# Vulnerabilities published in 2023


- [CVE-2023-4242](https://insights.sbomify.com/CVE-2023-4242/): FULL - Customer <= 2.2.3 - Authenticated(Subscriber+) Information Disclosure via Health Check (medium 4.3)
- [CVE-2023-42419](https://insights.sbomify.com/CVE-2023-42419/): Improper Management of Cryptographic Keys in the Maintenance Server in QCOW Air-Gapped Distribution (China Edition) (low 3.8)
- [CVE-2023-4241](https://insights.sbomify.com/CVE-2023-4241/): lol-html panics on certain HTML inputs (high 7.5)
- [CVE-2023-42406](https://insights.sbomify.com/CVE-2023-42406/): SQL injection in dlink:dar-7000 firmware (critical 9.8)
- [CVE-2023-42405](https://insights.sbomify.com/CVE-2023-42405/): SQL injection in fit2cloud:rackshift (critical 9.8)
- [CVE-2023-42404](https://insights.sbomify.com/CVE-2023-42404/): Code injection in Workspace (medium 4.9)
- [CVE-2023-42399](https://insights.sbomify.com/CVE-2023-42399/): Jodit Editor vulnerable to cross-site scripting (medium 6.1)
- [CVE-2023-42398](https://insights.sbomify.com/CVE-2023-42398/): Server-side request forgery in zzcms:zzcms (critical 9.8)
- [CVE-2023-4239](https://insights.sbomify.com/CVE-2023-4239/): Real Estate Manager <= 7.2 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation (high 8.8)
- [CVE-2023-42387](https://insights.sbomify.com/CVE-2023-42387/): Information disclosure in tdsql chitu project:tdsql chitu (high 7.5)
- [CVE-2023-4238](https://insights.sbomify.com/CVE-2023-4238/): Prevent files / folders access < 2.5.2 - Admin+ Arbitrary File Upload (high 7.2)
- [CVE-2023-42374](https://insights.sbomify.com/CVE-2023-42374/): Code injection in mystenlabs:sui (critical 9.8)
- [CVE-2023-42371](https://insights.sbomify.com/CVE-2023-42371/): Cross-site scripting in summernote:rich text editor (medium 5.4)
- [CVE-2023-4237](https://insights.sbomify.com/CVE-2023-4237/): Platform: ec2_key module prints out the private key directly to the standard output (high 7.3)
- [CVE-2023-42366](https://insights.sbomify.com/CVE-2023-42366/): Memory corruption in busybox:busybox (medium 5.5)
- [CVE-2023-42365](https://insights.sbomify.com/CVE-2023-42365/): Use after free in busybox:busybox (medium 5.5)
- [CVE-2023-42364](https://insights.sbomify.com/CVE-2023-42364/): Use after free in busybox:busybox (medium 5.5)
- [CVE-2023-42363](https://insights.sbomify.com/CVE-2023-42363/): Use after free in busybox:busybox (medium 5.5)
- [CVE-2023-42362](https://insights.sbomify.com/CVE-2023-42362/): File upload in teller:teller (medium 5.4)
- [CVE-2023-42361](https://insights.sbomify.com/CVE-2023-42361/): Path traversal in midori-global:better pdf exporter (high 7.8)
- [CVE-2023-4236](https://insights.sbomify.com/CVE-2023-4236/): named may terminate unexpectedly under high DNS-over-TLS query load (high 7.5)
- [CVE-2023-42359](https://insights.sbomify.com/CVE-2023-42359/): SQL injection in exam form submission in php with source code project:exam form submission in php with source code (critical 9.8)
- [CVE-2023-42358](https://insights.sbomify.com/CVE-2023-42358/): Denial of service in o-ran-sc:ric-plt-e2mgr (high 7.5)
- [CVE-2023-4235](https://insights.sbomify.com/CVE-2023-4235/): Memory corruption in Fedora (high 8.1)
