CVEs published May 27, 2023
24 CVEs were published on May 27, 2023: 1 critical, 7 high.
- Published
- 24
- Critical
- 1
- High
- 7
- Medium
- 13
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 14
Most affected products
- openemr/openemr
- 6
- bwm-ng
- 1
- craftcms cms · craftcms/cms
- 1
- DedeCMS
- 1
- federicoiosue Omni-Notes
- 1
- JIZHICMS
- 1
- keep-module-latest
- 1
- kiwitcms Kiwi · kiwitcms
- 1
- n158
- 1
- nextcloud security-advisories
- 1
Critical 1
High 7
- CVE-2023-32695Insufficient validation when decoding a Socket.IO packetsocketio socket.io-parser · socket.io-parser
- CVE-2023-26127All versions of the package n158 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports' function.n158
- CVE-2023-26128All versions of the package keep-module-latest are vulnerable to Command Injection due to missing input sanitization or other checks and sankeep-module-latest
- CVE-2023-26129All versions of the package bwm-ng are vulnerable to Command Injection due to improper input sanitization in the 'check' function in the bwmbwm-ng
- CVE-2023-32686kiwitcms vulnerable to stored XSS via unrestricted files uploadkiwitcms Kiwi · kiwitcms
- CVE-2023-33192Improper handling of NTS cookie length that could crash the ntpd-rs serverpendulum-project ntpd-rs · ntpd
- CVE-2023-2942Improper Input Validation in openemr/openemropenemr/openemr
Medium, low and unrated 16
- CVE-2023-2928DedeCMS article_allowurl_edit.php code injectionDedeCMS
- CVE-2023-2927JIZHICMS TemplateController.php index server-side request forgeryJIZHICMS
- CVE-2023-2926SeaCMS Picture Upload member.php denial of serviceSeaCMS
- CVE-2023-2925Webkul krayin crm Edit Person Page 2 cross site scriptingWebkul krayin crm
- CVE-2023-2924Supcon SimField reportupload.aspx unrestricted uploadSupcon SimField
- CVE-2023-2923Tenda AC6 fromDhcpListClient stack-based overflowTenda AC6
- CVE-2023-2922SourceCodester Comment System GET Parameter index.php cross site scriptingSourceCodester Comment System
- CVE-2023-33184Blind SSRF in the Nextcloud Mail app on avatar endpointnextcloud security-advisories
- CVE-2023-33195Craft CMS XSS in RSS widget feedcraftcms cms · craftcms/cms
- CVE-2023-33188 Uncontrolled data used in content resolution federicoiosue Omni-Notes
- CVE-2023-32688Invalid push request payload crashes Parse Serverparse-community parse-server-push-adapter · parse-server-pu…
- CVE-2023-2943Code Injection in openemr/openemropenemr/openemr
- CVE-2023-2944Improper Access Control in openemr/openemropenemr/openemr
- CVE-2023-2945Missing Authorization in openemr/openemropenemr/openemr
- CVE-2023-2946Improper Access Control in openemr/openemropenemr/openemr
- CVE-2023-2947Cross-site Scripting (XSS) - Stored in openemr/openemropenemr/openemr