# CVEs published 2023-05-09

252 CVEs were published on May 9, 2023: 15 critical, 90 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2022-36330](https://cve.now/CVE-2022-36330.md): Buffer Overflow Vulnerability in Western Digital My Cloud Home and ibi devices (CVSS 1.9, Western Digital My Cloud Home and My Cloud Home Duo · SanDi…)
- [CVE-2023-25831](https://cve.now/CVE-2023-25831.md): BUG-000154236 There is a reflected cross-site scripting (XSS) vulnerability in Portal for ArcGIS. (CVSS 6.1, Esri Portal for ArcGIS)
- [CVE-2021-46794](https://cve.now/CVE-2021-46794.md): Insufficient bounds checking in ASP (AMD Secure Processor) may allow for an out of bounds read in SMI (System Management Interface) mailbox (CVSS 7.5, AMD Ryzen™ 2000 series Desktop Processors “Raven Ridge”… +12)
- [CVE-2021-46792](https://cve.now/CVE-2021-46792.md): Time-of-check Time-of-use (TOCTOU) in the BIOS2PSP command may allow an attacker with a malicious BIOS to create a race condition causing th (CVSS 5.9, AMD Ryzen™ 2000 series Desktop Processors “Raven Ridge”… +6)
- [CVE-2021-46773](https://cve.now/CVE-2021-46773.md): Insufficient input validation in ABL may enable a privileged attacker to corrupt ASP memory, potentially resulting in a loss of integrity or (CVSS 8.8, AMD Ryzen™ 2000 series Desktop Processors “Raven Ridge”… +10)
- [CVE-2021-46765](https://cve.now/CVE-2021-46765.md): Insufficient input validation in ASP may allow an attacker with a compromised SMM to induce out-of-bounds memory reads within the ASP, poten (CVSS 7.5, AMD Ryzen™ 5000 Series Desktop processor with Radeon™ Gr… +3)
- [CVE-2021-46760](https://cve.now/CVE-2021-46760.md): A malicious or compromised UApp or ABL can send a malformed system call to the bootloader, which may result in an out-of-bounds memory acces (CVSS 9.8, 3rd Gen AMD Ryzen™ Threadripper™ Processors “Castle Peak” H…)
- [CVE-2021-46759](https://cve.now/CVE-2021-46759.md): Improper syscall input validation in AMD TEE (Trusted Execution Environment) may allow an attacker with physical access and control of a Uap (CVSS 6.1, AMD Ryzen™ 2000 series Desktop Processors “Raven Ridge”… +7)
- [CVE-2021-46756](https://cve.now/CVE-2021-46756.md): Insufficient validation of inputs in SVC\_MAP\_USER\_STACK in the ASP (AMD Secure Processor) bootloader may allow an attacker with a malicious (CVSS 9.1, AMD Ryzen™ 2000 series Desktop Processors “Raven Ridge”… +16)
- [CVE-2021-46755](https://cve.now/CVE-2021-46755.md): Failure to unmap certain SysHub mappings in error paths of the ASP (AMD Secure Processor) bootloader may allow an attacker with a malicious (CVSS 7.5, AMD Ryzen™ 3000 Series Desktop Processors “Matisse” AM4… +7)
- [CVE-2021-46754](https://cve.now/CVE-2021-46754.md): Insufficient input validation in the ASP (AMD Secure Processor) bootloader may allow an attacker with a compromised Uapp or ABL to coerce th (no CVSS, AMD Ryzen™ 2000 series Desktop Processors “Raven Ridge”… +10)
- [CVE-2021-46753](https://cve.now/CVE-2021-46753.md): Failure to validate the length fields of the ASP (AMD Secure Processor) sensor fusion hub headers may allow an attacker with a malicious Uap (CVSS 9.1, AMD Ryzen™ 2000 series Desktop Processors “Raven Ridge”… +8)
- [CVE-2021-46749](https://cve.now/CVE-2021-46749.md): Insufficient bounds checking in ASP (AMD Secure Processor) may allow for an out of bounds read in SMI (System Management Interface) mailbox (CVSS 7.5, AMD Ryzen™ 2000 Series Desktop Processors “Pinnacle Rid… +12)
- [CVE-2021-26406](https://cve.now/CVE-2021-26406.md): Insufficient validation in parsing Owner's Certificate Authority (OCA) certificates in SEV (AMD Secure Encrypted Virtualization) and SEV-ES (CVSS 7.5, AMD Ryzen™ 2000 series Desktop Processors “Raven Ridge”… +11)
- [CVE-2021-26371](https://cve.now/CVE-2021-26371.md): A compromised or malicious ABL or UApp could send a SHA256 system call to the bootloader, which may result in exposure of ASP memory to user (CVSS 5.5, AMD Ryzen™ 2000 series Desktop Processors “Raven Ridge”… +11)
- [CVE-2021-26365](https://cve.now/CVE-2021-26365.md): Certain size values in firmware binary headers could trigger out of bounds reads during signature validation, leading to denial of service o (CVSS 8.2, AMD Ryzen™ 2000 series Desktop Processors “Raven Ridge”… +8)
- [CVE-2021-26356](https://cve.now/CVE-2021-26356.md): A TOCTOU in ASP bootloader may allow an attacker to tamper with the SPI ROM following data read to memory potentially resulting in S3 data c (CVSS 7.4, AMD Ryzen™ 3000 Series Desktop Processors “Matisse” AM4… +6)
- [CVE-2021-26354](https://cve.now/CVE-2021-26354.md): Insufficient bounds checking in ASP may allow an attacker to issue a system call from a compromised ABL which may cause arbitrary memory val (CVSS 5.5, AMD Ryzen™ 2000 series Desktop Processors “Raven Ridge”… +16)
- [CVE-2023-20524](https://cve.now/CVE-2023-20524.md): An attacker with a compromised ASP could possibly send malformed commands to an ASP on another CPU, resulting in an out of bounds write, pot (CVSS 7.5, 2nd Gen AMD EPYC™ · 3rd Gen AMD EPYC™)
- [CVE-2023-20520](https://cve.now/CVE-2023-20520.md): Improper access control settings in ASP Bootloader may allow an attacker to corrupt the return address causing a stack-based buffer overrun (CVSS 9.8, 1st Gen AMD EPYC™ · 2nd Gen AMD EPYC™ +1)
- [CVE-2022-23818](https://cve.now/CVE-2022-23818.md): Insufficient input validation on the model specific register: VM\_HSAVE\_PA may potentially lead to loss of SEV-SNP guest memory integrity. (CVSS 7.5, 3rd Gen AMD EPYC™)
