CVEs published May 19, 2023
27 CVEs were published on May 19, 2023: 2 critical, 6 high.
- Published
- 27
- Critical
- 2
- High
- 6
- Medium
- 15
- Low
- 3
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- IBM InfoSphere Information Server
- 3
- IBM MQ
- 2
- libtiff
- 2
- zulip
- 2
- Cloud Controller API
- 1
- craftcms cms · craftcms/cms
- 1
- Dassault Systèmes 3DEXPERIENCE
- 1
- Dell CloudIQ Collector
- 1
- Mitsubishi Electric MELSEC WS Series WS0-GETH00200
- 1
- SourceCodester Class Scheduling System
- 1
Critical 2
High 6
- CVE-2023-32679Remote Code Execution via unrestricted file extension in Craft CMScraftcms cms · craftcms/cms
- CVE-2023-1618Authentication Bypass Vulnerability in MELSEC WS Series Ethernet Interface ModuleMitsubishi Electric MELSEC WS Series WS0-GETH00200
- CVE-2022-30114A heap-based buffer overflow in a network service in Fastweb FASTGate MediaAccess FGA2130FWB, firmware version 18.3.n.0482_FW_230_FGA2130, a
- CVE-2023-20881Cloud foundry instances having CAPI version between 1.140 and 1.152.0 along with loggregator-agent v7+ may override other users syslog drainCloud Controller API
- CVE-2023-30199Prestashop customexporter <= 1.7.20 is vulnerable to Incorrect Access Control via modules/customexporter/downloads/download.php.
- CVE-2023-33240Foxit PDF Reader (12.1.1.15289 and earlier) and Foxit PDF Editor (12.1.1.15289 and all previous 12.x versions, 11.2.5.53785 and all previous
Medium, low and unrated 19
- CVE-2023-28623Unauthorized user can register an account in specific configurations in Zulipzulip
- CVE-2023-32677Users who can send invitations can erroneously add users to streams during invitation in Zulipzulip
- CVE-2023-32675Nonpayable default functions are sometimes payable in vypervyperlang vyper · vyper
- CVE-2023-1996Reflected Cross-site Scripting (XSS) vulnerability affecting Release 3DEXPERIENCE R2018x through Release 3DEXPERIENCE R2023xDassault Systèmes 3DEXPERIENCE
- CVE-2023-2815SourceCodester Online Jewelry Store POST Parameter supplier.php sql injectionSourceCodester Online Jewelry Store
- CVE-2023-2814SourceCodester Class Scheduling System POST Parameter save_teacher.php cross site scriptingSourceCodester Class Scheduling System
- CVE-2022-47984IBM InfoSphere Information Server SQL injectionIBM InfoSphere Information Server
- CVE-2023-22878IBM InfoSphere Information Server information disclosureIBM InfoSphere Information Server
- CVE-2023-28529IBM InfoSphere Information Server 11.7IBM InfoSphere Information Server
- CVE-2023-28950IBM MQ information disclosureIBM MQ
- CVE-2023-28514IBM MQ information disclosureIBM MQ
- CVE-2023-28045 Dell CloudIQ Collector version 1.10.2 contains a missing encryption of sensitive data vulnerability.Dell CloudIQ Collector
- CVE-2023-2806Weaver e-cology API RequestInfoByXml xml external entity referenceWeaver e-cology
- CVE-2023-26818Telegram 9.3.1 and 9.4.0 allows attackers to access restricted files, microphone ,or video recording via the DYLD_INSERT_LIBRARIES flag.
- CVE-2023-30774A vulnerability was found in the libtiff library.libtiff
- CVE-2023-30775A vulnerability was found in the libtiff library.libtiff
- CVE-2023-31756A command injection vulnerability exists in the administrative web portal in TP-Link Archer VR1600V devices running firmware Versions <= 0.1
- CVE-2023-31757DedeCMS up to v5.7.108 is vulnerable to XSS in sys_info.php via parameters 'edit___cfg_powerby' and 'edit___cfg_beian'
- CVE-2023-31862jizhicms v2.4.6 is vulnerable to Cross Site Scripting (XSS).