# Vulnerabilities published in 2023


- [CVE-2023-3618](https://insights.sbomify.com/CVE-2023-3618/): Segmentation fault in fax3encode in libtiff/tif_fax3.c (medium 6.5)
- [CVE-2023-36177](https://insights.sbomify.com/CVE-2023-36177/): Code injection in badaix:snapcast (critical 9.8)
- [CVE-2023-3617](https://insights.sbomify.com/CVE-2023-3617/): SourceCodester Best POS Management System Login Page admin_class.php sql injection (high 7.3)
- [CVE-2023-36163](https://insights.sbomify.com/CVE-2023-36163/): Cross-site scripting in buildagate project:buildagate (medium 6.1)
- [CVE-2023-36162](https://insights.sbomify.com/CVE-2023-36162/): Cross-site request forgery in zzcms:zzcms (high 8.8)
- [CVE-2023-36161](https://insights.sbomify.com/CVE-2023-36161/): Denial of service in quboworld:smart plug 10a firmware (high 7.5)
- [CVE-2023-36160](https://insights.sbomify.com/CVE-2023-36160/): Information disclosure in quboworld:smart plug 10a firmware (medium 5.5)
- [CVE-2023-3616](https://insights.sbomify.com/CVE-2023-3616/): SQLi in Mava Softwares Hotel Management System (critical 9.8)
- [CVE-2023-36159](https://insights.sbomify.com/CVE-2023-36159/): Cross-site scripting in oretnom23:lost and found information system (medium 6.1)
- [CVE-2023-36158](https://insights.sbomify.com/CVE-2023-36158/): Cross-site scripting in oretnom23:toll tax management system (medium 6.1)
- [CVE-2023-3615](https://insights.sbomify.com/CVE-2023-3615/): Lack of server certificate validation in websockets connection (high 8.1)
- [CVE-2023-36146](https://insights.sbomify.com/CVE-2023-36146/): Cross-site scripting in multilaser:re170 firmware (medium 5.4)
- [CVE-2023-36144](https://insights.sbomify.com/CVE-2023-36144/): Missing authorization in intelbras:sg 2404 mr firmware (high 7.5)
- [CVE-2023-36143](https://insights.sbomify.com/CVE-2023-36143/): Command injection in maxprintisp:maxlink 1200g firmware (high 8.8)
- [CVE-2023-36141](https://insights.sbomify.com/CVE-2023-36141/): Information disclosure in phpjabbers:cleaning business software (medium 5.3)
- [CVE-2023-36140](https://insights.sbomify.com/CVE-2023-36140/): Weak cryptography in phpjabbers:cleaning business software (critical 9.8)
- [CVE-2023-3614](https://insights.sbomify.com/CVE-2023-3614/): Denial of Service via specially crafted gif image (medium 4.3)
- [CVE-2023-36139](https://insights.sbomify.com/CVE-2023-36139/): Business logic in phpjabbers:cleaning business software (critical 9.8)
- [CVE-2023-36138](https://insights.sbomify.com/CVE-2023-36138/): Cross-site scripting in phpjabbers:cleaning business software (medium 6.1)
- [CVE-2023-36137](https://insights.sbomify.com/CVE-2023-36137/): Cross-site scripting in phpjabbers:class scheduling system (medium 6.1)
- [CVE-2023-36136](https://insights.sbomify.com/CVE-2023-36136/): Information disclosure in phpjabbers:class scheduling system (medium 6.5)
- [CVE-2023-36135](https://insights.sbomify.com/CVE-2023-36135/): Information disclosure in phpjabbers:class scheduling system (high 7.5)
- [CVE-2023-36134](https://insights.sbomify.com/CVE-2023-36134/): Auth bypass in phpjabbers:class scheduling system (critical 9.8)
- [CVE-2023-36133](https://insights.sbomify.com/CVE-2023-36133/): Auth bypass in phpjabbers:availability booking calendar (critical 9.8)
- [CVE-2023-36132](https://insights.sbomify.com/CVE-2023-36132/): Missing authorization in phpjabbers:availability booking calendar (critical 9.8)
