# Vulnerabilities published in 2023


- [CVE-2023-36006](https://insights.sbomify.com/CVE-2023-36006/): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-36005](https://insights.sbomify.com/CVE-2023-36005/): Windows Telephony Server Elevation of Privilege Vulnerability (high 7.5)
- [CVE-2023-36004](https://insights.sbomify.com/CVE-2023-36004/): Windows DPAPI (Data Protection Application Programming Interface) Spoofing Vulnerability (high 7.5)
- [CVE-2023-36003](https://insights.sbomify.com/CVE-2023-36003/): XAML Diagnostics Elevation of Privilege Vulnerability (medium 6.7)
- [CVE-2023-36002](https://insights.sbomify.com/CVE-2023-36002/): ITM Server Missing Authorization for URL validation (medium 4.3)
- [CVE-2023-36000](https://insights.sbomify.com/CVE-2023-36000/): ITM Server Missing Authorization for Agent Config (medium 6.5)
- [CVE-2023-3600](https://insights.sbomify.com/CVE-2023-3600/): Use-after-free in workers (high 8.8)
- [CVE-2023-35998](https://insights.sbomify.com/CVE-2023-35998/): ITM Server Missing Authorization in SOAP Endpoints (medium 4.6)
- [CVE-2023-35997](https://insights.sbomify.com/CVE-2023-35997/): Memory corruption in GTKWave (high 7.8)
- [CVE-2023-35996](https://insights.sbomify.com/CVE-2023-35996/): Memory corruption in GTKWave (high 7.8)
- [CVE-2023-35995](https://insights.sbomify.com/CVE-2023-35995/): Memory corruption in GTKWave (high 7.8)
- [CVE-2023-35994](https://insights.sbomify.com/CVE-2023-35994/): Memory corruption in GTKWave (high 7.8)
- [CVE-2023-35993](https://insights.sbomify.com/CVE-2023-35993/): Use after free in iOS and iPadOS (high 7.8)
- [CVE-2023-35992](https://insights.sbomify.com/CVE-2023-35992/): Integer overflow in GTKWave (high 7.0)
- [CVE-2023-35991](https://insights.sbomify.com/CVE-2023-35991/): Auth bypass in LAN-W300N/DR (high 8.8)
- [CVE-2023-35990](https://insights.sbomify.com/CVE-2023-35990/): Information disclosure in iOS and iPadOS (low 3.3)
- [CVE-2023-3599](https://insights.sbomify.com/CVE-2023-3599/): SourceCodester Best Fee Management System Add User admin_class.php save_user access control (medium 6.3)
- [CVE-2023-35989](https://insights.sbomify.com/CVE-2023-35989/): Integer overflow in GTKWave (high 7.8)
- [CVE-2023-35987](https://insights.sbomify.com/CVE-2023-35987/): PiiGAB M-Bus Use of Hard-coded Credentials (critical 9.8)
- [CVE-2023-35986](https://insights.sbomify.com/CVE-2023-35986/): Santesoft Sante DICOM Viewer Pro Stack-based Buffer Overflow (high 7.8)
- [CVE-2023-35985](https://insights.sbomify.com/CVE-2023-35985/): Code injection in Foxit Reader (high 8.8)
- [CVE-2023-35984](https://insights.sbomify.com/CVE-2023-35984/): Memory corruption in iOS and iPadOS (medium 4.3)
- [CVE-2023-35983](https://insights.sbomify.com/CVE-2023-35983/): Security feature bypass in macOS (medium 5.5)
- [CVE-2023-35982](https://insights.sbomify.com/CVE-2023-35982/): Unauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI Protocol (critical 9.8)
- [CVE-2023-35981](https://insights.sbomify.com/CVE-2023-35981/): Unauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI Protocol (critical 9.8)
- [CVE-2023-35980](https://insights.sbomify.com/CVE-2023-35980/): Unauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI Protocol (critical 9.8)
- [CVE-2023-3598](https://insights.sbomify.com/CVE-2023-3598/): Memory corruption in Chrome (high 8.8)
