# CVEs published 2023-05-15

147 CVEs were published on May 15, 2023: 10 critical, 65 high. Days are UTC.

- [CVE-2023-31131](https://cve.now/CVE-2023-31131.md): Arbitrary File Write when Extracting Tarballs in greenplum-db (CVSS 7.4, greenplum-db gpdb)
- [CVE-2023-31145](https://cve.now/CVE-2023-31145.md): Reflected XSS vulnerability in CollaboraOnline (CVSS 4.3, CollaboraOnline online)
- [CVE-2023-32068](https://cve.now/CVE-2023-32068.md): URL Redirection to Untrusted Site in XWiki (CVSS 4.7, xwiki-platform · org.xwiki.platform:xwiki-platform-oldcore)
- [CVE-2023-32308](https://cve.now/CVE-2023-32308.md): SQL Injection Vulnerability in anuko timetracker (CVSS 8.2, anuko timetracker)
- [CVE-2023-32309](https://cve.now/CVE-2023-32309.md): Arbitrary file inclusion with the pymdowm-snippets extension (CVSS 7.5, facelessuser pymdown-extensions · pymdown-extensions)
- [CVE-2023-32314](https://cve.now/CVE-2023-32314.md): Sandbox Escape (CVSS 9.8, patriksimek vm2 · vm2)
- [CVE-2023-32313](https://cve.now/CVE-2023-32313.md): Inspect method manipulation in vm2 (CVSS 5.3, patriksimek vm2 · vm2)
- [CVE-2023-0233](https://cve.now/CVE-2023-0233.md): ActiveCampaign \< 8.1.12 - Contributor+ Stored XSS (CVSS 5.4, ActiveCampaign)
- [CVE-2023-1835](https://cve.now/CVE-2023-1835.md): Ninja Forms \< 3.6.22 - Reflected XSS (CVSS 6.1, Ninja Forms Contact Form)
- [CVE-2023-1839](https://cve.now/CVE-2023-1839.md): Product Addons & Fields for WooCommerce \< 32.0.6 - Admin+ Stored Cross-Site Scripting (CVSS 4.8, Product Addons & Fields for WooCommerce)
- [CVE-2022-4774](https://cve.now/CVE-2022-4774.md): Bit Form \< 1.9 - RCE via Unauthenticated Arbitrary File Upload (CVSS 9.8, Bit Form)
- [CVE-2023-0761](https://cve.now/CVE-2023-0761.md): Clock In Portal \<= 2.1 - Staff Deletion via CSRF (CVSS 4.3, Clock In Portal- Staff & Attendance Management)
- [CVE-2023-1019](https://cve.now/CVE-2023-1019.md): Help Desk WP \<= 1.2.0 - Editor+ Stored XSS (CVSS 5.4, Help Desk WP)
- [CVE-2023-2009](https://cve.now/CVE-2023-2009.md): Pretty Url \<= 1.5.4 - Admin+ Stored XSS in plugin settings (CVSS 4.8, Pretty Url)
- [CVE-2023-1890](https://cve.now/CVE-2023-1890.md): Tablesome \< 1.0.9 - Reflected XSS (CVSS 6.1, Tablesome)
- [CVE-2023-0644](https://cve.now/CVE-2023-0644.md): PushAssist \<= 3.0.8 - Reflected Cross-Site Scripting (CVSS 6.1, Push Notifications for WordPress by PushAssist)
- [CVE-2023-0490](https://cve.now/CVE-2023-0490.md): f(x) TOC \<= 1.1.0 - Contributor+ Stored XSS (CVSS 5.4, f(x) TOC)
- [CVE-2023-0812](https://cve.now/CVE-2023-0812.md): Active Directory Integration / LDAP Integration \< 4.1.1 - Unauthenticated Data Disclosure (CVSS 7.5, Active Directory Integration / LDAP Integration)
- [CVE-2023-0520](https://cve.now/CVE-2023-0520.md): RapidExpCart \<= 1.0 - Stored XSS via CSRF (CVSS 5.4, RapidExpCart)
- [CVE-2023-0763](https://cve.now/CVE-2023-0763.md): Clock In Portal \<= 2.1 - Holidays Deletion via CSRF (CVSS 4.3, Clock In Portal- Staff & Attendance Management)
- [CVE-2023-1596](https://cve.now/CVE-2023-1596.md): tagDiv Composer \< 4.0 - Reflected Cross-site Scripting (CVSS 6.1, tagDiv Composer)
- [CVE-2023-2179](https://cve.now/CVE-2023-2179.md): WooCommerce Order Status Change Notifier \<= 1.1.0 - Subscriber+ Arbitrary Order Status Update (CVSS 6.5, WooCommerce Order Status Change Notifier)
- [CVE-2023-2180](https://cve.now/CVE-2023-2180.md): KIWIZ Invoices Certification & PDF System \<= 2.1.3 - Unauthenticated Arbitrary File Download (CVSS 7.5, KIWIZ Invoices Certification & PDF System)
- [CVE-2023-0892](https://cve.now/CVE-2023-0892.md): BizLibrary \<= 1.1 - Admin+ Stored XSS (CVSS 4.8, BizLibrary)
