# Vulnerabilities published in 2023


- [CVE-2023-3497](https://insights.sbomify.com/CVE-2023-3497/): Memory corruption in Chrome (medium 4.6)
- [CVE-2023-34969](https://insights.sbomify.com/CVE-2023-34969/): Denial of service in debian:debian linux (medium 6.5)
- [CVE-2023-34968](https://insights.sbomify.com/CVE-2023-34968/): Samba: spotlight server-side share path disclosure (medium 5.3)
- [CVE-2023-34967](https://insights.sbomify.com/CVE-2023-34967/): Samba: type confusion in mdssvc rpc service for spotlight (medium 5.3)
- [CVE-2023-34966](https://insights.sbomify.com/CVE-2023-34966/): Samba: infinite loop in mdssvc rpc service for spotlight (high 7.5)
- [CVE-2023-34965](https://insights.sbomify.com/CVE-2023-34965/): Missing authorization in sspanel-uim project:sspanel-uim (medium 5.3)
- [CVE-2023-34962](https://insights.sbomify.com/CVE-2023-34962/): Missing authorization in chamilo:chamilo lms (high 8.1)
- [CVE-2023-34961](https://insights.sbomify.com/CVE-2023-34961/): Cross-site scripting in chamilo:chamilo lms (medium 6.1)
- [CVE-2023-34960](https://insights.sbomify.com/CVE-2023-34960/): Command injection in chamilo:chamilo (critical 9.8)
- [CVE-2023-34959](https://insights.sbomify.com/CVE-2023-34959/): Server-side request forgery in chamilo:chamilo lms (medium 5.3)
- [CVE-2023-34958](https://insights.sbomify.com/CVE-2023-34958/): Missing authorization in chamilo:chamilo lms (medium 4.3)
- [CVE-2023-3495](https://insights.sbomify.com/CVE-2023-3495/): Out-of-bounds Write Vulnerability in Hitachi EH-VIEW (KeypadDesigner) (high 7.8)
- [CVE-2023-34944](https://insights.sbomify.com/CVE-2023-34944/): File upload in chamilo:chamilo lms (critical 9.8)
- [CVE-2023-34942](https://insights.sbomify.com/CVE-2023-34942/): Memory corruption in asus:rt-n10lx firmware (high 7.5)
- [CVE-2023-34941](https://insights.sbomify.com/CVE-2023-34941/): Cross-site scripting in asus:rt-n10lx firmware (medium 5.4)
- [CVE-2023-34940](https://insights.sbomify.com/CVE-2023-34940/): Memory corruption in asus:rt-n10lx firmware (high 7.5)
- [CVE-2023-3494](https://insights.sbomify.com/CVE-2023-3494/): bhyve privileged guest escape via fwctl (high 8.8)
- [CVE-2023-34939](https://insights.sbomify.com/CVE-2023-34939/): Path traversal in onlyoffice:onlyoffice (critical 9.8)
- [CVE-2023-34937](https://insights.sbomify.com/CVE-2023-34937/): Memory corruption in h3c:magic b1st firmware (high 7.5)
- [CVE-2023-34936](https://insights.sbomify.com/CVE-2023-34936/): Memory corruption in h3c:magic b1st firmware (high 7.5)
- [CVE-2023-34935](https://insights.sbomify.com/CVE-2023-34935/): Memory corruption in h3c:magic b1st firmware (high 7.5)
- [CVE-2023-34934](https://insights.sbomify.com/CVE-2023-34934/): Memory corruption in h3c:magic b1st firmware (high 7.5)
- [CVE-2023-34933](https://insights.sbomify.com/CVE-2023-34933/): Memory corruption in h3c:magic b1st firmware (high 7.5)
- [CVE-2023-34932](https://insights.sbomify.com/CVE-2023-34932/): Memory corruption in h3c:magic b1st firmware (high 7.5)
- [CVE-2023-34931](https://insights.sbomify.com/CVE-2023-34931/): Memory corruption in h3c:magic b1st firmware (high 7.5)
