CVEs published May 8, 2023
185 CVEs were published on May 8, 2023: 27 critical, 63 high.
- Published
- 185
- Critical
- 27
- High
- 63
- Medium
- 85
- Low
- 7
- Unrated
- 3
- Now in CISA KEV
- 0
- Fix available
- 107
Most affected products
- Apple macOS
- 23
- Apple macOS · Apple iOS and iPadOS +2
- 14
- Hewlett Packard Enterprise (HPE) Aruba Access Points runnin…
- 13
- Apple macOS · Apple iOS and iPadOS
- 11
- MonicaHQ
- 6
- AI ChatBot
- 5
- Apple iOS and iPadOS
- 5
- Apple macOS · Apple iOS and iPadOS +1
- 4
- Advantech EKI-1524 · Advantech EKI-1522 +1
- 3
- AgilePoint NX
- 3
Critical 27
- CVE-2023-31127DMTF-2023-0001: SPDM mutual authentication bypassDMTF libspdm
- CVE-2023-31123effectindex/tripreporter vulnerable to improper password verification on POST `/api/v1/account/login`effectindex tripreporter
- CVE-2023-22786Unauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI ProtocolHewlett Packard Enterprise (HPE) Aruba Access Points runnin…
- CVE-2023-22785Unauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI ProtocolHewlett Packard Enterprise (HPE) Aruba Access Points runnin…
- CVE-2023-22784Unauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI ProtocolHewlett Packard Enterprise (HPE) Aruba Access Points runnin…
- CVE-2023-22783Unauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI ProtocolHewlett Packard Enterprise (HPE) Aruba Access Points runnin…
- CVE-2023-22782Unauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI ProtocolHewlett Packard Enterprise (HPE) Aruba Access Points runnin…
- CVE-2023-22781Unauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI ProtocolHewlett Packard Enterprise (HPE) Aruba Access Points runnin…
- CVE-2023-22780Unauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI ProtocolHewlett Packard Enterprise (HPE) Aruba Access Points runnin…
- CVE-2023-22779Unauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI ProtocolHewlett Packard Enterprise (HPE) Aruba Access Points runnin…
- CVE-2022-4118Bitcoin / AltCoin Payment Gateway <= 1.7.1 - Unauthenticated SQLiBitcoin / AltCoin Payment Gateway for WooCommerce & Multive…
- CVE-2023-1650ChatBot < 4.4.7 - Unauthenticated PHP Object InjectionAI ChatBot
- CVE-2023-25754Apache Airflow: Privilege escalation using airflow logsApache Software Foundation Apache Airflow · apache-airflow
- CVE-2023-31039Apache bRPC: ServerOptions.pid_file may cause arbitrary code executionApache Software Foundation Apache bRPC
- CVE-2020-23966SQL Injection vulnerability in victor cms 1.0 allows attackers to execute arbitrary commands via the post parameter to /post.php in a crafte
- CVE-2023-23526This was addressed with additional checks by Gatekeeper on files downloaded from an iCloud shared-by-me folder.Apple macOS · Apple iOS and iPadOS
- CVE-2023-2478An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.9.7, all versions starting from 15.10 beforGitLab
- CVE-2023-2583 Code Injection in jsreport/jsreportjsreport/jsreport · jsreport
- CVE-2023-27953The issue was addressed with improved memory handling.Apple macOS
- CVE-2023-27958The issue was addressed with improved memory handling.Apple macOS
- CVE-2023-28201This issue was addressed with improved state management.Apple macOS · Apple Safari +2
- CVE-2023-29693H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function set_tftp_upgrad.
- CVE-2023-29696H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function version_set.
- CVE-2023-29944Metersphere v1.20.20-lts-79d354a6 is vulnerable to Remote Command Execution.
- CVE-2023-30018Judging Management System v1.0 is vulnerable to SQL Injection.
- CVE-2023-30092SourceCodester Online Pizza Ordering System v1.0 is vulnerable to SQL Injection via the QTY parameter.
