# Vulnerabilities published in 2023


- [CVE-2023-30431](https://insights.sbomify.com/CVE-2023-30431/): IBM Db2 buffer overflow (high 8.4)
- [CVE-2023-30430](https://insights.sbomify.com/CVE-2023-30430/): IBM Security Verify Access information disclosure (medium 5.5)
- [CVE-2023-3043](https://insights.sbomify.com/CVE-2023-3043/): Stack-based Buffer Overflow BMC (critical 9.6)
- [CVE-2023-30429](https://insights.sbomify.com/CVE-2023-30429/): Apache Pulsar: Incorrect Authorization for Function Worker when using mTLS Authentication through Pulsar Proxy (critical 9.6)
- [CVE-2023-30428](https://insights.sbomify.com/CVE-2023-30428/): Apache Pulsar Broker: Incorrect Authorization Validation for Rest Producer (high 8.2)
- [CVE-2023-30421](https://insights.sbomify.com/CVE-2023-30421/): Denial of service in mjson (low 2.9)
- [CVE-2023-3042](https://insights.sbomify.com/CVE-2023-3042/): CNA SHORTNAME: dotCMSORG UUID: 5b9d93f2-25c7-46b4-ab60-d201718c9dd8 (medium 5.3)
- [CVE-2023-30417](https://insights.sbomify.com/CVE-2023-30417/): Cross-site scripting in pearadmin:pear admin boot (medium 5.4)
- [CVE-2023-30415](https://insights.sbomify.com/CVE-2023-30415/): SQL injection in oretnom23:packers and movers management system (critical 9.8)
- [CVE-2023-30414](https://insights.sbomify.com/CVE-2023-30414/): Memory corruption in jerryscript:jerryscript (medium 5.5)
- [CVE-2023-30410](https://insights.sbomify.com/CVE-2023-30410/): Memory corruption in jerryscript:jerryscript (medium 5.5)
- [CVE-2023-3041](https://insights.sbomify.com/CVE-2023-3041/): Autochat <= 1.1.7- Unauthenticated Stored XSS (medium 6.1)
- [CVE-2023-30408](https://insights.sbomify.com/CVE-2023-30408/): Denial of service in jerryscript:jerryscript (medium 5.5)
- [CVE-2023-30406](https://insights.sbomify.com/CVE-2023-30406/): Denial of service in jerryscript:jerryscript (medium 5.5)
- [CVE-2023-30405](https://insights.sbomify.com/CVE-2023-30405/): Cross-site scripting in aigital:wireless-n repeater mini router firmware (medium 5.4)
- [CVE-2023-30404](https://insights.sbomify.com/CVE-2023-30404/): Code injection in aigital:wireless-n repeater mini router firmware (critical 9.8)
- [CVE-2023-30403](https://insights.sbomify.com/CVE-2023-30403/): Auth bypass in aigital:wireless-n repeater mini router firmware (high 7.5)
- [CVE-2023-30402](https://insights.sbomify.com/CVE-2023-30402/): Memory corruption in yasm project:yasm (medium 5.5)
- [CVE-2023-30400](https://insights.sbomify.com/CVE-2023-30400/): Command injection in anyka:ak3918ev300 firmware (critical 9.8)
- [CVE-2023-3040](https://insights.sbomify.com/CVE-2023-3040/): Out of Bounds Access Leading to Undefined Behavior (low 3.7)
- [CVE-2023-30399](https://insights.sbomify.com/CVE-2023-30399/): Other in garo:wallbox glb firmware (high 8.1)
- [CVE-2023-30394](https://insights.sbomify.com/CVE-2023-30394/): Cross-site scripting in moveit:moveit (medium 6.1)
- [CVE-2023-3039](https://insights.sbomify.com/CVE-2023-3039/): Missing authorization in SD ROM Utility (high 7.3)
- [CVE-2023-30383](https://insights.sbomify.com/CVE-2023-30383/): Memory corruption in tp-link:archer c20 firmware (high 7.5)
- [CVE-2023-30382](https://insights.sbomify.com/CVE-2023-30382/): Memory corruption in valvesoftware:half-life (high 7.3)
