# Vulnerabilities published in 2023


- [CVE-2023-29629](https://insights.sbomify.com/CVE-2023-29629/): SQL injection in jmsthemelayout project:jmsthemelayout (critical 9.8)
- [CVE-2023-29627](https://insights.sbomify.com/CVE-2023-29627/): File upload in online pizza ordering project:online pizza ordering (high 8.8)
- [CVE-2023-29626](https://insights.sbomify.com/CVE-2023-29626/): SQL injection in yoga class registration system project:yoga class registration system (high 7.5)
- [CVE-2023-29625](https://insights.sbomify.com/CVE-2023-29625/): File upload in employee performance evaluation system project:employee performance evaluation system (high 8.8)
- [CVE-2023-29623](https://insights.sbomify.com/CVE-2023-29623/): Cross-site scripting in purchase order management project:purchase order management (medium 6.1)
- [CVE-2023-29622](https://insights.sbomify.com/CVE-2023-29622/): SQL injection in purchase order management project:purchase order management (critical 9.8)
- [CVE-2023-29621](https://insights.sbomify.com/CVE-2023-29621/): File upload in purchase order management project:purchase order management (high 8.8)
- [CVE-2023-2962](https://insights.sbomify.com/CVE-2023-2962/): SourceCodester Faculty Evaluation System sql injection (medium 4.7)
- [CVE-2023-2961](https://insights.sbomify.com/CVE-2023-2961/): Denial of service in advancecomp (low 3.3)
- [CVE-2023-2960](https://insights.sbomify.com/CVE-2023-2960/): XSS in Oliva Expertise (medium 6.1)
- [CVE-2023-29598](https://insights.sbomify.com/CVE-2023-29598/): SQL injection in lmxcms:lmxcms (critical 9.8)
- [CVE-2023-29597](https://insights.sbomify.com/CVE-2023-29597/): SQL injection in bloofox:bloofoxcms (high 8.8)
- [CVE-2023-29596](https://insights.sbomify.com/CVE-2023-29596/): Memory corruption in cmix project:cmix (high 7.8)
- [CVE-2023-2959](https://insights.sbomify.com/CVE-2023-2959/): Authentication Bypass by Primary Weakness in Oliva Expertise (high 7.5)
- [CVE-2023-29586](https://insights.sbomify.com/CVE-2023-29586/): Missing authorization in codesector:teracopy (medium 5.5)
- [CVE-2023-29584](https://insights.sbomify.com/CVE-2023-29584/): Memory corruption in mp4v2 project:mp4v2 (high 8.8)
- [CVE-2023-29583](https://insights.sbomify.com/CVE-2023-29583/): Memory corruption in yasm project:yasm (medium 6.2)
- [CVE-2023-29582](https://insights.sbomify.com/CVE-2023-29582/): Memory corruption in yasm project:yasm (medium 5.5)
- [CVE-2023-29581](https://insights.sbomify.com/CVE-2023-29581/): Memory corruption in yasm project:yasm (medium 5.5)
- [CVE-2023-29580](https://insights.sbomify.com/CVE-2023-29580/): Memory corruption in yasm project:yasm (medium 5.5)
- [CVE-2023-2958](https://insights.sbomify.com/CVE-2023-2958/): IDOR in ATS Pro (critical 9.8)
- [CVE-2023-29579](https://insights.sbomify.com/CVE-2023-29579/): Memory corruption in yasm project:yasm (medium 5.5)
- [CVE-2023-29578](https://insights.sbomify.com/CVE-2023-29578/): Memory corruption in mp4v2 project:mp4v2 (high 8.8)
- [CVE-2023-29576](https://insights.sbomify.com/CVE-2023-29576/): Memory corruption in axiosys:bento4 (medium 5.5)
- [CVE-2023-29575](https://insights.sbomify.com/CVE-2023-29575/): Denial of service in axiosys:bento4 (medium 5.5)
