# Vulnerabilities published in 2023


- [CVE-2023-33562](https://insights.sbomify.com/CVE-2023-33562/): Information disclosure in phpjabbers:time slots booking calendar (critical 9.8)
- [CVE-2023-33561](https://insights.sbomify.com/CVE-2023-33561/): Other in phpjabbers:time slots booking calendar (critical 9.8)
- [CVE-2023-33560](https://insights.sbomify.com/CVE-2023-33560/): Cross-site scripting in phpjabbers:time slots booking calendar (medium 6.1)
- [CVE-2023-3356](https://insights.sbomify.com/CVE-2023-3356/): Subscribers Text Counter < 1.7.1 - Settings Update via CSRF to Stored XSS (medium 4.3)
- [CVE-2023-33559](https://insights.sbomify.com/CVE-2023-33559/): Path traversal in ocomon project:ocomon (high 8.8)
- [CVE-2023-33558](https://insights.sbomify.com/CVE-2023-33558/): Information disclosure in ocomon project:ocomon (high 7.5)
- [CVE-2023-33557](https://insights.sbomify.com/CVE-2023-33557/): SQL injection in thedaylightstudio:fuel cms (high 8.8)
- [CVE-2023-33556](https://insights.sbomify.com/CVE-2023-33556/): Command injection in totolink:a7100ru firmware (critical 9.8)
- [CVE-2023-33553](https://insights.sbomify.com/CVE-2023-33553/): Auth bypass in planet:wdrt-1800ax firmware (critical 9.8)
- [CVE-2023-33552](https://insights.sbomify.com/CVE-2023-33552/): Memory corruption in erofs-utils project:erofs-utils (high 7.8)
- [CVE-2023-33551](https://insights.sbomify.com/CVE-2023-33551/): Memory corruption in erofs-utils project:erofs-utils (high 7.8)
- [CVE-2023-3355](https://insights.sbomify.com/CVE-2023-3355/): Null pointer dereference in submit_lookup_cmds() in drivers/gpu/drm/msm/msm_gem_submit.c (medium 4.7)
- [CVE-2023-33548](https://insights.sbomify.com/CVE-2023-33548/): Cross Site Scripting (XSS) vulnerability in ASUS RT-AC51U with firmware versions up to and including 3.0.0.4.380.8591 allows attackers to ru (medium 6.8)
- [CVE-2023-33546](https://insights.sbomify.com/CVE-2023-33546/): janino vulnerable to denial of service due to stack overflow (medium 5.5)
- [CVE-2023-33544](https://insights.sbomify.com/CVE-2023-33544/): hawtio vulnerable to Path Traversal (medium 5.5)
- [CVE-2023-3354](https://insights.sbomify.com/CVE-2023-3354/): Improper i/o watch removal in tls handshake can lead to remote unauthenticated denial of service (high 7.5)
- [CVE-2023-33538](https://insights.sbomify.com/CVE-2023-33538/): TP-Link Multiple Routers Command Injection (high 8.8, exploited in the wild)
- [CVE-2023-33537](https://insights.sbomify.com/CVE-2023-33537/): Memory corruption in tp-link:tl-wr740n firmware (high 8.1)
- [CVE-2023-33536](https://insights.sbomify.com/CVE-2023-33536/): Memory corruption in tp-link:tl-wr740n firmware (high 8.1)
- [CVE-2023-33534](https://insights.sbomify.com/CVE-2023-33534/): Cross-site request forgery in sztozed:zlt s10g firmware (high 8.8)
- [CVE-2023-33533](https://insights.sbomify.com/CVE-2023-33533/): Command injection in netgear:d6220 firmware (high 8.8)
- [CVE-2023-33532](https://insights.sbomify.com/CVE-2023-33532/): Command injection in netgear:r6250 firmware (critical 9.8)
- [CVE-2023-33530](https://insights.sbomify.com/CVE-2023-33530/): Command injection in tenda:g103 firmware (high 8.8)
- [CVE-2023-33528](https://insights.sbomify.com/CVE-2023-33528/): Cross-site scripting in halo:halo (medium 6.1)
