# Vulnerabilities published in 2023


- [CVE-2023-43542](https://insights.sbomify.com/CVE-2023-43542/): Buffer Copy Without Checking Size of Input in Trusted Execution Environment (high 7.8)
- [CVE-2023-43541](https://insights.sbomify.com/CVE-2023-43541/): NULL Pointer Dereference in Windows Graphics (high 8.4)
- [CVE-2023-43540](https://insights.sbomify.com/CVE-2023-43540/): Buffer Copy Without Checking Size of Input in Bluetooth HOST (high 8.4)
- [CVE-2023-4354](https://insights.sbomify.com/CVE-2023-4354/): Memory corruption in Chrome (high 8.8)
- [CVE-2023-43539](https://insights.sbomify.com/CVE-2023-43539/): Buffer Over-read in WLAN Firmware (high 7.5)
- [CVE-2023-43538](https://insights.sbomify.com/CVE-2023-43538/): Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in TZ Secure OS (critical 9.3)
- [CVE-2023-43537](https://insights.sbomify.com/CVE-2023-43537/): Buffer Over-read in WLAN Host (medium 6.5)
- [CVE-2023-43536](https://insights.sbomify.com/CVE-2023-43536/): Buffer Over-read in WLAN Firmware (high 7.5)
- [CVE-2023-43535](https://insights.sbomify.com/CVE-2023-43535/): Improper Validation of Array Index in Display (high 8.4)
- [CVE-2023-43534](https://insights.sbomify.com/CVE-2023-43534/): Use of Out-of-range Pointer Offset in WLAN HOST (high 8.6)
- [CVE-2023-43533](https://insights.sbomify.com/CVE-2023-43533/): Buffer Over-read in WLAN Firmware (high 7.5)
- [CVE-2023-43532](https://insights.sbomify.com/CVE-2023-43532/): Untrusted Pointer Dereference in Display (high 8.4)
- [CVE-2023-43531](https://insights.sbomify.com/CVE-2023-43531/): Access of Uninitialized Pointer in SPS Applications (high 8.4)
- [CVE-2023-43530](https://insights.sbomify.com/CVE-2023-43530/): Integer Overflow or Wraparound in HLOS (medium 5.9)
- [CVE-2023-4353](https://insights.sbomify.com/CVE-2023-4353/): Memory corruption in Chrome (high 8.8)
- [CVE-2023-43529](https://insights.sbomify.com/CVE-2023-43529/): Reachable Assertion in Data Modem (high 7.5)
- [CVE-2023-43528](https://insights.sbomify.com/CVE-2023-43528/): Buffer Over-read in Audio (medium 6.1)
- [CVE-2023-43527](https://insights.sbomify.com/CVE-2023-43527/): Buffer Over-read in Video (medium 6.8)
- [CVE-2023-43526](https://insights.sbomify.com/CVE-2023-43526/): Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Audio (medium 6.7)
- [CVE-2023-43525](https://insights.sbomify.com/CVE-2023-43525/): Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Audio (medium 6.7)
- [CVE-2023-43524](https://insights.sbomify.com/CVE-2023-43524/): Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Audio (medium 6.7)
- [CVE-2023-43523](https://insights.sbomify.com/CVE-2023-43523/): Reachable Assertion in WLAN Firmware (high 7.5)
- [CVE-2023-43522](https://insights.sbomify.com/CVE-2023-43522/): NULL Pointer Dereference in WLAN Firmware (high 7.5)
- [CVE-2023-43521](https://insights.sbomify.com/CVE-2023-43521/): Use After Free in HLOS (medium 6.7)
- [CVE-2023-43520](https://insights.sbomify.com/CVE-2023-43520/): Stack-based Buffer Overflow in WLAN HOST (high 8.6)
- [CVE-2023-4352](https://insights.sbomify.com/CVE-2023-4352/): Memory corruption in Chrome (high 8.8)
- [CVE-2023-43519](https://insights.sbomify.com/CVE-2023-43519/): Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in Video (high 7.3)
