# Vulnerabilities published in 2023


- [CVE-2023-38349](https://insights.sbomify.com/CVE-2023-38349/): Cross-site request forgery in pnp4nagios:pnp4nagios (high 8.8)
- [CVE-2023-38348](https://insights.sbomify.com/CVE-2023-38348/): Cross-site request forgery in lw-systems:benno mailarchiv (high 8.8)
- [CVE-2023-38347](https://insights.sbomify.com/CVE-2023-38347/): Cross-site scripting in lw-systems:benno mailarchiv (medium 6.1)
- [CVE-2023-38346](https://insights.sbomify.com/CVE-2023-38346/): Path traversal in windriver:vxworks (high 8.8)
- [CVE-2023-38344](https://insights.sbomify.com/CVE-2023-38344/): Path traversal in ivanti:endpoint manager (medium 6.5)
- [CVE-2023-38343](https://insights.sbomify.com/CVE-2023-38343/): XML external entity in ivanti:endpoint manager (high 7.5)
- [CVE-2023-3834](https://insights.sbomify.com/CVE-2023-3834/): Bug Finder EX-RATE Ticket create cross site scripting (low 3.5)
- [CVE-2023-38337](https://insights.sbomify.com/CVE-2023-38337/): rswag vulnerable to arbitrary JSON and YAML file read via directory traversal (high 7.5)
- [CVE-2023-38336](https://insights.sbomify.com/CVE-2023-38336/): Command injection in netkit:netkit (critical 9.8)
- [CVE-2023-38335](https://insights.sbomify.com/CVE-2023-38335/): Security feature bypass in omnis:studio (medium 5.3)
- [CVE-2023-38334](https://insights.sbomify.com/CVE-2023-38334/): Security feature bypass in omnis:studio (medium 6.5)
- [CVE-2023-38333](https://insights.sbomify.com/CVE-2023-38333/): Cross-site scripting in zohocorp:manageengine applications manager (medium 6.1)
- [CVE-2023-38332](https://insights.sbomify.com/CVE-2023-38332/): Information disclosure in zohocorp:manageengine admanager plus (medium 6.5)
- [CVE-2023-38331](https://insights.sbomify.com/CVE-2023-38331/): Cross-site scripting in zohocorp:manageengine supportcenter plus (medium 5.4)
- [CVE-2023-38330](https://insights.sbomify.com/CVE-2023-38330/): File upload in oxid-esales:eshop (medium 5.3)
- [CVE-2023-3833](https://insights.sbomify.com/CVE-2023-3833/): Bug Finder Montage Ticket create cross site scripting (low 3.5)
- [CVE-2023-38329](https://insights.sbomify.com/CVE-2023-38329/): Cross-site scripting in egroupware:egroupware (medium 6.1)
- [CVE-2023-38328](https://insights.sbomify.com/CVE-2023-38328/): Information disclosure in egroupware:egroupware (medium 4.9)
- [CVE-2023-38327](https://insights.sbomify.com/CVE-2023-38327/): Information disclosure in egroupware:egroupware (medium 5.3)
- [CVE-2023-38325](https://insights.sbomify.com/CVE-2023-38325/): cryptography mishandles SSH certificates (high 7.5)
- [CVE-2023-38324](https://insights.sbomify.com/CVE-2023-38324/): Auth bypass in opennds:captive portal (medium 5.3)
- [CVE-2023-38323](https://insights.sbomify.com/CVE-2023-38323/): Command injection in opennds:opennds (critical 9.8)
- [CVE-2023-38322](https://insights.sbomify.com/CVE-2023-38322/): Null dereference in opennds:captive portal (high 7.5)
- [CVE-2023-38321](https://insights.sbomify.com/CVE-2023-38321/): Null dereference in sierrawireless:aleos (high 7.5)
- [CVE-2023-38320](https://insights.sbomify.com/CVE-2023-38320/): Null dereference in opennds:captive portal (high 7.5)
- [CVE-2023-3832](https://insights.sbomify.com/CVE-2023-3832/): Bug Finder Wedding Wonders Ticket create cross site scripting (low 3.5)
- [CVE-2023-38319](https://insights.sbomify.com/CVE-2023-38319/): Command injection in opennds:opennds (critical 9.8)
