# Vulnerabilities published in 2023


- [CVE-2023-1289](https://insights.sbomify.com/CVE-2023-1289/): ImageMagick: Specially crafted SVG leads to segmentation fault and generate trash files in "/tmp", possible to leverage DoS (medium 5.5)
- [CVE-2023-1288](https://insights.sbomify.com/CVE-2023-1288/): ENOVIA Live Collaboration V6R2013xE is affected by an XML External Entity injection (XXE) vulnerability (medium 6.8)
- [CVE-2023-1287](https://insights.sbomify.com/CVE-2023-1287/): ENOVIA Live Collaboration V6R2013xE is affected by an XSL template injection vulnerability (critical 9.0)
- [CVE-2023-1286](https://insights.sbomify.com/CVE-2023-1286/): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (medium 4.8)
- [CVE-2023-1285](https://insights.sbomify.com/CVE-2023-1285/): Race condition in GC-ENET-COM (high 7.5)
- [CVE-2023-1283](https://insights.sbomify.com/CVE-2023-1283/): Code Injection in builderio/qwik (critical 10.0)
- [CVE-2023-1282](https://insights.sbomify.com/CVE-2023-1282/): Drag and Drop Multiple File Upload PRO - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-1281](https://insights.sbomify.com/CVE-2023-1281/): UAF in Linux kernel's tcindex (traffic control index filter) implementation (high 7.8)
- [CVE-2023-1279](https://insights.sbomify.com/CVE-2023-1279/): URL Redirection to Untrusted Site in GitLab (low 2.6)
- [CVE-2023-1278](https://insights.sbomify.com/CVE-2023-1278/): IBOS index.php cross site scripting (low 3.5)
- [CVE-2023-1277](https://insights.sbomify.com/CVE-2023-1277/): kylin-system-updater Update InstallSnap command injection (high 7.8)
- [CVE-2023-1276](https://insights.sbomify.com/CVE-2023-1276/): SUL1SS_shop Order.php sql injection (medium 4.7)
- [CVE-2023-1275](https://insights.sbomify.com/CVE-2023-1275/): SourceCodester Phone Shop Sales Managements System CAPTCHA index.php cross site scripting (low 3.5)
- [CVE-2023-1274](https://insights.sbomify.com/CVE-2023-1274/): Pricing Tables For WPBakery Page Builder < 3.0 - Subscriber+ LFI (medium 6.5)
- [CVE-2023-1273](https://insights.sbomify.com/CVE-2023-1273/): ND Shortcodes < 7.0 - Subscriber+ LFI (high 8.8)
- [CVE-2023-1270](https://insights.sbomify.com/CVE-2023-1270/): Cross-site Scripting in btcpayserver/btcpayserver (medium 5.1)
- [CVE-2023-1269](https://insights.sbomify.com/CVE-2023-1269/): Use of Hard-coded Credentials in alextselegidis/easyappointments (medium 6.5)
- [CVE-2023-1267](https://insights.sbomify.com/CVE-2023-1267/): SQLi in Ulkem Company's PtteM Kart (critical 9.8)
- [CVE-2023-1265](https://insights.sbomify.com/CVE-2023-1265/): Information disclosure in GitLab (medium 5.4)
- [CVE-2023-1264](https://insights.sbomify.com/CVE-2023-1264/): NULL Pointer Dereference in vim/vim (medium 6.6)
- [CVE-2023-1263](https://insights.sbomify.com/CVE-2023-1263/): CMP – Coming Soon & Maintenance Plugin by NiteoThemes <= 4.1.6 - Information Exposure (medium 5.3)
- [CVE-2023-1262](https://insights.sbomify.com/CVE-2023-1262/): Missing MAC layer security in Wi-SUN Linux Border Router (high 8.2)
- [CVE-2023-1261](https://insights.sbomify.com/CVE-2023-1261/): Missing MAC layer security in Wi-SUN SDK (high 8.2)
- [CVE-2023-1260](https://insights.sbomify.com/CVE-2023-1260/): Kube-apiserver: privesc (high 8.0)
- [CVE-2023-1259](https://insights.sbomify.com/CVE-2023-1259/): Hotjar <= 1.0.15 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2023-1258](https://insights.sbomify.com/CVE-2023-1258/): Flow-X disclosure of sensitive information to unauthenticated users (medium 5.3)
- [CVE-2023-1257](https://insights.sbomify.com/CVE-2023-1257/): CVE-2023-1257 (high 7.6)
- [CVE-2023-1256](https://insights.sbomify.com/CVE-2023-1256/): CVE-2023-1256 (critical 9.8)
- [CVE-2023-1255](https://insights.sbomify.com/CVE-2023-1255/): Input buffer over-read in AES-XTS implementation on 64 bit ARM (medium 5.9)
- [CVE-2023-1254](https://insights.sbomify.com/CVE-2023-1254/): SourceCodester Health Center Patient Record Management System birthing_print.php cross site scripting (low 3.5)
- [CVE-2023-1253](https://insights.sbomify.com/CVE-2023-1253/): SourceCodester Health Center Patient Record Management System login.php sql injection (high 7.3)
