CVEs published May 18, 2023
90 CVEs were published on May 18, 2023: 11 critical, 20 high.
- Published
- 90
- Critical
- 11
- High
- 20
- Medium
- 50
- Low
- 8
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 28
Most affected products
- Cisco Identity Services Engine Software
- 11
- Cisco Small Business Smart and Managed Switches
- 9
- silabs.com Gecko Platform
- 8
- Facebook Hermes
- 7
- Acronis Agent · Acronis Cyber Protect
- 5
- Cisco Digital Network Architecture Center
- 3
- Western Digital My Cloud Home and My Cloud Home Duo · Sa… +1
- 3
- Johnson Controls OpenBlue Enterprise Manager Data Collector
- 2
- Acronis Cyber Infrastructure
- 1
- Acronis Cyber Protect
- 1
Critical 11
- CVE-2023-30470A use-after-free related to unsound inference in the bytecode generation when optimizations are enabled for Hermes prior to commit da8990f73Facebook Hermes
- CVE-2023-28753netconsd prior to v0.2 was vulnerable to an integer overflow in its parse_packet function.Facebook netconsd
- CVE-2023-28081A bytecode optimization bug in Hermes prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could be used to cause an use-after-free and Facebook Hermes
- CVE-2023-25933A type confusion bug in TypedArray prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could have been used by a malicious attacker to Facebook Hermes
- CVE-2023-23557An error in Hermes' algorithm for copying objects properties prior to commit a00d237346894c6067a594983be6634f4168c9ad could be used by a malFacebook Hermes
- CVE-2023-23556An error in BigInt conversion to Number in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by a malicioFacebook Hermes
- CVE-2023-2024Improper Authentication for OpenBlue Enterprise Manager Data CollectorJohnson Controls OpenBlue Enterprise Manager Data Collector
- CVE-2023-27217A stack-based buffer overflow in the ChangeFriendlyName() function of Belkin Smart Outlet V2 F7c063 firmware_2.00.11420.OWRT.PVT_SNSV2 allow
- CVE-2023-29985Sourcecodester Student Study Center Desk Management System v1.0 admin\reports\index.php#date_from has a SQL Injection vulnerability.
- CVE-2023-30333An arbitrary file upload vulnerability in the component /admin/ThemeController.java of PerfreeBlog v3.1.2 allows attackers to execute arbitr
- CVE-2023-31729TOTOLINK A3300R v17.0.0cu.557 is vulnerable to Command Injection via /cgi-bin/cstecgi.cgi.
High 20
- CVE-2023-24833A use-after-free in BigIntPrimitive addition in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by an aFacebook Hermes
- CVE-2023-24832A null pointer dereference bug in Hermes prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708 could have been used by an attacker to craFacebook Hermes
- CVE-2023-23759There is a vulnerability in the fizz library prior to v2023.01.30.00 where a CHECK failure can be triggered remotely.Facebook fizz
- CVE-2022-4418Local privilege escalation due to unrestricted loading of unsigned libraries.Acronis Cyber Protect Home Office
- CVE-2022-45452Local privilege escalation due to insecure folder permissions.Acronis Agent · Acronis Cyber Protect
- CVE-2023-30487WordPress LearnPress Export Import Plugin <= 4.0.2 is vulnerable to Cross Site Scripting (XSS)ThimPress LearnPress Export Import
- CVE-2023-30868WordPress CMS Tree Page View Plugin <= 1.6.7 is vulnerable to Cross Site Scripting (XSS)Jon Christopher CMS Tree Page View
- CVE-2023-2757Waiting: One-click countdowns <= 0.6.2 - Missing Authorization Checks leading to Authenticated (Subscriber+) Stored Cross-Site Scriptingpluginbuilders Waiting: One-click countdowns
- CVE-2019-25137Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by authenticated administrators via msxsl:script in an xsltSele
- CVE-2023-20024Cisco Small Business Series Switches Buffer Overflow VulnerabilitiesCisco Small Business Smart and Managed Switches
- CVE-2023-20156Cisco Small Business Series Switches Buffer Overflow VulnerabilitiesCisco Small Business Smart and Managed Switches
- CVE-2023-20157Cisco Small Business Series Switches Buffer Overflow VulnerabilitiesCisco Small Business Smart and Managed Switches
- CVE-2023-20158Cisco Small Business Series Switches Buffer Overflow VulnerabilitiesCisco Small Business Smart and Managed Switches
- CVE-2023-20159Cisco Small Business Series Switches Buffer Overflow VulnerabilitiesCisco Small Business Smart and Managed Switches
- CVE-2023-20160Cisco Small Business Series Switches Buffer Overflow VulnerabilitiesCisco Small Business Smart and Managed Switches
- CVE-2023-20161Cisco Small Business Series Switches Buffer Overflow VulnerabilitiesCisco Small Business Smart and Managed Switches
- CVE-2023-20162Cisco Small Business Series Switches Buffer Overflow VulnerabilitiesCisco Small Business Smart and Managed Switches
- CVE-2023-20189Cisco Small Business Series Switches Buffer Overflow VulnerabilitiesCisco Small Business Smart and Managed Switches
- CVE-2023-31871OpenText Documentum Content Server before 23.2 has a flaw that allows for privilege escalation from a non-privileged Documentum user to root
- CVE-2023-33204sysstat through 12.7.2 allows a multiplication integer overflow in check_overflow in common.c.