- [CVE-2023-34930](https://insights.sbomify.com/CVE-2023-34930/): Memory corruption in h3c:magic b1st firmware (high 7.5)
- [CVE-2023-3493](https://insights.sbomify.com/CVE-2023-3493/): Improper Neutralization of Formula Elements in a CSV File in fossbilling/fossbilling (high 7.7)
- [CVE-2023-34929](https://insights.sbomify.com/CVE-2023-34929/): Memory corruption in h3c:magic b1st firmware (high 7.5)
- [CVE-2023-34928](https://insights.sbomify.com/CVE-2023-34928/): Memory corruption in h3c:magic b1st firmware (high 7.5)
- [CVE-2023-34927](https://insights.sbomify.com/CVE-2023-34927/): Casdoor Cross-Site Request Forgery vulnerability (medium 6.5)
- [CVE-2023-34924](https://insights.sbomify.com/CVE-2023-34924/): Memory corruption in h3c:magic b1stw firmware (high 7.5)
- [CVE-2023-34923](https://insights.sbomify.com/CVE-2023-34923/): Auth bypass in topdesk:topdesk (high 8.1)
- [CVE-2023-3492](https://insights.sbomify.com/CVE-2023-3492/): WP Shopping Pages <= 1.14 - Stored XSS via CSRF (medium 6.8)
- [CVE-2023-34917](https://insights.sbomify.com/CVE-2023-34917/): Open redirect in cms project:cms (medium 6.1)
- [CVE-2023-34916](https://insights.sbomify.com/CVE-2023-34916/): Open redirect in cms project:cms (medium 6.1)
- [CVE-2023-3491](https://insights.sbomify.com/CVE-2023-3491/): Unrestricted Upload of File with Dangerous Type in fossbilling/fossbilling (high 8.0)
- [CVE-2023-3490](https://insights.sbomify.com/CVE-2023-3490/): SQL Injection in fossbilling/fossbilling (critical 9.8)
- [CVE-2023-3489](https://insights.sbomify.com/CVE-2023-3489/): firmwaredownload command could log servers passwords in clear text (high 8.6)
- [CVE-2023-34880](https://insights.sbomify.com/CVE-2023-34880/): Path traversal in cmseasy:cmseasy (critical 9.8)
- [CVE-2023-3488](https://insights.sbomify.com/CVE-2023-3488/): Uninitialized variable in Gecko Bootloader can leak secure stack (low 3.8)
- [CVE-2023-34878](https://insights.sbomify.com/CVE-2023-34878/): Information disclosure in ujcms:ujcms (high 7.5)
- [CVE-2023-34873](https://insights.sbomify.com/CVE-2023-34873/): Command injection in Mx6 (high 8.7)
- [CVE-2023-34872](https://insights.sbomify.com/CVE-2023-34872/): Denial of service in freedesktop:poppler (medium 5.5)
- [CVE-2023-3487](https://insights.sbomify.com/CVE-2023-3487/): Integer overflow in Silicon Labs Gecko Bootloader leads to unbounded memory access (high 7.7)
- [CVE-2023-34869](https://insights.sbomify.com/CVE-2023-34869/): Cross-site scripting in phpjabbers:catering system (medium 6.1)
- [CVE-2023-34868](https://insights.sbomify.com/CVE-2023-34868/): Denial of service in jerryscript:jerryscript (high 7.5)
- [CVE-2023-34867](https://insights.sbomify.com/CVE-2023-34867/): Denial of service in jerryscript:jerryscript (high 7.5)
- [CVE-2023-34865](https://insights.sbomify.com/CVE-2023-34865/): Path traversal in ujcms:ujcms (critical 9.8)
- [CVE-2023-3486](https://insights.sbomify.com/CVE-2023-3486/): PaperCut NG Unauthenticated File Upload (high 8.2)
- [CVE-2023-34856](https://insights.sbomify.com/CVE-2023-34856/): Cross-site scripting in dlink:di-7500g-ci firmware (medium 5.4)
