# Vulnerabilities published in 2023


- [CVE-2023-28323](https://insights.sbomify.com/CVE-2023-28323/): Deserialization in Ivanti Endpoint Manager (critical 9.8)
- [CVE-2023-28322](https://insights.sbomify.com/CVE-2023-28322/): Information disclosure in https://github.com/curl/curl (medium 5.3)
- [CVE-2023-28321](https://insights.sbomify.com/CVE-2023-28321/): Security feature bypass in https://github.com/curl/curl (medium 5.9)
- [CVE-2023-28320](https://insights.sbomify.com/CVE-2023-28320/): Race condition in https://github.com/curl/curl (medium 5.9)
- [CVE-2023-2832](https://insights.sbomify.com/CVE-2023-2832/): SQL Injection in unilogies/bumsys (high 7.2)
- [CVE-2023-28319](https://insights.sbomify.com/CVE-2023-28319/): Use after free in https://github.com/curl/curl (high 7.5)
- [CVE-2023-28318](https://insights.sbomify.com/CVE-2023-28318/): Security feature bypass in Rocket.Chat (medium 5.3)
- [CVE-2023-28317](https://insights.sbomify.com/CVE-2023-28317/): Business logic in Rocket.Chat (medium 5.3)
- [CVE-2023-28316](https://insights.sbomify.com/CVE-2023-28316/): Auth bypass in Rocket.Chat (critical 9.8)
- [CVE-2023-28314](https://insights.sbomify.com/CVE-2023-28314/): Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability (medium 6.1)
- [CVE-2023-28313](https://insights.sbomify.com/CVE-2023-28313/): Microsoft Dynamics 365 Customer Voice Cross-Site Scripting Vulnerability (medium 6.1)
- [CVE-2023-28312](https://insights.sbomify.com/CVE-2023-28312/): Azure Machine Learning Information Disclosure Vulnerability (medium 6.5)
- [CVE-2023-28311](https://insights.sbomify.com/CVE-2023-28311/): Microsoft Word Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-28310](https://insights.sbomify.com/CVE-2023-28310/): Microsoft Exchange Server Remote Code Execution Vulnerability (high 8.0)
- [CVE-2023-2831](https://insights.sbomify.com/CVE-2023-2831/): Denial of Service while unescaping a Markdown string (medium 4.3)
- [CVE-2023-28309](https://insights.sbomify.com/CVE-2023-28309/): Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability (high 7.6)
- [CVE-2023-28308](https://insights.sbomify.com/CVE-2023-28308/): Windows DNS Server Remote Code Execution Vulnerability (medium 6.6)
- [CVE-2023-28307](https://insights.sbomify.com/CVE-2023-28307/): Windows DNS Server Remote Code Execution Vulnerability (medium 6.6)
- [CVE-2023-28306](https://insights.sbomify.com/CVE-2023-28306/): Windows DNS Server Remote Code Execution Vulnerability (medium 6.6)
- [CVE-2023-28305](https://insights.sbomify.com/CVE-2023-28305/): Windows DNS Server Remote Code Execution Vulnerability (medium 6.6)
- [CVE-2023-28304](https://insights.sbomify.com/CVE-2023-28304/): Microsoft ODBC and OLE DB Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-28303](https://insights.sbomify.com/CVE-2023-28303/): Windows Snipping Tool Information Disclosure Vulnerability (low 3.3)
- [CVE-2023-28302](https://insights.sbomify.com/CVE-2023-28302/): Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability (high 7.5)
- [CVE-2023-28301](https://insights.sbomify.com/CVE-2023-28301/): Microsoft Edge (Chromium-based) Tampering Vulnerability (low 3.7)
- [CVE-2023-28300](https://insights.sbomify.com/CVE-2023-28300/): Azure Service Connector Security Feature Bypass Vulnerability (high 7.5)
- [CVE-2023-2830](https://insights.sbomify.com/CVE-2023-2830/): WordPress WP Testimonials Plugin <= 1.4.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-28299](https://insights.sbomify.com/CVE-2023-28299/): Visual Studio Spoofing Vulnerability (medium 5.5)
- [CVE-2023-28298](https://insights.sbomify.com/CVE-2023-28298/): Windows Kernel Denial of Service Vulnerability (medium 5.5)
- [CVE-2023-28297](https://insights.sbomify.com/CVE-2023-28297/): Windows Remote Procedure Call Service (RPCSS) Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2023-28296](https://insights.sbomify.com/CVE-2023-28296/): Visual Studio Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-28295](https://insights.sbomify.com/CVE-2023-28295/): Microsoft Publisher Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-28293](https://insights.sbomify.com/CVE-2023-28293/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2023-28292](https://insights.sbomify.com/CVE-2023-28292/): Raw Image Extension Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-28291](https://insights.sbomify.com/CVE-2023-28291/): Raw Image Extension Remote Code Execution Vulnerability (high 8.4)
