# CVEs published 2023-05-08

185 CVEs were published on May 8, 2023: 27 critical, 63 high. Days are UTC.

- [CVE-2023-22813](https://cve.now/CVE-2023-22813.md): Device API endpoint missing access controls on Western Digital Mobile and Web Apps (CVSS 3.3, Western Digital My Cloud OS 5 Mobile App · Western Digit… +4)
- [CVE-2023-22710](https://cve.now/CVE-2023-22710.md): WordPress Return and Warranty Management System for WooCommerce Plugin \<= 1.2.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, chilidevs Return and Warranty Management System for WooComm…)
- [CVE-2023-23894](https://cve.now/CVE-2023-23894.md): WordPress Surbma | GDPR Proof Cookie Consent & Notice Bar Plugin \<= 17.5.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Surbma | GDPR Proof Cookie Consent & Notice Bar)
- [CVE-2023-24376](https://cve.now/CVE-2023-24376.md): WordPress WP Simple Events Plugin \<= 1.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Nico Graff WP Simple Events)
- [CVE-2023-31133](https://cve.now/CVE-2023-31133.md): Ghost vulnerable to disclosure of private API fields (CVSS 7.5, TryGhost Ghost · ghost)
- [CVE-2023-31129](https://cve.now/CVE-2023-31129.md): Contiki-NG missing NULL pointer check in IPv6 neighbor discovery (CVSS 7.5, contiki-ng)
- [CVE-2023-31141](https://cve.now/CVE-2023-31141.md): OpenSearch issue with fine-grained access control during extremely rare race conditions (CVSS 4.8, opensearch-project security · org.opensearch.plugin:opensea…)
- [CVE-2023-31140](https://cve.now/CVE-2023-31140.md): OpenProject user sessions not terminated after activation of 2FA (CVSS 4.8, opf openproject)
- [CVE-2023-31125](https://cve.now/CVE-2023-31125.md): Uncaught exception in engine.io (CVSS 6.5, socketio engine.io · engine.io)
- [CVE-2023-31127](https://cve.now/CVE-2023-31127.md): DMTF-2023-0001: SPDM mutual authentication bypass (CVSS 9.1, DMTF libspdm)
- [CVE-2023-31123](https://cve.now/CVE-2023-31123.md): effectindex/tripreporter vulnerable to improper password verification on POST \`/api/v1/account/login\` (CVSS 9.1, effectindex tripreporter)
- [CVE-2023-30860](https://cve.now/CVE-2023-30860.md): WWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's account (CVSS 8.0, WWBN AVideo · wwbn/avideo)
- [CVE-2023-30855](https://cve.now/CVE-2023-30855.md): Pimcore Path Traversal Vulnerability in AdminBundle/Controller/Reports/CustomReportController.php (CVSS 6.5, pimcore · pimcore/pimcore)
- [CVE-2023-30844](https://cve.now/CVE-2023-30844.md): Mutagen list and monitor operations do not neutralize control characters in text controlled by remote endpoints (CVSS 3.0, mutagen-io mutagen · github.com/mutagen-io/mutagen +1)
- [CVE-2023-30840](https://cve.now/CVE-2023-30840.md): On a compromised node, the fluid-csi service account can be used to modify node specs (CVSS 5.8, fluid-cloudnative fluid · github.com/fluid-cloudnative/fluid)
- [CVE-2023-1979](https://cve.now/CVE-2023-1979.md): Auth bypass in Web Stories for WordPress plugin (CVSS 4.9, Google Web Stories for WordPress)
- [CVE-2023-30837](https://cve.now/CVE-2023-30837.md): Vyper storage allocator overflow (CVSS 7.5, vyperlang vyper · vyper)
- [CVE-2023-30551](https://cve.now/CVE-2023-30551.md): Rekor's compressed archives can result in OOM conditions (CVSS 7.5, sigstore rekor · github.com/sigstore/rekor)
- [CVE-2023-24408](https://cve.now/CVE-2023-24408.md): WordPress Ecwid Shopping Cart Plugin \<= 6.11.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Ecwid Ecommerce Shopping Cart)
- [CVE-2022-45065](https://cve.now/CVE-2022-45065.md): WordPress SEO Plugin by Squirrly SEO Plugin \<= 12.1.20 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, SEO Plugin by Squirrly SEO)
- [CVE-2023-28493](https://cve.now/CVE-2023-28493.md): WordPress Newsmag Theme \<= 2.4.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Macho Themes NewsMag)
