# Vulnerabilities published in 2023


- [CVE-2023-43909](https://insights.sbomify.com/CVE-2023-43909/): SQL injection in hospital management system project:hospital management system (critical 9.1)
- [CVE-2023-43907](https://insights.sbomify.com/CVE-2023-43907/): Memory corruption in optipng project:optipng (high 7.8)
- [CVE-2023-43906](https://insights.sbomify.com/CVE-2023-43906/): Cross-site scripting in onworks:xolo cms (medium 6.1)
- [CVE-2023-43905](https://insights.sbomify.com/CVE-2023-43905/): Information disclosure in writercms:writercms (high 7.5)
- [CVE-2023-43902](https://insights.sbomify.com/CVE-2023-43902/): Auth bypass in emudhra:emsigner (high 8.8)
- [CVE-2023-43901](https://insights.sbomify.com/CVE-2023-43901/): Missing authorization in emudhra:emsigner (medium 5.4)
- [CVE-2023-43900](https://insights.sbomify.com/CVE-2023-43900/): Missing authorization in emudhra:emsigner (medium 6.5)
- [CVE-2023-4390](https://insights.sbomify.com/CVE-2023-4390/): Popup box < 3.7.2 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2023-43899](https://insights.sbomify.com/CVE-2023-43899/): SQL injection in hansuncms project:hansuncms (critical 9.8)
- [CVE-2023-43898](https://insights.sbomify.com/CVE-2023-43898/): Null dereference in nothings:stb image.h (medium 5.5)
- [CVE-2023-43896](https://insights.sbomify.com/CVE-2023-43896/): Memory corruption in macrium:reflect (high 7.8)
- [CVE-2023-43893](https://insights.sbomify.com/CVE-2023-43893/): Command injection in netis-systems:n3m firmware (critical 9.8)
- [CVE-2023-43892](https://insights.sbomify.com/CVE-2023-43892/): Command injection in netis-systems:n3m firmware (critical 9.8)
- [CVE-2023-43891](https://insights.sbomify.com/CVE-2023-43891/): Command injection in netis-systems:n3m firmware (critical 9.8)
- [CVE-2023-43890](https://insights.sbomify.com/CVE-2023-43890/): Command injection in netis-systems:n3m firmware (high 8.8)
- [CVE-2023-4389](https://insights.sbomify.com/CVE-2023-4389/): Kernel: btrfs: double free in btrfs_get_root_ref() (high 7.0)
- [CVE-2023-43887](https://insights.sbomify.com/CVE-2023-43887/): Memory corruption in struktur:libde265 (high 8.1)
- [CVE-2023-43886](https://insights.sbomify.com/CVE-2023-43886/): Memory corruption in tenda:rx9 pro firmware (high 7.1)
- [CVE-2023-43885](https://insights.sbomify.com/CVE-2023-43885/): Denial of service in tenda:rx9 pro firmware (high 8.1)
- [CVE-2023-43884](https://insights.sbomify.com/CVE-2023-43884/): Subrion CMS Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2023-4388](https://insights.sbomify.com/CVE-2023-4388/): EventON < 2.2 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-43879](https://insights.sbomify.com/CVE-2023-43879/): Cross-site scripting in ritecms:ritecms (medium 4.8)
- [CVE-2023-43878](https://insights.sbomify.com/CVE-2023-43878/): Cross-site scripting in ritecms:ritecms (medium 5.4)
- [CVE-2023-43877](https://insights.sbomify.com/CVE-2023-43877/): Cross-site scripting in ritecms:ritecms (medium 4.8)
- [CVE-2023-43876](https://insights.sbomify.com/CVE-2023-43876/): Cross-site scripting in octobercms:october (medium 5.4)
- [CVE-2023-43875](https://insights.sbomify.com/CVE-2023-43875/): Subrion CMS vulnerable to Cross-site Scripting (medium 6.1)
- [CVE-2023-43874](https://insights.sbomify.com/CVE-2023-43874/): Cross-site scripting in e107:e107 cms (medium 5.4)
