# Vulnerabilities published in 2023


- [CVE-2023-23388](https://insights.sbomify.com/CVE-2023-23388/): Windows Bluetooth Driver Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2023-23385](https://insights.sbomify.com/CVE-2023-23385/): Windows Point-to-Point Protocol over Ethernet (PPPoE) Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2023-23384](https://insights.sbomify.com/CVE-2023-23384/): Microsoft SQL Server Remote Code Execution Vulnerability (high 7.3)
- [CVE-2023-23383](https://insights.sbomify.com/CVE-2023-23383/): Service Fabric Explorer Spoofing Vulnerability (high 8.2)
- [CVE-2023-23382](https://insights.sbomify.com/CVE-2023-23382/): Azure Machine Learning Compute Instance Information Disclosure Vulnerability (medium 6.5)
- [CVE-2023-23381](https://insights.sbomify.com/CVE-2023-23381/): Visual Studio Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-2338](https://insights.sbomify.com/CVE-2023-2338/): SQL Injection in pimcore/pimcore (high 7.2)
- [CVE-2023-23379](https://insights.sbomify.com/CVE-2023-23379/): Microsoft Defender for IoT Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2023-23378](https://insights.sbomify.com/CVE-2023-23378/): Print 3D Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-23377](https://insights.sbomify.com/CVE-2023-23377/): 3D Builder Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-23376](https://insights.sbomify.com/CVE-2023-23376/): Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation (high 7.8, exploited in the wild)
- [CVE-2023-23375](https://insights.sbomify.com/CVE-2023-23375/): Microsoft ODBC and OLE DB Remote Code Execution Vulnerability (high 7.8)
- [CVE-2023-23374](https://insights.sbomify.com/CVE-2023-23374/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (high 8.3)
- [CVE-2023-23373](https://insights.sbomify.com/CVE-2023-23373/): QUSBCam2 (high 8.8)
- [CVE-2023-23372](https://insights.sbomify.com/CVE-2023-23372/): QTS, QuTS hero (medium 6.5)
- [CVE-2023-23371](https://insights.sbomify.com/CVE-2023-23371/): QVPN Device Client (medium 5.2)
- [CVE-2023-23370](https://insights.sbomify.com/CVE-2023-23370/): QVPN Device Client (medium 6.7)
- [CVE-2023-2337](https://insights.sbomify.com/CVE-2023-2337/): ConvertKit < 2.2.1 - Reflected XSS (medium 6.1)
- [CVE-2023-23369](https://insights.sbomify.com/CVE-2023-23369/): QTS, Multimedia Console, and Media Streaming add-on (critical 9.0)
- [CVE-2023-23368](https://insights.sbomify.com/CVE-2023-23368/): QTS, QuTS hero, QuTScloud (critical 9.8)
- [CVE-2023-23367](https://insights.sbomify.com/CVE-2023-23367/): QTS, QuTS hero, QuTScloud (medium 4.7)
- [CVE-2023-23366](https://insights.sbomify.com/CVE-2023-23366/): Music Station (high 7.7)
- [CVE-2023-23365](https://insights.sbomify.com/CVE-2023-23365/): Music Station (high 7.7)
- [CVE-2023-23364](https://insights.sbomify.com/CVE-2023-23364/): Multimedia Console (high 8.1)
- [CVE-2023-23363](https://insights.sbomify.com/CVE-2023-23363/): QTS (high 8.1)
- [CVE-2023-23362](https://insights.sbomify.com/CVE-2023-23362/): QTS, QuTS hero, QuTScloud (high 8.8)
- [CVE-2023-2336](https://insights.sbomify.com/CVE-2023-2336/): Path Traversal in pimcore/pimcore (medium 5.5)
- [CVE-2023-23357](https://insights.sbomify.com/CVE-2023-23357/): QuLog Center (medium 4.8)
- [CVE-2023-23356](https://insights.sbomify.com/CVE-2023-23356/): QuFirewall (medium 5.5)
- [CVE-2023-23355](https://insights.sbomify.com/CVE-2023-23355/): QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances), QVR (medium 6.6)
- [CVE-2023-23354](https://insights.sbomify.com/CVE-2023-23354/): QuLog Center (high 7.3)
- [CVE-2023-2335](https://insights.sbomify.com/CVE-2023-2335/): Plaintext Password in Registry (medium 6.5)
- [CVE-2023-23349](https://insights.sbomify.com/CVE-2023-23349/): Information disclosure in Kaspersky Password Manager for Windows (low 2.2)
- [CVE-2023-23348](https://insights.sbomify.com/CVE-2023-23348/): HCL Launch is vulnerable to sensitive information disclosure (medium 5.1)
- [CVE-2023-23347](https://insights.sbomify.com/CVE-2023-23347/): Use of a broken cryptographic algorithm affects HCL DRYiCE iAutomate (medium 6.4)
- [CVE-2023-23346](https://insights.sbomify.com/CVE-2023-23346/): Use of a broken cryptographic algorithm affects HCL DRYiCE MyCloud (medium 6.4)
