# Vulnerabilities published in 2023


- [CVE-2023-29818](https://insights.sbomify.com/CVE-2023-29818/): Security feature bypass in webroot:secureanywhere (medium 5.5)
- [CVE-2023-29815](https://insights.sbomify.com/CVE-2023-29815/): Cross-site request forgery in chshcms:mccms (high 8.8)
- [CVE-2023-2981](https://insights.sbomify.com/CVE-2023-2981/): Abstrium Pydio Cells Chat cross site scripting (low 3.5)
- [CVE-2023-29809](https://insights.sbomify.com/CVE-2023-29809/): SQL injection in companymaps project:companymaps (critical 9.8)
- [CVE-2023-29808](https://insights.sbomify.com/CVE-2023-29808/): Cross-site scripting in companymaps project:companymaps (medium 6.1)
- [CVE-2023-29805](https://insights.sbomify.com/CVE-2023-29805/): Command injection in iodata:wfs-sr03k firmware (critical 9.8)
- [CVE-2023-29804](https://insights.sbomify.com/CVE-2023-29804/): Command injection in iodata:wfs-sr03k firmware (high 8.8)
- [CVE-2023-29803](https://insights.sbomify.com/CVE-2023-29803/): Command injection in totolink:x18 firmware (critical 9.8)
- [CVE-2023-29802](https://insights.sbomify.com/CVE-2023-29802/): Command injection in totolink:x18 firmware (critical 9.8)
- [CVE-2023-29801](https://insights.sbomify.com/CVE-2023-29801/): Command injection in totolink:x18 firmware (critical 9.8)
- [CVE-2023-29800](https://insights.sbomify.com/CVE-2023-29800/): Command injection in totolink:x18 firmware (critical 9.8)
- [CVE-2023-2980](https://insights.sbomify.com/CVE-2023-2980/): Abstrium Pydio Cells User Creation resource injection (medium 6.3)
- [CVE-2023-29799](https://insights.sbomify.com/CVE-2023-29799/): Command injection in totolink:x18 firmware (critical 9.8)
- [CVE-2023-29798](https://insights.sbomify.com/CVE-2023-29798/): Command injection in totolink:x18 firmware (critical 9.8)
- [CVE-2023-29791](https://insights.sbomify.com/CVE-2023-29791/): Cross-site scripting in kodcloud:kodbox (medium 6.1)
- [CVE-2023-29790](https://insights.sbomify.com/CVE-2023-29790/): Information disclosure in kodcloud:kodbox (high 7.5)
- [CVE-2023-2979](https://insights.sbomify.com/CVE-2023-2979/): Abstrium Pydio Cells User Creation access control (medium 4.7)
- [CVE-2023-29780](https://insights.sbomify.com/CVE-2023-29780/): Denial of service in 3reality:3rsb015bz firmware (high 7.5)
- [CVE-2023-2978](https://insights.sbomify.com/CVE-2023-2978/): Abstrium Pydio Cells Change Subscription authorization (medium 4.6)
- [CVE-2023-29779](https://insights.sbomify.com/CVE-2023-29779/): Denial of service in sengled:e1e-g7f firmware (high 7.5)
- [CVE-2023-29778](https://insights.sbomify.com/CVE-2023-29778/): Command injection in gl-inet:gl-mt3000 firmware (critical 9.8)
- [CVE-2023-29774](https://insights.sbomify.com/CVE-2023-29774/): Cross-site scripting in iteachyou:dreamer cms (medium 5.4)
- [CVE-2023-29772](https://insights.sbomify.com/CVE-2023-29772/): Cross-site scripting in asus:rt-ac51u firmware (medium 5.2)
- [CVE-2023-29770](https://insights.sbomify.com/CVE-2023-29770/): File upload in sapplica:sentrifugo (high 8.8)
- [CVE-2023-2977](https://insights.sbomify.com/CVE-2023-2977/): Memory corruption in OpenSC (high 7.1)
- [CVE-2023-29767](https://insights.sbomify.com/CVE-2023-29767/): Denial of service in appcrossx:crossx (medium 5.5)
