# Vulnerabilities published in 2023


- [CVE-2023-37649](https://insights.sbomify.com/CVE-2023-37649/): Cockpit CMS vulnerable to incorrect access control (high 7.5)
- [CVE-2023-37647](https://insights.sbomify.com/CVE-2023-37647/): SQL injection in sem-cms:semcms (critical 9.8)
- [CVE-2023-37646](https://insights.sbomify.com/CVE-2023-37646/): Path traversal in bitberry:file opener (high 7.8)
- [CVE-2023-37645](https://insights.sbomify.com/CVE-2023-37645/): Information disclosure in eyoucms:eyoucms (medium 5.3)
- [CVE-2023-37644](https://insights.sbomify.com/CVE-2023-37644/): Memory corruption in swftools:swftools (medium 5.5)
- [CVE-2023-3764](https://insights.sbomify.com/CVE-2023-3764/): WooCommerce PDF Invoice Builder <= 1.2.90 - Cross-Site Request Forgery via Save (medium 4.3)
- [CVE-2023-37636](https://insights.sbomify.com/CVE-2023-37636/): Cross-site scripting in webkul:uvdesk (medium 5.4)
- [CVE-2023-37635](https://insights.sbomify.com/CVE-2023-37635/): Auth bypass in uvdesk:community-skeleton (critical 9.8)
- [CVE-2023-37630](https://insights.sbomify.com/CVE-2023-37630/): Cross-site scripting in simple online piggery management system project:simple online piggery management system (medium 6.1)
- [CVE-2023-3763](https://insights.sbomify.com/CVE-2023-3763/): Intergard SGS SQL Query cleartext transmission (low 3.7)
- [CVE-2023-37629](https://insights.sbomify.com/CVE-2023-37629/): File upload in simple online piggery management system project:simple online piggery management system (critical 9.8)
- [CVE-2023-37628](https://insights.sbomify.com/CVE-2023-37628/): SQL injection in simple online piggery management system project:simple online piggery management system (critical 9.8)
- [CVE-2023-37627](https://insights.sbomify.com/CVE-2023-37627/): SQL injection in code-projects:online restaurant management system (critical 9.8)
- [CVE-2023-37625](https://insights.sbomify.com/CVE-2023-37625/): Cross-site scripting in netbox:netbox (medium 5.4)
- [CVE-2023-37624](https://insights.sbomify.com/CVE-2023-37624/): Open redirect in netdisco:netdisco (medium 6.1)
- [CVE-2023-37623](https://insights.sbomify.com/CVE-2023-37623/): Cross-site scripting in netdisco:netdisco (medium 4.8)
- [CVE-2023-3762](https://insights.sbomify.com/CVE-2023-3762/): Intergard SGS sensitive information in memory (medium 4.3)
- [CVE-2023-37613](https://insights.sbomify.com/CVE-2023-37613/): Cross-site scripting in assemblysoftware:trialworks (medium 6.1)
- [CVE-2023-37611](https://insights.sbomify.com/CVE-2023-37611/): Neos CMS Cross Site Scripting vulnerability (medium 5.4)
- [CVE-2023-3761](https://insights.sbomify.com/CVE-2023-3761/): Intergard SGS Password Change cleartext transmission (low 3.7)
- [CVE-2023-37608](https://insights.sbomify.com/CVE-2023-37608/): Hardcoded credentials in automaticsystems:soc fl9600 firstlane firmware (high 7.5)
- [CVE-2023-37607](https://insights.sbomify.com/CVE-2023-37607/): Path traversal in automaticsystems:soc fl9600 firstlane firmware (high 7.5)
- [CVE-2023-37605](https://insights.sbomify.com/CVE-2023-37605/): Denial of service in baramundi:enterprise mobility management (medium 5.5)
- [CVE-2023-37602](https://insights.sbomify.com/CVE-2023-37602/): Alkacon OpenCMS arbitrary file upload vulnerability (medium 6.1)
- [CVE-2023-37601](https://insights.sbomify.com/CVE-2023-37601/): Path traversal in mobisystems:office suite (high 7.5)
