# Vulnerabilities published in 2023


- [CVE-2023-3005](https://insights.sbomify.com/CVE-2023-3005/): SourceCodester Local Service Search Engine Management System POST Parameter cross site scripting (low 3.5)
- [CVE-2023-3004](https://insights.sbomify.com/CVE-2023-3004/): SourceCodester Simple Chat System POST Parameter sql injection (medium 6.3)
- [CVE-2023-3003](https://insights.sbomify.com/CVE-2023-3003/): SourceCodester Train Station Ticketing System GET Parameter manage_prices.php sql injection (medium 6.3)
- [CVE-2023-30024](https://insights.sbomify.com/CVE-2023-30024/): Missing authorization in magicjack:a921 firmware (medium 6.6)
- [CVE-2023-30019](https://insights.sbomify.com/CVE-2023-30019/): imgproxy is vulnerable to Server-Side Request Forgery (medium 5.3)
- [CVE-2023-30018](https://insights.sbomify.com/CVE-2023-30018/): SQL injection in judging management system project:judging management system (critical 9.8)
- [CVE-2023-30016](https://insights.sbomify.com/CVE-2023-30016/): SQL injection in oretnom23:judging management system (critical 9.8)
- [CVE-2023-30015](https://insights.sbomify.com/CVE-2023-30015/): SQL injection in oretnom23:judging management system (critical 9.8)
- [CVE-2023-30014](https://insights.sbomify.com/CVE-2023-30014/): SQL injection in oretnom23:judging management system (critical 9.8)
- [CVE-2023-30013](https://insights.sbomify.com/CVE-2023-30013/): Command injection in totolink:x5000r firmware (critical 9.8)
- [CVE-2023-3001](https://insights.sbomify.com/CVE-2023-3001/): Deserialization in IGSS Dashboard (DashBoard.exe) (high 7.8)
- [CVE-2023-3000](https://insights.sbomify.com/CVE-2023-3000/): SQLi in Erikoglu Technology's ErMon (critical 9.8)
- [CVE-2023-29998](https://insights.sbomify.com/CVE-2023-29998/): Cross-site scripting in gis3w:g3w-suite (medium 5.4)
- [CVE-2023-29996](https://insights.sbomify.com/CVE-2023-29996/): Null dereference in emqx:nanomq (high 7.5)
- [CVE-2023-29995](https://insights.sbomify.com/CVE-2023-29995/): Memory corruption in emqx:nanomq (high 7.5)
- [CVE-2023-29994](https://insights.sbomify.com/CVE-2023-29994/): Memory corruption in emqx:nanomq (high 7.5)
- [CVE-2023-2999](https://insights.sbomify.com/CVE-2023-2999/): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (medium 6.7)
- [CVE-2023-29986](https://insights.sbomify.com/CVE-2023-29986/): Path traversal in spring-boot-actuator-logview project:spring-boot-actuator-logview (medium 5.3)
- [CVE-2023-29985](https://insights.sbomify.com/CVE-2023-29985/): SQL injection in oretnom23:student study center desk management system (critical 9.8)
- [CVE-2023-29984](https://insights.sbomify.com/CVE-2023-29984/): Null dereference in brother:dcp-1610w firmware (high 7.5)
- [CVE-2023-29983](https://insights.sbomify.com/CVE-2023-29983/): Cross-site scripting in companymaps project:companymaps (medium 5.4)
- [CVE-2023-2998](https://insights.sbomify.com/CVE-2023-2998/): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (medium 6.0)
- [CVE-2023-29975](https://insights.sbomify.com/CVE-2023-29975/): Auth bypass in pfsense:pfsense (high 7.2)
- [CVE-2023-29974](https://insights.sbomify.com/CVE-2023-29974/): Weak cryptography in pfsense:pfsense (critical 9.8)
