# Vulnerabilities published in 2023


- [CVE-2023-29284](https://insights.sbomify.com/CVE-2023-29284/): Memory corruption in Substance3D - Painter (high 7.8)
- [CVE-2023-29283](https://insights.sbomify.com/CVE-2023-29283/): Memory corruption in Substance3D - Painter (high 7.8)
- [CVE-2023-29282](https://insights.sbomify.com/CVE-2023-29282/): ZDI-CAN-20359: Adobe Substance 3D Painter USD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-29281](https://insights.sbomify.com/CVE-2023-29281/): ZDI-CAN-20364: Adobe Substance 3D Painter USD File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-29280](https://insights.sbomify.com/CVE-2023-29280/): ZDI-CAN-20372: Adobe Substance 3D Painter PLY File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (high 7.8)
- [CVE-2023-2928](https://insights.sbomify.com/CVE-2023-2928/): DedeCMS article_allowurl_edit.php code injection (medium 6.3)
- [CVE-2023-29279](https://insights.sbomify.com/CVE-2023-29279/): ZDI-CAN-20368: Adobe Substance 3D Painter USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-29278](https://insights.sbomify.com/CVE-2023-29278/): ZDI-CAN-20371: Adobe Substance 3D Painter GLTF File Parsing Uninitialized Variable Information Disclosure Vulnerability (high 7.8)
- [CVE-2023-29277](https://insights.sbomify.com/CVE-2023-29277/): ZDI-CAN-20370: Adobe Substance 3D Painter USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-29276](https://insights.sbomify.com/CVE-2023-29276/): ZDI-CAN-20362: Adobe Substance 3D Painter USD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-29275](https://insights.sbomify.com/CVE-2023-29275/): ZDI-CAN-20363: Adobe Substance 3D Painter USD File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-29274](https://insights.sbomify.com/CVE-2023-29274/): ZDI-CAN-20366: Adobe Substance 3D Painter USDC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-29273](https://insights.sbomify.com/CVE-2023-29273/): ZDI-CAN-20367: Adobe Substance 3D Painter USDC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-2927](https://insights.sbomify.com/CVE-2023-2927/): JIZHICMS TemplateController.php index server-side request forgery (medium 6.3)
- [CVE-2023-29268](https://insights.sbomify.com/CVE-2023-29268/): TIBCO Spotfire Statistics Services Unrestricted File Upload Vulnerability (critical 9.8)
- [CVE-2023-29267](https://insights.sbomify.com/CVE-2023-29267/): IBM Db2 denial of service (medium 5.3)
- [CVE-2023-29261](https://insights.sbomify.com/CVE-2023-29261/): IBM Sterling Secure Proxy information disclosure (medium 5.1)
- [CVE-2023-29260](https://insights.sbomify.com/CVE-2023-29260/): IBM Sterling Connect:Express for UNIX server-side request forgery (medium 6.5)
- [CVE-2023-2926](https://insights.sbomify.com/CVE-2023-2926/): SeaCMS Picture Upload member.php denial of service (medium 5.4)
- [CVE-2023-29259](https://insights.sbomify.com/CVE-2023-29259/): IBM Sterling Connect:Express for UNIX information disclosure (low 3.7)
- [CVE-2023-29258](https://insights.sbomify.com/CVE-2023-29258/): IBM Db2 denial of service (medium 5.3)
- [CVE-2023-29257](https://insights.sbomify.com/CVE-2023-29257/): IBM Db2 code execution (high 7.2)
- [CVE-2023-29256](https://insights.sbomify.com/CVE-2023-29256/): IBM Db2 information disclosure (medium 5.3)
- [CVE-2023-29255](https://insights.sbomify.com/CVE-2023-29255/): IBM DB2 for Linux, UNIX and Windows denial of service (high 7.5)
- [CVE-2023-2925](https://insights.sbomify.com/CVE-2023-2925/): Webkul krayin crm Edit Person Page 2 cross site scripting (low 2.4)