- [CVE-2023-29574](https://insights.sbomify.com/CVE-2023-29574/): Denial of service in axiosys:bento4 (medium 5.5)
- [CVE-2023-29573](https://insights.sbomify.com/CVE-2023-29573/): Denial of service in axiosys:bento4 (medium 5.5)
- [CVE-2023-29571](https://insights.sbomify.com/CVE-2023-29571/): Memory corruption in cesanta:mjs (medium 5.5)
- [CVE-2023-29570](https://insights.sbomify.com/CVE-2023-29570/): Null dereference in cesanta:mjs (medium 5.5)
- [CVE-2023-2957](https://insights.sbomify.com/CVE-2023-2957/): SQLi in Lisa Softwares Florist Site (critical 9.8)
- [CVE-2023-29569](https://insights.sbomify.com/CVE-2023-29569/): Null dereference in cesanta:mjs (medium 5.5)
- [CVE-2023-29566](https://insights.sbomify.com/CVE-2023-29566/): Remote code execution in dawnsparks-node-tesseract (critical 9.8)
- [CVE-2023-29562](https://insights.sbomify.com/CVE-2023-29562/): Memory corruption in tp-link:tl-wpa7510 firmware (critical 9.8)
- [CVE-2023-29552](https://insights.sbomify.com/CVE-2023-29552/): Service Location Protocol (SLP) Denial-of-Service (high 7.5, exploited in the wild)
- [CVE-2023-29551](https://insights.sbomify.com/CVE-2023-29551/): Memory corruption in Firefox (high 8.8)
- [CVE-2023-29550](https://insights.sbomify.com/CVE-2023-29550/): Memory corruption in Firefox (high 8.8)
- [CVE-2023-2955](https://insights.sbomify.com/CVE-2023-2955/): SourceCodester Students Online Internship Timesheet System GET Parameter rendered_report.php sql injection (medium 6.3)
- [CVE-2023-29549](https://insights.sbomify.com/CVE-2023-29549/): Security feature bypass in Firefox (medium 6.5)
- [CVE-2023-29548](https://insights.sbomify.com/CVE-2023-29548/): Memory corruption in Firefox (medium 6.5)
- [CVE-2023-29547](https://insights.sbomify.com/CVE-2023-29547/): Security feature bypass in Firefox (medium 6.5)
- [CVE-2023-29546](https://insights.sbomify.com/CVE-2023-29546/): Information disclosure in Firefox for Android (medium 6.5)
- [CVE-2023-29545](https://insights.sbomify.com/CVE-2023-29545/): Other in Firefox (medium 6.5)
- [CVE-2023-29544](https://insights.sbomify.com/CVE-2023-29544/): Memory corruption in Firefox (medium 6.5)
- [CVE-2023-29543](https://insights.sbomify.com/CVE-2023-29543/): Use after free in Firefox (high 8.8)
- [CVE-2023-29542](https://insights.sbomify.com/CVE-2023-29542/): Security feature bypass in Firefox (critical 9.8)
- [CVE-2023-29541](https://insights.sbomify.com/CVE-2023-29541/): Command injection in Firefox (high 8.8)
- [CVE-2023-29540](https://insights.sbomify.com/CVE-2023-29540/): Security feature bypass in Firefox (medium 6.1)
- [CVE-2023-2954](https://insights.sbomify.com/CVE-2023-2954/): Cross-site Scripting (XSS) - Stored in liangliangyy/djangoblog (medium 4.8)
- [CVE-2023-29539](https://insights.sbomify.com/CVE-2023-29539/): Other in Firefox (high 8.8)
- [CVE-2023-29538](https://insights.sbomify.com/CVE-2023-29538/): Information disclosure in Firefox (medium 4.3)
- [CVE-2023-29537](https://insights.sbomify.com/CVE-2023-29537/): Race condition in Firefox (high 7.5)
- [CVE-2023-29536](https://insights.sbomify.com/CVE-2023-29536/): Use after free in Firefox (high 8.8)
- [CVE-2023-29535](https://insights.sbomify.com/CVE-2023-29535/): Use after free in Firefox (medium 6.5)
- [CVE-2023-29534](https://insights.sbomify.com/CVE-2023-29534/): Other in Firefox for Android (critical 9.1)
