# Vulnerabilities published in 2023


- [CVE-2023-38766](https://insights.sbomify.com/CVE-2023-38766/): Cross-site scripting in churchcrm:churchcrm (medium 5.4)
- [CVE-2023-38765](https://insights.sbomify.com/CVE-2023-38765/): SQL injection in churchcrm:churchcrm (high 7.5)
- [CVE-2023-38764](https://insights.sbomify.com/CVE-2023-38764/): SQL injection in churchcrm:churchcrm (high 7.5)
- [CVE-2023-38763](https://insights.sbomify.com/CVE-2023-38763/): SQL injection in churchcrm:churchcrm (medium 6.5)
- [CVE-2023-38762](https://insights.sbomify.com/CVE-2023-38762/): SQL injection in churchcrm:churchcrm (high 7.5)
- [CVE-2023-38761](https://insights.sbomify.com/CVE-2023-38761/): Cross-site scripting in churchcrm:churchcrm (medium 6.1)
- [CVE-2023-38760](https://insights.sbomify.com/CVE-2023-38760/): SQL injection in churchcrm:churchcrm (high 7.5)
- [CVE-2023-3876](https://insights.sbomify.com/CVE-2023-3876/): Campcodes Beauty Salon Management System search-appointment.php sql injection (medium 6.3)
- [CVE-2023-38759](https://insights.sbomify.com/CVE-2023-38759/): wger Workout Manager Cross-Site Request Forgery vulnerability (high 8.8)
- [CVE-2023-38758](https://insights.sbomify.com/CVE-2023-38758/): wger Workout Manager Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2023-38752](https://insights.sbomify.com/CVE-2023-38752/): Missing authorization in Special Interest Group Network for Analysis and Liaison (medium 4.3)
- [CVE-2023-38751](https://insights.sbomify.com/CVE-2023-38751/): Missing authorization in Special Interest Group Network for Analysis and Liaison (medium 4.3)
- [CVE-2023-38750](https://insights.sbomify.com/CVE-2023-38750/): Information disclosure in zimbra:zimbra (high 7.5)
- [CVE-2023-3875](https://insights.sbomify.com/CVE-2023-3875/): Campcodes Beauty Salon Management System del_feedback.php sql injection (medium 6.3)
- [CVE-2023-38748](https://insights.sbomify.com/CVE-2023-38748/): Use after free in CX-Programmer (high 7.8)
- [CVE-2023-38747](https://insights.sbomify.com/CVE-2023-38747/): Memory corruption in CX-Programmer (high 7.8)
- [CVE-2023-38746](https://insights.sbomify.com/CVE-2023-38746/): Memory corruption in CX-Programmer (high 7.8)
- [CVE-2023-38745](https://insights.sbomify.com/CVE-2023-38745/): Path traversal in debian:debian linux (medium 6.3)
- [CVE-2023-38744](https://insights.sbomify.com/CVE-2023-38744/): Denial of service in CJ2H CPU Unit (high 7.5)
- [CVE-2023-38743](https://insights.sbomify.com/CVE-2023-38743/): Command injection in zohocorp:manageengine admanager plus (high 7.2)
- [CVE-2023-38741](https://insights.sbomify.com/CVE-2023-38741/): IBM TXSeries for Multiplatforms denial of service (high 7.5)
- [CVE-2023-38740](https://insights.sbomify.com/CVE-2023-38740/): IBM Db2 denial of service (medium 5.3)
- [CVE-2023-3874](https://insights.sbomify.com/CVE-2023-3874/): Campcodes Beauty Salon Management System admin-profile.php sql injection (medium 6.3)
- [CVE-2023-38739](https://insights.sbomify.com/CVE-2023-38739/): IBM Sterling B2B Integrator cross-site request forgery (medium 4.3)
- [CVE-2023-38738](https://insights.sbomify.com/CVE-2023-38738/): IBM OpenPages with Watson information disclosure (medium 6.8)