- [CVE-2021-46775](https://cve.now/CVE-2021-46775.md): Improper input validation in ABL may enable an attacker with physical access, to perform arbitrary memory overwrites, potentially leading to (CVSS 6.8, 2nd Gen AMD EPYC™ · 3rd Gen AMD EPYC™)
- [CVE-2021-46769](https://cve.now/CVE-2021-46769.md): Insufficient syscall input validation in the ASP Bootloader may allow a privileged attacker to execute arbitrary DMA copies, which can lead (CVSS 8.8, 2nd Gen AMD EPYC™ · 3rd Gen AMD EPYC™)
- [CVE-2021-46764](https://cve.now/CVE-2021-46764.md): Improper validation of DRAM addresses in SMU may allow an attacker to overwrite sensitive memory locations within the ASP potentially result (CVSS 7.5, 2nd Gen AMD EPYC™ · 3rd Gen AMD EPYC™)
- [CVE-2021-46763](https://cve.now/CVE-2021-46763.md): Insufficient input validation in the SMU may enable a privileged attacker to write beyond the intended bounds of a shared memory buffer pote (CVSS 7.5, 2nd Gen AMD EPYC™ · 3rd Gen AMD EPYC™)
- [CVE-2021-46762](https://cve.now/CVE-2021-46762.md): Insufficient input validation in the SMU may allow an attacker to corrupt SMU SRAM potentially leading to a loss of integrity or denial of s (CVSS 3.9, 2nd Gen AMD EPYC™ · 3rd Gen AMD EPYC™ +1)
- [CVE-2021-26397](https://cve.now/CVE-2021-26397.md): Insufficient address validation, may allow an attacker with a compromised ABL and UApp to corrupt sensitive memory locations potentially res (CVSS 7.1, 3rd Gen AMD EPYC™)
- [CVE-2021-26379](https://cve.now/CVE-2021-26379.md): Insufficient input validation of mailbox data in the SMU may allow an attacker to coerce the SMU to corrupt SMRAM, potentially leading to a (CVSS 9.8, 2nd Gen AMD EPYC™ · 3rd Gen AMD EPYC™)
- [CVE-2023-29333](https://cve.now/CVE-2023-29333.md): Microsoft Access Denial of Service Vulnerability (CVSS 3.3, Microsoft Office · Microsoft 365 Apps for Enterprise)
- [CVE-2023-29325](https://cve.now/CVE-2023-29325.md): Windows OLE Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2023-24904](https://cve.now/CVE-2023-24904.md): Windows Installer Elevation of Privilege Vulnerability (CVSS 7.1, Microsoft Windows Server 2008 Service Pack · Microsoft W… +1)
- [CVE-2023-28290](https://cve.now/CVE-2023-28290.md): Microsoft Remote Desktop app for Windows Information Disclosure Vulnerability (CVSS 5.3, Microsoft Remote Desktop)
- [CVE-2023-28251](https://cve.now/CVE-2023-28251.md): Windows Driver Revocation List Security Feature Bypass Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2023-24932](https://cve.now/CVE-2023-24932.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 6.7, Microsoft Windows Server · Microsoft Windows)
- [CVE-2023-29343](https://cve.now/CVE-2023-29343.md): SysInternals Sysmon for Windows Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Sysmon)
- [CVE-2023-29341](https://cve.now/CVE-2023-29341.md): AV1 Video Extension Remote Code Execution Vulnerability (CVSS 7.8, Microsoft AV1 Video Extension)
- [CVE-2023-29340](https://cve.now/CVE-2023-29340.md): AV1 Video Extension Remote Code Execution Vulnerability (CVSS 7.8, Microsoft AV1 Video Extension)
- [CVE-2023-29338](https://cve.now/CVE-2023-29338.md): Visual Studio Code Spoofing Vulnerability (CVSS 6.6, Microsoft Visual Studio Code)
- [CVE-2023-29336](https://cve.now/CVE-2023-29336.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2023-29335](https://cve.now/CVE-2023-29335.md): Microsoft Word Security Feature Bypass Vulnerability (CVSS 7.5, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2023-29324](https://cve.now/CVE-2023-29324.md): Windows MSHTML Platform Security Feature Bypass Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2023-24955](https://cve.now/CVE-2023-24955.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 7.2, KEV, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2023-24954](https://cve.now/CVE-2023-24954.md): Microsoft SharePoint Server Information Disclosure Vulnerability (CVSS 6.5, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2023-24953](https://cve.now/CVE-2023-24953.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2023-24950](https://cve.now/CVE-2023-24950.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 6.5, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2023-24949](https://cve.now/CVE-2023-24949.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-24948](https://cve.now/CVE-2023-24948.md): Windows Bluetooth Driver Elevation of Privilege Vulnerability (CVSS 7.4, Microsoft Windows)
- [CVE-2023-24947](https://cve.now/CVE-2023-24947.md): Windows Bluetooth Driver Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2023-24946](https://cve.now/CVE-2023-24946.md): Windows Backup Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-24945](https://cve.now/CVE-2023-24945.md): Windows iSCSI Target Service Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2023-24944](https://cve.now/CVE-2023-24944.md): Windows Bluetooth Driver Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2023-24905](https://cve.now/CVE-2023-24905.md): Remote Desktop Client Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-24943](https://cve.now/CVE-2023-24943.md): Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows)
- [CVE-2023-24903](https://cve.now/CVE-2023-24903.md): Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2023-24942](https://cve.now/CVE-2023-24942.md): Remote Procedure Call Runtime Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2023-24902](https://cve.now/CVE-2023-24902.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-24941](https://cve.now/CVE-2023-24941.md): Windows Network File System Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows Server)
