# CVEs published 2023-05-24

85 CVEs were published on May 24, 2023: 12 critical, 16 high. 4 are now in CISA KEV. Days are UTC.

- [CVE-2023-2500](https://cve.now/CVE-2023-2500.md): Go Pricing - WordPress Responsive Pricing Tables \<= 3.3.19 - Authenticated (Subscriber+) PHP Object Injection (CVSS 8.8, Granth Go Pricing - WordPress Responsive Pricing Tables)
- [CVE-2022-4815](https://cve.now/CVE-2022-4815.md): Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data (CVSS 8.0, Hitachi Vantara Pentaho Business Analytics Server)
- [CVE-2023-1158](https://cve.now/CVE-2023-1158.md): Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization (CVSS 4.3, Hitachi Vantara Pentaho Business Analytics Server)
- [CVE-2023-2875](https://cve.now/CVE-2023-2875.md): eScan Antivirus IoControlCode PROCOBSRVESX.SYS 0x22E008u null pointer dereference (CVSS 5.5, eScan Antivirus)
- [CVE-2023-2874](https://cve.now/CVE-2023-2874.md): Twister Antivirus IoControlCode filppd.sys 0x804f2140 denial of service (CVSS 5.5, Twister Antivirus)
- [CVE-2023-2868](https://cve.now/CVE-2023-2868.md): Remote Code injection in Barracuda Email Security Gateway (CVSS 9.4, KEV, Barracuda Email Security Gateway)
- [CVE-2023-2873](https://cve.now/CVE-2023-2873.md): Twister Antivirus IoControlCode filppd.sys 0x80800043 memory corruption (CVSS 5.3, Twister Antivirus)
- [CVE-2023-2872](https://cve.now/CVE-2023-2872.md): FlexiHub IoControlCode fusbhub.sys 0x220088 null pointer dereference (CVSS 5.5, FlexiHub)
- [CVE-2023-2871](https://cve.now/CVE-2023-2871.md): FabulaTech USB for Remote Desktop IoControlCode 0x220408 null pointer dereference (CVSS 3.3, FabulaTech USB for Remote Desktop)
- [CVE-2023-2870](https://cve.now/CVE-2023-2870.md): EnTech Monitor Asset Manager IoControlCode 0x80002014 denial of service (CVSS 3.3, EnTech Monitor Asset Manager)
- [CVE-2023-25028](https://cve.now/CVE-2023-25028.md): WordPress CC Custom Taxonomy Plugin \<= 1.0.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, chuyencode CC Custom Taxonomy)
- [CVE-2022-47448](https://cve.now/CVE-2022-47448.md): WordPress xili-tidy-tags Plugin \<= 1.12.03 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, dev.xiligroup.com - MS xili-tidy-tags)
- [CVE-2023-33950](https://cve.now/CVE-2023-33950.md): Pattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.76, and Liferay DXP 7.4 update 48 through 76 allows regular expressions that are (CVSS 6.5, Liferay Portal · Liferay DXP +1)
- [CVE-2022-47447](https://cve.now/CVE-2022-47447.md): WordPress WP-Advanced-Search Plugin \<= 3.3.8 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Mathieu Chartier WordPress WP-Advanced-Search)
- [CVE-2022-47446](https://cve.now/CVE-2022-47446.md): WordPress Store Locator Plugin \<= 3.98.7 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Viadat Creations Store Locator for WordPress with Google Ma…)
- [CVE-2023-33949](https://cve.now/CVE-2023-33949.md): In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier the default configuration does not require users to verify their email (CVSS 5.3, Liferay Portal · Liferay DXP +1)
- [CVE-2022-46794](https://cve.now/CVE-2022-46794.md): WordPress WooCommerce Weight Based Shipping Plugin \<= 5.4.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, weightbasedshipping.com WooCommerce Weight Based Shipping)
