# Vulnerabilities published in 2023


- [CVE-2023-37215](https://insights.sbomify.com/CVE-2023-37215/): JBL soundbar multibeam 5.1 - CWE-798: Use of Hard-coded Credentials (medium 6.2)
- [CVE-2023-37214](https://insights.sbomify.com/CVE-2023-37214/): Heights Telecom ERO1xS-Pro Dual-Band WiFi command injection (critical 9.8)
- [CVE-2023-37213](https://insights.sbomify.com/CVE-2023-37213/): Synel SYnergy Fingerprint Terminals - CWE-78: 'OS Command Injection' (high 8.8)
- [CVE-2023-37212](https://insights.sbomify.com/CVE-2023-37212/): Memory corruption in Firefox (high 8.8)
- [CVE-2023-37211](https://insights.sbomify.com/CVE-2023-37211/): Memory corruption in Firefox (high 8.8)
- [CVE-2023-37210](https://insights.sbomify.com/CVE-2023-37210/): Security feature bypass in Firefox (medium 6.5)
- [CVE-2023-3721](https://insights.sbomify.com/CVE-2023-3721/): WP-EMail < 2.69.1 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2023-37209](https://insights.sbomify.com/CVE-2023-37209/): Use after free in Firefox (high 8.8)
- [CVE-2023-37208](https://insights.sbomify.com/CVE-2023-37208/): Security feature bypass in Firefox (high 7.8)
- [CVE-2023-37207](https://insights.sbomify.com/CVE-2023-37207/): Security feature bypass in Firefox (medium 6.5)
- [CVE-2023-37206](https://insights.sbomify.com/CVE-2023-37206/): Information disclosure in Firefox (medium 6.5)
- [CVE-2023-37205](https://insights.sbomify.com/CVE-2023-37205/): Other in Firefox (medium 6.5)
- [CVE-2023-37204](https://insights.sbomify.com/CVE-2023-37204/): Security feature bypass in Firefox (medium 6.5)
- [CVE-2023-37203](https://insights.sbomify.com/CVE-2023-37203/): Security feature bypass in Firefox (high 7.8)
- [CVE-2023-37202](https://insights.sbomify.com/CVE-2023-37202/): Use after free in Firefox (high 8.8)
- [CVE-2023-37201](https://insights.sbomify.com/CVE-2023-37201/): Use after free in Firefox (high 8.8)
- [CVE-2023-37200](https://insights.sbomify.com/CVE-2023-37200/): XML external entity in EcoStruxure OPC UA Server Expert (medium 5.5)
- [CVE-2023-3720](https://insights.sbomify.com/CVE-2023-3720/): Upload Media By URL < 1.0.8 - Stored XSS via CSRF (medium 6.5)
- [CVE-2023-37199](https://insights.sbomify.com/CVE-2023-37199/): Code injection in StruxureWare Data Center Expert (medium 6.8)
- [CVE-2023-37198](https://insights.sbomify.com/CVE-2023-37198/): Code injection in StruxureWare Data Center Expert (medium 6.8)
- [CVE-2023-37197](https://insights.sbomify.com/CVE-2023-37197/): SQL injection in StruxureWare Data Center Expert (high 8.8)
- [CVE-2023-37196](https://insights.sbomify.com/CVE-2023-37196/): SQL injection in StruxureWare Data Center Expert (high 8.8)
- [CVE-2023-37195](https://insights.sbomify.com/CVE-2023-37195/): Denial of service in SIMATIC CP 1604 (medium 4.4)
- [CVE-2023-37194](https://insights.sbomify.com/CVE-2023-37194/): Privilege escalation in SIMATIC CP 1604 (medium 6.7)
- [CVE-2023-37192](https://insights.sbomify.com/CVE-2023-37192/): Memory corruption in bitcoin:bitcoin core (high 7.5)
- [CVE-2023-37191](https://insights.sbomify.com/CVE-2023-37191/): Cross-site scripting in issabel:pbx (medium 4.8)
