# Vulnerabilities published in 2023


- [CVE-2023-42533](https://insights.sbomify.com/CVE-2023-42533/): Other in Samsung Mobile Devices (medium 6.6)
- [CVE-2023-42532](https://insights.sbomify.com/CVE-2023-42532/): Security feature bypass in Samsung Mobile Devices (medium 5.9)
- [CVE-2023-42531](https://insights.sbomify.com/CVE-2023-42531/): Security feature bypass in Samsung Mobile Devices (medium 6.2)
- [CVE-2023-42530](https://insights.sbomify.com/CVE-2023-42530/): Missing authorization in Samsung Mobile Devices (medium 6.7)
- [CVE-2023-4253](https://insights.sbomify.com/CVE-2023-4253/): Chatbot < 4.7.8 - Admin+ Stored XSS in FAQ Builder (medium 4.8)
- [CVE-2023-42529](https://insights.sbomify.com/CVE-2023-42529/): Memory corruption in Samsung Mobile Devices (medium 6.7)
- [CVE-2023-42528](https://insights.sbomify.com/CVE-2023-42528/): Memory corruption in Samsung Mobile Devices (medium 6.7)
- [CVE-2023-42527](https://insights.sbomify.com/CVE-2023-42527/): Information disclosure in Samsung Mobile Devices (medium 5.6)
- [CVE-2023-42526](https://insights.sbomify.com/CVE-2023-42526/): Denial of service in withsecure:atlant (high 7.5)
- [CVE-2023-42525](https://insights.sbomify.com/CVE-2023-42525/): Denial of service in withsecure:atlant (high 7.5)
- [CVE-2023-42524](https://insights.sbomify.com/CVE-2023-42524/): Denial of service in withsecure:atlant (high 7.5)
- [CVE-2023-42523](https://insights.sbomify.com/CVE-2023-42523/): Denial of service in withsecure:atlant (high 7.5)
- [CVE-2023-42522](https://insights.sbomify.com/CVE-2023-42522/): Denial of service in withsecure:atlant (high 7.5)
- [CVE-2023-42521](https://insights.sbomify.com/CVE-2023-42521/): Denial of service in withsecure:atlant (high 7.5)
- [CVE-2023-42520](https://insights.sbomify.com/CVE-2023-42520/): Denial of service in withsecure:atlant (high 7.5)
- [CVE-2023-4252](https://insights.sbomify.com/CVE-2023-4252/): EventPrime <= 3.2.9 - Booking Pricing Bypass (medium 5.3)
- [CVE-2023-4251](https://insights.sbomify.com/CVE-2023-4251/): EventPrime < 3.2.0 - Booking Creation via CSRF (medium 4.3)
- [CVE-2023-42509](https://insights.sbomify.com/CVE-2023-42509/): JFrog Artifactory Sensitive Data Leakage in Repository configuration process (medium 6.6)
- [CVE-2023-42508](https://insights.sbomify.com/CVE-2023-42508/): JFrog Artifactory Improper header input validation leads to email manipulation sent from the platform (medium 6.5)
- [CVE-2023-42507](https://insights.sbomify.com/CVE-2023-42507/): Memory corruption in OnSinView2 (high 7.8)
- [CVE-2023-42506](https://insights.sbomify.com/CVE-2023-42506/): Memory corruption in OnSinView2 (high 7.8)
- [CVE-2023-42505](https://insights.sbomify.com/CVE-2023-42505/): Apache Superset: Sensitive information disclosure on db connection details (medium 4.3)
- [CVE-2023-42504](https://insights.sbomify.com/CVE-2023-42504/): Apache Superset: Lack of rate limiting allows for possible denial of service (medium 5.8)
- [CVE-2023-42503](https://insights.sbomify.com/CVE-2023-42503/): Apache Commons Compress: Denial of service via CPU consumption for malformed TAR file (medium 5.5)
- [CVE-2023-42502](https://insights.sbomify.com/CVE-2023-42502/): Apache Superset: Open Redirect Vulnerability (medium 4.8)
- [CVE-2023-42501](https://insights.sbomify.com/CVE-2023-42501/): Apache Superset: Unnecessary read permissions within the Gamma role (medium 4.3)