- [CVE-2022-47439](https://cve.now/CVE-2022-47439.md): WordPress Open Graphite Plugin \<= 1.6.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Rocket Apps Open Graphite)
- [CVE-2022-47437](https://cve.now/CVE-2022-47437.md): WordPress WSB Brands Plugin \<= 1.1.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Branko Borilovic WSB Brands)
- [CVE-2023-22791](https://cve.now/CVE-2023-22791.md): Aruba InstantOS and ArubaOS 10 Sensitive Information Disclosure (CVSS 5.4, Hewlett Packard Enterprise (HPE) Aruba Access Points runnin…)
- [CVE-2023-22790](https://cve.now/CVE-2023-22790.md): Authenticated Remote Command Execution in Aruba InstantOS or ArubaOS 10 Command Line Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba Access Points runnin…)
- [CVE-2023-22789](https://cve.now/CVE-2023-22789.md): Authenticated Remote Command Execution in Aruba InstantOS or ArubaOS 10 Command Line Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba Access Points runnin…)
- [CVE-2023-22788](https://cve.now/CVE-2023-22788.md): Authenticated Remote Command Execution in Aruba InstantOS or ArubaOS 10 Command Line Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba Access Points runnin…)
- [CVE-2023-22787](https://cve.now/CVE-2023-22787.md): Unauthenticated Denial of Service (DoS) in Aruba InstantOS or ArubaOS 10 Service Accessed via the PAPI Protocol (CVSS 7.5, Hewlett Packard Enterprise (HPE) Aruba Access Points runnin…)
- [CVE-2023-22786](https://cve.now/CVE-2023-22786.md): Unauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI Protocol (CVSS 9.8, Hewlett Packard Enterprise (HPE) Aruba Access Points runnin…)
- [CVE-2023-22785](https://cve.now/CVE-2023-22785.md): Unauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI Protocol (CVSS 9.8, Hewlett Packard Enterprise (HPE) Aruba Access Points runnin…)
- [CVE-2023-22784](https://cve.now/CVE-2023-22784.md): Unauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI Protocol (CVSS 9.8, Hewlett Packard Enterprise (HPE) Aruba Access Points runnin…)
- [CVE-2023-22783](https://cve.now/CVE-2023-22783.md): Unauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI Protocol (CVSS 9.8, Hewlett Packard Enterprise (HPE) Aruba Access Points runnin…)
- [CVE-2023-22782](https://cve.now/CVE-2023-22782.md): Unauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI Protocol (CVSS 9.8, Hewlett Packard Enterprise (HPE) Aruba Access Points runnin…)
- [CVE-2023-22781](https://cve.now/CVE-2023-22781.md): Unauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI Protocol (CVSS 9.8, Hewlett Packard Enterprise (HPE) Aruba Access Points runnin…)
- [CVE-2023-22780](https://cve.now/CVE-2023-22780.md): Unauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI Protocol (CVSS 9.8, Hewlett Packard Enterprise (HPE) Aruba Access Points runnin…)
- [CVE-2023-22779](https://cve.now/CVE-2023-22779.md): Unauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI Protocol (CVSS 9.8, Hewlett Packard Enterprise (HPE) Aruba Access Points runnin…)
- [CVE-2023-0268](https://cve.now/CVE-2023-0268.md): Mega Addons For WPBakery Page Builder \< 4.3.0 - Contributor+ Stored XSS (CVSS 5.4, Mega Addons For WPBakery Page Builder)
- [CVE-2023-0526](https://cve.now/CVE-2023-0526.md): Post Shortcode \<= 2.0.9 - Contributor+ Stored Cross-Site Scripting (CVSS 5.4, Post Shortcode)
- [CVE-2023-0603](https://cve.now/CVE-2023-0603.md): Sloth Logo Customizer \<= 2.0.2 - Stored XSS via CSRF (CVSS 8.8, Sloth Logo Customizer)
- [CVE-2023-0537](https://cve.now/CVE-2023-0537.md): Product Slider For WooCommerce Lite \<= 1.1.7 - Contributor+ Stored XSS (CVSS 5.4, Product Slider For WooCommerce Lite)
- [CVE-2023-1408](https://cve.now/CVE-2023-1408.md): Video List Manager \<= 1.7 - Admin+ SQL Injection (CVSS 7.2, Video List Manager)
