CVEs published May 23, 2023
99 CVEs were published on May 23, 2023: 17 critical, 28 high.
- Published
- 99
- Critical
- 17
- High
- 28
- Medium
- 40
- Low
- 0
- Unrated
- 14
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- Contec Co. SolarView Compact
- 5
- T&D Corporation and ESPEC MIC CORP. data logger products
- 4
- Cybozu Garoon
- 3
- Granth Go Pricing - WordPress Responsive Pricing Tables
- 3
- cloudexplorer-dev/cloudexplorer-lite
- 2
- Dell VxRail HCI
- 2
- Finex Media Competition Management System
- 2
- MicroEngine Mailform
- 2
- Monkey Wrench MW WP Form
- 2
- Vektor VK All in One Expansion Unit
- 2
Critical 17
- CVE-2023-1508SQLi in AdamPOS's Mobilmen Terminal SoftwareAdam Retail Automation Systems Mobilmen Terminal Software
- CVE-2023-23305The GarminOS TVM component in CIQ API version 1.0.0 through 4.1.7 is vulnerable to various buffer overflows when loading binary resources.
- CVE-2023-23306The `Toybox.Ant.BurstPayload.add` API method in CIQ API version 2.2.0 through 4.1.7 suffers from a type confusion vulnreability, which can r
- CVE-2023-25953Code injection vulnerability in Drive Explorer for macOS versions 3.5.4 and earlier allows an attacker who can login to the client where theWORKS MOBILE Japan Drive Explorer for macOS
- CVE-2023-27068Deserialization of Untrusted Data in Sitecore Experience Platform through 10.2 allows remote attackers to run arbitrary code via ValidationR
- CVE-2023-27388Improper authentication vulnerability in T&D Corporation and ESPEC MIC CORP.T&D Corporation and ESPEC MIC CORP. data logger products
- CVE-2023-27397Unrestricted upload of file with dangerous type exists in MicroEngine Mailform version 1.1.0 to 1.1.8.MicroEngine Mailform
- CVE-2023-27507MicroEngine Mailform version 1.1.0 to 1.1.8 contains a path traversal vulnerability.MicroEngine Mailform
- CVE-2023-28408Directory traversal vulnerability in MW WP Form versions v4.4.2 and earlier allows a remote unauthenticated attacker to alter the website orMonkey Wrench MW WP Form
- CVE-2023-28409Unrestricted upload of file with dangerous type exists in MW WP Form versions v4.4.2 and earlier, which may allow a remote unauthenticated aMonkey Wrench MW WP Form
- CVE-2023-28413Directory traversal vulnerability in Snow Monkey Forms versions v5.0.6 and earlier allows a remote unauthenticated attacker to obtain sensitMonkey Wrench Snow Monkey Forms
- CVE-2023-29919SolarView Compact <= 6.0 is vulnerable to Insecure Permissions.
- CVE-2023-31752SourceCodester Employee and Visitor Gate Pass Logging System v1.0 is vulnerable to SQL Injection via /employee_gatepass/classes/Login.php.
- CVE-2023-31814D-Link DIR-300 firmware <=REVA1.06 and <=REVB2.06 is vulnerable to File inclusion via /model/__lang_msg.php.
- CVE-2023-33338Old Age Home Management 1.0 is vulnerable to SQL Injection via the username parameter.
- CVE-2023-33361Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php.
- CVE-2023-33362Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function.
