CVEs published May 25, 2023
78 CVEs were published on May 25, 2023: 11 critical, 14 high.
- Published
- 78
- Critical
- 11
- High
- 14
- Medium
- 48
- Low
- 3
- Unrated
- 2
- Now in CISA KEV
- 0
- Fix available
- 21
Most affected products
- CBOT Chatbot
- 6
- c-ares
- 4
- NFine Rapid Development Platform
- 4
- inspireui MStore API – Create Native Android & iOS Apps On…
- 3
- The Document Foundation LibreOffice
- 2
- TIBCO Software TIBCO EBX Add-ons
- 2
- VillaTheme Thank You Page Customizer for WooCommerce – Incr…
- 2
- AGT Tech Ceppatron
- 1
- Apache Software Foundation Apache JSPWiki · org.apache.j… +1
- 1
- Atlassian Confluence Data Center · Atlassian Confluence Ser…
- 1
Critical 11
- CVE-2023-26216TIBCO EBX Add-ons Arbitrary File WriteTIBCO Software TIBCO EBX Add-ons
- CVE-2023-2851SQLi in CeppatronAGT Tech Ceppatron
- CVE-2023-2887User Authentication Bypass in CBOT's ChatbotCBOT Chatbot
- CVE-2023-2884Insecure Randomness in CBOT's ChatbotCBOT Chatbot
- CVE-2023-2882Privilege Escalation in CBOT's ChatbotCBOT Chatbot
- CVE-2023-2732MStore API <= 3.9.2 - Authentication Bypassinspireui MStore API – Create Native Android & iOS Apps On…
- CVE-2023-2733MStore API <= 3.9.0 - Authentication Bypassinspireui MStore API – Create Native Android & iOS Apps On…
- CVE-2023-2734MStore API <= 3.9.1 - Authentication Bypassinspireui MStore API – Create Native Android & iOS Apps On…
- CVE-2023-33278In the Store Commander scexportcustomers module for PrestaShop through 3.6.1, sensitive SQL calls can be executed with a trivial HTTP reques
- CVE-2023-33279In the Store Commander scfixmyprestashop module through 2023-05-09 for PrestaShop, sensitive SQL calls can be executed with a trivial HTTP r
- CVE-2023-33280In the Store Commander scquickaccounting module for PrestaShop through 3.7.3, multiple sensitive SQL calls can be executed with a trivial HT
High 14
- CVE-2023-32074Nextcloud user_oidc app is missing brute force protectionnextcloud security-advisories
- CVE-2023-320670-byte UDP payload DoS in c-aresc-ares
- CVE-2023-26215TIBCO EBX® Add-ons Path TraversalTIBCO Software TIBCO EBX Add-ons
- CVE-2023-2798Denial of service in HtmlUnithtmlunit · org.htmlunit:htmlunit
- CVE-2023-2480Elevation of Privilege in M-Files Desktop ClientM-Files Client
- CVE-2022-45366WordPress Slimstat Analytics Plugin <= 5.0.4 is vulnerable to Cross Site Scripting (XSS)Jason Crouse, VeronaLabs Slimstat Analytics
- CVE-2023-2885Channel Accessible by Non-Endpoint in CBOT's ChatbotCBOT Chatbot
- CVE-2023-2883IDOR in CBOT's ChatbotCBOT Chatbot
- CVE-2023-0950Array Index UnderFlow in Calc Formula ParsingThe Document Foundation LibreOffice
- CVE-2023-27529Wacom Tablet Driver installer prior to 6.4.2-1 (for macOS) contains an improper link resolution before file access vulnerability.Wacom Tablet Driver installer
- CVE-2023-31594IC Realtime ICIP-P2012T 2.420 is vulnerable to Incorrect Access Control via an exposed HTTP channel using VLC network.
- CVE-2023-31861ZLMediaKit 4.0 is vulnerable to Directory Traversal.
- CVE-2023-33263In WFTPD 3.25, usernames and password hashes are stored in an openly viewable wftpd.ini configuration file within the WFTPD directory.
- CVE-2023-33355IceCMS v1.0.0 has Insecure Permissions.
