# Vulnerabilities published in 2023


- [CVE-2023-25438](https://insights.sbomify.com/CVE-2023-25438/): Misconfiguration in genomedics:millegpg (high 7.8)
- [CVE-2023-25437](https://insights.sbomify.com/CVE-2023-25437/): Information disclosure in vtech:vcs754a firmware (high 8.8)
- [CVE-2023-25435](https://insights.sbomify.com/CVE-2023-25435/): Memory corruption in libtiff:libtiff (medium 5.5)
- [CVE-2023-25434](https://insights.sbomify.com/CVE-2023-25434/): Memory corruption in libtiff:libtiff (high 8.8)
- [CVE-2023-25433](https://insights.sbomify.com/CVE-2023-25433/): Memory corruption in libtiff:libtiff (medium 5.5)
- [CVE-2023-25432](https://insights.sbomify.com/CVE-2023-25432/): SQL injection in online reviewer management system project:online reviewer management system (high 7.2)
- [CVE-2023-25431](https://insights.sbomify.com/CVE-2023-25431/): Cross-site scripting in online reviewer management system project:online reviewer management system (medium 4.8)
- [CVE-2023-25428](https://insights.sbomify.com/CVE-2023-25428/): Other in soft-o:free password manager (high 7.8)
- [CVE-2023-25415](https://insights.sbomify.com/CVE-2023-25415/): Missing authorization in aten:pe8108 firmware (medium 5.3)
- [CVE-2023-25414](https://insights.sbomify.com/CVE-2023-25414/): Denial of service in aten:pe8108 firmware (medium 5.3)
- [CVE-2023-25413](https://insights.sbomify.com/CVE-2023-25413/): Information disclosure in aten:pe8108 firmware (high 7.5)
- [CVE-2023-25411](https://insights.sbomify.com/CVE-2023-25411/): Cross-site request forgery in aten:pe8108 firmware (medium 4.3)
- [CVE-2023-2541](https://insights.sbomify.com/CVE-2023-2541/): Sensitive information disclosure in KNIME Hub Web Application (medium 5.3)
- [CVE-2023-25409](https://insights.sbomify.com/CVE-2023-25409/): Missing authorization in aten:pe8108 firmware (high 8.1)
- [CVE-2023-25407](https://insights.sbomify.com/CVE-2023-25407/): Information disclosure in aten:pe8108 firmware (high 7.2)
- [CVE-2023-25403](https://insights.sbomify.com/CVE-2023-25403/): Auth bypass in yf-exam project:yf-exam (high 7.5)
- [CVE-2023-25402](https://insights.sbomify.com/CVE-2023-25402/): File upload in yf-exam project:yf-exam (high 7.5)
- [CVE-2023-25399](https://insights.sbomify.com/CVE-2023-25399/): Withdrawn: scipy memory leak vulnerability (medium 5.5)
- [CVE-2023-25396](https://insights.sbomify.com/CVE-2023-25396/): Privilege escalation in caphyon:advanced installer (high 7.8)
- [CVE-2023-25395](https://insights.sbomify.com/CVE-2023-25395/): Command injection in totolink:a7100ru firmware (critical 9.8)
- [CVE-2023-25394](https://insights.sbomify.com/CVE-2023-25394/): Race condition in getvideostream:videostream (high 7.0)
- [CVE-2023-25392](https://insights.sbomify.com/CVE-2023-25392/): Allegro Tech BigFlow vulnerable to Missing SSL Certificate Validation (medium 5.9)
- [CVE-2023-2538](https://insights.sbomify.com/CVE-2023-2538/): TLS Private Key Accessible to External Parties (medium 5.8)
- [CVE-2023-25369](https://insights.sbomify.com/CVE-2023-25369/): Denial of service in siglent:sds1074x-e firmware (high 7.5)
- [CVE-2023-25368](https://insights.sbomify.com/CVE-2023-25368/): Missing authorization in siglent:sds1074x-e firmware (high 7.5)
