# Vulnerabilities published in 2023


- [CVE-2023-31191](https://insights.sbomify.com/CVE-2023-31191/): Denial of Service due to loss of information in DroneScout ds230 Remote ID receiver from BlueMark Innovations (critical 9.3)
- [CVE-2023-31190](https://insights.sbomify.com/CVE-2023-31190/): Security feature bypass in ds230 (high 8.1)
- [CVE-2023-3119](https://insights.sbomify.com/CVE-2023-3119/): SourceCodester Service Provider Management System view.php sql injection (medium 6.3)
- [CVE-2023-31189](https://insights.sbomify.com/CVE-2023-31189/): Auth bypass in Intel(R) Server Product OpenBMC firmware (medium 5.2)
- [CVE-2023-31188](https://insights.sbomify.com/CVE-2023-31188/): Command injection in Archer C20 (high 8.0)
- [CVE-2023-31187](https://insights.sbomify.com/CVE-2023-31187/): Avaya IX Workforce Engagement - CWE-522: Insufficiently Protected Credentials (medium 6.5)
- [CVE-2023-31186](https://insights.sbomify.com/CVE-2023-31186/): Avaya IX Workforce Engagement - User Enumeration - CWE-204: Observable Response Discrepancy (medium 5.3)
- [CVE-2023-31185](https://insights.sbomify.com/CVE-2023-31185/): ROZCOM server framework (high 7.5)
- [CVE-2023-31184](https://insights.sbomify.com/CVE-2023-31184/): ROZCOM client (medium 6.2)
- [CVE-2023-31183](https://insights.sbomify.com/CVE-2023-31183/): Cybonet PineApp Mail Secure RXSS vulnerability (medium 6.1)
- [CVE-2023-31182](https://insights.sbomify.com/CVE-2023-31182/): EasyTor Applications – Authorization Bypass (high 8.1)
- [CVE-2023-31181](https://insights.sbomify.com/CVE-2023-31181/): WJJ Software - InnoKB Server, InnoKB/Console 2.2.1 - CWE-22: Path Traversal (high 7.5)
- [CVE-2023-31180](https://insights.sbomify.com/CVE-2023-31180/): WJJ Software - InnoKB Server, InnoKB/Console 2.2.1 - Reflected cross-site scripting (RXSS) (medium 6.1)
- [CVE-2023-3118](https://insights.sbomify.com/CVE-2023-3118/): Export All URLs < 4.6 - Reflected XSS (medium 6.1)
- [CVE-2023-31179](https://insights.sbomify.com/CVE-2023-31179/): AgilePoint NX v8.0 SU2.2 & SU2.3 - Path traversal (medium 6.5)
- [CVE-2023-31178](https://insights.sbomify.com/CVE-2023-31178/): AgilePoint NX v8.0 SU2.2 & SU2.3 – Arbitrary File Delete (high 8.1)
- [CVE-2023-31177](https://insights.sbomify.com/CVE-2023-31177/): Improper neutralizataion of input could lead to execution of arbitrary code (medium 4.3)
- [CVE-2023-31176](https://insights.sbomify.com/CVE-2023-31176/): Insufficient entropy vulnerability could lead to authentication bypass (high 7.5)
- [CVE-2023-31175](https://insights.sbomify.com/CVE-2023-31175/): Execution with Unnecessary Privileges (high 8.8)
- [CVE-2023-31174](https://insights.sbomify.com/CVE-2023-31174/): Cross-Site Request Forgery (CSRF) (high 7.4)
- [CVE-2023-31173](https://insights.sbomify.com/CVE-2023-31173/): Use of Hard-coded Credentials (high 7.7)
- [CVE-2023-31172](https://insights.sbomify.com/CVE-2023-31172/): Incomplete Filtering of Special Elements (medium 5.9)
- [CVE-2023-31171](https://insights.sbomify.com/CVE-2023-31171/): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (medium 5.9)
- [CVE-2023-31170](https://insights.sbomify.com/CVE-2023-31170/): Inclusion of Functionality from Untrusted Control Sphere (medium 5.9)
- [CVE-2023-31169](https://insights.sbomify.com/CVE-2023-31169/): Improper Handling of Unicode Encoding (medium 4.8)
- [CVE-2023-31168](https://insights.sbomify.com/CVE-2023-31168/): Inclusion of Functionality from Untrusted Control Sphere (medium 5.5)