- [CVE-2023-24901](https://cve.now/CVE-2023-24901.md): Windows NFS Portmapper Information Disclosure Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2023-24940](https://cve.now/CVE-2023-24940.md): Windows Pragmatic General Multicast (PGM) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2023-24900](https://cve.now/CVE-2023-24900.md): Windows NTLM Security Support Provider Information Disclosure Vulnerability (CVSS 5.9, Microsoft Windows)
- [CVE-2023-24939](https://cve.now/CVE-2023-24939.md): Server for NFS Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2023-24899](https://cve.now/CVE-2023-24899.md): Windows Graphics Component Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows Server · Microsoft Windows)
- [CVE-2023-24898](https://cve.now/CVE-2023-24898.md): Windows SMB Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows Server)
- [CVE-2023-28283](https://cve.now/CVE-2023-28283.md): Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2023-25830](https://cve.now/CVE-2023-25830.md): BUG-000154662 Reflected XSS vulnerability in Portal for ArcGIS (CVSS 6.1, Esri Portal for ArcGIS)
- [CVE-2023-25829](https://cve.now/CVE-2023-25829.md): BUG-000155001 - Unvalidated redirect in Portal for ArcGIS. (CVSS 6.1, Esri Portal for ArcGIS)
- [CVE-2023-32071](https://cve.now/CVE-2023-32071.md): XWiki Platform vulnerable to RXSS via editor parameter - importinline template (CVSS 9.1, xwiki-platform · org.xwiki.platform:xwiki-platform-distribu…)
- [CVE-2023-32069](https://cve.now/CVE-2023-32069.md): XWiki Platform privilege escalation (PR)/RCE from account through class sheet (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-test-ui)
- [CVE-2023-32066](https://cve.now/CVE-2023-32066.md): Time Tracker has Stored XSS vulnerability in Week View plugin (CVSS 5.4, anuko timetracker)
- [CVE-2023-31144](https://cve.now/CVE-2023-31144.md): Craft CMS vulnerable to cross site scripting in RSS feed widget (CVSS 6.1, craftcms cms · craftcms/cms)
- [CVE-2023-31143](https://cve.now/CVE-2023-31143.md): Mage terminal user authentication not working properly (CVSS 5.9, mage-ai)
- [CVE-2023-32060](https://cve.now/CVE-2023-32060.md): DHIS2 Core Improper Access Control with Category Option Combination sharing in /api/trackedEntityInstance and /api/events (CVSS 6.5, dhis2-core)
- [CVE-2023-31139](https://cve.now/CVE-2023-31139.md): DHIS2 Core unrestricted session cookies with Personal Access Tokens (CVSS 4.3, dhis2-core)
- [CVE-2023-31138](https://cve.now/CVE-2023-31138.md): DHIS2 Core vulnerable to Improper Access Control with PATCH requests (CVSS 7.1, dhis2-core)
- [CVE-2023-31137](https://cve.now/CVE-2023-31137.md): MaraDNS Integer Underflow Vulnerability in DNS Packet Decompression (CVSS 7.5, samboy MaraDNS)
- [CVE-2023-31136](https://cve.now/CVE-2023-31136.md): PostgresNIO processes unencrypted bytes from man-in-the-middle (CVSS 3.7, vapor postgres-nio)
- [CVE-2023-29462](https://cve.now/CVE-2023-29462.md): Rockwell Automation Arena Simulation Software Remote Code Execution Vulnerability (CVSS 7.8, Rockwell Automation Arena Simulation)
- [CVE-2023-29461](https://cve.now/CVE-2023-29461.md): Rockwell Automation Arena Simulation Software Remote Code Execution Vulnerability (CVSS 7.8, Rockwell Automation Arena Simulation)
- [CVE-2023-29460](https://cve.now/CVE-2023-29460.md): Rockwell Automation Arena Simulation Software Remote Code Execution Vulnerability (CVSS 7.8, Rockwell Automation Arena Simulation)
- [CVE-2023-20098](https://cve.now/CVE-2023-20098.md): A vulnerability in the CLI of Cisco SDWAN vManage Software could allow an authenticated, local attacker to delete arbitrary files. (CVSS 4.4, Cisco SD-WAN vManage)
- [CVE-2023-31134](https://cve.now/CVE-2023-31134.md): Tauri Open Redirect Vulnerability Possibly Exposes IPC to External Sites (CVSS 4.8, tauri-apps tauri · tauri)
- [CVE-2023-20046](https://cve.now/CVE-2023-20046.md): A vulnerability in the key-based SSH authentication feature of Cisco StarOS Software could allow an authenticated, remote attacker to elevat (CVSS 8.8, Cisco ASR 5000 Series Software · Cisco Ultra Cloud Core - U…)
- [CVE-2023-2596](https://cve.now/CVE-2023-2596.md): SourceCodester Online Reviewer System GET Parameter user-update.php sql injection (CVSS 6.3, SourceCodester Online Reviewer System)
- [CVE-2023-31126](https://cve.now/CVE-2023-31126.md): Improper Neutralization of Invalid Characters in Data Attribute Names in org.xwiki.commons:xwiki-commons-xml (CVSS 9.1, xwiki-commons · org.xwiki.commons:xwiki-commons-xml)
- [CVE-2023-2595](https://cve.now/CVE-2023-2595.md): SourceCodester Billing Management System POST Parameter ajax\_service.php sql injection (CVSS 6.3, SourceCodester Billing Management System)
- [CVE-2023-2594](https://cve.now/CVE-2023-2594.md): SourceCodester Food Ordering Management System Registration sql injection (CVSS 7.3, SourceCodester Food Ordering Management System)
- [CVE-2023-30986](https://cve.now/CVE-2023-30986.md): A vulnerability has been identified in Solid Edge SE2023 (All versions \< V223.0 Update 3), Solid Edge SE2023 (All versions \< V223.0 Update 2 (CVSS 7.8, Siemens Solid Edge SE2023)
- [CVE-2023-30985](https://cve.now/CVE-2023-30985.md): A vulnerability has been identified in Solid Edge SE2023 (All versions \< V223.0 Update 3), Solid Edge SE2023 (All versions \< V223.0 Update 2 (CVSS 3.3, Siemens Solid Edge SE2023)
- [CVE-2023-30899](https://cve.now/CVE-2023-30899.md): A vulnerability has been identified in Siveillance Video 2020 R2 (All versions \< V20.2 HotfixRev14), Siveillance Video 2020 R3 (All versions (CVSS 9.9, Siemens Siveillance Video 2020 R2 · Siemens Siveillance… +6)
