# CVEs published 2023-05-11

99 CVEs were published on May 11, 2023: 14 critical, 34 high. Days are UTC.

- [CVE-2023-32059](https://cve.now/CVE-2023-32059.md): Vyper vulnerable to incorrect ordering of arguments for kwargs passed to internal calls (CVSS 7.5, vyperlang vyper · vyper)
- [CVE-2023-32058](https://cve.now/CVE-2023-32058.md): Vyper vulnerable to integer overflow in loop (CVSS 7.5, vyperlang vyper · vyper)
- [CVE-2023-31146](https://cve.now/CVE-2023-31146.md): Vyper vulnerable to OOB DynArray access when array is on both LHS and RHS of an assignment (CVSS 7.5, vyperlang vyper · vyper)
- [CVE-2023-2664](https://cve.now/CVE-2023-2664.md): Stack overflow in Xpdf 4.04 due to object loop in PDF embedded file tree (CVSS 2.9, Xpdf)
- [CVE-2023-2663](https://cve.now/CVE-2023-2663.md): Stack overflow in Xpdf 4.04 due to object loop in PDF page label tree (CVSS 2.9, Xpdf)
- [CVE-2023-2662](https://cve.now/CVE-2023-2662.md): Divide-by-zero in Xpdf 4.04 due to bad color space object (CVSS 2.9, Xpdf)
- [CVE-2023-27870](https://cve.now/CVE-2023-27870.md): IBM Spectrum Virtualize information disclosure (CVSS 5.9, IBM Spectrum Virtualize)
- [CVE-2023-27554](https://cve.now/CVE-2023-27554.md): IBM WebSphere Application Server XML external entity injection (CVSS 6.3, IBM WebSphere Application Server)
- [CVE-2023-32082](https://cve.now/CVE-2023-32082.md): etcd key name can be accessed via LeaseTimeToLive API (CVSS 3.1, etcd-io etcd · github.com/etcd-io/etcd)
- [CVE-2023-29195](https://cve.now/CVE-2023-29195.md): Vitess VTAdmin users that can create shards can deny access to other functions (CVSS 4.1, vitessio vitess · vitess.io/vitess)
- [CVE-2023-2444](https://cve.now/CVE-2023-2444.md): A cross site request forgery vulnerability exists in Rockwell Automation's FactoryTalk Vantagepoint. (CVSS 7.1, Rockwell Automation FactoryTalk Vantagepoint)
- [CVE-2023-2443](https://cve.now/CVE-2023-2443.md): Rockwell Automation ThinManager product allows the use of medium strength ciphers. (CVSS 7.5, Rockwell Automation ThinManager)
- [CVE-2023-1834](https://cve.now/CVE-2023-1834.md): Rockwell Automation Kinetix 5500 Vulnerable to Open Port Exploitation (CVSS 9.4, Rockwell Automation Kinetix 5500 EtherNet/IP Servo Drive)
- [CVE-2023-29022](https://cve.now/CVE-2023-29022.md): Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting Attack (CVSS 4.7, Rockwell Automation ArmorStart ST)
- [CVE-2023-29029](https://cve.now/CVE-2023-29029.md): Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting Attack (CVSS 4.7, Rockwell Automation ArmorStart ST)
- [CVE-2023-29028](https://cve.now/CVE-2023-29028.md): Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting Attack (CVSS 4.7, Rockwell Automation ArmorStart ST)
- [CVE-2023-29027](https://cve.now/CVE-2023-29027.md): Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting Attack (CVSS 4.7, Rockwell Automation ArmorStart ST)
- [CVE-2023-29026](https://cve.now/CVE-2023-29026.md): Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting Attack (CVSS 4.7, Rockwell Automation ArmorStart ST)
- [CVE-2023-29025](https://cve.now/CVE-2023-29025.md): Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting Attack (CVSS 4.7, Rockwell Automation ArmorStart ST)
- [CVE-2023-29024](https://cve.now/CVE-2023-29024.md): Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting Attack (CVSS 5.5, Rockwell Automation ArmorStart ST)
- [CVE-2023-29023](https://cve.now/CVE-2023-29023.md): Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting Attack (CVSS 7.0, Rockwell Automation ArmorStart ST)
