CVEs published May 15, 2023
147 CVEs were published on May 15, 2023: 10 critical, 65 high.
- Published
- 147
- Critical
- 10
- High
- 65
- Medium
- 68
- Low
- 1
- Unrated
- 3
- Now in CISA KEV
- 0
- Fix available
- 40
Most affected products
- Android
- 15
- CODESYS Control RTE · CODESYS Control Win +14
- 15
- SICK AG SICK FTMG-ESD15AXX AIR FLOW SENSOR · SICK AG SIC… +5
- 8
- MediaTek MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT…
- 6
- MediaTek MT6853, MT6853T, MT6873, MT6875, MT6877, MT6879, M…
- 4
- Clock In Portal- Staff & Attendance Management
- 3
- MediaTek MT6762, MT6765, MT6768, MT6769, MT6779, MT6781, MT…
- 2
- MediaTek MT6768, MT6769, MT6779, MT6781, MT6785, MT6789, MT…
- 2
- patriksimek vm2 · vm2
- 2
- Active Directory Integration / LDAP Integration
- 1
Critical 10
- CVE-2023-32314Sandbox Escapepatriksimek vm2 · vm2
- CVE-2022-4774Bit Form < 1.9 - RCE via Unauthenticated Arbitrary File UploadBit Form
- CVE-2023-0600WP Visitor Statistics (Real Time Traffic) < 6.9 - Unauthenticated SQLiWP Visitor Statistics
- CVE-2022-47937Multiple parsing problems in the Apache Sling Commons JSON moduleApache Software Foundation org.apache.sling.commons.json ·…
- CVE-2023-1698WAGO: WBM Command Injection in multiple productsWAGO Compact Controller CC100 · WAGO Edge Controller +5
- CVE-2021-0877Product: AndroidVersions: Android SoCAndroid ID: A-273754094Android
- CVE-2023-29861An issue found in FLIR-DVTEL version not specified allows a remote attacker to execute arbitrary code via a crafted request to the managemen
- CVE-2023-29862An issue found in Agasio-Camera device version not specified allows a remote attacker to execute arbitrary code via the check and authLevel
- CVE-2023-30245SQL injection vulnerability found in Judging Management System v.1.0 allows a remote attacker to execute arbitrary code via the crit_id para
- CVE-2023-31986A Command Injection vulnerability in Edimax Wireless Router N300 Firmware BR-6428NS_v4 allows attacker to execute arbitrary code via the set
High 65
- CVE-2023-31131Arbitrary File Write when Extracting Tarballs in greenplum-dbgreenplum-db gpdb
- CVE-2023-32308SQL Injection Vulnerability in anuko timetrackeranuko timetracker
- CVE-2023-32309Arbitrary file inclusion with the pymdowm-snippets extensionfacelessuser pymdown-extensions · pymdown-extensions
- CVE-2023-0812Active Directory Integration / LDAP Integration < 4.1.1 - Unauthenticated Data DisclosureActive Directory Integration / LDAP Integration
- CVE-2023-2180KIWIZ Invoices Certification & PDF System <= 2.1.3 - Unauthenticated Arbitrary File DownloadKIWIZ Invoices Certification & PDF System
- CVE-2023-1549Ad Inserter < 2.7.27 - Admin+ PHP Object InjectionAd Inserter
- CVE-2023-1207HTTP Headers < 1.18.8 - Admin+ SQL InjectionHTTP Headers
- CVE-2023-22706WordPress PropertyHive Plugin <= 1.5.48 is vulnerable to Cross Site Scripting (XSS)PropertyHive
- CVE-2023-23447Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 112252SICK AG SICK FTMG-ESD15AXX AIR FLOW SENSOR · SICK AG SIC… +5
- CVE-2023-23446Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows aSICK AG SICK FTMG-ESD15AXX AIR FLOW SENSOR · SICK AG SIC… +5
- CVE-2023-23445Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows aSICK AG SICK FTMG-ESD15AXX AIR FLOW SENSOR · SICK AG SIC… +5
- CVE-2023-22703WordPress WCP Contact Form Plugin <= 3.1.0 is vulnerable to Cross Site Scripting (XSS)Webcodin WCP Contact Form
- CVE-2022-47391CODESYS: Multiple products prone to Improper Input ValidationCODESYS Control RTE · CODESYS Control Win +17
- CVE-2022-47390CODESYS: Multiple products prone to stack based out-of-bounds writeCODESYS Control RTE · CODESYS Control Win +14
- CVE-2022-47389CODESYS: Multiple products prone to stack based out-of-bounds writeCODESYS Control RTE · CODESYS Control Win +14
- CVE-2022-47388CODESYS: Multiple products prone to stack based out-of-bounds writeCODESYS Control RTE · CODESYS Control Win +14
- CVE-2022-47387CODESYS: Multiple products prone to stack based out-of-bounds writeCODESYS Control RTE · CODESYS Control Win +14
- CVE-2022-47386CODESYS: Multiple products prone to stack based out-of-bounds writeCODESYS Control RTE · CODESYS Control Win +14
- CVE-2022-47385CODESYS: Multiple products prone to stack based out-of-bounds writeCODESYS Control RTE · CODESYS Control Win +14
- CVE-2022-47384CODESYS: Multiple products prone to stack based out-of-bounds writeCODESYS Control RTE · CODESYS Control Win +14
- CVE-2022-47383CODESYS: Multiple products prone to stack based out-of-bounds writeCODESYS Control RTE · CODESYS Control Win +14
- CVE-2022-47382CODESYS: Multiple products prone to stack based out-of-bounds writeCODESYS Control RTE · CODESYS Control Win +14
