# Vulnerabilities published in 2023


- [CVE-2023-30854](https://insights.sbomify.com/CVE-2023-30854/): WWBN AVideo vulnerable to OS Command Injection (high 8.8)
- [CVE-2023-30853](https://insights.sbomify.com/CVE-2023-30853/): Gradle Build Action data written to GitHub Actions Cache may expose secrets (high 7.6)
- [CVE-2023-30852](https://insights.sbomify.com/CVE-2023-30852/): Pimcore Arbitrary File Read in Admin JS CSS files (medium 4.4)
- [CVE-2023-30851](https://insights.sbomify.com/CVE-2023-30851/): Potential HTTP policy bypass when using header rules in Cilium (low 2.6)
- [CVE-2023-30850](https://insights.sbomify.com/CVE-2023-30850/): Pimcore SQL Injection Vulnerability in Admin Translations API (high 8.8)
- [CVE-2023-3085](https://insights.sbomify.com/CVE-2023-3085/): X-WRT luci 404 Error Template dispatcher.uc run_action cross site scripting (low 3.5)
- [CVE-2023-30849](https://insights.sbomify.com/CVE-2023-30849/): Pimcore vulnerable to SQL Injection in Translation Export API (high 8.8)
- [CVE-2023-30848](https://insights.sbomify.com/CVE-2023-30848/): Pimcore SQL Injection Vulnerability in Admin Search Find API (high 8.8)
- [CVE-2023-30847](https://insights.sbomify.com/CVE-2023-30847/): H2O vulnerable to read from uninitialized pointer in the reverse proxy handler (high 8.2)
- [CVE-2023-30846](https://insights.sbomify.com/CVE-2023-30846/): typed-rest-client vulnerable to potential leak of authentication data to 3rd parties (critical 9.1)
- [CVE-2023-30845](https://insights.sbomify.com/CVE-2023-30845/): ESPv2 vulnerable to JWT authentication bypass via `X-HTTP-Method-Override` header (high 8.2)
- [CVE-2023-30844](https://insights.sbomify.com/CVE-2023-30844/): Mutagen list and monitor operations do not neutralize control characters in text controlled by remote endpoints (low 3.0)
- [CVE-2023-30843](https://insights.sbomify.com/CVE-2023-30843/): Payload's hidden fields can be leaked on readable collections (high 7.4)
- [CVE-2023-30841](https://insights.sbomify.com/CVE-2023-30841/): Ironic and ironic-inspector deployed within Baremetal Operator may expose as ConfigMaps (medium 6.0)
- [CVE-2023-30840](https://insights.sbomify.com/CVE-2023-30840/): On a compromised node, the fluid-csi service account can be used to modify node specs (medium 5.8)
- [CVE-2023-3084](https://insights.sbomify.com/CVE-2023-3084/): Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass (high 8.1)
- [CVE-2023-30839](https://insights.sbomify.com/CVE-2023-30839/): PrestaShop vulnerable to SQL filter bypass leading to arbitrary write requests using "SQL Manager" (critical 10.0)
- [CVE-2023-30838](https://insights.sbomify.com/CVE-2023-30838/): PrestaShop vulnerable to possible XSS injection through Validate::isCleanHTML method (high 8.6)
- [CVE-2023-30837](https://insights.sbomify.com/CVE-2023-30837/): Vyper storage allocator overflow (high 7.5)
- [CVE-2023-3083](https://insights.sbomify.com/CVE-2023-3083/): Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass (medium 6.1)
- [CVE-2023-3082](https://insights.sbomify.com/CVE-2023-3082/): Post SMTP <= 2.5.7 - Unauthenticated Stored Cross-Site Scripting via Email (high 7.2)
- [CVE-2023-3081](https://insights.sbomify.com/CVE-2023-3081/): WP Mail Logging <= 1.11.1 - Unauthenticated Stored Cross-Site Scripting via Email (high 7.2)
- [CVE-2023-30806](https://insights.sbomify.com/CVE-2023-30806/): Sangfor Next-Gen Application Firewall PHPSESSID Command Injection (critical 9.8)
