# Vulnerabilities published in 2023


- [CVE-2023-39057](https://insights.sbomify.com/CVE-2023-39057/): Information disclosure in lycorp:line mini app (high 7.5)
- [CVE-2023-39056](https://insights.sbomify.com/CVE-2023-39056/): Information disclosure in coffee-jumbo project:coffee-jumbo (medium 6.5)
- [CVE-2023-39054](https://insights.sbomify.com/CVE-2023-39054/): Information disclosure in lycorp:line mini app (high 7.5)
- [CVE-2023-39053](https://insights.sbomify.com/CVE-2023-39053/): Information disclosure in lycorp:line mini app (high 7.5)
- [CVE-2023-39052](https://insights.sbomify.com/CVE-2023-39052/): Information disclosure in earthgarden waiting project:earthgarden waiting (medium 6.5)
- [CVE-2023-39051](https://insights.sbomify.com/CVE-2023-39051/): Information disclosure in lycorp:line mini app (high 7.5)
- [CVE-2023-39050](https://insights.sbomify.com/CVE-2023-39050/): Information disclosure in lycorp:line mini app (high 7.5)
- [CVE-2023-39049](https://insights.sbomify.com/CVE-2023-39049/): Information disclosure in youmart-tokunaga project:youmart-tokunaga (medium 6.5)
- [CVE-2023-39048](https://insights.sbomify.com/CVE-2023-39048/): Information disclosure in lycorp:line mini app (high 7.5)
- [CVE-2023-39047](https://insights.sbomify.com/CVE-2023-39047/): Information disclosure in lycorp:line mini app (high 7.5)
- [CVE-2023-39046](https://insights.sbomify.com/CVE-2023-39046/): Information disclosure in tonton-tei waiting project:tonton-tei waiting (medium 6.5)
- [CVE-2023-39045](https://insights.sbomify.com/CVE-2023-39045/): Information disclosure in kokoroe members card project:kokoroe members card (medium 6.5)
- [CVE-2023-39044](https://insights.sbomify.com/CVE-2023-39044/): Information disclosure in ajino-shiretoko project:ajino-shiretoko (medium 6.5)
- [CVE-2023-39043](https://insights.sbomify.com/CVE-2023-39043/): Information disclosure in ykc:tokushima awayokocho (medium 6.5)
- [CVE-2023-39042](https://insights.sbomify.com/CVE-2023-39042/): Information disclosure in lycorp:line mini app (high 7.5)
- [CVE-2023-39041](https://insights.sbomify.com/CVE-2023-39041/): Information disclosure in kukurudeli project:kukurudeli (medium 6.5)
- [CVE-2023-39040](https://insights.sbomify.com/CVE-2023-39040/): Information disclosure in cheese cafe line project:cheese cafe line (medium 6.5)
- [CVE-2023-3904](https://insights.sbomify.com/CVE-2023-3904/): Improper Validation of Specified Type of Input in GitLab (medium 4.3)
- [CVE-2023-39039](https://insights.sbomify.com/CVE-2023-39039/): Information disclosure in camp style project line project:camp style project line (medium 6.5)
- [CVE-2023-39026](https://insights.sbomify.com/CVE-2023-39026/): Path traversal in filemage:filemage (high 7.5)
- [CVE-2023-39023](https://insights.sbomify.com/CVE-2023-39023/): Code injection in university compass project:university compass (critical 9.8)
- [CVE-2023-39022](https://insights.sbomify.com/CVE-2023-39022/): Code injection in oscore (critical 9.8)
- [CVE-2023-39021](https://insights.sbomify.com/CVE-2023-39021/): Code injection in wix-embedded-mysql (critical 9.8)
