# Vulnerabilities published in 2023


- [CVE-2023-32398](https://insights.sbomify.com/CVE-2023-32398/): Use after free in iOS and iPadOS (high 7.8)
- [CVE-2023-32397](https://insights.sbomify.com/CVE-2023-32397/): Business logic in iOS and iPadOS (high 7.5)
- [CVE-2023-32396](https://insights.sbomify.com/CVE-2023-32396/): Privilege escalation in Xcode (high 7.8)
- [CVE-2023-32395](https://insights.sbomify.com/CVE-2023-32395/): Business logic in macOS (medium 5.5)
- [CVE-2023-32394](https://insights.sbomify.com/CVE-2023-32394/): Security feature bypass in iOS and iPadOS (low 2.4)
- [CVE-2023-32393](https://insights.sbomify.com/CVE-2023-32393/): Memory corruption in iOS and iPadOS (high 8.8)
- [CVE-2023-32392](https://insights.sbomify.com/CVE-2023-32392/): Information disclosure in iOS and iPadOS (medium 5.5)
- [CVE-2023-32391](https://insights.sbomify.com/CVE-2023-32391/): Security feature bypass in iOS and iPadOS (medium 4.6)
- [CVE-2023-32390](https://insights.sbomify.com/CVE-2023-32390/): Information disclosure in iOS and iPadOS (low 2.4)
- [CVE-2023-3239](https://insights.sbomify.com/CVE-2023-3239/): OTCMS path traversal (low 3.5)
- [CVE-2023-32389](https://insights.sbomify.com/CVE-2023-32389/): Information disclosure in iOS and iPadOS (medium 5.5)
- [CVE-2023-32388](https://insights.sbomify.com/CVE-2023-32388/): Security feature bypass in iOS and iPadOS (medium 5.5)
- [CVE-2023-32387](https://insights.sbomify.com/CVE-2023-32387/): Use after free in macOS (critical 9.8)
- [CVE-2023-32386](https://insights.sbomify.com/CVE-2023-32386/): Information disclosure in macOS (low 3.3)
- [CVE-2023-32385](https://insights.sbomify.com/CVE-2023-32385/): Denial of service in iOS and iPadOS (medium 5.5)
- [CVE-2023-32384](https://insights.sbomify.com/CVE-2023-32384/): Memory corruption in iOS and iPadOS (high 7.8)
- [CVE-2023-32383](https://insights.sbomify.com/CVE-2023-32383/): Code injection in macOS (high 7.8)
- [CVE-2023-32382](https://insights.sbomify.com/CVE-2023-32382/): Memory corruption in macOS (medium 5.5)
- [CVE-2023-32381](https://insights.sbomify.com/CVE-2023-32381/): Use after free in iOS and iPadOS (high 7.8)
- [CVE-2023-32380](https://insights.sbomify.com/CVE-2023-32380/): Memory corruption in macOS (high 7.8)
- [CVE-2023-3238](https://insights.sbomify.com/CVE-2023-3238/): OTCMS server-side request forgery (medium 6.3)
- [CVE-2023-32379](https://insights.sbomify.com/CVE-2023-32379/): Memory corruption in macOS (high 7.8)
- [CVE-2023-32378](https://insights.sbomify.com/CVE-2023-32378/): Use after free in macOS (high 7.8)
- [CVE-2023-32377](https://insights.sbomify.com/CVE-2023-32377/): Memory corruption in macOS (high 7.8)
- [CVE-2023-32376](https://insights.sbomify.com/CVE-2023-32376/): Security feature bypass in iOS and iPadOS (medium 5.5)
- [CVE-2023-32375](https://insights.sbomify.com/CVE-2023-32375/): Memory corruption in macOS (medium 5.5)
- [CVE-2023-32373](https://insights.sbomify.com/CVE-2023-32373/): Apple Multiple Products WebKit Use-After-Free (high 8.8, exploited in the wild)
- [CVE-2023-32372](https://insights.sbomify.com/CVE-2023-32372/): Memory corruption in iOS and iPadOS (medium 5.5)
- [CVE-2023-32371](https://insights.sbomify.com/CVE-2023-32371/): Security feature bypass in iOS and iPadOS (medium 6.3)
- [CVE-2023-32370](https://insights.sbomify.com/CVE-2023-32370/): Security feature bypass in macOS (medium 5.3)
- [CVE-2023-3237](https://insights.sbomify.com/CVE-2023-3237/): OTCMS hard-coded password (medium 6.3)
- [CVE-2023-32369](https://insights.sbomify.com/CVE-2023-32369/): Business logic in macOS (medium 6.0)
- [CVE-2023-32368](https://insights.sbomify.com/CVE-2023-32368/): Memory corruption in iOS and iPadOS (medium 5.5)
- [CVE-2023-32367](https://insights.sbomify.com/CVE-2023-32367/): Missing authorization in iOS and iPadOS (medium 5.5)
- [CVE-2023-32366](https://insights.sbomify.com/CVE-2023-32366/): Memory corruption in iOS and iPadOS (high 7.8)
- [CVE-2023-32365](https://insights.sbomify.com/CVE-2023-32365/): Security feature bypass in iOS and iPadOS (low 2.4)
