# Vulnerabilities published in 2023


- [CVE-2023-3942](https://insights.sbomify.com/CVE-2023-3942/): Multiple SQLi in ZkTeco-based OEM devices (high 7.5)
- [CVE-2023-39419](https://insights.sbomify.com/CVE-2023-39419/): Memory corruption in Solid Edge SE2023 (high 7.8)
- [CVE-2023-39418](https://insights.sbomify.com/CVE-2023-39418/): Postgresql: merge fails to enforce update or select row security policies (low 3.1)
- [CVE-2023-39417](https://insights.sbomify.com/CVE-2023-39417/): Postgresql: extension script @substitutions@ within quoting allow sql injection (high 7.5)
- [CVE-2023-39416](https://insights.sbomify.com/CVE-2023-39416/): Command injection in Proself Enterprise/Standard Edition (high 7.2)
- [CVE-2023-39415](https://insights.sbomify.com/CVE-2023-39415/): Auth bypass in Proself Enterprise/Standard Edition (high 7.5)
- [CVE-2023-39414](https://insights.sbomify.com/CVE-2023-39414/): Integer overflow in GTKWave (high 7.0)
- [CVE-2023-39413](https://insights.sbomify.com/CVE-2023-39413/): Integer overflow in GTKWave (high 7.0)
- [CVE-2023-39412](https://insights.sbomify.com/CVE-2023-39412/): Cross-site request forgery in Intel Unison software (medium 5.4)
- [CVE-2023-39411](https://insights.sbomify.com/CVE-2023-39411/): Denial of service in Intel Unison software (medium 5.0)
- [CVE-2023-39410](https://insights.sbomify.com/CVE-2023-39410/): Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK (high 7.5)
- [CVE-2023-3941](https://insights.sbomify.com/CVE-2023-3941/): Multiple arbitrary file writes in ZkTeco-based OEM devices (critical 10.0)
- [CVE-2023-39409](https://insights.sbomify.com/CVE-2023-39409/): Memory corruption in EMUI (high 7.5)
- [CVE-2023-39408](https://insights.sbomify.com/CVE-2023-39408/): Memory corruption in EMUI (high 7.5)
- [CVE-2023-39407](https://insights.sbomify.com/CVE-2023-39407/): Path traversal in HarmonyOS (critical 9.1)
- [CVE-2023-39406](https://insights.sbomify.com/CVE-2023-39406/): Missing authorization in EMUI (high 7.5)
- [CVE-2023-39405](https://insights.sbomify.com/CVE-2023-39405/): Memory corruption in EMUI (critical 9.8)
- [CVE-2023-39404](https://insights.sbomify.com/CVE-2023-39404/): Denial of service in EMUI (high 7.5)
- [CVE-2023-39403](https://insights.sbomify.com/CVE-2023-39403/): Missing authorization in EMUI (critical 9.1)
- [CVE-2023-39402](https://insights.sbomify.com/CVE-2023-39402/): Path traversal in EMUI (critical 9.1)
- [CVE-2023-39401](https://insights.sbomify.com/CVE-2023-39401/): Path traversal in EMUI (critical 9.1)
- [CVE-2023-39400](https://insights.sbomify.com/CVE-2023-39400/): Path traversal in EMUI (critical 9.1)
- [CVE-2023-3940](https://insights.sbomify.com/CVE-2023-3940/): Multiple arbitrary file reads in ZkTeco-based OEM devices (high 7.5)
- [CVE-2023-39399](https://insights.sbomify.com/CVE-2023-39399/): Missing authorization in EMUI (critical 9.1)
- [CVE-2023-39398](https://insights.sbomify.com/CVE-2023-39398/): Missing authorization in EMUI (critical 9.1)
- [CVE-2023-39397](https://insights.sbomify.com/CVE-2023-39397/): Null dereference in EMUI (high 7.5)
- [CVE-2023-39396](https://insights.sbomify.com/CVE-2023-39396/): Deserialization in EMUI (high 7.5)