- [CVE-2023-34855](https://insights.sbomify.com/CVE-2023-34855/): Cross-site scripting in ac centralized management platform project:ac centralized management platform (medium 4.8)
- [CVE-2023-34854](https://insights.sbomify.com/CVE-2023-34854/): File upload in HotelDruid (medium 6.6)
- [CVE-2023-34853](https://insights.sbomify.com/CVE-2023-34853/): Memory corruption in supermicro:h11dsi-nt firmware (high 7.8)
- [CVE-2023-34852](https://insights.sbomify.com/CVE-2023-34852/): Misconfiguration in publiccms:publiccms (critical 9.8)
- [CVE-2023-3485](https://insights.sbomify.com/CVE-2023-3485/): Insecure Default Authorization in Temporal Server (low 3.0)
- [CVE-2023-34849](https://insights.sbomify.com/CVE-2023-34849/): Command injection in ikuai8:ikuaios (critical 9.8)
- [CVE-2023-34845](https://insights.sbomify.com/CVE-2023-34845/): File upload in bludit:bludit (medium 5.4)
- [CVE-2023-34844](https://insights.sbomify.com/CVE-2023-34844/): Privilege escalation in play with docker project:play with docker (critical 9.8)
- [CVE-2023-34843](https://insights.sbomify.com/CVE-2023-34843/): Path traversal in traggo:traggo (high 7.5)
- [CVE-2023-34842](https://insights.sbomify.com/CVE-2023-34842/): Code injection in dedecms:dedecms (critical 9.8)
- [CVE-2023-34840](https://insights.sbomify.com/CVE-2023-34840/): angular-ui-notification Cross-site Scripting vulnerability (medium 6.1)
- [CVE-2023-3484](https://insights.sbomify.com/CVE-2023-3484/): Incorrect Authorization in GitLab (high 8.0)
- [CVE-2023-34839](https://insights.sbomify.com/CVE-2023-34839/): Cross-site request forgery in issabel:pbx (medium 6.8)
- [CVE-2023-34838](https://insights.sbomify.com/CVE-2023-34838/): Cross-site scripting in escanav:escan management console (medium 5.4)
- [CVE-2023-34837](https://insights.sbomify.com/CVE-2023-34837/): Cross-site scripting in escanav:escan management console (medium 5.4)
- [CVE-2023-34836](https://insights.sbomify.com/CVE-2023-34836/): Cross-site scripting in escanav:escan management console (medium 5.4)
- [CVE-2023-34835](https://insights.sbomify.com/CVE-2023-34835/): Cross-site scripting in escanav:escan management console (medium 5.4)
- [CVE-2023-34834](https://insights.sbomify.com/CVE-2023-34834/): Information disclosure in mcl-collection:mcl-net firmware (medium 5.3)
- [CVE-2023-34833](https://insights.sbomify.com/CVE-2023-34833/): File upload in thinkadmin:thinkadmin (medium 6.1)
- [CVE-2023-34832](https://insights.sbomify.com/CVE-2023-34832/): Memory corruption in tp-link:archer ax10 firmware (critical 9.8)
- [CVE-2023-34831](https://insights.sbomify.com/CVE-2023-34831/): Cross-site scripting in odysseycs:ithacalabs turnitin lti (medium 5.4)
- [CVE-2023-34830](https://insights.sbomify.com/CVE-2023-34830/): Cross-site scripting in i-doit:i-doit (medium 5.4)
- [CVE-2023-34829](https://insights.sbomify.com/CVE-2023-34829/): Information disclosure in tp-link:tapo (medium 6.5)
- [CVE-2023-34824](https://insights.sbomify.com/CVE-2023-34824/): Memory corruption in fdkaac project:fdkaac (medium 5.5)
- [CVE-2023-34823](https://insights.sbomify.com/CVE-2023-34823/): Memory corruption in fdkaac project:fdkaac (medium 5.5)
- [CVE-2023-3482](https://insights.sbomify.com/CVE-2023-3482/): Security feature bypass in Firefox (medium 6.5)
