CVEs published May 30, 2023
151 CVEs were published on May 30, 2023: 17 critical, 55 high.
- Published
- 151
- Critical
- 17
- High
- 55
- Medium
- 61
- Low
- 9
- Unrated
- 9
- Now in CISA KEV
- 0
- Fix available
- 79
Most affected products
- Google Chrome
- 13
- RIOT-OS RIOT
- 6
- Shop Beat studio
- 6
- xibosignage xibo-cms
- 5
- Abstrium Pydio Cells · github.com/pydio/cells +1
- 3
- Avaya IX Workforce Engagement
- 3
- Dell PowerPath Windows
- 3
- Honeywell OneWireless
- 3
- ImageMagick
- 3
- ZTE Blade A52, ZTE Blade A51, ZTE Blade A3 Lite, ZTE Blade…
- 3
Critical 17
- CVE-2023-33975RIOT-OS vulnerable to Out of Bounds Write in _rbuf_addRIOT-OS RIOT
- CVE-2023-33189Incorrect Authorization with specially crafted requestspomerium · github.com/pomerium/pomerium
- CVE-2023-33193Emby Server Proxy Header Spoofing VulnerabilityEmbySupport security
- CVE-2023-33175ToUI allows user-specific variables to be shared between usersmubarakalmehairbi ToUI · toui
- CVE-2023-32692Remote Code Execution Vulnerability in Validation PlaceholdersCodeIgniter4 · codeigniter4/framework
- CVE-2022-36246Shop Beat Services Vulnerable To Insecure PermissionsShop Beat studio
- CVE-2022-36247Shop Beat Services Vulnerable To IDORShop Beat studio
- CVE-2022-47526Fox-IT DataDiode (aka Fox DataDiode) 3.4.3 suffers from a path traversal vulnerability with resultant arbitrary writing of files.
- CVE-2023-28347An issue was discovered in Faronics Insight 10.0.19045 on Windows.
- CVE-2023-29727The Call Blocker application 6.6.3 for Android allows unauthorized applications to use exposed components to delete data stored in its datab
- CVE-2023-29728The Call Blocker application 6.6.3 for Android allows attackers to tamper with feature-related data, resulting in a severe elevation of priv
- CVE-2023-29732SoLive 1.6.14 thru 1.6.20 for Android exists exposed component, the component provides the method to modify the SharedPreference file.
- CVE-2023-29739An issue found in Alarm Clock for Heavy Sleepers v.5.3.2 for Android allows unauthorized apps to cause escalation of privilege attacks by ma
- CVE-2023-29741An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause an escalation of privileges attack by manipulating the d
- CVE-2023-33734BlueCMS v1.6 was discovered to contain a SQL injection vulnerability via the keywords parameter at search.php.
- CVE-2023-34152A vulnerability was found in ImageMagick.ImageMagick
- CVE-2023-34205In Moov signedxml through 1.0.0, parsing the raw XML (as received) can result in different output than parsing the canonicalized XML.github.com/moov-io/signedxml
High 55
- CVE-2023-33961Leantime Stored Cross-site Scripting Vulnerabilityleantime
- CVE-2023-2939Insufficient data validation in Installer in Google Chrome on Windows prior to 114.0.5735.90 allowed a local attacker to perform privilege eGoogle Chrome
- CVE-2023-2936Type Confusion in V8 in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2023-2935Type Confusion in V8 in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2023-2934Out of bounds memory access in Mojo in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruptionGoogle Chrome
- CVE-2023-2933Use after free in PDF in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a craftedGoogle Chrome
- CVE-2023-2932Use after free in PDF in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a craftedGoogle Chrome
- CVE-2023-2931Use after free in PDF in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a craftedGoogle Chrome