- [CVE-2023-30898](https://cve.now/CVE-2023-30898.md): A vulnerability has been identified in Siveillance Video 2020 R2 (All versions \< V20.2 HotfixRev14), Siveillance Video 2020 R3 (All versions (CVSS 9.9, Siemens Siveillance Video 2020 R2 · Siemens Siveillance… +6)
- [CVE-2023-29128](https://cve.now/CVE-2023-29128.md): A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions \>= V2.0 \< V2.1), SIMATIC Cloud Connect 7 CC716 (All versi (CVSS 3.8, Siemens SIMATIC Cloud Connect 7 CC712 · Siemens SIMATIC Clo…)
- [CVE-2023-29107](https://cve.now/CVE-2023-29107.md): A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions \>= V2.0 \< V2.1), SIMATIC Cloud Connect 7 CC716 (All versi (CVSS 5.3, Siemens SIMATIC Cloud Connect 7 CC712 · Siemens SIMATIC Clo…)
- [CVE-2023-29106](https://cve.now/CVE-2023-29106.md): A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions \>= V2.0 \< V2.1), SIMATIC Cloud Connect 7 CC716 (All versi (CVSS 5.3, Siemens SIMATIC Cloud Connect 7 CC712 · Siemens SIMATIC Clo…)
- [CVE-2023-29105](https://cve.now/CVE-2023-29105.md): A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions \>= V2.0 \< V2.1), SIMATIC Cloud Connect 7 CC712 (All versi (CVSS 5.9, Siemens SIMATIC Cloud Connect 7 CC712 · Siemens SIMATIC Clo…)
- [CVE-2023-29104](https://cve.now/CVE-2023-29104.md): A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions \>= V2.0 \< V2.1), SIMATIC Cloud Connect 7 CC716 (All versi (CVSS 6.0, Siemens SIMATIC Cloud Connect 7 CC712 · Siemens SIMATIC Clo…)
- [CVE-2023-29103](https://cve.now/CVE-2023-29103.md): A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions \>= V2.0 \< V2.1), SIMATIC Cloud Connect 7 CC712 (All versi (CVSS 4.3, Siemens SIMATIC Cloud Connect 7 CC712 · Siemens SIMATIC Clo…)
- [CVE-2023-28832](https://cve.now/CVE-2023-28832.md): A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions \>= V2.0 \< V2.1), SIMATIC Cloud Connect 7 CC716 (All versi (CVSS 7.2, Siemens SIMATIC Cloud Connect 7 CC712 · Siemens SIMATIC Clo…)
- [CVE-2023-27410](https://cve.now/CVE-2023-27410.md): A vulnerability has been identified in SCALANCE LPE9403 (All versions \< V2.1). (CVSS 2.7, Siemens SCALANCE LPE9403)
- [CVE-2023-27409](https://cve.now/CVE-2023-27409.md): A vulnerability has been identified in SCALANCE LPE9403 (All versions \< V2.1). (CVSS 2.5, Siemens SCALANCE LPE9403)
- [CVE-2023-27408](https://cve.now/CVE-2023-27408.md): A vulnerability has been identified in SCALANCE LPE9403 (All versions \< V2.1). (CVSS 3.3, Siemens SCALANCE LPE9403)
- [CVE-2023-27407](https://cve.now/CVE-2023-27407.md): A vulnerability has been identified in SCALANCE LPE9403 (All versions \< V2.1). (CVSS 9.9, Siemens SCALANCE LPE9403)
- [CVE-2022-46844](https://cve.now/CVE-2022-46844.md): WordPress PixFields Plugin \<= 0.7.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, PixelGrade PixFields)
- [CVE-2022-46858](https://cve.now/CVE-2022-46858.md): WordPress Product Specifications for Woocommerce Plugin \<= 0.6.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Amin A.Rezapour Product Specifications for Woocommerce)
- [CVE-2022-46864](https://cve.now/CVE-2022-46864.md): WordPress Woocommerce Custom Checkout Fields Editor With Drag & Drop Plugin \<= 0.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Umair Saleem Woocommerce Custom Checkout Fields Editor With…)
- [CVE-2022-46822](https://cve.now/CVE-2022-46822.md): WordPress WooCommerce JazzCash Gateway Plugin Plugin \<= 2.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, JC Development Team WooCommerce JazzCash Gateway Plugin)
- [CVE-2023-23647](https://cve.now/CVE-2023-23647.md): WordPress Team Member Plugin \<= 4.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Sk. Abul Hasan Team Member – Team with Slider)
- [CVE-2023-24372](https://cve.now/CVE-2023-24372.md): WordPress Simple Custom Author Profiles Plugin \<= 1.0.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, USB Memory Direct Simple Custom Author Profiles)
- [CVE-2023-23734](https://cve.now/CVE-2023-23734.md): WordPress Userlike – WordPress Live Chat plugin Plugin \<= 2.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, David Voswinkel Userlike – WordPress Live Chat plugin)
- [CVE-2023-23733](https://cve.now/CVE-2023-23733.md): WordPress Lazy Social Comments Plugin \<= 2.0.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Joel James Lazy Social Comments)
- [CVE-2023-23732](https://cve.now/CVE-2023-23732.md): WordPress Disqus Conditional Load Plugin \<= 11.0.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Joel James Disqus Conditional Load)
- [CVE-2023-23862](https://cve.now/CVE-2023-23862.md): WordPress Vertical scroll recent post Plugin \<= 14.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Gopi Ramasamy Vertical scroll recent post)
- [CVE-2023-23884](https://cve.now/CVE-2023-23884.md): WordPress Kanban Boards for WordPress Plugin \<= 2.5.20 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Kanban for WordPress Kanban Boards for WordPress)
- [CVE-2023-23883](https://cve.now/CVE-2023-23883.md): WordPress WP Content Filter – Censor All Offensive Content From Your Site Plugin \<= 3.0.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, David Gwyer WP Content Filter)
- [CVE-2023-23664](https://cve.now/CVE-2023-23664.md): WordPress ConvertBox Auto Embed WordPress plugin Plugin \<= 1.0.19 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, ConvertBox Auto Embed WordPress plugin)
