# CVEs published 2023-05-16

94 CVEs were published on May 16, 2023: 10 critical, 32 high. Days are UTC.

- [CVE-2023-2528](https://cve.now/CVE-2023-2528.md): Contact Form by Supsystic \<= 1.7.24 - Cross-Site Request Forgery via AJAX action (CVSS 5.4, supsysticcom Contact Form by Supsystic)
- [CVE-2023-30510](https://cve.now/CVE-2023-30510.md): Authenticated Server-side Request Forgery in Aruba EdgeConnect Enterprise Web Management Interface (CVSS 4.1, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2023-30509](https://cve.now/CVE-2023-30509.md): Authenticated Remote Path Traversal in Aruba EdgeConnect Enterprise Command Line Interface (CVSS 4.9, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2023-30508](https://cve.now/CVE-2023-30508.md): Authenticated Remote Path Traversal in Aruba EdgeConnect Enterprise Command Line Interface (CVSS 4.9, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2023-30507](https://cve.now/CVE-2023-30507.md): Authenticated Remote Path Traversal in Aruba EdgeConnect Enterprise Command Line Interface (CVSS 4.9, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2023-30506](https://cve.now/CVE-2023-30506.md): Authenticated Remote Code Execution in Aruba EdgeConnect Enterprise Command Line Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2023-30505](https://cve.now/CVE-2023-30505.md): Authenticated Remote Code Execution in Aruba EdgeConnect Enterprise Command Line Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2023-30504](https://cve.now/CVE-2023-30504.md): Authenticated Remote Code Execution in Aruba EdgeConnect Enterprise Command Line Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2023-30503](https://cve.now/CVE-2023-30503.md): Authenticated Remote Code Execution in Aruba EdgeConnect Enterprise Command Line Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2023-30502](https://cve.now/CVE-2023-30502.md): Authenticated Remote Code Execution in Aruba EdgeConnect Enterprise Command Line Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2023-30501](https://cve.now/CVE-2023-30501.md): Authenticated Remote Code Execution in Aruba EdgeConnect Enterprise Command Line Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2023-2726](https://cve.now/CVE-2023-2726.md): Inappropriate implementation in WebApp Installs in Google Chrome prior to 113.0.5672.126 allowed an attacker who convinced a user to install (CVSS 8.8, Google Chrome)
- [CVE-2023-2725](https://cve.now/CVE-2023-2725.md): Use after free in Guest View in Google Chrome prior to 113.0.5672.126 allowed an attacker who convinced a user to install a malicious extens (CVSS 8.8, Google Chrome)
- [CVE-2023-2724](https://cve.now/CVE-2023-2724.md): Type confusion in V8 in Google Chrome prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2023-2723](https://cve.now/CVE-2023-2723.md): Use after free in DevTools in Google Chrome prior to 113.0.5672.126 allowed a remote attacker who had compromised the renderer process to po (CVSS 8.8, Google Chrome)
- [CVE-2023-2722](https://cve.now/CVE-2023-2722.md): Use after free in Autofill UI in Google Chrome on Android prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap corr (CVSS 8.8, Google Chrome)
- [CVE-2023-2721](https://cve.now/CVE-2023-2721.md): Use after free in Navigation in Google Chrome prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap corruption via a (CVSS 8.8, Google Chrome)
- [CVE-2023-2631](https://cve.now/CVE-2023-2631.md): CSRF vulnerability and missing permission checks in Code Dx Plugin (CVSS 4.3, Jenkins Code Dx Plugin · org.jenkins-ci.plugins:codedx)
- [CVE-2023-2195](https://cve.now/CVE-2023-2195.md): CSRF vulnerability and missing permission checks in Code Dx Plugin (CVSS 4.3, Jenkins Code Dx Plugin · org.jenkins-ci.plugins:codedx)
- [CVE-2023-2633](https://cve.now/CVE-2023-2633.md): API keys stored and displayed in plain text by Code Dx Plugin (CVSS 4.3, Jenkins Code Dx Plugin · org.jenkins-ci.plugins:codedx)