- [CVE-2023-25367](https://insights.sbomify.com/CVE-2023-25367/): Command injection in siglent:sds1074x-e firmware (critical 9.8)
- [CVE-2023-25366](https://insights.sbomify.com/CVE-2023-25366/): Information disclosure in siglent:sds 1104x-e firmware (critical 9.8)
- [CVE-2023-25365](https://insights.sbomify.com/CVE-2023-25365/): October CMS Cross-site Scripting vulnerability (high 7.8)
- [CVE-2023-25364](https://insights.sbomify.com/CVE-2023-25364/): Opswat Metadefender Core before 5.2.1 does not properly defend against potential HTML injection and XSS attacks. (medium 6.1)
- [CVE-2023-25363](https://insights.sbomify.com/CVE-2023-25363/): Use after free in webkitgtk:webkitgtk (high 8.8)
- [CVE-2023-25362](https://insights.sbomify.com/CVE-2023-25362/): Use after free in webkitgtk:webkitgtk (high 8.8)
- [CVE-2023-25361](https://insights.sbomify.com/CVE-2023-25361/): Use after free in webkitgtk:webkitgtk (high 8.8)
- [CVE-2023-25360](https://insights.sbomify.com/CVE-2023-25360/): Use after free in webkitgtk:webkitgtk (high 8.8)
- [CVE-2023-25358](https://insights.sbomify.com/CVE-2023-25358/): Use after free in fedoraproject:fedora (high 8.8)
- [CVE-2023-25356](https://insights.sbomify.com/CVE-2023-25356/): Command injection in coredial:sipxcom (high 8.8)
- [CVE-2023-25355](https://insights.sbomify.com/CVE-2023-25355/): Privilege escalation in coredial:sipxcom (high 8.8)
- [CVE-2023-25350](https://insights.sbomify.com/CVE-2023-25350/): SQL injection in ladybirdweb:faveo helpdesk (high 8.8)
- [CVE-2023-25348](https://insights.sbomify.com/CVE-2023-25348/): Code injection in churchcrm:churchcrm (high 7.8)
- [CVE-2023-25347](https://insights.sbomify.com/CVE-2023-25347/): Cross-site scripting in churchcrm:churchcrm (medium 5.4)
- [CVE-2023-25346](https://insights.sbomify.com/CVE-2023-25346/): Cross-site scripting in churchcrm:churchcrm (medium 6.1)
- [CVE-2023-25345](https://insights.sbomify.com/CVE-2023-25345/): Arbitrary local file read vulnerability during template rendering (high 7.5)
- [CVE-2023-25344](https://insights.sbomify.com/CVE-2023-25344/): Code injection in swig-templates project:swig-templates (critical 9.8)
- [CVE-2023-25341](https://insights.sbomify.com/CVE-2023-25341/): A Directory Traversal vulnerability in ladle dev server 2.5.1 and earlier allows an attacker on the same network to read files accessible to (medium 6.5)
- [CVE-2023-2534](https://insights.sbomify.com/CVE-2023-2534/): Information disclouse and DoS via websocket push events (high 7.6)
- [CVE-2023-25330](https://insights.sbomify.com/CVE-2023-25330/): MyBatis-Plus vulnerable to SQL injection via TenantPlugin (critical 9.8)
- [CVE-2023-2533](https://insights.sbomify.com/CVE-2023-2533/): PaperCut NG/MF Cross-Site Request Forgery (CSRF) (high 8.4, exploited in the wild)
- [CVE-2023-25314](https://insights.sbomify.com/CVE-2023-25314/): Cross-site scripting in wwbn:avideo (medium 6.1)
- [CVE-2023-25313](https://insights.sbomify.com/CVE-2023-25313/): AVideo contains Command injection when embedding a video link (critical 9.8)
- [CVE-2023-2531](https://insights.sbomify.com/CVE-2023-2531/): Improper Restriction of Excessive Authentication Attempts in azuracast/azuracast (high 7.3)
