# Vulnerabilities published in 2023


- [CVE-2023-39917](https://insights.sbomify.com/CVE-2023-39917/): WordPress Photo Gallery by Ays Plugin <= 5.2.6 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-39916](https://insights.sbomify.com/CVE-2023-39916/): Possible path traversal when storing RRDP responses (critical 9.3)
- [CVE-2023-39915](https://insights.sbomify.com/CVE-2023-39915/): Crashes on parsing certain invalid RPKI objects (high 7.5)
- [CVE-2023-39914](https://insights.sbomify.com/CVE-2023-39914/): BER/CER/DER decoder panics on invalid input (high 7.5)
- [CVE-2023-39913](https://insights.sbomify.com/CVE-2023-39913/): Apache UIMA Java SDK Deserialization of Untrusted Data, Improper Input Validation vulnerability (high 8.8)
- [CVE-2023-39912](https://insights.sbomify.com/CVE-2023-39912/): Path traversal in zohocorp:manageengine admanager plus (medium 4.9)
- [CVE-2023-39910](https://insights.sbomify.com/CVE-2023-39910/): Weak cryptography in libbitcoin:libbitcoin explorer (high 7.5)
- [CVE-2023-3991](https://insights.sbomify.com/CVE-2023-3991/): OS command injection vulnerability in FreshTomato 2023.3 (critical 10.0)
- [CVE-2023-39909](https://insights.sbomify.com/CVE-2023-39909/): Missing authorization in ericsson:network manager (high 8.8)
- [CVE-2023-39908](https://insights.sbomify.com/CVE-2023-39908/): Information disclosure in yubico:yubihsm 2 sdk (high 7.5)
- [CVE-2023-39903](https://insights.sbomify.com/CVE-2023-39903/): Information disclosure in fujitsu:software infrastructure manager (medium 5.9)
- [CVE-2023-39902](https://insights.sbomify.com/CVE-2023-39902/): Memory corruption in nxp:uboot secondary program loader (high 7.0)
- [CVE-2023-3990](https://insights.sbomify.com/CVE-2023-3990/): Mingsoft MCMS HTTP POST Request search.do cross site scripting (low 3.5)
- [CVE-2023-3989](https://insights.sbomify.com/CVE-2023-3989/): SourceCodester Jewelry Store System add_customer.php cross site scripting (low 3.5)
- [CVE-2023-3988](https://insights.sbomify.com/CVE-2023-3988/): Cafe Billing System Order index.php sql injection (medium 6.3)
- [CVE-2023-3987](https://insights.sbomify.com/CVE-2023-3987/): SourceCodester Simple Online Mens Salon Management System sql injection (medium 6.3)
- [CVE-2023-3986](https://insights.sbomify.com/CVE-2023-3986/): SourceCodester Simple Online Mens Salon Management System cross site scripting (low 2.4)
- [CVE-2023-39854](https://insights.sbomify.com/CVE-2023-39854/): Server-side request forgery in atx:ucrypt (medium 6.5)
- [CVE-2023-39853](https://insights.sbomify.com/CVE-2023-39853/): SQL injection in dzzoffice:dzzoffice (medium 6.5)
- [CVE-2023-39852](https://insights.sbomify.com/CVE-2023-39852/): SQL injection in doctor appointment system project:doctor appointment system (critical 9.8)
- [CVE-2023-39851](https://insights.sbomify.com/CVE-2023-39851/): SQL injection in webchess project:webchess (critical 9.8)
- [CVE-2023-39850](https://insights.sbomify.com/CVE-2023-39850/): SQL injection in schoolmate project:schoolmate (critical 9.8)
- [CVE-2023-3985](https://insights.sbomify.com/CVE-2023-3985/): SourceCodester Online Jewelry Store login.php sql injection (high 7.3)
- [CVE-2023-39846](https://insights.sbomify.com/CVE-2023-39846/): Auth bypass in pantsel:konga (critical 9.8)
- [CVE-2023-39843](https://insights.sbomify.com/CVE-2023-39843/): Weak cryptography in sulimet:5-in-1 smart door lock firmware (low 2.4)
