# Vulnerabilities published in 2023


- [CVE-2023-20943](https://insights.sbomify.com/CVE-2023-20943/): Path traversal in Android (high 7.8)
- [CVE-2023-20942](https://insights.sbomify.com/CVE-2023-20942/): Business logic in Android (medium 5.5)
- [CVE-2023-20941](https://insights.sbomify.com/CVE-2023-20941/): Memory corruption in Android (medium 6.6)
- [CVE-2023-20940](https://insights.sbomify.com/CVE-2023-20940/): Weak cryptography in Android (high 7.8)
- [CVE-2023-2094](https://insights.sbomify.com/CVE-2023-2094/): SourceCodester Vehicle Service Management System manage_mechanic.php sql injection (medium 6.3)
- [CVE-2023-20939](https://insights.sbomify.com/CVE-2023-20939/): Race condition in Android (high 7.8)
- [CVE-2023-20938](https://insights.sbomify.com/CVE-2023-20938/): Use after free in Android (high 8.1)
- [CVE-2023-20937](https://insights.sbomify.com/CVE-2023-20937/): Use after free in Android (high 7.8)
- [CVE-2023-20936](https://insights.sbomify.com/CVE-2023-20936/): Memory corruption in Android (high 7.8)
- [CVE-2023-20935](https://insights.sbomify.com/CVE-2023-20935/): Memory corruption in Android (medium 5.5)
- [CVE-2023-20934](https://insights.sbomify.com/CVE-2023-20934/): Security feature bypass in Android (high 7.8)
- [CVE-2023-20933](https://insights.sbomify.com/CVE-2023-20933/): Use after free in Android (high 7.8)
- [CVE-2023-20932](https://insights.sbomify.com/CVE-2023-20932/): Information disclosure in Android (low 3.3)
- [CVE-2023-20931](https://insights.sbomify.com/CVE-2023-20931/): Memory corruption in Android (high 7.8)
- [CVE-2023-20930](https://insights.sbomify.com/CVE-2023-20930/): Denial of service in Android (medium 5.5)
- [CVE-2023-2093](https://insights.sbomify.com/CVE-2023-2093/): SourceCodester Vehicle Service Management System Login.php sql injection (medium 6.3)
- [CVE-2023-20929](https://insights.sbomify.com/CVE-2023-20929/): Information disclosure in Android (medium 5.5)
- [CVE-2023-20928](https://insights.sbomify.com/CVE-2023-20928/): Use after free in Android (high 7.8)
- [CVE-2023-20927](https://insights.sbomify.com/CVE-2023-20927/): Privilege escalation in Android (high 7.8)
- [CVE-2023-20926](https://insights.sbomify.com/CVE-2023-20926/): Missing authorization in Android (medium 6.8)
- [CVE-2023-20925](https://insights.sbomify.com/CVE-2023-20925/): Use after free in Android (high 7.8)
- [CVE-2023-20924](https://insights.sbomify.com/CVE-2023-20924/): Auth bypass in Android (medium 6.8)
- [CVE-2023-20923](https://insights.sbomify.com/CVE-2023-20923/): Information disclosure in Android (medium 5.5)
- [CVE-2023-20922](https://insights.sbomify.com/CVE-2023-20922/): Denial of service in Android (medium 5.5)
- [CVE-2023-20921](https://insights.sbomify.com/CVE-2023-20921/): Business logic in Android (high 7.3)
- [CVE-2023-20920](https://insights.sbomify.com/CVE-2023-20920/): Use after free in Android (high 7.8)
- [CVE-2023-2092](https://insights.sbomify.com/CVE-2023-2092/): SourceCodester Vehicle Service Management System view_service.php sql injection (medium 6.3)
- [CVE-2023-20919](https://insights.sbomify.com/CVE-2023-20919/): Business logic in Android (high 7.8)
- [CVE-2023-20918](https://insights.sbomify.com/CVE-2023-20918/): Privilege escalation in Android (critical 9.8)