- [CVE-2023-38737](https://insights.sbomify.com/CVE-2023-38737/): IBM WebSphere Application Server Liberty denial of service (medium 5.9)
- [CVE-2023-38736](https://insights.sbomify.com/CVE-2023-38736/): IBM QRadar WinCollect Agent privilege escalation (high 7.5)
- [CVE-2023-38735](https://insights.sbomify.com/CVE-2023-38735/): IBM Cognos Dashboards improper authentication (medium 5.7)
- [CVE-2023-38734](https://insights.sbomify.com/CVE-2023-38734/): IBM Robotic Process Automation privilege escalation (medium 6.6)
- [CVE-2023-38733](https://insights.sbomify.com/CVE-2023-38733/): IBM Robotic Process Automation information disclosure (medium 4.3)
- [CVE-2023-38732](https://insights.sbomify.com/CVE-2023-38732/): IBM Robotic Process Automation information disclosure (medium 4.3)
- [CVE-2023-38730](https://insights.sbomify.com/CVE-2023-38730/): IBM Spectrum Copy Data Management information disclosure (medium 5.9)
- [CVE-2023-3873](https://insights.sbomify.com/CVE-2023-3873/): Campcodes Beauty Salon Management System index.php sql injection (high 7.3)
- [CVE-2023-38729](https://insights.sbomify.com/CVE-2023-38729/): IBM Db2 information disclosure (medium 6.8)
- [CVE-2023-38728](https://insights.sbomify.com/CVE-2023-38728/): IBM Db2 denial of service (medium 5.3)
- [CVE-2023-38727](https://insights.sbomify.com/CVE-2023-38727/): IBM Db2 denial of service (medium 5.3)
- [CVE-2023-38724](https://insights.sbomify.com/CVE-2023-38724/): IBM Cognos Controller SQL injection (medium 6.3)
- [CVE-2023-38723](https://insights.sbomify.com/CVE-2023-38723/): Maximo Asset Management cross-site scripting (medium 6.4)
- [CVE-2023-38722](https://insights.sbomify.com/CVE-2023-38722/): IBM Sterling Partner Engagement Manager cross-site scripting (medium 6.4)
- [CVE-2023-38721](https://insights.sbomify.com/CVE-2023-38721/): IBM i privilege escalation (high 8.4)
- [CVE-2023-38720](https://insights.sbomify.com/CVE-2023-38720/): IBM Db2 denial of service (medium 5.3)
- [CVE-2023-3872](https://insights.sbomify.com/CVE-2023-3872/): Campcodes Beauty Salon Management System edit-services.php sql injection (medium 6.3)
- [CVE-2023-38719](https://insights.sbomify.com/CVE-2023-38719/): IBM Db2 denial of service (medium 5.1)
- [CVE-2023-38718](https://insights.sbomify.com/CVE-2023-38718/): IBM Robotic Process Automation information disclosure (low 3.7)
- [CVE-2023-38716](https://insights.sbomify.com/CVE-2023-38716/): IBM Cloud Pak System information disclosure (medium 5.3)
- [CVE-2023-38714](https://insights.sbomify.com/CVE-2023-38714/): IBM Cloud Pak System information disclosure (medium 5.3)
- [CVE-2023-38713](https://insights.sbomify.com/CVE-2023-38713/): IBM Cloud Pak System information disclosure (medium 5.3)
- [CVE-2023-38712](https://insights.sbomify.com/CVE-2023-38712/): Null dereference in libreswan:libreswan (medium 6.5)
- [CVE-2023-38711](https://insights.sbomify.com/CVE-2023-38711/): Null dereference in libreswan:libreswan (medium 6.5)
- [CVE-2023-38710](https://insights.sbomify.com/CVE-2023-38710/): Denial of service in libreswan:libreswan (medium 6.5)
- [CVE-2023-3871](https://insights.sbomify.com/CVE-2023-3871/): Campcodes Beauty Salon Management System edit_category.php sql injection (medium 6.3)
- [CVE-2023-38709](https://insights.sbomify.com/CVE-2023-38709/): Apache HTTP Server: HTTP response splitting (high 7.3)