- CVE-2023-2930Use after free in Extensions in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install a malicious extensiGoogle Chrome
- CVE-2023-2929Out of bounds write in Swiftshader in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption Google Chrome
- CVE-2023-32342IBM GSKit information disclosureIBM GSKit
- CVE-2023-33177Xibo CMS vulnerable to Remote Code Execution through Zip Slipxibosignage xibo-cms
- CVE-2023-32696Excessive permissions for ckan userckan-docker-base
- CVE-2023-2968Undefined variable usage in npm package "proxy" leads to remote denial of serviceproxy
- CVE-2023-33974RIOT-OS vulnerable to Race Condition in SFR TimeoutRIOT-OS RIOT
- CVE-2023-33973RIOT-OS vulnerable to NULL pointer dereference during NHC encodingRIOT-OS RIOT
- CVE-2023-23755[20230502] - Core - Bruteforce prevention within the mfa screenJoomla! Project Joomla! CMS
- CVE-2023-24825RIOT-OS vulnerable to NULL pointer dereference in gnrc_pktbuf_markRIOT-OS RIOT
- CVE-2023-24817RIOT-OS vulnerable to Out of Bounds write in routing with SRHRIOT-OS RIOT
- CVE-2023-28079 PowerPath for Windows, versions 7.0, 7.1 & 7.2 contains Insecure File and Folder Permissions vulnerability.Dell PowerPath Windows
- CVE-2023-33234Apache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configurationApache Software Foundation Apache Airflow CNCF Kubernetes P…
- CVE-2023-0766Newsletter Popup <= 1.2 - Record Deletion via CSRFNewsletter Popup
- CVE-2023-2288Otter - Gutenberg Blocks < 2.2.6 - Author+ PHAR DeserializationOtter
- CVE-2023-1938WP Fatest Cache < 1.1.5 - Blind SSRF via CSRFWP Fastest Cache
- CVE-2023-0329Elementor Website Builder < 3.12.2 - Admin+ SQLiElementor Website Builder
- CVE-2023-30601Apache Cassandra: Privilege escalation when enabling FQL/Audit logsApache Software Foundation Apache Cassandra · org.apache.ca…
- CVE-2023-33186Cross-site scripting vulnerability in Zulip Server development branch via topic tooltipzulip
- CVE-2023-26130Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the contyhirose/cpp-httplib
- CVE-2023-32698nfpm vulnerable to Incorrect Default Permissionsgoreleaser nfpm · github.com/goreleaser/nfpm/v2 +1
- CVE-2022-36250Cross Site Request Forgery on Shop Beat ServicesShop Beat studio
- CVE-2022-39071There is an unauthorized access vulnerability in some ZTE mobile phones.ZTE Blade A52, ZTE Blade A51, ZTE Blade A3 Lite, ZTE Blade…
- CVE-2022-39075There is an unauthorized access vulnerability in some ZTE mobile phones.ZTE Blade A52, ZTE Blade A51, ZTE Blade A3 Lite, ZTE Blade…
- CVE-2022-47029An issue was found in Action Launcher v50.5 allows an attacker to escalate privilege via modification of the intent string to function updat
- CVE-2022-47525Fox-IT DataDiode (aka Fox DataDiode) 3.4.3 suffers from a Divide-by-Zero vulnerability in the packet parser.
- CVE-2023-27988The post-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.13)C0 could allow an autheZyxel NAS326 firmware
- CVE-2023-28344An issue was discovered in Faronics Insight 10.0.19045 on Windows.
- CVE-2023-28346An issue was discovered in Faronics Insight 10.0.19045 on Windows.
- CVE-2023-28348An issue was discovered in Faronics Insight 10.0.19045 on Windows.
- CVE-2023-28349An issue was discovered in Faronics Insight 10.0.19045 on Windows.
- CVE-2023-28352An issue was discovered in Faronics Insight 10.0.19045 on Windows.
- CVE-2023-28353An issue was discovered in Faronics Insight 10.0.19045 on Windows.
