# CVEs published 2023-05-12

90 CVEs were published on May 12, 2023: 11 critical, 28 high. Days are UTC.

- [CVE-2023-32303](https://cve.now/CVE-2023-32303.md): Planet's secret file is created with excessive permissions (CVSS 5.2, planetlabs planet-client-python · planet)
- [CVE-2023-32306](https://cve.now/CVE-2023-32306.md): Time Tracker has Blind SQL Injection Vulnerability in Reports (CVSS 8.8, anuko timetracker)
- [CVE-2023-32305](https://cve.now/CVE-2023-32305.md): aiven-extras PostgreSQL Privilege Escalation Through Overloaded Search Path (CVSS 8.8, aiven-extras)
- [CVE-2023-27863](https://cve.now/CVE-2023-27863.md): IBM Spectrum Protect Plus Server information disclosure (CVSS 4.4, IBM Spectrum Protect Plus Server)
- [CVE-2023-25927](https://cve.now/CVE-2023-25927.md): IBM Security Verify Access denial of service (CVSS 6.5, IBM Security Verify Access)
- [CVE-2023-2458](https://cve.now/CVE-2023-2458.md): Use after free in ChromeOS Camera in Google Chrome on ChromeOS prior to 113.0.5672.114 allowed a remote attacker who convinced a user to eng (CVSS 8.8, Google Chrome)
- [CVE-2023-2457](https://cve.now/CVE-2023-2457.md): Out of bounds write in ChromeOS Audio Server in Google Chrome on ChromeOS prior to 113.0.5672.114 allowed a remote attacker to potentially e (CVSS 8.8, Google Chrome)
- [CVE-2023-22685](https://cve.now/CVE-2023-22685.md): WordPress Category Specific RSS feed Subscription Plugin \<= v2.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Tips and Tricks HQ, Ruhul Amin Category Specific RSS feed S…)
- [CVE-2023-25460](https://cve.now/CVE-2023-25460.md): WordPress Easy Ad Manager Plugin \<= 1.0.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, CodeSolz Easy Ad Manager)
- [CVE-2023-25958](https://cve.now/CVE-2023-25958.md): WordPress Simple Tooltips Plugin \<= 2.1.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Justin Saad Simple Tooltips)
- [CVE-2023-28414](https://cve.now/CVE-2023-28414.md): WordPress ApexChat Plugin \<= 1.3.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, ApexChat)
- [CVE-2023-23810](https://cve.now/CVE-2023-23810.md): WordPress Panorama – WordPress Project Management Plugin Plugin \<= 1.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, SnapOrbital Panorama)
- [CVE-2023-23867](https://cve.now/CVE-2023-23867.md): WordPress Button Builder – Buttons X Plugin \<= 0.8.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Gautam Thapar Button Builder – Buttons X)
- [CVE-2023-30768](https://cve.now/CVE-2023-30768.md): Improper access control in the Intel(R) Server Board S2600WTT belonging to the Intel(R) Server Board S2600WT Family with the BIOS version 00 (CVSS 7.1, Intel(R) Server Board S2600WTT belonging to the Intel(R) Se…)
- [CVE-2023-31199](https://cve.now/CVE-2023-31199.md): Improper access control in the Intel(R) Solid State Drive Toolbox(TM) before version 3.4.5 may allow a privileged user to potentially enable (CVSS 7.1, Intel(R) Solid State Drive Toolbox)
- [CVE-2023-30763](https://cve.now/CVE-2023-30763.md): Heap-based overflow in Intel(R) SoC Watch based software before version 2021.1 may allow a privileged user to potentially enable escalation (CVSS 7.2, Intel(R) SoC Watch based software)
- [CVE-2023-29242](https://cve.now/CVE-2023-29242.md): Improper access control for Intel(R) oneAPI Toolkits before version 2021.1 Beta 10 may allow an authenticated user to potentially enable esc (CVSS 6.7, Intel(R) oneAPI Toolkits)
