# Vulnerabilities published in 2023


- [CVE-2023-36478](https://insights.sbomify.com/CVE-2023-36478/): HTTP/2 HPACK integer overflow and buffer allocation (high 7.5)
- [CVE-2023-36477](https://insights.sbomify.com/CVE-2023-36477/): Persistent Cross-site Scripting (XSS) through CKEditor Configuration pages in XWiki Platform (critical 9.1)
- [CVE-2023-36476](https://insights.sbomify.com/CVE-2023-36476/): `calamares-nixos-extensions` LUKS keyfile exposure (high 7.9)
- [CVE-2023-36475](https://insights.sbomify.com/CVE-2023-36475/): Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution (critical 9.8)
- [CVE-2023-36474](https://insights.sbomify.com/CVE-2023-36474/): Interactsh server settings make users vulnerable to Subdomain Takeover (high 8.2)
- [CVE-2023-36473](https://insights.sbomify.com/CVE-2023-36473/): CSP nonce reuse vulnerability in Discourse (medium 6.8)
- [CVE-2023-36472](https://insights.sbomify.com/CVE-2023-36472/): Strapi may leak sensitive user information, user reset password, tokens via content-manager views (medium 5.8)
- [CVE-2023-36471](https://insights.sbomify.com/CVE-2023-36471/): HTML sanitizer allows form elements in restricted in org.xwiki.commons:xwiki-commons-xml (critical 9.1)
- [CVE-2023-36470](https://insights.sbomify.com/CVE-2023-36470/): Code injection in icon themes of XWiki Platform (critical 10.0)
- [CVE-2023-3647](https://insights.sbomify.com/CVE-2023-3647/): IURNY by INDIGITALL < 3.2.3 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-36469](https://insights.sbomify.com/CVE-2023-36469/): Code injection through NotificationRSSService in XWiki Platform (critical 10.0)
- [CVE-2023-36468](https://insights.sbomify.com/CVE-2023-36468/): Upgrading doesn't prevent exploiting vulnerable XWiki documents (critical 10.0)
- [CVE-2023-36467](https://insights.sbomify.com/CVE-2023-36467/): AWS data.all vulnerable to RCE through user injection of Python Commands (high 8.0)
- [CVE-2023-36466](https://insights.sbomify.com/CVE-2023-36466/): Topic Title Validation Skipped When Changing Category in Discourse (low 3.5)
- [CVE-2023-36465](https://insights.sbomify.com/CVE-2023-36465/): Decidim has broken access control in templates (critical 9.1)
- [CVE-2023-36464](https://insights.sbomify.com/CVE-2023-36464/): Infinite Loop when a comment isn't followed by a character in pypdf (medium 6.2)
- [CVE-2023-36463](https://insights.sbomify.com/CVE-2023-36463/): Cross site scripting (XSS) in meldekarten generator (medium 5.3)
- [CVE-2023-36462](https://insights.sbomify.com/CVE-2023-36462/): Mastodon's verified profile links can be formatted in a misleading way (medium 5.4)
- [CVE-2023-36461](https://insights.sbomify.com/CVE-2023-36461/): Mastodon vulnerable to Denial of Service through slow HTTP responses (high 7.5)
- [CVE-2023-36460](https://insights.sbomify.com/CVE-2023-36460/): Mastodon vulnerable to arbitrary file creation through media attachments (critical 10.0)
- [CVE-2023-3646](https://insights.sbomify.com/CVE-2023-3646/): Memory corruption in EOS (medium 5.9)
- [CVE-2023-36459](https://insights.sbomify.com/CVE-2023-36459/): Mastodon vulnerable to Cross-site Scripting through oEmbed preview cards (critical 9.3)
- [CVE-2023-36458](https://insights.sbomify.com/CVE-2023-36458/): 1Panel vulnerable to ommand injection when entering the container terminal (medium 6.3)
- [CVE-2023-36457](https://insights.sbomify.com/CVE-2023-36457/): 1Panel vulnerable to command injection when adding container repositories (medium 6.3)
- [CVE-2023-36456](https://insights.sbomify.com/CVE-2023-36456/): Authentik lacks Proxy IP headers validation (high 8.3)
- [CVE-2023-3645](https://insights.sbomify.com/CVE-2023-3645/): Contact Form Builder by Bit Form < 2.2.0 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-3644](https://insights.sbomify.com/CVE-2023-3644/): SourceCodester Service Provider Management System sql injection (medium 6.3)
- [CVE-2023-36439](https://insights.sbomify.com/CVE-2023-36439/): Microsoft Exchange Server Remote Code Execution Vulnerability (high 8.0)
- [CVE-2023-36438](https://insights.sbomify.com/CVE-2023-36438/): Windows TCP/IP Information Disclosure Vulnerability (high 7.5)
- [CVE-2023-36437](https://insights.sbomify.com/CVE-2023-36437/): Azure DevOps Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-36436](https://insights.sbomify.com/CVE-2023-36436/): Windows MSHTML Platform Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-36435](https://insights.sbomify.com/CVE-2023-36435/): Microsoft QUIC Denial of Service Vulnerability (high 7.5)
