# Vulnerabilities published in 2023 - [DRUPAL-CONTRIB-2023-052](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-052/): This module enables you to pay online via Mollie. (not scored) - [DRUPAL-CONTRIB-2023-051](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-051/): The GraphQL module enables you to build GraphQL APIs which can include data fetching through Queries and data updates (create, update, delete) through mutations. (not scored) - [DRUPAL-CONTRIB-2023-050](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-050/): This module lets you craft and expose a GraphQL schema for Drupal 9 and 10. (not scored) - [DRUPAL-CONTRIB-2023-049](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-049/): This module enables you to view all paragraph entities in an admin view. (not scored) - [DRUPAL-CONTRIB-2023-048](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-048/): This module enables users to log in by email address with minimal configurations. (not scored) - [DRUPAL-CONTRIB-2023-047](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-047/): This module enables notifications to be sent to all users of a particular role, or to the content's author when a piece of content is transi (not scored) - [DRUPAL-CONTRIB-2023-045](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-045/): This module enables users to log in by email address with minimal configurations. (not scored) - [DRUPAL-CONTRIB-2023-044](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-044/): The Webprofiler module provides a way of displaying the Symfony profile debugging tool at the bottom of each page. (not scored) - [DRUPAL-CONTRIB-2023-043](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-043/): Provides [highlight.php](https://github.com/scrivo/highlight.php "highlight.php") integration to Drupal, allowing blocks to be automa (not scored) - [DRUPAL-CONTRIB-2023-042](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-042/): This module enables you to hide email addresses from bots and site scrapers by using the rot13 strategy. (not scored) - [DRUPAL-CONTRIB-2023-041](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-041/): This module makes PatternLab's custom Twig functions available to Drupal theming. (not scored) - [DRUPAL-CONTRIB-2023-040](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-040/): The Data Field module provides a way of building field types that are made up of other fields, a simpler alternative to e.g. (not scored) - [DRUPAL-CONTRIB-2023-039](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-039/): This module aims to prevent broken content references by informing content editors either on delete or archive moderation. (not scored) - [DRUPAL-CONTRIB-2023-038](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-038/): This module provides integration with Shorthand, an application which describes itself as "beautifully simple storytelling". (not scored) - [DRUPAL-CONTRIB-2023-037](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-037/): This module enables you to build administrative pages for managing configuration objects, which may then be used elsewhere in the site. (not scored) - [DRUPAL-CONTRIB-2023-035](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-035/): This module changes your forum administration page to allow you to set forums private. (not scored) - [DRUPAL-CONTRIB-2023-034](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-034/): The ACL module, short for Access Control Lists, is an API for other modules to create lists of users and give them access to nodes. (not scored) - [DRUPAL-CONTRIB-2023-033](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-033/): This module enables you to add the Matomo web statistics tracking system to your website. (not scored) - [DRUPAL-CONTRIB-2023-032](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-032/): Carefully crafted input by an attacker will not be sanitized by this module, which can result in a script injection. (not scored) - [DRUPAL-CONTRIB-2023-031](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-031/): The module doesn’t sufficiently protect against malicious links, which means an attacker can trick an administrator into performing unwanted actions. (not