Medium, low and unrated 53
- CVE-2023-2903NFine Rapid Development Platform access controlNFine Rapid Development Platform
- CVE-2023-2902NFine Rapid Development Platform access controlNFine Rapid Development Platform
- CVE-2023-31147Insufficient randomness in generation of DNS query IDs in c-aresc-ares
- CVE-2023-31130Buffer Underwrite in ares_inet_net_pton()c-ares
- CVE-2023-2901NFine Rapid Development Platform access controlNFine Rapid Development Platform
- CVE-2023-31124AutoTools does not set CARES_RANDOM_FILE during cross compilationc-ares
- CVE-2023-2900NFine Rapid Development Platform CheckLogin weak hashNFine Rapid Development Platform
- CVE-2023-30851Potential HTTP policy bypass when using header rules in Ciliumcilium · github.com/cilium/cilium
- CVE-2023-30615Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in iris-webdfir-iris iris-web
- CVE-2023-32694Non-constant time HMAC comparison in Adyen plugin in Saleorsaleor
- CVE-2023-22504Affected versions of Atlassian Confluence Server allow remote attackers who have read permissions to a page, but not write permissions, to uAtlassian Confluence Data Center · Atlassian Confluence Ser…
- CVE-2023-0459Copy_from_user Spectre-V1 Gadget in Linux KernelLinux Kernel
- CVE-2023-2888PHPOK unrestricted uploadPHPOK
- CVE-2022-47174WordPress Performance Lab Plugin <= 2.2.0 is vulnerable to Cross Site Request Forgery (CSRF)WordPress Performance Team Performance Lab
- CVE-2022-47178WordPress Simple Share Buttons Adder Plugin <= 8.4.7 is vulnerable to Cross Site Request Forgery (CSRF)Simple Share Buttons Adder
- CVE-2022-47136WordPress Ninja Tables Plugin <= 4.3.4 is vulnerable to Cross Site Request Forgery (CSRF)WPManageNinja Ninja Tables – Best Data Table Plugin for Wor…
- CVE-2022-47144WordPress Mediamatic – Media Library Folders Plugin <= 2.8.1 is vulnerable to Cross Site Request Forgery (CSRF)Plugincraft Mediamatic – Media Library Folders
- CVE-2022-46856WordPress Woocommerce Product Designer Plugin <= 4.3.3 is vulnerable to Cross Site Request Forgery (CSRF)ORION Woocommerce Products Designer
- CVE-2022-46810WordPress Thank You Page Customizer for WooCommerce – Increase Your Sales Plugin <= 1.0.13 is vulnerable to Cross Site Request Forgery (CSRF)VillaTheme Thank You Page Customizer for WooCommerce – Incr…
- CVE-2022-46814WordPress Kodex Posts likes Plugin <= 2.4.3 is vulnerable to Cross Site Request Forgery (CSRF)Pierre Lebedel Kodex Posts likes
- CVE-2022-46820WordPress Joli Table Of Contents Plugin <= 1.3.9 is vulnerable to Cross Site Request Forgery (CSRF)WPJoli Joli Table Of Contents
- CVE-2022-45815WordPress GDPR Compliance & Cookie Consent Plugin <= 1.2 is vulnerable to Cross Site Request Forgery (CSRF)StylemixThemes GDPR Compliance & Cookie Consent
- CVE-2022-45371WordPress ShopEngine Plugin <= 4.1.1 is vulnerable to Cross Site Request Forgery (CSRF)Wpmet ShopEngine
- CVE-2022-38716WordPress Motors – Car Dealer & Classified Ads Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF)StylemixThemes Motors – Car Dealer, Classifieds & Listing
- CVE-2022-38356WordPress Pearl Plugin <= 1.3.4 is vulnerable to Cross Site Request Forgery (CSRF)StylemixThemes WordPress Header Builder Plugin – Pearl
- CVE-2022-43490WordPress Stream Plugin <= 3.9.2 is vulnerable to Cross Site Request Forgery (CSRF)XWP Stream
- CVE-2022-41987WordPress BadgeOS Plugin <= 3.7.1.6 is vulnerable to Cross Site Request Forgery (CSRF)LearningTimes BadgeOS
- CVE-2022-45367WordPress Custom Order Numbers for WooCommerce Plugin <= 1.4.0 is vulnerable to Cross Site Request Forgery (CSRF)Tyche Softwares Custom Order Numbers for WooCommerce
