# CVEs published 2023-05-22

84 CVEs were published on May 22, 2023: 7 critical, 32 high. Days are UTC.

- [CVE-2022-46658](https://cve.now/CVE-2022-46658.md): CVE-2022-46658 (CVSS 6.5, Dataprobe iBoot-PDU FW)
- [CVE-2022-46738](https://cve.now/CVE-2022-46738.md): CVE-2022-46738 (CVSS 7.2, Dataprobe iBoot-PDU FW)
- [CVE-2022-47320](https://cve.now/CVE-2022-47320.md): CVE-2022-47320 (CVSS 8.1, Dataprobe iBoot-PDU FW)
- [CVE-2022-47311](https://cve.now/CVE-2022-47311.md): CVE-2022-47311 (CVSS 8.5, Dataprobe iBoot-PDU FW)
- [CVE-2022-4945](https://cve.now/CVE-2022-4945.md): CVE-2022-4945 (CVSS 6.5, Dataprobe iBoot-PDU FW)
- [CVE-2023-2504](https://cve.now/CVE-2023-2504.md): Files present on firmware images could allow an attacker to gain unauthorized access as a root user using hard-coded credentials. (CVSS 8.4, BirdDog STUDIO R3 · BirdDog 4K QUAD +2)
- [CVE-2023-2505](https://cve.now/CVE-2023-2505.md): The affected products have a CSRF vulnerability that could allow an attacker to execute code and upload malicious files. (CVSS 7.7, BirdDog STUDIO R3 · BirdDog 4K QUAD +2)
- [CVE-2023-25183](https://cve.now/CVE-2023-25183.md): In Snap One OvrC Pro versions prior to 7.2, when logged into the superuser account, a new functionality app (CVSS 8.3, Snap One OvrC Cloud)
- [CVE-2023-31240](https://cve.now/CVE-2023-31240.md): Snap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network and remotely. (CVSS 8.3, Snap One OvrC Cloud)
- [CVE-2023-31245](https://cve.now/CVE-2023-31245.md): Devices using Snap One OvrC cloud are sent to a web address when accessing a web management interface using a HTTP (CVSS 7.1, Snap One OvrC Cloud)
- [CVE-2023-28386](https://cve.now/CVE-2023-28386.md): Snap One OvrC Pro devices versions 7.2 and prior do not validate firmware updates correctly. (CVSS 8.6, Snap One OvrC Cloud)
- [CVE-2023-31193](https://cve.now/CVE-2023-31193.md): Snap One OvrC Pro versions prior to 7.3 use HTTP connections when downloading a program from their servers. (CVSS 7.5, Snap One OvrC Cloud)
- [CVE-2023-31241](https://cve.now/CVE-2023-31241.md): Snap One OvrC cloud servers contain a route an attacker can use to bypass requirements and claim devices outright. (CVSS 8.6, Snap One OvrC Cloud)
- [CVE-2023-28412](https://cve.now/CVE-2023-28412.md): When supplied with a random MAC address, Snap One OvrC cloud servers will return information about the device. (CVSS 5.3, Snap One OvrC Cloud)
- [CVE-2023-28649](https://cve.now/CVE-2023-28649.md): The Hub in the Snap One OvrC cloud platform is a device used to centralize and manage nested devices connected to it. (CVSS 8.6, Snap One OvrC Cloud)
- [CVE-2023-31062](https://cve.now/CVE-2023-31062.md): Apache InLong: Privilege escalation vulnerability for InLong (CVSS 9.8, Apache Software Foundation Apache InLong · org.apache.in… +3)
- [CVE-2023-31064](https://cve.now/CVE-2023-31064.md): Apache InLong: Insecurity direct object references cancelling applications (CVSS 7.5, Apache Software Foundation Apache InLong · org.apache.inlon…)
- [CVE-2023-31065](https://cve.now/CVE-2023-31065.md): Apache InLong: Insufficient Session Expiration in InLong (CVSS 9.1, Apache Software Foundation Apache InLong · org.apache.in… +3)
- [CVE-2023-31066](https://cve.now/CVE-2023-31066.md): Apache InLong: Insecure direct object references for inlong sources (CVSS 9.1, Apache Software Foundation Apache InLong · org.apache.in… +1)
- [CVE-2023-31098](https://cve.now/CVE-2023-31098.md): Apache InLong: Weak Password Implementation in InLong (CVSS 9.8, Apache Software Foundation Apache InLong · org.apache.inlon…)
- [CVE-2023-31101](https://cve.now/CVE-2023-31101.md): Apache InLong: Users who joined later can see the data of deleted users (no CVSS, Apache Software Foundation Apache InLong · org.apache.in… +3)