- [CVE-2023-35979](https://insights.sbomify.com/CVE-2023-35979/): Unauthenticated Buffer Overflow Vulnerability in ArubaOS Web-Based Management Interface (medium 5.3)
- [CVE-2023-35978](https://insights.sbomify.com/CVE-2023-35978/): Reflected Cross-Site Scripting (XSS) in ArubaOS Web-based Management Interface (medium 6.1)
- [CVE-2023-35977](https://insights.sbomify.com/CVE-2023-35977/): Authenticated Sensitive Information Disclosure in ArubaOS Command Line Interface (medium 6.5)
- [CVE-2023-35976](https://insights.sbomify.com/CVE-2023-35976/): Authenticated Sensitive Information Disclosure in ArubaOS Command Line Interface (medium 6.5)
- [CVE-2023-35975](https://insights.sbomify.com/CVE-2023-35975/): Authenticated Path Traversal in ArubaOS Command Line Interface Allows for Arbitrary File Deletion (medium 6.5)
- [CVE-2023-35974](https://insights.sbomify.com/CVE-2023-35974/): Authenticated Remote Command Execution in the ArubaOS Command Line Interface (high 7.2)
- [CVE-2023-35973](https://insights.sbomify.com/CVE-2023-35973/): Authenticated Remote Command Execution in the ArubaOS Command Line Interface (high 7.2)
- [CVE-2023-35972](https://insights.sbomify.com/CVE-2023-35972/): Authenticated Remote Command Execution in ArubaOS Web-based Management Interface (high 7.2)
- [CVE-2023-35971](https://insights.sbomify.com/CVE-2023-35971/): Unauthenticated Stored Cross-Site Scripting (XSS) in ArubaOS Web-based Management Interface (high 8.8)
- [CVE-2023-35970](https://insights.sbomify.com/CVE-2023-35970/): Memory corruption in GTKWave (high 7.8)
- [CVE-2023-3597](https://insights.sbomify.com/CVE-2023-3597/): Keycloak: secondary factor bypass in step-up authentication (medium 5.0)
- [CVE-2023-35969](https://insights.sbomify.com/CVE-2023-35969/): Memory corruption in GTKWave (high 7.8)
- [CVE-2023-35968](https://insights.sbomify.com/CVE-2023-35968/): Memory corruption in YF325 (critical 9.8)
- [CVE-2023-35967](https://insights.sbomify.com/CVE-2023-35967/): Memory corruption in YF325 (critical 9.8)
- [CVE-2023-35966](https://insights.sbomify.com/CVE-2023-35966/): Memory corruption in YF325 (critical 9.8)
- [CVE-2023-35965](https://insights.sbomify.com/CVE-2023-35965/): Memory corruption in YF325 (critical 9.8)
- [CVE-2023-35964](https://insights.sbomify.com/CVE-2023-35964/): Command injection in GTKWave (high 7.8)
- [CVE-2023-35963](https://insights.sbomify.com/CVE-2023-35963/): Command injection in GTKWave (high 7.8)
- [CVE-2023-35962](https://insights.sbomify.com/CVE-2023-35962/): Command injection in GTKWave (high 7.8)
- [CVE-2023-35961](https://insights.sbomify.com/CVE-2023-35961/): Command injection in GTKWave (high 7.8)
- [CVE-2023-35960](https://insights.sbomify.com/CVE-2023-35960/): Command injection in GTKWave (high 7.8)
- [CVE-2023-3596](https://insights.sbomify.com/CVE-2023-3596/): Rockwell Automation Allen-Bradley ControlLogix Communication Modules vulnerable to Denial of Service (high 7.5)
- [CVE-2023-35959](https://insights.sbomify.com/CVE-2023-35959/): Command injection in GTKWave (high 7.8)
- [CVE-2023-35958](https://insights.sbomify.com/CVE-2023-35958/): Memory corruption in GTKWave (high 7.8)
- [CVE-2023-35957](https://insights.sbomify.com/CVE-2023-35957/): Memory corruption in GTKWave (high 7.8)
- [CVE-2023-35956](https://insights.sbomify.com/CVE-2023-35956/): Memory corruption in GTKWave (high 7.8)
