# Vulnerabilities published in 2023


- [CVE-2023-39674](https://insights.sbomify.com/CVE-2023-39674/): Memory corruption in dlink:dir-880l a1 firmware (critical 9.8)
- [CVE-2023-39673](https://insights.sbomify.com/CVE-2023-39673/): Memory corruption in tenda:ac15 firmware (critical 9.8)
- [CVE-2023-39672](https://insights.sbomify.com/CVE-2023-39672/): Memory corruption in tenda:wh450a firmware (critical 9.8)
- [CVE-2023-39671](https://insights.sbomify.com/CVE-2023-39671/): Memory corruption in dlink:dir-880l a1 firmware (critical 9.8)
- [CVE-2023-39670](https://insights.sbomify.com/CVE-2023-39670/): Memory corruption in tenda:ac6 firmware (critical 9.8)
- [CVE-2023-3967](https://insights.sbomify.com/CVE-2023-3967/): DoS Vulnerability in Hitachi Ops Center Common Services (medium 5.3)
- [CVE-2023-39669](https://insights.sbomify.com/CVE-2023-39669/): Null dereference in dlink:dir-880l a1 firmware (high 7.5)
- [CVE-2023-39668](https://insights.sbomify.com/CVE-2023-39668/): Memory corruption in dlink:dir-868l firmware (critical 9.8)
- [CVE-2023-39667](https://insights.sbomify.com/CVE-2023-39667/): Memory corruption in dlink:dir-868l firmware (critical 9.8)
- [CVE-2023-39666](https://insights.sbomify.com/CVE-2023-39666/): Memory corruption in dlink:dir-842 firmware (critical 9.8)
- [CVE-2023-39665](https://insights.sbomify.com/CVE-2023-39665/): Memory corruption in dlink:dir-868l firmware (critical 9.8)
- [CVE-2023-39663](https://insights.sbomify.com/CVE-2023-39663/): MathJax Regular expression Denial of Service (ReDoS) (high 7.5)
- [CVE-2023-39662](https://insights.sbomify.com/CVE-2023-39662/): llama-index vulnerable to arbitrary code execution (critical 9.8)
- [CVE-2023-39661](https://insights.sbomify.com/CVE-2023-39661/): PandasAI vulnerable to arbitrary code execution (critical 9.8)
- [CVE-2023-39660](https://insights.sbomify.com/CVE-2023-39660/): pandasai vulnerable to prompt injection (critical 9.8)
- [CVE-2023-3966](https://insights.sbomify.com/CVE-2023-3966/): Openvswsitch: ovs-vswitch fails to recover after malformed geneve metadata packet (high 7.5)
- [CVE-2023-39659](https://insights.sbomify.com/CVE-2023-39659/): LangChain vulnerable to arbitrary code execution (critical 9.8)
- [CVE-2023-39655](https://insights.sbomify.com/CVE-2023-39655/): CouchAuth host header injection vulnerability leaks the password reset token (critical 9.6)
- [CVE-2023-39654](https://insights.sbomify.com/CVE-2023-39654/): SQL injection in abuquant:abupy (critical 9.8)
- [CVE-2023-39652](https://insights.sbomify.com/CVE-2023-39652/): SQL injection in themevolty:theme volty video tab (critical 9.8)
- [CVE-2023-39651](https://insights.sbomify.com/CVE-2023-39651/): SQL injection in themevolty:theme volty cms brandlist (critical 9.8)
- [CVE-2023-39650](https://insights.sbomify.com/CVE-2023-39650/): SQL injection in themevolty:theme volty cms blog (critical 9.8)
- [CVE-2023-3965](https://insights.sbomify.com/CVE-2023-3965/): nsc <= 1.0 - Prototype Pollution to Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-39649](https://insights.sbomify.com/CVE-2023-39649/): SQL injection in themevolty:theme volty cms category slider (critical 9.8)
- [CVE-2023-39648](https://insights.sbomify.com/CVE-2023-39648/): SQL injection in themevolty:theme volty cms testimonial (critical 9.8)
