CVEs published May 12, 2023
90 CVEs were published on May 12, 2023: 11 critical, 28 high.
- Published
- 90
- Critical
- 11
- High
- 28
- Medium
- 48
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 17
Most affected products
- SourceCodester Lost and Found Information System
- 6
- Autodesk 3ds Max USD Plugin
- 4
- VMware Aria Operations
- 4
- Apache Software Foundation Apache OpenMeetings · org.apache…
- 3
- Google Chrome
- 2
- lavalite/cms
- 2
- aiven-extras
- 1
- anuko timetracker
- 1
- ApexChat
- 1
- Autodesk InfraWorks
- 1
Critical 11
- CVE-2023-1934The PnPSCADA system, a product of SDG Technologies CC, is afflicted by a critical unauthenticated error-based PostgreSQL Injection vulnerabiSDG Technologies PnPSCADA
- CVE-2023-32243WordPress Essential Addons for Elementor Plugin 5.4.0-5.7.1 is vulnerable to Privilege EscalationWPDeveloper Essential Addons for Elementor
- CVE-2023-1096SnapCenter versions 4.7 prior to 4.7P2 and 4.8 prior to 4.8P1 are susceptible to a vulnerability which could allow a remote unauthenticated SnapCenter
- CVE-2023-27238LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning.lavalite/cms
- CVE-2023-27823An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid credentials.
- CVE-2023-29809SQL injection vulnerability found in Maximilian Vogt companymaps (cmaps) v.8.0 allows a remote attacker to execute arbitrary code via a craf
- CVE-2023-30246SQL injection vulnerability found in Judging Management System v.1.0 allows a remote attacker to execute arbitrary code via the contestant_i
- CVE-2023-30247File Upload vulnerability found in Oretnom23 Storage Unit Rental Management System v.1.0 allows a remote attacker to execute arbitrary code
- CVE-2023-30330SoftExpert (SE) Excellence Suite 2.x versions before 2.1.3 is vulnerable to Local File Inclusion in the function /se/v42300/generic/gn_defau
- CVE-2023-31983A Command Injection vulnerability in Edimax Wireless Router N300 Firmware BR-6428NS_v4 allows attacker to execute arbitrary code via the mp
- CVE-2023-31985A Command Injection vulnerability in Edimax Wireless Router N300 Firmware BR-6428NS_v4 allows attacker to execute arbitrary code via the for
High 28
- CVE-2023-32306Time Tracker has Blind SQL Injection Vulnerability in Reportsanuko timetracker
- CVE-2023-32305aiven-extras PostgreSQL Privilege Escalation Through Overloaded Search Pathaiven-extras
- CVE-2023-2458Use after free in ChromeOS Camera in Google Chrome on ChromeOS prior to 113.0.5672.114 allowed a remote attacker who convinced a user to engGoogle Chrome
- CVE-2023-2457Out of bounds write in ChromeOS Audio Server in Google Chrome on ChromeOS prior to 113.0.5672.114 allowed a remote attacker to potentially eGoogle Chrome
- CVE-2023-30768Improper access control in the Intel(R) Server Board S2600WTT belonging to the Intel(R) Server Board S2600WT Family with the BIOS version 00Intel(R) Server Board S2600WTT belonging to the Intel(R) Se…
- CVE-2023-31199Improper access control in the Intel(R) Solid State Drive Toolbox(TM) before version 3.4.5 may allow a privileged user to potentially enableIntel(R) Solid State Drive Toolbox
- CVE-2023-30763Heap-based overflow in Intel(R) SoC Watch based software before version 2021.1 may allow a privileged user to potentially enable escalation Intel(R) SoC Watch based software
- CVE-2023-32073AVideo command injection vulnerabilityWWBN AVideo · wwbn/avideo
- CVE-2023-23444Missing Authentication for Critical Function in SICK Flexi Classic and Flexi Soft Gateways with Partnumbers 1042193, 1042964, 1044078, 10440SICK AG UE410-EN3 FLEXI ETHERNET GATEW. · SICK AG UE410… +14
- CVE-2023-29032Apache OpenMeetings: allows bypass authenticationApache Software Foundation Apache OpenMeetings · org.apache…
- CVE-2023-29246Apache OpenMeetings: allows null-byte InjectionApache Software Foundation Apache OpenMeetings · org.apache…
- CVE-2020-13377The web-services interface of Loadbalancer.org Enterprise VA MAX through 8.3.8 could allow an authenticated, remote, low-privileged attacker
- CVE-2020-13378Loadbalancer.org Enterprise VA MAX through 8.3.8 has an OS Command Injection vulnerability that allows a remote authenticated attacker to ex
