# CVEs published 2023-05-16

94 CVEs were published on May 16, 2023: 10 critical, 32 high. Days are UTC.

- [CVE-2023-2528](https://cve.now/CVE-2023-2528.md): Contact Form by Supsystic \<= 1.7.24 - Cross-Site Request Forgery via AJAX action (CVSS 5.4, supsysticcom Contact Form by Supsystic)
- [CVE-2023-30510](https://cve.now/CVE-2023-30510.md): Authenticated Server-side Request Forgery in Aruba EdgeConnect Enterprise Web Management Interface (CVSS 4.1, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2023-30509](https://cve.now/CVE-2023-30509.md): Authenticated Remote Path Traversal in Aruba EdgeConnect Enterprise Command Line Interface (CVSS 4.9, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2023-30508](https://cve.now/CVE-2023-30508.md): Authenticated Remote Path Traversal in Aruba EdgeConnect Enterprise Command Line Interface (CVSS 4.9, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2023-30507](https://cve.now/CVE-2023-30507.md): Authenticated Remote Path Traversal in Aruba EdgeConnect Enterprise Command Line Interface (CVSS 4.9, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2023-30506](https://cve.now/CVE-2023-30506.md): Authenticated Remote Code Execution in Aruba EdgeConnect Enterprise Command Line Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2023-30505](https://cve.now/CVE-2023-30505.md): Authenticated Remote Code Execution in Aruba EdgeConnect Enterprise Command Line Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2023-30504](https://cve.now/CVE-2023-30504.md): Authenticated Remote Code Execution in Aruba EdgeConnect Enterprise Command Line Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2023-30503](https://cve.now/CVE-2023-30503.md): Authenticated Remote Code Execution in Aruba EdgeConnect Enterprise Command Line Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2023-30502](https://cve.now/CVE-2023-30502.md): Authenticated Remote Code Execution in Aruba EdgeConnect Enterprise Command Line Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2023-30501](https://cve.now/CVE-2023-30501.md): Authenticated Remote Code Execution in Aruba EdgeConnect Enterprise Command Line Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2023-2726](https://cve.now/CVE-2023-2726.md): Inappropriate implementation in WebApp Installs in Google Chrome prior to 113.0.5672.126 allowed an attacker who convinced a user to… (CVSS 8.8, Google Chrome)
- [CVE-2023-2725](https://cve.now/CVE-2023-2725.md): Use after free in Guest View in Google Chrome prior to 113.0.5672.126 allowed an attacker who convinced a user to install a malicious… (CVSS 8.8, Google Chrome)
- [CVE-2023-2724](https://cve.now/CVE-2023-2724.md): Type confusion in V8 in Google Chrome prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap corruption via a… (CVSS 8.8, Google Chrome)
- [CVE-2023-2723](https://cve.now/CVE-2023-2723.md): Use after free in DevTools in Google Chrome prior to 113.0.5672.126 allowed a remote attacker who had compromised the renderer process to… (CVSS 8.8, Google Chrome)
- [CVE-2023-2722](https://cve.now/CVE-2023-2722.md): Use after free in Autofill UI in Google Chrome on Android prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap… (CVSS 8.8, Google Chrome)
- [CVE-2023-2721](https://cve.now/CVE-2023-2721.md): Use after free in Navigation in Google Chrome prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap corruption via… (CVSS 8.8, Google Chrome)
- [CVE-2023-2631](https://cve.now/CVE-2023-2631.md): CSRF vulnerability and missing permission checks in Code Dx Plugin (CVSS 4.3, Jenkins Code Dx Plugin · org.jenkins-ci.plugins:codedx)
- [CVE-2023-2195](https://cve.now/CVE-2023-2195.md): CSRF vulnerability and missing permission checks in Code Dx Plugin (CVSS 4.3, Jenkins Code Dx Plugin · org.jenkins-ci.plugins:codedx)
- [CVE-2023-2633](https://cve.now/CVE-2023-2633.md): API keys stored and displayed in plain text by Code Dx Plugin (CVSS 4.3, Jenkins Code Dx Plugin · org.jenkins-ci.plugins:codedx)
