# Vulnerabilities published in 2023


- [CVE-2023-39326](https://insights.sbomify.com/CVE-2023-39326/): Denial of service via chunk extensions in net/http (medium 5.3)
- [CVE-2023-39325](https://insights.sbomify.com/CVE-2023-39325/): HTTP/2 rapid reset can cause excessive work in net/http (high 7.5)
- [CVE-2023-39323](https://insights.sbomify.com/CVE-2023-39323/): Arbitrary code execution during build via line directives in cmd/go (high 8.1)
- [CVE-2023-39322](https://insights.sbomify.com/CVE-2023-39322/): Memory exhaustion in QUIC connection handling in crypto/tls (high 7.5)
- [CVE-2023-39321](https://insights.sbomify.com/CVE-2023-39321/): Panic when processing post-handshake message on QUIC connections in crypto/tls (high 7.5)
- [CVE-2023-39320](https://insights.sbomify.com/CVE-2023-39320/): Arbitrary code execution via go.mod toolchain directive in cmd/go (critical 9.8)
- [CVE-2023-3932](https://insights.sbomify.com/CVE-2023-3932/): Incorrect User Management in GitLab (high 8.2)
- [CVE-2023-39319](https://insights.sbomify.com/CVE-2023-39319/): Improper handling of special tags within script contexts in html/template (medium 6.1)
- [CVE-2023-39318](https://insights.sbomify.com/CVE-2023-39318/): Improper handling of HTML-like comments in script contexts in html/template (medium 6.1)
- [CVE-2023-39317](https://insights.sbomify.com/CVE-2023-39317/): Integer overflow in GTKWave (high 7.8)
- [CVE-2023-39316](https://insights.sbomify.com/CVE-2023-39316/): Integer overflow in GTKWave (high 7.8)
- [CVE-2023-39314](https://insights.sbomify.com/CVE-2023-39314/): WordPress Leyka Plugin <= 3.30.2 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-39313](https://insights.sbomify.com/CVE-2023-39313/): WordPress Avada theme <= 7.11.1 - Authenticated Server Side Request Forgery (SSRF) vulnerability (high 7.7)
- [CVE-2023-39312](https://insights.sbomify.com/CVE-2023-39312/): WordPress Avada theme <= 7.11.1 - Auth. Unrestricted Zip Extraction vulnerability (critical 9.1)
- [CVE-2023-39311](https://insights.sbomify.com/CVE-2023-39311/): WordPress Avada Builder plugin <= 3.11.1 - Cross Site Request Forgery (CSRF) vulnerability (high 7.1)
- [CVE-2023-39310](https://insights.sbomify.com/CVE-2023-39310/): WordPress Avada Builder plugin <= 3.11.1 - Authenticated Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-39309](https://insights.sbomify.com/CVE-2023-39309/): WordPress Avada Builder plugin <= 3.11.1 - Auth. SQL Injection vulnerability (high 8.5)
- [CVE-2023-39308](https://insights.sbomify.com/CVE-2023-39308/): WordPress User Feedback Plugin <= 1.0.7 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-39307](https://insights.sbomify.com/CVE-2023-39307/): WordPress Avada theme <= 7.11.1 - Authenticated Arbitrary File Upload vulnerability (high 8.5)
- [CVE-2023-39306](https://insights.sbomify.com/CVE-2023-39306/): WordPress Avada Builder plugin <= 3.11.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2023-39305](https://insights.sbomify.com/CVE-2023-39305/): WordPress Yet Another Stars Rating plugin <= 3.4.3 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-39303](https://insights.sbomify.com/CVE-2023-39303/): QTS, QuTS hero, QuTScloud (medium 5.3)