- [CVE-2023-43873](https://insights.sbomify.com/CVE-2023-43873/): Cross-site scripting in e107:e107 cms (medium 5.4)
- [CVE-2023-43872](https://insights.sbomify.com/CVE-2023-43872/): Cross-site scripting in cmsmadesimple:cms made simple (medium 5.4)
- [CVE-2023-43871](https://insights.sbomify.com/CVE-2023-43871/): Cross-site scripting in wbce:wbce cms (medium 5.4)
- [CVE-2023-43870](https://insights.sbomify.com/CVE-2023-43870/): Hardcoded credentials in Net2 (high 8.1)
- [CVE-2023-4387](https://insights.sbomify.com/CVE-2023-4387/): Kernel: vmxnet3: use-after-free in vmxnet3_rq_alloc_rx_buf() (high 7.1)
- [CVE-2023-43869](https://insights.sbomify.com/CVE-2023-43869/): Memory corruption in dlink:dir-619l firmware (critical 9.8)
- [CVE-2023-43868](https://insights.sbomify.com/CVE-2023-43868/): Memory corruption in dlink:dir-619l firmware (high 7.5)
- [CVE-2023-43867](https://insights.sbomify.com/CVE-2023-43867/): Memory corruption in dlink:dir-619l firmware (high 7.5)
- [CVE-2023-43866](https://insights.sbomify.com/CVE-2023-43866/): Memory corruption in dlink:dir-619l firmware (high 7.5)
- [CVE-2023-43865](https://insights.sbomify.com/CVE-2023-43865/): Memory corruption in dlink:dir-619l firmware (high 7.5)
- [CVE-2023-43864](https://insights.sbomify.com/CVE-2023-43864/): Memory corruption in dlink:dir-619l firmware (high 7.5)
- [CVE-2023-43863](https://insights.sbomify.com/CVE-2023-43863/): Memory corruption in dlink:dir-619l firmware (high 7.5)
- [CVE-2023-43862](https://insights.sbomify.com/CVE-2023-43862/): Memory corruption in dlink:dir-619l firmware (high 7.5)
- [CVE-2023-43861](https://insights.sbomify.com/CVE-2023-43861/): Memory corruption in dlink:dir-619l firmware (high 7.5)
- [CVE-2023-43860](https://insights.sbomify.com/CVE-2023-43860/): Memory corruption in dlink:dir-619l firmware (high 7.5)
- [CVE-2023-4386](https://insights.sbomify.com/CVE-2023-4386/): Essential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via queries (high 8.1)
- [CVE-2023-43857](https://insights.sbomify.com/CVE-2023-43857/): Cross-site scripting in iteachyou:dreamer cms (medium 5.4)
- [CVE-2023-43856](https://insights.sbomify.com/CVE-2023-43856/): Path traversal in iteachyou:dreamer cms (high 7.5)
- [CVE-2023-43850](https://insights.sbomify.com/CVE-2023-43850/): Denial of service in aten:pe6208 firmware (medium 6.5)
- [CVE-2023-4385](https://insights.sbomify.com/CVE-2023-4385/): Kernel: jfs: null pointer dereference in dbfree() (medium 5.5)
- [CVE-2023-43849](https://insights.sbomify.com/CVE-2023-43849/): Missing authorization in aten:pe6208 firmware (medium 6.5)
- [CVE-2023-43848](https://insights.sbomify.com/CVE-2023-43848/): Missing authorization in aten:pe6208 firmware (high 8.0)
- [CVE-2023-43847](https://insights.sbomify.com/CVE-2023-43847/): Missing authorization in aten:pe6208 firmware (medium 5.3)
- [CVE-2023-43846](https://insights.sbomify.com/CVE-2023-43846/): Missing authorization in aten:pe6208 firmware (medium 5.3)
- [CVE-2023-43845](https://insights.sbomify.com/CVE-2023-43845/): Hardcoded credentials in aten:pe6208 firmware (critical 9.8)
- [CVE-2023-43844](https://insights.sbomify.com/CVE-2023-43844/): Hardcoded credentials in aten:pe6208 firmware (high 8.0)
- [CVE-2023-43843](https://insights.sbomify.com/CVE-2023-43843/): Information disclosure in aten:pe6208 firmware (high 7.3)