- [CVE-2023-23793](https://cve.now/CVE-2023-23793.md): WordPress Read More Without Refresh Plugin \<= 3.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Eightweb Interactive Read More Without Refresh)
- [CVE-2022-41640](https://cve.now/CVE-2022-41640.md): WordPress Wholesale Suite Plugin \<= 2.1.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Rymera Web Wholesale Suite)
- [CVE-2023-23863](https://cve.now/CVE-2023-23863.md): WordPress TreePress – Easy Family Trees & Ancestor Profiles Plugin \<= 2.0.22 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Black and White Digital TreePress – Easy Family Trees & Anc…)
- [CVE-2022-4537](https://cve.now/CVE-2022-4537.md): Hide My WP Ghost – Security Plugin \<= 5.0.18 - IP Address Spoofing to Protection Mechanism Bypass (CVSS 6.5, johndarrel WP Ghost (Hide My WP Ghost) – Security & Firewall)
- [CVE-2023-32112](https://cve.now/CVE-2023-32112.md): Missing Authorization Check in Vendor Master Hierarchy (CVSS 2.8, SAP\_SE Vendor Master Hierarchy)
- [CVE-2023-32113](https://cve.now/CVE-2023-32113.md): Information Disclosure vulnerability in SAP GUI for Windows (CVSS 7.5, SAP\_SE SAP GUI for Windows)
- [CVE-2023-32111](https://cve.now/CVE-2023-32111.md): Memory Corruption vulnerability in SAP PowerDesigner (Proxy) (CVSS 7.5, SAP\_SE SAP PowerDesigner)
- [CVE-2023-31407](https://cve.now/CVE-2023-31407.md): Cross-Site Scripting (XSS) vulnerability in SAP Business Planning and Consolidation (CVSS 5.4, SAP\_SE SAP Business Planning and Consolidation)
- [CVE-2023-31406](https://cve.now/CVE-2023-31406.md): Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (CVSS 6.1, SAP\_SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2023-31404](https://cve.now/CVE-2023-31404.md): Information Disclosure in SAP BusinessObjects Business Intelligence Platform (Central Management Service) (CVSS 5.0, SAP\_SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2023-30744](https://cve.now/CVE-2023-30744.md): Improper access control during application start-up in SAP AS NetWeaver JAVA. (CVSS 8.2, SAP\_SE SAP AS NetWeaver JAVA)
- [CVE-2023-30743](https://cve.now/CVE-2023-30743.md): Improper Neutralization of Input in SAPUI5 (CVSS 7.1, SAP\_SE SAPUI5)
- [CVE-2023-30742](https://cve.now/CVE-2023-30742.md): Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI) (CVSS 6.1, SAP\_SE SAP CRM)
- [CVE-2023-30741](https://cve.now/CVE-2023-30741.md): Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (CVSS 6.1, SAP\_SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2023-30740](https://cve.now/CVE-2023-30740.md): Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (CVSS 6.3, SAP\_SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2022-44419](https://cve.now/CVE-2022-44419.md): In modem, there is a possible missing verification of NAS Security Mode Command Replay Attacks in LTE. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-44420](https://cve.now/CVE-2022-44420.md): In modem, there is a possible missing verification of HashMME value in Security Mode Command. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47485](https://cve.now/CVE-2022-47485.md): In modem control device, there is a possible out of bounds write due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47334](https://cve.now/CVE-2022-47334.md): In phasecheck server, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48389](https://cve.now/CVE-2022-48389.md): In modem control device, there is a possible out of bounds write due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-44433](https://cve.now/CVE-2022-44433.md): In phoneEx service, there is a possible missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48388](https://cve.now/CVE-2022-48388.md): In powerEx service, there is a possible missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39089](https://cve.now/CVE-2022-39089.md): In mlog service, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-38685](https://cve.now/CVE-2022-38685.md): In bluetooth service, there is a possible missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48387](https://cve.now/CVE-2022-48387.md): the apipe driver, there is a possible out of bounds write due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48386](https://cve.now/CVE-2022-48386.md): the apipe driver, there is a possible use after free due to a logic error. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48385](https://cve.now/CVE-2022-48385.md): In cp\_dump driver, there is a possible out of bounds write due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48384](https://cve.now/CVE-2022-48384.md): In srtd service, there is a possible missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48383](https://cve.now/CVE-2022-48383.md): .In srtd service, there is a possible missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48382](https://cve.now/CVE-2022-48382.md): In log service, there is a possible out of bounds write due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48381](https://cve.now/CVE-2022-48381.md): In modem control device, there is a possible out of bounds write due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48380](https://cve.now/CVE-2022-48380.md): In modem control device, there is a possible out of bounds write due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47340](https://cve.now/CVE-2022-47340.md): In h265 codec firmware, there is a possible out of bounds write due to a missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48379](https://cve.now/CVE-2022-48379.md): In dialer service, there is a possible missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48378](https://cve.now/CVE-2022-48378.md): In engineermode