# Vulnerabilities published in 2023


- [CVE-2023-39519](https://insights.sbomify.com/CVE-2023-39519/): CloudExplorer Lite sensitive information leakage vulnerability (high 7.5)
- [CVE-2023-39518](https://insights.sbomify.com/CVE-2023-39518/): social-media-skeleton stored Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2023-39517](https://insights.sbomify.com/CVE-2023-39517/): Cross site scripting (XSS) when clicking on an untrusted `<map>` link in Joplin (high 8.2)
- [CVE-2023-39516](https://insights.sbomify.com/CVE-2023-39516/): Stored Cross-Site-Scripting on data_sources.php debug html-block in Cacti (medium 6.1)
- [CVE-2023-39515](https://insights.sbomify.com/CVE-2023-39515/): Stored Cross-site Scripting on data_debug.php datasource path view in Cacti (medium 6.1)
- [CVE-2023-39514](https://insights.sbomify.com/CVE-2023-39514/): Stored Cross-site Scripting on graphs.php data template formated name view in Cacti (medium 6.1)
- [CVE-2023-39513](https://insights.sbomify.com/CVE-2023-39513/): Stored Cross-site Scripting on host.php verbose data-query debug view in Cacti (medium 6.1)
- [CVE-2023-39512](https://insights.sbomify.com/CVE-2023-39512/): Stored Cross-site Scripting on data_sources.php device name view in Cacti (medium 6.1)
- [CVE-2023-39511](https://insights.sbomify.com/CVE-2023-39511/): Stored Cross-Site-Scripting on reports_admin.php device name in Cacti (medium 6.1)
- [CVE-2023-39510](https://insights.sbomify.com/CVE-2023-39510/): Stored Cross-site Scripting in reports_admin.php through Device-Name in 'select' input in Cacti (medium 6.1)
- [CVE-2023-39509](https://insights.sbomify.com/CVE-2023-39509/): Command injection in Camera Firmware (high 7.2)
- [CVE-2023-39508](https://insights.sbomify.com/CVE-2023-39508/): Apache Airflow: Airflow "Run task" feature allows execution with unnecessary priviledges (high 8.8)
- [CVE-2023-39507](https://insights.sbomify.com/CVE-2023-39507/): Missing authorization in "Rikunabi NEXT" App for Android (medium 6.1)
- [CVE-2023-39506](https://insights.sbomify.com/CVE-2023-39506/): PDF-XChange Editor createDataObject Directory Traversal Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-39505](https://insights.sbomify.com/CVE-2023-39505/): PDF-XChange Editor Net.HTTP.requests Exposed Dangerous Function Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-39504](https://insights.sbomify.com/CVE-2023-39504/): PDF-XChange Editor OXPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2023-39503](https://insights.sbomify.com/CVE-2023-39503/): PDF-XChange Editor OXPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2023-39502](https://insights.sbomify.com/CVE-2023-39502/): PDF-XChange Editor OXPS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-39501](https://insights.sbomify.com/CVE-2023-39501/): PDF-XChange Editor OXPS File Parsing Untrusted Pointer Dereference Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-39500](https://insights.sbomify.com/CVE-2023-39500/): PDF-XChange Editor JPG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-3950](https://insights.sbomify.com/CVE-2023-3950/): Cleartext Storage of Sensitive Information in GitLab (medium 5.5)
