# Vulnerabilities published in 2023


- [CVE-2023-26407](https://insights.sbomify.com/CVE-2023-26407/): ZDI-CAN-20712: Net.HTTP.request Arbitrary Command Execution (high 7.8)
- [CVE-2023-26406](https://insights.sbomify.com/CVE-2023-26406/): ZDI-CAN-20712: Net.HTTP.request URL restriction bypass (high 7.8)
- [CVE-2023-26405](https://insights.sbomify.com/CVE-2023-26405/): ZDI-CAN-20712: Object Prototype pollution which leads to API Restrictions Bypass (high 7.8)
- [CVE-2023-26404](https://insights.sbomify.com/CVE-2023-26404/): ZDI-CAN-20143: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-26403](https://insights.sbomify.com/CVE-2023-26403/): ZDI-CAN-20259: Adobe Substance 3D Stager USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-26402](https://insights.sbomify.com/CVE-2023-26402/): ZDI-CAN-20237: Adobe Substance 3D Stager USD File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-26401](https://insights.sbomify.com/CVE-2023-26401/): ZDI-CAN-20278: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-26400](https://insights.sbomify.com/CVE-2023-26400/): ZDI-CAN-20232: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-2640](https://insights.sbomify.com/CVE-2023-2640/): Privilege escalation in Ubuntu Kernel (high 7.8)
- [CVE-2023-26398](https://insights.sbomify.com/CVE-2023-26398/): ZDI-CAN-20310: Adobe Substance 3D Designer USDC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-26397](https://insights.sbomify.com/CVE-2023-26397/): [ZS-VR-22-112] Adobe Acrobat Out-of-bounds Read Memory leak (medium 5.5)
- [CVE-2023-26396](https://insights.sbomify.com/CVE-2023-26396/): Privilege escalation in Acrobat Reader (high 7.8)
- [CVE-2023-26395](https://insights.sbomify.com/CVE-2023-26395/): Adobe Acrobat parsing PDF Out-of-bounds Write Arbitrary code execution (high 7.8)
- [CVE-2023-26394](https://insights.sbomify.com/CVE-2023-26394/): Memory corruption in Substance3D - Stager (high 7.8)
- [CVE-2023-26393](https://insights.sbomify.com/CVE-2023-26393/): ZDI-CAN-20234: Adobe Substance 3D Stager USD File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-26392](https://insights.sbomify.com/CVE-2023-26392/): ZDI-CAN-20235: Adobe Substance 3D Stager USD File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-26391](https://insights.sbomify.com/CVE-2023-26391/): ZDI-CAN-20256: Adobe Substance 3D Stager USD File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-26390](https://insights.sbomify.com/CVE-2023-26390/): Memory corruption in Substance3D - Stager (high 7.8)
- [CVE-2023-2639](https://insights.sbomify.com/CVE-2023-2639/): Rockwell Automation FactoryTalk System Services Vulnerable to Sensitive Information Disclosure (medium 4.1)
- [CVE-2023-26389](https://insights.sbomify.com/CVE-2023-26389/): ZDI-CAN-20258: Adobe Substance 3D Stager USDC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-26388](https://insights.sbomify.com/CVE-2023-26388/): ZDI-CAN-20286: Adobe Substance 3D Stager USDZ File Parsing Memory Corruption Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-26387](https://insights.sbomify.com/CVE-2023-26387/): ZDI-CAN-20265: Adobe Substance 3D Stager USDC File Parsing Uninitialized Variable Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-26386](https://insights.sbomify.com/CVE-2023-26386/): ZDI-CAN-20266: Adobe Substance 3D Stager USDC File Parsing Uninitialized Variable Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-26385](https://insights.sbomify.com/CVE-2023-26385/): ZDI-CAN-20267: Adobe Substance 3D Stager USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-26384](https://insights.sbomify.com/CVE-2023-26384/): ZDI-CAN-20279: Adobe Substance 3D Stager USD File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-26383](https://insights.sbomify.com/CVE-2023-26383/): Memory corruption in Substance3D - Stager (high 7.8)
- [CVE-2023-26382](https://insights.sbomify.com/CVE-2023-26382/): ZDI-CAN-20156: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-26381](https://insights.sbomify.com/CVE-2023-26381/): ZDI-CAN-20147: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-26380](https://insights.sbomify.com/CVE-2023-26380/): ZDI-CAN-20150: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-2638](https://insights.sbomify.com/CVE-2023-2638/): Rockwell Automation FactoryTalk System Services Vulnerable to a Denial-of-Service Attack (medium 5.9)
- [CVE-2023-26379](https://insights.sbomify.com/CVE-2023-26379/): ZDI-CAN-20233: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-26378](https://insights.sbomify.com/CVE-2023-26378/): ZDI-CAN-20148: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-26377](https://insights.sbomify.com/CVE-2023-26377/): ZDI-CAN-20151: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-26376](https://insights.sbomify.com/CVE-2023-26376/): ZDI-CAN-20155: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-26375](https://insights.sbomify.com/CVE-2023-26375/): ZDI-CAN-20231: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-26374](https://insights.sbomify.com/CVE-2023-26374/): ZDI-CAN-20045: Adobe Dimension USD File Parsing Out-Of-Bounds Read Memory leak Vulnerability (medium 5.5)