- [CVE-2023-38318](https://insights.sbomify.com/CVE-2023-38318/): Command injection in opennds:opennds (critical 9.8)
- [CVE-2023-38317](https://insights.sbomify.com/CVE-2023-38317/): Command injection in opennds:opennds (critical 9.8)
- [CVE-2023-38316](https://insights.sbomify.com/CVE-2023-38316/): Command injection in opennds:captive portal (critical 9.8)
- [CVE-2023-38315](https://insights.sbomify.com/CVE-2023-38315/): Null dereference in opennds:captive portal (high 7.5)
- [CVE-2023-38314](https://insights.sbomify.com/CVE-2023-38314/): Null dereference in opennds:captive portal (medium 6.5)
- [CVE-2023-38313](https://insights.sbomify.com/CVE-2023-38313/): Null dereference in opennds:captive portal (high 7.5)
- [CVE-2023-38312](https://insights.sbomify.com/CVE-2023-38312/): Path traversal in valvesoftware:counter-strike (high 7.5)
- [CVE-2023-38311](https://insights.sbomify.com/CVE-2023-38311/): Cross-site scripting in webmin:webmin (medium 5.4)
- [CVE-2023-38310](https://insights.sbomify.com/CVE-2023-38310/): Cross-site scripting in webmin:webmin (medium 5.4)
- [CVE-2023-3831](https://insights.sbomify.com/CVE-2023-3831/): Bug Finder Finounce Ticket create cross site scripting (low 3.5)
- [CVE-2023-38309](https://insights.sbomify.com/CVE-2023-38309/): Cross-site scripting in webmin:webmin (medium 6.1)
- [CVE-2023-38308](https://insights.sbomify.com/CVE-2023-38308/): Cross-site scripting in webmin:webmin (medium 6.1)
- [CVE-2023-38307](https://insights.sbomify.com/CVE-2023-38307/): Cross-site scripting in webmin:webmin (medium 5.4)
- [CVE-2023-38306](https://insights.sbomify.com/CVE-2023-38306/): Cross-site scripting in webmin:webmin (medium 6.1)
- [CVE-2023-38305](https://insights.sbomify.com/CVE-2023-38305/): Cross-site scripting in webmin:webmin (medium 6.1)
- [CVE-2023-38304](https://insights.sbomify.com/CVE-2023-38304/): Cross-site scripting in webmin:webmin (medium 5.4)
- [CVE-2023-38303](https://insights.sbomify.com/CVE-2023-38303/): Cross-site scripting in webmin:webmin (medium 5.4)
- [CVE-2023-38302](https://insights.sbomify.com/CVE-2023-38302/): A certain software build for the Sharp Rouvo V device (SHARP/VZW_STTM21VAPP/STTM21VAPP:12/SP1A.210812.016/1KN0_0_530:user/release-keys) leak (medium 4.3)
- [CVE-2023-38301](https://insights.sbomify.com/CVE-2023-38301/): An issue was discovered in a third-party component related to vendor.gsm.serial, shipped on devices from multiple device manufacturers. (low 3.4)
- [CVE-2023-38300](https://insights.sbomify.com/CVE-2023-38300/): A certain software build for the Orbic Maui device (Orbic/RC545L/RC545L:10/ORB545L_V1.4.2_BVZPP/230106:user/release-keys) leaks the IMEI and (medium 6.2)
- [CVE-2023-3830](https://insights.sbomify.com/CVE-2023-3830/): Bug Finder SASS BILLER store cross site scripting (low 3.5)
- [CVE-2023-38299](https://insights.sbomify.com/CVE-2023-38299/): Various software builds for the AT&T Calypso, Nokia C100, Nokia C200, and BLU View 3 devices leak the device IMEI to a system property that (medium 5.5)
- [CVE-2023-38298](https://insights.sbomify.com/CVE-2023-38298/): Various software builds for the following TCL devices (30Z, A3X, 20XE, 10L) leak the device IMEI to a system property that can be accessed b (high 8.8)
- [CVE-2023-38297](https://insights.sbomify.com/CVE-2023-38297/): An issue was discovered in a third-party com.factory.mmigroup component, shipped on devices from multiple device manufacturers. (high 8.4)
- [CVE-2023-38296](https://insights.sbomify.com/CVE-2023-38296/): Various software builds for the following TCL 30Z and TCL A3X devices leak the ICCID to a system property that can be accessed by any local (high 8.0)