- [CVE-2023-29030](https://cve.now/CVE-2023-29030.md): Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting Attack (CVSS 7.0, Rockwell Automation ArmorStart ST)
- [CVE-2023-29031](https://cve.now/CVE-2023-29031.md): Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting Attack (CVSS 7.0, Rockwell Automation ArmorStart ST)
- [CVE-2023-32075](https://cve.now/CVE-2023-32075.md): Pimcore vulnerable to Business Logic Errors in Customer automation rules (CVSS 4.3, pimcore customer-data-framework · pimcore/customer-manageme…)
- [CVE-2023-24539](https://cve.now/CVE-2023-24539.md): Improper sanitization of CSS values in html/template (CVSS 7.3, Go standard library html/template · stdlib)
- [CVE-2023-24540](https://cve.now/CVE-2023-24540.md): Improper handling of JavaScript whitespace in html/template (CVSS 9.8, Go standard library html/template · stdlib)
- [CVE-2023-29400](https://cve.now/CVE-2023-29400.md): Improper handling of empty HTML attributes in html/template (CVSS 7.3, Go standard library html/template · stdlib)
- [CVE-2023-2661](https://cve.now/CVE-2023-2661.md): SourceCodester Online Computer and Laptop Store Master.php sql injection (CVSS 6.3, SourceCodester Online Computer and Laptop Store)
- [CVE-2023-2660](https://cve.now/CVE-2023-2660.md): SourceCodester Online Computer and Laptop Store view\_categories.php sql injection (CVSS 6.3, SourceCodester Online Computer and Laptop Store)
- [CVE-2023-22720](https://cve.now/CVE-2023-22720.md): WordPress WP Links Page Plugin \<= 4.9.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Robert Macchi WP Links Page)
- [CVE-2023-2659](https://cve.now/CVE-2023-2659.md): SourceCodester Online Computer and Laptop Store view\_product.php sql injection (CVSS 6.3, SourceCodester Online Computer and Laptop Store)
- [CVE-2023-2658](https://cve.now/CVE-2023-2658.md): SourceCodester Online Computer and Laptop Store products.php sql injection (CVSS 6.3, SourceCodester Online Computer and Laptop Store)
- [CVE-2023-2657](https://cve.now/CVE-2023-2657.md): SourceCodester Online Computer and Laptop Store products.php cross site scripting (CVSS 3.5, SourceCodester Online Computer and Laptop Store)
- [CVE-2023-2656](https://cve.now/CVE-2023-2656.md): SourceCodester AC Repair and Services System sql injection (CVSS 6.3, SourceCodester AC Repair and Services System)
- [CVE-2023-2490](https://cve.now/CVE-2023-2490.md): WordPress UserAgent-Spy Plugin \<= 1.3.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Fernando Briano UserAgent-Spy)
- [CVE-2023-2653](https://cve.now/CVE-2023-2653.md): SourceCodester Lost and Found Information System index.php sql injection (CVSS 6.3, SourceCodester Lost and Found Information System)
- [CVE-2023-2652](https://cve.now/CVE-2023-2652.md): SourceCodester Lost and Found Information System sql injection (CVSS 6.3, SourceCodester Lost and Found Information System)
- [CVE-2023-2649](https://cve.now/CVE-2023-2649.md): Tenda AC23 Service Port 7329 ate command injection (CVSS 7.2, Tenda AC23)
- [CVE-2023-2648](https://cve.now/CVE-2023-2648.md): Weaver E-Office uploadify.php unrestricted upload (CVSS 6.3, Weaver E-Office)
- [CVE-2023-2647](https://cve.now/CVE-2023-2647.md): Weaver E-Office File Upload utility\_all.php command injection (CVSS 6.3, Weaver E-Office)
- [CVE-2023-2646](https://cve.now/CVE-2023-2646.md): TP-Link Archer C7v2 GET Request Parameter denial of service (CVSS 4.5, TP-Link Archer C7v2)
- [CVE-2023-2645](https://cve.now/CVE-2023-2645.md): USR USR-G806 Web Management Page hard-coded password (CVSS 9.8, USR-G806)
- [CVE-2023-2644](https://cve.now/CVE-2023-2644.md): DigitalPersona FPSensor DpHost.exe unquoted search path (CVSS 5.3, DigitalPersona FPSensor)