- [CVE-2023-30380](https://insights.sbomify.com/CVE-2023-30380/): Path traversal in dedecms:dedecms (high 7.5)
- [CVE-2023-3038](https://insights.sbomify.com/CVE-2023-3038/): HelpDezk Community improper authorization (critical 9.8)
- [CVE-2023-30378](https://insights.sbomify.com/CVE-2023-30378/): Memory corruption in tenda:ac15 firmware (critical 9.8)
- [CVE-2023-30376](https://insights.sbomify.com/CVE-2023-30376/): Memory corruption in tenda:ac15 firmware (critical 9.8)
- [CVE-2023-30375](https://insights.sbomify.com/CVE-2023-30375/): Memory corruption in tenda:ac15 firmware (critical 9.8)
- [CVE-2023-30373](https://insights.sbomify.com/CVE-2023-30373/): Memory corruption in tenda:ac15 firmware (critical 9.8)
- [CVE-2023-30372](https://insights.sbomify.com/CVE-2023-30372/): Memory corruption in tenda:ac15 firmware (critical 9.8)
- [CVE-2023-30371](https://insights.sbomify.com/CVE-2023-30371/): Memory corruption in tenda:ac15 firmware (critical 9.8)
- [CVE-2023-30370](https://insights.sbomify.com/CVE-2023-30370/): Memory corruption in tenda:ac15 firmware (critical 9.8)
- [CVE-2023-3037](https://insights.sbomify.com/CVE-2023-3037/): HelpDezk Community improper authorization (high 8.6)
- [CVE-2023-30369](https://insights.sbomify.com/CVE-2023-30369/): Memory corruption in tenda:ac15 firmware (critical 9.8)
- [CVE-2023-30368](https://insights.sbomify.com/CVE-2023-30368/): Memory corruption in tenda:ac5 firmware (critical 9.8)
- [CVE-2023-30367](https://insights.sbomify.com/CVE-2023-30367/): Information disclosure in mremoteng:mremoteng (high 7.5)
- [CVE-2023-30363](https://insights.sbomify.com/CVE-2023-30363/): Prototype Pollution in vConsole (critical 9.8)
- [CVE-2023-30362](https://insights.sbomify.com/CVE-2023-30362/): Memory corruption in libcoap:libcoap (high 7.5)
- [CVE-2023-3036](https://insights.sbomify.com/CVE-2023-3036/): Out of Bounds Slice index in cfnts leads to remote panic (high 8.6)
- [CVE-2023-30356](https://insights.sbomify.com/CVE-2023-30356/): Security feature bypass in tenda:cp3 firmware (high 7.5)
- [CVE-2023-30354](https://insights.sbomify.com/CVE-2023-30354/): Hardcoded credentials in tenda:cp3 firmware (critical 9.8)
- [CVE-2023-30353](https://insights.sbomify.com/CVE-2023-30353/): Command injection in tenda:cp3 firmware (critical 9.8)
- [CVE-2023-30352](https://insights.sbomify.com/CVE-2023-30352/): Hardcoded credentials in tenda:cp3 firmware (critical 9.8)
- [CVE-2023-30351](https://insights.sbomify.com/CVE-2023-30351/): Hardcoded credentials in tenda:cp3 firmware (high 7.5)
- [CVE-2023-30350](https://insights.sbomify.com/CVE-2023-30350/): Privilege escalation in fs:s3900 24t4s firmware (high 8.8)
- [CVE-2023-3035](https://insights.sbomify.com/CVE-2023-3035/): Guangdong Pythagorean OA Office System Schedule cross site scripting (low 3.5)
- [CVE-2023-30349](https://insights.sbomify.com/CVE-2023-30349/): Remote code execution in JFinal CMS (critical 9.8)
- [CVE-2023-30347](https://insights.sbomify.com/CVE-2023-30347/): Cross-site scripting in stl:neox dial centre (medium 4.8)
- [CVE-2023-3034](https://insights.sbomify.com/CVE-2023-3034/): Reflected XSS in BKG Ntrip Professional Caster version <=2.0.44 (medium 4.7)
- [CVE-2023-30338](https://insights.sbomify.com/CVE-2023-30338/): Cross-site scripting in emlog:emlog (medium 5.4)