- [CVE-2023-2632](https://cve.now/CVE-2023-2632.md): API keys stored and displayed in plain text by Code Dx Plugin (CVSS 4.3, Jenkins Code Dx Plugin · org.jenkins-ci.plugins:codedx)
- [CVE-2023-2196](https://cve.now/CVE-2023-2196.md): Missing permission checks in Code Dx Plugin (CVSS 4.3, Jenkins Code Dx Plugin · org.jenkins-ci.plugins:codedx)
- [CVE-2023-2740](https://cve.now/CVE-2023-2740.md): SourceCodester Guest Management System GET Parameter dateTest.php cross site scripting (CVSS 3.5, SourceCodester Guest Management System)
- [CVE-2023-33007](https://cve.now/CVE-2023-33007.md): Jenkins LoadComplete support Plugin 1.0 and earlier does not escape the LoadComplete test name, resulting in a stored cross-site scripting… (CVSS 5.4, Jenkins Project Jenkins LoadComplete support Plugin · org.j…)
- [CVE-2023-33006](https://cve.now/CVE-2023-33006.md): A cross-site request forgery (CSRF) vulnerability in Jenkins WSO2 Oauth Plugin 1.0 and earlier allows attackers to trick users into… (CVSS 5.4, Jenkins Project Jenkins WSO2 Oauth Plugin · org.jenkins-ci.…)
- [CVE-2023-33005](https://cve.now/CVE-2023-33005.md): Jenkins WSO2 Oauth Plugin 1.0 and earlier does not invalidate the previous session on login. (CVSS 5.4, Jenkins Project Jenkins WSO2 Oauth Plugin · org.jenkins-ci.…)
- [CVE-2023-33004](https://cve.now/CVE-2023-33004.md): A missing permission check in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers with Overall/Read permission to reset profiler… (CVSS 4.3, Jenkins Project Jenkins Tag Profiler Plugin · org.jenkins-c…)
- [CVE-2023-33003](https://cve.now/CVE-2023-33003.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers to reset profiler… (CVSS 4.3, Jenkins Project Jenkins Tag Profiler Plugin · org.jenkins-c…)
- [CVE-2023-33002](https://cve.now/CVE-2023-33002.md): Jenkins TestComplete support Plugin 2.8.1 and earlier does not escape the TestComplete project name, resulting in a stored cross-site… (CVSS 5.4, Jenkins Project Jenkins TestComplete support Plugin · org.j…)
- [CVE-2023-33001](https://cve.now/CVE-2023-33001.md): Jenkins HashiCorp Vault Plugin 360.v0a\_1c04cf807d and earlier does not properly mask (i.e., replace with asterisks) credentials in the… (CVSS 7.5, Jenkins Project Jenkins HashiCorp Vault Plugin · com.datapi…)
- [CVE-2023-33000](https://cve.now/CVE-2023-33000.md): Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.149 and earlier does not mask credentials displayed on the configuration… (CVSS 7.5, Jenkins Project Jenkins NS-ND Integration Performance Publi…)
- [CVE-2023-32999](https://cve.now/CVE-2023-32999.md): A missing permission check in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers with Overall/Read permission to connect to an… (CVSS 4.3, Jenkins Project Jenkins AppSpider Plugin · com.rapid7:jenki…)
- [CVE-2023-32998](https://cve.now/CVE-2023-32998.md): A cross-site request forgery (CSRF) vulnerability in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers to connect to an… (CVSS 8.8, Jenkins Project Jenkins AppSpider Plugin · com.rapid7:jenki…)
- [CVE-2023-32997](https://cve.now/CVE-2023-32997.md): Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the previous session on login. (CVSS 8.8, Jenkins Project Jenkins CAS Plugin · org.jenkins-ci.plugins…)
- [CVE-2023-32996](https://cve.now/CVE-2023-32996.md): A missing permission check in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers with Overall/Read permission to… (CVSS 4.3, Jenkins Project Jenkins SAML Single Sign On(SSO) Plugin · i…)
- [CVE-2023-32995](https://cve.now/CVE-2023-32995.md): A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers to send an… (CVSS 8.8, Jenkins Project Jenkins SAML Single Sign On(SSO) Plugin · i…)
- [CVE-2023-32994](https://cve.now/CVE-2023-32994.md): Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to… (CVSS 3.7, Jenkins Project Jenkins SAML Single Sign On(SSO) Plugin · i…)