- CVE-2023-30185CRMEB v4.4 to v4.6 was discovered to contain an arbitrary file upload vulnerability via the component \attachment\SystemAttachmentServices.p
High 63
- CVE-2023-22710WordPress Return and Warranty Management System for WooCommerce Plugin <= 1.2.3 is vulnerable to Cross Site Scripting (XSS)chilidevs Return and Warranty Management System for WooComm…
- CVE-2023-31133Ghost vulnerable to disclosure of private API fieldsTryGhost Ghost · ghost
- CVE-2023-31129Contiki-NG missing NULL pointer check in IPv6 neighbor discoverycontiki-ng
- CVE-2023-30860WWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's accountWWBN AVideo · wwbn/avideo
- CVE-2023-30837Vyper storage allocator overflowvyperlang vyper · vyper
- CVE-2023-30551Rekor's compressed archives can result in OOM conditionssigstore rekor · github.com/sigstore/rekor
- CVE-2022-45065WordPress SEO Plugin by Squirrly SEO Plugin <= 12.1.20 is vulnerable to Cross Site Scripting (XSS)SEO Plugin by Squirrly SEO
- CVE-2022-47439WordPress Open Graphite Plugin <= 1.6.0 is vulnerable to Cross Site Scripting (XSS)Rocket Apps Open Graphite
- CVE-2023-22790Authenticated Remote Command Execution in Aruba InstantOS or ArubaOS 10 Command Line InterfaceHewlett Packard Enterprise (HPE) Aruba Access Points runnin…
- CVE-2023-22789Authenticated Remote Command Execution in Aruba InstantOS or ArubaOS 10 Command Line InterfaceHewlett Packard Enterprise (HPE) Aruba Access Points runnin…
- CVE-2023-22788Authenticated Remote Command Execution in Aruba InstantOS or ArubaOS 10 Command Line InterfaceHewlett Packard Enterprise (HPE) Aruba Access Points runnin…
- CVE-2023-22787Unauthenticated Denial of Service (DoS) in Aruba InstantOS or ArubaOS 10 Service Accessed via the PAPI ProtocolHewlett Packard Enterprise (HPE) Aruba Access Points runnin…
- CVE-2023-0603Sloth Logo Customizer <= 2.0.2 - Stored XSS via CSRFSloth Logo Customizer
- CVE-2023-1408Video List Manager <= 1.7 - Admin+ SQL InjectionVideo List Manager
- CVE-2023-1347Customizer Export/Import < 0.9.6 - Admin+ PHP Object InjectionCustomizer Export/Import
- CVE-2023-2114NEX-Forms < 8.4 - Admin+ SQL InjectionNEX-Forms
- CVE-2023-0768Avirato hotels online booking engine <= 5.0.5 - Subscriber+ SQLiAvirato hotels online booking engine
- CVE-2023-2573Authenticated Command InjectionAdvantech EKI-1524 · Advantech EKI-1522 +1
- CVE-2023-2574Authenticated Command InjectionAdvantech EKI-1524 · Advantech EKI-1522 +1
- CVE-2023-2575Authenticated Buffer OverflowAdvantech EKI-1524 · Advantech EKI-1522 +1
- CVE-2022-46799WordPress Easy Testimonial Slider and Form Plugin <= 1.0.15 is vulnerable to Cross Site Scripting (XSS)I Thirteen Web Solution Easy Testimonial Slider and Form
- CVE-2023-31038Apache Log4cxx: SQL injection when using ODBC appenderApache Software Foundation Apache Log4cxx
- CVE-2023-2534Information disclouse and DoS via websocket push eventsOTRS AG OTRS
- CVE-2020-18131Cross Site Request Forgery (CSRF) vulnerability in Bluethrust Clan Scripts v4 allows attackers to escilate privledges to an arbitrary accoun
- CVE-2020-22755File upload vulnerability in MCMS 5.0 allows attackers to execute arbitrary code via a crafted thumbnail.net.mingsoft:ms-mcms
- CVE-2020-36065Cross Site Request Forgery (CSRF) vulnerability in FlyCms 1.0 allows attackers to add arbitrary administrator accounts via system/admin/admi
- CVE-2021-27280OS Command injection vulnerability in mblog 3.5.0 allows attackers to execute arbitrary code via crafted theme when it gets selected.
