# Vulnerabilities published in 2023


- [CVE-2023-4164](https://insights.sbomify.com/CVE-2023-4164/): There is a possible information disclosure due to a missing permission check in Pixel Watch (high 8.4)
- [CVE-2023-41638](https://insights.sbomify.com/CVE-2023-41638/): File upload in grupposcai:realgimm (high 8.8)
- [CVE-2023-41637](https://insights.sbomify.com/CVE-2023-41637/): File upload in grupposcai:realgimm (critical 9.8)
- [CVE-2023-41636](https://insights.sbomify.com/CVE-2023-41636/): SQL injection in grupposcai:realgimm (critical 9.8)
- [CVE-2023-41635](https://insights.sbomify.com/CVE-2023-41635/): XML external entity in grupposcai:realgimm (medium 6.5)
- [CVE-2023-41633](https://insights.sbomify.com/CVE-2023-41633/): Null dereference in fossies:catdoc (medium 5.5)
- [CVE-2023-41631](https://insights.sbomify.com/CVE-2023-41631/): File upload in esst:esst monitoring (high 8.8)
- [CVE-2023-41630](https://insights.sbomify.com/CVE-2023-41630/): Code injection in esst:esst monitoring (critical 9.8)
- [CVE-2023-4163](https://insights.sbomify.com/CVE-2023-4163/): Possible buffer overflow in portcfgfportbuffers in Brocade Fabric OS (medium 4.4)
- [CVE-2023-41629](https://insights.sbomify.com/CVE-2023-41629/): Path traversal in esst:esst monitoring (high 7.5)
- [CVE-2023-41628](https://insights.sbomify.com/CVE-2023-41628/): Denial of service in o-ran-sc:e2 (high 7.5)
- [CVE-2023-41627](https://insights.sbomify.com/CVE-2023-41627/): Security feature bypass in o-ran-sc:ric message router (high 7.5)
- [CVE-2023-41626](https://insights.sbomify.com/CVE-2023-41626/): Gradio arbitrary file upload vulnerability (medium 4.8)
- [CVE-2023-41623](https://insights.sbomify.com/CVE-2023-41623/): SQL injection in emlog:emlog (high 7.2)
- [CVE-2023-41621](https://insights.sbomify.com/CVE-2023-41621/): Cross-site scripting in emlog:emlog (medium 6.1)
- [CVE-2023-4162](https://insights.sbomify.com/CVE-2023-4162/): Segmentation fault in Brocade Fabric OS after Brocade Fabric OS v9.0 (medium 4.4)
- [CVE-2023-41619](https://insights.sbomify.com/CVE-2023-41619/): Cross-site scripting in emlog:emlog (medium 6.1)
- [CVE-2023-41618](https://insights.sbomify.com/CVE-2023-41618/): Cross-site scripting in emlog:emlog (medium 6.1)
- [CVE-2023-41616](https://insights.sbomify.com/CVE-2023-41616/): Cross-site scripting in student management system project:student management system (medium 4.8)
- [CVE-2023-41615](https://insights.sbomify.com/CVE-2023-41615/): SQL injection in phpgurukul:zoo management system (critical 9.8)
- [CVE-2023-41614](https://insights.sbomify.com/CVE-2023-41614/): Cross-site scripting in phpgurukul:zoo management system (medium 4.8)
- [CVE-2023-41613](https://insights.sbomify.com/CVE-2023-41613/): Other in ezviz:ezviz studio (high 7.8)
- [CVE-2023-41612](https://insights.sbomify.com/CVE-2023-41612/): Hardcoded credentials in govicture:pc420 firmware (high 8.8)
- [CVE-2023-41611](https://insights.sbomify.com/CVE-2023-41611/): Hardcoded credentials in govicture:pc420 firmware (medium 6.5)
- [CVE-2023-41610](https://insights.sbomify.com/CVE-2023-41610/): Hardcoded credentials in govicture:pc420 firmware (high 8.8)
- [CVE-2023-4161](https://insights.sbomify.com/CVE-2023-4161/): WooCommerce PDF Invoice Builder <= 1.2.90 - Cross-Site Request Forgery to Custom Field Creation (medium 4.3)