- [CVE-2023-39647](https://insights.sbomify.com/CVE-2023-39647/): SQL injection in themevolty:theme volty cms category product (critical 9.8)
- [CVE-2023-39646](https://insights.sbomify.com/CVE-2023-39646/): SQL injection in themevolty:theme volty cms category chain slider (critical 9.8)
- [CVE-2023-39645](https://insights.sbomify.com/CVE-2023-39645/): SQL injection in themevolty:cms payment icon (critical 9.8)
- [CVE-2023-39643](https://insights.sbomify.com/CVE-2023-39643/): SQL injection in blmodules:xmlfeeds pro (critical 9.8)
- [CVE-2023-39642](https://insights.sbomify.com/CVE-2023-39642/): SQL injection in carts.guru:cartsguru (critical 9.8)
- [CVE-2023-39641](https://insights.sbomify.com/CVE-2023-39641/): SQL injection in activedesign:full affiliates (critical 9.8)
- [CVE-2023-39640](https://insights.sbomify.com/CVE-2023-39640/): SQL injection in uplight:cookie law (critical 9.8)
- [CVE-2023-3964](https://insights.sbomify.com/CVE-2023-3964/): Incorrect Authorization in GitLab (medium 4.3)
- [CVE-2023-39639](https://insights.sbomify.com/CVE-2023-39639/): SQL injection in leotheme:leoblog (critical 9.8)
- [CVE-2023-39638](https://insights.sbomify.com/CVE-2023-39638/): Command injection in dlink:dir-859 a1 firmware (critical 9.8)
- [CVE-2023-39637](https://insights.sbomify.com/CVE-2023-39637/): Command injection in dlink:dir-816 firmware (critical 9.8)
- [CVE-2023-39631](https://insights.sbomify.com/CVE-2023-39631/): Langchain vulnerable to arbitrary code execution via the evaluate function in the numexpr library (critical 9.8)
- [CVE-2023-39620](https://insights.sbomify.com/CVE-2023-39620/): Information disclosure in buffalo:terastation nas 5410r firmware (high 7.5)
- [CVE-2023-3962](https://insights.sbomify.com/CVE-2023-3962/): Winters <= 1.4.3 - Prototype Pollution to Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-39619](https://insights.sbomify.com/CVE-2023-39619/): Inefficient Regular Expression Complexity in node-email-check (high 7.5)
- [CVE-2023-39618](https://insights.sbomify.com/CVE-2023-39618/): Command injection in totolink:x5000r firmware (critical 9.8)
- [CVE-2023-39617](https://insights.sbomify.com/CVE-2023-39617/): Command injection in totolink:x5000r firmware (critical 9.8)
- [CVE-2023-39616](https://insights.sbomify.com/CVE-2023-39616/): Memory corruption in aomedia:aomedia (high 7.5)
- [CVE-2023-39615](https://insights.sbomify.com/CVE-2023-39615/): Memory corruption in xmlsoft:libxml2 (medium 6.5)
- [CVE-2023-39612](https://insights.sbomify.com/CVE-2023-39612/): Cross-site scripting in filebrowser:filebrowser (critical 9.0)
- [CVE-2023-39611](https://insights.sbomify.com/CVE-2023-39611/): Path traversal in softwarefx:chart fx (high 7.5)
- [CVE-2023-39610](https://insights.sbomify.com/CVE-2023-39610/): Denial of service in tp-link:tapo c100 firmware (medium 6.5)
- [CVE-2023-3961](https://insights.sbomify.com/CVE-2023-3961/): Samba: smbd allows client access to unix domain sockets on the file system as root (critical 9.1)
- [CVE-2023-39600](https://insights.sbomify.com/CVE-2023-39600/): Cross-site scripting in icewarp:icewarp (medium 6.1)
- [CVE-2023-39599](https://insights.sbomify.com/CVE-2023-39599/): Cross-site scripting in cszcms:csz cms (medium 5.4)
