# Vulnerabilities published in 2023


- [CVE-2023-30640](https://insights.sbomify.com/CVE-2023-30640/): Missing authorization in Samsung Mobile Devices (medium 4.3)
- [CVE-2023-3064](https://insights.sbomify.com/CVE-2023-3064/): Mobatime mobile application - Sensitive information disclosure (high 7.5)
- [CVE-2023-30639](https://insights.sbomify.com/CVE-2023-30639/): Cross-site scripting in archerirm:archer (high 7.1)
- [CVE-2023-30638](https://insights.sbomify.com/CVE-2023-30638/): Command injection in atos:unify openscape bcf (high 7.2)
- [CVE-2023-30637](https://insights.sbomify.com/CVE-2023-30637/): Denial of service in baidu:braft (high 7.5)
- [CVE-2023-30636](https://insights.sbomify.com/CVE-2023-30636/): Denial of service in tikv:tikv (high 7.5)
- [CVE-2023-30635](https://insights.sbomify.com/CVE-2023-30635/): Denial of service in tikv:tikv (high 7.5)
- [CVE-2023-30633](https://insights.sbomify.com/CVE-2023-30633/): Security feature bypass in insyde:insydeh2o (medium 5.3)
- [CVE-2023-30631](https://insights.sbomify.com/CVE-2023-30631/): Apache Traffic Server: Configuration option to block the PUSH method in ATS didn't work (high 7.5)
- [CVE-2023-30630](https://insights.sbomify.com/CVE-2023-30630/): Path traversal in nongnu:dmidecode (high 7.1)
- [CVE-2023-3063](https://insights.sbomify.com/CVE-2023-3063/): Missing authorization in SP Project & Document Manager (high 8.8)
- [CVE-2023-30629](https://insights.sbomify.com/CVE-2023-30629/): Vyper's raw_call with outsize=0 and revert_on_failure=False returns incorrect success value (high 7.5)
- [CVE-2023-30628](https://insights.sbomify.com/CVE-2023-30628/): Kiwi TCMS has command injection vulnerability in changelog.yml CI workflow (high 8.8)
- [CVE-2023-30627](https://insights.sbomify.com/CVE-2023-30627/): jellyfin-web has a stored cross-site scripting vulnerability in devices.js (critical 9.1)
- [CVE-2023-30626](https://insights.sbomify.com/CVE-2023-30626/): Jellyfin vulnerable to directory traversal and file write causing arbitrary code execution (high 8.8)
- [CVE-2023-30625](https://insights.sbomify.com/CVE-2023-30625/): rudder-server vulnerable to SQL Injection (high 8.8)
- [CVE-2023-30624](https://insights.sbomify.com/CVE-2023-30624/): Wasmtime has Undefined Behavior in Rust runtime functions (low 3.9)
- [CVE-2023-30623](https://insights.sbomify.com/CVE-2023-30623/): Arbitrary command injection in embano1/wip (high 8.8)
- [CVE-2023-30622](https://insights.sbomify.com/CVE-2023-30622/): Clusternet has potential risk which can be leveraged to make a cluster-level privilege escalation (medium 6.6)
- [CVE-2023-30621](https://insights.sbomify.com/CVE-2023-30621/): OS command injection in Gipsy (critical 9.8)
- [CVE-2023-30620](https://insights.sbomify.com/CVE-2023-30620/): Arbitrary File Write when Extracting a Remotely retrieved Tarball in mindsdb/mindsdb (high 7.5)
- [CVE-2023-3062](https://insights.sbomify.com/CVE-2023-3062/): code-projects Agro-School Management System index.php sql injection (medium 6.3)
- [CVE-2023-30619](https://insights.sbomify.com/CVE-2023-30619/): XSS in the tooltip via an artifact title (medium 5.4)
- [CVE-2023-30618](https://insights.sbomify.com/CVE-2023-30618/): Sensitive Terraform Output Values Printed At Info Logging Level In Kitchen-Terraform (low 3.2)
- [CVE-2023-30617](https://insights.sbomify.com/CVE-2023-30617/): Leverage the kruise-daemon pod to list all secrets in the entire cluster (medium 6.5)