- [CVE-2023-2643](https://cve.now/CVE-2023-2643.md): SourceCodester File Tracker Manager System POST Parameter update\_password.php sql injection (CVSS 6.3, SourceCodester File Tracker Manager System)
- [CVE-2023-2642](https://cve.now/CVE-2023-2642.md): SourceCodester Online Exam System GET Parameter updateCourse.php sql injection (CVSS 6.3, SourceCodester Online Exam System)
- [CVE-2023-2641](https://cve.now/CVE-2023-2641.md): SourceCodester Online Internship Management System POST Parameter login.php sql injection (CVSS 7.3, SourceCodester Online Internship Management System)
- [CVE-2021-34076](https://cve.now/CVE-2021-34076.md): File Upload vulnerability in PHPOK 5.7.140 allows remote attackers to run arbitrary code and gain escalated privileges via crafted zip file (CVSS 8.8)
- [CVE-2022-47129](https://cve.now/CVE-2022-47129.md): PHPOK v6.3 was discovered to contain a remote code execution (RCE) vulnerability. (CVSS 9.8)
- [CVE-2023-0851](https://cve.now/CVE-2023-0851.md): Buffer overflow in CPCA Resource Download process of Office / Small Office Multifunction Printers and Laser Printers(\*) which may allow an a (CVSS 9.8, Canon Office/Small Office Multifunction Printers and Laser…)
- [CVE-2023-0852](https://cve.now/CVE-2023-0852.md): Buffer overflow in the Address Book of Mobile Device function of Office / Small Office Multifunction Printers and Laser Printers(\*) which ma (CVSS 9.8, Canon Office/Small Office Multifunction Printers and Laser…)
- [CVE-2023-0853](https://cve.now/CVE-2023-0853.md): Buffer overflow in mDNS NSEC record registering process of Office / Small Office Multifunction Printers and Laser Printers(\*) which may allo (CVSS 9.8, Canon Office/Small Office Multifunction Printers and Laser…)
- [CVE-2023-0854](https://cve.now/CVE-2023-0854.md): Buffer overflow in NetBIOS QNAME registering and communication process of Office / Small Office Multifunction Printers and Laser Printers(\*) (CVSS 9.8, Canon Office/Small Office Multifunction Printers and Laser…)
- [CVE-2023-0855](https://cve.now/CVE-2023-0855.md): Buffer overflow in IPP number-up attribute process of Office / Small Office Multifunction Printers and Laser Printers(\*) which may allow an (CVSS 9.8, Canon Office/Small Office Multifunction Printers and Laser…)
- [CVE-2023-0856](https://cve.now/CVE-2023-0856.md): Buffer overflow in IPP sides attribute process of Office / Small Office Multifunction Printers and Laser Printers(\*) which may allow an atta (CVSS 9.8, Canon Office/Small Office Multifunction Printers and Laser…)
- [CVE-2023-0857](https://cve.now/CVE-2023-0857.md): Unintentional change of settings during initial registration of system administrators which uses control protocols. (CVSS 5.9, Canon Office/Small Office Multifunction Printers and Laser…)
- [CVE-2023-0858](https://cve.now/CVE-2023-0858.md): Improper Authentication of RemoteUI of Office / Small Office Multifunction Printers and Laser Printers(\*) which may allow an attacker on the (CVSS 3.1, Canon Office/Small Office Multifunction Printers and Laser…)
- [CVE-2023-0859](https://cve.now/CVE-2023-0859.md): Arbitrary Files can be installed in the Setting Data Import function of Office / Small Office Multifunction Printers and Laser Printers(\*). (CVSS 2.2, Canon Office/Small Office Multifunction Printers and Laser…)
- [CVE-2023-25309](https://cve.now/CVE-2023-25309.md): Cross Site Scripting (XSS) Vulnerability in Fetlife rollout-ui version 0.5, allows attackers to execute arbitrary code via a crafted url to (CVSS 6.1, rollout-ui)
