# Vulnerabilities published in 2023


- [CVE-2023-36361](https://insights.sbomify.com/CVE-2023-36361/): SQL injection in web-audimex:audimexee (critical 9.8)
- [CVE-2023-3636](https://insights.sbomify.com/CVE-2023-3636/): WP Project Manager <= 2.6.4 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation (high 8.8)
- [CVE-2023-36359](https://insights.sbomify.com/CVE-2023-36359/): Memory corruption in tp-link:tl-wr841n firmware (high 7.5)
- [CVE-2023-36358](https://insights.sbomify.com/CVE-2023-36358/): Memory corruption in tp-link:tl-wr743nd firmware (high 7.7)
- [CVE-2023-36357](https://insights.sbomify.com/CVE-2023-36357/): Denial of service in tp-link:tl-wr841n firmware (high 7.7)
- [CVE-2023-36356](https://insights.sbomify.com/CVE-2023-36356/): Memory corruption in tp-link:tl-wr740n firmware (high 7.7)
- [CVE-2023-36355](https://insights.sbomify.com/CVE-2023-36355/): Memory corruption in tp-link:tl-wr940n firmware (critical 9.9)
- [CVE-2023-36354](https://insights.sbomify.com/CVE-2023-36354/): Memory corruption in tp-link:tl-wr740n firmware (high 7.5)
- [CVE-2023-36351](https://insights.sbomify.com/CVE-2023-36351/): Code injection in viatomtech:vihealth (high 7.8)
- [CVE-2023-3635](https://insights.sbomify.com/CVE-2023-3635/): Okio GzipSource unhandled exception Denial of Service (medium 5.9)
- [CVE-2023-36348](https://insights.sbomify.com/CVE-2023-36348/): Missing authorization in codekop:codekop (high 8.8)
- [CVE-2023-36347](https://insights.sbomify.com/CVE-2023-36347/): Auth bypass in codekop:codekop (high 7.5)
- [CVE-2023-36346](https://insights.sbomify.com/CVE-2023-36346/): Cross-site scripting in codekop:codekop (medium 6.1)
- [CVE-2023-36345](https://insights.sbomify.com/CVE-2023-36345/): Cross-site request forgery in codekop:codekop (high 8.8)
- [CVE-2023-36344](https://insights.sbomify.com/CVE-2023-36344/): Other in dieboldnixdorf:vynamic view (high 7.8)
- [CVE-2023-36340](https://insights.sbomify.com/CVE-2023-36340/): Memory corruption in totolink:nr1800x firmware (critical 9.8)
- [CVE-2023-3634](https://insights.sbomify.com/CVE-2023-3634/): Festo: MSE6-C2M/D2M/E2M Incomplete User Documentation of Remote Accessible Functions (high 8.8)
- [CVE-2023-36339](https://insights.sbomify.com/CVE-2023-36339/): Missing authorization in webboss:webboss.io cms (high 7.5)
- [CVE-2023-36338](https://insights.sbomify.com/CVE-2023-36338/): SQL injection in inventory management system project:inventory management system (medium 5.3)
- [CVE-2023-36337](https://insights.sbomify.com/CVE-2023-36337/): Cross-site scripting in inventory management system project:inventory management system (medium 6.1)
- [CVE-2023-36331](https://insights.sbomify.com/CVE-2023-36331/): Missing authorization in exrick:xmall (high 8.2)
- [CVE-2023-3633](https://insights.sbomify.com/CVE-2023-3633/): Out of Bounds Memory Corruption Issue in CEVA Engine (high 8.1)
- [CVE-2023-36328](https://insights.sbomify.com/CVE-2023-36328/): Integer overflow in fedoraproject:fedora (critical 9.8)
- [CVE-2023-36327](https://insights.sbomify.com/CVE-2023-36327/): Integer overflow in relic project:relic (critical 9.8)
- [CVE-2023-36326](https://insights.sbomify.com/CVE-2023-36326/): Integer overflow in relic project:relic (critical 9.8)
