# Vulnerabilities published in 2023


- [CVE-2023-38239](https://insights.sbomify.com/CVE-2023-38239/): ZDI-CAN-21242: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-38238](https://insights.sbomify.com/CVE-2023-38238/): ZDI-CAN-21243: Adobe Acrobat Reader DC Font Parsing Use-After-Free Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-38237](https://insights.sbomify.com/CVE-2023-38237/): ZDI-CAN-21244: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-38236](https://insights.sbomify.com/CVE-2023-38236/): ZDI-CAN-21247: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-38235](https://insights.sbomify.com/CVE-2023-38235/): ZDI-CAN-21356: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-38234](https://insights.sbomify.com/CVE-2023-38234/): ZDI-CAN-21359: Adobe Acrobat Reader DC Font Parsing Uninitialized Variable Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-38233](https://insights.sbomify.com/CVE-2023-38233/): ZDI-CAN-21337: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-38232](https://insights.sbomify.com/CVE-2023-38232/): ZDI-CAN-21357: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-38231](https://insights.sbomify.com/CVE-2023-38231/): ZDI-CAN-21334: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-38230](https://insights.sbomify.com/CVE-2023-38230/): ZDI-CAN-21318: Adobe Acrobat Reader DC Font Parsing Use-After-Free Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-3823](https://insights.sbomify.com/CVE-2023-3823/): Security issue with external entity loading in XML without enabling it (high 8.6)
- [CVE-2023-38229](https://insights.sbomify.com/CVE-2023-38229/): ZDI-CAN-21310: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (high 7.8)
- [CVE-2023-38228](https://insights.sbomify.com/CVE-2023-38228/): ZDI-CAN-21317: Adobe Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-38227](https://insights.sbomify.com/CVE-2023-38227/): ZDI-CAN-21241: Adobe Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-38226](https://insights.sbomify.com/CVE-2023-38226/): ZDI-CAN-21240: Adobe Acrobat Reader DC Font Parsing Uninitialized Variable Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-38225](https://insights.sbomify.com/CVE-2023-38225/): ZDI-CAN-21118: Adobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-38224](https://insights.sbomify.com/CVE-2023-38224/): ZDI-CAN-21122: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-38223](https://insights.sbomify.com/CVE-2023-38223/): ZDI-CAN-21063: Adobe Acrobat Reader DC Font Parsing Uninitialized Variable Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-38222](https://insights.sbomify.com/CVE-2023-38222/): Use after free in Acrobat Reader (high 7.8)
- [CVE-2023-38221](https://insights.sbomify.com/CVE-2023-38221/): Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) (high 8.0)
- [CVE-2023-38220](https://insights.sbomify.com/CVE-2023-38220/): Full page cache enumeration via cookie X-Magento-Vary (high 7.5)
- [CVE-2023-3822](https://insights.sbomify.com/CVE-2023-3822/): Cross-site Scripting (XSS) - Reflected in pimcore/pimcore (medium 6.0)
- [CVE-2023-38219](https://insights.sbomify.com/CVE-2023-38219/): Validate Your Inputs | Cross-site Scripting (Stored XSS) (CWE-79) - Customer to Admin stored XSS with Gift wrapping (high 8.7)
- [CVE-2023-38218](https://insights.sbomify.com/CVE-2023-38218/): Incorrect Authorization - Customer account takeover (high 8.8)
- [CVE-2023-38217](https://insights.sbomify.com/CVE-2023-38217/): ZDI-CAN-21403: Adobe Bridge Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-38216](https://insights.sbomify.com/CVE-2023-38216/): ZDI-CAN-21404: Adobe Bridge Font Parsing Use-After-Free Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-38215](https://insights.sbomify.com/CVE-2023-38215/): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 5.4)
- [CVE-2023-38214](https://insights.sbomify.com/CVE-2023-38214/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2023-38213](https://insights.sbomify.com/CVE-2023-38213/): ZDI-CAN-21094: Adobe Dimension GLB File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-38212](https://insights.sbomify.com/CVE-2023-38212/): ZDI-CAN-21093: Adobe Dimension GLB File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-38211](https://insights.sbomify.com/CVE-2023-38211/): ZDI-CAN-21078: Adobe Dimension GLB File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-38210](https://insights.sbomify.com/CVE-2023-38210/): Other | Uncontrolled Resource Consumption (CWE-400) (medium 5.5)
