# Vulnerabilities published in 2023


- [CVE-2023-32019](https://insights.sbomify.com/CVE-2023-32019/): Windows Kernel Information Disclosure Vulnerability (medium 4.7)
- [CVE-2023-32018](https://insights.sbomify.com/CVE-2023-32018/): Windows Hello Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-32017](https://insights.sbomify.com/CVE-2023-32017/): Microsoft PostScript Printer Driver Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-32016](https://insights.sbomify.com/CVE-2023-32016/): Windows Installer Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-32015](https://insights.sbomify.com/CVE-2023-32015/): Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2023-32014](https://insights.sbomify.com/CVE-2023-32014/): Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2023-32013](https://insights.sbomify.com/CVE-2023-32013/): Windows Hyper-V Denial of Service Vulnerability (medium 5.3)
- [CVE-2023-32012](https://insights.sbomify.com/CVE-2023-32012/): Windows Container Manager Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2023-32011](https://insights.sbomify.com/CVE-2023-32011/): Windows iSCSI Discovery Service Denial of Service Vulnerability (high 7.5)
- [CVE-2023-32010](https://insights.sbomify.com/CVE-2023-32010/): Windows Bus Filter Driver Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2023-3201](https://insights.sbomify.com/CVE-2023-3201/): MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Title Update (medium 4.3)
- [CVE-2023-32009](https://insights.sbomify.com/CVE-2023-32009/): Windows Collaborative Translation Framework Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2023-32008](https://insights.sbomify.com/CVE-2023-32008/): Windows Resilient File System (ReFS) Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-32007](https://insights.sbomify.com/CVE-2023-32007/): Apache Spark: Shell command injection via Spark UI (high 8.8)
- [CVE-2023-32006](https://insights.sbomify.com/CVE-2023-32006/): Security feature bypass in Node (high 8.8)
- [CVE-2023-32005](https://insights.sbomify.com/CVE-2023-32005/): Security feature bypass in Node (medium 5.3)
- [CVE-2023-32004](https://insights.sbomify.com/CVE-2023-32004/): Path traversal in Node (high 8.8)
- [CVE-2023-32003](https://insights.sbomify.com/CVE-2023-32003/): Path traversal in Node (medium 5.3)
- [CVE-2023-32002](https://insights.sbomify.com/CVE-2023-32002/): Security feature bypass in Node (critical 9.8)
- [CVE-2023-32000](https://insights.sbomify.com/CVE-2023-32000/): Cross-site scripting in UniFi Network Application (medium 4.8)
- [CVE-2023-3200](https://insights.sbomify.com/CVE-2023-3200/): MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Message Update (medium 4.3)
- [CVE-2023-31999](https://insights.sbomify.com/CVE-2023-31999/): @fastify/oauth2 vulnerable to Cross Site Request Forgery due to reused Oauth2 state (high 8.8)
- [CVE-2023-31998](https://insights.sbomify.com/CVE-2023-31998/): Memory corruption in Aircube (medium 5.9)
- [CVE-2023-31997](https://insights.sbomify.com/CVE-2023-31997/): Misconfiguration in UniFi OS (critical 9.0)
- [CVE-2023-31996](https://insights.sbomify.com/CVE-2023-31996/): Command injection in hanwhavision:ane-l6012r firmware (high 8.8)
- [CVE-2023-31995](https://insights.sbomify.com/CVE-2023-31995/): Cross-site scripting in hanwhavision:ane-l6012r firmware (medium 5.4)
- [CVE-2023-31994](https://insights.sbomify.com/CVE-2023-31994/): Denial of service in hanwhavision:ane-l6012r firmware (medium 5.3)
- [CVE-2023-3199](https://insights.sbomify.com/CVE-2023-3199/): MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Title Update (medium 4.3)
- [CVE-2023-31986](https://insights.sbomify.com/CVE-2023-31986/): Command injection in edimax:br-6428ns firmware (critical 9.8)
- [CVE-2023-31985](https://insights.sbomify.com/CVE-2023-31985/): Command injection in edimax:br-6428ns firmware (critical 9.8)
- [CVE-2023-31983](https://insights.sbomify.com/CVE-2023-31983/): Command injection in edimax:br-6428ns firmware (critical 9.8)
- [CVE-2023-31982](https://insights.sbomify.com/CVE-2023-31982/): Memory corruption in irontec:sngrep (high 7.8)
- [CVE-2023-31981](https://insights.sbomify.com/CVE-2023-31981/): Memory corruption in irontec:sngrep (high 7.8)
- [CVE-2023-3198](https://insights.sbomify.com/CVE-2023-3198/): MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Status Update (medium 4.3)
