CVEs published May 26, 2023
88 CVEs were published on May 26, 2023: 7 critical, 29 high. 1 is now in CISA KEV.
- Published
- 88
- Critical
- 7
- High
- 29
- Medium
- 46
- Low
- 2
- Unrated
- 4
- Now in CISA KEV
- 1
- Fix available
- 33
Most affected products
- Huawei HarmonyOS · Huawei EMUI
- 11
- Wireshark Foundation Wireshark
- 6
- https://github.com/curl/curl
- 4
- craftcms cms · craftcms/cms
- 3
- matrix-org synapse · matrix-synapse
- 3
- Samsung Mobile Galaxy Store
- 3
- Autolab
- 2
- CloudExplorer-Dev CloudExplorer-Lite
- 2
- Huawei EMUI
- 2
- Huawei HarmonyOS
- 2
Critical 7
- CVE-2023-32321CKAN remote code execution and private information access via crafted resource idsckan
- CVE-2021-46887Lack of length check vulnerability in the HW_KEYMASTER module.Huawei EMUI
- CVE-2022-46945Nagvis before 1.9.34 was discovered to contain an arbitrary file read vulnerability via the component /core/classes/NagVisHoverUrl.php.
- CVE-2022-48478The facial recognition TA of some products lacks memory length verification.Huawei HarmonyOS
- CVE-2022-48479The facial recognition TA of some products has the out-of-bounds memory read vulnerability.Huawei HarmonyOS
- CVE-2023-2825An issue has been discovered in GitLab CE/EE affecting only version 16.0.0.GitLab
- CVE-2023-30145Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter.camaleon_cms
High 29
- CVE-2023-32319Basic auth header on WebDAV requests is not brute-force protected in Nextcloudnextcloud security-advisories
- CVE-2023-32316Users can add themselves to any organization in CloudExplorer LiteCloudExplorer-Dev CloudExplorer-Lite
- CVE-2023-32315Openfire administration console authentication bypassigniterealtime Openfire · org.igniterealtime.openfire:xmpps…
- CVE-2023-32311The CloudExplorer Lite missing permissions checkCloudExplorer-Dev CloudExplorer-Lite
- CVE-2023-32307heap-over-flow and integer-overflow in sofia-sipfreeswitch sofia-sip
- CVE-2023-31128NextCloud Cookbook's pull-checks.yml workflow is vulnerable to OS Command Injectionnextcloud cookbook
- CVE-2023-32318User session not correctly destroyed on logoutnextcloud security-advisories
- CVE-2023-29098WordPress CopySafe Web Protection Plugin <= 3.13 is vulnerable to Cross Site Scripting (XSS)ArtistScope CopySafe Web Protection
- CVE-2021-46881The video framework has memory overwriting caused by addition overflow.Huawei HarmonyOS · Huawei EMUI
- CVE-2021-46882The video framework has memory overwriting caused by addition overflow.Huawei HarmonyOS · Huawei EMUI
- CVE-2021-46883The video framework has memory overwriting caused by addition overflow.Huawei HarmonyOS · Huawei EMUI
- CVE-2021-46884The video framework has memory overwriting caused by addition overflow.Huawei HarmonyOS · Huawei EMUI
- CVE-2021-46885The video framework has memory overwriting caused by addition overflow.Huawei HarmonyOS · Huawei EMUI
- CVE-2021-46886The video framework has memory overwriting caused by addition overflow.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-48480Integer overflow vulnerability in some phones.Huawei EMUI
- CVE-2023-0116The reminder module lacks an authentication mechanism for broadcasts received.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-20883In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential forSpring Boot · org.springframework.boot:spring-boot-autoconf…
- CVE-2023-21514Improper scheme validation from InstantPlay Deeplink in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API toSamsung Mobile Galaxy Store
- CVE-2023-21515InstantPlay which included vulnerable script which could execute javascript in Galaxy Store prior to version 4.5.49.8 allows attackers to exSamsung Mobile Galaxy Store
- CVE-2023-21516XSS vulnerability from InstantPlay in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from Samsung Mobile Galaxy Store
- CVE-2023-22970Bottles before 51.0 mishandles YAML load, which allows remote code execution via a crafted file.