- [CVE-2023-30334](https://insights.sbomify.com/CVE-2023-30334/): Cross-site scripting in asmbb project:asmbb (medium 6.1)
- [CVE-2023-30333](https://insights.sbomify.com/CVE-2023-30333/): File upload in perfree:perfreeblog (critical 9.8)
- [CVE-2023-30331](https://insights.sbomify.com/CVE-2023-30331/): Server-side template injection in beetl (critical 9.8)
- [CVE-2023-30330](https://insights.sbomify.com/CVE-2023-30330/): Path traversal in softexpert:excellence suite (critical 9.8)
- [CVE-2023-3033](https://insights.sbomify.com/CVE-2023-3033/): Mobatime web application - broken authorisation mechanisms (medium 6.8)
- [CVE-2023-30328](https://insights.sbomify.com/CVE-2023-30328/): Auth bypass in mailbutler:shimo (critical 9.8)
- [CVE-2023-30326](https://insights.sbomify.com/CVE-2023-30326/): Cross-site scripting in chatengine project:chatengine (medium 6.1)
- [CVE-2023-30325](https://insights.sbomify.com/CVE-2023-30325/): SQL injection in chatengine project:chatengine (high 7.5)
- [CVE-2023-30323](https://insights.sbomify.com/CVE-2023-30323/): SQL injection in chatengine project:chatengine (high 7.5)
- [CVE-2023-30322](https://insights.sbomify.com/CVE-2023-30322/): Cross-site scripting in chatengine project:chatengine (medium 5.4)
- [CVE-2023-30321](https://insights.sbomify.com/CVE-2023-30321/): Cross-site scripting in chatengine project:chatengine (critical 9.0)
- [CVE-2023-30320](https://insights.sbomify.com/CVE-2023-30320/): Cross-site scripting in chatengine project:chatengine (critical 9.0)
- [CVE-2023-3032](https://insights.sbomify.com/CVE-2023-3032/): Mobatime web application - Arbitrary file upload (RCE) (high 8.1)
- [CVE-2023-30319](https://insights.sbomify.com/CVE-2023-30319/): Cross-site scripting in chatengine project:chatengine (critical 9.6)
- [CVE-2023-30314](https://insights.sbomify.com/CVE-2023-30314/): An issue discovered in 360 V6G, 360 T5G, 360 T6M, and 360 P1 routers allows attackers to hijack TCP sessions which could lead to a denial of service. (medium 6.5)
- [CVE-2023-30313](https://insights.sbomify.com/CVE-2023-30313/): An issue discovered in Wavlink QUANTUM D2G routers allows attackers to hijack TCP sessions which could lead to a denial of service. (high 7.5)
- [CVE-2023-30312](https://insights.sbomify.com/CVE-2023-30312/): An issue discovered in OpenWrt 18.06, 19.07, 21.02, 22.03, and beyond allows off-path attackers to hijack TCP sessions, which could lead to (high 7.3)
- [CVE-2023-30311](https://insights.sbomify.com/CVE-2023-30311/): An issue discovered in H3C Magic R365 and H3C Magic R100 routers allows attackers to hijack TCP sessions which could lead to a denial of service. (high 7.5)
- [CVE-2023-30310](https://insights.sbomify.com/CVE-2023-30310/): An issue discovered in Comfast Comfast CF-616AC routers allows attackers to hijack TCP sessions which could lead to a denial of service. (high 7.5)
- [CVE-2023-3031](https://insights.sbomify.com/CVE-2023-3031/): Prestahop module King-Avis - Path traversal (medium 4.9)
- [CVE-2023-30309](https://insights.sbomify.com/CVE-2023-30309/): Other in dlink:di-7003g firmware (medium 5.7)
- [CVE-2023-30308](https://insights.sbomify.com/CVE-2023-30308/): Other in ruijie:rg-eg105g firmware (medium 6.5)
