# CVEs published 2023-06-12

81 CVEs were published on June 12, 2023: 9 critical, 30 high. Days are UTC.

- [CVE-2023-32674](https://cve.now/CVE-2023-32674.md): Certain versions of HP PC Hardware Diagnostics Windows are potentially vulnerable to buffer overflow. (CVSS 9.8, HP PC Hardware Diagnostics Windows)
- [CVE-2023-32673](https://cve.now/CVE-2023-32673.md): Certain versions of HP PC Hardware Diagnostics Windows, HP Image Assistant, and HP Thunderbolt Dock G2 Firmware are potentially vulnerable… (CVSS 9.8, HP PC Hardware Diagnostics Windows, HP Image Assistant, and…)
- [CVE-2023-26298](https://cve.now/CVE-2023-26298.md): Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges. (CVSS 8.8, HP Device Manager)
- [CVE-2023-26297](https://cve.now/CVE-2023-26297.md): Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges. (CVSS 8.8, HP Device Manager)
- [CVE-2023-26296](https://cve.now/CVE-2023-26296.md): Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges. (CVSS 8.8, HP Device Manager)
- [CVE-2023-26295](https://cve.now/CVE-2023-26295.md): Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges. (CVSS 9.8, HP Device Manager)
- [CVE-2023-26294](https://cve.now/CVE-2023-26294.md): Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges. (CVSS 7.8, HP Device Manager)
- [CVE-2023-1897](https://cve.now/CVE-2023-1897.md): CVE-2023-1897 (CVSS 9.4, Atlas Copco Power Focus)
- [CVE-2023-1898](https://cve.now/CVE-2023-1898.md): CVE-2023-1898 (CVSS 9.4, Atlas Copco Power Focus)
- [CVE-2023-1899](https://cve.now/CVE-2023-1899.md): CVE-2023-1899 (CVSS 9.4, Atlas Copco Power Focus)
- [CVE-2022-43778](https://cve.now/CVE-2022-43778.md): Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may… (CVSS 7.8, HP PC BIOS)
- [CVE-2022-43777](https://cve.now/CVE-2022-43777.md): Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may… (CVSS 7.8, HP PC BIOS)
- [CVE-2022-27541](https://cve.now/CVE-2022-27541.md): Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may… (CVSS 7.8, HP PC BIOS)
- [CVE-2022-27539](https://cve.now/CVE-2022-27539.md): Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may… (CVSS 7.8, HP PC BIOS)
- [CVE-2022-36331](https://cve.now/CVE-2022-36331.md): Impersonation attack causing an Authentication Bypass on Western Digital devices (CVSS 10.0, Western Digital My Cloud OS · Western Digital My Cloud H… +1)
- [CVE-2023-2568](https://cve.now/CVE-2023-2568.md): Photo Gallery by Ays \< 5.1.7 - Reflected XSS (no CVSS, Photo Gallery by Ays)
- [CVE-2023-2362](https://cve.now/CVE-2023-2362.md): Multiple Plugins from Wow-Company - Reflected XSS (CVSS 6.1, Float menu · Bubble Menu +10)
- [CVE-2023-2398](https://cve.now/CVE-2023-2398.md): Icegram Engage \< 3.1.12 - Reflected XSS (no CVSS, Icegram Engage)
- [CVE-2023-0431](https://cve.now/CVE-2023-0431.md): File Away \<= 3.9.9.0.1 - Contributor+ Stored XSS via Shortcode (no CVSS, File Away)
- [CVE-2023-2718](https://cve.now/CVE-2023-2718.md): Contact Form Email \< 1.3.38 - Unauthenticated Stored Cross-Site Scripting (no CVSS, Contact Form Email)
- [CVE-2023-1323](https://cve.now/CVE-2023-1323.md): Easy Forms for MailChimp \< 6.8.9 - Admin+ Stored XSS (CVSS 4.8, Easy Forms for Mailchimp)
- [CVE-2023-34336](https://cve.now/CVE-2023-34336.md): AMI BMC contains a vulnerability in the IPMI handler, where an attacker with the required privileges can cause a buffer overflow, which… (CVSS 8.1, AMI MegaRAC\_SPx)
- [CVE-2023-34335](https://cve.now/CVE-2023-34335.md): AMI BMC contains a vulnerability in the IPMI handler, where an unauthenticated host is allowed to write to a host SPI flash, bypassing… (CVSS 7.7, AMI MegaRAC\_SPx)