- [CVE-2023-36131](https://insights.sbomify.com/CVE-2023-36131/): Auth bypass in phpjabbers:availability booking calendar (critical 9.8)
- [CVE-2023-3613](https://insights.sbomify.com/CVE-2023-3613/): Guest accounts invited and added to channels by Welcomebot plugin (low 3.5)
- [CVE-2023-36127](https://insights.sbomify.com/CVE-2023-36127/): Information disclosure in phpjabbers:appointment scheduler (high 7.5)
- [CVE-2023-36126](https://insights.sbomify.com/CVE-2023-36126/): Cross-site scripting in phpjabbers:appointment scheduler (medium 6.1)
- [CVE-2023-36123](https://insights.sbomify.com/CVE-2023-36123/): Path traversal in plain craft launcher 2 project:plain craft launcher 2 (high 7.8)
- [CVE-2023-36121](https://insights.sbomify.com/CVE-2023-36121/): Cross-site scripting in e107:e107 (medium 5.4)
- [CVE-2023-3612](https://insights.sbomify.com/CVE-2023-3612/): Unprotected WebView access in Govee Home App (high 8.2)
- [CVE-2023-36118](https://insights.sbomify.com/CVE-2023-36118/): Cross-site scripting in faculty evaluation system project:faculty evaluation system (medium 5.4)
- [CVE-2023-3611](https://insights.sbomify.com/CVE-2023-3611/): Out-of-bounds write in Linux kernel's net/sched: sch_qfq component (high 7.8)
- [CVE-2023-36109](https://insights.sbomify.com/CVE-2023-36109/): Memory corruption in jerryscript:jerryscript (critical 9.8)
- [CVE-2023-36106](https://insights.sbomify.com/CVE-2023-36106/): PowerJob incorrect access control vulnerability (high 7.5)
- [CVE-2023-36103](https://insights.sbomify.com/CVE-2023-36103/): Command injection in tenda:ac15 firmware (high 8.0)
- [CVE-2023-36100](https://insights.sbomify.com/CVE-2023-36100/): Privilege escalation in macwk:icecms (critical 9.8)
- [CVE-2023-3610](https://insights.sbomify.com/CVE-2023-3610/): Use-after-free in Linux kernel's netfilter: nf_tables component (high 7.8)
- [CVE-2023-36097](https://insights.sbomify.com/CVE-2023-36097/): fuadmin vulnerable to insecure file upload (critical 9.8)
- [CVE-2023-36095](https://insights.sbomify.com/CVE-2023-36095/): langchain Code Injection vulnerability (critical 9.8)
- [CVE-2023-36093](https://insights.sbomify.com/CVE-2023-36093/): Cross-site scripting in eyoucms:eyoucms (medium 5.4)
- [CVE-2023-36092](https://insights.sbomify.com/CVE-2023-36092/): Auth bypass in dlink:dir-859 firmware (high 8.8)
- [CVE-2023-36091](https://insights.sbomify.com/CVE-2023-36091/): Auth bypass in dlink:dir-895l firmware (critical 9.8)
- [CVE-2023-36090](https://insights.sbomify.com/CVE-2023-36090/): Auth bypass in dlink:dir-885l firmware (critical 9.8)
- [CVE-2023-3609](https://insights.sbomify.com/CVE-2023-3609/): Use-after-free in Linux kernel's net/sched: cls_u32 component (high 7.8)
- [CVE-2023-36089](https://insights.sbomify.com/CVE-2023-36089/): Auth bypass in dlink:dir-645 firmware (critical 9.8)
- [CVE-2023-36088](https://insights.sbomify.com/CVE-2023-36088/): Server-side request forgery in vesoft:nebulagraph studio (high 7.5)
- [CVE-2023-36085](https://insights.sbomify.com/CVE-2023-36085/): Open redirect in sisqualwfm:sisqualwfm (medium 6.1)
- [CVE-2023-36082](https://insights.sbomify.com/CVE-2023-36082/): Information disclosure in gatesair:flexiva fax 150w firmware (critical 9.8)
