CVEs published May 16, 2023
94 CVEs were published on May 16, 2023: 10 critical, 32 high.
- Published
- 94
- Critical
- 10
- High
- 32
- Medium
- 49
- Low
- 2
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 39
Most affected products
- Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- 10
- Google Chrome
- 6
- Jenkins Project Jenkins SAML Single Sign On(SSO) Plugin · i…
- 6
- Jenkins Code Dx Plugin · org.jenkins-ci.plugins:codedx
- 5
- Jenkins Project Jenkins Azure VM Agents Plugin · org.jenkin…
- 3
- Jenkins Project Jenkins Ansible Plugin · org.jenkins-ci.plu…
- 2
- Jenkins Project Jenkins AppSpider Plugin · com.rapid7:jenki…
- 2
- Jenkins Project Jenkins Email Extension Plugin · org.jenkin…
- 2
- Jenkins Project Jenkins Tag Profiler Plugin · org.jenkins-c…
- 2
- Jenkins Project Jenkins WSO2 Oauth Plugin · org.jenkins-ci.…
- 2
Critical 10
- CVE-2023-2499RegistrationMagic <= 5.2.1.0 - Authentication Bypassmetagauss RegistrationMagic – Custom Registration Forms, Us…
- CVE-2023-32956Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in CGI component in Synology RouterSynology Router Manager
- CVE-2023-27742IDURAR ERP/CRM v1 was discovered to contain a SQL injection vulnerability via the component /api/login.
- CVE-2023-29961D-Link DIR-605L firmware version 1.17B01 BETA is vulnerable to stack overflow via /goform/formTcpipSetup,
- CVE-2023-30189Prestashop posstaticblocks <= 1.0.0 is vulnerable to SQL Injection via posstaticblocks::getPosCurrentHook().
- CVE-2023-31519Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the email parameter at login_core.php.
- CVE-2023-31587Tenda AC5 router V15.03.06.28 was discovered to contain a remote code execution (RCE) vulnerability via the Mac parameter at ip/goform/Write
- CVE-2023-31856A command injection vulnerability in the hostTime parameter in the function NTPSyncWithHostof TOTOLINK CP300+ V5.2cu.7594_B20200910 allows a
- CVE-2023-31857Sourcecodester Online Computer and Laptop Store 1.0 allows unrestricted file upload and can lead to remote code execution.
- CVE-2023-31890An XML Deserialization vulnerability in glazedlists v1.11.0 allows an attacker to execute arbitrary code via the BeanXMLByteCoder.decode() pcom.glazedlists:glazedlists
High 32
- CVE-2023-30506Authenticated Remote Code Execution in Aruba EdgeConnect Enterprise Command Line InterfaceHewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- CVE-2023-30505Authenticated Remote Code Execution in Aruba EdgeConnect Enterprise Command Line InterfaceHewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- CVE-2023-30504Authenticated Remote Code Execution in Aruba EdgeConnect Enterprise Command Line InterfaceHewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- CVE-2023-30503Authenticated Remote Code Execution in Aruba EdgeConnect Enterprise Command Line InterfaceHewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- CVE-2023-30502Authenticated Remote Code Execution in Aruba EdgeConnect Enterprise Command Line InterfaceHewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- CVE-2023-30501Authenticated Remote Code Execution in Aruba EdgeConnect Enterprise Command Line InterfaceHewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- CVE-2023-2726Inappropriate implementation in WebApp Installs in Google Chrome prior to 113.0.5672.126 allowed an attacker who convinced a user to installGoogle Chrome
- CVE-2023-2725Use after free in Guest View in Google Chrome prior to 113.0.5672.126 allowed an attacker who convinced a user to install a malicious extensGoogle Chrome
- CVE-2023-2724Type confusion in V8 in Google Chrome prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap corruption via a craftedGoogle Chrome
