# Vulnerabilities published in 2023


- [CVE-2023-3097](https://insights.sbomify.com/CVE-2023-3097/): KylinSoft kylin-software-properties setMainSource os command injection (medium 5.3)
- [CVE-2023-30969](https://insights.sbomify.com/CVE-2023-30969/): Palantir Tiles missing authentication on API endpoints (high 8.2)
- [CVE-2023-30968](https://insights.sbomify.com/CVE-2023-30968/): Stored XSS in gaia (medium 6.8)
- [CVE-2023-30967](https://insights.sbomify.com/CVE-2023-30967/): Gotham Orbital Simulator path traversal (critical 9.8)
- [CVE-2023-30963](https://insights.sbomify.com/CVE-2023-30963/): Stored XSS in Foundry Slate Query Dropdown menu (medium 5.4)
- [CVE-2023-30962](https://insights.sbomify.com/CVE-2023-30962/): Stored XSS in cerberus attachments (medium 6.8)
- [CVE-2023-30961](https://insights.sbomify.com/CVE-2023-30961/): Palantir Gotham UI bug that could lead to incorrect data classification (medium 6.5)
- [CVE-2023-30960](https://insights.sbomify.com/CVE-2023-30960/): Insecure Direct Object Reference (IDOR) in Foundry job-tracker (medium 4.3)
- [CVE-2023-3096](https://insights.sbomify.com/CVE-2023-3096/): KylinSoft kylin-software-properties changedSource access control (medium 5.3)
- [CVE-2023-30959](https://insights.sbomify.com/CVE-2023-30959/): Stored XSS via javascript URI in Apollo Change Requests comment (medium 4.1)
- [CVE-2023-30958](https://insights.sbomify.com/CVE-2023-30958/): DOM XSS in Developer mode dashboard via redirect GET parameter (medium 4.7)
- [CVE-2023-30956](https://insights.sbomify.com/CVE-2023-30956/): IDOR in Foundry Comments allows retrieval of attachments (medium 5.3)
- [CVE-2023-30955](https://insights.sbomify.com/CVE-2023-30955/): Foundry workspace-server Developer Mode Authorization Bypass (medium 4.3)
- [CVE-2023-30954](https://insights.sbomify.com/CVE-2023-30954/): Gotham Video Broken Authentication (low 2.7)
- [CVE-2023-30952](https://insights.sbomify.com/CVE-2023-30952/): Foundry Issues reporterPath phishing by parameter injection (medium 5.0)
- [CVE-2023-30951](https://insights.sbomify.com/CVE-2023-30951/): CVE-2023-30951 (medium 6.3)
- [CVE-2023-30950](https://insights.sbomify.com/CVE-2023-30950/): CVE-2023-30950 (medium 6.5)
- [CVE-2023-3095](https://insights.sbomify.com/CVE-2023-3095/): Improper Access Control in nilsteampassnet/teampass (medium 6.2)
- [CVE-2023-30949](https://insights.sbomify.com/CVE-2023-30949/): CVE-2023-30949 (medium 4.3)
- [CVE-2023-30948](https://insights.sbomify.com/CVE-2023-30948/): Retrieval of Attachments to Comments lacks Authorization (medium 6.5)
- [CVE-2023-30946](https://insights.sbomify.com/CVE-2023-30946/): Issues notification metadata lacks authorization (low 3.5)
- [CVE-2023-30945](https://insights.sbomify.com/CVE-2023-30945/): CVE-2023-30945 (critical 9.8)
- [CVE-2023-30944](https://insights.sbomify.com/CVE-2023-30944/): Moodle: minor sql injection risk in external wiki method for listing pages (medium 5.6)
- [CVE-2023-30943](https://insights.sbomify.com/CVE-2023-30943/): Moodle: tinymce loaders susceptible to arbitrary folder creation (medium 6.5)
- [CVE-2023-30942](https://insights.sbomify.com/CVE-2023-30942/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-30941](https://insights.sbomify.com/CVE-2023-30941/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-30940](https://insights.sbomify.com/CVE-2023-30940/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-3094](https://insights.sbomify.com/CVE-2023-3094/): code-projects Agro-School Management System btn_functions.php doUpdateQuestion sql injection (medium 6.3)
- [CVE-2023-30939](https://insights.sbomify.com/CVE-2023-30939/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-30938](https://insights.sbomify.com/CVE-2023-30938/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-30937](https://insights.sbomify.com/CVE-2023-30937/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-30936](https://insights.sbomify.com/CVE-2023-30936/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-30935](https://insights.sbomify.com/CVE-2023-30935/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-30934](https://insights.sbomify.com/CVE-2023-30934/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-30933](https://insights.sbomify.com/CVE-2023-30933/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-30932](https://insights.sbomify.com/CVE-2023-30932/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-30931](https://insights.sbomify.com/CVE-2023-30931/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-30930](https://insights.sbomify.com/CVE-2023-30930/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-3093](https://insights.sbomify.com/CVE-2023-3093/): YaySMTP <= 2.4.5 - Unauthenticated Stored Cross-Site Scripting via Email (high 7.2)