- [CVE-2023-23344](https://insights.sbomify.com/CVE-2023-23344/): HCL BigFix WebUI Insights is susceptible to a lack of sufficient authorization (low 3.0)
- [CVE-2023-23343](https://insights.sbomify.com/CVE-2023-23343/): HCL BigFix OSD Bare Metal Server version 311.12 or lower is affected by a clickjacking vulnerability. (low 2.4)
- [CVE-2023-23342](https://insights.sbomify.com/CVE-2023-23342/): HCL Nomad for web is affected by cryptographic validation of local data access that can be circumvented (medium 6.6)
- [CVE-2023-2334](https://insights.sbomify.com/CVE-2023-2334/): Easy Digital Downloads Google Sheet Connector < 1.6.6 - Access Code Update via CSRF (medium 5.4)
- [CVE-2023-23333](https://insights.sbomify.com/CVE-2023-23333/): Command injection in contec:solarview compact firmware (critical 9.8)
- [CVE-2023-23331](https://insights.sbomify.com/CVE-2023-23331/): SQL injection in amano:xoffice (critical 9.8)
- [CVE-2023-23330](https://insights.sbomify.com/CVE-2023-23330/): Path traversal in amano:xoffice (high 7.5)
- [CVE-2023-2333](https://insights.sbomify.com/CVE-2023-2333/): Ninja Forms Google Sheet Connector < 1.2.7 - Reflected XSS (medium 6.1)
- [CVE-2023-23328](https://insights.sbomify.com/CVE-2023-23328/): File upload in avantfax:avantfax (high 8.8)
- [CVE-2023-23327](https://insights.sbomify.com/CVE-2023-23327/): Information disclosure in avantfax:avantfax (medium 4.9)
- [CVE-2023-23326](https://insights.sbomify.com/CVE-2023-23326/): Cross-site scripting in avantfax:avantfax (medium 5.4)
- [CVE-2023-23325](https://insights.sbomify.com/CVE-2023-23325/): Command injection in zumtobel:netlink ccd firmware (critical 9.8)
- [CVE-2023-23324](https://insights.sbomify.com/CVE-2023-23324/): Hardcoded credentials in zumtobel:netlink ccd firmware (critical 9.8)
- [CVE-2023-2332](https://insights.sbomify.com/CVE-2023-2332/): Stored Cross-site Scripting (XSS) in pimcore/pimcore (medium 4.0)
- [CVE-2023-23315](https://insights.sbomify.com/CVE-2023-23315/): SQL injection in stripe:stripe payment pro (critical 9.8)
- [CVE-2023-23314](https://insights.sbomify.com/CVE-2023-23314/): File upload in zdir project:zdir (high 8.8)
- [CVE-2023-23313](https://insights.sbomify.com/CVE-2023-23313/): Cross-site scripting in draytek:vigor1000b firmware (medium 6.1)
- [CVE-2023-2331](https://insights.sbomify.com/CVE-2023-2331/): Bypassing hardening via Unquoted Service path vulnerability (high 7.8)
- [CVE-2023-23306](https://insights.sbomify.com/CVE-2023-23306/): Memory corruption in garmin:connect-iq (critical 9.8)
- [CVE-2023-23305](https://insights.sbomify.com/CVE-2023-23305/): Memory corruption in garmin:connect-iq (critical 9.8)
- [CVE-2023-23304](https://insights.sbomify.com/CVE-2023-23304/): Missing authorization in garmin:connect-iq (high 7.7)
- [CVE-2023-23303](https://insights.sbomify.com/CVE-2023-23303/): Memory corruption in garmin:connect-iq (critical 9.8)
- [CVE-2023-23302](https://insights.sbomify.com/CVE-2023-23302/): Memory corruption in garmin:connect-iq (critical 9.8)
- [CVE-2023-23301](https://insights.sbomify.com/CVE-2023-23301/): Memory corruption in garmin:connect-iq (critical 9.8)
- [CVE-2023-23300](https://insights.sbomify.com/CVE-2023-23300/): Memory corruption in garmin:connect-iq (critical 9.8)
- [CVE-2023-2330](https://insights.sbomify.com/CVE-2023-2330/): Caldera Forms Google Sheets Connector < 1.3 - Access Code Update via CSRF (high 8.8)
- [CVE-2023-23299](https://insights.sbomify.com/CVE-2023-23299/): Security feature bypass in garmin:connect-iq (high 7.5)
- [CVE-2023-23298](https://insights.sbomify.com/CVE-2023-23298/): Integer overflow in garmin:connect-iq (critical 9.8)
- [CVE-2023-23296](https://insights.sbomify.com/CVE-2023-23296/): Denial of service in korenix:jetwave 2111 firmware (medium 6.5)
- [CVE-2023-23295](https://insights.sbomify.com/CVE-2023-23295/): Command injection in korenix:jetwave 2111 firmware (high 8.8)
- [CVE-2023-23294](https://insights.sbomify.com/CVE-2023-23294/): Command injection in korenix:jetwave 2111 firmware (high 8.8)
- [CVE-2023-2329](https://insights.sbomify.com/CVE-2023-2329/): WooCommerce Google Sheet Connector < 1.3.6 - Access Code Update via CSRF (high 8.8)