- [CVE-2023-32364](https://insights.sbomify.com/CVE-2023-32364/): Security feature bypass in macOS (high 8.6)
- [CVE-2023-32363](https://insights.sbomify.com/CVE-2023-32363/): Security feature bypass in macOS (medium 5.5)
- [CVE-2023-32362](https://insights.sbomify.com/CVE-2023-32362/): Information disclosure in macOS (medium 6.5)
- [CVE-2023-32361](https://insights.sbomify.com/CVE-2023-32361/): Information disclosure in iOS and iPadOS (medium 5.5)
- [CVE-2023-32360](https://insights.sbomify.com/CVE-2023-32360/): Auth bypass in macOS (medium 5.5)
- [CVE-2023-3236](https://insights.sbomify.com/CVE-2023-3236/): mccms Comic.php pic_save server-side request forgery (medium 6.3)
- [CVE-2023-32359](https://insights.sbomify.com/CVE-2023-32359/): Information disclosure in iOS and iPadOS (high 7.5)
- [CVE-2023-32358](https://insights.sbomify.com/CVE-2023-32358/): Memory corruption in iOS and iPadOS (high 8.8)
- [CVE-2023-32357](https://insights.sbomify.com/CVE-2023-32357/): Missing authorization in iOS and iPadOS (high 7.1)
- [CVE-2023-32356](https://insights.sbomify.com/CVE-2023-32356/): Memory corruption in macOS (high 7.8)
- [CVE-2023-32355](https://insights.sbomify.com/CVE-2023-32355/): Business logic in macOS (medium 5.5)
- [CVE-2023-32354](https://insights.sbomify.com/CVE-2023-32354/): Memory corruption in iOS and iPadOS (medium 5.5)
- [CVE-2023-32353](https://insights.sbomify.com/CVE-2023-32353/): Privilege escalation in iTunes for Windows (high 7.8)
- [CVE-2023-32352](https://insights.sbomify.com/CVE-2023-32352/): Security feature bypass in iOS and iPadOS (medium 5.5)
- [CVE-2023-32351](https://insights.sbomify.com/CVE-2023-32351/): Privilege escalation in iTunes for Windows (high 7.8)
- [CVE-2023-32350](https://insights.sbomify.com/CVE-2023-32350/): Command injection in RUT model routers (high 8.0)
- [CVE-2023-3235](https://insights.sbomify.com/CVE-2023-3235/): mccms Comic.php pic_api server-side request forgery (medium 6.3)
- [CVE-2023-32349](https://insights.sbomify.com/CVE-2023-32349/): Code injection in RUT model routers (high 8.0)
- [CVE-2023-32348](https://insights.sbomify.com/CVE-2023-32348/): Server-side request forgery in Remote Management System (medium 5.8)
- [CVE-2023-32347](https://insights.sbomify.com/CVE-2023-32347/): Auth bypass in Remote Management System (high 8.1)
- [CVE-2023-32346](https://insights.sbomify.com/CVE-2023-32346/): Information disclosure in Remote Management System (medium 5.3)
- [CVE-2023-32344](https://insights.sbomify.com/CVE-2023-32344/): IBM Cognos Analytics cross-site request forgery (medium 4.3)
- [CVE-2023-32342](https://insights.sbomify.com/CVE-2023-32342/): IBM GSKit information disclosure (high 7.5)
- [CVE-2023-32341](https://insights.sbomify.com/CVE-2023-32341/): IBM Sterling B2B Integrator denial of service (medium 6.5)
- [CVE-2023-32340](https://insights.sbomify.com/CVE-2023-32340/): IBM Sterling B2B Integrator cross-site scripting (medium 4.6)
- [CVE-2023-3234](https://insights.sbomify.com/CVE-2023-3234/): Zhong Bang CRMEB PublicController.php put_image deserialization (medium 4.3)
- [CVE-2023-32339](https://insights.sbomify.com/CVE-2023-32339/): IBM Business Automation Workflow cross-site scripting (medium 6.1)
- [CVE-2023-32338](https://insights.sbomify.com/CVE-2023-32338/): IBM Sterling Secure Proxy information disclosure (medium 5.1)
- [CVE-2023-32337](https://insights.sbomify.com/CVE-2023-32337/): IBM Maximo Spatial Asset Management server-side request forgery (medium 5.4)
- [CVE-2023-32336](https://insights.sbomify.com/CVE-2023-32336/): IBM InfoSphere Information Server code execution (high 8.8)
- [CVE-2023-32335](https://insights.sbomify.com/CVE-2023-32335/): IBM Maximo Application Suite information disclosure (low 3.7)
- [CVE-2023-32334](https://insights.sbomify.com/CVE-2023-32334/): IBM Maximo Asset Management information disclosure (low 3.7)
- [CVE-2023-32333](https://insights.sbomify.com/CVE-2023-32333/): IBM Maximo Asset Management improper access control (medium 6.5)
- [CVE-2023-32332](https://insights.sbomify.com/CVE-2023-32332/): IBM Maximo Application Suite and IBM Maximo Asset Management HTML injection (medium 5.4)