- CVE-2023-2953A vulnerability was found in openldap.openldap
- CVE-2023-29726The Call Blocker application 6.6.3 for Android incorrectly opens a key component that an attacker can use to inject large amounts of dirty d
- CVE-2023-29731SoLive 1.6.14 thru 1.6.20 for Android has an exposed component that provides a method to modify the SharedPreference file.
- CVE-2023-29738An issue found in Wave Animated Keyboard Emoji v.1.70.7 for Android allows a local attacker to cause code execution and escalation of Privil
- CVE-2023-29740An issue found in Alarm Clock for Heavy Sleepers v.5.3.2 for Android allows unauthorized apps to cause a denial of service attack by manipul
- CVE-2023-29742An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a code execution attack by manipulating the database.
- CVE-2023-29743An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service attack by manipulating th
- CVE-2023-29745An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service attack by manipulating th
- CVE-2023-30196Prestashop salesbooster <= 1.10.4 is vulnerable to Incorrect Access Control via modules/salesbooster/downloads/download.php.
- CVE-2023-31185ROZCOM server frameworkROZCOM server framework
- CVE-2023-33245Minecraft through 1.19 and 1.20 pre-releases before 7 (Java) allow arbitrary file overwrite, and possibly code execution, via crafted world
- CVE-2023-33740Incorrect access control in luowice v3.5.18 allows attackers to access cloud source code information via modification fo the Verify paramete
- CVE-2023-33741Macrovideo v380pro v1.4.97 shares the device id and password when sharing the device.
- CVE-2023-34153A vulnerability was found in ImageMagick.ImageMagick
Medium, low and unrated 79
- CVE-2012-10015BestWebSoft Twitter Plugin Settings Page twitter.php twttr_settings_page cross-site request forgeryBestWebSoft Twitter Plugin
- CVE-2023-2612shiftfs lock unbalance in Ubuntu-specific kernelsCanonical ubuntu-linux
- CVE-2023-33962JStachio XSS vulnerability: Unescaped single quotesjstachio · io.jstach:jstachio
- CVE-2023-2941Inappropriate implementation in Extensions API in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install aGoogle Chrome
- CVE-2023-2940Inappropriate implementation in Downloads in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install a maliGoogle Chrome
- CVE-2023-2938Inappropriate implementation in Picture In Picture in Google Chrome prior to 114.0.5735.90 allowed a remote attacker who had compromised theGoogle Chrome
- CVE-2023-2937Inappropriate implementation in Picture In Picture in Google Chrome prior to 114.0.5735.90 allowed a remote attacker who had compromised theGoogle Chrome
- CVE-2023-33181Sensitive Information Disclosure abusing Stack Trace in Xibo CMSxibosignage xibo-cms
- CVE-2023-33180Sensitive Information Disclosure abusing SQL Injection in Xibo CMS display mapxibosignage xibo-cms
- CVE-2023-33179Sensitive Information Disclosure abusing SQL Injection in Xibo CMS nameFilterxibosignage xibo-cms
- CVE-2023-33178Sensitive Information Disclosure abusing SQL Injection in Xibo CMS dataset filterxibosignage xibo-cms
- CVE-2023-32699MeterSphere denial of service vulnerabilitymetersphere
- CVE-2023-1711A vulnerability exists in a FOXMAN-UN and UNEM logging component, it only affects systems that use remote authentication to the network elemHitachi Energy FOXMAN-UN · Hitachi Energy UNEM
- CVE-2023-32689Parse Server vulnerable to phishing attack vulnerability that involves uploading malicious HTML fileparse-community parse-server · parse-server
