CVEs published May 22, 2023
84 CVEs were published on May 22, 2023: 7 critical, 32 high.
- Published
- 84
- Critical
- 7
- High
- 32
- Medium
- 36
- Low
- 0
- Unrated
- 9
- Now in CISA KEV
- 0
- Fix available
- 38
Most affected products
- Snap One OvrC Cloud
- 8
- Teltonika Remote Management System
- 6
- Dataprobe iBoot-PDU FW
- 5
- gpac/gpac
- 4
- Apache Software Foundation Apache InLong · org.apache.in… +1
- 3
- Apache Software Foundation Apache InLong · org.apache.in… +3
- 3
- Apache Software Foundation Apache InLong · org.apache.inlon…
- 3
- Apache Software Foundation Apache InLong · org.apache.in… +4
- 2
- BirdDog STUDIO R3 · BirdDog 4K QUAD +2
- 2
- Moxa MXsecurity Series
- 2
Critical 7
- CVE-2023-31062Apache InLong: Privilege escalation vulnerability for InLongApache Software Foundation Apache InLong · org.apache.in… +3
- CVE-2023-31065Apache InLong: Insufficient Session Expiration in InLongApache Software Foundation Apache InLong · org.apache.in… +3
- CVE-2023-31066Apache InLong: Insecure direct object references for inlong sourcesApache Software Foundation Apache InLong · org.apache.in… +1
- CVE-2023-31098Apache InLong: Weak Password Implementation in InLongApache Software Foundation Apache InLong · org.apache.inlon…
- CVE-2023-2586 Teltonika’s Remote Management System versions 4.14.0 is vulnerable to an unauthorized attacker registering previously unregistered devices Teltonika Remote Management System
- CVE-2023-33236MXsecurity Hardcoded Credential VulnerabilityMoxa MXsecurity Series
- CVE-2023-31689In Wcms 0.3.2, an attacker can send a crafted request from a vulnerable web application backend server /wcms/wex/html.php via the finish par
High 32
- CVE-2022-46738CVE-2022-46738Dataprobe iBoot-PDU FW
- CVE-2022-47320CVE-2022-47320Dataprobe iBoot-PDU FW
- CVE-2022-47311CVE-2022-47311Dataprobe iBoot-PDU FW
- CVE-2023-2504 Files present on firmware images could allow an attacker to gain unauthorized access as a root user using hard-coded credentials.BirdDog STUDIO R3 · BirdDog 4K QUAD +2
- CVE-2023-2505 The affected products have a CSRF vulnerability that could allow an attacker to execute code and upload malicious files.BirdDog STUDIO R3 · BirdDog 4K QUAD +2
- CVE-2023-25183 In Snap One OvrC Pro versions prior to 7.2, when logged into the superuser account, a new functionality appSnap One OvrC Cloud
- CVE-2023-31240Snap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network and remotely.Snap One OvrC Cloud
- CVE-2023-31245 Devices using Snap One OvrC cloud are sent to a web address when accessing a web management interface using a HTTP Snap One OvrC Cloud
- CVE-2023-28386Snap One OvrC Pro devices versions 7.2 and prior do not validate firmware updates correctly.Snap One OvrC Cloud
- CVE-2023-31193 Snap One OvrC Pro versions prior to 7.3 use HTTP connections when downloading a program from their servers.Snap One OvrC Cloud
- CVE-2023-31241Snap One OvrC cloud servers contain a route an attacker can use to bypass requirements and claim devices outright.Snap One OvrC Cloud
- CVE-2023-28649The Hub in the Snap One OvrC cloud platform is a device used to centralize and manage nested devices connected to it.Snap One OvrC Cloud
- CVE-2023-31064Apache InLong: Insecurity direct object references cancelling applicationsApache Software Foundation Apache InLong · org.apache.inlon…
- CVE-2023-32350 Versions 00.07.00 through 00.07.03 of Teltonika’s RUT router firmware contain an operating system (OS) command injection vulnerability in aTeltonika RUT model routers
- CVE-2023-31103Apache InLong: Attackers can change the immutable name and type of clusterApache Software Foundation Apache InLong · org.apache.in… +4
- CVE-2023-32349 Version 00.07.03.4 and prior of Teltonika’s RUT router firmware contain a packet dump utility that contains proper validation for filter paTeltonika RUT model routers