- [CVE-2022-47180](https://cve.now/CVE-2022-47180.md): WordPress Kopa Framework Plugin \<= 1.3.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Kopa Theme Kopa Framework)
- [CVE-2022-47152](https://cve.now/CVE-2022-47152.md): WordPress clickfunnels Plugin \<= 3.1.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Etison ClickFunnels)
- [CVE-2022-45364](https://cve.now/CVE-2022-45364.md): WordPress Drag and Drop Multiple File Upload – Contact Form 7 Plugin \<= 1.3.6.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Glen Don L. Mongaya Drag and Drop Multiple File Upload – Co…)
- [CVE-2022-46816](https://cve.now/CVE-2022-46816.md): WordPress Booking Ultra Pro Plugin \<= 1.1.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Booking Ultra Pro Appointments Booking Calendar Plugin)
- [CVE-2023-33948](https://cve.now/CVE-2023-33948.md): The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can (CVSS 5.3, Liferay Portal · Liferay DXP +1)
- [CVE-2023-33947](https://cve.now/CVE-2023-33947.md): The Object module in Liferay Portal 7.4.3.4 through 7.4.3.60, and Liferay DXP 7.4 before update 61 does not segment object definition by vir (CVSS 2.7, Liferay Portal · Liferay DXP +1)
- [CVE-2023-33946](https://cve.now/CVE-2023-33946.md): The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in differen (CVSS 2.7, Liferay Portal · Liferay DXP +1)
- [CVE-2023-33945](https://cve.now/CVE-2023-33945.md): SQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 through 7.4.3.17, and Liferay DXP 7.3 before updat (CVSS 6.4, Liferay Portal · Liferay DXP +1)
- [CVE-2023-33944](https://cve.now/CVE-2023-33944.md): Cross-site scripting (XSS) vulnerability in Layout module in Liferay Portal 7.3.4 through 7.4.3.68, and Liferay DXP 7.3 before update 24, an (CVSS 4.8, Liferay Portal · Liferay DXP +1)
- [CVE-2023-33943](https://cve.now/CVE-2023-33943.md): Cross-site scripting (XSS) vulnerability in the Account module in Liferay Portal 7.4.3.21 through 7.4.3.62, and Liferay DXP 7.4 update 21 th (CVSS 5.4, Liferay Portal · Liferay DXP +1)
- [CVE-2023-33942](https://cve.now/CVE-2023-33942.md): Cross-site scripting (XSS) vulnerability in the Web Content Display widget's article selector in Liferay Liferay Portal 7.4.3.50, and Lifera (CVSS 5.4, Liferay Portal · Liferay DXP +1)
- [CVE-2023-33246](https://cve.now/CVE-2023-33246.md): Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function (CVSS 9.8, KEV, Apache Software Foundation Apache RocketMQ · org.apache.… +2)
- [CVE-2023-33941](https://cve.now/CVE-2023-33941.md): Multiple cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay (CVSS 6.1, Liferay Portal · Liferay DXP +1)
- [CVE-2023-33940](https://cve.now/CVE-2023-33940.md): Cross-site scripting (XSS) vulnerability in IFrame type Remote Apps in Liferay Portal 7.4.0 through 7.4.3.30, and Liferay DXP 7.4 before upd (CVSS 4.8, Liferay Portal · Liferay DXP +1)
- [CVE-2023-33939](https://cve.now/CVE-2023-33939.md): Cross-site scripting (XSS) vulnerability in the Modified Facet widget in Liferay Portal 7.1.0 through 7.4.3.12, and Liferay DXP 7.1 before f (CVSS 5.4, Liferay Portal · Liferay DXP +1)
- [CVE-2023-2045](https://cve.now/CVE-2023-2045.md): SQLi in Ipekyolu Software's Auto Damage Tracking Software (CVSS 9.8, Ipekyolu Software Auto Damage Tracking Software)
