# CVEs published 2023-05-17

57 CVEs were published on May 17, 2023: 7 critical, 19 high. Days are UTC.

- [CVE-2023-2776](https://cve.now/CVE-2023-2776.md): code-projects Simple Photo Gallery unrestricted upload (CVSS 6.3, code-projects Simple Photo Gallery)
- [CVE-2023-2775](https://cve.now/CVE-2023-2775.md): code-projects Bus Dispatch and Information System adminHome.php sql injection (CVSS 6.3, code-projects Bus Dispatch and Information System)
- [CVE-2023-2774](https://cve.now/CVE-2023-2774.md): code-projects Bus Dispatch and Information System view\_branch.php sql injection (CVSS 6.3, code-projects Bus Dispatch and Information System)
- [CVE-2023-2773](https://cve.now/CVE-2023-2773.md): code-projects Bus Dispatch and Information System view\_admin.php sql injection (CVSS 6.3, code-projects Bus Dispatch and Information System)
- [CVE-2023-2772](https://cve.now/CVE-2023-2772.md): SourceCodester Budget and Expense Tracker System GET Parameter manage\_budget.php sql injection (CVSS 6.3, SourceCodester Budget and Expense Tracker System)
- [CVE-2023-2771](https://cve.now/CVE-2023-2771.md): SourceCodester Online Exam System data sql injection (CVSS 6.3, SourceCodester Online Exam System)
- [CVE-2023-2770](https://cve.now/CVE-2023-2770.md): SourceCodester Online Exam System data sql injection (CVSS 6.3, SourceCodester Online Exam System)
- [CVE-2023-24805](https://cve.now/CVE-2023-24805.md): Command injection in cups-filters (CVSS 8.8, OpenPrinting cups-filters)
- [CVE-2023-2769](https://cve.now/CVE-2023-2769.md): SourceCodester Service Provider Management System sql injection (CVSS 6.3, SourceCodester Service Provider Management System)
- [CVE-2023-26044](https://cve.now/CVE-2023-26044.md): ReactPHP's HTTP server continues parsing unused multipart parts after reaching limits (CVSS 5.3, reactphp http · react/http)
- [CVE-2023-31135](https://cve.now/CVE-2023-31135.md): Dgraph Audit Log Encryption nonce reuse (CVSS 3.3, dgraph-io dgraph · github.com/dgraph-io/dgraph)
- [CVE-2023-2768](https://cve.now/CVE-2023-2768.md): Sucms cross site scripting (CVSS 3.5, Sucms)
- [CVE-2023-2766](https://cve.now/CVE-2023-2766.md): Weaver OA jx2\_config.ini file access (CVSS 5.3, Weaver OA)
- [CVE-2023-2765](https://cve.now/CVE-2023-2765.md): Weaver OA downfile.php absolute path traversal (CVSS 4.3, Weaver OA)
- [CVE-2023-22348](https://cve.now/CVE-2023-22348.md): Reading host\_configs does not honour contact groups (CVSS 4.3, Checkmk)
- [CVE-2023-2679](https://cve.now/CVE-2023-2679.md): Data leakage in Adobe connector for SPE edition of SLM (CVSS 4.1, Snow Software SPE SLM)
- [CVE-2023-30438](https://cve.now/CVE-2023-30438.md): IBM PowerVM gain access (CVSS 9.3, IBM PowerVM Hypervisor)
- [CVE-2023-2745](https://cve.now/CVE-2023-2745.md): WordPress Core \< 6.2.1 - Directory Traversal (CVSS 5.4, WordPress Foundation WordPress)
- [CVE-2023-31208](https://cve.now/CVE-2023-31208.md): Livestatus command injection in RestAPI (CVSS 8.3, Checkmk)
- [CVE-2023-0864](https://cve.now/CVE-2023-0864.md): Configuration data is exchanged in plaintext and could be available to a nearby attacker if present during configuration or usage of the device via Bluetooth Low Energy (BLE). (CVSS 7.1, ABB Terra AC wallbox)
