# Vulnerabilities published in 2023


- [CVE-2023-32208](https://insights.sbomify.com/CVE-2023-32208/): Information disclosure in Firefox (medium 5.3)
- [CVE-2023-32207](https://insights.sbomify.com/CVE-2023-32207/): Security feature bypass in Firefox (high 8.8)
- [CVE-2023-32206](https://insights.sbomify.com/CVE-2023-32206/): Memory corruption in Firefox (medium 6.5)
- [CVE-2023-32205](https://insights.sbomify.com/CVE-2023-32205/): Security feature bypass in Firefox (medium 4.3)
- [CVE-2023-32204](https://insights.sbomify.com/CVE-2023-32204/): Privilege escalation in Intel(R) OFU software (high 8.8)
- [CVE-2023-32203](https://insights.sbomify.com/CVE-2023-32203/): Horner Automation Cscape Out-of-bounds Write (high 7.8)
- [CVE-2023-32202](https://insights.sbomify.com/CVE-2023-32202/): Walchem Intuition Improper Authentication (medium 6.5)
- [CVE-2023-32201](https://insights.sbomify.com/CVE-2023-32201/): Memory corruption in TELLUS and TELLUS Lite (high 7.8)
- [CVE-2023-32200](https://insights.sbomify.com/CVE-2023-32200/): Apache Jena: Exposure of execution in script engine expressions. (high 8.8)
- [CVE-2023-3220](https://insights.sbomify.com/CVE-2023-3220/): Null dereference in Linux kernel (medium 5.5)
- [CVE-2023-32199](https://insights.sbomify.com/CVE-2023-32199/): Rancher user retains access to clusters despite Global Role removal (medium 4.3)
- [CVE-2023-32198](https://insights.sbomify.com/CVE-2023-32198/): Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks (high 8.0)
- [CVE-2023-32197](https://insights.sbomify.com/CVE-2023-32197/): Rancher's External RoleTemplates can lead to privilege escalation (high 7.5)
- [CVE-2023-32196](https://insights.sbomify.com/CVE-2023-32196/): Rancher's External RoleTemplates can lead to privilege escalation (high 7.5)
- [CVE-2023-32194](https://insights.sbomify.com/CVE-2023-32194/): Rancher permissions on 'namespaces' in any API group grants 'edit' permissions on namespaces in 'core' (high 8.6)
- [CVE-2023-32193](https://insights.sbomify.com/CVE-2023-32193/): Norman API Cross-site Scripting Vulnerability (high 8.3)
- [CVE-2023-32192](https://insights.sbomify.com/CVE-2023-32192/): Rancher API Server Cross-site Scripting Vulnerability (high 8.3)
- [CVE-2023-32191](https://insights.sbomify.com/CVE-2023-32191/): rke's credentials are stored in the RKE1 Cluster state ConfigMap (critical 9.9)
- [CVE-2023-32190](https://insights.sbomify.com/CVE-2023-32190/): mlocate's %post script allows RUN_UPDATEDB_AS user to make arbitrary files world readable (high 8.5)
- [CVE-2023-3219](https://insights.sbomify.com/CVE-2023-3219/): EventON < 2.1.2 - Unauthenticated Post Access via IDOR (medium 5.3)
- [CVE-2023-32189](https://insights.sbomify.com/CVE-2023-32189/): Insecure handling SSH key in SUSE Manager when bootstrapping new clients (medium 6.4)
- [CVE-2023-32188](https://insights.sbomify.com/CVE-2023-32188/): JWT token compromise can allow malicious actions including Remote Code Execution (RCE) (critical 9.4)
- [CVE-2023-32187](https://insights.sbomify.com/CVE-2023-32187/): K3s apiserver port is vulnerable to unauthenticated remote denial-of-service (DoS) attack via TLS SAN stuffing attack (high 7.5)
- [CVE-2023-32186](https://insights.sbomify.com/CVE-2023-32186/): RKE2 supervisor port is vulnerable to unauthenticated remote denial-of-service (DoS) attack via TLS SAN stuffing attack (high 7.5)
- [CVE-2023-32184](https://insights.sbomify.com/CVE-2023-32184/): Code injection in opensuse-welcome (high 7.8)
- [CVE-2023-32183](https://insights.sbomify.com/CVE-2023-32183/): Misconfiguration in Tumbleweed (high 7.8)
- [CVE-2023-32182](https://insights.sbomify.com/CVE-2023-32182/): Path traversal in SUSE Linux Enterprise Desktop 15 SP5 (medium 5.9)