- CVE-2021-28998File upload vulnerability in CMS Made Simple through 2.2.15 allows remote authenticated attackers to gain a webshell via a crafted phar file
- CVE-2021-28999SQL Injection vulnerability in CMS Made Simple through 2.2.15 allows remote attackers to execute arbitrary commands via the m1_sortby parame
- CVE-2022-32885A memory corruption issue was addressed with improved validation.Apple macOS
- CVE-2022-46720An integer overflow was addressed with improved input validation.Apple macOS
- CVE-2023-1031MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `settings` endpoMonicaHQ
- CVE-2023-1094MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/food`MonicaHQ
- CVE-2023-23525This issue was addressed with improved checks.Apple macOS · Apple iOS and iPadOS
- CVE-2023-23532This issue was addressed with improved checks.Apple macOS · Apple iOS and iPadOS
- CVE-2023-23536The issue was addressed with improved bounds checks.Apple macOS · Apple iOS and iPadOS +2
- CVE-2023-23540The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS
- CVE-2023-24506Milesight NCR/Camera CWE-522: Insufficiently Protected CredentialsMilesight NCR/Camera
- CVE-2023-24507AgilePoint NX v8.0 SU2.2 & SU2.3 – Insecure File UploadAgilePoint NX
- CVE-2023-2566Cross-site Scripting (XSS) - Stored in openemr/openemropenemr/openemr
- CVE-2023-27934A memory initialization issue was addressed.Apple macOS
- CVE-2023-27935The issue was addressed with improved bounds checks.Apple macOS
- CVE-2023-27936An out-of-bounds write issue was addressed with improved input validation.Apple macOS · Apple iOS and iPadOS
- CVE-2023-27937An integer overflow was addressed with improved input validation.Apple macOS · Apple iOS and iPadOS +2
- CVE-2023-27938An out-of-bounds read issue was addressed with improved input validation.Apple macOS
- CVE-2023-27944This issue was addressed with a new entitlement.Apple macOS
- CVE-2023-27946An out-of-bounds read was addressed with improved bounds checking.Apple macOS · Apple iOS and iPadOS
- CVE-2023-27949An out-of-bounds read was addressed with improved input validation.Apple macOS · Apple iOS and iPadOS
- CVE-2023-27957A buffer overflow issue was addressed with improved memory handling.Apple macOS
- CVE-2023-27959The issue was addressed with improved memory handling.Apple iOS and iPadOS
- CVE-2023-27960This issue was addressed by removing the vulnerable code.Apple macOS
- CVE-2023-27963The issue was addressed with additional permissions checks.Apple macOS · Apple iOS and iPadOS +2
- CVE-2023-27965A memory corruption issue was addressed with improved state management.Apple macOS · Apple Studio Display Firmware Update
- CVE-2023-27967The issue was addressed with improved memory handling.Apple Xcode
- CVE-2023-27968A buffer overflow issue was addressed with improved memory handling.Apple macOS
- CVE-2023-27969A use after free issue was addressed with improved memory management.Apple macOS · Apple iOS and iPadOS +2
- CVE-2023-27970An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS and iPadOS
- CVE-2023-28181The issue was addressed with improved memory handling.Apple macOS · Apple iOS and iPadOS +2
- CVE-2023-30257A buffer overflow in the component /proc/ftxxxx-debug of FiiO M6 Build Number v1.0.4 allows attackers to escalate privileges to root.