- [CVE-2023-31979](https://insights.sbomify.com/CVE-2023-31979/): Memory corruption in fossies:catdoc (high 7.8)
- [CVE-2023-31976](https://insights.sbomify.com/CVE-2023-31976/): Memory corruption in libming:libming (high 8.8)
- [CVE-2023-31975](https://insights.sbomify.com/CVE-2023-31975/): Denial of service in yasm project:yasm (low 3.3)
- [CVE-2023-31974](https://insights.sbomify.com/CVE-2023-31974/): Use after free in tortall:yasm (medium 5.5)
- [CVE-2023-31973](https://insights.sbomify.com/CVE-2023-31973/): Use after free in tortall:yasm (high 7.8)
- [CVE-2023-31972](https://insights.sbomify.com/CVE-2023-31972/): Use after free in tortall:yasm (medium 5.5)
- [CVE-2023-3197](https://insights.sbomify.com/CVE-2023-3197/): MStore API <= 4.0.1 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2023-3196](https://insights.sbomify.com/CVE-2023-3196/): Multiple vulnerabilities in Canopsis of Capensis (medium 4.7)
- [CVE-2023-3195](https://insights.sbomify.com/CVE-2023-3195/): Memory corruption in ImageMagick (medium 5.5)
- [CVE-2023-31946](https://insights.sbomify.com/CVE-2023-31946/): File upload in online travel agency system project:online travel agency system (high 7.2)
- [CVE-2023-31945](https://insights.sbomify.com/CVE-2023-31945/): SQL injection in online travel agency system project:online travel agency system (high 7.2)
- [CVE-2023-31944](https://insights.sbomify.com/CVE-2023-31944/): SQL injection in online travel agency system project:online travel agency system (high 7.2)
- [CVE-2023-31943](https://insights.sbomify.com/CVE-2023-31943/): SQL injection in online travel agency system project:online travel agency system (high 7.2)
- [CVE-2023-31942](https://insights.sbomify.com/CVE-2023-31942/): Cross-site scripting in online travel agency system project:online travel agency system (medium 4.8)
- [CVE-2023-31941](https://insights.sbomify.com/CVE-2023-31941/): File upload in online travel agency system project:online travel agency system (high 7.2)
- [CVE-2023-31940](https://insights.sbomify.com/CVE-2023-31940/): SQL injection in online travel agency system project:online travel agency system (high 7.2)
- [CVE-2023-31939](https://insights.sbomify.com/CVE-2023-31939/): SQL injection in online travel agency system project:online travel agency system (high 7.2)
- [CVE-2023-31938](https://insights.sbomify.com/CVE-2023-31938/): SQL injection in online travel agency system project:online travel agency system (high 7.2)
- [CVE-2023-31937](https://insights.sbomify.com/CVE-2023-31937/): SQL injection in phpgurukul:rail pass management system (high 7.2)
- [CVE-2023-31936](https://insights.sbomify.com/CVE-2023-31936/): SQL injection in phpgurukul:rail pass management system (high 7.2)
- [CVE-2023-31935](https://insights.sbomify.com/CVE-2023-31935/): Cross-site scripting in phpgurukul:rail pass management system (medium 4.8)
- [CVE-2023-31934](https://insights.sbomify.com/CVE-2023-31934/): Cross-site scripting in phpgurukul:rail pass management system (medium 4.8)
- [CVE-2023-31933](https://insights.sbomify.com/CVE-2023-31933/): SQL injection in phpgurukul:rail pass management system (high 7.2)
- [CVE-2023-31932](https://insights.sbomify.com/CVE-2023-31932/): SQL injection in phpgurukul:rail pass management system (high 7.2)
- [CVE-2023-3193](https://insights.sbomify.com/CVE-2023-3193/): Liferay Portal and Liferay DXP Vulnerable to XSS via the Layout Module (medium 6.1)
- [CVE-2023-31928](https://insights.sbomify.com/CVE-2023-31928/): XSS vulnerability in Brocade Webtools (medium 6.3)
- [CVE-2023-31927](https://insights.sbomify.com/CVE-2023-31927/): An information disclosure in the web interface of Brocade Fabric OS (medium 5.3)
- [CVE-2023-31926](https://insights.sbomify.com/CVE-2023-31926/): Arbitrary File Overwrite using less command (high 7.1)
- [CVE-2023-31925](https://insights.sbomify.com/CVE-2023-31925/): Storage of clear text password in Brocade SANnav (medium 5.4)
- [CVE-2023-31923](https://insights.sbomify.com/CVE-2023-31923/): Privilege escalation in supremainc:biostar 2 (high 8.8)
- [CVE-2023-31922](https://insights.sbomify.com/CVE-2023-31922/): Memory corruption in quickjs project:quickjs (high 7.5)
- [CVE-2023-31921](https://insights.sbomify.com/CVE-2023-31921/): Denial of service in jerryscript:jerryscript (medium 5.5)
