CVEs published May 11, 2023
99 CVEs were published on May 11, 2023: 14 critical, 34 high.
- Published
- 99
- Critical
- 14
- High
- 34
- Medium
- 43
- Low
- 7
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- Adobe Substance3D - Painter
- 14
- Rockwell Automation ArmorStart ST
- 10
- Canon Office/Small Office Multifunction Printers and Laser…
- 9
- Rocket.Chat
- 5
- SourceCodester Online Computer and Laptop Store
- 5
- Go standard library html/template · stdlib
- 3
- vyperlang vyper · vyper
- 3
- Xpdf
- 3
- SourceCodester Lost and Found Information System
- 2
- Weaver E-Office
- 2
Critical 14
- CVE-2023-1834Rockwell Automation Kinetix 5500 Vulnerable to Open Port ExploitationRockwell Automation Kinetix 5500 EtherNet/IP Servo Drive
- CVE-2023-24540Improper handling of JavaScript whitespace in html/templateGo standard library html/template · stdlib
- CVE-2023-2645USR USR-G806 Web Management Page hard-coded passwordUSR-G806
- CVE-2022-47129PHPOK v6.3 was discovered to contain a remote code execution (RCE) vulnerability.
- CVE-2023-0851Buffer overflow in CPCA Resource Download process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an aCanon Office/Small Office Multifunction Printers and Laser…
- CVE-2023-0852Buffer overflow in the Address Book of Mobile Device function of Office / Small Office Multifunction Printers and Laser Printers(*) which maCanon Office/Small Office Multifunction Printers and Laser…
- CVE-2023-0853Buffer overflow in mDNS NSEC record registering process of Office / Small Office Multifunction Printers and Laser Printers(*) which may alloCanon Office/Small Office Multifunction Printers and Laser…
- CVE-2023-0854Buffer overflow in NetBIOS QNAME registering and communication process of Office / Small Office Multifunction Printers and Laser Printers(*)Canon Office/Small Office Multifunction Printers and Laser…
- CVE-2023-0855Buffer overflow in IPP number-up attribute process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an Canon Office/Small Office Multifunction Printers and Laser…
- CVE-2023-0856Buffer overflow in IPP sides attribute process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attaCanon Office/Small Office Multifunction Printers and Laser…
- CVE-2023-29863Medical Systems Co.
- CVE-2023-30192Prestashop possearchproducts 1.7 is vulnerable to SQL Injection via PosSearch::find().
- CVE-2023-31475An issue was discovered on GL.iNet devices before 3.216.
- CVE-2023-31498A privilege escalation issue was found in PHP Gurukul Hospital Management System In v.4.0 allows a remote attacker to execute arbitrary code
High 34
- CVE-2023-32059Vyper vulnerable to incorrect ordering of arguments for kwargs passed to internal callsvyperlang vyper · vyper
- CVE-2023-32058Vyper vulnerable to integer overflow in loopvyperlang vyper · vyper
- CVE-2023-31146Vyper vulnerable to OOB DynArray access when array is on both LHS and RHS of an assignmentvyperlang vyper · vyper
- CVE-2023-2444 A cross site request forgery vulnerability exists in Rockwell Automation's FactoryTalk Vantagepoint.Rockwell Automation FactoryTalk Vantagepoint
- CVE-2023-2443 Rockwell Automation ThinManager product allows the use of medium strength ciphers.Rockwell Automation ThinManager
- CVE-2023-29023Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting AttackRockwell Automation ArmorStart ST
- CVE-2023-29030Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting AttackRockwell Automation ArmorStart ST
- CVE-2023-29031Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting AttackRockwell Automation ArmorStart ST
- CVE-2023-24539Improper sanitization of CSS values in html/templateGo standard library html/template · stdlib
- CVE-2023-29400Improper handling of empty HTML attributes in html/templateGo standard library html/template · stdlib
- CVE-2023-2649Tenda AC23 Service Port 7329 ate command injectionTenda AC23
- CVE-2023-2641SourceCodester Online Internship Management System POST Parameter login.php sql injectionSourceCodester Online Internship Management System
- CVE-2021-34076File Upload vulnerability in PHPOK 5.7.140 allows remote attackers to run arbitrary code and gain escalated privileges via crafted zip file
- CVE-2023-28356A vulnerability has been identified where a maliciously crafted message containing a specific chain of characters can cause the chat to enteRocket.Chat
- CVE-2023-29273ZDI-CAN-20367: Adobe Substance 3D Painter USDC File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Substance3D - Painter
- CVE-2023-29274ZDI-CAN-20366: Adobe Substance 3D Painter USDC File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Substance3D - Painter
