CVEs published May 4, 2023
87 CVEs were published on May 4, 2023: 11 critical, 24 high. 1 is now in CISA KEV.
- Published
- 87
- Critical
- 11
- High
- 24
- Medium
- 50
- Low
- 1
- Unrated
- 1
- Now in CISA KEV
- 1
- Fix available
- 36
Most affected products
- Samsung Mobile Devices
- 21
- Samsung Mobile Samsung Blockchain Keystore
- 6
- Elastic Kibana
- 2
- 9seeds.com CPT – Speakers
- 1
- Biplob Adhikari Accordion – Multiple Accordion or FAQs Buil…
- 1
- Carlo Gavazzi Powersoft
- 1
- Catch Themes Darcie
- 1
- Caton CTP Relay Server
- 1
- Caton Prime
- 1
- Chengdu VEC40G
- 1
Critical 11
- CVE-2023-22651Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation.SUSE Rancher · github.com/rancher/rancher
- CVE-2023-20126Cisco SPA112 2-Port Phone Adapters Remote Command Execution VulnerabilityCisco Small Business IP Phones
- CVE-2023-23059An issue was discovered in GeoVision GV-Edge Recording Manager 2.2.3.0 for windows, which contains improper permissions within the default i
- CVE-2023-29827ejs v3.1.9 is vulnerable to server-side template injection.
- CVE-2023-30077Judging Management System v1.0 by oretnom23 was discovered to vulnerable to SQL injection via /php-jms/review_result.php?mainevent_id=, main
- CVE-2023-30203Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the event_id parameter at /php-jms/result_sheet.p
- CVE-2023-30264CLTPHP <=6.0 is vulnerable to Unrestricted Upload of File with Dangerous Type via application/admin/controller/Template.php:update.
- CVE-2023-30268CLTPHP <=6.0 is vulnerable to Improper Input Validation.
- CVE-2023-30328An issue in the helper tool of Mailbutler GmbH Shimo VPN Client for macOS v5.0.4 allows attackers to bypass authentication via PID re-use.
- CVE-2023-30331An issue in the render function of beetl v3.15.0 allows attackers to execute server-side template injection (SSTI) via a crafted payload.com.ibeetl:beetl
- CVE-2023-31415Kibana version 8.7.0 contains an arbitrary code execution flaw.Elastic Kibana
High 24
- CVE-2022-47449WordPress Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD Plugin <= 3.1.5 is vulnerable to Cross Site Scripting (XSS)RexTheme Cart Lift – Abandoned Cart Recovery for WooCommerc…
- CVE-2023-25961WordPress Darcie Theme <= 1.1.5 is vulnerable to Cross Site Scripting (XSS)Catch Themes Darcie
- CVE-2023-2523Weaver E-Office unrestricted uploadWeaver E-Office
- CVE-2023-2520Caton Prime Ping command injectionCaton Prime
- CVE-2023-2519Caton CTP Relay Server API login sql injectionCaton CTP Relay Server
- CVE-2023-24958IBM TS7700 Management Interface command injectionIBM Virtualization Engine TS7700
- CVE-2022-4259Authenticated SQL Injection on Alerts in Guardian/CMC before 22.5.2Nozomi Networks CMC · Nozomi Networks Guardian
- CVE-2017-20184Carlo Gavazzi Powersoft prone to Path TraversalCarlo Gavazzi Powersoft
- CVE-2023-21489Heap out-of-bounds write vulnerability in bootloader prior to SMR May-2023 Release 1 allows a physical attacker to execute arbitrary code.Samsung Mobile Devices
- CVE-2023-21491Improper access control vulnerability in ThemeManager prior to SMR May-2023 Release 1 allows local attackers to write arbitrary files with sSamsung Mobile Devices
- CVE-2023-21499Out-of-bounds write vulnerability in TA_Communication_mpos_encrypt_pin in mPOS TUI trustlet prior to SMR May-2023 Release 1 allows local attSamsung Mobile Devices
- CVE-2023-21501Improper input validation vulnerability in mPOS fiserve trustlet prior to SMR May-2023 Release 1 allows local attackers to execute arbitrarySamsung Mobile Devices
- CVE-2023-25289Directory Traversal vulnerability in virtualreception Digital Receptie version win7sp1_rtm.101119-1850 6.1.7601.1.0.65792 in embedded web se
- CVE-2023-25438An issue was discovered in Genomedics MilleGP5 5.9.2, allows remote attackers to execute arbitrary code and gain escalated privileges via mo
- CVE-2023-27568SQL injection vulnerability inSpryker Commerce OS 0.9 that allows for access to sensitive data via customer/order?orderSearchForm[searchText
- CVE-2023-29842ChurchCRM 4.5.4 endpoint /EditEventTypes.php is vulnerable to Blind SQL Injection (Time-based) via the EN_tyid POST parameter.