- [CVE-2023-29766](https://insights.sbomify.com/CVE-2023-29766/): Privilege escalation in appcrossx:crossx (high 7.8)
- [CVE-2023-29761](https://insights.sbomify.com/CVE-2023-29761/): Missing authorization in urbanandroid:sleep (medium 5.5)
- [CVE-2023-2976](https://insights.sbomify.com/CVE-2023-2976/): Use of temporary directory for file creation in `FileBackedOutputStream` in Guava (medium 5.5)
- [CVE-2023-29759](https://insights.sbomify.com/CVE-2023-29759/): Missing authorization in flightaware:flightaware (medium 5.5)
- [CVE-2023-29758](https://insights.sbomify.com/CVE-2023-29758/): Missing authorization in leap:blue light filter (medium 5.5)
- [CVE-2023-29757](https://insights.sbomify.com/CVE-2023-29757/): Privilege escalation in leap:blue light filter (high 7.8)
- [CVE-2023-29756](https://insights.sbomify.com/CVE-2023-29756/): Denial of service in urbanandroid:twilight (medium 5.5)
- [CVE-2023-29755](https://insights.sbomify.com/CVE-2023-29755/): Privilege escalation in urbanandroid:twilight (high 7.8)
- [CVE-2023-29753](https://insights.sbomify.com/CVE-2023-29753/): Denial of service in ekatox:facemoji\ (medium 5.5)
- [CVE-2023-29752](https://insights.sbomify.com/CVE-2023-29752/): Privilege escalation in ekatox:facemoji emoji keyboard (high 7.8)
- [CVE-2023-29751](https://insights.sbomify.com/CVE-2023-29751/): Denial of service in yandex:navigator (medium 5.5)
- [CVE-2023-2975](https://insights.sbomify.com/CVE-2023-2975/): AES-SIV implementation ignores empty associated data entries (medium 5.3)
- [CVE-2023-29749](https://insights.sbomify.com/CVE-2023-29749/): Privilege escalation in yandex:navigator (high 7.8)
- [CVE-2023-29748](https://insights.sbomify.com/CVE-2023-29748/): Missing authorization in story saver for instagram - video downloader project:story saver for instagram - video downloader (high 7.5)
- [CVE-2023-29747](https://insights.sbomify.com/CVE-2023-29747/): Missing authorization in story saver for instagram - video downloader project:story saver for instagram - video downloader (critical 9.8)
- [CVE-2023-29746](https://insights.sbomify.com/CVE-2023-29746/): Missing authorization in thethaiger:the thaiger (critical 9.8)
- [CVE-2023-29745](https://insights.sbomify.com/CVE-2023-29745/): Denial of service in bestweather project:bestweather (high 7.1)
- [CVE-2023-29743](https://insights.sbomify.com/CVE-2023-29743/): Denial of service in bestweather project:bestweather (high 7.5)
- [CVE-2023-29742](https://insights.sbomify.com/CVE-2023-29742/): Code injection in bestweather project:bestweather (high 7.8)
- [CVE-2023-29741](https://insights.sbomify.com/CVE-2023-29741/): Privilege escalation in bestweather project:bestweather (critical 9.8)
- [CVE-2023-29740](https://insights.sbomify.com/CVE-2023-29740/): Missing authorization in amdroidapp:alarm clock for heavy sleepers (high 7.5)
- [CVE-2023-2974](https://insights.sbomify.com/CVE-2023-2974/): quarkus-core vulnerable to client driven TLS cipher downgrading (medium 6.5)
- [CVE-2023-29739](https://insights.sbomify.com/CVE-2023-29739/): Privilege escalation in amdroidapp:alarm clock for heavy sleepers (critical 9.8)
- [CVE-2023-29738](https://insights.sbomify.com/CVE-2023-29738/): Privilege escalation in wavekeyboard:wave animated keyboard emoji (high 7.8)
