# CVEs published 2023-05-19

27 CVEs were published on May 19, 2023: 2 critical, 6 high. Days are UTC.

- [CVE-2023-28623](https://cve.now/CVE-2023-28623.md): Unauthorized user can register an account in specific configurations in Zulip (CVSS 6.5, zulip)
- [CVE-2023-32677](https://cve.now/CVE-2023-32677.md): Users who can send invitations can erroneously add users to streams during invitation in Zulip (CVSS 3.1, zulip)
- [CVE-2023-32675](https://cve.now/CVE-2023-32675.md): Nonpayable default functions are sometimes payable in vyper (CVSS 3.7, vyperlang vyper · vyper)
- [CVE-2023-32679](https://cve.now/CVE-2023-32679.md): Remote Code Execution via unrestricted file extension in Craft CMS (CVSS 7.2, craftcms cms · craftcms/cms)
- [CVE-2023-1996](https://cve.now/CVE-2023-1996.md): Reflected Cross-site Scripting (XSS) vulnerability affecting Release 3DEXPERIENCE R2018x through Release 3DEXPERIENCE R2023x (CVSS 6.1, Dassault Systèmes 3DEXPERIENCE)
- [CVE-2023-2815](https://cve.now/CVE-2023-2815.md): SourceCodester Online Jewelry Store POST Parameter supplier.php sql injection (CVSS 6.3, SourceCodester Online Jewelry Store)
- [CVE-2023-2814](https://cve.now/CVE-2023-2814.md): SourceCodester Class Scheduling System POST Parameter save\_teacher.php cross site scripting (CVSS 3.5, SourceCodester Class Scheduling System)
- [CVE-2022-47984](https://cve.now/CVE-2022-47984.md): IBM InfoSphere Information Server SQL injection (CVSS 6.3, IBM InfoSphere Information Server)
- [CVE-2023-22878](https://cve.now/CVE-2023-22878.md): IBM InfoSphere Information Server information disclosure (CVSS 6.2, IBM InfoSphere Information Server)
- [CVE-2023-28529](https://cve.now/CVE-2023-28529.md): IBM InfoSphere Information Server 11.7 (CVSS 5.5, IBM InfoSphere Information Server)
- [CVE-2023-28950](https://cve.now/CVE-2023-28950.md): IBM MQ information disclosure (CVSS 5.1, IBM MQ)
- [CVE-2023-28514](https://cve.now/CVE-2023-28514.md): IBM MQ information disclosure (CVSS 6.2, IBM MQ)
- [CVE-2023-28045](https://cve.now/CVE-2023-28045.md): Dell CloudIQ Collector version 1.10.2 contains a missing encryption of sensitive data vulnerability. (CVSS 6.3, Dell CloudIQ Collector)
- [CVE-2023-2806](https://cve.now/CVE-2023-2806.md): Weaver e-cology API RequestInfoByXml xml external entity reference (CVSS 5.5, Weaver e-cology)
- [CVE-2023-1618](https://cve.now/CVE-2023-1618.md): Authentication Bypass Vulnerability in MELSEC WS Series Ethernet Interface Module (CVSS 7.5, Mitsubishi Electric MELSEC WS Series WS0-GETH00200)
- [CVE-2023-2704](https://cve.now/CVE-2023-2704.md): BP Social Connect \<= 1.5 - Authentication Bypass (CVSS 9.8, vibethemes BP Social Connect)
- [CVE-2022-30114](https://cve.now/CVE-2022-30114.md): A heap-based buffer overflow in a network service in Fastweb FASTGate MediaAccess FGA2130FWB, firmware version 18.3.n.0482\_FW\_230\_FGA2130, a (CVSS 7.5)
- [CVE-2023-20881](https://cve.now/CVE-2023-20881.md): Cloud foundry instances having CAPI version between 1.140 and 1.152.0 along with loggregator-agent v7+ may override other users syslog drain (CVSS 8.1, Cloud Controller API)
- [CVE-2023-26818](https://cve.now/CVE-2023-26818.md): Telegram 9.3.1 and 9.4.0 allows attackers to access restricted files, microphone ,or video recording via the DYLD\_INSERT\_LIBRARIES flag. (CVSS 5.5)
- [CVE-2023-30199](https://cve.now/CVE-2023-30199.md): Prestashop customexporter \<= 1.7.20 is vulnerable to Incorrect Access Control via modules/customexporter/downloads/download.php. (CVSS 7.5)
- [CVE-2023-30774](https://cve.now/CVE-2023-30774.md): A vulnerability was found in the libtiff library. (no CVSS, libtiff)
- [CVE-2023-30775](https://cve.now/CVE-2023-30775.md): A vulnerability was found in the libtiff library. (CVSS 5.5, libtiff)
- [CVE-2023-31707](https://cve.now/CVE-2023-31707.md): SEMCMS 1.5 is vulnerable to SQL Injection via Ant\_Rponse.php. (CVSS 9.8)
- [CVE-2023-31756](https://cve.now/CVE-2023-31756.md): A command injection vulnerability exists in the administrative web portal in TP-Link Archer VR1600V devices running firmware Versions \<= 0.1 (CVSS 6.7)
- [CVE-2023-31757](https://cve.now/CVE-2023-31757.md): DedeCMS up to v5.7.108 is vulnerable to XSS in sys\_info.php via parameters 'edit\_\_\_cfg\_powerby' and 'edit\_\_\_cfg\_beian' (CVSS 5.4)
- [CVE-2023-31862](https://cve.now/CVE-2023-31862.md): jizhicms v2.4.6 is vulnerable to Cross Site Scripting (XSS). (CVSS 5.4)
- [CVE-2023-33240](https://cve.now/CVE-2023-33240.md): Foxit PDF Reader (12.1.1.15289 and earlier) and Foxit PDF Editor (12.1.1.15289 and all previous 12.x versions, 11.2.5.53785 and all previous (CVSS 7.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-05-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.