- CVE-2023-31178AgilePoint NX v8.0 SU2.2 & SU2.3 – Arbitrary File DeleteAgilePoint NX
- CVE-2023-31181 WJJ Software - InnoKB Server, InnoKB/Console 2.2.1 - CWE-22: Path TraversalWJJ Software InnoKB Server, InnoKB/Console
- CVE-2023-31182 EasyTor Applications – Authorization BypassEasyTor Applications
- CVE-2023-32233In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary
Medium, low and unrated 95
- CVE-2023-22813Device API endpoint missing access controls on Western Digital Mobile and Web AppsWestern Digital My Cloud OS 5 Mobile App · Western Digit… +4
- CVE-2023-23894WordPress Surbma | GDPR Proof Cookie Consent & Notice Bar Plugin <= 17.5.3 is vulnerable to Cross Site Scripting (XSS)Surbma | GDPR Proof Cookie Consent & Notice Bar
- CVE-2023-24376WordPress WP Simple Events Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)Nico Graff WP Simple Events
- CVE-2023-31141OpenSearch issue with fine-grained access control during extremely rare race conditionsopensearch-project security · org.opensearch.plugin:opensea…
- CVE-2023-31140OpenProject user sessions not terminated after activation of 2FAopf openproject
- CVE-2023-31125Uncaught exception in engine.iosocketio engine.io · engine.io
- CVE-2023-30855Pimcore Path Traversal Vulnerability in AdminBundle/Controller/Reports/CustomReportController.phppimcore · pimcore/pimcore
- CVE-2023-30844Mutagen list and monitor operations do not neutralize control characters in text controlled by remote endpointsmutagen-io mutagen · github.com/mutagen-io/mutagen +1
- CVE-2023-30840On a compromised node, the fluid-csi service account can be used to modify node specsfluid-cloudnative fluid · github.com/fluid-cloudnative/fluid
- CVE-2023-1979Auth bypass in Web Stories for WordPress pluginGoogle Web Stories for WordPress
- CVE-2023-24408WordPress Ecwid Shopping Cart Plugin <= 6.11.4 is vulnerable to Cross Site Scripting (XSS)Ecwid Ecommerce Shopping Cart
- CVE-2023-28493WordPress Newsmag Theme <= 2.4.4 is vulnerable to Cross Site Scripting (XSS)Macho Themes NewsMag
- CVE-2022-47437WordPress WSB Brands Plugin <= 1.1.8 is vulnerable to Cross Site Scripting (XSS)Branko Borilovic WSB Brands
- CVE-2023-22791Aruba InstantOS and ArubaOS 10 Sensitive Information DisclosureHewlett Packard Enterprise (HPE) Aruba Access Points runnin…
- CVE-2023-0268Mega Addons For WPBakery Page Builder < 4.3.0 - Contributor+ Stored XSSMega Addons For WPBakery Page Builder
- CVE-2023-0526Post Shortcode <= 2.0.9 - Contributor+ Stored Cross-Site ScriptingPost Shortcode
- CVE-2023-0537Product Slider For WooCommerce Lite <= 1.1.7 - Contributor+ Stored XSSProduct Slider For WooCommerce Lite
- CVE-2023-0280Ultimate Carousel For Elementor <= 2.1.7 - Contributor+ Stored XSSUltimate Carousel For Elementor
- CVE-2023-0536Wp-D3 <= 2.4.1 - Contributor+ Stored XSSWp-D3
- CVE-2023-1649ChatBot < 4.5.1 - Admin+ Stored XSSAI ChatBot
- CVE-2023-1806WP Inventory Manager < 2.1.0.12 - Reflected XSSWP Inventory Manager
- CVE-2023-0542Custom Post Type List Shortcode <= 1.4.4 - Contributor+ Stored XSSCustom Post Type List Shortcode
- CVE-2023-0514Membership Database <= 1.0 - Reflected XSSMembership Database
- CVE-2023-1651ChatBot < 4.4.9 - Subscriber+ OpenAI Settings Update to Stored XSSAI ChatBot
- CVE-2023-0522Enable/Disable Auto Login when Register <= 1.1.0 - Settings Update via CSRFEnable/Disable Auto Login when Register
- CVE-2023-1011ChatBot < 4.4.5 - Stored XSS via CSRFAI ChatBot
- CVE-2023-0544WP Login Box <= 2.0.2 - Admin+ Stored XSSWP Login Box
- CVE-2023-1660ChatBot < 4.4.9 - Unauthenticated Stored XSSAI ChatBot
- CVE-2023-0421Cloud Manager <= 1.0 - Reflected XSSCloud Manager