- [CVE-2023-32331](https://insights.sbomify.com/CVE-2023-32331/): IBM Connect:Express for UNIX denial of service (high 7.5)
- [CVE-2023-32330](https://insights.sbomify.com/CVE-2023-32330/): IBM Security Verify Access man in the middle (high 7.5)
- [CVE-2023-3233](https://insights.sbomify.com/CVE-2023-3233/): Zhong Bang CRMEB PublicController.php get_image_base64 server-side request forgery (medium 6.3)
- [CVE-2023-32329](https://insights.sbomify.com/CVE-2023-32329/): IBM Security Access Manager Container improper file validation (medium 6.2)
- [CVE-2023-32328](https://insights.sbomify.com/CVE-2023-32328/): IBM Security Verify Access information disclosure (high 7.5)
- [CVE-2023-32327](https://insights.sbomify.com/CVE-2023-32327/): IBM Security Access Manager Container XML external entity injection (high 7.1)
- [CVE-2023-32325](https://insights.sbomify.com/CVE-2023-32325/): Cross-site scripting in PostHog-js (medium 5.4)
- [CVE-2023-32324](https://insights.sbomify.com/CVE-2023-32324/): OpenPrinting CUPS vulnerable to heap buffer overflow (high 7.5)
- [CVE-2023-32323](https://insights.sbomify.com/CVE-2023-32323/): Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites (medium 5.0)
- [CVE-2023-32322](https://insights.sbomify.com/CVE-2023-32322/): Arbitrary file read in Ombi (medium 4.9)
- [CVE-2023-32321](https://insights.sbomify.com/CVE-2023-32321/): CKAN remote code execution and private information access via crafted resource ids (critical 9.8)
- [CVE-2023-32320](https://insights.sbomify.com/CVE-2023-32320/): Nextcloud Server's brute force protection allows someone to send more requests than intended (high 8.7)
- [CVE-2023-3232](https://insights.sbomify.com/CVE-2023-3232/): Zhong Bang CRMEB Image Upload app_auth deserialization (medium 6.3)
- [CVE-2023-32319](https://insights.sbomify.com/CVE-2023-32319/): Basic auth header on WebDAV requests is not brute-force protected in Nextcloud (high 8.1)
- [CVE-2023-32318](https://insights.sbomify.com/CVE-2023-32318/): User session not correctly destroyed on logout (high 7.2)
- [CVE-2023-32317](https://insights.sbomify.com/CVE-2023-32317/): Autolab tar slip in cheat checker functionality (`GHSL-2023-082`) (medium 6.7)
- [CVE-2023-32316](https://insights.sbomify.com/CVE-2023-32316/): Users can add themselves to any organization in CloudExplorer Lite (high 7.1)
- [CVE-2023-32315](https://insights.sbomify.com/CVE-2023-32315/): Ignite Realtime Openfire Path Traversal (high 8.6, exploited in the wild)
- [CVE-2023-32314](https://insights.sbomify.com/CVE-2023-32314/): Sandbox Escape (critical 9.8)
- [CVE-2023-32313](https://insights.sbomify.com/CVE-2023-32313/): Inspect method manipulation in vm2 (medium 5.3)
- [CVE-2023-32312](https://insights.sbomify.com/CVE-2023-32312/): Client secret not mandatory in UmbracoIdentityExtensions (low 3.7)
- [CVE-2023-32311](https://insights.sbomify.com/CVE-2023-32311/): The CloudExplorer Lite missing permissions check (high 7.1)
- [CVE-2023-32310](https://insights.sbomify.com/CVE-2023-32310/): DataEase API interface has IDOR vulnerability (high 8.1)
- [CVE-2023-3231](https://insights.sbomify.com/CVE-2023-3231/): UJCMS ZIP Package information disclosure (low 3.1)
- [CVE-2023-32309](https://insights.sbomify.com/CVE-2023-32309/): Arbitrary file inclusion with the pymdowm-snippets extension (high 7.5)
- [CVE-2023-32308](https://insights.sbomify.com/CVE-2023-32308/): SQL Injection Vulnerability in anuko timetracker (high 8.2)
- [CVE-2023-32307](https://insights.sbomify.com/CVE-2023-32307/): heap-over-flow and integer-overflow in sofia-sip (high 7.5)
- [CVE-2023-32306](https://insights.sbomify.com/CVE-2023-32306/): Time Tracker has Blind SQL Injection Vulnerability in Reports (high 8.8)
- [CVE-2023-32305](https://insights.sbomify.com/CVE-2023-32305/): aiven-extras PostgreSQL Privilege Escalation Through Overloaded Search Path (high 8.8)
- [CVE-2023-32303](https://insights.sbomify.com/CVE-2023-32303/): Planet's secret file is created with excessive permissions (medium 5.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/310/