- [CVE-2023-41609](https://insights.sbomify.com/CVE-2023-41609/): Open redirect in couchcms:couchcms (medium 6.1)
- [CVE-2023-41603](https://insights.sbomify.com/CVE-2023-41603/): Misconfiguration in dlink:r15 firmware (medium 5.3)
- [CVE-2023-41601](https://insights.sbomify.com/CVE-2023-41601/): Cross-site scripting in cszcms:csz cms (medium 6.1)
- [CVE-2023-4160](https://insights.sbomify.com/CVE-2023-4160/): WooCommerce PDF Invoice Builder <= 1.2.90 - Authenticated (Administrator+) Cross-Site Scripting (medium 4.4)
- [CVE-2023-41599](https://insights.sbomify.com/CVE-2023-41599/): Path traversal in jfinalcms project:jfinalcms (medium 5.3)
- [CVE-2023-41597](https://insights.sbomify.com/CVE-2023-41597/): Cross-site scripting in eyoucms:eyoucms (medium 6.1)
- [CVE-2023-41595](https://insights.sbomify.com/CVE-2023-41595/): Hardcoded credentials in vaxilu:x-ui (high 7.5)
- [CVE-2023-41594](https://insights.sbomify.com/CVE-2023-41594/): SQL injection in phpgurukul:dairy farm shop management system (high 7.5)
- [CVE-2023-41593](https://insights.sbomify.com/CVE-2023-41593/): Cross-site scripting in phpgurukul:dairy farm shop management system (medium 5.4)
- [CVE-2023-41592](https://insights.sbomify.com/CVE-2023-41592/): Froala Editor Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2023-41591](https://insights.sbomify.com/CVE-2023-41591/): Auth bypass in opennetworking:onos (critical 9.8)
- [CVE-2023-4159](https://insights.sbomify.com/CVE-2023-4159/): Unrestricted Upload of File with Dangerous Type in omeka/omeka-s (critical 9.9)
- [CVE-2023-41588](https://insights.sbomify.com/CVE-2023-41588/): Cross-site scripting in appfire:time to sla (medium 6.1)
- [CVE-2023-41580](https://insights.sbomify.com/CVE-2023-41580/): Other in phpipam:phpipam (high 7.5)
- [CVE-2023-4158](https://insights.sbomify.com/CVE-2023-4158/): Cross-site Scripting (XSS) - Stored in omeka/omeka-s (medium 6.4)
- [CVE-2023-41578](https://insights.sbomify.com/CVE-2023-41578/): Jeecg boot arbitrary file read vulnerability (high 7.5)
- [CVE-2023-41575](https://insights.sbomify.com/CVE-2023-41575/): Cross-site scripting in phpgurukul:blood bank \& donor management system (medium 5.4)
- [CVE-2023-41570](https://insights.sbomify.com/CVE-2023-41570/): Missing authorization in mikrotik:routeros (medium 5.3)
- [CVE-2023-4157](https://insights.sbomify.com/CVE-2023-4157/): Improper Neutralization of Special Elements in Output Used by a Downstream Component in omeka/omeka-s (medium 5.2)
- [CVE-2023-41566](https://insights.sbomify.com/CVE-2023-41566/): OA EKP v16 was discovered to contain an arbitrary download vulnerability via the component /ui/sys_ui_extend/sysUiExtend.do. (high 8.1)
- [CVE-2023-41564](https://insights.sbomify.com/CVE-2023-41564/): Cockpit CMS arbitrary file upload vulnerability (medium 6.1)
- [CVE-2023-41563](https://insights.sbomify.com/CVE-2023-41563/): Memory corruption in tenda:ac5 firmware (critical 9.8)
- [CVE-2023-41562](https://insights.sbomify.com/CVE-2023-41562/): Memory corruption in tenda:ac5 firmware (critical 9.8)
- [CVE-2023-41561](https://insights.sbomify.com/CVE-2023-41561/): Memory corruption in tenda:ac5 firmware (critical 9.8)
- [CVE-2023-41560](https://insights.sbomify.com/CVE-2023-41560/): Memory corruption in tenda:ac9 firmware (critical 9.8)