- [CVE-2023-39302](https://insights.sbomify.com/CVE-2023-39302/): QTS, QuTS hero, QuTScloud (medium 6.6)
- [CVE-2023-39301](https://insights.sbomify.com/CVE-2023-39301/): QTS, QuTS hero, QuTScloud (medium 4.3)
- [CVE-2023-39300](https://insights.sbomify.com/CVE-2023-39300/): QTS (high 7.2)
- [CVE-2023-39299](https://insights.sbomify.com/CVE-2023-39299/): Music Station (high 7.5)
- [CVE-2023-39298](https://insights.sbomify.com/CVE-2023-39298/): QTS, QuTS hero (high 7.8)
- [CVE-2023-39297](https://insights.sbomify.com/CVE-2023-39297/): QTS, QuTS hero, QuTScloud (high 8.8)
- [CVE-2023-39296](https://insights.sbomify.com/CVE-2023-39296/): QTS, QuTS hero (high 7.5)
- [CVE-2023-39295](https://insights.sbomify.com/CVE-2023-39295/): QuMagie (high 8.8)
- [CVE-2023-39294](https://insights.sbomify.com/CVE-2023-39294/): QTS, QuTS hero (medium 6.6)
- [CVE-2023-39293](https://insights.sbomify.com/CVE-2023-39293/): Command injection in mitel:mivoice office 400 (critical 9.8)
- [CVE-2023-39292](https://insights.sbomify.com/CVE-2023-39292/): SQL injection in mitel:mivoice office 400 (critical 9.8)
- [CVE-2023-39291](https://insights.sbomify.com/CVE-2023-39291/): Misconfiguration in mitel:mivoice connect (medium 4.9)
- [CVE-2023-39290](https://insights.sbomify.com/CVE-2023-39290/): Misconfiguration in mitel:mivoice connect (medium 4.9)
- [CVE-2023-39289](https://insights.sbomify.com/CVE-2023-39289/): Information disclosure in mitel:mivoice connect (high 7.5)
- [CVE-2023-39288](https://insights.sbomify.com/CVE-2023-39288/): Command injection in mitel:mivoice connect (medium 5.5)
- [CVE-2023-39287](https://insights.sbomify.com/CVE-2023-39287/): Command injection in mitel:mivoice connect (medium 5.5)
- [CVE-2023-39286](https://insights.sbomify.com/CVE-2023-39286/): Cross-site request forgery in mitel:connect mobility router (medium 4.3)
- [CVE-2023-39285](https://insights.sbomify.com/CVE-2023-39285/): Cross-site request forgery in mitel:mivoice connect (medium 4.3)
- [CVE-2023-39284](https://insights.sbomify.com/CVE-2023-39284/): Memory corruption in insyde:insydeh2o (medium 5.5)
- [CVE-2023-39283](https://insights.sbomify.com/CVE-2023-39283/): Memory corruption in insyde:insydeh2o (high 7.8)
- [CVE-2023-39281](https://insights.sbomify.com/CVE-2023-39281/): Memory corruption in insyde:insydeh2o (medium 5.7)
- [CVE-2023-39280](https://insights.sbomify.com/CVE-2023-39280/): Memory corruption in SonicOS (medium 6.5)
- [CVE-2023-39279](https://insights.sbomify.com/CVE-2023-39279/): Memory corruption in SonicOS (medium 6.5)
- [CVE-2023-39278](https://insights.sbomify.com/CVE-2023-39278/): Memory corruption in SonicOS (medium 6.5)
- [CVE-2023-39277](https://insights.sbomify.com/CVE-2023-39277/): Memory corruption in SonicOS (medium 6.5)
- [CVE-2023-39276](https://insights.sbomify.com/CVE-2023-39276/): Memory corruption in SonicOS (medium 6.5)
- [CVE-2023-39275](https://insights.sbomify.com/CVE-2023-39275/): Integer overflow in GTKWave (high 7.8)
- [CVE-2023-39274](https://insights.sbomify.com/CVE-2023-39274/): Integer overflow in GTKWave (high 7.8)
- [CVE-2023-39273](https://insights.sbomify.com/CVE-2023-39273/): Integer overflow in GTKWave (high 7.8)