- CVE-2023-0948Japanized For WooCommerce < 2.5.8 - Reflected XSSJapanized For WooCommerce
- CVE-2023-0267Ultimate Carousel For WPBakery Page Builder <= 2.6 - Contributor+ Stored XSSUltimate Carousel For WPBakery Page Builder
- CVE-2023-0894Pickup | Delivery | Dine-in date time <= 1.0.9 - Admin+ Stored XSSPickup | Delivery | Dine-in date time
- CVE-2023-1905WP Popups < 2.1.5.1 - Contributor+ Stored XSSWP Popups
- CVE-2023-25052WordPress Yandex.News Feed by Teplitsa Plugin <= 1.12.5 is vulnerable to Cross Site Scripting (XSS)Yandex.News Feed by Teplitsa
- CVE-2023-28169WordPress Easy Event calendar Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)CoreFortress Easy Event calendar
- CVE-2023-25452WordPress CMS Press Plugin <= 0.2.3 is vulnerable to Cross Site Scripting (XSS)Michael Pretty (prettyboymp) CMS Press
- CVE-2022-45812WordPress Exxp Plugin <= 2.6.8 is vulnerable to Cross Site Scripting (XSS)Martin Lees Exxp
- CVE-2023-23668WordPress GiveWP Plugin <= 2.25.1 is vulnerable to Cross Site Scripting (XSS)GiveWP
- CVE-2023-25021WordPress FareHarbor for WordPress Plugin <= 3.6.6 is vulnerable to Cross Site Scripting (XSS)FareHarbor for WordPress
- CVE-2023-29247Stored XSS on Apache AirflowApache Software Foundation Apache Airflow · apache-airflow
- CVE-2020-18132Cross Site Scripting (XSS) vulnerability in MIPCMS 3.6.0 allows attackers to execute arbitrary code via the category name field to categoryE
- CVE-2020-18282Cross-site scripting (XSS) vulnerability in NoneCms 1.3.0 allows remote attackers to inject arbitrary web script or HTML via feedback featur
- CVE-2020-19660Cross Site Scripting (XSS) pandao editor.md 1.5.0 allows attackers to execute arbitrary code via crafted linked url values.
- CVE-2020-21038Open redirect vulnerability in typecho 1.1-17.10.30-release via the referer parameter to Login.php.
- CVE-2020-22334Cross Site Request Forgery (CSRF) vulnerability in beescms v4 allows attackers to delete the administrator account via crafted request to /a
- CVE-2023-21404AXIS OS 11.0.X - 11.3.x use a static RSA key in legacy LUA-components to protect Axis-specific source code.Axis Communications AB AXIS OS
- CVE-2023-23494A buffer overflow was addressed with improved bounds checking.Apple iOS and iPadOS
- CVE-2023-23523A logic issue was addressed with improved restrictions.Apple macOS · Apple iOS and iPadOS
- CVE-2023-23527The issue was addressed with improved checks.Apple macOS · Apple iOS and iPadOS +2
- CVE-2023-23528An out-of-bounds read was addressed with improved bounds checking.Apple iOS and iPadOS · Apple tvOS
- CVE-2023-23533A logic issue was addressed with improved checks.Apple macOS
- CVE-2023-23534The issue was addressed with improved checks.Apple macOS
- CVE-2023-23535The issue was addressed with improved memory handling.Apple macOS · Apple iOS and iPadOS +2
- CVE-2023-23537A privacy issue was addressed with improved private data redaction for log entries.Apple macOS · Apple iOS and iPadOS +1
- CVE-2023-23538A logic issue was addressed with improved checks.Apple macOS
- CVE-2023-23541A privacy issue was addressed with improved private data redaction for log entries.Apple iOS and iPadOS
- CVE-2023-23542A privacy issue was addressed with improved private data redaction for log entries.Apple macOS
- CVE-2023-23543The issue was addressed with additional restrictions on the observability of app states.Apple macOS · Apple iOS and iPadOS +1
- CVE-2023-24505Milesight NCR/Camera CWE-200: Exposure of Sensitive InformationMilesight NCR/Camera
- CVE-2023-2513A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inode size for extended attriLinux kernel ext4 filesystem