- [CVE-2023-33524](https://insights.sbomify.com/CVE-2023-33524/): Path traversal in advent:tamale rms (medium 5.3)
- [CVE-2023-3352](https://insights.sbomify.com/CVE-2023-3352/): Smush – Lazy Load Images, Optimize & Compress Images <= 3.16.4 - Missing Authorization to Resmush List Deletion (medium 4.3)
- [CVE-2023-33518](https://insights.sbomify.com/CVE-2023-33518/): Information disclosure in emoncms:emoncms (medium 5.3)
- [CVE-2023-33517](https://insights.sbomify.com/CVE-2023-33517/): Path traversal in carrental project:carrental (high 7.5)
- [CVE-2023-33515](https://insights.sbomify.com/CVE-2023-33515/): Cross-site scripting in softexpert:excellence suite (medium 5.4)
- [CVE-2023-33510](https://insights.sbomify.com/CVE-2023-33510/): Jeecg P3 Biz Chat allows remote attackers to read arbitrary files (high 7.5)
- [CVE-2023-33509](https://insights.sbomify.com/CVE-2023-33509/): SQL injection in kramerav:via go2 firmware (critical 9.8)
- [CVE-2023-33508](https://insights.sbomify.com/CVE-2023-33508/): File upload in kramerav:via go2 firmware (critical 9.8)
- [CVE-2023-33507](https://insights.sbomify.com/CVE-2023-33507/): Path traversal in kramerav:via go2 firmware (high 7.5)
- [CVE-2023-3350](https://insights.sbomify.com/CVE-2023-3350/): Cryptographic Issues on IBERMATICA RPS (high 8.2)
- [CVE-2023-33498](https://insights.sbomify.com/CVE-2023-33498/): alist Incorrect Access Control vulnerability (high 8.8)
- [CVE-2023-33496](https://insights.sbomify.com/CVE-2023-33496/): xxl-rpc deserialization vulnerability (critical 9.8)
- [CVE-2023-33495](https://insights.sbomify.com/CVE-2023-33495/): Craft CMS vulnerable to HTML injection (medium 6.1)
- [CVE-2023-33493](https://insights.sbomify.com/CVE-2023-33493/): File upload in ajaxmanager project:ajaxmanager (critical 9.8)
- [CVE-2023-33492](https://insights.sbomify.com/CVE-2023-33492/): Cross-site scripting in eyoucms:eyoucms (medium 5.4)
- [CVE-2023-3349](https://insights.sbomify.com/CVE-2023-3349/): Information exposure on IBERMATICA RPS (high 8.2)
- [CVE-2023-33487](https://insights.sbomify.com/CVE-2023-33487/): Command injection in totolink:x5000r firmware (critical 9.8)
- [CVE-2023-33486](https://insights.sbomify.com/CVE-2023-33486/): Command injection in totolink:x5000r firmware (critical 9.8)
- [CVE-2023-33485](https://insights.sbomify.com/CVE-2023-33485/): Memory corruption in totolink:x5000r firmware (high 8.8)
- [CVE-2023-33481](https://insights.sbomify.com/CVE-2023-33481/): SQL injection in remoteclinic:remote clinic (critical 9.8)
- [CVE-2023-33480](https://insights.sbomify.com/CVE-2023-33480/): Privilege escalation in remoteclinic:remote clinic (high 8.8)
- [CVE-2023-3348](https://insights.sbomify.com/CVE-2023-3348/): Directory traversal vulnerability in Cloudflare Wrangler (medium 5.7)
- [CVE-2023-33479](https://insights.sbomify.com/CVE-2023-33479/): SQL injection in remoteclinic:remote clinic (critical 9.8)
- [CVE-2023-33478](https://insights.sbomify.com/CVE-2023-33478/): SQL injection in remoteclinic:remote clinic (critical 9.8)
- [CVE-2023-33477](https://insights.sbomify.com/CVE-2023-33477/): Missing authorization in harmonicinc:nsg 9000-6g firmware (medium 6.5)
- [CVE-2023-33476](https://insights.sbomify.com/CVE-2023-33476/): Memory corruption in readymedia project:readymedia (critical 9.8)
- [CVE-2023-33472](https://insights.sbomify.com/CVE-2023-33472/): Code injection in scada-lts:scada-lts (high 8.8)