- [CVE-2023-29973](https://insights.sbomify.com/CVE-2023-29973/): Denial of service in pfsense:pfsense (medium 4.9)
- [CVE-2023-29963](https://insights.sbomify.com/CVE-2023-29963/): Code injection in s-cms:s-cms (high 7.2)
- [CVE-2023-29962](https://insights.sbomify.com/CVE-2023-29962/): Path traversal in s-cms:s-cms (medium 6.5)
- [CVE-2023-29961](https://insights.sbomify.com/CVE-2023-29961/): Memory corruption in dlink:dir-605l firmware (critical 9.8)
- [CVE-2023-2996](https://insights.sbomify.com/CVE-2023-2996/): Jetpack < 12.1.1 - Author+ Arbitrary File Manipulation via API (high 8.8)
- [CVE-2023-29950](https://insights.sbomify.com/CVE-2023-29950/): Memory corruption in swftools:swftools (medium 5.5)
- [CVE-2023-2995](https://insights.sbomify.com/CVE-2023-2995/): Leyka < 3.30.4 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-29944](https://insights.sbomify.com/CVE-2023-29944/): Command injection in metersphere:metersphere (critical 9.8)
- [CVE-2023-29942](https://insights.sbomify.com/CVE-2023-29942/): Memory corruption in llvm:llvm (medium 5.5)
- [CVE-2023-29941](https://insights.sbomify.com/CVE-2023-29941/): Memory corruption in llvm:llvm (medium 5.5)
- [CVE-2023-29939](https://insights.sbomify.com/CVE-2023-29939/): Memory corruption in llvm:llvm (medium 5.5)
- [CVE-2023-29935](https://insights.sbomify.com/CVE-2023-29935/): Denial of service in llvm:llvm (medium 5.5)
- [CVE-2023-29934](https://insights.sbomify.com/CVE-2023-29934/): Memory corruption in llvm:llvm (medium 5.5)
- [CVE-2023-29933](https://insights.sbomify.com/CVE-2023-29933/): Memory corruption in llvm:llvm (medium 5.5)
- [CVE-2023-29932](https://insights.sbomify.com/CVE-2023-29932/): Memory corruption in llvm:llvm (medium 5.5)
- [CVE-2023-29931](https://insights.sbomify.com/CVE-2023-29931/): laravel-s vulnerable to Local File Inclusion (critical 9.8)
- [CVE-2023-29930](https://insights.sbomify.com/CVE-2023-29930/): File upload in genesys:tftp server (high 8.8)
- [CVE-2023-2993](https://insights.sbomify.com/CVE-2023-2993/): Privilege escalation in Fan Power Controller (FPC) (medium 5.4)
- [CVE-2023-29929](https://insights.sbomify.com/CVE-2023-29929/): Buffer Overflow vulnerability found in Kemptechnologies Loadmaster before v.7.2.60.0 allows a remote attacker to casue a denial of service v (high 7.5)
- [CVE-2023-29927](https://insights.sbomify.com/CVE-2023-29927/): Missing authorization in sage:sage 300 (medium 4.3)
- [CVE-2023-29926](https://insights.sbomify.com/CVE-2023-29926/): PowerJob vulnerable to remote code execution (critical 9.8)
- [CVE-2023-29924](https://insights.sbomify.com/CVE-2023-29924/): PowerJob vulnerable to incorrect access control (critical 9.8)
- [CVE-2023-29923](https://insights.sbomify.com/CVE-2023-29923/): PowerJob vulnerable to Insecure Permissions (medium 5.3)
- [CVE-2023-29922](https://insights.sbomify.com/CVE-2023-29922/): PowerJob vulnerable to Incorrect Access Control via the create user/save interface. (medium 5.3)
- [CVE-2023-29921](https://insights.sbomify.com/CVE-2023-29921/): PowerJob Incorrect Access Control vulnerability (medium 5.3)
- [CVE-2023-2992](https://insights.sbomify.com/CVE-2023-2992/): Denial of service in Fan Power Controller (FPC) (high 7.5)