- [CVE-2023-43518](https://insights.sbomify.com/CVE-2023-43518/): Untrusted Pointer Dereference in Video (high 7.3)
- [CVE-2023-43517](https://insights.sbomify.com/CVE-2023-43517/): Improper Access Control in Automotive Multimedia (high 8.4)
- [CVE-2023-43516](https://insights.sbomify.com/CVE-2023-43516/): Use of out-of-range pointer offset in Video (high 7.8)
- [CVE-2023-43515](https://insights.sbomify.com/CVE-2023-43515/): Buffer copy without checking size of input (Classic buffer overflow) in HLOS (medium 6.6)
- [CVE-2023-43514](https://insights.sbomify.com/CVE-2023-43514/): Use After Free in DSP Services (high 8.4)
- [CVE-2023-43513](https://insights.sbomify.com/CVE-2023-43513/): Use of Out-of-range Pointer Offset in PCIe (high 7.8)
- [CVE-2023-43512](https://insights.sbomify.com/CVE-2023-43512/): Buffer Over-read in Qualcomm ESL (high 7.5)
- [CVE-2023-43511](https://insights.sbomify.com/CVE-2023-43511/): Loop with Unreachable Exit Condition (Infinite Loop) in WLAN Firmware (high 7.5)
- [CVE-2023-43510](https://insights.sbomify.com/CVE-2023-43510/): Command injection in Aruba ClearPass Policy Manager (medium 4.7)
- [CVE-2023-4351](https://insights.sbomify.com/CVE-2023-4351/): Use after free in Chrome (high 8.8)
- [CVE-2023-43509](https://insights.sbomify.com/CVE-2023-43509/): Unauthenticated Endpoint Allows Sending Arbitrary OnGuard Notifications (medium 5.8)
- [CVE-2023-43508](https://insights.sbomify.com/CVE-2023-43508/): Authorization Bypass Leading to Privilege Escalation in ClearPass Policy Manager Web-Based Management Interface (medium 6.3)
- [CVE-2023-43507](https://insights.sbomify.com/CVE-2023-43507/): Authenticated SQL Injection Vulnerability in ClearPass Policy Manager Web-based Management Interface (high 7.2)
- [CVE-2023-43506](https://insights.sbomify.com/CVE-2023-43506/): Local Privilege Escalation in ClearPass OnGuard Linux Agent (high 7.8)
- [CVE-2023-43505](https://insights.sbomify.com/CVE-2023-43505/): Missing authorization in COMOS (critical 9.6)
- [CVE-2023-43504](https://insights.sbomify.com/CVE-2023-43504/): Memory corruption in COMOS (critical 9.6)
- [CVE-2023-43503](https://insights.sbomify.com/CVE-2023-43503/): Information disclosure in COMOS (low 3.5)
- [CVE-2023-43502](https://insights.sbomify.com/CVE-2023-43502/): Jenkins Build Failure Analyzer Plugin Cross-Site Request Forgery vulnerability (medium 4.3)
- [CVE-2023-43501](https://insights.sbomify.com/CVE-2023-43501/): Jenkins Build Failure Analyzer Plugin missing permission check (medium 6.5)
- [CVE-2023-43500](https://insights.sbomify.com/CVE-2023-43500/): Jenkins Build Failure Analyzer Plugin Cross-Site Request Forgery vulnerability (high 8.8)
- [CVE-2023-4350](https://insights.sbomify.com/CVE-2023-4350/): Other in Chrome (medium 6.5)
- [CVE-2023-43499](https://insights.sbomify.com/CVE-2023-43499/): Jenkins Build Failure Analyzer Plugin Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2023-43498](https://insights.sbomify.com/CVE-2023-43498/): Jenkins temporary uploaded file created with insecure permissions (high 8.1)
- [CVE-2023-43497](https://insights.sbomify.com/CVE-2023-43497/): Jenkins temporary uploaded file created with insecure permissions (high 8.1)