- [CVE-2023-37600](https://insights.sbomify.com/CVE-2023-37600/): Cross-site scripting in mobisystems:office suite (medium 6.1)
- [CVE-2023-3760](https://insights.sbomify.com/CVE-2023-3760/): Intergard SGS Change Password denial of service (medium 4.3)
- [CVE-2023-37599](https://insights.sbomify.com/CVE-2023-37599/): Information disclosure in issabel:pbx (high 7.5)
- [CVE-2023-37598](https://insights.sbomify.com/CVE-2023-37598/): Cross-site request forgery in issabel:pbx (medium 4.5)
- [CVE-2023-37597](https://insights.sbomify.com/CVE-2023-37597/): Cross-site request forgery in issabel:pbx (high 8.1)
- [CVE-2023-37596](https://insights.sbomify.com/CVE-2023-37596/): Cross-site request forgery in issabel:pbx (high 8.1)
- [CVE-2023-3759](https://insights.sbomify.com/CVE-2023-3759/): Intergard SGS permission (medium 6.3)
- [CVE-2023-37582](https://insights.sbomify.com/CVE-2023-37582/): Apache RocketMQ: Possible remote code execution when using the update configuration function (critical 9.8)
- [CVE-2023-37581](https://insights.sbomify.com/CVE-2023-37581/): Cross-site scripting in Apache Roller (medium 5.4)
- [CVE-2023-37580](https://insights.sbomify.com/CVE-2023-37580/): Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) (medium 6.1, exploited in the wild)
- [CVE-2023-3758](https://insights.sbomify.com/CVE-2023-3758/): Sssd: race condition during authorization leads to gpo policies functioning inconsistently (high 7.1)
- [CVE-2023-37579](https://insights.sbomify.com/CVE-2023-37579/): Apache Pulsar Function Worker: Incorrect Authorization for Function Worker Can Leak Sink/Source Credentials (high 8.2)
- [CVE-2023-37578](https://insights.sbomify.com/CVE-2023-37578/): Use after free in GTKWave (high 7.8)
- [CVE-2023-37577](https://insights.sbomify.com/CVE-2023-37577/): Use after free in GTKWave (high 7.8)
- [CVE-2023-37576](https://insights.sbomify.com/CVE-2023-37576/): Use after free in GTKWave (high 7.8)
- [CVE-2023-37575](https://insights.sbomify.com/CVE-2023-37575/): Use after free in GTKWave (high 7.8)
- [CVE-2023-37574](https://insights.sbomify.com/CVE-2023-37574/): Use after free in GTKWave (high 7.8)
- [CVE-2023-37573](https://insights.sbomify.com/CVE-2023-37573/): Use after free in GTKWave (high 7.8)
- [CVE-2023-37572](https://insights.sbomify.com/CVE-2023-37572/): Misconfiguration in softing:opc (high 7.5)
- [CVE-2023-37571](https://insights.sbomify.com/CVE-2023-37571/): Cross-site scripting in softing:th scope (medium 6.1)
- [CVE-2023-37570](https://insights.sbomify.com/CVE-2023-37570/): Insufficient Session Expiration Vulnerability in Emagic Data Center Management Suite (high 7.2)
- [CVE-2023-3757](https://insights.sbomify.com/CVE-2023-3757/): GZ Scripts Car Rental Script cross site scripting (low 3.5)
- [CVE-2023-37569](https://insights.sbomify.com/CVE-2023-37569/): OS Command Injection Vulnerability in Emagic Data Center Management Suite (high 8.8)
- [CVE-2023-37568](https://insights.sbomify.com/CVE-2023-37568/): Command injection in WRC-1167GEBK-S (high 8.0)
- [CVE-2023-37567](https://insights.sbomify.com/CVE-2023-37567/): Command injection in LAN-W301NR (critical 9.8)
- [CVE-2023-37566](https://insights.sbomify.com/CVE-2023-37566/): Command injection in LAN-W301NR (high 8.0)
- [CVE-2023-37565](https://insights.sbomify.com/CVE-2023-37565/): Code injection in WRC-1167FEBK-A (high 8.0)