- [CVE-2023-32350](https://cve.now/CVE-2023-32350.md): Versions 00.07.00 through 00.07.03 of Teltonika’s RUT router firmware contain an operating system (OS) command injection vulnerability in a (CVSS 8.0, Teltonika RUT model routers)
- [CVE-2023-31103](https://cve.now/CVE-2023-31103.md): Apache InLong: Attackers can change the immutable name and type of cluster (CVSS 7.5, Apache Software Foundation Apache InLong · org.apache.in… +4)
- [CVE-2023-32349](https://cve.now/CVE-2023-32349.md): Version 00.07.03.4 and prior of Teltonika’s RUT router firmware contain a packet dump utility that contains proper validation for filter pa (CVSS 8.0, Teltonika RUT model routers)
- [CVE-2023-2588](https://cve.now/CVE-2023-2588.md): Teltonika’s Remote Management System versions prior to 4.10.0 have a feature allowing users to access managed devices’ local secure shell ( (CVSS 8.8, Teltonika Remote Management System)
- [CVE-2023-2587](https://cve.now/CVE-2023-2587.md): Teltonika’s Remote Management System versions prior to 4.10.0 contain a cross-site scripting (XSS) vulnerability in the main page of the we (CVSS 7.5, Teltonika Remote Management System)
- [CVE-2023-2586](https://cve.now/CVE-2023-2586.md): Teltonika’s Remote Management System versions 4.14.0 is vulnerable to an unauthorized attacker registering previously unregistered devices (CVSS 9.0, Teltonika Remote Management System)
- [CVE-2023-32348](https://cve.now/CVE-2023-32348.md): Teltonika’s Remote Management System versions prior to 4.10.0 contain a virtual private network (VPN) hub feature for cross-device communic (CVSS 5.8, Teltonika Remote Management System)
- [CVE-2023-32347](https://cve.now/CVE-2023-32347.md): Teltonika’s Remote Management System versions prior to 4.10.0 use device serial numbers and MAC addresses to identify devices from the user (CVSS 8.1, Teltonika Remote Management System)
- [CVE-2023-32346](https://cve.now/CVE-2023-32346.md): Teltonika’s Remote Management System versions prior to 4.10.0 contain a function that allows users to claim their devices. (CVSS 5.3, Teltonika Remote Management System)
- [CVE-2023-25448](https://cve.now/CVE-2023-25448.md): WordPress Archivist – Custom Archive Templates Plugin \<= 1.7.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Eric Teubert Archivist – Custom Archive Templates)
- [CVE-2023-25447](https://cve.now/CVE-2023-25447.md): WordPress ColorWay Theme \<= 4.2.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Inkthemescom ColorWay)
- [CVE-2023-31206](https://cve.now/CVE-2023-31206.md): Apache InLong: Attackers can change the immutable name and type of nodes (CVSS 7.5, Apache Software Foundation Apache InLong · org.apache.in… +4)
- [CVE-2023-31453](https://cve.now/CVE-2023-31453.md): Apache InLong: IDOR make users can delete others' subscription (CVSS 7.5, Apache Software Foundation Apache InLong · org.apache.in… +1)
- [CVE-2022-46680](https://cve.now/CVE-2022-46680.md): A CWE-319: Cleartext transmission of sensitive information vulnerability exists that could cause disclosure of sensitive information, denia (CVSS 8.8, Schneider Electric PowerLogic ION9000 · Schneider Electr… +4)
- [CVE-2023-31454](https://cve.now/CVE-2023-31454.md): Apache InLong: IDOR make users can bind any cluster (CVSS 7.5, Apache Software Foundation Apache InLong · org.apache.inlon…)
- [CVE-2023-31058](https://cve.now/CVE-2023-31058.md): Apache InLong: JDBC URL bypassing by adding blanks (CVSS 7.5, Apache Software Foundation Apache InLong · org.apache.in… +1)
- [CVE-2023-25537](https://cve.now/CVE-2023-25537.md): Dell PowerEdge 14G server BIOS versions prior to 2.18.1 and Dell Precision BIOS versions prior to 2.18.2, contain an Out of Bounds write vu (CVSS 6.1, Dell PowerEdge Platform)
- [CVE-2023-2832](https://cve.now/CVE-2023-2832.md): SQL Injection in unilogies/bumsys (CVSS 7.2, unilogies/bumsys)