- [CVE-2023-1915](https://cve.now/CVE-2023-1915.md): Thumbnail carousel slider \< 1.1.10 - Reflected XSS (CVSS 6.1, Thumbnail carousel slider)
- [CVE-2023-0762](https://cve.now/CVE-2023-0762.md): Clock In Portal \<= 2.1 - Designation Deletion via CSRF (CVSS 4.3, Clock In Portal- Staff & Attendance Management)
- [CVE-2023-0600](https://cve.now/CVE-2023-0600.md): WP Visitor Statistics (Real Time Traffic) \< 6.9 - Unauthenticated SQLi (CVSS 9.8, WP Visitor Statistics)
- [CVE-2023-1549](https://cve.now/CVE-2023-1549.md): Ad Inserter \< 2.7.27 - Admin+ PHP Object Injection (CVSS 7.2, Ad Inserter)
- [CVE-2023-1207](https://cve.now/CVE-2023-1207.md): HTTP Headers \< 1.18.8 - Admin+ SQL Injection (CVSS 7.2, HTTP Headers)
- [CVE-2023-23682](https://cve.now/CVE-2023-23682.md): WordPress EZP Maintenance Mode Plugin \<= 1.0.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Snap Creek Software EZP Maintenance Mode)
- [CVE-2023-23654](https://cve.now/CVE-2023-23654.md): WordPress SparkPost Plugin \<= 3.2.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, SparkPost)
- [CVE-2023-23683](https://cve.now/CVE-2023-23683.md): WordPress White Label Branding for Elementor Page Builder Plugin \<= 1.0.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Ozan Canakli White Label Branding for Elementor Page Builder)
- [CVE-2023-23674](https://cve.now/CVE-2023-23674.md): WordPress WP Original Media Path Plugin \<= 2.4.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, RVOLA WP Original Media Path)
- [CVE-2023-23688](https://cve.now/CVE-2023-23688.md): WordPress Social Share Boost Plugin \<= 4.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Sumo Social Share Boost)
- [CVE-2023-22717](https://cve.now/CVE-2023-22717.md): WordPress FormCraft Plugin \<= 1.2.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, nCrafts FormCraft)
- [CVE-2023-22706](https://cve.now/CVE-2023-22706.md): WordPress PropertyHive Plugin \<= 1.5.48 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, PropertyHive)
- [CVE-2023-31409](https://cve.now/CVE-2023-31409.md): Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 112252 (CVSS 5.3, SICK AG SICK FTMG-ESD15AXX AIR FLOW SENSOR · SICK AG SIC… +5)
- [CVE-2023-31408](https://cve.now/CVE-2023-31408.md): Cleartext Storage of Sensitive Information in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 112252 (CVSS 5.3, SICK AG SICK FTMG-ESD15AXX AIR FLOW SENSOR · SICK AG SIC… +5)
- [CVE-2023-23450](https://cve.now/CVE-2023-23450.md): Use of Password Hash Instead of Password for Authentication in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114 (CVSS 6.2, SICK AG SICK FTMG-ESD15AXX AIR FLOW SENSOR · SICK AG SIC… +5)
- [CVE-2023-23449](https://cve.now/CVE-2023-23449.md): Observable Response Discrepancy in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 (CVSS 5.3, SICK AG SICK FTMG-ESD15AXX AIR FLOW SENSOR · SICK AG SIC… +5)
- [CVE-2023-23448](https://cve.now/CVE-2023-23448.md): Inclusion of Sensitive Information in Source Code in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, (CVSS 5.3, SICK AG SICK FTMG-ESD15AXX AIR FLOW SENSOR · SICK AG SIC… +5)
- [CVE-2023-23447](https://cve.now/CVE-2023-23447.md): Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 112252 (CVSS 7.5, SICK AG SICK FTMG-ESD15AXX AIR FLOW SENSOR · SICK AG SIC… +5)
- [CVE-2023-23446](https://cve.now/CVE-2023-23446.md): Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a (CVSS 7.5, SICK AG SICK FTMG-ESD15AXX AIR FLOW SENSOR · SICK AG SIC… +5)
- [CVE-2023-23445](https://cve.now/CVE-2023-23445.md): Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a (CVSS 7.5, SICK AG SICK FTMG-ESD15AXX AIR FLOW SENSOR · SICK AG SIC… +5)