- [CVE-2023-37564](https://insights.sbomify.com/CVE-2023-37564/): Command injection in WRC-1167FEBK-A (high 8.0)
- [CVE-2023-37563](https://insights.sbomify.com/CVE-2023-37563/): Information disclosure in WRC-1167FEBK-A (medium 6.5)
- [CVE-2023-37562](https://insights.sbomify.com/CVE-2023-37562/): Cross-site request forgery in WTC-C1167GC-B (high 8.8)
- [CVE-2023-37561](https://insights.sbomify.com/CVE-2023-37561/): Open redirect in WRH-300WH-H (medium 6.1)
- [CVE-2023-37560](https://insights.sbomify.com/CVE-2023-37560/): Cross-site scripting in WRH-300WH-H (medium 6.1)
- [CVE-2023-3756](https://insights.sbomify.com/CVE-2023-3756/): Creativeitem Atlas Business Directory Listing search cross site scripting (low 3.5)
- [CVE-2023-37559](https://insights.sbomify.com/CVE-2023-37559/): CODESYS Improper Validation of Consistency within Input in multiple products (medium 6.5)
- [CVE-2023-37558](https://insights.sbomify.com/CVE-2023-37558/): CODESYS Improper Validation of Consistency within Input in multiple products (medium 6.5)
- [CVE-2023-37557](https://insights.sbomify.com/CVE-2023-37557/): CODESYS Heap-based Buffer Overflow in multiple products (medium 6.5)
- [CVE-2023-37556](https://insights.sbomify.com/CVE-2023-37556/): CODESYS Improper Input Validation in CmpAppBP (medium 6.5)
- [CVE-2023-37555](https://insights.sbomify.com/CVE-2023-37555/): CODESYS Improper Input Validation in CmpAppBP (medium 6.5)
- [CVE-2023-37554](https://insights.sbomify.com/CVE-2023-37554/): CODESYS Improper Input Validation in CmpAppBP (medium 6.5)
- [CVE-2023-37553](https://insights.sbomify.com/CVE-2023-37553/): CODESYS Improper Input Validation in CmpAppBP (medium 6.5)
- [CVE-2023-37552](https://insights.sbomify.com/CVE-2023-37552/): CODESYS Improper Input Validation in CmpAppBP (medium 6.5)
- [CVE-2023-37551](https://insights.sbomify.com/CVE-2023-37551/): CODESYS Files or Directories Accessible to External Parties in CmpApp (medium 6.5)
- [CVE-2023-37550](https://insights.sbomify.com/CVE-2023-37550/): CODESYS: Improper Input Validation in CmpApp component (medium 6.5)
- [CVE-2023-3755](https://insights.sbomify.com/CVE-2023-3755/): Creativeitem Atlas Business Directory Listing filter_listings cross site scripting (low 3.5)
- [CVE-2023-37549](https://insights.sbomify.com/CVE-2023-37549/): CODESYS: Improper Input Validation in CmpApp component (medium 6.5)
- [CVE-2023-37548](https://insights.sbomify.com/CVE-2023-37548/): CODESYS: Improper Input Validation in CmpApp component (medium 6.5)
- [CVE-2023-37547](https://insights.sbomify.com/CVE-2023-37547/): CODESYS: Improper Input Validation in CmpApp component (medium 6.5)
- [CVE-2023-37546](https://insights.sbomify.com/CVE-2023-37546/): CODESYS: Improper Input Validation in CmpApp component (medium 6.5)
- [CVE-2023-37545](https://insights.sbomify.com/CVE-2023-37545/): CODESYS: Improper Input Validation in CmpApp component (medium 6.5)
- [CVE-2023-37544](https://insights.sbomify.com/CVE-2023-37544/): Apache Pulsar WebSocket Proxy: Improper Authentication for WebSocket Proxy Endpoint Allows DoS (high 7.5)
- [CVE-2023-37543](https://insights.sbomify.com/CVE-2023-37543/): Missing authorization in cacti:cacti (high 7.5)
- [CVE-2023-37541](https://insights.sbomify.com/CVE-2023-37541/): HCL Connections is vulnerable to broken access control (low 3.5)
- [CVE-2023-37540](https://insights.sbomify.com/CVE-2023-37540/): HCL Sametime Chat is affected by an unimplemented feature in the UI (low 3.9)