- CVE-2023-29275ZDI-CAN-20363: Adobe Substance 3D Painter USD File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Substance3D - Painter
- CVE-2023-29276ZDI-CAN-20362: Adobe Substance 3D Painter USD File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Substance3D - Painter
- CVE-2023-29278ZDI-CAN-20371: Adobe Substance 3D Painter GLTF File Parsing Uninitialized Variable Information Disclosure VulnerabilityAdobe Substance3D - Painter
- CVE-2023-29280ZDI-CAN-20372: Adobe Substance 3D Painter PLY File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Substance3D - Painter
- CVE-2023-29281ZDI-CAN-20364: Adobe Substance 3D Painter USD File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Substance3D - Painter
- CVE-2023-29282ZDI-CAN-20359: Adobe Substance 3D Painter USD File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Substance3D - Painter
- CVE-2023-29283ZDI-CAN-20361: Adobe Substance 3D Painter USD File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAdobe Substance3D - Painter
- CVE-2023-29284ZDI-CAN-20365: Adobe Substance 3D Painter USDA File Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityAdobe Substance3D - Painter
- CVE-2023-29285ZDI-CAN-20360: Adobe Substance 3D Painter USD File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Substance3D - Painter
- CVE-2023-30172A directory traversal vulnerability in the /get-artifact API method of the mlflow platform up to v2.0.1 allows attackers to read arbitrary fmlflow
- CVE-2023-31442In Lightbend Akka before 2.8.1, the async-dns resolver (used by Discovery in DNS mode and transitively by Cluster Bootstrap) uses predictabl
- CVE-2023-31477A path traversal issue was discovered on GL.iNet devices before 3.216.
- CVE-2023-31497Incorrect access control in Quick Heal Technologies Limited Seqrite Endpoint Security (EPS) all versions prior to v8.0 allows attackers to e
- CVE-2023-31502Altenergy Power Control Software C1.2.5 was discovered to contain a remote code execution (RCE) vulnerability via the component /models/mana
- CVE-2023-31528Motorola CX2L Router 1.0.1 was discovered to contain a command injection vulnerability via the staticroute_list parameter.
- CVE-2023-31529Motorola CX2L Router 1.0.1 was discovered to contain a command injection vulnerability via the system_time_timezone parameter.
- CVE-2023-31530Motorola CX2L Router 1.0.1 was discovered to contain a command injection vulnerability via the smartqos_priority_devices parameter.
- CVE-2023-31531Motorola CX2L Router 1.0.1 was discovered to contain a command injection vulnerability via the tomography_ping_number parameter.
Medium, low and unrated 51
- CVE-2023-2664Stack overflow in Xpdf 4.04 due to object loop in PDF embedded file treeXpdf
- CVE-2023-2663Stack overflow in Xpdf 4.04 due to object loop in PDF page label treeXpdf
- CVE-2023-2662Divide-by-zero in Xpdf 4.04 due to bad color space objectXpdf
- CVE-2023-27870IBM Spectrum Virtualize information disclosureIBM Spectrum Virtualize
- CVE-2023-27554IBM WebSphere Application Server XML external entity injectionIBM WebSphere Application Server
- CVE-2023-32082etcd key name can be accessed via LeaseTimeToLive APIetcd-io etcd · github.com/etcd-io/etcd
- CVE-2023-29195Vitess VTAdmin users that can create shards can deny access to other functionsvitessio vitess · vitess.io/vitess
- CVE-2023-29022Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting AttackRockwell Automation ArmorStart ST
- CVE-2023-29029Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting AttackRockwell Automation ArmorStart ST
- CVE-2023-29028Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting AttackRockwell Automation ArmorStart ST
- CVE-2023-29027Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting AttackRockwell Automation ArmorStart ST
- CVE-2023-29026Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting AttackRockwell Automation ArmorStart ST
- CVE-2023-29025Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting AttackRockwell Automation ArmorStart ST
- CVE-2023-29024Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting AttackRockwell Automation ArmorStart ST
- CVE-2023-32075Pimcore vulnerable to Business Logic Errors in Customer automation rulespimcore customer-data-framework · pimcore/customer-manageme…
- CVE-2023-2661SourceCodester Online Computer and Laptop Store Master.php sql injectionSourceCodester Online Computer and Laptop Store
- CVE-2023-2660SourceCodester Online Computer and Laptop Store view_categories.php sql injectionSourceCodester Online Computer and Laptop Store