- [CVE-2023-30929](https://insights.sbomify.com/CVE-2023-30929/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (high 7.8)
- [CVE-2023-30928](https://insights.sbomify.com/CVE-2023-30928/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (high 7.8)
- [CVE-2023-30927](https://insights.sbomify.com/CVE-2023-30927/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-30926](https://insights.sbomify.com/CVE-2023-30926/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-30925](https://insights.sbomify.com/CVE-2023-30925/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-30924](https://insights.sbomify.com/CVE-2023-30924/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-30923](https://insights.sbomify.com/CVE-2023-30923/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-30922](https://insights.sbomify.com/CVE-2023-30922/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-30921](https://insights.sbomify.com/CVE-2023-30921/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-30920](https://insights.sbomify.com/CVE-2023-30920/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-3092](https://insights.sbomify.com/CVE-2023-3092/): SMTP Mail <= 1.3.46 - Unauthenticated Stored Cross-Site Scripting via Email Subject (high 7.2)
- [CVE-2023-30919](https://insights.sbomify.com/CVE-2023-30919/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-30918](https://insights.sbomify.com/CVE-2023-30918/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-30917](https://insights.sbomify.com/CVE-2023-30917/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (high 7.8)
- [CVE-2023-30916](https://insights.sbomify.com/CVE-2023-30916/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (high 7.8)
- [CVE-2023-30915](https://insights.sbomify.com/CVE-2023-30915/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-30914](https://insights.sbomify.com/CVE-2023-30914/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-30913](https://insights.sbomify.com/CVE-2023-30913/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-30912](https://insights.sbomify.com/CVE-2023-30912/): Code injection in HPE OneView (high 7.2)
- [CVE-2023-30911](https://insights.sbomify.com/CVE-2023-30911/): Denial of service in HPE Integrated Lights-Out (medium 6.8)
- [CVE-2023-30910](https://insights.sbomify.com/CVE-2023-30910/): Other in HPE MSA Controller (medium 5.4)
- [CVE-2023-3091](https://insights.sbomify.com/CVE-2023-3091/): Captura CRYPTBASE.dll uncontrolled search path (high 7.0)
- [CVE-2023-30909](https://insights.sbomify.com/CVE-2023-30909/): Auth bypass in HPE OneView (critical 9.8)
- [CVE-2023-30908](https://insights.sbomify.com/CVE-2023-30908/): Auth bypass in HPE OneView (critical 9.8)
- [CVE-2023-30906](https://insights.sbomify.com/CVE-2023-30906/): Privilege escalation in HPE Intelligent Provisioning (IP) for Gen9 (high 7.5)
- [CVE-2023-30905](https://insights.sbomify.com/CVE-2023-30905/): Misconfiguration in HPE MC990 X RMC firmware (high 7.8)
- [CVE-2023-30904](https://insights.sbomify.com/CVE-2023-30904/): Hardcoded credentials in HPE Insight Remote Support (medium 5.5)
- [CVE-2023-30903](https://insights.sbomify.com/CVE-2023-30903/): Denial of service in HP-UX (medium 5.5)
- [CVE-2023-30902](https://insights.sbomify.com/CVE-2023-30902/): Privilege escalation in Trend Micro Apex One (medium 5.5)
- [CVE-2023-30901](https://insights.sbomify.com/CVE-2023-30901/): Cross-site request forgery in SICAM P850 (medium 4.3)
- [CVE-2023-30900](https://insights.sbomify.com/CVE-2023-30900/): Memory corruption in Xpedition Layout Browser (high 7.8)
- [CVE-2023-3090](https://insights.sbomify.com/CVE-2023-3090/): Out-of-bounds write in Linux kernel's ipvlan network driver (high 7.8)