- [CVE-2023-36434](https://insights.sbomify.com/CVE-2023-36434/): Windows IIS Server Elevation of Privilege Vulnerability (critical 9.8)
- [CVE-2023-36433](https://insights.sbomify.com/CVE-2023-36433/): Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability (medium 6.5)
- [CVE-2023-36431](https://insights.sbomify.com/CVE-2023-36431/): Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability (high 7.5)
- [CVE-2023-3643](https://insights.sbomify.com/CVE-2023-3643/): Boss Mini document file inclusion (high 7.3)
- [CVE-2023-36429](https://insights.sbomify.com/CVE-2023-36429/): Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability (medium 6.5)
- [CVE-2023-36428](https://insights.sbomify.com/CVE-2023-36428/): Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-36427](https://insights.sbomify.com/CVE-2023-36427/): Windows Hyper-V Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2023-36425](https://insights.sbomify.com/CVE-2023-36425/): Windows Distributed File System (DFS) Remote Code Execution Vulnerability (high 8.0)
- [CVE-2023-36424](https://insights.sbomify.com/CVE-2023-36424/): Microsoft Windows Out-of-Bounds Read (high 7.8, exploited in the wild)
- [CVE-2023-36423](https://insights.sbomify.com/CVE-2023-36423/): Microsoft Remote Registry Service Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-36422](https://insights.sbomify.com/CVE-2023-36422/): Microsoft Windows Defender Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2023-36420](https://insights.sbomify.com/CVE-2023-36420/): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-3642](https://insights.sbomify.com/CVE-2023-3642/): GZ Scripts Vacation Rental Website HTTP POST Request cross site scripting (medium 4.3)
- [CVE-2023-36419](https://insights.sbomify.com/CVE-2023-36419/): Azure HDInsight Apache Oozie Workflow Scheduler XXE Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2023-36418](https://insights.sbomify.com/CVE-2023-36418/): Azure RTOS GUIX Studio Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-36417](https://insights.sbomify.com/CVE-2023-36417/): Microsoft SQL OLE DB Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-36416](https://insights.sbomify.com/CVE-2023-36416/): Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability (medium 6.1)
- [CVE-2023-36415](https://insights.sbomify.com/CVE-2023-36415/): Azure Identity SDK Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-36414](https://insights.sbomify.com/CVE-2023-36414/): Azure Identity SDK Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-36413](https://insights.sbomify.com/CVE-2023-36413/): Microsoft Office Security Feature Bypass Vulnerability (medium 6.5)
- [CVE-2023-36410](https://insights.sbomify.com/CVE-2023-36410/): Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability (high 7.6)
- [CVE-2023-3641](https://insights.sbomify.com/CVE-2023-3641/): khodakhah NodCMS POST Request blog-comment-4 cross site scripting (medium 4.3)
- [CVE-2023-36409](https://insights.sbomify.com/CVE-2023-36409/): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (medium 6.5)
- [CVE-2023-36408](https://insights.sbomify.com/CVE-2023-36408/): Windows Hyper-V Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2023-36407](https://insights.sbomify.com/CVE-2023-36407/): Windows Hyper-V Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2023-36406](https://insights.sbomify.com/CVE-2023-36406/): Windows Hyper-V Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-36405](https://insights.sbomify.com/CVE-2023-36405/): Windows Kernel Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2023-36404](https://insights.sbomify.com/CVE-2023-36404/): Windows Kernel Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-36403](https://insights.sbomify.com/CVE-2023-36403/): Windows Kernel Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2023-36402](https://insights.sbomify.com/CVE-2023-36402/): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-36401](https://insights.sbomify.com/CVE-2023-36401/): Microsoft Remote Registry Service Remote Code Execution Vulnerability (high 7.2)
- [CVE-2023-36400](https://insights.sbomify.com/CVE-2023-36400/): Windows HMAC Key Derivation Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2023-3640](https://insights.sbomify.com/CVE-2023-3640/): Information disclosure in Red Hat Enterprise Linux 6 (high 7.0)
- [CVE-2023-36399](https://insights.sbomify.com/CVE-2023-36399/): Windows Storage Elevation of Privilege Vulnerability (high 7.1)
