# Vulnerabilities published in 2023


- [CVE-2023-39211](https://insights.sbomify.com/CVE-2023-39211/): Privilege escalation in Zoom Desktop Client for Windows and Zoom Rooms for Windows (high 8.8)
- [CVE-2023-39210](https://insights.sbomify.com/CVE-2023-39210/): Information disclosure in Zoom Client SDK for Windows (medium 5.5)
- [CVE-2023-39209](https://insights.sbomify.com/CVE-2023-39209/): Information disclosure in Zoom Desktop Client for Windows (medium 5.9)
- [CVE-2023-39208](https://insights.sbomify.com/CVE-2023-39208/): Denial of service in Zoom Desktop Client for Linux (medium 6.5)
- [CVE-2023-39206](https://insights.sbomify.com/CVE-2023-39206/): Memory corruption in Zoom Clients (low 3.7)
- [CVE-2023-39205](https://insights.sbomify.com/CVE-2023-39205/): Denial of service in Zoom Clients (medium 4.3)
- [CVE-2023-39204](https://insights.sbomify.com/CVE-2023-39204/): Memory corruption in Zoom Clients (medium 4.3)
- [CVE-2023-39203](https://insights.sbomify.com/CVE-2023-39203/): Denial of service in Zoom Rooms Client for Windows and Zoom VDI Client (medium 4.3)
- [CVE-2023-39202](https://insights.sbomify.com/CVE-2023-39202/): Denial of service in Zoom Rooms Client for Windows and Zoom VDI Client (low 3.1)
- [CVE-2023-39201](https://insights.sbomify.com/CVE-2023-39201/): Privilege escalation in CleanZoom (high 7.2)
- [CVE-2023-3920](https://insights.sbomify.com/CVE-2023-3920/): Incorrect Authorization in GitLab (medium 4.3)
- [CVE-2023-39199](https://insights.sbomify.com/CVE-2023-39199/): Weak cryptography in Zoom Clients (medium 4.9)
- [CVE-2023-39198](https://insights.sbomify.com/CVE-2023-39198/): Kernel: qxl: race condition leading to use-after-free in qxl_mode_dumb_create() (high 7.5)
- [CVE-2023-39197](https://insights.sbomify.com/CVE-2023-39197/): Kernel: dccp: conntrack out-of-bounds read in nf_conntrack_dccp_packet() (medium 4.0)
- [CVE-2023-39196](https://insights.sbomify.com/CVE-2023-39196/): Apache Ozone Improper Authentication vulnerability (medium 5.3)
- [CVE-2023-39194](https://insights.sbomify.com/CVE-2023-39194/): Kernel: xfrm: out-of-bounds read in __xfrm_state_filter_match() (low 3.2)
- [CVE-2023-39193](https://insights.sbomify.com/CVE-2023-39193/): Kernel: netfilter: xtables sctp out-of-bounds read in match_flags() (medium 6.1)
- [CVE-2023-39192](https://insights.sbomify.com/CVE-2023-39192/): Kernel: netfilter: xtables out-of-bounds read in u32_match_it() (medium 6.7)
- [CVE-2023-39191](https://insights.sbomify.com/CVE-2023-39191/): Kernel: ebpf: insufficient stack type checks in dynptr (high 8.2)
- [CVE-2023-39189](https://insights.sbomify.com/CVE-2023-39189/): Kernel: netfilter: nftables out-of-bounds read in nf_osf_match_one() (medium 5.1)
- [CVE-2023-39188](https://insights.sbomify.com/CVE-2023-39188/): Memory corruption in Solid Edge SE2023 (high 7.8)
- [CVE-2023-39187](https://insights.sbomify.com/CVE-2023-39187/): Memory corruption in Solid Edge SE2023 (high 7.8)
- [CVE-2023-39186](https://insights.sbomify.com/CVE-2023-39186/): Memory corruption in Solid Edge SE2023 (high 7.8)
- [CVE-2023-39185](https://insights.sbomify.com/CVE-2023-39185/): Memory corruption in Solid Edge SE2023 (high 7.8)
- [CVE-2023-39184](https://insights.sbomify.com/CVE-2023-39184/): Memory corruption in Solid Edge SE2023 (high 7.8)