scored) - [DRUPAL-CONTRIB-2023-030](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-030/): This module enables you to allow and/or require users to use a second authentication method in addition to password authentication. (not scored) - [DRUPAL-CONTRIB-2023-029](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-029/): This module enables sites to comply with the European cookie law using tarteaucitron.js. (not scored) - [DRUPAL-CONTRIB-2023-028](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-028/): This module enables you to render a field in an expandable/collapsible region. (not scored) - [DRUPAL-CONTRIB-2023-027](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-027/): This module enables a UI to display all libraries provided by modules and themes on the Drupal site. (not scored) - [DRUPAL-CONTRIB-2023-026](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-026/): This module enables you to use complex autocompletion in forms. (not scored) - [DRUPAL-CONTRIB-2023-025](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-025/): This module provides integration with Mailchimp, a popular email delivery service. (not scored) - [DRUPAL-CONTRIB-2023-024](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-024/): This module enables you to create dynamic layouts and add sample color palettes for color selection hints via its UI. (not scored) - [DRUPAL-CONTRIB-2023-023](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-023/): This module enables you to define configurable GDPR alert messages. (not scored) - [DRUPAL-CONTRIB-2023-021](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-021/): CivicCookieControl is a module that can help make a website compliant with EU and UK cookie legislation. (not scored) - [DRUPAL-CONTRIB-2023-020](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-020/): This module enables you to define a 'weekly office hours' field type, and add a field to any Content type, in order to display the weekly op (not scored) - [DRUPAL-CONTRIB-2023-019](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-019/): This module provides social media share & follow buttons. (not scored) - [DRUPAL-CONTRIB-2023-018](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-018/): This module provides social media share & follow buttons. (not scored) - [DRUPAL-CONTRIB-2023-017](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-017/): The Consent Popup provides a configurable popup that requires acceptance of a question before the visitor can continue, typically used for age consent. (not scored) - [DRUPAL-CONTRIB-2023-016](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-016/): The Iubenda Integration module provides a custom block to provide a link to the Iubenda privacy policy. (not scored) - [DRUPAL-CONTRIB-2023-014](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-014/): S3 File System (s3fs) provides an additional file system to your Drupal site, which stores files in Amazon's Simple Storage Service (S3) or (not scored) - [DRUPAL-CONTRIB-2023-013](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-013/): This module enables you to secure any page with a password. (not scored) - [DRUPAL-CONTRIB-2023-012](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-012/): This module is a tool for developers, analysts, and administrators that allows them to generate reports on a given Drupal installation. (not scored) - [DRUPAL-CONTRIB-2023-011](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-011/): The security team is marking this project unsupported. (not scored) - [DRUPAL-CONTRIB-2023-010](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-010/): The Media Responsive Thumbnail module allows media reference fields to be rendered as a responsive image. (not scored) - [DRUPAL-CONTRIB-2023-009](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-009/): This module provides a new UI experience for node editing - Gutenberg editor. (not scored) - [DRUPAL-CONTRIB-2023-008](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-008/): This module enables you to associate Forums as Group 1.x content and use Group access permissions. (not scored) - [DRUPAL-CONTRIB-2023-006](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-006/): This