- [CVE-2023-39499](https://insights.sbomify.com/CVE-2023-39499/): PDF-XChange Editor JPG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-39498](https://insights.sbomify.com/CVE-2023-39498/): PDF-XChange Editor JPG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-39497](https://insights.sbomify.com/CVE-2023-39497/): PDF-XChange Editor JPG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-39496](https://insights.sbomify.com/CVE-2023-39496/): PDF-XChange Editor TIF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-39495](https://insights.sbomify.com/CVE-2023-39495/): PDF-XChange Editor readFileIntoStream Exposed Dangerous Function Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-39494](https://insights.sbomify.com/CVE-2023-39494/): PDF-XChange Editor OXPS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-39493](https://insights.sbomify.com/CVE-2023-39493/): PDF-XChange Editor exportAsText Exposed Dangerous Method Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-39492](https://insights.sbomify.com/CVE-2023-39492/): PDF-XChange Editor PDF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-39491](https://insights.sbomify.com/CVE-2023-39491/): PDF-XChange Editor TIF File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-39490](https://insights.sbomify.com/CVE-2023-39490/): PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-3949](https://insights.sbomify.com/CVE-2023-3949/): Insertion of Sensitive Information Into Sent Data in GitLab (medium 5.3)
- [CVE-2023-39489](https://insights.sbomify.com/CVE-2023-39489/): PDF-XChange Editor TIF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-39488](https://insights.sbomify.com/CVE-2023-39488/): PDF-XChange Editor TIF File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-39487](https://insights.sbomify.com/CVE-2023-39487/): PDF-XChange Editor util Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2023-39486](https://insights.sbomify.com/CVE-2023-39486/): PDF-XChange Editor JP2 File Parsing Memory Corruption Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-39485](https://insights.sbomify.com/CVE-2023-39485/): PDF-XChange Editor JP2 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-39484](https://insights.sbomify.com/CVE-2023-39484/): PDF-XChange Editor PDF File Parsing Uninitialized Variable Information Disclosure Vulnerability (low 3.3)
- [CVE-2023-39483](https://insights.sbomify.com/CVE-2023-39483/): PDF-XChange Editor J2K File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2023-39482](https://insights.sbomify.com/CVE-2023-39482/): Softing Secure Integration Server Hardcoded Cryptographic Key Information Disclosure Vulnerability (medium 4.9)
- [CVE-2023-39481](https://insights.sbomify.com/CVE-2023-39481/): Softing Secure Integration Server Interpretation Conflict Remote Code Execution Vulnerability (medium 6.6)
- [CVE-2023-39480](https://insights.sbomify.com/CVE-2023-39480/): Softing Secure Integration Server FileDirectory OPC UA Object Arbitrary File Creation Vulnerability (medium 4.4)
- [CVE-2023-39479](https://insights.sbomify.com/CVE-2023-39479/): Softing Secure Integration Server OPC UA Gateway Directory Creation Vulnerability (medium 6.6)
- [CVE-2023-39478](https://insights.sbomify.com/CVE-2023-39478/): Softing Secure Integration Server Exposure of Resource to Wrong Sphere Remote Code Execution Vulnerability (medium 6.6)
- [CVE-2023-39477](https://insights.sbomify.com/CVE-2023-39477/): Inductive Automation Ignition ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability (high 7.5)
- [CVE-2023-39476](https://insights.sbomify.com/CVE-2023-39476/): Deserialization in Ignition (critical 9.8)
- [CVE-2023-39475](https://insights.sbomify.com/CVE-2023-39475/): Deserialization in Ignition (critical 9.8)
- [CVE-2023-39474](https://insights.sbomify.com/CVE-2023-39474/): Inductive Automation Ignition downloadLaunchClientJar Remote Code Execution Vulnerability (high 8.0)