service, there is a possible missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48377](https://cve.now/CVE-2022-48377.md): In dialer service, there is a possible missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48376](https://cve.now/CVE-2022-48376.md): In dialer service, there is a possible missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48375](https://cve.now/CVE-2022-48375.md): In contacts service, there is a possible missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48374](https://cve.now/CVE-2022-48374.md): In tee service, there is a possible out of bounds write due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48373](https://cve.now/CVE-2022-48373.md): In tee service, there is a possible out of bounds write due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48372](https://cve.now/CVE-2022-48372.md): In bootcp service, there is a possible out of bounds write due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48371](https://cve.now/CVE-2022-48371.md): In dialer service, there is a possible missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48370](https://cve.now/CVE-2022-48370.md): In dialer service, there is a possible missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48369](https://cve.now/CVE-2022-48369.md): In audio service, there is a possible missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48368](https://cve.now/CVE-2022-48368.md): In audio service, there is a possible missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48250](https://cve.now/CVE-2022-48250.md): In audio service, there is a possible missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48249](https://cve.now/CVE-2022-48249.md): In audio service, there is a possible missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48248](https://cve.now/CVE-2022-48248.md): In audio service, there is a possible missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48247](https://cve.now/CVE-2022-48247.md): In audio service, there is a possible missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48246](https://cve.now/CVE-2022-48246.md): In audio service, there is a possible missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48245](https://cve.now/CVE-2022-48245.md): In audio service, there is a possible missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48244](https://cve.now/CVE-2022-48244.md): In audio service, there is a possible missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48243](https://cve.now/CVE-2022-48243.md): In audio service, there is a possible missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48242](https://cve.now/CVE-2022-48242.md): In telephony service, there is a possible missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48241](https://cve.now/CVE-2022-48241.md): In telephony service, there is a possible missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48240](https://cve.now/CVE-2022-48240.md): In camera driver, there is a possible out of bounds write due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48239](https://cve.now/CVE-2022-48239.md): In camera driver, there is a possible out of bounds write due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48238](https://cve.now/CVE-2022-48238.md): In Image filter, there is a possible out of bounds write due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48237](https://cve.now/CVE-2022-48237.md): In Image filter, there is a possible out of bounds write due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48236](https://cve.now/CVE-2022-48236.md): In MP3 encoder, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48235](https://cve.now/CVE-2022-48235.md): In MP3 encoder, there is a possible out of bounds write due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47499](https://cve.now/CVE-2022-47499.md): In soter service, there is a possible out of bounds write due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47498](https://cve.now/CVE-2022-47498.md): In soter service, there is a possible out of bounds write due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47497](https://cve.now/CVE-2022-47497.md): In soter service, there is a possible out of bounds write due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47496](https://cve.now/CVE-2022-47496.md): In soter service, there is a possible out of bounds write due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47495](https://cve.now/CVE-2022-47495.md): In soter service, there is a possible out of bounds write due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47494](https://cve.now/CVE-2022-47494.md): In soter service, there is a possible out of bounds write due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47491](https://cve.now/CVE-2022-47491.md): In soter service, there is a possible out of bounds write due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47489](https://cve.now/CVE-2022-47489.md): In soter service, there is a possible out of bounds write due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48231](https://cve.now/CVE-2022-48231.md): In soter service, there is a possible missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47493](https://cve.now/CVE-2022-47493.md): In soter service, there is a possible missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47492](https://cve.now/CVE-2022-47492.md): In soter service, there is a possible missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47490](https://cve.now/CVE-2022-47490.md): In soter service, there is a possible missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47488](https://cve.now/CVE-2022-47488.md): In spipe drive, there is a possible out of bounds write due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47487](https://cve.now/CVE-2022-47487.md): In thermal service, there is a possible out of bounds write due to a missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47486](https://cve.now/CVE-2022-47486.md): In ext4fsfilter driver, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47470](https://cve.now/CVE-2022-47470.md): In ext4fsfilter driver, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47469](https://cve.now/CVE-2022-47469.md): In ext4fsfilter driver, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48234](https://cve.now/CVE-2022-48234.md): In FM service , there is a possible missing params check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48233](https://cve.now/CVE-2022-48233.md): In FM service , there is a possible missing params check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48232](https://cve.now/CVE-2022-48232.md): In FM service , there is a possible missing params check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-29188](https://cve.now/CVE-2023-29188.md): Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI (CVSS 5.4, SAP\_SE SAP CRM WebClient UI)
- [CVE-2023-28764](https://cve.now/CVE-2023-28764.md): Information Disclosure vulnerability in SAP BusinessObjects Platform (CVSS 3.7, SAP\_SE SAP BusinessObjects Platform)
- [CVE-2023-28762](https://cve.now/CVE-2023-28762.md): Information Disclosure in SAP BusinessObjects Intelligence Platform (CVSS 9.1, SAP\_SE SAP BusinessObjects Intelligence Platform)
- [CVE-2020-18280](https://cve.now/CVE-2020-18280.md): Cross Site Scripting vulnerability found in Phodal CMD v.1.0 allows a local attacker to execute arbitrary code via the EMBED SRC function. (CVSS 6.1)
- [CVE-2020-23362](https://cve.now/CVE-2020-23362.md): Insecure Permissons vulnerability found in Shop\_CMS YerShop all versions allows a remote attacker to escalate privileges via the cover\_id pa (CVSS 7.1)
- [CVE-2020-23363](https://cve.now/CVE-2020-23363.md): Cross Site Request Forgery (CSRF) vulnerability found in Verytops Verydows all versions that allows an attacker to execute arbitrary code vi (CVSS 8.8)
- [CVE-2021-31239](https://cve.now/CVE-2021-31239.md): An issue found in SQLite SQLite3 v.3.35.4 that allows a remote attacker to cause a denial of service via the appendvfs.c function. (CVSS 7.5, sqlite)
- [CVE-2021-31240](https://cve.now/CVE-2021-31240.md): An issue found in libming v.0.4.8 allows a local attacker to execute arbitrary code via the parseSWF\_IMPORTASSETS function in the parser.c f (CVSS 7.8)
- [CVE-2021-31711](https://cve.now/CVE-2021-31711.md): Cross Site Scripting vulnerability found in Trippo ResponsiveFilemanager v.9.14.0 and before allows a remote attacker to execute arbitrary c (CVSS 5.4)
- [CVE-2021-44283](https://cve.now/CVE-2021-44283.md): A buffer overflow in the component /Enclave.cpp of Electronics and Telecommunications Research Institute ShieldStore commit 58d455617f99705f (CVSS 7.5)
- [CVE-2023-2156](https://cve.now/CVE-2023-2156.md): A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol. (no CVSS, Linux kernel)
- [CVE-2023-25832](https://cve.now/CVE-2023-25832.md): BUG-000148346 There is a Cross-Site Request Forgery (CSRF) vulnerability in Portal for ArcGIS. (CVSS 8.8, Esri Portal for ArcGIS)
- [CVE-2023-25834](https://cve.now/CVE-2023-25834.md): BUG-000142922 Incomplete permission changes in specific cases. (CVSS 5.4, Esri Portal for ArcGIS)
- [CVE-2023-2590](https://cve.now/CVE-2023-2590.md): Missing Authorization in answerdev/answer (CVSS 7.7, answerdev/answer · github.com/answerdev/answer)
- [CVE-2023-2591](https://cve.now/CVE-2023-2591.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in nilsteampassnet/teampass (CVSS 7.1, nilsteampassnet/teampass)
- [CVE-2023-2609](https://cve.now/CVE-2023-2609.md): NULL Pointer Dereference in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2023-2610](https://cve.now/CVE-2023-2610.md): Integer Overflow or Wraparound in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2023-28125](https://cve.now/CVE-2023-28125.md): An improper authentication vulnerability exists in Avalanche Premise versions 6.3.x and below that could allow an attacker to gain access to (CVSS 5.9, Avalanche)
- [CVE-2023-28126](https://cve.now/CVE-2023-28126.md): An authentication bypass vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to gain access by exploitin (CVSS 5.9, Avalanche)
- [CVE-2023-28127](https://cve.now/CVE-2023-28127.md): A path traversal vulnerability exists in Avalanche version 6.3.x and below that when exploited could result in possible information disclosu (CVSS 7.5, Avalanche)
- [CVE-2023-28128](https://cve.now/CVE-2023-28128.md): An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker t (CVSS 7.2, Avalanche)
- [CVE-2023-28316](https://cve.now/CVE-2023-28316.md): A security vulnerability has been discovered in the implementation of 2FA on the rocket.chat platform, where other active sessions are not i (CVSS 9.8, Rocket.Chat)
- [CVE-2023-28317](https://cve.now/CVE-2023-28317.md): A vulnerability has been discovered in Rocket.Chat, where editing messages can change the original timestamp, causing the UI to display mess (CVSS 5.3, Rocket.Chat)
- [CVE-2023-28318](https://cve.now/CVE-2023-28318.md): A vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of the Message\_KeepHistory or Message\_ShowDelete (CVSS 5.3, Rocket.Chat)
