CVEs published May 3, 2023
77 CVEs were published on May 3, 2023: 4 critical, 14 high.
- Published
- 77
- Critical
- 4
- High
- 14
- Medium
- 53
- Low
- 4
- Unrated
- 2
- Now in CISA KEV
- 0
- Fix available
- 24
Most affected products
- GitLab
- 12
- Fortinet FortiNAC
- 6
- F5 BIG-IP
- 5
- Acronis Cyber Protect · Acronis Cyber Backup
- 2
- Amazon Fire TV Stick 3rd gen · Insignia TV with FireOS
- 2
- F5 BIG-IP Edge Client
- 2
- F5 NGINX Instance Manager · F5 NGINX API Connectivity Ma… +1
- 2
- Fortinet FortiADC
- 2
- OpenTSDB · net.opentsdb:opentsdb
- 2
- ProfilePress Membership Team ProfilePress
- 2
Critical 4
- CVE-2023-25826Remote Code Execution in OpenTSDBOpenTSDB · net.opentsdb:opentsdb
- CVE-2022-30995Sensitive information disclosure due to improper authentication.Acronis Cyber Protect · Acronis Cyber Backup
- CVE-2022-3405Code execution and sensitive information disclosure due to excessive privileges assigned to Acronis Agent.Acronis Cyber Protect · Acronis Cyber Backup
- CVE-2023-30204Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the judge_id parameter at /php-jms/edit_judge.php
High 14
- CVE-2023-27999An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC 7.2.0, 7.1.0 through 7.1.1 may allowFortinet FortiADC
- CVE-2023-22640A out-of-bounds write vulnerability in Fortinet FortiOS 7.2.0 through 7.2.3, FortiOS 7.0.0 through 7.0.10, FortiOS 6.4.0 through 6.4.11, ForFortinet FortiOS · Fortinet FortiProxy
- CVE-2023-25827Cross-site Scripting in OpenTSDBOpenTSDB · net.opentsdb:opentsdb
- CVE-2023-23830WordPress ProfilePress Plugin <= 4.5.4 is vulnerable to Cross Site Scripting (XSS)ProfilePress Membership Team ProfilePress
- CVE-2023-29163BIG-IP UDP Profile vulnerabilityF5 BIG-IP
- CVE-2023-28742BIG-IP iQuery mesh vulnerabilityF5 BIG-IP
- CVE-2023-28724NGINX Management Suite vulnerabilityF5 NGINX Instance Manager · F5 NGINX API Connectivity Ma… +1
- CVE-2023-28656NGINX Management Suite vulnerabilityF5 NGINX Instance Manager · F5 NGINX API Connectivity Ma… +1
- CVE-2023-27378BIG-IP TMUI XSS vulnerabilityF5 BIG-IP
- CVE-2023-24461BIG-IP Edge Client for Windows and macOS vulnerabilityF5 BIG-IP Edge Client
- CVE-2023-1385Improper JPAKE implementation allows offline PIN brute-forcing due to the initialization of random values to a known value, which leads to uAmazon Fire TV Stick 3rd gen · Insignia TV with FireOS
- CVE-2023-23790WordPress Pods Plugin <= 2.9.10.2 is vulnerable to Cross Site Request Forgery (CSRF)Pods Framework Team Pods – Custom Content Types and Fields
- CVE-2017-11197In CyberArk Viewfinity 5.5.10.95 and 6.x before 6.1.1.220, a low privilege user can escalate to an administrative user via a bug within the
- CVE-2020-22429redox-os v0.1.0 was discovered to contain a use-after-free bug via the gethostbyaddr() function at /src/header/netdb/mod.rs.
