# Vulnerabilities published in 2023


- [CVE-2023-43361](https://insights.sbomify.com/CVE-2023-43361/): Memory corruption in xiph:vorbis-tools (high 7.8)
- [CVE-2023-43360](https://insights.sbomify.com/CVE-2023-43360/): Cross-site scripting in cmsmadesimple:cms made simple (medium 5.4)
- [CVE-2023-4336](https://insights.sbomify.com/CVE-2023-4336/): Misconfiguration in LSI Storage Authority (LSA) (critical 9.8)
- [CVE-2023-43359](https://insights.sbomify.com/CVE-2023-43359/): Cross-site scripting in cmsmadesimple:cms made simple (medium 5.4)
- [CVE-2023-43358](https://insights.sbomify.com/CVE-2023-43358/): Cross-site scripting in cmsmadesimple:cms made simple (medium 5.4)
- [CVE-2023-43357](https://insights.sbomify.com/CVE-2023-43357/): Cross-site scripting in cmsmadesimple:cms made simple (medium 5.4)
- [CVE-2023-43356](https://insights.sbomify.com/CVE-2023-43356/): Cross-site scripting in cmsmadesimple:cms made simple (medium 5.4)
- [CVE-2023-43355](https://insights.sbomify.com/CVE-2023-43355/): Cross-site scripting in cmsmadesimple:cms made simple (medium 5.4)
- [CVE-2023-43354](https://insights.sbomify.com/CVE-2023-43354/): Cross-site scripting in cmsmadesimple:cms made simple (medium 5.4)
- [CVE-2023-43353](https://insights.sbomify.com/CVE-2023-43353/): Cross-site scripting in cmsmadesimple:cms made simple (medium 5.4)
- [CVE-2023-43352](https://insights.sbomify.com/CVE-2023-43352/): Code injection in cmsmadesimple:cms made simple (high 7.8)
- [CVE-2023-4335](https://insights.sbomify.com/CVE-2023-4335/): Broadcom RAID Controller Web server (nginx) is serving private server-side files without any authentication on Linux (high 7.5)
- [CVE-2023-43346](https://insights.sbomify.com/CVE-2023-43346/): Cross-site scripting in opensolution:quick cms (medium 5.4)
- [CVE-2023-43345](https://insights.sbomify.com/CVE-2023-43345/): Cross-site scripting in opensolution:quick cms (high 8.6)
- [CVE-2023-43344](https://insights.sbomify.com/CVE-2023-43344/): Cross-site scripting in opensolution:quick cms (medium 5.4)
- [CVE-2023-43343](https://insights.sbomify.com/CVE-2023-43343/): Cross-site scripting in opensolution:quick cms (medium 5.4)
- [CVE-2023-43342](https://insights.sbomify.com/CVE-2023-43342/): Cross-site scripting in opensolution:quick cms (medium 5.4)
- [CVE-2023-43341](https://insights.sbomify.com/CVE-2023-43341/): Evolution CMS Cross-site Scripting vulnerability (medium 6.1)
- [CVE-2023-43340](https://insights.sbomify.com/CVE-2023-43340/): Evolution CMS Cross-site Scripting vulnerability (medium 5.2)
- [CVE-2023-4334](https://insights.sbomify.com/CVE-2023-4334/): Broadcom RAID Controller Web server (nginx) is serving private files without any authentication (high 7.5)
- [CVE-2023-43339](https://insights.sbomify.com/CVE-2023-43339/): Cross-site scripting in cmsmadesimple:cms made simple (medium 6.1)
- [CVE-2023-43338](https://insights.sbomify.com/CVE-2023-43338/): Memory corruption in cesanta:mjs (critical 9.8)
- [CVE-2023-43336](https://insights.sbomify.com/CVE-2023-43336/): Missing authorization in sangoma:freepbx (high 8.8)
- [CVE-2023-43331](https://insights.sbomify.com/CVE-2023-43331/): Cross-site scripting in small crm project:small crm (medium 5.4)