- [CVE-2023-37190](https://insights.sbomify.com/CVE-2023-37190/): Cross-site scripting in issabel:pbx (medium 4.8)
- [CVE-2023-37189](https://insights.sbomify.com/CVE-2023-37189/): Cross-site scripting in issabel:pbx (medium 4.8)
- [CVE-2023-37188](https://insights.sbomify.com/CVE-2023-37188/): Null dereference in blosc:c-blosc2 (high 7.5)
- [CVE-2023-37187](https://insights.sbomify.com/CVE-2023-37187/): Null dereference in blosc:c-blosc2 (high 7.5)
- [CVE-2023-37186](https://insights.sbomify.com/CVE-2023-37186/): Null dereference in blosc:c-blosc2 (high 7.5)
- [CVE-2023-37185](https://insights.sbomify.com/CVE-2023-37185/): Null dereference in blosc:c-blosc2 (high 7.5)
- [CVE-2023-3718](https://insights.sbomify.com/CVE-2023-3718/): Authenticated Command Injection Vulnerability in AOS-CX Command Line Interface (high 8.8)
- [CVE-2023-37177](https://insights.sbomify.com/CVE-2023-37177/): SQL injection in sigb:pmb (critical 9.8)
- [CVE-2023-37174](https://insights.sbomify.com/CVE-2023-37174/): Memory corruption in gpac:gpac (medium 5.5)
- [CVE-2023-37173](https://insights.sbomify.com/CVE-2023-37173/): Command injection in totolink:a3300r firmware (critical 9.8)
- [CVE-2023-37172](https://insights.sbomify.com/CVE-2023-37172/): Command injection in totolink:a3300r firmware (critical 9.8)
- [CVE-2023-37171](https://insights.sbomify.com/CVE-2023-37171/): Command injection in totolink:a3300r firmware (critical 9.8)
- [CVE-2023-37170](https://insights.sbomify.com/CVE-2023-37170/): Command injection in totolink:a3300r firmware (critical 9.8)
- [CVE-2023-3717](https://insights.sbomify.com/CVE-2023-3717/): SQLi in Farmakoms Remote Administration Console (critical 9.8)
- [CVE-2023-37165](https://insights.sbomify.com/CVE-2023-37165/): SQL injection in millhouse-project project:millhouse-project (critical 9.8)
- [CVE-2023-37164](https://insights.sbomify.com/CVE-2023-37164/): Cross-site scripting in diafan:diafan.cms (medium 6.1)
- [CVE-2023-3716](https://insights.sbomify.com/CVE-2023-3716/): SQLi in Oduyo Online Collection Software (critical 9.8)
- [CVE-2023-37154](https://insights.sbomify.com/CVE-2023-37154/): check_by_ssh in Nagios nagios-plugins 2.4.5 allows arbitrary command execution via ProxyCommand, LocalCommand, and PermitLocalCommand with \${IFS}. (high 8.4)
- [CVE-2023-37153](https://insights.sbomify.com/CVE-2023-37153/): Cross-site scripting in kodcloud:kodexplorer (medium 6.1)
- [CVE-2023-37152](https://insights.sbomify.com/CVE-2023-37152/): File upload in online art gallery project:online art gallery (critical 9.8)
- [CVE-2023-37150](https://insights.sbomify.com/CVE-2023-37150/): Cross-site scripting in online pizza ordering system project:online pizza ordering system (medium 6.1)
- [CVE-2023-37149](https://insights.sbomify.com/CVE-2023-37149/): Command injection in totolink:lr350 firmware (critical 9.8)
- [CVE-2023-37148](https://insights.sbomify.com/CVE-2023-37148/): Command injection in totolink:lr350 firmware (critical 9.8)
- [CVE-2023-37146](https://insights.sbomify.com/CVE-2023-37146/): Command injection in totolink:lr350 firmware (critical 9.8)
- [CVE-2023-37145](https://insights.sbomify.com/CVE-2023-37145/): Command injection in totolink:lr350 firmware (critical 9.8)