- [CVE-2023-32993](https://cve.now/CVE-2023-32993.md): Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the… (CVSS 4.8, Jenkins Project Jenkins SAML Single Sign On(SSO) Plugin · i…)
- [CVE-2023-32992](https://cve.now/CVE-2023-32992.md): Missing permission checks in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allow attackers with Overall/Read permission to… (CVSS 8.8, Jenkins Project Jenkins SAML Single Sign On(SSO) Plugin · i…)
- [CVE-2023-32991](https://cve.now/CVE-2023-32991.md): A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allows attackers to send an… (CVSS 8.8, Jenkins Project Jenkins SAML Single Sign On(SSO) Plugin · i…)
- [CVE-2023-32990](https://cve.now/CVE-2023-32990.md): A missing permission check in Jenkins Azure VM Agents Plugin 852.v8d35f0960a\_43 and earlier allows attackers with Overall/Read permission… (CVSS 6.5, Jenkins Project Jenkins Azure VM Agents Plugin · org.jenkin…)
- [CVE-2023-32989](https://cve.now/CVE-2023-32989.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Azure VM Agents Plugin 852.v8d35f0960a\_43 and earlier allows attackers to… (CVSS 8.8, Jenkins Project Jenkins Azure VM Agents Plugin · org.jenkin…)
- [CVE-2023-32988](https://cve.now/CVE-2023-32988.md): A missing permission check in Jenkins Azure VM Agents Plugin 852.v8d35f0960a\_43 and earlier allows attackers with Overall/Read permission… (CVSS 4.3, Jenkins Project Jenkins Azure VM Agents Plugin · org.jenkin…)
- [CVE-2023-32987](https://cve.now/CVE-2023-32987.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Reverse Proxy Auth Plugin 1.7.4 and earlier allows attackers to connect to an… (CVSS 8.8, Jenkins Project Jenkins Reverse Proxy Auth Plugin · org.jen…)
- [CVE-2023-32986](https://cve.now/CVE-2023-32986.md): Jenkins File Parameter Plugin 285.v757c5b\_67a\_c25 and earlier does not restrict the name (and resulting uploaded file name) of Stashed… (CVSS 8.8, Jenkins Project Jenkins File Parameter Plugin · io.jenkins.…)
- [CVE-2023-32985](https://cve.now/CVE-2023-32985.md): Jenkins Sidebar Link Plugin 2.2.1 and earlier does not restrict the path of files in a method implementing form validation, allowing… (CVSS 4.3, Jenkins Project Jenkins Sidebar Link Plugin · org.jenkins-c…)
- [CVE-2023-32984](https://cve.now/CVE-2023-32984.md): Jenkins TestNG Results Plugin 730.v4c5283037693 and earlier does not escape several values that are parsed from TestNG report files and… (CVSS 5.4, Jenkins Project Jenkins TestNG Results Plugin · org.jenkins…)
- [CVE-2023-32983](https://cve.now/CVE-2023-32983.md): Jenkins Ansible Plugin 204.v8191fd551eb\_f and earlier does not mask extra variables displayed on the configuration form, increasing the… (CVSS 5.3, Jenkins Project Jenkins Ansible Plugin · org.jenkins-ci.plu…)
- [CVE-2023-32982](https://cve.now/CVE-2023-32982.md): Jenkins Ansible Plugin 204.v8191fd551eb\_f and earlier stores extra variables unencrypted in job config.xml files on the Jenkins controller… (CVSS 4.3, Jenkins Project Jenkins Ansible Plugin · org.jenkins-ci.plu…)
- [CVE-2023-32981](https://cve.now/CVE-2023-32981.md): An arbitrary file write vulnerability in Jenkins Pipeline Utility Steps Plugin 2.15.2 and earlier allows attackers able to provide crafted… (CVSS 8.8, Jenkins Project Jenkins Pipeline Utility Steps Plugin · org…)
- [CVE-2023-32980](https://cve.now/CVE-2023-32980.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Email Extension Plugin allows attackers to make another user stop watching an… (CVSS 4.3, Jenkins Project Jenkins Email Extension Plugin · org.jenkin…)
- [CVE-2023-32979](https://cve.now/CVE-2023-32979.md): Jenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with… (CVSS 4.3, Jenkins Project Jenkins Email Extension Plugin · org.jenkin…)
- [CVE-2023-32978](https://cve.now/CVE-2023-32978.md): A cross-site request forgery (CSRF) vulnerability in Jenkins LDAP Plugin allows attackers to connect to an attacker-specified LDAP server… (CVSS 4.3, Jenkins Project Jenkins LDAP Plugin · org.jenkins-ci.plugin…)