- [CVE-2023-22703](https://cve.now/CVE-2023-22703.md): WordPress WCP Contact Form Plugin \<= 3.1.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Webcodin WCP Contact Form)
- [CVE-2023-22690](https://cve.now/CVE-2023-22690.md): WordPress Ebook Store Plugin \<= 5.775 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Shopfiles Ebook Store)
- [CVE-2023-22684](https://cve.now/CVE-2023-22684.md): WordPress Subscribers – Free Web Push Notifications Plugin \<= 1.5.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Subscribers.com Subscribers)
- [CVE-2022-47393](https://cve.now/CVE-2022-47393.md): CODESYS: Multiple products prone to improperly restricted memory operations (CVSS 6.5, CODESYS Control RTE · CODESYS Control Win +14)
- [CVE-2022-47392](https://cve.now/CVE-2022-47392.md): CODESYS: Multiple products prone to Improper Input Validation (CVSS 6.5, CODESYS Control RTE · CODESYS Control Win +14)
- [CVE-2022-47391](https://cve.now/CVE-2022-47391.md): CODESYS: Multiple products prone to Improper Input Validation (CVSS 7.5, CODESYS Control RTE · CODESYS Control Win +17)
- [CVE-2022-47390](https://cve.now/CVE-2022-47390.md): CODESYS: Multiple products prone to stack based out-of-bounds write (CVSS 8.8, CODESYS Control RTE · CODESYS Control Win +14)
- [CVE-2022-47389](https://cve.now/CVE-2022-47389.md): CODESYS: Multiple products prone to stack based out-of-bounds write (CVSS 8.8, CODESYS Control RTE · CODESYS Control Win +14)
- [CVE-2022-47388](https://cve.now/CVE-2022-47388.md): CODESYS: Multiple products prone to stack based out-of-bounds write (CVSS 8.8, CODESYS Control RTE · CODESYS Control Win +14)
- [CVE-2022-47387](https://cve.now/CVE-2022-47387.md): CODESYS: Multiple products prone to stack based out-of-bounds write (CVSS 8.8, CODESYS Control RTE · CODESYS Control Win +14)
- [CVE-2022-47386](https://cve.now/CVE-2022-47386.md): CODESYS: Multiple products prone to stack based out-of-bounds write (CVSS 8.8, CODESYS Control RTE · CODESYS Control Win +14)
- [CVE-2022-47385](https://cve.now/CVE-2022-47385.md): CODESYS: Multiple products prone to stack based out-of-bounds write (CVSS 8.8, CODESYS Control RTE · CODESYS Control Win +14)
- [CVE-2022-47384](https://cve.now/CVE-2022-47384.md): CODESYS: Multiple products prone to stack based out-of-bounds write (CVSS 8.8, CODESYS Control RTE · CODESYS Control Win +14)
- [CVE-2022-47383](https://cve.now/CVE-2022-47383.md): CODESYS: Multiple products prone to stack based out-of-bounds write (CVSS 8.8, CODESYS Control RTE · CODESYS Control Win +14)
- [CVE-2022-47382](https://cve.now/CVE-2022-47382.md): CODESYS: Multiple products prone to stack based out-of-bounds write (CVSS 8.8, CODESYS Control RTE · CODESYS Control Win +14)
- [CVE-2022-47381](https://cve.now/CVE-2022-47381.md): CODESYS: Multiple products prone to stack based out-of-bounds write (CVSS 8.8, CODESYS Control RTE · CODESYS Control Win +14)
- [CVE-2022-47380](https://cve.now/CVE-2022-47380.md): CODESYS: Multiple products prone to out-of-bounds write (CVSS 8.8, CODESYS Control RTE · CODESYS Control Win +14)
- [CVE-2022-47379](https://cve.now/CVE-2022-47379.md): CODESYS: Multiple products prone to out-of-bounds write (CVSS 8.8, CODESYS Control RTE · CODESYS Control Win +14)
- [CVE-2022-47378](https://cve.now/CVE-2022-47378.md): CODESYS: Multiple products prone to Improper Input Validation (CVSS 6.5, CODESYS Control RTE · CODESYS Control Win +14)
- [CVE-2022-22508](https://cve.now/CVE-2022-22508.md): CODESYS V3: Improper Input Validation (CVSS 4.3, CODESYS V3 CODESYS Control RTE · CODESYS V3 CODESYS Con… +11)
- [CVE-2022-4048](https://cve.now/CVE-2022-4048.md): CODESYS V3 prone to Inadequate Encryption Stregth (CVSS 7.7, CODESYS Development System)
