# Vulnerabilities published in 2023


- [CVE-2023-1611](https://insights.sbomify.com/CVE-2023-1611/): Use after free in Kernel (medium 6.3)
- [CVE-2023-1610](https://insights.sbomify.com/CVE-2023-1610/): Rebuild list sql injection (medium 6.3)
- [CVE-2023-1609](https://insights.sbomify.com/CVE-2023-1609/): Zhong Bang CRMEB Java save cross site scripting (low 3.5)
- [CVE-2023-1608](https://insights.sbomify.com/CVE-2023-1608/): Zhong Bang CRMEB Java list getAdminList sql injection (medium 6.3)
- [CVE-2023-1607](https://insights.sbomify.com/CVE-2023-1607/): novel-plus list sql injection (medium 4.7)
- [CVE-2023-1606](https://insights.sbomify.com/CVE-2023-1606/): novel-plus DictController.java sql injection (medium 6.3)
- [CVE-2023-1605](https://insights.sbomify.com/CVE-2023-1605/): Denial of Service in radareorg/radare2 (high 7.5)
- [CVE-2023-1604](https://insights.sbomify.com/CVE-2023-1604/): Short URL <= 1.6.8 - Cross-Site Request Forgery via configuration_page (medium 4.7)
- [CVE-2023-1603](https://insights.sbomify.com/CVE-2023-1603/): Missing authorization in Server (medium 6.5)
- [CVE-2023-1602](https://insights.sbomify.com/CVE-2023-1602/): Cross-site scripting in Short URL (medium 4.4)
- [CVE-2023-1597](https://insights.sbomify.com/CVE-2023-1597/): tagDiv Cloud Library < 2.7 - Unauthenticated Arbitrary User Metadata Update to Privilege Escalation (high 8.8)
- [CVE-2023-1596](https://insights.sbomify.com/CVE-2023-1596/): tagDiv Composer < 4.0 - Reflected Cross-site Scripting (medium 6.1)
- [CVE-2023-1595](https://insights.sbomify.com/CVE-2023-1595/): novel-plus list sql injection (medium 4.7)
- [CVE-2023-1594](https://insights.sbomify.com/CVE-2023-1594/): novel-plus list MenuService sql injection (high 7.3)
- [CVE-2023-1593](https://insights.sbomify.com/CVE-2023-1593/): SourceCodester Automatic Question Paper Generator System cross site scripting (low 3.5)
- [CVE-2023-1592](https://insights.sbomify.com/CVE-2023-1592/): SourceCodester Automatic Question Paper Generator System GET Parameter view_class.php sql injection (medium 6.3)
- [CVE-2023-1591](https://insights.sbomify.com/CVE-2023-1591/): SourceCodester Automatic Question Paper Generator System sql injection (medium 6.3)
- [CVE-2023-1590](https://insights.sbomify.com/CVE-2023-1590/): SourceCodester Online Tours & Travels Management System currency.php exec sql injection (medium 6.3)
- [CVE-2023-1589](https://insights.sbomify.com/CVE-2023-1589/): SourceCodester Online Tours & Travels Management System approve_delete.php exec sql injection (medium 6.3)
- [CVE-2023-1587](https://insights.sbomify.com/CVE-2023-1587/): Null dereference in AVG Antivirus (medium 5.8)
- [CVE-2023-1586](https://insights.sbomify.com/CVE-2023-1586/): Race condition in AVG Antivirus (medium 6.5)
- [CVE-2023-1585](https://insights.sbomify.com/CVE-2023-1585/): Race condition in AVG Antivirus (medium 6.5)
- [CVE-2023-1584](https://insights.sbomify.com/CVE-2023-1584/): Quarkus-oidc: id and access tokens leak via the authorization code flow (high 7.5)
- [CVE-2023-1583](https://insights.sbomify.com/CVE-2023-1583/): Null dereference in Linux kernel (medium 5.5)
- [CVE-2023-1582](https://insights.sbomify.com/CVE-2023-1582/): Race condition in Linux (medium 4.7)
