# Vulnerabilities published in 2023


- [CVE-2023-1073](https://insights.sbomify.com/CVE-2023-1073/): Memory corruption in kernel (medium 6.6)
- [CVE-2023-1072](https://insights.sbomify.com/CVE-2023-1072/): Denial of service in GitLab (medium 4.3)
- [CVE-2023-1071](https://insights.sbomify.com/CVE-2023-1071/): Missing authorization in GitLab (low 3.1)
- [CVE-2023-1070](https://insights.sbomify.com/CVE-2023-1070/): External Control of File Name or Path in nilsteampassnet/teampass (high 7.1)
- [CVE-2023-1069](https://insights.sbomify.com/CVE-2023-1069/): Complianz - GDPR/CCPA Cookie Consent < 6.4.2 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-1068](https://insights.sbomify.com/CVE-2023-1068/): Download Read More Excerpt Link <= 1.6.0 - Cross-Site Request Forgery to Settings Update (medium 4.3)
- [CVE-2023-1067](https://insights.sbomify.com/CVE-2023-1067/): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (medium 5.2)
- [CVE-2023-1065](https://insights.sbomify.com/CVE-2023-1065/): Other in Snyk Kubernetes Monitor (medium 6.5)
- [CVE-2023-1064](https://insights.sbomify.com/CVE-2023-1064/): SQLi in Uzay Baskul's Weighbridge Automation Software (critical 9.8)
- [CVE-2023-1063](https://insights.sbomify.com/CVE-2023-1063/): SourceCodester Doctors Appointment System Parameter patient.php sql injection (medium 6.3)
- [CVE-2023-1062](https://insights.sbomify.com/CVE-2023-1062/): SourceCodester Doctors Appointment System Parameter add-new.php sql injection (medium 6.3)
- [CVE-2023-1061](https://insights.sbomify.com/CVE-2023-1061/): SourceCodester Doctors Appointment System edit-doc.php sql injection (medium 5.3)
- [CVE-2023-1060](https://insights.sbomify.com/CVE-2023-1060/): XSS in YKM CRM (medium 6.1)
- [CVE-2023-1059](https://insights.sbomify.com/CVE-2023-1059/): SourceCodester Doctors Appointment System Parameter doctors.php sql injection (medium 5.3)
- [CVE-2023-1058](https://insights.sbomify.com/CVE-2023-1058/): SourceCodester Doctors Appointment System create-account.php sql injection (high 7.3)
- [CVE-2023-1057](https://insights.sbomify.com/CVE-2023-1057/): SourceCodester Doctors Appointment System login.php edoc sql injection (medium 5.5)
- [CVE-2023-1056](https://insights.sbomify.com/CVE-2023-1056/): SourceCodester Doctors Appointment System patient.php sql injection (medium 6.3)
- [CVE-2023-1055](https://insights.sbomify.com/CVE-2023-1055/): Information disclosure in Red Hat Directory Server (medium 5.5)
- [CVE-2023-1054](https://insights.sbomify.com/CVE-2023-1054/): SourceCodester Music Gallery Site sql injection (medium 4.7)
- [CVE-2023-1053](https://insights.sbomify.com/CVE-2023-1053/): SourceCodester Music Gallery Site view_category.php sql injection (medium 4.7)
- [CVE-2023-1051](https://insights.sbomify.com/CVE-2023-1051/): XSS in As Koc Web Report System (medium 6.1)
- [CVE-2023-1050](https://insights.sbomify.com/CVE-2023-1050/): SQLi in As Koc Web Report System (critical 9.8)
- [CVE-2023-1049](https://insights.sbomify.com/CVE-2023-1049/): Code injection in EcoStruxure™ Operator Terminal Expert (high 7.8)
- [CVE-2023-1048](https://insights.sbomify.com/CVE-2023-1048/): TechPowerUp Ryzen DRAM Calculator WinRing0x64.sys initialization (medium 5.3)
- [CVE-2023-1047](https://insights.sbomify.com/CVE-2023-1047/): TechPowerUp RealTemp WinRing0x64.sys initialization (medium 5.3)