module enables you to add social sharing buttons to a site. (not scored) - [DRUPAL-CONTRIB-2023-005](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-005/): The Apigee Edge module allows connecting a Drupal site to Apigee X / Edge in order to build a developer portal. (not scored) - [DRUPAL-CONTRIB-2023-004](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-004/): This module enables you to use the media library in custom forms without the Media Library Widget. (not scored) - [DRUPAL-CONTRIB-2023-003](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-003/): The Media Library Block module allows you to render a media entity in a block. (not scored) - [DRUPAL-CONTRIB-2023-002](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-002/): The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widget. (not scored) - [DRUPAL-CONTRIB-2023-001](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-001/): This module enables users to create 'private' vocabularies. (not scored) - [CVE-2023-7357](https://insights.sbomify.com/CVE-2023-7357/): FlexNet Publisher lmadmin Rogue Vendor Daemon Vulnerability (high 8.6) - [CVE-2023-7356](https://insights.sbomify.com/CVE-2023-7356/): Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID (high 8.8) - [CVE-2023-7346](https://insights.sbomify.com/CVE-2023-7346/): Ledger Bitcoin App 2.1.0 Address Derivation Error via Miniscript (medium 4.1) - [CVE-2023-7345](https://insights.sbomify.com/CVE-2023-7345/): Ledger Live hw-app-eth EIP-712 Message Parsing Integer Truncation (medium 6.9) - [CVE-2023-7343](https://insights.sbomify.com/CVE-2023-7343/): Belden Industrial HiVision Arbitrary Code Execution via Malicious Project File (high 8.5) - [CVE-2023-7342](https://insights.sbomify.com/CVE-2023-7342/): Belden HiSecOS Web Server Privilege Escalation (high 8.7) - [CVE-2023-7340](https://insights.sbomify.com/CVE-2023-7340/): Wazuh authd service (os_auth) Heap-based Buffer Overflow (medium 5.3) - [CVE-2023-7339](https://insights.sbomify.com/CVE-2023-7339/): Data collection for dowloading leads into buffer overflow (medium 6.5) - [CVE-2023-7338](https://insights.sbomify.com/CVE-2023-7338/): Ruckus Unleashed Authenticated RCE in Gateway Mode (high 7.7) - [CVE-2023-7337](https://insights.sbomify.com/CVE-2023-7337/): SQL injection in JS Help Desk – AI-Powered Support & Ticketing System (high 7.5) - [CVE-2023-7335](https://insights.sbomify.com/CVE-2023-7335/): EduSoho < 22.4.7 Arbitrary File Read via classroom-course-statistics (high 8.7) - [CVE-2023-7334](https://insights.sbomify.com/CVE-2023-7334/): Changjetong T+ <= 16.x GetStoreWarehouseByStore Deserialization RCE (critical 9.3) - [CVE-2023-7333](https://insights.sbomify.com/CVE-2023-7333/): bluelabsio records-mover Table Object sql injection (medium 4.8) - [CVE-2023-7332](https://insights.sbomify.com/CVE-2023-7332/): PocketMine-MP < 4.18.1 Improper Validation of Dropped Item Count Allows Remote Server Crash (high 7.1) - [CVE-2023-7331](https://insights.sbomify.com/CVE-2023-7331/): PKrystian Full-Stack-Bank User sql injection (medium 5.1) - [CVE-2023-7330](https://insights.sbomify.com/CVE-2023-7330/): Ruijie Networks NBR Routers Unauthenticated Arbitrary File Upload via fileupload.php (critical 9.3) - [CVE-2023-7329](https://insights.sbomify.com/CVE-2023-7329/): Tinycontrol LAN Controller v3 (LK3) Remote DoS (high 8.7) - [CVE-2023-7328](https://insights.sbomify.com/CVE-2023-7328/): Screen SFT DAB 600/C <= 1.9.3 Unauthenticated Information Disclosure (medium 6.9) - [CVE-2023-7327](https://insights.sbomify.com/CVE-2023-7327/): Ozeki SMS Gateway <= 10.3.208 Unauthenticated Arbitrary File Read (high 8.7) - [CVE-2023-7326](https://insights.sbomify.com/CVE-2023-7326/): Epson Stylus SX510W Printer Remote Power Off DoS (high 8.7) - [CVE-2023-7325](https://insights.sbomify.com/CVE-2023-7325/): Mingyu Operations and Maintenance Audit and Risk Control System xmlrpc.sock SSRF (critical 9.3) - [CVE-2023-7324](https://insights.sbomify.com/CVE-2023-7324/): scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses (high 8.1) - [CVE-2023-7323](https://insights.sbomify.com/CVE-2023-7323/): Nagios Log Server < 2024R1 XSS via Create User Function (medium 