# Vulnerabilities published in 2023


- [CVE-2023-34477](https://insights.sbomify.com/CVE-2023-34477/): Extension - braincert.com - SQLi in Virtual Classroom component for Joomla <= 1.6.0 (critical 9.8)
- [CVE-2023-34476](https://insights.sbomify.com/CVE-2023-34476/): Extension - mooj.org - SQLi in Proforms Basic component for Joomla <= 1.6.0 (critical 9.8)
- [CVE-2023-34475](https://insights.sbomify.com/CVE-2023-34475/): Use after free in ImageMagick (medium 5.5)
- [CVE-2023-34474](https://insights.sbomify.com/CVE-2023-34474/): Memory corruption in ImageMagick (medium 5.5)
- [CVE-2023-34473](https://insights.sbomify.com/CVE-2023-34473/): Usage of Hard-coded Credentials (medium 6.6)
- [CVE-2023-34472](https://insights.sbomify.com/CVE-2023-34472/): Other in MegaRAC SPx (medium 5.7)
- [CVE-2023-34471](https://insights.sbomify.com/CVE-2023-34471/): Missing Cryptographic Step (medium 6.3)
- [CVE-2023-34470](https://insights.sbomify.com/CVE-2023-34470/): Improper access control (medium 6.8)
- [CVE-2023-3447](https://insights.sbomify.com/CVE-2023-3447/): Active Directory Integration / LDAP Integration <= 4.1.5 - Authenticated (Subscriber+) LDAP Injection (high 7.6)
- [CVE-2023-34469](https://insights.sbomify.com/CVE-2023-34469/): Cold Rest Vulnerabiltiy (medium 4.9)
- [CVE-2023-34468](https://insights.sbomify.com/CVE-2023-34468/): Apache NiFi: Potential Code Injection with Database Services using H2 (high 8.8)
- [CVE-2023-34467](https://insights.sbomify.com/CVE-2023-34467/): XWiki Platform may retrieve email addresses of all users (high 7.5)
- [CVE-2023-34466](https://insights.sbomify.com/CVE-2023-34466/): XWiki Platform's tags on non-viewable pages can be revealed to users (medium 4.3)
- [CVE-2023-34465](https://insights.sbomify.com/CVE-2023-34465/): XWiki Platform's Mail.MailConfig can be edited by any user with edit rights (critical 10.0)
- [CVE-2023-34464](https://insights.sbomify.com/CVE-2023-34464/): XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template (critical 9.1)
- [CVE-2023-34463](https://insights.sbomify.com/CVE-2023-34463/): Unauthorized users can delete applications in DataEase (high 8.1)
- [CVE-2023-34462](https://insights.sbomify.com/CVE-2023-34462/): netty-handler SniHandler 16MB allocation (medium 6.5)
- [CVE-2023-34461](https://insights.sbomify.com/CVE-2023-34461/): Cross-site Scripting (XSS) Availability in PyBB (medium 4.6)
- [CVE-2023-34460](https://insights.sbomify.com/CVE-2023-34460/): Tauri vulnerable to Regression on Filesystem Scope Checks for Dotfiles (medium 4.8)
- [CVE-2023-3446](https://insights.sbomify.com/CVE-2023-3446/): Excessive time spent checking DH keys and parameters (medium 5.3)
- [CVE-2023-34459](https://insights.sbomify.com/CVE-2023-34459/): OpenZeppelin Contracts's MerkleProof multiproofs may allow proving arbitrary leaves for specific trees (medium 5.3)
- [CVE-2023-34458](https://insights.sbomify.com/CVE-2023-34458/): mx-chain-go's relayed transactions always increment nonce (high 7.1)
- [CVE-2023-34457](https://insights.sbomify.com/CVE-2023-34457/): MechanicalSoup vulnerable to malicious web server reading arbitrary files on client using file input inside HTML form (medium 5.9)
- [CVE-2023-34455](https://insights.sbomify.com/CVE-2023-34455/): snappy-java's unchecked chunk length leads to DoS (high 7.5)
- [CVE-2023-34454](https://insights.sbomify.com/CVE-2023-34454/): snappy-java's Integer Overflow vulnerability in compress leads to DoS (medium 5.9)