- [CVE-2023-36081](https://insights.sbomify.com/CVE-2023-36081/): Cross-site scripting in gatesair:flexiva fax 150w firmware (medium 5.4)
- [CVE-2023-3608](https://insights.sbomify.com/CVE-2023-3608/): Ruijie BCR810W Tracert Page os command injection (medium 4.7)
- [CVE-2023-36076](https://insights.sbomify.com/CVE-2023-36076/): SQL injection in pocketmanga:smanga (critical 9.8)
- [CVE-2023-3607](https://insights.sbomify.com/CVE-2023-3607/): kodbox WebConsole Plug-In webconsole.php.txt Execute os command injection (medium 5.5)
- [CVE-2023-3606](https://insights.sbomify.com/CVE-2023-3606/): TamronOS ping os command injection (medium 6.3)
- [CVE-2023-36054](https://insights.sbomify.com/CVE-2023-36054/): Memory corruption in debian:debian linux (medium 6.5)
- [CVE-2023-36053](https://insights.sbomify.com/CVE-2023-36053/): Django has regular expression denial of service vulnerability in EmailValidator/URLValidator (high 7.5)
- [CVE-2023-36052](https://insights.sbomify.com/CVE-2023-36052/): Azure CLI REST Command Information Disclosure Vulnerability (high 8.6)
- [CVE-2023-36050](https://insights.sbomify.com/CVE-2023-36050/): Microsoft Exchange Server Spoofing Vulnerability (high 8.0)
- [CVE-2023-3605](https://insights.sbomify.com/CVE-2023-3605/): PHPGurukul Online Shopping Portal Registration Page excessive authentication (medium 6.5)
- [CVE-2023-36049](https://insights.sbomify.com/CVE-2023-36049/): .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability (high 7.6)
- [CVE-2023-36047](https://insights.sbomify.com/CVE-2023-36047/): Windows Authentication Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2023-36046](https://insights.sbomify.com/CVE-2023-36046/): Windows Authentication Denial of Service Vulnerability (high 7.1)
- [CVE-2023-36045](https://insights.sbomify.com/CVE-2023-36045/): Microsoft Office Graphics Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-36043](https://insights.sbomify.com/CVE-2023-36043/): Open Management Infrastructure Information Disclosure Vulnerability (medium 6.5)
- [CVE-2023-36042](https://insights.sbomify.com/CVE-2023-36042/): Visual Studio Denial of Service Vulnerability (medium 6.2)
- [CVE-2023-36041](https://insights.sbomify.com/CVE-2023-36041/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-3604](https://insights.sbomify.com/CVE-2023-3604/): Change WP Admin < 1.1.4 - Secret Login Page Disclosure (high 7.5)
- [CVE-2023-36039](https://insights.sbomify.com/CVE-2023-36039/): Microsoft Exchange Server Spoofing Vulnerability (high 8.0)
- [CVE-2023-36038](https://insights.sbomify.com/CVE-2023-36038/): ASP.NET Core Denial of Service Vulnerability (high 8.2)
- [CVE-2023-36037](https://insights.sbomify.com/CVE-2023-36037/): Microsoft Excel Security Feature Bypass Vulnerability (high 7.8)
- [CVE-2023-36036](https://insights.sbomify.com/CVE-2023-36036/): Microsoft Windows Cloud Files Mini Filter Driver Privilege Escalation (high 7.8, exploited in the wild)
- [CVE-2023-36035](https://insights.sbomify.com/CVE-2023-36035/): Microsoft Exchange Server Spoofing Vulnerability (high 8.0)
- [CVE-2023-36034](https://insights.sbomify.com/CVE-2023-36034/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (high 7.3)
- [CVE-2023-36033](https://insights.sbomify.com/CVE-2023-36033/): Microsoft Windows Desktop Window Manager (DWM) Core Library Privilege Escalation (high 7.8, exploited in the wild)
