# Vulnerabilities published in 2023


- [CVE-2023-42874](https://insights.sbomify.com/CVE-2023-42874/): Information disclosure in macOS (low 2.4)
- [CVE-2023-42873](https://insights.sbomify.com/CVE-2023-42873/): Memory corruption in iOS and iPadOS (high 7.8)
- [CVE-2023-42872](https://insights.sbomify.com/CVE-2023-42872/): Missing authorization in iOS and iPadOS (medium 5.5)
- [CVE-2023-42871](https://insights.sbomify.com/CVE-2023-42871/): Memory corruption in iOS and iPadOS (high 7.8)
- [CVE-2023-42870](https://insights.sbomify.com/CVE-2023-42870/): Use after free in iOS and iPadOS (high 7.8)
- [CVE-2023-42869](https://insights.sbomify.com/CVE-2023-42869/): Memory corruption in iOS and iPadOS (high 7.5)
- [CVE-2023-42867](https://insights.sbomify.com/CVE-2023-42867/): Privilege escalation in GarageBand (high 7.8)
- [CVE-2023-42866](https://insights.sbomify.com/CVE-2023-42866/): Memory corruption in Safari (high 8.8)
- [CVE-2023-42865](https://insights.sbomify.com/CVE-2023-42865/): Memory corruption in iOS and iPadOS (medium 6.5)
- [CVE-2023-42862](https://insights.sbomify.com/CVE-2023-42862/): Memory corruption in iOS and iPadOS (medium 6.5)
- [CVE-2023-42861](https://insights.sbomify.com/CVE-2023-42861/): Business logic in macOS (medium 6.5)
- [CVE-2023-42860](https://insights.sbomify.com/CVE-2023-42860/): Security feature bypass in macOS (high 7.7)
- [CVE-2023-42859](https://insights.sbomify.com/CVE-2023-42859/): Security feature bypass in macOS (high 7.7)
- [CVE-2023-42858](https://insights.sbomify.com/CVE-2023-42858/): Information disclosure in macOS (medium 5.5)
- [CVE-2023-42857](https://insights.sbomify.com/CVE-2023-42857/): Information disclosure in iOS and iPadOS (low 3.3)
- [CVE-2023-42856](https://insights.sbomify.com/CVE-2023-42856/): Memory corruption in macOS (high 7.8)
- [CVE-2023-42855](https://insights.sbomify.com/CVE-2023-42855/): Security feature bypass in iOS and iPadOS (medium 4.6)
- [CVE-2023-42854](https://insights.sbomify.com/CVE-2023-42854/): Denial of service in macOS (medium 5.5)
- [CVE-2023-42853](https://insights.sbomify.com/CVE-2023-42853/): Business logic in macOS (medium 5.5)
- [CVE-2023-42852](https://insights.sbomify.com/CVE-2023-42852/): Business logic in Safari (high 8.8)
- [CVE-2023-42850](https://insights.sbomify.com/CVE-2023-42850/): Privilege escalation in macOS (medium 5.5)
- [CVE-2023-42849](https://insights.sbomify.com/CVE-2023-42849/): Memory corruption in iOS and iPadOS (medium 6.5)
- [CVE-2023-42848](https://insights.sbomify.com/CVE-2023-42848/): Memory corruption in iOS and iPadOS (high 7.8)
- [CVE-2023-42847](https://insights.sbomify.com/CVE-2023-42847/): Auth bypass in iOS and iPadOS (high 7.5)
- [CVE-2023-42846](https://insights.sbomify.com/CVE-2023-42846/): Information disclosure in iOS and iPadOS (medium 5.3)
- [CVE-2023-42845](https://insights.sbomify.com/CVE-2023-42845/): Auth bypass in iOS and iPadOS (medium 5.3)
- [CVE-2023-42844](https://insights.sbomify.com/CVE-2023-42844/): Path traversal in macOS (high 7.5)
- [CVE-2023-42843](https://insights.sbomify.com/CVE-2023-42843/): Other in Safari (high 7.5)
- [CVE-2023-42842](https://insights.sbomify.com/CVE-2023-42842/): Information disclosure in macOS (medium 5.5)
- [CVE-2023-42841](https://insights.sbomify.com/CVE-2023-42841/): Memory corruption in iOS and iPadOS (high 7.8)
- [CVE-2023-42840](https://insights.sbomify.com/CVE-2023-42840/): Information disclosure in macOS (medium 4.3)
- [CVE-2023-4284](https://insights.sbomify.com/CVE-2023-4284/): Post Timeline < 2.2.6 - Reflected XSS (medium 6.1)
- [CVE-2023-42839](https://insights.sbomify.com/CVE-2023-42839/): Information disclosure in iOS and iPadOS (medium 6.2)
- [CVE-2023-42838](https://insights.sbomify.com/CVE-2023-42838/): Security feature bypass in macOS (high 8.2)
- [CVE-2023-42836](https://insights.sbomify.com/CVE-2023-42836/): Security feature bypass in iOS and iPadOS (medium 5.3)
- [CVE-2023-42835](https://insights.sbomify.com/CVE-2023-42835/): Business logic in macOS (medium 5.5)
- [CVE-2023-42834](https://insights.sbomify.com/CVE-2023-42834/): Information disclosure in iOS and iPadOS (medium 6.2)
