# CVEs published 2023-05-18

90 CVEs were published on May 18, 2023: 11 critical, 20 high. Days are UTC.

- [CVE-2023-32680](https://cve.now/CVE-2023-32680.md): Missing SQL permissions check in metabase (CVSS 5.8, metabase)
- [CVE-2022-35798](https://cve.now/CVE-2022-35798.md): Azure Arc Jumpstart Information Disclosure Vulnerability (CVSS 3.3, Microsoft Azure Arc Jumpstart)
- [CVE-2023-30470](https://cve.now/CVE-2023-30470.md): A use-after-free related to unsound inference in the bytecode generation when optimizations are enabled for Hermes prior to commit da8990f73 (CVSS 9.8, Facebook Hermes)
- [CVE-2023-28753](https://cve.now/CVE-2023-28753.md): netconsd prior to v0.2 was vulnerable to an integer overflow in its parse\_packet function. (CVSS 9.8, Facebook netconsd)
- [CVE-2023-28081](https://cve.now/CVE-2023-28081.md): A bytecode optimization bug in Hermes prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could be used to cause an use-after-free and (CVSS 9.8, Facebook Hermes)
- [CVE-2023-25933](https://cve.now/CVE-2023-25933.md): A type confusion bug in TypedArray prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could have been used by a malicious attacker to (CVSS 9.8, Facebook Hermes)
- [CVE-2023-24833](https://cve.now/CVE-2023-24833.md): A use-after-free in BigIntPrimitive addition in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by an a (CVSS 7.5, Facebook Hermes)
- [CVE-2023-24832](https://cve.now/CVE-2023-24832.md): A null pointer dereference bug in Hermes prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708 could have been used by an attacker to cra (CVSS 7.5, Facebook Hermes)
- [CVE-2023-23759](https://cve.now/CVE-2023-23759.md): There is a vulnerability in the fizz library prior to v2023.01.30.00 where a CHECK failure can be triggered remotely. (CVSS 7.5, Facebook fizz)
- [CVE-2023-23557](https://cve.now/CVE-2023-23557.md): An error in Hermes' algorithm for copying objects properties prior to commit a00d237346894c6067a594983be6634f4168c9ad could be used by a mal (CVSS 9.8, Facebook Hermes)
- [CVE-2023-23556](https://cve.now/CVE-2023-23556.md): An error in BigInt conversion to Number in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by a malicio (CVSS 9.8, Facebook Hermes)
- [CVE-2023-2025](https://cve.now/CVE-2023-2025.md): Exposure of Sensitive Information in OpenBlue Enterprise Manager Data Collector (CVSS 5.0, Johnson Controls OpenBlue Enterprise Manager Data Collector)
- [CVE-2023-2024](https://cve.now/CVE-2023-2024.md): Improper Authentication for OpenBlue Enterprise Manager Data Collector (CVSS 10.0, Johnson Controls OpenBlue Enterprise Manager Data Collector)
- [CVE-2023-32100](https://cve.now/CVE-2023-32100.md): Key duplication in GSDK (CVSS 5.3, silabs.com Gecko Platform)
- [CVE-2023-32099](https://cve.now/CVE-2023-32099.md): Key duplication in GSDK (CVSS 5.3, silabs.com Gecko Platform)
- [CVE-2023-32098](https://cve.now/CVE-2023-32098.md): Key duplication in GSDK (CVSS 5.3, silabs.com Gecko Platform)
- [CVE-2023-32097](https://cve.now/CVE-2023-32097.md): Key duplication in GSDK (CVSS 3.1, silabs.com Gecko Platform)
- [CVE-2023-32096](https://cve.now/CVE-2023-32096.md): Key duplication in GSDK (CVSS 3.1, silabs.com Gecko Platform)
- [CVE-2023-2481](https://cve.now/CVE-2023-2481.md): Key duplication in GSDK (CVSS 5.3, silabs.com Gecko Platform)
- [CVE-2023-1132](https://cve.now/CVE-2023-1132.md): Key duplication in GSDK (CVSS 5.3, silabs.com Gecko Platform)
- [CVE-2023-0965](https://cve.now/CVE-2023-0965.md): Key duplication in GSDK (CVSS 3.1, silabs.com Gecko Platform)
- [CVE-2022-36328](https://cve.now/CVE-2022-36328.md): Path Traversal Vulnerability leading to an arbitrary file read in Western Digital devices (CVSS 5.8, Western Digital My Cloud Home and My Cloud Home Duo · Sa… +1)
- [CVE-2022-36327](https://cve.now/CVE-2022-36327.md): Path traversal vulnerability leading to an arbitrary file write in Western Digital devices (CVSS 5.8, Western Digital My Cloud Home and My Cloud Home Duo · Sa… +1)
