CVEs published May 24, 2023
85 CVEs were published on May 24, 2023: 12 critical, 16 high. 4 are now in CISA KEV.
- Published
- 85
- Critical
- 12
- High
- 16
- Medium
- 34
- Low
- 7
- Unrated
- 16
- Now in CISA KEV
- 4
- Fix available
- 26
Most affected products
- Liferay Portal · Liferay DXP +1
- 14
- Hitachi Vantara Pentaho Business Analytics Server
- 2
- Kubernetes minikube
- 2
- Twister Antivirus
- 2
- Zyxel ATP series firmware · Zyxel USG FLEX series firmwa… +4
- 2
- Apache Software Foundation Apache RocketMQ · org.apache.… +2
- 1
- Armoli Technology Cargo Tracking System
- 1
- Barracuda Email Security Gateway
- 1
- Bitdefender Total Security · Bitdefender Internet Securi… +1
- 1
- Booking Ultra Pro Appointments Booking Calendar Plugin
- 1
Critical 12
- CVE-2023-2868Remote Code injection in Barracuda Email Security GatewayBarracuda Email Security Gateway
- CVE-2023-33246Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration functionApache Software Foundation Apache RocketMQ · org.apache.… +2
- CVE-2023-2045SQLi in Ipekyolu Software's Auto Damage Tracking SoftwareIpekyolu Software Auto Damage Tracking Software
- CVE-2023-2064SQLi in Minova Technology's eTraceMinova Technology eTrace
- CVE-2023-2750SQLi in Cityboss Software's E-municipalityCityboss E-municipality
- CVE-2023-1424Denial-of-Service and Remote Code Execution Vulnerability in MELSEC Series CPU moduleMitsubishi Electric MELSEC iQ-F Series FX5U-32MT/ES · M… +46
- CVE-2023-1174[minikube] Network Port exposure in minikube running on macOS using Docker driverKubernetes minikube
- CVE-2023-29721SofaWiki <= 3.8.9 has a file upload vulnerability that leads to command execution.
- CVE-2023-31457A vulnerability in the Headquarters server component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an un
- CVE-2023-31458A vulnerability in the Edge Gateway component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthent
- CVE-2023-33009A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX serieZyxel ATP series firmware · Zyxel USG FLEX series firmwa… +4
- CVE-2023-33010A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX seriZyxel ATP series firmware · Zyxel USG FLEX series firmwa… +4
High 16
- CVE-2023-2500Go Pricing - WordPress Responsive Pricing Tables <= 3.3.19 - Authenticated (Subscriber+) PHP Object InjectionGranth Go Pricing - WordPress Responsive Pricing Tables
- CVE-2022-4815Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data Hitachi Vantara Pentaho Business Analytics Server
- CVE-2023-2065IDOR in Armoli Technology's Cargo Tracking SystemArmoli Technology Cargo Tracking System
- CVE-2021-25748Ingress-nginx `path` sanitization can be bypassed with newline characterKubernetes ingress-nginx · k8s.io/ingress-nginx
- CVE-2021-25749runAsNonRoot logic bypass for Windows containersKubernetes
- CVE-2022-41221The client in OpenText Archive Center Administration through 21.2 allows XXE attacks.
- CVE-2023-1944[minikube] ssh server with default passwordKubernetes minikube
- CVE-2023-25599A vulnerability in the conferencing component of Mitel MiVoice Connect through 19.3 SP2, 22.24.1500.0 could allow an unauthenticated attacke
- CVE-2023-2859 Code Injection in nilsteampassnet/teampassnilsteampassnet/teampass
- CVE-2023-31459A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect versions 9.6.2208.101 and earlier could allow an unauthent
- CVE-2023-31460A vulnerability in the Connect Mobility Router component of MiVoice Connect versions 9.6.2208.101 and earlier could allow an authenticated a
- CVE-2023-31595IC Realtime ICIP-P2012T 2.420 is vulnerable to Incorrect Access Control via unauthenticated port access.
- CVE-2023-31748Insecure permissions in MobileTrans v4.0.11 allows attackers to escalate privileges to local admin via replacing the executable file.
- CVE-2023-33248Amazon Alexa software version 8960323972 on Echo Dot 2nd generation and 3rd generation devices potentially allows attackers to deliver secur
- CVE-2023-33980Bramble Synchronisation Protocol (BSP) in Briar before 1.4.22 allows attackers to cause a denial of service (repeated application crashes) v
- CVE-2023-33983The Introduction Client in Briar through 1.5.3 does not implement out-of-band verification for the public keys of introducees.