- [CVE-2023-43496](https://insights.sbomify.com/CVE-2023-43496/): Jenkins temporary plugin file created with insecure permissions (high 8.8)
- [CVE-2023-43495](https://insights.sbomify.com/CVE-2023-43495/): Jenkins Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2023-43494](https://insights.sbomify.com/CVE-2023-43494/): Jenkins does not exclude sensitive build variables from search (medium 4.3)
- [CVE-2023-43493](https://insights.sbomify.com/CVE-2023-43493/): SQL injection in Welcart e-Commerce (medium 4.9)
- [CVE-2023-43492](https://insights.sbomify.com/CVE-2023-43492/): Weintek cMT3000 HMI Web CGI Stack-based Buffer Overflow (critical 9.8)
- [CVE-2023-43491](https://insights.sbomify.com/CVE-2023-43491/): Information disclosure in Smart Reader (medium 5.3)
- [CVE-2023-43490](https://insights.sbomify.com/CVE-2023-43490/): Weak cryptography in Intel(R) Xeon(R) D Processors with Intel(R) SGX (medium 5.3)
- [CVE-2023-4349](https://insights.sbomify.com/CVE-2023-4349/): Use after free in Chrome (high 8.8)
- [CVE-2023-43489](https://insights.sbomify.com/CVE-2023-43489/): Missing authorization in Intel(R) CIP software (medium 6.8)
- [CVE-2023-43488](https://insights.sbomify.com/CVE-2023-43488/): Missing authorization in ctrlX HMI Web Panel - WR21 (WR2107) (high 7.9)
- [CVE-2023-43487](https://insights.sbomify.com/CVE-2023-43487/): Missing authorization in Intel(R) CST (medium 4.7)
- [CVE-2023-43485](https://insights.sbomify.com/CVE-2023-43485/): BIGIP and BIG-IQ TACACS+ audit log Vulnerability (medium 5.5)
- [CVE-2023-43484](https://insights.sbomify.com/CVE-2023-43484/): Cross-site scripting in Welcart e-Commerce (medium 6.1)
- [CVE-2023-43482](https://insights.sbomify.com/CVE-2023-43482/): Command injection in ER7206 Omada Gigabit VPN Router (high 7.2)
- [CVE-2023-43481](https://insights.sbomify.com/CVE-2023-43481/): Code injection in tcl:browser tv web - browsehere (critical 9.8)
- [CVE-2023-43478](https://insights.sbomify.com/CVE-2023-43478/): Unauthenticated configuration restore and firmware update (high 8.8)
- [CVE-2023-43477](https://insights.sbomify.com/CVE-2023-43477/): Post-Auth Command Injection in Telstra Smart Modem Gen 2 (Arcadyan LH1000) (medium 6.8)
- [CVE-2023-43472](https://insights.sbomify.com/CVE-2023-43472/): Information exposure in MLflow (high 7.5)
- [CVE-2023-43470](https://insights.sbomify.com/CVE-2023-43470/): SQL injection in janobe:online voting system (critical 9.8)
- [CVE-2023-4347](https://insights.sbomify.com/CVE-2023-4347/): Cross-site Scripting (XSS) - Reflected in librenms/librenms (high 7.6)
- [CVE-2023-43469](https://insights.sbomify.com/CVE-2023-43469/): SQL injection in online job portal project:online job portal (critical 9.8)
- [CVE-2023-43468](https://insights.sbomify.com/CVE-2023-43468/): SQL injection in online job portal project:online job portal (critical 9.8)
- [CVE-2023-4346](https://insights.sbomify.com/CVE-2023-4346/): KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism (high 7.5, exploited in the wild)
- [CVE-2023-43458](https://insights.sbomify.com/CVE-2023-43458/): Cross-site scripting in resort reservation system project:resort reservation system (medium 5.4)