- [CVE-2023-31197](https://cve.now/CVE-2023-31197.md): Uncontrolled search path in the Intel(R) Trace Analyzer and Collector before version 2020 update 3 may allow an authenticated user to potent (CVSS 6.7, Intel(R) Trace Analyzer and Collector)
- [CVE-2023-32081](https://cve.now/CVE-2023-32081.md): Vert.x STOMP server process client frames that would not send initially a connect frame (CVSS 6.5, vert-x3 vertx-stomp · io.vertx:vertx-stomp)
- [CVE-2023-32073](https://cve.now/CVE-2023-32073.md): AVideo command injection vulnerability (CVSS 8.8, WWBN AVideo · wwbn/avideo)
- [CVE-2023-1934](https://cve.now/CVE-2023-1934.md): The PnPSCADA system, a product of SDG Technologies CC, is afflicted by a critical unauthenticated error-based PostgreSQL Injection vulnerabi (CVSS 9.8, SDG Technologies PnPSCADA)
- [CVE-2023-23444](https://cve.now/CVE-2023-23444.md): Missing Authentication for Critical Function in SICK Flexi Classic and Flexi Soft Gateways with Partnumbers 1042193, 1042964, 1044078, 10440 (CVSS 7.5, SICK AG UE410-EN3 FLEXI ETHERNET GATEW. · SICK AG UE410… +14)
- [CVE-2023-2682](https://cve.now/CVE-2023-2682.md): Caton Live Mini\_HTTPD ping.cgi command injection (CVSS 6.3, Caton Live)
- [CVE-2023-2512](https://cve.now/CVE-2023-2512.md): Buffer under-read in workerd (CVSS 6.5, Cloudflare workerd · workerd)
- [CVE-2023-2678](https://cve.now/CVE-2023-2678.md): SourceCodester File Tracker Manager System POST Parameter save\_user.php cross site scripting (CVSS 3.5, SourceCodester File Tracker Manager System)
- [CVE-2023-2677](https://cve.now/CVE-2023-2677.md): SourceCodester Covid-19 Contact Tracing System manage.php sql injection (CVSS 6.3, SourceCodester Covid-19 Contact Tracing System)
- [CVE-2023-2676](https://cve.now/CVE-2023-2676.md): H3C R160 aspForm stack-based overflow (CVSS 5.5, H3C R160)
- [CVE-2023-2672](https://cve.now/CVE-2023-2672.md): SourceCodester Lost and Found Information System GET Parameter view.php sql injection (CVSS 6.3, SourceCodester Lost and Found Information System)
- [CVE-2023-2514](https://cve.now/CVE-2023-2514.md): DB username/password revealed in application logs (CVSS 6.7, Mattermost)
- [CVE-2023-2515](https://cve.now/CVE-2023-2515.md): Privilege escalation to system admin via personal access tokens (CVSS 4.7, Mattermost · github.com/mattermost/mattermost-server/v6)
- [CVE-2023-2671](https://cve.now/CVE-2023-2671.md): SourceCodester Lost and Found Information System Contact Form cross site scripting (CVSS 3.5, SourceCodester Lost and Found Information System)
- [CVE-2023-2670](https://cve.now/CVE-2023-2670.md): SourceCodester Lost and Found Information System access control (CVSS 6.3, SourceCodester Lost and Found Information System)
- [CVE-2023-28936](https://cve.now/CVE-2023-28936.md): Apache OpenMeetings: insufficient check of invitation hash (CVSS 5.3, Apache Software Foundation Apache OpenMeetings · org.apache…)
- [CVE-2023-29032](https://cve.now/CVE-2023-29032.md): Apache OpenMeetings: allows bypass authentication (CVSS 8.1, Apache Software Foundation Apache OpenMeetings · org.apache…)
- [CVE-2023-29246](https://cve.now/CVE-2023-29246.md): Apache OpenMeetings: allows null-byte Injection (CVSS 7.2, Apache Software Foundation Apache OpenMeetings · org.apache…)