- [CVE-2023-39020](https://insights.sbomify.com/CVE-2023-39020/): Code injection in stanford-parser (critical 9.8)
- [CVE-2023-39018](https://insights.sbomify.com/CVE-2023-39018/): Code injection in bramp:ffmpeg-cli-wrapper (critical 9.8)
- [CVE-2023-39017](https://insights.sbomify.com/CVE-2023-39017/): Code injection in softwareag:quartz (critical 9.8)
- [CVE-2023-39016](https://insights.sbomify.com/CVE-2023-39016/): Code injection in bbossgroups:bboss (critical 9.8)
- [CVE-2023-39015](https://insights.sbomify.com/CVE-2023-39015/): Code injection in webmagic-core (critical 9.8)
- [CVE-2023-39013](https://insights.sbomify.com/CVE-2023-39013/): Code injection in Duke (critical 9.8)
- [CVE-2023-39010](https://insights.sbomify.com/CVE-2023-39010/): Code injection in BoofCV (critical 9.8)
- [CVE-2023-39008](https://insights.sbomify.com/CVE-2023-39008/): Command injection in opnsense:opnsense (critical 9.8)
- [CVE-2023-39007](https://insights.sbomify.com/CVE-2023-39007/): Cross-site scripting in opnsense:opnsense (critical 9.6)
- [CVE-2023-39006](https://insights.sbomify.com/CVE-2023-39006/): Cross-site scripting in opnsense:opnsense (medium 5.4)
- [CVE-2023-39005](https://insights.sbomify.com/CVE-2023-39005/): Misconfiguration in opnsense:opnsense (high 7.5)
- [CVE-2023-39004](https://insights.sbomify.com/CVE-2023-39004/): Misconfiguration in opnsense:opnsense (critical 9.8)
- [CVE-2023-39003](https://insights.sbomify.com/CVE-2023-39003/): Misconfiguration in opnsense:opnsense (high 7.5)
- [CVE-2023-39002](https://insights.sbomify.com/CVE-2023-39002/): Cross-site scripting in opnsense:opnsense (medium 6.1)
- [CVE-2023-39001](https://insights.sbomify.com/CVE-2023-39001/): Command injection in opnsense:opnsense (critical 9.8)
- [CVE-2023-39000](https://insights.sbomify.com/CVE-2023-39000/): Cross-site scripting in opnsense:opnsense (medium 6.1)
- [CVE-2023-3900](https://insights.sbomify.com/CVE-2023-3900/): Improper Validation of Specified Type of Input in GitLab (medium 4.3)
- [CVE-2023-38999](https://insights.sbomify.com/CVE-2023-38999/): Cross-site request forgery in opnsense:opnsense (medium 6.5)
- [CVE-2023-38998](https://insights.sbomify.com/CVE-2023-38998/): Open redirect in opnsense:opnsense (medium 6.1)
- [CVE-2023-38997](https://insights.sbomify.com/CVE-2023-38997/): Path traversal in opnsense:opnsense (high 7.2)
- [CVE-2023-38996](https://insights.sbomify.com/CVE-2023-38996/): Command injection in douran:dsgate (medium 6.7)
- [CVE-2023-38995](https://insights.sbomify.com/CVE-2023-38995/): Hardcoded credentials in schuhfried:schuhfried (critical 9.8)
- [CVE-2023-38994](https://insights.sbomify.com/CVE-2023-38994/): Information disclosure in univention:univention corporate server (high 7.9)
- [CVE-2023-38992](https://insights.sbomify.com/CVE-2023-38992/): SQL injection in jeecg-boot (critical 9.8)
- [CVE-2023-38991](https://insights.sbomify.com/CVE-2023-38991/): Missing authorization in jeesite:jeesite (medium 5.4)
- [CVE-2023-38990](https://insights.sbomify.com/CVE-2023-38990/): Missing authorization in jeesite:jeesite (medium 4.3)