Medium, low and unrated 59
- CVE-2023-22637An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiNAC-F version 7.2.0, Fortinet FortiNAC
- CVE-2023-26203A use of hard-coded credentials vulnerability [CWE-798] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1Fortinet FortiNAC
- CVE-2022-45860A weak authentication vulnerability [CWE-1390] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versFortinet FortiNAC
- CVE-2022-45858A use of a weak cryptographic algorithm vulnerability [CWE-327] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.0 all versions, 8.8.0 all Fortinet FortiNAC
- CVE-2022-43950A URL redirection to untrusted site ('Open Redirect') vulnerability [CWE-601] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.1 and below,Fortinet FortiNAC
- CVE-2022-45859An insufficiently protected credentials vulnerability [CWE-522] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and beFortinet FortiNAC
- CVE-2023-27993A relative path traversal [CWE-23] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a privileged attacker to delete arbitrary direFortinet FortiADC
- CVE-2022-39161IBM WebSphere Application Server information disclosureIBM WebSphere Application Server
- CVE-2023-25967WordPress Community by PeepSo Plugin <= 6.0.2.0 is vulnerable to Cross Site Request Forgery (CSRF)Community by PeepSo
- CVE-2023-26017WordPress Jobs for WordPress Plugin <= 2.5.10.2 is vulnerable to Cross Site Scripting (XSS)BlueGlass Jobs for WordPress
- CVE-2023-23875WordPress Bing Site Verification plugin using Meta Tag Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)Himanshu Bing Site Verification plugin using Meta Tag
- CVE-2023-23881WordPress Circles Gallery Plugin <= 1.0.10 is vulnerable to Cross Site Scripting (XSS)GreenTreeLabs Circles Gallery
- CVE-2023-29240BIG-IQ iControl REST VulnerabilityF5 BIG-IQ
- CVE-2023-28406BIG-IP Configuration utility vulnerabilityF5 BIG-IP
- CVE-2023-23808WordPress Sponsors Carousel Plugin <= 4.02 is vulnerable to Cross Site Scripting (XSS)Sergey Panasenko Sponsors Carousel
- CVE-2023-24594BIG-IP TMM SSL vulnerabilityF5 BIG-IP
- CVE-2023-22372BIG-IP Edge Client for Windows and Mac OS vulnerabilityF5 BIG-IP Edge Client
- CVE-2023-23809WordPress Stock market charts from finviz Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)Moris Dov Stock market charts from finviz
- CVE-2023-23785WordPress Exquisite PayPal Donation Plugin <= v2.0.0 is vulnerable to Cross Site Scripting (XSS)DgCult Exquisite PayPal Donation
- CVE-2022-46852WordPress WP Table Builder – WordPress Table Plugin Plugin <= 1.4.6 is vulnerable to Cross Site Scripting (XSS)WP Table Builder
- CVE-2023-22683WordPress Clio Grow Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)Themis Solutions Clio Grow
- CVE-2023-25979WordPress Video Gallery – YouTube Gallery Plugin <= 1.7.6 is vulnerable to Cross Site Scripting (XSS)Video Gallery by Total-Soft Video Gallery
- CVE-2023-23876WordPress wpDataTables Plugin <= 2.1.49 is vulnerable to Cross Site Scripting (XSS)TMS-Plugins wpDataTables
- CVE-2023-23874WordPress Ditty Plugin <= 3.0.32 is vulnerable to Cross Site Scripting (XSS)Metaphor Creations Ditty
- CVE-2023-23820WordPress ProfilePress Plugin <= 4.5.4 is vulnerable to Cross Site Scripting (XSS)ProfilePress Membership Team ProfilePress
- CVE-2023-23708WordPress Visualizer Plugin <= 3.9.4 is vulnerable to Cross Site Scripting (XSS)Themeisle Visualizer: Tables and Charts Manager for WordPre…
- CVE-2023-1384The setMediaSource function on the amzn.thin.pl service does not sanitize the "source" parameter allowing for arbitrary javascript code to bAmazon Fire TV Stick 3rd gen · Insignia TV with FireOS
- CVE-2023-1383An Improper Enforcement of Behavioral Workflow vulnerability in the exchangeDeviceServices function on the amzn.dmgr service allowed an attaAmazonFire TV Stick 3rd gen Fire TV Stick 3rd gen · Insigni…
- CVE-2023-22713WordPress Gutenberg Blocks by WordPress Download Manager Plugin <= 2.1.8 is vulnerable to Cross Site Scripting (XSS)Gutenberg Blocks by WordPress Download Manager