- [CVE-2023-1046](https://insights.sbomify.com/CVE-2023-1046/): MuYuCMS getFile.html server-side request forgery (medium 6.3)
- [CVE-2023-1045](https://insights.sbomify.com/CVE-2023-1045/): MuYuCMS filesdel.html path traversal (low 3.8)
- [CVE-2023-1044](https://insights.sbomify.com/CVE-2023-1044/): MuYuCMS index.php path traversal (medium 4.3)
- [CVE-2023-1043](https://insights.sbomify.com/CVE-2023-1043/): MuYuCMS index.php path traversal (medium 4.3)
- [CVE-2023-1042](https://insights.sbomify.com/CVE-2023-1042/): SourceCodester Online Pet Shop We App update_status.php cross site scripting (low 3.5)
- [CVE-2023-1041](https://insights.sbomify.com/CVE-2023-1041/): SourceCodester Simple Responsive Tourism Website rate_review.php cross site scripting (low 3.5)
- [CVE-2023-1040](https://insights.sbomify.com/CVE-2023-1040/): SourceCodester Online Graduate Tracer System add_acc.php sql injection (medium 6.3)
- [CVE-2023-1039](https://insights.sbomify.com/CVE-2023-1039/): SourceCodester Class and Exam Timetabling System POST Parameter index3.php sql injection (high 7.3)
- [CVE-2023-1038](https://insights.sbomify.com/CVE-2023-1038/): SourceCodester Online Reviewer Management System questions-view.php sql injection (medium 6.3)
- [CVE-2023-1037](https://insights.sbomify.com/CVE-2023-1037/): SourceCodester Dental Clinic Appointment Reservation System POST Parameter login.php sql injection (high 7.3)
- [CVE-2023-1036](https://insights.sbomify.com/CVE-2023-1036/): SourceCodester Dental Clinic Appointment Reservation System POST Parameter signup.php cross site scripting (medium 4.3)
- [CVE-2023-1035](https://insights.sbomify.com/CVE-2023-1035/): SourceCodester Clinics Patient Management System update_user.php sql injection (medium 6.3)
- [CVE-2023-1034](https://insights.sbomify.com/CVE-2023-1034/): Path Traversal: '\..\filename' in salesagility/suitecrm (medium 4.3)
- [CVE-2023-1033](https://insights.sbomify.com/CVE-2023-1033/): Cross-Site Request Forgery (CSRF) in froxlor/froxlor (medium 6.8)
- [CVE-2023-1032](https://insights.sbomify.com/CVE-2023-1032/): Memory corruption in linux (medium 4.7)
- [CVE-2023-1031](https://insights.sbomify.com/CVE-2023-1031/): Cross-site scripting in MonicaHQ (high 8.8)
- [CVE-2023-1030](https://insights.sbomify.com/CVE-2023-1030/): SourceCodester/code-projects Online Boat Reservation System POST Parameter login.php cross site scripting (medium 5.1)
- [CVE-2023-1029](https://insights.sbomify.com/CVE-2023-1029/): WP Meta SEO <= 4.5.3 - Cross-Site Request Forgery via 'regenerateSitemaps' (medium 4.3)
- [CVE-2023-1028](https://insights.sbomify.com/CVE-2023-1028/): WP Meta SEO <= 4.5.3 - Cross-Site Request Forgery via 'setIgnore' (medium 4.3)
- [CVE-2023-1027](https://insights.sbomify.com/CVE-2023-1027/): WP Meta SEO <= 4.5.3 - Missing Authorization in 'checkAllCategoryInSitemap' (medium 4.3)
- [CVE-2023-1026](https://insights.sbomify.com/CVE-2023-1026/): WP Meta SEO <= 4.5.3 - Missing Authorization in 'listPostsCategory' (medium 4.3)
- [CVE-2023-1025](https://insights.sbomify.com/CVE-2023-1025/): Simple File List < 6.0.10 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-1024](https://insights.sbomify.com/CVE-2023-1024/): WP Meta SEO <= 4.5.3 - Missing Authorization in 'regenerateSitemaps' (medium 4.3)
- [CVE-2023-1023](https://insights.sbomify.com/CVE-2023-1023/): WP Meta SEO <= 4.5.3 - Missing Authorization in 'saveSitemapSettings' (medium 5.4)