- [CVE-2023-0863](https://cve.now/CVE-2023-0863.md): Authentication to access the AC wallbox via its Bluetooth Low Energy (BLE) channel can be bypassed, (CVSS 8.8, ABB Terra AC wallbox)
- [CVE-2023-2509](https://cve.now/CVE-2023-2509.md): A Cross-Site Scripting(XSS) vulnerability was found on ADM (CVSS 7.1, ASUSTOR ADM · ASUSTOR LooksGood +1)
- [CVE-2023-2608](https://cve.now/CVE-2023-2608.md): Multiple Page Generator Plugin \<= 3.3.17 - Cross-Site Request Forgery to SQL Injection (CVSS 3.1, themeisle Multiple Page Generator Plugin – MPG)
- [CVE-2023-2706](https://cve.now/CVE-2023-2706.md): OTP Login Woocommerce & Gravity Forms \<= 2.2 - Authentication Bypass to Privilege Escalation (CVSS 8.1, xootix OTP Login & Register Woocommerce)
- [CVE-2022-42336](https://cve.now/CVE-2022-42336.md): Mishandling of guest SSBD selection on AMD hardware The current logic to set SSBD on AMD Family 17h and Hygon Family 18h processors requires (CVSS 3.3, xen)
- [CVE-2022-45144](https://cve.now/CVE-2022-45144.md): Algoo Tracim before 4.4.2 allows XSS via HTML file upload. (CVSS 6.1)
- [CVE-2023-1763](https://cve.now/CVE-2023-1763.md): Canon IJ Network Tool/Ver.4.7.5 and earlier (supported OS: OS X 10.9.5-macOS 13),IJ Network Tool/Ver.4.7.3 and earlier (supported OS: OS X 1 (CVSS 6.5, Canon IJ NW Tool)
- [CVE-2023-1764](https://cve.now/CVE-2023-1764.md): Canon IJ Network Tool/Ver.4.7.5 and earlier (supported OS: OS X 10.9.5-macOS 13),IJ Network Tool/Ver.4.7.3 and earlier (supported OS: OS X 1 (CVSS 6.5, Canon IJ NW Tool)
- [CVE-2023-1859](https://cve.now/CVE-2023-1859.md): A use-after-free flaw was found in xen\_9pfs\_front\_removet in net/9p/trans\_xen.c in Xen transport for 9pfs in the Linux Kernel. (CVSS 4.7, Kernel)
- [CVE-2023-1972](https://cve.now/CVE-2023-1972.md): A potential heap based buffer overflow was found in \_bfd\_elf\_slurp\_version\_tables() in bfd/elf.c. (CVSS 6.5, binutils)
- [CVE-2023-2203](https://cve.now/CVE-2023-2203.md): A flaw was found in the WebKitGTK package. (CVSS 8.8, WebKitGTK)
- [CVE-2023-2295](https://cve.now/CVE-2023-2295.md): A vulnerability was found in the libreswan library. (CVSS 7.5, libreswan)
- [CVE-2023-2319](https://cve.now/CVE-2023-2319.md): It was discovered that an update for PCS package in RHBA-2023:2151 erratum released as part of Red Hat Enterprise Linux 9.2 failed to includ (CVSS 9.8, pcs)
- [CVE-2023-2491](https://cve.now/CVE-2023-2491.md): A flaw was found in the Emacs text editor. (CVSS 7.8, emacs)
- [CVE-2023-27233](https://cve.now/CVE-2023-27233.md): Piwigo before 13.6.0 was discovered to contain a SQL injection vulnerability via the order\[0\]\[dir\] parameter at user\_list\_backend.php. (CVSS 8.8)
- [CVE-2023-2731](https://cve.now/CVE-2023-2731.md): A NULL pointer dereference flaw was found in Libtiff's LZWDecode() function in the libtiff/tif\_lzw.c file. (CVSS 5.5, libtiff)
- [CVE-2023-2752](https://cve.now/CVE-2023-2752.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 7.2, thorsten/phpmyfaq)
- [CVE-2023-2753](https://cve.now/CVE-2023-2753.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 7.2, thorsten/phpmyfaq)
- [CVE-2023-2756](https://cve.now/CVE-2023-2756.md): SQL Injection in pimcore/customer-data-framework (CVSS 6.5, pimcore/customer-data-framework · pimcore/customer-manageme…)
