# Vulnerabilities published in 2023


- [CVE-2023-33979](https://insights.sbomify.com/CVE-2023-33979/): gpt_academic's Configuration File vulnerable to File Information Disclosure (medium 6.5)
- [CVE-2023-33977](https://insights.sbomify.com/CVE-2023-33977/): Stored cross site scripting (XSS) via unrestricted file upload in Kiwi TCMS (high 8.1)
- [CVE-2023-33976](https://insights.sbomify.com/CVE-2023-33976/): TensorFlow segfault in array_ops.upper_bound (high 7.5)
- [CVE-2023-33975](https://insights.sbomify.com/CVE-2023-33975/): RIOT-OS vulnerable to Out of Bounds Write in _rbuf_add (critical 9.8)
- [CVE-2023-33974](https://insights.sbomify.com/CVE-2023-33974/): RIOT-OS vulnerable to Race Condition in SFR Timeout (high 7.5)
- [CVE-2023-33973](https://insights.sbomify.com/CVE-2023-33973/): RIOT-OS vulnerable to NULL pointer dereference during NHC encoding (high 7.5)
- [CVE-2023-33972](https://insights.sbomify.com/CVE-2023-33972/): Privilege escalation from having CREATE access on a keyspace in Scylladb (high 7.2)
- [CVE-2023-33971](https://insights.sbomify.com/CVE-2023-33971/): Formcreator vulnerable to stored XSS from ##FULLFORM## (medium 6.1)
- [CVE-2023-33970](https://insights.sbomify.com/CVE-2023-33970/): Missing access control in internal task links feature in Kanboard (medium 5.4)
- [CVE-2023-3397](https://insights.sbomify.com/CVE-2023-3397/): Kernel: slab-use-after-free write in txend due to race condition (high 7.0)
- [CVE-2023-33969](https://insights.sbomify.com/CVE-2023-33969/): Stored Cross site scripting in the Task External Link Functionality in Kanboard (medium 6.4)
- [CVE-2023-33968](https://insights.sbomify.com/CVE-2023-33968/): Missing Access Control allows User to move and duplicate tasks in Kanboard (medium 5.4)
- [CVE-2023-33967](https://insights.sbomify.com/CVE-2023-33967/): EaseProbe vulnerable to SQL injection when using MySQL/PostgreSQL data checking (high 8.3)
- [CVE-2023-33966](https://insights.sbomify.com/CVE-2023-33966/): Deno missing "--allow-net" permission check for built-in Node modules (high 8.6)
- [CVE-2023-33965](https://insights.sbomify.com/CVE-2023-33965/): Brook's tproxy server is vulnerable to a drive-by command injection. (critical 9.7)
- [CVE-2023-33964](https://insights.sbomify.com/CVE-2023-33964/): mx-chain-go does not treat invalid transaction with wrong username correctly (high 8.6)
- [CVE-2023-33963](https://insights.sbomify.com/CVE-2023-33963/): DataEase data source has deserialization vulnerability (critical 9.8)
- [CVE-2023-33962](https://insights.sbomify.com/CVE-2023-33962/): JStachio XSS vulnerability: Unescaped single quotes (medium 5.4)
- [CVE-2023-33961](https://insights.sbomify.com/CVE-2023-33961/): Leantime Stored Cross-site Scripting Vulnerability (high 8.9)
- [CVE-2023-33960](https://insights.sbomify.com/CVE-2023-33960/): OpenProject vulnerable to project identifier information leakage through robots.txt (high 7.5)
- [CVE-2023-3396](https://insights.sbomify.com/CVE-2023-3396/): Campcodes Retro Cellphone Online Store index.php sql injection (medium 6.3)
- [CVE-2023-33959](https://insights.sbomify.com/CVE-2023-33959/): Verification bypass can cause users into verifying the wrong artifact (high 8.4)
- [CVE-2023-33958](https://insights.sbomify.com/CVE-2023-33958/): Default `maxSignatureAttempts` in `notation verify` enables an endless data attack in notation (medium 5.4)
- [CVE-2023-33957](https://insights.sbomify.com/CVE-2023-33957/): Denial of service from high number of artifact signatures in notation (low 2.6)
- [CVE-2023-33956](https://insights.sbomify.com/CVE-2023-33956/): Parameter based Indirect Object Referencing leading to private file exposure in Kanboard (medium 4.3)
- [CVE-2023-33955](https://insights.sbomify.com/CVE-2023-33955/): Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited (medium 4.3)
- [CVE-2023-33953](https://insights.sbomify.com/CVE-2023-33953/): Denial-of-Service in gRPC (high 7.5)
- [CVE-2023-33952](https://insights.sbomify.com/CVE-2023-33952/): Kernel: vmwgfx: double free within the handling of vmw_buffer_object objects (medium 6.7)
- [CVE-2023-33951](https://insights.sbomify.com/CVE-2023-33951/): Kernel: vmwgfx: race condition leading to information disclosure vulnerability (medium 6.7)
- [CVE-2023-33950](https://insights.sbomify.com/CVE-2023-33950/): Liferay Portal has Inefficient Regular Expression (medium 6.5)
- [CVE-2023-3395](https://insights.sbomify.com/CVE-2023-3395/): Information disclosure in TBox LT2 (medium 6.5)
- [CVE-2023-33949](https://insights.sbomify.com/CVE-2023-33949/): Insecure Default Initialization In Liferay Portal (medium 5.3)