- [CVE-2023-4333](https://insights.sbomify.com/CVE-2023-4333/): Broadcom RAID Controller web interface doesn’t enforce SSL cipher ordering by server (medium 5.5)
- [CVE-2023-43326](https://insights.sbomify.com/CVE-2023-43326/): Cross-site scripting in moosocial:moosocial (medium 6.1)
- [CVE-2023-43325](https://insights.sbomify.com/CVE-2023-43325/): Cross-site scripting in moosocial:moosocial (medium 6.1)
- [CVE-2023-43323](https://insights.sbomify.com/CVE-2023-43323/): Server-side request forgery in moosocial:moosocial (medium 6.5)
- [CVE-2023-43322](https://insights.sbomify.com/CVE-2023-43322/): Command injection in zpesystems:nodegrid os (high 8.8)
- [CVE-2023-43321](https://insights.sbomify.com/CVE-2023-43321/): File upload in dcnetworks:dcfw-1800-sdc firmware (high 8.8)
- [CVE-2023-43320](https://insights.sbomify.com/CVE-2023-43320/): Auth bypass in proxmox:backup server (high 8.8)
- [CVE-2023-4332](https://insights.sbomify.com/CVE-2023-4332/): Broadcom RAID Controller web interface is vulnerable due to Improper permissions on the log file (high 7.5)
- [CVE-2023-43319](https://insights.sbomify.com/CVE-2023-43319/): Cross-site scripting in icewarp:webclient (medium 6.1)
- [CVE-2023-43318](https://insights.sbomify.com/CVE-2023-43318/): Privilege escalation in tp-link:tl-sg2210p firmware (high 8.8)
- [CVE-2023-43317](https://insights.sbomify.com/CVE-2023-43317/): Privilege escalation in coign:coign (high 8.8)
- [CVE-2023-43314](https://insights.sbomify.com/CVE-2023-43314/): Memory corruption in PMG2005-T20B (high 7.5)
- [CVE-2023-4331](https://insights.sbomify.com/CVE-2023-4331/): Weak cryptography in LSI Storage Authority (LSA) (high 7.5)
- [CVE-2023-43309](https://insights.sbomify.com/CVE-2023-43309/): Cross-site scripting in webmin:webmin (medium 4.8)
- [CVE-2023-43305](https://insights.sbomify.com/CVE-2023-43305/): Information disclosure in linecorp:line (high 8.2)
- [CVE-2023-43304](https://insights.sbomify.com/CVE-2023-43304/): Information disclosure in linecorp:line (high 8.2)
- [CVE-2023-43303](https://insights.sbomify.com/CVE-2023-43303/): Information disclosure in linecorp:line (high 8.2)
- [CVE-2023-43302](https://insights.sbomify.com/CVE-2023-43302/): Information disclosure in linecorp:line (high 8.2)
- [CVE-2023-43301](https://insights.sbomify.com/CVE-2023-43301/): Information disclosure in linecorp:line (high 8.2)
- [CVE-2023-43300](https://insights.sbomify.com/CVE-2023-43300/): Information disclosure in linecorp:line (high 8.2)
- [CVE-2023-43299](https://insights.sbomify.com/CVE-2023-43299/): Information disclosure in linecorp:line (medium 5.3)
- [CVE-2023-43298](https://insights.sbomify.com/CVE-2023-43298/): Information disclosure in linecorp:line (medium 5.3)
- [CVE-2023-43297](https://insights.sbomify.com/CVE-2023-43297/): Information disclosure in linecorp:line (medium 5.4)
- [CVE-2023-43295](https://insights.sbomify.com/CVE-2023-43295/): Cross-site request forgery in clickstudios:passwordstate (low 3.5)
- [CVE-2023-43292](https://insights.sbomify.com/CVE-2023-43292/): Cross-site scripting in rems:my food recipe (medium 6.1)
- [CVE-2023-43291](https://insights.sbomify.com/CVE-2023-43291/): Deserialization in emlog:emlog (critical 9.8)
