# Vulnerabilities published in 2023


- [CVE-2023-43662](https://insights.sbomify.com/CVE-2023-43662/): Arbitrary file read vulnerability in Shoko Server (high 8.6)
- [CVE-2023-43661](https://insights.sbomify.com/CVE-2023-43661/): Cachet vulnerable to Authenticated Remote Code Execution (critical 9.1)
- [CVE-2023-43660](https://insights.sbomify.com/CVE-2023-43660/): SSH key password bypassed in warpgate (medium 4.8)
- [CVE-2023-4366](https://insights.sbomify.com/CVE-2023-4366/): Use after free in Chrome (high 8.8)
- [CVE-2023-43659](https://insights.sbomify.com/CVE-2023-43659/): Cross-site Scripting via email preview when CSP disabled in Discourse (high 8.0)
- [CVE-2023-43658](https://insights.sbomify.com/CVE-2023-43658/): Improper escaping of user input in discourse-calendar (high 8.0)
- [CVE-2023-43657](https://insights.sbomify.com/CVE-2023-43657/): Improper escaping of encrypted topic titles can lead to Cross-site Scripting under non-default site configuration (high 7.2)
- [CVE-2023-43656](https://insights.sbomify.com/CVE-2023-43656/): Sandbox escape for instances that have enabled transformation functions in matrix-hookshot (medium 5.6)
- [CVE-2023-43655](https://insights.sbomify.com/CVE-2023-43655/): Remote Code Execution via web-accessible composer.phar (medium 6.4)
- [CVE-2023-43654](https://insights.sbomify.com/CVE-2023-43654/): TorchServe Server-Side Request Forgery (critical 10.0)
- [CVE-2023-43652](https://insights.sbomify.com/CVE-2023-43652/): Non-MFA account takeover via using only SSH public key to login in jumpserver (high 8.2)
- [CVE-2023-43651](https://insights.sbomify.com/CVE-2023-43651/): Remote code execution on the host system via MongoDB shell in jumpserver (high 8.6)
- [CVE-2023-43650](https://insights.sbomify.com/CVE-2023-43650/): Non-MFA account takeover via brute-force attack on weak password reset code in jumpserver (high 8.2)
- [CVE-2023-4365](https://insights.sbomify.com/CVE-2023-4365/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2023-43649](https://insights.sbomify.com/CVE-2023-43649/): baserCMS CSRF vulnerability in Content preview Feature (medium 4.7)
- [CVE-2023-43648](https://insights.sbomify.com/CVE-2023-43648/): baserCMS Directory Traversal vulnerability in Form submission data management Feature (medium 4.9)
- [CVE-2023-43647](https://insights.sbomify.com/CVE-2023-43647/): baserCMS Cross-site Scripting vulnerability in File upload Feature (medium 6.1)
- [CVE-2023-43646](https://insights.sbomify.com/CVE-2023-43646/): Inefficient Regular Expression Complexity in get-func-name (high 8.6)
- [CVE-2023-43645](https://insights.sbomify.com/CVE-2023-43645/): Denial of service from circular relationship definitions in OpenFGA (medium 5.9)
- [CVE-2023-43644](https://insights.sbomify.com/CVE-2023-43644/): Improper authentication in the SOCKS5 inbound in sing-box (critical 9.1)
- [CVE-2023-43643](https://insights.sbomify.com/CVE-2023-43643/): mXSS in AntiSamy (medium 6.1)
- [CVE-2023-43642](https://insights.sbomify.com/CVE-2023-43642/): Missing upper bound check on chunk length in snappy-java (high 7.5)
- [CVE-2023-43641](https://insights.sbomify.com/CVE-2023-43641/): libcue vulnerable to out-of-bounds array access (high 8.8)
- [CVE-2023-43640](https://insights.sbomify.com/CVE-2023-43640/): TaxonWorks SQL injection vulnerability (medium 6.5)
- [CVE-2023-4364](https://insights.sbomify.com/CVE-2023-4364/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2023-43637](https://insights.sbomify.com/CVE-2023-43637/): Vault Key Partially Predetermined (high 7.8)
- [CVE-2023-43636](https://insights.sbomify.com/CVE-2023-43636/): Rootfs Not Protected (high 8.8)
- [CVE-2023-43635](https://insights.sbomify.com/CVE-2023-43635/): Vault Key Sealed With SHA1 PCRs (high 8.8)
- [CVE-2023-43634](https://insights.sbomify.com/CVE-2023-43634/): Config Partition Not Protected by Measured Boot (high 8.8)
- [CVE-2023-43633](https://insights.sbomify.com/CVE-2023-43633/): Debug Functions Unlockable Without Triggering Measured Boot (high 8.8)
- [CVE-2023-43632](https://insights.sbomify.com/CVE-2023-43632/): Freely Allocate Buffer on The Stack With Data From Socket (critical 9.0)