- [CVE-2023-28325](https://cve.now/CVE-2023-28325.md): An improper authorization vulnerability exists in Rocket.Chat \<6.0 that could allow a hacker to manipulate the rid parameter and change the (CVSS 6.5, Rocket.Chat)
- [CVE-2023-28356](https://cve.now/CVE-2023-28356.md): A vulnerability has been identified where a maliciously crafted message containing a specific chain of characters can cause the chat to ente (CVSS 7.5, Rocket.Chat)
- [CVE-2023-28357](https://cve.now/CVE-2023-28357.md): A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command /mute occur after checking whether a user is a (CVSS 4.3, Rocket.Chat)
- [CVE-2023-28358](https://cve.now/CVE-2023-28358.md): A vulnerability has been discovered in Rocket.Chat where a markdown parsing issue in the "Search Messages" feature allows the insertion of m (CVSS 6.1, Rocket.Chat)
- [CVE-2023-28359](https://cve.now/CVE-2023-28359.md): A NoSQL injection vulnerability has been identified in the listEmojiCustom method call within Rocket.Chat. (CVSS 5.3, Rocket.Chat)
- [CVE-2023-28360](https://cve.now/CVE-2023-28360.md): An omission of security-relevant information vulnerability exists in Brave desktop prior to version 1.48.171 when a user was saving a file t (CVSS 4.3, https://laptop-updates.brave.com/latest/winx64)
- [CVE-2023-28361](https://cve.now/CVE-2023-28361.md): A Cross-site WebSocket Hijacking (CSWSH) vulnerability found in UniFi OS 2.5 and earlier allows a malicious actor to access certain confiden (CVSS 6.5, UniFi OS)
- [CVE-2023-29273](https://cve.now/CVE-2023-29273.md): ZDI-CAN-20367: Adobe Substance 3D Painter USDC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2023-29274](https://cve.now/CVE-2023-29274.md): ZDI-CAN-20366: Adobe Substance 3D Painter USDC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2023-29275](https://cve.now/CVE-2023-29275.md): ZDI-CAN-20363: Adobe Substance 3D Painter USD File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2023-29276](https://cve.now/CVE-2023-29276.md): ZDI-CAN-20362: Adobe Substance 3D Painter USD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2023-29277](https://cve.now/CVE-2023-29277.md): ZDI-CAN-20370: Adobe Substance 3D Painter USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Substance3D - Painter)
- [CVE-2023-29278](https://cve.now/CVE-2023-29278.md): ZDI-CAN-20371: Adobe Substance 3D Painter GLTF File Parsing Uninitialized Variable Information Disclosure Vulnerability (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2023-29279](https://cve.now/CVE-2023-29279.md): ZDI-CAN-20368: Adobe Substance 3D Painter USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Substance3D - Painter)
- [CVE-2023-29280](https://cve.now/CVE-2023-29280.md): ZDI-CAN-20372: Adobe Substance 3D Painter PLY File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2023-29281](https://cve.now/CVE-2023-29281.md): ZDI-CAN-20364: Adobe Substance 3D Painter USD File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2023-29282](https://cve.now/CVE-2023-29282.md): ZDI-CAN-20359: Adobe Substance 3D Painter USD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2023-29283](https://cve.now/CVE-2023-29283.md): ZDI-CAN-20361: Adobe Substance 3D Painter USD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2023-29284](https://cve.now/CVE-2023-29284.md): ZDI-CAN-20365: Adobe Substance 3D Painter USDA File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2023-29285](https://cve.now/CVE-2023-29285.md): ZDI-CAN-20360: Adobe Substance 3D Painter USD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2023-29286](https://cve.now/CVE-2023-29286.md): ZDI-CAN-20369: Adobe Substance 3D Painter USD File Parsing Uninitialized Variable Information Disclosure Vulnerability (CVSS 5.5, Adobe Substance3D - Painter)
