# Vulnerabilities published in 2023


- [CVE-2023-37310](https://insights.sbomify.com/CVE-2023-37310/): D-Link DAP-2622 DDP Set Device Info Auth Username Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-3731](https://insights.sbomify.com/CVE-2023-3731/): Use after free in Chrome (high 8.8)
- [CVE-2023-37308](https://insights.sbomify.com/CVE-2023-37308/): Cross-site scripting in zohocorp:manageengine adaudit plus (medium 5.4)
- [CVE-2023-37307](https://insights.sbomify.com/CVE-2023-37307/): Cross-site scripting in misp-project:misp (medium 5.4)
- [CVE-2023-37306](https://insights.sbomify.com/CVE-2023-37306/): Information disclosure in misp-project:misp (high 7.5)
- [CVE-2023-37305](https://insights.sbomify.com/CVE-2023-37305/): Information disclosure in mediawiki:mediawiki (medium 5.3)
- [CVE-2023-37304](https://insights.sbomify.com/CVE-2023-37304/): Cross-site scripting in mediawiki:mediawiki (medium 5.4)
- [CVE-2023-37303](https://insights.sbomify.com/CVE-2023-37303/): Other in mediawiki:mediawiki (critical 9.8)
- [CVE-2023-37302](https://insights.sbomify.com/CVE-2023-37302/): MediaWiki Cross-site Scripting vulnerability (medium 6.1)
- [CVE-2023-37301](https://insights.sbomify.com/CVE-2023-37301/): Security feature bypass in mediawiki:mediawiki (medium 5.3)
- [CVE-2023-37300](https://insights.sbomify.com/CVE-2023-37300/): Missing authorization in mediawiki:mediawiki (medium 5.3)
- [CVE-2023-3730](https://insights.sbomify.com/CVE-2023-3730/): Use after free in Chrome (high 8.8)
- [CVE-2023-37299](https://insights.sbomify.com/CVE-2023-37299/): Joplin Cross-site Scripting vulnerability (medium 6.1)
- [CVE-2023-37298](https://insights.sbomify.com/CVE-2023-37298/): Joplin Cross-site Scripting vulnerability (medium 6.1)
- [CVE-2023-37297](https://insights.sbomify.com/CVE-2023-37297/): heap memory overflow (high 8.3)
- [CVE-2023-37296](https://insights.sbomify.com/CVE-2023-37296/): Stack-based Buffer Overflow (high 8.3)
- [CVE-2023-37295](https://insights.sbomify.com/CVE-2023-37295/): Heap-based Buffer Overflow (high 8.3)
- [CVE-2023-37294](https://insights.sbomify.com/CVE-2023-37294/): Heap-based Buffer Overflow (high 8.3)
- [CVE-2023-37293](https://insights.sbomify.com/CVE-2023-37293/): stack-based buffer overflow (critical 9.6)
- [CVE-2023-37292](https://insights.sbomify.com/CVE-2023-37292/): HGiga iSherlock - Command Injection (critical 9.8)
- [CVE-2023-37291](https://insights.sbomify.com/CVE-2023-37291/): Galaxy Software Services Vitals ESP - Use of Hard-coded Cryptographic Key (high 8.6)
- [CVE-2023-37290](https://insights.sbomify.com/CVE-2023-37290/): InfoDoc Document On-line Submission and Approval System - Server-Side Request Forgery (SSRF) (high 7.5)
- [CVE-2023-3729](https://insights.sbomify.com/CVE-2023-3729/): Use after free in Chrome (high 8.8)
- [CVE-2023-37289](https://insights.sbomify.com/CVE-2023-37289/): InfoDoc Document On-line Submission and Approval System - Arbitrary File Upload (critical 9.8)
- [CVE-2023-37288](https://insights.sbomify.com/CVE-2023-37288/): SmartBPM.NET - Path Traversal (medium 6.5)
- [CVE-2023-37287](https://insights.sbomify.com/CVE-2023-37287/): SmartBPM.NET - Use of Hard-Coded Credentials - 2 (critical 9.1)
