# Vulnerabilities published in 2023


- [CVE-2023-31315](https://insights.sbomify.com/CVE-2023-31315/): Privilege escalation in 1st Gen AMD EPYC™ Processors (high 7.5)
- [CVE-2023-31313](https://insights.sbomify.com/CVE-2023-31313/): Other in AMD Instinct™ MI210 (high 7.2)
- [CVE-2023-31310](https://insights.sbomify.com/CVE-2023-31310/): Other in AMD Radeon™ PRO W6000 Series Graphics Cards (medium 5.0)
- [CVE-2023-3131](https://insights.sbomify.com/CVE-2023-3131/): MStore API < 3.9.7 - Subscriber+ Unauthorized Settings Update (medium 4.3)
- [CVE-2023-31309](https://insights.sbomify.com/CVE-2023-31309/): Other in AMD Radeon™ PRO V520 (medium 6.8)
- [CVE-2023-31308](https://insights.sbomify.com/CVE-2023-31308/): Memory corruption in AMD Radeon™ PRO V620 Graphics Products (low 3.3)
- [CVE-2023-31307](https://insights.sbomify.com/CVE-2023-31307/): Memory corruption in AMD Radeon™ PRO W6000 Series Graphics Cards (low 2.3)
- [CVE-2023-31306](https://insights.sbomify.com/CVE-2023-31306/): Memory corruption in AMD Radeon™ PRO V520 Graphics Products (low 3.3)
- [CVE-2023-31305](https://insights.sbomify.com/CVE-2023-31305/): Weak cryptography in AMD Radeon™ PRO W6000 Series Graphics Cards (low 1.9)
- [CVE-2023-31304](https://insights.sbomify.com/CVE-2023-31304/): Other in AMD Radeon™ PRO W6000 Series Graphics Cards (low 2.3)
- [CVE-2023-31302](https://insights.sbomify.com/CVE-2023-31302/): Cross-site scripting in sesami:cash point \& transport optimizer (medium 6.1)
- [CVE-2023-31301](https://insights.sbomify.com/CVE-2023-31301/): Cross-site scripting in sesami:cash point \& transport optimizer (medium 6.1)
- [CVE-2023-31300](https://insights.sbomify.com/CVE-2023-31300/): Information disclosure in sesami:cash point \& transport optimizer (high 7.5)
- [CVE-2023-3130](https://insights.sbomify.com/CVE-2023-3130/): Short URL < 1.6.5 - Admin+ Cross Site Scripting (medium 4.8)
- [CVE-2023-31299](https://insights.sbomify.com/CVE-2023-31299/): Cross-site scripting in sesami:cash point \& transport optimizer (medium 6.1)
- [CVE-2023-31298](https://insights.sbomify.com/CVE-2023-31298/): Cross-site scripting in sesami:cash point \& transport optimizer (medium 4.8)
- [CVE-2023-31297](https://insights.sbomify.com/CVE-2023-31297/): Cross-site scripting in sesami:cash point \& transport optimizer (medium 4.8)
- [CVE-2023-31296](https://insights.sbomify.com/CVE-2023-31296/): Code injection in sesami:cash point \& transport optimizer (medium 5.3)
- [CVE-2023-31295](https://insights.sbomify.com/CVE-2023-31295/): Code injection in sesami:cash point \& transport optimizer (high 7.5)
- [CVE-2023-31294](https://insights.sbomify.com/CVE-2023-31294/): Code injection in sesami:cash point \& transport optimizer (high 7.5)
- [CVE-2023-31293](https://insights.sbomify.com/CVE-2023-31293/): Missing authorization in sesami:cash point \& transport optimizer (medium 4.3)
- [CVE-2023-31292](https://insights.sbomify.com/CVE-2023-31292/): Auth bypass in sesami:cash point \& transport optimizer (medium 5.5)
- [CVE-2023-31290](https://insights.sbomify.com/CVE-2023-31290/): Weak cryptography in trustwallet:trust wallet browser extension (medium 5.9)
- [CVE-2023-3129](https://insights.sbomify.com/CVE-2023-3129/): URL Shortify < 1.7.0 - Admin+ Cross Site Scripting (medium 4.8)
- [CVE-2023-31289](https://insights.sbomify.com/CVE-2023-31289/): Denial of service in pexip:pexip infinity (high 7.5)
