CVEs published May 29, 2023
34 CVEs were published on May 29, 2023: 3 critical, 5 high.
- Published
- 34
- Critical
- 3
- High
- 5
- Medium
- 14
- Low
- 2
- Unrated
- 10
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- Bestwebsoft Relevant Plugin
- 1
- Chris Reynolds Progress Bar
- 1
- Codeixer Product Gallery Slider for WooCommerce
- 1
- dolibarr/dolibarr
- 1
- Enalean tuleap
- 1
- liangliangyy/djangoblog
- 1
- Mattermost
- 1
- MonitorClick Forms Ada – Form Builder
- 1
- Smash Balloon Custom Twitter Feeds
- 1
- SourceCodester Faculty Evaluation System
- 1
Critical 3
- CVE-2019-19791In LemonLDAP::NG (aka lemonldap-ng) before 2.0.7, the default Apache HTTP Server configuration does not properly restrict access to SOAP/RES
- CVE-2022-24627An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752.
- CVE-2022-24629An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752.
High 5
- CVE-2023-32687Insufficiently Protected ChatBot Credentials in tgstation-servertgstation-server
- CVE-2023-27613WordPress Forms Ada Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)MonitorClick Forms Ada – Form Builder
- CVE-2021-27825A directory traversal vulnerability on Mercury MAC1200R devices allows attackers to read arbitrary files via a web-static/ URL.
- CVE-2022-24628An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752.
- CVE-2023-30253Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instead of <?php in injectdolibarr/dolibarr
Medium, low and unrated 26
- CVE-2014-125102Bestwebsoft Relevant Plugin Thumbnail information disclosureBestwebsoft Relevant Plugin
- CVE-2023-32072Tuleap vulnerable toXSS via the triggered job URL of a Jenkins jobEnalean tuleap
- CVE-2023-23699WordPress Progress Bar Plugin <= 2.2.1 is vulnerable to Cross Site Scripting (XSS)Chris Reynolds Progress Bar
- CVE-2023-2962SourceCodester Faculty Evaluation System sql injectionSourceCodester Faculty Evaluation System
- CVE-2023-2808Lack of URL normalization allows rendering previews for disallowed domainsMattermost
- CVE-2023-2955SourceCodester Students Online Internship Timesheet System GET Parameter rendered_report.php sql injectionSourceCodester Students Online Internship Timesheet System
- CVE-2022-45372WordPress Product Gallery Slider for WooCommerce Plugin <= 2.2.8 is vulnerable to Cross Site Request Forgery (CSRF)Codeixer Product Gallery Slider for WooCommerce
- CVE-2022-33974WordPress Custom Twitter Feeds (Tweets Widget) Plugin <= 1.8.4 is vulnerable to Cross Site Request Forgery (CSRF)Smash Balloon Custom Twitter Feeds
- CVE-2020-29547An issue was discovered in Citadel through webcit-926.
- CVE-2021-37845An issue was discovered in Citadel through webcit-932.
- CVE-2022-24630An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752.
- CVE-2022-24631An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752.
- CVE-2022-24632An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752.
- CVE-2022-41766An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3.
- CVE-2023-24597OX App Suite before frontend 7.10.6-rev24 allows the loading (without user consent) of an e-mail message's remote resources during printing.
- CVE-2023-24598OX App Suite before backend 7.10.6-rev37 has an information leak in the handling of distribution lists, e.g., partial disclosure of the priv
- CVE-2023-24599OX App Suite before backend 7.10.6-rev37 allows authenticated users to change the appointments of arbitrary users via conflicting ID numbers
- CVE-2023-24600OX App Suite before backend 7.10.6-rev37 allows authenticated users to bypass access controls (for reading contacts) via a move to their own
- CVE-2023-24601OX App Suite before frontend 7.10.6-rev24 allows XSS via a non-app deeplink such as the jslob API's registry sub-tree.
- CVE-2023-24602OX App Suite before frontend 7.10.6-rev24 allows XSS via data to the Tumblr portal widget, such as a post title.
- CVE-2023-24603OX App Suite before backend 7.10.6-rev37 does not check size limits when downloading, e.g., potentially allowing a crafted iCal feed to prov
- CVE-2023-24604OX App Suite before backend 7.10.6-rev37 does not check HTTP header lengths when downloading, e.g., potentially allowing a crafted iCal feed
- CVE-2023-24605OX App Suite before backend 7.10.6-rev37 does not enforce 2FA for all endpoints, e.g., reading from a drive, reading contact data, and renam
- CVE-2023-28153An issue was discovered in the Kiddoware Kids Place Parental Control application before 3.8.50 for Android.
- CVE-2023-2954Cross-site Scripting (XSS) - Stored in liangliangyy/djangoblogliangliangyy/djangoblog
- CVE-2023-30571Libarchive through 3.6.2 can cause directories to have world-writable permissions.