- [CVE-2023-37286](https://insights.sbomify.com/CVE-2023-37286/): SmartBPM.NET - Use of Hard-Coded Credentials - 1 (critical 9.8)
- [CVE-2023-37285](https://insights.sbomify.com/CVE-2023-37285/): Memory corruption in iOS and iPadOS (critical 9.8)
- [CVE-2023-37284](https://insights.sbomify.com/CVE-2023-37284/): Auth bypass in Archer C20 (high 8.8)
- [CVE-2023-37283](https://insights.sbomify.com/CVE-2023-37283/): Authentication Bypass via HTML Form & Identifier First Adapter (high 8.1)
- [CVE-2023-37282](https://insights.sbomify.com/CVE-2023-37282/): Memory corruption in GTKWave (high 7.8)
- [CVE-2023-37281](https://insights.sbomify.com/CVE-2023-37281/): Out-of-bounds read during IPHC address decompression (medium 5.3)
- [CVE-2023-37280](https://insights.sbomify.com/CVE-2023-37280/): Pimcore admin UI vulnerable to Cross-site Scripting in two factor authentication setup page (medium 5.0)
- [CVE-2023-3728](https://insights.sbomify.com/CVE-2023-3728/): Use after free in Chrome (high 8.8)
- [CVE-2023-37279](https://insights.sbomify.com/CVE-2023-37279/): Faktory Web Dashboard can lead to denial of service(DOS) via malicious user input (high 7.5)
- [CVE-2023-37278](https://insights.sbomify.com/CVE-2023-37278/): GLPI vulnerable to SQL injection via dashboard administration (medium 6.8)
- [CVE-2023-37277](https://insights.sbomify.com/CVE-2023-37277/): XWiki Platform vulnerable to cross-site request forgery (CSRF) via the REST API (critical 9.7)
- [CVE-2023-37276](https://insights.sbomify.com/CVE-2023-37276/): aiohttp vulnerable to HTTP request smuggling (medium 5.3)
- [CVE-2023-37275](https://insights.sbomify.com/CVE-2023-37275/): System logs spoofable in Auto-GPT via ANSI control sequences (low 3.1)
- [CVE-2023-37274](https://insights.sbomify.com/CVE-2023-37274/): Python code execution sandbox escape in non-docker version in Auto-GPT (high 7.6)
- [CVE-2023-37273](https://insights.sbomify.com/CVE-2023-37273/): Docker escape in Auto-GPT when running from docker-compose.yml included in git repo (high 8.1)
- [CVE-2023-37272](https://insights.sbomify.com/CVE-2023-37272/): XSS vulnerability in JOC Cockpit branch 1.13 (medium 6.3)
- [CVE-2023-37271](https://insights.sbomify.com/CVE-2023-37271/): RestrictedPython vulnerable to arbitrary code execution via stack frame sandbox escape (high 8.4)
- [CVE-2023-37270](https://insights.sbomify.com/CVE-2023-37270/): Piwigo SQL Injection vulnerability in "User-Agent" (high 7.6)
- [CVE-2023-3727](https://insights.sbomify.com/CVE-2023-3727/): Use after free in Chrome (high 8.8)
- [CVE-2023-37269](https://insights.sbomify.com/CVE-2023-37269/): Winter CMS vulnerable to stored XSS through privileged upload of SVG file (low 2.0)
- [CVE-2023-37268](https://insights.sbomify.com/CVE-2023-37268/): User login confusion with SSO in warpgate (medium 6.4)
- [CVE-2023-37267](https://insights.sbomify.com/CVE-2023-37267/): Umbraco allows possible Admin-level access to backoffice without Auth under rare conditions (high 7.5)
- [CVE-2023-37266](https://insights.sbomify.com/CVE-2023-37266/): Weak json web token (JWT) secrets in CasaOS (critical 9.8)
- [CVE-2023-37265](https://insights.sbomify.com/CVE-2023-37265/): Incorrect identification of source IP addresses in CasaOS (critical 9.8)
