# Vulnerabilities published in 2023


- [CVE-2023-41095](https://insights.sbomify.com/CVE-2023-41095/): Keys Stored in Plaintext on Secure Vault High for Silabs OpenThread devices (medium 6.8)
- [CVE-2023-41094](https://insights.sbomify.com/CVE-2023-41094/): Touchlink authentication bypass due to packets processed after timeout or out of range in Ember ZNet (critical 10.0)
- [CVE-2023-41093](https://insights.sbomify.com/CVE-2023-41093/): Loss of confidentiality due to potential race condition in Bluetooth controller Connection_Handle reuse (low 3.1)
- [CVE-2023-41092](https://insights.sbomify.com/CVE-2023-41092/): Denial of service in Intel(R) Stratix 10 and Intel(R) Agilex 7 FPGAs (high 7.6)
- [CVE-2023-41091](https://insights.sbomify.com/CVE-2023-41091/): Privilege escalation in Intel(R) MPI Library Software (medium 6.7)
- [CVE-2023-41090](https://insights.sbomify.com/CVE-2023-41090/): Race condition in Intel(R) MAS software (low 1.8)
- [CVE-2023-4109](https://insights.sbomify.com/CVE-2023-4109/): Ninja Forms < 3.6.26 - Admin+ Stored HTML Injection (medium 4.8)
- [CVE-2023-41089](https://insights.sbomify.com/CVE-2023-41089/): Improper Authentication in DEXMA DEXGate (high 8.0)
- [CVE-2023-41088](https://insights.sbomify.com/CVE-2023-41088/): Cleartext Transmission of Sensitive Information in DEXMA DEXGate (medium 6.3)
- [CVE-2023-41086](https://insights.sbomify.com/CVE-2023-41086/): Cross-site request forgery in ACERA 1010 (high 8.8)
- [CVE-2023-41085](https://insights.sbomify.com/CVE-2023-41085/): BIG-IP IPSEC vulnerability (high 7.5)
- [CVE-2023-41084](https://insights.sbomify.com/CVE-2023-41084/): Socomec MOD3GP-SY-120K Reliance on Cookies without Validation and Integrity Checking (critical 10.0)
- [CVE-2023-41082](https://insights.sbomify.com/CVE-2023-41082/): Null dereference in Intel(R) CST software (medium 4.4)
- [CVE-2023-41081](https://insights.sbomify.com/CVE-2023-41081/): Apache Tomcat Connectors: Unexpected use of first declared worker in mod_jk for unmapped request (high 7.5)
- [CVE-2023-41080](https://insights.sbomify.com/CVE-2023-41080/): Apache Tomcat: Open redirect with FORM authentication (medium 6.1)
- [CVE-2023-4108](https://insights.sbomify.com/CVE-2023-4108/): Audit logging fails to sanitize post metadata (medium 4.5)
- [CVE-2023-41079](https://insights.sbomify.com/CVE-2023-41079/): Security feature bypass in macOS (medium 5.5)
- [CVE-2023-41078](https://insights.sbomify.com/CVE-2023-41078/): Security feature bypass in macOS (medium 5.5)
- [CVE-2023-41077](https://insights.sbomify.com/CVE-2023-41077/): Missing authorization in macOS (medium 5.5)
- [CVE-2023-41076](https://insights.sbomify.com/CVE-2023-41076/): Privilege escalation in macOS (high 7.3)
- [CVE-2023-41075](https://insights.sbomify.com/CVE-2023-41075/): Memory corruption in iOS and iPadOS (high 7.8)
- [CVE-2023-41074](https://insights.sbomify.com/CVE-2023-41074/): Code injection in Safari (high 8.8)
- [CVE-2023-41073](https://insights.sbomify.com/CVE-2023-41073/): Missing authorization in iOS and iPadOS (medium 5.5)
- [CVE-2023-41072](https://insights.sbomify.com/CVE-2023-41072/): Information disclosure in iOS and iPadOS (medium 5.5)
- [CVE-2023-41071](https://insights.sbomify.com/CVE-2023-41071/): Use after free in iOS and iPadOS (high 7.8)