- [CVE-2023-3481](https://insights.sbomify.com/CVE-2023-3481/): XSS in Chrome Lab Critters (medium 5.7)
- [CVE-2023-34800](https://insights.sbomify.com/CVE-2023-34800/): Command injection in dlink:go-rt-ac750 firmware (critical 9.8)
- [CVE-2023-34798](https://insights.sbomify.com/CVE-2023-34798/): File upload in weaver:e-office (critical 9.8)
- [CVE-2023-34797](https://insights.sbomify.com/CVE-2023-34797/): Missing authorization in temenos:cwx (medium 5.4)
- [CVE-2023-34796](https://insights.sbomify.com/CVE-2023-34796/): Cross-site scripting in techsneeze:dmarc report (medium 6.1)
- [CVE-2023-34795](https://insights.sbomify.com/CVE-2023-34795/): Memory corruption in xlsxio project:xlsxio (high 7.8)
- [CVE-2023-3479](https://insights.sbomify.com/CVE-2023-3479/): Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp (medium 4.3)
- [CVE-2023-3478](https://insights.sbomify.com/CVE-2023-3478/): IBOS OA Add User edit&op=member actionEdit sql injection (medium 4.7)
- [CVE-2023-3477](https://insights.sbomify.com/CVE-2023-3477/): RocketSoft Rocket LMS Contact Form store cross site scripting (low 3.5)
- [CVE-2023-34761](https://insights.sbomify.com/CVE-2023-34761/): Auth bypass in 7-eleven:hello cup (medium 6.5)
- [CVE-2023-3476](https://insights.sbomify.com/CVE-2023-3476/): SimplePHPscripts GuestBook Script URL Parameter preview.php cross site scripting (low 3.5)
- [CVE-2023-34758](https://insights.sbomify.com/CVE-2023-34758/): Silver vulnerable to MitM attack against implants due to a cryptography vulnerability (high 8.1)
- [CVE-2023-34756](https://insights.sbomify.com/CVE-2023-34756/): SQL injection in bloofox:bloofoxcms (critical 9.8)
- [CVE-2023-34755](https://insights.sbomify.com/CVE-2023-34755/): SQL injection in bloofox:bloofoxcms (critical 9.8)
- [CVE-2023-34754](https://insights.sbomify.com/CVE-2023-34754/): SQL injection in bloofox:bloofoxcms (critical 9.8)
- [CVE-2023-34753](https://insights.sbomify.com/CVE-2023-34753/): SQL injection in bloofox:bloofoxcms (critical 9.8)
- [CVE-2023-34752](https://insights.sbomify.com/CVE-2023-34752/): SQL injection in bloofox:bloofoxcms (critical 9.8)
- [CVE-2023-34751](https://insights.sbomify.com/CVE-2023-34751/): SQL injection in bloofox:bloofoxcms (critical 9.8)
- [CVE-2023-34750](https://insights.sbomify.com/CVE-2023-34750/): SQL injection in bloofox:bloofoxcms (critical 9.8)
- [CVE-2023-3475](https://insights.sbomify.com/CVE-2023-3475/): SimplePHPscripts Event Script URL Parameter preview.php cross site scripting (low 3.5)
- [CVE-2023-34747](https://insights.sbomify.com/CVE-2023-34747/): File upload in ujcms:ujcms (critical 9.8)
- [CVE-2023-3474](https://insights.sbomify.com/CVE-2023-3474/): SimplePHPscripts Simple Blog URL Parameter preview.php cross site scripting (low 3.5)
- [CVE-2023-34738](https://insights.sbomify.com/CVE-2023-34738/): File upload in chemex:chemex (critical 9.8)
- [CVE-2023-34736](https://insights.sbomify.com/CVE-2023-34736/): File upload in guantang equipment management system project:guantang equipment management system (high 7.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/290/