- [CVE-2023-29247](https://insights.sbomify.com/CVE-2023-29247/): Stored XSS on Apache Airflow (medium 5.4)
- [CVE-2023-29246](https://insights.sbomify.com/CVE-2023-29246/): Apache OpenMeetings: allows null-byte Injection (high 7.2)
- [CVE-2023-29245](https://insights.sbomify.com/CVE-2023-29245/): SQL Injection on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0 (critical 9.2)
- [CVE-2023-29244](https://insights.sbomify.com/CVE-2023-29244/): Misconfiguration in Intel Integrated Sensor Hub (ISH) driver for Windows 10 for Intel NUC P14E Laptop Element software installers (medium 6.7)
- [CVE-2023-29243](https://insights.sbomify.com/CVE-2023-29243/): Denial of service in Intel(R) RealSense(TM) ID software for Intel(R) RealSense(TM) 450 FA (medium 4.4)
- [CVE-2023-29242](https://insights.sbomify.com/CVE-2023-29242/): Privilege escalation in Intel(R) oneAPI Toolkits (medium 6.7)
- [CVE-2023-29241](https://insights.sbomify.com/CVE-2023-29241/): Misconfiguration in BIS (high 8.1)
- [CVE-2023-29240](https://insights.sbomify.com/CVE-2023-29240/): BIG-IQ iControl REST Vulnerability (medium 5.4)
- [CVE-2023-2924](https://insights.sbomify.com/CVE-2023-2924/): Supcon SimField reportupload.aspx unrestricted upload (medium 4.7)
- [CVE-2023-29239](https://insights.sbomify.com/CVE-2023-29239/): WordPress LuckyWP Scripts Control plugin <= 1.2.1 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-29238](https://insights.sbomify.com/CVE-2023-29238/): WordPress Whydonate – FREE Donate button Plugin <= 3.12.15 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-29237](https://insights.sbomify.com/CVE-2023-29237/): WordPress Remove Duplicate Posts plugin <= 1.3.5 - Broken Access Control vulnerability (medium 6.3)
- [CVE-2023-29236](https://insights.sbomify.com/CVE-2023-29236/): WordPress Outdoor Theme <= 3.9.6 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-29235](https://insights.sbomify.com/CVE-2023-29235/): WordPress Maintenance Switch Plugin <= 1.5.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-29234](https://insights.sbomify.com/CVE-2023-29234/): Bypass serialize checks in Apache Dubbo (critical 9.8)
- [CVE-2023-2923](https://insights.sbomify.com/CVE-2023-2923/): Tenda AC6 fromDhcpListClient stack-based overflow (medium 6.3)
- [CVE-2023-2922](https://insights.sbomify.com/CVE-2023-2922/): SourceCodester Comment System GET Parameter index.php cross site scripting (low 3.5)
- [CVE-2023-29218](https://insights.sbomify.com/CVE-2023-29218/): Business logic in twitter:recommendation algorithm (high 7.5)
- [CVE-2023-29216](https://insights.sbomify.com/CVE-2023-29216/): Apache Linkis DatasourceManager module has a deserialization command execution (critical 9.8)
- [CVE-2023-29215](https://insights.sbomify.com/CVE-2023-29215/): Apache Linkis JDBC EngineCon has a deserialization command execution (critical 9.8)
- [CVE-2023-29214](https://insights.sbomify.com/CVE-2023-29214/): org.xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerability (critical 10.0)
- [CVE-2023-29213](https://insights.sbomify.com/CVE-2023-29213/): org.xwiki.platform:xwiki-platform-logging-ui Injection vulnerability (critical 9.1)
- [CVE-2023-29212](https://insights.sbomify.com/CVE-2023-29212/): xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerability (critical 10.0)
- [CVE-2023-29211](https://insights.sbomify.com/CVE-2023-29211/): org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerability (critical 10.0)
- [CVE-2023-29210](https://insights.sbomify.com/CVE-2023-29210/): org.xwiki.platform:xwiki-platform-notifications-ui Eval Injection vulnerability (critical 10.0)