- [CVE-2023-34334](https://cve.now/CVE-2023-34334.md): AMI BMC contains a vulnerability in the SPX REST API, where an attacker with the required privileges can inject arbitrary shell commands… (CVSS 7.2, AMI MegaRAC\_SPx)
- [CVE-2023-34343](https://cve.now/CVE-2023-34343.md): AMI BMC contains a vulnerability in the SPX REST API, where an attacker with the required privileges can inject arbitrary shell commands… (CVSS 7.2, AMI MegaRAC\_SPx)
- [CVE-2023-34342](https://cve.now/CVE-2023-34342.md): AMI BMC contains a vulnerability in the IPMI handler, where an attacker can upload and download arbitrary files under certain… (CVSS 6.0, AMI MegaRAC\_SPx)
- [CVE-2023-34341](https://cve.now/CVE-2023-34341.md): AMI BMC contains a vulnerability in the SPX REST API, where an attacker with the required privileges can read and write to arbitrary… (CVSS 7.2, AMI MegaRAC\_SPx)
- [CVE-2023-34345](https://cve.now/CVE-2023-34345.md): AMI BMC contains a vulnerability in the SPX REST API, where an attacker with the required privileges can access arbitrary files, which may… (CVSS 6.5, AMI MegaRAC\_SPx)
- [CVE-2023-34344](https://cve.now/CVE-2023-34344.md): A vulnerability in the IPMI handler, where an unauthorized attacker can use certain oracles to guess a valid username (CVSS 5.3, AMI MegaRAC\_SPx)
- [CVE-2023-34246](https://cve.now/CVE-2023-34246.md): Doorkeeper Improper Authentication vulnerability (CVSS 4.2, doorkeeper-gem doorkeeper · doorkeeper)
- [CVE-2023-34105](https://cve.now/CVE-2023-34105.md): SRS has command injection vulnerability in demonstration api-server for HTTP callback. (CVSS 7.5, ossrs srs)
- [CVE-2023-35054](https://cve.now/CVE-2023-35054.md): In JetBrains YouTrack before 2023.1.10518 stored XSS in a Markdown-rendering engine was possible (CVSS 4.6, JetBrains YouTrack)
- [CVE-2023-35053](https://cve.now/CVE-2023-35053.md): In JetBrains YouTrack before 2023.1.10518 a DoS attack was possible via Helpdesk forms (CVSS 7.5, JetBrains YouTrack)
- [CVE-2023-29385](https://cve.now/CVE-2023-29385.md): WordPress WP Abstracts Plugin \<= 2.6.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Kevon Adonis WP Abstracts)
- [CVE-2023-34212](https://cve.now/CVE-2023-34212.md): Apache NiFi: Potential Deserialization of Untrusted Data with JNDI in JMS Components (no CVSS, Apache Software Foundation Apache NiFi · org.apache.nifi:ni…)
- [CVE-2023-28933](https://cve.now/CVE-2023-28933.md): WordPress Call Now Accessibility Button Plugin \<= 1.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, StPeteDesign Call Now Accessibility Button)
- [CVE-2023-34468](https://cve.now/CVE-2023-34468.md): Apache NiFi: Potential Code Injection with Database Services using H2 (CVSS 8.8, Apache Software Foundation Apache NiFi · nifi +3)
- [CVE-2023-34026](https://cve.now/CVE-2023-34026.md): WordPress This Day In History Plugin \<= 3.10.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, BrokenCrust This Day In History)
- [CVE-2023-3208](https://cve.now/CVE-2023-3208.md): RoadFlow Visual Process Engine .NET Core Mvc Login sql injection (CVSS 6.3, RoadFlow Visual Process Engine .NET Core Mvc)
- [CVE-2023-3206](https://cve.now/CVE-2023-3206.md): Chengdu VEC40G denial of service (CVSS 5.3, Chengdu VEC40G)
- [CVE-2023-32118](https://cve.now/CVE-2023-32118.md): WordPress SALERT Plugin \<= 1.2.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, WPoperation SALERT – Fake Sales Notification WooCommerce)
- [CVE-2023-31236](https://cve.now/CVE-2023-31236.md): WordPress Scripts n Styles Plugin \<= 3.5.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, unFocus Projects Scripts n Styles)