- [CVE-2023-39842](https://insights.sbomify.com/CVE-2023-39842/): Weak cryptography in mydigoo:dg-hamb smart home security system firmware (low 2.4)
- [CVE-2023-39841](https://insights.sbomify.com/CVE-2023-39841/): Weak cryptography in etekcity:3-in-1 smart door lock firmware (medium 4.6)
- [CVE-2023-3984](https://insights.sbomify.com/CVE-2023-3984/): phpscriptpoint RecipePoint recipe-result sql injection (medium 6.3)
- [CVE-2023-39834](https://insights.sbomify.com/CVE-2023-39834/): Command injection in pbootcms:pbootcms (critical 9.8)
- [CVE-2023-3983](https://insights.sbomify.com/CVE-2023-3983/): SQL injection in Advantech iView (high 8.8)
- [CVE-2023-39829](https://insights.sbomify.com/CVE-2023-39829/): Memory corruption in tenda:a18 firmware (high 7.5)
- [CVE-2023-39828](https://insights.sbomify.com/CVE-2023-39828/): Memory corruption in tenda:a18 firmware (high 7.5)
- [CVE-2023-39827](https://insights.sbomify.com/CVE-2023-39827/): Memory corruption in tenda:a18 firmware (high 7.5)
- [CVE-2023-3982](https://insights.sbomify.com/CVE-2023-3982/): Cross-site Scripting (XSS) - Stored in omeka/omeka-s (medium 5.4)
- [CVE-2023-39810](https://insights.sbomify.com/CVE-2023-39810/): Path traversal in busybox:busybox (high 7.8)
- [CVE-2023-3981](https://insights.sbomify.com/CVE-2023-3981/): Server-Side Request Forgery (SSRF) in omeka/omeka-s (medium 6.5)
- [CVE-2023-39809](https://insights.sbomify.com/CVE-2023-39809/): Command injection in nvki:intelligent broadband subscriber gateway (critical 9.8)
- [CVE-2023-39808](https://insights.sbomify.com/CVE-2023-39808/): Hardcoded credentials in nvki:intelligent broadband subscriber gateway (critical 9.8)
- [CVE-2023-39807](https://insights.sbomify.com/CVE-2023-39807/): SQL injection in nvki:intelligent broadband subscriber gateway (critical 9.8)
- [CVE-2023-39806](https://insights.sbomify.com/CVE-2023-39806/): SQL injection in idreamsoft:icms (critical 9.8)
- [CVE-2023-39805](https://insights.sbomify.com/CVE-2023-39805/): SQL injection in idreamsoft:icms (critical 9.8)
- [CVE-2023-39804](https://insights.sbomify.com/CVE-2023-39804/): Denial of service in gnu:tar (medium 6.2)
- [CVE-2023-39801](https://insights.sbomify.com/CVE-2023-39801/): Denial of service in renault:easy link (medium 4.6)
- [CVE-2023-3980](https://insights.sbomify.com/CVE-2023-3980/): Cross-site Scripting (XSS) - Stored in omeka/omeka-s (medium 5.4)
- [CVE-2023-39796](https://insights.sbomify.com/CVE-2023-39796/): SQL injection in wbce:wbce cms (critical 9.8)
- [CVE-2023-3979](https://insights.sbomify.com/CVE-2023-3979/): Incorrect Authorization in GitLab (low 3.1)
- [CVE-2023-39786](https://insights.sbomify.com/CVE-2023-39786/): Memory corruption in tenda:ac8 firmware (high 7.5)
- [CVE-2023-39785](https://insights.sbomify.com/CVE-2023-39785/): Memory corruption in tenda:ac8 firmware (high 7.5)
- [CVE-2023-39784](https://insights.sbomify.com/CVE-2023-39784/): Memory corruption in tenda:ac8 firmware (high 7.5)
- [CVE-2023-39780](https://insights.sbomify.com/CVE-2023-39780/): ASUS RT-AX55 Routers OS Command Injection (high 8.8, exploited in the wild)
- [CVE-2023-3978](https://insights.sbomify.com/CVE-2023-3978/): Improper rendering of text nodes in golang.org/x/net/html (medium 6.1)
- [CVE-2023-39777](https://insights.sbomify.com/CVE-2023-39777/): Cross-site scripting in vbulletin:vbulletin (medium 5.4)