- [CVE-2023-39395](https://insights.sbomify.com/CVE-2023-39395/): Other in EMUI (high 7.5)
- [CVE-2023-39394](https://insights.sbomify.com/CVE-2023-39394/): Privilege escalation in EMUI (high 7.5)
- [CVE-2023-39393](https://insights.sbomify.com/CVE-2023-39393/): Security feature bypass in EMUI (high 7.5)
- [CVE-2023-39392](https://insights.sbomify.com/CVE-2023-39392/): Security feature bypass in EMUI (high 7.5)
- [CVE-2023-39391](https://insights.sbomify.com/CVE-2023-39391/): Information disclosure in EMUI (high 7.5)
- [CVE-2023-39390](https://insights.sbomify.com/CVE-2023-39390/): Denial of service in EMUI (high 7.5)
- [CVE-2023-3939](https://insights.sbomify.com/CVE-2023-3939/): Multiple command injection in ZkTeco-based OEM devices (critical 10.0)
- [CVE-2023-39389](https://insights.sbomify.com/CVE-2023-39389/): Denial of service in EMUI (high 7.5)
- [CVE-2023-39388](https://insights.sbomify.com/CVE-2023-39388/): Denial of service in EMUI (high 7.5)
- [CVE-2023-39387](https://insights.sbomify.com/CVE-2023-39387/): Missing authorization in EMUI (medium 5.3)
- [CVE-2023-39386](https://insights.sbomify.com/CVE-2023-39386/): Other in EMUI (high 7.5)
- [CVE-2023-39385](https://insights.sbomify.com/CVE-2023-39385/): Misconfiguration in EMUI (critical 9.1)
- [CVE-2023-39384](https://insights.sbomify.com/CVE-2023-39384/): Missing authorization in EMUI (high 7.5)
- [CVE-2023-39383](https://insights.sbomify.com/CVE-2023-39383/): Other in EMUI (high 7.5)
- [CVE-2023-39382](https://insights.sbomify.com/CVE-2023-39382/): Denial of service in EMUI (high 7.5)
- [CVE-2023-39381](https://insights.sbomify.com/CVE-2023-39381/): Denial of service in EMUI (high 7.5)
- [CVE-2023-39380](https://insights.sbomify.com/CVE-2023-39380/): Missing authorization in EMUI (high 7.5)
- [CVE-2023-3938](https://insights.sbomify.com/CVE-2023-3938/): Bypassing ZkTeco-based OEM devices/ZKTeco biometric authentication system via SQLi in QR code (medium 4.6)
- [CVE-2023-39379](https://insights.sbomify.com/CVE-2023-39379/): Information disclosure in Fujitsu Software Infrastructure Manager Advanced Edition (high 7.5)
- [CVE-2023-39378](https://insights.sbomify.com/CVE-2023-39378/): SQL injection in SiberianCMS (high 8.8)
- [CVE-2023-39377](https://insights.sbomify.com/CVE-2023-39377/): File upload in SiberianCMS (high 7.2)
- [CVE-2023-39376](https://insights.sbomify.com/CVE-2023-39376/): SiberianCMS - CWE-284: Improper Access Control Authorized user may disable a security feature over the network (medium 6.5)
- [CVE-2023-39375](https://insights.sbomify.com/CVE-2023-39375/): SiberianCMS - CWE-274: Improper Handling of Insufficient Privileges (high 7.5)
- [CVE-2023-39374](https://insights.sbomify.com/CVE-2023-39374/): ForeScout NAC SecureConnector – CWE-427: Uncontrolled Search Path Element (high 7.8)
- [CVE-2023-39373](https://insights.sbomify.com/CVE-2023-39373/): Hyundai car CWE-294: Authentication Bypass by Capture-replay (high 7.4)
- [CVE-2023-39372](https://insights.sbomify.com/CVE-2023-39372/): StarTrinity Softswitch version 2023-02-16 - multiple CSRF (CWE-352) (high 8.1)