- [CVE-2023-3821](https://insights.sbomify.com/CVE-2023-3821/): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (medium 6.1)
- [CVE-2023-38209](https://insights.sbomify.com/CVE-2023-38209/): Adobe Commerce Incorrect Authorization Security feature bypass (medium 6.5)
- [CVE-2023-38208](https://insights.sbomify.com/CVE-2023-38208/): Magento Open Source allows Improper Neutralization of Special Elements Used (critical 9.1)
- [CVE-2023-38207](https://insights.sbomify.com/CVE-2023-38207/): Adobe Commerce XML Injection (aka Blind XPath Injection) Arbitrary file system read (high 7.5)
- [CVE-2023-38206](https://insights.sbomify.com/CVE-2023-38206/): ColdFusion | Improper Access Control (CWE-284) (medium 5.3)
- [CVE-2023-38205](https://insights.sbomify.com/CVE-2023-38205/): Adobe ColdFusion Improper Access Control (high 7.5, exploited in the wild)
- [CVE-2023-38204](https://insights.sbomify.com/CVE-2023-38204/): Bypass APSB23-41 (CVE-2023-38203) - Pre-Auth RCE ColdFusion 2021 Update 8 (critical 9.8)
- [CVE-2023-38203](https://insights.sbomify.com/CVE-2023-38203/): Adobe ColdFusion Deserialization of Untrusted Data (critical 9.8, exploited in the wild)
- [CVE-2023-38201](https://insights.sbomify.com/CVE-2023-38201/): Keylime: challenge-response protocol bypass during agent registration (medium 6.5)
- [CVE-2023-38200](https://insights.sbomify.com/CVE-2023-38200/): Keylime: registrar is subject to a dos against ssl connections (high 7.5)
- [CVE-2023-3820](https://insights.sbomify.com/CVE-2023-3820/): SQL Injection in pimcore/pimcore (high 7.2)
- [CVE-2023-38199](https://insights.sbomify.com/CVE-2023-38199/): Security feature bypass in owasp:coreruleset (critical 9.8)
- [CVE-2023-38198](https://insights.sbomify.com/CVE-2023-38198/): Code injection in acme.sh project:acme.sh (critical 9.8)
- [CVE-2023-38197](https://insights.sbomify.com/CVE-2023-38197/): Denial of service in qt:qt (high 7.5)
- [CVE-2023-38195](https://insights.sbomify.com/CVE-2023-38195/): Information disclosure in datalust:seq (medium 4.9)
- [CVE-2023-38194](https://insights.sbomify.com/CVE-2023-38194/): Cross-site scripting in superwebmailer:superwebmailer (medium 6.1)
- [CVE-2023-38193](https://insights.sbomify.com/CVE-2023-38193/): Command injection in superwebmailer:superwebmailer (high 8.8)
- [CVE-2023-38192](https://insights.sbomify.com/CVE-2023-38192/): Cross-site scripting in superwebmailer:superwebmailer (medium 6.1)
- [CVE-2023-38191](https://insights.sbomify.com/CVE-2023-38191/): Cross-site scripting in superwebmailer:superwebmailer (medium 6.1)
- [CVE-2023-38190](https://insights.sbomify.com/CVE-2023-38190/): SQL injection in superwebmailer:superwebmailer (high 8.8)
- [CVE-2023-3819](https://insights.sbomify.com/CVE-2023-3819/): Exposure of Sensitive Information to an Unauthorized Actor in pimcore/pimcore (high 7.6)
- [CVE-2023-38188](https://insights.sbomify.com/CVE-2023-38188/): Azure Apache Hadoop Spoofing Vulnerability (medium 4.5)
- [CVE-2023-38187](https://insights.sbomify.com/CVE-2023-38187/): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (medium 6.5)
- [CVE-2023-38186](https://insights.sbomify.com/CVE-2023-38186/): Windows Mobile Device Management Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2023-38185](https://insights.sbomify.com/CVE-2023-38185/): Microsoft Exchange Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-38184](https://insights.sbomify.com/CVE-2023-38184/): Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (high 7.5)
- [CVE-2023-38182](https://insights.sbomify.com/CVE-2023-38182/): Microsoft Exchange Server Remote Code Execution Vulnerability (high 8.0)
- [CVE-2023-38181](https://insights.sbomify.com/CVE-2023-38181/): Microsoft Exchange Server Spoofing Vulnerability (high 8.8)
- [CVE-2023-38180](https://insights.sbomify.com/CVE-2023-38180/): Microsoft .NET Core and Visual Studio Denial-of-Service (high 7.5, exploited in the wild)
- [CVE-2023-38178](https://insights.sbomify.com/CVE-2023-38178/): .NET Core and Visual Studio Denial of Service Vulnerability (high 7.5)
- [CVE-2023-38177](https://insights.sbomify.com/CVE-2023-38177/): Microsoft SharePoint Server Remote Code Execution Vulnerability (medium 6.1)
- [CVE-2023-38176](https://insights.sbomify.com/CVE-2023-38176/): Azure Arc-Enabled Servers Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2023-38175](https://insights.sbomify.com/CVE-2023-38175/): Microsoft Windows Defender Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2023-38174](https://insights.sbomify.com/CVE-2023-38174/): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (medium 4.3)
