# Vulnerabilities published in 2023


- [CVE-2023-33044](https://insights.sbomify.com/CVE-2023-33044/): Reachable Assertion in Data Modem (high 7.5)
- [CVE-2023-33043](https://insights.sbomify.com/CVE-2023-33043/): Reachable Assertion in Modem (high 7.5)
- [CVE-2023-33042](https://insights.sbomify.com/CVE-2023-33042/): Improper Input Validation in Modem (high 7.5)
- [CVE-2023-33041](https://insights.sbomify.com/CVE-2023-33041/): Reachable assertion in WLAN Firmware (high 7.5)
- [CVE-2023-33040](https://insights.sbomify.com/CVE-2023-33040/): Buffer Over-read in Data Modem (high 7.5)
- [CVE-2023-3304](https://insights.sbomify.com/CVE-2023-3304/): Improper Access Control in admidio/admidio (medium 5.9)
- [CVE-2023-33039](https://insights.sbomify.com/CVE-2023-33039/): Use After Free in Automotive Display (high 8.4)
- [CVE-2023-33038](https://insights.sbomify.com/CVE-2023-33038/): Integer Overflow or Wraparound in Radio Interface Layer (medium 6.7)
- [CVE-2023-33037](https://insights.sbomify.com/CVE-2023-33037/): Cryptographic Issues in Automotive (high 7.1)
- [CVE-2023-33036](https://insights.sbomify.com/CVE-2023-33036/): NULL Pointer Dereference in Hypervisor (high 7.1)
- [CVE-2023-33035](https://insights.sbomify.com/CVE-2023-33035/): Buffer Copy Without Checking Size of Input in Audio (high 7.8)
- [CVE-2023-33034](https://insights.sbomify.com/CVE-2023-33034/): Signed-to-unsigned conversion error in Audio (high 7.8)
- [CVE-2023-33033](https://insights.sbomify.com/CVE-2023-33033/): Use of Out-of-range Pointer Offset in Audio (high 8.4)
- [CVE-2023-33032](https://insights.sbomify.com/CVE-2023-33032/): Integer Overflow or Wraparound in TZ Secure OS (critical 9.3)
- [CVE-2023-33031](https://insights.sbomify.com/CVE-2023-33031/): Buffer Copy Without Checking Size of Input in Automotive Audio (high 7.8)
- [CVE-2023-33030](https://insights.sbomify.com/CVE-2023-33030/): Buffer Copy without Checking Size of Input in HLOS (critical 9.3)
- [CVE-2023-3303](https://insights.sbomify.com/CVE-2023-3303/): Improper Access Control in admidio/admidio (medium 6.4)
- [CVE-2023-33029](https://insights.sbomify.com/CVE-2023-33029/): Use After Free in DSP Service (high 8.4)
- [CVE-2023-33028](https://insights.sbomify.com/CVE-2023-33028/): Buffer Copy without Checking Size of Input in WLAN Firmware (critical 9.8)
- [CVE-2023-33027](https://insights.sbomify.com/CVE-2023-33027/): Buffer Over-read in WLAN Firmware (high 7.5)
- [CVE-2023-33026](https://insights.sbomify.com/CVE-2023-33026/): Buffer over-read in WLAN Firmware (high 7.5)
- [CVE-2023-33025](https://insights.sbomify.com/CVE-2023-33025/): Buffer Copy without Checking Size of Input in Data Modem (critical 9.8)
- [CVE-2023-33024](https://insights.sbomify.com/CVE-2023-33024/): Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Radio Interface Layer (medium 6.7)
- [CVE-2023-33023](https://insights.sbomify.com/CVE-2023-33023/): Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in SPS-Applications (high 8.4)
- [CVE-2023-33022](https://insights.sbomify.com/CVE-2023-33022/): Integer Overflow to Buffer Overflow in HLOS (high 8.4)
- [CVE-2023-33021](https://insights.sbomify.com/CVE-2023-33021/): Use After Free in Graphics (high 8.4)
- [CVE-2023-33020](https://insights.sbomify.com/CVE-2023-33020/): Improper Authorization in WLAN Host (high 7.5)