- [CVE-2023-2632](https://cve.now/CVE-2023-2632.md): API keys stored and displayed in plain text by Code Dx Plugin (CVSS 4.3, Jenkins Code Dx Plugin · org.jenkins-ci.plugins:codedx)
- [CVE-2023-2196](https://cve.now/CVE-2023-2196.md): Missing permission checks in Code Dx Plugin (CVSS 4.3, Jenkins Code Dx Plugin · org.jenkins-ci.plugins:codedx)
- [CVE-2023-2740](https://cve.now/CVE-2023-2740.md): SourceCodester Guest Management System GET Parameter dateTest.php cross site scripting (CVSS 3.5, SourceCodester Guest Management System)
- [CVE-2023-33007](https://cve.now/CVE-2023-33007.md): Jenkins LoadComplete support Plugin 1.0 and earlier does not escape the LoadComplete test name, resulting in a stored cross-site scripting ( (CVSS 5.4, Jenkins Project Jenkins LoadComplete support Plugin · org.j…)
- [CVE-2023-33006](https://cve.now/CVE-2023-33006.md): A cross-site request forgery (CSRF) vulnerability in Jenkins WSO2 Oauth Plugin 1.0 and earlier allows attackers to trick users into logging (CVSS 5.4, Jenkins Project Jenkins WSO2 Oauth Plugin · org.jenkins-ci.…)
- [CVE-2023-33005](https://cve.now/CVE-2023-33005.md): Jenkins WSO2 Oauth Plugin 1.0 and earlier does not invalidate the previous session on login. (CVSS 5.4, Jenkins Project Jenkins WSO2 Oauth Plugin · org.jenkins-ci.…)
- [CVE-2023-33004](https://cve.now/CVE-2023-33004.md): A missing permission check in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers with Overall/Read permission to reset profiler st (CVSS 4.3, Jenkins Project Jenkins Tag Profiler Plugin · org.jenkins-c…)
- [CVE-2023-33003](https://cve.now/CVE-2023-33003.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers to reset profiler statisti (CVSS 4.3, Jenkins Project Jenkins Tag Profiler Plugin · org.jenkins-c…)
- [CVE-2023-33002](https://cve.now/CVE-2023-33002.md): Jenkins TestComplete support Plugin 2.8.1 and earlier does not escape the TestComplete project name, resulting in a stored cross-site script (CVSS 5.4, Jenkins Project Jenkins TestComplete support Plugin · org.j…)
- [CVE-2023-33001](https://cve.now/CVE-2023-33001.md): Jenkins HashiCorp Vault Plugin 360.v0a\_1c04cf807d and earlier does not properly mask (i.e., replace with asterisks) credentials in the build (CVSS 7.5, Jenkins Project Jenkins HashiCorp Vault Plugin · com.datapi…)
- [CVE-2023-33000](https://cve.now/CVE-2023-33000.md): Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.149 and earlier does not mask credentials displayed on the configuration form, (CVSS 7.5, Jenkins Project Jenkins NS-ND Integration Performance Publi…)
- [CVE-2023-32999](https://cve.now/CVE-2023-32999.md): A missing permission check in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers with Overall/Read permission to connect to an att (CVSS 4.3, Jenkins Project Jenkins AppSpider Plugin · com.rapid7:jenki…)
- [CVE-2023-32998](https://cve.now/CVE-2023-32998.md): A cross-site request forgery (CSRF) vulnerability in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers to connect to an attacker- (CVSS 8.8, Jenkins Project Jenkins AppSpider Plugin · com.rapid7:jenki…)
- [CVE-2023-32997](https://cve.now/CVE-2023-32997.md): Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the previous session on login. (CVSS 8.8, Jenkins Project Jenkins CAS Plugin · org.jenkins-ci.plugins…)
- [CVE-2023-32996](https://cve.now/CVE-2023-32996.md): A missing permission check in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers with Overall/Read permission to sen (CVSS 4.3, Jenkins Project Jenkins SAML Single Sign On(SSO) Plugin · i…)
- [CVE-2023-32995](https://cve.now/CVE-2023-32995.md): A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers to send an H (CVSS 8.8, Jenkins Project Jenkins SAML Single Sign On(SSO) Plugin · i…)
- [CVE-2023-32994](https://cve.now/CVE-2023-32994.md): Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOra (CVSS 3.7, Jenkins Project Jenkins SAML Single Sign On(SSO) Plugin · i…)