- CVE-2023-22720WordPress WP Links Page Plugin <= 4.9.3 is vulnerable to Cross Site Scripting (XSS)Robert Macchi WP Links Page
- CVE-2023-2659SourceCodester Online Computer and Laptop Store view_product.php sql injectionSourceCodester Online Computer and Laptop Store
- CVE-2023-2658SourceCodester Online Computer and Laptop Store products.php sql injectionSourceCodester Online Computer and Laptop Store
- CVE-2023-2657SourceCodester Online Computer and Laptop Store products.php cross site scriptingSourceCodester Online Computer and Laptop Store
- CVE-2023-2656SourceCodester AC Repair and Services System sql injectionSourceCodester AC Repair and Services System
- CVE-2023-2490WordPress UserAgent-Spy Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)Fernando Briano UserAgent-Spy
- CVE-2023-2653SourceCodester Lost and Found Information System index.php sql injectionSourceCodester Lost and Found Information System
- CVE-2023-2652SourceCodester Lost and Found Information System sql injectionSourceCodester Lost and Found Information System
- CVE-2023-2648Weaver E-Office uploadify.php unrestricted uploadWeaver E-Office
- CVE-2023-2647Weaver E-Office File Upload utility_all.php command injectionWeaver E-Office
- CVE-2023-2646TP-Link Archer C7v2 GET Request Parameter denial of serviceTP-Link Archer C7v2
- CVE-2023-2644DigitalPersona FPSensor DpHost.exe unquoted search pathDigitalPersona FPSensor
- CVE-2023-2643SourceCodester File Tracker Manager System POST Parameter update_password.php sql injectionSourceCodester File Tracker Manager System
- CVE-2023-2642SourceCodester Online Exam System GET Parameter updateCourse.php sql injectionSourceCodester Online Exam System
- CVE-2023-0857Unintentional change of settings during initial registration of system administrators which uses control protocols.Canon Office/Small Office Multifunction Printers and Laser…
- CVE-2023-0858Improper Authentication of RemoteUI of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on theCanon Office/Small Office Multifunction Printers and Laser…
- CVE-2023-0859Arbitrary Files can be installed in the Setting Data Import function of Office / Small Office Multifunction Printers and Laser Printers(*).Canon Office/Small Office Multifunction Printers and Laser…
- CVE-2023-25309Cross Site Scripting (XSS) Vulnerability in Fetlife rollout-ui version 0.5, allows attackers to execute arbitrary code via a crafted url to rollout-ui
- CVE-2023-28325An improper authorization vulnerability exists in Rocket.Chat <6.0 that could allow a hacker to manipulate the rid parameter and change the Rocket.Chat
- CVE-2023-28357A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command /mute occur after checking whether a user is aRocket.Chat
- CVE-2023-28358A vulnerability has been discovered in Rocket.Chat where a markdown parsing issue in the "Search Messages" feature allows the insertion of mRocket.Chat
- CVE-2023-28359A NoSQL injection vulnerability has been identified in the listEmojiCustom method call within Rocket.Chat.Rocket.Chat
- CVE-2023-28360An omission of security-relevant information vulnerability exists in Brave desktop prior to version 1.48.171 when a user was saving a file thttps://laptop-updates.brave.com/latest/winx64
- CVE-2023-28361A Cross-site WebSocket Hijacking (CSWSH) vulnerability found in UniFi OS 2.5 and earlier allows a malicious actor to access certain confidenUniFi OS
- CVE-2023-29277ZDI-CAN-20370: Adobe Substance 3D Painter USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Substance3D - Painter
- CVE-2023-29279ZDI-CAN-20368: Adobe Substance 3D Painter USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Substance3D - Painter
- CVE-2023-29286ZDI-CAN-20369: Adobe Substance 3D Painter USD File Parsing Uninitialized Variable Information Disclosure VulnerabilityAdobe Substance3D - Painter
- CVE-2023-29791kodbox <= 1.37 is vulnerable to Cross Site Scripting (XSS) via the debug information.
- CVE-2023-29986spring-boot-actuator-logview 0.2.13 allows Directory Traversal to sibling directories via LogViewEndpoint.view.
- CVE-2023-30256Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive information via the back and
- CVE-2023-30394The MoveIt framework 1.1.11 for ROS allows cross-site scripting (XSS) via the API authentication function.
- CVE-2023-31445Cassia Access controller before 2.1.1.2203171453, was discovered to have a unprivileged -information disclosure vulnerability that allows re
- CVE-2023-31473An issue was discovered on GL.iNet devices before 3.216.
- CVE-2023-32668LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests.