CVE-2023-39427

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share v12 SP0 Build (1204.77), the affected applications lack proper validation of user-supplied data when parsing XE files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Oct 26, 2023
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-394295.4Cross-site scripting vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to inject an arbitrary s CVE-2023-394310.0Stack-based Buffer Overflow vulnerability in ZkTeco-based OEM devices allows, in some cases, the execution of arbitrary code. Due to the lac CVE-2023-394317.8Sante DICOM Viewer Pro lacks proper validation of user-supplied data when parsing DICOM files. This could lead to an out-of-bounds write. An CVE-2023-394327.8Improper access control element in some Intel(R) Ethernet tools and driver install software, before versions 28.2, may allow an authenticate CVE-2023-394334.4Improper access control for some Intel(R) CST software before version 2.1.10300 may allow an authenticated user to potentially enable escala CVE-2023-394348.8A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma CVE-2023-394359.8Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 CVE-2023-394365.8SAP Supplier Relationship Management -versions 600, 602, 603, 604, 605, 606, 616, 617, allows an unauthorized attacker to discover informati CVE-2023-394375.4SAP business One allows - version 10.0, allows an attacker to insert malicious code into the content of a web page or application and gets i CVE-2023-394388.1A missing authorization check allows an arbitrary authenticated user to perform certain operations through the API of CLA-assistant by execu CVE-2023-394399.8SAP Commerce Cloud may accept an empty passphrase for user ID and passphrase authentication, allowing users to log into the system without a CVE-2023-39446.1A vulnerability was found in phpscriptpoint Lawyer 1.6 and classified as problematic. Affected by this issue is some unknown functionality o