- CVE-2023-2588 Teltonika’s Remote Management System versions prior to 4.10.0 have a feature allowing users to access managed devices’ local secure shell (Teltonika Remote Management System
- CVE-2023-2587 Teltonika’s Remote Management System versions prior to 4.10.0 contain a cross-site scripting (XSS) vulnerability in the main page of the weTeltonika Remote Management System
- CVE-2023-32347 Teltonika’s Remote Management System versions prior to 4.10.0 use device serial numbers and MAC addresses to identify devices from the userTeltonika Remote Management System
- CVE-2023-31206Apache InLong: Attackers can change the immutable name and type of nodesApache Software Foundation Apache InLong · org.apache.in… +4
- CVE-2023-31453Apache InLong: IDOR make users can delete others' subscriptionApache Software Foundation Apache InLong · org.apache.in… +1
- CVE-2022-46680 A CWE-319: Cleartext transmission of sensitive information vulnerability exists that could cause disclosure of sensitive information, deniaSchneider Electric PowerLogic ION9000 · Schneider Electr… +4
- CVE-2023-31454Apache InLong: IDOR make users can bind any clusterApache Software Foundation Apache InLong · org.apache.inlon…
- CVE-2023-31058Apache InLong: JDBC URL bypassing by adding blanksApache Software Foundation Apache InLong · org.apache.in… +1
- CVE-2023-2832 SQL Injection in unilogies/bumsysunilogies/bumsys
- CVE-2022-0010QCS 800xA Vulnerability identified in system log filesABB QCS 800xA · ABB QCS AC450 +1
- CVE-2023-33235MXsecurity Command Injection VulnerabilityMoxa MXsecurity Series
- CVE-2023-32336IBM InfoSphere Information Server code executionIBM InfoSphere Information Server
- CVE-2023-2597In Eclipse Openj9 before version 0.38.0, in the implementation of the shared cache (which is enabled by default in OpenJ9 builds) the size oEclipse Foundation Eclipse OpenJ9
- CVE-2023-27067Directory Traversal vulnerability in Sitecore Experience Platform through 10.2 allows remote attackers to download arbitrary files via craft
- CVE-2023-31742There is a command injection vulnerability in the Linksys WRT54GL router with firmware version 4.30.18.006.
- CVE-2023-33297Bitcoin Core before 24.1, when debug mode is not used, allows attackers to cause a denial of service (e.g., CPU consumption) because drainin
Medium, low and unrated 45
- CVE-2022-46658CVE-2022-46658Dataprobe iBoot-PDU FW
- CVE-2022-4945CVE-2022-4945Dataprobe iBoot-PDU FW
- CVE-2023-28412 When supplied with a random MAC address, Snap One OvrC cloud servers will return information about the device.Snap One OvrC Cloud
- CVE-2023-31101Apache InLong: Users who joined later can see the data of deleted usersApache Software Foundation Apache InLong · org.apache.in… +3
- CVE-2023-32348 Teltonika’s Remote Management System versions prior to 4.10.0 contain a virtual private network (VPN) hub feature for cross-device communicTeltonika Remote Management System
- CVE-2023-32346 Teltonika’s Remote Management System versions prior to 4.10.0 contain a function that allows users to claim their devices.Teltonika Remote Management System
- CVE-2023-25448WordPress Archivist – Custom Archive Templates Plugin <= 1.7.4 is vulnerable to Cross Site Request Forgery (CSRF)Eric Teubert Archivist – Custom Archive Templates
- CVE-2023-25447WordPress ColorWay Theme <= 4.2.3 is vulnerable to Cross Site Request Forgery (CSRF)Inkthemescom ColorWay
- CVE-2023-25537 Dell PowerEdge 14G server BIOS versions prior to 2.18.1 and Dell Precision BIOS versions prior to 2.18.2, contain an Out of Bounds write vuDell PowerEdge Platform
- CVE-2023-28709Apache Tomcat: Fix for CVE-2023-24998 is incompleteApache Software Foundation Apache Tomcat · org.apache.to… +1
- CVE-2023-23797WordPress Auto YouTube Importer Plugin <= 1.0.3 is vulnerable to Cross Site Request Forgery (CSRF)SecondLineThemes Auto YouTube Importer
- CVE-2022-41608WordPress Asgaros Forum Plugin <= 2.2.0 is vulnerable to Cross Site Request Forgery (CSRF)Thomas Belser Asgaros Forum
