# Vulnerabilities published in 2023


- [CVE-2023-24898](https://insights.sbomify.com/CVE-2023-24898/): Windows SMB Denial of Service Vulnerability (high 7.5)
- [CVE-2023-24897](https://insights.sbomify.com/CVE-2023-24897/): .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-24896](https://insights.sbomify.com/CVE-2023-24896/): Dynamics 365 Finance Spoofing Vulnerability (medium 5.4)
- [CVE-2023-24895](https://insights.sbomify.com/CVE-2023-24895/): .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-24893](https://insights.sbomify.com/CVE-2023-24893/): Visual Studio Code Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-24892](https://insights.sbomify.com/CVE-2023-24892/): Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability (high 8.2)
- [CVE-2023-24891](https://insights.sbomify.com/CVE-2023-24891/): Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability (medium 5.4)
- [CVE-2023-24890](https://insights.sbomify.com/CVE-2023-24890/): Microsoft OneDrive for iOS Security Feature Bypass Vulnerability (medium 6.5)
- [CVE-2023-2489](https://insights.sbomify.com/CVE-2023-2489/): Stop Spammers Security < 2023 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-24887](https://insights.sbomify.com/CVE-2023-24887/): Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-24886](https://insights.sbomify.com/CVE-2023-24886/): Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-24885](https://insights.sbomify.com/CVE-2023-24885/): Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-24884](https://insights.sbomify.com/CVE-2023-24884/): Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-24883](https://insights.sbomify.com/CVE-2023-24883/): Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability (medium 6.5)
- [CVE-2023-24882](https://insights.sbomify.com/CVE-2023-24882/): Microsoft OneDrive for Android Information Disclosure Vulnerability (medium 5.5)
- [CVE-2023-24881](https://insights.sbomify.com/CVE-2023-24881/): Microsoft Teams Information Disclosure Vulnerability (medium 6.5)
- [CVE-2023-24880](https://insights.sbomify.com/CVE-2023-24880/): Microsoft Windows SmartScreen Security Feature Bypass (medium 4.4, exploited in the wild)
- [CVE-2023-2488](https://insights.sbomify.com/CVE-2023-2488/): Stop Spammers Security < 2023 - Reflected XSS (medium 6.1)
- [CVE-2023-24879](https://insights.sbomify.com/CVE-2023-24879/): Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability (medium 5.4)
- [CVE-2023-24876](https://insights.sbomify.com/CVE-2023-24876/): Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-24872](https://insights.sbomify.com/CVE-2023-24872/): Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-24871](https://insights.sbomify.com/CVE-2023-24871/): Windows Bluetooth Service Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-24870](https://insights.sbomify.com/CVE-2023-24870/): Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability (medium 6.5)
- [CVE-2023-2487](https://insights.sbomify.com/CVE-2023-2487/): WordPress WP Ultimate Exporter Plugin <= 2.4.1 is vulnerable to Sensitive Data Exposure (medium 5.9)
- [CVE-2023-24869](https://insights.sbomify.com/CVE-2023-24869/): Remote Procedure Call Runtime Remote Code Execution Vulnerability (high 8.1)
- [CVE-2023-24868](https://insights.sbomify.com/CVE-2023-24868/): Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-24867](https://insights.sbomify.com/CVE-2023-24867/): Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability (high 8.8)
- [CVE-2023-24866](https://insights.sbomify.com/CVE-2023-24866/): Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability (medium 6.5)
- [CVE-2023-24865](https://insights.sbomify.com/CVE-2023-24865/): Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability (medium 6.5)
- [CVE-2023-24864](https://insights.sbomify.com/CVE-2023-24864/): Microsoft PostScript and PCL6 Class Printer Driver Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2023-24863](https://insights.sbomify.com/CVE-2023-24863/): Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability (medium 6.5)
- [CVE-2023-24862](https://insights.sbomify.com/CVE-2023-24862/): Windows Secure Channel Denial of Service Vulnerability (medium 5.5)
- [CVE-2023-24861](https://insights.sbomify.com/CVE-2023-24861/): Windows Graphics Component Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2023-24860](https://insights.sbomify.com/CVE-2023-24860/): Microsoft Defender Denial of Service Vulnerability (high 7.5)