- [CVE-2023-29737](https://insights.sbomify.com/CVE-2023-29737/): Denial of service in wavekeyboard:wave animated keyboard emoji (medium 5.5)
- [CVE-2023-29736](https://insights.sbomify.com/CVE-2023-29736/): Path traversal in timmystudios:keyboard themes (critical 9.8)
- [CVE-2023-29735](https://insights.sbomify.com/CVE-2023-29735/): Denial of service in mwm:edjing mix (medium 5.5)
- [CVE-2023-29734](https://insights.sbomify.com/CVE-2023-29734/): Privilege escalation in mwm:edjing mix (critical 9.8)
- [CVE-2023-29733](https://insights.sbomify.com/CVE-2023-29733/): Missing authorization in dualspace:lock master (high 7.8)
- [CVE-2023-29732](https://insights.sbomify.com/CVE-2023-29732/): Missing authorization in loka:solive (critical 9.8)
- [CVE-2023-29731](https://insights.sbomify.com/CVE-2023-29731/): Missing authorization in loka:solive (high 7.5)
- [CVE-2023-2973](https://insights.sbomify.com/CVE-2023-2973/): SourceCodester Students Online Internship Timesheet Syste cross site scripting (low 2.4)
- [CVE-2023-29728](https://insights.sbomify.com/CVE-2023-29728/): Privilege escalation in applika:call blocker (critical 9.8)
- [CVE-2023-29727](https://insights.sbomify.com/CVE-2023-29727/): Missing authorization in applika:call blocker (critical 9.8)
- [CVE-2023-29726](https://insights.sbomify.com/CVE-2023-29726/): Denial of service in applika:call blocker (high 7.5)
- [CVE-2023-29725](https://insights.sbomify.com/CVE-2023-29725/): Missing authorization in bt21 x bts wallpaper project:bt21 x bts wallpaper (medium 5.5)
- [CVE-2023-29724](https://insights.sbomify.com/CVE-2023-29724/): Missing authorization in bt21 x bts wallpaper project:bt21 x bts wallpaper (high 7.8)
- [CVE-2023-29723](https://insights.sbomify.com/CVE-2023-29723/): Missing authorization in glitter unicorn wallpaper project:glitter unicorn wallpaper (high 7.5)
- [CVE-2023-29722](https://insights.sbomify.com/CVE-2023-29722/): Missing authorization in glitter unicorn wallpaper project:glitter unicorn wallpaper (critical 9.1)
- [CVE-2023-29721](https://insights.sbomify.com/CVE-2023-29721/): File upload in sofawiki project:sofawiki (critical 9.8)
- [CVE-2023-29720](https://insights.sbomify.com/CVE-2023-29720/): Cross-site scripting in sofawiki project:sofawiki (medium 6.1)
- [CVE-2023-2972](https://insights.sbomify.com/CVE-2023-2972/): Prototype Pollution in antfu/utils (medium 5.4)
- [CVE-2023-29714](https://insights.sbomify.com/CVE-2023-29714/): Cross-site scripting in vadesecure:secure gateway (medium 6.1)
- [CVE-2023-29713](https://insights.sbomify.com/CVE-2023-29713/): Cross-site scripting in vadesecure:secure gateway (medium 6.1)
- [CVE-2023-29712](https://insights.sbomify.com/CVE-2023-29712/): Cross-site scripting in vadesecure:secure gateway (medium 6.1)
- [CVE-2023-29711](https://insights.sbomify.com/CVE-2023-29711/): Auth bypass in interlink:psg-5124 firmware (critical 9.8)
- [CVE-2023-2971](https://insights.sbomify.com/CVE-2023-2971/): Typora Local File Disclosure (medium 6.3)
- [CVE-2023-29709](https://insights.sbomify.com/CVE-2023-29709/): Auth bypass in wildix:wsg24poe firmware (high 7.5)
- [CVE-2023-29708](https://insights.sbomify.com/CVE-2023-29708/): Missing authorization in wavlink:wavrouter app (high 7.5)