- [CVE-2023-1580](https://insights.sbomify.com/CVE-2023-1580/): Denial of service in Gateway (high 7.5)
- [CVE-2023-1579](https://insights.sbomify.com/CVE-2023-1579/): Memory corruption in binutils (high 7.8)
- [CVE-2023-1578](https://insights.sbomify.com/CVE-2023-1578/): SQL Injection in pimcore/pimcore (medium 6.7)
- [CVE-2023-1577](https://insights.sbomify.com/CVE-2023-1577/): Privilege escalation in Driver Manager (high 7.8)
- [CVE-2023-1575](https://insights.sbomify.com/CVE-2023-1575/): Mega Main Menu <= 2.2.2 - Authenticated (Administrator+) Cross-Site Scripting (medium 5.5)
- [CVE-2023-1574](https://insights.sbomify.com/CVE-2023-1574/): Information disclosure in Remote Desktop Manager (medium 6.5)
- [CVE-2023-1573](https://insights.sbomify.com/CVE-2023-1573/): DataGear Graph Dataset cross site scripting (low 3.5)
- [CVE-2023-1572](https://insights.sbomify.com/CVE-2023-1572/): DataGear Plugin cross site scripting (low 2.0)
- [CVE-2023-1571](https://insights.sbomify.com/CVE-2023-1571/): DataGear pagingQueryData sql injection (medium 6.3)
- [CVE-2023-1570](https://insights.sbomify.com/CVE-2023-1570/): syoyo tinydng tiny_dng_loader.h __interceptor_memcpy heap-based overflow (low 3.3)
- [CVE-2023-1569](https://insights.sbomify.com/CVE-2023-1569/): SourceCodester E-Commerce System cross site scripting (low 3.5)
- [CVE-2023-1568](https://insights.sbomify.com/CVE-2023-1568/): SourceCodester Student Study Center Desk Management System GET Parameter index.php cross site scripting (low 3.5)
- [CVE-2023-1567](https://insights.sbomify.com/CVE-2023-1567/): SourceCodester Student Study Center Desk Management System assign.php cross site scripting (low 3.5)
- [CVE-2023-1566](https://insights.sbomify.com/CVE-2023-1566/): SourceCodester Medical Certificate Generator App action.php sql injection (medium 6.3)
- [CVE-2023-1565](https://insights.sbomify.com/CVE-2023-1565/): FeiFeiCMS Extension Tool slide_add.html cross site scripting (low 3.5)
- [CVE-2023-1564](https://insights.sbomify.com/CVE-2023-1564/): SourceCodester Air Cargo Management System GET Parameter update_status.php sql injection (medium 6.3)
- [CVE-2023-1563](https://insights.sbomify.com/CVE-2023-1563/): SourceCodester Student Study Center Desk Management System assign.php sql injection (medium 6.3)
- [CVE-2023-1562](https://insights.sbomify.com/CVE-2023-1562/): Full name revealed via /plugins/focalboard/api/v2/users (low 3.5)
- [CVE-2023-1561](https://insights.sbomify.com/CVE-2023-1561/): code-projects Simple Online Hotel Reservation System add_room.php unrestricted upload (medium 6.3)
- [CVE-2023-1560](https://insights.sbomify.com/CVE-2023-1560/): TinyTIFF File tinytiffreader.c buffer overflow (low 2.8)
- [CVE-2023-1559](https://insights.sbomify.com/CVE-2023-1559/): SourceCodester Storage Unit Rental Management System unrestricted upload (medium 4.7)
- [CVE-2023-1558](https://insights.sbomify.com/CVE-2023-1558/): Simple and Beautiful Shopping Cart System uploadera.php unrestricted upload (medium 6.3)
- [CVE-2023-1557](https://insights.sbomify.com/CVE-2023-1557/): SourceCodester E-Commerce System Username access control (medium 6.3)
- [CVE-2023-1556](https://insights.sbomify.com/CVE-2023-1556/): SourceCodester Judging Management System summary_results.php sql injection (medium 6.3)