- [CVE-2022-47937](https://cve.now/CVE-2022-47937.md): Multiple parsing problems in the Apache Sling Commons JSON module (CVSS 9.8, Apache Software Foundation org.apache.sling.commons.json ·…)
- [CVE-2023-1698](https://cve.now/CVE-2023-1698.md): WAGO: WBM Command Injection in multiple products (CVSS 9.8, WAGO Compact Controller CC100 · WAGO Edge Controller +5)
- [CVE-2023-22318](https://cve.now/CVE-2023-22318.md): Denial of service against webconf (CVSS 7.5, Tribe29 Checkmk Appliance)
- [CVE-2021-0877](https://cve.now/CVE-2021-0877.md): Product: AndroidVersions: Android SoCAndroid ID: A-273754094 (CVSS 9.8, Android)
- [CVE-2023-1729](https://cve.now/CVE-2023-1729.md): A flaw was found in LibRaw. (no CVSS, LibRaw)
- [CVE-2023-20673](https://cve.now/CVE-2023-20673.md): In vcu, there is a possible memory corruption due to type confusion. (CVSS 6.7, MediaTek MT5696, MT5836, MT5838, MT6768, MT6769, MT6779, MT…)
- [CVE-2023-20694](https://cve.now/CVE-2023-20694.md): In preloader, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6769, MT…)
- [CVE-2023-20695](https://cve.now/CVE-2023-20695.md): In preloader, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6835, MT6880, MT6886, MT6890, MT6980, MT6985, MT…)
- [CVE-2023-20696](https://cve.now/CVE-2023-20696.md): In preloader, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6880, MT6890, MT8167, MT8175, MT8185, MT8195, MT…)
- [CVE-2023-20697](https://cve.now/CVE-2023-20697.md): In keyinstall, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, MediaTek MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT…)
- [CVE-2023-20698](https://cve.now/CVE-2023-20698.md): In keyinstall, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, MediaTek MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT…)
- [CVE-2023-20699](https://cve.now/CVE-2023-20699.md): In adsp, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6895, MT6983, MT8781, MT8791, MT8791T, MT8797)
- [CVE-2023-20700](https://cve.now/CVE-2023-20700.md): In widevine, there is a possible out of bounds write due to a logic error. (CVSS 6.7, MediaTek MT6762, MT6765, MT6768, MT6769, MT6779, MT6781, MT…)
- [CVE-2023-20701](https://cve.now/CVE-2023-20701.md): In widevine, there is a possible out of bounds write due to a logic error. (CVSS 6.7, MediaTek MT6762, MT6765, MT6768, MT6769, MT6779, MT6781, MT…)
- [CVE-2023-20703](https://cve.now/CVE-2023-20703.md): In apu, there is a possible out of bounds read due to a missing bounds check. (CVSS 5.5, MediaTek MT6853, MT6853T, MT6873, MT6875, MT6877, MT6879, M…)
- [CVE-2023-20704](https://cve.now/CVE-2023-20704.md): In apu, there is a possible out of bounds read due to a missing bounds check. (CVSS 5.5, MediaTek MT6853, MT6853T, MT6873, MT6875, MT6877, MT6879, M…)
- [CVE-2023-20705](https://cve.now/CVE-2023-20705.md): In apu, there is a possible out of bounds read due to a missing bounds check. (CVSS 5.5, MediaTek MT6853, MT6853T, MT6873, MT6875, MT6877, MT6879, M…)
- [CVE-2023-20706](https://cve.now/CVE-2023-20706.md): In apu, there is a possible out of bounds read due to a missing bounds check. (CVSS 5.5, MediaTek MT6853, MT6853T, MT6873, MT6875, MT6877, MT6879, M…)
- [CVE-2023-20707](https://cve.now/CVE-2023-20707.md): In ril, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6735, MT6737, MT6739, MT6753, MT6757, MT6757C, M…)
- [CVE-2023-20708](https://cve.now/CVE-2023-20708.md): In keyinstall, there is a possible out of bounds read due to a missing bounds check. (CVSS 6.7, MediaTek MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT…)
- [CVE-2023-20709](https://cve.now/CVE-2023-20709.md): In keyinstall, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, MediaTek MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT…)
