CVEs published May 2, 2023
80 CVEs were published on May 2, 2023: 8 critical, 27 high.
- Published
- 80
- Critical
- 8
- High
- 27
- Medium
- 28
- Low
- 6
- Unrated
- 11
- Now in CISA KEV
- 0
- Fix available
- 34
Most affected products
- Qualcomm Snapdragon
- 13
- Google Chrome
- 10
- Dromara J2eeFAST
- 2
- moodle · moodle/moodle
- 2
- Product Catalog Feed by PixelYourSite
- 2
- Advanced Custom Fields
- 1
- amr ical events lists
- 1
- Apache Software Foundation Apache CouchDB · Apache Software…
- 1
- Apache Software Foundation Apache Spark · pyspark +1
- 1
- appium/appium-desktop · appium-desktop
- 1
Critical 8
- CVE-2023-30869WordPress Easy Digital Downloads Plugin 3.1-3.1.1.4.1 is vulnerable to Privilege EscalationEasy Digital Downloads
- CVE-2023-1730SupportCandy < 3.1.5 - Unauthenticated SQLiSupportCandy
- CVE-2022-47876The integrator in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to create Jobs to execute arbitrary code via Groovy-scripts.
- CVE-2022-47877A Stored cross-site scripting vulnerability in Jedox 2020.2.5 allows remote, authenticated users to inject arbitrary web script or HTML in t
- CVE-2022-47878Incorrect input validation for the default-storage-path in the settings page in Jedox 2020.2.5 allows remote, authenticated users to specify
- CVE-2023-2479OS Command Injection in appium/appium-desktopappium/appium-desktop · appium-desktop
- CVE-2023-26089European Chemicals Agency IUCLID 6.x before 6.27.6 allows authentication bypass because a weak hard-coded secret is used for JWT signing.
- CVE-2023-29778GL.iNET MT3000 4.1.0 Release 2 is vulnerable to OS Command Injection via /usr/lib/oui-httpd/rpc/logread.
High 27
- CVE-2023-2461Use after free in OS Inputs in Google Chrome on ChromeOS prior to 113.0.5672.63 allowed a remote attacker who convinced a user to enage in sGoogle Chrome
- CVE-2023-30861Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie headerpallets flask · flask
- CVE-2023-1196Advanced Custom Fields - Contributor+ PHP Object InjectionAdvanced Custom Fields
- CVE-2023-32007Apache Spark: Shell command injection via Spark UIApache Software Foundation Apache Spark · pyspark +1
- CVE-2022-40504Reachable assertion in ModemQualcomm Snapdragon
- CVE-2022-33273Buffer over-read in Trusted Execution EnvironmentQualcomm Snapdragon
- CVE-2023-1669SEOPress < 6.5.0.3 - Admin+ PHP Object InjectionSEOPress
- CVE-2023-1809Download Manager Pro < 6.3.0 - Unauthenticated Sensitive Information DisclosureDownload Manager
- CVE-2023-0924Zyrex Popup <= 1.0 - Admin+ Arbitrary File UploadZYREX POPUP
- CVE-2023-21666Improper Release of Memory Before Removing Last Reference (`Memory Leak`) in GraphicsQualcomm Snapdragon
- CVE-2023-21665Incorrect Type Conversion or Cast in GraphicsQualcomm Snapdragon
- CVE-2023-21642Improper Access Control in HAB Memory ManagementQualcomm Snapdragon
- CVE-2022-40508Reachable assertion in ModemQualcomm Snapdragon
- CVE-2022-40505Buffer over-read in ModemQualcomm Snapdragon
- CVE-2022-34144Reachable assertion in ModemQualcomm Snapdragon
- CVE-2022-33305Null pointer dereference in ModemQualcomm Snapdragon
- CVE-2022-33304NULL pointers dereference in ModemQualcomm Snapdragon
- CVE-2022-33292Use after free in Qualcomm IPCQualcomm Snapdragon
- CVE-2022-25713Improper Restriction of Operations within the Bounds of a Memory Buffer in AutomotiveQualcomm Snapdragon
- CVE-2022-30759In Nokia One-NDS (aka Network Directory Server) through 20.9, some Sudo permissions can be exploited by some users to escalate to root privi
- CVE-2022-47875A Directory Traversal vulnerability in /be/erpc.php in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to execute arbitrary code
- CVE-2022-484823CX before 18 Update 2 Security Hotfix build 18.0.2.315 on Windows allows unauthenticated remote attackers to read certain files via /Electr
- CVE-2022-484833CX before 18 Hotfix 1 build 18.0.3.461 on Windows allows unauthenticated remote attackers to read %WINDIR%\system32 files via /Electron/dow
- CVE-2023-26546European Chemicals Agency IUCLID before 6.27.6 allows remote authenticated users to execute arbitrary code via Server Side Template Injectio
- CVE-2023-30403An issue in the time-based authentication mechanism of Aigital Aigital Wireless-N Repeater Mini_Router v0.131229 allows attackers to bypass
- CVE-2023-31433A SQL injection issue in Logbuch in evasys before 8.2 Build 2286 and 9.x before 9.0 Build 2401 allows authenticated attackers to execute SQL
- CVE-2023-31435Multiple components (such as Onlinetemplate-Verwaltung, Liste aller Teilbereiche, Umfragen anzeigen, and questionnaire previews) in evasys b
Medium, low and unrated 45
- CVE-2023-2468Inappropriate implementation in PictureInPicture in Google Chrome prior to 113.0.5672.63 allowed a remote attacker who had compromised the rGoogle Chrome
- CVE-2023-2467Inappropriate implementation in Prompts in Google Chrome on Android prior to 113.0.5672.63 allowed a remote attacker to bypass permissions rGoogle Chrome