- [CVE-2023-1555](https://insights.sbomify.com/CVE-2023-1555/): Missing Authorization in GitLab (low 2.7)
- [CVE-2023-1554](https://insights.sbomify.com/CVE-2023-1554/): Quick Paypal Payments < 5.7.26.4 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-1552](https://insights.sbomify.com/CVE-2023-1552/): ToolboxST Deserialization of Untrusted Configuration Data (low 2.9)
- [CVE-2023-1550](https://insights.sbomify.com/CVE-2023-1550/): NGINX Agent vulnerability CVE-2023-1550 (medium 5.5)
- [CVE-2023-1549](https://insights.sbomify.com/CVE-2023-1549/): Ad Inserter < 2.7.27 - Admin+ PHP Object Injection (high 7.2)
- [CVE-2023-1548](https://insights.sbomify.com/CVE-2023-1548/): Privilege escalation in EcoStruxure Control Expert (medium 5.5)
- [CVE-2023-1547](https://insights.sbomify.com/CVE-2023-1547/): SQLi in Elra Computers Parkmatik (critical 9.8)
- [CVE-2023-1546](https://insights.sbomify.com/CVE-2023-1546/): MyCryptoCheckout < 2.124 - Reflected XSS (medium 6.1)
- [CVE-2023-1545](https://insights.sbomify.com/CVE-2023-1545/): SQL Injection in nilsteampassnet/teampass (high 7.5)
- [CVE-2023-1544](https://insights.sbomify.com/CVE-2023-1544/): Qemu: pvrdma: out-of-bounds read in pvrdma_ring_next_elem_read() (medium 6.0)
- [CVE-2023-1543](https://insights.sbomify.com/CVE-2023-1543/): Insufficient Session Expiration in answerdev/answer (medium 6.8)
- [CVE-2023-1542](https://insights.sbomify.com/CVE-2023-1542/): Business Logic Errors in answerdev/answer (high 8.1)
- [CVE-2023-1541](https://insights.sbomify.com/CVE-2023-1541/): Business Logic Errors in answerdev/answer (medium 6.0)
- [CVE-2023-1540](https://insights.sbomify.com/CVE-2023-1540/): Observable Response Discrepancy in answerdev/answer (medium 5.3)
- [CVE-2023-1539](https://insights.sbomify.com/CVE-2023-1539/): Improper Restriction of Excessive Authentication Attempts in answerdev/answer (medium 5.3)
- [CVE-2023-1538](https://insights.sbomify.com/CVE-2023-1538/): Observable Timing Discrepancy in answerdev/answer (medium 5.3)
- [CVE-2023-1537](https://insights.sbomify.com/CVE-2023-1537/): Authentication Bypass by Capture-replay in answerdev/answer (medium 5.3)
- [CVE-2023-1536](https://insights.sbomify.com/CVE-2023-1536/): Cross-site Scripting (XSS) - Stored in answerdev/answer (high 7.6)
- [CVE-2023-1535](https://insights.sbomify.com/CVE-2023-1535/): Cross-site Scripting (XSS) - Stored in answerdev/answer (high 8.3)
- [CVE-2023-1534](https://insights.sbomify.com/CVE-2023-1534/): Memory corruption in Chrome (high 8.8)
- [CVE-2023-1533](https://insights.sbomify.com/CVE-2023-1533/): Use after free in Chrome (high 8.8)
- [CVE-2023-1532](https://insights.sbomify.com/CVE-2023-1532/): Memory corruption in Chrome (high 8.8)
- [CVE-2023-1531](https://insights.sbomify.com/CVE-2023-1531/): Use after free in Chrome (high 8.8)
- [CVE-2023-1530](https://insights.sbomify.com/CVE-2023-1530/): Use after free in Chrome (high 8.8)
- [CVE-2023-1529](https://insights.sbomify.com/CVE-2023-1529/): Memory corruption in Chrome (critical 9.8)
- [CVE-2023-1528](https://insights.sbomify.com/CVE-2023-1528/): Use after free in Chrome (high 8.8)
- [CVE-2023-1527](https://insights.sbomify.com/CVE-2023-1527/): Cross-site Scripting (XSS) - Generic in tsolucio/corebos (high 8.3)