- [CVE-2023-29092](https://cve.now/CVE-2023-29092.md): An issue was discovered in Exynos Mobile Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, and Exynos 1080. (CVSS 3.1)
- [CVE-2023-30056](https://cve.now/CVE-2023-30056.md): A session takeover vulnerability exists in FICO Origination Manager Decision Module 4.8.1 due to insufficient protection of the JSESSIONID c (CVSS 7.5)
- [CVE-2023-30057](https://cve.now/CVE-2023-30057.md): Multiple stored cross-site scripting (XSS) vulnerabilities in FICO Origination Manager Decision Module 4.8.1 allow attackers to execute arbi (CVSS 5.4)
- [CVE-2023-30083](https://cve.now/CVE-2023-30083.md): Buffer Overflow vulnerability found in Libming swftophp v.0.4.8 allows a local attacker to cause a denial of service via the newVar\_N in uti (CVSS 5.5)
- [CVE-2023-30084](https://cve.now/CVE-2023-30084.md): An issue found in libming swftophp v.0.4.8 allows a local attacker to cause a denial of service via the stackVal function in util/decompile. (CVSS 5.5)
- [CVE-2023-30085](https://cve.now/CVE-2023-30085.md): Buffer Overflow vulnerability found in Libming swftophp v.0.4.8 allows a local attacker to cause a denial of service via the cws2fws functio (CVSS 5.5)
- [CVE-2023-30086](https://cve.now/CVE-2023-30086.md): Buffer Overflow vulnerability found in Libtiff V.4.0.7 allows a local attacker to cause a denial of service via the tiffcp function in tiffc (CVSS 5.5)
- [CVE-2023-30087](https://cve.now/CVE-2023-30087.md): Buffer Overflow vulnerability found in Cesanta MJS v.1.26 allows a local attacker to cause a denial of service via the mjs\_mk\_string functio (CVSS 5.5)
- [CVE-2023-30088](https://cve.now/CVE-2023-30088.md): An issue found in Cesanta MJS v.1.26 allows a local attacker to cause a denial of service via the mjs\_execute function in mjs.c. (CVSS 5.5)
- [CVE-2023-30237](https://cve.now/CVE-2023-30237.md): CyberGhostVPN Windows Client before v8.3.10.10015 was discovered to contain a DLL injection vulnerability via the component Dashboard.exe. (CVSS 7.8)
- [CVE-2023-31472](https://cve.now/CVE-2023-31472.md): An issue was discovered on GL.iNet devices before 3.216. (CVSS 7.5)
- [CVE-2023-31474](https://cve.now/CVE-2023-31474.md): An issue was discovered on GL.iNet devices before 3.216. (CVSS 7.5)
- [CVE-2023-31476](https://cve.now/CVE-2023-31476.md): An issue was discovered on GL.iNet devices running firmware before 3.216. (CVSS 7.5)
- [CVE-2023-31478](https://cve.now/CVE-2023-31478.md): An issue was discovered on GL.iNet devices before 3.216. (CVSS 7.5)
- [CVE-2023-31489](https://cve.now/CVE-2023-31489.md): An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp\_capability\_llgr() function. (no CVSS)
- [CVE-2023-31490](https://cve.now/CVE-2023-31490.md): An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp\_attr\_psid\_sub() function. (no CVSS)
- [CVE-2023-31799](https://cve.now/CVE-2023-31799.md): Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the system annnounce (CVSS 4.8)
- [CVE-2023-31800](https://cve.now/CVE-2023-31800.md): Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the forum title para (CVSS 5.4)
- [CVE-2023-31801](https://cve.now/CVE-2023-31801.md): Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skills wheel par (CVSS 6.1)
- [CVE-2023-31802](https://cve.now/CVE-2023-31802.md): Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skype and linedi (CVSS 5.4)
- [CVE-2023-31803](https://cve.now/CVE-2023-31803.md): Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the resource sequenc (CVSS 4.8)
- [CVE-2023-31804](https://cve.now/CVE-2023-31804.md): Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the course category (CVSS 5.4)
- [CVE-2023-31805](https://cve.now/CVE-2023-31805.md): Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local authenticated attacker to execute arbitrary code via the ho (CVSS 4.8)
- [CVE-2023-31806](https://cve.now/CVE-2023-31806.md): Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to (CVSS 5.4)
- [CVE-2023-31807](https://cve.now/CVE-2023-31807.md): Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to (CVSS 5.4)
- [CVE-2023-31972](https://cve.now/CVE-2023-31972.md): yasm v1.3.0 was discovered to contain a use after free via the function pp\_getline at /nasm/nasm-pp.c. (CVSS 5.5)
- [CVE-2023-31973](https://cve.now/CVE-2023-31973.md): yasm v1.3.0 was discovered to contain a use after free via the function expand\_mmac\_params at /nasm/nasm-pp.c. (CVSS 7.8)
- [CVE-2023-31974](https://cve.now/CVE-2023-31974.md): yasm v1.3.0 was discovered to contain a use after free via the function error at /nasm/nasm-pp.c. (CVSS 5.5)
- [CVE-2023-31975](https://cve.now/CVE-2023-31975.md): yasm v1.3.0 was discovered to contain a memory leak via the function yasm\_intnum\_copy at /libyasm/intnum.c. (CVSS 3.3)
- [CVE-2023-31976](https://cve.now/CVE-2023-31976.md): libming v0.4.8 was discovered to contain a stack buffer overflow via the function makeswf\_preprocess at /util/makeswf\_utils.c. (CVSS 8.8)
- [CVE-2023-31979](https://cve.now/CVE-2023-31979.md): Catdoc v0.95 was discovered to contain a global buffer overflow via the function process\_file at /src/reader.c. (CVSS 7.8)
- [CVE-2023-31981](https://cve.now/CVE-2023-31981.md): Sngrep v1.6.0 was discovered to contain a stack buffer overflow via the function packet\_set\_payload at /src/packet.c. (CVSS 7.8)
- [CVE-2023-31982](https://cve.now/CVE-2023-31982.md): Sngrep v1.6.0 was discovered to contain a heap buffer overflow via the function capture\_packet\_reasm\_ip at /src/capture.c. (CVSS 7.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-05-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.