- [CVE-2023-38173](https://insights.sbomify.com/CVE-2023-38173/): Microsoft Edge for Android Spoofing Vulnerability (medium 4.3)
- [CVE-2023-38172](https://insights.sbomify.com/CVE-2023-38172/): Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability (high 7.5)
- [CVE-2023-38171](https://insights.sbomify.com/CVE-2023-38171/): Microsoft QUIC Denial of Service Vulnerability (high 7.5)
- [CVE-2023-38170](https://insights.sbomify.com/CVE-2023-38170/): HEVC Video Extensions Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-3817](https://insights.sbomify.com/CVE-2023-3817/): Excessive time spent checking DH q parameter value (medium 5.3)
- [CVE-2023-38169](https://insights.sbomify.com/CVE-2023-38169/): Microsoft SQL OLE DB Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-38167](https://insights.sbomify.com/CVE-2023-38167/): Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability (high 7.2)
- [CVE-2023-38166](https://insights.sbomify.com/CVE-2023-38166/): Layer 2 Tunneling Protocol Remote Code Execution Vulnerability (high 8.1)
- [CVE-2023-38164](https://insights.sbomify.com/CVE-2023-38164/): Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability (high 7.6)
- [CVE-2023-38163](https://insights.sbomify.com/CVE-2023-38163/): Windows Defender Attack Surface Reduction Security Feature Bypass (high 7.8)
- [CVE-2023-38162](https://insights.sbomify.com/CVE-2023-38162/): DHCP Server Service Denial of Service Vulnerability (high 7.5)
- [CVE-2023-38161](https://insights.sbomify.com/CVE-2023-38161/): Windows GDI Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2023-38160](https://insights.sbomify.com/CVE-2023-38160/): Windows TCP/IP Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-38159](https://insights.sbomify.com/CVE-2023-38159/): Windows Graphics Component Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2023-38158](https://insights.sbomify.com/CVE-2023-38158/): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (low 3.1)
- [CVE-2023-38157](https://insights.sbomify.com/CVE-2023-38157/): Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (medium 6.5)
- [CVE-2023-38156](https://insights.sbomify.com/CVE-2023-38156/): Azure HDInsight Apache Ambari JDBC Injection Elevation of Privilege Vulnerability (high 7.2)
- [CVE-2023-38155](https://insights.sbomify.com/CVE-2023-38155/): Azure DevOps Server Remote Code Execution Vulnerability (high 7.0)
- [CVE-2023-38154](https://insights.sbomify.com/CVE-2023-38154/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2023-38152](https://insights.sbomify.com/CVE-2023-38152/): DHCP Server Service Information Disclosure Vulnerability (medium 5.3)
- [CVE-2023-38151](https://insights.sbomify.com/CVE-2023-38151/): Microsoft Host Integration Server 2020 Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-38150](https://insights.sbomify.com/CVE-2023-38150/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2023-3815](https://insights.sbomify.com/CVE-2023-3815/): y_project RuoYi File Upload uploadFilesPath cross site scripting (low 3.5)
- [CVE-2023-38149](https://insights.sbomify.com/CVE-2023-38149/): Windows TCP/IP Denial of Service Vulnerability (high 7.5)
- [CVE-2023-38148](https://insights.sbomify.com/CVE-2023-38148/): Internet Connection Sharing (ICS) Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-38147](https://insights.sbomify.com/CVE-2023-38147/): Windows Miracast Wireless Display Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-38146](https://insights.sbomify.com/CVE-2023-38146/): Windows Themes Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-38144](https://insights.sbomify.com/CVE-2023-38144/): Windows Common Log File System Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2023-38143](https://insights.sbomify.com/CVE-2023-38143/): Windows Common Log File System Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2023-38142](https://insights.sbomify.com/CVE-2023-38142/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2023-38141](https://insights.sbomify.com/CVE-2023-38141/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2023-38140](https://insights.sbomify.com/CVE-2023-38140/): Windows Kernel Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-3814](https://insights.sbomify.com/CVE-2023-3814/): Advanced File Manager < 5.1.1 - Admin+ Arbitrary File/Folder Access (medium 4.9)
- [CVE-2023-38139](https://insights.sbomify.com/CVE-2023-38139/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/265/