- [CVE-2023-4329](https://insights.sbomify.com/CVE-2023-4329/): Misconfiguration in LSI Storage Authority (LSA) (critical 9.8)
- [CVE-2023-43284](https://insights.sbomify.com/CVE-2023-43284/): Code injection in dlink:dir-846 firmware (high 8.8)
- [CVE-2023-43281](https://insights.sbomify.com/CVE-2023-43281/): Memory corruption in nothings:stb image.h (medium 6.5)
- [CVE-2023-4328](https://insights.sbomify.com/CVE-2023-4328/): Information disclosure in LSI Storage Authority (LSA) (medium 5.5)
- [CVE-2023-43279](https://insights.sbomify.com/CVE-2023-43279/): Null dereference in broadcom:tcpreplay (medium 6.5)
- [CVE-2023-43278](https://insights.sbomify.com/CVE-2023-43278/): Cross-site request forgery in seacms:seacms (high 8.8)
- [CVE-2023-43275](https://insights.sbomify.com/CVE-2023-43275/): Cross-site request forgery in dedecms:dedecms (high 8.8)
- [CVE-2023-43274](https://insights.sbomify.com/CVE-2023-43274/): SQL injection in phpjabbers:php shopping cart (high 7.5)
- [CVE-2023-43271](https://insights.sbomify.com/CVE-2023-43271/): Missing authorization in 70mai:a500s firmware (critical 9.1)
- [CVE-2023-43270](https://insights.sbomify.com/CVE-2023-43270/): Code injection in dst-admin project:dst-admin (critical 9.8)
- [CVE-2023-4327](https://insights.sbomify.com/CVE-2023-4327/): Information disclosure in LSI Storage Authority (LSA) (medium 5.5)
- [CVE-2023-43269](https://insights.sbomify.com/CVE-2023-43269/): File upload in pigcms:pigcms (critical 9.8)
- [CVE-2023-43268](https://insights.sbomify.com/CVE-2023-43268/): Deserialization in deyue remote vehicle management system project:deyue remote vehicle management system (high 8.8)
- [CVE-2023-43267](https://insights.sbomify.com/CVE-2023-43267/): Cross-site scripting in emlog:emlog (medium 5.4)
- [CVE-2023-43263](https://insights.sbomify.com/CVE-2023-43263/): Cross-site scripting in froala:froala editor (medium 6.1)
- [CVE-2023-43261](https://insights.sbomify.com/CVE-2023-43261/): Information disclosure in milesight:ur32 firmware (high 7.5)
- [CVE-2023-43260](https://insights.sbomify.com/CVE-2023-43260/): Cross-site scripting in milesight:ur32 firmware (medium 6.1)
- [CVE-2023-4326](https://insights.sbomify.com/CVE-2023-4326/): Weak cryptography in LSI Storage Authority (LSA) (high 7.5)
- [CVE-2023-43256](https://insights.sbomify.com/CVE-2023-43256/): Path traversal in gladysassistant:gladys assistant (medium 6.5)
- [CVE-2023-43252](https://insights.sbomify.com/CVE-2023-43252/): Memory corruption in xnview:nconvert (high 7.8)
- [CVE-2023-43251](https://insights.sbomify.com/CVE-2023-43251/): Memory corruption in xnview:nconvert (high 7.8)
- [CVE-2023-43250](https://insights.sbomify.com/CVE-2023-43250/): Memory corruption in xnview:nconvert (high 7.8)
- [CVE-2023-4325](https://insights.sbomify.com/CVE-2023-4325/): Broadcom RAID Controller web interface is vulnerable due to usage of Libcurl with LSA has known vulnerabilities (critical 9.8)
- [CVE-2023-43242](https://insights.sbomify.com/CVE-2023-43242/): Memory corruption in dlink:dir-816a2 firmware (high 8.8)
- [CVE-2023-43241](https://insights.sbomify.com/CVE-2023-43241/): Memory corruption in dlink:dir-823g firmware (critical 9.8)
