# Vulnerabilities published in 2023


- [CVE-2023-2650](https://insights.sbomify.com/CVE-2023-2650/): Possible DoS translating ASN.1 object identifiers (medium 6.5)
- [CVE-2023-26498](https://insights.sbomify.com/CVE-2023-26498/): Memory corruption in samsung:exynos 1080 firmware (high 8.6)
- [CVE-2023-26497](https://insights.sbomify.com/CVE-2023-26497/): Memory corruption in samsung:exynos 1080 firmware (high 8.6)
- [CVE-2023-26496](https://insights.sbomify.com/CVE-2023-26496/): Memory corruption in samsung:exynos 1080 firmware (high 8.6)
- [CVE-2023-26495](https://insights.sbomify.com/CVE-2023-26495/): Use after free in opendesign:drawings sdk (high 7.8)
- [CVE-2023-26494](https://insights.sbomify.com/CVE-2023-26494/): lorawan-stack has open redirect vulnerability (medium 6.1)
- [CVE-2023-26493](https://insights.sbomify.com/CVE-2023-26493/): Command Injection in Cocos Engine workflow (high 8.1)
- [CVE-2023-26492](https://insights.sbomify.com/CVE-2023-26492/): Directus vulnerable to Server-Side Request Forgery On File Import (medium 5.0)
- [CVE-2023-26491](https://insights.sbomify.com/CVE-2023-26491/): RSSHub is vulnerable to cross-site scripting (XSS) via unvalidated URL parameters (medium 5.4)
- [CVE-2023-26490](https://insights.sbomify.com/CVE-2023-26490/): mailcow is vulnerable to shell command injection via xoauth2 authentication in imapsync​ (high 7.3)
- [CVE-2023-2649](https://insights.sbomify.com/CVE-2023-2649/): Tenda AC23 Service Port 7329 ate command injection (high 7.2)
- [CVE-2023-26489](https://insights.sbomify.com/CVE-2023-26489/): Guest-controlled out-of-bounds read/write on x86_64 in wasmtime (critical 10.0)
- [CVE-2023-26488](https://insights.sbomify.com/CVE-2023-26488/): OpenZeppelin Contracts contains Incorrect Calculation (medium 6.5)
- [CVE-2023-26487](https://insights.sbomify.com/CVE-2023-26487/): Vega has cross-site scripting vulnerability in `lassoAppend` function (medium 6.5)
- [CVE-2023-26486](https://insights.sbomify.com/CVE-2023-26486/): Vega `scale` expression function cross site scripting (medium 6.5)
- [CVE-2023-26485](https://insights.sbomify.com/CVE-2023-26485/): Quadratic complexity may lead to a denial of service in cmark-gfm (medium 5.3)
- [CVE-2023-26484](https://insights.sbomify.com/CVE-2023-26484/): On a compromised KubeVirt node, the virt-handler service account can be used to modify all node specs (high 8.2)
- [CVE-2023-26483](https://insights.sbomify.com/CVE-2023-26483/): gosaml2 vulnerable to Denial of Service via deflate decompression bomb (medium 5.3)
- [CVE-2023-26482](https://insights.sbomify.com/CVE-2023-26482/): Scope of workflow operations is not validated in nextcloud server (critical 9.1)
- [CVE-2023-26481](https://insights.sbomify.com/CVE-2023-26481/): Insufficient user check in FlowTokens by Email stage (critical 9.1)
- [CVE-2023-26480](https://insights.sbomify.com/CVE-2023-26480/): XWiki-Platform vulnerable to stored Cross-site Scripting via the HTML displayer in Live Data (high 8.9)
- [CVE-2023-2648](https://insights.sbomify.com/CVE-2023-2648/): Weaver E-Office uploadify.php unrestricted upload (medium 6.3)
- [CVE-2023-26479](https://insights.sbomify.com/CVE-2023-26479/): org.xwiki.platform:xwiki-platform-rendering-parser vulnerable to Improper Handling of Exceptional Conditions (medium 6.5)
- [CVE-2023-26478](https://insights.sbomify.com/CVE-2023-26478/): org.xwiki.platform:xwiki-platform-store-filesystem-oldcore has Exposed Dangerous Method or Function (medium 6.6)
