# Vulnerabilities published in 2023


- [CVE-2023-43199](https://insights.sbomify.com/CVE-2023-43199/): Memory corruption in dlink:di-7200g firmware (critical 9.8)
- [CVE-2023-43198](https://insights.sbomify.com/CVE-2023-43198/): Memory corruption in dlink:di-7200g firmware (critical 9.8)
- [CVE-2023-43197](https://insights.sbomify.com/CVE-2023-43197/): Memory corruption in dlink:di-7200g firmware (critical 9.8)
- [CVE-2023-43196](https://insights.sbomify.com/CVE-2023-43196/): Memory corruption in dlink:di-7200g firmware (critical 9.8)
- [CVE-2023-43194](https://insights.sbomify.com/CVE-2023-43194/): Missing authorization in rcos:submitty (medium 5.3)
- [CVE-2023-43193](https://insights.sbomify.com/CVE-2023-43193/): Cross-site scripting in rcos:submitty (medium 6.1)
- [CVE-2023-43192](https://insights.sbomify.com/CVE-2023-43192/): SQL injection in jrecms:springbootcms (high 8.8)
- [CVE-2023-43191](https://insights.sbomify.com/CVE-2023-43191/): Cross-site scripting in jrecms:springbootcms (medium 5.4)
- [CVE-2023-43187](https://insights.sbomify.com/CVE-2023-43187/): Code injection in nodebb:nodebb (critical 9.8)
- [CVE-2023-43183](https://insights.sbomify.com/CVE-2023-43183/): Missing authorization in reprisesoftware:reprise license manager (high 8.8)
- [CVE-2023-4318](https://insights.sbomify.com/CVE-2023-4318/): Herd Effects < 5.2.4 - Effect Deletion via CSRF (medium 4.3)
- [CVE-2023-43177](https://insights.sbomify.com/CVE-2023-43177/): Other in crushftp:crushftp (critical 9.8)
- [CVE-2023-43176](https://insights.sbomify.com/CVE-2023-43176/): Deserialization in afterlogic:aurora files (high 8.8)
- [CVE-2023-4317](https://insights.sbomify.com/CVE-2023-4317/): Incorrect Authorization in GitLab (medium 4.3)
- [CVE-2023-4316](https://insights.sbomify.com/CVE-2023-4316/): Zod 3.22.2 - Regular expression Denial of Service (high 7.5)
- [CVE-2023-43154](https://insights.sbomify.com/CVE-2023-43154/): Auth bypass in macs cms project:macs cms (critical 9.8)
- [CVE-2023-4315](https://insights.sbomify.com/CVE-2023-4315/): Woo Custom Emails <= 2.2 - Reflected Cross-Site Scripting via wcemails_edit (medium 6.1)
- [CVE-2023-43149](https://insights.sbomify.com/CVE-2023-43149/): Cross-site request forgery in spa-cart:spa-cart (high 8.8)
- [CVE-2023-43148](https://insights.sbomify.com/CVE-2023-43148/): Cross-site request forgery in spa-cart:spa-cart (high 8.1)
- [CVE-2023-43147](https://insights.sbomify.com/CVE-2023-43147/): Cross-site request forgery in phpjabbers:limo booking software (high 8.8)
- [CVE-2023-43144](https://insights.sbomify.com/CVE-2023-43144/): SQL injection in projectworlds:asset management system project in php (critical 9.8)
- [CVE-2023-43141](https://insights.sbomify.com/CVE-2023-43141/): Missing authorization in totolink:a3700r firmware (critical 9.8)
- [CVE-2023-4314](https://insights.sbomify.com/CVE-2023-4314/): wpDataTables < 2.1.66 - Admin+ PHP Object Injection (high 7.2)
- [CVE-2023-43139](https://insights.sbomify.com/CVE-2023-43139/): Command injection in franfinance:franfinance (critical 9.8)
- [CVE-2023-43138](https://insights.sbomify.com/CVE-2023-43138/): Command injection in tp-link:tl-er5120g firmware (high 8.8)