- [CVE-2023-4250](https://insights.sbomify.com/CVE-2023-4250/): EventPrime < 3.2.0 - Reflected XSS (medium 6.1)
- [CVE-2023-42498](https://insights.sbomify.com/CVE-2023-42498/): Liferay Portal Language Override edit screen and Liferay DXP vulnerable to reflected Cross-site Scripting (critical 9.6)
- [CVE-2023-42497](https://insights.sbomify.com/CVE-2023-42497/): Liferay Portal and Liferay DXP Vulnerable to Reflected XSS via the Export for Translation Page (critical 9.6)
- [CVE-2023-42496](https://insights.sbomify.com/CVE-2023-42496/): Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting (critical 9.6)
- [CVE-2023-42495](https://insights.sbomify.com/CVE-2023-42495/): Command injection in Dasan Networks (critical 9.8)
- [CVE-2023-42494](https://insights.sbomify.com/CVE-2023-42494/): EisBaer Scada - CWE-749: Exposed Dangerous Method or Function (high 7.5)
- [CVE-2023-42493](https://insights.sbomify.com/CVE-2023-42493/): EisBaer Scada - CWE-256: Plaintext Storage of a Password (high 7.1)
- [CVE-2023-42492](https://insights.sbomify.com/CVE-2023-42492/): EisBaer Scada - CWE-321: Use of Hard-coded Cryptographic Key (high 7.1)
- [CVE-2023-42491](https://insights.sbomify.com/CVE-2023-42491/): EisBaer Scada - CWE-285: Improper Authorization (high 8.8)
- [CVE-2023-42490](https://insights.sbomify.com/CVE-2023-42490/): EisBaer Scada - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (high 7.5)
- [CVE-2023-4249](https://insights.sbomify.com/CVE-2023-4249/): Zavio IP Camera Stack-Based Buffer Overflow (high 8.8)
- [CVE-2023-42489](https://insights.sbomify.com/CVE-2023-42489/): EisBaer Scada - CWE-732: Incorrect Permission Assignment for Critical Resource (high 7.5)
- [CVE-2023-42488](https://insights.sbomify.com/CVE-2023-42488/): EisBaer Scada - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (high 7.5)
- [CVE-2023-42487](https://insights.sbomify.com/CVE-2023-42487/): Soundminer – CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (high 7.5)
- [CVE-2023-42486](https://insights.sbomify.com/CVE-2023-42486/): Fortect - CWE-428: Unquoted Search Path or Element (medium 6.3)
- [CVE-2023-42483](https://insights.sbomify.com/CVE-2023-42483/): Race condition in samsung:exynos 1080 firmware (medium 6.3)
- [CVE-2023-42482](https://insights.sbomify.com/CVE-2023-42482/): Use after free in samsung:exynos 2200 firmware (medium 4.7)
- [CVE-2023-42481](https://insights.sbomify.com/CVE-2023-42481/): Improper Access Control vulnerability in SAP Commerce Cloud (high 8.1)
- [CVE-2023-42480](https://insights.sbomify.com/CVE-2023-42480/): Information Disclosure in NetWeaver AS Java Logon (medium 5.3)
- [CVE-2023-4248](https://insights.sbomify.com/CVE-2023-4248/): GiveWP <= 2.33.3 - Cross-Site Request Forgery to Stripe Integration Deletion (medium 5.4)
- [CVE-2023-42479](https://insights.sbomify.com/CVE-2023-42479/): Cross-Site Scripting (XSS) vulnerability in SAP Biller Direct (medium 6.1)
- [CVE-2023-42478](https://insights.sbomify.com/CVE-2023-42478/): Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (high 7.5)
- [CVE-2023-42477](https://insights.sbomify.com/CVE-2023-42477/): Server-Side Request Forgery in SAP NetWeaver AS Java (GRMG Heartbeat application) (medium 6.5)
- [CVE-2023-42476](https://insights.sbomify.com/CVE-2023-42476/): Cross Site Scripting vulnerability in SAP BusinessObjects Web Intelligence (medium 6.8)