- [CVE-2023-32993](https://cve.now/CVE-2023-32993.md): Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configur (CVSS 4.8, Jenkins Project Jenkins SAML Single Sign On(SSO) Plugin · i…)
- [CVE-2023-32992](https://cve.now/CVE-2023-32992.md): Missing permission checks in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allow attackers with Overall/Read permission to send (CVSS 8.8, Jenkins Project Jenkins SAML Single Sign On(SSO) Plugin · i…)
- [CVE-2023-32991](https://cve.now/CVE-2023-32991.md): A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allows attackers to send an H (CVSS 8.8, Jenkins Project Jenkins SAML Single Sign On(SSO) Plugin · i…)
- [CVE-2023-32990](https://cve.now/CVE-2023-32990.md): A missing permission check in Jenkins Azure VM Agents Plugin 852.v8d35f0960a\_43 and earlier allows attackers with Overall/Read permission to (CVSS 6.5, Jenkins Project Jenkins Azure VM Agents Plugin · org.jenkin…)
- [CVE-2023-32989](https://cve.now/CVE-2023-32989.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Azure VM Agents Plugin 852.v8d35f0960a\_43 and earlier allows attackers to conne (CVSS 8.8, Jenkins Project Jenkins Azure VM Agents Plugin · org.jenkin…)
- [CVE-2023-32988](https://cve.now/CVE-2023-32988.md): A missing permission check in Jenkins Azure VM Agents Plugin 852.v8d35f0960a\_43 and earlier allows attackers with Overall/Read permission to (CVSS 4.3, Jenkins Project Jenkins Azure VM Agents Plugin · org.jenkin…)
- [CVE-2023-32987](https://cve.now/CVE-2023-32987.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Reverse Proxy Auth Plugin 1.7.4 and earlier allows attackers to connect to an a (CVSS 8.8, Jenkins Project Jenkins Reverse Proxy Auth Plugin · org.jen…)
- [CVE-2023-32986](https://cve.now/CVE-2023-32986.md): Jenkins File Parameter Plugin 285.v757c5b\_67a\_c25 and earlier does not restrict the name (and resulting uploaded file name) of Stashed File (CVSS 8.8, Jenkins Project Jenkins File Parameter Plugin · io.jenkins.…)
- [CVE-2023-32985](https://cve.now/CVE-2023-32985.md): Jenkins Sidebar Link Plugin 2.2.1 and earlier does not restrict the path of files in a method implementing form validation, allowing attacke (CVSS 4.3, Jenkins Project Jenkins Sidebar Link Plugin · org.jenkins-c…)
- [CVE-2023-32984](https://cve.now/CVE-2023-32984.md): Jenkins TestNG Results Plugin 730.v4c5283037693 and earlier does not escape several values that are parsed from TestNG report files and disp (CVSS 5.4, Jenkins Project Jenkins TestNG Results Plugin · org.jenkins…)
- [CVE-2023-32983](https://cve.now/CVE-2023-32983.md): Jenkins Ansible Plugin 204.v8191fd551eb\_f and earlier does not mask extra variables displayed on the configuration form, increasing the pote (CVSS 5.3, Jenkins Project Jenkins Ansible Plugin · org.jenkins-ci.plu…)
- [CVE-2023-32982](https://cve.now/CVE-2023-32982.md): Jenkins Ansible Plugin 204.v8191fd551eb\_f and earlier stores extra variables unencrypted in job config.xml files on the Jenkins controller w (CVSS 4.3, Jenkins Project Jenkins Ansible Plugin · org.jenkins-ci.plu…)
- [CVE-2023-32981](https://cve.now/CVE-2023-32981.md): An arbitrary file write vulnerability in Jenkins Pipeline Utility Steps Plugin 2.15.2 and earlier allows attackers able to provide crafted a (CVSS 8.8, Jenkins Project Jenkins Pipeline Utility Steps Plugin · org…)
- [CVE-2023-32980](https://cve.now/CVE-2023-32980.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Email Extension Plugin allows attackers to make another user stop watching an a (CVSS 4.3, Jenkins Project Jenkins Email Extension Plugin · org.jenkin…)
- [CVE-2023-32979](https://cve.now/CVE-2023-32979.md): Jenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with Overall (CVSS 4.3, Jenkins Project Jenkins Email Extension Plugin · org.jenkin…)
- [CVE-2023-32978](https://cve.now/CVE-2023-32978.md): A cross-site request forgery (CSRF) vulnerability in Jenkins LDAP Plugin allows attackers to connect to an attacker-specified LDAP server us (CVSS 4.3, Jenkins Project Jenkins LDAP Plugin · org.jenkins-ci.plugin…)