- [CVE-2023-39371](https://insights.sbomify.com/CVE-2023-39371/): StarTrinity Softswitch version 2023-02-16 – Open Redirect (CWE-601) (high 8.8)
- [CVE-2023-39370](https://insights.sbomify.com/CVE-2023-39370/): StarTrinity Softswitch version 2023-02-16 - Persistent XSS (CWE-79) (high 8.8)
- [CVE-2023-3937](https://insights.sbomify.com/CVE-2023-3937/): Cross site scripting vulnerabilities in Snow License Manager (medium 4.8)
- [CVE-2023-39369](https://insights.sbomify.com/CVE-2023-39369/): StarTrinity Softswitch version 2023-02-16 - multiple Reflected XSS (CWE-79) (high 8.8)
- [CVE-2023-39368](https://insights.sbomify.com/CVE-2023-39368/): Security feature bypass in Intel(R) Processors (medium 6.5)
- [CVE-2023-39367](https://insights.sbomify.com/CVE-2023-39367/): Command injection in Smart Reader (critical 9.1)
- [CVE-2023-39366](https://insights.sbomify.com/CVE-2023-39366/): Stored Cross-site Scripting in data_sources.php through Device-Name in 'select' input in Cacti (medium 6.1)
- [CVE-2023-39365](https://insights.sbomify.com/CVE-2023-39365/): Unchecked regular expressions can lead to SQL Injection and data leakage in Cacti (medium 4.6)
- [CVE-2023-39364](https://insights.sbomify.com/CVE-2023-39364/): Open redirect in change password functionality in Cacti (low 3.5)
- [CVE-2023-39363](https://insights.sbomify.com/CVE-2023-39363/): Vyper incorrectly allocated named re-entrancy locks (critical 9.1)
- [CVE-2023-39362](https://insights.sbomify.com/CVE-2023-39362/): Authenticated command injection in SNMP options of a Device (high 7.2)
- [CVE-2023-39361](https://insights.sbomify.com/CVE-2023-39361/): Unauthenticated SQL Injection in graph_view.php in Cacti (critical 9.8)
- [CVE-2023-39360](https://insights.sbomify.com/CVE-2023-39360/): Reflected Cross-site Scripting in graphs_new.php in Cacti (medium 6.1)
- [CVE-2023-3936](https://insights.sbomify.com/CVE-2023-3936/): Blog2Social < 7.2.1 - Reflected XSS (medium 6.1)
- [CVE-2023-39359](https://insights.sbomify.com/CVE-2023-39359/): Authenticated SQL injection vulnerability in graphs.php in Cacti (high 8.8)
- [CVE-2023-39358](https://insights.sbomify.com/CVE-2023-39358/): Authenticated SQL injection vulnerability in reports_user.php in Cacti (high 8.8)
- [CVE-2023-39357](https://insights.sbomify.com/CVE-2023-39357/): A Defect in sql_save() Causes Multiple SQL Injection Vulnerabilities in Cacti (high 8.8)
- [CVE-2023-39356](https://insights.sbomify.com/CVE-2023-39356/): Missing offset validation leading to Out-of-Bounds Read in FreeRDP (medium 5.3)
- [CVE-2023-39355](https://insights.sbomify.com/CVE-2023-39355/): FreeRDP Use-After-Free in RDPGFX_CMDID_RESETGRAPHICS (high 7.0)
- [CVE-2023-39354](https://insights.sbomify.com/CVE-2023-39354/): FreeRDP Out-Of-Bounds Read in nsc_rle_decompress_data (medium 5.9)
- [CVE-2023-39353](https://insights.sbomify.com/CVE-2023-39353/): Missing offset validation leading to Out Of Bound Read in FreeRDP (medium 5.3)
- [CVE-2023-39352](https://insights.sbomify.com/CVE-2023-39352/): Invalid offset validation leading to Out Of Bound Write in FreeRDP (medium 5.3)