- CVE-2023-28319A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 2https://github.com/curl/curl
- CVE-2023-28382Directory traversal vulnerability in ESS REC Agent Server Edition series allows an authenticated attacker to view or alter an arbitrary fileEncourage Technologies Co. ESS REC Agent Server Edition ser…
- CVE-2023-31226The SDK for the MediaPlaybackController module has improper permission verification.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-31227The hwPartsDFR module has a vulnerability in API calling verification.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-33247Talend Data Catalog remote harvesting server before 8.0-20230413 contains a /upgrade endpoint that allows an unauthenticated WAR file to be
- CVE-2023-33439Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/manage_task.php?id=.
- CVE-2023-33440Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via /eval/ajax.php?action=save_user.
- CVE-2023-33779A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crcom.xuxueli:xxl-job
Medium, low and unrated 52
- CVE-2023-32325Cross-site scripting in PostHog-jsposthog-js
- CVE-2023-33199malformed proposed intoto v0.0.2 entries can cause a panic in Rekorsigstore rekor · github.com/sigstore/rekor
- CVE-2023-32676Autolab tar slip in Install Assessment functionality (`GHSL-2023-081`)Autolab
- CVE-2023-32317Autolab tar slip in cheat checker functionality (`GHSL-2023-082`)Autolab
- CVE-2023-33194CraftCMS stored XSS in Quick Post widget error messagecraftcms cms · craftcms/cms
- CVE-2023-33196Craft CMS stored XSS in review volumecraftcms cms · craftcms/cms
- CVE-2023-33187highlight vulnerable to cleartext transmission of sensitive informationhighlight · highlight.run
- CVE-2023-33185Incorrect signature verification in django-sesdjango-ses
- CVE-2023-33197Craft CMS stored XSS in indexedVolumescraftcms cms · craftcms/cms
- CVE-2023-32681Unintended leak of Proxy-Authorization header in requestspsf requests · requests
- CVE-2023-32964WordPress Better Notifications for WP Plugin <= 1.9.2 is vulnerable to Cross Site Request Forgery (CSRF)Made with Fuel Better Notifications for WP
- CVE-2023-25058WordPress Schema – All In One Schema Rich Snippets Plugin <= 1.6.5 is vulnerable to Cross Site Request Forgery (CSRF)Brainstorm Force Schema – All In One Schema Rich Snippets
- CVE-2023-25034WordPress WP Clean Up Plugin <= 1.2.3 is vulnerable to Cross Site Request Forgery (CSRF)BoLiQuan WP Clean Up
- CVE-2023-25467WordPress Resize at Upload Plus Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF)Daniel Mores, A. Huizinga Resize at Upload Plus
- CVE-2023-25470WordPress Rus-To-Lat Plugin <= 0.3 is vulnerable to Cross Site Request Forgery (CSRF)Anton Skorobogatov Rus-To-Lat
- CVE-2023-25029WordPress WP Social Bookmarking Light Plugin <= 2.0.7 is vulnerable to Cross Site Request Forgery (CSRF)utahta WP Social Bookmarking Light
- CVE-2022-39374Synapse Denial of service due to incorrect application of event authorization rules during state resolutionmatrix-org synapse · matrix-synapse
- CVE-2022-39335Synapse does not apply enough checks to servers requesting auth events of events in a roommatrix-org synapse · matrix-synapse
- CVE-2023-32323Synapse Outgoing federation to specific hosts can be disabled by sending malicious invitesmatrix-org synapse · matrix-synapse
- CVE-2023-24008WordPress Maspik – Spam blacklist Plugin <= 0.7.8 is vulnerable to Cross Site Request Forgery (CSRF)yonifre Maspik – Spam Blacklist
- CVE-2023-22693WordPress WP Google Tag Manager Plugin <= 1.1 is vulnerable to Cross Site Request Forgery (CSRF)conlabzgmbh WP Google Tag Manager
- CVE-2023-25038WordPress For the visually impaired Plugin <= 0.58 is vulnerable to Cross Site Request Forgery (CSRF)984.ru For the visually impaired