- [CVE-2023-4156](https://insights.sbomify.com/CVE-2023-4156/): Heap out of bound read in builtin.c (medium 4.4)
- [CVE-2023-41559](https://insights.sbomify.com/CVE-2023-41559/): Memory corruption in tenda:ac5 firmware (critical 9.8)
- [CVE-2023-41558](https://insights.sbomify.com/CVE-2023-41558/): Memory corruption in tenda:ac7 firmware (critical 9.8)
- [CVE-2023-41557](https://insights.sbomify.com/CVE-2023-41557/): Memory corruption in tenda:ac5 firmware (critical 9.8)
- [CVE-2023-41556](https://insights.sbomify.com/CVE-2023-41556/): Memory corruption in tenda:ac5 firmware (critical 9.8)
- [CVE-2023-41555](https://insights.sbomify.com/CVE-2023-41555/): Memory corruption in tenda:ac7 firmware (critical 9.8)
- [CVE-2023-41554](https://insights.sbomify.com/CVE-2023-41554/): Memory corruption in tenda:ac9 firmware (critical 9.8)
- [CVE-2023-41553](https://insights.sbomify.com/CVE-2023-41553/): Memory corruption in tenda:ac5 firmware (critical 9.8)
- [CVE-2023-41552](https://insights.sbomify.com/CVE-2023-41552/): Memory corruption in tenda:ac7 firmware (critical 9.8)
- [CVE-2023-4155](https://insights.sbomify.com/CVE-2023-4155/): Sev-es / sev-snp vmgexit double fetch vulnerability (medium 5.3)
- [CVE-2023-41544](https://insights.sbomify.com/CVE-2023-41544/): JeecgBoot server-side template injection (critical 9.8)
- [CVE-2023-41543](https://insights.sbomify.com/CVE-2023-41543/): Jeecg Boot SQL Injection (critical 9.8)
- [CVE-2023-41542](https://insights.sbomify.com/CVE-2023-41542/): Jeecg Boot SQL injection vulnerability (critical 9.8)
- [CVE-2023-4154](https://insights.sbomify.com/CVE-2023-4154/): Samba: ad dc password exposure to privileged users and rodcs (high 7.5)
- [CVE-2023-41539](https://insights.sbomify.com/CVE-2023-41539/): SQL injection in phpjabbers:business directory script (high 7.5)
- [CVE-2023-41538](https://insights.sbomify.com/CVE-2023-41538/): Cross-site scripting in phpjabbers:php forum script (medium 6.1)
- [CVE-2023-41537](https://insights.sbomify.com/CVE-2023-41537/): Cross-site scripting in phpjabbers:business directory script (medium 6.1)
- [CVE-2023-41532](https://insights.sbomify.com/CVE-2023-41532/): SQL injection in kishan0725:hospital management system (high 8.8)
- [CVE-2023-41531](https://insights.sbomify.com/CVE-2023-41531/): SQL injection in kishan0725:hospital management system (high 8.8)
- [CVE-2023-41530](https://insights.sbomify.com/CVE-2023-41530/): SQL injection in kishan0725:hospital management system (critical 9.8)
- [CVE-2023-4153](https://insights.sbomify.com/CVE-2023-4153/): BAN Users <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update & Privilege Escalation (high 8.8)
- [CVE-2023-41529](https://insights.sbomify.com/CVE-2023-41529/): Cross-site scripting in kishan0725:hospital management system (medium 6.1)
- [CVE-2023-41528](https://insights.sbomify.com/CVE-2023-41528/): SQL injection in kishan0725:hospital management system (critical 9.8)
- [CVE-2023-41527](https://insights.sbomify.com/CVE-2023-41527/): SQL injection in kishan0725:hospital management system (critical 9.8)
- [CVE-2023-41526](https://insights.sbomify.com/CVE-2023-41526/): SQL injection in kishan0725:hospital management system (critical 9.8)
- [CVE-2023-41525](https://insights.sbomify.com/CVE-2023-41525/): SQL injection in kishan0725:hospital management system (critical 9.8)