- [CVE-2023-3899](https://insights.sbomify.com/CVE-2023-3899/): Missing authorization in Red Hat Enterprise Linux 6 (high 7.8)
- [CVE-2023-38989](https://insights.sbomify.com/CVE-2023-38989/): Missing authorization in jeesite:jeesite (medium 4.3)
- [CVE-2023-38988](https://insights.sbomify.com/CVE-2023-38988/): Missing authorization in jeesite:jeesite (medium 4.3)
- [CVE-2023-3898](https://insights.sbomify.com/CVE-2023-3898/): SQLi in mAyaNets E-Commerce Software (critical 9.8)
- [CVE-2023-38976](https://insights.sbomify.com/CVE-2023-38976/): Weaviate denial of service vulnerability (high 7.5)
- [CVE-2023-38975](https://insights.sbomify.com/CVE-2023-38975/): Memory corruption in qdrant:qdrant (high 7.5)
- [CVE-2023-38974](https://insights.sbomify.com/CVE-2023-38974/): Cross-site scripting in uatech:badaso (medium 5.4)
- [CVE-2023-38973](https://insights.sbomify.com/CVE-2023-38973/): Cross-site scripting in uatech:badaso (medium 5.4)
- [CVE-2023-38971](https://insights.sbomify.com/CVE-2023-38971/): Cross-site scripting in uatech:badaso (medium 5.4)
- [CVE-2023-38970](https://insights.sbomify.com/CVE-2023-38970/): Badaso vulnerable to cross-site scripting (medium 5.4)
- [CVE-2023-3897](https://insights.sbomify.com/CVE-2023-3897/): Bypassing CAPTCHA & Enumerating Usernames via Password Reset Page (medium 4.8)
- [CVE-2023-38969](https://insights.sbomify.com/CVE-2023-38969/): Cross-site scripting in uatech:badaso (medium 5.4)
- [CVE-2023-38965](https://insights.sbomify.com/CVE-2023-38965/): Auth bypass in oretnom23:lost and found information system (critical 9.8)
- [CVE-2023-38964](https://insights.sbomify.com/CVE-2023-38964/): Cross-site scripting in creativeitem:academy lms (medium 6.1)
- [CVE-2023-38961](https://insights.sbomify.com/CVE-2023-38961/): Memory corruption in jerryscript:jerryscript (critical 9.8)
- [CVE-2023-38960](https://insights.sbomify.com/CVE-2023-38960/): Misconfiguration in raidenftpd:raidenftpd (high 7.3)
- [CVE-2023-3896](https://insights.sbomify.com/CVE-2023-3896/): A divide by zero issue existed in vim of OpenCloudOS Stream (high 7.8)
- [CVE-2023-38958](https://insights.sbomify.com/CVE-2023-38958/): Missing authorization in zkteco:bioaccess ivs (medium 5.3)
- [CVE-2023-38956](https://insights.sbomify.com/CVE-2023-38956/): Path traversal in zkteco:bioaccess ivs (high 7.5)
- [CVE-2023-38955](https://insights.sbomify.com/CVE-2023-38955/): Information disclosure in zkteco:bioaccess ivs (high 7.5)
- [CVE-2023-38954](https://insights.sbomify.com/CVE-2023-38954/): SQL injection in zkteco:bioaccess ivs (critical 9.8)
- [CVE-2023-38952](https://insights.sbomify.com/CVE-2023-38952/): Privilege escalation in zkteco:biotime (high 7.5)
- [CVE-2023-38951](https://insights.sbomify.com/CVE-2023-38951/): Path traversal in zkteco:biotime (critical 9.8)
- [CVE-2023-38950](https://insights.sbomify.com/CVE-2023-38950/): ZKTeco BioTime Path Traversal (high 7.5, exploited in the wild)
- [CVE-2023-38949](https://insights.sbomify.com/CVE-2023-38949/): Missing authorization in zkteco:biotime (high 7.5)
- [CVE-2023-38948](https://insights.sbomify.com/CVE-2023-38948/): Code injection in jizhicms:jizhicms (high 7.2)
