# Vulnerabilities published in 2023


- [CVE-2023-4410](https://insights.sbomify.com/CVE-2023-4410/): TOTOLINK EX1200L setDiagnosisCfg os command injection (medium 6.3)
- [CVE-2023-44099](https://insights.sbomify.com/CVE-2023-44099/): Other in EMUI (high 7.5)
- [CVE-2023-44098](https://insights.sbomify.com/CVE-2023-44098/): Information disclosure in EMUI (high 7.5)
- [CVE-2023-44097](https://insights.sbomify.com/CVE-2023-44097/): Information disclosure in EMUI (high 7.5)
- [CVE-2023-44096](https://insights.sbomify.com/CVE-2023-44096/): Auth bypass in EMUI (high 7.5)
- [CVE-2023-44095](https://insights.sbomify.com/CVE-2023-44095/): Use after free in EMUI (high 7.5)
- [CVE-2023-44094](https://insights.sbomify.com/CVE-2023-44094/): Memory corruption in EMUI (medium 5.3)
- [CVE-2023-44093](https://insights.sbomify.com/CVE-2023-44093/): Weak cryptography in EMUI (high 7.5)
- [CVE-2023-44092](https://insights.sbomify.com/CVE-2023-44092/): OS Command Injection (high 7.6)
- [CVE-2023-44091](https://insights.sbomify.com/CVE-2023-44091/): Unauth Time-Based SQL Injection (high 7.5)
- [CVE-2023-44090](https://insights.sbomify.com/CVE-2023-44090/): UnautH SQL Injection (medium 6.8)
- [CVE-2023-4409](https://insights.sbomify.com/CVE-2023-4409/): NBS&HappySoftWeChat unrestricted upload (medium 6.3)
- [CVE-2023-44089](https://insights.sbomify.com/CVE-2023-44089/): XSS in Visual Console (medium 6.1)
- [CVE-2023-44088](https://insights.sbomify.com/CVE-2023-44088/): SQL Injection in Visual Console (medium 5.9)
- [CVE-2023-44087](https://insights.sbomify.com/CVE-2023-44087/): Memory corruption in Tecnomatix Plant Simulation V2201 (high 7.8)
- [CVE-2023-44086](https://insights.sbomify.com/CVE-2023-44086/): Memory corruption in Tecnomatix Plant Simulation V2201 (high 7.8)
- [CVE-2023-44085](https://insights.sbomify.com/CVE-2023-44085/): Memory corruption in Tecnomatix Plant Simulation V2201 (high 7.8)
- [CVE-2023-44084](https://insights.sbomify.com/CVE-2023-44084/): Memory corruption in Tecnomatix Plant Simulation V2201 (high 7.8)
- [CVE-2023-44083](https://insights.sbomify.com/CVE-2023-44083/): Memory corruption in Tecnomatix Plant Simulation V2201 (high 7.8)
- [CVE-2023-44082](https://insights.sbomify.com/CVE-2023-44082/): Memory corruption in Tecnomatix Plant Simulation V2201 (high 7.8)
- [CVE-2023-44081](https://insights.sbomify.com/CVE-2023-44081/): Memory corruption in Tecnomatix Plant Simulation V2201 (high 7.8)
- [CVE-2023-44080](https://insights.sbomify.com/CVE-2023-44080/): Command injection in pgyer:codefever (critical 9.8)
- [CVE-2023-4408](https://insights.sbomify.com/CVE-2023-4408/): Parsing large DNS messages may cause excessive CPU load (high 7.5)
- [CVE-2023-44077](https://insights.sbomify.com/CVE-2023-44077/): Security feature bypass in studionetworksolutions:sharebrowser (critical 9.8)
- [CVE-2023-44075](https://insights.sbomify.com/CVE-2023-44075/): Cross-site scripting in small crm project:small crm (medium 5.4)
- [CVE-2023-4407](https://insights.sbomify.com/CVE-2023-4407/): Codecanyon Credit Lite POST Request account_statement sql injection (medium 6.3)
