# Vulnerabilities published in 2023


- [CVE-2023-34285](https://insights.sbomify.com/CVE-2023-34285/): NETGEAR RAX30 cmsCli_authenticate Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-34284](https://insights.sbomify.com/CVE-2023-34284/): NETGEAR RAX30 Use of Hard-coded Credentials Authentication Bypass Vulnerability (medium 6.3)
- [CVE-2023-34283](https://insights.sbomify.com/CVE-2023-34283/): NETGEAR RAX30 USB Share Link Following Information Disclosure Vulnerability (medium 4.6)
- [CVE-2023-34282](https://insights.sbomify.com/CVE-2023-34282/): D-Link DIR-2150 HNAP Incorrect Implementation of Authentication Algorithm Authentication Bypass Vulnerability (high 8.8)
- [CVE-2023-34281](https://insights.sbomify.com/CVE-2023-34281/): D-Link DIR-2150 GetFirmwareStatus Target Command Injection Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2023-34280](https://insights.sbomify.com/CVE-2023-34280/): D-Link DIR-2150 SetSysEmailSettings EmailTo Command Injection Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2023-3428](https://insights.sbomify.com/CVE-2023-3428/): Imagemagick: heap-buffer-overflow in coders/tiff.c (medium 6.2)
- [CVE-2023-34279](https://insights.sbomify.com/CVE-2023-34279/): D-Link DIR-2150 GetDeviceSettings Target Command Injection Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2023-34278](https://insights.sbomify.com/CVE-2023-34278/): D-Link DIR-2150 SetSysEmailSettings EmailFrom Command Injection Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2023-34277](https://insights.sbomify.com/CVE-2023-34277/): D-Link DIR-2150 SetSysEmailSettings AccountName Command Injection Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2023-34276](https://insights.sbomify.com/CVE-2023-34276/): D-Link DIR-2150 SetTriggerPPPoEValidate Username Command Injection Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2023-34275](https://insights.sbomify.com/CVE-2023-34275/): D-Link DIR-2150 SetNTPServerSettings Command Injection Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2023-34274](https://insights.sbomify.com/CVE-2023-34274/): D-Link DIR-2150 LoginPassword Incorrect Implementation of Authentication Algorithm Authentication Bypass Vulnerability (high 8.8)
- [CVE-2023-34273](https://insights.sbomify.com/CVE-2023-34273/): Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-34272](https://insights.sbomify.com/CVE-2023-34272/): Fatek Automation FvDesigner FPJ File Parsing Uninitialized Pointer Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-34271](https://insights.sbomify.com/CVE-2023-34271/): Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-34270](https://insights.sbomify.com/CVE-2023-34270/): Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-3427](https://insights.sbomify.com/CVE-2023-3427/): Cross-site request forgery in Salon Booking System – Free Version (medium 5.4)
- [CVE-2023-34269](https://insights.sbomify.com/CVE-2023-34269/): Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-34268](https://insights.sbomify.com/CVE-2023-34268/): Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-34267](https://insights.sbomify.com/CVE-2023-34267/): Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-34266](https://insights.sbomify.com/CVE-2023-34266/): Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-34265](https://insights.sbomify.com/CVE-2023-34265/): Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-34264](https://insights.sbomify.com/CVE-2023-34264/): Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-34263](https://insights.sbomify.com/CVE-2023-34263/): Fatek Automation FvDesigner FPJ File Parsing Uninitialized Pointer Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-34262](https://insights.sbomify.com/CVE-2023-34262/): Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-34261](https://insights.sbomify.com/CVE-2023-34261/): Information disclosure in kyocera:d-copia253mf plus firmware (medium 5.3)
- [CVE-2023-34260](https://insights.sbomify.com/CVE-2023-34260/): Path traversal in kyocera:d-copia253mf plus firmware (high 7.5)
- [CVE-2023-3426](https://insights.sbomify.com/CVE-2023-3426/): Liferay Portal and Liferay DXP Organization Selector Does Not Check User Permissions (medium 4.3)
- [CVE-2023-34259](https://insights.sbomify.com/CVE-2023-34259/): Path traversal in kyocera:d-copia253mf plus firmware (medium 4.9)
- [CVE-2023-34258](https://insights.sbomify.com/CVE-2023-34258/): Information disclosure in bmc:patrol (high 7.5)
- [CVE-2023-34257](https://insights.sbomify.com/CVE-2023-34257/): Code injection in bmc:patrol agent (critical 9.8)