Medium, low and unrated 57
- CVE-2023-1158Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization Hitachi Vantara Pentaho Business Analytics Server
- CVE-2023-2875eScan Antivirus IoControlCode PROCOBSRVESX.SYS 0x22E008u null pointer dereferenceeScan Antivirus
- CVE-2023-2874Twister Antivirus IoControlCode filppd.sys 0x804f2140 denial of serviceTwister Antivirus
- CVE-2023-2873Twister Antivirus IoControlCode filppd.sys 0x80800043 memory corruptionTwister Antivirus
- CVE-2023-2872FlexiHub IoControlCode fusbhub.sys 0x220088 null pointer dereferenceFlexiHub
- CVE-2023-2871FabulaTech USB for Remote Desktop IoControlCode 0x220408 null pointer dereferenceFabulaTech USB for Remote Desktop
- CVE-2023-2870EnTech Monitor Asset Manager IoControlCode 0x80002014 denial of serviceEnTech Monitor Asset Manager
- CVE-2023-25028WordPress CC Custom Taxonomy Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)chuyencode CC Custom Taxonomy
- CVE-2022-47448WordPress xili-tidy-tags Plugin <= 1.12.03 is vulnerable to Cross Site Request Forgery (CSRF)dev.xiligroup.com - MS xili-tidy-tags
- CVE-2023-33950Pattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.76, and Liferay DXP 7.4 update 48 through 76 allows regular expressions that are Liferay Portal · Liferay DXP +1
- CVE-2022-47447WordPress WP-Advanced-Search Plugin <= 3.3.8 is vulnerable to Cross Site Request Forgery (CSRF)Mathieu Chartier WordPress WP-Advanced-Search
- CVE-2022-47446WordPress Store Locator Plugin <= 3.98.7 is vulnerable to Cross Site Request Forgery (CSRF)Viadat Creations Store Locator for WordPress with Google Ma…
- CVE-2023-33949In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier the default configuration does not require users to verify their email Liferay Portal · Liferay DXP +1
- CVE-2022-46794WordPress WooCommerce Weight Based Shipping Plugin <= 5.4.1 is vulnerable to Cross Site Request Forgery (CSRF)weightbasedshipping.com WooCommerce Weight Based Shipping
- CVE-2022-47180WordPress Kopa Framework Plugin <= 1.3.5 is vulnerable to Cross Site Request Forgery (CSRF)Kopa Theme Kopa Framework
- CVE-2022-47152WordPress clickfunnels Plugin <= 3.1.1 is vulnerable to Cross Site Request Forgery (CSRF)Etison ClickFunnels
- CVE-2022-45364WordPress Drag and Drop Multiple File Upload – Contact Form 7 Plugin <= 1.3.6.5 is vulnerable to Cross Site Request Forgery (CSRF)Glen Don L. Mongaya Drag and Drop Multiple File Upload – Co…
- CVE-2022-46816WordPress Booking Ultra Pro Plugin <= 1.1.4 is vulnerable to Cross Site Request Forgery (CSRF)Booking Ultra Pro Appointments Booking Calendar Plugin
- CVE-2023-33948The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can Liferay Portal · Liferay DXP +1
- CVE-2023-33947The Object module in Liferay Portal 7.4.3.4 through 7.4.3.60, and Liferay DXP 7.4 before update 61 does not segment object definition by virLiferay Portal · Liferay DXP +1
- CVE-2023-33946The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in differenLiferay Portal · Liferay DXP +1
- CVE-2023-33945SQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 through 7.4.3.17, and Liferay DXP 7.3 before updatLiferay Portal · Liferay DXP +1
- CVE-2023-33944Cross-site scripting (XSS) vulnerability in Layout module in Liferay Portal 7.3.4 through 7.4.3.68, and Liferay DXP 7.3 before update 24, anLiferay Portal · Liferay DXP +1
- CVE-2023-33943Cross-site scripting (XSS) vulnerability in the Account module in Liferay Portal 7.4.3.21 through 7.4.3.62, and Liferay DXP 7.4 update 21 thLiferay Portal · Liferay DXP +1
- CVE-2023-33942Cross-site scripting (XSS) vulnerability in the Web Content Display widget's article selector in Liferay Liferay Portal 7.4.3.50, and LiferaLiferay Portal · Liferay DXP +1
- CVE-2023-33941Multiple cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Liferay Portal · Liferay DXP +1
- CVE-2023-33940Cross-site scripting (XSS) vulnerability in IFrame type Remote Apps in Liferay Portal 7.4.0 through 7.4.3.30, and Liferay DXP 7.4 before updLiferay Portal · Liferay DXP +1
- CVE-2023-33939Cross-site scripting (XSS) vulnerability in the Modified Facet widget in Liferay Portal 7.1.0 through 7.4.3.12, and Liferay DXP 7.1 before fLiferay Portal · Liferay DXP +1
- CVE-2023-33938Cross-site scripting (XSS) vulnerability in the App Builder module's custom object details page in Liferay Portal 7.3.0 through 7.4.0, and LLiferay Portal · Liferay DXP +1
