# Vulnerabilities published in 2023


- [CVE-2023-45996](https://insights.sbomify.com/CVE-2023-45996/): SQL injection in slims:senayan library management system (high 8.8)
- [CVE-2023-45992](https://insights.sbomify.com/CVE-2023-45992/): Cross-site scripting in commscope:ruckus cloudpath enrollment system (critical 9.6)
- [CVE-2023-45990](https://insights.sbomify.com/CVE-2023-45990/): Privilege escalation in wenwen-ai:wenwenai cms (high 8.0)
- [CVE-2023-4599](https://insights.sbomify.com/CVE-2023-4599/): Email Encoder <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-45985](https://insights.sbomify.com/CVE-2023-45985/): Memory corruption in totolink:a7000r firmware (high 7.5)
- [CVE-2023-45984](https://insights.sbomify.com/CVE-2023-45984/): Memory corruption in totolink:a7000r firmware (high 8.8)
- [CVE-2023-4598](https://insights.sbomify.com/CVE-2023-4598/): Slimstat Analytics <= 5.0.9 - Authenticated (Contributor+) Blind SQL Injection via Shortcode (high 8.8)
- [CVE-2023-4597](https://insights.sbomify.com/CVE-2023-4597/): Slimstat Analytics <= 5.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-45966](https://insights.sbomify.com/CVE-2023-45966/): Server-side request forgery in remark42:remark42 (high 7.5)
- [CVE-2023-4596](https://insights.sbomify.com/CVE-2023-4596/): Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2023-45958](https://insights.sbomify.com/CVE-2023-45958/): Cross-site scripting in thirtybees:thirty bees (medium 6.1)
- [CVE-2023-45957](https://insights.sbomify.com/CVE-2023-45957/): Cross-site scripting in thirtybees:thirty bees (medium 5.4)
- [CVE-2023-45956](https://insights.sbomify.com/CVE-2023-45956/): Denial of service in govee:led strip firmware (high 7.5)
- [CVE-2023-45955](https://insights.sbomify.com/CVE-2023-45955/): Denial of service in nanoleaf:lightstrip firmware (high 7.5)
- [CVE-2023-45952](https://insights.sbomify.com/CVE-2023-45952/): File upload in lylme:lylme spage (critical 9.8)
- [CVE-2023-45951](https://insights.sbomify.com/CVE-2023-45951/): SQL injection in lylme:lylme spage (critical 9.8)
- [CVE-2023-4595](https://insights.sbomify.com/CVE-2023-4595/): Insertion of Sensitive Information into Externally-Accessible File or Directory in BVRP Software SLmail (high 7.5)
- [CVE-2023-4594](https://insights.sbomify.com/CVE-2023-4594/): Cross-site Scripting in BVRP Software SLmail (medium 6.1)
- [CVE-2023-45935](https://insights.sbomify.com/CVE-2023-45935/): Qt 6 through 6.6 was discovered to contain a NULL pointer dereference via the function QXcbConnection::initializeAllAtoms(). (medium 4.2)
- [CVE-2023-45931](https://insights.sbomify.com/CVE-2023-45931/): Null dereference in mesa3d:mesa (high 7.5)
- [CVE-2023-4593](https://insights.sbomify.com/CVE-2023-4593/): Path Traversal in BVRP Software SLmail (medium 6.5)
- [CVE-2023-45929](https://insights.sbomify.com/CVE-2023-45929/): Memory corruption in jedsoft:s-lang (critical 9.1)
- [CVE-2023-45927](https://insights.sbomify.com/CVE-2023-45927/): Denial of service in jedsoft:s-lang (critical 9.1)
- [CVE-2023-45925](https://insights.sbomify.com/CVE-2023-45925/): GNU Midnight Commander 4.8.29-146-g299d9a2fb was discovered to contain a NULL pointer dereference via the function x_error_handler() at tty/x11conn.c. (not scored)
