# Vulnerabilities published in 2023


- [CVE-2023-1722](https://insights.sbomify.com/CVE-2023-1722/): Yoga Class Registration System 1.0 - ATO (critical 9.1)
- [CVE-2023-1721](https://insights.sbomify.com/CVE-2023-1721/): Yoga Class Registration System 1.0 - RCE (critical 9.1)
- [CVE-2023-1720](https://insights.sbomify.com/CVE-2023-1720/): Bitrix24 Stored Cross-Site Scripting (XSS) via File Upload (critical 9.6)
- [CVE-2023-1719](https://insights.sbomify.com/CVE-2023-1719/): Bitrix24 Insecure Global Variable Extraction (high 7.5)
- [CVE-2023-1718](https://insights.sbomify.com/CVE-2023-1718/): Bitrix24 Denial-of-Service (DoS) via Improper File Stream Access (high 7.5)
- [CVE-2023-1717](https://insights.sbomify.com/CVE-2023-1717/): Bitrix24 Cross-Site Scripting (XSS) via Client-side Prototype Pollution (critical 9.6)
- [CVE-2023-1716](https://insights.sbomify.com/CVE-2023-1716/): Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (2 of 2) (critical 9.0)
- [CVE-2023-1715](https://insights.sbomify.com/CVE-2023-1715/): Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (1 of 2) (critical 9.0)
- [CVE-2023-1714](https://insights.sbomify.com/CVE-2023-1714/): Bitrix24 Remote Command Execution (RCE) via Unsafe Variable Extraction (high 8.8)
- [CVE-2023-1713](https://insights.sbomify.com/CVE-2023-1713/): Bitrix24 Remote Command Execution (RCE) via Insecure Temporary File Creation (high 8.8)
- [CVE-2023-1712](https://insights.sbomify.com/CVE-2023-1712/): Use of Hard-coded, Security-relevant Constants in deepset-ai/haystack (critical 9.1)
- [CVE-2023-1711](https://insights.sbomify.com/CVE-2023-1711/): Information disclosure in FOXMAN-UN (medium 4.0)
- [CVE-2023-1710](https://insights.sbomify.com/CVE-2023-1710/): Information disclosure in GitLab (medium 5.3)
- [CVE-2023-1709](https://insights.sbomify.com/CVE-2023-1709/): Datalogics Library APDFL Stack-based Buffer Overflow (high 7.8)
- [CVE-2023-1708](https://insights.sbomify.com/CVE-2023-1708/): Command injection in GitLab (medium 5.7)
- [CVE-2023-1707](https://insights.sbomify.com/CVE-2023-1707/): Information disclosure in HP Enterprise LaserJet and HP LaserJet Managed Printers (high 7.5)
- [CVE-2023-1705](https://insights.sbomify.com/CVE-2023-1705/): Missing authorization in F|One SmartEdge Agent (high 8.4)
- [CVE-2023-1704](https://insights.sbomify.com/CVE-2023-1704/): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (medium 5.1)
- [CVE-2023-1703](https://insights.sbomify.com/CVE-2023-1703/): Cross-site Scripting (XSS) - Generic in pimcore/pimcore (medium 5.3)
- [CVE-2023-1702](https://insights.sbomify.com/CVE-2023-1702/): Cross-site Scripting (XSS) - Generic in pimcore/pimcore (medium 4.0)
- [CVE-2023-1701](https://insights.sbomify.com/CVE-2023-1701/): Cross-site Scripting (XSS) - Reflected in pimcore/pimcore (medium 4.0)
- [CVE-2023-1699](https://insights.sbomify.com/CVE-2023-1699/): Rapid7 Nexpose Forced Browsing (medium 4.3)
- [CVE-2023-1698](https://insights.sbomify.com/CVE-2023-1698/): WAGO: WBM Command Injection in multiple products (critical 9.8)
- [CVE-2023-1697](https://insights.sbomify.com/CVE-2023-1697/): Junos OS: QFX10000 Series, PTX1000 Series: The dcpfe process will crash when a malformed ethernet frame is received (medium 6.5)
- [CVE-2023-1696](https://insights.sbomify.com/CVE-2023-1696/): Other in EMUI (high 7.5)
