# Vulnerabilities published in 2023


- [CVE-2023-2733](https://insights.sbomify.com/CVE-2023-2733/): MStore API <= 3.9.0 - Authentication Bypass (critical 9.8)
- [CVE-2023-27329](https://insights.sbomify.com/CVE-2023-27329/): Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-27328](https://insights.sbomify.com/CVE-2023-27328/): Parallels Desktop Toolgate XML Injection Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2023-27327](https://insights.sbomify.com/CVE-2023-27327/): Parallels Desktop Toolgate Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability (high 7.5)
- [CVE-2023-27326](https://insights.sbomify.com/CVE-2023-27326/): Parallels Desktop Toolgate Directory Traversal Local Privilege Escalation Vulnerability (high 8.2)
- [CVE-2023-27325](https://insights.sbomify.com/CVE-2023-27325/): Parallels Desktop Updater Improper Initialization Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2023-27324](https://insights.sbomify.com/CVE-2023-27324/): Parallels Desktop Updater Improper Initialization Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2023-27323](https://insights.sbomify.com/CVE-2023-27323/): Parallels Desktop Updater Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2023-27322](https://insights.sbomify.com/CVE-2023-27322/): Parallels Desktop Service Improper Initialization Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2023-27321](https://insights.sbomify.com/CVE-2023-27321/): OPC Foundation UA .NET Standard ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability (high 7.5)
- [CVE-2023-27320](https://insights.sbomify.com/CVE-2023-27320/): Memory corruption in fedoraproject:fedora (high 7.2)
- [CVE-2023-2732](https://insights.sbomify.com/CVE-2023-2732/): MStore API <= 3.9.2 - Authentication Bypass (critical 9.8)
- [CVE-2023-27319](https://insights.sbomify.com/CVE-2023-27319/): CVE-2023-27319 Information Disclosure Vulnerability in ONTAP Mediator (medium 5.3)
- [CVE-2023-27318](https://insights.sbomify.com/CVE-2023-27318/): Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale) (medium 6.5)
- [CVE-2023-27317](https://insights.sbomify.com/CVE-2023-27317/): Information Disclosure Vulnerability in ONTAP 9 (medium 4.3)
- [CVE-2023-27316](https://insights.sbomify.com/CVE-2023-27316/): Privilege Escalation Vulnerability in SnapCenter (high 8.8)
- [CVE-2023-27315](https://insights.sbomify.com/CVE-2023-27315/): Information Disclosure Vulnerability in SnapGathers (medium 6.5)
- [CVE-2023-27314](https://insights.sbomify.com/CVE-2023-27314/): Denial of Service Vulnerability in ONTAP 9 (high 7.5)
- [CVE-2023-27313](https://insights.sbomify.com/CVE-2023-27313/): Privilege Escalation Vulnerability in SnapCenter (high 8.3)
- [CVE-2023-27312](https://insights.sbomify.com/CVE-2023-27312/): Privilege Escalation Vulnerability in SnapCenter Plugin for VMware vSphere (medium 5.4)
- [CVE-2023-27311](https://insights.sbomify.com/CVE-2023-27311/): Information disclosure in Information Disclosure Vulnerability in NetApp BlueXP Connector (medium 5.3)
- [CVE-2023-27310](https://insights.sbomify.com/CVE-2023-27310/): Missing authorization in RUGGEDCOM CROSSBOW (medium 6.6)
- [CVE-2023-2731](https://insights.sbomify.com/CVE-2023-2731/): Null dereference in libtiff (medium 5.5)
- [CVE-2023-27309](https://insights.sbomify.com/CVE-2023-27309/): Missing authorization in RUGGEDCOM CROSSBOW (medium 5.0)