- [CVE-2022-4118](https://cve.now/CVE-2022-4118.md): Bitcoin / AltCoin Payment Gateway \<= 1.7.1 - Unauthenticated SQLi (CVSS 9.8, Bitcoin / AltCoin Payment Gateway for WooCommerce & Multive…)
- [CVE-2023-1347](https://cve.now/CVE-2023-1347.md): Customizer Export/Import \< 0.9.6 - Admin+ PHP Object Injection (CVSS 7.2, Customizer Export/Import)
- [CVE-2023-0280](https://cve.now/CVE-2023-0280.md): Ultimate Carousel For Elementor \<= 2.1.7 - Contributor+ Stored XSS (CVSS 5.4, Ultimate Carousel For Elementor)
- [CVE-2023-0536](https://cve.now/CVE-2023-0536.md): Wp-D3 \<= 2.4.1 - Contributor+ Stored XSS (CVSS 5.4, Wp-D3)
- [CVE-2023-1649](https://cve.now/CVE-2023-1649.md): ChatBot \< 4.5.1 - Admin+ Stored XSS (CVSS 4.8, AI ChatBot)
- [CVE-2023-1806](https://cve.now/CVE-2023-1806.md): WP Inventory Manager \< 2.1.0.12 - Reflected XSS (CVSS 6.1, WP Inventory Manager)
- [CVE-2023-1650](https://cve.now/CVE-2023-1650.md): ChatBot \< 4.4.7 - Unauthenticated PHP Object Injection (CVSS 9.8, AI ChatBot)
- [CVE-2023-0542](https://cve.now/CVE-2023-0542.md): Custom Post Type List Shortcode \<= 1.4.4 - Contributor+ Stored XSS (CVSS 5.4, Custom Post Type List Shortcode)
- [CVE-2023-0514](https://cve.now/CVE-2023-0514.md): Membership Database \<= 1.0 - Reflected XSS (CVSS 6.1, Membership Database)
- [CVE-2023-1651](https://cve.now/CVE-2023-1651.md): ChatBot \< 4.4.9 - Subscriber+ OpenAI Settings Update to Stored XSS (CVSS 5.4, AI ChatBot)
- [CVE-2023-2114](https://cve.now/CVE-2023-2114.md): NEX-Forms \< 8.4 - Admin+ SQL Injection (CVSS 7.2, NEX-Forms)
- [CVE-2023-0522](https://cve.now/CVE-2023-0522.md): Enable/Disable Auto Login when Register \<= 1.1.0 - Settings Update via CSRF (CVSS 6.5, Enable/Disable Auto Login when Register)
- [CVE-2023-1011](https://cve.now/CVE-2023-1011.md): ChatBot \< 4.4.5 - Stored XSS via CSRF (CVSS 6.1, AI ChatBot)
- [CVE-2023-0544](https://cve.now/CVE-2023-0544.md): WP Login Box \<= 2.0.2 - Admin+ Stored XSS (CVSS 4.8, WP Login Box)
- [CVE-2023-1660](https://cve.now/CVE-2023-1660.md): ChatBot \< 4.4.9 - Unauthenticated Stored XSS (CVSS 6.1, AI ChatBot)
- [CVE-2023-0421](https://cve.now/CVE-2023-0421.md): Cloud Manager \<= 1.0 - Reflected XSS (CVSS 6.1, Cloud Manager)
- [CVE-2023-0948](https://cve.now/CVE-2023-0948.md): Japanized For WooCommerce \< 2.5.8 - Reflected XSS (CVSS 6.1, Japanized For WooCommerce)
- [CVE-2023-0267](https://cve.now/CVE-2023-0267.md): Ultimate Carousel For WPBakery Page Builder \<= 2.6 - Contributor+ Stored XSS (CVSS 5.4, Ultimate Carousel For WPBakery Page Builder)
- [CVE-2023-0768](https://cve.now/CVE-2023-0768.md): Avirato hotels online booking engine \<= 5.0.5 - Subscriber+ SQLi (CVSS 8.8, Avirato hotels online booking engine)
- [CVE-2023-0894](https://cve.now/CVE-2023-0894.md): Pickup | Delivery | Dine-in date time \<= 1.0.9 - Admin+ Stored XSS (CVSS 4.8, Pickup | Delivery | Dine-in date time)
- [CVE-2023-1905](https://cve.now/CVE-2023-1905.md): WP Popups \< 2.1.5.1 - Contributor+ Stored XSS (CVSS 5.4, WP Popups)
- [CVE-2023-25052](https://cve.now/CVE-2023-25052.md): WordPress Yandex.News Feed by Teplitsa Plugin \<= 1.12.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Yandex.News Feed by Teplitsa)
- [CVE-2023-2573](https://cve.now/CVE-2023-2573.md): Authenticated Command Injection (CVSS 8.8, Advantech EKI-1524 · Advantech EKI-1522 +1)
- [CVE-2023-2574](https://cve.now/CVE-2023-2574.md): Authenticated Command Injection (CVSS 8.8, Advantech EKI-1524 · Advantech EKI-1522 +1)
- [CVE-2023-28169](https://cve.now/CVE-2023-28169.md): WordPress Easy Event calendar Plugin \<= 1.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, CoreFortress Easy Event calendar)
