CVEs published May 20, 2023
23 CVEs were published on May 20, 2023: 3 critical, 8 high.
- Published
- 23
- Critical
- 3
- High
- 8
- Medium
- 11
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- trainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…
- 6
- Huawei HarmonyOS · Huawei EMUI
- 4
- Rental Module
- 2
- Bill Erickson Gallery Metabox
- 1
- Ellucian Ethos Identity
- 1
- LJ Apps WP Airbnb Review Slider
- 1
- Lucian Apostol Auto Affiliate Links
- 1
- PingOnline Dyslexiefont Free
- 1
- RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery
- 1
- SourceCodester Class Scheduling System
- 1
Critical 3
- CVE-2023-2713IDOR vulnerability in "Rental Module" developed by third-party for Ideasoft's E-commerce Platform.Rental Module
- CVE-2023-2712Malicious File Upload vulnerability in "Rental Module" developed by third-party for Ideasoft's E-commerce Platform.Rental Module
- CVE-2023-2276WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.10.7 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Password Changewclovers WCFM Membership – WooCommerce Memberships for Mult…
High 8
- CVE-2023-23890WordPress WP Airbnb Review Slider Plugin <= 3.2 is vulnerable to Cross Site Request Forgery (CSRF)LJ Apps WP Airbnb Review Slider
- CVE-2023-1696The multimedia video module has a vulnerability in data processing.Successful exploitation of this vulnerability may affect availability.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-1694The Settings module has the file privilege escalation vulnerability.Successful exploitation of this vulnerability may affect confidentialityHuawei HarmonyOS · Huawei EMUI
- CVE-2023-1693The Settings module has the file privilege escalation vulnerability.Successful exploitation of this vulnerability may affect confidentialityHuawei HarmonyOS · Huawei EMUI
- CVE-2023-1692The window management module lacks permission verification.Successful exploitation of this vulnerability may affect confidentiality.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-2736Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Privilege Escalationtrainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…
- CVE-2023-32700LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source.
- CVE-2023-33244Obsidian before 1.2.2 allows calls to unintended APIs (for microphone access, camera access, and desktop notification) via an embedded web p
Medium, low and unrated 12
- CVE-2022-47134WordPress Gallery Metabox Plugin <= 1.5 is vulnerable to Cross Site Request Forgery (CSRF)Bill Erickson Gallery Metabox
- CVE-2023-32589WordPress Dyslexiefont Free Plugin <= 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF)PingOnline Dyslexiefont Free
- CVE-2023-22689WordPress Auto Affiliate Links Plugin <= 6.3 is vulnerable to Broken Access ControlLucian Apostol Auto Affiliate Links
- CVE-2023-24414WordPress Robo Gallery Plugin <= 3.2.11 is vulnerable to Cross Site Request Forgery (CSRF)RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery
- CVE-2023-2824SourceCodester Dental Clinic Appointment Reservation System POST Parameter service.php cross site scriptingSourceCodester Dental Clinic Appointment Reservation System
- CVE-2023-2823SourceCodester Class Scheduling System GET Parameter edit_subject.php sql injectionSourceCodester Class Scheduling System
- CVE-2023-2822Ellucian Ethos Identity logout cross site scriptingEllucian Ethos Identity
- CVE-2023-2717Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Disable All Pluginstrainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…
- CVE-2023-2735Groundhogg <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodetrainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…
- CVE-2023-2716Groundhogg <= 2.7.9.8 - Missing Authorization to Non-Arbitrary File Uploadtrainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…
- CVE-2023-2714Groundhogg <= 2.7.9.8 - Missing Authorization to Update Licensetrainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…
- CVE-2023-2715Groundhogg <= 2.7.9.8 - Missing Authorization to Admin Account and Ticket Creationtrainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…