- [CVE-2023-42475](https://insights.sbomify.com/CVE-2023-42475/): Information Disclosure Vulnerability in Statutory Reporting (medium 4.3)
- [CVE-2023-42474](https://insights.sbomify.com/CVE-2023-42474/): Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Web Intelligence (medium 6.8)
- [CVE-2023-42473](https://insights.sbomify.com/CVE-2023-42473/): Missing Authorization Check In S/4HANA (Manage Withholding Tax Items) (medium 5.4)
- [CVE-2023-42472](https://insights.sbomify.com/CVE-2023-42472/): File upload in SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) (high 8.7)
- [CVE-2023-42471](https://insights.sbomify.com/CVE-2023-42471/): Code injection in wave-ai:wave (critical 9.8)
- [CVE-2023-42470](https://insights.sbomify.com/CVE-2023-42470/): Code injection in imoulife:life (critical 9.8)
- [CVE-2023-4247](https://insights.sbomify.com/CVE-2023-4247/): GiveWP <= 2.33.3 - Cross-Site Request Forgery to plugin deactivation (medium 5.4)
- [CVE-2023-42469](https://insights.sbomify.com/CVE-2023-42469/): Missing authorization in fulldive:full dialer (low 3.3)
- [CVE-2023-42468](https://insights.sbomify.com/CVE-2023-42468/): Missing authorization in azmobileapps:color phone (medium 5.3)
- [CVE-2023-42467](https://insights.sbomify.com/CVE-2023-42467/): Denial of service in qemu:qemu (medium 5.5)
- [CVE-2023-42465](https://insights.sbomify.com/CVE-2023-42465/): Auth bypass in sudo project:sudo (high 7.0)
- [CVE-2023-42464](https://insights.sbomify.com/CVE-2023-42464/): Memory corruption in debian:debian linux (critical 9.8)
- [CVE-2023-42463](https://insights.sbomify.com/CVE-2023-42463/): wazuh-logcollector integer underflow local privilege escalation (high 7.4)
- [CVE-2023-42462](https://insights.sbomify.com/CVE-2023-42462/): File deletion through document upload process in GLPI (high 7.7)
- [CVE-2023-42461](https://insights.sbomify.com/CVE-2023-42461/): SQL injection in ITIL actors in GLPI (medium 6.5)
- [CVE-2023-42460](https://insights.sbomify.com/CVE-2023-42460/): _abi_decode input not validated in complex expressions in Vyper (medium 5.3)
- [CVE-2023-4246](https://insights.sbomify.com/CVE-2023-4246/): GiveWP <= 2.33.3 - Cross-Site Request Forgery to plugin installation (medium 4.3)
- [CVE-2023-42459](https://insights.sbomify.com/CVE-2023-42459/): Malformed DATA submessage leads to bad-free error in Fast-DDS (high 8.6)
- [CVE-2023-42458](https://insights.sbomify.com/CVE-2023-42458/): Zope vulnerable to Stored Cross Site Scripting with SVG images (low 3.7)
- [CVE-2023-42457](https://insights.sbomify.com/CVE-2023-42457/): plone.rest vulnerable to Denial of Service when ++api++ is used many times (high 7.5)
- [CVE-2023-42456](https://insights.sbomify.com/CVE-2023-42456/): sudo-rs Session File Relative Path Traversal vulnerability (low 3.3)
- [CVE-2023-42455](https://insights.sbomify.com/CVE-2023-42455/): Wazuh vulnerable to user privilege escalation (high 8.8)
- [CVE-2023-42454](https://insights.sbomify.com/CVE-2023-42454/): SQLpage vulnerable to public exposure of database credentials (critical 10.0)
- [CVE-2023-42453](https://insights.sbomify.com/CVE-2023-42453/): Improper validation of receipts allows forged read receipts in matrix synapse (low 3.1)
- [CVE-2023-42452](https://insights.sbomify.com/CVE-2023-42452/): Mastodon vulnerable to Stored XSS through the translation feature (medium 6.1)