- [CVE-2023-1695](https://insights.sbomify.com/CVE-2023-1695/): Other in EMUI (high 7.5)
- [CVE-2023-1694](https://insights.sbomify.com/CVE-2023-1694/): Privilege escalation in EMUI (high 7.5)
- [CVE-2023-1693](https://insights.sbomify.com/CVE-2023-1693/): Privilege escalation in EMUI (high 7.5)
- [CVE-2023-1692](https://insights.sbomify.com/CVE-2023-1692/): Missing authorization in EMUI (high 7.5)
- [CVE-2023-1691](https://insights.sbomify.com/CVE-2023-1691/): Other in EMUI (high 7.5)
- [CVE-2023-1690](https://insights.sbomify.com/CVE-2023-1690/): SourceCodester Earnings and Expense Tracker App cross site scripting (low 3.5)
- [CVE-2023-1689](https://insights.sbomify.com/CVE-2023-1689/): SourceCodester Earnings and Expense Tracker App cross site scripting (low 3.5)
- [CVE-2023-1688](https://insights.sbomify.com/CVE-2023-1688/): SourceCodester Earnings and Expense Tracker App cross site scripting (low 3.5)
- [CVE-2023-1687](https://insights.sbomify.com/CVE-2023-1687/): SourceCodester Simple Task Allocation System cross site scripting (low 3.5)
- [CVE-2023-1686](https://insights.sbomify.com/CVE-2023-1686/): SourceCodester Young Entrepreneur E-Negosyo System GET Parameter index.php cross site scripting (low 3.5)
- [CVE-2023-1685](https://insights.sbomify.com/CVE-2023-1685/): HadSky Installation Interface index.php command injection (medium 6.3)
- [CVE-2023-1684](https://insights.sbomify.com/CVE-2023-1684/): HadSky unrestricted upload (medium 4.7)
- [CVE-2023-1683](https://insights.sbomify.com/CVE-2023-1683/): Xunrui CMS system_log.html information disclosure (medium 4.3)
- [CVE-2023-1682](https://insights.sbomify.com/CVE-2023-1682/): Xunrui CMS Install.txt direct request (medium 4.3)
- [CVE-2023-1681](https://insights.sbomify.com/CVE-2023-1681/): Xunrui CMS test.php information disclosure (medium 4.3)
- [CVE-2023-1680](https://insights.sbomify.com/CVE-2023-1680/): Xunrui CMS main.html information disclosure (medium 4.3)
- [CVE-2023-1679](https://insights.sbomify.com/CVE-2023-1679/): DriverGenius IOCTL mydrivers64.sys 0x9C40A108 memory corruption (medium 5.3)
- [CVE-2023-1678](https://insights.sbomify.com/CVE-2023-1678/): DriverGenius IOCTL mydrivers64.sys 0x9C40A0E0 memory corruption (medium 5.3)
- [CVE-2023-1677](https://insights.sbomify.com/CVE-2023-1677/): DriverGenius IOCTL mydrivers64.sys 0x9c402084 denial of service (medium 5.5)
- [CVE-2023-1676](https://insights.sbomify.com/CVE-2023-1676/): DriverGenius IOCTL mydrivers64.sys 0x9C402088 memory corruption (high 7.8)
- [CVE-2023-1675](https://insights.sbomify.com/CVE-2023-1675/): SourceCodester School Registration and Fee System GET Parameter edit_stud.php sql injection (medium 6.3)
- [CVE-2023-1674](https://insights.sbomify.com/CVE-2023-1674/): SourceCodester School Registration and Fee System POST Parameter login.php sql injection (high 7.3)
- [CVE-2023-1672](https://insights.sbomify.com/CVE-2023-1672/): Race condition exists in the key generation and rotation functionality (medium 5.3)
- [CVE-2023-1671](https://insights.sbomify.com/CVE-2023-1671/): Sophos Web Appliance Command Injection (critical 9.8, exploited in the wild)
- [CVE-2023-1670](https://insights.sbomify.com/CVE-2023-1670/): Use after free in Kernel (high 7.8)
- [CVE-2023-1669](https://insights.sbomify.com/CVE-2023-1669/): SEOPress < 6.5.0.3 - Admin+ PHP Object Injection (high 7.2)