- [CVE-2023-32977](https://cve.now/CVE-2023-32977.md): Jenkins Pipeline: Job Plugin does not escape the display name of the build that caused an earlier build to be aborted, resulting in a… (CVSS 5.4, Jenkins Project Jenkins Pipeline: Job Plugin · org.jenkins-…)
- [CVE-2023-2739](https://cve.now/CVE-2023-2739.md): Gira HomeServer hslist cross site scripting (CVSS 4.3, Gira HomeServer)
- [CVE-2023-28076](https://cve.now/CVE-2023-28076.md): CloudLink 7.1.2 and all prior versions contain a broken or risky cryptographic algorithm vulnerability. (CVSS 5.9, Dell CloudLink)
- [CVE-2023-2738](https://cve.now/CVE-2023-2738.md): Tongda OA GatewayController.php actionGetdata unrestricted upload (CVSS 6.3, Tongda OA)
- [CVE-2023-29439](https://cve.now/CVE-2023-29439.md): WordPress FooGallery Plugin \<= 2.2.35 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, FooPlugins FooGallery)
- [CVE-2023-23703](https://cve.now/CVE-2023-23703.md): WordPress Arconix Shortcodes Plugin \<= 2.1.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Tyche Softwares Arconix Shortcodes)
- [CVE-2023-23709](https://cve.now/CVE-2023-23709.md): WordPress WPJAM Basic Plugin \<= 6.2.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Denis WPJAM Basic)
- [CVE-2023-23720](https://cve.now/CVE-2023-23720.md): WordPress Verified Reviews (Avis Vérifiés) Plugin \<= 2.3.13 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, NetReviews SAS Verified Reviews)
- [CVE-2023-23657](https://cve.now/CVE-2023-23657.md): WordPress Mail Subscribe List Plugin \<= 2.1.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Richard Leishman t/a Webforward Mail Subscribe List)
- [CVE-2023-23641](https://cve.now/CVE-2023-23641.md): WordPress Uji Popup Plugin \<= 1.4.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, WPmanage Uji Popup)
- [CVE-2023-23727](https://cve.now/CVE-2023-23727.md): WordPress Live Chat by Formilla – Real-time Chat & Chatbots Plugin Plugin \<= 1.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Live Chat by Formilla)
- [CVE-2023-2548](https://cve.now/CVE-2023-2548.md): RegistrationMagic \<= 5.2.0.5 - Authenticated (Admin+) Insecure Direct Object Reference to Arbitrary User Password Change (CVSS 6.6, metagauss RegistrationMagic – Custom Registration Forms, Us…)
- [CVE-2023-2499](https://cve.now/CVE-2023-2499.md): RegistrationMagic \<= 5.2.1.0 - Authentication Bypass (CVSS 9.8, metagauss RegistrationMagic – Custom Registration Forms, Us…)
- [CVE-2023-23676](https://cve.now/CVE-2023-23676.md): WordPress File Gallery Plugin \<= 1.8.5.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Bruno "Aesqe" Babic File Gallery)
- [CVE-2023-23673](https://cve.now/CVE-2023-23673.md): WordPress I Recommend This Plugin \<= 3.8.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Harish Chouhan, Themeist I Recommend This)
- [CVE-2023-32956](https://cve.now/CVE-2023-32956.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in CGI component in Synology… (CVSS 9.8, Synology Router Manager)
- [CVE-2023-32955](https://cve.now/CVE-2023-32955.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DHCP Client Functionality in… (CVSS 8.1, Synology Router Manager)
- [CVE-2023-2161](https://cve.now/CVE-2023-2161.md): A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized read access to the… (CVSS 5.0, Schneider Electric OPC Factory Server)
- [CVE-2023-2710](https://cve.now/CVE-2023-2710.md): video carousel slider with lightbox \<= 1.0.22 - Reflected Cross-Site Scripting (CVSS 6.1, nik00726 video carousel slider with lightbox)
- [CVE-2023-2708](https://cve.now/CVE-2023-2708.md): Video Gallery \<= 1.0.10 - Reflected Cross-Site Scripting (CVSS 6.1, nik00726 Video Gallery)
- [CVE-2021-27131](https://cve.now/CVE-2021-27131.md): Moodle 3.10.1 is vulnerable to persistent/stored cross-site scripting (XSS) due to the improper input sanitization on the "Additional HTML… (no CVSS, moodle/moodle)