- [CVE-2023-34453](https://insights.sbomify.com/CVE-2023-34453/): snappy-java's Integer Overflow vulnerability in shuffle leads to DoS (medium 5.9)
- [CVE-2023-34452](https://insights.sbomify.com/CVE-2023-34452/): Grav vulnerable to Self Cross Site Scripting in /forgot_password (medium 5.4)
- [CVE-2023-34451](https://insights.sbomify.com/CVE-2023-34451/): CometBFT may duplicate transactions in the mempool's data structures (high 8.2)
- [CVE-2023-34450](https://insights.sbomify.com/CVE-2023-34450/): CometBFT PeerState JSON serialization deadlock (low 3.7)
- [CVE-2023-3445](https://insights.sbomify.com/CVE-2023-3445/): Cross-site Scripting (XSS) - Stored in spinacms/spina (low 3.5)
- [CVE-2023-34449](https://insights.sbomify.com/CVE-2023-34449/): ink! vulnerable to incorrect decoding of storage value when using `DelegateCall` (medium 5.3)
- [CVE-2023-34448](https://insights.sbomify.com/CVE-2023-34448/): Grav Server-side Template Injection (SSTI) via Twig Default Filters (high 8.8)
- [CVE-2023-34447](https://insights.sbomify.com/CVE-2023-34447/): iTop XSS vulnerability on pages/UI.php (high 8.8)
- [CVE-2023-34446](https://insights.sbomify.com/CVE-2023-34446/): iTop XSS vulnerability on pages/preferences.php (high 8.8)
- [CVE-2023-34445](https://insights.sbomify.com/CVE-2023-34445/): Cross-site Scripting vulnerability on pages/ajax.render.php in Combodo iTop (high 8.8)
- [CVE-2023-34444](https://insights.sbomify.com/CVE-2023-34444/): Cross-site Scripting vulnerability on pages/ajax.searchform.php in Combodo iTop (high 8.8)
- [CVE-2023-34443](https://insights.sbomify.com/CVE-2023-34443/): Cross-site Scripting vulnerability in the run_query.php page in Combodo iTop (high 8.8)
- [CVE-2023-34442](https://insights.sbomify.com/CVE-2023-34442/): Apache Camel JIRA: Temporary file information disclosure in Camel-Jira (low 3.3)
- [CVE-2023-34441](https://insights.sbomify.com/CVE-2023-34441/): Baker Hughes Bently Nevada 3500 System Cleartext Transmission of Sensitive Information (medium 6.8)
- [CVE-2023-34440](https://insights.sbomify.com/CVE-2023-34440/): Privilege escalation in Intel(R) Processors (high 8.7)
- [CVE-2023-3444](https://insights.sbomify.com/CVE-2023-3444/): Incorrect Authorization in GitLab (medium 5.7)
- [CVE-2023-34439](https://insights.sbomify.com/CVE-2023-34439/): Cross-site scripting in Pleasanter (medium 5.4)
- [CVE-2023-34438](https://insights.sbomify.com/CVE-2023-34438/): Race condition in Intel(R) NUC BIOS firmware (high 7.5)
- [CVE-2023-34437](https://insights.sbomify.com/CVE-2023-34437/): Baker Hughes Bently Nevada 3500 System Incorrect Permission Assignment for Critical Resource (high 7.5)
- [CVE-2023-34436](https://insights.sbomify.com/CVE-2023-34436/): Memory corruption in GTKWave (high 7.8)
- [CVE-2023-34435](https://insights.sbomify.com/CVE-2023-34435/): Security feature bypass in WBR-6013 (high 7.2)
- [CVE-2023-34434](https://insights.sbomify.com/CVE-2023-34434/): Apache InLong: JDBC URL bypassing by allowLoadLocalInfileInPath param (high 7.5)
- [CVE-2023-34433](https://insights.sbomify.com/CVE-2023-34433/): PiiGAB M-Bus Use of Password Hash With Insufficient Computational Effort (high 7.5)
- [CVE-2023-34432](https://insights.sbomify.com/CVE-2023-34432/): Heap-buffer-overflow in src/formats_i.c (high 7.8)
- [CVE-2023-34431](https://insights.sbomify.com/CVE-2023-34431/): Privilege escalation in Intel(R) Server Board BIOS firmware (high 8.2)