High 28
- CVE-2023-2496Go Pricing - WordPress Responsive Pricing Tables <= 3.3.19 - Improper Authorization to Arbitrary File UploadGranth Go Pricing - WordPress Responsive Pricing Tables
- CVE-2023-32697Sqlite-jdbc vulnerable to remote code execution when JDBC url is attacker controlledxerial sqlite-jdbc · org.xerial:sqlite-jdbc
- CVE-2023-2703Information Disclosure in Finex Media's Competition Management SystemFinex Media Competition Management System
- CVE-2023-2702IDOR in Finex Media's Competition Management SystemFinex Media Competition Management System
- CVE-2023-1837Missing Authentication for critical function vulnerability in HYPR Server allows Authentication Bypass when using Legacy APIs.This issue affHYPR Server
- CVE-2023-30469Reflrected Cross Site Scripting Vulnerability in Hitachi Ops Center AnalyzerHitachi Ops Center Analyzer
- CVE-2023-23304The GarminOS TVM component in CIQ API version 2.1.0 through 4.1.7 allows applications with a specially crafted head section to use the `Toyb
- CVE-2023-25946Authentication bypass vulnerability in Qrio Lock (Q-SL2) firmware version 2.0.9 and earlier allows a network-adjacent attacker to analyze thQrio Lock
- CVE-2023-27514OS command injection vulnerability in the download page of SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10 and SV-CPT-MC310F versiContec Co. SolarView Compact
- CVE-2023-27518Buffer overflow vulnerability in the multiple setting pages of SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10 and SV-CPT-MC310F vContec Co. SolarView Compact
- CVE-2023-27521OS command injection vulnerability in the mail setting page of SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10 and SV-CPT-MC310F vContec Co. SolarView Compact
- CVE-2023-28392Wi-Fi AP UNIT AC-PD-WAPU v1.05_B04 and earlier, AC-PD-WAPUM v1.05_B04 and earlier, AC-PD-WAPU-P v1.05_B04P and earlier, AC-PD-WAPUM-P v1.05_Inaba Denki Sangyo Co. Wi-Fi AP UNIT
- CVE-2023-28394Beekeeper Studio versions prior to 3.9.9 allows a remote authenticated attacker to execute arbitrary JavaScript code with the privilege of tBeekeeper Studio
- CVE-2023-2844Authorization Bypass Through User-Controlled Key in cloudexplorer-dev/cloudexplorer-litecloudexplorer-dev/cloudexplorer-lite
- CVE-2023-2845Improper Access Control in cloudexplorer-dev/cloudexplorer-litecloudexplorer-dev/cloudexplorer-lite
- CVE-2023-30382A buffer overflow in the component hl.exe of Valve Half-Life up to 5433873 allows attackers to execute arbitrary code and escalate privilege
- CVE-2023-31670An issue in wasm2c 1.0.32, wasm2wat 1.0.32, wasm-decompile 1.0.32, and wasm-validate 1.0.32 allows attackers to cause a Denial of Service (D
- CVE-2023-31726AList 3.15.1 is vulnerable to Incorrect Access Control, which can be exploited by attackers to obtain sensitive information.
- CVE-2023-31740There is a command injection vulnerability in the Linksys E2000 router with firmware version 1.0.06.
- CVE-2023-31741There is a command injection vulnerability in the Linksys E2000 router with firmware version 1.0.06.
- CVE-2023-31747Wondershare Filmora 12 (Build 12.2.1.2088) was discovered to contain an unquoted service path vulnerability via the component NativePushServ
- CVE-2023-31759Weak Security in the 433MHz keyfob of Kerui W18 Alarm System v1.0 allows attackers to gain full access via a code replay attack.
- CVE-2023-31761Weak security in the transmitter of Blitzwolf BW-IS22 Smart Home Security Alarm v1.0 allows attackers to gain full access to the system via
- CVE-2023-31762Weak security in the transmitter of Digoo DG-HAMB Smart Home Security System v1.0 allows attackers to gain full access to the system via a c
- CVE-2023-31763Weak security in the transmitter of AGShome Smart Alarm v1.0 allows attackers to gain full access to the system via a code replay attack.