- [CVE-2023-25452](https://cve.now/CVE-2023-25452.md): WordPress CMS Press Plugin \<= 0.2.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Michael Pretty (prettyboymp) CMS Press)
- [CVE-2023-2575](https://cve.now/CVE-2023-2575.md): Authenticated Buffer Overflow (CVSS 8.8, Advantech EKI-1524 · Advantech EKI-1522 +1)
- [CVE-2022-45812](https://cve.now/CVE-2022-45812.md): WordPress Exxp Plugin \<= 2.6.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Martin Lees Exxp)
- [CVE-2023-25754](https://cve.now/CVE-2023-25754.md): Apache Airflow: Privilege escalation using airflow logs (CVSS 9.8, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2023-23668](https://cve.now/CVE-2023-23668.md): WordPress GiveWP Plugin \<= 2.25.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, GiveWP)
- [CVE-2023-25021](https://cve.now/CVE-2023-25021.md): WordPress FareHarbor for WordPress Plugin \<= 3.6.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, FareHarbor for WordPress)
- [CVE-2022-46799](https://cve.now/CVE-2022-46799.md): WordPress Easy Testimonial Slider and Form Plugin \<= 1.0.15 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, I Thirteen Web Solution Easy Testimonial Slider and Form)
- [CVE-2023-29247](https://cve.now/CVE-2023-29247.md): Stored XSS on Apache Airflow (no CVSS, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2023-31039](https://cve.now/CVE-2023-31039.md): Apache bRPC: ServerOptions.pid\_file may cause arbitrary code execution (CVSS 9.8, Apache Software Foundation Apache bRPC)
- [CVE-2023-31038](https://cve.now/CVE-2023-31038.md): Apache Log4cxx: SQL injection when using ODBC appender (CVSS 8.8, Apache Software Foundation Apache Log4cxx)
- [CVE-2023-2534](https://cve.now/CVE-2023-2534.md): Information disclouse and DoS via websocket push events (CVSS 7.6, OTRS AG OTRS)
- [CVE-2020-18131](https://cve.now/CVE-2020-18131.md): Cross Site Request Forgery (CSRF) vulnerability in Bluethrust Clan Scripts v4 allows attackers to escilate privledges to an arbitrary accoun (CVSS 8.8)
- [CVE-2020-18132](https://cve.now/CVE-2020-18132.md): Cross Site Scripting (XSS) vulnerability in MIPCMS 3.6.0 allows attackers to execute arbitrary code via the category name field to categoryE (CVSS 4.8)
- [CVE-2020-18282](https://cve.now/CVE-2020-18282.md): Cross-site scripting (XSS) vulnerability in NoneCms 1.3.0 allows remote attackers to inject arbitrary web script or HTML via feedback featur (CVSS 6.1)
- [CVE-2020-19660](https://cve.now/CVE-2020-19660.md): Cross Site Scripting (XSS) pandao editor.md 1.5.0 allows attackers to execute arbitrary code via crafted linked url values. (CVSS 6.1)
- [CVE-2020-21038](https://cve.now/CVE-2020-21038.md): Open redirect vulnerability in typecho 1.1-17.10.30-release via the referer parameter to Login.php. (CVSS 6.1)
- [CVE-2020-22334](https://cve.now/CVE-2020-22334.md): Cross Site Request Forgery (CSRF) vulnerability in beescms v4 allows attackers to delete the administrator account via crafted request to /a (CVSS 6.5)
- [CVE-2020-22755](https://cve.now/CVE-2020-22755.md): File upload vulnerability in MCMS 5.0 allows attackers to execute arbitrary code via a crafted thumbnail. (CVSS 8.8, net.mingsoft:ms-mcms)
- [CVE-2020-23966](https://cve.now/CVE-2020-23966.md): SQL Injection vulnerability in victor cms 1.0 allows attackers to execute arbitrary commands via the post parameter to /post.php in a crafte (CVSS 9.8)
- [CVE-2020-36065](https://cve.now/CVE-2020-36065.md): Cross Site Request Forgery (CSRF) vulnerability in FlyCms 1.0 allows attackers to add arbitrary administrator accounts via system/admin/admi (CVSS 8.8)
- [CVE-2021-27280](https://cve.now/CVE-2021-27280.md): OS Command injection vulnerability in mblog 3.5.0 allows attackers to execute arbitrary code via crafted theme when it gets selected. (CVSS 7.8)