- [CVE-2023-1252](https://insights.sbomify.com/CVE-2023-1252/): Use after free in Kernel (high 7.8)
- [CVE-2023-1251](https://insights.sbomify.com/CVE-2023-1251/): SQLi in Wolvox (critical 9.8)
- [CVE-2023-1250](https://insights.sbomify.com/CVE-2023-1250/): Code execution through ACL creation (high 7.4)
- [CVE-2023-1249](https://insights.sbomify.com/CVE-2023-1249/): Use after free in Kernel (medium 5.5)
- [CVE-2023-1248](https://insights.sbomify.com/CVE-2023-1248/): Possible XSS in Ticket Actions (medium 6.1)
- [CVE-2023-1246](https://insights.sbomify.com/CVE-2023-1246/): Files or Directories Accessible to External Parties in Saysis Starcities (high 7.5)
- [CVE-2023-1245](https://insights.sbomify.com/CVE-2023-1245/): Cross-site Scripting (XSS) - Stored in answerdev/answer (low 3.5)
- [CVE-2023-1244](https://insights.sbomify.com/CVE-2023-1244/): Cross-site Scripting (XSS) - Stored in answerdev/answer (critical 9.3)
- [CVE-2023-1243](https://insights.sbomify.com/CVE-2023-1243/): Cross-site Scripting (XSS) - Stored in answerdev/answer (medium 6.0)
- [CVE-2023-1242](https://insights.sbomify.com/CVE-2023-1242/): Cross-site Scripting (XSS) - Stored in answerdev/answer (high 8.0)
- [CVE-2023-1241](https://insights.sbomify.com/CVE-2023-1241/): Cross-site Scripting (XSS) - Stored in answerdev/answer (high 8.8)
- [CVE-2023-1240](https://insights.sbomify.com/CVE-2023-1240/): Cross-site Scripting (XSS) - Stored in answerdev/answer (high 8.0)
- [CVE-2023-1239](https://insights.sbomify.com/CVE-2023-1239/): Cross-site Scripting (XSS) - Reflected in answerdev/answer (medium 6.0)
- [CVE-2023-1238](https://insights.sbomify.com/CVE-2023-1238/): Cross-site Scripting (XSS) - Stored in answerdev/answer (high 7.6)
- [CVE-2023-1237](https://insights.sbomify.com/CVE-2023-1237/): Cross-site Scripting (XSS) - Stored in answerdev/answer (low 3.4)
- [CVE-2023-1236](https://insights.sbomify.com/CVE-2023-1236/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2023-1235](https://insights.sbomify.com/CVE-2023-1235/): Memory corruption in Chrome (medium 6.3)
- [CVE-2023-1234](https://insights.sbomify.com/CVE-2023-1234/): Other in Chrome (medium 4.3)
- [CVE-2023-1233](https://insights.sbomify.com/CVE-2023-1233/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2023-1232](https://insights.sbomify.com/CVE-2023-1232/): Information disclosure in Chrome (medium 4.3)
- [CVE-2023-1231](https://insights.sbomify.com/CVE-2023-1231/): Other in Chrome (medium 4.3)
- [CVE-2023-1230](https://insights.sbomify.com/CVE-2023-1230/): Other in Chrome (medium 4.3)
- [CVE-2023-1229](https://insights.sbomify.com/CVE-2023-1229/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2023-1228](https://insights.sbomify.com/CVE-2023-1228/): Security feature bypass in Chrome (high 8.8)
- [CVE-2023-1227](https://insights.sbomify.com/CVE-2023-1227/): Use after free in Chrome (high 8.8)
- [CVE-2023-1226](https://insights.sbomify.com/CVE-2023-1226/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2023-1225](https://insights.sbomify.com/CVE-2023-1225/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2023-1224](https://insights.sbomify.com/CVE-2023-1224/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2023-1223](https://insights.sbomify.com/CVE-2023-1223/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2023-1222](https://insights.sbomify.com/CVE-2023-1222/): Memory corruption in Chrome (high 8.8)
- [CVE-2023-1221](https://insights.sbomify.com/CVE-2023-1221/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2023-1220](https://insights.sbomify.com/CVE-2023-1220/): Memory corruption in Chrome (high 8.8)
- [CVE-2023-1219](https://insights.sbomify.com/CVE-2023-1219/): Memory corruption in Chrome (high 8.8)
- [CVE-2023-1218](https://insights.sbomify.com/CVE-2023-1218/): Use after free in Chrome (high 8.8)
- [CVE-2023-1217](https://insights.sbomify.com/CVE-2023-1217/): Memory corruption in Chrome (medium 6.5)
- [CVE-2023-1216](https://insights.sbomify.com/CVE-2023-1216/): Use after free in Chrome (high 8.8)