- CVE-2022-44739WordPress Quick Restaurant Reservations Plugin <= 1.5.4 is vulnerable to Cross Site Request Forgery (CSRF)ThingsForRestaurants Quick Restaurant Reservations
- CVE-2022-45076WordPress Flexible Elementor Panel Plugin <= 2.3.8 is vulnerable to Cross Site Request Forgery (CSRF)WebMat Flexible Elementor Panel
- CVE-2022-45079WordPress Loginizer Plugin <= 1.7.5 is vulnerable to Cross Site Request Forgery (CSRF)Softaculous Loginizer
- CVE-2022-45376WordPress Side Cart Woocommerce (Ajax) Plugin < 2.1 is vulnerable to Cross Site Request Forgery (CSRF)XootiX Side Cart Woocommerce
- CVE-2022-47167WordPress Crayon Syntax Highlighter Plugin <= 2.8.4 is vulnerable to Cross Site Request Forgery (CSRF)Aram Kocharyan Crayon Syntax Highlighter
- CVE-2022-47183WordPress Extra Block Design, Style, CSS for ANY Gutenberg Blocks Plugin <= 0.2.6 is vulnerable to Cross Site Request Forgery (CSRF)StylistWP Extra Block Design, Style, CSS for ANY Gutenberg…
- CVE-2022-47611WordPress Hover Image Plugin <= 1.4.1 is vulnerable to Cross Site Request Forgery (CSRF)Julian Weinert // cs&m Hover Image
- CVE-2022-47609WordPress DNUI Plugin <= 2.8.1 is vulnerable to Cross Site Request Forgery (CSRF)Nicearma DNUI
- CVE-2022-47142WordPress Mediamatic – Media Library Folders Plugin <= 2.8.1 is vulnerable to Cross Site Request Forgery (CSRF)Plugincraft Mediamatic – Media Library Folders
- CVE-2023-22714WordPress Coming Soon by Supsystic Plugin <= 1.7.10 is vulnerable to Cross Site Request Forgery (CSRF)Coming Soon by Supsystic
- CVE-2023-22709WordPress SRS Simple Hits Counter Plugin <= 1.1.0 is vulnerable to Cross Site Request Forgery (CSRF)Atif N SRS Simple Hits Counter
- CVE-2023-22692WordPress Name Directory Plugin <= 1.27.1 is vulnerable to Cross Site Request Forgery (CSRF)Jeroen Peters Name Directory
- CVE-2023-22688WordPress WP Tabs Slides Plugin <= 2.0.3 is vulnerable to Cross Site Request Forgery (CSRF)Abdul Ibad WP Tabs Slides
- CVE-2023-23680WordPress WP TopBar Plugin <= 5.36 is vulnerable to Cross Site Request Forgery (CSRF)Bob Goetz WP-TopBar
- CVE-2023-23712WordPress User Meta Manager Plugin <= 3.4.9 is vulnerable to Cross Site Request Forgery (CSRF)User Meta Manager
- CVE-2023-23813WordPress My Calendar Plugin <= 3.4.3 is vulnerable to Cross Site Request Forgery (CSRF)Joseph C Dolson My Calendar
- CVE-2023-27066Directory Traversal vulnerability in Site Core Experience Platform 10.2 and earlier allows authenticated remote attackers to download arbitr
- CVE-2023-2837Stack-based Buffer Overflow in gpac/gpacgpac/gpac
- CVE-2023-2838Out-of-bounds Read in gpac/gpacgpac/gpac
- CVE-2023-2839Divide By Zero in gpac/gpacgpac/gpac
- CVE-2023-2840NULL Pointer Dereference in gpac/gpacgpac/gpac
- CVE-2023-28467In MyBB before 1.8.34, there is XSS in the User CP module via the user email field.
- CVE-2023-29838Insecure Permission vulnerability found in Botkind/Siber Systems SyncApp v.19.0.3.0 allows a local attacker toe escalate privileges via the
- CVE-2023-31584GitHub repository cu/silicon commit a9ef36 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the User Input
- CVE-2023-31779Wekan v6.84 and earlier is vulnerable to Cross Site Scripting (XSS).
- CVE-2023-31816IT Sourcecode Content Management System Project In PHP and MySQL With Source Code 1.0.0 is vulnerable to Cross Site Scripting (XSS) via /eco
- CVE-2023-31923Suprema BioStar 2 before 2022 Q4, v2.9.1 has Insecure Permissions.
- CVE-2023-33264In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuratiocom.hazelcast:hazelcast
- CVE-2023-33281The remote keyfob system on Nissan Sylphy Classic 2021 sends the same RF signal for each door-open request, which allows for a replay attack
- CVE-2023-33285An issue was discovered in Qt 5.x before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1.
- CVE-2023-33288An issue was discovered in the Linux kernel before 6.2.9.
- CVE-2023-33293An issue was discovered in KaiOS 3.0 and 3.1.
- CVE-2023-33294An issue was discovered in KaiOS 3.0 before 3.1.