- [CVE-2023-36325](https://insights.sbomify.com/CVE-2023-36325/): i2p before 2.3.0 (Java) allows de-anonymizing the public IPv4 and IPv6 addresses of i2p hidden services (aka eepsites) via a correlation att (low 3.7)
- [CVE-2023-36321](https://insights.sbomify.com/CVE-2023-36321/): Memory corruption in covesa:dlt-daemon (high 7.5)
- [CVE-2023-3632](https://insights.sbomify.com/CVE-2023-3632/): Hard-coded Cryptographic Key in Kunduz - Homework Helper App (critical 9.8)
- [CVE-2023-36319](https://insights.sbomify.com/CVE-2023-36319/): File upload in openupload project:openupload (high 8.8)
- [CVE-2023-36317](https://insights.sbomify.com/CVE-2023-36317/): Cross-site scripting in oretnom23:student study center desk management system (medium 4.8)
- [CVE-2023-36315](https://insights.sbomify.com/CVE-2023-36315/): Cross-site scripting in phpjabbers:callback widget (medium 6.1)
- [CVE-2023-36314](https://insights.sbomify.com/CVE-2023-36314/): Cross-site scripting in phpjabbers:callback widget (medium 6.1)
- [CVE-2023-36313](https://insights.sbomify.com/CVE-2023-36313/): Cross-site scripting in phpjabbers:document creator (medium 6.1)
- [CVE-2023-36312](https://insights.sbomify.com/CVE-2023-36312/): Cross-site scripting in phpjabbers:callback widget (medium 5.4)
- [CVE-2023-36311](https://insights.sbomify.com/CVE-2023-36311/): SQL injection in phpjabbers:document creator (critical 9.8)
- [CVE-2023-36310](https://insights.sbomify.com/CVE-2023-36310/): Cross-site scripting in phpjabbers:document creator (medium 6.1)
- [CVE-2023-3631](https://insights.sbomify.com/CVE-2023-3631/): SQLi in Medart Notification Panel (critical 9.8)
- [CVE-2023-36309](https://insights.sbomify.com/CVE-2023-36309/): Cross-site scripting in phpjabbers:document creator (medium 6.1)
- [CVE-2023-36308](https://insights.sbomify.com/CVE-2023-36308/): Crash when processing crafted TIFF files (medium 5.5)
- [CVE-2023-36307](https://insights.sbomify.com/CVE-2023-36307/): Index out of bounds leading to crash (medium 5.5)
- [CVE-2023-36306](https://insights.sbomify.com/CVE-2023-36306/): Cross-site scripting in adiscon:loganalyzer (medium 6.1)
- [CVE-2023-36301](https://insights.sbomify.com/CVE-2023-36301/): Path traversal in talend:data catalog (high 7.5)
- [CVE-2023-36299](https://insights.sbomify.com/CVE-2023-36299/): File upload in typecho:typecho (high 8.8)
- [CVE-2023-36298](https://insights.sbomify.com/CVE-2023-36298/): File upload in dedecms:dedecms (high 8.8)
- [CVE-2023-36293](https://insights.sbomify.com/CVE-2023-36293/): SQL injection in wmanager:wmanager (high 7.5)
- [CVE-2023-36291](https://insights.sbomify.com/CVE-2023-36291/): Cross-site scripting in maxsite:maxsite cms (medium 6.1)
- [CVE-2023-3629](https://insights.sbomify.com/CVE-2023-3629/): Infinispan: non-admins should not be able to get cache config via rest api (medium 4.3)
- [CVE-2023-36289](https://insights.sbomify.com/CVE-2023-36289/): Cross-site scripting in webkul:qloapps (medium 6.1)
- [CVE-2023-36288](https://insights.sbomify.com/CVE-2023-36288/): Cross-site scripting in webkul:qloapps (medium 5.4)
- [CVE-2023-36287](https://insights.sbomify.com/CVE-2023-36287/): Cross-site scripting in webkul:qloapps (medium 6.1)