- [CVE-2023-45924](https://insights.sbomify.com/CVE-2023-45924/): libglxproto.c in OpenGL libglvnd bb06db5a was discovered to contain a segmentation violation via the function glXGetDrawableScreen(). (critical 9.8)
- [CVE-2023-45922](https://insights.sbomify.com/CVE-2023-45922/): Denial of service in mesa3d:mesa (medium 4.3)
- [CVE-2023-45920](https://insights.sbomify.com/CVE-2023-45920/): Null dereference in xfig project:xfig (medium 4.2)
- [CVE-2023-4592](https://insights.sbomify.com/CVE-2023-4592/): Improper Neutralization of Input During Web Page Generation in WPN-XM Serverstack (medium 6.1)
- [CVE-2023-45919](https://insights.sbomify.com/CVE-2023-45919/): Memory corruption in mesa3d:mesa (medium 5.3)
- [CVE-2023-45913](https://insights.sbomify.com/CVE-2023-45913/): Null dereference in mesa3d:mesa (medium 6.2)
- [CVE-2023-45912](https://insights.sbomify.com/CVE-2023-45912/): Auth bypass in wipotec:comscale (high 7.5)
- [CVE-2023-45911](https://insights.sbomify.com/CVE-2023-45911/): Auth bypass in wipotec:comscale (critical 9.8)
- [CVE-2023-4591](https://insights.sbomify.com/CVE-2023-4591/): Inclusion of Functionality from Untrusted Control Sphere in WPN-XM Serverstack (high 7.5)
- [CVE-2023-45909](https://insights.sbomify.com/CVE-2023-45909/): Open redirect in zzzcms:zzzphp (medium 6.1)
- [CVE-2023-45908](https://insights.sbomify.com/CVE-2023-45908/): Homarr before v0.14.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Notebook widget. (medium 6.1)
- [CVE-2023-45907](https://insights.sbomify.com/CVE-2023-45907/): Cross-site request forgery in iteachyou:dreamer cms (high 8.8)
- [CVE-2023-45906](https://insights.sbomify.com/CVE-2023-45906/): Cross-site request forgery in iteachyou:dreamer cms (high 8.8)
- [CVE-2023-45905](https://insights.sbomify.com/CVE-2023-45905/): Cross-site request forgery in iteachyou:dreamer cms (high 8.8)
- [CVE-2023-45904](https://insights.sbomify.com/CVE-2023-45904/): Cross-site request forgery in iteachyou:dreamer cms (high 8.8)
- [CVE-2023-45903](https://insights.sbomify.com/CVE-2023-45903/): Cross-site request forgery in iteachyou:dreamer cms (high 8.8)
- [CVE-2023-45902](https://insights.sbomify.com/CVE-2023-45902/): Cross-site request forgery in iteachyou:dreamer cms (high 8.8)
- [CVE-2023-45901](https://insights.sbomify.com/CVE-2023-45901/): Cross-site request forgery in iteachyou:dreamer cms (high 8.8)
- [CVE-2023-4590](https://insights.sbomify.com/CVE-2023-4590/): Buffer Overflow vulnerability in Frhed (high 7.3)
- [CVE-2023-45899](https://insights.sbomify.com/CVE-2023-45899/): Auth bypass in idnovate:superuser (high 7.5)
- [CVE-2023-45898](https://insights.sbomify.com/CVE-2023-45898/): Use after free in linux:linux kernel (high 7.8)
- [CVE-2023-45897](https://insights.sbomify.com/CVE-2023-45897/): Memory corruption in namjaejeon:exfatprogs (medium 5.5)
- [CVE-2023-45896](https://insights.sbomify.com/CVE-2023-45896/): ntfs3 in the Linux kernel through 6.8.0 allows a physically proximate attacker to read kernel memory by mounting a filesystem (e.g., if a Li (high 7.1)
- [CVE-2023-45894](https://insights.sbomify.com/CVE-2023-45894/): Security feature bypass in parallels:remote application server (critical 10.0)
- [CVE-2023-45893](https://insights.sbomify.com/CVE-2023-45893/): Missing authorization in floorsightsoftware:customer portal (high 7.5)
