# Vulnerabilities published in 2023


- [CVE-2023-0861](https://insights.sbomify.com/CVE-2023-0861/): Authenticated Command Injection in NetModule NSRW (high 7.2)
- [CVE-2023-0860](https://insights.sbomify.com/CVE-2023-0860/): Improper Restriction of Excessive Authentication Attempts in modoboa/modoboa-installer (high 7.8)
- [CVE-2023-0859](https://insights.sbomify.com/CVE-2023-0859/): Other in Canon Office/Small Office Multifunction Printers and Laser Printers (low 2.2)
- [CVE-2023-0858](https://insights.sbomify.com/CVE-2023-0858/): Auth bypass in Canon Office/Small Office Multifunction Printers and Laser Printers (low 3.1)
- [CVE-2023-0857](https://insights.sbomify.com/CVE-2023-0857/): Auth bypass in Canon Office/Small Office Multifunction Printers and Laser Printers (medium 5.9)
- [CVE-2023-0856](https://insights.sbomify.com/CVE-2023-0856/): Memory corruption in Canon Office/Small Office Multifunction Printers and Laser Printers (critical 9.8)
- [CVE-2023-0855](https://insights.sbomify.com/CVE-2023-0855/): Memory corruption in Canon Office/Small Office Multifunction Printers and Laser Printers (critical 9.8)
- [CVE-2023-0854](https://insights.sbomify.com/CVE-2023-0854/): Memory corruption in Canon Office/Small Office Multifunction Printers and Laser Printers (critical 9.8)
- [CVE-2023-0853](https://insights.sbomify.com/CVE-2023-0853/): Memory corruption in Canon Office/Small Office Multifunction Printers and Laser Printers (critical 9.8)
- [CVE-2023-0852](https://insights.sbomify.com/CVE-2023-0852/): Memory corruption in Canon Office/Small Office Multifunction Printers and Laser Printers (critical 9.8)
- [CVE-2023-0851](https://insights.sbomify.com/CVE-2023-0851/): Memory corruption in Canon Office/Small Office Multifunction Printers and Laser Printers (critical 9.8)
- [CVE-2023-0850](https://insights.sbomify.com/CVE-2023-0850/): Netgear WNDR3700v2 Web Interface denial of service (low 2.7)
- [CVE-2023-0849](https://insights.sbomify.com/CVE-2023-0849/): Netgear WNDR3700v2 Web Interface command injection (medium 4.7)
- [CVE-2023-0848](https://insights.sbomify.com/CVE-2023-0848/): Netgear WNDR3700v2 Web Management Interface denial of service (medium 5.3)
- [CVE-2023-0847](https://insights.sbomify.com/CVE-2023-0847/): Memory corruption in DASH 7 Alliance Protocol stack implementation (medium 5.3)
- [CVE-2023-0846](https://insights.sbomify.com/CVE-2023-0846/): Unauthenticated, stored XSS in display of alarm reduction-key (medium 6.7)
- [CVE-2023-0845](https://insights.sbomify.com/CVE-2023-0845/): Consul Server Panic when Ingress and API Gateways Configured with Peering (medium 4.9)
- [CVE-2023-0844](https://insights.sbomify.com/CVE-2023-0844/): Namaste! LMS < 2.6 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-0842](https://insights.sbomify.com/CVE-2023-0842/): xml2js 0.4.23 - Prototype Pollution (medium 5.3)
- [CVE-2023-0841](https://insights.sbomify.com/CVE-2023-0841/): GPAC reframe_mp3.c mp3_dmx_process heap-based overflow (medium 6.3)
- [CVE-2023-0840](https://insights.sbomify.com/CVE-2023-0840/): PHPCrazy cross site scripting (low 3.5)
- [CVE-2023-0839](https://insights.sbomify.com/CVE-2023-0839/): Improper Error Handling in inSCADA (critical 9.8)
- [CVE-2023-0838](https://insights.sbomify.com/CVE-2023-0838/): Information disclosure in GitLab (medium 5.5)
- [CVE-2023-0837](https://insights.sbomify.com/CVE-2023-0837/): Missing authorization in Remote (medium 6.6)
- [CVE-2023-0836](https://insights.sbomify.com/CVE-2023-0836/): Information disclosure in HAProxy (high 7.5)
- [CVE-2023-0835](https://insights.sbomify.com/CVE-2023-0835/): markdown-pdf 11.0.0 - Local File Read via Server Side XSS (high 8.2)
- [CVE-2023-0834](https://insights.sbomify.com/CVE-2023-0834/): Privilege escalation in Workforce Access (high 7.0)
- [CVE-2023-0833](https://insights.sbomify.com/CVE-2023-0833/): Red hat a-mq streams: component version with information disclosure flaw (medium 4.7)
- [CVE-2023-0832](https://insights.sbomify.com/CVE-2023-0832/): Under Construction <= 3.96 - Cross-Site Request Forgery via admin_action_install_weglot (medium 4.3)
- [CVE-2023-0831](https://insights.sbomify.com/CVE-2023-0831/): Under Construction <= 3.96 - Cross-Site Request Forgery via admin_action_ucp_dismiss_notice (medium 4.3)
- [CVE-2023-0830](https://insights.sbomify.com/CVE-2023-0830/): EasyNAS backup.pl system os command injection (medium 5.3)
- [CVE-2023-0829](https://insights.sbomify.com/CVE-2023-0829/): Cross-Site Scripting (XSS) vulnerability in Plesk (high 8.8)
- [CVE-2023-0828](https://insights.sbomify.com/CVE-2023-0828/): Stored Cross Site Scripting in syslog section (medium 6.7)
- [CVE-2023-0827](https://insights.sbomify.com/CVE-2023-0827/): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (medium 6.3)
- [CVE-2023-0824](https://insights.sbomify.com/CVE-2023-0824/): UserPlus <= 2.0 - Stored XSS via CSRF (high 7.4)
- [CVE-2023-0823](https://insights.sbomify.com/CVE-2023-0823/): Cookie Notice & Compliance for GDPR / CCPA < 2.4.7 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2023-0822](https://insights.sbomify.com/CVE-2023-0822/): Improper Authorization (high 8.8)
- [CVE-2023-0821](https://insights.sbomify.com/CVE-2023-0821/): Nomad Client Vulnerable to Decompression Bombs in Artifact Block (medium 6.5)
- [CVE-2023-0820](https://insights.sbomify.com/CVE-2023-0820/): User Role by BestWebSoft < 1.6.7 - Privilege Escalation via CSRF (high 8.8)
- [CVE-2023-0819](https://insights.sbomify.com/CVE-2023-0819/): Heap-based Buffer Overflow in gpac/gpac (high 7.8)
- [CVE-2023-0818](https://insights.sbomify.com/CVE-2023-0818/): Off-by-one Error in gpac/gpac (high 7.1)
- [CVE-2023-0817](https://insights.sbomify.com/CVE-2023-0817/): Buffer Over-read in gpac/gpac (high 7.3)
- [CVE-2023-0816](https://insights.sbomify.com/CVE-2023-0816/): Formidable Forms < 6.1 - IP Spoofing (medium 6.5)
- [CVE-2023-0815](https://insights.sbomify.com/CVE-2023-0815/): Plaintext Password Present in the Web logs (medium 6.8)
- [CVE-2023-0814](https://insights.sbomify.com/CVE-2023-0814/): Profile Builder – User Profile & User Registration Forms <= 3.9.0 - Sensitive Information Disclosure via Shortcode (medium 6.5)
- [CVE-2023-0813](https://insights.sbomify.com/CVE-2023-0813/): Auth bypass in NETWORK-OBSERVABILITY-1.1.0-RHEL-8 (high 7.5)
- [CVE-2023-0812](https://insights.sbomify.com/CVE-2023-0812/): Active Directory Integration / LDAP Integration < 4.1.1 - Unauthenticated Data Disclosure (high 7.5)
- [CVE-2023-0811](https://insights.sbomify.com/CVE-2023-0811/): Missing authorization in CJ1M SYSMAC CJ-series (critical 9.1)