- CVE-2022-47381CODESYS: Multiple products prone to stack based out-of-bounds writeCODESYS Control RTE · CODESYS Control Win +14
- CVE-2022-47380CODESYS: Multiple products prone to out-of-bounds writeCODESYS Control RTE · CODESYS Control Win +14
- CVE-2022-47379CODESYS: Multiple products prone to out-of-bounds writeCODESYS Control RTE · CODESYS Control Win +14
- CVE-2022-4048CODESYS V3 prone to Inadequate Encryption StregthCODESYS Development System
- CVE-2023-22318Denial of service against webconfTribe29 Checkmk Appliance
- CVE-2023-20721In isp, there is a possible out of bounds write due to improper input validation.MediaTek MT6879, MT6895, MT6983, MT8195, MT8395, MT8673
- CVE-2023-21102In __efi_rt_asm_wrapper of efi-rt-wrapper.S, there is a possible bypass of shadow stack protection due to a logic error in the code.Android
- CVE-2023-21106In adreno_set_param of adreno_gpu.c, there is a possible memory corruption due to a double free.Android
- CVE-2023-21107In retrieveAppEntry of NotificationAccessDetails.java, there is a missing permission check.Android
- CVE-2023-21109In multiple places of AccessibilityService, there is a possible way to hide the app from the user due to a logic error in the code.Android
- CVE-2023-21110In several functions of SnoozeHelper.java, there is a possible way to grant notifications access due to resource exhaustion.Android
- CVE-2023-21117In registerReceiverWithFeature of ActivityManagerService.java, there is a possible way for isolated processes to register a broadcast receivAndroid
- CVE-2023-31607An issue in the __libc_malloc component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via craft
- CVE-2023-31608An issue in the artm_div_int component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafte
- CVE-2023-31609An issue in the dfe_unit_col_loci component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via c
- CVE-2023-31610An issue in the _IO_default_xsputn component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via
- CVE-2023-31611An issue in the __libc_longjmp component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via craf
- CVE-2023-31612An issue in the dfe_qexp_list component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via craft
- CVE-2023-31613An issue in the __nss_database_lookup component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) v
- CVE-2023-31614An issue in the mp_box_deserialize_string function in openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS
- CVE-2023-31615An issue in the chash_array component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted
- CVE-2023-31616An issue in the bif_mod component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL
- CVE-2023-31617An issue in the dk_set_delete component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via craft
- CVE-2023-31618An issue in the sqlc_union_dt_wrap component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via
- CVE-2023-31619An issue in the sch_name_to_object component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via
- CVE-2023-31620An issue in the dv_compare component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted
- CVE-2023-31621An issue in the kc_var_col component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted
- CVE-2023-31622An issue in the sqlc_make_policy_trig component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) v
- CVE-2023-31623An issue in the mp_box_copy component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted
- CVE-2023-31624An issue in the sinv_check_exp component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via craf
- CVE-2023-31625An issue in the psiginfo component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQ
- CVE-2023-31626An issue in the gpf_notice component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted
- CVE-2023-31627An issue in the strhash component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL
- CVE-2023-31628An issue in the stricmp component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL
- CVE-2023-31629An issue in the sqlo_union_scope component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via cr
- CVE-2023-31630An issue in the sqlo_query_spec component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via cra
- CVE-2023-31631An issue in the sqlo_preds_contradiction component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS
- CVE-2023-31842Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/index.php?page=edit_faculty&id=.
- CVE-2023-31843Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/view_faculty.php?id=.
- CVE-2023-31844Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/manage_subject.php?id=.
- CVE-2023-31845Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/manage_class.php?id=.