- CVE-2023-2723Use after free in DevTools in Google Chrome prior to 113.0.5672.126 allowed a remote attacker who had compromised the renderer process to poGoogle Chrome
- CVE-2023-2722Use after free in Autofill UI in Google Chrome on Android prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap corrGoogle Chrome
- CVE-2023-2721Use after free in Navigation in Google Chrome prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap corruption via aGoogle Chrome
- CVE-2023-33001Jenkins HashiCorp Vault Plugin 360.v0a_1c04cf807d and earlier does not properly mask (i.e., replace with asterisks) credentials in the buildJenkins Project Jenkins HashiCorp Vault Plugin · com.datapi…
- CVE-2023-33000Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.149 and earlier does not mask credentials displayed on the configuration form, Jenkins Project Jenkins NS-ND Integration Performance Publi…
- CVE-2023-32998A cross-site request forgery (CSRF) vulnerability in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers to connect to an attacker-Jenkins Project Jenkins AppSpider Plugin · com.rapid7:jenki…
- CVE-2023-32997Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the previous session on login.Jenkins Project Jenkins CAS Plugin · org.jenkins-ci.plugins…
- CVE-2023-32995A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers to send an HJenkins Project Jenkins SAML Single Sign On(SSO) Plugin · i…
- CVE-2023-32992Missing permission checks in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allow attackers with Overall/Read permission to send Jenkins Project Jenkins SAML Single Sign On(SSO) Plugin · i…
- CVE-2023-32991A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allows attackers to send an HJenkins Project Jenkins SAML Single Sign On(SSO) Plugin · i…
- CVE-2023-32989A cross-site request forgery (CSRF) vulnerability in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers to conneJenkins Project Jenkins Azure VM Agents Plugin · org.jenkin…
- CVE-2023-32987A cross-site request forgery (CSRF) vulnerability in Jenkins Reverse Proxy Auth Plugin 1.7.4 and earlier allows attackers to connect to an aJenkins Project Jenkins Reverse Proxy Auth Plugin · org.jen…
- CVE-2023-32986Jenkins File Parameter Plugin 285.v757c5b_67a_c25 and earlier does not restrict the name (and resulting uploaded file name) of Stashed File Jenkins Project Jenkins File Parameter Plugin · io.jenkins.…
- CVE-2023-32981An arbitrary file write vulnerability in Jenkins Pipeline Utility Steps Plugin 2.15.2 and earlier allows attackers able to provide crafted aJenkins Project Jenkins Pipeline Utility Steps Plugin · org…
- CVE-2023-29439WordPress FooGallery Plugin <= 2.2.35 is vulnerable to Cross Site Scripting (XSS)FooPlugins FooGallery
- CVE-2023-32955Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DHCP Client Functionality in SynSynology Router Manager
- CVE-2023-25394Videostream macOS app 0.5.0 and 0.4.3 has a Race Condition.
- CVE-2023-30281Insecure permissions vulnerability was discovered, due to a lack of permissions’s control in scquickaccounting before v3.7.3 from Store Comm
- CVE-2023-31572An issue in Bludit 4.0.0-rc-2 allows authenticated attackers to change the Administrator password and escalate privileges via a crafted requ
- CVE-2023-31576An arbitrary file upload vulnerability in Serendipity 2.4-beta1 allows attackers to execute arbitrary code via a crafted HTML or Javascript
- CVE-2023-31677Insecure permissions in luowice 3.5.18 allow attackers to view information for other alarm devices via modification of the eseeid parameter.
- CVE-2023-31679Incorrect access control in Videogo v6.8.1 allows attackers to access images from other devices via modification of the Device Id parameter.
- CVE-2023-31848davinci 0.3.0-rc is vulnerable to Server-side request forgery (SSRF).