- CVE-2022-47879A Remote Code Execution (RCE) vulnerability in /be/rpc.php in Jedox 2020.2.5 allows remote authenticated users to load arbitrary PHP classes
- CVE-2023-20877VMware Aria Operations contains a privilege escalation vulnerability.VMware Aria Operations
- CVE-2023-20878VMware Aria Operations contains a deserialization vulnerability.VMware Aria Operations
- CVE-2023-25005A maliciously crafted DLL file can be forced to read beyond allocated boundaries in Autodesk InfraWorks 2023, and 2021 when parsing the DLL Autodesk InfraWorks
- CVE-2023-25006A malicious actor may convince a user to open a malicious USD file that may trigger a use-after-free vulnerability which could result in codAutodesk 3ds Max USD Plugin
- CVE-2023-25007A malicious actor may convince a user to open a malicious USD file that may trigger an uninitialized pointer which could result in code execAutodesk 3ds Max USD Plugin
- CVE-2023-25008A malicious actor may convince a user to open a malicious USD file that may trigger an out-of-bounds read vulnerability which could result iAutodesk 3ds Max USD Plugin
- CVE-2023-25009A malicious actor may convince a user to open a malicious USD file that may trigger an out-of-bounds write vulnerability which could result Autodesk 3ds Max USD Plugin
- CVE-2023-25428A DLL Hijacking issue discovered in Soft-o Free Password Manager 1.1.20 allows attackers to create arbitrary DLLs leading to code execution.
- CVE-2023-2665Storage of Sensitive Data in a Mechanism without Access Control in francoisjacquet/rosariosisfrancoisjacquet/rosariosis
- CVE-2023-2674Improper Access Control in openemr/openemropenemr/openemr
- CVE-2023-29657eXtplorer 2.1.15 is vulnerable to Insecure Permissions.
- CVE-2023-29790kodbox 1.2.x through 1.3.7 has a Sensitive Information Leakage issue.
- CVE-2023-30130An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter.craftcms/cms
- CVE-2023-31922QuickJS commit 2788d71 was discovered to contain a stack-overflow via the component js_proxy_isArray at quickjs.c.
Medium, low and unrated 51
- CVE-2023-32303Planet's secret file is created with excessive permissionsplanetlabs planet-client-python · planet
- CVE-2023-27863IBM Spectrum Protect Plus Server information disclosureIBM Spectrum Protect Plus Server
- CVE-2023-25927IBM Security Verify Access denial of serviceIBM Security Verify Access
- CVE-2023-22685WordPress Category Specific RSS feed Subscription Plugin <= v2.2 is vulnerable to Cross Site Scripting (XSS)Tips and Tricks HQ, Ruhul Amin Category Specific RSS feed S…
- CVE-2023-25460WordPress Easy Ad Manager Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)CodeSolz Easy Ad Manager
- CVE-2023-25958WordPress Simple Tooltips Plugin <= 2.1.4 is vulnerable to Cross Site Scripting (XSS)Justin Saad Simple Tooltips
- CVE-2023-28414WordPress ApexChat Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)ApexChat
- CVE-2023-23810WordPress Panorama – WordPress Project Management Plugin Plugin <= 1.5 is vulnerable to Cross Site Scripting (XSS)SnapOrbital Panorama
- CVE-2023-23867WordPress Button Builder – Buttons X Plugin <= 0.8.6 is vulnerable to Cross Site Scripting (XSS)Gautam Thapar Button Builder – Buttons X
- CVE-2023-29242Improper access control for Intel(R) oneAPI Toolkits before version 2021.1 Beta 10 may allow an authenticated user to potentially enable escIntel(R) oneAPI Toolkits
- CVE-2023-31197Uncontrolled search path in the Intel(R) Trace Analyzer and Collector before version 2020 update 3 may allow an authenticated user to potentIntel(R) Trace Analyzer and Collector
- CVE-2023-32081Vert.x STOMP server process client frames that would not send initially a connect framevert-x3 vertx-stomp · io.vertx:vertx-stomp
- CVE-2023-2682Caton Live Mini_HTTPD ping.cgi command injectionCaton Live
- CVE-2023-2512Buffer under-read in workerdCloudflare workerd · workerd
- CVE-2023-2678SourceCodester File Tracker Manager System POST Parameter save_user.php cross site scriptingSourceCodester File Tracker Manager System
- CVE-2023-2677SourceCodester Covid-19 Contact Tracing System manage.php sql injectionSourceCodester Covid-19 Contact Tracing System