- [CVE-2023-42346](https://insights.sbomify.com/CVE-2023-42346/): Alkacon OpenCms is vulnerable to XXE when the <!DOCTYPE> refers to an external host (high 7.5)
- [CVE-2023-42345](https://insights.sbomify.com/CVE-2023-42345/): Alkacon OpenCms is vulnerable to XSS via updateModelGroups.jsp (medium 6.1)
- [CVE-2023-42344](https://insights.sbomify.com/CVE-2023-42344/): Alkacon OpenCms allows remote unauthenticated attackers to obtain sensitive information (high 7.3)
- [CVE-2023-42343](https://insights.sbomify.com/CVE-2023-42343/): Alkacon OpenCms is vulnerable to XSS via cmis-online/type (medium 6.1)
- [CVE-2023-4234](https://insights.sbomify.com/CVE-2023-4234/): Memory corruption in Fedora (high 8.1)
- [CVE-2023-42336](https://insights.sbomify.com/CVE-2023-42336/): Hardcoded credentials in netis-systems:wf2409e firmware (critical 9.8)
- [CVE-2023-42335](https://insights.sbomify.com/CVE-2023-42335/): File upload in fl3xx:crew (high 8.8)
- [CVE-2023-42334](https://insights.sbomify.com/CVE-2023-42334/): Privilege escalation in fl3xx:crew (medium 6.5)
- [CVE-2023-42331](https://insights.sbomify.com/CVE-2023-42331/): File upload in elitecms:elite cms (high 8.8)
- [CVE-2023-4233](https://insights.sbomify.com/CVE-2023-4233/): Memory corruption in Fedora (high 8.1)
- [CVE-2023-42328](https://insights.sbomify.com/CVE-2023-42328/): Hardcoded credentials in peppermint:peppermint (high 8.8)
- [CVE-2023-42327](https://insights.sbomify.com/CVE-2023-42327/): Cross-site scripting in netgate:pfsense (medium 5.4)
- [CVE-2023-42326](https://insights.sbomify.com/CVE-2023-42326/): Command injection in netgate:pfsense (high 8.8)
- [CVE-2023-42325](https://insights.sbomify.com/CVE-2023-42325/): Cross-site scripting in netgate:pfsense (medium 5.4)
- [CVE-2023-42323](https://insights.sbomify.com/CVE-2023-42323/): Cross-site request forgery in mnbvcxz131421:douhaocms (high 8.8)
- [CVE-2023-42322](https://insights.sbomify.com/CVE-2023-42322/): Information disclosure in icmsdev:icms (critical 9.8)
- [CVE-2023-42321](https://insights.sbomify.com/CVE-2023-42321/): Cross-site request forgery in icmsdev:icms (high 8.8)
- [CVE-2023-42320](https://insights.sbomify.com/CVE-2023-42320/): Memory corruption in tenda:ac10 firmware (critical 9.8)
- [CVE-2023-4232](https://insights.sbomify.com/CVE-2023-4232/): Memory corruption in Fedora (high 8.1)
- [CVE-2023-42319](https://insights.sbomify.com/CVE-2023-42319/): go-ethereum vulnerable to denial of service via crafted GraphQL query (high 7.5)
- [CVE-2023-4231](https://insights.sbomify.com/CVE-2023-4231/): SQLi in Cevik Informatics' Online Payment System (critical 9.8)
- [CVE-2023-42308](https://insights.sbomify.com/CVE-2023-42308/): Cross-site scripting in code-projects:exam form submission (medium 6.1)
- [CVE-2023-42307](https://insights.sbomify.com/CVE-2023-42307/): Cross-site scripting in code-projects:exam form submission (medium 6.1)
- [CVE-2023-4230](https://insights.sbomify.com/CVE-2023-4230/): ioLogik 4000 Series: Server Banner Information Disclosure (medium 5.3)
- [CVE-2023-42299](https://insights.sbomify.com/CVE-2023-42299/): Memory corruption in openimageio:openimageio (critical 9.8)
- [CVE-2023-42298](https://insights.sbomify.com/CVE-2023-42298/): Integer overflow in gpac:gpac (medium 5.5)