- CVE-2023-32758giturlparse (aka git-url-parse) through 1.2.2, as used in Semgrep 1.5.2 through 1.24.1, is vulnerable to ReDoS (Regular Expression Denial ofgit-url-parse
- CVE-2023-32784In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace is locked or n
Medium, low and unrated 72
- CVE-2023-31145Reflected XSS vulnerability in CollaboraOnlineCollaboraOnline online
- CVE-2023-32068URL Redirection to Untrusted Site in XWikixwiki-platform · org.xwiki.platform:xwiki-platform-oldcore
- CVE-2023-32313Inspect method manipulation in vm2patriksimek vm2 · vm2
- CVE-2023-0233ActiveCampaign < 8.1.12 - Contributor+ Stored XSSActiveCampaign
- CVE-2023-1835Ninja Forms < 3.6.22 - Reflected XSSNinja Forms Contact Form
- CVE-2023-1839Product Addons & Fields for WooCommerce < 32.0.6 - Admin+ Stored Cross-Site ScriptingProduct Addons & Fields for WooCommerce
- CVE-2023-0761Clock In Portal <= 2.1 - Staff Deletion via CSRFClock In Portal- Staff & Attendance Management
- CVE-2023-1019Help Desk WP <= 1.2.0 - Editor+ Stored XSSHelp Desk WP
- CVE-2023-2009Pretty Url <= 1.5.4 - Admin+ Stored XSS in plugin settingsPretty Url
- CVE-2023-1890Tablesome < 1.0.9 - Reflected XSSTablesome
- CVE-2023-0644PushAssist <= 3.0.8 - Reflected Cross-Site ScriptingPush Notifications for WordPress by PushAssist
- CVE-2023-0490f(x) TOC <= 1.1.0 - Contributor+ Stored XSSf(x) TOC
- CVE-2023-0520RapidExpCart <= 1.0 - Stored XSS via CSRFRapidExpCart
- CVE-2023-0763Clock In Portal <= 2.1 - Holidays Deletion via CSRFClock In Portal- Staff & Attendance Management
- CVE-2023-1596tagDiv Composer < 4.0 - Reflected Cross-site ScriptingtagDiv Composer
- CVE-2023-2179WooCommerce Order Status Change Notifier <= 1.1.0 - Subscriber+ Arbitrary Order Status UpdateWooCommerce Order Status Change Notifier
- CVE-2023-0892BizLibrary <= 1.1 - Admin+ Stored XSSBizLibrary
- CVE-2023-1915Thumbnail carousel slider < 1.1.10 - Reflected XSSThumbnail carousel slider
- CVE-2023-0762Clock In Portal <= 2.1 - Designation Deletion via CSRFClock In Portal- Staff & Attendance Management
- CVE-2023-23682WordPress EZP Maintenance Mode Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)Snap Creek Software EZP Maintenance Mode
- CVE-2023-23654WordPress SparkPost Plugin <= 3.2.5 is vulnerable to Cross Site Scripting (XSS)SparkPost
- CVE-2023-23683WordPress White Label Branding for Elementor Page Builder Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)Ozan Canakli White Label Branding for Elementor Page Builder
- CVE-2023-23674WordPress WP Original Media Path Plugin <= 2.4.0 is vulnerable to Cross Site Scripting (XSS)RVOLA WP Original Media Path
- CVE-2023-23688WordPress Social Share Boost Plugin <= 4.4 is vulnerable to Cross Site Scripting (XSS)Sumo Social Share Boost
- CVE-2023-22717WordPress FormCraft Plugin <= 1.2.6 is vulnerable to Cross Site Scripting (XSS)nCrafts FormCraft
- CVE-2023-31409Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 112252SICK AG SICK FTMG-ESD15AXX AIR FLOW SENSOR · SICK AG SIC… +5
- CVE-2023-31408Cleartext Storage of Sensitive Information in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 112252SICK AG SICK FTMG-ESD15AXX AIR FLOW SENSOR · SICK AG SIC… +5
- CVE-2023-23450Use of Password Hash Instead of Password for Authentication in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114SICK AG SICK FTMG-ESD15AXX AIR FLOW SENSOR · SICK AG SIC… +5
- CVE-2023-23449Observable Response Discrepancy in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 SICK AG SICK FTMG-ESD15AXX AIR FLOW SENSOR · SICK AG SIC… +5
- CVE-2023-23448Inclusion of Sensitive Information in Source Code in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116,SICK AG SICK FTMG-ESD15AXX AIR FLOW SENSOR · SICK AG SIC… +5
- CVE-2023-22690WordPress Ebook Store Plugin <= 5.775 is vulnerable to Cross Site Scripting (XSS)Shopfiles Ebook Store
- CVE-2023-22684WordPress Subscribers – Free Web Push Notifications Plugin <= 1.5.3 is vulnerable to Cross Site Scripting (XSS)Subscribers.com Subscribers
- CVE-2022-47393CODESYS: Multiple products prone to improperly restricted memory operationsCODESYS Control RTE · CODESYS Control Win +14
- CVE-2022-47392CODESYS: Multiple products prone to Improper Input ValidationCODESYS Control RTE · CODESYS Control Win +14
- CVE-2022-47378CODESYS: Multiple products prone to Improper Input ValidationCODESYS Control RTE · CODESYS Control Win +14
- CVE-2022-22508CODESYS V3: Improper Input ValidationCODESYS V3 CODESYS Control RTE · CODESYS V3 CODESYS Con… +11