- [CVE-2023-28290](https://insights.sbomify.com/CVE-2023-28290/): Microsoft Remote Desktop app for Windows Information Disclosure Vulnerability (medium 5.3)
- [CVE-2023-2829](https://insights.sbomify.com/CVE-2023-2829/): Malformed NSEC records can cause named to terminate unexpectedly when synth-from-dnssec is enabled (high 7.5)
- [CVE-2023-28288](https://insights.sbomify.com/CVE-2023-28288/): Microsoft SharePoint Server Spoofing Vulnerability (high 8.1)
- [CVE-2023-28287](https://insights.sbomify.com/CVE-2023-28287/): Microsoft Publisher Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-28286](https://insights.sbomify.com/CVE-2023-28286/): Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (medium 6.1)
- [CVE-2023-28285](https://insights.sbomify.com/CVE-2023-28285/): Microsoft Office Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-28284](https://insights.sbomify.com/CVE-2023-28284/): Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (medium 4.3)
- [CVE-2023-28283](https://insights.sbomify.com/CVE-2023-28283/): Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (high 8.1)
- [CVE-2023-2828](https://insights.sbomify.com/CVE-2023-2828/): named's configured cache size limit can be significantly exceeded (high 7.5)
- [CVE-2023-28278](https://insights.sbomify.com/CVE-2023-28278/): Windows DNS Server Remote Code Execution Vulnerability (medium 6.6)
- [CVE-2023-28277](https://insights.sbomify.com/CVE-2023-28277/): Windows DNS Server Information Disclosure Vulnerability (medium 4.9)
- [CVE-2023-28276](https://insights.sbomify.com/CVE-2023-28276/): Windows Group Policy Security Feature Bypass Vulnerability (medium 4.4)
- [CVE-2023-28275](https://insights.sbomify.com/CVE-2023-28275/): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-28274](https://insights.sbomify.com/CVE-2023-28274/): Windows Win32k Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2023-28273](https://insights.sbomify.com/CVE-2023-28273/): Windows Clip Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2023-28272](https://insights.sbomify.com/CVE-2023-28272/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2023-28271](https://insights.sbomify.com/CVE-2023-28271/): Windows Kernel Memory Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-28270](https://insights.sbomify.com/CVE-2023-28270/): Windows Lock Screen Security Feature Bypass Vulnerability (medium 6.8)
- [CVE-2023-2827](https://insights.sbomify.com/CVE-2023-2827/): Missing Authentication in SAP Plant Connectivity and Production Connector for SAP Digital (high 7.9)
- [CVE-2023-28269](https://insights.sbomify.com/CVE-2023-28269/): Windows Boot Manager Security Feature Bypass Vulnerability (medium 6.2)
- [CVE-2023-28268](https://insights.sbomify.com/CVE-2023-28268/): Netlogon RPC Elevation of Privilege Vulnerability (high 8.1)
- [CVE-2023-28267](https://insights.sbomify.com/CVE-2023-28267/): Remote Desktop Protocol Client Information Disclosure Vulnerability (medium 6.5)
- [CVE-2023-28266](https://insights.sbomify.com/CVE-2023-28266/): Windows Common Log File System Driver Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-28263](https://insights.sbomify.com/CVE-2023-28263/): Visual Studio Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-28262](https://insights.sbomify.com/CVE-2023-28262/): Visual Studio Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2023-28261](https://insights.sbomify.com/CVE-2023-28261/): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (medium 5.7)
- [CVE-2023-28260](https://insights.sbomify.com/CVE-2023-28260/): .NET DLL Hijacking Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-2826](https://insights.sbomify.com/CVE-2023-2826/): SourceCodester Class Scheduling System POST Parameter search_teacher_result.php cross site scripting (low 3.5)
- [CVE-2023-28256](https://insights.sbomify.com/CVE-2023-28256/): Windows DNS Server Remote Code Execution Vulnerability (medium 6.6)
- [CVE-2023-28255](https://insights.sbomify.com/CVE-2023-28255/): Windows DNS Server Remote Code Execution Vulnerability (medium 6.6)
- [CVE-2023-28254](https://insights.sbomify.com/CVE-2023-28254/): Windows DNS Server Remote Code Execution Vulnerability (high 7.2)
- [CVE-2023-28253](https://insights.sbomify.com/CVE-2023-28253/): Windows Kernel Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-28252](https://insights.sbomify.com/CVE-2023-28252/): Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation (high 7.8, exploited in the wild)