- [CVE-2023-0810](https://insights.sbomify.com/CVE-2023-0810/): Cross-site Scripting (XSS) - Stored in btcpayserver/btcpayserver (high 8.8)
- [CVE-2023-0809](https://insights.sbomify.com/CVE-2023-0809/): Denial of service in Mosquitto (medium 5.8)
- [CVE-2023-0808](https://insights.sbomify.com/CVE-2023-0808/): Deye/Revolt/Bosswerk Inverter Access Point Setting hard-coded password (low 3.9)
- [CVE-2023-0805](https://insights.sbomify.com/CVE-2023-0805/): Missing authorization in GitLab (medium 4.9)
- [CVE-2023-0804](https://insights.sbomify.com/CVE-2023-0804/): Memory corruption in libtiff (medium 6.8)
- [CVE-2023-0803](https://insights.sbomify.com/CVE-2023-0803/): Memory corruption in libtiff (medium 6.8)
- [CVE-2023-0802](https://insights.sbomify.com/CVE-2023-0802/): Memory corruption in libtiff (medium 6.8)
- [CVE-2023-0801](https://insights.sbomify.com/CVE-2023-0801/): Memory corruption in libtiff (medium 6.8)
- [CVE-2023-0800](https://insights.sbomify.com/CVE-2023-0800/): Memory corruption in libtiff (medium 6.8)
- [CVE-2023-0799](https://insights.sbomify.com/CVE-2023-0799/): Memory corruption in libtiff (medium 6.8)
- [CVE-2023-0798](https://insights.sbomify.com/CVE-2023-0798/): Memory corruption in libtiff (medium 6.8)
- [CVE-2023-0797](https://insights.sbomify.com/CVE-2023-0797/): Memory corruption in libtiff (medium 6.8)
- [CVE-2023-0796](https://insights.sbomify.com/CVE-2023-0796/): Memory corruption in libtiff (medium 6.8)
- [CVE-2023-0795](https://insights.sbomify.com/CVE-2023-0795/): Memory corruption in libtiff (medium 6.8)
- [CVE-2023-0794](https://insights.sbomify.com/CVE-2023-0794/): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (high 8.3)
- [CVE-2023-0793](https://insights.sbomify.com/CVE-2023-0793/): Weak Password Requirements in thorsten/phpmyfaq (high 7.1)
- [CVE-2023-0792](https://insights.sbomify.com/CVE-2023-0792/): Code Injection in thorsten/phpmyfaq (medium 6.5)
- [CVE-2023-0791](https://insights.sbomify.com/CVE-2023-0791/): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (high 8.3)
- [CVE-2023-0790](https://insights.sbomify.com/CVE-2023-0790/): Uncaught Exception in thorsten/phpmyfaq (high 7.6)
- [CVE-2023-0789](https://insights.sbomify.com/CVE-2023-0789/): Command Injection in thorsten/phpmyfaq (high 8.1)
- [CVE-2023-0788](https://insights.sbomify.com/CVE-2023-0788/): Code Injection in thorsten/phpmyfaq (high 8.1)
- [CVE-2023-0787](https://insights.sbomify.com/CVE-2023-0787/): Cross-site Scripting (XSS) - Generic in thorsten/phpmyfaq (high 8.1)
- [CVE-2023-0786](https://insights.sbomify.com/CVE-2023-0786/): Cross-site Scripting (XSS) - Generic in thorsten/phpmyfaq (high 8.4)
- [CVE-2023-0785](https://insights.sbomify.com/CVE-2023-0785/): SourceCodester Best Online News Portal check_availability.php information exposure (low 3.7)
- [CVE-2023-0784](https://insights.sbomify.com/CVE-2023-0784/): SourceCodester Best Online News Portal Login Page sql injection (high 7.3)
- [CVE-2023-0783](https://insights.sbomify.com/CVE-2023-0783/): EcShop PHP File template.php unrestricted upload (medium 4.7)
- [CVE-2023-0782](https://insights.sbomify.com/CVE-2023-0782/): Tenda AC23 httpd formGetSysToolDDNS out-of-bounds write (high 7.2)
- [CVE-2023-0781](https://insights.sbomify.com/CVE-2023-0781/): SourceCodester Canteen Management System removeOrder.php query sql injection (medium 6.3)