- [CVE-2023-35955](https://insights.sbomify.com/CVE-2023-35955/): Memory corruption in GTKWave (high 7.8)
- [CVE-2023-35953](https://insights.sbomify.com/CVE-2023-35953/): Memory corruption in libigl (high 7.8)
- [CVE-2023-35952](https://insights.sbomify.com/CVE-2023-35952/): Memory corruption in libigl (high 7.8)
- [CVE-2023-35951](https://insights.sbomify.com/CVE-2023-35951/): Memory corruption in libigl (high 7.8)
- [CVE-2023-35950](https://insights.sbomify.com/CVE-2023-35950/): Memory corruption in libigl (high 7.8)
- [CVE-2023-3595](https://insights.sbomify.com/CVE-2023-3595/): Rockwell Automation ControlLogix Communication Modules Vulnerable to Remote Code Execution (critical 9.8)
- [CVE-2023-35949](https://insights.sbomify.com/CVE-2023-35949/): Memory corruption in libigl (high 7.8)
- [CVE-2023-35948](https://insights.sbomify.com/CVE-2023-35948/): Novu Open Redirect Vulnerability in Sign-In with GitHub Functionality (medium 5.4)
- [CVE-2023-35947](https://insights.sbomify.com/CVE-2023-35947/): Path traversal vulnerabilities in handling of Tar archives in Gradle (medium 6.9)
- [CVE-2023-35946](https://insights.sbomify.com/CVE-2023-35946/): Dependency cache path traversal in Gradle (medium 6.9)
- [CVE-2023-35945](https://insights.sbomify.com/CVE-2023-35945/): Envoy vulnerable to HTTP/2 memory leak in nghttp2 codec (high 7.5)
- [CVE-2023-35944](https://insights.sbomify.com/CVE-2023-35944/): Envoy vulnerable to incorrect handling of HTTP requests and responses with mixed case schemes (high 8.2)
- [CVE-2023-35943](https://insights.sbomify.com/CVE-2023-35943/): Envoy vulnerable to CORS filter segfault when origin header is removed (medium 6.3)
- [CVE-2023-35942](https://insights.sbomify.com/CVE-2023-35942/): Envoy's gRPC access log crash caused by the listener draining (medium 6.5)
- [CVE-2023-35941](https://insights.sbomify.com/CVE-2023-35941/): Envoy vulnerable to OAuth2 credentials exploit with permanent validity (high 8.6)
- [CVE-2023-35940](https://insights.sbomify.com/CVE-2023-35940/): GLPI vulnerable to unauthenticated access to Dashboard data (high 7.5)
- [CVE-2023-35939](https://insights.sbomify.com/CVE-2023-35939/): GLPI vulnerable to unauthorized access to Dashboard data (high 8.1)
- [CVE-2023-35938](https://insights.sbomify.com/CVE-2023-35938/): User access not updated with privilege change in Tuleap (medium 4.1)
- [CVE-2023-35937](https://insights.sbomify.com/CVE-2023-35937/): Metersphere missing permission check (medium 6.0)
- [CVE-2023-35936](https://insights.sbomify.com/CVE-2023-35936/): Arbitrary file write is possible in Pandoc when using PDF output or --extract-media with untrusted input (medium 6.0)
- [CVE-2023-35934](https://insights.sbomify.com/CVE-2023-35934/): yt-dlp File Downloader cookie leak (medium 6.1)
- [CVE-2023-35933](https://insights.sbomify.com/CVE-2023-35933/): OpenFGA denial of service die to circular relationship (medium 5.9)
- [CVE-2023-35932](https://insights.sbomify.com/CVE-2023-35932/): jcvi vulnerable to Configuration Injection due to unsanitized user input (high 7.1)
- [CVE-2023-35931](https://insights.sbomify.com/CVE-2023-35931/): Shescape potential environment variable exposure on Windows with CMD (low 3.1)
- [CVE-2023-35930](https://insights.sbomify.com/CVE-2023-35930/): LookupResources may return partial results in spicedb (low 3.7)