- [CVE-2023-43842](https://insights.sbomify.com/CVE-2023-43842/): Missing authorization in aten:pe6208 firmware (high 7.3)
- [CVE-2023-4384](https://insights.sbomify.com/CVE-2023-4384/): MaximaTech Portal Executivo Cookie missing encryption (low 3.7)
- [CVE-2023-43838](https://insights.sbomify.com/CVE-2023-43838/): File upload in personal-management-system:personal management system (high 7.8)
- [CVE-2023-43836](https://insights.sbomify.com/CVE-2023-43836/): SQL injection in jizhicms:jizhicms (medium 6.5)
- [CVE-2023-43835](https://insights.sbomify.com/CVE-2023-43835/): Code injection in superstorefinder:super store finder (high 8.8)
- [CVE-2023-43830](https://insights.sbomify.com/CVE-2023-43830/): Subrion CMS XSS in /panel/configuration/financial/ (medium 5.4)
- [CVE-2023-4383](https://insights.sbomify.com/CVE-2023-4383/): MicroWorld eScan Anti-Virus runasroot incorrect execution-assigned permissions (high 7.8)
- [CVE-2023-43828](https://insights.sbomify.com/CVE-2023-43828/): Subrion CMS Cross-site Scripting vulnerability in /panel/languages (medium 5.4)
- [CVE-2023-43826](https://insights.sbomify.com/CVE-2023-43826/): Apache Guacamole: Integer overflow in handling of VNC image buffers (high 7.5)
- [CVE-2023-43825](https://insights.sbomify.com/CVE-2023-43825/): Path traversal in Shihonkanri Plus (high 7.8)
- [CVE-2023-43824](https://insights.sbomify.com/CVE-2023-43824/): Delta Electronics Delta Industrial Automation DOPSoft DPS File wTitleTextLen Buffer Overflow Remote Code Execution (high 8.8)
- [CVE-2023-43823](https://insights.sbomify.com/CVE-2023-43823/): Delta Electronics Delta Industrial Automation DOPSoft DPS File wTTitleLen Buffer Overflow Remote Code Execution (high 8.8)
- [CVE-2023-43822](https://insights.sbomify.com/CVE-2023-43822/): Delta Electronics Delta Industrial Automation DOPSoft DPS File wLogTitlesTimeLen Buffer Overflow Remote Code Execution (high 8.8)
- [CVE-2023-43821](https://insights.sbomify.com/CVE-2023-43821/): Memory corruption in DOPSoft (high 8.8)
- [CVE-2023-43820](https://insights.sbomify.com/CVE-2023-43820/): Memory corruption in DOPSoft (high 8.8)
- [CVE-2023-4382](https://insights.sbomify.com/CVE-2023-4382/): tdevs Hyip Rio Profile Settings settings cross site scripting (low 3.5)
- [CVE-2023-43819](https://insights.sbomify.com/CVE-2023-43819/): Delta Electronics Delta Industrial Automation DOPSoft DPS File InitialMacroLen Buffer Overflow Remote Code Execution (high 8.8)
- [CVE-2023-43818](https://insights.sbomify.com/CVE-2023-43818/): Delta Electronics Delta Industrial Automation DOPSoft DPS File wTextLen Buffer Overflow Remote Code Execution (high 8.8)
- [CVE-2023-43817](https://insights.sbomify.com/CVE-2023-43817/): Delta Electronics Delta Industrial Automation DOPSoft DPS File wMailContentLen Buffer Overflow Remote Code Execution (high 7.5)
- [CVE-2023-43816](https://insights.sbomify.com/CVE-2023-43816/): Delta Electronics Delta Industrial Automation DOPSoft DPS File wKPFStringLen Buffer Overflow Remote Code Execution (medium 6.3)
- [CVE-2023-43815](https://insights.sbomify.com/CVE-2023-43815/): Delta Electronics Delta Industrial Automation DOPSoft DPS File wScreenDESCTextLen Buffer Overflow Remote Code Execution (high 7.1)
- [CVE-2023-43814](https://insights.sbomify.com/CVE-2023-43814/): Exposure of poll options and votes to unauthorized users in Discourse (low 3.7)