- [CVE-2023-3302](https://insights.sbomify.com/CVE-2023-3302/): Improper Neutralization of Formula Elements in a CSV File in admidio/admidio (medium 6.6)
- [CVE-2023-33019](https://insights.sbomify.com/CVE-2023-33019/): Improper Authorization in WLAN Host (high 7.5)
- [CVE-2023-33018](https://insights.sbomify.com/CVE-2023-33018/): Integer Overflow to Buffer Overflow in User Identity Module (high 7.8)
- [CVE-2023-33017](https://insights.sbomify.com/CVE-2023-33017/): Buffer Copy Without Checking Size of Input in Boot (high 7.8)
- [CVE-2023-33016](https://insights.sbomify.com/CVE-2023-33016/): Buffer Over-read in WLAN Firmware (high 7.5)
- [CVE-2023-33015](https://insights.sbomify.com/CVE-2023-33015/): Buffer Over-read in WLAN Firmware (high 7.5)
- [CVE-2023-33014](https://insights.sbomify.com/CVE-2023-33014/): Improper Input Validation in Services (high 7.6)
- [CVE-2023-33013](https://insights.sbomify.com/CVE-2023-33013/): Command injection in NBG6604 firmware (high 8.8)
- [CVE-2023-33012](https://insights.sbomify.com/CVE-2023-33012/): Command injection in ATP series firmware (high 8.8)
- [CVE-2023-33011](https://insights.sbomify.com/CVE-2023-33011/): Memory corruption in ATP series firmware (high 8.8)
- [CVE-2023-33010](https://insights.sbomify.com/CVE-2023-33010/): Zyxel Multiple Firewalls Buffer Overflow (critical 9.8, exploited in the wild)
- [CVE-2023-3301](https://insights.sbomify.com/CVE-2023-3301/): Triggerable assertion due to race condition in hot-unplug (medium 5.6)
- [CVE-2023-33009](https://insights.sbomify.com/CVE-2023-33009/): Zyxel Multiple Firewalls Buffer Overflow (critical 9.8, exploited in the wild)
- [CVE-2023-33008](https://insights.sbomify.com/CVE-2023-33008/): Apache Johnzon: Prevent inefficient internal conversion from BigDecimal at large scale (medium 5.3)
- [CVE-2023-33007](https://insights.sbomify.com/CVE-2023-33007/): Jenkins LoadComplete support Plugin Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2023-33006](https://insights.sbomify.com/CVE-2023-33006/): Jenkins WSO2 Oauth Plugin cross-site request forgery vulnerability (medium 5.4)
- [CVE-2023-33005](https://insights.sbomify.com/CVE-2023-33005/): Jenkins WSO2 Oauth Plugin Session Fixation vulnerability (medium 5.4)
- [CVE-2023-33004](https://insights.sbomify.com/CVE-2023-33004/): Jenkins Tag Profiler Plugin missing permission check (medium 4.3)
- [CVE-2023-33003](https://insights.sbomify.com/CVE-2023-33003/): Jenkins Tag Profiler Plugin vulnerable to Cross-Site Request Forgery (medium 4.3)
- [CVE-2023-33002](https://insights.sbomify.com/CVE-2023-33002/): TestComplete support Plugin vulnerable to stored Cross-site Scripting (medium 5.4)
- [CVE-2023-33001](https://insights.sbomify.com/CVE-2023-33001/): Jenkins HashiCorp Vault Plugin has improper masking of credentials (high 7.5)
- [CVE-2023-33000](https://insights.sbomify.com/CVE-2023-33000/): Jenkins NS-ND Integration Performance Publisher Plugin displays credentials without masking (high 7.5)
- [CVE-2023-3300](https://insights.sbomify.com/CVE-2023-3300/): Nomad Search API Leaks Information About CSI Plugins (medium 5.3)
- [CVE-2023-32999](https://insights.sbomify.com/CVE-2023-32999/): Jenkins AppSpider Plugin missing permission check (medium 4.3)
