# CVEs published 2023-05-05

41 CVEs were published on May 5, 2023: 7 critical, 13 high. Days are UTC.

- [CVE-2023-29354](https://cve.now/CVE-2023-29354.md): Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (CVSS 4.7, Microsoft Edge)
- [CVE-2023-29350](https://cve.now/CVE-2023-29350.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft Edge)
- [CVE-2022-43866](https://cve.now/CVE-2022-43866.md): IBM Maximo Asset Management cross-site scripting (CVSS 5.4, IBM Maximo Asset Management)
- [CVE-2020-4914](https://cve.now/CVE-2020-4914.md): IBM Cloud Pak System Software Suite session fixation (CVSS 4.2, IBM Cloud Pak System Software Suite)
- [CVE-2023-26285](https://cve.now/CVE-2023-26285.md): IBM MQ denial of service (CVSS 5.9, IBM MQ)
- [CVE-2023-22874](https://cve.now/CVE-2023-22874.md): IBM MQ denial of service (CVSS 5.5, IBM MQ)
- [CVE-2022-43919](https://cve.now/CVE-2022-43919.md): IBM MQ denial of service (CVSS 5.3, IBM MQ)
- [CVE-2023-30434](https://cve.now/CVE-2023-30434.md): IBM Storage Scale denial of service (CVSS 6.2, IBM Elastic Storage System · IBM Spectrum Scale)
- [CVE-2022-38707](https://cve.now/CVE-2022-38707.md): IBM Cognos Command Center information disclosure (CVSS 4.0, IBM Cognos Command Center)
- [CVE-2021-40331](https://cve.now/CVE-2021-40331.md): Permissions problem in the Apache Ranger Hive Plugin (CVSS 8.1, Apache Software Foundation Apache Ranger Hive Plugin · org.…)
- [CVE-2022-45048](https://cve.now/CVE-2022-45048.md): Apache Ranger: code execution vulnerability in policy expressions (CVSS 8.4, Apache Software Foundation Apache Ranger · org.apache.range…)
- [CVE-2023-28068](https://cve.now/CVE-2023-28068.md): Dell Command Monitor, versions 10.9 and prior, contains an improper folder permission vulnerability. (CVSS 7.3, Dell Command Monitor)
- [CVE-2017-20183](https://cve.now/CVE-2017-20183.md): External Media without Import Plugin external-media-without-import.php print\_media\_new\_panel cross site scripting (CVSS 3.5, External Media without Import Plugin)
- [CVE-2023-2427](https://cve.now/CVE-2023-2427.md): Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq (CVSS 6.1, thorsten/phpmyfaq)
- [CVE-2023-2516](https://cve.now/CVE-2023-2516.md): Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass (CVSS 5.4, nilsteampassnet/teampass)
- [CVE-2023-2531](https://cve.now/CVE-2023-2531.md): Improper Restriction of Excessive Authentication Attempts in azuracast/azuracast (CVSS 7.3, azuracast/azuracast)
- [CVE-2023-2550](https://cve.now/CVE-2023-2550.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 8.2, thorsten/phpmyfaq)
- [CVE-2023-2551](https://cve.now/CVE-2023-2551.md): PHP Remote File Inclusion in unilogies/bumsys (CVSS 7.2, unilogies/bumsys)
- [CVE-2023-2552](https://cve.now/CVE-2023-2552.md): Cross-Site Request Forgery (CSRF) in unilogies/bumsys (CVSS 8.8, unilogies/bumsys)
- [CVE-2023-2553](https://cve.now/CVE-2023-2553.md): Cross-site Scripting (XSS) - Stored in unilogies/bumsys (CVSS 4.8, unilogies/bumsys)
- [CVE-2023-2554](https://cve.now/CVE-2023-2554.md): External Control of File Name or Path in unilogies/bumsys (CVSS 7.2, unilogies/bumsys)
- [CVE-2023-29659](https://cve.now/CVE-2023-29659.md): A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the heif::Fraction::round() (CVSS 6.5, github.com/strukturag/libheif)
- [CVE-2023-29932](https://cve.now/CVE-2023-29932.md): llvm-project commit fdbc55a5 was discovered to contain a segmentation fault via the component mlir::IROperand\<mlir::OpOperand. (CVSS 5.5)