- [CVE-2023-33938](https://cve.now/CVE-2023-33938.md): Cross-site scripting (XSS) vulnerability in the App Builder module's custom object details page in Liferay Portal 7.3.0 through 7.4.0, and L (CVSS 4.8, Liferay Portal · Liferay DXP +1)
- [CVE-2023-2064](https://cve.now/CVE-2023-2064.md): SQLi in Minova Technology's eTrace (CVSS 9.8, Minova Technology eTrace)
- [CVE-2023-33937](https://cve.now/CVE-2023-33937.md): Stored cross-site scripting (XSS) vulnerability in Form widget configuration in Liferay Portal 7.1.0 through 7.3.0, and Liferay DXP 7.1 befo (CVSS 5.4, Liferay Portal · Liferay DXP +1)
- [CVE-2023-2065](https://cve.now/CVE-2023-2065.md): IDOR in Armoli Technology's Cargo Tracking System (CVSS 8.8, Armoli Technology Cargo Tracking System)
- [CVE-2023-2750](https://cve.now/CVE-2023-2750.md): SQLi in Cityboss Software's E-municipality (CVSS 9.8, Cityboss E-municipality)
- [CVE-2023-2865](https://cve.now/CVE-2023-2865.md): SourceCodester Theme Park Ticketing System GET Parameter print\_ticket.php sql injection (CVSS 6.3, SourceCodester Theme Park Ticketing System)
- [CVE-2023-2864](https://cve.now/CVE-2023-2864.md): SourceCodester Online Jewelry Store POST Parameter customer.php cross site scripting (CVSS 3.5, SourceCodester Online Jewelry Store)
- [CVE-2023-2863](https://cve.now/CVE-2023-2863.md): Simple Design Daily Journal SQLite Database cleartext storage in a file or on disk (CVSS 2.3, Simple Design Daily Journal)
- [CVE-2023-2862](https://cve.now/CVE-2023-2862.md): SiteServer CMS search cross site scripting (CVSS 3.5, SiteServer CMS · SSCMS)
- [CVE-2022-0357](https://cve.now/CVE-2022-0357.md): Improper Quoting Path Issue in Bitdefender Total Security (CVSS 6.7, Bitdefender Total Security · Bitdefender Internet Securi… +1)
- [CVE-2023-1424](https://cve.now/CVE-2023-1424.md): Denial-of-Service and Remote Code Execution Vulnerability in MELSEC Series CPU module (CVSS 10.0, Mitsubishi Electric MELSEC iQ-F Series FX5U-32MT/ES · M… +46)
- [CVE-2021-25748](https://cve.now/CVE-2021-25748.md): Ingress-nginx \`path\` sanitization can be bypassed with newline character (CVSS 7.6, Kubernetes ingress-nginx · k8s.io/ingress-nginx)
- [CVE-2021-25749](https://cve.now/CVE-2021-25749.md): runAsNonRoot logic bypass for Windows containers (CVSS 7.8, Kubernetes)
- [CVE-2022-30025](https://cve.now/CVE-2022-30025.md): SQL injection in "/Framewrk/Home.jsp" file (POST method) in tCredence Analytics iDEAL Wealth and Funds - 1.0 iallows authenticated remote at (CVSS 6.5)
- [CVE-2022-41221](https://cve.now/CVE-2022-41221.md): The client in OpenText Archive Center Administration through 21.2 allows XXE attacks. (CVSS 7.1)
- [CVE-2022-42225](https://cve.now/CVE-2022-42225.md): Jumpserver 2.10.0 \<= version \<= 2.26.0 contains multiple stored XSS vulnerabilities because of improper filtering of user input, which can e (CVSS 5.4)
- [CVE-2023-1174](https://cve.now/CVE-2023-1174.md): \[minikube\] Network Port exposure in minikube running on macOS using Docker driver (CVSS 9.8, Kubernetes minikube)
- [CVE-2023-1944](https://cve.now/CVE-2023-1944.md): \[minikube\] ssh server with default password (CVSS 8.4, Kubernetes minikube)
- [CVE-2023-25598](https://cve.now/CVE-2023-25598.md): A vulnerability in the conferencing component of Mitel MiVoice Connect through 19.3 SP2 and 20.x, 21.x, and 22.x through 22.24.1500.0 could (CVSS 6.1)