- [CVE-2023-1668](https://insights.sbomify.com/CVE-2023-1668/): Security feature bypass in openvswitch (high 8.2)
- [CVE-2023-1667](https://insights.sbomify.com/CVE-2023-1667/): Null dereference in libssh (medium 6.5)
- [CVE-2023-1666](https://insights.sbomify.com/CVE-2023-1666/): SourceCodester Automatic Question Paper Generator System GET Parameter view_class.php sql injection (medium 6.3)
- [CVE-2023-1665](https://insights.sbomify.com/CVE-2023-1665/): Improper Restriction of Excessive Authentication Attempts in linagora/twake (high 7.8)
- [CVE-2023-1664](https://insights.sbomify.com/CVE-2023-1664/): Keycloak Untrusted Certificate Validation vulnerability (medium 6.5)
- [CVE-2023-1663](https://insights.sbomify.com/CVE-2023-1663/): Authenticated Resources Accessible via Forced Browsing (medium 6.5)
- [CVE-2023-1661](https://insights.sbomify.com/CVE-2023-1661/): Cross-site scripting in Display post meta, term meta, comment meta, and user meta (medium 6.4)
- [CVE-2023-1660](https://insights.sbomify.com/CVE-2023-1660/): ChatBot < 4.4.9 - Unauthenticated Stored XSS (medium 6.1)
- [CVE-2023-1656](https://insights.sbomify.com/CVE-2023-1656/): Information disclosure in OpenIDM and Java Remote Connector Server (RCS) (high 7.5)
- [CVE-2023-1655](https://insights.sbomify.com/CVE-2023-1655/): Heap-based Buffer Overflow in gpac/gpac (high 7.8)
- [CVE-2023-1654](https://insights.sbomify.com/CVE-2023-1654/): Denial of Service in gpac/gpac (medium 4.8)
- [CVE-2023-1652](https://insights.sbomify.com/CVE-2023-1652/): Use after free in Linux Kernel (high 7.1)
- [CVE-2023-1651](https://insights.sbomify.com/CVE-2023-1651/): ChatBot < 4.4.9 - Subscriber+ OpenAI Settings Update to Stored XSS (medium 5.4)
- [CVE-2023-1650](https://insights.sbomify.com/CVE-2023-1650/): ChatBot < 4.4.7 - Unauthenticated PHP Object Injection (critical 9.8)
- [CVE-2023-1649](https://insights.sbomify.com/CVE-2023-1649/): ChatBot < 4.5.1 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-1647](https://insights.sbomify.com/CVE-2023-1647/): Improper Access Control in calcom/cal.com (high 8.8)
- [CVE-2023-1646](https://insights.sbomify.com/CVE-2023-1646/): IObit Malware Fighter IOCTL IMFCameraProtect.sys 0x8018E004 stack-based overflow (medium 5.3)
- [CVE-2023-1645](https://insights.sbomify.com/CVE-2023-1645/): IObit Malware Fighter IOCTL IMFCameraProtect.sys 0x8018E008 denial of service (medium 5.5)
- [CVE-2023-1644](https://insights.sbomify.com/CVE-2023-1644/): IObit Malware Fighter IOCTL IMFCameraProtect.sys 0x8018E010 denial of service (medium 5.5)
- [CVE-2023-1643](https://insights.sbomify.com/CVE-2023-1643/): IObit Malware Fighter IOCTL ImfHpRegFilter.sys 0x8001E040 denial of service (medium 5.5)
- [CVE-2023-1642](https://insights.sbomify.com/CVE-2023-1642/): IObit Malware Fighter IOCTL ObCallbackProcess.sys 0x222040 denial of service (medium 5.5)
- [CVE-2023-1641](https://insights.sbomify.com/CVE-2023-1641/): IObit Malware Fighter IOCTL ObCallbackProcess.sys 0x222018 denial of service (medium 5.5)
- [CVE-2023-1640](https://insights.sbomify.com/CVE-2023-1640/): IObit Malware Fighter IOCTL ObCallbackProcess.sys 0x222010 denial of service (medium 5.5)
- [CVE-2023-1639](https://insights.sbomify.com/CVE-2023-1639/): IObit Malware Fighter IOCTL ImfRegistryFilter.sys 0x8001E04C denial of service (medium 5.5)