Medium, low and unrated 52
- CVE-2023-2528Contact Form by Supsystic <= 1.7.24 - Cross-Site Request Forgery via AJAX actionsupsysticcom Contact Form by Supsystic
- CVE-2023-30510Authenticated Server-side Request Forgery in Aruba EdgeConnect Enterprise Web Management InterfaceHewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- CVE-2023-30509Authenticated Remote Path Traversal in Aruba EdgeConnect Enterprise Command Line InterfaceHewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- CVE-2023-30508Authenticated Remote Path Traversal in Aruba EdgeConnect Enterprise Command Line InterfaceHewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- CVE-2023-30507Authenticated Remote Path Traversal in Aruba EdgeConnect Enterprise Command Line InterfaceHewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- CVE-2023-2631CSRF vulnerability and missing permission checks in Code Dx Plugin Jenkins Code Dx Plugin · org.jenkins-ci.plugins:codedx
- CVE-2023-2195CSRF vulnerability and missing permission checks in Code Dx Plugin Jenkins Code Dx Plugin · org.jenkins-ci.plugins:codedx
- CVE-2023-2633API keys stored and displayed in plain text by Code Dx Plugin Jenkins Code Dx Plugin · org.jenkins-ci.plugins:codedx
- CVE-2023-2632API keys stored and displayed in plain text by Code Dx Plugin Jenkins Code Dx Plugin · org.jenkins-ci.plugins:codedx
- CVE-2023-2196Missing permission checks in Code Dx Plugin Jenkins Code Dx Plugin · org.jenkins-ci.plugins:codedx
- CVE-2023-2740SourceCodester Guest Management System GET Parameter dateTest.php cross site scriptingSourceCodester Guest Management System
- CVE-2023-33007Jenkins LoadComplete support Plugin 1.0 and earlier does not escape the LoadComplete test name, resulting in a stored cross-site scripting (Jenkins Project Jenkins LoadComplete support Plugin · org.j…
- CVE-2023-33006A cross-site request forgery (CSRF) vulnerability in Jenkins WSO2 Oauth Plugin 1.0 and earlier allows attackers to trick users into logging Jenkins Project Jenkins WSO2 Oauth Plugin · org.jenkins-ci.…
- CVE-2023-33005Jenkins WSO2 Oauth Plugin 1.0 and earlier does not invalidate the previous session on login.Jenkins Project Jenkins WSO2 Oauth Plugin · org.jenkins-ci.…
- CVE-2023-33004A missing permission check in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers with Overall/Read permission to reset profiler stJenkins Project Jenkins Tag Profiler Plugin · org.jenkins-c…
- CVE-2023-33003A cross-site request forgery (CSRF) vulnerability in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers to reset profiler statistiJenkins Project Jenkins Tag Profiler Plugin · org.jenkins-c…
- CVE-2023-33002Jenkins TestComplete support Plugin 2.8.1 and earlier does not escape the TestComplete project name, resulting in a stored cross-site scriptJenkins Project Jenkins TestComplete support Plugin · org.j…
- CVE-2023-32999A missing permission check in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers with Overall/Read permission to connect to an attJenkins Project Jenkins AppSpider Plugin · com.rapid7:jenki…
- CVE-2023-32996A missing permission check in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers with Overall/Read permission to senJenkins Project Jenkins SAML Single Sign On(SSO) Plugin · i…
- CVE-2023-32994Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOraJenkins Project Jenkins SAML Single Sign On(SSO) Plugin · i…
- CVE-2023-32993Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configurJenkins Project Jenkins SAML Single Sign On(SSO) Plugin · i…
- CVE-2023-32990A missing permission check in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers with Overall/Read permission toJenkins Project Jenkins Azure VM Agents Plugin · org.jenkin…
- CVE-2023-32988A missing permission check in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers with Overall/Read permission toJenkins Project Jenkins Azure VM Agents Plugin · org.jenkin…
- CVE-2023-32985Jenkins Sidebar Link Plugin 2.2.1 and earlier does not restrict the path of files in a method implementing form validation, allowing attackeJenkins Project Jenkins Sidebar Link Plugin · org.jenkins-c…