- [CVE-2023-29533](https://insights.sbomify.com/CVE-2023-29533/): Security feature bypass in Firefox (medium 4.3)
- [CVE-2023-29532](https://insights.sbomify.com/CVE-2023-29532/): Race condition in Firefox (medium 5.5)
- [CVE-2023-29531](https://insights.sbomify.com/CVE-2023-29531/): Memory corruption in Firefox (critical 9.8)
- [CVE-2023-29530](https://insights.sbomify.com/CVE-2023-29530/): Laminas Diactoros vulnerable to HTTP Multiline Header Termination (high 7.5)
- [CVE-2023-2953](https://insights.sbomify.com/CVE-2023-2953/): Null dereference in openldap (high 7.5)
- [CVE-2023-29529](https://insights.sbomify.com/CVE-2023-29529/): matrix-js-sdk vulnerable to invisible eavesdropping in group calls (medium 5.0)
- [CVE-2023-29528](https://insights.sbomify.com/CVE-2023-29528/): Cross-site Scripting in org.xwiki.commons:xwiki-commons-xml (critical 9.1)
- [CVE-2023-29527](https://insights.sbomify.com/CVE-2023-29527/): Code injection from account through AWM view sheet in xwiki platform (critical 10.0)
- [CVE-2023-29526](https://insights.sbomify.com/CVE-2023-29526/): Async and display macro allow displaying and interacting with any document in restricted mode (critical 10.0)
- [CVE-2023-29525](https://insights.sbomify.com/CVE-2023-29525/): Privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platform (critical 10.0)
- [CVE-2023-29524](https://insights.sbomify.com/CVE-2023-29524/): Code injection from account through XWiki.SchedulerJobSheet in xwiki-platform (critical 10.0)
- [CVE-2023-29523](https://insights.sbomify.com/CVE-2023-29523/): Code injection in display method used in user profiles in xwiki-platform (critical 10.0)
- [CVE-2023-29522](https://insights.sbomify.com/CVE-2023-29522/): Code injection from view right on XWiki.ClassSheet in xwiki-platform (critical 9.9)
- [CVE-2023-29521](https://insights.sbomify.com/CVE-2023-29521/): Code injection from account/view through VFS Tree macro in xwiki-platform (high 8.4)
- [CVE-2023-29520](https://insights.sbomify.com/CVE-2023-29520/): Page render failure due to broken translations in xwiki-platform (medium 4.3)
- [CVE-2023-2952](https://insights.sbomify.com/CVE-2023-2952/): Denial of service in Wireshark (medium 5.3)
- [CVE-2023-29519](https://insights.sbomify.com/CVE-2023-29519/): Code injection in org.xwiki.platform:xwiki-platform-attachment-ui (critical 9.1)
- [CVE-2023-29518](https://insights.sbomify.com/CVE-2023-29518/): Code injection from view right using Invitation.InvitationCommon in xwiki-platform (critical 9.9)
- [CVE-2023-29517](https://insights.sbomify.com/CVE-2023-29517/): Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-office-viewer (high 7.5)
- [CVE-2023-29516](https://insights.sbomify.com/CVE-2023-29516/): Code injection from view right on XWiki.AttachmentSelector in xwiki-platform (critical 9.9)
- [CVE-2023-29515](https://insights.sbomify.com/CVE-2023-29515/): Cross-site scripting (XSS) in xwiki-platform (high 7.7)
- [CVE-2023-29514](https://insights.sbomify.com/CVE-2023-29514/): Code injection in template provider administration in xwiki-platform (critical 10.0)
- [CVE-2023-29513](https://insights.sbomify.com/CVE-2023-29513/): Users can be created even when registration is disabled without validation via the template macro in xwiki-platform (medium 5.0)