- [CVE-2023-39776](https://insights.sbomify.com/CVE-2023-39776/): File upload in phpjabbers:ticket support script (critical 9.8)
- [CVE-2023-3977](https://insights.sbomify.com/CVE-2023-3977/): Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function (medium 4.3)
- [CVE-2023-39751](https://insights.sbomify.com/CVE-2023-39751/): Memory corruption in tp-link:tl-wr941nd v6 firmware (critical 9.8)
- [CVE-2023-39750](https://insights.sbomify.com/CVE-2023-39750/): Memory corruption in dlink:dap-2660 firmware (critical 9.8)
- [CVE-2023-3975](https://insights.sbomify.com/CVE-2023-3975/): OS Command Injection in jgraph/drawio (high 8.3)
- [CVE-2023-39749](https://insights.sbomify.com/CVE-2023-39749/): Memory corruption in dlink:dap-2660 firmware (critical 9.8)
- [CVE-2023-39748](https://insights.sbomify.com/CVE-2023-39748/): Denial of service in tp-link:tl-wr1041n v2 firmware (high 7.5)
- [CVE-2023-39747](https://insights.sbomify.com/CVE-2023-39747/): Memory corruption in tp-link:tl-wr841n v8 firmware (critical 9.8)
- [CVE-2023-39745](https://insights.sbomify.com/CVE-2023-39745/): Memory corruption in tp-link:tl-wr841n v8 firmware (high 7.5)
- [CVE-2023-39743](https://insights.sbomify.com/CVE-2023-39743/): Memory corruption in pete4abw:lzma software development kit (medium 5.3)
- [CVE-2023-39742](https://insights.sbomify.com/CVE-2023-39742/): Memory corruption in giflib project:giflib (medium 5.5)
- [CVE-2023-39741](https://insights.sbomify.com/CVE-2023-39741/): Memory corruption in long range zip project:long range zip (medium 5.5)
- [CVE-2023-39740](https://insights.sbomify.com/CVE-2023-39740/): Information disclosure in linecorp:onigiriya-musubee (high 8.2)
- [CVE-2023-3974](https://insights.sbomify.com/CVE-2023-3974/): OS Command Injection in jgraph/drawio (critical 9.6)
- [CVE-2023-39739](https://insights.sbomify.com/CVE-2023-39739/): Information disclosure in linecorp:regina sweets\&bakery (high 8.2)
- [CVE-2023-39737](https://insights.sbomify.com/CVE-2023-39737/): Information disclosure in linecorp:matsuya (high 8.2)
- [CVE-2023-39736](https://insights.sbomify.com/CVE-2023-39736/): Information disclosure in linecorp:fukunaga memberscard (high 8.2)
- [CVE-2023-39735](https://insights.sbomify.com/CVE-2023-39735/): Information disclosure in linecorp:uomasa saiji new (high 8.2)
- [CVE-2023-39734](https://insights.sbomify.com/CVE-2023-39734/): Information disclosure in linecorp:trackdiner10\/10 mc (high 8.2)
- [CVE-2023-39733](https://insights.sbomify.com/CVE-2023-39733/): Information disclosure in linecorp:tonton-tei (high 8.2)
- [CVE-2023-39732](https://insights.sbomify.com/CVE-2023-39732/): Information disclosure in linecorp:tokueimaru waiting (high 8.2)
- [CVE-2023-39731](https://insights.sbomify.com/CVE-2023-39731/): Information disclosure in line:kaibutsunosato (medium 5.3)
- [CVE-2023-3973](https://insights.sbomify.com/CVE-2023-3973/): Cross-site Scripting (XSS) - Reflected in jgraph/drawio (critical 9.6)
- [CVE-2023-39726](https://insights.sbomify.com/CVE-2023-39726/): Code injection in mintty project:mintty (critical 9.8)
- [CVE-2023-3972](https://insights.sbomify.com/CVE-2023-3972/): Insights-client: unsafe handling of temporary files and directories (high 7.8)
- [CVE-2023-39714](https://insights.sbomify.com/CVE-2023-39714/): Cross-site scripting in free and open source inventory management system project:free and open source inventory management system (medium 6.1)