Medium, low and unrated 59
- CVE-2023-32680Missing SQL permissions check in metabasemetabase
- CVE-2022-35798Azure Arc Jumpstart Information Disclosure VulnerabilityMicrosoft Azure Arc Jumpstart
- CVE-2023-2025Exposure of Sensitive Information in OpenBlue Enterprise Manager Data CollectorJohnson Controls OpenBlue Enterprise Manager Data Collector
- CVE-2023-32100Key duplication in GSDKsilabs.com Gecko Platform
- CVE-2023-32099Key duplication in GSDKsilabs.com Gecko Platform
- CVE-2023-32098Key duplication in GSDKsilabs.com Gecko Platform
- CVE-2023-32097Key duplication in GSDKsilabs.com Gecko Platform
- CVE-2023-32096Key duplication in GSDKsilabs.com Gecko Platform
- CVE-2023-2481Key duplication in GSDKsilabs.com Gecko Platform
- CVE-2023-1132Key duplication in GSDKsilabs.com Gecko Platform
- CVE-2023-0965Key duplication in GSDKsilabs.com Gecko Platform
- CVE-2022-36328Path Traversal Vulnerability leading to an arbitrary file read in Western Digital devicesWestern Digital My Cloud Home and My Cloud Home Duo · Sa… +1
- CVE-2022-36327Path traversal vulnerability leading to an arbitrary file write in Western Digital devicesWestern Digital My Cloud Home and My Cloud Home Duo · Sa… +1
- CVE-2022-36326Resource Exhaustion Vulnerability in Western Digital devicesWestern Digital My Cloud Home and My Cloud Home Duo · Sa… +1
- CVE-2023-32322Arbitrary file read in OmbiOmbi-app Ombi
- CVE-2023-2799cnoa OA hard-coded passwordcnoa OA
- CVE-2023-2790TOTOLINK N200RE Telnet Service custom.conf password in configuration fileTOTOLINK N200RE
- CVE-2023-2789GNU cflow parser.c parse_variable_declaration denial of serviceGNU cflow
- CVE-2023-25698WordPress Shoppable Images Lite Plugin <= 1.2.3 is vulnerable to Cross Site Request Forgery (CSRF)Studio Wombat Shoppable Images
- CVE-2023-27430WordPress Mass Delete Unused Tags Plugin <= 2.0.0 is vulnerable to Cross Site Request Forgery (CSRF)Ramon Fincken Mass Delete Unused Tags
- CVE-2023-27423WordPress Auto Prune Posts Plugin <= 1.8.0 is vulnerable to Cross Site Request Forgery (CSRF)Ramon Fincken Auto Prune Posts
- CVE-2023-23667WordPress Brands for WooCommerce Plugin <= 3.7.0.6 is vulnerable to Cross Site Scripting (XSS)BeRocket Brands for WooCommerce
- CVE-2023-2782Sensitive information disclosure due to improper authorization.Acronis Cyber Infrastructure
- CVE-2023-23999WordPress Google Analytics by Monster Insights Plugin <= 8.14.0 is vulnerable to Cross Site Scripting (XSS)MonsterInsights
- CVE-2022-47157WordPress WP Custom Fields Search Plugin <= 1.2.34 is vulnerable to Cross Site Scripting (XSS)Don Benjamin WP Custom Fields Search
- CVE-2023-30780WordPress User IP and Location Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)TheGuideX User IP and Location
- CVE-2023-32515WordPress Custom Field Suite Plugin <= 2.6.2.1 is vulnerable to Cross Site Scripting (XSS)Matt Gibbs Custom Field Suite
- CVE-2023-31233WordPress Baidu Tongji generator Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)Haoqisir Baidu Tongji generator
- CVE-2022-45450Sensitive information disclosure and manipulation due to improper authorization.Acronis Agent · Acronis Cyber Protect
- CVE-2022-45459Sensitive information disclosure due to insecure registry permissions.Acronis Agent · Acronis Cyber Protect
- CVE-2022-45458Sensitive information disclosure and manipulation due to improper certification validation.Acronis Agent · Acronis Cyber Protect
