# Vulnerabilities published in 2023


- [CVE-2023-23144](https://insights.sbomify.com/CVE-2023-23144/): Integer overflow in gpac:gpac (medium 5.5)
- [CVE-2023-23143](https://insights.sbomify.com/CVE-2023-23143/): Memory corruption in gpac:gpac (high 7.8)
- [CVE-2023-2314](https://insights.sbomify.com/CVE-2023-2314/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2023-23136](https://insights.sbomify.com/CVE-2023-23136/): Path traversal in lmxcms:lmxcms (medium 6.5)
- [CVE-2023-23135](https://insights.sbomify.com/CVE-2023-23135/): File upload in ftdms project:ftdms (high 7.2)
- [CVE-2023-23132](https://insights.sbomify.com/CVE-2023-23132/): Hardcoded credentials in selfwealth:selfwealth (high 7.5)
- [CVE-2023-23131](https://insights.sbomify.com/CVE-2023-23131/): Weak cryptography in selfwealth:selfwealth (high 7.5)
- [CVE-2023-23130](https://insights.sbomify.com/CVE-2023-23130/): Weak cryptography in connectwise:automate (medium 5.9)
- [CVE-2023-2313](https://insights.sbomify.com/CVE-2023-2313/): Security feature bypass in Chrome (high 8.8)
- [CVE-2023-23128](https://insights.sbomify.com/CVE-2023-23128/): Misconfiguration in connectwise:connectwise (medium 6.1)
- [CVE-2023-23127](https://insights.sbomify.com/CVE-2023-23127/): Misconfiguration in connectwise:connectwise (medium 5.3)
- [CVE-2023-23126](https://insights.sbomify.com/CVE-2023-23126/): Other in connectwise:automate (medium 6.1)
- [CVE-2023-23120](https://insights.sbomify.com/CVE-2023-23120/): Weak cryptography in trendnet:tv-ip651wi firmware (medium 5.9)
- [CVE-2023-2312](https://insights.sbomify.com/CVE-2023-2312/): Use after free in Chrome (high 8.8)
- [CVE-2023-23119](https://insights.sbomify.com/CVE-2023-23119/): Weak cryptography in ui:af-2x firmware (medium 5.9)
- [CVE-2023-23110](https://insights.sbomify.com/CVE-2023-23110/): Security feature bypass in netgear:d6100 firmware (high 7.4)
- [CVE-2023-2311](https://insights.sbomify.com/CVE-2023-2311/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2023-23109](https://insights.sbomify.com/CVE-2023-23109/): Denial of service in crasm project:crasm (high 7.5)
- [CVE-2023-23108](https://insights.sbomify.com/CVE-2023-23108/): Null dereference in crasm project:crasm (high 7.5)
- [CVE-2023-2310](https://insights.sbomify.com/CVE-2023-2310/): Channel Accessible by Non-Endpoint (medium 6.8)
- [CVE-2023-2309](https://insights.sbomify.com/CVE-2023-2309/): wpForo Forum < 2.1.9 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-23088](https://insights.sbomify.com/CVE-2023-23088/): Memory corruption in json-parser project:json-parser (critical 9.8)
- [CVE-2023-23087](https://insights.sbomify.com/CVE-2023-23087/): Null dereference in mojojson project:mojojson (critical 9.8)
- [CVE-2023-23086](https://insights.sbomify.com/CVE-2023-23086/): Memory corruption in mojojson project:mojojson (critical 9.8)
- [CVE-2023-23082](https://insights.sbomify.com/CVE-2023-23082/): Memory corruption in kodi:kodi (medium 4.6)
- [CVE-2023-23080](https://insights.sbomify.com/CVE-2023-23080/): Command injection in tenda:cp3 firmware (critical 9.8)
- [CVE-2023-23078](https://insights.sbomify.com/CVE-2023-23078/): Cross-site scripting in zohocorp:manageengine servicedesk plus (medium 6.1)
- [CVE-2023-23077](https://insights.sbomify.com/CVE-2023-23077/): Cross-site scripting in zohocorp:manageengine servicedesk plus (medium 6.1)
- [CVE-2023-23076](https://insights.sbomify.com/CVE-2023-23076/): Command injection in zohocorp:manageengine supportcenter plus (critical 9.8)
- [CVE-2023-23075](https://insights.sbomify.com/CVE-2023-23075/): Cross-site scripting in zohocorp:manageengine assetexplorer (medium 6.1)
- [CVE-2023-23074](https://insights.sbomify.com/CVE-2023-23074/): Cross-site scripting in zohocorp:manageengine servicedesk plus (medium 6.1)
- [CVE-2023-23073](https://insights.sbomify.com/CVE-2023-23073/): Cross-site scripting in zohocorp:manageengine servicedesk plus (medium 6.1)
- [CVE-2023-2307](https://insights.sbomify.com/CVE-2023-2307/): Cross-Site Request Forgery (CSRF) in builderio/qwik (medium 4.7)
- [CVE-2023-23064](https://insights.sbomify.com/CVE-2023-23064/): Missing authorization in totolink:a720r firmware (critical 9.8)
- [CVE-2023-23063](https://insights.sbomify.com/CVE-2023-23063/): Path traversal in cellinx:nvt web server (high 7.5)
