# CVEs published 2023-05-29 34 CVEs were published on May 29, 2023: 3 critical, 5 high. Days are UTC. - [CVE-2014-125102](https://cve.now/CVE-2014-125102.md): Bestwebsoft Relevant Plugin Thumbnail information disclosure (CVSS 4.3, Bestwebsoft Relevant Plugin) - [CVE-2023-32687](https://cve.now/CVE-2023-32687.md): Insufficiently Protected ChatBot Credentials in tgstation-server (CVSS 7.7, tgstation-server) - [CVE-2023-32072](https://cve.now/CVE-2023-32072.md): Tuleap vulnerable toXSS via the triggered job URL of a Jenkins job (CVSS 4.8, Enalean tuleap) - [CVE-2023-27613](https://cve.now/CVE-2023-27613.md): WordPress Forms Ada Plugin \<= 1.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, MonitorClick Forms Ada – Form Builder) - [CVE-2023-23699](https://cve.now/CVE-2023-23699.md): WordPress Progress Bar Plugin \<= 2.2.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Chris Reynolds Progress Bar) - [CVE-2023-2962](https://cve.now/CVE-2023-2962.md): SourceCodester Faculty Evaluation System sql injection (CVSS 4.7, SourceCodester Faculty Evaluation System) - [CVE-2023-2808](https://cve.now/CVE-2023-2808.md): Lack of URL normalization allows rendering previews for disallowed domains (CVSS 4.3, Mattermost) - [CVE-2023-2955](https://cve.now/CVE-2023-2955.md): SourceCodester Students Online Internship Timesheet System GET Parameter rendered\_report.php sql injection (CVSS 6.3, SourceCodester Students Online Internship Timesheet System) - [CVE-2022-45372](https://cve.now/CVE-2022-45372.md): WordPress Product Gallery Slider for WooCommerce Plugin \<= 2.2.8 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Codeixer Product Gallery Slider for WooCommerce) - [CVE-2022-33974](https://cve.now/CVE-2022-33974.md): WordPress Custom Twitter Feeds (Tweets Widget) Plugin \<= 1.8.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Smash Balloon Custom Twitter Feeds) - [CVE-2019-19791](https://cve.now/CVE-2019-19791.md): In LemonLDAP::NG (aka lemonldap-ng) before 2.0.7, the default Apache HTTP Server configuration does not properly restrict access to SOAP/RES (CVSS 9.8) - [CVE-2020-29547](https://cve.now/CVE-2020-29547.md): An issue was discovered in Citadel through webcit-926. (CVSS 5.9) - [CVE-2021-27825](https://cve.now/CVE-2021-27825.md): A directory traversal vulnerability on Mercury MAC1200R devices allows attackers to read arbitrary files via a web-static/ URL. (CVSS 7.5) - [CVE-2021-37845](https://cve.now/CVE-2021-37845.md): An issue was discovered in Citadel through webcit-932. (CVSS 3.7) - [CVE-2022-24627](https://cve.now/CVE-2022-24627.md): An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. (CVSS 9.8) - [CVE-2022-24628](https://cve.now/CVE-2022-24628.md): An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. (CVSS 7.2) - [CVE-2022-24629](https://cve.now/CVE-2022-24629.md): An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. (CVSS 9.8) - [CVE-2022-24630](https://cve.now/CVE-2022-24630.md): An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. (no CVSS) - [CVE-2022-24631](https://cve.now/CVE-2022-24631.md): An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. (no CVSS) - [CVE-2022-24632](https://cve.now/CVE-2022-24632.md): An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. (no CVSS) - [CVE-2022-41766](https://cve.now/CVE-2022-41766.md): An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. (no CVSS) - [CVE-2023-24597](https://cve.now/CVE-2023-24597.md): OX App Suite before frontend 7.10.6-rev24 allows the loading (without user consent) of an e-mail message's remote resources during printing. (no CVSS) - [CVE-2023-24598](https://cve.now/CVE-2023-24598.md): OX App Suite before backend 7.10.6-rev37 has an information leak in the handling of distribution lists, e.g., partial disclosure of the priv (no CVSS) - [CVE-2023-24599](https://cve.now/CVE-2023-24599.md): OX App Suite before backend 7.10.6-rev37 allows authenticated users to change the appointments of arbitrary users via conflicting ID numbers (no CVSS) - [CVE-2023-24600](https://cve.now/CVE-2023-24600.md): OX App Suite before backend 7.10.6-rev37 allows authenticated users to bypass access controls (for reading contacts) via a move to their own (no CVSS) - [CVE-2023-24601](https://cve.now/CVE-2023-24601.md): OX App Suite before frontend 7.10.6-rev24 allows XSS via a non-app deeplink such as the jslob API's registry sub-tree. (no CVSS) - [CVE-2023-24602](https://cve.now/CVE-2023-24602.md): OX App Suite before frontend 7.10.6-rev24 allows XSS via data to the Tumblr portal widget, such as a post title. (no CVSS) - [CVE-2023-24603](https://cve.now/CVE-2023-24603.md): OX App Suite before backend 7.10.6-rev37 does not check size limits when downloading, e.g., potentially allowing a crafted iCal feed to prov (CVSS 6.5) - [CVE-2023-24604](https://cve.now/CVE-2023-24604.md): OX App Suite before backend 7.10.6-rev37 does not check HTTP header lengths when downloading, e.g., potentially allowing a crafted iCal feed (CVSS 4.3) - [CVE-2023-24605](https://cve.now/CVE-2023-24605.md): OX App Suite before backend 7.10.6-rev37 does not enforce 2FA for all endpoints, e.g., reading from a drive, reading contact data, and renam (CVSS 4.2) - [CVE-2023-28153](https://cve.now/CVE-2023-28153.md): An issue was discovered in the Kiddoware Kids Place Parental Control application before 3.8.50 for Android. (CVSS 6.4) - [CVE-2023-2954](https://cve.now/CVE-2023-2954.md): Cross-site Scripting (XSS) - Stored in liangliangyy/djangoblog (CVSS 4.8, liangliangyy/djangoblog) - [CVE-2023-30253](https://cve.now/CVE-2023-30253.md): Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: \