# CVEs published 2023-05-03

77 CVEs were published on May 3, 2023: 4 critical, 14 high. Days are UTC.

- [CVE-2023-22637](https://cve.now/CVE-2023-22637.md): An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability \[CWE-79\] in FortiNAC-F version 7.2.0, (CVSS 5.9, Fortinet FortiNAC)
- [CVE-2023-26203](https://cve.now/CVE-2023-26203.md): A use of hard-coded credentials vulnerability \[CWE-798\] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 (CVSS 6.1, Fortinet FortiNAC)
- [CVE-2022-45860](https://cve.now/CVE-2022-45860.md): A weak authentication vulnerability \[CWE-1390\] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all vers (CVSS 5.0, Fortinet FortiNAC)
- [CVE-2022-45858](https://cve.now/CVE-2022-45858.md): A use of a weak cryptographic algorithm vulnerability \[CWE-327\] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.0 all versions, 8.8.0 all (CVSS 3.8, Fortinet FortiNAC)
- [CVE-2022-43950](https://cve.now/CVE-2022-43950.md): A URL redirection to untrusted site ('Open Redirect') vulnerability \[CWE-601\] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.1 and below, (CVSS 3.9, Fortinet FortiNAC)
- [CVE-2022-45859](https://cve.now/CVE-2022-45859.md): An insufficiently protected credentials vulnerability \[CWE-522\] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and be (CVSS 3.9, Fortinet FortiNAC)
- [CVE-2023-27993](https://cve.now/CVE-2023-27993.md): A relative path traversal \[CWE-23\] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a privileged attacker to delete arbitrary dire (CVSS 5.7, Fortinet FortiADC)
- [CVE-2023-27999](https://cve.now/CVE-2023-27999.md): An improper neutralization of special elements used in an OS command vulnerability \[CWE-78\] in FortiADC 7.2.0, 7.1.0 through 7.1.1 may allow (CVSS 7.6, Fortinet FortiADC)
- [CVE-2023-22640](https://cve.now/CVE-2023-22640.md): A out-of-bounds write vulnerability in Fortinet FortiOS 7.2.0 through 7.2.3, FortiOS 7.0.0 through 7.0.10, FortiOS 6.4.0 through 6.4.11, For (CVSS 7.1, Fortinet FortiOS · Fortinet FortiProxy)
- [CVE-2022-39161](https://cve.now/CVE-2022-39161.md): IBM WebSphere Application Server information disclosure (CVSS 4.8, IBM WebSphere Application Server)
- [CVE-2023-25827](https://cve.now/CVE-2023-25827.md): Cross-site Scripting in OpenTSDB (CVSS 8.2, OpenTSDB · net.opentsdb:opentsdb)
- [CVE-2023-25826](https://cve.now/CVE-2023-25826.md): Remote Code Execution in OpenTSDB (CVSS 9.8, OpenTSDB · net.opentsdb:opentsdb)
- [CVE-2023-25967](https://cve.now/CVE-2023-25967.md): WordPress Community by PeepSo Plugin \<= 6.0.2.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Community by PeepSo)
- [CVE-2023-26017](https://cve.now/CVE-2023-26017.md): WordPress Jobs for WordPress Plugin \<= 2.5.10.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, BlueGlass Jobs for WordPress)
- [CVE-2023-23830](https://cve.now/CVE-2023-23830.md): WordPress ProfilePress Plugin \<= 4.5.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, ProfilePress Membership Team ProfilePress)
- [CVE-2023-23875](https://cve.now/CVE-2023-23875.md): WordPress Bing Site Verification plugin using Meta Tag Plugin \<= 1.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Himanshu Bing Site Verification plugin using Meta Tag)
- [CVE-2023-23881](https://cve.now/CVE-2023-23881.md): WordPress Circles Gallery Plugin \<= 1.0.10 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, GreenTreeLabs Circles Gallery)
- [CVE-2023-29240](https://cve.now/CVE-2023-29240.md): BIG-IQ iControl REST Vulnerability (CVSS 5.4, F5 BIG-IQ)