- [CVE-2023-32961](https://cve.now/CVE-2023-32961.md): WordPress Zotpress Plugin \<= 7.3.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Katie Seaborn Zotpress)
- [CVE-2023-30745](https://cve.now/CVE-2023-30745.md): WordPress IP Metaboxes Plugin \<= 2.1.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Phan Chuong IP Metaboxes)
- [CVE-2023-30753](https://cve.now/CVE-2023-30753.md): WordPress IP Metaboxes Plugin \<= 2.1.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Phan Chuong IP Metaboxes)
- [CVE-2023-23822](https://cve.now/CVE-2023-23822.md): WordPress UTM Tracker Plugin \<= 1.3.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Ludwig Media UTM Tracker)
- [CVE-2023-23819](https://cve.now/CVE-2023-23819.md): WordPress itemprop WP for SERP/SEO Rich snippets Plugin \<= 3.5.201706131 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Rolands Umbrovskis itemprop WP for SERP/SEO Rich snippets)
- [CVE-2022-47140](https://cve.now/CVE-2022-47140.md): WordPress ARMember Plugin \<= 4.0.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Repute InfoSystems ARMember)
- [CVE-2022-45827](https://cve.now/CVE-2022-45827.md): WordPress Video Contest WordPress Plugin Plugin \<= 3.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, GalleryPlugins Video Contest)
- [CVE-2023-23818](https://cve.now/CVE-2023-23818.md): WordPress WP Register Profile With Shortcode Plugin \<= 3.5.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Aviplugins.com WP Register Profile With Shortcode)
- [CVE-2015-10118](https://cve.now/CVE-2015-10118.md): cchetanonline WP-CopyProtect wp-copyprotect.php CopyProtect\_options\_page cross site scripting (CVSS 3.5, cchetanonline WP-CopyProtect)
- [CVE-2023-26133](https://cve.now/CVE-2023-26133.md): All versions of the package progressbar.js are vulnerable to Prototype Pollution via the function extend() in the file utils.js. (CVSS 8.2, progressbar.js)
- [CVE-2020-36732](https://cve.now/CVE-2020-36732.md): The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the… (CVSS 5.3, crypto-js)
- [CVE-2022-38156](https://cve.now/CVE-2022-38156.md): A remote command injection issues exists in the web server of the Kratos SpectralNet device with SpectralNet Narrowband (NB) before 1.7.5. (no CVSS)
- [CVE-2023-27716](https://cve.now/CVE-2023-27716.md): An issue was discovered in freakchicken kafkaUI-lite 1.2.11 allows attackers on the same network to gain escalated privileges for the… (CVSS 9.8)
- [CVE-2023-28478](https://cve.now/CVE-2023-28478.md): TP-Link EC-70 devices through 2.3.4 Build 20220902 rel.69498 have a Buffer Overflow. (CVSS 8.8)
- [CVE-2023-30198](https://cve.now/CVE-2023-30198.md): Prestashop winbizpayment \<= 1.0.2 is vulnerable to Incorrect Access Control via modules/winbizpayment/downloads/download.php. (CVSS 7.5)
- [CVE-2023-3159](https://cve.now/CVE-2023-3159.md): A use after free issue was discovered in driver/firewire in outbound\_phy\_packet\_callback in the Linux Kernel. (CVSS 6.7, Kernel)
- [CVE-2023-3161](https://cve.now/CVE-2023-3161.md): A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. (CVSS 5.5, Linux Kernel)
- [CVE-2023-32219](https://cve.now/CVE-2023-32219.md): Mazda cars unlocking (CVSS 6.5, Mazda)
- [CVE-2023-32220](https://cve.now/CVE-2023-32220.md): Milesight NCR/Camera Authentication Bypass (CVSS 8.2, Milesight NCR/camera)
- [CVE-2023-32221](https://cve.now/CVE-2023-32221.md): EaseUS Todo Backup may allow local privilege escalation (CVSS 8.8, EaseUS Todo Backup)