- CVE-2022-45457Sensitive information disclosure and manipulation due to improper certification validation.Acronis Agent · Acronis Cyber Protect
- CVE-2022-45453TLS/SSL weak cipher suites enabled.Acronis Cyber Protect
- CVE-2022-4870In affected versions of Octopus Deploy it is possible to discover network details via error messageOctopus Deploy Octopus Server
- CVE-2023-1195A use-after-free flaw was found in reconn_set_ipaddr_from_hostname in fs/cifs/connect.c in the Linux kernel.Kernel
- CVE-2023-20003Cisco Business Wireless Access Points Social Login Guest User Authentication Bypass VulnerabilityCisco Business Wireless Access Point Software
- CVE-2023-20077Cisco Identity Services Engine Arbitrary File Download VulnerabilitiesCisco Identity Services Engine Software
- CVE-2023-20087Cisco Identity Services Engine Arbitrary File Download VulnerabilitiesCisco Identity Services Engine Software
- CVE-2023-20106Cisco Identity Services Engine Arbitrary File Delete and File Read VulnerabilitiesCisco Identity Services Engine Software
- CVE-2023-20110Cisco Smart Software Manager On-Prem SQL Injection VulnerabilityCisco Smart Software Manager On-Prem
- CVE-2023-20163Cisco Identity Services Engine Command Injection VulnerabilitiesCisco Identity Services Engine Software
- CVE-2023-20164Cisco Identity Services Engine Command Injection VulnerabilitiesCisco Identity Services Engine Software
- CVE-2023-20166Cisco Identity Services Engine Path Traversal VulnerabilitiesCisco Identity Services Engine Software
- CVE-2023-20167Cisco Identity Services Engine Path Traversal VulnerabilitiesCisco Identity Services Engine Software
- CVE-2023-20171Cisco Identity Services Engine Arbitrary File Delete and File Read VulnerabilitiesCisco Identity Services Engine Software
- CVE-2023-20172Cisco Identity Services Engine Arbitrary File Delete and File Read VulnerabilitiesCisco Identity Services Engine Software
- CVE-2023-20173Cisco Identity Services Engine XML External Entity Injection VulnerabilitiesCisco Identity Services Engine Software
- CVE-2023-20174Cisco Identity Services Engine XML External Entity Injection VulnerabilitiesCisco Identity Services Engine Software
- CVE-2023-20182Cisco DNA Center Software API VulnerabilitiesCisco Digital Network Architecture Center
- CVE-2023-20183Cisco DNA Center Software API VulnerabilitiesCisco Digital Network Architecture Center
- CVE-2023-20184Cisco DNA Center Software API VulnerabilitiesCisco Digital Network Architecture Center
- CVE-2023-2800Insecure Temporary File in huggingface/transformershuggingface/transformers · transformers
- CVE-2023-28369Brother iPrint&Scan V6.11.2 and earlier contains an improper access control vulnerability.BROTHER INDUSTRIES Brother iPrint&Scan
- CVE-2023-29720SofaWiki <=3.8.9 is vulnerable to Cross Site Scripting (XSS) via index.php.
- CVE-2023-29857An issue in Teslamate v1.27.1 allows attackers to obtain sensitive information via directly accessing the teslamate link.
- CVE-2023-30124LavaLite v9.0.0 is vulnerable to Cross Site Scripting (XSS).lavalite/cms
- CVE-2023-31597An issue in Zammad v5.4.0 allows attackers to bypass e-mail verification using an arbitrary address and manipulate the data of the generated
- CVE-2023-31655redis v7.0.10 was discovered to contain a segmentation violation.
- CVE-2023-33203The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/net/ethernet/qualcomm/emac/emac.c if a physically