- [CVE-2023-29163](https://cve.now/CVE-2023-29163.md): BIG-IP UDP Profile vulnerability (CVSS 7.5, F5 BIG-IP)
- [CVE-2023-28742](https://cve.now/CVE-2023-28742.md): BIG-IP iQuery mesh vulnerability (CVSS 7.2, F5 BIG-IP)
- [CVE-2023-28724](https://cve.now/CVE-2023-28724.md): NGINX Management Suite vulnerability (CVSS 7.1, F5 NGINX Instance Manager · F5 NGINX API Connectivity Ma… +1)
- [CVE-2023-28656](https://cve.now/CVE-2023-28656.md): NGINX Management Suite vulnerability (CVSS 8.1, F5 NGINX Instance Manager · F5 NGINX API Connectivity Ma… +1)
- [CVE-2023-28406](https://cve.now/CVE-2023-28406.md): BIG-IP Configuration utility vulnerability (CVSS 4.3, F5 BIG-IP)
- [CVE-2023-27378](https://cve.now/CVE-2023-27378.md): BIG-IP TMUI XSS vulnerability (CVSS 7.5, F5 BIG-IP)
- [CVE-2023-23808](https://cve.now/CVE-2023-23808.md): WordPress Sponsors Carousel Plugin \<= 4.02 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Sergey Panasenko Sponsors Carousel)
- [CVE-2023-24594](https://cve.now/CVE-2023-24594.md): BIG-IP TMM SSL vulnerability (CVSS 5.3, F5 BIG-IP)
- [CVE-2023-24461](https://cve.now/CVE-2023-24461.md): BIG-IP Edge Client for Windows and macOS vulnerability (CVSS 7.4, F5 BIG-IP Edge Client)
- [CVE-2023-22372](https://cve.now/CVE-2023-22372.md): BIG-IP Edge Client for Windows and Mac OS vulnerability (CVSS 5.9, F5 BIG-IP Edge Client)
- [CVE-2023-23809](https://cve.now/CVE-2023-23809.md): WordPress Stock market charts from finviz Plugin \<= 1.0.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Moris Dov Stock market charts from finviz)
- [CVE-2023-23785](https://cve.now/CVE-2023-23785.md): WordPress Exquisite PayPal Donation Plugin \<= v2.0.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, DgCult Exquisite PayPal Donation)
- [CVE-2022-46852](https://cve.now/CVE-2022-46852.md): WordPress WP Table Builder – WordPress Table Plugin Plugin \<= 1.4.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, WP Table Builder)
- [CVE-2023-22683](https://cve.now/CVE-2023-22683.md): WordPress Clio Grow Plugin \<= 1.0.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Themis Solutions Clio Grow)
- [CVE-2023-25979](https://cve.now/CVE-2023-25979.md): WordPress Video Gallery – YouTube Gallery Plugin \<= 1.7.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Video Gallery by Total-Soft Video Gallery)
- [CVE-2023-23876](https://cve.now/CVE-2023-23876.md): WordPress wpDataTables Plugin \<= 2.1.49 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, TMS-Plugins wpDataTables)
- [CVE-2023-23874](https://cve.now/CVE-2023-23874.md): WordPress Ditty Plugin \<= 3.0.32 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Metaphor Creations Ditty)
- [CVE-2023-23820](https://cve.now/CVE-2023-23820.md): WordPress ProfilePress Plugin \<= 4.5.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, ProfilePress Membership Team ProfilePress)
- [CVE-2023-1385](https://cve.now/CVE-2023-1385.md): Improper JPAKE implementation allows offline PIN brute-forcing due to the initialization of random values to a known value, which leads to u (CVSS 7.1, Amazon Fire TV Stick 3rd gen · Insignia TV with FireOS)
- [CVE-2023-23708](https://cve.now/CVE-2023-23708.md): WordPress Visualizer Plugin \<= 3.9.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Themeisle Visualizer: Tables and Charts Manager for WordPre…)
- [CVE-2023-1384](https://cve.now/CVE-2023-1384.md): The setMediaSource function on the amzn.thin.pl service does not sanitize the "source" parameter allowing for arbitrary javascript code to b (CVSS 4.3, Amazon Fire TV Stick 3rd gen · Insignia TV with FireOS)