- [CVE-2023-33253](https://cve.now/CVE-2023-33253.md): LabCollector 6.0 though 6.15 allows remote code execution. (no CVSS)
- [CVE-2023-33290](https://cve.now/CVE-2023-33290.md): The git-url-parse crate through 0.4.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to normalize\_url in… (no CVSS, git-url-parse)
- [CVE-2023-33492](https://cve.now/CVE-2023-33492.md): EyouCMS 1.6.2 is vulnerable to Cross Site Scripting (XSS). (no CVSS)
- [CVE-2023-33625](https://cve.now/CVE-2023-33625.md): D-Link DIR-600 Hardware Version B5, Firmware Version 2.18 was discovered to contain a command injection vulnerability via the ST parameter… (no CVSS)
- [CVE-2023-33626](https://cve.now/CVE-2023-33626.md): D-Link DIR-600 Hardware Version B5, Firmware Version 2.18 was discovered to contain a stack overflow via the gena.cgi binary. (no CVSS)
- [CVE-2023-34488](https://cve.now/CVE-2023-34488.md): NanoMQ 0.17.5 has a one-byte heap-based buffer over-read in the conn\_handler function of mqtt\_parser.c when it processes malformed messages. (CVSS 8.0)
- [CVE-2023-34494](https://cve.now/CVE-2023-34494.md): NanoMQ 0.16.5 is vulnerable to heap-use-after-free in the nano\_ctx\_send function of nmq\_mqtt.c. (no CVSS)
- [CVE-2023-34581](https://cve.now/CVE-2023-34581.md): Sourcecodester Service Provider Management System v1.0 is vulnerable to SQL Injection via the ID parameter in… (no CVSS)
- [CVE-2023-34855](https://cve.now/CVE-2023-34855.md): A Cross Site Scripting (XSS) vulnerability in Youxun Electronic Equipment (Shanghai) Co., Ltd AC Centralized Management Platform v1.02.040… (no CVSS)
- [CVE-2023-34940](https://cve.now/CVE-2023-34940.md): Asus RT-N10LX Router v2.0.0.39 was discovered to contain a stack overflow via the url parameter at /start-apply.html. (CVSS 7.5)
- [CVE-2023-34941](https://cve.now/CVE-2023-34941.md): A stored cross-site scripting (XSS) vulnerability in the urlFilterList function of Asus RT-N10LX Router v2.0.0.39 allows attackers to… (CVSS 5.4)
- [CVE-2023-34942](https://cve.now/CVE-2023-34942.md): Asus RT-N10LX Router v2.0.0.39 was discovered to contain a stack overflow via the mac parameter at /start-apply.html. (no CVSS)
- [CVE-2023-35031](https://cve.now/CVE-2023-35031.md): Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8, Assistant V10 R0, Manager V10 R1 before V10 R1.42.0 and V10… (CVSS 8.8)
- [CVE-2023-35032](https://cve.now/CVE-2023-35032.md): Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8 and Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8 allow… (no CVSS)
- [CVE-2023-35033](https://cve.now/CVE-2023-35033.md): Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8, Assistant V10 R0, Manager V10 R1 before V10 R1.42.0 and V10… (no CVSS)
- [CVE-2023-35034](https://cve.now/CVE-2023-35034.md): Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8 and Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8 allow… (no CVSS)
- [CVE-2023-35035](https://cve.now/CVE-2023-35035.md): Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8, Assistant V10 R0, Manager V10 R1 before V10 R1.42.0 and V10… (no CVSS)
- [CVE-2023-35036](https://cve.now/CVE-2023-35036.md): In Progress MOVEit Transfer before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022.1.6 (14.1.6), and 2023.0.2 (15.0.2), SQL… (CVSS 9.1)
- [CVE-2023-35042](https://cve.now/CVE-2023-35042.md): GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via java.lang.Runtime.getRuntime().exec in… (no CVSS, org.geoserver:gs-wms · org.geoserver:gs-wfs +1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2023-06-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.