- [CVE-2023-32181](https://insights.sbomify.com/CVE-2023-32181/): Stack buffer overflow in "econf_writeFile" function (low 3.3)
- [CVE-2023-3218](https://insights.sbomify.com/CVE-2023-3218/): Race Condition within a Thread in it-novum/openitcockpit (medium 6.5)
- [CVE-2023-32179](https://insights.sbomify.com/CVE-2023-32179/): VIPRE Antivirus Plus FPQuarTransfer Link Following Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2023-32178](https://insights.sbomify.com/CVE-2023-32178/): VIPRE Antivirus Plus TelFileTransfer Link Following Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2023-32177](https://insights.sbomify.com/CVE-2023-32177/): VIPRE Antivirus Plus DeleteHistoryFile Directory Traversal Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2023-32176](https://insights.sbomify.com/CVE-2023-32176/): VIPRE Antivirus Plus SetPrivateConfig Directory Traversal Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2023-32175](https://insights.sbomify.com/CVE-2023-32175/): VIPRE Antivirus Plus Link Following Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2023-32174](https://insights.sbomify.com/CVE-2023-32174/): Unified Automation UaGateway NodeManagerOpcUa Use-After-Free Remote Code Execution Vulnerability (critical 9.1)
- [CVE-2023-32173](https://insights.sbomify.com/CVE-2023-32173/): Unified Automation UaGateway AddServer XML Injection Denial-of-Service Vulnerability (medium 5.8)
- [CVE-2023-32172](https://insights.sbomify.com/CVE-2023-32172/): Unified Automation UaGateway OPC UA Server Use-After-Free Denial-of-Service Vulnerability (medium 6.5)
- [CVE-2023-32171](https://insights.sbomify.com/CVE-2023-32171/): Unified Automation UaGateway OPC UA Server Null Pointer Dereference Denial-of-Service Vulnerability (medium 6.5)
- [CVE-2023-32170](https://insights.sbomify.com/CVE-2023-32170/): Unified Automation UaGateway OPC UA Server Improper Input Validation Denial-of-Service Vulnerability (medium 6.5)
- [CVE-2023-3217](https://insights.sbomify.com/CVE-2023-3217/): Use after free in Chrome (high 8.8)
- [CVE-2023-32169](https://insights.sbomify.com/CVE-2023-32169/): D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability (critical 9.8)
- [CVE-2023-32168](https://insights.sbomify.com/CVE-2023-32168/): D-Link D-View showUser Improper Authorization Privilege Escalation Vulnerability (high 8.8)
- [CVE-2023-32167](https://insights.sbomify.com/CVE-2023-32167/): D-Link D-View uploadMib Directory Traversal Arbitrary File Creation or Deletion Vulnerability (medium 6.5)
- [CVE-2023-32166](https://insights.sbomify.com/CVE-2023-32166/): D-Link D-View uploadFile Directory Traversal Arbitrary File Creation Vulnerability (high 8.1)
- [CVE-2023-32165](https://insights.sbomify.com/CVE-2023-32165/): D-Link D-View TftpReceiveFileHandler Directory Traversal Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2023-32164](https://insights.sbomify.com/CVE-2023-32164/): D-Link D-View TftpSendFileThread Directory Traversal Information Disclosure Vulnerability (high 7.5)
- [CVE-2023-32163](https://insights.sbomify.com/CVE-2023-32163/): Wacom Drivers for Windows Link Following Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2023-32162](https://insights.sbomify.com/CVE-2023-32162/): Wacom Drivers for Windows Incorrect Permission Assignment Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2023-32161](https://insights.sbomify.com/CVE-2023-32161/): PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-32160](https://insights.sbomify.com/CVE-2023-32160/): PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-3216](https://insights.sbomify.com/CVE-2023-3216/): Memory corruption in Chrome (high 8.8)