- [CVE-2023-34430](https://insights.sbomify.com/CVE-2023-34430/): Privilege escalation in Intel Battery Life Diagnostic Tool software (medium 6.7)
- [CVE-2023-3443](https://insights.sbomify.com/CVE-2023-3443/): Incorrect Authorization in GitLab (low 3.1)
- [CVE-2023-34429](https://insights.sbomify.com/CVE-2023-34429/): Weintek Weincloud Improper Handling of Structural Elements (high 7.5)
- [CVE-2023-34427](https://insights.sbomify.com/CVE-2023-34427/): Security feature bypass in Intel(R) RealSense(TM) ID software for Intel(R) RealSense(TM) 450 FA (medium 5.3)
- [CVE-2023-34426](https://insights.sbomify.com/CVE-2023-34426/): Memory corruption in YF325 (critical 9.8)
- [CVE-2023-34425](https://insights.sbomify.com/CVE-2023-34425/): Memory corruption in iOS and iPadOS (critical 9.8)
- [CVE-2023-34424](https://insights.sbomify.com/CVE-2023-34424/): Denial of service in Intel(R) CSME (medium 6.7)
- [CVE-2023-34423](https://insights.sbomify.com/CVE-2023-34423/): Cross-site scripting in Survey Maker (medium 6.1)
- [CVE-2023-34422](https://insights.sbomify.com/CVE-2023-34422/): Path traversal in Lenovo XClarity Administrator (medium 6.5)
- [CVE-2023-34421](https://insights.sbomify.com/CVE-2023-34421/): Other in Lenovo XClarity Administrator (medium 6.5)
- [CVE-2023-34420](https://insights.sbomify.com/CVE-2023-34420/): Command injection in Lenovo XClarity Administrator (high 7.2)
- [CVE-2023-3442](https://insights.sbomify.com/CVE-2023-3442/): Missing Authorization in Jenkins plug-in for ServiceNow DevOps (high 7.7)
- [CVE-2023-34419](https://insights.sbomify.com/CVE-2023-34419/): Memory corruption in Lenovo Notebook (medium 6.7)
- [CVE-2023-34418](https://insights.sbomify.com/CVE-2023-34418/): SQL injection in Lenovo XClarity Administrator (high 8.1)
- [CVE-2023-34417](https://insights.sbomify.com/CVE-2023-34417/): Memory corruption in Firefox (critical 9.8)
- [CVE-2023-34416](https://insights.sbomify.com/CVE-2023-34416/): Memory corruption in Firefox (critical 9.8)
- [CVE-2023-34415](https://insights.sbomify.com/CVE-2023-34415/): Security feature bypass in Firefox (medium 6.1)
- [CVE-2023-34414](https://insights.sbomify.com/CVE-2023-34414/): Security feature bypass in Firefox (low 3.1)
- [CVE-2023-34412](https://insights.sbomify.com/CVE-2023-34412/): Stored XXS vulnerability in mbnet, mbnet.rokey, REX 200 and REX 250 (medium 4.8)
- [CVE-2023-34411](https://insights.sbomify.com/CVE-2023-34411/): xml-rs vulnerable to denial of service via invalid token in XML document (high 7.5)
- [CVE-2023-34410](https://insights.sbomify.com/CVE-2023-34410/): Security feature bypass in debian:debian linux (medium 5.3)
- [CVE-2023-3441](https://insights.sbomify.com/CVE-2023-3441/): Exposure of Sensitive Information Due to Incompatible Policies in GitLab (medium 6.6)
- [CVE-2023-34409](https://insights.sbomify.com/CVE-2023-34409/): Path traversal in percona:monitoring and management (critical 9.8)
- [CVE-2023-34408](https://insights.sbomify.com/CVE-2023-34408/): Cross-site scripting in dokuwiki:dokuwiki (medium 5.4)
- [CVE-2023-34407](https://insights.sbomify.com/CVE-2023-34407/): Path traversal in harbingergroup:office player (high 7.5)
- [CVE-2023-34406](https://insights.sbomify.com/CVE-2023-34406/): Integer overflow in mercedes-benz:headunit ntg6 mercedes-benz user experience (low 3.3)
- [CVE-2023-34404](https://insights.sbomify.com/CVE-2023-34404/): Command injection in mercedes-benz:headunit ntg6 mercedes-benz user experience (medium 4.9)