- [CVE-2023-42295](https://insights.sbomify.com/CVE-2023-42295/): Integer overflow in openimageio:openimageio (high 8.8)
- [CVE-2023-4229](https://insights.sbomify.com/CVE-2023-4229/): ioLogik 4000 Series: Session Headers Not Implemented (medium 4.3)
- [CVE-2023-42286](https://insights.sbomify.com/CVE-2023-42286/): Code injection in eyoucms:eyoucms (critical 9.8)
- [CVE-2023-42284](https://insights.sbomify.com/CVE-2023-42284/): SQL injection in tyk:tyk (critical 9.8)
- [CVE-2023-42283](https://insights.sbomify.com/CVE-2023-42283/): SQL injection in tyk:tyk (critical 9.8)
- [CVE-2023-42282](https://insights.sbomify.com/CVE-2023-42282/): NPM IP package incorrectly identifies some private IP addresses as public (critical 9.8)
- [CVE-2023-42280](https://insights.sbomify.com/CVE-2023-42280/): Path traversal in springernature:mee-admin (high 7.5)
- [CVE-2023-4228](https://insights.sbomify.com/CVE-2023-4228/): ioLogik 4000 Series: Session Cookies Attribute Not Set Properly (low 3.1)
- [CVE-2023-42279](https://insights.sbomify.com/CVE-2023-42279/): SQL injection in iteachyou:dreamer cms (critical 9.8)
- [CVE-2023-42278](https://insights.sbomify.com/CVE-2023-42278/): hutool Buffer Overflow vulnerability (high 7.5)
- [CVE-2023-42277](https://insights.sbomify.com/CVE-2023-42277/): hutool Buffer Overflow vulnerability (critical 9.8)
- [CVE-2023-42276](https://insights.sbomify.com/CVE-2023-42276/): hutool Buffer Overflow vulnerability (critical 9.8)
- [CVE-2023-42270](https://insights.sbomify.com/CVE-2023-42270/): Cross-site request forgery in grocy project:grocy (high 8.8)
- [CVE-2023-4227](https://insights.sbomify.com/CVE-2023-4227/): ioLogik 4000 Series: Existence of an Unauthorized Service (medium 5.3)
- [CVE-2023-42268](https://insights.sbomify.com/CVE-2023-42268/): Jeecg boot SQL Injection vulnerability (critical 9.8)
- [CVE-2023-42261](https://insights.sbomify.com/CVE-2023-42261/): Withdrawn Advisory: Mobile Security Framework (MobSF) Vulnerable to Insecure Permissions (high 7.5)
- [CVE-2023-4226](https://insights.sbomify.com/CVE-2023-4226/): Chamilo LMS File Upload Functionality Remote Code Execution (high 8.8)
- [CVE-2023-42253](https://insights.sbomify.com/CVE-2023-42253/): Cross-site scripting in vehicle management project:vehicle management (medium 6.1)
- [CVE-2023-42250](https://insights.sbomify.com/CVE-2023-42250/): Cross-site scripting in seling:visual access manager (medium 6.1)
- [CVE-2023-4225](https://insights.sbomify.com/CVE-2023-4225/): Chamilo LMS File Upload Functionality Remote Code Execution (high 8.8)
- [CVE-2023-42249](https://insights.sbomify.com/CVE-2023-42249/): Cross-site scripting in seling:visual access manager (medium 6.1)
- [CVE-2023-42248](https://insights.sbomify.com/CVE-2023-42248/): File upload in seling:visual access manager (medium 6.5)
- [CVE-2023-42247](https://insights.sbomify.com/CVE-2023-42247/): Cross-site scripting in seling:visual access manager (medium 6.1)
- [CVE-2023-42246](https://insights.sbomify.com/CVE-2023-42246/): Cross-site scripting in seling:visual access manager (medium 6.1)
- [CVE-2023-42245](https://insights.sbomify.com/CVE-2023-42245/): Cross-site scripting in seling:visual access manager (medium 6.1)