- [CVE-2023-26477](https://insights.sbomify.com/CVE-2023-26477/): org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability (critical 10.0)
- [CVE-2023-26476](https://insights.sbomify.com/CVE-2023-26476/): Two XWiki Platform UIs Expose Sensitive Information to an Unauthorized Actor (high 7.5)
- [CVE-2023-26475](https://insights.sbomify.com/CVE-2023-26475/): XWiki Platform vulnerable to Remote Code Execution in Annotations (critical 10.0)
- [CVE-2023-26474](https://insights.sbomify.com/CVE-2023-26474/): XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author (critical 10.0)
- [CVE-2023-26473](https://insights.sbomify.com/CVE-2023-26473/): XWiki Platform allows unprivileged users to make arbitrary select queries using DatabaseListProperty and suggest.vm (medium 6.5)
- [CVE-2023-26472](https://insights.sbomify.com/CVE-2023-26472/): XWiki Platform vulnerable to privilege escalation via async macro and IconThemeSheet from the user profile (critical 10.0)
- [CVE-2023-26471](https://insights.sbomify.com/CVE-2023-26471/): XWiki Platform users may execute anything with superadmin right through comments and async macro (critical 10.0)
- [CVE-2023-26470](https://insights.sbomify.com/CVE-2023-26470/): In XWiki Platform, saving a document with a large object number leads to persistent OOM errors (medium 5.7)
- [CVE-2023-2647](https://insights.sbomify.com/CVE-2023-2647/): Weaver E-Office File Upload utility_all.php command injection (medium 6.3)
- [CVE-2023-26469](https://insights.sbomify.com/CVE-2023-26469/): Path traversal in jorani:jorani (critical 9.8)
- [CVE-2023-26468](https://insights.sbomify.com/CVE-2023-26468/): Missing authorization in cerebrate-project:cerebrate (critical 9.1)
- [CVE-2023-26467](https://insights.sbomify.com/CVE-2023-26467/): Security feature bypass in RPA: Synchronization Engine (high 8.1)
- [CVE-2023-26466](https://insights.sbomify.com/CVE-2023-26466/): Missing authorization in RPA: Synchronization Engine (high 7.8)
- [CVE-2023-26465](https://insights.sbomify.com/CVE-2023-26465/): Cross-site scripting in Pega Infinity (high 8.0)
- [CVE-2023-26464](https://insights.sbomify.com/CVE-2023-26464/): Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender (high 7.5)
- [CVE-2023-26463](https://insights.sbomify.com/CVE-2023-26463/): Use after free in strongswan:strongswan (critical 9.8)
- [CVE-2023-26462](https://insights.sbomify.com/CVE-2023-26462/): Hardcoded credentials in thingsboard:thingsboard (high 8.1)
- [CVE-2023-26461](https://insights.sbomify.com/CVE-2023-26461/): XML External Entity (XXE) vulnerability in SAP NetWeaver (SAP Enterprise Portal) (medium 6.8)
- [CVE-2023-26460](https://insights.sbomify.com/CVE-2023-26460/): Improper Access Control in SAP NetWeaver AS Java (Cache Management Service) (medium 5.3)
- [CVE-2023-2646](https://insights.sbomify.com/CVE-2023-2646/): TP-Link Archer C7v2 GET Request Parameter denial of service (medium 4.5)
- [CVE-2023-26459](https://insights.sbomify.com/CVE-2023-26459/): Server Side Request Forgery (SSRF) vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform (high 7.4)
- [CVE-2023-26458](https://insights.sbomify.com/CVE-2023-26458/): Information Disclosure vulnerability in SAP Landscape Management (medium 6.8)
- [CVE-2023-26457](https://insights.sbomify.com/CVE-2023-26457/): Cross-Site Scripting (XSS) vulnerability in SAP Content Server (medium 6.1)
- [CVE-2023-26456](https://insights.sbomify.com/CVE-2023-26456/): Cross-site scripting in OX App Suite (medium 5.4)