- [CVE-2023-29933](https://cve.now/CVE-2023-29933.md): llvm-project commit bd456297 was discovered to contain a segmentation fault via the component mlir::Block::getArgument. (CVSS 5.5)
- [CVE-2023-29934](https://cve.now/CVE-2023-29934.md): llvm-project commit 6c01b5c was discovered to contain a segmentation fault via the component mlir::Type::getDialect(). (CVSS 5.5)
- [CVE-2023-29935](https://cve.now/CVE-2023-29935.md): llvm-project commit a0138390 was discovered to contain an assertion failure at !replacements.count(op) && "operation was already replaced. (CVSS 5.5)
- [CVE-2023-29939](https://cve.now/CVE-2023-29939.md): llvm-project commit a0138390 was discovered to contain a segmentation fault via the component mlir::spirv::TargetEnv::TargetEnv(mlir::spirv: (CVSS 5.5)
- [CVE-2023-29941](https://cve.now/CVE-2023-29941.md): llvm-project commit a0138390 was discovered to contain a segmentation fault via the component matchAndRewriteSortOp\<mlir::sparse\_tensor::Sor (CVSS 5.5)
- [CVE-2023-29942](https://cve.now/CVE-2023-29942.md): llvm-project commit a0138390 was discovered to contain a segmentation fault via the component mlir::Type::isa\<mlir::LLVM::LLVMVoidType. (CVSS 5.5)
- [CVE-2023-29963](https://cve.now/CVE-2023-29963.md): S-CMS v5.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /admin/ajax.php. (CVSS 7.2)
- [CVE-2023-30013](https://cve.now/CVE-2023-30013.md): TOTOLINK X5000R V9.1.0u.6118\_B20201102 and V9.1.0u.6369\_B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. (CVSS 9.8)
- [CVE-2023-30053](https://cve.now/CVE-2023-30053.md): TOTOLINK A7100RU V7.4cu.2313\_B20191024 is vulnerable to Command Injection. (CVSS 9.8)
- [CVE-2023-30054](https://cve.now/CVE-2023-30054.md): TOTOLINK A7100RU V7.4cu.2313\_B20191024 has a Command Injection vulnerability. (CVSS 9.8)
- [CVE-2023-30065](https://cve.now/CVE-2023-30065.md): MitraStar GPT-2741GNAC-N2 with firmware BR\_g5.9\_1.11(WVK.0)b32 was discovered to contain a remote code execution (RCE) vulnerability in the (CVSS 8.8)
- [CVE-2023-30090](https://cve.now/CVE-2023-30090.md): Semcms Shop v4.2 was discovered to contain an arbitrary file uplaod vulnerability via the component SEMCMS\_Upfile.php. (CVSS 9.8)
- [CVE-2023-30122](https://cve.now/CVE-2023-30122.md): An arbitrary file upload vulnerability in the component /admin/ajax.php?action=save\_menu of Online Food Ordering System v2.0 allows attacker (CVSS 9.8)
- [CVE-2023-30135](https://cve.now/CVE-2023-30135.md): Tenda AC18 v15.03.05.19(6318\_)\_cn was discovered to contain a command injection vulnerability via the deviceName parameter in the setUsbUnlo (CVSS 9.8)
- [CVE-2023-30242](https://cve.now/CVE-2023-30242.md): NS-ASG v6.3 was discovered to contain a SQL injection vulnerability via the component /admin/add\_ikev2.php. (CVSS 9.8)
- [CVE-2023-30243](https://cve.now/CVE-2023-30243.md): Beijing Netcon NS-ASG Application Security Gateway v6.3 is vulnerable to SQL Injection via TunnelId that allows access to sensitive informat (CVSS 7.5)
- [CVE-2023-32235](https://cve.now/CVE-2023-32235.md): Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directo (CVSS 7.5, ghost)
- [CVE-2023-32269](https://cve.now/CVE-2023-32269.md): An issue was discovered in the Linux kernel before 6.1.11. (CVSS 6.7)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-05-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.