- CVE-2022-47177WordPress WP EasyPay Plugin <= 4.1 is vulnerable to Cross Site Request Forgery (CSRF)WP Easy Pay WP EasyPay – Square for WordPress
- CVE-2023-30484WordPress Enable Accessibility Plugin <= 1.4 is vulnerable to Cross Site Request Forgery (CSRF)uPress Enable Accessibility
- CVE-2022-47149WordPress Shortlinks by Pretty Links Plugin <= 3.4.0 is vulnerable to Cross Site Request Forgery (CSRF)Pretty Links
- CVE-2022-47165WordPress CoSchedule Plugin <= 3.3.8 is vulnerable to Cross Site Request Forgery (CSRF)CoSchedule
- CVE-2022-47161WordPress Health Check & Troubleshooting Plugin <= 1.5.1 is vulnerable to Cross Site Request Forgery (CSRF)The WordPress.org community Health Check & Troubleshooting
- CVE-2022-41635WordPress Advanced Shipment Tracking for WooCommerce Plugin <= 3.5.2 is vulnerable to Cross Site Request Forgery (CSRF)Zorem Advanced Shipment Tracking for WooCommerce
- CVE-2022-46800WordPress LiteSpeed Cache Plugin <= 5.3 is vulnerable to Cross Site Request Forgery (CSRF)LiteSpeed Technologies LiteSpeed Cache
- CVE-2022-46812WordPress Thank You Page Customizer for WooCommerce – Increase Your Sales Plugin <= 1.0.13 is vulnerable to Cross Site Request Forgery (CSRF)VillaTheme Thank You Page Customizer for WooCommerce – Incr…
- CVE-2022-46865WordPress Bulk Resize Media Plugin <= 1.1 is vulnerable to Cross Site Request Forgery (CSRF)Marty Thornley Bulk Resize Media
- CVE-2022-46866WordPress Import External Images Plugin <= 1.4 is vulnerable to Cross Site Request Forgery (CSRF)Marty Thornley Import External Images
- CVE-2023-2886Cross-Site WebSocket Hijacking in CBOT's ChatbotCBOT Chatbot
- CVE-2022-47164WordPress Event Manager for WooCommerce Plugin <= 3.7.7 is vulnerable to Cross Site Request Forgery (CSRF)MagePeople Team Event Manager and Tickets Selling Plugin fo…
- CVE-2022-47159WordPress Logaster Logo Generator Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF)Logaster Logo Generator
- CVE-2022-47138WordPress LOGIN AND REGISTRATION ATTEMPTS LIMIT Plugin <= 2.1 is vulnerable to Cross Site Request Forgery (CSRF)German Krutov LOGIN AND REGISTRATION ATTEMPTS LIMIT
- CVE-2022-47139WordPress WP Basic Elements Plugin <= 5.2.15 is vulnerable to Cross Site Request Forgery (CSRF)Damir Calusic WP Basic Elements
- CVE-2022-47135WordPress Chronoforms Plugin <= 7.0.9 is vulnerable to Cross Site Request Forgery (CSRF)chronoengine.com Chronoforms
- CVE-2022-46907Apache JSPWiki: XSS Injection points in several pluginsApache Software Foundation Apache JSPWiki · org.apache.j… +1
- CVE-2023-2255Remote documents loaded without prompt via IFrameThe Document Foundation LibreOffice
- CVE-2023-25439Stored Cross Site Scripting (XSS) vulnerability in Square Pig FusionInvoice 2023-1.0, allows attackers to execute arbitrary code via the des
- CVE-2023-2804A heap-based buffer overflow issue was discovered in libjpeg-turbo in h2v2_merged_upsample_internal() function of jdmrgext.c file.libjpeg-turbo
- CVE-2023-28370Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrartornadoweb Tornado · tornado
- CVE-2023-2881Storing Passwords in a Recoverable Format in pimcore/customer-data-frameworkpimcore/customer-data-framework · pimcore/customer-manageme…
- CVE-2023-33356IceCMS v1.0.0 is vulnerable to Cross Site Scripting (XSS).
- CVE-2023-33750A stored cross-site scripting (XSS) vulnerability in mipjz v5.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted pa
- CVE-2023-33751A stored cross-site scripting (XSS) vulnerability in mipjz v5.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted pa