- CVE-2023-1729A flaw was found in LibRaw.LibRaw
- CVE-2023-20673In vcu, there is a possible memory corruption due to type confusion.MediaTek MT5696, MT5836, MT5838, MT6768, MT6769, MT6779, MT…
- CVE-2023-20694In preloader, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6769, MT…
- CVE-2023-20695In preloader, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6835, MT6880, MT6886, MT6890, MT6980, MT6985, MT…
- CVE-2023-20696In preloader, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6880, MT6890, MT8167, MT8175, MT8185, MT8195, MT…
- CVE-2023-20697In keyinstall, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT…
- CVE-2023-20698In keyinstall, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT…
- CVE-2023-20699In adsp, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6895, MT6983, MT8781, MT8791, MT8791T, MT8797
- CVE-2023-20700In widevine, there is a possible out of bounds write due to a logic error.MediaTek MT6762, MT6765, MT6768, MT6769, MT6779, MT6781, MT…
- CVE-2023-20701In widevine, there is a possible out of bounds write due to a logic error.MediaTek MT6762, MT6765, MT6768, MT6769, MT6779, MT6781, MT…
- CVE-2023-20703In apu, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6853, MT6853T, MT6873, MT6875, MT6877, MT6879, M…
- CVE-2023-20704In apu, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6853, MT6853T, MT6873, MT6875, MT6877, MT6879, M…
- CVE-2023-20705In apu, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6853, MT6853T, MT6873, MT6875, MT6877, MT6879, M…
- CVE-2023-20706In apu, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6853, MT6853T, MT6873, MT6875, MT6877, MT6879, M…
- CVE-2023-20707In ril, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6735, MT6737, MT6739, MT6753, MT6757, MT6757C, M…
- CVE-2023-20708In keyinstall, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT…
- CVE-2023-20709In keyinstall, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT…
- CVE-2023-20710In keyinstall, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT…
- CVE-2023-20711In keyinstall, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT…
- CVE-2023-20717In vcu, there is a possible leak of dma buffer due to a race condition.MediaTek MT6768, MT6769, MT6779, MT6781, MT6785, MT6789, MT…
- CVE-2023-20718In vcu, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6768, MT6769, MT6779, MT6781, MT6785, MT6789, MT…
- CVE-2023-20719In pqframework, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6781, MT…
- CVE-2023-20720In pqframework, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6895, MT6983, MT8167, MT8168, MT8195, MT8673
- CVE-2023-20722In m4u, there is a possible out of bounds write due to improper input validation.MediaTek MT6765, MT6768, MT8768
- CVE-2023-20726In mnld, there is a possible leak of GPS location due to a missing permission check.MediaTek MT2731, MT2735, MT2737, MT6580, MT6739, MT6761, MT…
- CVE-2023-20914In onSetRuntimePermissionGrantStateByDeviceAdmin of AdminRestrictedPermissionsUtils.java, there is a possible way for the work profile to reAndroid
- CVE-2023-20930In pushDynamicShortcut of ShortcutPackage.java, there is a possible way to get the device into a boot loop due to resource exhaustion.Android
- CVE-2023-21103In registerPhoneAccount of PhoneAccountRegistrar.java, uncaught exceptions in parsing persisted user data could lead to local persistent denAndroid
- CVE-2023-21104In applySyncTransaction of WindowOrganizer.java, a missing permission check could lead to local information disclosure with no additional exAndroid
- CVE-2023-21111In several functions of PhoneAccountRegistrar.java, there is a possible way to prevent an access to emergency services due to improper inputAndroid
- CVE-2023-21112In AnalyzeMfcResp of NxpMfcReader.cc, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2023-21116In verifyReplacingVersionCode of InstallPackageHelper.java, there is a possible way to downgrade system apps below system image version due Android
- CVE-2023-21118In unflattenString8 of Sensor.cpp, there is a possible out of bounds read due to a heap buffer overflow.Android
- CVE-2023-2124An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure (with Kernel
- CVE-2023-2700A vulnerability was found in libvirt.libvirt
- CVE-2023-32787The OPC UA Legacy Java Stack before 6f176f2 enables an attacker to block OPC UA server applications via uncontrolled resource consumption so