- [CVE-2023-30805](https://insights.sbomify.com/CVE-2023-30805/): Sangfor Next-Gen Application Firewall Login Un Param Command Injection (critical 9.8)
- [CVE-2023-30804](https://insights.sbomify.com/CVE-2023-30804/): Sangfor Next-Gen Application Firewall Authenticated File Disclosure (medium 6.9)
- [CVE-2023-30803](https://insights.sbomify.com/CVE-2023-30803/): Sangfor Next-Gen Application Firewall Authentication Bypass (critical 9.8)
- [CVE-2023-30802](https://insights.sbomify.com/CVE-2023-30802/): Sangfor Next-Gen Application Firewall Source Code Disclosure (medium 5.3)
- [CVE-2023-30801](https://insights.sbomify.com/CVE-2023-30801/): qBittorrent Web UI Default Credentials Lead to RCE (critical 9.8)
- [CVE-2023-30800](https://insights.sbomify.com/CVE-2023-30800/): MikroTik RouterOS Web Interface Heap Corruption (high 7.5)
- [CVE-2023-3080](https://insights.sbomify.com/CVE-2023-3080/): WP Mail Catcher <= 2.1.2 - Unauthenticated Stored Cross-Site Scripting via Email Subject (high 7.2)
- [CVE-2023-30799](https://insights.sbomify.com/CVE-2023-30799/): MikroTik RouterOS Administrator Privilege Escalation (critical 9.1)
- [CVE-2023-30798](https://insights.sbomify.com/CVE-2023-30798/): MultipartParser DOS with too many fields or files in Starlette Framework (high 7.5)
- [CVE-2023-30797](https://insights.sbomify.com/CVE-2023-30797/): Insecure Random Generation in Netflix Lemur (high 7.5)
- [CVE-2023-30796](https://insights.sbomify.com/CVE-2023-30796/): Memory corruption in JT Open (high 7.8)
- [CVE-2023-30795](https://insights.sbomify.com/CVE-2023-30795/): Memory corruption in JT Open (high 7.8)
- [CVE-2023-30792](https://insights.sbomify.com/CVE-2023-30792/): Cross-site scripting in Lexical (medium 6.1)
- [CVE-2023-30791](https://insights.sbomify.com/CVE-2023-30791/): Plane 0.7.1 - Insecure file upload (high 7.1)
- [CVE-2023-30790](https://insights.sbomify.com/CVE-2023-30790/): Cross-site scripting in MonicaHQ (medium 5.4)
- [CVE-2023-3079](https://insights.sbomify.com/CVE-2023-3079/): Google Chromium V8 Type Confusion (high 8.8, exploited in the wild)
- [CVE-2023-30789](https://insights.sbomify.com/CVE-2023-30789/): Cross-site scripting in MonicaHQ (medium 5.4)
- [CVE-2023-30788](https://insights.sbomify.com/CVE-2023-30788/): Cross-site scripting in MonicaHQ (medium 5.4)
- [CVE-2023-30787](https://insights.sbomify.com/CVE-2023-30787/): Cross-site scripting in MonicaHQ (medium 5.4)
- [CVE-2023-30786](https://insights.sbomify.com/CVE-2023-30786/): WordPress Captcha Them All Plugin <= 1.3.3 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-30785](https://insights.sbomify.com/CVE-2023-30785/): WordPress Video Grid Plugin <= 1.21 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-30784](https://insights.sbomify.com/CVE-2023-30784/): WordPress Kaya QR Code Generator Plugin <= 1.5.2 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-30783](https://insights.sbomify.com/CVE-2023-30783/): WordPress Smart WooCommerce Search plugin <= 2.5.0 - Broken Access Control (medium 4.3)
- [CVE-2023-30782](https://insights.sbomify.com/CVE-2023-30782/): WordPress Church Admin Plugin <= 3.7.5 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-30781](https://insights.sbomify.com/CVE-2023-30781/): WordPress Tweeple Plugin <= 0.9.5 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-30780](https://insights.sbomify.com/CVE-2023-30780/): WordPress User IP and Location Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2023-3078](https://insights.sbomify.com/CVE-2023-3078/): Privilege escalation in Universal Device Client (UDC) (high 7.8)