- [CVE-2023-25599](https://cve.now/CVE-2023-25599.md): A vulnerability in the conferencing component of Mitel MiVoice Connect through 19.3 SP2, 22.24.1500.0 could allow an unauthenticated attacke (CVSS 7.4)
- [CVE-2023-2859](https://cve.now/CVE-2023-2859.md): Code Injection in nilsteampassnet/teampass (CVSS 7.1, nilsteampassnet/teampass)
- [CVE-2023-29721](https://cve.now/CVE-2023-29721.md): SofaWiki \<= 3.8.9 has a file upload vulnerability that leads to command execution. (CVSS 9.8)
- [CVE-2023-31457](https://cve.now/CVE-2023-31457.md): A vulnerability in the Headquarters server component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an un (CVSS 9.8)
- [CVE-2023-31458](https://cve.now/CVE-2023-31458.md): A vulnerability in the Edge Gateway component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthent (CVSS 9.8)
- [CVE-2023-31459](https://cve.now/CVE-2023-31459.md): A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect versions 9.6.2208.101 and earlier could allow an unauthent (CVSS 8.8)
- [CVE-2023-31460](https://cve.now/CVE-2023-31460.md): A vulnerability in the Connect Mobility Router component of MiVoice Connect versions 9.6.2208.101 and earlier could allow an authenticated a (CVSS 7.2)
- [CVE-2023-31595](https://cve.now/CVE-2023-31595.md): IC Realtime ICIP-P2012T 2.420 is vulnerable to Incorrect Access Control via unauthenticated port access. (CVSS 7.5)
- [CVE-2023-31748](https://cve.now/CVE-2023-31748.md): Insecure permissions in MobileTrans v4.0.11 allows attackers to escalate privileges to local admin via replacing the executable file. (CVSS 7.8)
- [CVE-2023-33009](https://cve.now/CVE-2023-33009.md): A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX serie (CVSS 9.8, KEV, Zyxel ATP series firmware · Zyxel USG FLEX series firmwa… +4)
- [CVE-2023-33010](https://cve.now/CVE-2023-33010.md): A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX seri (CVSS 9.8, KEV, Zyxel ATP series firmware · Zyxel USG FLEX series firmwa… +4)
- [CVE-2023-33248](https://cve.now/CVE-2023-33248.md): Amazon Alexa software version 8960323972 on Echo Dot 2nd generation and 3rd generation devices potentially allows attackers to deliver secur (CVSS 7.6)
- [CVE-2023-33785](https://cve.now/CVE-2023-33785.md): A stored cross-site scripting (XSS) vulnerability in the Create Rack Roles (/dcim/rack-roles/) function of Netbox v3.5.1 allows attackers to (no CVSS)
- [CVE-2023-33786](https://cve.now/CVE-2023-33786.md): A stored cross-site scripting (XSS) vulnerability in the Create Circuit Types (/circuits/circuit-types/) function of Netbox v3.5.1 allows at (no CVSS)
- [CVE-2023-33787](https://cve.now/CVE-2023-33787.md): A stored cross-site scripting (XSS) vulnerability in the Create Tenant Groups (/tenancy/tenant-groups/) function of Netbox v3.5.1 allows att (no CVSS)
- [CVE-2023-33788](https://cve.now/CVE-2023-33788.md): A stored cross-site scripting (XSS) vulnerability in the Create Providers (/circuits/providers/) function of Netbox v3.5.1 allows attackers (no CVSS)
- [CVE-2023-33789](https://cve.now/CVE-2023-33789.md): A stored cross-site scripting (XSS) vulnerability in the Create Contact Groups (/tenancy/contact-groups/) function of Netbox v3.5.1 allows a (no CVSS)