- [CVE-2023-39598](https://insights.sbomify.com/CVE-2023-39598/): Cross-site scripting in icewarp:webclient (medium 6.1)
- [CVE-2023-39593](https://insights.sbomify.com/CVE-2023-39593/): Privilege escalation in mariadb:mariadb (medium 5.6)
- [CVE-2023-3959](https://insights.sbomify.com/CVE-2023-3959/): Zavio IP Camera Stack-Based Buffer Overflow (critical 9.8)
- [CVE-2023-39584](https://insights.sbomify.com/CVE-2023-39584/): Hexo `include_code` has a path traversal (high 7.5)
- [CVE-2023-39582](https://insights.sbomify.com/CVE-2023-39582/): SQL injection in chamilo:chamilo lms (medium 4.9)
- [CVE-2023-3958](https://insights.sbomify.com/CVE-2023-3958/): WP Remote Users Sync <= 1.2.12 - Authenticated (Subscriber+) Server Side Request Forgery (high 8.5)
- [CVE-2023-39578](https://insights.sbomify.com/CVE-2023-39578/): Cross-site scripting in tribalsystems:zenario (medium 4.8)
- [CVE-2023-39575](https://insights.sbomify.com/CVE-2023-39575/): Cross-site scripting in isl:arp-guard (medium 5.4)
- [CVE-2023-3957](https://insights.sbomify.com/CVE-2023-3957/): ACF Photo Gallery Field <= 1.9 - Authenticated (Subscriber+) Arbitrary Usermeta Update (medium 4.3)
- [CVE-2023-39562](https://insights.sbomify.com/CVE-2023-39562/): Use after free in gpac:gpac (medium 5.5)
- [CVE-2023-39560](https://insights.sbomify.com/CVE-2023-39560/): SQL injection in ectouch:ectouch (critical 9.8)
- [CVE-2023-3956](https://insights.sbomify.com/CVE-2023-3956/): Missing authorization in InstaWP Connect – 1-click WP Staging & Migration (critical 9.8)
- [CVE-2023-39559](https://insights.sbomify.com/CVE-2023-39559/): Information disclosure in web-audimex:audimexee (medium 5.3)
- [CVE-2023-39558](https://insights.sbomify.com/CVE-2023-39558/): Cross-site scripting in web-audimex:audimexee (medium 6.1)
- [CVE-2023-39553](https://insights.sbomify.com/CVE-2023-39553/): Apache Airflow Drill Provider Arbitrary File Read Vulnerability (high 7.5)
- [CVE-2023-39551](https://insights.sbomify.com/CVE-2023-39551/): SQL injection in phpgurukul:online security guards hiring system (critical 9.8)
- [CVE-2023-39550](https://insights.sbomify.com/CVE-2023-39550/): Memory corruption in netgear:jwnr2000v2 firmware (high 8.8)
- [CVE-2023-3955](https://insights.sbomify.com/CVE-2023-3955/): Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation (high 8.8)
- [CVE-2023-39549](https://insights.sbomify.com/CVE-2023-39549/): Use after free in Solid Edge SE2023 (high 7.8)
- [CVE-2023-39548](https://insights.sbomify.com/CVE-2023-39548/): Command injection in CLUSTERPRO X (EXPRESSCLUSTER X) (high 8.8)
- [CVE-2023-39547](https://insights.sbomify.com/CVE-2023-39547/): Command injection in CLUSTERPRO X (EXPRESSCLUSTER X) (high 8.8)
- [CVE-2023-39546](https://insights.sbomify.com/CVE-2023-39546/): Command injection in CLUSTERPRO X (EXPRESSCLUSTER X) (high 8.8)
- [CVE-2023-39545](https://insights.sbomify.com/CVE-2023-39545/): Command injection in CLUSTERPRO X (EXPRESSCLUSTER X) (high 8.8)
- [CVE-2023-39544](https://insights.sbomify.com/CVE-2023-39544/): Missing authorization in CLUSTERPRO X SingleServerSafe (EXPRESSCLUSTER X SingleServerSafe) (high 8.8)
- [CVE-2023-39543](https://insights.sbomify.com/CVE-2023-39543/): Cross-site scripting in LuxCal Web Calendar (medium 6.1)
- [CVE-2023-39542](https://insights.sbomify.com/CVE-2023-39542/): Code injection in Foxit Reader (high 8.8)
