# Vulnerabilities published in 2023


- [CVE-2023-41198](https://insights.sbomify.com/CVE-2023-41198/): D-Link DAP-1325 HNAP SetHostIPv6StaticSettings StaticDNS1 Command Injection Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-41197](https://insights.sbomify.com/CVE-2023-41197/): Command injection in DAP-1325 (high 8.8)
- [CVE-2023-41196](https://insights.sbomify.com/CVE-2023-41196/): D-Link DAP-1325 HNAP SetHostIPv6StaticSettings StaticAddress Command Injection Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-41195](https://insights.sbomify.com/CVE-2023-41195/): D-Link DAP-1325 HNAP SetHostIPv6Settings IPv6Mode Command Injection Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-41194](https://insights.sbomify.com/CVE-2023-41194/): D-Link DAP-1325 HNAP SetAPLanSettings SubnetMask Command Injection Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-41193](https://insights.sbomify.com/CVE-2023-41193/): D-Link DAP-1325 HNAP SetAPLanSettings SecondaryDNS Command Injection Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-41192](https://insights.sbomify.com/CVE-2023-41192/): D-Link DAP-1325 HNAP SetAPLanSettings PrimaryDNS Command Injection Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-41191](https://insights.sbomify.com/CVE-2023-41191/): D-Link DAP-1325 HNAP SetAPLanSettings Mode Command Injection Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-41190](https://insights.sbomify.com/CVE-2023-41190/): D-Link DAP-1325 HNAP SetAPLanSettings IPAddr Command Injection Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-4119](https://insights.sbomify.com/CVE-2023-4119/): Academy LMS courses cross site scripting (medium 4.3)
- [CVE-2023-41189](https://insights.sbomify.com/CVE-2023-41189/): D-Link DAP-1325 HNAP SetAPLanSettings Gateway Command Injection Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-41188](https://insights.sbomify.com/CVE-2023-41188/): D-Link DAP-1325 HNAP SetAPLanSettings DeviceName Command Injection Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-41187](https://insights.sbomify.com/CVE-2023-41187/): D-Link DAP-1325 HNAP Missing Authentication Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-41186](https://insights.sbomify.com/CVE-2023-41186/): D-Link DAP-1325 CGI Missing Authentication Information Disclosure Vulnerability (medium 6.5)
- [CVE-2023-41185](https://insights.sbomify.com/CVE-2023-41185/): Unified Automation UaGateway Certificate Parsing Integer Overflow Denial-of-Service Vulnerability (high 8.6)
- [CVE-2023-41184](https://insights.sbomify.com/CVE-2023-41184/): TP-Link Tapo C210 ActiveCells Stack-based Buffer Overflow Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2023-41183](https://insights.sbomify.com/CVE-2023-41183/): NETGEAR Orbi 760 SOAP API Authentication Bypass Vulnerability (high 8.8)
- [CVE-2023-41182](https://insights.sbomify.com/CVE-2023-41182/): NETGEAR ProSAFE Network Management System ZipUtils Directory Traversal Remote Code Execution Vulnerability (high 7.2)
- [CVE-2023-41181](https://insights.sbomify.com/CVE-2023-41181/): LG SuperSign Media Editor getSubFolderList Directory Traversal Information Disclosure Vulnerability (medium 5.3)
- [CVE-2023-41180](https://insights.sbomify.com/CVE-2023-41180/): Apache NiFi MiNiFi C++: Incorrect Certificate Validation in InvokeHTTP for MiNiFi C++ (medium 5.9)
- [CVE-2023-4118](https://insights.sbomify.com/CVE-2023-4118/): Cute Http File Server Search cross site scripting (low 3.5)