- [CVE-2023-30779](https://insights.sbomify.com/CVE-2023-30779/): WordPress Query Wrangler Plugin <= 1.5.51 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-30778](https://insights.sbomify.com/CVE-2023-30778/): WordPress PowerPress Podcasting Plugin <= 10.0.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.5)
- [CVE-2023-30777](https://insights.sbomify.com/CVE-2023-30777/): WordPress Advanced Custom Fields / Advanced Custom Fields PRO plugins <= 6.1.5 vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-30776](https://insights.sbomify.com/CVE-2023-30776/): Apache Superset: Database connection password leak (medium 4.9)
- [CVE-2023-30775](https://insights.sbomify.com/CVE-2023-30775/): Memory corruption in libtiff (medium 5.5)
- [CVE-2023-30774](https://insights.sbomify.com/CVE-2023-30774/): Memory corruption in libtiff (medium 5.5)
- [CVE-2023-30772](https://insights.sbomify.com/CVE-2023-30772/): Use after free in linux:linux kernel (medium 6.4)
- [CVE-2023-30771](https://insights.sbomify.com/CVE-2023-30771/): Apache IoTDB Workbench: apache/iotdb-web-workbench: forge the JWTToken to access workbench (critical 9.8)
- [CVE-2023-30770](https://insights.sbomify.com/CVE-2023-30770/): A stack-based buffer overflow vulnerability was found in the ADM (high 7.1)
- [CVE-2023-3077](https://insights.sbomify.com/CVE-2023-3077/): MStore API < 3.9.8 - Unauthenticated Blind SQLi (critical 9.8)
- [CVE-2023-30769](https://insights.sbomify.com/CVE-2023-30769/): Rab13s Exploit (critical 9.1)
- [CVE-2023-30768](https://insights.sbomify.com/CVE-2023-30768/): Privilege escalation in Intel(R) Server Board S2600WTT belonging to the Intel(R) Server Board S2600WT Family (high 7.1)
- [CVE-2023-30767](https://insights.sbomify.com/CVE-2023-30767/): Memory corruption in TensorFlow (medium 5.5)
- [CVE-2023-30766](https://insights.sbomify.com/CVE-2023-30766/): Command injection in KB-AHR series and KB-IRIP series (critical 9.8)
- [CVE-2023-30765](https://insights.sbomify.com/CVE-2023-30765/): ​Delta Electronics InfraSuite Device Master Improper Access Control (high 8.8)
- [CVE-2023-30764](https://insights.sbomify.com/CVE-2023-30764/): Command injection in KB-AHR series and KB-IRIP series (critical 9.8)
- [CVE-2023-30763](https://insights.sbomify.com/CVE-2023-30763/): Memory corruption in Intel(R) SoC Watch based software (high 7.2)
- [CVE-2023-30762](https://insights.sbomify.com/CVE-2023-30762/): Auth bypass in KB-AHR series and KB-IRIP series (critical 9.8)
- [CVE-2023-30760](https://insights.sbomify.com/CVE-2023-30760/): Memory corruption in Intel(R) RealSense(TM) ID software for Intel(R) RealSense(TM) 450 FA (low 3.3)
- [CVE-2023-3076](https://insights.sbomify.com/CVE-2023-3076/): MStore API < 3.9.9 - Unauthenticated Privilege Escalation (critical 9.8)
- [CVE-2023-30759](https://insights.sbomify.com/CVE-2023-30759/): Privilege escalation in Printer Driver Packager NX (high 8.4)
- [CVE-2023-30758](https://insights.sbomify.com/CVE-2023-30758/): Cross-site scripting in Pleasanter (medium 5.4)
- [CVE-2023-30757](https://insights.sbomify.com/CVE-2023-30757/): Weak cryptography in Totally Integrated Automation Portal (TIA Portal) V14 (medium 6.2)
- [CVE-2023-30756](https://insights.sbomify.com/CVE-2023-30756/): Null dereference in SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) (high 8.2)
- [CVE-2023-30755](https://insights.sbomify.com/CVE-2023-30755/): Null dereference in SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) (medium 5.9)