- [CVE-2022-36326](https://cve.now/CVE-2022-36326.md): Resource Exhaustion Vulnerability in Western Digital devices (CVSS 4.4, Western Digital My Cloud Home and My Cloud Home Duo · Sa… +1)
- [CVE-2023-32322](https://cve.now/CVE-2023-32322.md): Arbitrary file read in Ombi (CVSS 4.9, Ombi-app Ombi)
- [CVE-2023-2799](https://cve.now/CVE-2023-2799.md): cnoa OA hard-coded password (CVSS 6.3, cnoa OA)
- [CVE-2023-2790](https://cve.now/CVE-2023-2790.md): TOTOLINK N200RE Telnet Service custom.conf password in configuration file (CVSS 2.3, TOTOLINK N200RE)
- [CVE-2023-2789](https://cve.now/CVE-2023-2789.md): GNU cflow parser.c parse\_variable\_declaration denial of service (CVSS 3.5, GNU cflow)
- [CVE-2023-25698](https://cve.now/CVE-2023-25698.md): WordPress Shoppable Images Lite Plugin \<= 1.2.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Studio Wombat Shoppable Images)
- [CVE-2023-27430](https://cve.now/CVE-2023-27430.md): WordPress Mass Delete Unused Tags Plugin \<= 2.0.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Ramon Fincken Mass Delete Unused Tags)
- [CVE-2023-27423](https://cve.now/CVE-2023-27423.md): WordPress Auto Prune Posts Plugin \<= 1.8.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Ramon Fincken Auto Prune Posts)
- [CVE-2023-23667](https://cve.now/CVE-2023-23667.md): WordPress Brands for WooCommerce Plugin \<= 3.7.0.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, BeRocket Brands for WooCommerce)
- [CVE-2023-2782](https://cve.now/CVE-2023-2782.md): Sensitive information disclosure due to improper authorization. (CVSS 5.5, Acronis Cyber Infrastructure)
- [CVE-2023-23999](https://cve.now/CVE-2023-23999.md): WordPress Google Analytics by Monster Insights Plugin \<= 8.14.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, MonsterInsights)
- [CVE-2022-47157](https://cve.now/CVE-2022-47157.md): WordPress WP Custom Fields Search Plugin \<= 1.2.34 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Don Benjamin WP Custom Fields Search)
- [CVE-2023-30780](https://cve.now/CVE-2023-30780.md): WordPress User IP and Location Plugin \<= 2.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, TheGuideX User IP and Location)
- [CVE-2022-4418](https://cve.now/CVE-2022-4418.md): Local privilege escalation due to unrestricted loading of unsigned libraries. (CVSS 7.8, Acronis Cyber Protect Home Office)
- [CVE-2023-32515](https://cve.now/CVE-2023-32515.md): WordPress Custom Field Suite Plugin \<= 2.6.2.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Matt Gibbs Custom Field Suite)
- [CVE-2023-31233](https://cve.now/CVE-2023-31233.md): WordPress Baidu Tongji generator Plugin \<= 1.0.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Haoqisir Baidu Tongji generator)
- [CVE-2022-45450](https://cve.now/CVE-2022-45450.md): Sensitive information disclosure and manipulation due to improper authorization. (CVSS 5.4, Acronis Agent · Acronis Cyber Protect)
- [CVE-2022-45459](https://cve.now/CVE-2022-45459.md): Sensitive information disclosure due to insecure registry permissions. (CVSS 3.8, Acronis Agent · Acronis Cyber Protect)
- [CVE-2022-45458](https://cve.now/CVE-2022-45458.md): Sensitive information disclosure and manipulation due to improper certification validation. (CVSS 4.2, Acronis Agent · Acronis Cyber Protect)
- [CVE-2022-45457](https://cve.now/CVE-2022-45457.md): Sensitive information disclosure and manipulation due to improper certification validation. (CVSS 4.2, Acronis Agent · Acronis Cyber Protect)
- [CVE-2022-45452](https://cve.now/CVE-2022-45452.md): Local privilege escalation due to insecure folder permissions. (CVSS 7.3, Acronis Agent · Acronis Cyber Protect)
- [CVE-2022-45453](https://cve.now/CVE-2022-45453.md): TLS/SSL weak cipher suites enabled. (CVSS 5.3, Acronis Cyber Protect)
- [CVE-2023-30487](https://cve.now/CVE-2023-30487.md): WordPress LearnPress Export Import Plugin \<= 4.0.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, ThimPress LearnPress Export Import)
