# Vulnerabilities published in 2023


- [CVE-2023-28218](https://insights.sbomify.com/CVE-2023-28218/): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2023-28217](https://insights.sbomify.com/CVE-2023-28217/): Windows Network Address Translation (NAT) Denial of Service Vulnerability (high 7.5)
- [CVE-2023-28216](https://insights.sbomify.com/CVE-2023-28216/): Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2023-28215](https://insights.sbomify.com/CVE-2023-28215/): Memory corruption in macOS (high 7.8)
- [CVE-2023-28214](https://insights.sbomify.com/CVE-2023-28214/): Memory corruption in macOS (high 7.8)
- [CVE-2023-28213](https://insights.sbomify.com/CVE-2023-28213/): Memory corruption in macOS (high 7.8)
- [CVE-2023-28212](https://insights.sbomify.com/CVE-2023-28212/): Memory corruption in macOS (high 7.8)
- [CVE-2023-28211](https://insights.sbomify.com/CVE-2023-28211/): Memory corruption in macOS (high 7.8)
- [CVE-2023-28210](https://insights.sbomify.com/CVE-2023-28210/): Memory corruption in macOS (high 7.8)
- [CVE-2023-28209](https://insights.sbomify.com/CVE-2023-28209/): Memory corruption in macOS (high 7.8)
- [CVE-2023-28208](https://insights.sbomify.com/CVE-2023-28208/): Business logic in iOS and iPadOS (medium 4.3)
- [CVE-2023-28207](https://insights.sbomify.com/CVE-2023-28207/): Privilege escalation in macOS (medium 5.5)
- [CVE-2023-28206](https://insights.sbomify.com/CVE-2023-28206/): Apple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds Write (high 8.6, exploited in the wild)
- [CVE-2023-28205](https://insights.sbomify.com/CVE-2023-28205/): Apple Multiple Products WebKit Use-After-Free (high 8.8, exploited in the wild)
- [CVE-2023-28204](https://insights.sbomify.com/CVE-2023-28204/): Apple Multiple Products WebKit Out-of-Bounds Read (medium 6.5, exploited in the wild)
- [CVE-2023-28203](https://insights.sbomify.com/CVE-2023-28203/): Information disclosure in Apple Music for Android (medium 5.5)
- [CVE-2023-28202](https://insights.sbomify.com/CVE-2023-28202/): Security feature bypass in iOS and iPadOS (medium 5.5)
- [CVE-2023-28201](https://insights.sbomify.com/CVE-2023-28201/): Race condition in Safari (critical 9.8)
- [CVE-2023-28200](https://insights.sbomify.com/CVE-2023-28200/): Information disclosure in iOS and iPadOS (medium 5.5)
- [CVE-2023-2820](https://insights.sbomify.com/CVE-2023-2820/): Information disclosure in Threat Response Auto Pull (medium 6.1)
- [CVE-2023-28199](https://insights.sbomify.com/CVE-2023-28199/): Memory corruption in macOS (medium 5.5)
- [CVE-2023-28198](https://insights.sbomify.com/CVE-2023-28198/): Use after free in iOS and iPadOS (high 8.8)
- [CVE-2023-28197](https://insights.sbomify.com/CVE-2023-28197/): Security feature bypass in macOS (low 3.3)
- [CVE-2023-28195](https://insights.sbomify.com/CVE-2023-28195/): Information disclosure in macOS (low 3.3)
- [CVE-2023-28194](https://insights.sbomify.com/CVE-2023-28194/): Security feature bypass in iOS and iPadOS (low 3.3)
- [CVE-2023-28192](https://insights.sbomify.com/CVE-2023-28192/): Information disclosure in macOS (medium 5.5)
- [CVE-2023-28191](https://insights.sbomify.com/CVE-2023-28191/): Security feature bypass in iOS and iPadOS (medium 5.5)
- [CVE-2023-28190](https://insights.sbomify.com/CVE-2023-28190/): Information disclosure in macOS (medium 5.5)
- [CVE-2023-2819](https://insights.sbomify.com/CVE-2023-2819/): Cross-site scripting in Threat Response Auto Pull (medium 4.3)
- [CVE-2023-28189](https://insights.sbomify.com/CVE-2023-28189/): Information disclosure in macOS (medium 5.5)
- [CVE-2023-28188](https://insights.sbomify.com/CVE-2023-28188/): Denial of service in macOS (medium 6.5)
- [CVE-2023-28187](https://insights.sbomify.com/CVE-2023-28187/): Denial of service in macOS (medium 6.5)
- [CVE-2023-28185](https://insights.sbomify.com/CVE-2023-28185/): Integer overflow in iOS and iPadOS (medium 5.5)
- [CVE-2023-28182](https://insights.sbomify.com/CVE-2023-28182/): Auth bypass in iOS and iPadOS (medium 6.5)
- [CVE-2023-28181](https://insights.sbomify.com/CVE-2023-28181/): Memory corruption in iOS and iPadOS (high 7.8)
- [CVE-2023-28180](https://insights.sbomify.com/CVE-2023-28180/): Denial of service in macOS (medium 6.5)