- [CVE-2023-38295](https://insights.sbomify.com/CVE-2023-38295/): Certain software builds for the TCL 30Z and TCL 10 Android devices contain a vulnerable, pre-installed app that relies on a missing permissi (high 7.8)
- [CVE-2023-38294](https://insights.sbomify.com/CVE-2023-38294/): Certain software builds for the Itel Vision 3 Turbo Android device contain a vulnerable pre-installed app with a package name of com.transsi (medium 6.1)
- [CVE-2023-38293](https://insights.sbomify.com/CVE-2023-38293/): Certain software builds for the Nokia C200 and Nokia C100 Android devices contain a vulnerable, pre-installed app with a package name of com (high 7.3)
- [CVE-2023-38292](https://insights.sbomify.com/CVE-2023-38292/): Certain software builds for the TCL 20XE Android device contain a vulnerable, pre-installed app with a package name of com.tct.gcs.hiddenmen (high 8.7)
- [CVE-2023-38291](https://insights.sbomify.com/CVE-2023-38291/): An issue was discovered in a third-party component related to ro.boot.wifimacaddr, shipped on devices from multiple device manufacturers. (high 7.1)
- [CVE-2023-38290](https://insights.sbomify.com/CVE-2023-38290/): Certain software builds for the BLU View 2 and Sharp Rouvo V Android devices contain a vulnerable pre-installed app with a package name of c (high 7.8)
- [CVE-2023-3829](https://insights.sbomify.com/CVE-2023-3829/): Bug Finder ICOGenie Support Ticket create cross site scripting (low 3.5)
- [CVE-2023-38286](https://insights.sbomify.com/CVE-2023-38286/): Spring-boot-admin sandbox bypass via crafted HTML (high 7.5)
- [CVE-2023-38285](https://insights.sbomify.com/CVE-2023-38285/): Denial of service in owasp:modsecurity (high 7.5)
- [CVE-2023-38283](https://insights.sbomify.com/CVE-2023-38283/): Denial of service in openbgpd:openbgpd (medium 5.3)
- [CVE-2023-38281](https://insights.sbomify.com/CVE-2023-38281/): Multiple Vulnerabilities in IBM Cloud Pak System (medium 5.3)
- [CVE-2023-38280](https://insights.sbomify.com/CVE-2023-38280/): IBM Power HMC privilege escalation (high 8.4)
- [CVE-2023-3828](https://insights.sbomify.com/CVE-2023-3828/): Bug Finder Listplace Directory Listing Platform Photo coverPhotoUpdate cross site scripting (low 3.5)
- [CVE-2023-38276](https://insights.sbomify.com/CVE-2023-38276/): IBM Cognos Dashboards information disclosure (medium 5.9)
- [CVE-2023-38275](https://insights.sbomify.com/CVE-2023-38275/): IBM Cognos Dashboards information disclosure (medium 5.9)
- [CVE-2023-38273](https://insights.sbomify.com/CVE-2023-38273/): IBM Cloud Pak System information disclosure (high 7.5)
- [CVE-2023-38272](https://insights.sbomify.com/CVE-2023-38272/): IBM Cloud Pak System information disclosure (medium 5.9)
- [CVE-2023-38271](https://insights.sbomify.com/CVE-2023-38271/): IBM Cloud Pak System information disclosure (medium 4.3)
- [CVE-2023-3827](https://insights.sbomify.com/CVE-2023-3827/): Bug Finder Listplace Directory Listing Platform HTTP POST Request create cross site scripting (low 3.5)
- [CVE-2023-38268](https://insights.sbomify.com/CVE-2023-38268/): IBM InfoSphere Information Server cross-site request forgery (medium 4.3)
- [CVE-2023-38267](https://insights.sbomify.com/CVE-2023-38267/): IBM Security Access Manager Appliance information disclosure (medium 6.2)
- [CVE-2023-38265](https://insights.sbomify.com/CVE-2023-38265/): Information disclosure in Cloud Pak System (medium 5.3)