- [CVE-2023-30616](https://insights.sbomify.com/CVE-2023-30616/): Cross Site Request Forgery due to missing nonce verification in form block (medium 6.5)
- [CVE-2023-30615](https://insights.sbomify.com/CVE-2023-30615/): Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in iris-web (medium 6.3)
- [CVE-2023-30614](https://insights.sbomify.com/CVE-2023-30614/): Improper Neutralization of Script-Related HTML Tags in a Web Page in pay (high 7.1)
- [CVE-2023-30613](https://insights.sbomify.com/CVE-2023-30613/): Kiwi TCMS unrestricted file upload vulnerability (high 8.1)
- [CVE-2023-30612](https://insights.sbomify.com/CVE-2023-30612/): Malicious HTTP requests could close arbitrary opening file descriptors in cloud-hypervisor (medium 4.0)
- [CVE-2023-30611](https://insights.sbomify.com/CVE-2023-30611/): Reaction metadata exposed in private topics in Discourse-reactions (medium 4.3)
- [CVE-2023-30610](https://insights.sbomify.com/CVE-2023-30610/): AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending (medium 5.5)
- [CVE-2023-3061](https://insights.sbomify.com/CVE-2023-3061/): code-projects Agro-School Management System Attachment Image btn_functions.php unrestricted upload (medium 6.3)
- [CVE-2023-30609](https://insights.sbomify.com/CVE-2023-30609/): matrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlighting (medium 5.4)
- [CVE-2023-30608](https://insights.sbomify.com/CVE-2023-30608/): Parser contains an inefficient regular expression in sqlparse (medium 5.5)
- [CVE-2023-30607](https://insights.sbomify.com/CVE-2023-30607/): icingaweb2-module-jira template and field configuration are susceptible to CSRF (medium 5.0)
- [CVE-2023-30606](https://insights.sbomify.com/CVE-2023-30606/): Multisite denial of service through unsanitized dynamic dispatch to SiteSetting in Discourse (medium 4.2)
- [CVE-2023-30605](https://insights.sbomify.com/CVE-2023-30605/): Multiple SQL injections in sql/instance.py param_edit method in Archery - GHSL-2022-104 (medium 6.5)
- [CVE-2023-30604](https://insights.sbomify.com/CVE-2023-30604/): Hitron Technologies Inc. CODA-5310 - Broken Access Control (critical 9.8)
- [CVE-2023-30603](https://insights.sbomify.com/CVE-2023-30603/): Hitron Technologies Inc. CODA-5310 - Using default credentials (critical 9.8)
- [CVE-2023-30602](https://insights.sbomify.com/CVE-2023-30602/): Hitron Technologies Inc. CODA-5310 - Insecure service Telnet (high 7.5)
- [CVE-2023-30601](https://insights.sbomify.com/CVE-2023-30601/): Apache Cassandra: Privilege escalation when enabling FQL/Audit logs (high 7.8)
- [CVE-2023-3060](https://insights.sbomify.com/CVE-2023-3060/): code-projects Agro-School Management System btn_functions.php doAddQuestion cross site scripting (low 3.5)
- [CVE-2023-30591](https://insights.sbomify.com/CVE-2023-30591/): NodeBB Pre-Authentication Denial-of-Service (high 7.5)
- [CVE-2023-30590](https://insights.sbomify.com/CVE-2023-30590/): Weak cryptography in Node (high 7.5)
- [CVE-2023-3059](https://insights.sbomify.com/CVE-2023-3059/): SourceCodester Online Exam Form Submission update_s6.php sql injection (medium 6.3)
- [CVE-2023-30589](https://insights.sbomify.com/CVE-2023-30589/): llhttp vulnerable to HTTP request smuggling (high 7.5)
- [CVE-2023-30588](https://insights.sbomify.com/CVE-2023-30588/): Denial of service in Node (medium 5.3)
- [CVE-2023-30587](https://insights.sbomify.com/CVE-2023-30587/): Security feature bypass in Node (high 7.5)