- CVE-2023-2582A prototype pollution vulnerability exists in Strikingly CMS which can result in reflected cross-site scripting (XSS) in affected applicatioStrikingly
- CVE-2023-27928A privacy issue was addressed with improved private data redaction for log entries.Apple macOS · Apple iOS and iPadOS +2
- CVE-2023-27929An out-of-bounds read was addressed with improved input validation.Apple macOS · Apple iOS and iPadOS +2
- CVE-2023-27931This issue was addressed by removing the vulnerable code.Apple macOS · Apple iOS and iPadOS +2
- CVE-2023-27932This issue was addressed with improved state management.Apple macOS · Apple Safari +3
- CVE-2023-27933The issue was addressed with improved memory handling.Apple macOS · Apple iOS and iPadOS +2
- CVE-2023-27941A validation issue was addressed with improved input sanitization.Apple macOS · Apple iOS and iPadOS
- CVE-2023-27942The issue was addressed with improved checks.Apple macOS · Apple iOS and iPadOS +2
- CVE-2023-27943This issue was addressed with improved checks.Apple macOS · Apple iOS and iPadOS
- CVE-2023-27945This issue was addressed with improved entitlements.Apple macOS · Apple Xcode
- CVE-2023-27951The issue was addressed with improved checks.Apple macOS
- CVE-2023-27952A race condition was addressed with improved locking.Apple macOS
- CVE-2023-27954The issue was addressed by removing origin information.Apple macOS · Apple Safari +3
- CVE-2023-27955The issue was addressed with improved checks.Apple macOS · Apple iOS and iPadOS +1
- CVE-2023-27956The issue was addressed with improved memory handling.Apple macOS · Apple iOS and iPadOS +2
- CVE-2023-27961Multiple validation issues were addressed with improved input sanitization.Apple macOS · Apple iOS and iPadOS +1
- CVE-2023-27962A logic issue was addressed with improved checks.Apple macOS
- CVE-2023-27966The issue was addressed with improved checks.Apple macOS
- CVE-2023-28178A logic issue was addressed with improved validation.Apple macOS · Apple iOS and iPadOS +2
- CVE-2023-28180A denial-of-service issue was addressed with improved memory handling.Apple macOS
- CVE-2023-28182The issue was addressed with improved authentication.Apple macOS · Apple iOS and iPadOS
- CVE-2023-28189The issue was addressed with improved checks.Apple macOS
- CVE-2023-28190A privacy issue was addressed by moving sensitive data to a more secure location.Apple macOS
- CVE-2023-28192A permissions issue was addressed with improved validation.Apple macOS
- CVE-2023-28194The issue was addressed with improved checks.Apple iOS and iPadOS
- CVE-2023-28200A validation issue was addressed with improved input sanitization.Apple macOS · Apple iOS and iPadOS
- CVE-2023-30019imgproxy <=3.14.0 is vulnerable to Server-Side Request Forgery (SSRF) due to a lack of sanitization of the imageURL parameter.github.com/imgproxy/imgproxy/v3 · github.com/imgproxy/im… +1
- CVE-2023-30334AsmBB v2.9.1 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the MiniMag.asm and bbcode.asm libraries.
- CVE-2023-30787MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/introMonicaHQ
- CVE-2023-30788MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people/add` endMonicaHQ
- CVE-2023-30789MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/work`MonicaHQ
- CVE-2023-30790MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/relatMonicaHQ
- CVE-2023-31179AgilePoint NX v8.0 SU2.2 & SU2.3 - Path traversalAgilePoint NX
- CVE-2023-31180 WJJ Software - InnoKB Server, InnoKB/Console 2.2.1 - Reflected cross-site scripting (RXSS)WJJ Software InnoKB Server, InnoKB/Console
- CVE-2023-31183 Cybonet PineApp Mail Secure RXSS vulnerabilityCybonet PineApp