- [CVE-2023-34256](https://insights.sbomify.com/CVE-2023-34256/): Memory corruption in debian:debian linux (medium 5.5)
- [CVE-2023-34254](https://insights.sbomify.com/CVE-2023-34254/): Remote inventory task command injection when using ssh command mode (high 7.7)
- [CVE-2023-34253](https://insights.sbomify.com/CVE-2023-34253/): Grav vulnerable to Server-side Template Injection (SSTI) via Denylist Bypass (high 8.8)
- [CVE-2023-34252](https://insights.sbomify.com/CVE-2023-34252/): Grav Server-side Template Injection via Insufficient Validation in filterFilter (high 8.8)
- [CVE-2023-34251](https://insights.sbomify.com/CVE-2023-34251/): Grav Server Side Template Injection vulnerability (critical 10.0)
- [CVE-2023-34250](https://insights.sbomify.com/CVE-2023-34250/): Discourse vulnerable to exposure of number of topics recently created in private categories (medium 4.8)
- [CVE-2023-3425](https://insights.sbomify.com/CVE-2023-3425/): CVE-2023-3425: Out-of-Bounds memory read (medium 6.5)
- [CVE-2023-34249](https://insights.sbomify.com/CVE-2023-34249/): benjjvi/PyBB may send unsanitized request to SQL database (critical 9.8)
- [CVE-2023-34247](https://insights.sbomify.com/CVE-2023-34247/): @keystone-6/auth Open Redirect vulnerability (medium 6.1)
- [CVE-2023-34246](https://insights.sbomify.com/CVE-2023-34246/): Doorkeeper Improper Authentication vulnerability (medium 4.2)
- [CVE-2023-34245](https://insights.sbomify.com/CVE-2023-34245/): Cross site scripting (XSS) in @udecode/plate-link (high 8.1)
- [CVE-2023-34244](https://insights.sbomify.com/CVE-2023-34244/): GLPI vulnerable to reflected XSS in search pages (medium 6.5)
- [CVE-2023-34243](https://insights.sbomify.com/CVE-2023-34243/): Windows user name disclosure in TGstation (medium 5.8)
- [CVE-2023-34242](https://insights.sbomify.com/CVE-2023-34242/): Cilium vulnerable to information leakage via incorrect ReferenceGrant handling (low 3.4)
- [CVE-2023-34241](https://insights.sbomify.com/CVE-2023-34241/): CUPS vulnerable to use-after-free in cupsdAcceptClient() (medium 5.3)
- [CVE-2023-34240](https://insights.sbomify.com/CVE-2023-34240/): Weak passwords allowed in cloudexplorer-lite (medium 6.5)
- [CVE-2023-3424](https://insights.sbomify.com/CVE-2023-3424/): Inefficient Regular Expression Complexity in GitLab (high 7.5)
- [CVE-2023-34239](https://insights.sbomify.com/CVE-2023-34239/): Unfiltered paths in gradio (high 7.3)
- [CVE-2023-34238](https://insights.sbomify.com/CVE-2023-34238/): Local File Inclusion vulnerability in Gatsby (medium 4.3)
- [CVE-2023-34237](https://insights.sbomify.com/CVE-2023-34237/): Remote code execution via specially crafted script settings in SABnzbd (high 8.1)
- [CVE-2023-34236](https://insights.sbomify.com/CVE-2023-34236/): Information Disclosure Vulnerability in Weave GitOps Terraform Controller (high 8.5)
- [CVE-2023-34235](https://insights.sbomify.com/CVE-2023-34235/): Leaking sensitive user information still possible by filtering on private with prefix fields (high 8.6)
- [CVE-2023-34234](https://insights.sbomify.com/CVE-2023-34234/): Governor proposal creation may be blocked by frontrunning in OpenZeppelin (medium 5.3)
- [CVE-2023-34233](https://insights.sbomify.com/CVE-2023-34233/): Snowflake Python Connector vulnerable to Command Injection (high 7.3)
- [CVE-2023-34232](https://insights.sbomify.com/CVE-2023-34232/): Snowflake NodeJS Driver vulnerable to Command Injection (high 7.3)
- [CVE-2023-34231](https://insights.sbomify.com/CVE-2023-34231/): Snowflake Golang Driver vulnerable to Command Injection (high 7.3)
- [CVE-2023-34230](https://insights.sbomify.com/CVE-2023-34230/): Snowflake Connector vulnerable to Command Injection (high 7.3)
- [CVE-2023-3423](https://insights.sbomify.com/CVE-2023-3423/): Weak Password Requirements in cloudexplorer-dev/cloudexplorer-lite (medium 6.5)
- [CVE-2023-34229](https://insights.sbomify.com/CVE-2023-34229/): Cross-site scripting in TeamCity (medium 4.6)
- [CVE-2023-34228](https://insights.sbomify.com/CVE-2023-34228/): Auth bypass in TeamCity (medium 5.3)
- [CVE-2023-34227](https://insights.sbomify.com/CVE-2023-34227/): Other in TeamCity (medium 5.3)
- [CVE-2023-34226](https://insights.sbomify.com/CVE-2023-34226/): Cross-site scripting in TeamCity (medium 4.6)
- [CVE-2023-34225](https://insights.sbomify.com/CVE-2023-34225/): Cross-site scripting in TeamCity (medium 4.6)
- [CVE-2023-34224](https://insights.sbomify.com/CVE-2023-34224/): Open redirect in TeamCity (medium 4.8)