- [CVE-2023-43137](https://insights.sbomify.com/CVE-2023-43137/): Command injection in tp-link:tl-er5120g firmware (high 8.8)
- [CVE-2023-43135](https://insights.sbomify.com/CVE-2023-43135/): Missing authorization in tp-link:tl-er5120g firmware (critical 9.8)
- [CVE-2023-43134](https://insights.sbomify.com/CVE-2023-43134/): Missing authorization in netis-systems:360r firmware (critical 9.8)
- [CVE-2023-43132](https://insights.sbomify.com/CVE-2023-43132/): SQL injection in szvone:vmqphp (medium 6.5)
- [CVE-2023-43131](https://insights.sbomify.com/CVE-2023-43131/): Memory corruption in maxiguvenlik:general device manager (critical 9.8)
- [CVE-2023-43130](https://insights.sbomify.com/CVE-2023-43130/): Command injection in dlink:dir-806 firmware (critical 9.8)
- [CVE-2023-43129](https://insights.sbomify.com/CVE-2023-43129/): Command injection in dlink:dir-806 firmware (critical 9.8)
- [CVE-2023-43128](https://insights.sbomify.com/CVE-2023-43128/): Command injection in dlink:dir-806 firmware (critical 9.8)
- [CVE-2023-43125](https://insights.sbomify.com/CVE-2023-43125/): BIG-IP APM Clients TunnelCrack vulnerability (medium 6.8)
- [CVE-2023-43124](https://insights.sbomify.com/CVE-2023-43124/): BIG-IP APM Clients TunnelCrack vulnerability (medium 5.3)
- [CVE-2023-43123](https://insights.sbomify.com/CVE-2023-43123/): Apache Storm: Local Information Disclosure Vulnerability in Storm-core on Unix-Like systems due temporary files (medium 5.5)
- [CVE-2023-43122](https://insights.sbomify.com/CVE-2023-43122/): Information disclosure in samsung:exynos 1080 firmware (medium 4.8)
- [CVE-2023-43121](https://insights.sbomify.com/CVE-2023-43121/): Path traversal in extremenetworks:exos (high 7.5)
- [CVE-2023-43120](https://insights.sbomify.com/CVE-2023-43120/): Privilege escalation in extremenetworks:exos (high 8.8)
- [CVE-2023-43119](https://insights.sbomify.com/CVE-2023-43119/): Privilege escalation in extremenetworks:exos (critical 9.8)
- [CVE-2023-43118](https://insights.sbomify.com/CVE-2023-43118/): Cross-site request forgery in extremenetworks:exos (high 8.8)
- [CVE-2023-43116](https://insights.sbomify.com/CVE-2023-43116/): Buildkite Elastic CI for AWS symbolic link following vulnerability (high 7.8)
- [CVE-2023-43115](https://insights.sbomify.com/CVE-2023-43115/): Code injection in artifex:ghostscript (high 8.8)
- [CVE-2023-43114](https://insights.sbomify.com/CVE-2023-43114/): Memory corruption in qt:qt (medium 5.5)
- [CVE-2023-4311](https://insights.sbomify.com/CVE-2023-4311/): Vrm 360 3D Model Viewer <= 1.2.1 - Contributor+ Arbitrary File Upload Leading to RCE (high 8.8)
- [CVE-2023-43103](https://insights.sbomify.com/CVE-2023-43103/): Cross-site scripting in zimbra:collaboration (medium 6.1)
- [CVE-2023-43102](https://insights.sbomify.com/CVE-2023-43102/): Cross-site scripting in zimbra:collaboration (medium 6.1)
- [CVE-2023-4310](https://insights.sbomify.com/CVE-2023-4310/): Command injection in Privileged Remote Access (PRA) (critical 9.8)
- [CVE-2023-43091](https://insights.sbomify.com/CVE-2023-43091/): Gnome-maps: gnome maps is vulnerable to a code injection attack (similar to xss) via its service.json (critical 9.8)
- [CVE-2023-43090](https://insights.sbomify.com/CVE-2023-43090/): Gnome-shell: screenshot tool allows viewing open windows when session is locked (medium 5.5)
