# Vulnerabilities published in 2023


- [CVE-2023-47145](https://insights.sbomify.com/CVE-2023-47145/): IBM Db2 for Windows privilege escalation (high 8.4)
- [CVE-2023-47144](https://insights.sbomify.com/CVE-2023-47144/): IBM Tivoli Application Dependency Discovery Manager cross-site scripting (medium 6.1)
- [CVE-2023-47143](https://insights.sbomify.com/CVE-2023-47143/): IBM Tivoli Application Dependency Discovery Manager HOST header injection (critical 10.0)
- [CVE-2023-47142](https://insights.sbomify.com/CVE-2023-47142/): IBM Tivoli Application Dependency Discovery Manager privilege escalation (high 7.5)
- [CVE-2023-47141](https://insights.sbomify.com/CVE-2023-47141/): IBM Db2 denial of service (medium 5.3)
- [CVE-2023-47140](https://insights.sbomify.com/CVE-2023-47140/): IBM CICS Transaction Gateway improper access controls (medium 4.0)
- [CVE-2023-4714](https://insights.sbomify.com/CVE-2023-4714/): PlayTube Redirect information disclosure (medium 4.3)
- [CVE-2023-47132](https://insights.sbomify.com/CVE-2023-47132/): Privilege escalation in n-able:n-central (critical 9.8)
- [CVE-2023-47131](https://insights.sbomify.com/CVE-2023-47131/): Information disclosure in n-able:passportal (high 7.5)
- [CVE-2023-47130](https://insights.sbomify.com/CVE-2023-47130/): Unsafe deserialization of user data in yiisoft/yii (high 8.1)
- [CVE-2023-4713](https://insights.sbomify.com/CVE-2023-4713/): IBOS OA addcomment addComment sql injection (medium 5.5)
- [CVE-2023-47129](https://insights.sbomify.com/CVE-2023-47129/): Statamic CMS remote code execution via front-end form uploads (high 8.4)
- [CVE-2023-47128](https://insights.sbomify.com/CVE-2023-47128/): piccolo SQL Injection via named transaction savepoints (critical 9.1)
- [CVE-2023-47127](https://insights.sbomify.com/CVE-2023-47127/): Weak Authentication in Session Handling in typo3/cms-core (medium 4.2)
- [CVE-2023-47126](https://insights.sbomify.com/CVE-2023-47126/): Information Disclosure in Install Tool in typo3/cms-install (low 3.7)
- [CVE-2023-47125](https://insights.sbomify.com/CVE-2023-47125/): By-passing Cross-Site Scripting Protection in HTML Sanitizer (medium 4.7)
- [CVE-2023-47124](https://insights.sbomify.com/CVE-2023-47124/): Denial of service whith ACME HTTPChallenge in Traefik (medium 5.9)
- [CVE-2023-47123](https://insights.sbomify.com/CVE-2023-47123/): iTop vulnerable to XSS vulnerability in n:n relations "tagset" widget (high 8.7)
- [CVE-2023-47122](https://insights.sbomify.com/CVE-2023-47122/): Gitsign's Rekor public keys fetched from upstream API instead of local TUF client. (medium 4.2)
- [CVE-2023-47121](https://insights.sbomify.com/CVE-2023-47121/): Discourse SSRF vulnerability in Embedding (low 3.4)
- [CVE-2023-47120](https://insights.sbomify.com/CVE-2023-47120/): Discourse DoS through Onebox favicon URL (high 7.5)
- [CVE-2023-4712](https://insights.sbomify.com/CVE-2023-4712/): Xintian Smart Table Integrated Management System AddUpdateRole.aspx sql injection (medium 5.5)
- [CVE-2023-47119](https://insights.sbomify.com/CVE-2023-47119/): HTML injection in oneboxed links (medium 5.3)
- [CVE-2023-47118](https://insights.sbomify.com/CVE-2023-47118/): Heap buffer overflow in T64 codec decompression (high 7.0)
- [CVE-2023-47117](https://insights.sbomify.com/CVE-2023-47117/): Object Relational Mapper Leak Vulnerability in Filtering Task in Label Studio (high 7.5)
- [CVE-2023-47116](https://insights.sbomify.com/CVE-2023-47116/): Label Studio SSRF on Import Bypassing `SSRF_PROTECTION_ENABLED` Protections (medium 5.3)