- CVE-2023-29994In NanoMQ v0.15.0-0, Heap overflow occurs in read_byte function of mqtt_code.c.
- CVE-2023-29995In NanoMQ v0.15.0-0, a Heap overflow occurs in copyn_utf8_str function of mqtt_parser.c
- CVE-2023-29996In NanoMQ v0.15.0-0, segment fault with Null Pointer Dereference occurs in the process of decoding subinfo_decode and unsubinfo_decode.
- CVE-2023-30282PrestaShop scexportcustomers <= 3.6.1 is vulnerable to Incorrect Access Control.
- CVE-2023-30399Insecure permissions in the settings page of GARO Wallbox GLB/GTB/GTC before v189 allows attackers to redirect users to a crafted update pac
- CVE-2023-31099Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote code execution via probe servers.
- CVE-2023-31284illumos illumos-gate before 676abcb has a stack buffer overflow in /dev/net, leading to privilege escalation via a stat on a long file name
- CVE-2023-31414Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw.Elastic Kibana
Medium, low and unrated 52
- CVE-2023-1894A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation.Puppet Enterprise · Puppet Server
- CVE-2022-47434WordPress PB SEO Friendly Images Plugin <= 4.0.5 is vulnerable to Cross Site Scripting (XSS)PB SEO Friendly Images
- CVE-2023-25982WordPress Simple YouTube Responsive Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)Eirudo Simple YouTube Responsive
- CVE-2023-25977WordPress CPT – Speakers Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)9seeds.com CPT – Speakers
- CVE-2023-25458WordPress TypeSquare Webfonts for ConoHa Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS)GMO Internet Group TypeSquare Webfonts for ConoHa
- CVE-2023-2524Control iD RHiD direct requestControl iD RHiD
- CVE-2023-2522Chengdu VEC40G Network Detection os command injectionChengdu VEC40G
- CVE-2023-30550IDOR vulnerability exists in meterspheremetersphere
- CVE-2023-2521NEXTU NEXT-7004N POST Request formFilter cross site scriptingNEXTU NEXT-7004N
- CVE-2023-30619XSS in the tooltip via an artifact titleEnalean tuleap
- CVE-2023-23470IBM i privilege escalationIBM i
- CVE-2023-26010WordPress WPMobile.App Plugin <= 11.18 is vulnerable to Cross Site Scripting (XSS)WPMobile.App
- CVE-2023-26012WordPress Custom Login Page Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)Denzel Chia | Phire Design Custom Login Page
- CVE-2023-26016WordPress Simple Portfolio Gallery Plugin <= 0.1 is vulnerable to Cross Site Scripting (XSS)Tauhidul Alam Simple Portfolio Gallery
- CVE-2022-45818WordPress Hero Banner Ultimate Plugin <= 1.3.4 is vulnerable to Cross Site Scripting (XSS)WP OnlineSupport, Essential Plugin Hero Banner Ultimate
- CVE-2023-25962WordPress Accordions Plugin <= 2.3.0 is vulnerable to Cross Site Scripting (XSS)Biplob Adhikari Accordion – Multiple Accordion or FAQs Buil…
- CVE-2023-25934 DELL ECS prior to 3.8.0.2 contains an improper verification of cryptographic signature vulnerability.Dell ECS
- CVE-2023-26125Versions of the package github.com/gin-gonic/gin before 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a sgithub.com/gin-gonic/gin
- CVE-2022-47757In imo.im 2022.11.1051, a path traversal vulnerability delivered via an unsanitized deeplink can force the application to write a file into
- CVE-2023-21484Improper access control vulnerability in AppLock prior to SMR May-2023 Release 1 allows local attackers without proper permission to executeSamsung Mobile Devices
- CVE-2023-21485Improper export of android application components vulnerability in VideoPreviewActivity in Call Settings to SMR May-2023 Release 1 allows phSamsung Mobile Devices
- CVE-2023-21486Improper export of android application components vulnerability in ImagePreviewActivity in Call Settings to SMR May-2023 Release 1 allows phSamsung Mobile Devices
- CVE-2023-21487Improper access control vulnerability in Telephony framework prior to SMR May-2023 Release 1 allows local attackers to change a call settingSamsung Mobile Devices
- CVE-2023-21488Improper access control vulnerablility in Tips prior to SMR May-2023 Release 1 allows local attackers to launch arbitrary activity in Tips.Samsung Mobile Devices
- CVE-2023-21490Improper access control in GearManagerStub prior to SMR May-2023 Release 1 allows a local attacker to delete applications installed by watchSamsung Mobile Devices
- CVE-2023-21492Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR.Samsung Mobile Devices