- [CVE-2023-39473](https://insights.sbomify.com/CVE-2023-39473/): Deserialization in Ignition (high 8.8)
- [CVE-2023-39472](https://insights.sbomify.com/CVE-2023-39472/): Inductive Automation Ignition SimpleXMLReader XML External Entity Processing Information Disclosure Vulnerability (medium 6.5)
- [CVE-2023-39471](https://insights.sbomify.com/CVE-2023-39471/): TP-Link TL-WR841N ated_tp Command Injection Remote Code Execution Vulnerability (high 7.5)
- [CVE-2023-39470](https://insights.sbomify.com/CVE-2023-39470/): PaperCut NG print.script.sandboxed Exposed Dangerous Function Remote Code Execution Vulnerability (high 7.2)
- [CVE-2023-3947](https://insights.sbomify.com/CVE-2023-3947/): Video Conferencing with Zoom <= 4.2.1 - Sensitive Information Exposure (low 3.7)
- [CVE-2023-39469](https://insights.sbomify.com/CVE-2023-39469/): PaperCut NG External User Lookup Code Injection Remote Code Execution Vulnerability (high 7.2)
- [CVE-2023-39468](https://insights.sbomify.com/CVE-2023-39468/): Code injection in SCADA Data Gateway (high 7.2)
- [CVE-2023-39467](https://insights.sbomify.com/CVE-2023-39467/): Triangle MicroWorks SCADA Data Gateway certificate Information Disclosure Vulnerability (medium 5.3)
- [CVE-2023-39466](https://insights.sbomify.com/CVE-2023-39466/): Triangle MicroWorks SCADA Data Gateway get_config Missing Authentication Information Disclosure Vulnerability (medium 5.3)
- [CVE-2023-39465](https://insights.sbomify.com/CVE-2023-39465/): Triangle MicroWorks SCADA Data Gateway Use of Hard-coded Cryptograhic Key Information Disclosure Vulnerability (high 7.5)
- [CVE-2023-39464](https://insights.sbomify.com/CVE-2023-39464/): Triangle MicroWorks SCADA Data Gateway GTWWebMonitorService Unquoted Search Path Remote Code Execution Vulnerability (high 7.2)
- [CVE-2023-39463](https://insights.sbomify.com/CVE-2023-39463/): File upload in SCADA Data Gateway (high 7.2)
- [CVE-2023-39462](https://insights.sbomify.com/CVE-2023-39462/): Triangle MicroWorks SCADA Data Gateway Workspace Unrestricted Upload Vulnerability (medium 6.5)
- [CVE-2023-39461](https://insights.sbomify.com/CVE-2023-39461/): Other in SCADA Data Gateway (medium 4.4)
- [CVE-2023-39460](https://insights.sbomify.com/CVE-2023-39460/): Triangle MicroWorks SCADA Data Gateway Event Log Directory Traversal Arbitrary File Creation Vulnerability (high 7.2)
- [CVE-2023-3946](https://insights.sbomify.com/CVE-2023-3946/): Cross-site scripting in Trellix EPO (medium 5.4)
- [CVE-2023-39459](https://insights.sbomify.com/CVE-2023-39459/): Triangle MicroWorks SCADA Data Gateway Directory Traversal Arbitrary File Creation Vulnerability (high 7.8)
- [CVE-2023-39458](https://insights.sbomify.com/CVE-2023-39458/): Triangle MicroWorks SCADA Data Gateway Use of Hard-coded Credentials Authentication Bypass Vulnerability (medium 5.3)
- [CVE-2023-39457](https://insights.sbomify.com/CVE-2023-39457/): Triangle MicroWorks SCADA Data Gateway Missing Authentication Vulnerability (critical 9.8)
- [CVE-2023-39456](https://insights.sbomify.com/CVE-2023-39456/): Apache Traffic Server: Malformed http/2 frames can cause an abort (high 7.5)
- [CVE-2023-39455](https://insights.sbomify.com/CVE-2023-39455/): Command injection in WRC-1467GHBK-A (high 8.8)
- [CVE-2023-39454](https://insights.sbomify.com/CVE-2023-39454/): Memory corruption in WMC-2LX-B (high 8.8)
- [CVE-2023-39453](https://insights.sbomify.com/CVE-2023-39453/): Use after free in ImageGear (critical 9.8)
- [CVE-2023-39452](https://insights.sbomify.com/CVE-2023-39452/): Socomec MOD3GP-SY-120K Plaintext Storage of a Password (high 7.5)
