CVEs published May 1, 2023
38 CVEs were published on May 1, 2023: 4 critical, 12 high.
- Published
- 38
- Critical
- 4
- High
- 12
- Medium
- 19
- Low
- 2
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- Zyxel NBG-418N v2 firmware
- 4
- Apache Software Foundation Apache StreamPark · org.apache.s…
- 2
- Lenovo XClarity Controller
- 2
- Linux Kernel
- 2
- Apache Software Foundation Apache StreamPark · org.apach… +1
- 1
- Atlassian Confluence Data Center · Atlassian Confluence Ser…
- 1
- editor.md
- 1
- HashiCorp Vault Enterprise
- 1
- Hewlett Packard Enterprise (HPE) HPE ProLiant RL300 Gen11
- 1
- IP Blacklist Cloud Plugin
- 1
Critical 4
- CVE-2022-46365Apache StreamPark (incubating): Logic error causing any account resetApache Software Foundation Apache StreamPark · org.apache.s…
- CVE-2022-45802Apache StreamPark (incubating): Upload any file to any directoryApache Software Foundation Apache StreamPark · org.apach… +1
- CVE-2022-35898OpenText BizManager before 16.6.0.1 does not perform proper validation during the change-password operation.
- CVE-2023-29635File upload vulnerability in Antabot White-Jotter v0.2.2, allows remote attackers to execute malicious code via the file parameter to functi
High 12
- CVE-2022-4568A directory permissions management vulnerability in Lenovo System Update may allow elevation of privileges.Lenovo System Update
- CVE-2023-0683A valid, authenticated XCC user with read only access may gain elevated privileges through a specifically crafted API call.Lenovo XClarity Controller
- CVE-2023-0896A default password was reported in Lenovo Smart Clock Essential with Alexa Built In that could allow unauthorized device access to an attackLenovo Smart Clock Essential with Alexa Built In
- CVE-2023-30859Spigot Command Exploit in Tritontritonmc Triton
- CVE-2023-2235Use-after-free in Linux kernel's Performance Events subsystemLinux Kernel
- CVE-2023-2236Use-after-free in Linux kernel's Performance Events subsystemLinux Kernel
- CVE-2023-22919The post-authentication command injection vulnerability in the Zyxel NBG6604 firmware version V1.01(ABIR.0)C0 could allow an authenticated aZyxel NBG6604 firmware
- CVE-2023-22921A cross-site scripting (XSS) vulnerability in the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could allow a remote authentZyxel NBG-418N v2 firmware
- CVE-2023-22922A buffer overflow vulnerability in the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could allow a remote unauthenticated atZyxel NBG-418N v2 firmware
- CVE-2023-30061D-Link DIR-879 v105A1 is vulnerable to Authentication Bypass via phpcgi.
- CVE-2023-30063D-Link DIR-890L FW1.10 A1 is vulnerable to Authentication bypass.
- CVE-2023-30639Archer Platform 6.8 before 6.12 P6 HF1 (6.12.0.6.1) contains a stored XSS vulnerability.
Medium, low and unrated 22
- CVE-2023-2197Vault Enterprise Vulnerable to Padding Oracle Attacks When Using a CBC-based Encryption Mechanism with a HSMHashiCorp Vault Enterprise
- CVE-2023-22503Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of attachments and labelAtlassian Confluence Data Center · Atlassian Confluence Ser…
- CVE-2023-2451SourceCodester Online DJ Management System GET Parameter view_details.php sql injectionSourceCodester Online DJ Management System
- CVE-2022-48186A certificate validation vulnerability exists in the Baiying Android application which could lead to information disclosure.Lenovo Baiying
- CVE-2022-45801Apache StreamPark (incubating): LDAP Injection VulnerabilityApache Software Foundation Apache StreamPark · org.apache.s…
- CVE-2023-25492A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior through a fLenovo XClarity Controller
- CVE-2023-28092A potential security vulnerability has been identified in HPE ProLiant RL300 Gen11 Server.Hewlett Packard Enterprise (HPE) HPE ProLiant RL300 Gen11
- CVE-2018-25085Responsive Menus Configuration Setting responsive_menus.module responsive_menus_admin_form_submit cross site scriptingResponsive Menus
- CVE-2015-10105IP Blacklist Cloud Plugin CSV File Import ip_blacklist_cloud.php valid_js_identifier path traversalIP Blacklist Cloud Plugin
- CVE-2023-22923A format string vulnerability in a binary of the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could allow a remote authentiZyxel NBG-418N v2 firmware
- CVE-2023-22924A buffer overflow vulnerability in the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could allow a remote authenticated attaZyxel NBG-418N v2 firmware
- CVE-2023-26987An issue discovered in Konga 0.14.9 allows remote attackers to manipulate user accounts regardless of privilege via crafted POST request.
- CVE-2023-27035An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio and other unspecified
- CVE-2023-27108An issue was discovered in KaiOS 3.0.
- CVE-2023-29636Cross site scripting (XSS) vulnerability in ZHENFENG13 My-Blog, allows attackers to inject arbitrary web script or HTML via the "title" fiel
- CVE-2023-29637Cross Site Scripting (XSS) vulnerability in Qbian61 forum-java, allows attackers to inject arbitrary web script or HTML via editing the arti
- CVE-2023-29638Cross Site Scripting (XSS) vulnerability in WinterChenS my-site before commit 3f0423da6d5200c7a46e200da145c1f54ee18548, allows attackers to
- CVE-2023-29639Cross site scripting (XSS) vulnerability in ZHENFENG13 My-Blog, allows attackers to inject arbitrary web script or HTML via editing an artic
- CVE-2023-29641Cross Site Scripting (XSS) vulnerability in pandao editor.md thru 1.5.0 allows attackers to inject arbitrary web script or HTML via crafted editor.md
- CVE-2023-29643Cross Site Scripting (XSS) vulnerability in PerfreeBlog 3.1.2 allows attackers to execute arbitrary code via the Post function.
- CVE-2023-29680Cleartext Transmission in set-cookie:ecos_pw: Tenda N301 v6.0, Firmware v12.02.01.61_multi allows an authenticated attacker on the LAN or WL
- CVE-2023-29681Cleartext Transmission in cookie:ecos_pw: in Tenda N301 v6.0, firmware v12.03.01.06_pt allows an authenticated attacker on the LAN or WLAN t