- [CVE-2023-39183](https://insights.sbomify.com/CVE-2023-39183/): Memory corruption in Solid Edge SE2023 (high 7.8)
- [CVE-2023-39182](https://insights.sbomify.com/CVE-2023-39182/): Memory corruption in Solid Edge SE2023 (high 7.8)
- [CVE-2023-39181](https://insights.sbomify.com/CVE-2023-39181/): Memory corruption in Solid Edge SE2023 (high 7.8)
- [CVE-2023-39180](https://insights.sbomify.com/CVE-2023-39180/): Kernel: ksmbd: read request memory leak denial-of-service vulnerability (medium 4.0)
- [CVE-2023-39179](https://insights.sbomify.com/CVE-2023-39179/): Kernel: ksmbd: read request out-of-bounds read information disclosure vulnerability (high 7.5)
- [CVE-2023-39176](https://insights.sbomify.com/CVE-2023-39176/): Kernel: ksmbd: transform header out-of-bounds read information disclosure vulnerability (medium 5.8)
- [CVE-2023-39175](https://insights.sbomify.com/CVE-2023-39175/): Cross-site scripting in TeamCity (medium 4.6)
- [CVE-2023-39174](https://insights.sbomify.com/CVE-2023-39174/): Denial of service in TeamCity (medium 4.3)
- [CVE-2023-39173](https://insights.sbomify.com/CVE-2023-39173/): Privilege escalation in TeamCity (medium 5.4)
- [CVE-2023-39172](https://insights.sbomify.com/CVE-2023-39172/): SENEC: Storage Box V1,V2 and V3 transmitting sensitive data unencrypted (critical 9.1)
- [CVE-2023-39171](https://insights.sbomify.com/CVE-2023-39171/): SENEC Storage Box V1,V2 and V3 accidentially expose a management interface (high 7.2)
- [CVE-2023-3917](https://insights.sbomify.com/CVE-2023-3917/): Improper Validation of Specified Type of Input in GitLab (medium 4.3)
- [CVE-2023-39169](https://insights.sbomify.com/CVE-2023-39169/): SENEC: Storage Box V1,V2 and V3 using default credentials (critical 9.8)
- [CVE-2023-39167](https://insights.sbomify.com/CVE-2023-39167/): SENEC: Storage Box V1,V2 and V3 affected by improper access control vulnerability (high 7.5)
- [CVE-2023-39166](https://insights.sbomify.com/CVE-2023-39166/): WordPress tagDiv Composer Plugin < 4.4 is vulnerable to Cross Site Request Forgery (CSRF) (high 7.1)
- [CVE-2023-39165](https://insights.sbomify.com/CVE-2023-39165/): WordPress Sign-up Sheets Plugin <= 2.2.8 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-39164](https://insights.sbomify.com/CVE-2023-39164/): WordPress Molongui Plugin <= 4.6.19 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-39163](https://insights.sbomify.com/CVE-2023-39163/): WordPress Phlox Shop plugin <= 2.0.0 - Unauthenticated Local File Inclusion vulnerability (high 8.6)
- [CVE-2023-39162](https://insights.sbomify.com/CVE-2023-39162/): WordPress User Email Verification for WooCommerce Plugin <= 3.5.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-39161](https://insights.sbomify.com/CVE-2023-39161/): WordPress Discussion Board plugin <= 2.4.8 - Content Injection vulnerability (medium 5.4)
- [CVE-2023-39159](https://insights.sbomify.com/CVE-2023-39159/): WordPress Fraud Prevention For Woocommerce Plugin <= 2.1.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-39158](https://insights.sbomify.com/CVE-2023-39158/): WordPress Woocommerce Category Banner Management Plugin <= 2.4.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-39157](https://insights.sbomify.com/CVE-2023-39157/): WordPress JetElements For Elementor Plugin <= 2.6.10 is vulnerable to Remote Code Execution (RCE) (critical 9.0)