- [CVE-2023-31920](https://insights.sbomify.com/CVE-2023-31920/): Denial of service in jerryscript:jerryscript (medium 5.5)
- [CVE-2023-3192](https://insights.sbomify.com/CVE-2023-3192/): Session Fixation in froxlor/froxlor (medium 4.2)
- [CVE-2023-31919](https://insights.sbomify.com/CVE-2023-31919/): Denial of service in jerryscript:jerryscript (medium 5.5)
- [CVE-2023-31918](https://insights.sbomify.com/CVE-2023-31918/): Denial of service in jerryscript:jerryscript (medium 5.5)
- [CVE-2023-31916](https://insights.sbomify.com/CVE-2023-31916/): Denial of service in jerryscript:jerryscript (medium 5.5)
- [CVE-2023-31914](https://insights.sbomify.com/CVE-2023-31914/): Denial of service in jerryscript:jerryscript (medium 5.5)
- [CVE-2023-31913](https://insights.sbomify.com/CVE-2023-31913/): Denial of service in jerryscript:jerryscript (medium 5.5)
- [CVE-2023-31910](https://insights.sbomify.com/CVE-2023-31910/): Memory corruption in jerryscript:jerryscript (high 7.8)
- [CVE-2023-3191](https://insights.sbomify.com/CVE-2023-3191/): Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass (high 8.1)
- [CVE-2023-31908](https://insights.sbomify.com/CVE-2023-31908/): Memory corruption in jerryscript:jerryscript (high 7.8)
- [CVE-2023-31907](https://insights.sbomify.com/CVE-2023-31907/): Memory corruption in jerryscript:jerryscript (high 7.8)
- [CVE-2023-31906](https://insights.sbomify.com/CVE-2023-31906/): Memory corruption in jerryscript:jerryscript (high 7.8)
- [CVE-2023-31904](https://insights.sbomify.com/CVE-2023-31904/): Path traversal in savysoda:wifi hd wireless disk drive (high 7.5)
- [CVE-2023-31903](https://insights.sbomify.com/CVE-2023-31903/): File upload in freeguppy:guppy (critical 9.8)
- [CVE-2023-31902](https://insights.sbomify.com/CVE-2023-31902/): Other in mobilemouse:mobile mouse (critical 9.8)
- [CVE-2023-3190](https://insights.sbomify.com/CVE-2023-3190/): Improper Encoding or Escaping of Output in nilsteampassnet/teampass (low 3.5)
- [CVE-2023-31893](https://insights.sbomify.com/CVE-2023-31893/): Denial of service in telefonica:brasil vivo play firmware (high 7.5)
- [CVE-2023-31890](https://insights.sbomify.com/CVE-2023-31890/): glazedlists XML Deserialization vulnerability (critical 9.8)
- [CVE-2023-3189](https://insights.sbomify.com/CVE-2023-3189/): SourceCodester Online School Fees System POST Parameter branch.php cross site scripting (low 3.5)
- [CVE-2023-31889](https://insights.sbomify.com/CVE-2023-31889/): An issue discovered in httpd in ASUS RT-AC51U with firmware version up to and including 3.0.0.4.380.8591 allows local attackers to cause a d (medium 5.5)
- [CVE-2023-3188](https://insights.sbomify.com/CVE-2023-3188/): Server-Side Request Forgery (SSRF) in owncast/owncast (high 8.3)
- [CVE-2023-31874](https://insights.sbomify.com/CVE-2023-31874/): Code injection in yank-note:yank note (high 8.8)
- [CVE-2023-31873](https://insights.sbomify.com/CVE-2023-31873/): Code injection in gin project:gin (high 7.8)
- [CVE-2023-31871](https://insights.sbomify.com/CVE-2023-31871/): Privilege escalation in opentext:documentum content server (high 7.8)
- [CVE-2023-3187](https://insights.sbomify.com/CVE-2023-3187/): PHPGurukul Teachers Record Management System Profile Picture changeimage.php unrestricted upload (medium 6.3)
- [CVE-2023-31868](https://insights.sbomify.com/CVE-2023-31868/): Cross-site scripting in sage:x3 (medium 5.4)
- [CVE-2023-31867](https://insights.sbomify.com/CVE-2023-31867/): Code injection in sage:x3 (high 7.2)
- [CVE-2023-31862](https://insights.sbomify.com/CVE-2023-31862/): Cross-site scripting in jizhicms:jizhicms (medium 5.4)
- [CVE-2023-31861](https://insights.sbomify.com/CVE-2023-31861/): Path traversal in zlmediakit:zlmediakit (high 7.5)
- [CVE-2023-31860](https://insights.sbomify.com/CVE-2023-31860/): Cross-site scripting in wuzhicms:wuzhicms (medium 5.4)
- [CVE-2023-3186](https://insights.sbomify.com/CVE-2023-3186/): Supsystic Popup < 1.10.19 - Prototype Pollution (critical 9.8)
- [CVE-2023-31857](https://insights.sbomify.com/CVE-2023-31857/): File upload in oretnom23:online computer and laptop store (critical 9.8)
- [CVE-2023-31856](https://insights.sbomify.com/CVE-2023-31856/): Command injection in totolink:cp300\+ firmware (critical 9.8)
- [CVE-2023-31854](https://insights.sbomify.com/CVE-2023-31854/): std::bad_alloc is mishandled in Precomp 0.4.8. (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/314/