- CVE-2023-25796WordPress WP BaiDu Submit Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)Include WP BaiDu Submit
- CVE-2023-25798WordPress Olevmedia Shortcodes Plugin <= 1.1.9 is vulnerable to Cross Site Scripting (XSS)Olevmedia Shortcodes
- CVE-2023-25786WordPress Eyes Only: User Access Shortcode Plugin <= 1.8.2 is vulnerable to Cross Site Scripting (XSS)Thom Stark Eyes Only: User Access Shortcode
- CVE-2023-25789WordPress Tapfiliate Plugin <= 3.0.12 is vulnerable to Cross Site Scripting (XSS)Tapfiliate
- CVE-2023-25783WordPress FireCask Like & Share Button Plugin <= 1.1.5 is vulnerable to Cross Site Scripting (XSS)Alex Moss FireCask Like & Share Button
- CVE-2023-25787WordPress WP资源下载管理 Plugin <= 1.3.9 is vulnerable to Cross Site Scripting (XSS)Wbolt team WP资源下载管理
- CVE-2023-25797WordPress vSlider Multi Image Slider for WordPress Plugin <= 4.1.2 is vulnerable to Cross Site Scripting (XSS)Mr.Vibe vSlider Multi Image Slider for WordPress
- CVE-2023-25784WordPress Sticky Ad Bar Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)Bon Plan Gratos Sticky Ad Bar Plugin
- CVE-2023-25792WordPress WP Open Social Plugin <= 5.0 is vulnerable to Cross Site Scripting (XSS)XiaoMac WP Open Social
- CVE-2023-28070 Alienware Command Center Application, versions 5.5.43.0 and prior, contain an improper access control vulnerability.Dell Alienware Command Center
- CVE-2023-22691WordPress Category Specific RSS feed Subscription Plugin <= v2.1 is vulnerable to Cross Site Request Forgery (CSRF)Tips and Tricks HQ, Ruhul Amin Category Specific RSS feed S…
- CVE-2022-40302An issue was discovered in bgpd in FRRouting (FRR) through 8.4.
- CVE-2022-40318An issue was discovered in bgpd in FRRouting (FRR) through 8.4.
- CVE-2022-43681An out-of-bounds read exists in the BGP daemon of FRRouting FRR through 8.4.
- CVE-2022-4376An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions sGitLab
- CVE-2023-0155An issue has been discovered in GitLab CE/EE affecting all versions before 15.8.5, 15.9.4, 15.10.1.GitLab
- CVE-2023-0485An issue has been discovered in GitLab affecting all versions starting from 13.11 before 15.8.5, all versions starting from 15.9 before 15.9GitLab
- CVE-2023-0756An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions sGitLab
- CVE-2023-0805An issue has been discovered in GitLab EE affecting all versions starting from 15.2 before 15.9.6, all versions starting from 15.10 before 1GitLab
- CVE-2023-1178An issue has been discovered in GitLab CE/EE affecting all versions from 8.6 before 15.9.6, all versions starting from 15.10 before 15.10.5,GitLab
- CVE-2023-1204An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.1 before 15.10.8, all versions starting from 15.11 befoGitLab
- CVE-2023-1265An issue has been discovered in GitLab affecting all versions starting from 11.9 before 15.9.6, all versions starting from 15.10 before 15.1GitLab
- CVE-2023-1836A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 15.9.6, all versions starting froGitLab
- CVE-2023-1965An issue has been discovered in GitLab EE affecting all versions starting from 14.2 before 15.9.6, all versions starting from 15.10 before 1GitLab
- CVE-2023-2069An issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8, all versions starting from 12.10 before 12.1GitLab
- CVE-2023-2182An issue has been discovered in GitLab EE affecting all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 beforeGitLab
- CVE-2023-24744Cross Site Scripting (XSS) vulnerability in Rediker Software AdminPlus 6.1.91.00 allows remote attackers to run arbitrary code via the onloa
- CVE-2023-29839A Stored Cross Site Scripting (XSS) vulnerability exists in multiple pages of Hotel Druid version 3.0.4, which allows arbitrary execution of
- CVE-2023-30205A stored cross-site scripting (XSS) vulnerability in DouPHP v1.7 allows attackers to execute arbitrary web scripts or HTML via a crafted pay
- CVE-2023-30300An issue in the component hang.wasm of WebAssembly 1.0 causes an infinite loop.