- [CVE-2023-20917](https://insights.sbomify.com/CVE-2023-20917/): Business logic in Android (high 7.8)
- [CVE-2023-20916](https://insights.sbomify.com/CVE-2023-20916/): Missing authorization in Android (high 7.8)
- [CVE-2023-20915](https://insights.sbomify.com/CVE-2023-20915/): Business logic in Android (high 7.8)
- [CVE-2023-20914](https://insights.sbomify.com/CVE-2023-20914/): Security feature bypass in Android (medium 5.5)
- [CVE-2023-20913](https://insights.sbomify.com/CVE-2023-20913/): Other in Android (high 7.8)
- [CVE-2023-20912](https://insights.sbomify.com/CVE-2023-20912/): Missing authorization in Android (high 7.8)
- [CVE-2023-20911](https://insights.sbomify.com/CVE-2023-20911/): Denial of service in Android (high 7.8)
- [CVE-2023-20910](https://insights.sbomify.com/CVE-2023-20910/): Denial of service in Android (medium 5.5)
- [CVE-2023-2091](https://insights.sbomify.com/CVE-2023-2091/): KylinSoft youker-assistant adjust_cpufreq_scaling_governer os command injection (high 7.8)
- [CVE-2023-20909](https://insights.sbomify.com/CVE-2023-20909/): Missing authorization in Android (medium 5.5)
- [CVE-2023-20908](https://insights.sbomify.com/CVE-2023-20908/): Denial of service in Android (medium 5.5)
- [CVE-2023-20906](https://insights.sbomify.com/CVE-2023-20906/): Privilege escalation in Android (high 7.8)
- [CVE-2023-20905](https://insights.sbomify.com/CVE-2023-20905/): Memory corruption in Android (high 7.8)
- [CVE-2023-20904](https://insights.sbomify.com/CVE-2023-20904/): Privilege escalation in Android (high 7.8)
- [CVE-2023-20903](https://insights.sbomify.com/CVE-2023-20903/): Auth bypass in Cloud Foundry (medium 4.3)
- [CVE-2023-20902](https://insights.sbomify.com/CVE-2023-20902/): Timing attack risk in Harbor (medium 5.9)
- [CVE-2023-20900](https://insights.sbomify.com/CVE-2023-20900/): Privilege escalation in VMware Tools (high 7.1)
- [CVE-2023-2090](https://insights.sbomify.com/CVE-2023-2090/): SourceCodester Employee and Visitor Gate Pass Logging System GET Parameter view_designation.php sql injection (medium 6.3)
- [CVE-2023-20899](https://insights.sbomify.com/CVE-2023-20899/): Missing authorization in VMware SD-WAN (Edge) (high 7.5)
- [CVE-2023-20898](https://insights.sbomify.com/CVE-2023-20898/): Salt can cause Git Providers to get wrong data (medium 4.2)
- [CVE-2023-20897](https://insights.sbomify.com/CVE-2023-20897/): Salt vulnerable to denial of service (medium 5.3)
- [CVE-2023-20896](https://insights.sbomify.com/CVE-2023-20896/): Memory corruption in VMware Cloud Foundation (vCenter Server) (medium 5.9)
- [CVE-2023-20895](https://insights.sbomify.com/CVE-2023-20895/): Memory corruption in VMware Cloud Foundation (vCenter Server) (high 8.1)
- [CVE-2023-20894](https://insights.sbomify.com/CVE-2023-20894/): Memory corruption in VMware Cloud Foundation (vCenter Server) (high 8.1)
- [CVE-2023-20893](https://insights.sbomify.com/CVE-2023-20893/): Use after free in VMware Cloud Foundation (vCenter Server) (high 8.1)
- [CVE-2023-20892](https://insights.sbomify.com/CVE-2023-20892/): VMware vCenter Server heap-overflow vulnerability (high 8.1)