- CVE-2023-31826Skyscreamer Open Source Nevado JMS v1.3.2 does not perform security checks when receiving messages.org.skyscreamer:nevado-jms
- CVE-2023-31996Hanwha IP Camera ANE-L7012R 1.41.01 is vulnerable to Command Injection due to improper sanitization of special characters for the NAS storag
- CVE-2023-33617An OS Command Injection vulnerability in Parks Fiberlink 210 firmware version V2.1.14_X000 was found via the /boaform/admin/formPing target_
Medium, low and unrated 54
- CVE-2023-2494Go Pricing - WordPress Responsive Pricing Tables <= 3.3.19 - Missing Authorization to Limited Privilege GrantingGranth Go Pricing - WordPress Responsive Pricing Tables
- CVE-2023-2498Go Pricing - WordPress Responsive Pricing Tables <= 3.3.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeGranth Go Pricing - WordPress Responsive Pricing Tables
- CVE-2023-28015HCL Domino AppDev Pack is susceptible to a User Account Enumeration vulnerabilityHCL Software Domino AppDev Pack
- CVE-2023-1209Cross-Site Scripting (XSS) vulnerabilities exist in ServiceNow records allowing an authenticated attacker to inject arbitrary scripts.ServiceNow Records
- CVE-2023-25474WordPress About Me 3000 widget Plugin <= 2.2.6 is vulnerable to Cross Site Request Forgery (CSRF)Csaba Kissi About Me 3000 widget
- CVE-2022-46813WordPress Advanced Database Cleaner Plugin <= 3.1.1 is vulnerable to Cross Site Request Forgery (CSRF)Younes JFR. Advanced Database Cleaner
- CVE-2023-26011WordPress Read More Excerpt Link Plugin <= 1.6 is vulnerable to Cross Site Request Forgery (CSRF)Tim Eckel Read More Excerpt Link
- CVE-2023-26014WordPress Minify HTML Plugin <= 2.1.7 is vulnerable to Cross Site Request Forgery (CSRF)Tim Eckel Minify HTML
- CVE-2023-25056WordPress Feed Them Social Plugin <= 3.0.2 is vulnerable to Cross Site Request Forgery (CSRF)SlickRemix Feed Them Social
- CVE-2023-30440IBM PowerVM Hypervisor denial of serviceIBM PowerVM Hypervisor
- CVE-2023-23713WordPress Theme Tweaker Plugin <= 5.20 is vulnerable to Cross Site Request Forgery (CSRF)Manoj Thulasidas Theme Tweaker
- CVE-2022-46853WordPress The Post Grid Plugin <= 5.0.4 is vulnerable to Cross Site Request Forgery (CSRF)RadiusTheme The Post Grid
- CVE-2022-46851WordPress Starter Templates Plugin <= 3.1.20 is vulnerable to Cross Site Request Forgery (CSRF)Brainstorm Force Starter Templates
- CVE-2023-23705WordPress Books Gallery Plugin <= 4.4.8 is vulnerable to Cross Site Request Forgery (CSRF)HM Plugin WordPress Books Gallery
- CVE-2023-23724WordPress WordPress Email Marketing Plugin – WP Email Capture Plugin <= 3.9.3 is vulnerable to Cross Site Request Forgery (CSRF)Winwar Media WP Email Capture
- CVE-2023-23706WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) Plugin <= 7.5.14 is vulnerable to Cross Site Request Forgery (CSRF)miniOrange WordPress Social Login and Register
- CVE-2023-25707WordPress VikBooking Hotel Booking Engine & PMS Plugin <= 1.5.12 is vulnerable to Cross Site Request Forgery (CSRF)E4J s.r.l. VikBooking Hotel Booking Engine & PMS
- CVE-2023-25481WordPress Podlove Subscribe button Plugin <= 1.3.7 is vulnerable to Cross Site Request Forgery (CSRF)Podlove Subscribe button
- CVE-2023-25472WordPress Podlove Podcast Publisher Plugin <= 3.8.3 is vulnerable to Cross Site Request Forgery (CSRF)Podlove Podcast Publisher
- CVE-2023-23694 Dell VxRail versions earlier than 7.0.450, contain(s) an OS command injection vulnerability in VxRail Manager.Dell VxRail HCI
- CVE-2023-23693 Dell VxRail, versions prior to 7.0.450, contains an OS command injection Vulnerability in DCManager command-line utility.Dell VxRail HCI
- CVE-2020-20012WebPlus Pro v1.4.7.8.4-01 is vulnerable to Incorrect Access Control.