- [CVE-2023-2306](https://insights.sbomify.com/CVE-2023-2306/): Qognify NiceVision Use of Hard-coded Credentials (critical 10.0)
- [CVE-2023-23059](https://insights.sbomify.com/CVE-2023-23059/): Misconfiguration in geovision:gv-edge recording manager (critical 9.8)
- [CVE-2023-2305](https://insights.sbomify.com/CVE-2023-2305/): Download Manager <= 3.2.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-23040](https://insights.sbomify.com/CVE-2023-23040/): Weak cryptography in tp-link:tl-wr940n firmware (high 7.5)
- [CVE-2023-2304](https://insights.sbomify.com/CVE-2023-2304/): Favorites <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-23039](https://insights.sbomify.com/CVE-2023-23039/): Use after free in linux:linux kernel (medium 5.7)
- [CVE-2023-2303](https://insights.sbomify.com/CVE-2023-2303/): Contact Form and Calls To Action by vcita <= 4.10.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 6.1)
- [CVE-2023-23026](https://insights.sbomify.com/CVE-2023-23026/): Cross-site scripting in simple sales management system project:simple sales management system (medium 6.1)
- [CVE-2023-23024](https://insights.sbomify.com/CVE-2023-23024/): Cross-site scripting in book store management system project:book store management system (medium 6.1)
- [CVE-2023-23022](https://insights.sbomify.com/CVE-2023-23022/): Cross-site scripting in oretnom23:employees payroll management system (medium 6.1)
- [CVE-2023-23021](https://insights.sbomify.com/CVE-2023-23021/): Cross-site scripting in oretnom23:pos - point of sale system (medium 6.1)
- [CVE-2023-2302](https://insights.sbomify.com/CVE-2023-2302/): Contact Form and Calls To Action by vcita <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2023-23019](https://insights.sbomify.com/CVE-2023-23019/): Cross-site scripting in oretnom23:blog site (medium 5.4)
- [CVE-2023-23015](https://insights.sbomify.com/CVE-2023-23015/): Cross-site scripting in kalkun project:kalkun (medium 6.1)
- [CVE-2023-23014](https://insights.sbomify.com/CVE-2023-23014/): Cross-site scripting in inventory system project:inventory system (medium 6.1)
- [CVE-2023-23012](https://insights.sbomify.com/CVE-2023-23012/): Cross-site scripting in classroombookings:classroombookings (medium 6.1)
- [CVE-2023-23011](https://insights.sbomify.com/CVE-2023-23011/): Cross-site scripting in invoiceplane:invoiceplane (medium 6.1)
- [CVE-2023-23010](https://insights.sbomify.com/CVE-2023-23010/): Cross-site scripting in ecommerce-codeigniter-bootstrap project:ecommerce-codeigniter-bootstrap (medium 6.1)
- [CVE-2023-2301](https://insights.sbomify.com/CVE-2023-2301/): Contact Form Builder by vcita <= 4.10.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 6.1)
- [CVE-2023-23009](https://insights.sbomify.com/CVE-2023-23009/): Denial of service in debian:debian linux (medium 6.5)
- [CVE-2023-23007](https://insights.sbomify.com/CVE-2023-23007/): SQL injection in ecisp:espcms (high 7.2)
- [CVE-2023-23006](https://insights.sbomify.com/CVE-2023-23006/): Null dereference in linux:linux kernel (medium 5.5)
- [CVE-2023-23005](https://insights.sbomify.com/CVE-2023-23005/): Null dereference in linux:linux kernel (medium 5.5)
- [CVE-2023-23004](https://insights.sbomify.com/CVE-2023-23004/): Null dereference in linux:linux kernel (medium 5.5)
- [CVE-2023-23003](https://insights.sbomify.com/CVE-2023-23003/): Other in linux:linux kernel (medium 4.0)
- [CVE-2023-23002](https://insights.sbomify.com/CVE-2023-23002/): Null dereference in linux:linux kernel (medium 5.5)
- [CVE-2023-23001](https://insights.sbomify.com/CVE-2023-23001/): Null dereference in linux:linux kernel (medium 5.5)
- [CVE-2023-23000](https://insights.sbomify.com/CVE-2023-23000/): Null dereference in linux:linux kernel (medium 5.5)
- [CVE-2023-2300](https://insights.sbomify.com/CVE-2023-2300/): Contact Form Builder by vcita <= 4.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2023-22999](https://insights.sbomify.com/CVE-2023-22999/): Null dereference in linux:linux kernel (medium 5.5)
- [CVE-2023-22998](https://insights.sbomify.com/CVE-2023-22998/): Null dereference in linux:linux kernel (medium 5.5)
- [CVE-2023-22997](https://insights.sbomify.com/CVE-2023-22997/): Null dereference in linux:linux kernel (medium 5.5)
- [CVE-2023-22996](https://insights.sbomify.com/CVE-2023-22996/): Other in linux:linux kernel (medium 5.5)