- [CVE-2023-41179](https://insights.sbomify.com/CVE-2023-41179/): Trend Micro Apex One and Worry-Free Business Security Remote Code Execution (high 7.2, exploited in the wild)
- [CVE-2023-41178](https://insights.sbomify.com/CVE-2023-41178/): Cross-site scripting in Trend Micro Mobile Security for Enterprise (medium 6.1)
- [CVE-2023-41177](https://insights.sbomify.com/CVE-2023-41177/): Cross-site scripting in Trend Micro Mobile Security for Enterprise (medium 6.1)
- [CVE-2023-41176](https://insights.sbomify.com/CVE-2023-41176/): Cross-site scripting in Trend Micro Mobile Security for Enterprise (medium 6.1)
- [CVE-2023-41175](https://insights.sbomify.com/CVE-2023-41175/): Libtiff: potential integer overflow in raw2tiff.c (medium 6.5)
- [CVE-2023-41174](https://insights.sbomify.com/CVE-2023-41174/): Memory corruption in iOS and iPadOS (high 7.8)
- [CVE-2023-41173](https://insights.sbomify.com/CVE-2023-41173/): Denial of service in adguard:adguard dns (high 7.5)
- [CVE-2023-41172](https://insights.sbomify.com/CVE-2023-41172/): Cross-site scripting in netscout:ngeniusone (medium 5.4)
- [CVE-2023-41171](https://insights.sbomify.com/CVE-2023-41171/): Cross-site scripting in netscout:ngeniusone (medium 5.4)
- [CVE-2023-41170](https://insights.sbomify.com/CVE-2023-41170/): Cross-site scripting in netscout:ngeniusone (medium 6.1)
- [CVE-2023-4117](https://insights.sbomify.com/CVE-2023-4117/): PHP Jabbers Rental Property Booking index.php cross site scripting (medium 4.3)
- [CVE-2023-41169](https://insights.sbomify.com/CVE-2023-41169/): Cross-site scripting in netscout:ngeniusone (medium 5.4)
- [CVE-2023-41168](https://insights.sbomify.com/CVE-2023-41168/): Cross-site scripting in netscout:ngeniusone (medium 5.4)
- [CVE-2023-41167](https://insights.sbomify.com/CVE-2023-41167/): @webiny/react-rich-text-renderer vulnerable to insecure rendering of rich text content (medium 4.8)
- [CVE-2023-41166](https://insights.sbomify.com/CVE-2023-41166/): Information disclosure in stormshield:stormshield network security (medium 5.3)
- [CVE-2023-41165](https://insights.sbomify.com/CVE-2023-41165/): Cross-site scripting in stormshield:stormshield network security (medium 4.8)
- [CVE-2023-41164](https://insights.sbomify.com/CVE-2023-41164/): Django Denial of service vulnerability in django.utils.encoding.uri_to_iri (high 7.5)
- [CVE-2023-41163](https://insights.sbomify.com/CVE-2023-41163/): Cross-site scripting in webmin:webmin (medium 6.1)
- [CVE-2023-41162](https://insights.sbomify.com/CVE-2023-41162/): Cross-site scripting in webmin:usermin (medium 6.1)
- [CVE-2023-41161](https://insights.sbomify.com/CVE-2023-41161/): Cross-site scripting in webmin:usermin (medium 5.4)
- [CVE-2023-41160](https://insights.sbomify.com/CVE-2023-41160/): Cross-site scripting in webmin:usermin (medium 5.4)
- [CVE-2023-4116](https://insights.sbomify.com/CVE-2023-4116/): PHP Jabbers Taxi Booking index.php cross site scripting (medium 4.3)
- [CVE-2023-41159](https://insights.sbomify.com/CVE-2023-41159/): Cross-site scripting in webmin:usermin (medium 5.4)
- [CVE-2023-41158](https://insights.sbomify.com/CVE-2023-41158/): Cross-site scripting in webmin:usermin (medium 5.4)
- [CVE-2023-41157](https://insights.sbomify.com/CVE-2023-41157/): Cross-site scripting in webmin:usermin (medium 5.4)
- [CVE-2023-41156](https://insights.sbomify.com/CVE-2023-41156/): Cross-site scripting in webmin:usermin (medium 5.4)
- [CVE-2023-41155](https://insights.sbomify.com/CVE-2023-41155/): Cross-site scripting in webmin:usermin (medium 5.4)