- [CVE-2023-36398](https://insights.sbomify.com/CVE-2023-36398/): Windows NTFS Information Disclosure Vulnerability (medium 6.5)
- [CVE-2023-36397](https://insights.sbomify.com/CVE-2023-36397/): Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2023-36396](https://insights.sbomify.com/CVE-2023-36396/): Windows Compressed Folder Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-36395](https://insights.sbomify.com/CVE-2023-36395/): Windows Deployment Services Denial of Service Vulnerability (high 7.5)
- [CVE-2023-36394](https://insights.sbomify.com/CVE-2023-36394/): Windows Search Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2023-36393](https://insights.sbomify.com/CVE-2023-36393/): Windows User Interface Application Core Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-36392](https://insights.sbomify.com/CVE-2023-36392/): DHCP Server Service Denial of Service Vulnerability (high 7.5)
- [CVE-2023-36391](https://insights.sbomify.com/CVE-2023-36391/): Local Security Authority Subsystem Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2023-36390](https://insights.sbomify.com/CVE-2023-36390/): Cross-site scripting in RUGGEDCOM ROX MX5000 (high 8.8)
- [CVE-2023-36389](https://insights.sbomify.com/CVE-2023-36389/): Cross-site scripting in RUGGEDCOM ROX MX5000 (high 8.8)
- [CVE-2023-36388](https://insights.sbomify.com/CVE-2023-36388/): Apache Superset: Improper API permission for low privilege users allows for SSRF (medium 4.3)
- [CVE-2023-36387](https://insights.sbomify.com/CVE-2023-36387/): Apache Superset: Improper API permission for low privilege users (medium 5.4)
- [CVE-2023-36386](https://insights.sbomify.com/CVE-2023-36386/): Cross-site scripting in RUGGEDCOM ROX MX5000 (high 8.8)
- [CVE-2023-36385](https://insights.sbomify.com/CVE-2023-36385/): WordPress PostX – Gutenberg Blocks for Post Grid Plugin <= 2.9.9 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-36384](https://insights.sbomify.com/CVE-2023-36384/): WordPress Booking Calendar Contact Form Plugin <= 1.2.40 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-36383](https://insights.sbomify.com/CVE-2023-36383/): WordPress Event Manager for WooCommerce Plugin <= 3.9.5 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-36382](https://insights.sbomify.com/CVE-2023-36382/): WordPress Media Library Categories Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-36381](https://insights.sbomify.com/CVE-2023-36381/): WordPress Zippy Plugin <= 1.6.5 is vulnerable to PHP Object Injection (medium 6.6)
- [CVE-2023-36380](https://insights.sbomify.com/CVE-2023-36380/): Hardcoded credentials in CP-8031 MASTER MODULE (critical 9.8)
- [CVE-2023-3638](https://insights.sbomify.com/CVE-2023-3638/): GeoVision GV-ADR2701 Improper Authentication (critical 9.8)
- [CVE-2023-36377](https://insights.sbomify.com/CVE-2023-36377/): Memory corruption in osslsigncode project:osslsigncode (high 7.8)
- [CVE-2023-36376](https://insights.sbomify.com/CVE-2023-36376/): Cross-site scripting in phpgurukul:hostel management system (medium 4.8)
- [CVE-2023-36375](https://insights.sbomify.com/CVE-2023-36375/): Cross-site scripting in phpgurukul:hostel management system (medium 5.4)
- [CVE-2023-36371](https://insights.sbomify.com/CVE-2023-36371/): Denial of service in monetdb:monetdb (high 7.5)
- [CVE-2023-36370](https://insights.sbomify.com/CVE-2023-36370/): Denial of service in monetdb:monetdb (high 7.5)
- [CVE-2023-3637](https://insights.sbomify.com/CVE-2023-3637/): Openstack-neutron: unrestricted creation of security groups (fix for cve-2022-3277) (medium 4.3)
- [CVE-2023-36369](https://insights.sbomify.com/CVE-2023-36369/): Denial of service in monetdb:monetdb (high 7.5)
- [CVE-2023-36368](https://insights.sbomify.com/CVE-2023-36368/): Denial of service in monetdb:monetdb (high 7.5)
- [CVE-2023-36367](https://insights.sbomify.com/CVE-2023-36367/): Denial of service in monetdb:monetdb (high 7.5)
- [CVE-2023-36366](https://insights.sbomify.com/CVE-2023-36366/): Denial of service in monetdb:monetdb (high 7.5)
- [CVE-2023-36365](https://insights.sbomify.com/CVE-2023-36365/): Denial of service in monetdb:monetdb (high 7.5)
- [CVE-2023-36364](https://insights.sbomify.com/CVE-2023-36364/): Denial of service in monetdb:monetdb (high 7.5)
- [CVE-2023-36363](https://insights.sbomify.com/CVE-2023-36363/): Denial of service in monetdb:monetdb (high 7.5)
- [CVE-2023-36362](https://insights.sbomify.com/CVE-2023-36362/): Denial of service in monetdb:monetdb (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/280/