- [CVE-2023-1215](https://insights.sbomify.com/CVE-2023-1215/): Memory corruption in Chrome (high 8.8)
- [CVE-2023-1214](https://insights.sbomify.com/CVE-2023-1214/): Memory corruption in Chrome (high 8.8)
- [CVE-2023-1213](https://insights.sbomify.com/CVE-2023-1213/): Use after free in Chrome (high 8.8)
- [CVE-2023-1212](https://insights.sbomify.com/CVE-2023-1212/): Cross-site Scripting (XSS) - Stored in phpipam/phpipam (medium 5.9)
- [CVE-2023-1211](https://insights.sbomify.com/CVE-2023-1211/): SQL Injection in phpipam/phpipam (high 7.2)
- [CVE-2023-1210](https://insights.sbomify.com/CVE-2023-1210/): Generation of Error Message Containing Sensitive Information in GitLab (low 3.1)
- [CVE-2023-1209](https://insights.sbomify.com/CVE-2023-1209/): Cross-site scripting in ServiceNow Records (medium 4.3)
- [CVE-2023-1208](https://insights.sbomify.com/CVE-2023-1208/): HTTP Headers < 1.18.11 - Admin+ Remote Code Execution (high 7.2)
- [CVE-2023-1207](https://insights.sbomify.com/CVE-2023-1207/): HTTP Headers < 1.18.8 - Admin+ SQL Injection (high 7.2)
- [CVE-2023-1206](https://insights.sbomify.com/CVE-2023-1206/): Denial of service in Kernel (medium 5.7)
- [CVE-2023-1205](https://insights.sbomify.com/CVE-2023-1205/): Cross-site request forgery in NETGEAR Nighthawk WiFi6 Router (high 8.8)
- [CVE-2023-1204](https://insights.sbomify.com/CVE-2023-1204/): Security feature bypass in GitLab (medium 4.3)
- [CVE-2023-1203](https://insights.sbomify.com/CVE-2023-1203/): Information disclosure in Remote Desktop Manager PowerShell Module (medium 6.5)
- [CVE-2023-1202](https://insights.sbomify.com/CVE-2023-1202/): Missing authorization in Remote Desktop Manager (medium 6.5)
- [CVE-2023-1201](https://insights.sbomify.com/CVE-2023-1201/): Missing authorization in Devolutions Server (medium 6.5)
- [CVE-2023-1200](https://insights.sbomify.com/CVE-2023-1200/): ehuacui bbs cross site scripting (low 3.5)
- [CVE-2023-1198](https://insights.sbomify.com/CVE-2023-1198/): SQLi in Saysis Starcities (critical 9.8)
- [CVE-2023-1197](https://insights.sbomify.com/CVE-2023-1197/): Cross-site Scripting (XSS) - Stored in uvdesk/community-skeleton (medium 4.3)
- [CVE-2023-1196](https://insights.sbomify.com/CVE-2023-1196/): Advanced Custom Fields - Contributor+ PHP Object Injection (high 8.8)
- [CVE-2023-1195](https://insights.sbomify.com/CVE-2023-1195/): Use after free in Kernel (medium 5.5)
- [CVE-2023-1194](https://insights.sbomify.com/CVE-2023-1194/): Use-after-free in parse_lease_state() (high 7.1)
- [CVE-2023-1193](https://insights.sbomify.com/CVE-2023-1193/): Use-after-free in setup_async_work() (medium 6.5)
- [CVE-2023-1192](https://insights.sbomify.com/CVE-2023-1192/): Use-after-free in smb2_is_status_io_timeout() (medium 6.5)
- [CVE-2023-1191](https://insights.sbomify.com/CVE-2023-1191/): fastcms ZIP File TemplateController.java path traversal (medium 4.7)
- [CVE-2023-1190](https://insights.sbomify.com/CVE-2023-1190/): xiaozhuai imageinfo imageinfo.hpp buffer overflow (medium 4.8)
- [CVE-2023-1189](https://insights.sbomify.com/CVE-2023-1189/): WiseCleaner Wise Folder Hider IoControlCode WiseFs64.sys 0x222410 denial of service (low 3.3)
- [CVE-2023-1188](https://insights.sbomify.com/CVE-2023-1188/): FabulaTech Webcam for Remote Desktop IoControlCode ftwebcam.sys 0x222018 denial of service (low 3.3)
- [CVE-2023-1187](https://insights.sbomify.com/CVE-2023-1187/): FabulaTech Webcam for Remote Desktop Global Variable ftwebcam.sys denial of service (low 3.3)
- [CVE-2023-1186](https://insights.sbomify.com/CVE-2023-1186/): FabulaTech Webcam for Remote Desktop IOCTL ftwebcam.sys 0x222018 null pointer dereference (low 3.3)
- [CVE-2023-1185](https://insights.sbomify.com/CVE-2023-1185/): ECshop New Product unrestricted upload (medium 4.7)
- [CVE-2023-1184](https://insights.sbomify.com/CVE-2023-1184/): ECshop Backup Database database.php unrestricted upload (medium 4.7)
- [CVE-2023-1183](https://insights.sbomify.com/CVE-2023-1183/): Arbitrary file write (medium 5.0)
- [CVE-2023-1181](https://insights.sbomify.com/CVE-2023-1181/): Cross-site Scripting (XSS) - Stored in icret/easyimages2.0 (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/418/