- [CVE-2023-31287](https://insights.sbomify.com/CVE-2023-31287/): Insufficient token expiration in Serenity (high 7.8)
- [CVE-2023-31286](https://insights.sbomify.com/CVE-2023-31286/): User account enumeration in Serenity (medium 5.3)
- [CVE-2023-31285](https://insights.sbomify.com/CVE-2023-31285/): Cross Site Scripting (XSS) in Serenity (medium 6.1)
- [CVE-2023-31284](https://insights.sbomify.com/CVE-2023-31284/): Memory corruption in illumos:illumos-gate (high 7.8)
- [CVE-2023-31280](https://insights.sbomify.com/CVE-2023-31280/): Exposure of Sensitive Information to an Unauthorized Actor (medium 5.3)
- [CVE-2023-3128](https://insights.sbomify.com/CVE-2023-3128/): Grafana vulnerable to Authentication Bypass by Spoofing (critical 9.4)
- [CVE-2023-31279](https://insights.sbomify.com/CVE-2023-31279/): Improper Authentication (high 8.1)
- [CVE-2023-31278](https://insights.sbomify.com/CVE-2023-31278/): Horner Automation Cscape Out-of-bounds Read (high 7.8)
- [CVE-2023-31277](https://insights.sbomify.com/CVE-2023-31277/): PiiGAB M-Bus Unprotected Transport of Credentials (high 7.5)
- [CVE-2023-31276](https://insights.sbomify.com/CVE-2023-31276/): Memory corruption in Intel(R) Server Board S2600WF, Intel(R) Server Board S2600ST, Intel(R) Server Board S2600BP, Intel(R) Server Board M50CYP and Intel(R) Server Board D50TNP (high 8.4)
- [CVE-2023-31275](https://insights.sbomify.com/CVE-2023-31275/): Memory corruption in WPS Office (high 8.8)
- [CVE-2023-31274](https://insights.sbomify.com/CVE-2023-31274/): Missing Release of Resource after Effective Lifetime vulnerability in Aveva PI Server (medium 5.3)
- [CVE-2023-31273](https://insights.sbomify.com/CVE-2023-31273/): Privilege escalation in Intel DCM software (critical 10.0)
- [CVE-2023-31272](https://insights.sbomify.com/CVE-2023-31272/): Memory corruption in YF325 (high 8.8)
- [CVE-2023-31271](https://insights.sbomify.com/CVE-2023-31271/): Privilege escalation in Intel(R) VROC software (medium 6.7)
- [CVE-2023-3127](https://insights.sbomify.com/CVE-2023-3127/): Improper Authentication in iSTAR (high 7.5)
- [CVE-2023-3126](https://insights.sbomify.com/CVE-2023-3126/): B2BKing <= 4.6.00 - Missing Authorization to Authenticated(Subscriber+) Information Disclosure (medium 4.3)
- [CVE-2023-31250](https://insights.sbomify.com/CVE-2023-31250/): Drupal core - Moderately critical - Access bypass - SA-CORE-2023-005 (medium 6.5)
- [CVE-2023-3125](https://insights.sbomify.com/CVE-2023-3125/): B2BKing <= 4.6.00 - Missing Authorization to Authenticated(Subscriber+) Price Modification (medium 6.5)
- [CVE-2023-31248](https://insights.sbomify.com/CVE-2023-31248/): Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2023-31247](https://insights.sbomify.com/CVE-2023-31247/): Memory corruption in Cesium NET (critical 9.0)
- [CVE-2023-31246](https://insights.sbomify.com/CVE-2023-31246/): Misconfiguration in Intel(R) SDP Tool software (medium 6.7)
- [CVE-2023-31245](https://insights.sbomify.com/CVE-2023-31245/): Open redirect in OvrC Cloud (high 7.1)
- [CVE-2023-31244](https://insights.sbomify.com/CVE-2023-31244/): Memory corruption in Cscape (high 7.8)
- [CVE-2023-31242](https://insights.sbomify.com/CVE-2023-31242/): Auth bypass in OAS Platform (high 8.1)
- [CVE-2023-31241](https://insights.sbomify.com/CVE-2023-31241/): Auth bypass in OvrC Cloud (high 8.6)