- [CVE-2023-30307](https://insights.sbomify.com/CVE-2023-30307/): An issue discovered in TP-LINK TL-R473GP-AC, TP-LINK XDR6020, TP-LINK TL-R479GP-AC, TP-LINK TL-R4239G, TP-LINK TL-WAR1200L, and TP-LINK TL-R (medium 5.3)
- [CVE-2023-30306](https://insights.sbomify.com/CVE-2023-30306/): An issue discovered in Mercury x30g, Mercury YR1800XG routers allows attackers to hijack TCP sessions which could lead to a denial of service. (medium 4.3)
- [CVE-2023-30305](https://insights.sbomify.com/CVE-2023-30305/): Other in linksys:e5600 firmware (high 7.5)
- [CVE-2023-30300](https://insights.sbomify.com/CVE-2023-30300/): Denial of service in w3:webassembly (medium 5.5)
- [CVE-2023-30297](https://insights.sbomify.com/CVE-2023-30297/): Code injection in n-able:n-central (high 7.0)
- [CVE-2023-3029](https://insights.sbomify.com/CVE-2023-3029/): Guangdong Pythagorean OA Office System delete cross-site request forgery (medium 4.3)
- [CVE-2023-30285](https://insights.sbomify.com/CVE-2023-30285/): Information disclosure in deviniti:issue sync (high 7.5)
- [CVE-2023-30282](https://insights.sbomify.com/CVE-2023-30282/): Missing authorization in prestashop:scexportcustomers (high 7.5)
- [CVE-2023-30281](https://insights.sbomify.com/CVE-2023-30281/): Missing authorization in storecommander:scquickaccounting (high 7.5)
- [CVE-2023-30280](https://insights.sbomify.com/CVE-2023-30280/): Memory corruption in netgear:r6700 firmware (critical 9.8)
- [CVE-2023-3028](https://insights.sbomify.com/CVE-2023-3028/): Improper backend communication allows access and manipulation of the telemetry data (high 8.6)
- [CVE-2023-3027](https://insights.sbomify.com/CVE-2023-3027/): Privilege escalation in RHACM (high 7.8)
- [CVE-2023-30269](https://insights.sbomify.com/CVE-2023-30269/): Other in cltphp:cltphp (high 8.1)
- [CVE-2023-30268](https://insights.sbomify.com/CVE-2023-30268/): Path traversal in cltphp:cltphp (critical 9.8)
- [CVE-2023-30267](https://insights.sbomify.com/CVE-2023-30267/): Cross-site scripting in cltphp:cltphp (medium 6.1)
- [CVE-2023-30266](https://insights.sbomify.com/CVE-2023-30266/): File upload in cltphp:cltphp (high 8.8)
- [CVE-2023-30265](https://insights.sbomify.com/CVE-2023-30265/): Path traversal in cltphp:cltphp (medium 6.5)
- [CVE-2023-30264](https://insights.sbomify.com/CVE-2023-30264/): File upload in cltphp:cltphp (critical 9.8)
- [CVE-2023-30262](https://insights.sbomify.com/CVE-2023-30262/): Deserialization in mimsoftware:mim concurrent license server (high 8.8)
- [CVE-2023-30261](https://insights.sbomify.com/CVE-2023-30261/): Command injection in openwb:openwb (critical 9.8)
- [CVE-2023-30260](https://insights.sbomify.com/CVE-2023-30260/): RaspAP raspap-webgui Command Injection vulnerability (high 8.8)
- [CVE-2023-3026](https://insights.sbomify.com/CVE-2023-3026/): Cross-site Scripting (XSS) - Stored in jgraph/drawio (medium 6.5)
- [CVE-2023-30259](https://insights.sbomify.com/CVE-2023-30259/): Memory corruption in librecad:librecad (medium 5.5)
- [CVE-2023-30258](https://insights.sbomify.com/CVE-2023-30258/): Command injection in magnussolution:magnusbilling (critical 9.8)
- [CVE-2023-30257](https://insights.sbomify.com/CVE-2023-30257/): Memory corruption in fiio:m6 firmware (high 7.8)
- [CVE-2023-30256](https://insights.sbomify.com/CVE-2023-30256/): Cross-site scripting in webkul:qloapps (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/326/