- [CVE-2023-42833](https://insights.sbomify.com/CVE-2023-42833/): Code injection in Safari (high 8.8)
- [CVE-2023-42832](https://insights.sbomify.com/CVE-2023-42832/): Race condition in macOS (high 7.0)
- [CVE-2023-42831](https://insights.sbomify.com/CVE-2023-42831/): Information disclosure in iOS and iPadOS (medium 5.5)
- [CVE-2023-42830](https://insights.sbomify.com/CVE-2023-42830/): Information disclosure in iOS and iPadOS (low 3.3)
- [CVE-2023-4283](https://insights.sbomify.com/CVE-2023-4283/): EmbedPress <= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-42829](https://insights.sbomify.com/CVE-2023-42829/): Information disclosure in macOS (medium 5.5)
- [CVE-2023-42828](https://insights.sbomify.com/CVE-2023-42828/): Privilege escalation in macOS (high 7.8)
- [CVE-2023-42826](https://insights.sbomify.com/CVE-2023-42826/): Other in macOS (high 7.8)
- [CVE-2023-42824](https://insights.sbomify.com/CVE-2023-42824/): Apple iOS and iPadOS Kernel Privilege Escalation (high 7.8, exploited in the wild)
- [CVE-2023-42823](https://insights.sbomify.com/CVE-2023-42823/): Information disclosure in iOS and iPadOS (low 2.7)
- [CVE-2023-42822](https://insights.sbomify.com/CVE-2023-42822/): Unchecked access to font glyph info in xrdp (medium 4.6)
- [CVE-2023-42821](https://insights.sbomify.com/CVE-2023-42821/): github.com/gomarkdown/markdown Out-of-bounds Read while parsing citations (high 7.5)
- [CVE-2023-42820](https://insights.sbomify.com/CVE-2023-42820/): Random seed leakage in Jumpserver (high 7.0)
- [CVE-2023-4282](https://insights.sbomify.com/CVE-2023-4282/): Missing authorization in EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more (medium 5.4)
- [CVE-2023-42819](https://insights.sbomify.com/CVE-2023-42819/): Path traversal in Jumpserver (high 8.9)
- [CVE-2023-42818](https://insights.sbomify.com/CVE-2023-42818/): SSH public key login without private key challenge if mfa is enabled in jumpserver (medium 5.4)
- [CVE-2023-42817](https://insights.sbomify.com/CVE-2023-42817/): Cross-site Scripting (XSS) in pimcore admin-ui-classic-bundle translations (medium 5.4)
- [CVE-2023-42816](https://insights.sbomify.com/CVE-2023-42816/): Denial of service from malicious signature in kyverno (medium 6.1)
- [CVE-2023-42815](https://insights.sbomify.com/CVE-2023-42815/): Denial of service from malicious image manifest in kyverno (low 3.1)
- [CVE-2023-42814](https://insights.sbomify.com/CVE-2023-42814/): Denial of service from malicious image manifest in kyverno (low 3.1)
- [CVE-2023-42813](https://insights.sbomify.com/CVE-2023-42813/): Denial of service from malicious manifest in kyverno (medium 6.1)
- [CVE-2023-42812](https://insights.sbomify.com/CVE-2023-42812/): Galaxy vulnerable to Server Side Request Forgery during data imports (medium 6.3)
- [CVE-2023-42811](https://insights.sbomify.com/CVE-2023-42811/): AEADs/aes-gcm: Plaintext exposed in decrypt_in_place_detached even on tag verification failure (medium 4.7)
- [CVE-2023-42810](https://insights.sbomify.com/CVE-2023-42810/): systeminformation SSID Command Injection Vulnerability (critical 9.8)
- [CVE-2023-4281](https://insights.sbomify.com/CVE-2023-4281/): Activity Log < 2.8.8 - IP Spoofing (medium 5.3)
- [CVE-2023-42809](https://insights.sbomify.com/CVE-2023-42809/): Redisson unsafe deserialization vulnerability (critical 9.7)
- [CVE-2023-42808](https://insights.sbomify.com/CVE-2023-42808/): Common Voice Cross-site Scripting vulnerability (medium 6.1)
- [CVE-2023-42807](https://insights.sbomify.com/CVE-2023-42807/): Frappe LMS SQL Injection Issue on People Page (medium 6.3)
- [CVE-2023-42806](https://insights.sbomify.com/CVE-2023-42806/): Snapshot signature not including HeadID will allow replay attacks (medium 6.5)
- [CVE-2023-42805](https://insights.sbomify.com/CVE-2023-42805/): quinn-proto Denial of Service vulnerability (high 7.5)
- [CVE-2023-42804](https://insights.sbomify.com/CVE-2023-42804/): BigBlueButton Path Traversal – Reading Certain File Extensions (low 3.1)
- [CVE-2023-42803](https://insights.sbomify.com/CVE-2023-42803/): BigBlueButton Unrestricted File Upload vulnerability (medium 5.3)