- [CVE-2023-28709](https://cve.now/CVE-2023-28709.md): Apache Tomcat: Fix for CVE-2023-24998 is incomplete (no CVSS, Apache Software Foundation Apache Tomcat · org.apache.to… +1)
- [CVE-2023-23797](https://cve.now/CVE-2023-23797.md): WordPress Auto YouTube Importer Plugin \<= 1.0.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, SecondLineThemes Auto YouTube Importer)
- [CVE-2022-41608](https://cve.now/CVE-2022-41608.md): WordPress Asgaros Forum Plugin \<= 2.2.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Thomas Belser Asgaros Forum)
- [CVE-2022-44739](https://cve.now/CVE-2022-44739.md): WordPress Quick Restaurant Reservations Plugin \<= 1.5.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.3, ThingsForRestaurants Quick Restaurant Reservations)
- [CVE-2022-45076](https://cve.now/CVE-2022-45076.md): WordPress Flexible Elementor Panel Plugin \<= 2.3.8 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, WebMat Flexible Elementor Panel)
- [CVE-2022-45079](https://cve.now/CVE-2022-45079.md): WordPress Loginizer Plugin \<= 1.7.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.7, Softaculous Loginizer)
- [CVE-2022-45376](https://cve.now/CVE-2022-45376.md): WordPress Side Cart Woocommerce (Ajax) Plugin \< 2.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, XootiX Side Cart Woocommerce)
- [CVE-2022-47167](https://cve.now/CVE-2022-47167.md): WordPress Crayon Syntax Highlighter Plugin \<= 2.8.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Aram Kocharyan Crayon Syntax Highlighter)
- [CVE-2022-47183](https://cve.now/CVE-2022-47183.md): WordPress Extra Block Design, Style, CSS for ANY Gutenberg Blocks Plugin \<= 0.2.6 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, StylistWP Extra Block Design, Style, CSS for ANY Gutenberg…)
- [CVE-2022-47611](https://cve.now/CVE-2022-47611.md): WordPress Hover Image Plugin \<= 1.4.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Julian Weinert // cs&m Hover Image)
- [CVE-2022-47609](https://cve.now/CVE-2022-47609.md): WordPress DNUI Plugin \<= 2.8.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 6.3, Nicearma DNUI)
- [CVE-2022-47142](https://cve.now/CVE-2022-47142.md): WordPress Mediamatic – Media Library Folders Plugin \<= 2.8.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Plugincraft Mediamatic – Media Library Folders)
- [CVE-2023-22714](https://cve.now/CVE-2023-22714.md): WordPress Coming Soon by Supsystic Plugin \<= 1.7.10 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Coming Soon by Supsystic)
- [CVE-2023-22709](https://cve.now/CVE-2023-22709.md): WordPress SRS Simple Hits Counter Plugin \<= 1.1.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Atif N SRS Simple Hits Counter)
- [CVE-2023-22692](https://cve.now/CVE-2023-22692.md): WordPress Name Directory Plugin \<= 1.27.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Jeroen Peters Name Directory)
- [CVE-2023-22688](https://cve.now/CVE-2023-22688.md): WordPress WP Tabs Slides Plugin \<= 2.0.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Abdul Ibad WP Tabs Slides)
- [CVE-2023-23680](https://cve.now/CVE-2023-23680.md): WordPress WP TopBar Plugin \<= 5.36 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Bob Goetz WP-TopBar)
- [CVE-2023-23712](https://cve.now/CVE-2023-23712.md): WordPress User Meta Manager Plugin \<= 3.4.9 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, User Meta Manager)
- [CVE-2023-23813](https://cve.now/CVE-2023-23813.md): WordPress My Calendar Plugin \<= 3.4.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Joseph C Dolson My Calendar)
- [CVE-2022-0010](https://cve.now/CVE-2022-0010.md): QCS 800xA Vulnerability identified in system log files (CVSS 7.8, ABB QCS 800xA · ABB QCS AC450 +1)
- [CVE-2023-33236](https://cve.now/CVE-2023-33236.md): MXsecurity Hardcoded Credential Vulnerability (CVSS 9.8, Moxa MXsecurity Series)
- [CVE-2023-33235](https://cve.now/CVE-2023-33235.md): MXsecurity Command Injection Vulnerability (CVSS 7.2, Moxa MXsecurity Series)