- [CVE-2023-23286](https://insights.sbomify.com/CVE-2023-23286/): Cross-site scripting in farsight:provide server (medium 6.1)
- [CVE-2023-2328](https://insights.sbomify.com/CVE-2023-2328/): Cross-site Scripting (XSS) - Generic in pimcore/pimcore (medium 5.2)
- [CVE-2023-23279](https://insights.sbomify.com/CVE-2023-23279/): SQL injection in canteen management system project:canteen management system (critical 9.8)
- [CVE-2023-23277](https://insights.sbomify.com/CVE-2023-23277/): Cross-site scripting in snippet box project:snippet box (medium 6.1)
- [CVE-2023-2327](https://insights.sbomify.com/CVE-2023-2327/): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (medium 4.0)
- [CVE-2023-2326](https://insights.sbomify.com/CVE-2023-2326/): Gravity Forms Google Sheet Connector < 1.3.5 - Access Code Update via CSRF (medium 6.5)
- [CVE-2023-2325](https://insights.sbomify.com/CVE-2023-2325/): Stored XSS Vulnerability in M-Files Classic Web (high 7.3)
- [CVE-2023-2324](https://insights.sbomify.com/CVE-2023-2324/): Elementor Forms Google Sheet Connector < 1.0.7 - Reflected XSS (medium 6.1)
- [CVE-2023-2323](https://insights.sbomify.com/CVE-2023-2323/): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (medium 6.8)
- [CVE-2023-2322](https://insights.sbomify.com/CVE-2023-2322/): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (medium 5.2)
- [CVE-2023-2321](https://insights.sbomify.com/CVE-2023-2321/): WPForms Google Sheet Connector < 3.4.6 - Reflected XSS (medium 6.1)
- [CVE-2023-23208](https://insights.sbomify.com/CVE-2023-23208/): Cross-site scripting in genesys:administrator extension (medium 6.1)
- [CVE-2023-23205](https://insights.sbomify.com/CVE-2023-23205/): Denial of service in mz-automation:lib60870 (medium 5.5)
- [CVE-2023-2320](https://insights.sbomify.com/CVE-2023-2320/): CF7 Google Sheets Connector < 5.0.2 - Reflected XSS (medium 6.1)
- [CVE-2023-23192](https://insights.sbomify.com/CVE-2023-23192/): Auth bypass in isdecisions:userlock (high 7.2)
- [CVE-2023-2319](https://insights.sbomify.com/CVE-2023-2319/): Other in pcs (critical 9.8)
- [CVE-2023-2318](https://insights.sbomify.com/CVE-2023-2318/): MarkText DOM-Based Cross-site Scripting leading to Remote Code Execution (high 8.6)
- [CVE-2023-2317](https://insights.sbomify.com/CVE-2023-2317/): Typora DOM-Based Cross-site Scripting leading to Remote Code Execution (high 8.6)
- [CVE-2023-23169](https://insights.sbomify.com/CVE-2023-23169/): Path traversal in synapsoft:pdfocus (medium 6.5)
- [CVE-2023-23163](https://insights.sbomify.com/CVE-2023-23163/): SQL injection in phpgurukul:art gallery management system (critical 9.8)
- [CVE-2023-23162](https://insights.sbomify.com/CVE-2023-23162/): SQL injection in phpgurukul:art gallery management system (critical 9.8)
- [CVE-2023-23161](https://insights.sbomify.com/CVE-2023-23161/): Cross-site scripting in phpgurukul:art gallery management system (medium 6.1)
- [CVE-2023-2316](https://insights.sbomify.com/CVE-2023-2316/): Typora Local File Disclosure (high 7.4)
- [CVE-2023-23158](https://insights.sbomify.com/CVE-2023-23158/): Cross-site scripting in phpgurukul:art gallery management system (medium 5.4)
- [CVE-2023-23157](https://insights.sbomify.com/CVE-2023-23157/): Cross-site scripting in phpgurukul:art gallery management system (medium 5.4)
- [CVE-2023-23156](https://insights.sbomify.com/CVE-2023-23156/): SQL injection in phpgurukul:art gallery management system (critical 9.8)
- [CVE-2023-23155](https://insights.sbomify.com/CVE-2023-23155/): SQL injection in phpgurukul:art gallery management system (critical 9.8)
- [CVE-2023-23151](https://insights.sbomify.com/CVE-2023-23151/): Path traversal in bloofox:bloofoxcms (medium 6.5)
- [CVE-2023-23150](https://insights.sbomify.com/CVE-2023-23150/): Other in lancombg:sa-wr915nd firmware (critical 9.8)
- [CVE-2023-2315](https://insights.sbomify.com/CVE-2023-2315/): Path Traversal in OpenCart versions 4.0.0.0 to 4.0.2.2 (high 8.1)
- [CVE-2023-23149](https://insights.sbomify.com/CVE-2023-23149/): Command injection in dek-1705 project:dek-1705 firmware (critical 9.8)
- [CVE-2023-23145](https://insights.sbomify.com/CVE-2023-23145/): Denial of service in gpac:gpac (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/383/