- [CVE-2023-30754](https://insights.sbomify.com/CVE-2023-30754/): WordPress AdFoxly – Ad Manager, AdSense Ads & Ads.txt Plugin <= 1.8.5 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-30753](https://insights.sbomify.com/CVE-2023-30753/): WordPress IP Metaboxes Plugin <= 2.1.1 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-30752](https://insights.sbomify.com/CVE-2023-30752/): WordPress External Videos Plugin <= 2.0.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-30751](https://insights.sbomify.com/CVE-2023-30751/): WordPress Article Directory Redux Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-30750](https://insights.sbomify.com/CVE-2023-30750/): WordPress CM Pop-Up banners Plugin <= 1.5.10 is vulnerable to SQL Injection (high 8.5)
- [CVE-2023-3075](https://insights.sbomify.com/CVE-2023-3075/): Cross-Site Request Forgery (CSRF) in tsolucio/corebos (high 7.5)
- [CVE-2023-30749](https://insights.sbomify.com/CVE-2023-30749/): WordPress Optima Express + MarketBoost IDX Plugin Plugin <= 7.3.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-30748](https://insights.sbomify.com/CVE-2023-30748/): WordPress Easy Appointments plugin <= 3.10.7 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (medium 4.3)
- [CVE-2023-30747](https://insights.sbomify.com/CVE-2023-30747/): WordPress WooCommerce Easy Duplicate Product Plugin <= 0.3.0.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2023-30746](https://insights.sbomify.com/CVE-2023-30746/): WordPress Booqable Rental Plugin Plugin <= 2.4.15 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-30745](https://insights.sbomify.com/CVE-2023-30745/): WordPress IP Metaboxes Plugin <= 2.1.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2023-30744](https://insights.sbomify.com/CVE-2023-30744/): Improper access control during application start-up in SAP AS NetWeaver JAVA. (high 8.2)
- [CVE-2023-30743](https://insights.sbomify.com/CVE-2023-30743/): Improper Neutralization of Input in SAPUI5 (high 7.1)
- [CVE-2023-30742](https://insights.sbomify.com/CVE-2023-30742/): Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI) (medium 6.1)
- [CVE-2023-30741](https://insights.sbomify.com/CVE-2023-30741/): Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (medium 6.1)
- [CVE-2023-30740](https://insights.sbomify.com/CVE-2023-30740/): Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (medium 6.3)
- [CVE-2023-3074](https://insights.sbomify.com/CVE-2023-3074/): Cross-site Scripting (XSS) - Stored in tsolucio/corebos (high 8.6)
- [CVE-2023-30739](https://insights.sbomify.com/CVE-2023-30739/): Other in Samsung Mobile Devices (medium 6.7)
- [CVE-2023-30738](https://insights.sbomify.com/CVE-2023-30738/): Memory corruption in Galaxy Book, Galaxy Book Pro, Galaxy Book Pro 360 and Galaxy Book Odyssey (medium 5.5)
- [CVE-2023-30737](https://insights.sbomify.com/CVE-2023-30737/): Missing authorization in Samsung Health (medium 4.0)
- [CVE-2023-30736](https://insights.sbomify.com/CVE-2023-30736/): Missing authorization in Samsung Assistant (medium 4.4)
- [CVE-2023-30735](https://insights.sbomify.com/CVE-2023-30735/): Missing authorization in SAssistant (medium 5.1)
- [CVE-2023-30734](https://insights.sbomify.com/CVE-2023-30734/): Missing authorization in Samsung Health (medium 4.0)
- [CVE-2023-30733](https://insights.sbomify.com/CVE-2023-30733/): Memory corruption in Samsung Mobile Devices (high 7.8)
- [CVE-2023-30732](https://insights.sbomify.com/CVE-2023-30732/): Missing authorization in Samsung Mobile Devices (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/322/