- [CVE-2023-20710](https://cve.now/CVE-2023-20710.md): In keyinstall, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, MediaTek MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT…)
- [CVE-2023-20711](https://cve.now/CVE-2023-20711.md): In keyinstall, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, MediaTek MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT…)
- [CVE-2023-20717](https://cve.now/CVE-2023-20717.md): In vcu, there is a possible leak of dma buffer due to a race condition. (CVSS 4.1, MediaTek MT6768, MT6769, MT6779, MT6781, MT6785, MT6789, MT…)
- [CVE-2023-20718](https://cve.now/CVE-2023-20718.md): In vcu, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6768, MT6769, MT6779, MT6781, MT6785, MT6789, MT…)
- [CVE-2023-20719](https://cve.now/CVE-2023-20719.md): In pqframework, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6781, MT…)
- [CVE-2023-20720](https://cve.now/CVE-2023-20720.md): In pqframework, there is a possible out of bounds read due to a missing bounds check. (CVSS 6.7, MediaTek MT6895, MT6983, MT8167, MT8168, MT8195, MT8673)
- [CVE-2023-20721](https://cve.now/CVE-2023-20721.md): In isp, there is a possible out of bounds write due to improper input validation. (CVSS 8.4, MediaTek MT6879, MT6895, MT6983, MT8195, MT8395, MT8673)
- [CVE-2023-20722](https://cve.now/CVE-2023-20722.md): In m4u, there is a possible out of bounds write due to improper input validation. (CVSS 6.7, MediaTek MT6765, MT6768, MT8768)
- [CVE-2023-20726](https://cve.now/CVE-2023-20726.md): In mnld, there is a possible leak of GPS location due to a missing permission check. (CVSS 3.3, MediaTek MT2731, MT2735, MT2737, MT6580, MT6739, MT6761, MT…)
- [CVE-2023-20914](https://cve.now/CVE-2023-20914.md): In onSetRuntimePermissionGrantStateByDeviceAdmin of AdminRestrictedPermissionsUtils.java, there is a possible way for the work profile to re (CVSS 5.5, Android)
- [CVE-2023-20930](https://cve.now/CVE-2023-20930.md): In pushDynamicShortcut of ShortcutPackage.java, there is a possible way to get the device into a boot loop due to resource exhaustion. (CVSS 5.5, Android)
- [CVE-2023-21102](https://cve.now/CVE-2023-21102.md): In \_\_efi\_rt\_asm\_wrapper of efi-rt-wrapper.S, there is a possible bypass of shadow stack protection due to a logic error in the code. (CVSS 7.8, Android)
- [CVE-2023-21103](https://cve.now/CVE-2023-21103.md): In registerPhoneAccount of PhoneAccountRegistrar.java, uncaught exceptions in parsing persisted user data could lead to local persistent den (CVSS 5.5, Android)
- [CVE-2023-21104](https://cve.now/CVE-2023-21104.md): In applySyncTransaction of WindowOrganizer.java, a missing permission check could lead to local information disclosure with no additional ex (CVSS 5.5, Android)
- [CVE-2023-21106](https://cve.now/CVE-2023-21106.md): In adreno\_set\_param of adreno\_gpu.c, there is a possible memory corruption due to a double free. (CVSS 7.8, Android)
- [CVE-2023-21107](https://cve.now/CVE-2023-21107.md): In retrieveAppEntry of NotificationAccessDetails.java, there is a missing permission check. (CVSS 7.8, Android)
- [CVE-2023-21109](https://cve.now/CVE-2023-21109.md): In multiple places of AccessibilityService, there is a possible way to hide the app from the user due to a logic error in the code. (CVSS 7.8, Android)
- [CVE-2023-21110](https://cve.now/CVE-2023-21110.md): In several functions of SnoozeHelper.java, there is a possible way to grant notifications access due to resource exhaustion. (CVSS 7.8, Android)
- [CVE-2023-21111](https://cve.now/CVE-2023-21111.md): In several functions of PhoneAccountRegistrar.java, there is a possible way to prevent an access to emergency services due to improper input (CVSS 6.2, Android)