- [CVE-2023-26373](https://insights.sbomify.com/CVE-2023-26373/): Adobe Dimension has an arbitrary address write vulnerability when parsing USDZ files (high 7.8)
- [CVE-2023-26372](https://insights.sbomify.com/CVE-2023-26372/): ZDI-CAN-20284: Adobe Dimension USDZ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-26371](https://insights.sbomify.com/CVE-2023-26371/): Validate Your Inputs | Out-of-bounds Read (CWE-125) (high 7.8)
- [CVE-2023-26370](https://insights.sbomify.com/CVE-2023-26370/): ZDI-CAN-21257: Adobe Photoshop PSD File Parsing Uninitialized Variable Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-2637](https://insights.sbomify.com/CVE-2023-2637/): Rockwell Automation FactoryTalk System Services Vulnerable To Use Of Hard-Coded Cryptographic Key (high 7.3)
- [CVE-2023-26369](https://insights.sbomify.com/CVE-2023-26369/): Adobe Acrobat and Reader Out-of-Bounds Write (high 7.8, exploited in the wild)
- [CVE-2023-26368](https://insights.sbomify.com/CVE-2023-26368/): Adobe InCopy Out-of-Bounds Read Vulnerability v1.0 (high 7.8)
- [CVE-2023-26367](https://insights.sbomify.com/CVE-2023-26367/): Error based file extraction via PHP filter chains during product bulk import logic (medium 4.9)
- [CVE-2023-26366](https://insights.sbomify.com/CVE-2023-26366/): Validate Your Inputs | Server-Side Request Forgery (SSRF) (CWE-918) (medium 6.8)
- [CVE-2023-26364](https://insights.sbomify.com/CVE-2023-26364/): Denial of Service of regular expression in package @adobe/css-tools (medium 5.3)
- [CVE-2023-26361](https://insights.sbomify.com/CVE-2023-26361/): Adobe ColdFusion Directory Traversal Arbitrary file system read Vulnerability (medium 4.9)
- [CVE-2023-26360](https://insights.sbomify.com/CVE-2023-26360/): Adobe ColdFusion Deserialization of Untrusted Data (high 8.6, exploited in the wild)
- [CVE-2023-2636](https://insights.sbomify.com/CVE-2023-2636/): AN_GradeBook <= 5.0.1 - Subscriber+ SQLi (high 8.8)
- [CVE-2023-26359](https://insights.sbomify.com/CVE-2023-26359/): Adobe ColdFusion Deserialization of Untrusted Data (critical 9.8, exploited in the wild)
- [CVE-2023-26358](https://insights.sbomify.com/CVE-2023-26358/): Adobe Creative Cloud AdobeExtensionService.exe local privilege escalation vulnerability (high 8.6)
- [CVE-2023-26356](https://insights.sbomify.com/CVE-2023-26356/): ZDI-CAN-19506: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-26355](https://insights.sbomify.com/CVE-2023-26355/): ZDI-CAN-19512: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-26354](https://insights.sbomify.com/CVE-2023-26354/): ZDI-CAN-19519: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-26353](https://insights.sbomify.com/CVE-2023-26353/): ZDI-CAN-19511: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-26352](https://insights.sbomify.com/CVE-2023-26352/): ZDI-CAN-19509: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-26351](https://insights.sbomify.com/CVE-2023-26351/): ZDI-CAN-19507: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-26350](https://insights.sbomify.com/CVE-2023-26350/): ZDI-CAN-19510: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-2635](https://insights.sbomify.com/CVE-2023-2635/): Call Now Accessibility Button < 1.1 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-26349](https://insights.sbomify.com/CVE-2023-26349/): ZDI-CAN-20218: Adobe Dimension USDZ File Parsing Use-After-Free Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-26348](https://insights.sbomify.com/CVE-2023-26348/): ZDI-CAN-19518: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-26347](https://insights.sbomify.com/CVE-2023-26347/): CVE-2023-38205 issues | ColdFusion Admin Panel Access (high 7.5)