- [CVE-2023-31167](https://insights.sbomify.com/CVE-2023-31167/): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (medium 5.0)
- [CVE-2023-31166](https://insights.sbomify.com/CVE-2023-31166/): Improper Limitation of a Pathname to a Restricted Directory (medium 4.1)
- [CVE-2023-31165](https://insights.sbomify.com/CVE-2023-31165/): Improper Neutralization of Input During Web Page Generation (medium 4.3)
- [CVE-2023-31164](https://insights.sbomify.com/CVE-2023-31164/): Improper Neutralization of Input During Web Page Generation (medium 4.3)
- [CVE-2023-31163](https://insights.sbomify.com/CVE-2023-31163/): Improper Neutralization of Input During Web Page Generation (medium 4.3)
- [CVE-2023-31162](https://insights.sbomify.com/CVE-2023-31162/): Improper Input Validation in Web Interface (medium 4.8)
- [CVE-2023-31161](https://insights.sbomify.com/CVE-2023-31161/): Improper Input Validation in Web Interface (medium 5.9)
- [CVE-2023-31160](https://insights.sbomify.com/CVE-2023-31160/): Improper Neutralization of Input During Web Page Generation (medium 4.3)
- [CVE-2023-3116](https://insights.sbomify.com/CVE-2023-3116/): Liteos-A has a incorrect default permissions vulnerability (high 7.3)
- [CVE-2023-31159](https://insights.sbomify.com/CVE-2023-31159/): Improper Neutralization of Input During Web Page Generation (medium 4.3)
- [CVE-2023-31158](https://insights.sbomify.com/CVE-2023-31158/): Improper Neutralization of Input During Web Page Generation (medium 4.3)
- [CVE-2023-31157](https://insights.sbomify.com/CVE-2023-31157/): Improper Neutralization of Input During Web Page Generation (medium 4.3)
- [CVE-2023-31156](https://insights.sbomify.com/CVE-2023-31156/): Improper Neutralization of Input During Web Page Generation (medium 4.3)
- [CVE-2023-31155](https://insights.sbomify.com/CVE-2023-31155/): Improper Neutralization of Input During Web Page Generation (medium 4.3)
- [CVE-2023-31154](https://insights.sbomify.com/CVE-2023-31154/): Improper Neutralization of Input During Web Page Generation (medium 4.3)
- [CVE-2023-31153](https://insights.sbomify.com/CVE-2023-31153/): Improper Neutralization of Input During Web Page Generation (medium 4.3)
- [CVE-2023-31152](https://insights.sbomify.com/CVE-2023-31152/): Authentication Bypass Using an Alternate Path or Channel (medium 4.0)
- [CVE-2023-31151](https://insights.sbomify.com/CVE-2023-31151/): Improper Certificate Validation (medium 4.7)
- [CVE-2023-31150](https://insights.sbomify.com/CVE-2023-31150/): Storing Passwords in a Recoverable Format (high 8.0)
- [CVE-2023-3115](https://insights.sbomify.com/CVE-2023-3115/): Incorrect User Management in GitLab (medium 5.4)
- [CVE-2023-31149](https://insights.sbomify.com/CVE-2023-31149/): Improper Input Validation in Web Interface (critical 9.1)
- [CVE-2023-31148](https://insights.sbomify.com/CVE-2023-31148/): Improper Input Validation in Web Interface (critical 9.1)
- [CVE-2023-31147](https://insights.sbomify.com/CVE-2023-31147/): Insufficient randomness in generation of DNS query IDs in c-ares (medium 5.9)
- [CVE-2023-31146](https://insights.sbomify.com/CVE-2023-31146/): Vyper vulnerable to OOB DynArray access when array is on both LHS and RHS of an assignment (high 7.5)
- [CVE-2023-31145](https://insights.sbomify.com/CVE-2023-31145/): Reflected XSS vulnerability in CollaboraOnline (medium 4.3)