- [CVE-2023-32977](https://cve.now/CVE-2023-32977.md): Jenkins Pipeline: Job Plugin does not escape the display name of the build that caused an earlier build to be aborted, resulting in a stored (CVSS 5.4, Jenkins Project Jenkins Pipeline: Job Plugin · org.jenkins-…)
- [CVE-2023-2739](https://cve.now/CVE-2023-2739.md): Gira HomeServer hslist cross site scripting (CVSS 4.3, Gira HomeServer)
- [CVE-2023-28076](https://cve.now/CVE-2023-28076.md): CloudLink 7.1.2 and all prior versions contain a broken or risky cryptographic algorithm vulnerability. (CVSS 5.9, Dell CloudLink)
- [CVE-2023-2738](https://cve.now/CVE-2023-2738.md): Tongda OA GatewayController.php actionGetdata unrestricted upload (CVSS 6.3, Tongda OA)
- [CVE-2023-29439](https://cve.now/CVE-2023-29439.md): WordPress FooGallery Plugin \<= 2.2.35 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, FooPlugins FooGallery)
- [CVE-2023-23703](https://cve.now/CVE-2023-23703.md): WordPress Arconix Shortcodes Plugin \<= 2.1.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Tyche Softwares Arconix Shortcodes)
- [CVE-2023-23709](https://cve.now/CVE-2023-23709.md): WordPress WPJAM Basic Plugin \<= 6.2.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Denis WPJAM Basic)
- [CVE-2023-23720](https://cve.now/CVE-2023-23720.md): WordPress Verified Reviews (Avis Vérifiés) Plugin \<= 2.3.13 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, NetReviews SAS Verified Reviews)
- [CVE-2023-23657](https://cve.now/CVE-2023-23657.md): WordPress Mail Subscribe List Plugin \<= 2.1.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Richard Leishman t/a Webforward Mail Subscribe List)
- [CVE-2023-23641](https://cve.now/CVE-2023-23641.md): WordPress Uji Popup Plugin \<= 1.4.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, WPmanage Uji Popup)
- [CVE-2023-23727](https://cve.now/CVE-2023-23727.md): WordPress Live Chat by Formilla – Real-time Chat & Chatbots Plugin Plugin \<= 1.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Live Chat by Formilla)
- [CVE-2023-2548](https://cve.now/CVE-2023-2548.md): RegistrationMagic \<= 5.2.0.5 - Authenticated (Admin+) Insecure Direct Object Reference to Arbitrary User Password Change (CVSS 6.6, metagauss RegistrationMagic – Custom Registration Forms, Us…)
- [CVE-2023-2499](https://cve.now/CVE-2023-2499.md): RegistrationMagic \<= 5.2.1.0 - Authentication Bypass (CVSS 9.8, metagauss RegistrationMagic – Custom Registration Forms, Us…)
- [CVE-2023-23676](https://cve.now/CVE-2023-23676.md): WordPress File Gallery Plugin \<= 1.8.5.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Bruno "Aesqe" Babic File Gallery)
- [CVE-2023-23673](https://cve.now/CVE-2023-23673.md): WordPress I Recommend This Plugin \<= 3.8.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Harish Chouhan, Themeist I Recommend This)
- [CVE-2023-32956](https://cve.now/CVE-2023-32956.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in CGI component in Synology Router (CVSS 9.8, Synology Router Manager)
- [CVE-2023-32955](https://cve.now/CVE-2023-32955.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DHCP Client Functionality in Syn (CVSS 8.1, Synology Router Manager)
- [CVE-2023-2161](https://cve.now/CVE-2023-2161.md): A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized read access to the file (CVSS 5.0, Schneider Electric OPC Factory Server)
- [CVE-2023-2710](https://cve.now/CVE-2023-2710.md): video carousel slider with lightbox \<= 1.0.22 - Reflected Cross-Site Scripting (CVSS 6.1, nik00726 video carousel slider with lightbox)
- [CVE-2023-2708](https://cve.now/CVE-2023-2708.md): Video Gallery \<= 1.0.10 - Reflected Cross-Site Scripting (CVSS 6.1, nik00726 Video Gallery)
- [CVE-2021-27131](https://cve.now/CVE-2021-27131.md): Moodle 3.10.1 is vulnerable to persistent/stored cross-site scripting (XSS) due to the improper input sanitization on the "Additional HTML S (no CVSS, moodle/moodle)
