# CVEs published 2023-05-01 38 CVEs were published on May 1, 2023: 4 critical, 12 high. Days are UTC. - [CVE-2023-2197](https://cve.now/CVE-2023-2197.md): Vault Enterprise Vulnerable to Padding Oracle Attacks When Using a CBC-based Encryption Mechanism with a HSM (CVSS 2.5, HashiCorp Vault Enterprise) - [CVE-2023-22503](https://cve.now/CVE-2023-22503.md): Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of attachments and label (CVSS 5.3, Atlassian Confluence Data Center · Atlassian Confluence Ser…) - [CVE-2023-2451](https://cve.now/CVE-2023-2451.md): SourceCodester Online DJ Management System GET Parameter view\_details.php sql injection (CVSS 6.3, SourceCodester Online DJ Management System) - [CVE-2022-46365](https://cve.now/CVE-2022-46365.md): Apache StreamPark (incubating): Logic error causing any account reset (CVSS 9.1, Apache Software Foundation Apache StreamPark · org.apache.s…) - [CVE-2022-48186](https://cve.now/CVE-2022-48186.md): A certificate validation vulnerability exists in the Baiying Android application which could lead to information disclosure. (CVSS 6.2, Lenovo Baiying) - [CVE-2022-45801](https://cve.now/CVE-2022-45801.md): Apache StreamPark (incubating): LDAP Injection Vulnerability (no CVSS, Apache Software Foundation Apache StreamPark · org.apache.s…) - [CVE-2022-4568](https://cve.now/CVE-2022-4568.md): A directory permissions management vulnerability in Lenovo System Update may allow elevation of privileges. (CVSS 7.0, Lenovo System Update) - [CVE-2023-0683](https://cve.now/CVE-2023-0683.md): A valid, authenticated XCC user with read only access may gain elevated privileges through a specifically crafted API call. (CVSS 8.3, Lenovo XClarity Controller) - [CVE-2023-25492](https://cve.now/CVE-2023-25492.md): A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior through a f (CVSS 6.3, Lenovo XClarity Controller) - [CVE-2023-28092](https://cve.now/CVE-2023-28092.md): A potential security vulnerability has been identified in HPE ProLiant RL300 Gen11 Server. (CVSS 6.1, Hewlett Packard Enterprise (HPE) HPE ProLiant RL300 Gen11) - [CVE-2022-45802](https://cve.now/CVE-2022-45802.md): Apache StreamPark (incubating): Upload any file to any directory (CVSS 9.8, Apache Software Foundation Apache StreamPark · org.apach… +1) - [CVE-2023-0896](https://cve.now/CVE-2023-0896.md): A default password was reported in Lenovo Smart Clock Essential with Alexa Built In that could allow unauthorized device access to an attack (CVSS 8.8, Lenovo Smart Clock Essential with Alexa Built In) - [CVE-2023-30859](https://cve.now/CVE-2023-30859.md): Spigot Command Exploit in Triton (CVSS 7.2, tritonmc Triton) - [CVE-2023-2235](https://cve.now/CVE-2023-2235.md): Use-after-free in Linux kernel's Performance Events subsystem (CVSS 7.8, Linux Kernel) - [CVE-2023-2236](https://cve.now/CVE-2023-2236.md): Use-after-free in Linux kernel's Performance Events subsystem (CVSS 7.8, Linux Kernel) - [CVE-2018-25085](https://cve.now/CVE-2018-25085.md): Responsive Menus Configuration Setting responsive\_menus.module responsive\_menus\_admin\_form\_submit cross site scripting (CVSS 2.4, Responsive Menus) - [CVE-2015-10105](https://cve.now/CVE-2015-10105.md): IP Blacklist Cloud Plugin CSV File Import ip\_blacklist\_cloud.php valid\_js\_identifier path traversal (CVSS 6.3, IP Blacklist Cloud Plugin) - [CVE-2022-35898](https://cve.now/CVE-2022-35898.md): OpenText BizManager before 16.6.0.1 does not perform proper validation during the change-password operation. (CVSS 9.8) - [CVE-2023-22919](https://cve.now/CVE-2023-22919.md): The post-authentication command injection vulnerability in the Zyxel NBG6604 firmware version V1.01(ABIR.0)C0 could allow an authenticated a (CVSS 8.8, Zyxel NBG6604 