- [CVE-2023-39272](https://insights.sbomify.com/CVE-2023-39272/): Integer overflow in GTKWave (high 7.8)
- [CVE-2023-39271](https://insights.sbomify.com/CVE-2023-39271/): Integer overflow in GTKWave (high 7.8)
- [CVE-2023-39270](https://insights.sbomify.com/CVE-2023-39270/): Integer overflow in GTKWave (high 7.8)
- [CVE-2023-39269](https://insights.sbomify.com/CVE-2023-39269/): Denial of service in RUGGEDCOM M2100 (high 7.5)
- [CVE-2023-39268](https://insights.sbomify.com/CVE-2023-39268/): Memory Corruption Vulnerability in ArubaOS-Switch (medium 4.5)
- [CVE-2023-39267](https://insights.sbomify.com/CVE-2023-39267/): Authenticated Denial of Service Vulnerability in ArubaOS-Switch Command Line Interface (medium 6.6)
- [CVE-2023-39266](https://insights.sbomify.com/CVE-2023-39266/): Unauthenticated Stored Cross-Site Scripting in ArubaOS-Switch (high 8.3)
- [CVE-2023-39265](https://insights.sbomify.com/CVE-2023-39265/): Apache Superset: Possible Unauthorized Registration of SQLite Database Connections (low 3.8)
- [CVE-2023-39264](https://insights.sbomify.com/CVE-2023-39264/): Apache Superset: Stack traces enabled by default (medium 4.3)
- [CVE-2023-39261](https://insights.sbomify.com/CVE-2023-39261/): Misconfiguration in IntelliJ IDEA (medium 5.2)
- [CVE-2023-39259](https://insights.sbomify.com/CVE-2023-39259/): Privilege escalation in Dell OS Recovery Tool (high 7.3)
- [CVE-2023-39257](https://insights.sbomify.com/CVE-2023-39257/): Privilege escalation in Rugged Control Center (RCC) (high 7.3)
- [CVE-2023-39256](https://insights.sbomify.com/CVE-2023-39256/): Privilege escalation in Rugged Control Center (RCC) (high 7.3)
- [CVE-2023-39254](https://insights.sbomify.com/CVE-2023-39254/): Privilege escalation in DUP Framework (medium 6.7)
- [CVE-2023-39253](https://insights.sbomify.com/CVE-2023-39253/): Privilege escalation in Dell OS Recovery Tool (high 7.3)
- [CVE-2023-39252](https://insights.sbomify.com/CVE-2023-39252/): Weak cryptography in Secure Connect Gateway (SCG) Policy Manager (medium 5.9)
- [CVE-2023-39251](https://insights.sbomify.com/CVE-2023-39251/): Memory corruption in CPG BIOS (medium 6.7)
- [CVE-2023-39250](https://insights.sbomify.com/CVE-2023-39250/): Information disclosure in Dell Storage Integration Tools for VMware (DSITV), Dell Storage vSphere Client Plugin (DSVCP), Replay Manager for VMware (RMSV) (high 7.8)
- [CVE-2023-39249](https://insights.sbomify.com/CVE-2023-39249/): Privilege escalation in SupportAssist Client Consumer (medium 6.3)
- [CVE-2023-39248](https://insights.sbomify.com/CVE-2023-39248/): Denial of service in Dell Networking OS10 (high 7.5)
- [CVE-2023-39246](https://insights.sbomify.com/CVE-2023-39246/): Privilege escalation in Dell Encryption, Dell Endpoint Security Suite Enterprise, Dell Security Management Server (Windows) (medium 4.6)
- [CVE-2023-39245](https://insights.sbomify.com/CVE-2023-39245/): Information disclosure in ESI (Enterprise Storage Integrator) for SAP LAMA (critical 9.8)
- [CVE-2023-39244](https://insights.sbomify.com/CVE-2023-39244/): Information disclosure in ESI (Enterprise Storage Integrator) for SAP LAMA (high 7.3)
- [CVE-2023-39240](https://insights.sbomify.com/CVE-2023-39240/): ASUS RT-AX55、RT-AX56U_V2 - Format String - 3 (high 7.2)