- [CVE-2023-36284](https://insights.sbomify.com/CVE-2023-36284/): SQL injection in webkul:qloapps (high 7.5)
- [CVE-2023-36281](https://insights.sbomify.com/CVE-2023-36281/): langchain vulnerable to arbitrary code execution (critical 9.8)
- [CVE-2023-3628](https://insights.sbomify.com/CVE-2023-3628/): Infispan: rest bulk ops don't check permissions (medium 6.5)
- [CVE-2023-36274](https://insights.sbomify.com/CVE-2023-36274/): Memory corruption in gnu:libredwg (high 8.8)
- [CVE-2023-36273](https://insights.sbomify.com/CVE-2023-36273/): Memory corruption in gnu:libredwg (high 8.8)
- [CVE-2023-36272](https://insights.sbomify.com/CVE-2023-36272/): Memory corruption in gnu:libredwg (high 8.8)
- [CVE-2023-36271](https://insights.sbomify.com/CVE-2023-36271/): Memory corruption in gnu:libredwg (high 8.8)
- [CVE-2023-3627](https://insights.sbomify.com/CVE-2023-3627/): Cross-Site Request Forgery (CSRF) in salesagility/suitecrm-core (high 8.1)
- [CVE-2023-36266](https://insights.sbomify.com/CVE-2023-36266/): Information disclosure in keepersecurity:keeper (medium 5.5)
- [CVE-2023-36263](https://insights.sbomify.com/CVE-2023-36263/): SQL injection in store-opart:op\'art limit quantity (critical 9.8)
- [CVE-2023-36260](https://insights.sbomify.com/CVE-2023-36260/): Craft CMS Feed-Me (high 7.5)
- [CVE-2023-3626](https://insights.sbomify.com/CVE-2023-3626/): File upload in Mountain Flood Disaster Prevention Monitoring and Early Warning System (medium 6.3)
- [CVE-2023-36259](https://insights.sbomify.com/CVE-2023-36259/): Craft CMS Audit Plugin Cross Site Scripting vulnerability (medium 5.4)
- [CVE-2023-36258](https://insights.sbomify.com/CVE-2023-36258/): langchain arbitrary code execution vulnerability (critical 9.8)
- [CVE-2023-36256](https://insights.sbomify.com/CVE-2023-36256/): Cross-site request forgery in online examination system project:online examination system (medium 6.5)
- [CVE-2023-36255](https://insights.sbomify.com/CVE-2023-36255/): Code injection in eramba:eramba (high 8.8)
- [CVE-2023-36252](https://insights.sbomify.com/CVE-2023-36252/): XML external entity in ateme:flamingo xl firmware (high 8.8)
- [CVE-2023-36250](https://insights.sbomify.com/CVE-2023-36250/): Code injection in gnome:gnome-time tracker (high 7.8)
- [CVE-2023-3625](https://insights.sbomify.com/CVE-2023-3625/): File upload in Mountain Flood Disaster Prevention Monitoring and Early Warning System (medium 6.3)
- [CVE-2023-36243](https://insights.sbomify.com/CVE-2023-36243/): Memory corruption in flvmeta:flvmeta (high 7.8)
- [CVE-2023-3624](https://insights.sbomify.com/CVE-2023-3624/): Nesote Inout Blockchain FiatExchanger POST Parameter update_marketboxslider sql injection (medium 6.3)
- [CVE-2023-36239](https://insights.sbomify.com/CVE-2023-36239/): Memory corruption in libming:libming (high 8.8)
- [CVE-2023-36238](https://insights.sbomify.com/CVE-2023-36238/): Bagisto vulnerable to Insecure Direct Object Reference (IDOR) (medium 6.5)
- [CVE-2023-36237](https://insights.sbomify.com/CVE-2023-36237/): Bagisto Cross-Site Request Forgery vulnerability (high 8.8)
- [CVE-2023-36236](https://insights.sbomify.com/CVE-2023-36236/): Cross-site Scripting in Bagisto (medium 4.8)