- [CVE-2023-30868](https://cve.now/CVE-2023-30868.md): WordPress CMS Tree Page View Plugin \<= 1.6.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Jon Christopher CMS Tree Page View)
- [CVE-2023-2757](https://cve.now/CVE-2023-2757.md): Waiting: One-click countdowns \<= 0.6.2 - Missing Authorization Checks leading to Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 7.4, pluginbuilders Waiting: One-click countdowns)
- [CVE-2019-25137](https://cve.now/CVE-2019-25137.md): Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by authenticated administrators via msxsl:script in an xsltSele (CVSS 7.2)
- [CVE-2022-4870](https://cve.now/CVE-2022-4870.md): In affected versions of Octopus Deploy it is possible to discover network details via error message (CVSS 5.3, Octopus Deploy Octopus Server)
- [CVE-2023-1195](https://cve.now/CVE-2023-1195.md): A use-after-free flaw was found in reconn\_set\_ipaddr\_from\_hostname in fs/cifs/connect.c in the Linux kernel. (CVSS 5.5, Kernel)
- [CVE-2023-20003](https://cve.now/CVE-2023-20003.md): Cisco Business Wireless Access Points Social Login Guest User Authentication Bypass Vulnerability (CVSS 4.7, Cisco Business Wireless Access Point Software)
- [CVE-2023-20024](https://cve.now/CVE-2023-20024.md): Cisco Small Business Series Switches Buffer Overflow Vulnerabilities (CVSS 8.6, Cisco Small Business Smart and Managed Switches)
- [CVE-2023-20077](https://cve.now/CVE-2023-20077.md): Cisco Identity Services Engine Arbitrary File Download Vulnerabilities (CVSS 4.9, Cisco Identity Services Engine Software)
- [CVE-2023-20087](https://cve.now/CVE-2023-20087.md): Cisco Identity Services Engine Arbitrary File Download Vulnerabilities (CVSS 4.9, Cisco Identity Services Engine Software)
- [CVE-2023-20106](https://cve.now/CVE-2023-20106.md): Cisco Identity Services Engine Arbitrary File Delete and File Read Vulnerabilities (CVSS 5.4, Cisco Identity Services Engine Software)
- [CVE-2023-20110](https://cve.now/CVE-2023-20110.md): Cisco Smart Software Manager On-Prem SQL Injection Vulnerability (CVSS 6.5, Cisco Smart Software Manager On-Prem)
- [CVE-2023-20156](https://cve.now/CVE-2023-20156.md): Cisco Small Business Series Switches Buffer Overflow Vulnerabilities (CVSS 8.6, Cisco Small Business Smart and Managed Switches)
- [CVE-2023-20157](https://cve.now/CVE-2023-20157.md): Cisco Small Business Series Switches Buffer Overflow Vulnerabilities (CVSS 8.6, Cisco Small Business Smart and Managed Switches)
- [CVE-2023-20158](https://cve.now/CVE-2023-20158.md): Cisco Small Business Series Switches Buffer Overflow Vulnerabilities (CVSS 8.6, Cisco Small Business Smart and Managed Switches)
- [CVE-2023-20159](https://cve.now/CVE-2023-20159.md): Cisco Small Business Series Switches Buffer Overflow Vulnerabilities (CVSS 8.6, Cisco Small Business Smart and Managed Switches)
- [CVE-2023-20160](https://cve.now/CVE-2023-20160.md): Cisco Small Business Series Switches Buffer Overflow Vulnerabilities (CVSS 8.6, Cisco Small Business Smart and Managed Switches)
- [CVE-2023-20161](https://cve.now/CVE-2023-20161.md): Cisco Small Business Series Switches Buffer Overflow Vulnerabilities (CVSS 8.6, Cisco Small Business Smart and Managed Switches)
- [CVE-2023-20162](https://cve.now/CVE-2023-20162.md): Cisco Small Business Series Switches Buffer Overflow Vulnerabilities (CVSS 8.6, Cisco Small Business Smart and Managed Switches)
- [CVE-2023-20163](https://cve.now/CVE-2023-20163.md): Cisco Identity Services Engine Command Injection Vulnerabilities (CVSS 6.5, Cisco Identity Services Engine Software)
- [CVE-2023-20164](https://cve.now/CVE-2023-20164.md): Cisco Identity Services Engine Command Injection Vulnerabilities (CVSS 6.5, Cisco Identity Services Engine Software)
- [CVE-2023-20166](https://cve.now/CVE-2023-20166.md): Cisco Identity Services Engine Path Traversal Vulnerabilities (CVSS 6.0, Cisco Identity Services Engine Software)
- [CVE-2023-20167](https://cve.now/CVE-2023-20167.md): Cisco Identity Services Engine Path Traversal Vulnerabilities (CVSS 6.0, Cisco Identity Services Engine Software)