- [CVE-2023-32159](https://insights.sbomify.com/CVE-2023-32159/): PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-32158](https://insights.sbomify.com/CVE-2023-32158/): PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-32157](https://insights.sbomify.com/CVE-2023-32157/): Tesla Model 3 bsa_server BIP Heap-based Buffer Overflow Arbitrary Code Execution Vulnerability (medium 4.6)
- [CVE-2023-32156](https://insights.sbomify.com/CVE-2023-32156/): Tesla Model 3 Gateway Firmware Signature Validation Bypass Vulnerability (critical 9.0)
- [CVE-2023-32155](https://insights.sbomify.com/CVE-2023-32155/): Tesla Model 3 bcmdhd Out-Of-Bounds Write Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2023-32154](https://insights.sbomify.com/CVE-2023-32154/): Mikrotik RouterOS RADVD Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.5)
- [CVE-2023-32153](https://insights.sbomify.com/CVE-2023-32153/): D-Link DIR-2640 EmailFrom Command Injection Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2023-32152](https://insights.sbomify.com/CVE-2023-32152/): D-Link DIR-2640 HNAP LoginPassword Authentication Bypass Vulnerability (medium 6.5)
- [CVE-2023-32151](https://insights.sbomify.com/CVE-2023-32151/): D-Link DIR-2640 DestNetwork Command Injection Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2023-32150](https://insights.sbomify.com/CVE-2023-32150/): D-Link DIR-2640 PrefixLen Command Injection Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2023-3215](https://insights.sbomify.com/CVE-2023-3215/): Use after free in Chrome (high 8.8)
- [CVE-2023-32149](https://insights.sbomify.com/CVE-2023-32149/): D-Link DIR-2640 prog.cgi Request Handling Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-32148](https://insights.sbomify.com/CVE-2023-32148/): D-Link DIR-2640 HNAP PrivateLogin Authentication Bypass Vulnerability (medium 6.5)
- [CVE-2023-32147](https://insights.sbomify.com/CVE-2023-32147/): D-Link DIR-2640 LocalIPAddress Command Injection Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2023-32146](https://insights.sbomify.com/CVE-2023-32146/): D-Link DAP-1360 Multiple Parameters Stack-Based Buffer Overflow Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-32145](https://insights.sbomify.com/CVE-2023-32145/): D-Link DAP-1360 Hardcoded Credentials Authentication Bypass Vulnerability (high 8.8)
- [CVE-2023-32144](https://insights.sbomify.com/CVE-2023-32144/): D-Link DAP-1360 webproc COMM_MakeCustomMsg Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-32143](https://insights.sbomify.com/CVE-2023-32143/): D-Link DAP-1360 webupg UPGCGI_CheckAuth Numeric Truncation Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-32142](https://insights.sbomify.com/CVE-2023-32142/): D-Link DAP-1360 webproc var:page Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-32141](https://insights.sbomify.com/CVE-2023-32141/): D-Link DAP-1360 webproc WEB_DisplayPage Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-32140](https://insights.sbomify.com/CVE-2023-32140/): D-Link DAP-1360 webproc var:sys_Token Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.5)
- [CVE-2023-3214](https://insights.sbomify.com/CVE-2023-3214/): Use after free in Chrome (high 8.8)
- [CVE-2023-32139](https://insights.sbomify.com/CVE-2023-32139/): D-Link DAP-1360 webproc Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-32138](https://insights.sbomify.com/CVE-2023-32138/): D-Link DAP-1360 webproc Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.5)
- [CVE-2023-32137](https://insights.sbomify.com/CVE-2023-32137/): D-Link DAP-1360 webproc WEB_DisplayPage Directory Traversal Information Disclosure Vulnerability (medium 4.3)