- [CVE-2023-3593](https://insights.sbomify.com/CVE-2023-3593/): Server crash via a specially crafted markdown input (medium 4.3)
- [CVE-2023-35929](https://insights.sbomify.com/CVE-2023-35929/): Tuleap Cross-site Scripting vulnerability in the card field of the agile dashboard apps (medium 5.4)
- [CVE-2023-35928](https://insights.sbomify.com/CVE-2023-35928/): Nextcloud user scoped external storage can be used to gather credentials of other users (high 8.5)
- [CVE-2023-35927](https://insights.sbomify.com/CVE-2023-35927/): Nextcloud system addressbooks can be modified by malicious trusted server (high 7.6)
- [CVE-2023-35926](https://insights.sbomify.com/CVE-2023-35926/): Insecure sandbox in Backstage Scaffolder plugin (high 8.1)
- [CVE-2023-35925](https://insights.sbomify.com/CVE-2023-35925/): FastAsyncWorldEdit vulnerable to Uncontrolled Resource Consumption (medium 6.2)
- [CVE-2023-35924](https://insights.sbomify.com/CVE-2023-35924/): GLPI vulnerable to SQL injection via inventory agent request (high 8.6)
- [CVE-2023-35921](https://insights.sbomify.com/CVE-2023-35921/): Denial of service in SIMATIC MV540 H (high 7.5)
- [CVE-2023-35920](https://insights.sbomify.com/CVE-2023-35920/): Denial of service in SIMATIC MV540 H (high 7.5)
- [CVE-2023-3592](https://insights.sbomify.com/CVE-2023-3592/): Denial of service in Mosquitto (medium 5.8)
- [CVE-2023-35918](https://insights.sbomify.com/CVE-2023-35918/): WordPress WooCommerce Bulk Stock Management Plugin <= 2.2.33 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-35917](https://insights.sbomify.com/CVE-2023-35917/): WordPress WooCommerce PayPal Payments Plugin <= 2.0.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-35916](https://insights.sbomify.com/CVE-2023-35916/): WordPress WooCommerce Payments Plugin <= 5.9.0 is vulnerable to Insecure Direct Object References (IDOR) (high 7.5)
- [CVE-2023-35915](https://insights.sbomify.com/CVE-2023-35915/): WordPress WooCommerce Payments Plugin <= 5.9.0 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-35914](https://insights.sbomify.com/CVE-2023-35914/): WordPress WooCommerce Subscriptions Plugin <= 5.1.2 is vulnerable to Insecure Direct Object References (IDOR) (high 7.5)
- [CVE-2023-35913](https://insights.sbomify.com/CVE-2023-35913/): WordPress OOPSpam Anti-Spam Plugin <= 1.1.44 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-35912](https://insights.sbomify.com/CVE-2023-35912/): WordPress Potent Donations for WooCommerce Plugin <= 1.1.9 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-35911](https://insights.sbomify.com/CVE-2023-35911/): WordPress Contact Form Generator Plugin <= 2.6.0 is vulnerable to SQL Injection (high 8.5)
- [CVE-2023-35910](https://insights.sbomify.com/CVE-2023-35910/): WordPress Quasar form Plugin <= 6.0 is vulnerable to SQL Injection (high 8.5)
- [CVE-2023-3591](https://insights.sbomify.com/CVE-2023-3591/): Lack of previous password reset tokens on new token creation (medium 4.8)
- [CVE-2023-35909](https://insights.sbomify.com/CVE-2023-35909/): WordPress Ninja Forms Plugin <= 3.6.25 is vulnerable to Denial of Service Attack (medium 5.3)
- [CVE-2023-35908](https://insights.sbomify.com/CVE-2023-35908/): Apache Airflow: Access to DAGs without relevant permission (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/283/