- [CVE-2023-38708](https://insights.sbomify.com/CVE-2023-38708/): Pimcore Path Traversal Vulnerability in AssetController:importServerFilesAction (medium 6.3)
- [CVE-2023-38706](https://insights.sbomify.com/CVE-2023-38706/): Discourse vulnerable to DoS via drafts (medium 6.5)
- [CVE-2023-38704](https://insights.sbomify.com/CVE-2023-38704/): import-in-the-middle allows unsanitized user controlled input in module generation (high 8.1)
- [CVE-2023-38703](https://insights.sbomify.com/CVE-2023-38703/): PJSIP has use-after-free vulnerability in SRTP media transport (critical 9.8)
- [CVE-2023-38702](https://insights.sbomify.com/CVE-2023-38702/): Knowage Server vulnerable to path traversal via upload functionality (critical 10.0)
- [CVE-2023-38701](https://insights.sbomify.com/CVE-2023-38701/): Hydra's committed UTxOs at Commit validator and UTxOs at Initial validator can be spent arbitrarily by anyone (critical 9.1)
- [CVE-2023-38700](https://insights.sbomify.com/CVE-2023-38700/): matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms (low 3.5)
- [CVE-2023-38699](https://insights.sbomify.com/CVE-2023-38699/): MindsDB 'Call to requests with verify=False disabling SSL certificate checks, security issue.' issue (critical 9.1)
- [CVE-2023-38698](https://insights.sbomify.com/CVE-2023-38698/): .eth registrar controller can shorten the duration of registered names (medium 4.9)
- [CVE-2023-38697](https://insights.sbomify.com/CVE-2023-38697/): protocol-http1 HTTP Request/Response Smuggling vulnerability (medium 5.8)
- [CVE-2023-38695](https://insights.sbomify.com/CVE-2023-38695/): cypress-image-snapshot vulnerable to insecure snapshot file names (medium 6.5)
- [CVE-2023-38694](https://insights.sbomify.com/CVE-2023-38694/): Umbraco CMS vulnerable to possible injection of HTML in an unintended form (low 3.5)
- [CVE-2023-38693](https://insights.sbomify.com/CVE-2023-38693/): RCE in Lucee REST endpoint (critical 9.8)
- [CVE-2023-38692](https://insights.sbomify.com/CVE-2023-38692/): Command injection vulnerability in module management function in CloudExplorer Lite (critical 9.8)
- [CVE-2023-38691](https://insights.sbomify.com/CVE-2023-38691/): matrix-appservice-bridge doesn't verify the sub parameter of an openId token exhange, allowing unauthorized access to provisioning APIs (medium 5.0)
- [CVE-2023-38690](https://insights.sbomify.com/CVE-2023-38690/): matrix-appservice-irc IRC command injection via admin commands containing newlines (medium 5.8)
- [CVE-2023-3869](https://insights.sbomify.com/CVE-2023-3869/): wpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Comment Rating Increase/Decrease (medium 5.3)
- [CVE-2023-38689](https://insights.sbomify.com/CVE-2023-38689/): Deserialization of Untrusted Data in network IO (high 8.1)
- [CVE-2023-38688](https://insights.sbomify.com/CVE-2023-38688/): twitch-tui's connection is not encrypted (high 7.5)
- [CVE-2023-38687](https://insights.sbomify.com/CVE-2023-38687/): Execution of arbitrary JavaScript from Svelecte item names (medium 5.4)
- [CVE-2023-38686](https://insights.sbomify.com/CVE-2023-38686/): Sydent does not verify email server certificates (critical 9.3)