- [CVE-2023-41070](https://insights.sbomify.com/CVE-2023-41070/): Business logic in iOS and iPadOS (medium 5.5)
- [CVE-2023-4107](https://insights.sbomify.com/CVE-2023-4107/): Incorrect authorization allows a user manager to update a system admin (medium 6.7)
- [CVE-2023-41069](https://insights.sbomify.com/CVE-2023-41069/): Auth bypass in iOS and iPadOS (medium 5.5)
- [CVE-2023-41068](https://insights.sbomify.com/CVE-2023-41068/): Privilege escalation in iOS and iPadOS (high 7.8)
- [CVE-2023-41067](https://insights.sbomify.com/CVE-2023-41067/): Security feature bypass in macOS (medium 5.5)
- [CVE-2023-41066](https://insights.sbomify.com/CVE-2023-41066/): Information disclosure in macOS (medium 5.5)
- [CVE-2023-41065](https://insights.sbomify.com/CVE-2023-41065/): Information disclosure in iOS and iPadOS (low 3.3)
- [CVE-2023-41064](https://insights.sbomify.com/CVE-2023-41064/): Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow (high 7.8, exploited in the wild)
- [CVE-2023-41063](https://insights.sbomify.com/CVE-2023-41063/): Memory corruption in iOS and iPadOS (high 7.8)
- [CVE-2023-41061](https://insights.sbomify.com/CVE-2023-41061/): Apple iOS, iPadOS, and watchOS Wallet Code Execution (high 7.8, exploited in the wild)
- [CVE-2023-41060](https://insights.sbomify.com/CVE-2023-41060/): Memory corruption in iOS and iPadOS (high 8.8)
- [CVE-2023-4106](https://insights.sbomify.com/CVE-2023-4106/): A guest user can perform various actions on public playbooks (medium 6.3)
- [CVE-2023-41058](https://insights.sbomify.com/CVE-2023-41058/): Trigger `beforeFind` not invoked in internal query pipeline in parse-server (high 7.5)
- [CVE-2023-41057](https://insights.sbomify.com/CVE-2023-41057/): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in hyper-bump-it (medium 5.5)
- [CVE-2023-41056](https://insights.sbomify.com/CVE-2023-41056/): Redis vulnerable to integer overflow in certain payloads (high 8.1)
- [CVE-2023-41055](https://insights.sbomify.com/CVE-2023-41055/): LibreY Server-Side Request Forgery (SSRF) vulnerability via wikipedia_language cookie (high 7.5)
- [CVE-2023-41054](https://insights.sbomify.com/CVE-2023-41054/): LibreY Server-Side Request Forgery (SSRF) vulnerability in image_proxy.php (high 8.2)
- [CVE-2023-41053](https://insights.sbomify.com/CVE-2023-41053/): Redis SORT_RO may bypass ACL configuration (low 3.3)
- [CVE-2023-41052](https://insights.sbomify.com/CVE-2023-41052/): Vyper: incorrect order of evaluation of side effects for some builtins (low 3.7)
- [CVE-2023-41051](https://insights.sbomify.com/CVE-2023-41051/): Default functions in VolatileMemory trait lack bounds checks in vm-memory (low 2.5)
- [CVE-2023-41050](https://insights.sbomify.com/CVE-2023-41050/): Information disclosure through Python's "format" functionality in Zope AccessControl (medium 6.8)
- [CVE-2023-4105](https://insights.sbomify.com/CVE-2023-4105/): Attachment of deleted message in a thread remains accessible and downloadable (low 3.1)
- [CVE-2023-41049](https://insights.sbomify.com/CVE-2023-41049/): Improper Neutralization of Script in Attributes in @dcl/single-sign-on-client (high 7.5)
- [CVE-2023-41048](https://insights.sbomify.com/CVE-2023-41048/): plone.namedfile vulnerable to Stored Cross Site Scripting with SVG images (low 3.7)