- [CVE-2023-27308](https://insights.sbomify.com/CVE-2023-27308/): Memory corruption in Intel(R) Thunderbolt(TM) DCH drivers for Windows (medium 4.6)
- [CVE-2023-27307](https://insights.sbomify.com/CVE-2023-27307/): Memory corruption in Intel(R) Thunderbolt(TM) DCH drivers for Windows (low 3.8)
- [CVE-2023-27306](https://insights.sbomify.com/CVE-2023-27306/): Denial of service in Intel(R) Optane(TM) SSD products (medium 6.5)
- [CVE-2023-27305](https://insights.sbomify.com/CVE-2023-27305/): Misconfiguration in Intel(R) Arc(TM) Control software (medium 6.7)
- [CVE-2023-27304](https://insights.sbomify.com/CVE-2023-27304/): Missing authorization in Cybozu Garoon (medium 4.3)
- [CVE-2023-27303](https://insights.sbomify.com/CVE-2023-27303/): Missing authorization in Intel(R) Thunderbolt(TM) DCH drivers for Windows (low 3.8)
- [CVE-2023-27301](https://insights.sbomify.com/CVE-2023-27301/): Privilege escalation in Intel(R) Thunderbolt(TM) DCH drivers for Windows (medium 4.2)
- [CVE-2023-27300](https://insights.sbomify.com/CVE-2023-27300/): Memory corruption in Intel(R) Thunderbolt(TM) DCH drivers for Windows (low 3.8)
- [CVE-2023-2730](https://insights.sbomify.com/CVE-2023-2730/): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (medium 6.3)
- [CVE-2023-27298](https://insights.sbomify.com/CVE-2023-27298/): Privilege escalation in WULT software maintained by Intel(R) (high 8.8)
- [CVE-2023-27296](https://insights.sbomify.com/CVE-2023-27296/): Apache InLong: JDBC Deserialization Vulnerability in InLong (high 8.8)
- [CVE-2023-27295](https://insights.sbomify.com/CVE-2023-27295/): Cross-site request forgery in OpenCATS (medium 5.4)
- [CVE-2023-27294](https://insights.sbomify.com/CVE-2023-27294/): Cross-site scripting in OpenCATS (medium 5.4)
- [CVE-2023-27293](https://insights.sbomify.com/CVE-2023-27293/): Cross-site scripting in OpenCATS (medium 6.1)
- [CVE-2023-27292](https://insights.sbomify.com/CVE-2023-27292/): Open redirect in OpenCATS (medium 5.4)
- [CVE-2023-27291](https://insights.sbomify.com/CVE-2023-27291/): IBM Watson CP4D Data Stores information disclosure (medium 4.5)
- [CVE-2023-27290](https://insights.sbomify.com/CVE-2023-27290/): IBM Observability with Instana missing authentication (critical 9.1)
- [CVE-2023-2729](https://insights.sbomify.com/CVE-2023-2729/): Weak cryptography in DiskStation Manager (DSM) (medium 5.9)
- [CVE-2023-27286](https://insights.sbomify.com/CVE-2023-27286/): IBM Aspera code execution (high 8.4)
- [CVE-2023-27285](https://insights.sbomify.com/CVE-2023-27285/): IBM Aspera buffer overflow (high 8.4)
- [CVE-2023-27284](https://insights.sbomify.com/CVE-2023-27284/): IBM Aspera code execution (high 8.4)
- [CVE-2023-27283](https://insights.sbomify.com/CVE-2023-27283/): IBM Aspera Orchestrator information disclosure (medium 5.3)
- [CVE-2023-2728](https://insights.sbomify.com/CVE-2023-2728/): Bypassing enforce mountable secrets policy imposed by the ServiceAccount admission plugin (medium 6.5)
- [CVE-2023-27279](https://insights.sbomify.com/CVE-2023-27279/): IBM Aspera Faspex denial of service (medium 6.5)
- [CVE-2023-27272](https://insights.sbomify.com/CVE-2023-27272/): IBM Aspera Console weak password requirements (low 3.1)
- [CVE-2023-27271](https://insights.sbomify.com/CVE-2023-27271/): Server Side Request Forgery (SSRF) in the SAP BusinessObjects Business Intelligence platform (medium 6.5)