- CVE-2023-32684In Lima, a malicious disk image could read a single file on the host filesystem as a qcow2/vmdk backing filelima-vm lima · github.com/lima-vm/lima
- CVE-2022-46361Physical access to the WDM enables use of USB device to gain access to the WDMHoneywell OneWireless
- CVE-2022-43485Insecure random number used for generating keys for signing Jwt tokensHoneywell OneWireless
- CVE-2022-4240Unauthenticated API allowing an attacker to obtain the information about network resourcesHoneywell OneWireless
- CVE-2023-23754[20230501] - Core - Open Redirect and XSS within the mfa selectJoomla! Project Joomla! CMS
- CVE-2023-24826Usage of Uninitialized Timer during forwarding of Fragments with SFRRIOT-OS RIOT
- CVE-2023-32448 PowerPath for Windows, versions 7.0, 7.1 & 7.2 contains License Key Stored in Cleartext vulnerability.Dell PowerPath Windows
- CVE-2023-28080 PowerPath for Windows, versions 7.0, 7.1 & 7.2 contains DLL Hijacking Vulnerabilities.Dell PowerPath Windows
- CVE-2023-24568 Dell NetWorker, contains an Improper Validation of Certificate with Host Mismatch vulnerability in Rabbitmq port which could disallow replaDell NetWorker
- CVE-2023-20884VMware Workspace ONE Access and VMware Identity Manager contain an insecure redirect vulnerability.VMware Workspace ONE Access (Access), VMware Identity Manag…
- CVE-2023-2981Abstrium Pydio Cells Chat cross site scriptingAbstrium Pydio Cells · github.com/pydio/cells +1
- CVE-2023-2980Abstrium Pydio Cells User Creation resource injectionAbstrium Pydio Cells · github.com/pydio/cells +1
- CVE-2023-2979Abstrium Pydio Cells User Creation access controlAbstrium Pydio Cells
- CVE-2023-2978Abstrium Pydio Cells Change Subscription authorizationAbstrium Pydio Cells · github.com/pydio/cells +1
- CVE-2023-2650Possible DoS translating ASN.1 object identifiersOpenSSL
- CVE-2023-2973SourceCodester Students Online Internship Timesheet Syste cross site scriptingSourceCodester Students Online Internship Timesheet Syste
- CVE-2022-45853The privilege escalation vulnerability in the Zyxel GS1900-8 firmware version V2.70(AAHH.3) and the GS1900-8HP firmware version V2.70(AAHIZyxel GS1900-8HP firmware · Zyxel GS1900-8 firmware
- CVE-2023-2111HollerBox < 2.1.4 - Admin+ SQL InjectionFast & Effective Popups & Lead-Generation for WordPress
- CVE-2023-2296Loginizer 1.7.8 - Reflected XSSLoginizer
- CVE-2023-2023Custom 404 Pro < 3.7.3 - Reflected Cross-Site ScriptingCustom 404 Pro
- CVE-2023-2223Login Rebuilder < 2.8.1 - Admin+ Stored XSSLogin rebuilder
- CVE-2023-0443AnyWhere Elementor < 1.2.8 - Freemius API Key DisclosureAnyWhere Elementor
- CVE-2023-2117Image Optimizer by 10web < 1.0.27 - Admin+ Path TraversalImage Optimizer by 10web
- CVE-2023-2287Orbit Fox < 2.10.24 - Author+ Server-Side Request ForgeryOrbit Fox by ThemeIsle
- CVE-2022-4676OSM – OpenStreetMap <= 6.01 - Contributor+ Stored XSS via ShortcodeOSM
- CVE-2023-2113Autoptimize < 3.1.7 - Admin+ Stored Cross-Site Scripting via Settings ImportAutoptimize
- CVE-2023-2518Easy Forms for Mailchimp < 6.8.9 - Reflected XSSEasy Forms for Mailchimp
- CVE-2023-1524Download Manager < 3.2.71 - Broken Access ControlsDownload Manager
- CVE-2023-0733Newsletter Popup <= 1.2 - Unauthenticated Stored XSSNewsletter Popup
- CVE-2023-2470Add to Feedly <= 1.2.11 - Admin+ Stored XSSAdd to Feedly
- CVE-2023-2256Product Addons & Fields for WooCommerce < 32.0.7 - Reflected Cross-Site ScriptingProduct Addons & Fields for WooCommerce
- CVE-2023-33955Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploitedminio console · github.com/minio/console