- [CVE-2023-38947](https://insights.sbomify.com/CVE-2023-38947/): File upload in wbce:wbce cms (high 7.2)
- [CVE-2023-38946](https://insights.sbomify.com/CVE-2023-38946/): Auth bypass in multilaser:re160 firmware (high 8.8)
- [CVE-2023-38945](https://insights.sbomify.com/CVE-2023-38945/): Auth bypass in multilaser:re160 firmware (high 8.8)
- [CVE-2023-38944](https://insights.sbomify.com/CVE-2023-38944/): Auth bypass in multilaser:re160v firmware (critical 9.8)
- [CVE-2023-38943](https://insights.sbomify.com/CVE-2023-38943/): Code injection in shuize 0x727 project:shuize 0x727 (high 8.8)
- [CVE-2023-38942](https://insights.sbomify.com/CVE-2023-38942/): Command injection in dango:dango-translator (critical 9.8)
- [CVE-2023-38941](https://insights.sbomify.com/CVE-2023-38941/): Command injection in ehco1996:django-sspanel (critical 9.8)
- [CVE-2023-38940](https://insights.sbomify.com/CVE-2023-38940/): Memory corruption in tenda:f1203 firmware (critical 9.8)
- [CVE-2023-3894](https://insights.sbomify.com/CVE-2023-3894/): DOS in jackson-dataformats-text (medium 5.8)
- [CVE-2023-38939](https://insights.sbomify.com/CVE-2023-38939/): Memory corruption in tenda:f1202 firmware (critical 9.8)
- [CVE-2023-38938](https://insights.sbomify.com/CVE-2023-38938/): Memory corruption in tenda:f1202 firmware (critical 9.8)
- [CVE-2023-38937](https://insights.sbomify.com/CVE-2023-38937/): Memory corruption in tenda:ac10 firmware (critical 9.8)
- [CVE-2023-38936](https://insights.sbomify.com/CVE-2023-38936/): Memory corruption in tenda:ac10 firmware (critical 9.8)
- [CVE-2023-38935](https://insights.sbomify.com/CVE-2023-38935/): Memory corruption in tenda:ac10 firmware (critical 9.8)
- [CVE-2023-38934](https://insights.sbomify.com/CVE-2023-38934/): Memory corruption in tenda:f1203 firmware (critical 9.8)
- [CVE-2023-38933](https://insights.sbomify.com/CVE-2023-38933/): Memory corruption in tenda:ac10 firmware (critical 9.8)
- [CVE-2023-38932](https://insights.sbomify.com/CVE-2023-38932/): Memory corruption in tenda:f1202 firmware (critical 9.8)
- [CVE-2023-38931](https://insights.sbomify.com/CVE-2023-38931/): Memory corruption in tenda:ac10 firmware (critical 9.8)
- [CVE-2023-38930](https://insights.sbomify.com/CVE-2023-38930/): Memory corruption in tenda:ac5 firmware (critical 9.8)
- [CVE-2023-3893](https://insights.sbomify.com/CVE-2023-3893/): Kubernetes - csi-proxy - Insufficient input sanitization leads to privilege escalation (high 8.8)
- [CVE-2023-38929](https://insights.sbomify.com/CVE-2023-38929/): Memory corruption in tenda:4g300 firmware (critical 9.8)
- [CVE-2023-38928](https://insights.sbomify.com/CVE-2023-38928/): Command injection in netgear:r7100lg firmware (critical 9.8)
- [CVE-2023-38926](https://insights.sbomify.com/CVE-2023-38926/): Memory corruption in netgear:ex6200 firmware (high 8.8)
- [CVE-2023-38925](https://insights.sbomify.com/CVE-2023-38925/): Memory corruption in netgear:dc112a firmware (high 8.8)
- [CVE-2023-38924](https://insights.sbomify.com/CVE-2023-38924/): Memory corruption in netgear:dgn3500 firmware (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/258/