- [CVE-2023-20891](https://insights.sbomify.com/CVE-2023-20891/): VMware Tanzu Application Service for VMs and Isolation Segment information disclosure vulnerability (medium 6.5)
- [CVE-2023-20890](https://insights.sbomify.com/CVE-2023-20890/): Path traversal in Aria Operations for Networks (high 7.2)
- [CVE-2023-2089](https://insights.sbomify.com/CVE-2023-2089/): SourceCodester Complaint Management System GET Parameter userprofile.php sql injection (medium 6.3)
- [CVE-2023-20889](https://insights.sbomify.com/CVE-2023-20889/): Command injection in Aria Operations for Networks (Formerly vRealize Network Insight) (high 7.5)
- [CVE-2023-20888](https://insights.sbomify.com/CVE-2023-20888/): Deserialization in Aria Operations for Networks (Formerly vRealize Network Insight) (high 8.8)
- [CVE-2023-20887](https://insights.sbomify.com/CVE-2023-20887/): Vmware Aria Operations for Networks Command Injection (critical 9.8, exploited in the wild)
- [CVE-2023-20886](https://insights.sbomify.com/CVE-2023-20886/): Open redirect in VMware Workspace ONE UEM Console (high 8.8)
- [CVE-2023-20885](https://insights.sbomify.com/CVE-2023-20885/): CF workflows leak credentials in system audit logs (medium 6.5)
- [CVE-2023-20884](https://insights.sbomify.com/CVE-2023-20884/): Open redirect in VMware Workspace ONE Access (Access), VMware Identity Manager (vIDM), VMware Cloud Foundation (Cloud Foundation) (medium 6.1)
- [CVE-2023-20883](https://insights.sbomify.com/CVE-2023-20883/): Spring Boot Welcome Page Denial of Service (high 7.5)
- [CVE-2023-20882](https://insights.sbomify.com/CVE-2023-20882/): Denial of service in Cloud Foundry Routing release (medium 5.9)
- [CVE-2023-20881](https://insights.sbomify.com/CVE-2023-20881/): Missing authorization in Cloud Controller API (high 8.1)
- [CVE-2023-20880](https://insights.sbomify.com/CVE-2023-20880/): Privilege escalation in VMware Aria Operations (formerly vRealize Operations) (medium 6.7)
- [CVE-2023-2088](https://insights.sbomify.com/CVE-2023-2088/): Other in OpenStack (medium 6.5)
- [CVE-2023-20879](https://insights.sbomify.com/CVE-2023-20879/): Privilege escalation in VMware Aria Operations (formerly vRealize Operations) (medium 6.7)
- [CVE-2023-20878](https://insights.sbomify.com/CVE-2023-20878/): Deserialization in VMware Aria Operations (formerly vRealize Operations) (high 7.2)
- [CVE-2023-20877](https://insights.sbomify.com/CVE-2023-20877/): Privilege escalation in VMware Aria Operations (formerly vRealize Operations) (high 8.8)
- [CVE-2023-20873](https://insights.sbomify.com/CVE-2023-20873/): Spring Boot Security Bypass with Wildcard Pattern Matching on Cloud Foundry (critical 9.8)
- [CVE-2023-20872](https://insights.sbomify.com/CVE-2023-20872/): Memory corruption in VMware Workstation Pro / Player (Workstation) and VMware Fusion (high 8.8)
- [CVE-2023-20871](https://insights.sbomify.com/CVE-2023-20871/): Privilege escalation in VMware Fusion (high 7.8)
- [CVE-2023-20870](https://insights.sbomify.com/CVE-2023-20870/): Memory corruption in VMware Workstation Pro / Player (Workstation) and VMware Fusion (medium 6.0)
- [CVE-2023-2087](https://insights.sbomify.com/CVE-2023-2087/): Essential Blocks <= 4.0.6 - Cross-Site Request Forgery via save (medium 4.3)