- [CVE-2023-36031](https://insights.sbomify.com/CVE-2023-36031/): Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability (high 7.6)
- [CVE-2023-36030](https://insights.sbomify.com/CVE-2023-36030/): Microsoft Dynamics 365 Sales Spoofing Vulnerability (medium 6.1)
- [CVE-2023-3603](https://insights.sbomify.com/CVE-2023-3603/): Processing sftp server read may cause null dereference (low 3.1)
- [CVE-2023-36029](https://insights.sbomify.com/CVE-2023-36029/): Microsoft Edge (Chromium-based) Spoofing Vulnerability (medium 4.3)
- [CVE-2023-36028](https://insights.sbomify.com/CVE-2023-36028/): Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2023-36027](https://insights.sbomify.com/CVE-2023-36027/): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (high 7.1)
- [CVE-2023-36026](https://insights.sbomify.com/CVE-2023-36026/): Microsoft Edge (Chromium-based) Spoofing Vulnerability (medium 4.3)
- [CVE-2023-36025](https://insights.sbomify.com/CVE-2023-36025/): Microsoft Windows SmartScreen Security Feature Bypass (high 8.8, exploited in the wild)
- [CVE-2023-36024](https://insights.sbomify.com/CVE-2023-36024/): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (high 7.1)
- [CVE-2023-36022](https://insights.sbomify.com/CVE-2023-36022/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (medium 6.6)
- [CVE-2023-36021](https://insights.sbomify.com/CVE-2023-36021/): Microsoft On-Prem Data Gateway Security Feature Bypass Vulnerability (high 8.0)
- [CVE-2023-36020](https://insights.sbomify.com/CVE-2023-36020/): Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability (high 7.6)
- [CVE-2023-36019](https://insights.sbomify.com/CVE-2023-36019/): Microsoft Power Platform Connector Spoofing Vulnerability (critical 9.6)
- [CVE-2023-36018](https://insights.sbomify.com/CVE-2023-36018/): Visual Studio Code Jupyter Extension Spoofing Vulnerability (high 7.8)
- [CVE-2023-36017](https://insights.sbomify.com/CVE-2023-36017/): Windows Scripting Engine Memory Corruption Vulnerability (high 8.8)
- [CVE-2023-36016](https://insights.sbomify.com/CVE-2023-36016/): Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability (medium 6.2)
- [CVE-2023-36014](https://insights.sbomify.com/CVE-2023-36014/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (high 7.3)
- [CVE-2023-36013](https://insights.sbomify.com/CVE-2023-36013/): PowerShell Information Disclosure Vulnerability (medium 6.5)
- [CVE-2023-36012](https://insights.sbomify.com/CVE-2023-36012/): DHCP Server Service Information Disclosure Vulnerability (medium 5.3)
- [CVE-2023-36011](https://insights.sbomify.com/CVE-2023-36011/): Win32k Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2023-36010](https://insights.sbomify.com/CVE-2023-36010/): Microsoft Defender Denial of Service Vulnerability (high 7.5)
- [CVE-2023-3601](https://insights.sbomify.com/CVE-2023-3601/): Simple Author Box < 2.52 - Contributor+ Arbitrary User Information Disclosure via IDOR (medium 4.3)
- [CVE-2023-36009](https://insights.sbomify.com/CVE-2023-36009/): Microsoft Word Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-36008](https://insights.sbomify.com/CVE-2023-36008/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (medium 6.6)
- [CVE-2023-36007](https://insights.sbomify.com/CVE-2023-36007/): Microsoft Send Customer Voice survey from Dynamics 365 Spoofing Vulnerability (high 7.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/282/