# CVEs published 2023-05-30

151 CVEs were published on May 30, 2023: 17 critical, 55 high. Days are UTC.

- [CVE-2012-10015](https://cve.now/CVE-2012-10015.md): BestWebSoft Twitter Plugin Settings Page twitter.php twttr\_settings\_page cross-site request forgery (CVSS 4.3, BestWebSoft Twitter Plugin)
- [CVE-2023-2612](https://cve.now/CVE-2023-2612.md): shiftfs lock unbalance in Ubuntu-specific kernels (CVSS 4.4, Canonical ubuntu-linux)
- [CVE-2023-33962](https://cve.now/CVE-2023-33962.md): JStachio XSS vulnerability: Unescaped single quotes (CVSS 5.4, jstachio · io.jstach:jstachio)
- [CVE-2023-33961](https://cve.now/CVE-2023-33961.md): Leantime Stored Cross-site Scripting Vulnerability (CVSS 8.9, leantime)
- [CVE-2023-2941](https://cve.now/CVE-2023-2941.md): Inappropriate implementation in Extensions API in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install a (CVSS 4.3, Google Chrome)
- [CVE-2023-2940](https://cve.now/CVE-2023-2940.md): Inappropriate implementation in Downloads in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install a mali (CVSS 6.5, Google Chrome)
- [CVE-2023-2939](https://cve.now/CVE-2023-2939.md): Insufficient data validation in Installer in Google Chrome on Windows prior to 114.0.5735.90 allowed a local attacker to perform privilege e (CVSS 7.8, Google Chrome)
- [CVE-2023-2938](https://cve.now/CVE-2023-2938.md): Inappropriate implementation in Picture In Picture in Google Chrome prior to 114.0.5735.90 allowed a remote attacker who had compromised the (CVSS 4.3, Google Chrome)
- [CVE-2023-2937](https://cve.now/CVE-2023-2937.md): Inappropriate implementation in Picture In Picture in Google Chrome prior to 114.0.5735.90 allowed a remote attacker who had compromised the (CVSS 4.3, Google Chrome)
- [CVE-2023-2936](https://cve.now/CVE-2023-2936.md): Type Confusion in V8 in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2023-2935](https://cve.now/CVE-2023-2935.md): Type Confusion in V8 in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2023-2934](https://cve.now/CVE-2023-2934.md): Out of bounds memory access in Mojo in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption (CVSS 8.8, Google Chrome)
- [CVE-2023-2933](https://cve.now/CVE-2023-2933.md): Use after free in PDF in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2023-2932](https://cve.now/CVE-2023-2932.md): Use after free in PDF in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2023-2931](https://cve.now/CVE-2023-2931.md): Use after free in PDF in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2023-2930](https://cve.now/CVE-2023-2930.md): Use after free in Extensions in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install a malicious extensi (CVSS 8.8, Google Chrome)
- [CVE-2023-2929](https://cve.now/CVE-2023-2929.md): Out of bounds write in Swiftshader in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption (CVSS 8.8, Google Chrome)
- [CVE-2023-32342](https://cve.now/CVE-2023-32342.md): IBM GSKit information disclosure (CVSS 7.5, IBM GSKit)
- [CVE-2023-33181](https://cve.now/CVE-2023-33181.md): Sensitive Information Disclosure abusing Stack Trace in Xibo CMS (CVSS 4.3, xibosignage xibo-cms)
- [CVE-2023-33180](https://cve.now/CVE-2023-33180.md): Sensitive Information Disclosure abusing SQL Injection in Xibo CMS display map (CVSS 6.5, xibosignage xibo-cms)
- [CVE-2023-33179](https://cve.now/CVE-2023-33179.md): Sensitive Information Disclosure abusing SQL Injection in Xibo CMS nameFilter (CVSS 6.5, xibosignage xibo-cms)