- [CVE-2023-1638](https://insights.sbomify.com/CVE-2023-1638/): IObit Malware Fighter IOCTL ImfRegistryFilter.sys 0x8001E040 denial of service (medium 5.5)
- [CVE-2023-1637](https://insights.sbomify.com/CVE-2023-1637/): Information disclosure in Kernel (medium 5.5)
- [CVE-2023-1636](https://insights.sbomify.com/CVE-2023-1636/): Incomplete container isolation (medium 6.0)
- [CVE-2023-1635](https://insights.sbomify.com/CVE-2023-1635/): OTCMS apiRun.php AutoRun cross site scripting (low 3.5)
- [CVE-2023-1634](https://insights.sbomify.com/CVE-2023-1634/): OTCMS URL Parameter info_deal.php UseCurl server-side request forgery (medium 6.3)
- [CVE-2023-1633](https://insights.sbomify.com/CVE-2023-1633/): Insecure barbican configuration file leaking credential (medium 6.6)
- [CVE-2023-1631](https://insights.sbomify.com/CVE-2023-1631/): JiangMin Antivirus IOCTL kvcore.sys 0x222010 null pointer dereference (medium 5.5)
- [CVE-2023-1630](https://insights.sbomify.com/CVE-2023-1630/): JiangMin Antivirus IOCTL kvcore.sys 0x222000 denial of service (medium 5.5)
- [CVE-2023-1629](https://insights.sbomify.com/CVE-2023-1629/): JiangMin Antivirus IOCTL kvcore.sys 0x222010 memory corruption (medium 5.3)
- [CVE-2023-1628](https://insights.sbomify.com/CVE-2023-1628/): Jianming Antivirus IoControlCode kvcore.sys null pointer dereference (medium 5.5)
- [CVE-2023-1627](https://insights.sbomify.com/CVE-2023-1627/): Jianming Antivirus IoControlCode kvcore.sys denial of service (medium 5.5)
- [CVE-2023-1626](https://insights.sbomify.com/CVE-2023-1626/): Jianming Antivirus IoControlCode kvcore.sys memory corruption (medium 5.3)
- [CVE-2023-1625](https://insights.sbomify.com/CVE-2023-1625/): Information leak in api (high 7.4)
- [CVE-2023-1624](https://insights.sbomify.com/CVE-2023-1624/): WPCode Lite < 2.0.9 - Arbitrary Log File Deletion via CSRF (medium 6.5)
- [CVE-2023-1623](https://insights.sbomify.com/CVE-2023-1623/): Custom Post Type UI < 1.13.5 - Debug Info Sending via CSRF (medium 6.5)
- [CVE-2023-1621](https://insights.sbomify.com/CVE-2023-1621/): Security feature bypass in GitLab (medium 6.5)
- [CVE-2023-1620](https://insights.sbomify.com/CVE-2023-1620/): WAGO: DoS in multiple products in multiple versions using Codesys (medium 4.9)
- [CVE-2023-1619](https://insights.sbomify.com/CVE-2023-1619/): WAGO: DoS in multiple versions of multiple products (medium 4.9)
- [CVE-2023-1618](https://insights.sbomify.com/CVE-2023-1618/): Authentication Bypass Vulnerability in MELSEC WS Series Ethernet Interface Module (high 7.5)
- [CVE-2023-1617](https://insights.sbomify.com/CVE-2023-1617/): Improper Authentication Mechanism in B&R VC4 Visualization (critical 9.8)
- [CVE-2023-1616](https://insights.sbomify.com/CVE-2023-1616/): XiaoBingBy TeaCMS Article Title cross site scripting (low 3.5)
- [CVE-2023-1615](https://insights.sbomify.com/CVE-2023-1615/): SQL injection in Ultimate Addons for Contact Form 7 (high 8.8)
- [CVE-2023-1614](https://insights.sbomify.com/CVE-2023-1614/): WP Custom Author URL < 1.0.5 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-1613](https://insights.sbomify.com/CVE-2023-1613/): Rebuild publish cross site scripting (low 3.5)
- [CVE-2023-1612](https://insights.sbomify.com/CVE-2023-1612/): Rebuild list-file sql injection (medium 6.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/414/