- [CVE-2021-28998](https://cve.now/CVE-2021-28998.md): File upload vulnerability in CMS Made Simple through 2.2.15 allows remote authenticated attackers to gain a webshell via a crafted phar file (CVSS 7.2)
- [CVE-2021-28999](https://cve.now/CVE-2021-28999.md): SQL Injection vulnerability in CMS Made Simple through 2.2.15 allows remote attackers to execute arbitrary commands via the m1\_sortby parame (CVSS 8.8)
- [CVE-2022-32885](https://cve.now/CVE-2022-32885.md): A memory corruption issue was addressed with improved validation. (CVSS 8.8, Apple macOS)
- [CVE-2022-46720](https://cve.now/CVE-2022-46720.md): An integer overflow was addressed with improved input validation. (CVSS 8.6, Apple macOS)
- [CVE-2023-1031](https://cve.now/CVE-2023-1031.md): MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the \`settings\` endpo (CVSS 8.8, MonicaHQ)
- [CVE-2023-1094](https://cve.now/CVE-2023-1094.md): MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the \`people:id/food\` (CVSS 8.0, MonicaHQ)
- [CVE-2023-21404](https://cve.now/CVE-2023-21404.md): AXIS OS 11.0.X - 11.3.x use a static RSA key in legacy LUA-components to protect Axis-specific source code. (CVSS 4.1, Axis Communications AB AXIS OS)
- [CVE-2023-23494](https://cve.now/CVE-2023-23494.md): A buffer overflow was addressed with improved bounds checking. (CVSS 5.3, Apple iOS and iPadOS)
- [CVE-2023-23523](https://cve.now/CVE-2023-23523.md): A logic issue was addressed with improved restrictions. (CVSS 3.3, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-23525](https://cve.now/CVE-2023-23525.md): This issue was addressed with improved checks. (CVSS 7.8, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-23526](https://cve.now/CVE-2023-23526.md): This was addressed with additional checks by Gatekeeper on files downloaded from an iCloud shared-by-me folder. (CVSS 9.8, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-23527](https://cve.now/CVE-2023-23527.md): The issue was addressed with improved checks. (CVSS 5.5, Apple macOS · Apple iOS and iPadOS +2)
- [CVE-2023-23528](https://cve.now/CVE-2023-23528.md): An out-of-bounds read was addressed with improved bounds checking. (no CVSS, Apple iOS and iPadOS · Apple tvOS)
- [CVE-2023-23532](https://cve.now/CVE-2023-23532.md): This issue was addressed with improved checks. (CVSS 8.8, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-23533](https://cve.now/CVE-2023-23533.md): A logic issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2023-23534](https://cve.now/CVE-2023-23534.md): The issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2023-23535](https://cve.now/CVE-2023-23535.md): The issue was addressed with improved memory handling. (CVSS 5.5, Apple macOS · Apple iOS and iPadOS +2)
- [CVE-2023-23536](https://cve.now/CVE-2023-23536.md): The issue was addressed with improved bounds checks. (CVSS 7.8, Apple macOS · Apple iOS and iPadOS +2)
- [CVE-2023-23537](https://cve.now/CVE-2023-23537.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 5.5, Apple macOS · Apple iOS and iPadOS +1)
- [CVE-2023-23538](https://cve.now/CVE-2023-23538.md): A logic issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2023-23540](https://cve.now/CVE-2023-23540.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-23541](https://cve.now/CVE-2023-23541.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 3.3, Apple iOS and iPadOS)
- [CVE-2023-23542](https://cve.now/CVE-2023-23542.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 5.5, Apple macOS)
- [CVE-2023-23543](https://cve.now/CVE-2023-23543.md): The issue was addressed with additional restrictions on the observability of app states. (CVSS 3.6, Apple macOS · Apple iOS and iPadOS +1)
- [CVE-2023-24505](https://cve.now/CVE-2023-24505.md): Milesight NCR/Camera CWE-200: Exposure of Sensitive Information (CVSS 5.3, Milesight NCR/Camera)