- [CVE-2023-25309](https://insights.sbomify.com/CVE-2023-25309/): Cross Site Scripting (XSS) Vulnerability in Fetlife rollout-ui gem (medium 6.1)
- [CVE-2023-25307](https://insights.sbomify.com/CVE-2023-25307/): mrpack-install vulnerable to path traversal with dependency (high 7.8)
- [CVE-2023-25306](https://insights.sbomify.com/CVE-2023-25306/): Path traversal in multimc:multimc (high 7.5)
- [CVE-2023-25305](https://insights.sbomify.com/CVE-2023-25305/): Path traversal in polymc:polymc (high 7.1)
- [CVE-2023-25304](https://insights.sbomify.com/CVE-2023-25304/): Path traversal in prismlauncher:prism launcher (high 7.8)
- [CVE-2023-25303](https://insights.sbomify.com/CVE-2023-25303/): Path traversal in atlauncher:atlauncher (high 7.1)
- [CVE-2023-2530](https://insights.sbomify.com/CVE-2023-2530/): Privilege escalation in Puppet Enterprise (critical 9.8)
- [CVE-2023-25295](https://insights.sbomify.com/CVE-2023-25295/): Cross-site scripting in gruen:evewa3 (medium 6.1)
- [CVE-2023-25292](https://insights.sbomify.com/CVE-2023-25292/): Cross-site scripting in group-office:group office (medium 6.1)
- [CVE-2023-2529](https://insights.sbomify.com/CVE-2023-2529/): Enable SVG Uploads <= 2.1.5 - Author+ Stored XSS via SVG (medium 5.4)
- [CVE-2023-25289](https://insights.sbomify.com/CVE-2023-25289/): Path traversal in virtualreception:digital reciptie (high 7.5)
- [CVE-2023-25283](https://insights.sbomify.com/CVE-2023-25283/): Memory corruption in dlink:dir-820l firmware (high 7.5)
- [CVE-2023-25282](https://insights.sbomify.com/CVE-2023-25282/): Memory corruption in dlink:dir-820l firmware (medium 6.5)
- [CVE-2023-25281](https://insights.sbomify.com/CVE-2023-25281/): Memory corruption in dlink:dir-820l firmware (high 7.5)
- [CVE-2023-25280](https://insights.sbomify.com/CVE-2023-25280/): D-Link DIR-820 Router OS Command Injection (critical 9.8, exploited in the wild)
- [CVE-2023-2528](https://insights.sbomify.com/CVE-2023-2528/): Contact Form by Supsystic <= 1.7.24 - Cross-Site Request Forgery via AJAX action (medium 5.4)
- [CVE-2023-25279](https://insights.sbomify.com/CVE-2023-25279/): Command injection in dlink:dir-820l firmware (critical 9.8)
- [CVE-2023-2527](https://insights.sbomify.com/CVE-2023-2527/): Integration for Contact Form 7 and Zoho CRM, Bigin < 1.2.4 - Admin+ SQLi (medium 4.8)
- [CVE-2023-25267](https://insights.sbomify.com/CVE-2023-25267/): Memory corruption in gfi:kerio connect (high 8.8)
- [CVE-2023-25266](https://insights.sbomify.com/CVE-2023-25266/): Code injection in docmosis:tornado (high 8.8)
- [CVE-2023-25265](https://insights.sbomify.com/CVE-2023-25265/): Path traversal in docmosis:tornado (high 7.5)
- [CVE-2023-25264](https://insights.sbomify.com/CVE-2023-25264/): Auth bypass in docmosis:tornado (high 7.5)
- [CVE-2023-25263](https://insights.sbomify.com/CVE-2023-25263/): Hardcoded credentials in stimulsoft:designer (medium 5.5)
- [CVE-2023-25262](https://insights.sbomify.com/CVE-2023-25262/): Server-side request forgery in stimulsoft:designer (high 7.5)
- [CVE-2023-25261](https://insights.sbomify.com/CVE-2023-25261/): Code injection in stimulsoft:designer (critical 9.8)