- [CVE-2023-43631](https://insights.sbomify.com/CVE-2023-43631/): SSH as Root Unlockable Without Triggering Measured Boot (high 8.8)
- [CVE-2023-43630](https://insights.sbomify.com/CVE-2023-43630/): Config Partition Not Measured From 2 Fronts (high 8.8)
- [CVE-2023-4363](https://insights.sbomify.com/CVE-2023-4363/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2023-43629](https://insights.sbomify.com/CVE-2023-43629/): Misconfiguration in Intel(R) GPA software installers (high 7.8)
- [CVE-2023-43628](https://insights.sbomify.com/CVE-2023-43628/): Integer overflow in GPSd (medium 5.9)
- [CVE-2023-43627](https://insights.sbomify.com/CVE-2023-43627/): Path traversal in ACERA 1310 (medium 5.7)
- [CVE-2023-43626](https://insights.sbomify.com/CVE-2023-43626/): Privilege escalation in UEFI firmware for some Intel(R) Processors (high 8.7)
- [CVE-2023-43625](https://insights.sbomify.com/CVE-2023-43625/): Code injection in Simcenter Amesim (critical 9.8)
- [CVE-2023-43624](https://insights.sbomify.com/CVE-2023-43624/): XML external entity in CX-Designer (medium 5.5)
- [CVE-2023-43623](https://insights.sbomify.com/CVE-2023-43623/): Information disclosure in Mendix Forgot Password (Mendix 10 compatible) (medium 5.3)
- [CVE-2023-43622](https://insights.sbomify.com/CVE-2023-43622/): Apache HTTP Server: DoS in HTTP/2 with initial windows size 0 (high 7.5)
- [CVE-2023-43621](https://insights.sbomify.com/CVE-2023-43621/): Croc may expose secret to local users (medium 4.7)
- [CVE-2023-43620](https://insights.sbomify.com/CVE-2023-43620/): Croc sender may place ANSI or CSI escape sequences in filename to attach receiver's terminal device (high 7.8)
- [CVE-2023-4362](https://insights.sbomify.com/CVE-2023-4362/): Memory corruption in Chrome (high 8.8)
- [CVE-2023-43619](https://insights.sbomify.com/CVE-2023-43619/): Croc sender may send dangerous new files to receiver (high 7.8)
- [CVE-2023-43618](https://insights.sbomify.com/CVE-2023-43618/): Croc requires senders to provide local IP addresses in cleartext (medium 5.3)
- [CVE-2023-43617](https://insights.sbomify.com/CVE-2023-43617/): Cros secrets may be disclosed to untrusted relay (medium 5.3)
- [CVE-2023-43616](https://insights.sbomify.com/CVE-2023-43616/): Sender can cause a receiver to overwrite files during ZIP extraction in Croc (medium 5.5)
- [CVE-2023-43615](https://insights.sbomify.com/CVE-2023-43615/): Memory corruption in arm:mbed tls (high 7.5)
- [CVE-2023-43614](https://insights.sbomify.com/CVE-2023-43614/): Cross-site scripting in Welcart e-Commerce (medium 6.1)
- [CVE-2023-43612](https://insights.sbomify.com/CVE-2023-43612/): Hiview has an improper preservation of permissions vulnerability (high 8.4)
- [CVE-2023-43611](https://insights.sbomify.com/CVE-2023-43611/): BIG-IP Edge Client for macOS vulnerability (high 7.8)
- [CVE-2023-43610](https://insights.sbomify.com/CVE-2023-43610/): SQL injection in Welcart e-Commerce (high 8.8)
- [CVE-2023-4361](https://insights.sbomify.com/CVE-2023-4361/): Security feature bypass in Chrome (medium 5.3)
- [CVE-2023-43609](https://insights.sbomify.com/CVE-2023-43609/): Emerson Rosemount GC370XA, GC700XA, GC1500XA Improper Authorization (medium 6.9)
- [CVE-2023-43608](https://insights.sbomify.com/CVE-2023-43608/): Security feature bypass in Buildroot (high 8.1)
- [CVE-2023-4360](https://insights.sbomify.com/CVE-2023-4360/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2023-43591](https://insights.sbomify.com/CVE-2023-43591/): Privilege escalation in Zoom Rooms for macOS (high 7.8)
- [CVE-2023-43590](https://insights.sbomify.com/CVE-2023-43590/): Privilege escalation in Zoom Rooms for macOS (high 7.8)
- [CVE-2023-4359](https://insights.sbomify.com/CVE-2023-4359/): Security feature bypass in Chrome (medium 5.3)
- [CVE-2023-43588](https://insights.sbomify.com/CVE-2023-43588/): Information disclosure in Zoom Clients (low 3.5)
- [CVE-2023-43586](https://insights.sbomify.com/CVE-2023-43586/): Path traversal in Zoom Desktop Client for Windows, Zoom VDI Client for Windows and Zoom SDKs for Windows (high 7.3)
- [CVE-2023-43585](https://insights.sbomify.com/CVE-2023-43585/): Information disclosure in Zoom Mobile App for iOS and SDKs for iOS (high 7.1)