- [CVE-2023-2921](https://insights.sbomify.com/CVE-2023-2921/): Short URL <= 1.6.8 - Subscriber+ SQLi (high 8.8)
- [CVE-2023-29209](https://insights.sbomify.com/CVE-2023-29209/): org.xwiki.platform:xwiki-platform-legacy-notification-activitymacro Eval Injection vulnerability (critical 10.0)
- [CVE-2023-29208](https://insights.sbomify.com/CVE-2023-29208/): Data leak through deleted documents (high 7.5)
- [CVE-2023-29207](https://insights.sbomify.com/CVE-2023-29207/): Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macro (high 8.9)
- [CVE-2023-29206](https://insights.sbomify.com/CVE-2023-29206/): org.xwiki.platform:xwiki-platform-skin-skinx vulnerable to basic Cross-site Scripting by exploiting JSX or SSX plugins (critical 9.1)
- [CVE-2023-29205](https://insights.sbomify.com/CVE-2023-29205/): org.xwiki.platform:xwiki-platform-rendering-xwiki vulnerable to stored cross-site scripting via HTML and raw macro (critical 10.0)
- [CVE-2023-29204](https://insights.sbomify.com/CVE-2023-29204/): URL Redirection to Untrusted Site ('Open Redirect') in org.xwiki.platform:xwiki-platform-oldcore (medium 4.7)
- [CVE-2023-29203](https://insights.sbomify.com/CVE-2023-29203/): Unauthenticated user can have information about hidden users on subwikis through uorgsuggest.vm (low 3.7)
- [CVE-2023-29202](https://insights.sbomify.com/CVE-2023-29202/): org.xwiki.platform:xwiki-platform-rendering-macro-rss Cross-site Scripting vulnerability (critical 9.1)
- [CVE-2023-29201](https://insights.sbomify.com/CVE-2023-29201/): org.xwiki.commons:xwiki-commons-xml Cross-site Scripting vulnerability (critical 9.1)
- [CVE-2023-29200](https://insights.sbomify.com/CVE-2023-29200/): contao/core-bundle has path traversal vulnerability in the file manager (medium 4.3)
- [CVE-2023-29199](https://insights.sbomify.com/CVE-2023-29199/): vm2 Sandbox escape vulnerability (critical 9.8)
- [CVE-2023-29198](https://insights.sbomify.com/CVE-2023-29198/): Context isolation bypass via nested unserializable return value in Electron (medium 6.0)
- [CVE-2023-29197](https://insights.sbomify.com/CVE-2023-29197/): Improper header name validation in guzzlehttp/psr7 (medium 5.3)
- [CVE-2023-29196](https://insights.sbomify.com/CVE-2023-29196/): HTML injection via topic embedding in Discourse (medium 4.2)
- [CVE-2023-29195](https://insights.sbomify.com/CVE-2023-29195/): Vitess VTAdmin users that can create shards can deny access to other functions (medium 4.1)
- [CVE-2023-29194](https://insights.sbomify.com/CVE-2023-29194/): vitess allows users to create keyspaces that can deny access to already existing keyspaces (medium 4.1)
- [CVE-2023-29193](https://insights.sbomify.com/CVE-2023-29193/): SpiceDB binding metrics port to untrusted networks and can leak command-line flags (high 8.7)
- [CVE-2023-29192](https://insights.sbomify.com/CVE-2023-29192/): Missing authorization in silverwaregames-io-issue-tracker (low 2.7)
- [CVE-2023-2919](https://insights.sbomify.com/CVE-2023-2919/): Tutor LMS <= 2.7.4 - Cross-Site Request Forgery via 'addon_enable_disable' (medium 4.3)
- [CVE-2023-29189](https://insights.sbomify.com/CVE-2023-29189/): HTTP Verb Tampering vulnerability in SAP CRM (WebClient UI) (medium 5.4)
- [CVE-2023-29188](https://insights.sbomify.com/CVE-2023-29188/): Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI (medium 5.4)
- [CVE-2023-29187](https://insights.sbomify.com/CVE-2023-29187/): DLL Hijacking vulnerability in SapSetup (Software Installation Program) (medium 6.7)