- [CVE-2023-24859](https://insights.sbomify.com/CVE-2023-24859/): Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability (high 7.5)
- [CVE-2023-24858](https://insights.sbomify.com/CVE-2023-24858/): Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability (high 7.5)
- [CVE-2023-24857](https://insights.sbomify.com/CVE-2023-24857/): Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability (medium 6.5)
- [CVE-2023-24856](https://insights.sbomify.com/CVE-2023-24856/): Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability (high 7.5)
- [CVE-2023-24855](https://insights.sbomify.com/CVE-2023-24855/): Use of Out-of-range Pointer Offset in Modem (critical 9.8)
- [CVE-2023-24854](https://insights.sbomify.com/CVE-2023-24854/): Stack-based Buffer Overflow in WLAN HOST (high 7.8)
- [CVE-2023-24853](https://insights.sbomify.com/CVE-2023-24853/): Improper Input Validation in HLOS (high 8.4)
- [CVE-2023-24852](https://insights.sbomify.com/CVE-2023-24852/): Improper Authentication in Core (high 8.4)
- [CVE-2023-24851](https://insights.sbomify.com/CVE-2023-24851/): Buffer Copy Without Checking Size of Input in WLAN HOST (high 7.8)
- [CVE-2023-24850](https://insights.sbomify.com/CVE-2023-24850/): Improper Validation of Array Index in HLOS (high 7.8)
- [CVE-2023-2485](https://insights.sbomify.com/CVE-2023-2485/): Incorrect Privilege Assignment in GitLab (medium 4.4)
- [CVE-2023-24849](https://insights.sbomify.com/CVE-2023-24849/): Buffer Over-read in Data Modem (high 8.2)
- [CVE-2023-24848](https://insights.sbomify.com/CVE-2023-24848/): Buffer Over-read in Data Modem (high 8.2)
- [CVE-2023-24847](https://insights.sbomify.com/CVE-2023-24847/): NULL pointer Dereference in Modem (high 7.5)
- [CVE-2023-24845](https://insights.sbomify.com/CVE-2023-24845/): Other in RUGGEDCOM M2100 (critical 9.1)
- [CVE-2023-24844](https://insights.sbomify.com/CVE-2023-24844/): Improper Access Control in Core (high 8.4)
- [CVE-2023-24843](https://insights.sbomify.com/CVE-2023-24843/): Reachable Assertion in Modem (high 7.5)
- [CVE-2023-24842](https://insights.sbomify.com/CVE-2023-24842/): HGiga MailSherlock - Broken Access Control (medium 5.3)
- [CVE-2023-24841](https://insights.sbomify.com/CVE-2023-24841/): HGiga MailSherlock - Command Injection (high 7.2)
- [CVE-2023-24840](https://insights.sbomify.com/CVE-2023-24840/): HGiga MailSherlock - SQL Injection (high 7.2)
- [CVE-2023-2484](https://insights.sbomify.com/CVE-2023-2484/): Active Directory Integration / LDAP Integration <= 4.1.4 - Authenticated (Administrator+) SQL Injection (high 7.2)
- [CVE-2023-24839](https://insights.sbomify.com/CVE-2023-24839/): HGiga MailSherlock - Reflected XSS (medium 6.1)
- [CVE-2023-24838](https://insights.sbomify.com/CVE-2023-24838/): HGiga PowerStation - Information Leakage (critical 9.8)
- [CVE-2023-24837](https://insights.sbomify.com/CVE-2023-24837/): HGiga PowerStation - Command Injection (high 8.8)
- [CVE-2023-24836](https://insights.sbomify.com/CVE-2023-24836/): SUNNET CTMS - Path Traversal (high 8.8)
- [CVE-2023-24835](https://insights.sbomify.com/CVE-2023-24835/): Softnext SPAM SQR - Code Injection (high 7.2)
- [CVE-2023-24834](https://insights.sbomify.com/CVE-2023-24834/): WisdomGarden Tronclass ilearn - Broken Access Control (medium 6.5)
- [CVE-2023-24833](https://insights.sbomify.com/CVE-2023-24833/): Use after free in Hermes (high 7.5)
- [CVE-2023-24832](https://insights.sbomify.com/CVE-2023-24832/): Null dereference in Hermes (high 7.5)
- [CVE-2023-24831](https://insights.sbomify.com/CVE-2023-24831/): Apache IoTDB grafana-connector Login Bypass Vulnerability (critical 9.8)
- [CVE-2023-24830](https://insights.sbomify.com/CVE-2023-24830/): Apache IoTDB Workbench: apache/iotdb-web-workbench: create a user without authorization (high 7.5)
- [CVE-2023-24829](https://insights.sbomify.com/CVE-2023-24829/): Apache IoTDB Workbench: apache/iotdb-web-workbench: forge the JWTToken to access workbench (high 8.8)
- [CVE-2023-24828](https://insights.sbomify.com/CVE-2023-24828/): Use of Cryptographically Weak Pseudo-Random Number Generator in Onedev (high 8.1)
- [CVE-2023-24827](https://insights.sbomify.com/CVE-2023-24827/): Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set in syft (medium 6.5)