- [CVE-2023-38685](https://insights.sbomify.com/CVE-2023-38685/): Discourse's restricted tag information visible to unauthenticated users (medium 4.3)
- [CVE-2023-38684](https://insights.sbomify.com/CVE-2023-38684/): Discourse vulnerable to ossible DDoS due to unbounded limits in various controller actions (medium 5.3)
- [CVE-2023-38683](https://insights.sbomify.com/CVE-2023-38683/): Memory corruption in JT2Go (high 7.8)
- [CVE-2023-38682](https://insights.sbomify.com/CVE-2023-38682/): Memory corruption in JT2Go (high 7.8)
- [CVE-2023-38681](https://insights.sbomify.com/CVE-2023-38681/): Memory corruption in Tecnomatix Plant Simulation V2201 (high 7.8)
- [CVE-2023-38680](https://insights.sbomify.com/CVE-2023-38680/): Memory corruption in Tecnomatix Plant Simulation V2201 (high 7.8)
- [CVE-2023-38679](https://insights.sbomify.com/CVE-2023-38679/): Memory corruption in Tecnomatix Plant Simulation V2201 (high 7.8)
- [CVE-2023-38678](https://insights.sbomify.com/CVE-2023-38678/): Segfault in paddle.mode (medium 4.7)
- [CVE-2023-38677](https://insights.sbomify.com/CVE-2023-38677/): FPE in paddle.linalg.eig (medium 4.7)
- [CVE-2023-38676](https://insights.sbomify.com/CVE-2023-38676/): Segfault in paddle.dot (medium 4.7)
- [CVE-2023-38675](https://insights.sbomify.com/CVE-2023-38675/): FPE in paddle.linalg.matrix_rank (medium 4.7)
- [CVE-2023-38674](https://insights.sbomify.com/CVE-2023-38674/): FPE in paddle.nanmedian (medium 4.7)
- [CVE-2023-38673](https://insights.sbomify.com/CVE-2023-38673/): Command injection in fs.py (critical 9.6)
- [CVE-2023-38672](https://insights.sbomify.com/CVE-2023-38672/): FPE in paddle.linalg.matrix_power (medium 4.7)
- [CVE-2023-38671](https://insights.sbomify.com/CVE-2023-38671/): Heap buffer overflow in paddle.trace (high 8.3)
- [CVE-2023-38670](https://insights.sbomify.com/CVE-2023-38670/): Null pointer dereference in paddle.flip (medium 4.7)
- [CVE-2023-3867](https://insights.sbomify.com/CVE-2023-3867/): ksmbd: fix out of bounds read in smb2_sess_setup (critical 9.1)
- [CVE-2023-38669](https://insights.sbomify.com/CVE-2023-38669/): Use after free in PaddlePaddle (high 8.3)
- [CVE-2023-38668](https://insights.sbomify.com/CVE-2023-38668/): Memory corruption in nasm:netwide assembler (medium 5.5)
- [CVE-2023-38667](https://insights.sbomify.com/CVE-2023-38667/): Memory corruption in nasm:netwide assembler (medium 5.5)
- [CVE-2023-38666](https://insights.sbomify.com/CVE-2023-38666/): Memory corruption in axiosys:bento4 (medium 5.5)
- [CVE-2023-38665](https://insights.sbomify.com/CVE-2023-38665/): Null dereference in nasm:netwide assembler (medium 5.5)
- [CVE-2023-3866](https://insights.sbomify.com/CVE-2023-3866/): ksmbd: validate session id and tree id in the compound request (high 7.5)
- [CVE-2023-38657](https://insights.sbomify.com/CVE-2023-38657/): Memory corruption in GTKWave (high 7.8)
- [CVE-2023-38655](https://insights.sbomify.com/CVE-2023-38655/): Memory corruption in Intel(R) AMT and Intel(R) Standard Manageability (medium 6.9)
- [CVE-2023-38654](https://insights.sbomify.com/CVE-2023-38654/): Denial of service in some Intel(R) PROSet/Wireless WiFi software for Windows (high 8.2)
- [CVE-2023-38653](https://insights.sbomify.com/CVE-2023-38653/): Integer overflow in GTKWave (high 7.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/260/