- [CVE-2023-43240](https://insights.sbomify.com/CVE-2023-43240/): Memory corruption in dlink:dir-816 a2 firmware (critical 9.8)
- [CVE-2023-4324](https://insights.sbomify.com/CVE-2023-4324/): Misconfiguration in LSI Storage Authority (LSA) (critical 9.8)
- [CVE-2023-43239](https://insights.sbomify.com/CVE-2023-43239/): Memory corruption in dlink:dir-816 a2 firmware (high 8.8)
- [CVE-2023-43238](https://insights.sbomify.com/CVE-2023-43238/): Memory corruption in dlink:dir-816 a2 firmware (high 8.8)
- [CVE-2023-43237](https://insights.sbomify.com/CVE-2023-43237/): Memory corruption in dlink:dir-816 a2 firmware (high 8.8)
- [CVE-2023-43236](https://insights.sbomify.com/CVE-2023-43236/): Memory corruption in dlink:dir-816 a2 firmware (high 8.8)
- [CVE-2023-43235](https://insights.sbomify.com/CVE-2023-43235/): Memory corruption in dlink:dir-823g firmware (critical 9.8)
- [CVE-2023-43234](https://insights.sbomify.com/CVE-2023-43234/): Code injection in dedebiz:dedebiz (critical 9.8)
- [CVE-2023-43233](https://insights.sbomify.com/CVE-2023-43233/): Cross-site scripting in yzncms:yzncms (medium 6.1)
- [CVE-2023-43232](https://insights.sbomify.com/CVE-2023-43232/): Cross-site scripting in dedebiz:dedebiz (medium 5.4)
- [CVE-2023-4323](https://insights.sbomify.com/CVE-2023-4323/): Broadcom RAID Controller web interface is vulnerable to improper session management of active sessions on Gateway setup (critical 9.8)
- [CVE-2023-43226](https://insights.sbomify.com/CVE-2023-43226/): File upload in dedecms:dedecms (high 8.8)
- [CVE-2023-43222](https://insights.sbomify.com/CVE-2023-43222/): Code injection in seacms:seacms (critical 9.8)
- [CVE-2023-4322](https://insights.sbomify.com/CVE-2023-4322/): Heap-based Buffer Overflow in radareorg/radare2 (high 7.3)
- [CVE-2023-43216](https://insights.sbomify.com/CVE-2023-43216/): Path traversal in seacms:seacms (critical 9.8)
- [CVE-2023-4321](https://insights.sbomify.com/CVE-2023-4321/): Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit (high 8.3)
- [CVE-2023-43208](https://insights.sbomify.com/CVE-2023-43208/): NextGen Healthcare Mirth Connect Deserialization of Untrusted Data (critical 9.8, exploited in the wild)
- [CVE-2023-43207](https://insights.sbomify.com/CVE-2023-43207/): Command injection in dlink:dwl-6610ap firmware (high 8.0)
- [CVE-2023-43206](https://insights.sbomify.com/CVE-2023-43206/): Command injection in dlink:dwl-6610ap firmware (high 8.0)
- [CVE-2023-43204](https://insights.sbomify.com/CVE-2023-43204/): Command injection in dlink:dwl-6610ap firmware (high 8.0)
- [CVE-2023-43203](https://insights.sbomify.com/CVE-2023-43203/): Memory corruption in dlink:dwl-6610ap firmware (high 8.0)
- [CVE-2023-43202](https://insights.sbomify.com/CVE-2023-43202/): Command injection in dlink:dwl-6610ap firmware (high 8.0)
- [CVE-2023-43201](https://insights.sbomify.com/CVE-2023-43201/): Memory corruption in dlink:di-7200g firmware (critical 9.8)
- [CVE-2023-43200](https://insights.sbomify.com/CVE-2023-43200/): Memory corruption in dlink:di-7200g firmware (critical 9.8)
- [CVE-2023-4320](https://insights.sbomify.com/CVE-2023-4320/): Satellite: arithmetic overflow in satellite (high 7.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/225/