- [CVE-2023-37144](https://insights.sbomify.com/CVE-2023-37144/): Command injection in tendacn:ac10 firmware (critical 9.8)
- [CVE-2023-37143](https://insights.sbomify.com/CVE-2023-37143/): Denial of service in microsoft:chakracore (medium 5.5)
- [CVE-2023-37142](https://insights.sbomify.com/CVE-2023-37142/): Denial of service in microsoft:chakracore (medium 5.5)
- [CVE-2023-37141](https://insights.sbomify.com/CVE-2023-37141/): Denial of service in microsoft:chakracore (medium 5.5)
- [CVE-2023-37140](https://insights.sbomify.com/CVE-2023-37140/): Denial of service in microsoft:chakracore (medium 5.5)
- [CVE-2023-3714](https://insights.sbomify.com/CVE-2023-3714/): ProfileGrid <= 5.5.2 - Missing Authorization to Arbitrary Group Option Modification and Privilege Escalation (high 7.5)
- [CVE-2023-37139](https://insights.sbomify.com/CVE-2023-37139/): Memory corruption in microsoft:chakracore (medium 5.5)
- [CVE-2023-37136](https://insights.sbomify.com/CVE-2023-37136/): Cross-site scripting in eyoucms:eyoucms (medium 5.4)
- [CVE-2023-37135](https://insights.sbomify.com/CVE-2023-37135/): Cross-site scripting in eyoucms:eyoucms (medium 5.4)
- [CVE-2023-37134](https://insights.sbomify.com/CVE-2023-37134/): Cross-site scripting in eyoucms:eyoucms (medium 5.4)
- [CVE-2023-37133](https://insights.sbomify.com/CVE-2023-37133/): Cross-site scripting in eyoucms:eyoucms (medium 5.4)
- [CVE-2023-37132](https://insights.sbomify.com/CVE-2023-37132/): Cross-site scripting in eyoucms:eyoucms (medium 5.4)
- [CVE-2023-37131](https://insights.sbomify.com/CVE-2023-37131/): Cross-site request forgery in yzncms:yzncms (medium 6.5)
- [CVE-2023-3713](https://insights.sbomify.com/CVE-2023-3713/): ProfileGrid <= 5.5.1 - Authenticated (Subscriber+) Arbitrary Option Update (high 8.8)
- [CVE-2023-37125](https://insights.sbomify.com/CVE-2023-37125/): Cross-site scripting in seacms:seacms (medium 5.4)
- [CVE-2023-37124](https://insights.sbomify.com/CVE-2023-37124/): Cross-site scripting in seacms:seacms (medium 5.4)
- [CVE-2023-37122](https://insights.sbomify.com/CVE-2023-37122/): Cross-site scripting in bagesoft:bagecms (medium 5.4)
- [CVE-2023-3712](https://insights.sbomify.com/CVE-2023-3712/): Potential user privilege escalation (medium 6.6)
- [CVE-2023-37117](https://insights.sbomify.com/CVE-2023-37117/): Use after free in live555:live555 (critical 9.8)
- [CVE-2023-3711](https://insights.sbomify.com/CVE-2023-3711/): Potential Predictable Session ID (medium 6.4)
- [CVE-2023-3710](https://insights.sbomify.com/CVE-2023-3710/): Printer web page invalid command execution (critical 9.9)
- [CVE-2023-3709](https://insights.sbomify.com/CVE-2023-3709/): Royal Elementor Addons <=1.3.70 - Unauthenticated MailChimp API Key Disclosure (medium 5.3)
- [CVE-2023-3708](https://insights.sbomify.com/CVE-2023-3708/): Multiple DeoThemes Themes <= (Various Versions) - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-37070](https://insights.sbomify.com/CVE-2023-37070/): Cross-site scripting in code-projects:hospital information system (medium 4.8)
- [CVE-2023-3707](https://insights.sbomify.com/CVE-2023-3707/): ActivityPub for WordPress < 1.0.0 - Subscriber+ Arbitrary Post Content Disclosure (medium 4.3)