- [CVE-2023-26455](https://insights.sbomify.com/CVE-2023-26455/): Missing authorization in OX App Suite (medium 5.6)
- [CVE-2023-26454](https://insights.sbomify.com/CVE-2023-26454/): SQL injection in OX App Suite (high 7.6)
- [CVE-2023-26453](https://insights.sbomify.com/CVE-2023-26453/): SQL injection in OX App Suite (high 7.6)
- [CVE-2023-26452](https://insights.sbomify.com/CVE-2023-26452/): SQL injection in OX App Suite (high 7.6)
- [CVE-2023-26451](https://insights.sbomify.com/CVE-2023-26451/): Weak cryptography in OX App Suite (high 7.5)
- [CVE-2023-26450](https://insights.sbomify.com/CVE-2023-26450/): Cross-site scripting in OX App Suite (medium 5.4)
- [CVE-2023-2645](https://insights.sbomify.com/CVE-2023-2645/): USR USR-G806 Web Management Page hard-coded password (critical 9.8)
- [CVE-2023-26449](https://insights.sbomify.com/CVE-2023-26449/): Cross-site scripting in OX App Suite (medium 5.4)
- [CVE-2023-26448](https://insights.sbomify.com/CVE-2023-26448/): Cross-site scripting in OX App Suite (medium 5.4)
- [CVE-2023-26447](https://insights.sbomify.com/CVE-2023-26447/): Cross-site scripting in OX App Suite (medium 5.4)
- [CVE-2023-26446](https://insights.sbomify.com/CVE-2023-26446/): Cross-site scripting in OX App Suite (medium 5.4)
- [CVE-2023-26445](https://insights.sbomify.com/CVE-2023-26445/): Cross-site scripting in OX App Suite (medium 5.4)
- [CVE-2023-26443](https://insights.sbomify.com/CVE-2023-26443/): SQL injection in OX App Suite (medium 5.5)
- [CVE-2023-26442](https://insights.sbomify.com/CVE-2023-26442/): Server-side request forgery in OX App Suite (low 3.2)
- [CVE-2023-26441](https://insights.sbomify.com/CVE-2023-26441/): Path traversal in OX App Suite (medium 5.7)
- [CVE-2023-26440](https://insights.sbomify.com/CVE-2023-26440/): SQL injection in OX App Suite (high 7.1)
- [CVE-2023-2644](https://insights.sbomify.com/CVE-2023-2644/): DigitalPersona FPSensor DpHost.exe unquoted search path (medium 5.3)
- [CVE-2023-26439](https://insights.sbomify.com/CVE-2023-26439/): SQL injection in OX App Suite (high 7.6)
- [CVE-2023-26438](https://insights.sbomify.com/CVE-2023-26438/): Server-side request forgery in OX App Suite (medium 4.3)
- [CVE-2023-26437](https://insights.sbomify.com/CVE-2023-26437/): Deterred spoofing attempts can lead to authoritative servers being marked unavailable (low 3.4)
- [CVE-2023-26436](https://insights.sbomify.com/CVE-2023-26436/): Deserialization in OX App Suite (high 7.1)
- [CVE-2023-26435](https://insights.sbomify.com/CVE-2023-26435/): Server-side request forgery in OX App Suite (medium 5.0)
- [CVE-2023-26434](https://insights.sbomify.com/CVE-2023-26434/): Denial of service in OX App Suite (medium 4.3)
- [CVE-2023-26433](https://insights.sbomify.com/CVE-2023-26433/): Denial of service in OX App Suite (medium 4.3)
- [CVE-2023-26432](https://insights.sbomify.com/CVE-2023-26432/): Denial of service in OX App Suite (medium 4.3)
- [CVE-2023-26431](https://insights.sbomify.com/CVE-2023-26431/): Server-side request forgery in OX App Suite (medium 5.0)
- [CVE-2023-26430](https://insights.sbomify.com/CVE-2023-26430/): Command injection in OX App Suite (low 3.5)
- [CVE-2023-2643](https://insights.sbomify.com/CVE-2023-2643/): SourceCodester File Tracker Manager System POST Parameter update_password.php sql injection (medium 6.3)
- [CVE-2023-26429](https://insights.sbomify.com/CVE-2023-26429/): Other in OX App Suite (low 3.5)
- [CVE-2023-26428](https://insights.sbomify.com/CVE-2023-26428/): Missing authorization in OX App Suite (medium 6.5)