- [CVE-2023-3945](https://insights.sbomify.com/CVE-2023-3945/): phpscriptpoint Lawyer search.php cross site scripting (low 3.5)
- [CVE-2023-39448](https://insights.sbomify.com/CVE-2023-39448/): Path traversal in SHIRASAGI (high 8.8)
- [CVE-2023-39447](https://insights.sbomify.com/CVE-2023-39447/): BIG-IP APM Guided Configuration vulnerability (medium 4.4)
- [CVE-2023-39446](https://insights.sbomify.com/CVE-2023-39446/): Socomec MOD3GP-SY-120K Cross-Site Request Forgery (high 8.9)
- [CVE-2023-39445](https://insights.sbomify.com/CVE-2023-39445/): Code injection in LAN-WH300N/RE (high 8.8)
- [CVE-2023-39444](https://insights.sbomify.com/CVE-2023-39444/): Memory corruption in GTKWave (high 7.8)
- [CVE-2023-39443](https://insights.sbomify.com/CVE-2023-39443/): Memory corruption in GTKWave (high 7.8)
- [CVE-2023-39441](https://insights.sbomify.com/CVE-2023-39441/): Apache Airflow missing Certificate Validation (medium 5.9)
- [CVE-2023-39440](https://insights.sbomify.com/CVE-2023-39440/): Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (medium 4.4)
- [CVE-2023-3944](https://insights.sbomify.com/CVE-2023-3944/): phpscriptpoint Lawyer page.php cross site scripting (low 3.5)
- [CVE-2023-39439](https://insights.sbomify.com/CVE-2023-39439/): SAP Commerce accepts empty passphrases. (high 8.8)
- [CVE-2023-39438](https://insights.sbomify.com/CVE-2023-39438/): Missing Authorization check allows certain operations on CLA Assistant data (high 8.1)
- [CVE-2023-39437](https://insights.sbomify.com/CVE-2023-39437/): Cross-Site Scripting (XSS) vulnerability in SAP Business One (high 7.6)
- [CVE-2023-39436](https://insights.sbomify.com/CVE-2023-39436/): Information Disclosure in SAP Supplier Relationship Management (medium 5.8)
- [CVE-2023-39435](https://insights.sbomify.com/CVE-2023-39435/): Zavio IP Camera Stack-Based Buffer Overflow (high 8.8)
- [CVE-2023-39434](https://insights.sbomify.com/CVE-2023-39434/): Use after free in iOS and iPadOS (high 8.8)
- [CVE-2023-39433](https://insights.sbomify.com/CVE-2023-39433/): Privilege escalation in Intel(R) CST software (medium 4.4)
- [CVE-2023-39432](https://insights.sbomify.com/CVE-2023-39432/): Privilege escalation in Intel(R) Ethernet tools and driver install software, (medium 6.7)
- [CVE-2023-39431](https://insights.sbomify.com/CVE-2023-39431/): Santesoft Sante DICOM Viewer Pro Out-of-bounds Write (high 7.8)
- [CVE-2023-3943](https://insights.sbomify.com/CVE-2023-3943/): Multiple buffer overflow in ZkTeco-based OEM devices (critical 10.0)
- [CVE-2023-39429](https://insights.sbomify.com/CVE-2023-39429/): Cross-site scripting in ACERA 1010 (medium 5.4)
- [CVE-2023-39427](https://insights.sbomify.com/CVE-2023-39427/): Ashlar-Vellum Cobalt, Xenon, Argon, Lithium Out-of-bounds Write (high 7.8)
- [CVE-2023-39425](https://insights.sbomify.com/CVE-2023-39425/): Privilege escalation in Intel(R) DSA software (high 8.8)
- [CVE-2023-39424](https://insights.sbomify.com/CVE-2023-39424/): File upload in IRM Next Generation (critical 9.9)
- [CVE-2023-39423](https://insights.sbomify.com/CVE-2023-39423/): Improper Neutralization of Special Elements used in an SQL Command in RDPData.dll (high 8.6)
- [CVE-2023-39422](https://insights.sbomify.com/CVE-2023-39422/): Use of Hard-coded Credentials in multiple /irmdata/api/ endpoints (medium 6.5)
- [CVE-2023-39421](https://insights.sbomify.com/CVE-2023-39421/): Use of Hard-coded Credentials in RDPWin.dll (high 7.7)
- [CVE-2023-39420](https://insights.sbomify.com/CVE-2023-39420/): Use of Hard-coded Credentials in RDPCore.dll (critical 9.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/254/