- [CVE-2023-25394](https://cve.now/CVE-2023-25394.md): Videostream macOS app 0.5.0 and 0.4.3 has a Race Condition. (CVSS 7.0)
- [CVE-2023-2730](https://cve.now/CVE-2023-2730.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 6.3, pimcore/pimcore)
- [CVE-2023-27742](https://cve.now/CVE-2023-27742.md): IDURAR ERP/CRM v1 was discovered to contain a SQL injection vulnerability via the component /api/login. (CVSS 9.8)
- [CVE-2023-29927](https://cve.now/CVE-2023-29927.md): Versions of Sage 300 through 2022 implement role-based access controls that are only enforced client-side. (CVSS 4.3)
- [CVE-2023-29961](https://cve.now/CVE-2023-29961.md): D-Link DIR-605L firmware version 1.17B01 BETA is vulnerable to stack overflow via /goform/formTcpipSetup, (CVSS 9.8)
- [CVE-2023-30189](https://cve.now/CVE-2023-30189.md): Prestashop posstaticblocks \<= 1.0.0 is vulnerable to SQL Injection via posstaticblocks::getPosCurrentHook(). (CVSS 9.8)
- [CVE-2023-30281](https://cve.now/CVE-2023-30281.md): Insecure permissions vulnerability was discovered, due to a lack of permissions’s control in scquickaccounting before v3.7.3 from Store… (CVSS 7.5)
- [CVE-2023-30452](https://cve.now/CVE-2023-30452.md): The MoroSystems EasyMind - Mind Maps plugin before 2.15.0 for Confluence allows persistent XSS when saving a Mind Map with the hyperlink… (CVSS 5.4)
- [CVE-2023-31519](https://cve.now/CVE-2023-31519.md): Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the email parameter at login\_core.php. (CVSS 9.8)
- [CVE-2023-31544](https://cve.now/CVE-2023-31544.md): A stored cross-site scripting (XSS) vulnerability in alkacon-OpenCMS v11.0.0.0 allows attackers to execute arbitrary web scripts or HTML… (CVSS 5.4, org.opencms:opencms-core)
- [CVE-2023-31572](https://cve.now/CVE-2023-31572.md): An issue in Bludit 4.0.0-rc-2 allows authenticated attackers to change the Administrator password and escalate privileges via a crafted… (CVSS 8.8)
- [CVE-2023-31576](https://cve.now/CVE-2023-31576.md): An arbitrary file upload vulnerability in Serendipity 2.4-beta1 allows attackers to execute arbitrary code via a crafted HTML or… (CVSS 8.8)
- [CVE-2023-31587](https://cve.now/CVE-2023-31587.md): Tenda AC5 router V15.03.06.28 was discovered to contain a remote code execution (RCE) vulnerability via the Mac parameter at… (CVSS 9.8)
- [CVE-2023-31677](https://cve.now/CVE-2023-31677.md): Insecure permissions in luowice 3.5.18 allow attackers to view information for other alarm devices via modification of the eseeid parameter. (CVSS 7.5)
- [CVE-2023-31678](https://cve.now/CVE-2023-31678.md): Incorrect access control in Videogo v6.8.1 allows attackers to bind shared devices after the connection has been ended. (CVSS 5.3)
- [CVE-2023-31679](https://cve.now/CVE-2023-31679.md): Incorrect access control in Videogo v6.8.1 allows attackers to access images from other devices via modification of the Device Id parameter. (CVSS 7.5)
- [CVE-2023-31848](https://cve.now/CVE-2023-31848.md): davinci 0.3.0-rc is vulnerable to Server-side request forgery (SSRF). (CVSS 8.8)
- [CVE-2023-31856](https://cve.now/CVE-2023-31856.md): A command injection vulnerability in the hostTime parameter in the function NTPSyncWithHostof TOTOLINK CP300+ V5.2cu.7594\_B20200910 allows… (CVSS 9.8)
- [CVE-2023-31857](https://cve.now/CVE-2023-31857.md): Sourcecodester Online Computer and Laptop Store 1.0 allows unrestricted file upload and can lead to remote code execution. (CVSS 9.8)
- [CVE-2023-31890](https://cve.now/CVE-2023-31890.md): An XML Deserialization vulnerability in glazedlists v1.11.0 allows an attacker to execute arbitrary code via the BeanXMLByteCoder.decode()… (CVSS 9.8, com.glazedlists:glazedlists)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2023-05-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.