- [CVE-2023-44061](https://insights.sbomify.com/CVE-2023-44061/): File upload in simple and nice shopping cart script project:simple and nice shopping cart script (high 8.8)
- [CVE-2023-4406](https://insights.sbomify.com/CVE-2023-4406/): XSS in KC Group's E-Commerce Software (medium 6.1)
- [CVE-2023-44048](https://insights.sbomify.com/CVE-2023-44048/): Cross-site scripting in oretnom23:expense tracker (medium 5.4)
- [CVE-2023-44047](https://insights.sbomify.com/CVE-2023-44047/): SQL injection in oretnom23:toll tax management system (high 7.2)
- [CVE-2023-44044](https://insights.sbomify.com/CVE-2023-44044/): SQL injection in superstorefinder:super store finder (high 7.2)
- [CVE-2023-44043](https://insights.sbomify.com/CVE-2023-44043/): Cross-site scripting in blackcat-cms:blackcat cms (medium 6.1)
- [CVE-2023-44042](https://insights.sbomify.com/CVE-2023-44042/): Cross-site scripting in blackcat-cms:blackcat cms (medium 5.4)
- [CVE-2023-44040](https://insights.sbomify.com/CVE-2023-44040/): Cross-site scripting in veridiumid:veridiumad (medium 6.1)
- [CVE-2023-4404](https://insights.sbomify.com/CVE-2023-4404/): Donation Forms by Charitable <= 1.7.0.12 - Unauthenticated Privilege Escalation (critical 9.8)
- [CVE-2023-44039](https://insights.sbomify.com/CVE-2023-44039/): Auth bypass in veridiumid:veridiumad (critical 9.1)
- [CVE-2023-44038](https://insights.sbomify.com/CVE-2023-44038/): Other in veridiumid:veridiumad (medium 6.5)
- [CVE-2023-44037](https://insights.sbomify.com/CVE-2023-44037/): Information disclosure in zpesystems:nodegrid os (high 7.5)
- [CVE-2023-44031](https://insights.sbomify.com/CVE-2023-44031/): Missing authorization in reprisesoftware:reprise license manager (high 7.5)
- [CVE-2023-44025](https://insights.sbomify.com/CVE-2023-44025/): SQL injection in addify:free gifts (critical 9.8)
- [CVE-2023-44024](https://insights.sbomify.com/CVE-2023-44024/): SQL injection in knowband:one page checkout\, social login \& mailchimp (critical 9.8)
- [CVE-2023-44023](https://insights.sbomify.com/CVE-2023-44023/): Memory corruption in tendacn:ac10u firmware (critical 9.8)
- [CVE-2023-44022](https://insights.sbomify.com/CVE-2023-44022/): Memory corruption in tendacn:ac10u firmware (critical 9.8)
- [CVE-2023-44021](https://insights.sbomify.com/CVE-2023-44021/): Memory corruption in tendacn:ac10u firmware (critical 9.8)
- [CVE-2023-44020](https://insights.sbomify.com/CVE-2023-44020/): Memory corruption in tendacn:ac10u firmware (critical 9.8)
- [CVE-2023-4402](https://insights.sbomify.com/CVE-2023-4402/): Essential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via products (high 8.1)
- [CVE-2023-44019](https://insights.sbomify.com/CVE-2023-44019/): Memory corruption in tendacn:ac10u firmware (high 8.8)
- [CVE-2023-44018](https://insights.sbomify.com/CVE-2023-44018/): Memory corruption in tendacn:ac10u firmware (high 8.8)
- [CVE-2023-44017](https://insights.sbomify.com/CVE-2023-44017/): Memory corruption in tendacn:ac10u firmware (high 8.8)
- [CVE-2023-44016](https://insights.sbomify.com/CVE-2023-44016/): Memory corruption in tendacn:ac10u firmware (high 8.8)
- [CVE-2023-44015](https://insights.sbomify.com/CVE-2023-44015/): Memory corruption in tendacn:ac10u firmware (high 8.8)