- [CVE-2023-29512](https://insights.sbomify.com/CVE-2023-29512/): Code injection in xwiki-platform-web-templates (critical 9.9)
- [CVE-2023-29511](https://insights.sbomify.com/CVE-2023-29511/): xwiki-platform-administration-ui vulnerable to privilege escalation (critical 9.9)
- [CVE-2023-29510](https://insights.sbomify.com/CVE-2023-29510/): Code injection via unescaped translations in xwiki-platform (critical 10.0)
- [CVE-2023-2951](https://insights.sbomify.com/CVE-2023-2951/): code-projects Bus Dispatch and Information System delete_bus.php sql injection (medium 6.3)
- [CVE-2023-29509](https://insights.sbomify.com/CVE-2023-29509/): org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability (critical 10.0)
- [CVE-2023-29508](https://insights.sbomify.com/CVE-2023-29508/): org.xwiki.platform:xwiki-platform-livedata-macro vulnerable to Cross-site Scripting (high 8.9)
- [CVE-2023-29507](https://insights.sbomify.com/CVE-2023-29507/): org.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthors (critical 9.1)
- [CVE-2023-29506](https://insights.sbomify.com/CVE-2023-29506/): org.xwiki.platform:xwiki-platform-security-authentication-default XSS with authenticated endpoints (medium 5.4)
- [CVE-2023-29505](https://insights.sbomify.com/CVE-2023-29505/): Cross-site request forgery in zohocorp:manageengine network configuration manager (medium 4.3)
- [CVE-2023-29504](https://insights.sbomify.com/CVE-2023-29504/): Privilege escalation in Intel(R) RealSense(TM) Dynamic Calibration software (medium 6.7)
- [CVE-2023-29503](https://insights.sbomify.com/CVE-2023-29503/): Memory corruption in Cscape (high 7.8)
- [CVE-2023-29502](https://insights.sbomify.com/CVE-2023-29502/): PTC Vuforia Studio Path Traversal (medium 6.2)
- [CVE-2023-29501](https://insights.sbomify.com/CVE-2023-29501/): Weak cryptography in Jiyu Kukan Toku-Toku coupon App for iOS, and Jiyu Kukan Toku-Toku coupon App for Android (medium 4.8)
- [CVE-2023-29500](https://insights.sbomify.com/CVE-2023-29500/): Information disclosure in Intel(R) NUCs (medium 5.3)
- [CVE-2023-2950](https://insights.sbomify.com/CVE-2023-2950/): Improper Authorization in openemr/openemr (medium 6.3)
- [CVE-2023-29499](https://insights.sbomify.com/CVE-2023-29499/): Gvariant offset table entry size is not checked in is_normal() (medium 5.5)
- [CVE-2023-29498](https://insights.sbomify.com/CVE-2023-29498/): XML external entity in FRENIC RHC Loader (medium 5.5)
- [CVE-2023-29497](https://insights.sbomify.com/CVE-2023-29497/): Information disclosure in macOS (low 3.3)
- [CVE-2023-29495](https://insights.sbomify.com/CVE-2023-29495/): Privilege escalation in Intel NUC BIOS firmware (high 7.5)
- [CVE-2023-29494](https://insights.sbomify.com/CVE-2023-29494/): Privilege escalation in Intel(R) NUCs (high 7.5)
- [CVE-2023-29492](https://insights.sbomify.com/CVE-2023-29492/): Novi Survey Insecure Deserialization (critical 9.8, exploited in the wild)
- [CVE-2023-29491](https://insights.sbomify.com/CVE-2023-29491/): Memory corruption in invisible-island:ncurses (high 7.8)
- [CVE-2023-2949](https://insights.sbomify.com/CVE-2023-2949/): Cross-site Scripting (XSS) - Reflected in openemr/openemr (high 8.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/330/