- [CVE-2023-33948](https://insights.sbomify.com/CVE-2023-33948/): Missing authorization in Liferay portal (medium 5.3)
- [CVE-2023-33947](https://insights.sbomify.com/CVE-2023-33947/): Liferay portal has unauthorized access to object definition via search (low 2.7)
- [CVE-2023-33946](https://insights.sbomify.com/CVE-2023-33946/): Liferay portal unauthorized access to objects via OAuth 2 scope (low 2.7)
- [CVE-2023-33945](https://insights.sbomify.com/CVE-2023-33945/): SQL injection in Liferay Portal (medium 6.4)
- [CVE-2023-33944](https://insights.sbomify.com/CVE-2023-33944/): Cross-site scripting in Liferay Portal (medium 4.8)
- [CVE-2023-33943](https://insights.sbomify.com/CVE-2023-33943/): Cross-site scripting in Liferay Portal (medium 5.4)
- [CVE-2023-33942](https://insights.sbomify.com/CVE-2023-33942/): Cross-site scripting in Liferay Portal (medium 5.4)
- [CVE-2023-33941](https://insights.sbomify.com/CVE-2023-33941/): Cross-site scripting in Liferay Portal (medium 6.1)
- [CVE-2023-33940](https://insights.sbomify.com/CVE-2023-33940/): Cross-site scripting in Liferay Portal (medium 4.8)
- [CVE-2023-3394](https://insights.sbomify.com/CVE-2023-3394/): Session Fixation in fossbilling/fossbilling (medium 6.8)
- [CVE-2023-33939](https://insights.sbomify.com/CVE-2023-33939/): Cross-site scripting in Liferay Portal (medium 5.4)
- [CVE-2023-33938](https://insights.sbomify.com/CVE-2023-33938/): Cross-site scripting in Liferay Portal (medium 4.8)
- [CVE-2023-33937](https://insights.sbomify.com/CVE-2023-33937/): Cross-site scripting in Liferay Portal (medium 5.4)
- [CVE-2023-33934](https://insights.sbomify.com/CVE-2023-33934/): Apache Traffic Server: Differential fuzzing for HTTP request parsing discrepancies (critical 9.1)
- [CVE-2023-33933](https://insights.sbomify.com/CVE-2023-33933/): Apache Traffic Server: s3_auth plugin problem with hash calculation (high 7.5)
- [CVE-2023-33931](https://insights.sbomify.com/CVE-2023-33931/): WordPress YouTube Playlist Player Plugin <= 4.6.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-33930](https://insights.sbomify.com/CVE-2023-33930/): WordPress Unlimited Elements For Elementor plugin <= 1.5.66 - Unrestricted Zip Extraction vulnerability (critical 9.1)
- [CVE-2023-3393](https://insights.sbomify.com/CVE-2023-3393/): Code Injection in fossbilling/fossbilling (high 8.0)
- [CVE-2023-33929](https://insights.sbomify.com/CVE-2023-33929/): WordPress Easy Admin Menu Plugin <= 1.3 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-33928](https://insights.sbomify.com/CVE-2023-33928/): WordPress WordPress Backup & Migration plugin <= 1.4.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-33927](https://insights.sbomify.com/CVE-2023-33927/): WordPress Multiple Page Generator Plugin – MPG Plugin <= 3.3.19 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-33926](https://insights.sbomify.com/CVE-2023-33926/): WordPress Easy Google Maps Plugin <= 1.11.7 is vulnerable to Cross Site Request Forgery (CSRF) (high 7.1)
- [CVE-2023-33925](https://insights.sbomify.com/CVE-2023-33925/): WordPress WooCommerce Product Categories Selection Widget Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-33924](https://insights.sbomify.com/CVE-2023-33924/): WordPress SIS Handball Plugin <= 1.0.45 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-33923](https://insights.sbomify.com/CVE-2023-33923/): Broken Access Control leading to Arbitrary Plugin Activation in multiple HashThemes themes (medium 4.3)
- [CVE-2023-33922](https://insights.sbomify.com/CVE-2023-33922/): WordPress Elementor plugin <= 3.13.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-33921](https://insights.sbomify.com/CVE-2023-33921/): Misconfiguration in CP-8031 MASTER MODULE (medium 6.8)
- [CVE-2023-33920](https://insights.sbomify.com/CVE-2023-33920/): Hardcoded credentials in CP-8031 MASTER MODULE (medium 6.8)
- [CVE-2023-3392](https://insights.sbomify.com/CVE-2023-3392/): Read More & Accordion < 3.2.7 - Admin+ PHP Object Injection (high 7.2)
- [CVE-2023-33919](https://insights.sbomify.com/CVE-2023-33919/): Command injection in CP-8031 MASTER MODULE (high 7.2)
- [CVE-2023-33918](https://insights.sbomify.com/CVE-2023-33918/): Missing authorization in SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618 (medium 5.5)
- [CVE-2023-33917](https://insights.sbomify.com/CVE-2023-33917/): Missing authorization in SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618 (medium 5.5)