- [CVE-2023-44014](https://insights.sbomify.com/CVE-2023-44014/): Memory corruption in tendacn:ac10u firmware (high 8.8)
- [CVE-2023-44013](https://insights.sbomify.com/CVE-2023-44013/): Memory corruption in tendacn:ac10u firmware (high 8.8)
- [CVE-2023-44012](https://insights.sbomify.com/CVE-2023-44012/): Cross-site scripting in mojoportal:mojoportal (medium 6.1)
- [CVE-2023-44011](https://insights.sbomify.com/CVE-2023-44011/): Code injection in mojoportal:mojoportal (critical 9.8)
- [CVE-2023-4401](https://insights.sbomify.com/CVE-2023-4401/): Command injection in Dell SmartFabric Storage Software (high 7.8)
- [CVE-2023-44009](https://insights.sbomify.com/CVE-2023-44009/): File upload in mojoportal:mojoportal (critical 9.8)
- [CVE-2023-44008](https://insights.sbomify.com/CVE-2023-44008/): File upload in mojoportal:mojoportal (critical 9.8)
- [CVE-2023-44001](https://insights.sbomify.com/CVE-2023-44001/): Information disclosure in linecorp:line (medium 5.4)
- [CVE-2023-44000](https://insights.sbomify.com/CVE-2023-44000/): Information disclosure in linecorp:line (medium 5.4)
- [CVE-2023-4400](https://insights.sbomify.com/CVE-2023-4400/): Information disclosure in Skyhigh Secure Web Gateway (SWG) (medium 6.2)
- [CVE-2023-43999](https://insights.sbomify.com/CVE-2023-43999/): Hardcoded credentials in linecorp:line (medium 5.4)
- [CVE-2023-43998](https://insights.sbomify.com/CVE-2023-43998/): Information disclosure in linecorp:line (medium 5.4)
- [CVE-2023-43997](https://insights.sbomify.com/CVE-2023-43997/): Information disclosure in linecorp:line (medium 5.4)
- [CVE-2023-43996](https://insights.sbomify.com/CVE-2023-43996/): Information disclosure in linecorp:line (medium 5.4)
- [CVE-2023-43995](https://insights.sbomify.com/CVE-2023-43995/): Information disclosure in linecorp:line (medium 5.4)
- [CVE-2023-43994](https://insights.sbomify.com/CVE-2023-43994/): Information disclosure in linecorp:line (medium 5.4)
- [CVE-2023-43993](https://insights.sbomify.com/CVE-2023-43993/): Information disclosure in linecorp:line (medium 5.4)
- [CVE-2023-43992](https://insights.sbomify.com/CVE-2023-43992/): Information disclosure in linecorp:line (medium 5.4)
- [CVE-2023-43991](https://insights.sbomify.com/CVE-2023-43991/): Information disclosure in linecorp:line (medium 5.4)
- [CVE-2023-43990](https://insights.sbomify.com/CVE-2023-43990/): Information disclosure in linecorp:line (medium 5.4)
- [CVE-2023-4399](https://insights.sbomify.com/CVE-2023-4399/): Security feature bypass in Grafana Enterprise (medium 6.6)
- [CVE-2023-43989](https://insights.sbomify.com/CVE-2023-43989/): Information disclosure in linecorp:line (medium 5.4)
- [CVE-2023-43988](https://insights.sbomify.com/CVE-2023-43988/): Hardcoded credentials in linecorp:line (medium 5.4)
- [CVE-2023-43986](https://insights.sbomify.com/CVE-2023-43986/): SQL injection in dmconcept:configurator (critical 9.8)
- [CVE-2023-43985](https://insights.sbomify.com/CVE-2023-43985/): SQL injection in sunnytoo:stblogsearch (critical 9.8)