- [CVE-2023-30586](https://insights.sbomify.com/CVE-2023-30586/): Security feature bypass in Node (high 7.5)
- [CVE-2023-30585](https://insights.sbomify.com/CVE-2023-30585/): Privilege escalation in Node (high 7.5)
- [CVE-2023-30584](https://insights.sbomify.com/CVE-2023-30584/): Path traversal in Node (high 7.7)
- [CVE-2023-30583](https://insights.sbomify.com/CVE-2023-30583/): Security feature bypass in Node (high 7.5)
- [CVE-2023-30582](https://insights.sbomify.com/CVE-2023-30582/): Security feature bypass in Node (medium 5.3)
- [CVE-2023-30581](https://insights.sbomify.com/CVE-2023-30581/): Security feature bypass in Node (high 7.5)
- [CVE-2023-3058](https://insights.sbomify.com/CVE-2023-3058/): 07FLY CRM User Profile cross site scripting (low 3.5)
- [CVE-2023-30577](https://insights.sbomify.com/CVE-2023-30577/): Command injection in zmanda:amanda (high 7.8)
- [CVE-2023-30576](https://insights.sbomify.com/CVE-2023-30576/): Apache Guacamole: Use-after-free in handling of RDP audio input buffer (medium 6.8)
- [CVE-2023-30575](https://insights.sbomify.com/CVE-2023-30575/): Apache Guacamole: Incorrect calculation of Guacamole protocol element lengths (medium 6.5)
- [CVE-2023-30571](https://insights.sbomify.com/CVE-2023-30571/): Race condition in libarchive:libarchive (low 3.9)
- [CVE-2023-30570](https://insights.sbomify.com/CVE-2023-30570/): Denial of service in libreswan:libreswan (high 7.5)
- [CVE-2023-3057](https://insights.sbomify.com/CVE-2023-3057/): YFCMF Ajax.php path traversal (medium 4.3)
- [CVE-2023-30565](https://insights.sbomify.com/CVE-2023-30565/): CQI Data Sniffing (low 3.5)
- [CVE-2023-30564](https://insights.sbomify.com/CVE-2023-30564/): Stored Cross-Site Scripting on Device Import Functionality (medium 6.9)
- [CVE-2023-30563](https://insights.sbomify.com/CVE-2023-30563/): Stored Cross-Site Scripting on User Import Functionality (high 8.2)
- [CVE-2023-30562](https://insights.sbomify.com/CVE-2023-30562/): Lack of Dataset Integrity Checking (medium 6.7)
- [CVE-2023-30561](https://insights.sbomify.com/CVE-2023-30561/): Lack of Cryptographic Security of IUI Bus (medium 6.1)
- [CVE-2023-30560](https://insights.sbomify.com/CVE-2023-30560/): PCU Configuration Lacks Authentication (medium 6.8)
- [CVE-2023-3056](https://insights.sbomify.com/CVE-2023-3056/): YFCMF index.php path traversal (medium 4.3)
- [CVE-2023-30559](https://insights.sbomify.com/CVE-2023-30559/): Wireless Card Firmware Improperly Signed (medium 5.2)
- [CVE-2023-30558](https://insights.sbomify.com/CVE-2023-30558/): Multiple SQL injections in sql/data_dictionary.py table_list method in Archery - GHSL-2022-105 (medium 6.5)
- [CVE-2023-30557](https://insights.sbomify.com/CVE-2023-30557/): SQL injection in data_dictionary.py table_info method in Archery - GHSL-2022-106 (medium 6.5)
- [CVE-2023-30556](https://insights.sbomify.com/CVE-2023-30556/): SQL injection in sql_optimize.py optimize_sqltuningadvisor method in Archery - GHSL-2022-107 (medium 6.5)
- [CVE-2023-30555](https://insights.sbomify.com/CVE-2023-30555/): SQL injection in sql_optimize.py explain method in Archery - GHSL-2022-108 (medium 6.5)
- [CVE-2023-30554](https://insights.sbomify.com/CVE-2023-30554/): SQL injection in sql_api/api_workflow.py endpoint in Archery - GHSL-2022-103 (medium 6.5)
- [CVE-2023-30553](https://insights.sbomify.com/CVE-2023-30553/): Multiple SQL injections in sql_api/api_workflow.py endpoint in Archery - GHSL-2022-102 (medium 6.5)