- [CVE-2023-2669](https://cve.now/CVE-2023-2669.md): SourceCodester Lost and Found Information System GET Parameter sql injection (CVSS 6.3, SourceCodester Lost and Found Information System)
- [CVE-2023-32243](https://cve.now/CVE-2023-32243.md): WordPress Essential Addons for Elementor Plugin 5.4.0-5.7.1 is vulnerable to Privilege Escalation (CVSS 9.8, WPDeveloper Essential Addons for Elementor)
- [CVE-2023-2668](https://cve.now/CVE-2023-2668.md): SourceCodester Lost and Found Information System GET Parameter manager\_category sql injection (CVSS 6.3, SourceCodester Lost and Found Information System)
- [CVE-2023-2667](https://cve.now/CVE-2023-2667.md): SourceCodester Lost and Found Information System cross site scripting (CVSS 3.5, SourceCodester Lost and Found Information System)
- [CVE-2023-28522](https://cve.now/CVE-2023-28522.md): IBM API Connect improper access control (CVSS 4.3, IBM API Connect)
- [CVE-2023-28520](https://cve.now/CVE-2023-28520.md): IBM Planning Analytics Local cross-site scripting (CVSS 6.4, IBM Planning Analytics Local)
- [CVE-2021-39036](https://cve.now/CVE-2021-39036.md): IBM Cognos Analytics cross-site scripting (CVSS 6.1, IBM Cognos Analytics)
- [CVE-2020-13377](https://cve.now/CVE-2020-13377.md): The web-services interface of Loadbalancer.org Enterprise VA MAX through 8.3.8 could allow an authenticated, remote, low-privileged attacker (CVSS 8.1)
- [CVE-2020-13378](https://cve.now/CVE-2020-13378.md): Loadbalancer.org Enterprise VA MAX through 8.3.8 has an OS Command Injection vulnerability that allows a remote authenticated attacker to ex (CVSS 8.8)
- [CVE-2022-47879](https://cve.now/CVE-2022-47879.md): A Remote Code Execution (RCE) vulnerability in /be/rpc.php in Jedox 2020.2.5 allows remote authenticated users to load arbitrary PHP classes (CVSS 7.5)
- [CVE-2022-47880](https://cve.now/CVE-2022-47880.md): An Information disclosure vulnerability in /be/rpc.php in Jedox GmbH Jedox 2020.2.5 allow remote, authenticated users with permissions to mo (CVSS 6.8)
- [CVE-2022-48020](https://cve.now/CVE-2022-48020.md): Vinteo VCC v2.36.4 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the conference parameter. (CVSS 6.1)
- [CVE-2023-1096](https://cve.now/CVE-2023-1096.md): SnapCenter versions 4.7 prior to 4.7P2 and 4.8 prior to 4.8P1 are susceptible to a vulnerability which could allow a remote unauthenticated (CVSS 9.8, SnapCenter)
- [CVE-2023-20877](https://cve.now/CVE-2023-20877.md): VMware Aria Operations contains a privilege escalation vulnerability. (CVSS 8.8, VMware Aria Operations)
- [CVE-2023-20878](https://cve.now/CVE-2023-20878.md): VMware Aria Operations contains a deserialization vulnerability. (CVSS 7.2, VMware Aria Operations)
- [CVE-2023-20879](https://cve.now/CVE-2023-20879.md): VMware Aria Operations contains a Local privilege escalation vulnerability. (CVSS 6.7, VMware Aria Operations)
- [CVE-2023-2088](https://cve.now/CVE-2023-2088.md): A flaw was found in OpenStack due to an inconsistency between Cinder and Nova. (CVSS 6.5, OpenStack)
- [CVE-2023-20880](https://cve.now/CVE-2023-20880.md): VMware Aria Operations contains a privilege escalation vulnerability. (CVSS 6.7, VMware Aria Operations)
- [CVE-2023-2181](https://cve.now/CVE-2023-2181.md): An issue has been discovered in GitLab affecting all versions before 15.9.8, 15.10.0 before 15.10.7, and 15.11.0 before 15.11.3. (CVSS 6.3, GitLab)