- [CVE-2023-1526](https://insights.sbomify.com/CVE-2023-1526/): Information disclosure in HP DesignJet and PageWide XL (medium 4.6)
- [CVE-2023-1525](https://insights.sbomify.com/CVE-2023-1525/): Site Reviews < 6.7.1 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-1524](https://insights.sbomify.com/CVE-2023-1524/): Download Manager < 3.2.71 - Broken Access Controls (medium 6.5)
- [CVE-2023-1523](https://insights.sbomify.com/CVE-2023-1523/): Command injection in snapd (critical 10.0)
- [CVE-2023-1522](https://insights.sbomify.com/CVE-2023-1522/): SQL injection in Genetec Security Center (high 8.8)
- [CVE-2023-1521](https://insights.sbomify.com/CVE-2023-1521/): Local Privilege Escalation in sccache (high 7.8)
- [CVE-2023-1518](https://insights.sbomify.com/CVE-2023-1518/): Information disclosure in KVMS Pro (high 7.8)
- [CVE-2023-1517](https://insights.sbomify.com/CVE-2023-1517/): Cross-site Scripting (XSS) - DOM in pimcore/pimcore (medium 4.0)
- [CVE-2023-1516](https://insights.sbomify.com/CVE-2023-1516/): Misconfiguration in RoboDK (high 7.9)
- [CVE-2023-1515](https://insights.sbomify.com/CVE-2023-1515/): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (medium 5.2)
- [CVE-2023-1514](https://insights.sbomify.com/CVE-2023-1514/): Security feature bypass in RTU500 Scripting Interface (high 7.4)
- [CVE-2023-1513](https://insights.sbomify.com/CVE-2023-1513/): Information disclosure in Linux kernel (KVM) (low 3.3)
- [CVE-2023-1509](https://insights.sbomify.com/CVE-2023-1509/): GMAce <= 1.5.2 - Cross-Site Request Forgery to Arbitrary File Modification (Creation/Overwrite/Deletion) (high 8.8)
- [CVE-2023-1508](https://insights.sbomify.com/CVE-2023-1508/): SQLi in AdamPOS's Mobilmen Terminal Software (critical 9.8)
- [CVE-2023-1507](https://insights.sbomify.com/CVE-2023-1507/): SourceCodester E-Commerce System Category Name controller.php cross site scripting (low 3.5)
- [CVE-2023-1506](https://insights.sbomify.com/CVE-2023-1506/): SourceCodester E-Commerce System login.php sql injection (medium 5.6)
- [CVE-2023-1505](https://insights.sbomify.com/CVE-2023-1505/): SourceCodester E-Commerce System setDiscount.php sql injection (medium 5.0)
- [CVE-2023-1504](https://insights.sbomify.com/CVE-2023-1504/): SourceCodester Alphaware Simple E-Commerce System sql injection (medium 5.6)
- [CVE-2023-1503](https://insights.sbomify.com/CVE-2023-1503/): SourceCodester Alphaware Simple E-Commerce System admin_index.php sql injection (medium 5.6)
- [CVE-2023-1502](https://insights.sbomify.com/CVE-2023-1502/): SourceCodester Alphaware Simple E-Commerce System edit_customer.php sql injection (medium 5.6)
- [CVE-2023-1501](https://insights.sbomify.com/CVE-2023-1501/): RockOA acloudCosAction.php.SQL runAction unrestricted upload (medium 6.3)
- [CVE-2023-1500](https://insights.sbomify.com/CVE-2023-1500/): code-projects Simple Art Gallery adminHome.php cross site scripting (low 3.5)
- [CVE-2023-1499](https://insights.sbomify.com/CVE-2023-1499/): code-projects Simple Art Gallery adminHome.php sql injection (medium 6.3)
- [CVE-2023-1498](https://insights.sbomify.com/CVE-2023-1498/): code-projects Responsive Hotel Site Newsletter Log messages.php sql injection (medium 6.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/415/