- CVE-2023-24007WordPress Admin Block Country Plugin <= 7.1.4 is vulnerable to Cross Site Request Forgery (CSRF)TheOnlineHero - Tom Skroza Admin Block Country
- CVE-2023-25781WordPress Upload File Type Settings Plugin Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)Sebastian Krysmanski Upload File Type Settings Plugin
- CVE-2023-25976WordPress Integration for Contact Form 7 and Zoho CRM, Bigin Plugin <= 1.2.2 is vulnerable to Cross Site Request Forgery (CSRF)CRM Perks Integration for Contact Form 7 and Zoho CRM, Bigin
- CVE-2023-25971WordPress Educare – Students & Result Management System Plugin <= 1.4.1 is vulnerable to Cross Site Request Forgery (CSRF)FixBD Educare
- CVE-2023-23714WordPress Uncanny Toolkit for LearnDash Plugin <= 3.6.4.1 is vulnerable to Cross Site Request Forgery (CSRF)Uncanny Owl Uncanny Toolkit for LearnDash
- CVE-2023-0117The online authentication provided by the hwKitAssistant lacks strict identity verification of applications.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-1664A flaw was found in Keycloak.Keycloak · org.keycloak:keycloak-core
- CVE-2023-1667A NULL pointer dereference was found In libssh during re-keying with algorithm guessing.libssh
- CVE-2023-1981A vulnerability was found in the avahi library.avahi
- CVE-2023-2002A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hci_sock.c in the Linux KerneKernel
- CVE-2023-20868NSX-T contains a reflected cross-site scripting vulnerability due to a lack of input validation.NSX-T
- CVE-2023-20882In Cloud foundry routing release versions from 0.262.0 and prior to 0.266.0,a bug in the gorouter process can lead to a denial of service ofCloud Foundry Routing release
- CVE-2023-2283A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signaturlibssh
- CVE-2023-27311NetApp Blue XP Connector versions prior to 3.9.25 expose information via a directory listing.Information Disclosure Vulnerability in NetApp BlueXP Conne…
- CVE-2023-2817A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11.Craft CMS · craftcms/cms
- CVE-2023-28320A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, sehttps://github.com/curl/curl
- CVE-2023-28321An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as https://github.com/curl/curl
- CVE-2023-28322An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callbackhttps://github.com/curl/curl
- CVE-2023-2854BLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture fileWireshark Foundation Wireshark
- CVE-2023-2855Candump log parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture fileWireshark Foundation Wireshark
- CVE-2023-2856VMS TCPIPtrace file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture fileWireshark Foundation Wireshark
- CVE-2023-2857BLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture fileWireshark Foundation Wireshark
- CVE-2023-2858NetScaler file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture fileWireshark Foundation Wireshark
- CVE-2023-2879GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture fileWireshark Foundation Wireshark
- CVE-2023-2898There is a null-pointer-dereference flaw found in f2fs_write_end_io in fs/f2fs/data.c in the Linux kernel.Kernel
- CVE-2023-31225The Gallery app has the risk of hijacking attacks.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-33255An issue was discovered in Papaya Viewer 1.0.1449.
- CVE-2023-33394skycaiji v2.5.4 is vulnerable to Cross Site Scripting (XSS).
- CVE-2023-33720mp4v2 v2.1.2 was discovered to contain a memory leak via the class MP4BytesProperty.
- CVE-2023-33780A stored cross-site scripting (XSS) vulnerability in TFDi Design smartCARS 3 v0.7.0 and below allows attackers to execute arbitrary web scri