- CVE-2023-33191kyverno seccomp control can be circumventedkyverno · github.com/kyverno/kyverno
- CVE-2023-2970MindSpore json_helper.cc UpdateArray memory corruptionMindSpore
- CVE-2023-33183Error in calendar when booking an appointment reveals the full path of the websitenextcloud security-advisories
- CVE-2023-33182Nextcloud Contacts photos only sanitized if mime type is all lower casenextcloud security-advisories
- CVE-2023-33198Incorrectly Specified Chat Message Destinations in tgstation-server and DreamMaker APItgstation-server
- CVE-2023-32685Clipboard based cross-site scripting (blocked with default CSP) in Kanboardkanboard
- CVE-2023-32691ginuerzh/gost vulnerable to Timing Attackginuerzh gost · github.com/ginuerzh/gost
- CVE-2022-36243Directory Traversal on Shop Beat ServicesShop Beat studio
- CVE-2022-36244Multiple Stored Cross-Site Scripting Vulnerabilities on Shop Beat ServicesShop Beat studio
- CVE-2022-36249Shop Beat Services Vulnerable To Bypass 2FA via APIsShop Beat studio
- CVE-2022-39074There is an unauthorized access vulnerability in some ZTE mobile phones.ZTE Blade A52, ZTE Blade A51, ZTE Blade A3 Lite, ZTE Blade…
- CVE-2022-47028An issue discovered in Action Launcher for Android v50.5 allows an attacker to cause a denial of service via arbitary data injection to func
- CVE-2023-0779net: shell: Improper input validationzephyrproject-rtos zephyr
- CVE-2023-23561Stormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control: authenticated users can read sensitive information.
- CVE-2023-23956A user can supply malicious HTML and JavaScript code that will be executed in the client browserSymantec SiteMinder WebAgent
- CVE-2023-28345An issue was discovered in Faronics Insight 10.0.19045 on Windows.
- CVE-2023-28350An issue was discovered in Faronics Insight 10.0.19045 on Windows.
- CVE-2023-28351An issue was discovered in Faronics Insight 10.0.19045 on Windows.
- CVE-2023-2952XRA dissector infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted captureWireshark Foundation Wireshark
- CVE-2023-2972Prototype Pollution in antfu/utilsantfu/utils · @antfu/utils
- CVE-2023-29733The Lock Master app 2.2.4 for Android allows unauthorized apps to modify the values in its SharedPreference files.
- CVE-2023-29734An issue found in edjing Mix v.7.09.01 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the dat
- CVE-2023-29735An issue found in edjing Mix v.7.09.01 for Android allows a local attacker to cause a denial of service via the database files.
- CVE-2023-29737An issue found in Wave Animated Keyboard Emoji v.1.70.7 for Android allows a local attacker to cause a denial of service via the database fi
- CVE-2023-2983Privilege Defined With Unsafe Actions in pimcore/pimcorepimcore/pimcore
- CVE-2023-2984Path Traversal: '\..\filename' in pimcore/pimcorepimcore/pimcore
- CVE-2023-31184ROZCOM clientROZCOM client
- CVE-2023-31186Avaya IX Workforce Engagement - User Enumeration - CWE-204: Observable Response DiscrepancyAvaya IX Workforce Engagement
- CVE-2023-31187Avaya IX Workforce Engagement - CWE-522: Insufficiently Protected CredentialsAvaya IX Workforce Engagement
- CVE-2023-32218Avaya IX Workforce Engagement - CWE-601: URL Redirection to Untrusted Site ('Open Redirect')Avaya IX Workforce Engagement
- CVE-2023-33656A memory leak vulnerability exists in NanoMQ 0.17.2.
- CVE-2023-34151A vulnerability was found in ImageMagick.ImageMagick
- CVE-2023-34204imapsync through 2.229 uses predictable paths under /tmp and /var/tmp in its default mode of operation.