- [CVE-2023-32998](https://insights.sbomify.com/CVE-2023-32998/): Jenkins AppSpider Plugin Cross-Site Request Forgery vulnerability (high 8.8)
- [CVE-2023-32997](https://insights.sbomify.com/CVE-2023-32997/): Jenkins CAS Plugin Session Fixation vulnerability (high 8.8)
- [CVE-2023-32996](https://insights.sbomify.com/CVE-2023-32996/): Jenkins SAML Single Sign On(SSO) Plugin missing permission checks (medium 4.3)
- [CVE-2023-32995](https://insights.sbomify.com/CVE-2023-32995/): Jenkins SAML Single Sign On(SSO) Plugin Cross-Site Request Forgery vulnerability (high 8.8)
- [CVE-2023-32994](https://insights.sbomify.com/CVE-2023-32994/): Jenkins SAML Single Sign On(SSO) Plugin unconditionally disables SSL/TLS certificate validation (low 3.7)
- [CVE-2023-32993](https://insights.sbomify.com/CVE-2023-32993/): Jenkins SAML Single Sign On(SSO) Plugin missing hostname validation (medium 4.8)
- [CVE-2023-32992](https://insights.sbomify.com/CVE-2023-32992/): Jenkins SAML Single Sign On(SSO) Plugin missing permission checks (high 8.8)
- [CVE-2023-32991](https://insights.sbomify.com/CVE-2023-32991/): Jenkins SAML Single Sign On(SSO) Plugin Cross-Site Request Forgery vulnerability (high 8.8)
- [CVE-2023-32990](https://insights.sbomify.com/CVE-2023-32990/): Jenkins Azure VM Agents Plugin missing permission checks (medium 6.5)
- [CVE-2023-3299](https://insights.sbomify.com/CVE-2023-3299/): Nomad Caller ACL Token's Secret ID is Exposed to Sentinel (low 3.4)
- [CVE-2023-32989](https://insights.sbomify.com/CVE-2023-32989/): Jenkins Azure VM Agents Plugin Cross-site Request Forgery vulnerability (high 8.8)
- [CVE-2023-32988](https://insights.sbomify.com/CVE-2023-32988/): Jenkins Azure VM Agents Plugin missing permission checks (medium 4.3)
- [CVE-2023-32987](https://insights.sbomify.com/CVE-2023-32987/): Jenkins Reverse Proxy Auth Plugin cross-site request forgery vulnerability (high 8.8)
- [CVE-2023-32986](https://insights.sbomify.com/CVE-2023-32986/): Jenkins File Parameter Plugin arbitrary file write vulnerability (high 8.8)
- [CVE-2023-32985](https://insights.sbomify.com/CVE-2023-32985/): Jenkins Sidebar Link Plugin vulnerable to Path Traversal (medium 4.3)
- [CVE-2023-32984](https://insights.sbomify.com/CVE-2023-32984/): Jenkins TestNG Results Plugin Stored Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2023-32983](https://insights.sbomify.com/CVE-2023-32983/): Jenkins Ansible Plugin job configuration form does not mask variables (medium 5.3)
- [CVE-2023-32982](https://insights.sbomify.com/CVE-2023-32982/): Jenkins Ansible Plugin stores and displays secrets in plain text (medium 4.3)
- [CVE-2023-32981](https://insights.sbomify.com/CVE-2023-32981/): Jenkins Pipeline Utility Steps Plugin arbitrary file write vulnerability (high 8.8)
- [CVE-2023-32980](https://insights.sbomify.com/CVE-2023-32980/): Jenkins Email Extension Plugin Cross-Site Request Forgery vulnerability (medium 4.3)
- [CVE-2023-32979](https://insights.sbomify.com/CVE-2023-32979/): Jenkins Email Extension Plugin missing permission check (medium 4.3)
- [CVE-2023-32978](https://insights.sbomify.com/CVE-2023-32978/): Jenkins LDAP Plugin vulnerable to Cross-Site Request Forgery (medium 4.3)
- [CVE-2023-32977](https://insights.sbomify.com/CVE-2023-32977/): Jenkins Pipeline: Job Plugin vulnerable to stored Cross-site Scripting (medium 5.4)