- [CVE-2023-1022](https://insights.sbomify.com/CVE-2023-1022/): WP Meta SEO <= 4.5.3 - Missing Authorization in 'wpmsGGSaveInformation' (medium 5.4)
- [CVE-2023-1021](https://insights.sbomify.com/CVE-2023-1021/): Amr Ical Events Lists <= 6.6 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-1020](https://insights.sbomify.com/CVE-2023-1020/): Steveas WP Live Chat Shoutbox <= 1.4.2 - Unauthenticated SQLi (critical 9.8)
- [CVE-2023-1019](https://insights.sbomify.com/CVE-2023-1019/): Help Desk WP <= 1.2.0 - Editor+ Stored XSS (medium 5.4)
- [CVE-2023-1018](https://insights.sbomify.com/CVE-2023-1018/): TPM2.0 vulnerable to out-of-bounds read (medium 5.5)
- [CVE-2023-1017](https://insights.sbomify.com/CVE-2023-1017/): TPM2.0 vulnerable to out-of-bounds write (high 7.8)
- [CVE-2023-1016](https://insights.sbomify.com/CVE-2023-1016/): Intuitive Custom Post Order <= 3.1.4.1 - Authenticated (Admin+) SQL Injection (medium 6.6)
- [CVE-2023-1014](https://insights.sbomify.com/CVE-2023-1014/): Information disclosure in Vira-Investing (high 7.5)
- [CVE-2023-1013](https://insights.sbomify.com/CVE-2023-1013/): XSS in Vira-Investing (medium 6.1)
- [CVE-2023-1011](https://insights.sbomify.com/CVE-2023-1011/): ChatBot < 4.4.5 - Stored XSS via CSRF (medium 6.1)
- [CVE-2023-1010](https://insights.sbomify.com/CVE-2023-1010/): vox2png vox2png.c heap-based overflow (medium 5.3)
- [CVE-2023-1009](https://insights.sbomify.com/CVE-2023-1009/): DrayTek Vigor 2960 Web Management Interface mainfunction.cgi sub_1DF14 path traversal (medium 6.5)
- [CVE-2023-1008](https://insights.sbomify.com/CVE-2023-1008/): Twister Antivirus IoControlCode filmfd.sys 0x801120E4 denial of service (medium 5.5)
- [CVE-2023-1007](https://insights.sbomify.com/CVE-2023-1007/): Twister Antivirus IoControlCode filmfd.sys 0x801120E4 access control (medium 5.3)
- [CVE-2023-1006](https://insights.sbomify.com/CVE-2023-1006/): SourceCodester Medical Certificate Generator App New Record cross site scripting (low 3.5)
- [CVE-2023-1005](https://insights.sbomify.com/CVE-2023-1005/): JP1016 Markdown-Electron code injection (medium 5.3)
- [CVE-2023-1004](https://insights.sbomify.com/CVE-2023-1004/): MarkText WSH JScript code injection (medium 5.3)
- [CVE-2023-1003](https://insights.sbomify.com/CVE-2023-1003/): Typora WSH JScript code injection (medium 5.3)
- [CVE-2023-1002](https://insights.sbomify.com/CVE-2023-1002/): MuYuCMS index.php path traversal (medium 4.3)
- [CVE-2023-1001](https://insights.sbomify.com/CVE-2023-1001/): xuliangzhan vxe-table vxe-textarea textarea.js export cross site scripting (medium 5.3)
- [CVE-2023-1000](https://insights.sbomify.com/CVE-2023-1000/): cyanomiko dcnnt-py Notification notifications.py main command injection (medium 6.3)
- [CVE-2023-0999](https://insights.sbomify.com/CVE-2023-0999/): SourceCodester Sales Tracker Management System cross-site request forgery (medium 4.3)
- [CVE-2023-0998](https://insights.sbomify.com/CVE-2023-0998/): SourceCodester Alphaware Simple E-Commerce System Payment summary.php access control (medium 6.5)
- [CVE-2023-0997](https://insights.sbomify.com/CVE-2023-0997/): SourceCodester Moosikay E-Commerce System POST Parameter order.php sql injection (high 7.3)
- [CVE-2023-0996](https://insights.sbomify.com/CVE-2023-0996/): Memory corruption in libheif (high 7.8)