- [CVE-2023-1383](https://cve.now/CVE-2023-1383.md): An Improper Enforcement of Behavioral Workflow vulnerability in the exchangeDeviceServices function on the amzn.dmgr service allowed an atta (CVSS 5.4, AmazonFire TV Stick 3rd gen Fire TV Stick 3rd gen · Insigni…)
- [CVE-2023-22713](https://cve.now/CVE-2023-22713.md): WordPress Gutenberg Blocks by WordPress Download Manager Plugin \<= 2.1.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Gutenberg Blocks by WordPress Download Manager)
- [CVE-2023-25796](https://cve.now/CVE-2023-25796.md): WordPress WP BaiDu Submit Plugin \<= 1.2.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Include WP BaiDu Submit)
- [CVE-2023-25798](https://cve.now/CVE-2023-25798.md): WordPress Olevmedia Shortcodes Plugin \<= 1.1.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Olevmedia Shortcodes)
- [CVE-2022-30995](https://cve.now/CVE-2022-30995.md): Sensitive information disclosure due to improper authentication. (CVSS 9.3, Acronis Cyber Protect · Acronis Cyber Backup)
- [CVE-2022-3405](https://cve.now/CVE-2022-3405.md): Code execution and sensitive information disclosure due to excessive privileges assigned to Acronis Agent. (CVSS 9.3, Acronis Cyber Protect · Acronis Cyber Backup)
- [CVE-2023-25786](https://cve.now/CVE-2023-25786.md): WordPress Eyes Only: User Access Shortcode Plugin \<= 1.8.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Thom Stark Eyes Only: User Access Shortcode)
- [CVE-2023-25789](https://cve.now/CVE-2023-25789.md): WordPress Tapfiliate Plugin \<= 3.0.12 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Tapfiliate)
- [CVE-2023-25783](https://cve.now/CVE-2023-25783.md): WordPress FireCask Like & Share Button Plugin \<= 1.1.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Alex Moss FireCask Like & Share Button)
- [CVE-2023-25787](https://cve.now/CVE-2023-25787.md): WordPress WP资源下载管理 Plugin \<= 1.3.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Wbolt team WP资源下载管理)
- [CVE-2023-25797](https://cve.now/CVE-2023-25797.md): WordPress vSlider Multi Image Slider for WordPress Plugin \<= 4.1.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Mr.Vibe vSlider Multi Image Slider for WordPress)
- [CVE-2023-25784](https://cve.now/CVE-2023-25784.md): WordPress Sticky Ad Bar Plugin \<= 1.3.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Bon Plan Gratos Sticky Ad Bar Plugin)
- [CVE-2023-25792](https://cve.now/CVE-2023-25792.md): WordPress WP Open Social Plugin \<= 5.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, XiaoMac WP Open Social)
- [CVE-2023-23790](https://cve.now/CVE-2023-23790.md): WordPress Pods Plugin \<= 2.9.10.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 7.1, Pods Framework Team Pods – Custom Content Types and Fields)
- [CVE-2023-28070](https://cve.now/CVE-2023-28070.md): Alienware Command Center Application, versions 5.5.43.0 and prior, contain an improper access control vulnerability. (CVSS 6.7, Dell Alienware Command Center)
- [CVE-2023-22691](https://cve.now/CVE-2023-22691.md): WordPress Category Specific RSS feed Subscription Plugin \<= v2.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Tips and Tricks HQ, Ruhul Amin Category Specific RSS feed S…)
- [CVE-2017-11197](https://cve.now/CVE-2017-11197.md): In CyberArk Viewfinity 5.5.10.95 and 6.x before 6.1.1.220, a low privilege user can escalate to an administrative user via a bug within the (CVSS 7.8)
- [CVE-2020-22429](https://cve.now/CVE-2020-22429.md): redox-os v0.1.0 was discovered to contain a use-after-free bug via the gethostbyaddr() function at /src/header/netdb/mod.rs. (CVSS 7.8)