- [CVE-2023-27270](https://insights.sbomify.com/CVE-2023-27270/): Denial of Service (DoS) in SAP NetWeaver AS for ABAP and ABAP Platform (medium 6.5)
- [CVE-2023-2727](https://insights.sbomify.com/CVE-2023-2727/): Bypassing policies imposed by the ImagePolicyWebhook admission plugin (medium 6.5)
- [CVE-2023-27269](https://insights.sbomify.com/CVE-2023-27269/): Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform (critical 9.6)
- [CVE-2023-27268](https://insights.sbomify.com/CVE-2023-27268/): Improper Access Control in SAP NetWeaver AS Java (Object Analyzing Service) (medium 5.3)
- [CVE-2023-27267](https://insights.sbomify.com/CVE-2023-27267/): Multiple vulnerabilities in SAP Diagnostics Agent (OSCommand Bridge) (critical 9.0)
- [CVE-2023-27266](https://insights.sbomify.com/CVE-2023-27266/): Disclosure of team owner email address when when accessing the teams API (low 2.7)
- [CVE-2023-27265](https://insights.sbomify.com/CVE-2023-27265/): Disclosure of team owner email address when regenerating Invite ID (low 2.7)
- [CVE-2023-27264](https://insights.sbomify.com/CVE-2023-27264/): IDOR: Updating a playbook via the Playbooks API (high 7.1)
- [CVE-2023-27263](https://insights.sbomify.com/CVE-2023-27263/): IDOR: Accessing playbook runs via the Playbooks Runs API (medium 4.3)
- [CVE-2023-27262](https://insights.sbomify.com/CVE-2023-27262/): Unauthenticated SQL Injection In IDAttend’s IDWeb Application (critical 9.8)
- [CVE-2023-27261](https://insights.sbomify.com/CVE-2023-27261/): Missing Authentication In IDAttend’s IDWeb Application (medium 5.3)
- [CVE-2023-27260](https://insights.sbomify.com/CVE-2023-27260/): Unauthenticated SQL Injection In IDAttend’s IDWeb Application (critical 9.8)
- [CVE-2023-2726](https://insights.sbomify.com/CVE-2023-2726/): Security feature bypass in Chrome (high 8.8)
- [CVE-2023-27259](https://insights.sbomify.com/CVE-2023-27259/): Missing Authentication In IDAttend’s IDWeb Application (high 7.5)
- [CVE-2023-27258](https://insights.sbomify.com/CVE-2023-27258/): Missing Authentication In IDAttend’s IDWeb Application (high 7.5)
- [CVE-2023-27257](https://insights.sbomify.com/CVE-2023-27257/): Missing Authentication In IDAttend’s IDWeb Application (high 7.5)
- [CVE-2023-27256](https://insights.sbomify.com/CVE-2023-27256/): Missing Authentication In IDAttend’s IDWeb Application (medium 5.8)
- [CVE-2023-27255](https://insights.sbomify.com/CVE-2023-27255/): Unauthenticated SQL Injection In IDAttend’s IDWeb Application (critical 9.8)
- [CVE-2023-27254](https://insights.sbomify.com/CVE-2023-27254/): Unauthenticated SQL Injection In IDAttend’s IDWeb Application (critical 9.8)
- [CVE-2023-27253](https://insights.sbomify.com/CVE-2023-27253/): Command injection in netgate:pfsense (high 8.8)
- [CVE-2023-27250](https://insights.sbomify.com/CVE-2023-27250/): SQL injection in online book store project project:online book store project (critical 9.8)
- [CVE-2023-2725](https://insights.sbomify.com/CVE-2023-2725/): Use after free in Chrome (high 8.8)
- [CVE-2023-27249](https://insights.sbomify.com/CVE-2023-27249/): Memory corruption in swftools:swftools (medium 5.5)
- [CVE-2023-27247](https://insights.sbomify.com/CVE-2023-27247/): Security feature bypass in cynet:client agent (medium 4.4)
- [CVE-2023-27246](https://insights.sbomify.com/CVE-2023-27246/): File upload in mk-auth:mk-auth (high 8.8)