- [CVE-2023-41524](https://insights.sbomify.com/CVE-2023-41524/): SQL injection in student attendance management system project:student attendance management system (high 8.8)
- [CVE-2023-41523](https://insights.sbomify.com/CVE-2023-41523/): SQL injection in student attendance management system project:student attendance management system (high 8.8)
- [CVE-2023-41522](https://insights.sbomify.com/CVE-2023-41522/): SQL injection in student attendance management system project:student attendance management system (high 8.8)
- [CVE-2023-41521](https://insights.sbomify.com/CVE-2023-41521/): SQL injection in student attendance management system project:student attendance management system (high 8.8)
- [CVE-2023-41520](https://insights.sbomify.com/CVE-2023-41520/): SQL injection in student attendance management system project:student attendance management system (high 8.8)
- [CVE-2023-4152](https://insights.sbomify.com/CVE-2023-4152/): Frauscher FDS101 for FAdC/FAdCi path traversal vulnerability (high 7.5)
- [CVE-2023-41519](https://insights.sbomify.com/CVE-2023-41519/): Cross-site scripting in student attendance management system project:student attendance management system (medium 6.1)
- [CVE-2023-4151](https://insights.sbomify.com/CVE-2023-4151/): Store Locator WordPress < 1.4.13 - Reflected XSS (medium 6.1)
- [CVE-2023-41508](https://insights.sbomify.com/CVE-2023-41508/): Hardcoded credentials in superstorefinder:super store finder (critical 9.8)
- [CVE-2023-41507](https://insights.sbomify.com/CVE-2023-41507/): SQL injection in superstorefinder:super store finder (critical 9.8)
- [CVE-2023-41506](https://insights.sbomify.com/CVE-2023-41506/): File upload in code-projects:student enrollment (critical 9.8)
- [CVE-2023-41505](https://insights.sbomify.com/CVE-2023-41505/): File upload in code-projects:student enrollment (critical 9.8)
- [CVE-2023-41504](https://insights.sbomify.com/CVE-2023-41504/): SQL injection in code-projects:student enrollment (high 8.8)
- [CVE-2023-41503](https://insights.sbomify.com/CVE-2023-41503/): SQL injection in code-projects:student enrollment (critical 9.8)
- [CVE-2023-4150](https://insights.sbomify.com/CVE-2023-4150/): User Activity Tracking and Log < 4.0.9 - License Update/Deactivation via CSRF (medium 4.3)
- [CVE-2023-4149](https://insights.sbomify.com/CVE-2023-4149/): WAGO: OS Command Injection Vulnerability in Managed Switch (critical 9.8)
- [CVE-2023-41484](https://insights.sbomify.com/CVE-2023-41484/): Information disclosure in cimg:cimg (high 8.1)
- [CVE-2023-4148](https://insights.sbomify.com/CVE-2023-4148/): Ditty < 3.1.25 - Reflected XSS (medium 6.1)
- [CVE-2023-41474](https://insights.sbomify.com/CVE-2023-41474/): Path traversal in ivanti:avalanche (medium 6.5)
- [CVE-2023-41471](https://insights.sbomify.com/CVE-2023-41471/): Cross-site scripting in 9001:copyparty (high 7.8)
- [CVE-2023-4147](https://insights.sbomify.com/CVE-2023-4147/): Kernel: netfilter: nf_tables_newrule when adding a rule with nfta_rule_chain_id leads to use-after-free (high 7.8)
- [CVE-2023-41453](https://insights.sbomify.com/CVE-2023-41453/): Cross-site scripting in phpkobo:ajaxnewsticker (medium 6.1)
- [CVE-2023-41452](https://insights.sbomify.com/CVE-2023-41452/): Cross-site request forgery in phpkobo:ajaxnewsticker (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/238/