- [CVE-2023-29186](https://insights.sbomify.com/CVE-2023-29186/): Directory/Path Traversal vulnerability in SAP NetWeaver. (high 8.7)
- [CVE-2023-29185](https://insights.sbomify.com/CVE-2023-29185/): Denial of Service (DOS) in SAP NetWeaver AS for ABAP (Business Server Pages) (medium 5.3)
- [CVE-2023-29184](https://insights.sbomify.com/CVE-2023-29184/): Other in FortiOS (low 3.1)
- [CVE-2023-29183](https://insights.sbomify.com/CVE-2023-29183/): Cross-site scripting in FortiOS (high 7.3)
- [CVE-2023-29182](https://insights.sbomify.com/CVE-2023-29182/): Memory corruption in FortiOS (medium 6.4)
- [CVE-2023-29181](https://insights.sbomify.com/CVE-2023-29181/): Memory corruption in FortiOS (high 8.3)
- [CVE-2023-29180](https://insights.sbomify.com/CVE-2023-29180/): Null dereference in FortiOS (high 7.3)
- [CVE-2023-29179](https://insights.sbomify.com/CVE-2023-29179/): Null dereference in FortiOS (medium 6.4)
- [CVE-2023-29178](https://insights.sbomify.com/CVE-2023-29178/): Memory corruption in FortiOS (low 3.9)
- [CVE-2023-29177](https://insights.sbomify.com/CVE-2023-29177/): Memory corruption in FortiADC (medium 6.2)
- [CVE-2023-29175](https://insights.sbomify.com/CVE-2023-29175/): Security feature bypass in FortiOS (medium 4.4)
- [CVE-2023-29174](https://insights.sbomify.com/CVE-2023-29174/): WordPress SKU Label Changer For WooCommerce plugin <= 3.0 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2023-29173](https://insights.sbomify.com/CVE-2023-29173/): WordPress Product Category Tree plugin <= 2.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2023-29172](https://insights.sbomify.com/CVE-2023-29172/): WordPress PropertyHive Plugin <= 1.5.46 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-29171](https://insights.sbomify.com/CVE-2023-29171/): WordPress Magic Post Thumbnail Plugin <= 4.1.10 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-29170](https://insights.sbomify.com/CVE-2023-29170/): WordPress Product Enquiry for WooCommerce Plugin <= 2.2.12 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-2917](https://insights.sbomify.com/CVE-2023-2917/): Rockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation Vulnerability (critical 9.8)
- [CVE-2023-29169](https://insights.sbomify.com/CVE-2023-29169/): CVE-2023-29169 (high 8.8)
- [CVE-2023-29168](https://insights.sbomify.com/CVE-2023-29168/): PTC Vuforia Studio Insufficiently Protected Credentials (low 3.7)
- [CVE-2023-29167](https://insights.sbomify.com/CVE-2023-29167/): Memory corruption in FRENIC RHC Loader (high 7.8)
- [CVE-2023-29166](https://insights.sbomify.com/CVE-2023-29166/): Privilege escalation in Pro Video Formats (high 8.8)
- [CVE-2023-29165](https://insights.sbomify.com/CVE-2023-29165/): Privilege escalation in Intel(R) Arc(TM) Control software (medium 6.7)
- [CVE-2023-29164](https://insights.sbomify.com/CVE-2023-29164/): Privilege escalation in Intel(R) Server Board S2600WF, Intel(R) Server Board S2600ST, Intel(R) Server Board S2600BP, Intel(R) Server Board M50CYP and Intel(R) Server Board D50TNP (medium 5.8)
- [CVE-2023-29163](https://insights.sbomify.com/CVE-2023-29163/): BIG-IP UDP Profile vulnerability (high 7.5)
- [CVE-2023-29162](https://insights.sbomify.com/CVE-2023-29162/): Memory corruption in Intel(R) C++ Compiler Classic (medium 6.0)
- [CVE-2023-29161](https://insights.sbomify.com/CVE-2023-29161/): Privilege escalation in Intel(R) OFU software (medium 6.7)
- [CVE-2023-29160](https://insights.sbomify.com/CVE-2023-29160/): Memory corruption in FRENIC RHC Loader (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/333/