- [CVE-2023-32136](https://insights.sbomify.com/CVE-2023-32136/): D-Link DAP-1360 webproc var:menu Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-32135](https://insights.sbomify.com/CVE-2023-32135/): Sante DICOM Viewer Pro DCM File Parsing Use-After-Free Information Disclosure Vulnerability (low 3.3)
- [CVE-2023-32134](https://insights.sbomify.com/CVE-2023-32134/): Sante DICOM Viewer Pro DCM File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-32133](https://insights.sbomify.com/CVE-2023-32133/): Sante DICOM Viewer Pro J2K File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-32132](https://insights.sbomify.com/CVE-2023-32132/): Sante DICOM Viewer Pro DCM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-32131](https://insights.sbomify.com/CVE-2023-32131/): Sante DICOM Viewer Pro DCM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-32130](https://insights.sbomify.com/CVE-2023-32130/): WordPress Multi Rating Plugin <= 5.0.6 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-3213](https://insights.sbomify.com/CVE-2023-3213/): WP Mail SMTP Pro <= 3.8.0 - Missing Authorization to Information Dislcosure via is_print_page (medium 5.3)
- [CVE-2023-32129](https://insights.sbomify.com/CVE-2023-32129/): WordPress Editorialmag theme <= 1.1.9 - Authenticated Arbitrary Plugin Activation (medium 4.3)
- [CVE-2023-32128](https://insights.sbomify.com/CVE-2023-32128/): WordPress Cryptocurrency Donation Box – Bitcoin & Crypto Donations Plugin <= 2.2.7 is vulnerable to SQL Injection (medium 5.5)
- [CVE-2023-32127](https://insights.sbomify.com/CVE-2023-32127/): WordPress Multi Rating plugin <= 5.0.6 - Unauth Arbitrary rating value change (medium 5.3)
- [CVE-2023-32126](https://insights.sbomify.com/CVE-2023-32126/): WordPress SALERT plugin <= 1.2.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-32125](https://insights.sbomify.com/CVE-2023-32125/): WordPress Multi Rating Plugin <= 5.0.6 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-32124](https://insights.sbomify.com/CVE-2023-32124/): WordPress Publish Confirm Message Plugin <= 1.3.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-32123](https://insights.sbomify.com/CVE-2023-32123/): WordPress The7 Theme <= 11.7.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 6.1)
- [CVE-2023-32122](https://insights.sbomify.com/CVE-2023-32122/): WordPress Spiffy Calendar Plugin <= 4.9.3 is vulnerable to Cross Site Scripting (XSS) (medium 5.8)
- [CVE-2023-32121](https://insights.sbomify.com/CVE-2023-32121/): WordPress Zero Spam Plugin <= 5.4.4 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-32120](https://insights.sbomify.com/CVE-2023-32120/): WordPress Hostel plugin <= 1.1.5.1 - Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-3212](https://insights.sbomify.com/CVE-2023-3212/): Null dereference in Linux kernel (gfs2 file system) (medium 4.4)
- [CVE-2023-32119](https://insights.sbomify.com/CVE-2023-32119/): Cross-site scripting in WPO365 | Mail Integration for Office 365 / Outlook (medium 5.8)
- [CVE-2023-32118](https://insights.sbomify.com/CVE-2023-32118/): WordPress SALERT Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-32117](https://insights.sbomify.com/CVE-2023-32117/): WordPress Integrate Google Drive plugin <= 1.1.99 - Unauthenticated Broken Access Control vulnerability (critical 9.8)
- [CVE-2023-32116](https://insights.sbomify.com/CVE-2023-32116/): WordPress Custom post types Plugin <= 4.0.12 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-32115](https://insights.sbomify.com/CVE-2023-32115/): SQL Injection in Master Data Synchronization (MDS COMPARE TOOL) (medium 4.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/312/