- [CVE-2023-47115](https://insights.sbomify.com/CVE-2023-47115/): Label Studio XSS Vulnerability on Avatar Upload (high 7.1)
- [CVE-2023-47114](https://insights.sbomify.com/CVE-2023-47114/): Ethyca Fides HTML Injection Vulnerability in HTML-Formatted DSR Packages (medium 4.3)
- [CVE-2023-47113](https://insights.sbomify.com/CVE-2023-47113/): DLL Search Order Hijacking vulnerability in BleachBit for Windows (high 7.3)
- [CVE-2023-47112](https://insights.sbomify.com/CVE-2023-47112/): Authenticated users can view job names and groups they do not have authorization to view in Rundeck (medium 4.3)
- [CVE-2023-47111](https://insights.sbomify.com/CVE-2023-47111/): ZITADEL race condition in lockout policy execution (high 7.3)
- [CVE-2023-47110](https://insights.sbomify.com/CVE-2023-47110/): Any value can be changed in the configuration table by an employee having access to block reassurance module (critical 9.1)
- [CVE-2023-4711](https://insights.sbomify.com/CVE-2023-4711/): D-Link DAR-8000-10 decodmail.php os command injection (medium 5.0)
- [CVE-2023-47109](https://insights.sbomify.com/CVE-2023-47109/): PrestaShop blockreassurance BO User can remove any file from server when adding a and deleting a block (medium 5.5)
- [CVE-2023-47108](https://insights.sbomify.com/CVE-2023-47108/): DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics (high 7.5)
- [CVE-2023-47107](https://insights.sbomify.com/CVE-2023-47107/): PILOS account takeover through password reset poisoning (high 8.8)
- [CVE-2023-47106](https://insights.sbomify.com/CVE-2023-47106/): Incorrect processing of fragment in the URL leads to Authorization Bypass in Traefik (medium 4.8)
- [CVE-2023-47105](https://insights.sbomify.com/CVE-2023-47105/): Chaosblade vulnerable to OS command execution (high 8.6)
- [CVE-2023-47104](https://insights.sbomify.com/CVE-2023-47104/): Command injection in vareille:tinyfiledialogs (critical 9.8)
- [CVE-2023-47102](https://insights.sbomify.com/CVE-2023-47102/): Information disclosure in urbackup:urbackup server (medium 5.3)
- [CVE-2023-47101](https://insights.sbomify.com/CVE-2023-47101/): Privilege escalation in securepoint:openvpn-client (high 7.8)
- [CVE-2023-4710](https://insights.sbomify.com/CVE-2023-4710/): TOTVS RM Portal cross site scripting (medium 4.3)
- [CVE-2023-47099](https://insights.sbomify.com/CVE-2023-47099/): Cross-site scripting in virtualmin:virtualmin (medium 5.4)
- [CVE-2023-47098](https://insights.sbomify.com/CVE-2023-47098/): Cross-site scripting in virtualmin:virtualmin (medium 4.8)
- [CVE-2023-47097](https://insights.sbomify.com/CVE-2023-47097/): Cross-site scripting in virtualmin:virtualmin (medium 5.4)
- [CVE-2023-47096](https://insights.sbomify.com/CVE-2023-47096/): Cross-site scripting in virtualmin:virtualmin (medium 5.4)
- [CVE-2023-47095](https://insights.sbomify.com/CVE-2023-47095/): Cross-site scripting in virtualmin:virtualmin (medium 5.4)
- [CVE-2023-47094](https://insights.sbomify.com/CVE-2023-47094/): Cross-site scripting in virtualmin:virtualmin (medium 5.4)
- [CVE-2023-47093](https://insights.sbomify.com/CVE-2023-47093/): Denial of service in stormshield:stormshield network security (medium 6.5)
- [CVE-2023-47091](https://insights.sbomify.com/CVE-2023-47091/): Denial of service in stormshield:stormshield network security (high 7.5)
- [CVE-2023-47090](https://insights.sbomify.com/CVE-2023-47090/): NATS.io: Adding accounts for just the system account adds auth bypass (medium 6.5)
- [CVE-2023-4709](https://insights.sbomify.com/CVE-2023-4709/): TOTVS RM Portal Login.aspx cross site scripting (low 2.3)