- [CVE-2023-26427](https://insights.sbomify.com/CVE-2023-26427/): Misconfiguration in OX App Suite (low 3.2)
- [CVE-2023-26426](https://insights.sbomify.com/CVE-2023-26426/): Adobe Illustrator (Beta) has a UAF vulnerability when parsing SVG files Arbitrary code execution (high 7.8)
- [CVE-2023-26425](https://insights.sbomify.com/CVE-2023-26425/): ZDI-CAN-19854: Adobe Acrobat Reader DC Annotation Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-26424](https://insights.sbomify.com/CVE-2023-26424/): ZDI-CAN-19833: Adobe Acrobat Reader DC PDF Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-26423](https://insights.sbomify.com/CVE-2023-26423/): ZDI-CAN-20160: Adobe Acrobat Reader DC AcroForm insertItemAt Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-26422](https://insights.sbomify.com/CVE-2023-26422/): ZDI-CAN-20176: Adobe Acrobat Reader DC AcroForm deleteItemAt Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-26421](https://insights.sbomify.com/CVE-2023-26421/): ZDI-CAN-19832: Adobe Acrobat Reader DC Doc Object Integer Underflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-26420](https://insights.sbomify.com/CVE-2023-26420/): ZDI-CAN-20227: Adobe Acrobat Reader DC AcroForm addField Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-2642](https://insights.sbomify.com/CVE-2023-2642/): SourceCodester Online Exam System GET Parameter updateCourse.php sql injection (medium 6.3)
- [CVE-2023-26419](https://insights.sbomify.com/CVE-2023-26419/): ZDI-CAN-20274: Adobe Acrobat Reader DC AcroForm removeField Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-26418](https://insights.sbomify.com/CVE-2023-26418/): ZDI-CAN-20311: Adobe Acrobat Reader DC AcroForm exportAsFDFStr Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-26417](https://insights.sbomify.com/CVE-2023-26417/): ZDI-CAN-20583: Adobe Acrobat Reader DC Popup Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-26416](https://insights.sbomify.com/CVE-2023-26416/): Memory corruption in Substance3D - Designer (high 7.8)
- [CVE-2023-26415](https://insights.sbomify.com/CVE-2023-26415/): ZDI-CAN-20317: Adobe Substance 3D Designer DAE File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-26414](https://insights.sbomify.com/CVE-2023-26414/): ZDI-CAN-20316: Adobe Substance 3D Designer USD File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-26413](https://insights.sbomify.com/CVE-2023-26413/): Memory corruption in Substance3D - Designer (high 7.8)
- [CVE-2023-26412](https://insights.sbomify.com/CVE-2023-26412/): Memory corruption in Substance3D - Designer (high 7.8)
- [CVE-2023-26411](https://insights.sbomify.com/CVE-2023-26411/): ZDI-CAN-20312: Adobe Substance 3D Designer USDC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-26410](https://insights.sbomify.com/CVE-2023-26410/): ZDI-CAN-20309: Adobe Substance 3D Designer USD File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-2641](https://insights.sbomify.com/CVE-2023-2641/): SourceCodester Online Internship Management System POST Parameter login.php sql injection (high 7.3)
- [CVE-2023-26409](https://insights.sbomify.com/CVE-2023-26409/): ZDI-CAN-20313: Adobe Substance 3D Designer USD File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-26408](https://insights.sbomify.com/CVE-2023-26408/): ZDI-CAN-20712: AnnotsString Object prototype pollution Restrictions Bypass Vulnerability (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/356/