- [CVE-2023-22995](https://insights.sbomify.com/CVE-2023-22995/): Other in linux:linux kernel (high 7.8)
- [CVE-2023-2299](https://insights.sbomify.com/CVE-2023-2299/): Online Booking & Scheduling Calendar for WordPress by vcita <= 4.4.2 - Missing Authorization on REST-API (medium 5.3)
- [CVE-2023-22985](https://insights.sbomify.com/CVE-2023-22985/): Cross-site scripting in simple guestbook management system project:simple guestbook management system (medium 6.1)
- [CVE-2023-22984](https://insights.sbomify.com/CVE-2023-22984/): Cross-site scripting in axis:207w firmware (medium 6.1)
- [CVE-2023-2298](https://insights.sbomify.com/CVE-2023-2298/): Online Booking & Scheduling Calendar for WordPress by vcita <= 4.3.0 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2023-22975](https://insights.sbomify.com/CVE-2023-22975/): Cross-site scripting in jflyfox:jfinal cms (medium 6.1)
- [CVE-2023-22974](https://insights.sbomify.com/CVE-2023-22974/): Path traversal in open-emr:openemr (high 7.5)
- [CVE-2023-22973](https://insights.sbomify.com/CVE-2023-22973/): Path traversal in open-emr:openemr (high 8.8)
- [CVE-2023-22972](https://insights.sbomify.com/CVE-2023-22972/): Cross-site scripting in open-emr:openemr (medium 5.4)
- [CVE-2023-22971](https://insights.sbomify.com/CVE-2023-22971/): Cross-site scripting in hughes:hn7000s firmware (medium 6.1)
- [CVE-2023-22970](https://insights.sbomify.com/CVE-2023-22970/): Deserialization in fedoraproject:fedora (high 7.8)
- [CVE-2023-2297](https://insights.sbomify.com/CVE-2023-2297/): Profile Builder – User Profile & User Registration Forms <= 3.9.0 - Insecure Password Reset Mechanism (critical 9.8)
- [CVE-2023-22964](https://insights.sbomify.com/CVE-2023-22964/): Auth bypass in zohocorp:manageengine servicedesk plus msp (critical 9.1)
- [CVE-2023-22963](https://insights.sbomify.com/CVE-2023-22963/): personnummer/dart vulnerable to Improper Input Validation (medium 5.3)
- [CVE-2023-22960](https://insights.sbomify.com/CVE-2023-22960/): Denial of service in lexmark:b2236 firmware (high 7.5)
- [CVE-2023-2296](https://insights.sbomify.com/CVE-2023-2296/): Loginizer 1.7.8 - Reflected XSS (medium 6.1)
- [CVE-2023-22959](https://insights.sbomify.com/CVE-2023-22959/): SQL injection in webchess project:webchess (high 8.8)
- [CVE-2023-22958](https://insights.sbomify.com/CVE-2023-22958/): Auth bypass in syracom:secure login (medium 6.1)
- [CVE-2023-22957](https://insights.sbomify.com/CVE-2023-22957/): Hardcoded credentials in audiocodes:405hd firmware (high 7.5)
- [CVE-2023-22956](https://insights.sbomify.com/CVE-2023-22956/): Hardcoded credentials in audiocodes:405hd firmware (high 7.5)
- [CVE-2023-22955](https://insights.sbomify.com/CVE-2023-22955/): Security feature bypass in audiocodes:405hd firmware (high 7.8)
- [CVE-2023-22953](https://insights.sbomify.com/CVE-2023-22953/): Code injection in expressionengine:expressionengine (high 8.8)
- [CVE-2023-22952](https://insights.sbomify.com/CVE-2023-22952/): Multiple SugarCRM Products Remote Code Execution (high 8.8, exploited in the wild)
- [CVE-2023-22951](https://insights.sbomify.com/CVE-2023-22951/): Hardcoded credentials in tigergraph:cloud (high 8.8)
- [CVE-2023-22950](https://insights.sbomify.com/CVE-2023-22950/): Information disclosure in tigergraph:tigergraph (medium 6.5)
- [CVE-2023-2295](https://insights.sbomify.com/CVE-2023-2295/): Denial of service in libreswan (high 7.5)
- [CVE-2023-22949](https://insights.sbomify.com/CVE-2023-22949/): Information disclosure in tigergraph:cloud (medium 4.9)
- [CVE-2023-22948](https://insights.sbomify.com/CVE-2023-22948/): Information disclosure in tigergraph:tigergraph (medium 4.9)
- [CVE-2023-22947](https://insights.sbomify.com/CVE-2023-22947/): Privilege escalation in shibboleth:service provider (high 7.3)
- [CVE-2023-22946](https://insights.sbomify.com/CVE-2023-22946/): Apache Spark proxy-user privilege escalation from malicious configuration class (medium 6.4)
- [CVE-2023-22945](https://insights.sbomify.com/CVE-2023-22945/): Missing authorization in fedoraproject:fedora (medium 4.3)
- [CVE-2023-22943](https://insights.sbomify.com/CVE-2023-22943/): Weak cryptography in Splunk Add-on Builder (medium 4.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/384/