- [CVE-2023-41154](https://insights.sbomify.com/CVE-2023-41154/): Cross-site scripting in webmin:usermin (medium 5.4)
- [CVE-2023-41153](https://insights.sbomify.com/CVE-2023-41153/): Cross-site scripting in webmin:usermin (medium 5.4)
- [CVE-2023-41152](https://insights.sbomify.com/CVE-2023-41152/): Cross-site scripting in webmin:usermin (medium 5.4)
- [CVE-2023-41151](https://insights.sbomify.com/CVE-2023-41151/): Denial of service in softing:opc (high 7.5)
- [CVE-2023-41150](https://insights.sbomify.com/CVE-2023-41150/): Cross-site scripting in F-RevoCRM (medium 5.4)
- [CVE-2023-4115](https://insights.sbomify.com/CVE-2023-4115/): PHP Jabbers Cleaning Business index.php cross site scripting (medium 4.3)
- [CVE-2023-41149](https://insights.sbomify.com/CVE-2023-41149/): Command injection in F-RevoCRM (critical 9.8)
- [CVE-2023-41146](https://insights.sbomify.com/CVE-2023-41146/): Missing authorization in Customer Portal (medium 4.3)
- [CVE-2023-41145](https://insights.sbomify.com/CVE-2023-41145/): Missing authorization in Customer Portal (medium 5.3)
- [CVE-2023-41140](https://insights.sbomify.com/CVE-2023-41140/): Memory corruption in AutoCAD, Advance Steel and Civil 3D (high 7.8)
- [CVE-2023-4114](https://insights.sbomify.com/CVE-2023-4114/): PHP Jabbers Night Club Booking Software index.php cross site scripting (medium 4.3)
- [CVE-2023-41139](https://insights.sbomify.com/CVE-2023-41139/): Memory corruption in AutoCAD, Advance Steel and Civil 3D (high 7.8)
- [CVE-2023-41138](https://insights.sbomify.com/CVE-2023-41138/): Privilege escalation in AppsAnywhere Client (high 7.5)
- [CVE-2023-41137](https://insights.sbomify.com/CVE-2023-41137/): Weak cryptography in AppsAnywhere Client (high 8.0)
- [CVE-2023-41136](https://insights.sbomify.com/CVE-2023-41136/): WordPress Simple Long Form Plugin <= 2.2.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-41134](https://insights.sbomify.com/CVE-2023-41134/): WordPress Antispam Bee plugin <= 2.11.3 - Country IP Restriction Bypass vulnerability (medium 5.3)
- [CVE-2023-41133](https://insights.sbomify.com/CVE-2023-41133/): WordPress Secure Admin IP plugin <= 2.0 - IP Spoofing vulnerability (medium 5.3)
- [CVE-2023-41132](https://insights.sbomify.com/CVE-2023-41132/): WordPress Category Slider for WooCommerce plugin <= 1.4.15 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-41131](https://insights.sbomify.com/CVE-2023-41131/): WordPress Sp*tify Play Button for WordPress Plugin <= 2.10 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-41130](https://insights.sbomify.com/CVE-2023-41130/): WordPress Premmerce User Roles plugin <= 1.0.12 - Broken Access Control vulnerability (high 8.1)
- [CVE-2023-4113](https://insights.sbomify.com/CVE-2023-4113/): PHP Jabbers Service Booking Script index.php cross site scripting (medium 4.3)
- [CVE-2023-41129](https://insights.sbomify.com/CVE-2023-41129/): WordPress Patreon WordPress Plugin <= 1.8.6 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-41128](https://insights.sbomify.com/CVE-2023-41128/): WordPress WP Roadmap Plugin <= 1.0.8 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-41127](https://insights.sbomify.com/CVE-2023-41127/): WordPress Evergreen Content Poster Plugin <= 1.3.6.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-41121](https://insights.sbomify.com/CVE-2023-41121/): Denial of service in arraynetworks:arrayos ag (high 7.5)
- [CVE-2023-41120](https://insights.sbomify.com/CVE-2023-41120/): Missing authorization in enterprisedb:postgres advanced server (medium 6.5)