- [CVE-2022-40302](https://cve.now/CVE-2022-40302.md): An issue was discovered in bgpd in FRRouting (FRR) through 8.4. (CVSS 6.5)
- [CVE-2022-40318](https://cve.now/CVE-2022-40318.md): An issue was discovered in bgpd in FRRouting (FRR) through 8.4. (no CVSS)
- [CVE-2022-43681](https://cve.now/CVE-2022-43681.md): An out-of-bounds read exists in the BGP daemon of FRRouting FRR through 8.4. (no CVSS)
- [CVE-2022-4376](https://cve.now/CVE-2022-4376.md): An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions s (CVSS 3.1, GitLab)
- [CVE-2023-0155](https://cve.now/CVE-2023-0155.md): An issue has been discovered in GitLab CE/EE affecting all versions before 15.8.5, 15.9.4, 15.10.1. (CVSS 5.4, GitLab)
- [CVE-2023-0485](https://cve.now/CVE-2023-0485.md): An issue has been discovered in GitLab affecting all versions starting from 13.11 before 15.8.5, all versions starting from 15.9 before 15.9 (CVSS 6.5, GitLab)
- [CVE-2023-0756](https://cve.now/CVE-2023-0756.md): An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions s (CVSS 4.8, GitLab)
- [CVE-2023-0805](https://cve.now/CVE-2023-0805.md): An issue has been discovered in GitLab EE affecting all versions starting from 15.2 before 15.9.6, all versions starting from 15.10 before 1 (CVSS 4.9, GitLab)
- [CVE-2023-1178](https://cve.now/CVE-2023-1178.md): An issue has been discovered in GitLab CE/EE affecting all versions from 8.6 before 15.9.6, all versions starting from 15.10 before 15.10.5, (CVSS 5.7, GitLab)
- [CVE-2023-1204](https://cve.now/CVE-2023-1204.md): An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.1 before 15.10.8, all versions starting from 15.11 befo (CVSS 4.3, GitLab)
- [CVE-2023-1265](https://cve.now/CVE-2023-1265.md): An issue has been discovered in GitLab affecting all versions starting from 11.9 before 15.9.6, all versions starting from 15.10 before 15.1 (CVSS 5.4, GitLab)
- [CVE-2023-1836](https://cve.now/CVE-2023-1836.md): A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 15.9.6, all versions starting fro (CVSS 4.4, GitLab)
- [CVE-2023-1965](https://cve.now/CVE-2023-1965.md): An issue has been discovered in GitLab EE affecting all versions starting from 14.2 before 15.9.6, all versions starting from 15.10 before 1 (CVSS 6.8, GitLab)
- [CVE-2023-2069](https://cve.now/CVE-2023-2069.md): An issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8, all versions starting from 12.10 before 12.1 (CVSS 6.4, GitLab)
- [CVE-2023-2182](https://cve.now/CVE-2023-2182.md): An issue has been discovered in GitLab EE affecting all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before (CVSS 6.8, GitLab)
- [CVE-2023-24744](https://cve.now/CVE-2023-24744.md): Cross Site Scripting (XSS) vulnerability in Rediker Software AdminPlus 6.1.91.00 allows remote attackers to run arbitrary code via the onloa (CVSS 6.1)
- [CVE-2023-29839](https://cve.now/CVE-2023-29839.md): A Stored Cross Site Scripting (XSS) vulnerability exists in multiple pages of Hotel Druid version 3.0.4, which allows arbitrary execution of (CVSS 5.4)
- [CVE-2023-30204](https://cve.now/CVE-2023-30204.md): Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the judge\_id parameter at /php-jms/edit\_judge.php (CVSS 9.8)
- [CVE-2023-30205](https://cve.now/CVE-2023-30205.md): A stored cross-site scripting (XSS) vulnerability in DouPHP v1.7 allows attackers to execute arbitrary web scripts or HTML via a crafted pay (CVSS 4.8)
- [CVE-2023-30300](https://cve.now/CVE-2023-30300.md): An issue in the component hang.wasm of WebAssembly 1.0 causes an infinite loop. (CVSS 5.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-05-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.