- [CVE-2023-39239](https://insights.sbomify.com/CVE-2023-39239/): ASUS RT-AX55、RT-AX56U_V2、RT-AC86U - Format String - 2 (high 7.2)
- [CVE-2023-39238](https://insights.sbomify.com/CVE-2023-39238/): ASUS RT-AX55、RT-AX56U_V2 - Format String - 1 (high 7.2)
- [CVE-2023-39237](https://insights.sbomify.com/CVE-2023-39237/): ASUS RT-AC86U - Command injection vulnerability - 5 (high 8.8)
- [CVE-2023-39236](https://insights.sbomify.com/CVE-2023-39236/): ASUS RT-AC86U - Command injection vulnerability - 4 (high 8.8)
- [CVE-2023-39235](https://insights.sbomify.com/CVE-2023-39235/): Memory corruption in GTKWave (high 7.8)
- [CVE-2023-39234](https://insights.sbomify.com/CVE-2023-39234/): Memory corruption in GTKWave (high 7.8)
- [CVE-2023-39233](https://insights.sbomify.com/CVE-2023-39233/): Information disclosure in macOS (medium 6.5)
- [CVE-2023-39231](https://insights.sbomify.com/CVE-2023-39231/): PingFederate PingOne MFA IK Device Pairing Second Factor Authentication Bypass (high 7.3)
- [CVE-2023-39230](https://insights.sbomify.com/CVE-2023-39230/): Privilege escalation in Intel Rapid Storage Technology software (medium 6.7)
- [CVE-2023-39228](https://insights.sbomify.com/CVE-2023-39228/): Missing authorization in Intel Unison software (medium 5.3)
- [CVE-2023-39227](https://insights.sbomify.com/CVE-2023-39227/): ​Softneta MedDream PACS Plaintext Storage of a Password (medium 6.1)
- [CVE-2023-39226](https://insights.sbomify.com/CVE-2023-39226/): Delta Electronics InfraSuite Device Master Exposed Dangerous Method Or Function (critical 9.8)
- [CVE-2023-39224](https://insights.sbomify.com/CVE-2023-39224/): Command injection in Archer C5 (high 8.0)
- [CVE-2023-39223](https://insights.sbomify.com/CVE-2023-39223/): Cross-site scripting in pmam.exe (medium 5.4)
- [CVE-2023-39222](https://insights.sbomify.com/CVE-2023-39222/): Command injection in ACERA 1010 (high 8.8)
- [CVE-2023-39221](https://insights.sbomify.com/CVE-2023-39221/): Missing authorization in Intel Unison software (medium 5.4)
- [CVE-2023-3922](https://insights.sbomify.com/CVE-2023-3922/): URL Redirection to Untrusted Site ('Open Redirect') in GitLab (low 3.0)
- [CVE-2023-39219](https://insights.sbomify.com/CVE-2023-39219/): Admin Console Denial of Service via Java class enumeration (high 7.5)
- [CVE-2023-39218](https://insights.sbomify.com/CVE-2023-39218/): Security feature bypass in Zoom Clients (medium 6.1)
- [CVE-2023-39217](https://insights.sbomify.com/CVE-2023-39217/): Denial of service in Zoom SDK's (medium 5.3)
- [CVE-2023-39216](https://insights.sbomify.com/CVE-2023-39216/): Other in Zoom Desktop Client for Windows (critical 9.6)
- [CVE-2023-39215](https://insights.sbomify.com/CVE-2023-39215/): Auth bypass in Zoom Clients (high 7.1)
- [CVE-2023-39214](https://insights.sbomify.com/CVE-2023-39214/): Denial of service in Zoom SDK's (high 7.6)
- [CVE-2023-39213](https://insights.sbomify.com/CVE-2023-39213/): Code injection in Zoom Desktop Client for Windows and Zoom VDI Client (critical 9.6)
- [CVE-2023-39212](https://insights.sbomify.com/CVE-2023-39212/): Denial of service in Zoom Rooms for Windows (high 7.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/256/