- [CVE-2023-4309](https://insights.sbomify.com/CVE-2023-4309/): SQL injection in Internet Election Service (critical 10.0)
- [CVE-2023-43089](https://insights.sbomify.com/CVE-2023-43089/): Misconfiguration in Dell Rugged Control Center (medium 4.4)
- [CVE-2023-43088](https://insights.sbomify.com/CVE-2023-43088/): Memory corruption in CPG BIOS (high 7.2)
- [CVE-2023-43087](https://insights.sbomify.com/CVE-2023-43087/): Information disclosure in PowerScale OneFS (medium 4.3)
- [CVE-2023-43086](https://insights.sbomify.com/CVE-2023-43086/): Privilege escalation in Dell Command Configure (DCC) (high 7.3)
- [CVE-2023-43082](https://insights.sbomify.com/CVE-2023-43082/): Security feature bypass in Unity (high 8.6)
- [CVE-2023-43081](https://insights.sbomify.com/CVE-2023-43081/): Misconfiguration in PowerProtect Agent for File System (medium 4.0)
- [CVE-2023-4308](https://insights.sbomify.com/CVE-2023-4308/): User Submitted Posts <= 20230809 - Unauthenticated Stored Cross-Site Scripting via 'user-submitted-content' (high 7.2)
- [CVE-2023-43079](https://insights.sbomify.com/CVE-2023-43079/): Privilege escalation in Dell OpenManage Server Administrator (high 7.3)
- [CVE-2023-43078](https://insights.sbomify.com/CVE-2023-43078/): Privilege escalation in Dell Client Platform, Dell Dock Firmware (medium 6.7)
- [CVE-2023-43076](https://insights.sbomify.com/CVE-2023-43076/): Denial of service in PowerScale OneFS (medium 6.5)
- [CVE-2023-43074](https://insights.sbomify.com/CVE-2023-43074/): Path traversal in Unity (medium 5.2)
- [CVE-2023-43073](https://insights.sbomify.com/CVE-2023-43073/): Other in Dell SmartFabric Storage Software (medium 4.3)
- [CVE-2023-43072](https://insights.sbomify.com/CVE-2023-43072/): Missing authorization in Dell SmartFabric Storage Software (medium 4.4)
- [CVE-2023-43071](https://insights.sbomify.com/CVE-2023-43071/): Cross-site scripting in Dell SmartFabric Storage Software (medium 4.4)
- [CVE-2023-43070](https://insights.sbomify.com/CVE-2023-43070/): Path traversal in Dell SmartFabric Storage Software (medium 6.3)
- [CVE-2023-4307](https://insights.sbomify.com/CVE-2023-4307/): Lock User Account <= 1.0.3 - Arbitrary Account Lock/Unlock via CSRF (medium 4.3)
- [CVE-2023-43069](https://insights.sbomify.com/CVE-2023-43069/): Command injection in Dell SmartFabric Storage Software (high 7.8)
- [CVE-2023-43068](https://insights.sbomify.com/CVE-2023-43068/): Command injection in Dell SmartFabric Storage Software (high 7.8)
- [CVE-2023-43067](https://insights.sbomify.com/CVE-2023-43067/): XML external entity in Unity (medium 4.9)
- [CVE-2023-43066](https://insights.sbomify.com/CVE-2023-43066/): Command injection in Unity (medium 5.1)
- [CVE-2023-43065](https://insights.sbomify.com/CVE-2023-43065/): Cross-site scripting in Unity (medium 5.5)
- [CVE-2023-43064](https://insights.sbomify.com/CVE-2023-43064/): IBM i code execution (high 7.0)
- [CVE-2023-43058](https://insights.sbomify.com/CVE-2023-43058/): IBM Robotic Process Automation privilege escalation (medium 5.3)
- [CVE-2023-43057](https://insights.sbomify.com/CVE-2023-43057/): IBM QRadar SIEM cross-site scripting (medium 4.6)