- CVE-2023-22654Client-side enforcement of server-side security issue exists in T&D Corporation and ESPEC MIC CORP.T&D Corporation and ESPEC MIC CORP. data logger products
- CVE-2023-23298The `Toybox.Graphics.BufferedBitmap.initialize` API method in CIQ API version 2.3.0 through 4.1.7 does not validate its parameters, which ca
- CVE-2023-23299The permission system implemented and enforced by the GarminOS TVM component in CIQ API version 1.0.0 through 4.1.7 can be bypassed entirely
- CVE-2023-23300The `Toybox.Cryptography.Cipher.initialize` API method in CIQ API version 3.0.0 through 4.1.7 does not validate its parameters, which can re
- CVE-2023-23301The `news` MonkeyC operation code in CIQ API version 1.0.0 through 4.1.7 fails to check that string resources are not extending past the end
- CVE-2023-23302The `Toybox.GenericChannel.setDeviceConfig` API method in CIQ API version 1.2.0 through 4.1.7 does not validate its parameter, which can res
- CVE-2023-23303The `Toybox.Ant.GenericChannel.enableEncryption` API method in CIQ API version 3.2.0 through 4.1.7 does not validate its parameter, which ca
- CVE-2023-23545Missing authentication for critical function exists in T&D Corporation and ESPEC MIC CORP.T&D Corporation and ESPEC MIC CORP. data logger products
- CVE-2023-25440Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to execute arbitrary code
- CVE-2023-26595Denial-of-service (DoS) vulnerability in Message of Cybozu Garoon 4.10.0 to 5.9.2 allows a remote authenticated attacker to cause a denial oCybozu Garoon
- CVE-2023-27304Operation restriction bypass vulnerability in Message and Bulletin of Cybozu Garoon 4.6.0 to 5.9.2 allows a remote authenticated attacker toCybozu Garoon
- CVE-2023-27384Operation restriction bypass vulnerability in MultiReport of Cybozu Garoon 5.15.0 allows a remote authenticated attacker to alter the data oCybozu Garoon
- CVE-2023-27387Cross-site request forgery (CSRF) in T&D Corporation and ESPEC MIC CORP.T&D Corporation and ESPEC MIC CORP. data logger products
- CVE-2023-27512Use of hard-coded credentials exists in SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10, and SV-CPT-MC310F versions prior to Ver.8Contec Co. SolarView Compact
- CVE-2023-27920Improper access control vulnerability in the system date/time setting page of SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10 and Contec Co. SolarView Compact
- CVE-2023-27921JINS MEME CORE Firmware version 2.2.0 and earlier uses a hard-coded cryptographic key, which may lead to data acquired by a sensor of the afJINS MEME CORE
- CVE-2023-27922Cross-site scripting vulnerability in Newsletter versions prior to 7.6.9 allows a remote unauthenticated attacker to inject an arbitrary scrStefano Lissa & The Newsletter Team Newsletter
- CVE-2023-27923Cross-site scripting vulnerability in Tag edit function of VK Blocks 1.53.0.1 and earlier and VK Blocks Pro 1.53.0.1 and earlier allows a reVektor VK Blocks and VK Blocks Pro
- CVE-2023-27925Cross-site scripting vulnerability in Post function of VK Blocks 1.53.0.1 and earlier and VK Blocks Pro 1.53.0.1 and earlier allows a remoteVektor VK Blocks and VK Blocks Pro
- CVE-2023-27926Cross-site scripting vulnerability in Profile setting function of VK All in One Expansion Unit 9.88.1.0 and earlier allows a remote authentiVektor VK All in One Expansion Unit
- CVE-2023-28367Cross-site scripting vulnerability in CTA post function of VK All in One Expansion Unit 9.88.1.0 and earlier allows a remote authenticated aVektor VK All in One Expansion Unit
- CVE-2023-28390Privilege escalation vulnerability in SR-7100VN firmware Ver.1.38(N) and earlier and SR-7100VN #31 firmware Ver.1.21 and earlier allows a neICOM INCORPORATED SR-7100VN
- CVE-2023-31517A memory leak in the component CConsole::Chain of Teeworlds v0.7.5 allows attackers to cause a Denial of Service (DoS) via opening a crafted
- CVE-2023-31518A heap use-after-free in the component CDataFileReader::GetItem of teeworlds v0.7.5 allows attackers to cause a Denial of Service (DoS) via
- CVE-2023-31664A reflected cross-site scripting (XSS) vulnerability in /authenticationendpoint/login.do of WSO2 API Manager before 4.2.0 allows attackers t
- CVE-2023-31669WebAssembly wat2wasm v1.0.32 allows attackers to cause a libc++abi.dylib crash by putting '@' before a quote (").
- CVE-2023-31708A Cross-Site Request Forgery (CSRF) in EyouCMS v1.6.2 allows attackers to execute arbitrary commands via a supplying a crafted HTML file to
- CVE-2023-31860Wuzhi CMS v3.1.2 has a storage type XSS vulnerability in the backend of the Five Finger CMS b2b system.
- CVE-2023-31994Certain Hanwha products are vulnerable to Denial of Service (DoS).
- CVE-2023-31995Hanwha IP Camera ANE-L7012R 1.41.01 is vulnerable to Cross Site Scripting (XSS).
- CVE-2023-33359Piwigo 13.6.0 is vulnerable to Cross Site Request Forgery (CSRF) in the "add tags" function.
- CVE-2023-33599EasyImages2.0 ≤ 2.8.1 is vulnerable to Cross Site Scripting (XSS) via viewlog.php.