- [CVE-2023-29919](https://insights.sbomify.com/CVE-2023-29919/): Misconfiguration in contec:solarview compact firmware (critical 9.8)
- [CVE-2023-29918](https://insights.sbomify.com/CVE-2023-29918/): RosarioSIS vulnerable to CSV Injection (medium 5.4)
- [CVE-2023-29917](https://insights.sbomify.com/CVE-2023-29917/): Memory corruption in h3c:magic r200 firmware (medium 4.9)
- [CVE-2023-29916](https://insights.sbomify.com/CVE-2023-29916/): Memory corruption in h3c:magic r200 firmware (medium 4.9)
- [CVE-2023-29915](https://insights.sbomify.com/CVE-2023-29915/): Memory corruption in h3c:magic r200 firmware (medium 4.9)
- [CVE-2023-29914](https://insights.sbomify.com/CVE-2023-29914/): Memory corruption in h3c:magic r200 firmware (medium 4.9)
- [CVE-2023-29913](https://insights.sbomify.com/CVE-2023-29913/): Memory corruption in h3c:magic r200 firmware (medium 4.9)
- [CVE-2023-29912](https://insights.sbomify.com/CVE-2023-29912/): Memory corruption in h3c:magic r200 firmware (medium 4.9)
- [CVE-2023-29911](https://insights.sbomify.com/CVE-2023-29911/): Memory corruption in h3c:magic r200 firmware (medium 4.9)
- [CVE-2023-29910](https://insights.sbomify.com/CVE-2023-29910/): Memory corruption in h3c:magic r200 firmware (medium 4.9)
- [CVE-2023-2991](https://insights.sbomify.com/CVE-2023-2991/): Fortra Globalscape Administration Server Information Disclosure (medium 5.3)
- [CVE-2023-29909](https://insights.sbomify.com/CVE-2023-29909/): Memory corruption in h3c:magic r200 firmware (medium 4.9)
- [CVE-2023-29908](https://insights.sbomify.com/CVE-2023-29908/): Memory corruption in h3c:magic r200 firmware (medium 4.9)
- [CVE-2023-29907](https://insights.sbomify.com/CVE-2023-29907/): Memory corruption in h3c:magic r200 firmware (medium 4.9)
- [CVE-2023-29906](https://insights.sbomify.com/CVE-2023-29906/): Memory corruption in h3c:magic r200 firmware (medium 4.9)
- [CVE-2023-29905](https://insights.sbomify.com/CVE-2023-29905/): Memory corruption in h3c:magic r200 firmware (medium 4.9)
- [CVE-2023-2990](https://insights.sbomify.com/CVE-2023-2990/): Fortra Globalscape Administration Server Denial of Service (high 7.5)
- [CVE-2023-2989](https://insights.sbomify.com/CVE-2023-2989/): Fortra Globalscape Administration Server Out of Bounds Memory Read (critical 9.1)
- [CVE-2023-29887](https://insights.sbomify.com/CVE-2023-29887/): Path traversal in nuovo:spreadsheet-reader (high 7.5)
- [CVE-2023-29881](https://insights.sbomify.com/CVE-2023-29881/): SQL injection in phpok:phpok (medium 6.5)
- [CVE-2023-2987](https://insights.sbomify.com/CVE-2023-2987/): Wordapp <= 1.6.0 - Authorization Bypass through Use of Insufficiently Unique Cryptographic Signature (critical 9.8)
- [CVE-2023-29868](https://insights.sbomify.com/CVE-2023-29868/): Missing authorization in zammad:zammad (medium 6.5)
- [CVE-2023-29867](https://insights.sbomify.com/CVE-2023-29867/): Missing authorization in zammad:zammad (medium 6.5)
- [CVE-2023-29863](https://insights.sbomify.com/CVE-2023-29863/): SQL injection in medisys:weblab (critical 9.8)
- [CVE-2023-29862](https://insights.sbomify.com/CVE-2023-29862/): Code injection in agasio camera project:agasio camera firmware (critical 9.8)