- [CVE-2023-3347](https://insights.sbomify.com/CVE-2023-3347/): Samba: smb2 packet signing is not enforced when "server signing = required" is set (medium 5.9)
- [CVE-2023-33469](https://insights.sbomify.com/CVE-2023-33469/): Code injection in kramerav:via connect2 firmware (high 7.8)
- [CVE-2023-33468](https://insights.sbomify.com/CVE-2023-33468/): Auth bypass in kramerav:via connect2 firmware (critical 9.1)
- [CVE-2023-33466](https://insights.sbomify.com/CVE-2023-33466/): Code injection in orthanc-server:orthanc (high 8.8)
- [CVE-2023-33461](https://insights.sbomify.com/CVE-2023-33461/): Null dereference in ndevilla:iniparser (medium 5.5)
- [CVE-2023-33460](https://insights.sbomify.com/CVE-2023-33460/): Denial of service in debian:debian linux (medium 6.5)
- [CVE-2023-3346](https://insights.sbomify.com/CVE-2023-3346/): Denial of Service (DoS) and Remote Code Execution Vulnerability in MITSUBISHI CNC Series (critical 9.8)
- [CVE-2023-33457](https://insights.sbomify.com/CVE-2023-33457/): Memory corruption in sogou:c\+\+ workflow (high 8.8)
- [CVE-2023-3345](https://insights.sbomify.com/CVE-2023-3345/): LMS by Masteriyo < 1.6.8 - Information Exposure (medium 6.5)
- [CVE-2023-33443](https://insights.sbomify.com/CVE-2023-33443/): Missing authorization in besder:videoplaytool (critical 9.8)
- [CVE-2023-33440](https://insights.sbomify.com/CVE-2023-33440/): Code injection in faculty evaluation system project:faculty evaluation system (high 7.2)
- [CVE-2023-3344](https://insights.sbomify.com/CVE-2023-3344/): Auto Location for WP Job Manager via Google < 1.1 - Admin+ Cross Site Scripting (medium 4.8)
- [CVE-2023-33439](https://insights.sbomify.com/CVE-2023-33439/): SQL injection in faculty evaluation system project:faculty evaluation system (high 7.2)
- [CVE-2023-33438](https://insights.sbomify.com/CVE-2023-33438/): Cross-site scripting in wolterskluwer:teammate\+ (medium 5.4)
- [CVE-2023-3343](https://insights.sbomify.com/CVE-2023-3343/): User Registration <= 3.0.1 - Authenticated (Subscriber+) PHP Object Injection (high 8.8)
- [CVE-2023-3342](https://insights.sbomify.com/CVE-2023-3342/): User Registration <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Upload (critical 9.9)
- [CVE-2023-33413](https://insights.sbomify.com/CVE-2023-33413/): Command injection in supermicro:b12dpe-6 firmware (high 8.8)
- [CVE-2023-33412](https://insights.sbomify.com/CVE-2023-33412/): Command injection in supermicro:b12dpe-6 firmware (high 8.8)
- [CVE-2023-33411](https://insights.sbomify.com/CVE-2023-33411/): Path traversal in supermicro:b12dpe-6 firmware (high 7.5)
- [CVE-2023-33410](https://insights.sbomify.com/CVE-2023-33410/): Code injection in minical:minical (high 8.8)
- [CVE-2023-3341](https://insights.sbomify.com/CVE-2023-3341/): A stack exhaustion flaw in control channel code may cause named to terminate unexpectedly (high 7.5)
- [CVE-2023-33409](https://insights.sbomify.com/CVE-2023-33409/): Cross-site request forgery in minical:minical (medium 6.5)
- [CVE-2023-33408](https://insights.sbomify.com/CVE-2023-33408/): Cross-site scripting in minical:minical (medium 5.4)
- [CVE-2023-33405](https://insights.sbomify.com/CVE-2023-33405/): Open redirect in blogengine:blogengine.net (medium 6.1)