- CVE-2023-2676H3C R160 aspForm stack-based overflowH3C R160
- CVE-2023-2672SourceCodester Lost and Found Information System GET Parameter view.php sql injectionSourceCodester Lost and Found Information System
- CVE-2023-2514DB username/password revealed in application logsMattermost
- CVE-2023-2515Privilege escalation to system admin via personal access tokensMattermost · github.com/mattermost/mattermost-server/v6
- CVE-2023-2671SourceCodester Lost and Found Information System Contact Form cross site scriptingSourceCodester Lost and Found Information System
- CVE-2023-2670SourceCodester Lost and Found Information System access controlSourceCodester Lost and Found Information System
- CVE-2023-28936Apache OpenMeetings: insufficient check of invitation hashApache Software Foundation Apache OpenMeetings · org.apache…
- CVE-2023-2669SourceCodester Lost and Found Information System GET Parameter sql injectionSourceCodester Lost and Found Information System
- CVE-2023-2668SourceCodester Lost and Found Information System GET Parameter manager_category sql injectionSourceCodester Lost and Found Information System
- CVE-2023-2667SourceCodester Lost and Found Information System cross site scriptingSourceCodester Lost and Found Information System
- CVE-2023-28522IBM API Connect improper access controlIBM API Connect
- CVE-2023-28520IBM Planning Analytics Local cross-site scriptingIBM Planning Analytics Local
- CVE-2021-39036IBM Cognos Analytics cross-site scriptingIBM Cognos Analytics
- CVE-2022-47880An Information disclosure vulnerability in /be/rpc.php in Jedox GmbH Jedox 2020.2.5 allow remote, authenticated users with permissions to mo
- CVE-2022-48020Vinteo VCC v2.36.4 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the conference parameter.
- CVE-2023-20879VMware Aria Operations contains a Local privilege escalation vulnerability.VMware Aria Operations
- CVE-2023-2088A flaw was found in OpenStack due to an inconsistency between Cinder and Nova.OpenStack
- CVE-2023-20880VMware Aria Operations contains a privilege escalation vulnerability.VMware Aria Operations
- CVE-2023-2181An issue has been discovered in GitLab affecting all versions before 15.9.8, 15.10.0 before 15.10.7, and 15.11.0 before 15.11.3.GitLab
- CVE-2023-23169Synapsoft pdfocus 1.17 is vulnerable to local file inclusion and server-side request forgery Directory Traversal.
- CVE-2023-2666Allocation of Resources Without Limits or Throttling in froxlor/froxlorfroxlor/froxlor
- CVE-2023-2675Improper Restriction of Excessive Authentication Attempts in linagora/twakelinagora/twake
- CVE-2023-27237LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack.lavalite/cms
- CVE-2023-29808Cross Site Scripting (XSS) vulnerability in vogtmh cmaps (companymaps) 8.0 allows attackers to execute arbitrary code.
- CVE-2023-29818An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to bypass protections vi
- CVE-2023-29819An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to bypass protections vi
- CVE-2023-29820An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to access sensitive info
- CVE-2023-29983Cross Site Scripting vulnerability found in Maximilian Vogt cmaps v.8.0 allows a remote attacker to execute arbitrary code via the auditlog
- CVE-2023-31913Jerryscript 3.0 *commit 1a2c047) was discovered to contain an Assertion Failure via the component parser_parse_class at jerry-core/parser/js
- CVE-2023-31914Jerryscript 3.0 (commit 05dbbd1) was discovered to contain out-of-memory issue in malloc.
- CVE-2023-31916Jerryscript 3.0 (commit 1a2c047) was discovered to contain an Assertion Failure via the jmem_heap_finalize at jerry-core/jmem/jmem-heap.c.
- CVE-2023-31918Jerryscript 3.0 (commit 1a2c047) was discovered to contain an Assertion Failure via the parser_parse_function_arguments at jerry-core/parser
- CVE-2023-31919Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the jcontext_raise_exception at jerry-core/jcontext/jcon
- CVE-2023-31920Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the vm_loop at jerry-core/vm/vm.c.
- CVE-2023-31921Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the ecma_big_uint_div_mod at jerry-core/ecma/operations/