- [CVE-2023-42451](https://insights.sbomify.com/CVE-2023-42451/): Mastodon Invalid Domain Name Normalization vulnerability (high 7.4)
- [CVE-2023-42450](https://insights.sbomify.com/CVE-2023-42450/): Mastodon Server-Side Request Forgery vulnerability (medium 5.4)
- [CVE-2023-4245](https://insights.sbomify.com/CVE-2023-4245/): WooCommerce PDF Invoice Builder <= 1.2.89 - Missing Authorization to Sensitive Information Exposure (medium 4.3)
- [CVE-2023-42449](https://insights.sbomify.com/CVE-2023-42449/): Business logic in hydra (high 8.1)
- [CVE-2023-42448](https://insights.sbomify.com/CVE-2023-42448/): Business logic in hydra (high 8.1)
- [CVE-2023-42447](https://insights.sbomify.com/CVE-2023-42447/): blurhash panics on parsing crafted inputs (high 8.6)
- [CVE-2023-42446](https://insights.sbomify.com/CVE-2023-42446/): Pow Mnesia cache doesn't invalidate all expired keys on startup (medium 6.5)
- [CVE-2023-42445](https://insights.sbomify.com/CVE-2023-42445/): Possible local file exfiltration by XML External entity injection (medium 6.8)
- [CVE-2023-42444](https://insights.sbomify.com/CVE-2023-42444/): phonenumber panics on parsing crafted RF3966 inputs (high 8.6)
- [CVE-2023-42443](https://insights.sbomify.com/CVE-2023-42443/): Vyper vulnerable to memory corruption in certain builtins utilizing `msize` (high 8.1)
- [CVE-2023-42442](https://insights.sbomify.com/CVE-2023-42442/): JumpServer session replays download without authentication (high 8.2)
- [CVE-2023-42441](https://insights.sbomify.com/CVE-2023-42441/): Vyper has incorrect re-entrancy lock when key is empty string (medium 5.3)
- [CVE-2023-4244](https://insights.sbomify.com/CVE-2023-4244/): Use-after-free in Linux kernel's netfilter: nf_tables component (high 7.8)
- [CVE-2023-42439](https://insights.sbomify.com/CVE-2023-42439/): GeoNode SSRF Bypass to return internal host data (high 7.5)
- [CVE-2023-42438](https://insights.sbomify.com/CVE-2023-42438/): Other in macOS (medium 4.3)
- [CVE-2023-42436](https://insights.sbomify.com/CVE-2023-42436/): Cross-site scripting in GROWI (medium 5.4)
- [CVE-2023-42435](https://insights.sbomify.com/CVE-2023-42435/): Cross-Site Request Forgery in DEXMA DEXGate (medium 5.5)
- [CVE-2023-42433](https://insights.sbomify.com/CVE-2023-42433/): Misconfiguration in Endurance Gaming Mode software installers (medium 6.7)
- [CVE-2023-42431](https://insights.sbomify.com/CVE-2023-42431/): Potential XSS on user preferences page (low 2.1)
- [CVE-2023-4243](https://insights.sbomify.com/CVE-2023-4243/): FULL - Customer <= 2.2.3 - Authenticated(Subscriber+) Improper Authorization to Arbitrary Plugin Installation (high 8.8)
- [CVE-2023-42429](https://insights.sbomify.com/CVE-2023-42429/): Memory corruption in Intel NUC BIOS firmware (high 7.5)
- [CVE-2023-42428](https://insights.sbomify.com/CVE-2023-42428/): Path traversal in CubeCart (medium 6.5)
- [CVE-2023-42427](https://insights.sbomify.com/CVE-2023-42427/): Cross-site scripting in UNIVERSAL PASSPORT RX (medium 6.5)
- [CVE-2023-42426](https://insights.sbomify.com/CVE-2023-42426/): Cross-site scripting in froala:froala editor (medium 6.1)
- [CVE-2023-42425](https://insights.sbomify.com/CVE-2023-42425/): Weak cryptography in turing:edge\+ evc5fd firmware (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/231/