- [CVE-2023-38264](https://insights.sbomify.com/CVE-2023-38264/): IBM SDK, Java Technology Edition denial of service (medium 5.9)
- [CVE-2023-38263](https://insights.sbomify.com/CVE-2023-38263/): IBM SOAR QRadar Plugin App improper access controls (medium 6.5)
- [CVE-2023-38261](https://insights.sbomify.com/CVE-2023-38261/): Memory corruption in iOS and iPadOS (high 7.8)
- [CVE-2023-3826](https://insights.sbomify.com/CVE-2023-3826/): IBOS OA Interview edit&op=status sql injection (medium 6.3)
- [CVE-2023-38259](https://insights.sbomify.com/CVE-2023-38259/): Business logic in macOS (medium 5.5)
- [CVE-2023-38258](https://insights.sbomify.com/CVE-2023-38258/): Information disclosure in macOS (medium 5.5)
- [CVE-2023-38257](https://insights.sbomify.com/CVE-2023-38257/): CVE-2023-38257 (high 7.5)
- [CVE-2023-38256](https://insights.sbomify.com/CVE-2023-38256/): Dover Fueling Solutions MAGLINK LX Console Path Traversal (medium 6.8)
- [CVE-2023-38255](https://insights.sbomify.com/CVE-2023-38255/): Socomec MOD3GP-SY-120K Cross-site Scripting (medium 6.5)
- [CVE-2023-38254](https://insights.sbomify.com/CVE-2023-38254/): Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability (medium 6.5)
- [CVE-2023-38253](https://insights.sbomify.com/CVE-2023-38253/): W3m: out of bounds read in growbuf_to_str() at w3m/indep.c (medium 4.7)
- [CVE-2023-38252](https://insights.sbomify.com/CVE-2023-38252/): W3m: out of bounds read in strnew_size() at w3m/str.c (medium 4.7)
- [CVE-2023-38251](https://insights.sbomify.com/CVE-2023-38251/): Adobe Commerce | Uncontrolled Resource Consumption (CWE-400) (medium 5.3)
- [CVE-2023-38250](https://insights.sbomify.com/CVE-2023-38250/): Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) (high 8.0)
- [CVE-2023-3825](https://insights.sbomify.com/CVE-2023-3825/): Denial of service in KEPServerEX (high 7.5)
- [CVE-2023-38249](https://insights.sbomify.com/CVE-2023-38249/): Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) (high 8.0)
- [CVE-2023-38248](https://insights.sbomify.com/CVE-2023-38248/): ZDI-CAN-21494: Adobe Acrobat Reader DC PDF Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-38247](https://insights.sbomify.com/CVE-2023-38247/): ZDI-CAN-21449: Adobe Acrobat Reader DC PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-38246](https://insights.sbomify.com/CVE-2023-38246/): Adobe Acrobat Reader DC ActiveX Control (AxAcroPDFLib.AxAcroPDF) stack-based stale pointer vulnerability (high 7.8)
- [CVE-2023-38245](https://insights.sbomify.com/CVE-2023-38245/): Adobe Acrobat Reader DC ActiveX Control (AxAcroPDFLib.AxAcroPDF) src NTLMv2 SSO Hash Theft Vulnerability (medium 5.5)
- [CVE-2023-38244](https://insights.sbomify.com/CVE-2023-38244/): ZDI-CAN-21371: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-38243](https://insights.sbomify.com/CVE-2023-38243/): ZDI-CAN-21252: Adobe Acrobat Reader DC JBIG2 File Parsing Use-After-Free Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-38242](https://insights.sbomify.com/CVE-2023-38242/): ZDI-CAN-21387: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-38241](https://insights.sbomify.com/CVE-2023-38241/): ZDI-CAN-21246: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-38240](https://insights.sbomify.com/CVE-2023-38240/): ZDI-CAN-21245: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-3824](https://insights.sbomify.com/CVE-2023-3824/): Buffer overflow and overread in phar_dir_read() (critical 9.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/264/