- [CVE-2023-24506](https://cve.now/CVE-2023-24506.md): Milesight NCR/Camera CWE-522: Insufficiently Protected Credentials (CVSS 7.5, Milesight NCR/Camera)
- [CVE-2023-24507](https://cve.now/CVE-2023-24507.md): AgilePoint NX v8.0 SU2.2 & SU2.3 – Insecure File Upload (CVSS 8.8, AgilePoint NX)
- [CVE-2023-2478](https://cve.now/CVE-2023-2478.md): An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.9.7, all versions starting from 15.10 befor (CVSS 9.6, GitLab)
- [CVE-2023-2513](https://cve.now/CVE-2023-2513.md): A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inode size for extended attri (CVSS 6.7, Linux kernel ext4 filesystem)
- [CVE-2023-2566](https://cve.now/CVE-2023-2566.md): Cross-site Scripting (XSS) - Stored in openemr/openemr (CVSS 7.5, openemr/openemr)
- [CVE-2023-2582](https://cve.now/CVE-2023-2582.md): A prototype pollution vulnerability exists in Strikingly CMS which can result in reflected cross-site scripting (XSS) in affected applicatio (CVSS 6.1, Strikingly)
- [CVE-2023-2583](https://cve.now/CVE-2023-2583.md): Code Injection in jsreport/jsreport (CVSS 10.0, jsreport/jsreport · jsreport)
- [CVE-2023-27928](https://cve.now/CVE-2023-27928.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 3.3, Apple macOS · Apple iOS and iPadOS +2)
- [CVE-2023-27929](https://cve.now/CVE-2023-27929.md): An out-of-bounds read was addressed with improved input validation. (CVSS 5.5, Apple macOS · Apple iOS and iPadOS +2)
- [CVE-2023-27931](https://cve.now/CVE-2023-27931.md): This issue was addressed by removing the vulnerable code. (CVSS 5.5, Apple macOS · Apple iOS and iPadOS +2)
- [CVE-2023-27932](https://cve.now/CVE-2023-27932.md): This issue was addressed with improved state management. (CVSS 5.5, Apple macOS · Apple Safari +3)
- [CVE-2023-27933](https://cve.now/CVE-2023-27933.md): The issue was addressed with improved memory handling. (CVSS 6.7, Apple macOS · Apple iOS and iPadOS +2)
- [CVE-2023-27934](https://cve.now/CVE-2023-27934.md): A memory initialization issue was addressed. (CVSS 8.8, Apple macOS)
- [CVE-2023-27935](https://cve.now/CVE-2023-27935.md): The issue was addressed with improved bounds checks. (CVSS 8.8, Apple macOS)
- [CVE-2023-27936](https://cve.now/CVE-2023-27936.md): An out-of-bounds write issue was addressed with improved input validation. (CVSS 7.8, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-27937](https://cve.now/CVE-2023-27937.md): An integer overflow was addressed with improved input validation. (CVSS 7.8, Apple macOS · Apple iOS and iPadOS +2)
- [CVE-2023-27938](https://cve.now/CVE-2023-27938.md): An out-of-bounds read issue was addressed with improved input validation. (CVSS 7.8, Apple macOS)
- [CVE-2023-27941](https://cve.now/CVE-2023-27941.md): A validation issue was addressed with improved input sanitization. (CVSS 5.5, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-27942](https://cve.now/CVE-2023-27942.md): The issue was addressed with improved checks. (CVSS 5.5, Apple macOS · Apple iOS and iPadOS +2)
- [CVE-2023-27943](https://cve.now/CVE-2023-27943.md): This issue was addressed with improved checks. (CVSS 5.5, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-27944](https://cve.now/CVE-2023-27944.md): This issue was addressed with a new entitlement. (CVSS 8.6, Apple macOS)
- [CVE-2023-27945](https://cve.now/CVE-2023-27945.md): This issue was addressed with improved entitlements. (CVSS 6.3, Apple macOS · Apple Xcode)
- [CVE-2023-27946](https://cve.now/CVE-2023-27946.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 7.8, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-27949](https://cve.now/CVE-2023-27949.md): An out-of-bounds read was addressed with improved input validation. (CVSS 7.8, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-27951](https://cve.now/CVE-2023-27951.md): The issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2023-27952](https://cve.now/CVE-2023-27952.md): A race condition was addressed with improved locking. (no CVSS, Apple macOS)