- [CVE-2023-25394](https://cve.now/CVE-2023-25394.md): Videostream macOS app 0.5.0 and 0.4.3 has a Race Condition. (CVSS 7.0)
- [CVE-2023-2730](https://cve.now/CVE-2023-2730.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 6.3, pimcore/pimcore)
- [CVE-2023-27742](https://cve.now/CVE-2023-27742.md): IDURAR ERP/CRM v1 was discovered to contain a SQL injection vulnerability via the component /api/login. (CVSS 9.8)
- [CVE-2023-29927](https://cve.now/CVE-2023-29927.md): Versions of Sage 300 through 2022 implement role-based access controls that are only enforced client-side. (CVSS 4.3)
- [CVE-2023-29961](https://cve.now/CVE-2023-29961.md): D-Link DIR-605L firmware version 1.17B01 BETA is vulnerable to stack overflow via /goform/formTcpipSetup, (CVSS 9.8)
- [CVE-2023-30189](https://cve.now/CVE-2023-30189.md): Prestashop posstaticblocks \<= 1.0.0 is vulnerable to SQL Injection via posstaticblocks::getPosCurrentHook(). (CVSS 9.8)
- [CVE-2023-30281](https://cve.now/CVE-2023-30281.md): Insecure permissions vulnerability was discovered, due to a lack of permissions’s control in scquickaccounting before v3.7.3 from Store Comm (CVSS 7.5)
- [CVE-2023-30452](https://cve.now/CVE-2023-30452.md): The MoroSystems EasyMind - Mind Maps plugin before 2.15.0 for Confluence allows persistent XSS when saving a Mind Map with the hyperlink par (CVSS 5.4)
- [CVE-2023-31519](https://cve.now/CVE-2023-31519.md): Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the email parameter at login\_core.php. (CVSS 9.8)
- [CVE-2023-31544](https://cve.now/CVE-2023-31544.md): A stored cross-site scripting (XSS) vulnerability in alkacon-OpenCMS v11.0.0.0 allows attackers to execute arbitrary web scripts or HTML via (CVSS 5.4, org.opencms:opencms-core)
- [CVE-2023-31572](https://cve.now/CVE-2023-31572.md): An issue in Bludit 4.0.0-rc-2 allows authenticated attackers to change the Administrator password and escalate privileges via a crafted requ (CVSS 8.8)
- [CVE-2023-31576](https://cve.now/CVE-2023-31576.md): An arbitrary file upload vulnerability in Serendipity 2.4-beta1 allows attackers to execute arbitrary code via a crafted HTML or Javascript (CVSS 8.8)
- [CVE-2023-31587](https://cve.now/CVE-2023-31587.md): Tenda AC5 router V15.03.06.28 was discovered to contain a remote code execution (RCE) vulnerability via the Mac parameter at ip/goform/Write (CVSS 9.8)
- [CVE-2023-31677](https://cve.now/CVE-2023-31677.md): Insecure permissions in luowice 3.5.18 allow attackers to view information for other alarm devices via modification of the eseeid parameter. (CVSS 7.5)
- [CVE-2023-31678](https://cve.now/CVE-2023-31678.md): Incorrect access control in Videogo v6.8.1 allows attackers to bind shared devices after the connection has been ended. (CVSS 5.3)
- [CVE-2023-31679](https://cve.now/CVE-2023-31679.md): Incorrect access control in Videogo v6.8.1 allows attackers to access images from other devices via modification of the Device Id parameter. (CVSS 7.5)
- [CVE-2023-31848](https://cve.now/CVE-2023-31848.md): davinci 0.3.0-rc is vulnerable to Server-side request forgery (SSRF). (CVSS 8.8)
- [CVE-2023-31856](https://cve.now/CVE-2023-31856.md): A command injection vulnerability in the hostTime parameter in the function NTPSyncWithHostof TOTOLINK CP300+ V5.2cu.7594\_B20200910 allows a (CVSS 9.8)
- [CVE-2023-31857](https://cve.now/CVE-2023-31857.md): Sourcecodester Online Computer and Laptop Store 1.0 allows unrestricted file upload and can lead to remote code execution. (CVSS 9.8)
- [CVE-2023-31890](https://cve.now/CVE-2023-31890.md): An XML Deserialization vulnerability in glazedlists v1.11.0 allows an attacker to execute arbitrary code via the BeanXMLByteCoder.decode() p (CVSS 9.8, com.glazedlists:glazedlists)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-05-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.