# Vulnerabilities published in 2023


- [CVE-2023-40116](https://insights.sbomify.com/CVE-2023-40116/): Security feature bypass in Android (high 7.8)
- [CVE-2023-40115](https://insights.sbomify.com/CVE-2023-40115/): Use after free in Android (critical 9.8)
- [CVE-2023-40114](https://insights.sbomify.com/CVE-2023-40114/): Use after free in Android (high 8.4)
- [CVE-2023-40113](https://insights.sbomify.com/CVE-2023-40113/): Missing authorization in Android (medium 5.5)
- [CVE-2023-40112](https://insights.sbomify.com/CVE-2023-40112/): Memory corruption in Android (medium 5.1)
- [CVE-2023-40111](https://insights.sbomify.com/CVE-2023-40111/): Privilege escalation in Android (high 7.8)
- [CVE-2023-40110](https://insights.sbomify.com/CVE-2023-40110/): Memory corruption in Android (medium 6.2)
- [CVE-2023-4011](https://insights.sbomify.com/CVE-2023-4011/): Allocation of Resources Without Limits or Throttling in GitLab (medium 4.3)
- [CVE-2023-40109](https://insights.sbomify.com/CVE-2023-40109/): Privilege escalation in Android (high 7.3)
- [CVE-2023-40108](https://insights.sbomify.com/CVE-2023-40108/): Missing authorization in Android (medium 5.5)
- [CVE-2023-40107](https://insights.sbomify.com/CVE-2023-40107/): Use after free in Android (high 7.4)
- [CVE-2023-40106](https://insights.sbomify.com/CVE-2023-40106/): Privilege escalation in Android (high 7.8)
- [CVE-2023-40105](https://insights.sbomify.com/CVE-2023-40105/): Missing authorization in Android (medium 5.5)
- [CVE-2023-40104](https://insights.sbomify.com/CVE-2023-40104/): Weak cryptography in Android (high 7.5)
- [CVE-2023-40103](https://insights.sbomify.com/CVE-2023-40103/): Memory corruption in Android (high 7.8)
- [CVE-2023-40101](https://insights.sbomify.com/CVE-2023-40101/): Memory corruption in Android (medium 5.5)
- [CVE-2023-40100](https://insights.sbomify.com/CVE-2023-40100/): Use after free in Android (high 8.4)
- [CVE-2023-40098](https://insights.sbomify.com/CVE-2023-40098/): Business logic in Android (medium 5.5)
- [CVE-2023-40097](https://insights.sbomify.com/CVE-2023-40097/): Privilege escalation in Android (high 7.8)
- [CVE-2023-40096](https://insights.sbomify.com/CVE-2023-40096/): Privilege escalation in Android (high 7.8)
- [CVE-2023-40095](https://insights.sbomify.com/CVE-2023-40095/): Privilege escalation in Android (high 7.8)
- [CVE-2023-40094](https://insights.sbomify.com/CVE-2023-40094/): Missing authorization in Android (high 7.8)
- [CVE-2023-40093](https://insights.sbomify.com/CVE-2023-40093/): Information disclosure in Android (medium 5.5)
- [CVE-2023-40092](https://insights.sbomify.com/CVE-2023-40092/): Information disclosure in Android (medium 5.5)
- [CVE-2023-40091](https://insights.sbomify.com/CVE-2023-40091/): Memory corruption in Android (high 7.8)
- [CVE-2023-40090](https://insights.sbomify.com/CVE-2023-40090/): Security feature bypass in Android (medium 6.5)
- [CVE-2023-4009](https://insights.sbomify.com/CVE-2023-4009/): Privilege Escalation for Project Owner and Project User Admin Roles in Ops Manager (high 7.2)
- [CVE-2023-40089](https://insights.sbomify.com/CVE-2023-40089/): Missing authorization in Android (high 7.8)
- [CVE-2023-40088](https://insights.sbomify.com/CVE-2023-40088/): Use after free in Android (high 8.8)
- [CVE-2023-40087](https://insights.sbomify.com/CVE-2023-40087/): Memory corruption in Android (high 8.8)
- [CVE-2023-40085](https://insights.sbomify.com/CVE-2023-40085/): Memory corruption in Android (low 3.3)
- [CVE-2023-40084](https://insights.sbomify.com/CVE-2023-40084/): Use after free in Android (high 7.8)
- [CVE-2023-40083](https://insights.sbomify.com/CVE-2023-40083/): Memory corruption in Android (medium 5.5)
- [CVE-2023-40082](https://insights.sbomify.com/CVE-2023-40082/): Weak cryptography in Android (critical 9.8)
- [CVE-2023-40081](https://insights.sbomify.com/CVE-2023-40081/): Information disclosure in Android (medium 5.5)
- [CVE-2023-40080](https://insights.sbomify.com/CVE-2023-40080/): Memory corruption in Android (high 7.8)
- [CVE-2023-4008](https://insights.sbomify.com/CVE-2023-4008/): Incorrect Ownership Assignment in GitLab (medium 5.3)
- [CVE-2023-40079](https://insights.sbomify.com/CVE-2023-40079/): Privilege escalation in Android (high 7.8)