- [CVE-2023-20869](https://insights.sbomify.com/CVE-2023-20869/): Memory corruption in VMware Workstation Pro / Player (Workstation) and VMware Fusion (high 8.2)
- [CVE-2023-20868](https://insights.sbomify.com/CVE-2023-20868/): Cross-site scripting in NSX-T (medium 6.1)
- [CVE-2023-20867](https://insights.sbomify.com/CVE-2023-20867/): VMware Tools Authentication Bypass (low 3.9, exploited in the wild)
- [CVE-2023-20866](https://insights.sbomify.com/CVE-2023-20866/): Spring Session session ID can be logged to the standard output stream (medium 6.5)
- [CVE-2023-20865](https://insights.sbomify.com/CVE-2023-20865/): Command injection in VMware Aria Operations for Logs (formerly vRealize Log Insight) (high 7.2)
- [CVE-2023-20864](https://insights.sbomify.com/CVE-2023-20864/): Deserialization in VMware Aria Operations for Logs (formerly vRealize Log Insight) (critical 9.8)
- [CVE-2023-20863](https://insights.sbomify.com/CVE-2023-20863/): Spring Framework vulnerable to denial of service (medium 6.5)
- [CVE-2023-20862](https://insights.sbomify.com/CVE-2023-20862/): Spring Security logout not clearing security context (medium 6.3)
- [CVE-2023-20861](https://insights.sbomify.com/CVE-2023-20861/): Spring Framework vulnerable to denial of service via specially crafted SpEL expression (medium 6.5)
- [CVE-2023-20860](https://insights.sbomify.com/CVE-2023-20860/): Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch (high 7.5)
- [CVE-2023-2086](https://insights.sbomify.com/CVE-2023-2086/): Essential Blocks <= 4.0.6 - Missing Authorization via template_count (medium 4.3)
- [CVE-2023-20859](https://insights.sbomify.com/CVE-2023-20859/): Spring Vault vulnerable to insertion of sensitive information into a log file (medium 5.5)
- [CVE-2023-20858](https://insights.sbomify.com/CVE-2023-20858/): Code injection in VMware Carbon Black App Control (high 7.2)
- [CVE-2023-20857](https://insights.sbomify.com/CVE-2023-20857/): Auth bypass in VMware Workspace ONE Content (medium 6.8)
- [CVE-2023-20856](https://insights.sbomify.com/CVE-2023-20856/): Cross-site request forgery in VMware vRealize Operations (vROps) (high 8.8)
- [CVE-2023-20855](https://insights.sbomify.com/CVE-2023-20855/): XML external entity in VMware vRealize Orchestrator, VMware vRealize Automation, VMware Cloud Foundation (high 8.8)
- [CVE-2023-20854](https://insights.sbomify.com/CVE-2023-20854/): Privilege escalation in VMware Workstation (high 8.4)
- [CVE-2023-20853](https://insights.sbomify.com/CVE-2023-20853/): aEnrich a+HRD - Deserialization of Untrusted Data (critical 9.8)
- [CVE-2023-20852](https://insights.sbomify.com/CVE-2023-20852/): aEnrich a+HRD - Deserialization of Untrusted Data (critical 9.8)
- [CVE-2023-20851](https://insights.sbomify.com/CVE-2023-20851/): Race condition in MT8188 (medium 6.3)
- [CVE-2023-20850](https://insights.sbomify.com/CVE-2023-20850/): Memory corruption in MT2713, MT6895, MT6897, MT6983, MT8188, MT8195, MT8395, MT8781 (medium 6.5)
- [CVE-2023-2085](https://insights.sbomify.com/CVE-2023-2085/): Essential Blocks <= 4.0.6 - Missing Authorization via templates (medium 4.3)
- [CVE-2023-20849](https://insights.sbomify.com/CVE-2023-20849/): Use after free in MT2713, MT6895, MT6897, MT6983, MT8188, MT8195, MT8395, MT8781 (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/404/