- [CVE-2023-23169](https://cve.now/CVE-2023-23169.md): Synapsoft pdfocus 1.17 is vulnerable to local file inclusion and server-side request forgery Directory Traversal. (CVSS 6.5)
- [CVE-2023-25005](https://cve.now/CVE-2023-25005.md): A maliciously crafted DLL file can be forced to read beyond allocated boundaries in Autodesk InfraWorks 2023, and 2021 when parsing the DLL (CVSS 7.8, Autodesk InfraWorks)
- [CVE-2023-25006](https://cve.now/CVE-2023-25006.md): A malicious actor may convince a user to open a malicious USD file that may trigger a use-after-free vulnerability which could result in cod (CVSS 7.8, Autodesk 3ds Max USD Plugin)
- [CVE-2023-25007](https://cve.now/CVE-2023-25007.md): A malicious actor may convince a user to open a malicious USD file that may trigger an uninitialized pointer which could result in code exec (CVSS 7.8, Autodesk 3ds Max USD Plugin)
- [CVE-2023-25008](https://cve.now/CVE-2023-25008.md): A malicious actor may convince a user to open a malicious USD file that may trigger an out-of-bounds read vulnerability which could result i (CVSS 7.8, Autodesk 3ds Max USD Plugin)
- [CVE-2023-25009](https://cve.now/CVE-2023-25009.md): A malicious actor may convince a user to open a malicious USD file that may trigger an out-of-bounds write vulnerability which could result (CVSS 7.8, Autodesk 3ds Max USD Plugin)
- [CVE-2023-25428](https://cve.now/CVE-2023-25428.md): A DLL Hijacking issue discovered in Soft-o Free Password Manager 1.1.20 allows attackers to create arbitrary DLLs leading to code execution. (CVSS 7.8)
- [CVE-2023-2665](https://cve.now/CVE-2023-2665.md): Storage of Sensitive Data in a Mechanism without Access Control in francoisjacquet/rosariosis (CVSS 7.5, francoisjacquet/rosariosis)
- [CVE-2023-2666](https://cve.now/CVE-2023-2666.md): Allocation of Resources Without Limits or Throttling in froxlor/froxlor (CVSS 6.8, froxlor/froxlor)
- [CVE-2023-2674](https://cve.now/CVE-2023-2674.md): Improper Access Control in openemr/openemr (CVSS 8.8, openemr/openemr)
- [CVE-2023-2675](https://cve.now/CVE-2023-2675.md): Improper Restriction of Excessive Authentication Attempts in linagora/twake (CVSS 5.5, linagora/twake)
- [CVE-2023-27237](https://cve.now/CVE-2023-27237.md): LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack. (CVSS 6.1, lavalite/cms)
- [CVE-2023-27238](https://cve.now/CVE-2023-27238.md): LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning. (CVSS 9.8, lavalite/cms)
- [CVE-2023-27823](https://cve.now/CVE-2023-27823.md): An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid credentials. (CVSS 9.8)
- [CVE-2023-29657](https://cve.now/CVE-2023-29657.md): eXtplorer 2.1.15 is vulnerable to Insecure Permissions. (CVSS 8.8)
- [CVE-2023-29790](https://cve.now/CVE-2023-29790.md): kodbox 1.2.x through 1.3.7 has a Sensitive Information Leakage issue. (CVSS 7.5)
- [CVE-2023-29808](https://cve.now/CVE-2023-29808.md): Cross Site Scripting (XSS) vulnerability in vogtmh cmaps (companymaps) 8.0 allows attackers to execute arbitrary code. (CVSS 6.1)
- [CVE-2023-29809](https://cve.now/CVE-2023-29809.md): SQL injection vulnerability found in Maximilian Vogt companymaps (cmaps) v.8.0 allows a remote attacker to execute arbitrary code via a craf (CVSS 9.8)