- [CVE-2023-31144](https://insights.sbomify.com/CVE-2023-31144/): Craft CMS vulnerable to cross site scripting in RSS feed widget (medium 6.1)
- [CVE-2023-31143](https://insights.sbomify.com/CVE-2023-31143/): Mage terminal user authentication not working properly (medium 5.9)
- [CVE-2023-31142](https://insights.sbomify.com/CVE-2023-31142/): Discourse's general category permissions could be set back to default (low 2.0)
- [CVE-2023-31141](https://insights.sbomify.com/CVE-2023-31141/): OpenSearch issue with fine-grained access control during extremely rare race conditions (medium 4.8)
- [CVE-2023-31140](https://insights.sbomify.com/CVE-2023-31140/): OpenProject user sessions not terminated after activation of 2FA (medium 4.8)
- [CVE-2023-3114](https://insights.sbomify.com/CVE-2023-3114/): Terraform Enterprise Agent Pool Controls Allowed Unauthorized Workspaces To Target an Agent Pool (medium 5.0)
- [CVE-2023-31139](https://insights.sbomify.com/CVE-2023-31139/): DHIS2 Core unrestricted session cookies with Personal Access Tokens (medium 4.3)
- [CVE-2023-31138](https://insights.sbomify.com/CVE-2023-31138/): DHIS2 Core vulnerable to Improper Access Control with PATCH requests (high 7.1)
- [CVE-2023-31137](https://insights.sbomify.com/CVE-2023-31137/): MaraDNS Integer Underflow Vulnerability in DNS Packet Decompression (high 7.5)
- [CVE-2023-31136](https://insights.sbomify.com/CVE-2023-31136/): PostgresNIO processes unencrypted bytes from man-in-the-middle (low 3.7)
- [CVE-2023-31135](https://insights.sbomify.com/CVE-2023-31135/): Dgraph Audit Log Encryption nonce reuse (low 3.3)
- [CVE-2023-31134](https://insights.sbomify.com/CVE-2023-31134/): Tauri Open Redirect Vulnerability Possibly Exposes IPC to External Sites (medium 4.8)
- [CVE-2023-31133](https://insights.sbomify.com/CVE-2023-31133/): Ghost vulnerable to disclosure of private API fields (high 7.5)
- [CVE-2023-31132](https://insights.sbomify.com/CVE-2023-31132/): Cacti Privilege Escalation (high 7.8)
- [CVE-2023-31131](https://insights.sbomify.com/CVE-2023-31131/): Arbitrary File Write when Extracting Tarballs in greenplum-db (high 7.4)
- [CVE-2023-31130](https://insights.sbomify.com/CVE-2023-31130/): Buffer Underwrite in ares_inet_net_pton() (medium 4.1)
- [CVE-2023-3113](https://insights.sbomify.com/CVE-2023-3113/): XML external entity in Lenovo XClarity Administrator (high 8.2)
- [CVE-2023-31129](https://insights.sbomify.com/CVE-2023-31129/): Contiki-NG missing NULL pointer check in IPv6 neighbor discovery (high 7.5)
- [CVE-2023-31128](https://insights.sbomify.com/CVE-2023-31128/): NextCloud Cookbook's pull-checks.yml workflow is vulnerable to OS Command Injection (high 8.1)
- [CVE-2023-31127](https://insights.sbomify.com/CVE-2023-31127/): DMTF-2023-0001: SPDM mutual authentication bypass (critical 9.1)
- [CVE-2023-31126](https://insights.sbomify.com/CVE-2023-31126/): Improper Neutralization of Invalid Characters in Data Attribute Names in org.xwiki.commons:xwiki-commons-xml (critical 9.1)
- [CVE-2023-31125](https://insights.sbomify.com/CVE-2023-31125/): Uncaught exception in engine.io (medium 6.5)
- [CVE-2023-31124](https://insights.sbomify.com/CVE-2023-31124/): AutoTools does not set CARES_RANDOM_FILE during cross compilation (low 3.7)
- [CVE-2023-31123](https://insights.sbomify.com/CVE-2023-31123/): effectindex/tripreporter vulnerable to improper password verification on POST `/api/v1/account/login` (critical 9.1)
- [CVE-2023-31122](https://insights.sbomify.com/CVE-2023-31122/): Apache HTTP Server: mod_macro buffer over-read (high 7.5)