- [CVE-2023-36235](https://insights.sbomify.com/CVE-2023-36235/): Missing authorization in webkul:qloapps (medium 6.5)
- [CVE-2023-36234](https://insights.sbomify.com/CVE-2023-36234/): Cross-site scripting in netbox:netbox (medium 5.4)
- [CVE-2023-3623](https://insights.sbomify.com/CVE-2023-3623/): File upload in Mountain Flood Disaster Prevention Monitoring and Early Warning System (medium 6.3)
- [CVE-2023-36223](https://insights.sbomify.com/CVE-2023-36223/): Cross-site scripting in bbs-go:bbs-go (medium 5.4)
- [CVE-2023-36222](https://insights.sbomify.com/CVE-2023-36222/): Cross-site scripting in bbs-go:bbs-go (medium 5.4)
- [CVE-2023-36220](https://insights.sbomify.com/CVE-2023-36220/): Path traversal in textpattern:textpattern (high 7.2)
- [CVE-2023-3622](https://insights.sbomify.com/CVE-2023-3622/): Access Control Bypass Vulnerability in the SolarWinds Platform (medium 4.3)
- [CVE-2023-36217](https://insights.sbomify.com/CVE-2023-36217/): Cross-site scripting in xoops:xoops (critical 9.0)
- [CVE-2023-36213](https://insights.sbomify.com/CVE-2023-36213/): SQL injection in motocms:motocms (critical 9.8)
- [CVE-2023-36212](https://insights.sbomify.com/CVE-2023-36212/): File upload in totalcms:total cms (high 8.8)
- [CVE-2023-36211](https://insights.sbomify.com/CVE-2023-36211/): Cross-site scripting in cubiclesoft:barebones cms (medium 5.4)
- [CVE-2023-36210](https://insights.sbomify.com/CVE-2023-36210/): Code injection in motocms:motocms (critical 9.8)
- [CVE-2023-3621](https://insights.sbomify.com/CVE-2023-3621/): IBOS OA Delete Packet delete createDeleteCommand sql injection (medium 6.3)
- [CVE-2023-36201](https://insights.sbomify.com/CVE-2023-36201/): Memory corruption in jerryscript:jerryscript (high 7.5)
- [CVE-2023-3620](https://insights.sbomify.com/CVE-2023-3620/): Cross-site Scripting (XSS) - Stored in amauric/tarteaucitron.js (medium 4.6)
- [CVE-2023-36199](https://insights.sbomify.com/CVE-2023-36199/): Null dereference in skale:sgxwallet (high 7.5)
- [CVE-2023-36198](https://insights.sbomify.com/CVE-2023-36198/): Memory corruption in skale:sgxwallet (high 7.5)
- [CVE-2023-36193](https://insights.sbomify.com/CVE-2023-36193/): Memory corruption in lcdf:gifsicle (high 7.8)
- [CVE-2023-36192](https://insights.sbomify.com/CVE-2023-36192/): Memory corruption in irontec:sngrep (high 7.8)
- [CVE-2023-3619](https://insights.sbomify.com/CVE-2023-3619/): SourceCodester AC Repair and Services System HTTP POST Request sql injection (medium 6.3)
- [CVE-2023-36189](https://insights.sbomify.com/CVE-2023-36189/): langchain SQL Injection vulnerability (high 7.5)
- [CVE-2023-36188](https://insights.sbomify.com/CVE-2023-36188/): langchain vulnerable to arbitrary code execution (critical 9.8)
- [CVE-2023-36187](https://insights.sbomify.com/CVE-2023-36187/): Memory corruption in netgear:cbr40 firmware (critical 9.8)
- [CVE-2023-36184](https://insights.sbomify.com/CVE-2023-36184/): Memory corruption in aptosfoundation:aptos (high 7.5)
- [CVE-2023-36183](https://insights.sbomify.com/CVE-2023-36183/): Memory corruption in openimageio:openimageio (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/281/