- CVE-2023-33937Stored cross-site scripting (XSS) vulnerability in Form widget configuration in Liferay Portal 7.1.0 through 7.3.0, and Liferay DXP 7.1 befoLiferay Portal · Liferay DXP +1
- CVE-2023-2865SourceCodester Theme Park Ticketing System GET Parameter print_ticket.php sql injectionSourceCodester Theme Park Ticketing System
- CVE-2023-2864SourceCodester Online Jewelry Store POST Parameter customer.php cross site scriptingSourceCodester Online Jewelry Store
- CVE-2023-2863Simple Design Daily Journal SQLite Database cleartext storage in a file or on diskSimple Design Daily Journal
- CVE-2023-2862SiteServer CMS search cross site scriptingSiteServer CMS · SSCMS
- CVE-2022-0357Improper Quoting Path Issue in Bitdefender Total SecurityBitdefender Total Security · Bitdefender Internet Securi… +1
- CVE-2022-30025SQL injection in "/Framewrk/Home.jsp" file (POST method) in tCredence Analytics iDEAL Wealth and Funds - 1.0 iallows authenticated remote at
- CVE-2022-42225Jumpserver 2.10.0 <= version <= 2.26.0 contains multiple stored XSS vulnerabilities because of improper filtering of user input, which can e
- CVE-2023-25598A vulnerability in the conferencing component of Mitel MiVoice Connect through 19.3 SP2 and 20.x, 21.x, and 22.x through 22.24.1500.0 could
- CVE-2023-33785A stored cross-site scripting (XSS) vulnerability in the Create Rack Roles (/dcim/rack-roles/) function of Netbox v3.5.1 allows attackers to
- CVE-2023-33786A stored cross-site scripting (XSS) vulnerability in the Create Circuit Types (/circuits/circuit-types/) function of Netbox v3.5.1 allows at
- CVE-2023-33787A stored cross-site scripting (XSS) vulnerability in the Create Tenant Groups (/tenancy/tenant-groups/) function of Netbox v3.5.1 allows att
- CVE-2023-33788A stored cross-site scripting (XSS) vulnerability in the Create Providers (/circuits/providers/) function of Netbox v3.5.1 allows attackers
- CVE-2023-33789A stored cross-site scripting (XSS) vulnerability in the Create Contact Groups (/tenancy/contact-groups/) function of Netbox v3.5.1 allows a
- CVE-2023-33790A stored cross-site scripting (XSS) vulnerability in the Create Locations (/dcim/locations/) function of Netbox v3.5.1 allows attackers to e
- CVE-2023-33791A stored cross-site scripting (XSS) vulnerability in the Create Provider Accounts (/circuits/provider-accounts/) function of Netbox v3.5.1 a
- CVE-2023-33792A stored cross-site scripting (XSS) vulnerability in the Create Site Groups (/dcim/site-groups/) function of Netbox v3.5.1 allows attackers
- CVE-2023-33793A stored cross-site scripting (XSS) vulnerability in the Create Power Panels (/dcim/power-panels/) function of Netbox v3.5.1 allows attacker
- CVE-2023-33794A stored cross-site scripting (XSS) vulnerability in the Create Tenants (/tenancy/tenants/) function of Netbox v3.5.1 allows attackers to ex
- CVE-2023-33795A stored cross-site scripting (XSS) vulnerability in the Create Contact Roles (/tenancy/contact-roles/) function of Netbox v3.5.1 allows att
- CVE-2023-33796A vulnerability in Netbox v3.5.1 allows unauthenticated attackers to execute queries against the GraphQL database, granting them access to s
- CVE-2023-33797A stored cross-site scripting (XSS) vulnerability in the Create Sites (/dcim/sites/) function of Netbox v3.5.1 allows attackers to execute a
- CVE-2023-33798A stored cross-site scripting (XSS) vulnerability in the Create Rack (/dcim/rack/) function of Netbox v3.5.1 allows attackers to execute arb
- CVE-2023-33799A stored cross-site scripting (XSS) vulnerability in the Create Contacts (/tenancy/contacts/) function of Netbox v3.5.1 allows attackers to
- CVE-2023-33800A stored cross-site scripting (XSS) vulnerability in the Create Regions (/dcim/regions/) function of Netbox v3.5.1 allows attackers to execu
- CVE-2023-33829A stored cross-site scripting (XSS) vulnerability in Cloudogu GmbH SCM Manager v1.2 to v1.60 allows attackers to execute arbitrary web scrip
- CVE-2023-33981Briar before 1.4.22 allows attackers to spoof other users' messages in a blog, forum, or private group, but each spoofed message would need
- CVE-2023-33982Bramble Handshake Protocol (BHP) in Briar before 1.5.3 is not forward secure: eavesdroppers can decrypt network traffic between two accounts