- [CVE-2023-43457](https://insights.sbomify.com/CVE-2023-43457/): Privilege escalation in oretnom23:service provider management system (critical 9.8)
- [CVE-2023-43456](https://insights.sbomify.com/CVE-2023-43456/): Cross-site scripting in oretnom23:service provider management system (medium 5.4)
- [CVE-2023-43455](https://insights.sbomify.com/CVE-2023-43455/): Command injection in totolink:x6000r firmware (critical 9.8)
- [CVE-2023-43454](https://insights.sbomify.com/CVE-2023-43454/): Command injection in totolink:x6000r firmware (critical 9.8)
- [CVE-2023-43453](https://insights.sbomify.com/CVE-2023-43453/): Command injection in totolink:x6000r firmware (critical 9.8)
- [CVE-2023-4345](https://insights.sbomify.com/CVE-2023-4345/): Broadcom RAID Controller web interface is vulnerable client-side control bypass (medium 6.5)
- [CVE-2023-43449](https://insights.sbomify.com/CVE-2023-43449/): Code injection in hummerrisk:hummerrisk (high 8.8)
- [CVE-2023-4344](https://insights.sbomify.com/CVE-2023-4344/): Weak cryptography in LSI Storage Authority (LSA) (critical 9.8)
- [CVE-2023-4343](https://insights.sbomify.com/CVE-2023-4343/): Information disclosure in LSI Storage Authority (LSA) (high 7.5)
- [CVE-2023-4342](https://insights.sbomify.com/CVE-2023-4342/): Misconfiguration in LSI Storage Authority (LSA) (critical 9.8)
- [CVE-2023-4341](https://insights.sbomify.com/CVE-2023-4341/): Broadcom RAID Controller is vulnerable to Privilege escalation to root due to creation of insecure folders by Web GUI (critical 9.8)
- [CVE-2023-4340](https://insights.sbomify.com/CVE-2023-4340/): Privilege escalation in LSI Storage Authority (LSA) (critical 9.8)
- [CVE-2023-4339](https://insights.sbomify.com/CVE-2023-4339/): Information disclosure in LSI Storage Authority (LSA) (high 7.5)
- [CVE-2023-43382](https://insights.sbomify.com/CVE-2023-43382/): Path traversal in iteachyou:dreamer cms (high 8.8)
- [CVE-2023-43381](https://insights.sbomify.com/CVE-2023-43381/): SQL injection in tianchoy:blog (high 7.5)
- [CVE-2023-4338](https://insights.sbomify.com/CVE-2023-4338/): Misconfiguration in LSI Storage Authority (LSA) (critical 9.8)
- [CVE-2023-43378](https://insights.sbomify.com/CVE-2023-43378/): Cross-site scripting in digitaldruid:hoteldruid (medium 6.1)
- [CVE-2023-43377](https://insights.sbomify.com/CVE-2023-43377/): Cross-site scripting in digitaldruid:hoteldruid (medium 5.4)
- [CVE-2023-43376](https://insights.sbomify.com/CVE-2023-43376/): Cross-site scripting in digitaldruid:hoteldruid (medium 5.4)
- [CVE-2023-43375](https://insights.sbomify.com/CVE-2023-43375/): SQL injection in digitaldruid:hoteldruid (critical 9.8)
- [CVE-2023-43374](https://insights.sbomify.com/CVE-2023-43374/): SQL injection in digitaldruid:hoteldruid (critical 9.8)
- [CVE-2023-43373](https://insights.sbomify.com/CVE-2023-43373/): SQL injection in digitaldruid:hoteldruid (critical 9.8)
- [CVE-2023-43371](https://insights.sbomify.com/CVE-2023-43371/): SQL injection in digitaldruid:hoteldruid (critical 9.8)
- [CVE-2023-4337](https://insights.sbomify.com/CVE-2023-4337/): Other in LSI Storage Authority (LSA) (critical 9.8)
- [CVE-2023-43364](https://insights.sbomify.com/CVE-2023-43364/): Searchor CLI's Search vulnerable to Arbitrary Code using Eval (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/224/