- [CVE-2023-39712](https://insights.sbomify.com/CVE-2023-39712/): Cross-site scripting in free and open source inventory management system project:free and open source inventory management system (medium 6.1)
- [CVE-2023-39711](https://insights.sbomify.com/CVE-2023-39711/): Cross-site scripting in free and open source inventory management system project:free and open source inventory management system (medium 6.1)
- [CVE-2023-39710](https://insights.sbomify.com/CVE-2023-39710/): Cross-site scripting in free and open source inventory management system project:free and open source inventory management system (medium 6.1)
- [CVE-2023-3971](https://insights.sbomify.com/CVE-2023-3971/): Controller: html injection in custom login info (high 7.3)
- [CVE-2023-39709](https://insights.sbomify.com/CVE-2023-39709/): Cross-site scripting in free and open source inventory management system project:free and open source inventory management system (medium 6.1)
- [CVE-2023-39708](https://insights.sbomify.com/CVE-2023-39708/): Cross-site scripting in free and open source inventory management system project:free and open source inventory management system (medium 6.1)
- [CVE-2023-39707](https://insights.sbomify.com/CVE-2023-39707/): Cross-site scripting in free and open source inventory management system project:free and open source inventory management system (medium 5.4)
- [CVE-2023-39703](https://insights.sbomify.com/CVE-2023-39703/): Cross-site scripting in typora:typora (medium 6.1)
- [CVE-2023-39700](https://insights.sbomify.com/CVE-2023-39700/): Cross-site scripting in icewarp:mail server (medium 6.1)
- [CVE-2023-3970](https://insights.sbomify.com/CVE-2023-3970/): GZ Scripts Availability Booking Calendar PHP Image cross site scripting (low 3.5)
- [CVE-2023-39699](https://insights.sbomify.com/CVE-2023-39699/): Path traversal in icewarp:mail server (critical 9.8)
- [CVE-2023-39695](https://insights.sbomify.com/CVE-2023-39695/): Auth bypass in elenos:etg150 firmware (medium 5.3)
- [CVE-2023-39691](https://insights.sbomify.com/CVE-2023-39691/): Missing authorization in kodcloud:kodbox (critical 9.8)
- [CVE-2023-3969](https://insights.sbomify.com/CVE-2023-3969/): GZ Scripts Availability Booking Calendar PHP HTTP POST Request index.php cross site scripting (low 3.5)
- [CVE-2023-39685](https://insights.sbomify.com/CVE-2023-39685/): hson-java vulnerable to denial of service (high 7.5)
- [CVE-2023-39683](https://insights.sbomify.com/CVE-2023-39683/): Cross-site scripting in zalify:easy email (medium 6.1)
- [CVE-2023-39681](https://insights.sbomify.com/CVE-2023-39681/): Code injection in cuppacms:cuppacms (critical 9.8)
- [CVE-2023-39680](https://insights.sbomify.com/CVE-2023-39680/): Deserialization in sollace:unicopia (high 7.5)
- [CVE-2023-39678](https://insights.sbomify.com/CVE-2023-39678/): Cross-site scripting in bdcom:p3310d-2ac firmware (medium 6.1)
- [CVE-2023-39677](https://insights.sbomify.com/CVE-2023-39677/): Information disclosure in myprestamodules:product catalog \(csv\, excel\) import (high 7.5)
- [CVE-2023-39676](https://insights.sbomify.com/CVE-2023-39676/): Cross-site scripting in fieldthemes:fieldpopupnewsletter (medium 6.1)
- [CVE-2023-39675](https://insights.sbomify.com/CVE-2023-39675/): SQL injection in myprestamodules:product catalog \(csv\, excel\) import (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/252/