- [CVE-2023-26346](https://insights.sbomify.com/CVE-2023-26346/): ZDI-CAN-19495: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-26345](https://insights.sbomify.com/CVE-2023-26345/): ZDI-CAN-19494: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-26344](https://insights.sbomify.com/CVE-2023-26344/): ZDI-CAN-19467: Adobe Dimension USD File Access of Uninitialized Pointer Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-26343](https://insights.sbomify.com/CVE-2023-26343/): ZDI-CAN-19465: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-26342](https://insights.sbomify.com/CVE-2023-26342/): ZDI-CAN-19413: Adobe Dimension GLB File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-26341](https://insights.sbomify.com/CVE-2023-26341/): ZDI-CAN-19391: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-26340](https://insights.sbomify.com/CVE-2023-26340/): ZDI-CAN-19387: Adobe Dimension OBJ File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-2634](https://insights.sbomify.com/CVE-2023-2634/): Get Your Number <= 1.1.3 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-26339](https://insights.sbomify.com/CVE-2023-26339/): ZDI-CAN-19388: Adobe Dimension OBJ File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-26338](https://insights.sbomify.com/CVE-2023-26338/): ZDI-CAN-19410: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-26337](https://insights.sbomify.com/CVE-2023-26337/): ZDI-CAN-20285: Adobe Dimension USDA File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-26336](https://insights.sbomify.com/CVE-2023-26336/): ZDI-CAN-20275: Adobe Dimension USD File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-26335](https://insights.sbomify.com/CVE-2023-26335/): ZDI-CAN-20215: Adobe Dimension USDC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-26334](https://insights.sbomify.com/CVE-2023-26334/): ZDI-CAN-20149: Adobe Dimension USD File Parsing Uninitialized Pointer Information Disclosure Vulnerability (high 7.8)
- [CVE-2023-26333](https://insights.sbomify.com/CVE-2023-26333/): ZDI-CAN-20214: Adobe Dimension USDC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-26332](https://insights.sbomify.com/CVE-2023-26332/): ZDI-CAN-20144: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (high 7.8)
- [CVE-2023-26331](https://insights.sbomify.com/CVE-2023-26331/): ZDI-CAN-20145: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (high 7.8)
- [CVE-2023-26330](https://insights.sbomify.com/CVE-2023-26330/): ZDI-CAN-20146: Adobe Dimension USD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-2633](https://insights.sbomify.com/CVE-2023-2633/): API keys stored and displayed in plain text by Code Dx Plugin (medium 4.3)
- [CVE-2023-26329](https://insights.sbomify.com/CVE-2023-26329/): ZDI-CAN-20213: Adobe Dimension OBJ File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (high 7.8)
- [CVE-2023-26328](https://insights.sbomify.com/CVE-2023-26328/): ZDI-CAN-20212: Adobe Dimension USD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-26327](https://insights.sbomify.com/CVE-2023-26327/): ZDI-CAN-20217: Adobe Dimension GLTF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (high 7.8)
- [CVE-2023-26326](https://insights.sbomify.com/CVE-2023-26326/): Deserialization in BuddyForms WordPress Plugin (critical 9.8)
- [CVE-2023-26325](https://insights.sbomify.com/CVE-2023-26325/): SQL injection in ReviewX WordPress Plugin (high 8.8)
- [CVE-2023-26324](https://insights.sbomify.com/CVE-2023-26324/): GetApps application has code execution vulnerability (high 8.8)
- [CVE-2023-26323](https://insights.sbomify.com/CVE-2023-26323/): Xiaomi App Market has a code execution vulnerability (high 7.6)
- [CVE-2023-26322](https://insights.sbomify.com/CVE-2023-26322/): GetApps application has code execution vulnerability (high 8.8)
- [CVE-2023-26321](https://insights.sbomify.com/CVE-2023-26321/): The international version of Xiaomi File Manager has a path traversal vulnerability (medium 6.3)
- [CVE-2023-26320](https://insights.sbomify.com/CVE-2023-26320/): Xiaomi Router external request interface vulnerability leads to stack overflow (high 7.5)
- [CVE-2023-2632](https://insights.sbomify.com/CVE-2023-2632/): API keys stored and displayed in plain text by Code Dx Plugin (medium 4.3)
- [CVE-2023-26319](https://insights.sbomify.com/CVE-2023-26319/): Xiaomi Router administration interface vulnerability leads command injection and stack overflow (medium 6.7)
- [CVE-2023-26318](https://insights.sbomify.com/CVE-2023-26318/): Xiaomi router web interface post-authorization stack overflow (medium 6.7)
- [CVE-2023-26317](https://insights.sbomify.com/CVE-2023-26317/): Xiaomi router external request interface has command injection (high 7.0)
- [CVE-2023-26316](https://insights.sbomify.com/CVE-2023-26316/): Cross-site scripting in Xiaomi cloud service Application (medium 6.1)
- [CVE-2023-26315](https://insights.sbomify.com/CVE-2023-26315/): Xiaomi router has a command injection vulnerability after authorization (medium 6.5)
- [CVE-2023-26314](https://insights.sbomify.com/CVE-2023-26314/): Security feature bypass in debian:debian linux (high 8.8)
- [CVE-2023-26311](https://insights.sbomify.com/CVE-2023-26311/): A remote code execution vulnerability in the webview component of OPPO Store app. (high 7.4)
- [CVE-2023-26310](https://insights.sbomify.com/CVE-2023-26310/): Command Injection In OPPO Service (high 7.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/357/