- [CVE-2023-47081](https://insights.sbomify.com/CVE-2023-47081/): Adobe Substance 3D Stager v2.1.1 Vulnerability II (medium 5.5)
- [CVE-2023-47080](https://insights.sbomify.com/CVE-2023-47080/): Adobe Substance 3D Stager v2.1.1 Vulnerability VI (medium 5.5)
- [CVE-2023-4708](https://insights.sbomify.com/CVE-2023-4708/): Infosoftbd Clcknshop GET Parameter all sql injection (medium 6.3)
- [CVE-2023-47079](https://insights.sbomify.com/CVE-2023-47079/): ZDI-CAN-22279: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-47078](https://insights.sbomify.com/CVE-2023-47078/): ZDI-CAN-22249: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-47077](https://insights.sbomify.com/CVE-2023-47077/): Adobe InDesign CC 2023 Memory Corruption Vulnerability VI. (medium 5.5)
- [CVE-2023-47076](https://insights.sbomify.com/CVE-2023-47076/): Adobe InDesign CC 2023 Memory Corruption Vulnerability IV. (medium 5.5)
- [CVE-2023-47075](https://insights.sbomify.com/CVE-2023-47075/): ZDI-CAN-22006: Adobe Illustrator JP2 File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-47074](https://insights.sbomify.com/CVE-2023-47074/): ZDI-CAN-21812: Adobe Illustrator JP2 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-47073](https://insights.sbomify.com/CVE-2023-47073/): ZDI-CAN-21709: Adobe After Effects MP4 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-47072](https://insights.sbomify.com/CVE-2023-47072/): ZDI-CAN-21790: Adobe After Effects MP4 File Uninitialized Variable Information Disclosure Vulnerability (low 3.3)
- [CVE-2023-47071](https://insights.sbomify.com/CVE-2023-47071/): ZDI-CAN-21704: Adobe After Effects MP4 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-47070](https://insights.sbomify.com/CVE-2023-47070/): ZDI-CAN-21708: Adobe After Effects MP4 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-4707](https://insights.sbomify.com/CVE-2023-4707/): Infosoftbd Clcknshop all cross site scripting (low 3.5)
- [CVE-2023-47069](https://insights.sbomify.com/CVE-2023-47069/): ZDI-CAN-21703: Adobe After Effects M4A File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-47068](https://insights.sbomify.com/CVE-2023-47068/): ZDI-CAN-21702: Adobe After Effects MP4 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-47067](https://insights.sbomify.com/CVE-2023-47067/): ZDI-CAN-21706: Adobe After Effects MP4 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-47066](https://insights.sbomify.com/CVE-2023-47066/): ZDI-CAN-21705: Adobe After Effects MP4 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-47065](https://insights.sbomify.com/CVE-2023-47065/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2023-47064](https://insights.sbomify.com/CVE-2023-47064/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2023-47063](https://insights.sbomify.com/CVE-2023-47063/): Adobe Illustrator 2023 CC 27.7 Memory Corruption Out-Of-Bounds-Write Vulnerability IV. (high 7.8)
- [CVE-2023-47062](https://insights.sbomify.com/CVE-2023-47062/): ZDI-CAN-22284: Adobe Dimension GLTF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-47061](https://insights.sbomify.com/CVE-2023-47061/): ZDI-CAN-22278: Adobe Dimension GLB File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-47060](https://insights.sbomify.com/CVE-2023-47060/): ZDI-CAN-21792: Adobe Premiere Pro MP4 File Uninitialized Variable Information Disclosure Vulnerability (low 3.3)
- [CVE-2023-4706](https://insights.sbomify.com/CVE-2023-4706/): Privilege escalation in 1Lenovo Preload Directory (high 7.3)