- [CVE-2023-39351](https://insights.sbomify.com/CVE-2023-39351/): FreeRDP Null Pointer Dereference leading denial of service (medium 5.3)
- [CVE-2023-39350](https://insights.sbomify.com/CVE-2023-39350/): Incorrect offset calculation leading to denial of service in FreeRDP (medium 5.9)
- [CVE-2023-3935](https://insights.sbomify.com/CVE-2023-3935/): Wibu: Buffer Overflow in CodeMeter Runtime (critical 9.8)
- [CVE-2023-39349](https://insights.sbomify.com/CVE-2023-39349/): Sentry vulnerable to privilege escalation via ApiTokensEndpoint (high 8.1)
- [CVE-2023-39348](https://insights.sbomify.com/CVE-2023-39348/): Improper log output when using GitHub Status Notifications in spinnaker (medium 4.0)
- [CVE-2023-39347](https://insights.sbomify.com/CVE-2023-39347/): Cilium NetworkPolicy bypass via pod labels (high 7.6)
- [CVE-2023-39346](https://insights.sbomify.com/CVE-2023-39346/): File upload in LinuxASMCallGraph (high 8.8)
- [CVE-2023-39345](https://insights.sbomify.com/CVE-2023-39345/): Unauthorized Access to Private Fields in User Registration API in strapi (high 7.6)
- [CVE-2023-39344](https://insights.sbomify.com/CVE-2023-39344/): social-media-skeleton vulnerable to Pre-Auth SQLi leading to RCE (critical 10.0)
- [CVE-2023-39343](https://insights.sbomify.com/CVE-2023-39343/): Sulu Observable Response Discrepancy on Admin Login (medium 4.3)
- [CVE-2023-39342](https://insights.sbomify.com/CVE-2023-39342/): Dangerzone CLI does not sanitize ANSI escape characters (low 3.6)
- [CVE-2023-39341](https://insights.sbomify.com/CVE-2023-39341/): Denial of service in ActSecure χ (low 3.3)
- [CVE-2023-39340](https://insights.sbomify.com/CVE-2023-39340/): Denial of service in Connect Secure (high 7.5)
- [CVE-2023-39339](https://insights.sbomify.com/CVE-2023-39339/): Path traversal in Policy Secure (medium 4.9)
- [CVE-2023-39338](https://insights.sbomify.com/CVE-2023-39338/): Missing authorization in Sentry (medium 6.8)
- [CVE-2023-39337](https://insights.sbomify.com/CVE-2023-39337/): Information disclosure in EPMM (critical 9.1)
- [CVE-2023-39336](https://insights.sbomify.com/CVE-2023-39336/): SQL injection in Endpoint Manager (critical 9.6)
- [CVE-2023-39335](https://insights.sbomify.com/CVE-2023-39335/): Auth bypass in EPMM (critical 9.8)
- [CVE-2023-39333](https://insights.sbomify.com/CVE-2023-39333/): Code injection in Node (medium 5.3)
- [CVE-2023-39332](https://insights.sbomify.com/CVE-2023-39332/): Path traversal in Node (critical 9.8)
- [CVE-2023-39331](https://insights.sbomify.com/CVE-2023-39331/): Path traversal in Node (high 7.7)
- [CVE-2023-3933](https://insights.sbomify.com/CVE-2023-3933/): Your Journey <= 1.9.8 - Prototype Pollution to Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-39329](https://insights.sbomify.com/CVE-2023-39329/): Openjpeg: resource exhaustion will occur in the opj_t1_decode_cblks function in the tcd.c (medium 6.5)
- [CVE-2023-39328](https://insights.sbomify.com/CVE-2023-39328/): Openjpeg: denail of service via crafted image file (medium 5.5)
- [CVE-2023-39327](https://insights.sbomify.com/CVE-2023-39327/): Openjpeg: malicious files can cause the program to enter a large loop (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/255/