- [CVE-2023-4112](https://insights.sbomify.com/CVE-2023-4112/): PHP Jabbers Shuttle Booking Software index.php cross site scripting (medium 4.3)
- [CVE-2023-41119](https://insights.sbomify.com/CVE-2023-41119/): Privilege escalation in enterprisedb:postgres advanced server (high 8.8)
- [CVE-2023-41118](https://insights.sbomify.com/CVE-2023-41118/): Missing authorization in enterprisedb:postgres advanced server (high 8.8)
- [CVE-2023-41117](https://insights.sbomify.com/CVE-2023-41117/): Privilege escalation in enterprisedb:postgres advanced server (high 8.8)
- [CVE-2023-41116](https://insights.sbomify.com/CVE-2023-41116/): Missing authorization in enterprisedb:postgres advanced server (medium 4.3)
- [CVE-2023-41115](https://insights.sbomify.com/CVE-2023-41115/): Missing authorization in enterprisedb:postgres advanced server (medium 6.5)
- [CVE-2023-41114](https://insights.sbomify.com/CVE-2023-41114/): Missing authorization in enterprisedb:postgres advanced server (medium 6.5)
- [CVE-2023-41113](https://insights.sbomify.com/CVE-2023-41113/): Information disclosure in enterprisedb:postgres advanced server (medium 4.3)
- [CVE-2023-41112](https://insights.sbomify.com/CVE-2023-41112/): Memory corruption in samsung:exynos 1080 firmware (high 7.1)
- [CVE-2023-41111](https://insights.sbomify.com/CVE-2023-41111/): Memory corruption in samsung:exynos 1080 firmware (high 7.1)
- [CVE-2023-4111](https://insights.sbomify.com/CVE-2023-4111/): PHP Jabbers Bus Reservation System index.php cross site scripting (medium 4.3)
- [CVE-2023-41109](https://insights.sbomify.com/CVE-2023-41109/): Command injection in patton:smartnode sn200 firmware (critical 9.8)
- [CVE-2023-41108](https://insights.sbomify.com/CVE-2023-41108/): File upload in tef:tef portal (high 8.8)
- [CVE-2023-41107](https://insights.sbomify.com/CVE-2023-41107/): Cross-site scripting in tef:tef portal (medium 5.4)
- [CVE-2023-41106](https://insights.sbomify.com/CVE-2023-41106/): Auth bypass in zimbra:collaboration (high 7.5)
- [CVE-2023-41105](https://insights.sbomify.com/CVE-2023-41105/): Security feature bypass in netapp:active iq unified manager (high 7.5)
- [CVE-2023-41104](https://insights.sbomify.com/CVE-2023-41104/): Memory corruption in varnish-software:varnish enterprise (medium 6.5)
- [CVE-2023-41103](https://insights.sbomify.com/CVE-2023-41103/): Cross-site scripting in interactsoftware:interact (medium 5.4)
- [CVE-2023-41102](https://insights.sbomify.com/CVE-2023-41102/): Denial of service in opennds:opennds (high 7.5)
- [CVE-2023-41101](https://insights.sbomify.com/CVE-2023-41101/): Memory corruption in opennds:opennds (critical 9.8)
- [CVE-2023-41100](https://insights.sbomify.com/CVE-2023-41100/): hCaptcha for EXT:form Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-4110](https://insights.sbomify.com/CVE-2023-4110/): PHP Jabbers Availability Booking Calendar index.php cross site scripting (low 3.5)
- [CVE-2023-41099](https://insights.sbomify.com/CVE-2023-41099/): Privilege escalation in atos:eviden cardos api (high 7.8)
- [CVE-2023-41098](https://insights.sbomify.com/CVE-2023-41098/): Cross-site scripting in misp-project:misp (medium 6.1)
- [CVE-2023-41097](https://insights.sbomify.com/CVE-2023-41097/): Potential Timing vulnerability in CBC PKCS7 padding calculations (medium 4.6)
- [CVE-2023-41096](https://insights.sbomify.com/CVE-2023-41096/): Keys Stored in Plaintext on Secure Vault High for Silabs Ember ZNet devices (medium 6.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/241/