- [CVE-2023-43813](https://insights.sbomify.com/CVE-2023-43813/): glpi Authenticated SQL Injection (medium 6.5)
- [CVE-2023-43810](https://insights.sbomify.com/CVE-2023-43810/): opentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metrics (high 7.5)
- [CVE-2023-4381](https://insights.sbomify.com/CVE-2023-4381/): Unverified Password Change in instantsoft/icms2 (medium 4.3)
- [CVE-2023-43809](https://insights.sbomify.com/CVE-2023-43809/): Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled (high 7.5)
- [CVE-2023-43805](https://insights.sbomify.com/CVE-2023-43805/): Nexkey allows users to bypass authentication of Bull dashboard (high 7.5)
- [CVE-2023-43804](https://insights.sbomify.com/CVE-2023-43804/): `Cookie` HTTP header isn't stripped on cross-origin redirects (medium 5.9)
- [CVE-2023-43803](https://insights.sbomify.com/CVE-2023-43803/): Path traversal in Arduino Create Agent (medium 6.1)
- [CVE-2023-43802](https://insights.sbomify.com/CVE-2023-43802/): Path traversal in Arduino Create Agent (high 7.1)
- [CVE-2023-43801](https://insights.sbomify.com/CVE-2023-43801/): Path traversal in Arduino Create Agent (medium 6.1)
- [CVE-2023-43800](https://insights.sbomify.com/CVE-2023-43800/): Insufficient Verification of Data Authenticity in Arduino Create Agent (high 7.3)
- [CVE-2023-4380](https://insights.sbomify.com/CVE-2023-4380/): Platform: token exposed at importing project (medium 6.3)
- [CVE-2023-43799](https://insights.sbomify.com/CVE-2023-43799/): The Altair Desktop Client Does Not Sanitize External URLs before passing them to the underlying system (medium 5.0)
- [CVE-2023-43798](https://insights.sbomify.com/CVE-2023-43798/): BigBlueButton Blind SSRF When Uploading Presentation (mitigation bypass) (medium 5.6)
- [CVE-2023-43797](https://insights.sbomify.com/CVE-2023-43797/): BigBlueButton Stored Cross-site Scripting vulnerability at Guest Lobby (medium 6.3)
- [CVE-2023-43796](https://insights.sbomify.com/CVE-2023-43796/): Synapse vulnerable to leak of remote user device information (medium 5.3)
- [CVE-2023-43795](https://insights.sbomify.com/CVE-2023-43795/): WPS Server Side Request Forgery in GeoServer (high 8.6)
- [CVE-2023-43794](https://insights.sbomify.com/CVE-2023-43794/): SQL Injection in nocodb (medium 6.5)
- [CVE-2023-43793](https://insights.sbomify.com/CVE-2023-43793/): Misskey allows users to bypass authentication of Bull dashboard (high 7.5)
- [CVE-2023-43792](https://insights.sbomify.com/CVE-2023-43792/): baserCMS Code Injection Vulnerability in Mail Form Feature (medium 5.3)
- [CVE-2023-43791](https://insights.sbomify.com/CVE-2023-43791/): Label Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session Tokens (critical 9.8)
- [CVE-2023-43790](https://insights.sbomify.com/CVE-2023-43790/): iTop vulnerable to XSS in friendlyname in object details (medium 5.7)
- [CVE-2023-4379](https://insights.sbomify.com/CVE-2023-4379/): Incorrect Authorization in GitLab (high 8.1)
- [CVE-2023-43789](https://insights.sbomify.com/CVE-2023-43789/): Libxpm: out of bounds read on xpm with corrupted colormap (medium 5.5)
- [CVE-2023-43788](https://insights.sbomify.com/CVE-2023-43788/): Libxpm: out of bounds read in xpmcreatexpmimagefrombuffer() (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/221/