- [CVE-2023-32976](https://insights.sbomify.com/CVE-2023-32976/): Container Station (medium 6.6)
- [CVE-2023-32975](https://insights.sbomify.com/CVE-2023-32975/): QTS, QuTS hero (medium 4.9)
- [CVE-2023-32974](https://insights.sbomify.com/CVE-2023-32974/): QTS, QuTS hero, QuTScloud (high 7.5)
- [CVE-2023-32973](https://insights.sbomify.com/CVE-2023-32973/): QTS, QuTS hero, QuTScloud (low 3.8)
- [CVE-2023-32972](https://insights.sbomify.com/CVE-2023-32972/): QTS, QuTS hero, QuTScloud (low 3.8)
- [CVE-2023-32971](https://insights.sbomify.com/CVE-2023-32971/): QTS, QuTS hero, QuTScloud (low 3.8)
- [CVE-2023-32970](https://insights.sbomify.com/CVE-2023-32970/): QTS, QuTS hero, QuTScloud (medium 4.9)
- [CVE-2023-3297](https://insights.sbomify.com/CVE-2023-3297/): Use after free in AccountService (high 8.1)
- [CVE-2023-32969](https://insights.sbomify.com/CVE-2023-32969/): Network & Virtual Switch (medium 4.9)
- [CVE-2023-32968](https://insights.sbomify.com/CVE-2023-32968/): QTS, QuTS hero (medium 4.5)
- [CVE-2023-32967](https://insights.sbomify.com/CVE-2023-32967/): QTS, QuTScloud (medium 5.0)
- [CVE-2023-32966](https://insights.sbomify.com/CVE-2023-32966/): WordPress Jazz Popups Plugin <= 1.8.7 is vulnerable to Cross Site Request Forgery (CSRF) leading to Stored XSS (medium 5.4)
- [CVE-2023-32965](https://insights.sbomify.com/CVE-2023-32965/): WordPress Jazz Popups Plugin <= 1.8.7 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-32964](https://insights.sbomify.com/CVE-2023-32964/): WordPress Better Notifications for WP Plugin <= 1.9.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-32963](https://insights.sbomify.com/CVE-2023-32963/): WordPress Predictive Search for WooCommerce plugin <= 5.8.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-32962](https://insights.sbomify.com/CVE-2023-32962/): WordPress WishSuite Plugin <= 1.3.4 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-32961](https://insights.sbomify.com/CVE-2023-32961/): WordPress Zotpress Plugin <= 7.3.3 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-32960](https://insights.sbomify.com/CVE-2023-32960/): WordPress UpdraftPlus Plugin <= 1.23.3 is vulnerable to Cross Site Request Forgery (CSRF) (high 7.1)
- [CVE-2023-32959](https://insights.sbomify.com/CVE-2023-32959/): WordPress MetroStore theme <= 1.3.2 - Broken Access Control (medium 4.3)
- [CVE-2023-32958](https://insights.sbomify.com/CVE-2023-32958/): WordPress Novelist Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-32957](https://insights.sbomify.com/CVE-2023-32957/): WordPress Team Members Showcase Plugin <= 1.3.4 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-32956](https://insights.sbomify.com/CVE-2023-32956/): Command injection in Synology Router Manager (SRM) (critical 9.8)
- [CVE-2023-32955](https://insights.sbomify.com/CVE-2023-32955/): Command injection in Synology Router Manager (SRM) (high 8.1)
- [CVE-2023-3295](https://insights.sbomify.com/CVE-2023-3295/): File upload in Unlimited Elements For Elementor (high 8.8)
- [CVE-2023-3294](https://insights.sbomify.com/CVE-2023-3294/): Cross-site Scripting (XSS) - DOM in saleor/react-storefront (high 7.6)
- [CVE-2023-3293](https://insights.sbomify.com/CVE-2023-3293/): Cross-site Scripting (XSS) - Stored in salesagility/suitecrm-core (high 7.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/304/