- [CVE-2023-29791](https://cve.now/CVE-2023-29791.md): kodbox \<= 1.37 is vulnerable to Cross Site Scripting (XSS) via the debug information. (CVSS 6.1)
- [CVE-2023-29863](https://cve.now/CVE-2023-29863.md): Medical Systems Co. (CVSS 9.8)
- [CVE-2023-29986](https://cve.now/CVE-2023-29986.md): spring-boot-actuator-logview 0.2.13 allows Directory Traversal to sibling directories via LogViewEndpoint.view. (CVSS 5.3)
- [CVE-2023-30172](https://cve.now/CVE-2023-30172.md): A directory traversal vulnerability in the /get-artifact API method of the mlflow platform up to v2.0.1 allows attackers to read arbitrary f (CVSS 7.5, mlflow)
- [CVE-2023-30192](https://cve.now/CVE-2023-30192.md): Prestashop possearchproducts 1.7 is vulnerable to SQL Injection via PosSearch::find(). (CVSS 9.8)
- [CVE-2023-30256](https://cve.now/CVE-2023-30256.md): Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive information via the back and (CVSS 6.1)
- [CVE-2023-30394](https://cve.now/CVE-2023-30394.md): The MoveIt framework 1.1.11 for ROS allows cross-site scripting (XSS) via the API authentication function. (CVSS 6.1)
- [CVE-2023-31442](https://cve.now/CVE-2023-31442.md): In Lightbend Akka before 2.8.1, the async-dns resolver (used by Discovery in DNS mode and transitively by Cluster Bootstrap) uses predictabl (CVSS 7.5)
- [CVE-2023-31445](https://cve.now/CVE-2023-31445.md): Cassia Access controller before 2.1.1.2203171453, was discovered to have a unprivileged -information disclosure vulnerability that allows re (no CVSS)
- [CVE-2023-31473](https://cve.now/CVE-2023-31473.md): An issue was discovered on GL.iNet devices before 3.216. (CVSS 4.9)
- [CVE-2023-31475](https://cve.now/CVE-2023-31475.md): An issue was discovered on GL.iNet devices before 3.216. (CVSS 9.0)
- [CVE-2023-31477](https://cve.now/CVE-2023-31477.md): A path traversal issue was discovered on GL.iNet devices before 3.216. (CVSS 7.5)
- [CVE-2023-31497](https://cve.now/CVE-2023-31497.md): Incorrect access control in Quick Heal Technologies Limited Seqrite Endpoint Security (EPS) all versions prior to v8.0 allows attackers to e (CVSS 7.8)
- [CVE-2023-31498](https://cve.now/CVE-2023-31498.md): A privilege escalation issue was found in PHP Gurukul Hospital Management System In v.4.0 allows a remote attacker to execute arbitrary code (CVSS 9.8)
- [CVE-2023-31502](https://cve.now/CVE-2023-31502.md): Altenergy Power Control Software C1.2.5 was discovered to contain a remote code execution (RCE) vulnerability via the component /models/mana (CVSS 7.2)
- [CVE-2023-31528](https://cve.now/CVE-2023-31528.md): Motorola CX2L Router 1.0.1 was discovered to contain a command injection vulnerability via the staticroute\_list parameter. (CVSS 8.8)
- [CVE-2023-31529](https://cve.now/CVE-2023-31529.md): Motorola CX2L Router 1.0.1 was discovered to contain a command injection vulnerability via the system\_time\_timezone parameter. (CVSS 8.8)
- [CVE-2023-31530](https://cve.now/CVE-2023-31530.md): Motorola CX2L Router 1.0.1 was discovered to contain a command injection vulnerability via the smartqos\_priority\_devices parameter. (CVSS 8.8)
- [CVE-2023-31531](https://cve.now/CVE-2023-31531.md): Motorola CX2L Router 1.0.1 was discovered to contain a command injection vulnerability via the tomography\_ping\_number parameter. (CVSS 8.8)
- [CVE-2023-32668](https://cve.now/CVE-2023-32668.md): LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests. (CVSS 5.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-05-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.