- [CVE-2023-33916](https://insights.sbomify.com/CVE-2023-33916/): Missing authorization in SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618 (medium 5.5)
- [CVE-2023-33915](https://insights.sbomify.com/CVE-2023-33915/): Missing authorization in T760/T770/T820/S8000 (high 7.5)
- [CVE-2023-33914](https://insights.sbomify.com/CVE-2023-33914/): Security feature bypass in T760/T770/T820/S8000 (high 7.5)
- [CVE-2023-33913](https://insights.sbomify.com/CVE-2023-33913/): Memory corruption in T606/T612/T616/T610/T618/T760/T770/T820/S8000 (high 7.2)
- [CVE-2023-33912](https://insights.sbomify.com/CVE-2023-33912/): Missing authorization in SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-33911](https://insights.sbomify.com/CVE-2023-33911/): Missing authorization in SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618 (medium 5.5)
- [CVE-2023-33910](https://insights.sbomify.com/CVE-2023-33910/): Missing authorization in SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-3391](https://insights.sbomify.com/CVE-2023-3391/): SourceCodester Human Resource Management System detailview.php sql injection (medium 6.3)
- [CVE-2023-33909](https://insights.sbomify.com/CVE-2023-33909/): Missing authorization in SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-33908](https://insights.sbomify.com/CVE-2023-33908/): Missing authorization in SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-33907](https://insights.sbomify.com/CVE-2023-33907/): Missing authorization in SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-33906](https://insights.sbomify.com/CVE-2023-33906/): Missing authorization in SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-33905](https://insights.sbomify.com/CVE-2023-33905/): Memory corruption in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 4.4)
- [CVE-2023-33904](https://insights.sbomify.com/CVE-2023-33904/): Memory corruption in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 4.4)
- [CVE-2023-33903](https://insights.sbomify.com/CVE-2023-33903/): Denial of service in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8001 (medium 4.4)
- [CVE-2023-33902](https://insights.sbomify.com/CVE-2023-33902/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-33901](https://insights.sbomify.com/CVE-2023-33901/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-33900](https://insights.sbomify.com/CVE-2023-33900/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-3390](https://insights.sbomify.com/CVE-2023-3390/): Use-after-free in Linux kernel's netfilter subsystem (high 7.8)
- [CVE-2023-33899](https://insights.sbomify.com/CVE-2023-33899/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-33898](https://insights.sbomify.com/CVE-2023-33898/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-33897](https://insights.sbomify.com/CVE-2023-33897/): Memory corruption in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8006 (medium 4.4)
- [CVE-2023-33896](https://insights.sbomify.com/CVE-2023-33896/): Memory corruption in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8005 (medium 4.4)
- [CVE-2023-33895](https://insights.sbomify.com/CVE-2023-33895/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8004 (medium 5.5)
- [CVE-2023-33894](https://insights.sbomify.com/CVE-2023-33894/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8003 (medium 5.5)
- [CVE-2023-33893](https://insights.sbomify.com/CVE-2023-33893/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8002 (medium 5.5)
- [CVE-2023-33892](https://insights.sbomify.com/CVE-2023-33892/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8001 (medium 5.5)
- [CVE-2023-33891](https://insights.sbomify.com/CVE-2023-33891/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-33890](https://insights.sbomify.com/CVE-2023-33890/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-3389](https://insights.sbomify.com/CVE-2023-3389/): Use after free in io_uring in the Linux Kernel (high 7.8)
- [CVE-2023-33889](https://insights.sbomify.com/CVE-2023-33889/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-33888](https://insights.sbomify.com/CVE-2023-33888/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-33887](https://insights.sbomify.com/CVE-2023-33887/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-33886](https://insights.sbomify.com/CVE-2023-33886/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-33885](https://insights.sbomify.com/CVE-2023-33885/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-33884](https://insights.sbomify.com/CVE-2023-33884/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/297/