- [CVE-2023-34223](https://insights.sbomify.com/CVE-2023-34223/): Information disclosure in TeamCity (medium 4.3)
- [CVE-2023-34222](https://insights.sbomify.com/CVE-2023-34222/): Cross-site scripting in TeamCity (medium 4.6)
- [CVE-2023-34221](https://insights.sbomify.com/CVE-2023-34221/): Cross-site scripting in TeamCity (medium 4.6)
- [CVE-2023-34220](https://insights.sbomify.com/CVE-2023-34220/): Cross-site scripting in TeamCity (medium 4.6)
- [CVE-2023-3422](https://insights.sbomify.com/CVE-2023-3422/): Use after free in Chrome (high 8.8)
- [CVE-2023-34219](https://insights.sbomify.com/CVE-2023-34219/): Missing authorization in TeamCity (medium 4.3)
- [CVE-2023-34218](https://insights.sbomify.com/CVE-2023-34218/): Missing authorization in TeamCity (critical 9.1)
- [CVE-2023-34217](https://insights.sbomify.com/CVE-2023-34217/): Second Order Command-injection Vulnerability in the Certificate-delete Function (high 8.1)
- [CVE-2023-34216](https://insights.sbomify.com/CVE-2023-34216/): Second Order Command-injection Vulnerability in the Key-delete Function (high 8.1)
- [CVE-2023-34215](https://insights.sbomify.com/CVE-2023-34215/): Second Order Command-injection Vulnerability in the Certificate-generation Function (high 7.2)
- [CVE-2023-34214](https://insights.sbomify.com/CVE-2023-34214/): Second Order Command-injection Vulnerability in the Certificate-generation Function (high 7.2)
- [CVE-2023-34213](https://insights.sbomify.com/CVE-2023-34213/): Second Order Command-injection Vulnerability in the Key-generation Function (high 8.8)
- [CVE-2023-34212](https://insights.sbomify.com/CVE-2023-34212/): Apache NiFi: Potential Deserialization of Untrusted Data with JNDI in JMS Components (medium 6.5)
- [CVE-2023-34210](https://insights.sbomify.com/CVE-2023-34210/): SQL Injection in EasyUse MailHunter Ultimate (high 7.7)
- [CVE-2023-3421](https://insights.sbomify.com/CVE-2023-3421/): Use after free in Chrome (high 8.8)
- [CVE-2023-34209](https://insights.sbomify.com/CVE-2023-34209/): Exposure of Sensitive System Information to an Unauthorized Control Sphere in EasyUse MailHunter Ultimate (medium 5.0)
- [CVE-2023-34208](https://insights.sbomify.com/CVE-2023-34208/): Path Traversal in EasyUse MailHunter Ultimate (medium 6.5)
- [CVE-2023-34207](https://insights.sbomify.com/CVE-2023-34207/): Unrestricted Upload of File with Dangerous Type in EasyUse MailHunter Ultimate (critical 9.9)
- [CVE-2023-34205](https://insights.sbomify.com/CVE-2023-34205/): Signature validation bypass in github.com/moov-io/signedxml (critical 9.1)
- [CVE-2023-34204](https://insights.sbomify.com/CVE-2023-34204/): Other in imapsync project:imapsync (medium 6.5)
- [CVE-2023-34203](https://insights.sbomify.com/CVE-2023-34203/): Other in progress:openedge (high 8.8)
- [CVE-2023-3420](https://insights.sbomify.com/CVE-2023-3420/): Memory corruption in Chrome (high 8.8)
- [CVE-2023-34198](https://insights.sbomify.com/CVE-2023-34198/): Security feature bypass in stormshield:stormshield network security (high 7.3)
- [CVE-2023-34197](https://insights.sbomify.com/CVE-2023-34197/): Missing authorization in zohocorp:manageengine servicedesk plus (medium 5.4)
- [CVE-2023-34196](https://insights.sbomify.com/CVE-2023-34196/): Auth bypass in keyfactor:ejbca (high 8.2)
- [CVE-2023-34195](https://insights.sbomify.com/CVE-2023-34195/): Code injection in insyde:insydeh2o (high 7.8)
- [CVE-2023-34194](https://insights.sbomify.com/CVE-2023-34194/): Denial of service in tinyxml project:tinyxml (high 7.5)
- [CVE-2023-34193](https://insights.sbomify.com/CVE-2023-34193/): File upload in zimbra:collaboration (high 8.8)
- [CVE-2023-34192](https://insights.sbomify.com/CVE-2023-34192/): Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) (critical 9.0, exploited in the wild)
- [CVE-2023-3419](https://insights.sbomify.com/CVE-2023-3419/): tagDiv Opt-In Builder <= 1.4.4 - Authenticated (Admin+) SQL Injection (high 7.2)
- [CVE-2023-34189](https://insights.sbomify.com/CVE-2023-34189/): Apache InLong: General user can delete and update process (medium 6.5)
- [CVE-2023-34188](https://insights.sbomify.com/CVE-2023-34188/): Denial of service in cesanta:mongoose (high 7.5)
- [CVE-2023-34187](https://insights.sbomify.com/CVE-2023-34187/): WordPress Call Now Icon Animate Plugin <= 0.1.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-34186](https://insights.sbomify.com/CVE-2023-34186/): WordPress Headless CMS plugin <= 2.0.3 - Broken Authentication vulnerability (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/294/