- [CVE-2023-2818](https://insights.sbomify.com/CVE-2023-2818/): ITM Windows Agent Insecure Filesystem Permissions (medium 5.5)
- [CVE-2023-28179](https://insights.sbomify.com/CVE-2023-28179/): Memory corruption in macOS (high 7.1)
- [CVE-2023-28178](https://insights.sbomify.com/CVE-2023-28178/): Security feature bypass in iOS and iPadOS (medium 5.5)
- [CVE-2023-28177](https://insights.sbomify.com/CVE-2023-28177/): Memory corruption in Firefox (high 8.8)
- [CVE-2023-28176](https://insights.sbomify.com/CVE-2023-28176/): Memory corruption in Firefox (high 8.8)
- [CVE-2023-28175](https://insights.sbomify.com/CVE-2023-28175/): Missing authorization in BVMS (high 7.1)
- [CVE-2023-28174](https://insights.sbomify.com/CVE-2023-28174/): WordPress eRocket Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-28173](https://insights.sbomify.com/CVE-2023-28173/): WordPress Google XML Sitemap for Images Plugin <= 2.1.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-28172](https://insights.sbomify.com/CVE-2023-28172/): WordPress WP Google Map Plugin Plugin <= 4.4.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-28171](https://insights.sbomify.com/CVE-2023-28171/): WordPress Brilliance Theme <= 1.3.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.4)
- [CVE-2023-28170](https://insights.sbomify.com/CVE-2023-28170/): WordPress Theme Demo Import Plugin <= 1.1.1 is vulnerable to Arbitrary File Upload (critical 9.1)
- [CVE-2023-2817](https://insights.sbomify.com/CVE-2023-2817/): Stored cross site scripting in Craft CMS (medium 5.4)
- [CVE-2023-28169](https://insights.sbomify.com/CVE-2023-28169/): WordPress Easy Event calendar Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-28168](https://insights.sbomify.com/CVE-2023-28168/): WordPress WordPress Console plugin <= 0.3.9 - Broken Access Control vulnerability (low 3.7)
- [CVE-2023-28167](https://insights.sbomify.com/CVE-2023-28167/): WordPress CF7 Invisible reCAPTCHA Plugin <= 1.3.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-28166](https://insights.sbomify.com/CVE-2023-28166/): WordPress Tags Cloud Manager Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-28165](https://insights.sbomify.com/CVE-2023-28165/): WordPress Backup Bank: WordPress Backup Plugin plugin <= 4.0.28 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2023-28164](https://insights.sbomify.com/CVE-2023-28164/): Security feature bypass in Firefox (medium 6.5)
- [CVE-2023-28163](https://insights.sbomify.com/CVE-2023-28163/): Path traversal in Firefox (medium 6.5)
- [CVE-2023-28162](https://insights.sbomify.com/CVE-2023-28162/): Memory corruption in Firefox (high 8.8)
- [CVE-2023-28161](https://insights.sbomify.com/CVE-2023-28161/): Security feature bypass in Firefox (high 8.8)
- [CVE-2023-28160](https://insights.sbomify.com/CVE-2023-28160/): Information disclosure in Firefox (medium 6.5)
- [CVE-2023-2816](https://insights.sbomify.com/CVE-2023-2816/): Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner (high 8.7)
- [CVE-2023-28159](https://insights.sbomify.com/CVE-2023-28159/): Other in Firefox (medium 4.3)
- [CVE-2023-28158](https://insights.sbomify.com/CVE-2023-28158/): Apache Archiva privilege escalation (medium 6.5)
- [CVE-2023-28155](https://insights.sbomify.com/CVE-2023-28155/): Server-Side Request Forgery in Request (medium 6.1)
- [CVE-2023-28154](https://insights.sbomify.com/CVE-2023-28154/): Cross-realm object access in Webpack 5 (critical 9.8)
- [CVE-2023-28153](https://insights.sbomify.com/CVE-2023-28153/): Security feature bypass in kiddoware:kiddoware (medium 6.4)
- [CVE-2023-28152](https://insights.sbomify.com/CVE-2023-28152/): XML external entity in independentsoft:jword (medium 5.3)
- [CVE-2023-28151](https://insights.sbomify.com/CVE-2023-28151/): XML external entity in independentsoft:jspreadsheet (medium 5.3)
- [CVE-2023-28150](https://insights.sbomify.com/CVE-2023-28150/): XML external entity in independentsoft:jodf (medium 5.3)
- [CVE-2023-2815](https://insights.sbomify.com/CVE-2023-2815/): SourceCodester Online Jewelry Store POST Parameter supplier.php sql injection (medium 6.3)