- [CVE-2023-0780](https://insights.sbomify.com/CVE-2023-0780/): Improper Restriction of Rendered UI Layers or Frames in cockpit-hq/cockpit (medium 4.0)
- [CVE-2023-0779](https://insights.sbomify.com/CVE-2023-0779/): net: shell: Improper input validation (medium 6.7)
- [CVE-2023-0778](https://insights.sbomify.com/CVE-2023-0778/): Podman Time-of-check Time-of-use (TOCTOU) Race Condition (medium 6.8)
- [CVE-2023-0777](https://insights.sbomify.com/CVE-2023-0777/): Authentication Bypass by Primary Weakness in modoboa/modoboa (high 8.6)
- [CVE-2023-0776](https://insights.sbomify.com/CVE-2023-0776/): Remote Code Execution in Baicells QRTB Platform (high 8.1)
- [CVE-2023-0775](https://insights.sbomify.com/CVE-2023-0775/): Bluetooth LE Invalid prepare write request command leads to denial of service (medium 6.5)
- [CVE-2023-0774](https://insights.sbomify.com/CVE-2023-0774/): SourceCodester Medical Certificate Generator App action.php sql injection (high 7.3)
- [CVE-2023-0773](https://insights.sbomify.com/CVE-2023-0773/): Unauthorized Access Control Vulnerability in Uniview IP Camera (critical 9.1)
- [CVE-2023-0772](https://insights.sbomify.com/CVE-2023-0772/): Popup Builder by OptinMonster < 2.12.2 - Subscriber+ Arbitrary Post Content Disclosure (medium 6.5)
- [CVE-2023-0771](https://insights.sbomify.com/CVE-2023-0771/): SQL Injection in ampache/ampache (high 7.2)
- [CVE-2023-0770](https://insights.sbomify.com/CVE-2023-0770/): Stack-based Buffer Overflow in gpac/gpac (high 7.8)
- [CVE-2023-0769](https://insights.sbomify.com/CVE-2023-0769/): hiWeb Migration Simple <= 2.0.0.1 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-0768](https://insights.sbomify.com/CVE-2023-0768/): Avirato hotels online booking engine <= 5.0.5 - Subscriber+ SQLi (high 8.8)
- [CVE-2023-0767](https://insights.sbomify.com/CVE-2023-0767/): Memory corruption in Firefox (high 8.8)
- [CVE-2023-0766](https://insights.sbomify.com/CVE-2023-0766/): Newsletter Popup <= 1.2 - Record Deletion via CSRF (high 8.8)
- [CVE-2023-0765](https://insights.sbomify.com/CVE-2023-0765/): Gallery by BestWebSoft < 4.7.0 - Author+ SQL Injection (high 8.8)
- [CVE-2023-0764](https://insights.sbomify.com/CVE-2023-0764/): Gallery by BestWebSoft < 4.7.0 - Author+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2023-0763](https://insights.sbomify.com/CVE-2023-0763/): Clock In Portal <= 2.1 - Holidays Deletion via CSRF (medium 4.3)
- [CVE-2023-0762](https://insights.sbomify.com/CVE-2023-0762/): Clock In Portal <= 2.1 - Designation Deletion via CSRF (medium 4.3)
- [CVE-2023-0761](https://insights.sbomify.com/CVE-2023-0761/): Clock In Portal <= 2.1 - Staff Deletion via CSRF (medium 4.3)
- [CVE-2023-0760](https://insights.sbomify.com/CVE-2023-0760/): Heap-based Buffer Overflow in gpac/gpac (high 7.3)
- [CVE-2023-0759](https://insights.sbomify.com/CVE-2023-0759/): Privilege Chaining in cockpit-hq/cockpit (medium 5.3)
- [CVE-2023-0758](https://insights.sbomify.com/CVE-2023-0758/): glorylion JFinalOA SysOrg.java sql injection (medium 6.3)
- [CVE-2023-0757](https://insights.sbomify.com/CVE-2023-0757/): Phoenix Contact ProConOS prone to Incorrect Permission Assignment for Critical Resource (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/422/