- [CVE-2023-31240](https://insights.sbomify.com/CVE-2023-31240/): Hardcoded credentials in OvrC Cloud (high 8.3)
- [CVE-2023-3124](https://insights.sbomify.com/CVE-2023-3124/): Elementor Pro <= 3.11.6 - Authenticated(Subscriber+) Privilege Escalation via update_page_option (high 8.8)
- [CVE-2023-31239](https://insights.sbomify.com/CVE-2023-31239/): Memory corruption in V-Server and V-Server Lite (high 7.8)
- [CVE-2023-31238](https://insights.sbomify.com/CVE-2023-31238/): Misconfiguration in SICAM P850 (medium 5.5)
- [CVE-2023-31237](https://insights.sbomify.com/CVE-2023-31237/): WordPress Zephyr Project Manager Plugin <= 3.3.9 is vulnerable to Open Redirection (medium 4.7)
- [CVE-2023-31236](https://insights.sbomify.com/CVE-2023-31236/): WordPress Scripts n Styles Plugin <= 3.5.7 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-31235](https://insights.sbomify.com/CVE-2023-31235/): WordPress Participants Database Plugin <= 2.4.9 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-31234](https://insights.sbomify.com/CVE-2023-31234/): WordPress Tilda Publishing plugin <= 0.3.23 - Broken Access Control vulnerability (medium 6.3)
- [CVE-2023-31233](https://insights.sbomify.com/CVE-2023-31233/): WordPress Baidu Tongji generator Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-31232](https://insights.sbomify.com/CVE-2023-31232/): WordPress Plugins List Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-31231](https://insights.sbomify.com/CVE-2023-31231/): File upload in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) (critical 9.9)
- [CVE-2023-31230](https://insights.sbomify.com/CVE-2023-31230/): WordPress Baidu Tongji generator Plugin <= 1.0.2 is vulnerable to Cross Site Request Forgery (CSRF) (high 7.1)
- [CVE-2023-31229](https://insights.sbomify.com/CVE-2023-31229/): WordPress WP Directory Kit Plugin <= 1.1.9 is vulnerable to Open Redirection (medium 4.7)
- [CVE-2023-31228](https://insights.sbomify.com/CVE-2023-31228/): WordPress CM On Demand Search And Replace Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-31227](https://insights.sbomify.com/CVE-2023-31227/): Missing authorization in EMUI (high 7.5)
- [CVE-2023-31226](https://insights.sbomify.com/CVE-2023-31226/): Missing authorization in EMUI (high 7.5)
- [CVE-2023-31225](https://insights.sbomify.com/CVE-2023-31225/): Race condition in EMUI (low 3.3)
- [CVE-2023-31224](https://insights.sbomify.com/CVE-2023-31224/): Auth bypass in jamf:jamf (critical 9.8)
- [CVE-2023-31223](https://insights.sbomify.com/CVE-2023-31223/): Cross-site scripting in dradisframework:dradis (high 8.7)
- [CVE-2023-31222](https://insights.sbomify.com/CVE-2023-31222/): Medtronic Paceart MSMQ Deserialization of Untrusted Data (critical 9.8)
- [CVE-2023-31221](https://insights.sbomify.com/CVE-2023-31221/): WordPress PDQ CSV Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-31220](https://insights.sbomify.com/CVE-2023-31220/): WordPress WP Categories Widget Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-3122](https://insights.sbomify.com/CVE-2023-3122/): GD Mail Queue <= 3.9.3 - Unauthenticated Stored Cross-Site Scripting via Email (high 7.2)
- [CVE-2023-31219](https://insights.sbomify.com/CVE-2023-31219/): WordPress Download Monitor Plugin <= 4.8.1 is vulnerable to Server Side Request Forgery (SSRF) (medium 4.1)