- [CVE-2023-25260](https://insights.sbomify.com/CVE-2023-25260/): Path traversal in stimulsoft:designer (high 7.5)
- [CVE-2023-2526](https://insights.sbomify.com/CVE-2023-2526/): Easy Google Maps <= 1.11.7 - Cross-Site Request Forgery via AJAX action (medium 5.4)
- [CVE-2023-25241](https://insights.sbomify.com/CVE-2023-25241/): Cross-site scripting in bgerp:bgerp (medium 6.1)
- [CVE-2023-25240](https://insights.sbomify.com/CVE-2023-25240/): SameSite Attribute vulnerability in pimCore (high 8.8)
- [CVE-2023-2524](https://insights.sbomify.com/CVE-2023-2524/): Control iD RHiD direct request (medium 6.3)
- [CVE-2023-25235](https://insights.sbomify.com/CVE-2023-25235/): Memory corruption in tenda:ac500 firmware (high 7.5)
- [CVE-2023-25234](https://insights.sbomify.com/CVE-2023-25234/): Memory corruption in tenda:ac500 firmware (critical 9.8)
- [CVE-2023-25233](https://insights.sbomify.com/CVE-2023-25233/): Memory corruption in tenda:ac500 firmware (critical 9.8)
- [CVE-2023-25231](https://insights.sbomify.com/CVE-2023-25231/): Memory corruption in tenda:w30e firmware (critical 9.8)
- [CVE-2023-25230](https://insights.sbomify.com/CVE-2023-25230/): Server-side request forgery in loonflow project:loonflow (medium 4.9)
- [CVE-2023-2523](https://insights.sbomify.com/CVE-2023-2523/): Weaver E-Office unrestricted upload (high 7.3)
- [CVE-2023-25223](https://insights.sbomify.com/CVE-2023-25223/): SQL injection in crmeb:crmeb java (high 7.2)
- [CVE-2023-25222](https://insights.sbomify.com/CVE-2023-25222/): Memory corruption in gnu:libredwg (high 8.8)
- [CVE-2023-25221](https://insights.sbomify.com/CVE-2023-25221/): Memory corruption in debian:debian linux (high 7.8)
- [CVE-2023-25220](https://insights.sbomify.com/CVE-2023-25220/): Memory corruption in tenda:ac5 firmware (critical 9.8)
- [CVE-2023-2522](https://insights.sbomify.com/CVE-2023-2522/): Chengdu VEC40G Network Detection os command injection (medium 4.7)
- [CVE-2023-25219](https://insights.sbomify.com/CVE-2023-25219/): Memory corruption in tenda:ac5 firmware (critical 9.8)
- [CVE-2023-25218](https://insights.sbomify.com/CVE-2023-25218/): Memory corruption in tenda:ac5 firmware (critical 9.8)
- [CVE-2023-25217](https://insights.sbomify.com/CVE-2023-25217/): Memory corruption in tenda:ac5 firmware (critical 9.8)
- [CVE-2023-25216](https://insights.sbomify.com/CVE-2023-25216/): Memory corruption in tenda:ac5 firmware (critical 9.8)
- [CVE-2023-25215](https://insights.sbomify.com/CVE-2023-25215/): Memory corruption in tenda:ac5 firmware (critical 9.8)
- [CVE-2023-25214](https://insights.sbomify.com/CVE-2023-25214/): Memory corruption in tenda:ac5 firmware (critical 9.8)
- [CVE-2023-25213](https://insights.sbomify.com/CVE-2023-25213/): Memory corruption in tenda:ac5 firmware (critical 9.8)
- [CVE-2023-25212](https://insights.sbomify.com/CVE-2023-25212/): Memory corruption in tenda:ac5 firmware (critical 9.8)
- [CVE-2023-25211](https://insights.sbomify.com/CVE-2023-25211/): Memory corruption in tenda:ac5 firmware (critical 9.8)
- [CVE-2023-25210](https://insights.sbomify.com/CVE-2023-25210/): Memory corruption in tenda:ac5 firmware (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/366/