- [CVE-2023-40078](https://insights.sbomify.com/CVE-2023-40078/): Memory corruption in Android (critical 9.8)
- [CVE-2023-40077](https://insights.sbomify.com/CVE-2023-40077/): Race condition in Android (critical 9.8)
- [CVE-2023-40076](https://insights.sbomify.com/CVE-2023-40076/): Privilege escalation in Android (medium 5.5)
- [CVE-2023-40075](https://insights.sbomify.com/CVE-2023-40075/): Denial of service in Android (medium 5.5)
- [CVE-2023-40074](https://insights.sbomify.com/CVE-2023-40074/): Denial of service in Android (medium 5.5)
- [CVE-2023-40073](https://insights.sbomify.com/CVE-2023-40073/): Information disclosure in Android (medium 5.5)
- [CVE-2023-40072](https://insights.sbomify.com/CVE-2023-40072/): Command injection in WAB-I1750-PS (high 8.8)
- [CVE-2023-40071](https://insights.sbomify.com/CVE-2023-40071/): Privilege escalation in Intel(R) GPA software installers (high 7.3)
- [CVE-2023-40070](https://insights.sbomify.com/CVE-2023-40070/): Privilege escalation in Intel(R) Power Gadget software for macOS (high 8.8)
- [CVE-2023-4007](https://insights.sbomify.com/CVE-2023-4007/): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (high 8.8)
- [CVE-2023-40069](https://insights.sbomify.com/CVE-2023-40069/): Command injection in WRC-1167GHBK2 (critical 9.8)
- [CVE-2023-40068](https://insights.sbomify.com/CVE-2023-40068/): Cross-site scripting in Advanced Custom Fields (medium 5.4)
- [CVE-2023-40067](https://insights.sbomify.com/CVE-2023-40067/): Privilege escalation in Intel(R) CSME (medium 5.7)
- [CVE-2023-40062](https://insights.sbomify.com/CVE-2023-40062/): Incomplete List of Disallowed Inputs Remote Code Execution Vulnerability (high 8.0)
- [CVE-2023-40061](https://insights.sbomify.com/CVE-2023-40061/): Insecure Job Execution Mechanism Vulnerability (high 8.8)
- [CVE-2023-40060](https://insights.sbomify.com/CVE-2023-40060/): 2FA/MFA Bypass Vulnerability in Serv-U 15.4 and 15.4 Hotfix 1 (high 7.2)
- [CVE-2023-4006](https://insights.sbomify.com/CVE-2023-4006/): Improper Neutralization of Formula Elements in a CSV File in thorsten/phpmyfaq (high 8.8)
- [CVE-2023-40058](https://insights.sbomify.com/CVE-2023-40058/): Sensitive Information Disclosure Vulnerability (medium 6.5)
- [CVE-2023-40057](https://insights.sbomify.com/CVE-2023-40057/): SolarWinds Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code Execution (critical 9.0)
- [CVE-2023-40056](https://insights.sbomify.com/CVE-2023-40056/): SolarWinds Platform SQL Injection Remote Code Execution Vulnerability (high 8.0)
- [CVE-2023-40055](https://insights.sbomify.com/CVE-2023-40055/): SolarWinds Network Configuration Manager Directory Traversal Remote Code Execution Vulnerability (high 8.0)
- [CVE-2023-40054](https://insights.sbomify.com/CVE-2023-40054/): SolarWinds Network Configuration Manager Directory Traversal Remote Code Execution Vulnerability (high 8.0)
- [CVE-2023-40053](https://insights.sbomify.com/CVE-2023-40053/): HTML injection Vulnerability in Serv-U 15.4 (medium 5.0)
- [CVE-2023-40052](https://insights.sbomify.com/CVE-2023-40052/): Progress Application Server (PAS) for OpenEdge Denial of Service (high 7.5)
- [CVE-2023-40051](https://insights.sbomify.com/CVE-2023-40051/): Progress Application Server (PAS) for OpenEdge File Upload via Directory Traversal (critical 9.1)
- [CVE-2023-40050](https://insights.sbomify.com/CVE-2023-40050/): Automate Vulnerable to Malicious Content Uploaded Through Embedded Compliance Application (critical 9.9)
- [CVE-2023-4005](https://insights.sbomify.com/CVE-2023-4005/): Insufficient Session Expiration in fossbilling/fossbilling (low 3.8)
- [CVE-2023-40049](https://insights.sbomify.com/CVE-2023-40049/): WS_FTP Server Information Disclosure via Directory Listing (medium 5.3)
- [CVE-2023-40048](https://insights.sbomify.com/CVE-2023-40048/): WS_FTP Server Cross-Site Request Forgery (CSRF) Vulnerability (medium 6.8)
- [CVE-2023-40047](https://insights.sbomify.com/CVE-2023-40047/): WS_FTP Server Stored Cross-Site Scripting Vulnerability (high 8.3)
- [CVE-2023-40046](https://insights.sbomify.com/CVE-2023-40046/): WS_FTP Server SQL Injection via Administrative Interface (high 8.2)
- [CVE-2023-40045](https://insights.sbomify.com/CVE-2023-40045/): WS_FTP Server Ad Hoc Transfer Module Reflected Cross-Site Scripting Vulnerability (high 8.3)
