CVEs published May 17, 2023
57 CVEs were published on May 17, 2023: 7 critical, 19 high.
- Published
- 57
- Critical
- 7
- High
- 19
- Medium
- 26
- Low
- 4
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- code-projects Bus Dispatch and Information System
- 3
- ABB Terra AC wallbox
- 2
- Canon IJ NW Tool
- 2
- Checkmk
- 2
- SourceCodester Online Exam System
- 2
- thorsten/phpmyfaq
- 2
- Weaver OA
- 2
- ASUSTOR ADM · ASUSTOR LooksGood +1
- 1
- binutils
- 1
- code-projects Simple Photo Gallery
- 1
Critical 7
- CVE-2023-30438IBM PowerVM gain accessIBM PowerVM Hypervisor
- CVE-2023-2319It was discovered that an update for PCS package in RHBA-2023:2151 erratum released as part of Red Hat Enterprise Linux 9.2 failed to includpcs
- CVE-2023-2780Path Traversal: '\..\filename' in mlflow/mlflowmlflow/mlflow · mlflow
- CVE-2023-30191PrestaShop cdesigner < 3.1.9 is vulnerable to SQL Injection via CdesignerTraitementModuleFrontController::initContent().
- CVE-2023-31703Cross Site Scripting (XSS) in the edit user form in Microworld Technologies eScan management console 14.0.1400.2281 allows remote attacker t
- CVE-2023-31902RPA Technology Mobile Mouse 3.6.0.4 is vulnerable to Remote Code Execution (RCE).
- CVE-2023-31903GuppY CMS 6.00.10 is vulnerable to Unrestricted File Upload which allows remote attackers to execute arbitrary code by uploading a php file.
High 19
- CVE-2023-24805Command injection in cups-filtersOpenPrinting cups-filters
- CVE-2023-31208Livestatus command injection in RestAPICheckmk
- CVE-2023-0864Configuration data is exchanged in plaintext and could be available to a nearby attacker if present during configuration or usage of the device via Bluetooth Low Energy (BLE).ABB Terra AC wallbox
- CVE-2023-0863Authentication to access the AC wallbox via its Bluetooth Low Energy (BLE) channel can be bypassed, ABB Terra AC wallbox
- CVE-2023-2509A Cross-Site Scripting(XSS) vulnerability was found on ADMASUSTOR ADM · ASUSTOR LooksGood +1
- CVE-2023-2706OTP Login Woocommerce & Gravity Forms <= 2.2 - Authentication Bypass to Privilege Escalationxootix OTP Login & Register Woocommerce
- CVE-2023-2203A flaw was found in the WebKitGTK package.WebKitGTK
- CVE-2023-2295A vulnerability was found in the libreswan library.libreswan
- CVE-2023-2491A flaw was found in the Emacs text editor.emacs
- CVE-2023-27233Piwigo before 13.6.0 was discovered to contain a SQL injection vulnerability via the order[0][dir] parameter at user_list_backend.php.
- CVE-2023-2752Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaqthorsten/phpmyfaq
- CVE-2023-2753Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaqthorsten/phpmyfaq
- CVE-2023-31700TP-Link TL-WPA4530 KIT V2 (EU)_170406 and V2 (EU)_161115 is vulnerable to Command Injection via _httpRpmPlcDeviceAdd.
- CVE-2023-31701TP-Link TL-WPA4530 KIT V2 (EU)_170406 and V2 (EU)_161115 is vulnerable to Command Injection via _httpRpmPlcDeviceRemove.
- CVE-2023-31702SQL injection in the View User Profile in MicroWorld eScan Management Console 14.0.1400.2281 allows remote attacker to dump entire database
- CVE-2023-31722There exists a heap buffer overflow in nasm 2.16.02rc1 (GitHub commit: b952891).
- CVE-2023-31724yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the function do_directive at /nasm/nasm-pp.c.
- CVE-2023-31904savysoda Wifi HD Wireless Disk Drive 11 is vulnerable to Local File Inclusion.
- CVE-2023-32767The web interface of Symcon IP-Symcon before 6.3 (i.e., before 2023-05-12) allows a remote attacker to read sensitive files via ..