5.1) - [CVE-2023-7322](https://insights.sbomify.com/CVE-2023-7322/): Nagios Log Server < 2024R1 Incorrect Authorization Granting Full API Access (high 8.7) - [CVE-2023-7321](https://insights.sbomify.com/CVE-2023-7321/): Nagios Log Server < 2.1.14 XSS via Snapshots Page (medium 5.1) - [CVE-2023-7320](https://insights.sbomify.com/CVE-2023-7320/): WooCommerce <= 7.8.2 - Sensitive Information Exposure (medium 5.3) - [CVE-2023-7319](https://insights.sbomify.com/CVE-2023-7319/): Nagios Network Analyzer < 2024R1 XSS via Percentile Calculator Menu (medium 5.1) - [CVE-2023-7318](https://insights.sbomify.com/CVE-2023-7318/): Nagios XI < 2024R1.0.2 XSS via Core Command Expansion (medium 5.1) - [CVE-2023-7317](https://insights.sbomify.com/CVE-2023-7317/): Nagios XI < 2024R1 Web SSH Terminal Missing Access Control (critical 9.4) - [CVE-2023-7316](https://insights.sbomify.com/CVE-2023-7316/): Nagios XI < 2024R1 XSS via Graph Explorer (medium 5.1) - [CVE-2023-7315](https://insights.sbomify.com/CVE-2023-7315/): Nagios XI < 5.11.3 XSS via Graph Explorer (medium 5.1) - [CVE-2023-7314](https://insights.sbomify.com/CVE-2023-7314/): Nagios XI < 5.11.3 XSS via Bandwidth Report (medium 5.1) - [CVE-2023-7313](https://insights.sbomify.com/CVE-2023-7313/): Nagios XI < 5.11.3 XSS via Bulk Modifications (medium 5.1) - [CVE-2023-7312](https://insights.sbomify.com/CVE-2023-7312/): Nagios Fusion < 4.2.0 Email Settings Stored XSS via SMTP/sendmail (medium 6.2) - [CVE-2023-7311](https://insights.sbomify.com/CVE-2023-7311/): BYTEVALUE Intelligent Flow Control Router Command Injection (critical 9.3) - [CVE-2023-7309](https://insights.sbomify.com/CVE-2023-7309/): Dahua Smart Park Integrated Management Platform Front-End Arbitrary File Upload (critical 10.0) - [CVE-2023-7308](https://insights.sbomify.com/CVE-2023-7308/): SecGate3600 Firewall Information Disclosure via authManageSet.cgi (high 8.7) - [CVE-2023-7307](https://insights.sbomify.com/CVE-2023-7307/): Sangfor Behavior Management System XML External Entity Injection (high 8.7) - [CVE-2023-7306](https://insights.sbomify.com/CVE-2023-7306/): Frontend File Manager <= 21.5 - Missing Authorization to Unauthenticated Arbitrary Post Deletion (high 7.5) - [CVE-2023-7305](https://insights.sbomify.com/CVE-2023-7305/): SmartBI RMIServlet Unrestricted File Upload RCE (critical 9.2) - [CVE-2023-7304](https://insights.sbomify.com/CVE-2023-7304/): Ruijie RG-UAC nmc_sync.php Command Injection (critical 9.3) - [CVE-2023-7303](https://insights.sbomify.com/CVE-2023-7303/): q2apro q2apro-on-site-notifications q2apro-onsitenotifications-page.php process_request cross site scripting (medium 5.1) - [CVE-2023-7300](https://insights.sbomify.com/CVE-2023-7300/): Path traversal in HarmonyOS AILife Solution 8.0 (high 8.0) - [CVE-2023-7299](https://insights.sbomify.com/CVE-2023-7299/): DataGear resolveSql sql injection (medium 5.3) - [CVE-2023-7298](https://insights.sbomify.com/CVE-2023-7298/): Out-of-Bounds Write Vulnerability in in Autodesk Desktop Software (medium 4.4) - [CVE-2023-7297](https://insights.sbomify.com/CVE-2023-7297/): TwitterPosts <= 1.0.2 - Settings Update via CSRF (low 3.5) - [CVE-2023-7296](https://insights.sbomify.com/CVE-2023-7296/): BigBlueButton <= 3.0.0-beta.4 - Authenticated (Author+) Stored Cross-Site Scripting (medium 6.4) - [CVE-2023-7295](https://insights.sbomify.com/CVE-2023-7295/): Video Grid <= 1.21 - Reflected Cross-Site Scripting (medium 6.1) - [CVE-2023-7294](https://insights.sbomify.com/CVE-2023-7294/): Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'create_mollie_profile' (high 7.1) - [CVE-2023-7293](https://insights.sbomify.com/CVE-2023-7293/): Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'check_mollie_account_details' (medium 4.3) - [CVE-2023-7292](https://insights.sbomify.com/CVE-2023-7292/): Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'paytium_notice_dismiss' (medium 4.3) - [CVE-2023-7291](https://insights.sbomify.com/CVE-2023-7291/): Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'create_mollie_account' (high 7.1) - [CVE-2023-7290](https://insights.sbomify.com/CVE-2023-7290/): Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'check_for_verified_profiles' (medium 4.3) --- From sbomify Insights: https://insights.sbomify.com/years/2023/page/123/