- [CVE-2023-40044](https://insights.sbomify.com/CVE-2023-40044/): Progress WS_FTP Server Deserialization of Untrusted Data (critical 10.0, exploited in the wild)
- [CVE-2023-40043](https://insights.sbomify.com/CVE-2023-40043/): MOVEit Transfer System Administrator SQL Injection (high 7.2)
- [CVE-2023-40042](https://insights.sbomify.com/CVE-2023-40042/): Memory corruption in totolink:t10 v2 firmware (critical 9.8)
- [CVE-2023-40041](https://insights.sbomify.com/CVE-2023-40041/): Memory corruption in totolink:t10 v2 firmware (critical 9.8)
- [CVE-2023-40040](https://insights.sbomify.com/CVE-2023-40040/): Missing authorization in mycrops:higrade (medium 5.3)
- [CVE-2023-4004](https://insights.sbomify.com/CVE-2023-4004/): Kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove() (high 7.8)
- [CVE-2023-40039](https://insights.sbomify.com/CVE-2023-40039/): Weak cryptography in arris:tg1672g firmware (critical 9.8)
- [CVE-2023-40038](https://insights.sbomify.com/CVE-2023-40038/): Weak cryptography in arris:dg1670a firmware (high 8.8)
- [CVE-2023-40037](https://insights.sbomify.com/CVE-2023-40037/): Apache NiFi: Incomplete Validation of JDBC and JNDI Connection URLs (medium 6.5)
- [CVE-2023-40036](https://insights.sbomify.com/CVE-2023-40036/): Notepad++ global buffer read overflow in CharDistributionAnalysis::HandleOneChar (medium 5.5)
- [CVE-2023-40035](https://insights.sbomify.com/CVE-2023-40035/): Craft CMS vulnerable to Remote Code Execution via validatePath bypass (high 7.2)
- [CVE-2023-40034](https://insights.sbomify.com/CVE-2023-40034/): Repositoty takeover in woodpecker-ci (high 8.1)
- [CVE-2023-40033](https://insights.sbomify.com/CVE-2023-40033/): Server-Side Request Forgery via Avatar upload in flarum (high 7.1)
- [CVE-2023-40032](https://insights.sbomify.com/CVE-2023-40032/): Potential segfault due to NULL pointer dereference in libvips (medium 5.5)
- [CVE-2023-40031](https://insights.sbomify.com/CVE-2023-40031/): Notepad++ vulnerable to heap buffer write overflow in Utf8_16_Read::convert (high 7.8)
- [CVE-2023-40030](https://insights.sbomify.com/CVE-2023-40030/): Malicious dependencies can inject arbitrary JavaScript into cargo-generated timing reports (medium 6.1)
- [CVE-2023-4003](https://insights.sbomify.com/CVE-2023-4003/): One Identity Password Manager version 5.9.7.1 - Unauthenticated physical access privilege escalation (high 7.6)
- [CVE-2023-40029](https://insights.sbomify.com/CVE-2023-40029/): Cluster secret might leak in cluster details page in Argo CD (critical 9.9)
- [CVE-2023-40028](https://insights.sbomify.com/CVE-2023-40028/): Arbitrary file read via symlinks in Ghost (medium 4.9)
- [CVE-2023-40027](https://insights.sbomify.com/CVE-2023-40027/): Conditionally missing authorization in @keystone-6/core (low 3.7)
- [CVE-2023-40026](https://insights.sbomify.com/CVE-2023-40026/): Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server (medium 5.0)
- [CVE-2023-40025](https://insights.sbomify.com/CVE-2023-40025/): Argo CD web terminal session doesn't expire (medium 4.7)
- [CVE-2023-40024](https://insights.sbomify.com/CVE-2023-40024/): Reflected Cross-Site Scripting (XSS) in scancode.io license endpoint (medium 5.4)
- [CVE-2023-40023](https://insights.sbomify.com/CVE-2023-40023/): Yaklang Plugin's Fuzztag Component Allows Unauthorized Local File Reading (medium 6.5)
- [CVE-2023-40022](https://insights.sbomify.com/CVE-2023-40022/): Rizin vulnerable to Integer Overflow in C++ demangler logic (high 7.8)
- [CVE-2023-40021](https://insights.sbomify.com/CVE-2023-40021/): Timing Attack Reveals CSRF Tokens in oppia (medium 5.3)
- [CVE-2023-40020](https://insights.sbomify.com/CVE-2023-40020/): Improper Authentication in PrivateUploader (critical 9.9)
- [CVE-2023-4002](https://insights.sbomify.com/CVE-2023-4002/): Insertion of Sensitive Information Into Sent Data in GitLab (medium 5.3)
- [CVE-2023-40019](https://insights.sbomify.com/CVE-2023-40019/): Denial of service in freeswitch (high 7.5)
- [CVE-2023-40018](https://insights.sbomify.com/CVE-2023-40018/): FreeSWITCH allows remote users to trigger out of bounds write by offering an ICE candidate with unknown component ID (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/250/