool allows attackers to view sensitive information via weak cryptographic algorithm (high 7.5)
- [CVE-2023-46892](https://insights.sbomify.com/CVE-2023-46892/): Auth bypass in meross:msh30q firmware (high 8.8)
- [CVE-2023-4689](https://insights.sbomify.com/CVE-2023-4689/): Elementor Addon Elements <= 1.12.7 - Cross-Site Request Forgery (medium 5.4)
- [CVE-2023-46889](https://insights.sbomify.com/CVE-2023-46889/): Information disclosure in meross:msh30q firmware (medium 5.7)
- [CVE-2023-46887](https://insights.sbomify.com/CVE-2023-46887/): Path traversal in iteachyou:dreamer cms (high 7.5)
- [CVE-2023-46886](https://insights.sbomify.com/CVE-2023-46886/): Path traversal in iteachyou:dreamer cms (critical 9.1)
- [CVE-2023-4688](https://insights.sbomify.com/CVE-2023-4688/): Information disclosure in Acronis Agent (medium 4.4)
- [CVE-2023-46871](https://insights.sbomify.com/CVE-2023-46871/): Denial of service in gpac:gpac (medium 5.3)
- [CVE-2023-46870](https://insights.sbomify.com/CVE-2023-46870/): extcap/nrf_sniffer_ble.py, extcap/nrf_sniffer_ble.sh, extcap/SnifferAPI/*.py in Nordic Semiconductor nRF Sniffer for Bluetooth LE 3.0.0, 3.1 (high 7.3)
- [CVE-2023-4687](https://insights.sbomify.com/CVE-2023-4687/): PageLayer < 1.7.7 - Unauthenticated Stored XSS (medium 6.1)
- [CVE-2023-46867](https://insights.sbomify.com/CVE-2023-46867/): Null dereference in color:demoiccmax (medium 6.5)
- [CVE-2023-46866](https://insights.sbomify.com/CVE-2023-46866/): Memory corruption in color:demoiccmax (medium 6.5)
- [CVE-2023-46865](https://insights.sbomify.com/CVE-2023-46865/): Code injection in craterapp:crater (high 7.2)
- [CVE-2023-46864](https://insights.sbomify.com/CVE-2023-46864/): Path traversal in peppermint:peppermint (medium 5.3)
- [CVE-2023-46863](https://insights.sbomify.com/CVE-2023-46863/): Path traversal in peppermint:peppermint (high 7.5)
- [CVE-2023-46862](https://insights.sbomify.com/CVE-2023-46862/): Null dereference in linux:linux kernel (medium 4.7)
- [CVE-2023-4686](https://insights.sbomify.com/CVE-2023-4686/): WP Customer Reviews <= 3.6.6 - Authenticated (Subscriber+) Sensitive Information Exposure (medium 4.3)
- [CVE-2023-46858](https://insights.sbomify.com/CVE-2023-46858/): Cross-site scripting in moodle:moodle (medium 5.4)
- [CVE-2023-46857](https://insights.sbomify.com/CVE-2023-46857/): Cross-site scripting in squidex.io:squidex (medium 5.4)
- [CVE-2023-46854](https://insights.sbomify.com/CVE-2023-46854/): Cross-site scripting in proxmox:proxmox-widget-toolkit (medium 5.4)
- [CVE-2023-46853](https://insights.sbomify.com/CVE-2023-46853/): Memory corruption in memcached:memcached (critical 9.8)
- [CVE-2023-46852](https://insights.sbomify.com/CVE-2023-46852/): Memory corruption in memcached:memcached (high 7.5)
- [CVE-2023-46851](https://insights.sbomify.com/CVE-2023-46851/): Apache Allura: sensitive information exposure via import (medium 4.9)
- [CVE-2023-46850](https://insights.sbomify.com/CVE-2023-46850/): Use after free in Access Server (critical 9.8)
- [CVE-2023-4685](https://insights.sbomify.com/CVE-2023-4685/): CVE-2023-4685 (high 7.8)
- [CVE-2023-46849](https://insights.sbomify.com/CVE-2023-46849/): Denial of service in Access Server (high 7.5)
- [CVE-2023-46848](https://insights.sbomify.com/CVE-2023-46848/): Squid: denial of service in ftp (high 8.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/200/