- [CVE-2023-43984](https://insights.sbomify.com/CVE-2023-43984/): Missing authorization in advanced export products orders cron csv excel project:advanced export products orders cron csv excel (high 7.5)
- [CVE-2023-43983](https://insights.sbomify.com/CVE-2023-43983/): SQL injection in presto-changeo:attribute grid (critical 9.8)
- [CVE-2023-43982](https://insights.sbomify.com/CVE-2023-43982/): Server-side request forgery in bontheme:socialfeed - photos \& video using instagram api (critical 9.8)
- [CVE-2023-43981](https://insights.sbomify.com/CVE-2023-43981/): Deserialization in presto-changeo:test site creator (critical 9.8)
- [CVE-2023-43980](https://insights.sbomify.com/CVE-2023-43980/): SQL injection in presto-changeo:testsitecreator (critical 9.8)
- [CVE-2023-4398](https://insights.sbomify.com/CVE-2023-4398/): Integer overflow in ATP series firmware (high 7.5)
- [CVE-2023-43979](https://insights.sbomify.com/CVE-2023-43979/): SQL injection in prestahero:ybc blog (critical 9.8)
- [CVE-2023-43976](https://insights.sbomify.com/CVE-2023-43976/): Race condition in catonetworks:cato client (high 8.1)
- [CVE-2023-43971](https://insights.sbomify.com/CVE-2023-43971/): Cross-site scripting in lizhipay:acg-faka (medium 6.1)
- [CVE-2023-4397](https://insights.sbomify.com/CVE-2023-4397/): Memory corruption in USG FLEX 50(W) series firmware (medium 4.4)
- [CVE-2023-43962](https://insights.sbomify.com/CVE-2023-43962/): Cross Site Scripting vulnerability in Xunrui CMS Public Edition v.4.6.1 allows a remote attacker to execute arbitrary code via the project n (medium 4.8)
- [CVE-2023-43961](https://insights.sbomify.com/CVE-2023-43961/): SaToken authentication bypass vulnerability (high 8.8)
- [CVE-2023-43960](https://insights.sbomify.com/CVE-2023-43960/): Privilege escalation in dlink:dph-400se firmware (high 8.8)
- [CVE-2023-43959](https://insights.sbomify.com/CVE-2023-43959/): Command injection in yealink:sip-t19p-e2 firmware (high 8.8)
- [CVE-2023-43958](https://insights.sbomify.com/CVE-2023-43958/): File upload in kishan0725:hospital management system (critical 9.8)
- [CVE-2023-43955](https://insights.sbomify.com/CVE-2023-43955/): Code injection in fedirtsapana:tv bro (critical 9.8)
- [CVE-2023-43953](https://insights.sbomify.com/CVE-2023-43953/): Cross-site scripting in sscms:sscms (medium 5.4)
- [CVE-2023-43952](https://insights.sbomify.com/CVE-2023-43952/): Cross-site scripting in sscms project:sscms (medium 5.4)
- [CVE-2023-43951](https://insights.sbomify.com/CVE-2023-43951/): Cross-site scripting in sscms project:sscms (medium 5.4)
- [CVE-2023-4395](https://insights.sbomify.com/CVE-2023-4395/): Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit (high 8.1)
- [CVE-2023-43944](https://insights.sbomify.com/CVE-2023-43944/): Cross-site scripting in oretnom23:task management system (medium 5.4)
- [CVE-2023-4394](https://insights.sbomify.com/CVE-2023-4394/): Memory leak in btrfs_get_dev_args_from_path() (medium 6.7)
- [CVE-2023-4393](https://insights.sbomify.com/CVE-2023-4393/): HTML and SMTP Injection in LiquidFiles (medium 5.4)
- [CVE-2023-4392](https://insights.sbomify.com/CVE-2023-4392/): Control iD Gerencia Web Cookie cleartext storage (low 3.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/220/