- [CVE-2023-45892](https://insights.sbomify.com/CVE-2023-45892/): Missing authorization in floorsightsoftware:insight (high 7.5)
- [CVE-2023-4589](https://insights.sbomify.com/CVE-2023-4589/): Insufficient verification of data authenticity vulnerability in Delinea Secret Server (critical 9.1)
- [CVE-2023-45889](https://insights.sbomify.com/CVE-2023-45889/): Cross-site scripting in classlink:oneclick (medium 6.1)
- [CVE-2023-45887](https://insights.sbomify.com/CVE-2023-45887/): Other in nintendo:ds wireless communication (critical 9.8)
- [CVE-2023-45886](https://insights.sbomify.com/CVE-2023-45886/): Denial of service in f5:big-ip global traffic manager (high 7.5)
- [CVE-2023-45885](https://insights.sbomify.com/CVE-2023-45885/): NASA Open MCT Cross Site Scripting vulnerability (medium 5.4)
- [CVE-2023-45884](https://insights.sbomify.com/CVE-2023-45884/): NASA Open MCT Cross Site Request Forgery (CSRF) vulnerability (medium 6.5)
- [CVE-2023-45883](https://insights.sbomify.com/CVE-2023-45883/): Privilege escalation in enghouse:qumu (high 7.8)
- [CVE-2023-45881](https://insights.sbomify.com/CVE-2023-45881/): Cross-site scripting in gibbonedu:gibbon (medium 6.1)
- [CVE-2023-45880](https://insights.sbomify.com/CVE-2023-45880/): Path traversal in gibbonedu:gibbon (high 7.2)
- [CVE-2023-4588](https://insights.sbomify.com/CVE-2023-4588/): File accessibility vulnerability in Delinea Secret Server (medium 6.8)
- [CVE-2023-45879](https://insights.sbomify.com/CVE-2023-45879/): Cross-site scripting in gibbonedu:gibbon (medium 5.4)
- [CVE-2023-45878](https://insights.sbomify.com/CVE-2023-45878/): File upload in gibbonedu:gibbon (critical 9.8)
- [CVE-2023-45875](https://insights.sbomify.com/CVE-2023-45875/): Information disclosure in couchbase:couchbase server (high 7.5)
- [CVE-2023-45874](https://insights.sbomify.com/CVE-2023-45874/): Denial of service in couchbase:couchbase server (medium 4.3)
- [CVE-2023-45873](https://insights.sbomify.com/CVE-2023-45873/): Denial of service in couchbase:couchbase server (medium 6.5)
- [CVE-2023-45872](https://insights.sbomify.com/CVE-2023-45872/): An issue was discovered in Qt before 6.2.11 and 6.3.x through 6.6.x before 6.6.1. (medium 6.5)
- [CVE-2023-45871](https://insights.sbomify.com/CVE-2023-45871/): Memory corruption in debian:debian linux (high 7.5)
- [CVE-2023-4587](https://insights.sbomify.com/CVE-2023-4587/): Insecure direct object reference in ZKTeco ZEM800 (high 8.3)
- [CVE-2023-45869](https://insights.sbomify.com/CVE-2023-45869/): Command injection in ilias:ilias (critical 9.0)
- [CVE-2023-45868](https://insights.sbomify.com/CVE-2023-45868/): Path traversal in ilias:ilias (high 8.1)
- [CVE-2023-45867](https://insights.sbomify.com/CVE-2023-45867/): Path traversal in ilias:ilias (medium 6.5)
- [CVE-2023-45866](https://insights.sbomify.com/CVE-2023-45866/): Auth bypass in apple:ipados (medium 6.3)
- [CVE-2023-45864](https://insights.sbomify.com/CVE-2023-45864/): Race condition in samsung:exynos 1080 firmware (medium 4.0)
- [CVE-2023-45863](https://insights.sbomify.com/CVE-2023-45863/): Race condition in linux:linux kernel (medium 6.4)
- [CVE-2023-45862](https://insights.sbomify.com/CVE-2023-45862/): Memory corruption in linux:linux kernel (medium 5.5)