- [CVE-2023-39156](https://insights.sbomify.com/CVE-2023-39156/): CSRF vulnerability in Bazaar Plugin (medium 5.3)
- [CVE-2023-39155](https://insights.sbomify.com/CVE-2023-39155/): Secret displayed without masking by Chef Identity Plugin (medium 5.3)
- [CVE-2023-39154](https://insights.sbomify.com/CVE-2023-39154/): Incorrect permission checks in Qualys Web App Scanning Connector Plugin allow capturing credentials (medium 6.5)
- [CVE-2023-39153](https://insights.sbomify.com/CVE-2023-39153/): CSRF vulnerability in GitLab Authentication Plugin (medium 5.4)
- [CVE-2023-39152](https://insights.sbomify.com/CVE-2023-39152/): Incorrect control flow in Jenkins Gradle Plugin breaks credentials masking in the build log (medium 6.5)
- [CVE-2023-39151](https://insights.sbomify.com/CVE-2023-39151/): Jenkins Stored Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2023-39150](https://insights.sbomify.com/CVE-2023-39150/): Code injection in maximus5:conemu (critical 9.8)
- [CVE-2023-3915](https://insights.sbomify.com/CVE-2023-3915/): Incorrect Execution-Assigned Permissions in GitLab (medium 6.5)
- [CVE-2023-39147](https://insights.sbomify.com/CVE-2023-39147/): File upload in webkul:uvdesk (high 7.8)
- [CVE-2023-39144](https://insights.sbomify.com/CVE-2023-39144/): Information disclosure in element55:knowmore (high 7.5)
- [CVE-2023-39143](https://insights.sbomify.com/CVE-2023-39143/): Path traversal in papercut:papercut mf (critical 9.8)
- [CVE-2023-39141](https://insights.sbomify.com/CVE-2023-39141/): webui-aria2 Path Traversal vulnerability (high 7.5)
- [CVE-2023-3914](https://insights.sbomify.com/CVE-2023-3914/): Incorrect User Management in GitLab (medium 5.4)
- [CVE-2023-39139](https://insights.sbomify.com/CVE-2023-39139/): Path traversal in Archive (high 7.8)
- [CVE-2023-39138](https://insights.sbomify.com/CVE-2023-39138/): Path traversal in ZIPFoundation (high 7.8)
- [CVE-2023-39137](https://insights.sbomify.com/CVE-2023-39137/): Filename spoofing in archive (high 7.8)
- [CVE-2023-39136](https://insights.sbomify.com/CVE-2023-39136/): Denial of service in ziparchive project:ziparchive (medium 5.5)
- [CVE-2023-39135](https://insights.sbomify.com/CVE-2023-39135/): Path traversal in Zip Swift (high 7.8)
- [CVE-2023-39130](https://insights.sbomify.com/CVE-2023-39130/): Memory corruption in gnu:gdb (medium 5.5)
- [CVE-2023-39129](https://insights.sbomify.com/CVE-2023-39129/): Use after free in gnu:gdb (medium 5.5)
- [CVE-2023-39128](https://insights.sbomify.com/CVE-2023-39128/): Memory corruption in gnu:gdb (medium 5.5)
- [CVE-2023-39125](https://insights.sbomify.com/CVE-2023-39125/): Integer overflow in ntsc-crt project:ntsc-crt (high 7.5)
- [CVE-2023-39122](https://insights.sbomify.com/CVE-2023-39122/): SQL injection in bmc:control-m (critical 9.8)
- [CVE-2023-39121](https://insights.sbomify.com/CVE-2023-39121/): SQL injection in emlog:emlog (high 7.2)
- [CVE-2023-39115](https://insights.sbomify.com/CVE-2023-39115/): Cross-site scripting in campcodes:complete online matrimonial website system script (critical 9.8)
- [CVE-2023-39114](https://insights.sbomify.com/CVE-2023-39114/): Memory corruption in miniupnp project:ngiflib (medium 5.5)