- CVE-2023-21493Improper access control vulnerability in SemShareFileProvider prior to SMR May-2023 Release 1 allows local attackers to access protected datSamsung Mobile Devices
- CVE-2023-21494Potential buffer overflow vulnerability in auth api in mm_Authentication.c in Shannon baseband prior to SMR May-2023 Release 1 allows remoteSamsung Mobile Devices
- CVE-2023-21495Improper access control vulnerability in Knox Enrollment Service prior to SMR May-2023 Release 1 allow attacker install KSP app when device Samsung Mobile Devices
- CVE-2023-21496Active Debug Code vulnerability in ActivityManagerService prior to SMR May-2023 Release 1 allows attacker to use debug function via setting Samsung Mobile Devices
- CVE-2023-21497Use of externally-controlled format string vulnerability in mPOS TUI trustlet prior to SMR May-2023 Release 1 allows local attackers to acceSamsung Mobile Devices
- CVE-2023-21498Improper input validation vulnerability in setPartnerTAInfo in mPOS TUI trustlet prior to SMR May-2023 Release 1 allows local attackers to oSamsung Mobile Devices
- CVE-2023-21500Double free validation vulnerability in setPinPadImages in mPOS TUI trustlet prior to SMR May-2023 Release 1 allows local attackers to accesSamsung Mobile Devices
- CVE-2023-21502Improper input validation vulnerability in FactoryTest application prior to SMR May-2023 Release 1 allows local attackers to get privilege eSamsung Mobile Devices
- CVE-2023-21503Potential buffer overflow vulnerability in mm_LteInterRatManagement.c in Shannon baseband prior to SMR May-2023 Release 1 allows remote attaSamsung Mobile Devices
- CVE-2023-21504Potential buffer overflow vulnerability in mm_Plmncoordination.c in Shannon baseband prior to SMR May-2023 Release 1 allows remote attackersSamsung Mobile Devices
- CVE-2023-21505Improper access control in Samsung Core Service prior to version 2.1.00.36 allows attacker to write arbitrary file in sandbox.Samsung Mobile Samsung Core Service
- CVE-2023-21506Out-of-bounds Write vulnerability while processing BC_TUI_CMD_SEND_RESOURCE_DATA_ARRAY command in bc_tui trustlet from Samsung Blockchain KeSamsung Mobile Samsung Blockchain Keystore
- CVE-2023-21507Out-of-bounds Read vulnerability while processing BC_TUI_CMD_SEND_RESOURCE_DATA_ARRAY command in bc_tui trustlet from Samsung Blockchain KeySamsung Mobile Samsung Blockchain Keystore
- CVE-2023-21508Out-of-bounds Write vulnerability while processing BC_TUI_CMD_SEND_RESOURCE_DATA command in bc_tui trustlet from Samsung Blockchain KeystoreSamsung Mobile Samsung Blockchain Keystore
- CVE-2023-21509Out-of-bounds Write vulnerability while processing BC_TUI_CMD_UPDATE_SCREEN in bc_tui trustlet from Samsung Blockchain Keystore prior to verSamsung Mobile Samsung Blockchain Keystore
- CVE-2023-21510Out-of-bounds Read vulnerability while processing BC_TUI_CMD_UPDATE_SCREEN in bc_tui trustlet from Samsung Blockchain Keystore prior to versSamsung Mobile Samsung Blockchain Keystore
- CVE-2023-21511Out-of-bounds Read vulnerability while processing CMD_COLDWALLET_BTC_SET_PRV_UTXO in bc_core trustlet from Samsung Blockchain Keystore priorSamsung Mobile Samsung Blockchain Keystore
- CVE-2023-27075A cross-site scripting vulnerability (XSS) in the component microbin/src/pasta.rs of Microbin v1.2.0 allows attackers to execute arbitrary wmicrobin
- CVE-2023-30093A cross-site scripting (XSS) vulnerability in Open Networking Foundation ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbiorg.onosproject:onos-archetypes
- CVE-2023-30094A stored cross-site scripting (XSS) vulnerability in TotalJS Flow v10 allows attackers to execute arbitrary web scripts or HTML via a craftetotal4
- CVE-2023-30095A stored cross-site scripting (XSS) vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbitrary web scripts or H
- CVE-2023-30096A stored cross-site scripting (XSS) vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbitrary web scripts or H
- CVE-2023-30097A stored cross-site scripting (XSS) vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbitrary web scripts or H
- CVE-2023-30184A stored cross-site scripting (XSS) vulnerability in Typecho v1.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted
- CVE-2023-30216Insecure permissions in the updateUserInfo function of newbee-mall before commit 1f2c2dfy allows attackers to obtain user account informatio
- CVE-2023-31413Filebeat versions through 7.17.9 and 8.6.2 have a flaw in httpjson input that allows the http request Authorization or Proxy-Authorization hElastic Filebeat