- [CVE-2023-30899](https://insights.sbomify.com/CVE-2023-30899/): Deserialization in Siveillance Video 2020 R2 (critical 9.9)
- [CVE-2023-30898](https://insights.sbomify.com/CVE-2023-30898/): Deserialization in Siveillance Video 2020 R2 (critical 9.9)
- [CVE-2023-30897](https://insights.sbomify.com/CVE-2023-30897/): Misconfiguration in SIMATIC WinCC (high 7.8)
- [CVE-2023-3089](https://insights.sbomify.com/CVE-2023-3089/): Ocp & fips mode (high 7.0)
- [CVE-2023-3088](https://insights.sbomify.com/CVE-2023-3088/): WP Mail Log <= 1.1.1 - Unauthenticated Stored Cross-Site Scripting via Email (high 7.2)
- [CVE-2023-30877](https://insights.sbomify.com/CVE-2023-30877/): WordPress XML for Google Merchant Center Plugin <= 3.0.1 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-30876](https://insights.sbomify.com/CVE-2023-30876/): WordPress Dave's WordPress Live Search Plugin <= 4.8.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-30875](https://insights.sbomify.com/CVE-2023-30875/): WordPress Logo Scheduler Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-30874](https://insights.sbomify.com/CVE-2023-30874/): WordPress GPS Plotter Plugin <= 5.1.4 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-30873](https://insights.sbomify.com/CVE-2023-30873/): WordPress WP Docs plugin <= 1.9.8 - Broken Access Control (medium 5.4)
- [CVE-2023-30872](https://insights.sbomify.com/CVE-2023-30872/): WordPress BSK Forms Blacklist Plugin <= 3.6.2 is vulnerable to SQL Injection (high 7.6)
- [CVE-2023-30871](https://insights.sbomify.com/CVE-2023-30871/): WordPress Stock Exporter for WooCommerce Plugin <= 1.1.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-30870](https://insights.sbomify.com/CVE-2023-30870/): Missing authorization in Sharkdropship for AliExpress Dropship and Affiliate (medium 6.5)
- [CVE-2023-3087](https://insights.sbomify.com/CVE-2023-3087/): FluentSMTP <= 2.2.4 - Unauthenticated Stored Cross-Site Scripting via Email Subject (high 7.2)
- [CVE-2023-30869](https://insights.sbomify.com/CVE-2023-30869/): WordPress Easy Digital Downloads Plugin 3.1-3.1.1.4.1 is vulnerable to Privilege Escalation (critical 9.8)
- [CVE-2023-30868](https://insights.sbomify.com/CVE-2023-30868/): WordPress CMS Tree Page View Plugin <= 1.6.7 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-30867](https://insights.sbomify.com/CVE-2023-30867/): Apache StreamPark (incubating): Authenticated system users could trigger SQL injection vulnerability (medium 4.9)
- [CVE-2023-30866](https://insights.sbomify.com/CVE-2023-30866/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-30865](https://insights.sbomify.com/CVE-2023-30865/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-30864](https://insights.sbomify.com/CVE-2023-30864/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (high 7.8)
- [CVE-2023-30863](https://insights.sbomify.com/CVE-2023-30863/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (high 7.8)
- [CVE-2023-30861](https://insights.sbomify.com/CVE-2023-30861/): Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header (high 7.5)
- [CVE-2023-30860](https://insights.sbomify.com/CVE-2023-30860/): WWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's account (high 8.0)
- [CVE-2023-3086](https://insights.sbomify.com/CVE-2023-3086/): Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass (critical 9.0)
- [CVE-2023-30859](https://insights.sbomify.com/CVE-2023-30859/): Spigot Command Exploit in Triton (high 7.2)
- [CVE-2023-30858](https://insights.sbomify.com/CVE-2023-30858/): Denosaurs emoji has ReDoS vulnerability in `replace` function (medium 5.3)
- [CVE-2023-30857](https://insights.sbomify.com/CVE-2023-30857/): @aedart/support possibly vulnerable to prototype pollution in metadata record, when using meta decorator (low 3.7)
- [CVE-2023-30856](https://insights.sbomify.com/CVE-2023-30856/): eDEX-UI cross-site websocket hijacking vulnerability enables remote command execution (high 8.3)
- [CVE-2023-30855](https://insights.sbomify.com/CVE-2023-30855/): Pimcore Path Traversal Vulnerability in AdminBundle/Controller/Reports/CustomReportController.php (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/321/