- [CVE-2023-32336](https://cve.now/CVE-2023-32336.md): IBM InfoSphere Information Server code execution (CVSS 8.8, IBM InfoSphere Information Server)
- [CVE-2023-2597](https://cve.now/CVE-2023-2597.md): In Eclipse Openj9 before version 0.38.0, in the implementation of the shared cache (which is enabled by default in OpenJ9 builds) the size o (CVSS 7.0, Eclipse Foundation Eclipse OpenJ9)
- [CVE-2023-27066](https://cve.now/CVE-2023-27066.md): Directory Traversal vulnerability in Site Core Experience Platform 10.2 and earlier allows authenticated remote attackers to download arbitr (CVSS 6.5)
- [CVE-2023-27067](https://cve.now/CVE-2023-27067.md): Directory Traversal vulnerability in Sitecore Experience Platform through 10.2 allows remote attackers to download arbitrary files via craft (CVSS 7.5)
- [CVE-2023-2837](https://cve.now/CVE-2023-2837.md): Stack-based Buffer Overflow in gpac/gpac (CVSS 5.5, gpac/gpac)
- [CVE-2023-2838](https://cve.now/CVE-2023-2838.md): Out-of-bounds Read in gpac/gpac (CVSS 6.1, gpac/gpac)
- [CVE-2023-2839](https://cve.now/CVE-2023-2839.md): Divide By Zero in gpac/gpac (CVSS 6.8, gpac/gpac)
- [CVE-2023-2840](https://cve.now/CVE-2023-2840.md): NULL Pointer Dereference in gpac/gpac (CVSS 5.3, gpac/gpac)
- [CVE-2023-28467](https://cve.now/CVE-2023-28467.md): In MyBB before 1.8.34, there is XSS in the User CP module via the user email field. (no CVSS)
- [CVE-2023-29838](https://cve.now/CVE-2023-29838.md): Insecure Permission vulnerability found in Botkind/Siber Systems SyncApp v.19.0.3.0 allows a local attacker toe escalate privileges via the (no CVSS)
- [CVE-2023-31584](https://cve.now/CVE-2023-31584.md): GitHub repository cu/silicon commit a9ef36 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the User Input (CVSS 6.1)
- [CVE-2023-31689](https://cve.now/CVE-2023-31689.md): In Wcms 0.3.2, an attacker can send a crafted request from a vulnerable web application backend server /wcms/wex/html.php via the finish par (CVSS 9.8)
- [CVE-2023-31742](https://cve.now/CVE-2023-31742.md): There is a command injection vulnerability in the Linksys WRT54GL router with firmware version 4.30.18.006. (CVSS 7.2)
- [CVE-2023-31779](https://cve.now/CVE-2023-31779.md): Wekan v6.84 and earlier is vulnerable to Cross Site Scripting (XSS). (CVSS 5.4)
- [CVE-2023-31816](https://cve.now/CVE-2023-31816.md): IT Sourcecode Content Management System Project In PHP and MySQL With Source Code 1.0.0 is vulnerable to Cross Site Scripting (XSS) via /eco (CVSS 6.5)
- [CVE-2023-31923](https://cve.now/CVE-2023-31923.md): Suprema BioStar 2 before 2022 Q4, v2.9.1 has Insecure Permissions. (no CVSS)
- [CVE-2023-33264](https://cve.now/CVE-2023-33264.md): In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuratio (no CVSS, com.hazelcast:hazelcast)
- [CVE-2023-33281](https://cve.now/CVE-2023-33281.md): The remote keyfob system on Nissan Sylphy Classic 2021 sends the same RF signal for each door-open request, which allows for a replay attack (no CVSS)
- [CVE-2023-33285](https://cve.now/CVE-2023-33285.md): An issue was discovered in Qt 5.x before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. (CVSS 5.3)
- [CVE-2023-33288](https://cve.now/CVE-2023-33288.md): An issue was discovered in the Linux kernel before 6.2.9. (CVSS 4.7)
- [CVE-2023-33293](https://cve.now/CVE-2023-33293.md): An issue was discovered in KaiOS 3.0 and 3.1. (no CVSS)
- [CVE-2023-33294](https://cve.now/CVE-2023-33294.md): An issue was discovered in KaiOS 3.0 before 3.1. (no CVSS)
- [CVE-2023-33297](https://cve.now/CVE-2023-33297.md): Bitcoin Core before 24.1, when debug mode is not used, allows attackers to cause a denial of service (e.g., CPU consumption) because drainin (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-05-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.