- [CVE-2023-39541](https://insights.sbomify.com/CVE-2023-39541/): Memory corruption in Gecko Platform (medium 5.9)
- [CVE-2023-39540](https://insights.sbomify.com/CVE-2023-39540/): Memory corruption in Gecko Platform (medium 5.9)
- [CVE-2023-3954](https://insights.sbomify.com/CVE-2023-3954/): MultiParcels Shipping For WooCommerce 1.15.2-1.15.3 - Reflected XSS (medium 6.1)
- [CVE-2023-39539](https://insights.sbomify.com/CVE-2023-39539/): Failure when uploading a Logo image file (high 7.5)
- [CVE-2023-39538](https://insights.sbomify.com/CVE-2023-39538/): Failure when uploading a Logo image file (high 7.5)
- [CVE-2023-39537](https://insights.sbomify.com/CVE-2023-39537/): Improper input validation in BIOS TCG2 (high 7.5)
- [CVE-2023-39536](https://insights.sbomify.com/CVE-2023-39536/): Improper input validation in BIOS OFBD (high 7.5)
- [CVE-2023-39535](https://insights.sbomify.com/CVE-2023-39535/): Improper input validation in BIOS (high 7.5)
- [CVE-2023-39534](https://insights.sbomify.com/CVE-2023-39534/): Malformed GAP submessage triggers assertion failure (high 7.5)
- [CVE-2023-39533](https://insights.sbomify.com/CVE-2023-39533/): libp2p nodes vulnerable to attack using large RSA keys (high 7.5)
- [CVE-2023-39532](https://insights.sbomify.com/CVE-2023-39532/): SES's dynamic import and spread operator provides possible path to arbitrary exfiltration and execution (critical 9.8)
- [CVE-2023-39531](https://insights.sbomify.com/CVE-2023-39531/): Sentry vulnerable to incorrect credential validation on OAuth token requests (medium 6.5)
- [CVE-2023-39530](https://insights.sbomify.com/CVE-2023-39530/): PrestaShop vulnerable to file deletion via CustomerMessage (medium 6.5)
- [CVE-2023-3953](https://insights.sbomify.com/CVE-2023-3953/): Memory corruption in GP-Pro EX WinGP for PC/AT (medium 5.3)
- [CVE-2023-39529](https://insights.sbomify.com/CVE-2023-39529/): PrestaShop vulnerable to file deletion via attachment API (medium 6.7)
- [CVE-2023-39528](https://insights.sbomify.com/CVE-2023-39528/): PrestaShop vulnerable to file reading through path traversal (medium 6.8)
- [CVE-2023-39527](https://insights.sbomify.com/CVE-2023-39527/): PrestaShop XSS vulnerability through Validate::isCleanHTML method (high 8.3)
- [CVE-2023-39526](https://insights.sbomify.com/CVE-2023-39526/): PrestaShopSQL manager vulnerability (potential RCE) (critical 9.1)
- [CVE-2023-39525](https://insights.sbomify.com/CVE-2023-39525/): PrestaShop vulnerable to path traversal (medium 6.5)
- [CVE-2023-39524](https://insights.sbomify.com/CVE-2023-39524/): PrestaShop vulnerable to boolean SQL injection in search product in BO (medium 6.7)
- [CVE-2023-39523](https://insights.sbomify.com/CVE-2023-39523/): ScanCode.io command injection in docker image fetch process (medium 6.8)
- [CVE-2023-39522](https://insights.sbomify.com/CVE-2023-39522/): Username enumeration attack in goauthentik (medium 5.3)
- [CVE-2023-39521](https://insights.sbomify.com/CVE-2023-39521/): Tuleap vulnerable to Cross-site Scripting on the success message of a kanban deletion (medium 4.8)
- [CVE-2023-39520](https://insights.sbomify.com/CVE-2023-39520/): Cryptomator vulnerable to Local Elevation of Privileges (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/253/