Medium, low and unrated 31
- CVE-2023-2776code-projects Simple Photo Gallery unrestricted uploadcode-projects Simple Photo Gallery
- CVE-2023-2775code-projects Bus Dispatch and Information System adminHome.php sql injectioncode-projects Bus Dispatch and Information System
- CVE-2023-2774code-projects Bus Dispatch and Information System view_branch.php sql injectioncode-projects Bus Dispatch and Information System
- CVE-2023-2773code-projects Bus Dispatch and Information System view_admin.php sql injectioncode-projects Bus Dispatch and Information System
- CVE-2023-2772SourceCodester Budget and Expense Tracker System GET Parameter manage_budget.php sql injectionSourceCodester Budget and Expense Tracker System
- CVE-2023-2771SourceCodester Online Exam System data sql injectionSourceCodester Online Exam System
- CVE-2023-2770SourceCodester Online Exam System data sql injectionSourceCodester Online Exam System
- CVE-2023-2769SourceCodester Service Provider Management System sql injectionSourceCodester Service Provider Management System
- CVE-2023-26044ReactPHP's HTTP server continues parsing unused multipart parts after reaching limitsreactphp http · react/http
- CVE-2023-31135Dgraph Audit Log Encryption nonce reusedgraph-io dgraph · github.com/dgraph-io/dgraph
- CVE-2023-2768Sucms cross site scriptingSucms
- CVE-2023-2766Weaver OA jx2_config.ini file accessWeaver OA
- CVE-2023-2765Weaver OA downfile.php absolute path traversalWeaver OA
- CVE-2023-22348Reading host_configs does not honour contact groupsCheckmk
- CVE-2023-2679Data leakage in Adobe connector for SPE edition of SLMSnow Software SPE SLM
- CVE-2023-2745WordPress Core < 6.2.1 - Directory TraversalWordPress Foundation WordPress
- CVE-2023-2608Multiple Page Generator Plugin <= 3.3.17 - Cross-Site Request Forgery to SQL Injectionthemeisle Multiple Page Generator Plugin – MPG
- CVE-2022-42336Mishandling of guest SSBD selection on AMD hardware The current logic to set SSBD on AMD Family 17h and Hygon Family 18h processors requiresxen
- CVE-2022-45144Algoo Tracim before 4.4.2 allows XSS via HTML file upload.
- CVE-2023-1763Canon IJ Network Tool/Ver.4.7.5 and earlier (supported OS: OS X 10.9.5-macOS 13),IJ Network Tool/Ver.4.7.3 and earlier (supported OS: OS X 1Canon IJ NW Tool
- CVE-2023-1764Canon IJ Network Tool/Ver.4.7.5 and earlier (supported OS: OS X 10.9.5-macOS 13),IJ Network Tool/Ver.4.7.3 and earlier (supported OS: OS X 1Canon IJ NW Tool
- CVE-2023-1859A use-after-free flaw was found in xen_9pfs_front_removet in net/9p/trans_xen.c in Xen transport for 9pfs in the Linux Kernel.Kernel
- CVE-2023-1972A potential heap based buffer overflow was found in _bfd_elf_slurp_version_tables() in bfd/elf.c.binutils
- CVE-2023-2731A NULL pointer dereference flaw was found in Libtiff's LZWDecode() function in the libtiff/tif_lzw.c file.libtiff
- CVE-2023-2756 SQL Injection in pimcore/customer-data-frameworkpimcore/customer-data-framework · pimcore/customer-manageme…
- CVE-2023-29837Cross Site Scripting vulnerability found in Exelysis Unified Communication Solution (EUCS) v.1.0 allows a remote attacker to gain privileges
- CVE-2023-31698Bludit v3.14.1 is vulnerable to Stored Cross Site Scripting (XSS) via SVG file on site logo.
- CVE-2023-31699ChurchCRM v4.5.4 is vulnerable to Reflected Cross-Site Scripting (XSS) via image file.
- CVE-2023-31723yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the function expand_mmac_params at /nasm/nasm-pp.c.
- CVE-2023-31725yasm 1.3.0.55.g101bc was discovered to contain a heap-use-after-free via the function expand_mmac_params at yasm/modules/preprocs/nasm/nasm-
- CVE-2023-31847In davinci 0.3.0-rc after logging in, the user can connect to the mysql malicious server by controlling the data source to read arbitrary fi