- [CVE-2023-3112](https://insights.sbomify.com/CVE-2023-3112/): Privilege escalation in AI Virtual Presence Sensor (high 7.8)
- [CVE-2023-31116](https://insights.sbomify.com/CVE-2023-31116/): Misconfiguration in samsung:exynos 5123 firmware (critical 9.8)
- [CVE-2023-31115](https://insights.sbomify.com/CVE-2023-31115/): Other in samsung:exynos 5123 firmware (high 7.5)
- [CVE-2023-31114](https://insights.sbomify.com/CVE-2023-31114/): Information disclosure in samsung:exynos 5123 firmware (critical 9.1)
- [CVE-2023-3111](https://insights.sbomify.com/CVE-2023-3111/): Use after free in Kernel (high 7.8)
- [CVE-2023-31103](https://insights.sbomify.com/CVE-2023-31103/): Apache InLong: Attackers can change the immutable name and type of cluster (high 7.5)
- [CVE-2023-31102](https://insights.sbomify.com/CVE-2023-31102/): Integer overflow in 7-zip:7-zip (high 7.8)
- [CVE-2023-31101](https://insights.sbomify.com/CVE-2023-31101/): Apache InLong: Users who joined later can see the data of deleted users (medium 6.5)
- [CVE-2023-31100](https://insights.sbomify.com/CVE-2023-31100/): Missing authorization in SecureCore™ Technology™ 4 (high 8.4)
- [CVE-2023-3110](https://insights.sbomify.com/CVE-2023-3110/): Buffer overflow in S0 Decryption on Unify Gateway (critical 9.6)
- [CVE-2023-31099](https://insights.sbomify.com/CVE-2023-31099/): Code injection in zohocorp:manageengine opmanager (high 8.8)
- [CVE-2023-31098](https://insights.sbomify.com/CVE-2023-31098/): Apache InLong: Weak Password Implementation in InLong (critical 9.8)
- [CVE-2023-31096](https://insights.sbomify.com/CVE-2023-31096/): Memory corruption in broadcom:lsi pci-sv92ex firmware (high 7.8)
- [CVE-2023-31095](https://insights.sbomify.com/CVE-2023-31095/): WordPress Integration for Contact Form 7 HubSpot Plugin <= 1.2.8 is vulnerable to Open Redirection (medium 4.7)
- [CVE-2023-31094](https://insights.sbomify.com/CVE-2023-31094/): WordPress Stock Sync for WooCommerce Plugin <= 2.4.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-31093](https://insights.sbomify.com/CVE-2023-31093/): WordPress Chronosly Events Calendar Plugin <= 2.6.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-31092](https://insights.sbomify.com/CVE-2023-31092/): WordPress Easy Bet Plugin <= 1.0.2 is vulnerable to SQL Injection (medium 5.5)
- [CVE-2023-31091](https://insights.sbomify.com/CVE-2023-31091/): WordPress Dynamically Register Sidebars Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-31090](https://insights.sbomify.com/CVE-2023-31090/): WordPress Unlimited Elements For Elementor plugin <= 1.5.60 - Unrestricted Zip Extraction vulnerability (critical 9.9)
- [CVE-2023-3109](https://insights.sbomify.com/CVE-2023-3109/): Cross-site Scripting (XSS) - Stored in admidio/admidio (medium 6.3)
- [CVE-2023-31089](https://insights.sbomify.com/CVE-2023-31089/): WordPress Video XML Sitemap Generator Plugin <= 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2023-31088](https://insights.sbomify.com/CVE-2023-31088/): WordPress Floating Action Button Plugin <=1.2.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-31087](https://insights.sbomify.com/CVE-2023-31087/): WordPress JS Job Manager Plugin <=2.0.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2023-31086](https://insights.sbomify.com/CVE-2023-31086/): WordPress Simple Giveaways Plugin <= 2.46.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/319/