- [CVE-2023-21112](https://cve.now/CVE-2023-21112.md): In AnalyzeMfcResp of NxpMfcReader.cc, there is a possible out of bounds read due to a missing bounds check. (CVSS 5.5, Android)
- [CVE-2023-21116](https://cve.now/CVE-2023-21116.md): In verifyReplacingVersionCode of InstallPackageHelper.java, there is a possible way to downgrade system apps below system image version due (CVSS 6.7, Android)
- [CVE-2023-21117](https://cve.now/CVE-2023-21117.md): In registerReceiverWithFeature of ActivityManagerService.java, there is a possible way for isolated processes to register a broadcast receiv (CVSS 8.4, Android)
- [CVE-2023-21118](https://cve.now/CVE-2023-21118.md): In unflattenString8 of Sensor.cpp, there is a possible out of bounds read due to a heap buffer overflow. (CVSS 6.2, Android)
- [CVE-2023-2124](https://cve.now/CVE-2023-2124.md): An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure (with (no CVSS, Kernel)
- [CVE-2023-2700](https://cve.now/CVE-2023-2700.md): A vulnerability was found in libvirt. (CVSS 5.5, libvirt)
- [CVE-2023-29861](https://cve.now/CVE-2023-29861.md): An issue found in FLIR-DVTEL version not specified allows a remote attacker to execute arbitrary code via a crafted request to the managemen (CVSS 9.8)
- [CVE-2023-29862](https://cve.now/CVE-2023-29862.md): An issue found in Agasio-Camera device version not specified allows a remote attacker to execute arbitrary code via the check and authLevel (CVSS 9.8)
- [CVE-2023-30245](https://cve.now/CVE-2023-30245.md): SQL injection vulnerability found in Judging Management System v.1.0 allows a remote attacker to execute arbitrary code via the crit\_id para (CVSS 9.8)
- [CVE-2023-31607](https://cve.now/CVE-2023-31607.md): An issue in the \_\_libc\_malloc component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via craft (CVSS 7.5)
- [CVE-2023-31608](https://cve.now/CVE-2023-31608.md): An issue in the artm\_div\_int component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafte (CVSS 7.5)
- [CVE-2023-31609](https://cve.now/CVE-2023-31609.md): An issue in the dfe\_unit\_col\_loci component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via c (CVSS 7.5)
- [CVE-2023-31610](https://cve.now/CVE-2023-31610.md): An issue in the \_IO\_default\_xsputn component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via (CVSS 7.5)
- [CVE-2023-31611](https://cve.now/CVE-2023-31611.md): An issue in the \_\_libc\_longjmp component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via craf (CVSS 7.5)
- [CVE-2023-31612](https://cve.now/CVE-2023-31612.md): An issue in the dfe\_qexp\_list component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via craft (CVSS 7.5)
- [CVE-2023-31613](https://cve.now/CVE-2023-31613.md): An issue in the \_\_nss\_database\_lookup component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) v (CVSS 7.5)
- [CVE-2023-31614](https://cve.now/CVE-2023-31614.md): An issue in the mp\_box\_deserialize\_string function in openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS (CVSS 7.5)
- [CVE-2023-31615](https://cve.now/CVE-2023-31615.md): An issue in the chash\_array component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted (CVSS 7.5)
- [CVE-2023-31616](https://cve.now/CVE-2023-31616.md): An issue in the bif\_mod component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL (CVSS 7.5)
- [CVE-2023-31617](https://cve.now/CVE-2023-31617.md): An issue in the dk\_set\_delete component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via craft (CVSS 7.5)