- [CVE-2023-37264](https://insights.sbomify.com/CVE-2023-37264/): Pipelines do not validate child UIDs (low 3.7)
- [CVE-2023-37263](https://insights.sbomify.com/CVE-2023-37263/): Strapi's field level permissions not being respected in relationship title (medium 6.8)
- [CVE-2023-37262](https://insights.sbomify.com/CVE-2023-37262/): CC: Tweaked SSRF to Cloud Services Metadata Services not Blocked by Default (critical 9.6)
- [CVE-2023-37261](https://insights.sbomify.com/CVE-2023-37261/): OpenComputers's SSRF to cloud service metadata services and local IPv6 addresses not blocked by default (critical 9.6)
- [CVE-2023-37260](https://insights.sbomify.com/CVE-2023-37260/): league/oauth2-server key exposed in exception message when passing as string and providing invalid pass phrase (high 8.2)
- [CVE-2023-3726](https://insights.sbomify.com/CVE-2023-3726/): OCSInventory-ocsreports 2.12.0 - Stored cross-site Scripting (medium 6.9)
- [CVE-2023-37259](https://insights.sbomify.com/CVE-2023-37259/): Cross site scripting in Export Chat feature (medium 6.1)
- [CVE-2023-37258](https://insights.sbomify.com/CVE-2023-37258/): DataEase has a SQL injection vulnerability that can bypass blacklists (high 8.8)
- [CVE-2023-37257](https://insights.sbomify.com/CVE-2023-37257/): The DataEase panel and dataset have a stored XSS vulnerability (medium 5.4)
- [CVE-2023-37256](https://insights.sbomify.com/CVE-2023-37256/): Cross-site scripting in mediawiki:mediawiki (medium 6.1)
- [CVE-2023-37255](https://insights.sbomify.com/CVE-2023-37255/): Cross-site scripting in mediawiki:mediawiki (medium 6.1)
- [CVE-2023-37254](https://insights.sbomify.com/CVE-2023-37254/): Cross-site scripting in mediawiki:mediawiki (medium 6.1)
- [CVE-2023-37253](https://insights.sbomify.com/CVE-2023-37253/): Information disclosure in ProofreadPage (low 3.1)
- [CVE-2023-37252](https://insights.sbomify.com/CVE-2023-37252/): Information disclosure in CheckUser (low 3.1)
- [CVE-2023-37251](https://insights.sbomify.com/CVE-2023-37251/): Cross-site scripting in mediawiki:mediawiki (medium 6.1)
- [CVE-2023-37250](https://insights.sbomify.com/CVE-2023-37250/): Race condition in unity:parsec (high 7.0)
- [CVE-2023-3725](https://insights.sbomify.com/CVE-2023-3725/): Potential buffer overflow vulnerability in the Zephyr CANbus subsystem (high 7.6)
- [CVE-2023-37249](https://insights.sbomify.com/CVE-2023-37249/): Command injection in infoblox:nios (high 8.8)
- [CVE-2023-37248](https://insights.sbomify.com/CVE-2023-37248/): Memory corruption in Tecnomatix Plant Simulation V2201 (high 7.8)
- [CVE-2023-37247](https://insights.sbomify.com/CVE-2023-37247/): Memory corruption in Tecnomatix Plant Simulation V2201 (high 7.8)
- [CVE-2023-37246](https://insights.sbomify.com/CVE-2023-37246/): Memory corruption in Tecnomatix Plant Simulation V2201 (high 7.8)
- [CVE-2023-37245](https://insights.sbomify.com/CVE-2023-37245/): Memory corruption in EMUI (critical 9.1)
- [CVE-2023-37244](https://insights.sbomify.com/CVE-2023-37244/): Privilege escalation in N-Able's AutomationManagerAgent (medium 5.3)
- [CVE-2023-37243](https://insights.sbomify.com/CVE-2023-37243/): Privilege escalation in Atera Agent Package Availability (high 7.8)
- [CVE-2023-37242](https://insights.sbomify.com/CVE-2023-37242/): Other in EMUI (critical 9.8)