- [CVE-2023-39113](https://insights.sbomify.com/CVE-2023-39113/): Memory corruption in miniupnp project:ngiflib (medium 5.5)
- [CVE-2023-39112](https://insights.sbomify.com/CVE-2023-39112/): Auth bypass in shopex:ecshop (medium 6.5)
- [CVE-2023-39110](https://insights.sbomify.com/CVE-2023-39110/): Server-side request forgery in rconfig:rconfig (high 8.8)
- [CVE-2023-39109](https://insights.sbomify.com/CVE-2023-39109/): Server-side request forgery in rconfig:rconfig (high 8.8)
- [CVE-2023-39108](https://insights.sbomify.com/CVE-2023-39108/): Server-side request forgery in rconfig:rconfig (high 8.8)
- [CVE-2023-39107](https://insights.sbomify.com/CVE-2023-39107/): Path traversal in nomachine:nomachine (critical 9.1)
- [CVE-2023-39106](https://insights.sbomify.com/CVE-2023-39106/): Nacos Spring vulnerable to Unsafe Deserialization (high 8.8)
- [CVE-2023-39097](https://insights.sbomify.com/CVE-2023-39097/): Cross-site scripting in webboss:webboss.io cms (medium 5.4)
- [CVE-2023-39096](https://insights.sbomify.com/CVE-2023-39096/): Cross-site scripting in webboss:webboss.io cms (medium 5.4)
- [CVE-2023-39094](https://insights.sbomify.com/CVE-2023-39094/): Cross-site scripting in zerowdd:studentmanager (medium 5.4)
- [CVE-2023-3909](https://insights.sbomify.com/CVE-2023-3909/): Inefficient Regular Expression Complexity in GitLab (medium 4.3)
- [CVE-2023-39086](https://insights.sbomify.com/CVE-2023-39086/): Information disclosure in asus:rt-ac66u b1 firmware (high 7.5)
- [CVE-2023-39076](https://insights.sbomify.com/CVE-2023-39076/): Denial of service in gm:mylink infotainment system (medium 4.6)
- [CVE-2023-39075](https://insights.sbomify.com/CVE-2023-39075/): Denial of service in renault:zoe ev 2021 firmware (medium 4.6)
- [CVE-2023-39073](https://insights.sbomify.com/CVE-2023-39073/): Missing authorization in voltronicpower:snmp web pro (critical 9.8)
- [CVE-2023-39070](https://insights.sbomify.com/CVE-2023-39070/): Use after free in cppchecksolutions:cppcheck (high 7.8)
- [CVE-2023-3907](https://insights.sbomify.com/CVE-2023-3907/): Improper User Management in GitLab (medium 4.9)
- [CVE-2023-39069](https://insights.sbomify.com/CVE-2023-39069/): Auth bypass in strangebee:cortex (critical 9.8)
- [CVE-2023-39068](https://insights.sbomify.com/CVE-2023-39068/): Memory corruption in xiongmaitech:nb080s09s-klc firmware (high 7.5)
- [CVE-2023-39067](https://insights.sbomify.com/CVE-2023-39067/): Cross-site scripting in zlmediakit:zlmediakit (medium 6.1)
- [CVE-2023-39063](https://insights.sbomify.com/CVE-2023-39063/): Memory corruption in raidenftpd:raidenftpd (high 7.8)
- [CVE-2023-39062](https://insights.sbomify.com/CVE-2023-39062/): Spipu HTML2PDF vulnerable to cross-site scripting (medium 6.1)
- [CVE-2023-39061](https://insights.sbomify.com/CVE-2023-39061/): Cross-site request forgery in chamilo:chamilo (low 3.5)
- [CVE-2023-3906](https://insights.sbomify.com/CVE-2023-3906/): Improper Validation of Specified Type of Input in GitLab (low 3.5)
- [CVE-2023-39059](https://insights.sbomify.com/CVE-2023-39059/): Code injection in ansible semaphore (high 8.8)
- [CVE-2023-39058](https://insights.sbomify.com/CVE-2023-39058/): Information disclosure in the b members card project:the b members card (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/257/