- CVE-2023-2466Inappropriate implementation in Prompts in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to spoof the contents of the securGoogle Chrome
- CVE-2023-2465Inappropriate implementation in CORS in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to leak cross-origin data via a craftGoogle Chrome
- CVE-2023-2464Inappropriate implementation in PictureInPicture in Google Chrome prior to 113.0.5672.63 allowed an attacker who convinced a user to installGoogle Chrome
- CVE-2023-2463Inappropriate implementation in Full Screen Mode in Google Chrome on Android prior to 113.0.5672.63 allowed a remote attacker to hide the coGoogle Chrome
- CVE-2023-2462Inappropriate implementation in Prompts in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to obfuscate main origin data via Google Chrome
- CVE-2023-2460Insufficient validation of untrusted input in Extensions in Google Chrome prior to 113.0.5672.63 allowed an attacker who convinced a user toGoogle Chrome
- CVE-2023-2459Inappropriate implementation in Prompts in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to bypass permission restrictions Google Chrome
- CVE-2023-26268Apache CouchDB, IBM Cloudant: Information sharing via couchjs processesApache Software Foundation Apache CouchDB · Apache Software…
- CVE-2023-2477Funadmin Cx.php tagLoad cross site scriptingFunadmin
- CVE-2023-2476Dromara J2eeFAST Announcement cross site scriptingDromara J2eeFAST
- CVE-2023-2445Improper access control in Subscriptions Folder path filter in Devolutions Server 2023.1.1 and earlier allows attackers with administrator pDevolutions Server
- CVE-2023-2475Dromara J2eeFAST System Message cross site scriptingDromara J2eeFAST
- CVE-2023-2474Rebuild cross-site request forgeryRebuild
- CVE-2023-2473Dreamer CMS Password Hash Calculation UserController.java updatePwd algorithmic complexityDreamer CMS
- CVE-2023-23723WordPress WordPress Email Marketing Plugin – WP Email Capture Plugin <= 3.9.3 is vulnerable to Cross Site Scripting (XSS)Winwar Media WP Email Capture
- CVE-2023-2000Unrestricted navigation due to unvalidated mattermost server redirectionMattermost
- CVE-2023-31207Automation user secret logged to Apache access logTribe29 Checkmk
- CVE-2023-1546MyCryptoCheckout < 2.124 - Reflected XSSMyCryptoCheckout
- CVE-2023-1911Blocksy Companion < 1.8.82 - Subscriber+ Draft Post AccessBlocksy Companion
- CVE-2023-1090WP SMTP Mailing Queue < 2.0.1 - Admin+ Stored XSSSMTP Mailing Queue
- CVE-2023-1614WP Custom Author URL < 1.0.5 - Admin+ Stored XSSWP Custom Author URL
- CVE-2023-1804Product Catalog Feed by PixelYourSite < 2.1.1 - Reflected XSSProduct Catalog Feed by PixelYourSite
- CVE-2023-0891Stagtools < 2.3.7 - Contributor+ Stored XSSStagTools
- CVE-2023-1805Product Catalog Feed by PixelYourSite < 2.1.1 - Reflected XSSProduct Catalog Feed by PixelYourSite
- CVE-2023-1125Ruby Help Desk < 1.3.4 - Subscriber+ Ticket Update via IDORRuby Help Desk
- CVE-2023-1021Amr Ical Events Lists <= 6.6 - Admin+ Stored XSSamr ical events lists
- CVE-2023-1554Quick Paypal Payments < 5.7.26.4 - Admin+ Stored XSSQuick Paypal Payments
- CVE-2023-1861Limit Login Attempts < 1.7.2 - Subscriber+ Stored XSSLimit Login Attempts
- CVE-2023-1525Site Reviews < 6.7.1 - Admin+ Stored XSSSite Reviews
- CVE-2022-33281Improper validation of array index in computer vision.Qualcomm Snapdragon
- CVE-2014-125100BestWebSoft Job Board Plugin cross site scriptingBestWebSoft Job Board Plugin
- CVE-2013-10026Mail Subscribe List Plugin index.php cross site scriptingMail Subscribe List Plugin
- CVE-2022-47874Improper Access Control in /tc/rpc in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to view details of database connections vi
- CVE-2023-2247In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview functionOctopus Deploy Octopus Server
- CVE-2023-27892Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware before 7.7.0 allow a global buffer overflow via crafted messag
- CVE-2023-29772A Cross-site scripting (XSS) vulnerability in the System Log/General Log page of the administrator web UI in ASUS RT-AC51U wireless router f
- CVE-2023-29856D-Link DIR-868L Hardware version A1, firmware version 1.12 is vulnerable to Buffer Overflow.
- CVE-2023-29867Zammad 5.3.x (Fixed 5.4.0) is vulnerable to Incorrect Access Control.
- CVE-2023-29868Zammad 5.3.x (Fixed in 5.4.0) is vulnerable to Incorrect Access Control.
- CVE-2023-29918RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.francoisjacquet/rosariosis
- CVE-2023-30943Moodle: tinymce loaders susceptible to arbitrary folder creationmoodle · moodle/moodle
- CVE-2023-30944Moodle: minor sql injection risk in external wiki method for listing pagesmoodle · moodle/moodle
- CVE-2023-31434The parameters nutzer_titel, nutzer_vn, and nutzer_nn in the user profile, and langID and ONLINEID in direct links, in evasys before 8.2 Bui