- [CVE-2023-41047](https://insights.sbomify.com/CVE-2023-41047/): Improper Neutralization of Special Elements Used in a Template Engine in OctoPrint (medium 6.2)
- [CVE-2023-41046](https://insights.sbomify.com/CVE-2023-41046/): Velocity execution without script rights in Xwiki platform (medium 6.3)
- [CVE-2023-41045](https://insights.sbomify.com/CVE-2023-41045/): Insecure source port usage for DNS queries in Graylog (low 3.7)
- [CVE-2023-41044](https://insights.sbomify.com/CVE-2023-41044/): Partial path traversal vulnerability in Support Bundle feature of Graylog (low 3.3)
- [CVE-2023-41043](https://insights.sbomify.com/CVE-2023-41043/): Discourse DoS via SvgSprite cache (medium 6.5)
- [CVE-2023-41042](https://insights.sbomify.com/CVE-2023-41042/): Discourse DoS via remote theme assets (medium 4.9)
- [CVE-2023-41041](https://insights.sbomify.com/CVE-2023-41041/): User session is still usable after logout in graylog2-server (low 2.6)
- [CVE-2023-41040](https://insights.sbomify.com/CVE-2023-41040/): GitPython blind local file inclusion (medium 4.0)
- [CVE-2023-4104](https://insights.sbomify.com/CVE-2023-4104/): Missing authorization in Mozilla VPN 2.16.1 (medium 5.5)
- [CVE-2023-41039](https://insights.sbomify.com/CVE-2023-41039/): Sandbox escape via various forms of "format" in RestrictedPython (high 8.3)
- [CVE-2023-41038](https://insights.sbomify.com/CVE-2023-41038/): Server crash when using specific form of SET BIND statement (high 7.5)
- [CVE-2023-41037](https://insights.sbomify.com/CVE-2023-41037/): Cleartext Signed Message Signature Spoofing in openpgpjs (medium 4.3)
- [CVE-2023-41036](https://insights.sbomify.com/CVE-2023-41036/): Macvim's Insecure Usage of IPC Mechanisms (high 7.8)
- [CVE-2023-41034](https://insights.sbomify.com/CVE-2023-41034/): DDFFileParser in eclipse leshan is vulnerable to XXE Attacks (medium 6.5)
- [CVE-2023-41033](https://insights.sbomify.com/CVE-2023-41033/): Memory corruption in Parasolid V35.0 (high 7.8)
- [CVE-2023-41032](https://insights.sbomify.com/CVE-2023-41032/): Memory corruption in Parasolid V34.1 (high 7.8)
- [CVE-2023-41031](https://insights.sbomify.com/CVE-2023-41031/): Juplink RX4-1500 homemng.htm Command Injection Vulnerability (high 8.0)
- [CVE-2023-41030](https://insights.sbomify.com/CVE-2023-41030/): Juplink RX4-1500 Hard-coded Credential Vulnerability (medium 6.3)
- [CVE-2023-4103](https://insights.sbomify.com/CVE-2023-4103/): Multiple vulnerabilities in IDM Sistemas QSige (high 8.8)
- [CVE-2023-41029](https://insights.sbomify.com/CVE-2023-41029/): Juplink RX4-1500 Command Injection Vulnerability (high 8.0)
- [CVE-2023-41028](https://insights.sbomify.com/CVE-2023-41028/): Juplink RX4-1500 Stack-based Buffer Overflow Vulnerability (critical 9.0)
- [CVE-2023-41027](https://insights.sbomify.com/CVE-2023-41027/): Juplink RX4-1500 Credential Disclosure Vulnerability (high 8.0)
- [CVE-2023-4102](https://insights.sbomify.com/CVE-2023-4102/): Multiple vulnerabilities in IDM Sistemas QSige (high 8.8)
- [CVE-2023-41015](https://insights.sbomify.com/CVE-2023-41015/): SQL injection in code-projects:online job portal (medium 5.5)
- [CVE-2023-41014](https://insights.sbomify.com/CVE-2023-41014/): SQL injection in code-projects:online job portal (critical 9.8)