- [CVE-2023-47059](https://insights.sbomify.com/CVE-2023-47059/): ZDI-CAN-21767: Adobe Premiere Pro MP4 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-47058](https://insights.sbomify.com/CVE-2023-47058/): ZDI-CAN-21766: Adobe Premiere Pro MP4 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-47057](https://insights.sbomify.com/CVE-2023-47057/): ZDI-CAN-21764: Adobe Premiere Pro MP4 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-47056](https://insights.sbomify.com/CVE-2023-47056/): ZDI-CAN-21763: Adobe Premiere Pro MP4 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-47055](https://insights.sbomify.com/CVE-2023-47055/): ZDI-CAN-21765: Adobe Premiere Pro M4A File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-47054](https://insights.sbomify.com/CVE-2023-47054/): ZDI-CAN-21782: Adobe Audition MP4 File Parsing Uninitialized Variable Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-47053](https://insights.sbomify.com/CVE-2023-47053/): ZDI-CAN-21689: Adobe Audition MP4 File Parsing Uninitialized Variable Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-47052](https://insights.sbomify.com/CVE-2023-47052/): ZDI-CAN-21687: Adobe Audition MP4 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-47051](https://insights.sbomify.com/CVE-2023-47051/): ZDI-CAN-21683: Adobe Audition MP4 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (medium 5.5)
- [CVE-2023-47050](https://insights.sbomify.com/CVE-2023-47050/): ZDI-CAN-21686: Adobe Audition M4A File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (medium 5.5)
- [CVE-2023-47049](https://insights.sbomify.com/CVE-2023-47049/): ZDI-CAN-21690: Adobe Audition MP4 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (medium 5.5)
- [CVE-2023-47048](https://insights.sbomify.com/CVE-2023-47048/): ZDI-CAN-21688: Adobe Audition MP4 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (medium 5.5)
- [CVE-2023-47047](https://insights.sbomify.com/CVE-2023-47047/): ZDI-CAN-21685: Adobe Audition MP4 File Parsing Uninitialized Variable Remote Code Execution Vulnerability (medium 5.5)
- [CVE-2023-47046](https://insights.sbomify.com/CVE-2023-47046/): ZDI-CAN-21684: Adobe Audition MP4 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (medium 5.5)
- [CVE-2023-47044](https://insights.sbomify.com/CVE-2023-47044/): ZDI-CAN-21789: Adobe Media Encoder MP4 File Uninitialized Variable Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-47043](https://insights.sbomify.com/CVE-2023-47043/): ZDI-CAN-21699: Adobe Media Encoder MP4 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-47042](https://insights.sbomify.com/CVE-2023-47042/): ZDI-CAN-21696: Adobe Media Encoder MP4 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-47041](https://insights.sbomify.com/CVE-2023-47041/): ZDI-CAN-21697: Adobe Media Encoder MP4 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-47040](https://insights.sbomify.com/CVE-2023-47040/): ZDI-CAN-21698: Adobe Media Encoder MP4 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-4704](https://insights.sbomify.com/CVE-2023-4704/): External Control of System or Configuration Setting in instantsoft/icms2 (high 8.8)
- [CVE-2023-47039](https://insights.sbomify.com/CVE-2023-47039/): Perl: perl for windows binary hijacking vulnerability (high 7.8)
- [CVE-2023-47038](https://insights.sbomify.com/CVE-2023-47038/): Perl: write past buffer end via illegal user-defined unicode property (high 7.0)
- [CVE-2023-47037](https://insights.sbomify.com/CVE-2023-47037/): Apache Airflow missing fix for CVE-2023-40611 in 2.7.1 (DAG run broken access) (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/199/