- [CVE-2023-3754](https://insights.sbomify.com/CVE-2023-3754/): Creativeitem Ekushey Project Manager CRM xxxxxxxx[random-msg-hash] cross site scripting (low 3.5)
- [CVE-2023-37539](https://insights.sbomify.com/CVE-2023-37539/): HCL Domino Catalog template is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability (high 8.4)
- [CVE-2023-37538](https://insights.sbomify.com/CVE-2023-37538/): HCL Digital Experience is susceptible to cross site scripting (XSS) (critical 9.3)
- [CVE-2023-37537](https://insights.sbomify.com/CVE-2023-37537/): HCL AppScan Presence deployed as Windows service might be vulnerable to an Unquoted Service Path vulnerability (high 7.8)
- [CVE-2023-37536](https://insights.sbomify.com/CVE-2023-37536/): HCL BigFix Platform is vulnerable to an integer overflow in xerces-c++ 3.2.3 (high 8.2)
- [CVE-2023-37535](https://insights.sbomify.com/CVE-2023-37535/): HCL Domino Volt and Domino Leap are affected by a Cross-site scripting (XSS) vulnerability (high 7.1)
- [CVE-2023-37534](https://insights.sbomify.com/CVE-2023-37534/): HCL Leap is affected by a Cross-site scripting (XSS) vulnerability (high 7.1)
- [CVE-2023-37533](https://insights.sbomify.com/CVE-2023-37533/): HCL Connections is vulnerable to reflected cross-site scripting (medium 5.4)
- [CVE-2023-37532](https://insights.sbomify.com/CVE-2023-37532/): A path traversal vulnerability affects HCL Commerce (medium 5.8)
- [CVE-2023-37531](https://insights.sbomify.com/CVE-2023-37531/): A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform (low 3.3)
- [CVE-2023-37530](https://insights.sbomify.com/CVE-2023-37530/): A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform (low 3.0)
- [CVE-2023-3753](https://insights.sbomify.com/CVE-2023-3753/): Creativeitem Mastery LMS browse cross site scripting (low 3.5)
- [CVE-2023-37529](https://insights.sbomify.com/CVE-2023-37529/): A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform (low 3.0)
- [CVE-2023-37528](https://insights.sbomify.com/CVE-2023-37528/): A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform (medium 6.5)
- [CVE-2023-37527](https://insights.sbomify.com/CVE-2023-37527/): A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform (medium 5.4)
- [CVE-2023-37526](https://insights.sbomify.com/CVE-2023-37526/): HCL DRYiCE Lucy v9 (now AEX) is affected by a Cross Origin Resource Sharing (CORS) Vulnerability (medium 6.5)
- [CVE-2023-37525](https://insights.sbomify.com/CVE-2023-37525/): HCL BigFix Compliance is vulnerable to a sensitive information disclosure (medium 5.3)
- [CVE-2023-37524](https://insights.sbomify.com/CVE-2023-37524/): Supply chain in Traveler for Microsoft Outlook (high 7.7)
- [CVE-2023-37523](https://insights.sbomify.com/CVE-2023-37523/): HCL BigFix OSD Bare Metal Server WebUI is affected by missing or insecure tags (medium 5.6)
- [CVE-2023-37522](https://insights.sbomify.com/CVE-2023-37522/): HCL BigFix OSD Bare Metal Server WebUI is affected by missing or insecure tags (medium 5.6)
- [CVE-2023-37521](https://insights.sbomify.com/CVE-2023-37521/): HCL BigFix OSD Bare Metal Server WebUI is affected by sensitive information disclosure (low 2.3)
- [CVE-2023-37520](https://insights.sbomify.com/CVE-2023-37520/): HCL BigFix Platform is affected by Unathenticated Stored Cross-Site Scripting (XSS) (high 7.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/270/