- [CVE-2023-42802](https://insights.sbomify.com/CVE-2023-42802/): GLPI vulnerable to unallowed PHP script execution (critical 10.0)
- [CVE-2023-42801](https://insights.sbomify.com/CVE-2023-42801/): Stack buffer overflow due to `strcpy` into fixed size buffer in `extractVersionQuadFromString` (high 7.6)
- [CVE-2023-42800](https://insights.sbomify.com/CVE-2023-42800/): Buffer overflow due to use of `strcpy` in `performRtspHandshake` (high 8.8)
- [CVE-2023-4280](https://insights.sbomify.com/CVE-2023-4280/): Unvalidated input in Silicon Labs TrustZone implementation leads to accessing Trusted memory region (critical 9.3)
- [CVE-2023-42799](https://insights.sbomify.com/CVE-2023-42799/): Buffer overflow due to use of `strcpy` in `parseUrlAddrFromRtspUrlString` (high 8.8)
- [CVE-2023-42798](https://insights.sbomify.com/CVE-2023-42798/): AutomataCI Release Job Can Revert Repo to First Commit (high 8.2)
- [CVE-2023-42797](https://insights.sbomify.com/CVE-2023-42797/): Command injection in CP-8031 MASTER MODULE (medium 6.6)
- [CVE-2023-42796](https://insights.sbomify.com/CVE-2023-42796/): Path traversal in CP-8031 MASTER MODULE (high 7.5)
- [CVE-2023-42795](https://insights.sbomify.com/CVE-2023-42795/): Apache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requests (medium 5.3)
- [CVE-2023-42794](https://insights.sbomify.com/CVE-2023-42794/): Apache Tomcat: FileUpload: DoS due to accumulation of temporary files on Windows (medium 5.9)
- [CVE-2023-42793](https://insights.sbomify.com/CVE-2023-42793/): JetBrains TeamCity Authentication Bypass (critical 9.8, exploited in the wild)
- [CVE-2023-42792](https://insights.sbomify.com/CVE-2023-42792/): Apache Airflow: Improper access control to DAG resources (medium 6.5)
- [CVE-2023-42791](https://insights.sbomify.com/CVE-2023-42791/): Path traversal in FortiAnalyzer (high 8.6)
- [CVE-2023-42790](https://insights.sbomify.com/CVE-2023-42790/): Memory corruption in FortiOS (high 7.7)
- [CVE-2023-4279](https://insights.sbomify.com/CVE-2023-4279/): User Activity Log < 1.6.7 - IP Spoofing (high 7.5)
- [CVE-2023-42789](https://insights.sbomify.com/CVE-2023-42789/): Memory corruption in FortiOS (critical 9.3)
- [CVE-2023-42788](https://insights.sbomify.com/CVE-2023-42788/): Command injection in FortiAnalyzer (high 7.6)
- [CVE-2023-42787](https://insights.sbomify.com/CVE-2023-42787/): Security feature bypass in FortiAnalyzer (medium 6.2)
- [CVE-2023-42786](https://insights.sbomify.com/CVE-2023-42786/): Null dereference in FortiOS (medium 6.4)
- [CVE-2023-42785](https://insights.sbomify.com/CVE-2023-42785/): Null dereference in FortiOS (medium 6.4)
- [CVE-2023-42784](https://insights.sbomify.com/CVE-2023-42784/): Command injection in FortiWeb (medium 5.5)
- [CVE-2023-42783](https://insights.sbomify.com/CVE-2023-42783/): Path traversal in FortiWLM (high 7.3)
- [CVE-2023-42782](https://insights.sbomify.com/CVE-2023-42782/): Auth bypass in FortiAnalyzer (medium 5.0)
- [CVE-2023-42781](https://insights.sbomify.com/CVE-2023-42781/): Apache Airflow: Permission verification bypass allows viewing dagruns of other dags (medium 6.5)
- [CVE-2023-42780](https://insights.sbomify.com/CVE-2023-42780/): Apache Airflow: Improper access control vulnerability in the "List dag warnings" feature (medium 6.5)
- [CVE-2023-4278](https://insights.sbomify.com/CVE-2023-4278/): MasterStudy LMS < 3.0.18 - Unauthenticated Instructor Account Creation (high 7.5)
- [CVE-2023-42776](https://insights.sbomify.com/CVE-2023-42776/): Information disclosure in Intel(R) SGX DCAP software for Windows (low 3.8)
- [CVE-2023-42774](https://insights.sbomify.com/CVE-2023-42774/): Liteos-A has a incorrect default permissions vulnerability (medium 6.2)
- [CVE-2023-42773](https://insights.sbomify.com/CVE-2023-42773/): Privilege escalation in Intel(R) Power Gadget software for Windows (high 8.8)
- [CVE-2023-42772](https://insights.sbomify.com/CVE-2023-42772/): Memory corruption in UEFI firmware for some Intel(R) reference processors (high 8.7)
- [CVE-2023-42771](https://insights.sbomify.com/CVE-2023-42771/): Auth bypass in ACERA 1310 (high 8.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/228/