- [CVE-2023-37241](https://insights.sbomify.com/CVE-2023-37241/): Denial of service in EMUI (high 7.5)
- [CVE-2023-37240](https://insights.sbomify.com/CVE-2023-37240/): Memory corruption in EMUI (critical 9.1)
- [CVE-2023-3724](https://insights.sbomify.com/CVE-2023-3724/): TLS 1.3 client issue handling malicious server when not including a KSE and PSK extension (critical 9.1)
- [CVE-2023-37239](https://insights.sbomify.com/CVE-2023-37239/): Memory corruption in EMUI (high 7.5)
- [CVE-2023-37238](https://insights.sbomify.com/CVE-2023-37238/): Missing authorization in EMUI (medium 5.3)
- [CVE-2023-37237](https://insights.sbomify.com/CVE-2023-37237/): Command injection in veritas:netbackup appliance (medium 6.5)
- [CVE-2023-37234](https://insights.sbomify.com/CVE-2023-37234/): Misconfiguration in loftware:spectrum (high 7.5)
- [CVE-2023-37233](https://insights.sbomify.com/CVE-2023-37233/): XML external entity in loftware:spectrum (high 8.8)
- [CVE-2023-37232](https://insights.sbomify.com/CVE-2023-37232/): Information disclosure in loftware:spectrum (high 7.5)
- [CVE-2023-37231](https://insights.sbomify.com/CVE-2023-37231/): Hardcoded credentials in loftware:spectrum (critical 9.8)
- [CVE-2023-37230](https://insights.sbomify.com/CVE-2023-37230/): Server-side request forgery in loftware:spectrum (high 8.8)
- [CVE-2023-37229](https://insights.sbomify.com/CVE-2023-37229/): Server-side request forgery in loftware:spectrum (high 8.8)
- [CVE-2023-37227](https://insights.sbomify.com/CVE-2023-37227/): Deserialization in loftware:spectrum (critical 9.8)
- [CVE-2023-37226](https://insights.sbomify.com/CVE-2023-37226/): Auth bypass in loftware:spectrum (critical 9.8)
- [CVE-2023-37225](https://insights.sbomify.com/CVE-2023-37225/): Cross-site scripting in pexip:pexip infinity (medium 6.1)
- [CVE-2023-37224](https://insights.sbomify.com/CVE-2023-37224/): Information disclosure in archerirm:archer (medium 6.0)
- [CVE-2023-37223](https://insights.sbomify.com/CVE-2023-37223/): Cross-site scripting in archerirm:archer (medium 5.4)
- [CVE-2023-37222](https://insights.sbomify.com/CVE-2023-37222/): Farsight Tech Nordic AB ProVide (medium 4.8)
- [CVE-2023-37221](https://insights.sbomify.com/CVE-2023-37221/): 7Twenty BOT - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). (high 8.8)
- [CVE-2023-37220](https://insights.sbomify.com/CVE-2023-37220/): Synel Terminals - CWE-494: Download of Code Without Integrity Check (high 7.2)
- [CVE-2023-3722](https://insights.sbomify.com/CVE-2023-3722/): Avaya Aura Device Services Remote Code Execution (high 8.6)
- [CVE-2023-37219](https://insights.sbomify.com/CVE-2023-37219/): Tadiran Telecom Composit - CWE-1236: Improper Neutralization of Formula Elements in a CSV File (high 7.3)
- [CVE-2023-37218](https://insights.sbomify.com/CVE-2023-37218/): Tadiran Telecom Aeonix - CWE-22: Improper Limitation of a Pathname to a Restricted Directory (high 7.5)
- [CVE-2023-37217](https://insights.sbomify.com/CVE-2023-37217/): Tadiran Telecom Aeonix - CWE-204: Observable Response Discrepancy (medium 5.3)
- [CVE-2023-37216](https://insights.sbomify.com/CVE-2023-37216/): AnaSystem SensMini M4 – an authenticated user can cause Denial of Service (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/273/