- [CVE-2023-29861](https://insights.sbomify.com/CVE-2023-29861/): Code injection in flir:dvtel camera firmware (critical 9.8)
- [CVE-2023-29860](https://insights.sbomify.com/CVE-2023-29860/): Information disclosure in dtstack:taier (high 7.5)
- [CVE-2023-2986](https://insights.sbomify.com/CVE-2023-2986/): Abandoned Cart Lite for WooCommerce <= 5.15.1 - Authentication Bypass (critical 9.8)
- [CVE-2023-29857](https://insights.sbomify.com/CVE-2023-29857/): Information disclosure in teslamate:teslamate (medium 5.3)
- [CVE-2023-29856](https://insights.sbomify.com/CVE-2023-29856/): Memory corruption in dlink:dir-868l firmware (critical 9.8)
- [CVE-2023-29855](https://insights.sbomify.com/CVE-2023-29855/): Command injection in wbce:wbce cms (high 7.2)
- [CVE-2023-29854](https://insights.sbomify.com/CVE-2023-29854/): Cross-site scripting in dircms project:dircms (medium 6.1)
- [CVE-2023-29850](https://insights.sbomify.com/CVE-2023-29850/): Information disclosure in slims:senayan library management system (high 7.5)
- [CVE-2023-2985](https://insights.sbomify.com/CVE-2023-2985/): Use after free in Kernel (medium 5.5)
- [CVE-2023-29849](https://insights.sbomify.com/CVE-2023-29849/): SQL injection in hockeycomputindo:bang resto (high 8.8)
- [CVE-2023-29848](https://insights.sbomify.com/CVE-2023-29848/): Cross-site scripting in hockeycomputindo:bang resto (medium 4.8)
- [CVE-2023-29847](https://insights.sbomify.com/CVE-2023-29847/): Cross-site scripting in aerocms project:aerocms (medium 5.4)
- [CVE-2023-29842](https://insights.sbomify.com/CVE-2023-29842/): SQL injection in churchcrm:churchcrm (high 8.8)
- [CVE-2023-2984](https://insights.sbomify.com/CVE-2023-2984/): Path Traversal: '\..\filename' in pimcore/pimcore (medium 6.3)
- [CVE-2023-29839](https://insights.sbomify.com/CVE-2023-29839/): Cross-site scripting in digitaldruid:hoteldruid (medium 5.4)
- [CVE-2023-29838](https://insights.sbomify.com/CVE-2023-29838/): Privilege escalation in allwaysync:allwaysync (high 7.8)
- [CVE-2023-29837](https://insights.sbomify.com/CVE-2023-29837/): Cross-site scripting in exelysis:exelysis unified communications solution (medium 6.1)
- [CVE-2023-29836](https://insights.sbomify.com/CVE-2023-29836/): Cross-site scripting in exelysis:exelysis unified communications solution (medium 6.1)
- [CVE-2023-29835](https://insights.sbomify.com/CVE-2023-29835/): Privilege escalation in wondershare:dr.fone (high 7.8)
- [CVE-2023-2983](https://insights.sbomify.com/CVE-2023-2983/): Privilege Defined With Unsafe Actions in pimcore/pimcore (medium 6.5)
- [CVE-2023-29827](https://insights.sbomify.com/CVE-2023-29827/): Code injection in ejs:ejs (critical 9.8)
- [CVE-2023-29824](https://insights.sbomify.com/CVE-2023-29824/): Withdrawn: Use after free in SciPy (critical 9.8)
- [CVE-2023-29820](https://insights.sbomify.com/CVE-2023-29820/): Information disclosure in webroot:secureanywhere (medium 5.5)
- [CVE-2023-2982](https://insights.sbomify.com/CVE-2023-2982/): WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.4 - Authentication Bypass (critical 9.8)
- [CVE-2023-29819](https://insights.sbomify.com/CVE-2023-29819/): Security feature bypass in webroot:secureanywhere (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/328/