- [CVE-2023-33790](https://cve.now/CVE-2023-33790.md): A stored cross-site scripting (XSS) vulnerability in the Create Locations (/dcim/locations/) function of Netbox v3.5.1 allows attackers to e (no CVSS)
- [CVE-2023-33791](https://cve.now/CVE-2023-33791.md): A stored cross-site scripting (XSS) vulnerability in the Create Provider Accounts (/circuits/provider-accounts/) function of Netbox v3.5.1 a (no CVSS)
- [CVE-2023-33792](https://cve.now/CVE-2023-33792.md): A stored cross-site scripting (XSS) vulnerability in the Create Site Groups (/dcim/site-groups/) function of Netbox v3.5.1 allows attackers (no CVSS)
- [CVE-2023-33793](https://cve.now/CVE-2023-33793.md): A stored cross-site scripting (XSS) vulnerability in the Create Power Panels (/dcim/power-panels/) function of Netbox v3.5.1 allows attacker (no CVSS)
- [CVE-2023-33794](https://cve.now/CVE-2023-33794.md): A stored cross-site scripting (XSS) vulnerability in the Create Tenants (/tenancy/tenants/) function of Netbox v3.5.1 allows attackers to ex (no CVSS)
- [CVE-2023-33795](https://cve.now/CVE-2023-33795.md): A stored cross-site scripting (XSS) vulnerability in the Create Contact Roles (/tenancy/contact-roles/) function of Netbox v3.5.1 allows att (no CVSS)
- [CVE-2023-33796](https://cve.now/CVE-2023-33796.md): A vulnerability in Netbox v3.5.1 allows unauthenticated attackers to execute queries against the GraphQL database, granting them access to s (no CVSS)
- [CVE-2023-33797](https://cve.now/CVE-2023-33797.md): A stored cross-site scripting (XSS) vulnerability in the Create Sites (/dcim/sites/) function of Netbox v3.5.1 allows attackers to execute a (no CVSS)
- [CVE-2023-33798](https://cve.now/CVE-2023-33798.md): A stored cross-site scripting (XSS) vulnerability in the Create Rack (/dcim/rack/) function of Netbox v3.5.1 allows attackers to execute arb (no CVSS)
- [CVE-2023-33799](https://cve.now/CVE-2023-33799.md): A stored cross-site scripting (XSS) vulnerability in the Create Contacts (/tenancy/contacts/) function of Netbox v3.5.1 allows attackers to (no CVSS)
- [CVE-2023-33800](https://cve.now/CVE-2023-33800.md): A stored cross-site scripting (XSS) vulnerability in the Create Regions (/dcim/regions/) function of Netbox v3.5.1 allows attackers to execu (no CVSS)
- [CVE-2023-33829](https://cve.now/CVE-2023-33829.md): A stored cross-site scripting (XSS) vulnerability in Cloudogu GmbH SCM Manager v1.2 to v1.60 allows attackers to execute arbitrary web scrip (CVSS 5.4)
- [CVE-2023-33980](https://cve.now/CVE-2023-33980.md): Bramble Synchronisation Protocol (BSP) in Briar before 1.4.22 allows attackers to cause a denial of service (repeated application crashes) v (CVSS 7.5)
- [CVE-2023-33981](https://cve.now/CVE-2023-33981.md): Briar before 1.4.22 allows attackers to spoof other users' messages in a blog, forum, or private group, but each spoofed message would need (CVSS 6.5)
- [CVE-2023-33982](https://cve.now/CVE-2023-33982.md): Bramble Handshake Protocol (BHP) in Briar before 1.5.3 is not forward secure: eavesdroppers can decrypt network traffic between two accounts (CVSS 5.9)
- [CVE-2023-33983](https://cve.now/CVE-2023-33983.md): The Introduction Client in Briar through 1.5.3 does not implement out-of-band verification for the public keys of introducees. (CVSS 7.4)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-05-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.