- [CVE-2023-30552](https://insights.sbomify.com/CVE-2023-30552/): SQL injection in sql/instance.py endpoint in Archery - GHSL-2022-101 (medium 6.5)
- [CVE-2023-30551](https://insights.sbomify.com/CVE-2023-30551/): Rekor's compressed archives can result in OOM conditions (high 7.5)
- [CVE-2023-30550](https://insights.sbomify.com/CVE-2023-30550/): IDOR vulnerability exists in metersphere (medium 6.8)
- [CVE-2023-3055](https://insights.sbomify.com/CVE-2023-3055/): Page Builder by AZEXO <= 1.27.133 - Cross-Site Request Forgery to Stored Cross-Site Scripting via azh_save (medium 6.1)
- [CVE-2023-30549](https://insights.sbomify.com/CVE-2023-30549/): Unpatched extfs vulnerabilities are exploitable through suid-mode Apptainer (high 7.1)
- [CVE-2023-30548](https://insights.sbomify.com/CVE-2023-30548/): Path traversal vulnerability in gatsby-plugin-sharp (medium 4.3)
- [CVE-2023-30547](https://insights.sbomify.com/CVE-2023-30547/): Sandbox Escape in vm2 (critical 9.8)
- [CVE-2023-30546](https://insights.sbomify.com/CVE-2023-30546/): Contiki-NG has off-by-one error in Antelope DBMS (critical 9.8)
- [CVE-2023-30545](https://insights.sbomify.com/CVE-2023-30545/): PrestaShop arbitrary file read vulnerability (high 7.7)
- [CVE-2023-30544](https://insights.sbomify.com/CVE-2023-30544/): Kiwi TCMS may allow user to update email address to unverified one (low 3.9)
- [CVE-2023-30543](https://insights.sbomify.com/CVE-2023-30543/): `chainId` may be outdated if user changes chains as part of connection in @web3-react (medium 5.2)
- [CVE-2023-30542](https://insights.sbomify.com/CVE-2023-30542/): GovernorCompatibilityBravo may trim proposal calldata (medium 6.8)
- [CVE-2023-30541](https://insights.sbomify.com/CVE-2023-30541/): TransparentUpgradeableProxy clashing selector calls may not be delegated in @openzeppelin/contracts (medium 5.3)
- [CVE-2023-30540](https://insights.sbomify.com/CVE-2023-30540/): Chat poll data can still be queried from API after purging history in Nextcloud talk (low 3.5)
- [CVE-2023-30539](https://insights.sbomify.com/CVE-2023-30539/): Users can set up workflows using restricted and invisible system tags in Nextcloud (medium 6.5)
- [CVE-2023-30538](https://insights.sbomify.com/CVE-2023-30538/): Stored Cross-site Scripting via improper sanitization of svg files in Discourse (medium 5.4)
- [CVE-2023-30537](https://insights.sbomify.com/CVE-2023-30537/): org.xwiki.platform:xwiki-platform-flamingo-theme-ui vulnerable to privilege escalation (critical 9.9)
- [CVE-2023-30536](https://insights.sbomify.com/CVE-2023-30536/): Insecure header validation in slim/psr7 (medium 6.5)
- [CVE-2023-30535](https://insights.sbomify.com/CVE-2023-30535/): Snowflake JDBC vulnerable to command injection via SSO URL authentication (high 7.3)
- [CVE-2023-30534](https://insights.sbomify.com/CVE-2023-30534/): Insecure Deserialization in Cacti (medium 4.3)
- [CVE-2023-30533](https://insights.sbomify.com/CVE-2023-30533/): Prototype Pollution in sheetJS (high 7.8)
- [CVE-2023-30532](https://insights.sbomify.com/CVE-2023-30532/): Lack of authentication mechanism in Jenkins TurboScript Plugin webhook (medium 6.5)
- [CVE-2023-30531](https://insights.sbomify.com/CVE-2023-30531/): Jenkins Consul KV Builder Plugin stores HashiCorp Consul ACL Token unencrypted (medium 6.5)
- [CVE-2023-30530](https://insights.sbomify.com/CVE-2023-30530/): Jenkins Consul KV Builder Plugin stores HashiCorp Consul ACL Token unencrypted (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/324/