- [CVE-2023-29707](https://insights.sbomify.com/CVE-2023-29707/): Cross-site scripting in gbcom:lac web control center (medium 4.8)
- [CVE-2023-2970](https://insights.sbomify.com/CVE-2023-2970/): MindSpore json_helper.cc UpdateArray memory corruption (low 3.5)
- [CVE-2023-29696](https://insights.sbomify.com/CVE-2023-29696/): Memory corruption in h3c:gr-1200w firmware (critical 9.8)
- [CVE-2023-29693](https://insights.sbomify.com/CVE-2023-29693/): Memory corruption in h3c:gr-1200w firmware (critical 9.8)
- [CVE-2023-29689](https://insights.sbomify.com/CVE-2023-29689/): PyroCMS remote code execution vulnerability (critical 9.8)
- [CVE-2023-29681](https://insights.sbomify.com/CVE-2023-29681/): Information disclosure in tenda:n301 firmware (medium 5.7)
- [CVE-2023-29680](https://insights.sbomify.com/CVE-2023-29680/): Information disclosure in tenda:n301 firmware (medium 5.7)
- [CVE-2023-2968](https://insights.sbomify.com/CVE-2023-2968/): Undefined variable usage in npm package "proxy" leads to remote denial of service (high 7.5)
- [CVE-2023-2967](https://insights.sbomify.com/CVE-2023-2967/): TinyMCE Custom Styles < 1.1.4 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2023-29665](https://insights.sbomify.com/CVE-2023-29665/): Memory corruption in dlink:dir-823g firmware (critical 9.8)
- [CVE-2023-29659](https://insights.sbomify.com/CVE-2023-29659/): libheif vulnerable to segmentation fault via floating point exception (medium 6.5)
- [CVE-2023-29657](https://insights.sbomify.com/CVE-2023-29657/): File upload in extplorer:extplorer (high 8.8)
- [CVE-2023-29656](https://insights.sbomify.com/CVE-2023-29656/): Missing authorization in darktrace:threat visualizer (medium 6.1)
- [CVE-2023-29643](https://insights.sbomify.com/CVE-2023-29643/): Cross-site scripting in perfree:perfreeblog (medium 5.4)
- [CVE-2023-29641](https://insights.sbomify.com/CVE-2023-29641/): editor.md vulnerable to Cross-site Scripting (medium 6.1)
- [CVE-2023-2964](https://insights.sbomify.com/CVE-2023-2964/): Simple Iframe < 1.2.0 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-29639](https://insights.sbomify.com/CVE-2023-29639/): Cross-site scripting in zhenfeng13:my blog (medium 5.4)
- [CVE-2023-29638](https://insights.sbomify.com/CVE-2023-29638/): Cross-site scripting in winterchen:my-site (medium 5.4)
- [CVE-2023-29637](https://insights.sbomify.com/CVE-2023-29637/): Cross-site scripting in qbian61 forum-java project:qbian61 forum-java (medium 6.1)
- [CVE-2023-29636](https://insights.sbomify.com/CVE-2023-29636/): Cross-site scripting in zhenfeng13:my blog (medium 5.4)
- [CVE-2023-29635](https://insights.sbomify.com/CVE-2023-29635/): File upload in antabot white-jotter project:antabot white-jotter (critical 9.8)
- [CVE-2023-29632](https://insights.sbomify.com/CVE-2023-29632/): SQL injection in joommasters:jmspagebuilder (critical 9.8)
- [CVE-2023-29631](https://insights.sbomify.com/CVE-2023-29631/): Missing authorization in joommasters:jms slider (critical 9.8)
- [CVE-2023-29630](https://insights.sbomify.com/CVE-2023-29630/): SQL injection in joommasters:jms drop mega menu (critical 9.8)
- [CVE-2023-2963](https://insights.sbomify.com/CVE-2023-2963/): SQLi in Oliva Expertise (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/329/