- [CVE-2023-29818](https://cve.now/CVE-2023-29818.md): An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to bypass protections vi (CVSS 5.5)
- [CVE-2023-29819](https://cve.now/CVE-2023-29819.md): An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to bypass protections vi (CVSS 5.5)
- [CVE-2023-29820](https://cve.now/CVE-2023-29820.md): An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to access sensitive info (CVSS 5.5)
- [CVE-2023-29983](https://cve.now/CVE-2023-29983.md): Cross Site Scripting vulnerability found in Maximilian Vogt cmaps v.8.0 allows a remote attacker to execute arbitrary code via the auditlog (CVSS 5.4)
- [CVE-2023-30130](https://cve.now/CVE-2023-30130.md): An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter. (CVSS 8.8, craftcms/cms)
- [CVE-2023-30246](https://cve.now/CVE-2023-30246.md): SQL injection vulnerability found in Judging Management System v.1.0 allows a remote attacker to execute arbitrary code via the contestant\_i (CVSS 9.8)
- [CVE-2023-30247](https://cve.now/CVE-2023-30247.md): File Upload vulnerability found in Oretnom23 Storage Unit Rental Management System v.1.0 allows a remote attacker to execute arbitrary code (CVSS 9.8)
- [CVE-2023-30330](https://cve.now/CVE-2023-30330.md): SoftExpert (SE) Excellence Suite 2.x versions before 2.1.3 is vulnerable to Local File Inclusion in the function /se/v42300/generic/gn\_defau (CVSS 9.8)
- [CVE-2023-31913](https://cve.now/CVE-2023-31913.md): Jerryscript 3.0 \*commit 1a2c047) was discovered to contain an Assertion Failure via the component parser\_parse\_class at jerry-core/parser/js (CVSS 5.5)
- [CVE-2023-31914](https://cve.now/CVE-2023-31914.md): Jerryscript 3.0 (commit 05dbbd1) was discovered to contain out-of-memory issue in malloc. (CVSS 5.5)
- [CVE-2023-31916](https://cve.now/CVE-2023-31916.md): Jerryscript 3.0 (commit 1a2c047) was discovered to contain an Assertion Failure via the jmem\_heap\_finalize at jerry-core/jmem/jmem-heap.c. (CVSS 5.5)
- [CVE-2023-31918](https://cve.now/CVE-2023-31918.md): Jerryscript 3.0 (commit 1a2c047) was discovered to contain an Assertion Failure via the parser\_parse\_function\_arguments at jerry-core/parser (CVSS 5.5)
- [CVE-2023-31919](https://cve.now/CVE-2023-31919.md): Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the jcontext\_raise\_exception at jerry-core/jcontext/jcon (CVSS 5.5)
- [CVE-2023-31920](https://cve.now/CVE-2023-31920.md): Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the vm\_loop at jerry-core/vm/vm.c. (CVSS 5.5)
- [CVE-2023-31921](https://cve.now/CVE-2023-31921.md): Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the ecma\_big\_uint\_div\_mod at jerry-core/ecma/operations/ (CVSS 5.5)
- [CVE-2023-31922](https://cve.now/CVE-2023-31922.md): QuickJS commit 2788d71 was discovered to contain a stack-overflow via the component js\_proxy\_isArray at quickjs.c. (CVSS 7.5)
- [CVE-2023-31983](https://cve.now/CVE-2023-31983.md): A Command Injection vulnerability in Edimax Wireless Router N300 Firmware BR-6428NS\_v4 allows attacker to execute arbitrary code via the mp (CVSS 9.8)
- [CVE-2023-31985](https://cve.now/CVE-2023-31985.md): A Command Injection vulnerability in Edimax Wireless Router N300 Firmware BR-6428NS\_v4 allows attacker to execute arbitrary code via the for (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-05-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.