- [CVE-2023-33404](https://insights.sbomify.com/CVE-2023-33404/): File upload in blogengine:blogengine.net (critical 9.8)
- [CVE-2023-3340](https://insights.sbomify.com/CVE-2023-3340/): SourceCodester Online School Fees System GET Parameter ajx.php sql injection (medium 6.3)
- [CVE-2023-33394](https://insights.sbomify.com/CVE-2023-33394/): Cross-site scripting in skycaiji:skycaiji (medium 5.4)
- [CVE-2023-3339](https://insights.sbomify.com/CVE-2023-3339/): code-projects Agro-School Management System exam-delete.php sql injection (medium 6.3)
- [CVE-2023-33387](https://insights.sbomify.com/CVE-2023-33387/): Cross-site scripting in datev:eg personal-management system comfort\/comfort plus (medium 6.1)
- [CVE-2023-33386](https://insights.sbomify.com/CVE-2023-33386/): File upload in marsctf project:marsctf (critical 9.8)
- [CVE-2023-33383](https://insights.sbomify.com/CVE-2023-33383/): Memory corruption in shelly:pro 4pm firmware (medium 5.3)
- [CVE-2023-33381](https://insights.sbomify.com/CVE-2023-33381/): Command injection in mitrastar:gpt-2741gnac firmware (high 7.2)
- [CVE-2023-3338](https://insights.sbomify.com/CVE-2023-3338/): Crash due to a null pointer dereference in the dn_nsp_send function (medium 6.5)
- [CVE-2023-33379](https://insights.sbomify.com/CVE-2023-33379/): Misconfiguration in connectedio:er2000t-vz-cat1 firmware (critical 9.8)
- [CVE-2023-33378](https://insights.sbomify.com/CVE-2023-33378/): Command injection in connectedio:connected io (critical 9.8)
- [CVE-2023-33377](https://insights.sbomify.com/CVE-2023-33377/): Command injection in connectedio:connected io (critical 9.8)
- [CVE-2023-33376](https://insights.sbomify.com/CVE-2023-33376/): Command injection in connectedio:connected io (critical 9.8)
- [CVE-2023-33375](https://insights.sbomify.com/CVE-2023-33375/): Memory corruption in connectedio:connected io (critical 9.8)
- [CVE-2023-33374](https://insights.sbomify.com/CVE-2023-33374/): Command injection in connectedio:connected io (critical 9.8)
- [CVE-2023-33373](https://insights.sbomify.com/CVE-2023-33373/): Information disclosure in connectedio:connected io (critical 9.8)
- [CVE-2023-33372](https://insights.sbomify.com/CVE-2023-33372/): Hardcoded credentials in connectedio:connected io (critical 9.8)
- [CVE-2023-33371](https://insights.sbomify.com/CVE-2023-33371/): Hardcoded credentials in assaabloy:control id idsecure (critical 9.8)
- [CVE-2023-33370](https://insights.sbomify.com/CVE-2023-33370/): Denial of service in assaabloy:control id idsecure (high 7.5)
- [CVE-2023-3337](https://insights.sbomify.com/CVE-2023-3337/): PuneethReddyHC Online Shopping System Advanced Admin Registration reg.php improper authentication (high 7.3)
- [CVE-2023-33369](https://insights.sbomify.com/CVE-2023-33369/): Path traversal in assaabloy:control id idsecure (critical 9.1)
- [CVE-2023-33368](https://insights.sbomify.com/CVE-2023-33368/): Information disclosure in assaabloy:control id idsecure (medium 6.5)
- [CVE-2023-33367](https://insights.sbomify.com/CVE-2023-33367/): SQL injection in assaabloy:control id idsecure (critical 9.8)
- [CVE-2023-33366](https://insights.sbomify.com/CVE-2023-33366/): SQL injection in supremainc:biostar 2 (high 8.8)
- [CVE-2023-33365](https://insights.sbomify.com/CVE-2023-33365/): Path traversal in supremainc:biostar 2 (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/300/