firmware) - [CVE-2023-22921](https://cve.now/CVE-2023-22921.md): A cross-site scripting (XSS) vulnerability in the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could allow a remote authent (CVSS 7.5, Zyxel NBG-418N v2 firmware) - [CVE-2023-22922](https://cve.now/CVE-2023-22922.md): A buffer overflow vulnerability in the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could allow a remote unauthenticated at (CVSS 7.5, Zyxel NBG-418N v2 firmware) - [CVE-2023-22923](https://cve.now/CVE-2023-22923.md): A format string vulnerability in a binary of the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could allow a remote authenti (CVSS 6.5, Zyxel NBG-418N v2 firmware) - [CVE-2023-22924](https://cve.now/CVE-2023-22924.md): A buffer overflow vulnerability in the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could allow a remote authenticated atta (CVSS 4.9, Zyxel NBG-418N v2 firmware) - [CVE-2023-26987](https://cve.now/CVE-2023-26987.md): An issue discovered in Konga 0.14.9 allows remote attackers to manipulate user accounts regardless of privilege via crafted POST request. (CVSS 6.5) - [CVE-2023-27035](https://cve.now/CVE-2023-27035.md): An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio and other unspecified (CVSS 6.5) - [CVE-2023-27108](https://cve.now/CVE-2023-27108.md): An issue was discovered in KaiOS 3.0. (CVSS 5.3) - [CVE-2023-29635](https://cve.now/CVE-2023-29635.md): File upload vulnerability in Antabot White-Jotter v0.2.2, allows remote attackers to execute malicious code via the file parameter to functi (CVSS 9.8) - [CVE-2023-29636](https://cve.now/CVE-2023-29636.md): Cross site scripting (XSS) vulnerability in ZHENFENG13 My-Blog, allows attackers to inject arbitrary web script or HTML via the "title" fiel (CVSS 5.4) - [CVE-2023-29637](https://cve.now/CVE-2023-29637.md): Cross Site Scripting (XSS) vulnerability in Qbian61 forum-java, allows attackers to inject arbitrary web script or HTML via editing the arti (CVSS 6.1) - [CVE-2023-29638](https://cve.now/CVE-2023-29638.md): Cross Site Scripting (XSS) vulnerability in WinterChenS my-site before commit 3f0423da6d5200c7a46e200da145c1f54ee18548, allows attackers to (CVSS 5.4) - [CVE-2023-29639](https://cve.now/CVE-2023-29639.md): Cross site scripting (XSS) vulnerability in ZHENFENG13 My-Blog, allows attackers to inject arbitrary web script or HTML via editing an artic (CVSS 5.4) - [CVE-2023-29641](https://cve.now/CVE-2023-29641.md): Cross Site Scripting (XSS) vulnerability in pandao editor.md thru 1.5.0 allows attackers to inject arbitrary web script or HTML via crafted (CVSS 6.1, editor.md) - [CVE-2023-29643](https://cve.now/CVE-2023-29643.md): Cross Site Scripting (XSS) vulnerability in PerfreeBlog 3.1.2 allows attackers to execute arbitrary code via the Post function. (CVSS 5.4) - [CVE-2023-29680](https://cve.now/CVE-2023-29680.md): Cleartext Transmission in set-cookie:ecos\_pw: Tenda N301 v6.0, Firmware v12.02.01.61\_multi allows an authenticated attacker on the LAN or WL (CVSS 5.7) - [CVE-2023-29681](https://cve.now/CVE-2023-29681.md): Cleartext Transmission in cookie:ecos\_pw: in Tenda N301 v6.0, firmware v12.03.01.06\_pt allows an authenticated attacker on the LAN or WLAN t (CVSS 5.7) - [CVE-2023-30061](https://cve.now/CVE-2023-30061.md): D-Link DIR-879 v105A1 is vulnerable to Authentication Bypass via phpcgi. (CVSS 7.5) - [CVE-2023-30063](https://cve.now/CVE-2023-30063.md): D-Link DIR-890L FW1.10 A1 is vulnerable to Authentication bypass. (CVSS 7.5) - [CVE-2023-30639](https://cve.now/CVE-2023-30639.md): Archer Platform 6.8 before 6.12 P6 HF1 (6.12.0.6.1) contains a stored XSS vulnerability. (CVSS 7.1) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2023-05-01 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.