- [CVE-2023-34403](https://insights.sbomify.com/CVE-2023-34403/): Race condition in mercedes-benz:headunit ntg6 mercedes-benz user experience (medium 4.9)
- [CVE-2023-34402](https://insights.sbomify.com/CVE-2023-34402/): Memory corruption in mercedes-benz:headunit ntg6 mercedes-benz user experience (high 7.7)
- [CVE-2023-34401](https://insights.sbomify.com/CVE-2023-34401/): Memory corruption in mercedes-benz:headunit ntg6 mercedes-benz user experience (low 3.7)
- [CVE-2023-34400](https://insights.sbomify.com/CVE-2023-34400/): Null dereference in mercedes-benz:headunit ntg6 mercedes-benz user experience (high 7.5)
- [CVE-2023-3440](https://insights.sbomify.com/CVE-2023-3440/): File and Directory Permission Vulnerability in JP1/Performance Management (high 8.4)
- [CVE-2023-34399](https://insights.sbomify.com/CVE-2023-34399/): Integer overflow in mercedes-benz:headunit ntg6 mercedes-benz user experience (critical 9.8)
- [CVE-2023-34398](https://insights.sbomify.com/CVE-2023-34398/): Null dereference in mercedes-benz:headunit ntg6 mercedes-benz user experience (high 7.5)
- [CVE-2023-34397](https://insights.sbomify.com/CVE-2023-34397/): Denial of service in mercedes-benz:headunit ntg6 mercedes-benz user experience (high 7.5)
- [CVE-2023-34396](https://insights.sbomify.com/CVE-2023-34396/): Apache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart forms (medium 4.3)
- [CVE-2023-34395](https://insights.sbomify.com/CVE-2023-34395/): Apache Airflow ODBC Provider: Remote code execution vulnerability (high 7.8)
- [CVE-2023-34394](https://insights.sbomify.com/CVE-2023-34394/): Keysight N6845A Relative Path Traversal (high 7.8)
- [CVE-2023-34392](https://insights.sbomify.com/CVE-2023-34392/): Missing Authentication for Critical Function (high 8.2)
- [CVE-2023-34391](https://insights.sbomify.com/CVE-2023-34391/): Insecure Inherited Permissions (high 7.4)
- [CVE-2023-34390](https://insights.sbomify.com/CVE-2023-34390/): Improper input validation could lead to denial of service (medium 4.5)
- [CVE-2023-3439](https://insights.sbomify.com/CVE-2023-3439/): Use after free in Linux Kernel (mctp) (medium 4.7)
- [CVE-2023-34389](https://insights.sbomify.com/CVE-2023-34389/): Allocation of resources without limits could lead to denial of service (medium 4.5)
- [CVE-2023-34388](https://insights.sbomify.com/CVE-2023-34388/): Improper authentication could lead to session hijacking (medium 6.5)
- [CVE-2023-34387](https://insights.sbomify.com/CVE-2023-34387/): WordPress Constant Contact Forms plugin <= 2.0.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-34386](https://insights.sbomify.com/CVE-2023-34386/): WordPress WPC Smart Wishlist for WooCommerce Plugin <= 4.7.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-34385](https://insights.sbomify.com/CVE-2023-34385/): WordPress Export Import Menus Plugin <= 1.8.0 is vulnerable to Arbitrary File Upload (critical 9.9)
- [CVE-2023-34384](https://insights.sbomify.com/CVE-2023-34384/): WordPress Kebo Twitter Feed Plugin <= 1.5.12 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-34383](https://insights.sbomify.com/CVE-2023-34383/): WordPress WP Project Manager Plugin <= 2.6.0 is vulnerable to SQL Injection (high 8.5)
- [CVE-2023-34382](https://insights.sbomify.com/CVE-2023-34382/): WordPress Dokan Plugin <= 3.7.19 is vulnerable to PHP Object Injection (medium 4.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/292/