- [CVE-2023-45860](https://insights.sbomify.com/CVE-2023-45860/): Hazelcast Platform permission checking in CSV File Source connector (medium 6.5)
- [CVE-2023-4586](https://insights.sbomify.com/CVE-2023-4586/): Hotrod-client: hot rod client does not enable hostname validation when using tls that lead to a mitm attack (high 7.4)
- [CVE-2023-45859](https://insights.sbomify.com/CVE-2023-45859/): Missing permission checks on Hazelcast client protocol (high 7.6)
- [CVE-2023-45858](https://insights.sbomify.com/CVE-2023-45858/): Path traversal in PRTG Network Monitor (high 8.6)
- [CVE-2023-45857](https://insights.sbomify.com/CVE-2023-45857/): Axios Cross-Site Request Forgery Vulnerability (medium 6.5)
- [CVE-2023-45856](https://insights.sbomify.com/CVE-2023-45856/): File upload in qdpm:qdpm (critical 9.8)
- [CVE-2023-45855](https://insights.sbomify.com/CVE-2023-45855/): Path traversal in qdpm:qdpm (high 7.5)
- [CVE-2023-45854](https://insights.sbomify.com/CVE-2023-45854/): A Business Logic vulnerability in Shopkit 1.0 allows an attacker to add products with negative quantities to the shopping cart via the qtd p (high 7.5)
- [CVE-2023-45853](https://insights.sbomify.com/CVE-2023-45853/): pyminizip affected by zlib's integer overflow/heap based buffer overflow vulnerability due to vulnerable dependency (high 8.8)
- [CVE-2023-45852](https://insights.sbomify.com/CVE-2023-45852/): Command injection in viessmann:vitogate 300 firmware (critical 9.8)
- [CVE-2023-45851](https://insights.sbomify.com/CVE-2023-45851/): Auth bypass in ctrlX HMI Web Panel - WR21 (WR2107) (high 8.8)
- [CVE-2023-4585](https://insights.sbomify.com/CVE-2023-4585/): Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2 (high 8.8)
- [CVE-2023-45849](https://insights.sbomify.com/CVE-2023-45849/): Arbitrary Code Execution in Helix Core (critical 9.0)
- [CVE-2023-45847](https://insights.sbomify.com/CVE-2023-45847/): Playbook Plugin Crash via Run Checklist (medium 4.3)
- [CVE-2023-45846](https://insights.sbomify.com/CVE-2023-45846/): Other in Intel(R) Power Gadget software for macOS (medium 5.5)
- [CVE-2023-45845](https://insights.sbomify.com/CVE-2023-45845/): Denial of service in Intel(R) Wireless Bluetooth(R) products for Windows (medium 4.4)
- [CVE-2023-45844](https://insights.sbomify.com/CVE-2023-45844/): Security feature bypass in ctrlX HMI Web Panel - WR21 (WR2107) (high 7.3)
- [CVE-2023-45842](https://insights.sbomify.com/CVE-2023-45842/): Supply chain in Buildroot (high 8.1)
- [CVE-2023-45841](https://insights.sbomify.com/CVE-2023-45841/): Supply chain in Buildroot (high 8.1)
- [CVE-2023-45840](https://insights.sbomify.com/CVE-2023-45840/): Supply chain in Buildroot (high 8.1)
- [CVE-2023-4584](https://insights.sbomify.com/CVE-2023-4584/): Memory corruption in Firefox (high 8.8)
- [CVE-2023-45839](https://insights.sbomify.com/CVE-2023-45839/): Supply chain in Buildroot (high 8.1)
- [CVE-2023-45838](https://insights.sbomify.com/CVE-2023-45838/): Supply chain in Buildroot (high 8.1)
- [CVE-2023-45837](https://insights.sbomify.com/CVE-2023-45837/): WordPress Ultimate Taxonomy Manager Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-45836](https://insights.sbomify.com/CVE-2023-45836/): WordPress Ultimate Taxonomy Manager Plugin <= 2.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/208/