- [CVE-2023-31218](https://insights.sbomify.com/CVE-2023-31218/): WordPress WOLF Plugin <= 1.0.6 is vulnerable to CSRF leading to Stored Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2023-31217](https://insights.sbomify.com/CVE-2023-31217/): WordPress User Location and IP Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-31216](https://insights.sbomify.com/CVE-2023-31216/): WordPress Ultimate Member Plugin <= 2.6.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-31215](https://insights.sbomify.com/CVE-2023-31215/): WordPress Dropshipping & Affiliation with Amazon Plugin <= 2.1.2 is vulnerable to Arbitrary File Upload (critical 9.9)
- [CVE-2023-31214](https://insights.sbomify.com/CVE-2023-31214/): WordPress WP Quick Post Duplicator plugin <= 2.0 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2023-31213](https://insights.sbomify.com/CVE-2023-31213/): WordPress WPBakery Page Builder Plugin < 6.13.0 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-31212](https://insights.sbomify.com/CVE-2023-31212/): WordPress Contact Form Entries Plugin <= 1.3.0 is vulnerable to SQL Injection (high 8.5)
- [CVE-2023-31211](https://insights.sbomify.com/CVE-2023-31211/): Disabled automation users could still authenticate (high 8.8)
- [CVE-2023-31210](https://insights.sbomify.com/CVE-2023-31210/): Privilege escalation in agent via LD_LIBRARY_PATH (high 8.8)
- [CVE-2023-3121](https://insights.sbomify.com/CVE-2023-3121/): Dahua Smart Parking Management image server-side request forgery (low 3.5)
- [CVE-2023-31209](https://insights.sbomify.com/CVE-2023-31209/): Command injection via active checks and REST API (high 8.8)
- [CVE-2023-31208](https://insights.sbomify.com/CVE-2023-31208/): Livestatus command injection in RestAPI (high 8.3)
- [CVE-2023-31207](https://insights.sbomify.com/CVE-2023-31207/): Automation user secret logged to Apache access log (medium 4.4)
- [CVE-2023-31206](https://insights.sbomify.com/CVE-2023-31206/): Apache InLong: Attackers can change the immutable name and type of nodes (high 7.5)
- [CVE-2023-31203](https://insights.sbomify.com/CVE-2023-31203/): Denial of service in OpenVINO Model Server software (medium 4.3)
- [CVE-2023-31200](https://insights.sbomify.com/CVE-2023-31200/): PTC Vuforia Studio Cross-Site Request Forgery (medium 5.7)
- [CVE-2023-3120](https://insights.sbomify.com/CVE-2023-3120/): SourceCodester Service Provider Management System view_service.php sql injection (medium 6.3)
- [CVE-2023-31199](https://insights.sbomify.com/CVE-2023-31199/): Privilege escalation in Intel(R) Solid State Drive Toolbox(TM) (high 7.1)
- [CVE-2023-31198](https://insights.sbomify.com/CVE-2023-31198/): Command injection in Wi-Fi AP UNIT (high 7.2)
- [CVE-2023-31197](https://insights.sbomify.com/CVE-2023-31197/): Privilege escalation in Intel(R) Trace Analyzer and Collector (medium 6.7)
- [CVE-2023-31196](https://insights.sbomify.com/CVE-2023-31196/): Missing authorization in Wi-Fi AP UNIT (high 7.5)
- [CVE-2023-31195](https://insights.sbomify.com/CVE-2023-31195/): Information disclosure in ASUS Router RT-AX3000 (medium 5.3)
- [CVE-2023-31194](https://insights.sbomify.com/CVE-2023-31194/): Memory corruption in Diagon (medium 5.3)
- [CVE-2023-31193](https://insights.sbomify.com/CVE-2023-31193/): Weak cryptography in OvrC Cloud (high 7.5)
- [CVE-2023-31192](https://insights.sbomify.com/CVE-2023-31192/): Information disclosure in SoftEther VPN (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/318/