- [CVE-2023-0995](https://insights.sbomify.com/CVE-2023-0995/): Cross-site Scripting (XSS) - Stored in unilogies/bumsys (medium 5.4)
- [CVE-2023-0994](https://insights.sbomify.com/CVE-2023-0994/): Exposure of Sensitive Information to an Unauthorized Actor in francoisjacquet/rosariosis (high 8.1)
- [CVE-2023-0993](https://insights.sbomify.com/CVE-2023-0993/): Shield Security <= 17.0.17 - Missing Authorization (medium 4.3)
- [CVE-2023-0992](https://insights.sbomify.com/CVE-2023-0992/): Shield Security <= 17.0.17 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2023-0989](https://insights.sbomify.com/CVE-2023-0989/): Improper Ownership Management in GitLab (medium 4.3)
- [CVE-2023-0988](https://insights.sbomify.com/CVE-2023-0988/): SourceCodester Online Pizza Ordering System cross-site request forgery (medium 4.3)
- [CVE-2023-0987](https://insights.sbomify.com/CVE-2023-0987/): SourceCodester Online Pizza Ordering System cross site scripting (low 3.5)
- [CVE-2023-0986](https://insights.sbomify.com/CVE-2023-0986/): SourceCodester Sales Tracker Management System Edit User sql injection (medium 6.3)
- [CVE-2023-0985](https://insights.sbomify.com/CVE-2023-0985/): Helmholz and MB Connect Line: Account takeover via password reset in multiple products (high 8.8)
- [CVE-2023-0983](https://insights.sbomify.com/CVE-2023-0983/): Stylish Cost Calculator Premium < 7.9.0 - Unauthenticated Stored XSS (medium 6.1)
- [CVE-2023-0982](https://insights.sbomify.com/CVE-2023-0982/): SourceCodester Yoga Class Registration System Add Class Entry sql injection (medium 6.3)
- [CVE-2023-0981](https://insights.sbomify.com/CVE-2023-0981/): SourceCodester Yoga Class Registration System Delete User sql injection (medium 6.3)
- [CVE-2023-0980](https://insights.sbomify.com/CVE-2023-0980/): SourceCodester Yoga Class Registration System Status Update update_status.php sql injection (medium 6.3)
- [CVE-2023-0979](https://insights.sbomify.com/CVE-2023-0979/): SQLi in MedDataPACS (critical 9.8)
- [CVE-2023-0978](https://insights.sbomify.com/CVE-2023-0978/): Command injection in Trellix Intelligent Sandbox (medium 6.4)
- [CVE-2023-0977](https://insights.sbomify.com/CVE-2023-0977/): Memory corruption in Trellix Agent (medium 6.7)
- [CVE-2023-0976](https://insights.sbomify.com/CVE-2023-0976/): Command injection in Trellix Agent (medium 6.3)
- [CVE-2023-0975](https://insights.sbomify.com/CVE-2023-0975/): Race condition in Trellix Agent (high 8.2)
- [CVE-2023-0973](https://insights.sbomify.com/CVE-2023-0973/): Step Tools Third-Party (low 2.2)
- [CVE-2023-0972](https://insights.sbomify.com/CVE-2023-0972/): Buffer overflow in S0 Decryption on Z/IP Gatweay (critical 9.6)
- [CVE-2023-0971](https://insights.sbomify.com/CVE-2023-0971/): Command Authentication Bypass in Z/IP Gateway (critical 9.6)
- [CVE-2023-0970](https://insights.sbomify.com/CVE-2023-0970/): Serial API Buffer Overflow in Z/IP Gateway (high 7.1)
- [CVE-2023-0969](https://insights.sbomify.com/CVE-2023-0969/): Global read overflow in Z/IP Gateway (low 3.5)
- [CVE-2023-0968](https://insights.sbomify.com/CVE-2023-0968/): Watu Quiz <= 3.3.9 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-0967](https://insights.sbomify.com/CVE-2023-0967/): Missing authorization in Bhima (medium 6.5)
- [CVE-2023-0966](https://insights.sbomify.com/CVE-2023-0966/): SourceCodester Online Eyewear Shop cross site scripting (low 2.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/420/