- [CVE-2023-20171](https://cve.now/CVE-2023-20171.md): Cisco Identity Services Engine Arbitrary File Delete and File Read Vulnerabilities (CVSS 5.4, Cisco Identity Services Engine Software)
- [CVE-2023-20172](https://cve.now/CVE-2023-20172.md): Cisco Identity Services Engine Arbitrary File Delete and File Read Vulnerabilities (CVSS 5.4, Cisco Identity Services Engine Software)
- [CVE-2023-20173](https://cve.now/CVE-2023-20173.md): Cisco Identity Services Engine XML External Entity Injection Vulnerabilities (CVSS 4.9, Cisco Identity Services Engine Software)
- [CVE-2023-20174](https://cve.now/CVE-2023-20174.md): Cisco Identity Services Engine XML External Entity Injection Vulnerabilities (CVSS 4.9, Cisco Identity Services Engine Software)
- [CVE-2023-20182](https://cve.now/CVE-2023-20182.md): Cisco DNA Center Software API Vulnerabilities (CVSS 5.4, Cisco Digital Network Architecture Center)
- [CVE-2023-20183](https://cve.now/CVE-2023-20183.md): Cisco DNA Center Software API Vulnerabilities (CVSS 5.4, Cisco Digital Network Architecture Center)
- [CVE-2023-20184](https://cve.now/CVE-2023-20184.md): Cisco DNA Center Software API Vulnerabilities (CVSS 5.4, Cisco Digital Network Architecture Center)
- [CVE-2023-20189](https://cve.now/CVE-2023-20189.md): Cisco Small Business Series Switches Buffer Overflow Vulnerabilities (CVSS 8.6, Cisco Small Business Smart and Managed Switches)
- [CVE-2023-27217](https://cve.now/CVE-2023-27217.md): A stack-based buffer overflow in the ChangeFriendlyName() function of Belkin Smart Outlet V2 F7c063 firmware\_2.00.11420.OWRT.PVT\_SNSV2 allow (CVSS 9.8)
- [CVE-2023-2800](https://cve.now/CVE-2023-2800.md): Insecure Temporary File in huggingface/transformers (CVSS 4.7, huggingface/transformers · transformers)
- [CVE-2023-28369](https://cve.now/CVE-2023-28369.md): Brother iPrint&Scan V6.11.2 and earlier contains an improper access control vulnerability. (CVSS 3.3, BROTHER INDUSTRIES Brother iPrint&Scan)
- [CVE-2023-29720](https://cve.now/CVE-2023-29720.md): SofaWiki \<=3.8.9 is vulnerable to Cross Site Scripting (XSS) via index.php. (CVSS 6.1)
- [CVE-2023-29857](https://cve.now/CVE-2023-29857.md): An issue in Teslamate v1.27.1 allows attackers to obtain sensitive information via directly accessing the teslamate link. (CVSS 5.3)
- [CVE-2023-29985](https://cve.now/CVE-2023-29985.md): Sourcecodester Student Study Center Desk Management System v1.0 admin\\reports\\index.php#date\_from has a SQL Injection vulnerability. (CVSS 9.8)
- [CVE-2023-30124](https://cve.now/CVE-2023-30124.md): LavaLite v9.0.0 is vulnerable to Cross Site Scripting (XSS). (CVSS 5.4, lavalite/cms)
- [CVE-2023-30333](https://cve.now/CVE-2023-30333.md): An arbitrary file upload vulnerability in the component /admin/ThemeController.java of PerfreeBlog v3.1.2 allows attackers to execute arbitr (CVSS 9.8)
- [CVE-2023-31597](https://cve.now/CVE-2023-31597.md): An issue in Zammad v5.4.0 allows attackers to bypass e-mail verification using an arbitrary address and manipulate the data of the generated (CVSS 6.5)
- [CVE-2023-31655](https://cve.now/CVE-2023-31655.md): redis v7.0.10 was discovered to contain a segmentation violation. (no CVSS)
- [CVE-2023-31729](https://cve.now/CVE-2023-31729.md): TOTOLINK A3300R v17.0.0cu.557 is vulnerable to Command Injection via /cgi-bin/cstecgi.cgi. (CVSS 9.8)
- [CVE-2023-31871](https://cve.now/CVE-2023-31871.md): OpenText Documentum Content Server before 23.2 has a flaw that allows for privilege escalation from a non-privileged Documentum user to root (CVSS 7.8)
- [CVE-2023-33203](https://cve.now/CVE-2023-33203.md): The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/net/ethernet/qualcomm/emac/emac.c if a physically (CVSS 6.4)
- [CVE-2023-33204](https://cve.now/CVE-2023-33204.md): sysstat through 12.7.2 allows a multiplication integer overflow in check\_overflow in common.c. (CVSS 7.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-05-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.