- [CVE-2023-28251](https://insights.sbomify.com/CVE-2023-28251/): Windows Driver Revocation List Security Feature Bypass Vulnerability (medium 5.5)
- [CVE-2023-28250](https://insights.sbomify.com/CVE-2023-28250/): Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2023-2825](https://insights.sbomify.com/CVE-2023-2825/): Path traversal in GitLab (critical 10.0)
- [CVE-2023-28249](https://insights.sbomify.com/CVE-2023-28249/): Windows Boot Manager Security Feature Bypass Vulnerability (medium 6.2)
- [CVE-2023-28248](https://insights.sbomify.com/CVE-2023-28248/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2023-28247](https://insights.sbomify.com/CVE-2023-28247/): Windows Network File System Information Disclosure Vulnerability (high 7.5)
- [CVE-2023-28246](https://insights.sbomify.com/CVE-2023-28246/): Windows Registry Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2023-28244](https://insights.sbomify.com/CVE-2023-28244/): Windows Kerberos Elevation of Privilege Vulnerability (high 8.1)
- [CVE-2023-28243](https://insights.sbomify.com/CVE-2023-28243/): Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-28241](https://insights.sbomify.com/CVE-2023-28241/): Windows Secure Socket Tunneling Protocol (SSTP) Denial of Service Vulnerability (high 7.5)
- [CVE-2023-28240](https://insights.sbomify.com/CVE-2023-28240/): Windows Network Load Balancing Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-2824](https://insights.sbomify.com/CVE-2023-2824/): SourceCodester Dental Clinic Appointment Reservation System POST Parameter service.php cross site scripting (low 3.5)
- [CVE-2023-28238](https://insights.sbomify.com/CVE-2023-28238/): Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability (high 7.5)
- [CVE-2023-28237](https://insights.sbomify.com/CVE-2023-28237/): Windows Kernel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-28236](https://insights.sbomify.com/CVE-2023-28236/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2023-28235](https://insights.sbomify.com/CVE-2023-28235/): Windows Lock Screen Security Feature Bypass Vulnerability (medium 6.8)
- [CVE-2023-28234](https://insights.sbomify.com/CVE-2023-28234/): Windows Secure Channel Denial of Service Vulnerability (high 7.5)
- [CVE-2023-28233](https://insights.sbomify.com/CVE-2023-28233/): Windows Secure Channel Denial of Service Vulnerability (high 7.5)
- [CVE-2023-28232](https://insights.sbomify.com/CVE-2023-28232/): Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability (high 7.5)
- [CVE-2023-28231](https://insights.sbomify.com/CVE-2023-28231/): DHCP Server Service Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-2823](https://insights.sbomify.com/CVE-2023-2823/): SourceCodester Class Scheduling System GET Parameter edit_subject.php sql injection (medium 6.3)
- [CVE-2023-28229](https://insights.sbomify.com/CVE-2023-28229/): Microsoft Windows CNG Key Isolation Service Privilege Escalation (high 7.0, exploited in the wild)
- [CVE-2023-28228](https://insights.sbomify.com/CVE-2023-28228/): Windows Spoofing Vulnerability (medium 5.5)
- [CVE-2023-28227](https://insights.sbomify.com/CVE-2023-28227/): Windows Bluetooth Driver Remote Code Execution Vulnerability (high 7.5)
- [CVE-2023-28226](https://insights.sbomify.com/CVE-2023-28226/): Windows Enroll Engine Security Feature Bypass Vulnerability (medium 5.3)
- [CVE-2023-28225](https://insights.sbomify.com/CVE-2023-28225/): Windows NTLM Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2023-28224](https://insights.sbomify.com/CVE-2023-28224/): Windows Point-to-Point Protocol over Ethernet (PPPoE) Remote Code Execution Vulnerability (high 7.1)
- [CVE-2023-28223](https://insights.sbomify.com/CVE-2023-28223/): Windows Domain Name Service Remote Code Execution Vulnerability (medium 6.6)
- [CVE-2023-28222](https://insights.sbomify.com/CVE-2023-28222/): Windows Kernel Elevation of Privilege Vulnerability (high 7.1)
- [CVE-2023-28221](https://insights.sbomify.com/CVE-2023-28221/): Windows Error Reporting Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2023-28220](https://insights.sbomify.com/CVE-2023-28220/): Layer 2 Tunneling Protocol Remote Code Execution Vulnerability (high 8.1)
- [CVE-2023-2822](https://insights.sbomify.com/CVE-2023-2822/): Ellucian Ethos Identity logout cross site scripting (medium 4.3)
- [CVE-2023-28219](https://insights.sbomify.com/CVE-2023-28219/): Layer 2 Tunneling Protocol Remote Code Execution Vulnerability (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/342/