- [CVE-2023-41013](https://insights.sbomify.com/CVE-2023-41013/): Cross-site scripting in icewarp:icewarp (medium 6.1)
- [CVE-2023-41012](https://insights.sbomify.com/CVE-2023-41012/): Auth bypass in chinamobile:intelligent home gateway firmware (critical 9.8)
- [CVE-2023-41011](https://insights.sbomify.com/CVE-2023-41011/): Command injection in chinamobile:intelligent home gateway firmware (critical 9.8)
- [CVE-2023-41010](https://insights.sbomify.com/CVE-2023-41010/): Hardcoded credentials in tianyisc:tewa-700g firmware (medium 5.5)
- [CVE-2023-4101](https://insights.sbomify.com/CVE-2023-4101/): Multiple vulnerabilities in IDM Sistemas QSige (high 8.8)
- [CVE-2023-41009](https://insights.sbomify.com/CVE-2023-41009/): File upload in adlered:bolo-solo (critical 9.8)
- [CVE-2023-41005](https://insights.sbomify.com/CVE-2023-41005/): Command injection in pagekit (high 7.8)
- [CVE-2023-41000](https://insights.sbomify.com/CVE-2023-41000/): Use after free in gpac:gpac (medium 5.5)
- [CVE-2023-4100](https://insights.sbomify.com/CVE-2023-4100/): Multiple vulnerabilities in IDM Sistemas QSige (medium 6.5)
- [CVE-2023-40998](https://insights.sbomify.com/CVE-2023-40998/): Memory corruption in o-ran-sc:ric message router (high 7.5)
- [CVE-2023-40997](https://insights.sbomify.com/CVE-2023-40997/): Memory corruption in o-ran-sc:ric message router (high 7.5)
- [CVE-2023-40992](https://insights.sbomify.com/CVE-2023-40992/): SQL injection in kishan0725:hospital management system (medium 6.5)
- [CVE-2023-4099](https://insights.sbomify.com/CVE-2023-4099/): Multiple vulnerabilities in IDM Sistemas QSige (high 7.6)
- [CVE-2023-40989](https://insights.sbomify.com/CVE-2023-40989/): SQL injection in jeecgboot (critical 9.8)
- [CVE-2023-40986](https://insights.sbomify.com/CVE-2023-40986/): Cross-site scripting in webmin:webmin (medium 5.4)
- [CVE-2023-40985](https://insights.sbomify.com/CVE-2023-40985/): Cross-site scripting in webmin:webmin (medium 5.4)
- [CVE-2023-40984](https://insights.sbomify.com/CVE-2023-40984/): Cross-site scripting in webmin:webmin (medium 5.4)
- [CVE-2023-40983](https://insights.sbomify.com/CVE-2023-40983/): Cross-site scripting in webmin:webmin (medium 6.1)
- [CVE-2023-40982](https://insights.sbomify.com/CVE-2023-40982/): Cross-site scripting in webmin:webmin (medium 5.4)
- [CVE-2023-40980](https://insights.sbomify.com/CVE-2023-40980/): File upload in diaowen:dwsurvey (critical 9.8)
- [CVE-2023-4098](https://insights.sbomify.com/CVE-2023-4098/): Multiple vulnerabilities in IDM Sistemas QSige (high 8.8)
- [CVE-2023-40970](https://insights.sbomify.com/CVE-2023-40970/): SQL injection in slims:senayan library management system (high 8.8)
- [CVE-2023-4097](https://insights.sbomify.com/CVE-2023-4097/): Multiple vulnerabilities in IDM Sistemas QSige (high 8.8)
- [CVE-2023-40969](https://insights.sbomify.com/CVE-2023-40969/): Server-side request forgery in slims:senayan library management system (medium 6.1)
- [CVE-2023-40968](https://insights.sbomify.com/CVE-2023-40968/): Memory corruption in hzeller:timg (high 7.5)
- [CVE-2023-4096](https://insights.sbomify.com/CVE-2023-4096/): Weak password recovery mechanism vulnerability in Fujitsu Arconte Áurea (high 8.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/242/