- [CVE-2023-37069](https://insights.sbomify.com/CVE-2023-37069/): SQL injection in online hospital management system project:online hospital management system (critical 9.8)
- [CVE-2023-37068](https://insights.sbomify.com/CVE-2023-37068/): SQL injection in sherlock:gym management system (critical 9.8)
- [CVE-2023-37067](https://insights.sbomify.com/CVE-2023-37067/): Cross-site scripting in chamilo:chamilo (medium 4.8)
- [CVE-2023-37066](https://insights.sbomify.com/CVE-2023-37066/): Cross-site scripting in chamilo:chamilo (medium 4.8)
- [CVE-2023-37065](https://insights.sbomify.com/CVE-2023-37065/): Cross-site scripting in chamilo:chamilo (medium 4.8)
- [CVE-2023-37064](https://insights.sbomify.com/CVE-2023-37064/): Cross-site scripting in chamilo:chamilo (medium 4.8)
- [CVE-2023-37063](https://insights.sbomify.com/CVE-2023-37063/): Cross-site scripting in chamilo:chamilo (medium 4.8)
- [CVE-2023-37062](https://insights.sbomify.com/CVE-2023-37062/): Cross-site scripting in chamilo:chamilo (medium 4.8)
- [CVE-2023-37061](https://insights.sbomify.com/CVE-2023-37061/): Cross-site scripting in chamilo:chamilo (medium 4.8)
- [CVE-2023-3706](https://insights.sbomify.com/CVE-2023-3706/): ActivityPub for WordPress < 1.0.0 - Subscriber+ Arbitrary Post Title Disclosure (medium 4.3)
- [CVE-2023-37058](https://insights.sbomify.com/CVE-2023-37058/): Privilege escalation in unionman:jlink ax1800 firmware (critical 9.8)
- [CVE-2023-37057](https://insights.sbomify.com/CVE-2023-37057/): An issue in JLINK Unionman Technology Co. (critical 9.8)
- [CVE-2023-3705](https://insights.sbomify.com/CVE-2023-3705/): Information Disclosure Vulnerability in CP-Plus Network Video Recorder (high 7.5)
- [CVE-2023-37049](https://insights.sbomify.com/CVE-2023-37049/): Missing authorization in emlog:emlog (medium 6.5)
- [CVE-2023-3704](https://insights.sbomify.com/CVE-2023-3704/): Timestamp Modification Vulnerability in CP-Plus Digital Video Recorder (medium 5.3)
- [CVE-2023-37039](https://insights.sbomify.com/CVE-2023-37039/): A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95 (medium 6.5)
- [CVE-2023-37038](https://insights.sbomify.com/CVE-2023-37038/): Null dereference in linuxfoundation:magma (medium 6.5)
- [CVE-2023-37037](https://insights.sbomify.com/CVE-2023-37037/): Null dereference in linuxfoundation:magma (medium 6.5)
- [CVE-2023-37036](https://insights.sbomify.com/CVE-2023-37036/): Null dereference in linuxfoundation:magma (medium 6.5)
- [CVE-2023-37035](https://insights.sbomify.com/CVE-2023-37035/): A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95 (medium 6.5)
- [CVE-2023-37034](https://insights.sbomify.com/CVE-2023-37034/): Null dereference in linuxfoundation:magma (medium 6.5)
- [CVE-2023-37033](https://insights.sbomify.com/CVE-2023-37033/): Null dereference in linuxfoundation:magma (medium 6.5)
- [CVE-2023-37032](https://insights.sbomify.com/CVE-2023-37032/): Memory corruption in linuxfoundation:magma (high 7.5)
- [CVE-2023-37031](https://insights.sbomify.com/CVE-2023-37031/): Null dereference in linuxfoundation:magma (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/274/