- [CVE-2023-2780](https://cve.now/CVE-2023-2780.md): Path Traversal: '\\..\\filename' in mlflow/mlflow (CVSS 9.8, mlflow/mlflow · mlflow)
- [CVE-2023-29837](https://cve.now/CVE-2023-29837.md): Cross Site Scripting vulnerability found in Exelysis Unified Communication Solution (EUCS) v.1.0 allows a remote attacker to gain privileges (CVSS 6.1)
- [CVE-2023-30191](https://cve.now/CVE-2023-30191.md): PrestaShop cdesigner \< 3.1.9 is vulnerable to SQL Injection via CdesignerTraitementModuleFrontController::initContent(). (CVSS 9.8)
- [CVE-2023-31698](https://cve.now/CVE-2023-31698.md): Bludit v3.14.1 is vulnerable to Stored Cross Site Scripting (XSS) via SVG file on site logo. (no CVSS)
- [CVE-2023-31699](https://cve.now/CVE-2023-31699.md): ChurchCRM v4.5.4 is vulnerable to Reflected Cross-Site Scripting (XSS) via image file. (CVSS 4.8)
- [CVE-2023-31700](https://cve.now/CVE-2023-31700.md): TP-Link TL-WPA4530 KIT V2 (EU)\_170406 and V2 (EU)\_161115 is vulnerable to Command Injection via \_httpRpmPlcDeviceAdd. (CVSS 8.8)
- [CVE-2023-31701](https://cve.now/CVE-2023-31701.md): TP-Link TL-WPA4530 KIT V2 (EU)\_170406 and V2 (EU)\_161115 is vulnerable to Command Injection via \_httpRpmPlcDeviceRemove. (CVSS 8.8)
- [CVE-2023-31702](https://cve.now/CVE-2023-31702.md): SQL injection in the View User Profile in MicroWorld eScan Management Console 14.0.1400.2281 allows remote attacker to dump entire database (CVSS 7.2)
- [CVE-2023-31703](https://cve.now/CVE-2023-31703.md): Cross Site Scripting (XSS) in the edit user form in Microworld Technologies eScan management console 14.0.1400.2281 allows remote attacker t (CVSS 9.0)
- [CVE-2023-31722](https://cve.now/CVE-2023-31722.md): There exists a heap buffer overflow in nasm 2.16.02rc1 (GitHub commit: b952891). (CVSS 7.8)
- [CVE-2023-31723](https://cve.now/CVE-2023-31723.md): yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the function expand\_mmac\_params at /nasm/nasm-pp.c. (CVSS 5.5)
- [CVE-2023-31724](https://cve.now/CVE-2023-31724.md): yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the function do\_directive at /nasm/nasm-pp.c. (CVSS 7.8)
- [CVE-2023-31725](https://cve.now/CVE-2023-31725.md): yasm 1.3.0.55.g101bc was discovered to contain a heap-use-after-free via the function expand\_mmac\_params at yasm/modules/preprocs/nasm/nasm- (CVSS 5.5)
- [CVE-2023-31847](https://cve.now/CVE-2023-31847.md): In davinci 0.3.0-rc after logging in, the user can connect to the mysql malicious server by controlling the data source to read arbitrary fi (CVSS 6.5)
- [CVE-2023-31902](https://cve.now/CVE-2023-31902.md): RPA Technology Mobile Mouse 3.6.0.4 is vulnerable to Remote Code Execution (RCE). (CVSS 9.8)
- [CVE-2023-31903](https://cve.now/CVE-2023-31903.md): GuppY CMS 6.00.10 is vulnerable to Unrestricted File Upload which allows remote attackers to execute arbitrary code by uploading a php file. (CVSS 9.8)
- [CVE-2023-31904](https://cve.now/CVE-2023-31904.md): savysoda Wifi HD Wireless Disk Drive 11 is vulnerable to Local File Inclusion. (CVSS 7.5)
- [CVE-2023-32767](https://cve.now/CVE-2023-32767.md): The web interface of Symcon IP-Symcon before 6.3 (i.e., before 2023-05-12) allows a remote attacker to read sensitive files via .. (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-05-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.