- [CVE-2023-42244](https://insights.sbomify.com/CVE-2023-42244/): SQL injection in seling:visual access manager (high 8.8)
- [CVE-2023-42243](https://insights.sbomify.com/CVE-2023-42243/): SQL injection in seling:visual access manager (medium 5.4)
- [CVE-2023-42242](https://insights.sbomify.com/CVE-2023-42242/): SQL injection in seling:visual access manager (low 3.8)
- [CVE-2023-42241](https://insights.sbomify.com/CVE-2023-42241/): SQL injection in seling:visual access manager (low 3.8)
- [CVE-2023-42240](https://insights.sbomify.com/CVE-2023-42240/): SQL injection in seling:visual access manager (low 3.8)
- [CVE-2023-4224](https://insights.sbomify.com/CVE-2023-4224/): Chamilo LMS File Upload Functionality Remote Code Execution (high 8.8)
- [CVE-2023-42239](https://insights.sbomify.com/CVE-2023-42239/): SQL injection in seling:visual access manager (low 3.8)
- [CVE-2023-42238](https://insights.sbomify.com/CVE-2023-42238/): SQL injection in seling:visual access manager (low 3.8)
- [CVE-2023-42237](https://insights.sbomify.com/CVE-2023-42237/): SQL injection in seling:visual access manager (low 3.8)
- [CVE-2023-42236](https://insights.sbomify.com/CVE-2023-42236/): SQL injection in seling:visual access manager (low 3.8)
- [CVE-2023-42235](https://insights.sbomify.com/CVE-2023-42235/): SQL injection in seling:visual access manager (low 3.8)
- [CVE-2023-42234](https://insights.sbomify.com/CVE-2023-42234/): Cross-site request forgery in zucchetti:helpdeskadvanced (medium 5.4)
- [CVE-2023-42233](https://insights.sbomify.com/CVE-2023-42233/): Cross-site scripting in zucchetti:helpdeskadvanced (medium 6.1)
- [CVE-2023-42232](https://insights.sbomify.com/CVE-2023-42232/): Path traversal in zucchetti:helpdeskadvanced (high 7.5)
- [CVE-2023-42231](https://insights.sbomify.com/CVE-2023-42231/): Missing authorization in zucchetti:helpdeskadvanced (high 8.1)
- [CVE-2023-42230](https://insights.sbomify.com/CVE-2023-42230/): Cross-site scripting in zucchetti:helpdeskadvanced (medium 6.1)
- [CVE-2023-4223](https://insights.sbomify.com/CVE-2023-4223/): Chamilo LMS File Upload Functionality Remote Code Execution (high 8.8)
- [CVE-2023-42229](https://insights.sbomify.com/CVE-2023-42229/): Path traversal in zucchetti:helpdeskadvanced (medium 6.5)
- [CVE-2023-42228](https://insights.sbomify.com/CVE-2023-42228/): Missing authorization in zucchetti:helpdeskadvanced (high 8.8)
- [CVE-2023-42227](https://insights.sbomify.com/CVE-2023-42227/): Path traversal in zucchetti:helpdeskadvanced (high 7.5)
- [CVE-2023-42226](https://insights.sbomify.com/CVE-2023-42226/): Path traversal in zucchetti:helpdeskadvanced (high 7.5)
- [CVE-2023-42225](https://insights.sbomify.com/CVE-2023-42225/): Path traversal in zucchetti:helpdeskadvanced (high 7.5)
- [CVE-2023-42222](https://insights.sbomify.com/CVE-2023-42222/): Security feature bypass in webcatalog:webcatalog (high 8.8)
- [CVE-2023-4222](https://insights.sbomify.com/CVE-2023-4222/): Chamilo LMS Learning Path PPT2LP Command Injection Vulnerability (high 7.2)
- [CVE-2023-4221](https://insights.sbomify.com/CVE-2023-4221/): Chamilo LMS Learning Path PPT2LP Command Injection Vulnerability (high 7.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/232/