- [CVE-2023-24826](https://insights.sbomify.com/CVE-2023-24826/): Usage of Uninitialized Timer during forwarding of Fragments with SFR (medium 5.9)
- [CVE-2023-24825](https://insights.sbomify.com/CVE-2023-24825/): RIOT-OS vulnerable to NULL pointer dereference in gnrc_pktbuf_mark (high 7.5)
- [CVE-2023-24824](https://insights.sbomify.com/CVE-2023-24824/): Quadratic complexity may lead to a denial of service in cmark-gfm (medium 5.3)
- [CVE-2023-24823](https://insights.sbomify.com/CVE-2023-24823/): RIOT-OS vulnerable to Packet Type Confusion during IPHC send (critical 9.8)
- [CVE-2023-24822](https://insights.sbomify.com/CVE-2023-24822/): RIOT-OS vulnerable to Null Pointer dereference during IPHC encoding (high 7.5)
- [CVE-2023-24821](https://insights.sbomify.com/CVE-2023-24821/): RIOT-OS vulnerable to Integer Underflow during defragmentation (high 7.5)
- [CVE-2023-24820](https://insights.sbomify.com/CVE-2023-24820/): RIOT-OS vulnerable to Integer Underflow during IPHC receive (high 7.5)
- [CVE-2023-2482](https://insights.sbomify.com/CVE-2023-2482/): Responsive CSS EDITOR <= 1.0 - Admin+ SQLi (high 7.2)
- [CVE-2023-24819](https://insights.sbomify.com/CVE-2023-24819/): RIOT-OS vulnerable to Buffer Overflow during IPHC receive (critical 9.8)
- [CVE-2023-24818](https://insights.sbomify.com/CVE-2023-24818/): RIOT-OS vulnerable to null pointer dereference during fragment forwarding (high 7.5)
- [CVE-2023-24817](https://insights.sbomify.com/CVE-2023-24817/): RIOT-OS vulnerable to Out of Bounds write in routing with SRH (high 7.5)
- [CVE-2023-24816](https://insights.sbomify.com/CVE-2023-24816/): set_term_title command injection in ipython (medium 4.5)
- [CVE-2023-24815](https://insights.sbomify.com/CVE-2023-24815/): Disclosure of classpath resources on Windows when mounted on a wildcard route in vertx-web (medium 4.8)
- [CVE-2023-24814](https://insights.sbomify.com/CVE-2023-24814/): Persisted Cross-Site Scripting in Frontend Rendering in typo3 (high 8.8)
- [CVE-2023-24813](https://insights.sbomify.com/CVE-2023-24813/): URI validation failure on SVG parsing. Bypass of CVE-2023-23924 (critical 10.0)
- [CVE-2023-24812](https://insights.sbomify.com/CVE-2023-24812/): SQL injection of notes/search-by-tag (high 8.8)
- [CVE-2023-24811](https://insights.sbomify.com/CVE-2023-24811/): Cross site scripting (XSS) vulnerability using url preview in Misskey (high 7.1)
- [CVE-2023-24810](https://insights.sbomify.com/CVE-2023-24810/): Cross site scripting (XSS) vulnerability using authentication callback in Misskey (high 7.1)
- [CVE-2023-2481](https://insights.sbomify.com/CVE-2023-2481/): Key duplication in GSDK (medium 5.3)
- [CVE-2023-24809](https://insights.sbomify.com/CVE-2023-24809/): NetHack Call command buffer overflow (medium 5.5)
- [CVE-2023-24808](https://insights.sbomify.com/CVE-2023-24808/): Denial Of Service when opening a corrupt PDF file in pdfio (medium 5.3)
- [CVE-2023-24807](https://insights.sbomify.com/CVE-2023-24807/): Undici vulnerable to Regular Expression Denial of Service in Headers (high 7.5)
- [CVE-2023-24805](https://insights.sbomify.com/CVE-2023-24805/): Command injection in cups-filters (high 8.8)
- [CVE-2023-24804](https://insights.sbomify.com/CVE-2023-24804/): ownCloud Android app vulnerable to Path Traversal (medium 5.0)
- [CVE-2023-24800](https://insights.sbomify.com/CVE-2023-24800/): Memory corruption in dlink:dir-878 firmware (critical 9.8)
- [CVE-2023-2480](https://insights.sbomify.com/CVE-2023-2480/): Elevation of Privilege in M-Files Desktop Client (high 7.5)
- [CVE-2023-24799](https://insights.sbomify.com/CVE-2023-24799/): Memory corruption in dlink:dir-878 firmware (critical 9.8)
- [CVE-2023-24798](https://insights.sbomify.com/CVE-2023-24798/): Memory corruption in dlink:dir-878 firmware (critical 9.8)
- [CVE-2023-24797](https://insights.sbomify.com/CVE-2023-24797/): Memory corruption in dlink:dir-882 a1 firmware (critical 9.8)
- [CVE-2023-24796](https://insights.sbomify.com/CVE-2023-24796/): Command injection in vinga:wr-ac1200 firmware (critical 9.8)
- [CVE-2023-24795](https://insights.sbomify.com/CVE-2023-24795/): Command injection in jcgcn.com:jhr-n916r firmware (critical 9.8)
- [CVE-2023-2479](https://insights.sbomify.com/CVE-2023-2479/): OS Command Injection in appium/appium-desktop (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/370/