- [CVE-2023-28149](https://insights.sbomify.com/CVE-2023-28149/): An issue was discovered in the IhisiServiceSmm module in Insyde InsydeH2O with kernel 5.2 before 05.28.42, 5.3 before 05.37.42, 5.4 before 0 (medium 6.1)
- [CVE-2023-28148](https://insights.sbomify.com/CVE-2023-28148/): Cross-site scripting in PRTG Network Monitor (high 7.2)
- [CVE-2023-28147](https://insights.sbomify.com/CVE-2023-28147/): Use after free in arm:avalon gpu kernel driver (medium 5.5)
- [CVE-2023-28144](https://insights.sbomify.com/CVE-2023-28144/): Race condition in kdab:hotspot (high 7.0)
- [CVE-2023-28143](https://insights.sbomify.com/CVE-2023-28143/): Local Privilege Escalation (medium 6.7)
- [CVE-2023-28142](https://insights.sbomify.com/CVE-2023-28142/): Race Condition (medium 6.7)
- [CVE-2023-28141](https://insights.sbomify.com/CVE-2023-28141/): NTFS Junction (medium 6.7)
- [CVE-2023-28140](https://insights.sbomify.com/CVE-2023-28140/): Executable Hijacking (medium 6.7)
- [CVE-2023-2814](https://insights.sbomify.com/CVE-2023-2814/): SourceCodester Class Scheduling System POST Parameter save_teacher.php cross site scripting (low 3.5)
- [CVE-2023-28134](https://insights.sbomify.com/CVE-2023-28134/): Local Privliege Escalation in Check Point Endpoint Security Remediation Service (high 7.8)
- [CVE-2023-28133](https://insights.sbomify.com/CVE-2023-28133/): Privilege escalation in Harmony Endpoint. (high 7.8)
- [CVE-2023-28131](https://insights.sbomify.com/CVE-2023-28131/): Expo SDK has an OAuth vulnerability (critical 9.6)
- [CVE-2023-28130](https://insights.sbomify.com/CVE-2023-28130/): Command injection in Quantum Appliances, Quantum Security Gateways (high 7.2)
- [CVE-2023-2813](https://insights.sbomify.com/CVE-2023-2813/): Multiple Themes - Reflected XSS (medium 6.1)
- [CVE-2023-28129](https://insights.sbomify.com/CVE-2023-28129/): Privilege escalation in Desktop & Server Management (DSM) (high 7.8)
- [CVE-2023-28128](https://insights.sbomify.com/CVE-2023-28128/): File upload in Avalanche (high 7.2)
- [CVE-2023-28127](https://insights.sbomify.com/CVE-2023-28127/): Path traversal in Avalanche (high 7.5)
- [CVE-2023-28126](https://insights.sbomify.com/CVE-2023-28126/): Auth bypass in Avalanche (medium 5.9)
- [CVE-2023-28125](https://insights.sbomify.com/CVE-2023-28125/): Auth bypass in Avalanche (medium 5.9)
- [CVE-2023-28124](https://insights.sbomify.com/CVE-2023-28124/): Weak cryptography in UI Desktop for Windows (medium 5.5)
- [CVE-2023-28123](https://insights.sbomify.com/CVE-2023-28123/): Misconfiguration in UI Desktop for Windows (medium 5.5)
- [CVE-2023-28122](https://insights.sbomify.com/CVE-2023-28122/): Privilege escalation in UI Desktop for Windows (high 7.8)
- [CVE-2023-28121](https://insights.sbomify.com/CVE-2023-28121/): Auth bypass in WooCommerce Payments WordPress Plugin (critical 9.8)
- [CVE-2023-28120](https://insights.sbomify.com/CVE-2023-28120/): Possible XSS Security Vulnerability in SafeBuffer#bytesplice (medium 5.3)
- [CVE-2023-2812](https://insights.sbomify.com/CVE-2023-2812/): Ultimate Dashboard < 3.7.6 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-28119](https://insights.sbomify.com/CVE-2023-28119/): crewjam/saml vulnerable to Denial Of Service Via Deflate Decompression Bomb (high 7.5)
- [CVE-2023-28118](https://insights.sbomify.com/CVE-2023-28118/): kaml has potential denial of service while parsing input with anchors and aliases (high 7.5)
- [CVE-2023-28117](https://insights.sbomify.com/CVE-2023-28117/): Sentry SDK leaks sensitive session information when `sendDefaultPII` is set to `True` (high 7.6)
- [CVE-2023-28116](https://insights.sbomify.com/CVE-2023-28116/): Buffer overflow in L2CAP due to misconfigured MTU (high 8.1)
- [CVE-2023-28115](https://insights.sbomify.com/CVE-2023-28115/): Snappy vulnerable to PHAR deserialization, allowing remote code execution (critical 9.8)
- [CVE-2023-28114](https://insights.sbomify.com/CVE-2023-28114/): `cilium-cli` disables etcd authorization for clustermesh clusters (medium 4.8)
- [CVE-2023-28113](https://insights.sbomify.com/CVE-2023-28113/): russh may use insecure Diffie-Hellman keys (medium 5.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/343/