- [CVE-2023-27953](https://cve.now/CVE-2023-27953.md): The issue was addressed with improved memory handling. (CVSS 9.8, Apple macOS)
- [CVE-2023-27954](https://cve.now/CVE-2023-27954.md): The issue was addressed by removing origin information. (CVSS 6.5, Apple macOS · Apple Safari +3)
- [CVE-2023-27955](https://cve.now/CVE-2023-27955.md): The issue was addressed with improved checks. (CVSS 5.5, Apple macOS · Apple iOS and iPadOS +1)
- [CVE-2023-27956](https://cve.now/CVE-2023-27956.md): The issue was addressed with improved memory handling. (CVSS 5.5, Apple macOS · Apple iOS and iPadOS +2)
- [CVE-2023-27957](https://cve.now/CVE-2023-27957.md): A buffer overflow issue was addressed with improved memory handling. (CVSS 7.8, Apple macOS)
- [CVE-2023-27958](https://cve.now/CVE-2023-27958.md): The issue was addressed with improved memory handling. (CVSS 9.1, Apple macOS)
- [CVE-2023-27959](https://cve.now/CVE-2023-27959.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple iOS and iPadOS)
- [CVE-2023-27960](https://cve.now/CVE-2023-27960.md): This issue was addressed by removing the vulnerable code. (CVSS 7.8, Apple macOS)
- [CVE-2023-27961](https://cve.now/CVE-2023-27961.md): Multiple validation issues were addressed with improved input sanitization. (CVSS 5.5, Apple macOS · Apple iOS and iPadOS +1)
- [CVE-2023-27962](https://cve.now/CVE-2023-27962.md): A logic issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2023-27963](https://cve.now/CVE-2023-27963.md): The issue was addressed with additional permissions checks. (CVSS 7.5, Apple macOS · Apple iOS and iPadOS +2)
- [CVE-2023-27965](https://cve.now/CVE-2023-27965.md): A memory corruption issue was addressed with improved state management. (CVSS 7.8, Apple macOS · Apple Studio Display Firmware Update)
- [CVE-2023-27966](https://cve.now/CVE-2023-27966.md): The issue was addressed with improved checks. (CVSS 6.3, Apple macOS)
- [CVE-2023-27967](https://cve.now/CVE-2023-27967.md): The issue was addressed with improved memory handling. (CVSS 8.6, Apple Xcode)
- [CVE-2023-27968](https://cve.now/CVE-2023-27968.md): A buffer overflow issue was addressed with improved memory handling. (CVSS 7.1, Apple macOS)
- [CVE-2023-27969](https://cve.now/CVE-2023-27969.md): A use after free issue was addressed with improved memory management. (CVSS 7.8, Apple macOS · Apple iOS and iPadOS +2)
- [CVE-2023-27970](https://cve.now/CVE-2023-27970.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 7.8, Apple iOS and iPadOS)
- [CVE-2023-28178](https://cve.now/CVE-2023-28178.md): A logic issue was addressed with improved validation. (CVSS 5.5, Apple macOS · Apple iOS and iPadOS +2)
- [CVE-2023-28180](https://cve.now/CVE-2023-28180.md): A denial-of-service issue was addressed with improved memory handling. (CVSS 6.5, Apple macOS)
- [CVE-2023-28181](https://cve.now/CVE-2023-28181.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple macOS · Apple iOS and iPadOS +2)
- [CVE-2023-28182](https://cve.now/CVE-2023-28182.md): The issue was addressed with improved authentication. (CVSS 6.5, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-28189](https://cve.now/CVE-2023-28189.md): The issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2023-28190](https://cve.now/CVE-2023-28190.md): A privacy issue was addressed by moving sensitive data to a more secure location. (CVSS 5.5, Apple macOS)
- [CVE-2023-28192](https://cve.now/CVE-2023-28192.md): A permissions issue was addressed with improved validation. (CVSS 5.5, Apple macOS)
- [CVE-2023-28194](https://cve.now/CVE-2023-28194.md): The issue was addressed with improved checks. (CVSS 3.3, Apple iOS and iPadOS)