- [CVE-2023-31618](https://cve.now/CVE-2023-31618.md): An issue in the sqlc\_union\_dt\_wrap component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via (CVSS 7.5)
- [CVE-2023-31619](https://cve.now/CVE-2023-31619.md): An issue in the sch\_name\_to\_object component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via (CVSS 7.5)
- [CVE-2023-31620](https://cve.now/CVE-2023-31620.md): An issue in the dv\_compare component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted (CVSS 7.5)
- [CVE-2023-31621](https://cve.now/CVE-2023-31621.md): An issue in the kc\_var\_col component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted (CVSS 7.5)
- [CVE-2023-31622](https://cve.now/CVE-2023-31622.md): An issue in the sqlc\_make\_policy\_trig component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) v (CVSS 7.5)
- [CVE-2023-31623](https://cve.now/CVE-2023-31623.md): An issue in the mp\_box\_copy component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted (CVSS 7.5)
- [CVE-2023-31624](https://cve.now/CVE-2023-31624.md): An issue in the sinv\_check\_exp component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via craf (CVSS 7.5)
- [CVE-2023-31625](https://cve.now/CVE-2023-31625.md): An issue in the psiginfo component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQ (CVSS 7.5)
- [CVE-2023-31626](https://cve.now/CVE-2023-31626.md): An issue in the gpf\_notice component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted (CVSS 7.5)
- [CVE-2023-31627](https://cve.now/CVE-2023-31627.md): An issue in the strhash component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL (CVSS 7.5)
- [CVE-2023-31628](https://cve.now/CVE-2023-31628.md): An issue in the stricmp component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL (CVSS 7.5)
- [CVE-2023-31629](https://cve.now/CVE-2023-31629.md): An issue in the sqlo\_union\_scope component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via cr (CVSS 7.5)
- [CVE-2023-31630](https://cve.now/CVE-2023-31630.md): An issue in the sqlo\_query\_spec component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via cra (CVSS 7.5)
- [CVE-2023-31631](https://cve.now/CVE-2023-31631.md): An issue in the sqlo\_preds\_contradiction component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS (CVSS 7.5)
- [CVE-2023-31842](https://cve.now/CVE-2023-31842.md): Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/index.php?page=edit\_faculty&id=. (CVSS 7.2)
- [CVE-2023-31843](https://cve.now/CVE-2023-31843.md): Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/view\_faculty.php?id=. (CVSS 7.2)
- [CVE-2023-31844](https://cve.now/CVE-2023-31844.md): Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/manage\_subject.php?id=. (CVSS 7.2)
- [CVE-2023-31845](https://cve.now/CVE-2023-31845.md): Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/manage\_class.php?id=. (CVSS 7.2)
- [CVE-2023-31986](https://cve.now/CVE-2023-31986.md): A Command Injection vulnerability in Edimax Wireless Router N300 Firmware BR-6428NS\_v4 allows attacker to execute arbitrary code via the set (CVSS 9.8)
- [CVE-2023-32758](https://cve.now/CVE-2023-32758.md): giturlparse (aka git-url-parse) through 1.2.2, as used in Semgrep 1.5.2 through 1.24.1, is vulnerable to ReDoS (Regular Expression Denial of (CVSS 7.5, git-url-parse)
- [CVE-2023-32784](https://cve.now/CVE-2023-32784.md): In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace is locked or n (CVSS 7.5)
- [CVE-2023-32787](https://cve.now/CVE-2023-32787.md): The OPC UA Legacy Java Stack before 6f176f2 enables an attacker to block OPC UA server applications via uncontrolled resource consumption so (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-05-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.