- [CVE-2023-43054](https://insights.sbomify.com/CVE-2023-43054/): IBM Engineering Test Management cross-site scripting (medium 6.4)
- [CVE-2023-43052](https://insights.sbomify.com/CVE-2023-43052/): IBM Control Center external service interaction (medium 5.3)
- [CVE-2023-43051](https://insights.sbomify.com/CVE-2023-43051/): IBM Cognos Analytics cross-site scripting (medium 5.4)
- [CVE-2023-43045](https://insights.sbomify.com/CVE-2023-43045/): IBM Sterling Partner Engagement Manager security bypass (medium 5.9)
- [CVE-2023-43044](https://insights.sbomify.com/CVE-2023-43044/): IBM License Metric Tool directory traversal (medium 5.3)
- [CVE-2023-43043](https://insights.sbomify.com/CVE-2023-43043/): IBM Maximo Application Suite information disclosure (medium 5.1)
- [CVE-2023-43042](https://insights.sbomify.com/CVE-2023-43042/): IBM Storage Virtualize information disclosure (high 7.5)
- [CVE-2023-43041](https://insights.sbomify.com/CVE-2023-43041/): IBM QRadar information disclosure (medium 6.5)
- [CVE-2023-43040](https://insights.sbomify.com/CVE-2023-43040/): IBM Spectrum Fusion HCI improper access control (medium 6.5)
- [CVE-2023-4304](https://insights.sbomify.com/CVE-2023-4304/): Business Logic Errors in froxlor/froxlor (low 3.8)
- [CVE-2023-43039](https://insights.sbomify.com/CVE-2023-43039/): IBM OpenPages with Watson cross-site scripting (medium 6.1)
- [CVE-2023-43037](https://insights.sbomify.com/CVE-2023-43037/): IBM Maximo Application Suite improper access control (medium 6.5)
- [CVE-2023-43035](https://insights.sbomify.com/CVE-2023-43035/): IBM Sterling Control Center information disclosure (medium 4.0)
- [CVE-2023-4303](https://insights.sbomify.com/CVE-2023-4303/): HTML injection vulnerability in Fortify Plugin (medium 4.3)
- [CVE-2023-43029](https://insights.sbomify.com/CVE-2023-43029/): IBM Storage Virtualize vSphere Remote Plug-in information disclosure (medium 6.8)
- [CVE-2023-43021](https://insights.sbomify.com/CVE-2023-43021/): IBM InfoSphere Information Server information disclosure (medium 5.3)
- [CVE-2023-4302](https://insights.sbomify.com/CVE-2023-4302/): Missing permission checks in Fortify Plugin allow capturing credentials (medium 4.2)
- [CVE-2023-43018](https://insights.sbomify.com/CVE-2023-43018/): IBM CICS TX privilege escalation (medium 5.9)
- [CVE-2023-43017](https://insights.sbomify.com/CVE-2023-43017/): IBM Security Verify Access man in the middle (high 8.2)
- [CVE-2023-43016](https://insights.sbomify.com/CVE-2023-43016/): IBM Security Access Manager Container unauthorized access (high 7.3)
- [CVE-2023-43015](https://insights.sbomify.com/CVE-2023-43015/): IBM InfoSphere Information Server cross-site scripting (medium 5.4)
- [CVE-2023-43014](https://insights.sbomify.com/CVE-2023-43014/): Asset Management System v1.0 - Authenticated SQL Injection (SQLi) (high 8.8)
- [CVE-2023-43013](https://insights.sbomify.com/CVE-2023-43013/): Asset Management System v1.0 - Unauthenticated SQL Injection (SQLi) (critical 9.8)
- [CVE-2023-43010](https://insights.sbomify.com/CVE-2023-43010/): Memory corruption in Safari (high 8.8)
- [CVE-2023-4301](https://insights.sbomify.com/CVE-2023-4301/): CSRF vulnerability in Fortify Plugin allow capturing credentials (medium 4.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/226/