- CVE-2023-32984Jenkins TestNG Results Plugin 730.v4c5283037693 and earlier does not escape several values that are parsed from TestNG report files and dispJenkins Project Jenkins TestNG Results Plugin · org.jenkins…
- CVE-2023-32983Jenkins Ansible Plugin 204.v8191fd551eb_f and earlier does not mask extra variables displayed on the configuration form, increasing the poteJenkins Project Jenkins Ansible Plugin · org.jenkins-ci.plu…
- CVE-2023-32982Jenkins Ansible Plugin 204.v8191fd551eb_f and earlier stores extra variables unencrypted in job config.xml files on the Jenkins controller wJenkins Project Jenkins Ansible Plugin · org.jenkins-ci.plu…
- CVE-2023-32980A cross-site request forgery (CSRF) vulnerability in Jenkins Email Extension Plugin allows attackers to make another user stop watching an aJenkins Project Jenkins Email Extension Plugin · org.jenkin…
- CVE-2023-32979Jenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with OverallJenkins Project Jenkins Email Extension Plugin · org.jenkin…
- CVE-2023-32978A cross-site request forgery (CSRF) vulnerability in Jenkins LDAP Plugin allows attackers to connect to an attacker-specified LDAP server usJenkins Project Jenkins LDAP Plugin · org.jenkins-ci.plugin…
- CVE-2023-32977Jenkins Pipeline: Job Plugin does not escape the display name of the build that caused an earlier build to be aborted, resulting in a storedJenkins Project Jenkins Pipeline: Job Plugin · org.jenkins-…
- CVE-2023-2739Gira HomeServer hslist cross site scriptingGira HomeServer
- CVE-2023-28076 CloudLink 7.1.2 and all prior versions contain a broken or risky cryptographic algorithm vulnerability.Dell CloudLink
- CVE-2023-2738Tongda OA GatewayController.php actionGetdata unrestricted uploadTongda OA
- CVE-2023-23703WordPress Arconix Shortcodes Plugin <= 2.1.7 is vulnerable to Cross Site Scripting (XSS)Tyche Softwares Arconix Shortcodes
- CVE-2023-23709WordPress WPJAM Basic Plugin <= 6.2.1 is vulnerable to Cross Site Scripting (XSS)Denis WPJAM Basic
- CVE-2023-23720WordPress Verified Reviews (Avis Vérifiés) Plugin <= 2.3.13 is vulnerable to Cross Site Scripting (XSS)NetReviews SAS Verified Reviews
- CVE-2023-23657WordPress Mail Subscribe List Plugin <= 2.1.9 is vulnerable to Cross Site Scripting (XSS)Richard Leishman t/a Webforward Mail Subscribe List
- CVE-2023-23641WordPress Uji Popup Plugin <= 1.4.3 is vulnerable to Cross Site Scripting (XSS)WPmanage Uji Popup
- CVE-2023-23727WordPress Live Chat by Formilla – Real-time Chat & Chatbots Plugin Plugin <= 1.3 is vulnerable to Cross Site Scripting (XSS)Live Chat by Formilla
- CVE-2023-2548RegistrationMagic <= 5.2.0.5 - Authenticated (Admin+) Insecure Direct Object Reference to Arbitrary User Password Changemetagauss RegistrationMagic – Custom Registration Forms, Us…
- CVE-2023-23676WordPress File Gallery Plugin <= 1.8.5.3 is vulnerable to Cross Site Scripting (XSS)Bruno "Aesqe" Babic File Gallery
- CVE-2023-23673WordPress I Recommend This Plugin <= 3.8.3 is vulnerable to Cross Site Scripting (XSS)Harish Chouhan, Themeist I Recommend This
- CVE-2023-2161 A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized read access to the fileSchneider Electric OPC Factory Server
- CVE-2023-2710video carousel slider with lightbox <= 1.0.22 - Reflected Cross-Site Scriptingnik00726 video carousel slider with lightbox
- CVE-2023-2708Video Gallery <= 1.0.10 - Reflected Cross-Site Scriptingnik00726 Video Gallery
- CVE-2021-27131Moodle 3.10.1 is vulnerable to persistent/stored cross-site scripting (XSS) due to the improper input sanitization on the "Additional HTML Smoodle/moodle
- CVE-2023-2730Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore
- CVE-2023-29927Versions of Sage 300 through 2022 implement role-based access controls that are only enforced client-side.
- CVE-2023-30452The MoroSystems EasyMind - Mind Maps plugin before 2.15.0 for Confluence allows persistent XSS when saving a Mind Map with the hyperlink par
- CVE-2023-31544A stored cross-site scripting (XSS) vulnerability in alkacon-OpenCMS v11.0.0.0 allows attackers to execute arbitrary web scripts or HTML viaorg.opencms:opencms-core
- CVE-2023-31678Incorrect access control in Videogo v6.8.1 allows attackers to bind shared devices after the connection has been ended.