- [CVE-2023-43583](https://insights.sbomify.com/CVE-2023-43583/): Hardcoded credentials in Zoom Mobile App for Android, Zoom Mobile App for iOS and Zoom SDK (medium 4.9)
- [CVE-2023-43582](https://insights.sbomify.com/CVE-2023-43582/): Privilege escalation in Zoom Clients (medium 5.5)
- [CVE-2023-43581](https://insights.sbomify.com/CVE-2023-43581/): Memory corruption in Desktop BIOS (medium 6.7)
- [CVE-2023-43580](https://insights.sbomify.com/CVE-2023-43580/): Memory corruption in Desktop BIOS (medium 6.7)
- [CVE-2023-4358](https://insights.sbomify.com/CVE-2023-4358/): Use after free in Chrome (high 8.8)
- [CVE-2023-43579](https://insights.sbomify.com/CVE-2023-43579/): Memory corruption in Desktop BIOS (medium 6.7)
- [CVE-2023-43578](https://insights.sbomify.com/CVE-2023-43578/): Memory corruption in Desktop BIOS (medium 6.7)
- [CVE-2023-43577](https://insights.sbomify.com/CVE-2023-43577/): Memory corruption in Desktop BIOS (medium 6.7)
- [CVE-2023-43576](https://insights.sbomify.com/CVE-2023-43576/): Memory corruption in Desktop BIOS (medium 6.7)
- [CVE-2023-43575](https://insights.sbomify.com/CVE-2023-43575/): Memory corruption in Desktop BIOS (medium 6.7)
- [CVE-2023-43574](https://insights.sbomify.com/CVE-2023-43574/): Memory corruption in Desktop BIOS (medium 4.4)
- [CVE-2023-43573](https://insights.sbomify.com/CVE-2023-43573/): Memory corruption in Desktop BIOS (medium 6.7)
- [CVE-2023-43572](https://insights.sbomify.com/CVE-2023-43572/): Memory corruption in Desktop BIOS (medium 4.4)
- [CVE-2023-43571](https://insights.sbomify.com/CVE-2023-43571/): Memory corruption in Desktop BIOS (medium 6.7)
- [CVE-2023-43570](https://insights.sbomify.com/CVE-2023-43570/): Code injection in Desktop BIOS (medium 6.7)
- [CVE-2023-4357](https://insights.sbomify.com/CVE-2023-4357/): Security feature bypass in Chrome (high 8.8)
- [CVE-2023-43569](https://insights.sbomify.com/CVE-2023-43569/): Memory corruption in Desktop BIOS (medium 6.7)
- [CVE-2023-43568](https://insights.sbomify.com/CVE-2023-43568/): Memory corruption in Desktop BIOS (medium 4.4)
- [CVE-2023-43567](https://insights.sbomify.com/CVE-2023-43567/): Memory corruption in Desktop BIOS (medium 6.7)
- [CVE-2023-43566](https://insights.sbomify.com/CVE-2023-43566/): Cross-site scripting in TeamCity (low 3.5)
- [CVE-2023-4356](https://insights.sbomify.com/CVE-2023-4356/): Use after free in Chrome (high 8.8)
- [CVE-2023-43556](https://insights.sbomify.com/CVE-2023-43556/): Buffer Copy Without Checking Size of Input in Hypervisor (critical 9.3)
- [CVE-2023-43555](https://insights.sbomify.com/CVE-2023-43555/): Buffer Over-read in Video (high 8.2)
- [CVE-2023-43554](https://insights.sbomify.com/CVE-2023-43554/): Improper Restriction of Operations withing the Bounds of a Memory Buffer in DSP Services (high 8.4)
- [CVE-2023-43553](https://insights.sbomify.com/CVE-2023-43553/): Use of Out-of-range Pointer Offset in WLAN HOST (critical 9.8)
- [CVE-2023-43552](https://insights.sbomify.com/CVE-2023-43552/): Use After Free in WLAN Host Communication (critical 9.8)
- [CVE-2023-43551](https://insights.sbomify.com/CVE-2023-43551/): Improper Authentication in Multi-Mode Call Processor (critical 9.1)
- [CVE-2023-43550](https://insights.sbomify.com/CVE-2023-43550/): Integer Overflow or Wraparound in Core Services (high 7.8)
- [CVE-2023-4355](https://insights.sbomify.com/CVE-2023-4355/): Memory corruption in Chrome (high 8.8)
- [CVE-2023-43549](https://insights.sbomify.com/CVE-2023-43549/): Stack-based Buffer Overflow in WLAN HAL (high 8.4)
- [CVE-2023-43548](https://insights.sbomify.com/CVE-2023-43548/): Buffer Copy Without Checking Size of Input in Video (high 7.3)
- [CVE-2023-43547](https://insights.sbomify.com/CVE-2023-43547/): Use After Free in Automotive Multimedia (high 8.4)
- [CVE-2023-43546](https://insights.sbomify.com/CVE-2023-43546/): Use After Free in Automotive Multimedia (high 8.4)
- [CVE-2023-43545](https://insights.sbomify.com/CVE-2023-43545/): Integer Overflow or Wraparound in WLAN HOST (medium 6.7)
- [CVE-2023-43544](https://insights.sbomify.com/CVE-2023-43544/): Use After Free in Audio (medium 6.7)
- [CVE-2023-43543](https://insights.sbomify.com/CVE-2023-43543/): Use After Free in Audio (medium 6.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/223/