- [CVE-2023-27245](https://insights.sbomify.com/CVE-2023-27245/): Cross-site scripting in file management system project:file management system (medium 6.1)
- [CVE-2023-27243](https://insights.sbomify.com/CVE-2023-27243/): Information disclosure in makves:dcap (high 7.5)
- [CVE-2023-27242](https://insights.sbomify.com/CVE-2023-27242/): Cross-site scripting in razormist:loan management system (medium 5.4)
- [CVE-2023-27241](https://insights.sbomify.com/CVE-2023-27241/): Cross-site scripting in water billing system project:water billing system (medium 6.1)
- [CVE-2023-27240](https://insights.sbomify.com/CVE-2023-27240/): Command injection in tenda:ax3 firmware (critical 9.8)
- [CVE-2023-2724](https://insights.sbomify.com/CVE-2023-2724/): Memory corruption in Chrome (high 8.8)
- [CVE-2023-27239](https://insights.sbomify.com/CVE-2023-27239/): Memory corruption in tenda:ax3 firmware (critical 9.8)
- [CVE-2023-27238](https://insights.sbomify.com/CVE-2023-27238/): LavaLite vulnerable to web cache poisoning (critical 9.8)
- [CVE-2023-27237](https://insights.sbomify.com/CVE-2023-27237/): LavaLite CMS vulnerable to host header injection attack (medium 6.1)
- [CVE-2023-27235](https://insights.sbomify.com/CVE-2023-27235/): File upload in jizhicms:jizhicms (high 7.2)
- [CVE-2023-27234](https://insights.sbomify.com/CVE-2023-27234/): Cross-site request forgery in jizhicms:jizhicms (medium 6.5)
- [CVE-2023-27233](https://insights.sbomify.com/CVE-2023-27233/): SQL injection in piwigo:piwigo (high 8.8)
- [CVE-2023-27232](https://insights.sbomify.com/CVE-2023-27232/): Command injection in totolink:a7100ru firmware (critical 9.8)
- [CVE-2023-27231](https://insights.sbomify.com/CVE-2023-27231/): Command injection in totolink:a7100ru firmware (critical 9.8)
- [CVE-2023-2723](https://insights.sbomify.com/CVE-2023-2723/): Use after free in Chrome (high 8.8)
- [CVE-2023-27229](https://insights.sbomify.com/CVE-2023-27229/): Command injection in totolink:a7100ru firmware (critical 9.8)
- [CVE-2023-27225](https://insights.sbomify.com/CVE-2023-27225/): Cross-site scripting in user registration \& login and user management system with admin panel project:user registration \& login and user management system with admin panel (medium 5.4)
- [CVE-2023-27224](https://insights.sbomify.com/CVE-2023-27224/): Code injection in jc21:nginx proxy manager (critical 9.8)
- [CVE-2023-2722](https://insights.sbomify.com/CVE-2023-2722/): Use after free in Chrome (high 8.8)
- [CVE-2023-27217](https://insights.sbomify.com/CVE-2023-27217/): Memory corruption in belkin:f7c063 firmware (critical 9.8)
- [CVE-2023-27216](https://insights.sbomify.com/CVE-2023-27216/): Command injection in dlink:dsl-3782 firmware (high 8.8)
- [CVE-2023-27214](https://insights.sbomify.com/CVE-2023-27214/): SQL injection in online student management system project:online student management system (critical 9.8)
- [CVE-2023-27213](https://insights.sbomify.com/CVE-2023-27213/): SQL injection in online student management system project:online student management system (critical 9.8)
- [CVE-2023-27212](https://insights.sbomify.com/CVE-2023-27212/): Cross-site scripting in online pizza ordering system project:online pizza ordering system (medium 6.1)
- [CVE-2023-27211](https://insights.sbomify.com/CVE-2023-27211/): Cross-site scripting in online pizza ordering system project:online pizza ordering system (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/351/