- [CVE-2023-28200](https://cve.now/CVE-2023-28200.md): A validation issue was addressed with improved input sanitization. (CVSS 5.5, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-28201](https://cve.now/CVE-2023-28201.md): This issue was addressed with improved state management. (CVSS 9.8, Apple macOS · Apple Safari +2)
- [CVE-2023-29693](https://cve.now/CVE-2023-29693.md): H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function set\_tftp\_upgrad. (CVSS 9.8)
- [CVE-2023-29696](https://cve.now/CVE-2023-29696.md): H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function version\_set. (CVSS 9.8)
- [CVE-2023-29944](https://cve.now/CVE-2023-29944.md): Metersphere v1.20.20-lts-79d354a6 is vulnerable to Remote Command Execution. (CVSS 9.8)
- [CVE-2023-30018](https://cve.now/CVE-2023-30018.md): Judging Management System v1.0 is vulnerable to SQL Injection. (CVSS 9.8)
- [CVE-2023-30019](https://cve.now/CVE-2023-30019.md): imgproxy \<=3.14.0 is vulnerable to Server-Side Request Forgery (SSRF) due to a lack of sanitization of the imageURL parameter. (CVSS 5.3, github.com/imgproxy/imgproxy/v3 · github.com/imgproxy/im… +1)
- [CVE-2023-30092](https://cve.now/CVE-2023-30092.md): SourceCodester Online Pizza Ordering System v1.0 is vulnerable to SQL Injection via the QTY parameter. (CVSS 9.8)
- [CVE-2023-30185](https://cve.now/CVE-2023-30185.md): CRMEB v4.4 to v4.6 was discovered to contain an arbitrary file upload vulnerability via the component \\attachment\\SystemAttachmentServices.p (CVSS 9.8)
- [CVE-2023-30257](https://cve.now/CVE-2023-30257.md): A buffer overflow in the component /proc/ftxxxx-debug of FiiO M6 Build Number v1.0.4 allows attackers to escalate privileges to root. (CVSS 7.8)
- [CVE-2023-30334](https://cve.now/CVE-2023-30334.md): AsmBB v2.9.1 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the MiniMag.asm and bbcode.asm libraries. (CVSS 6.1)
- [CVE-2023-30787](https://cve.now/CVE-2023-30787.md): MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the \`people:id/intro (CVSS 5.4, MonicaHQ)
- [CVE-2023-30788](https://cve.now/CVE-2023-30788.md): MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the \`people/add\` end (CVSS 5.4, MonicaHQ)
- [CVE-2023-30789](https://cve.now/CVE-2023-30789.md): MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the \`people:id/work\` (CVSS 5.4, MonicaHQ)
- [CVE-2023-30790](https://cve.now/CVE-2023-30790.md): MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the \`people:id/relat (CVSS 5.4, MonicaHQ)
- [CVE-2023-31178](https://cve.now/CVE-2023-31178.md): AgilePoint NX v8.0 SU2.2 & SU2.3 – Arbitrary File Delete (CVSS 8.1, AgilePoint NX)
- [CVE-2023-31179](https://cve.now/CVE-2023-31179.md): AgilePoint NX v8.0 SU2.2 & SU2.3 - Path traversal (CVSS 6.5, AgilePoint NX)
- [CVE-2023-31180](https://cve.now/CVE-2023-31180.md): WJJ Software - InnoKB Server, InnoKB/Console 2.2.1 - Reflected cross-site scripting (RXSS) (CVSS 6.1, WJJ Software InnoKB Server, InnoKB/Console)
- [CVE-2023-31181](https://cve.now/CVE-2023-31181.md): WJJ Software - InnoKB Server, InnoKB/Console 2.2.1 - CWE-22: Path Traversal (CVSS 7.5, WJJ Software InnoKB Server, InnoKB/Console)
- [CVE-2023-31182](https://cve.now/CVE-2023-31182.md): EasyTor Applications – Authorization Bypass (CVSS 8.1, EasyTor Applications)
- [CVE-2023-31183](https://cve.now/CVE-2023-31183.md): Cybonet PineApp Mail Secure RXSS vulnerability (CVSS 6.1, Cybonet PineApp)
- [CVE-2023-32233](https://cve.now/CVE-2023-32233.md): In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf\_tables when processing batch requests can be abused to perform arbitrary (CVSS 7.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-05-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.