- [CVE-2023-33178](https://cve.now/CVE-2023-33178.md): Sensitive Information Disclosure abusing SQL Injection in Xibo CMS dataset filter (CVSS 6.5, xibosignage xibo-cms)
- [CVE-2023-33177](https://cve.now/CVE-2023-33177.md): Xibo CMS vulnerable to Remote Code Execution through Zip Slip (CVSS 8.8, xibosignage xibo-cms)
- [CVE-2023-32699](https://cve.now/CVE-2023-32699.md): MeterSphere denial of service vulnerability (CVSS 6.5, metersphere)
- [CVE-2023-1711](https://cve.now/CVE-2023-1711.md): A vulnerability exists in a FOXMAN-UN and UNEM logging component, it only affects systems that use remote authentication to the network elem (CVSS 4.0, Hitachi Energy FOXMAN-UN · Hitachi Energy UNEM)
- [CVE-2023-32696](https://cve.now/CVE-2023-32696.md): Excessive permissions for ckan user (CVSS 8.8, ckan-docker-base)
- [CVE-2023-2968](https://cve.now/CVE-2023-2968.md): Undefined variable usage in npm package "proxy" leads to remote denial of service (CVSS 7.5, proxy)
- [CVE-2023-32689](https://cve.now/CVE-2023-32689.md): Parse Server vulnerable to phishing attack vulnerability that involves uploading malicious HTML file (CVSS 6.3, parse-community parse-server · parse-server)
- [CVE-2023-32684](https://cve.now/CVE-2023-32684.md): In Lima, a malicious disk image could read a single file on the host filesystem as a qcow2/vmdk backing file (CVSS 2.7, lima-vm lima · github.com/lima-vm/lima)
- [CVE-2023-33975](https://cve.now/CVE-2023-33975.md): RIOT-OS vulnerable to Out of Bounds Write in \_rbuf\_add (CVSS 9.8, RIOT-OS RIOT)
- [CVE-2023-33974](https://cve.now/CVE-2023-33974.md): RIOT-OS vulnerable to Race Condition in SFR Timeout (CVSS 7.5, RIOT-OS RIOT)
- [CVE-2022-46361](https://cve.now/CVE-2022-46361.md): Physical access to the WDM enables use of USB device to gain access to the WDM (CVSS 6.9, Honeywell OneWireless)
- [CVE-2022-43485](https://cve.now/CVE-2022-43485.md): Insecure random number used for generating keys for signing Jwt tokens (CVSS 6.2, Honeywell OneWireless)
- [CVE-2023-33973](https://cve.now/CVE-2023-33973.md): RIOT-OS vulnerable to NULL pointer dereference during NHC encoding (CVSS 7.5, RIOT-OS RIOT)
- [CVE-2022-4240](https://cve.now/CVE-2022-4240.md): Unauthenticated API allowing an attacker to obtain the information about network resources (CVSS 6.5, Honeywell OneWireless)
- [CVE-2023-23754](https://cve.now/CVE-2023-23754.md): \[20230501\] - Core - Open Redirect and XSS within the mfa select (CVSS 6.1, Joomla! Project Joomla! CMS)
- [CVE-2023-23755](https://cve.now/CVE-2023-23755.md): \[20230502\] - Core - Bruteforce prevention within the mfa screen (CVSS 7.5, Joomla! Project Joomla! CMS)
- [CVE-2023-24826](https://cve.now/CVE-2023-24826.md): Usage of Uninitialized Timer during forwarding of Fragments with SFR (CVSS 5.9, RIOT-OS RIOT)
- [CVE-2023-24825](https://cve.now/CVE-2023-24825.md): RIOT-OS vulnerable to NULL pointer dereference in gnrc\_pktbuf\_mark (CVSS 7.5, RIOT-OS RIOT)
- [CVE-2023-24817](https://cve.now/CVE-2023-24817.md): RIOT-OS vulnerable to Out of Bounds write in routing with SRH (CVSS 7.5, RIOT-OS RIOT)
- [CVE-2023-32448](https://cve.now/CVE-2023-32448.md): PowerPath for Windows, versions 7.0, 7.1 & 7.2 contains License Key Stored in Cleartext vulnerability. (CVSS 5.5, Dell PowerPath Windows)
- [CVE-2023-28080](https://cve.now/CVE-2023-28080.md): PowerPath for Windows, versions 7.0, 7.1 & 7.2 contains DLL Hijacking Vulnerabilities. (CVSS 6.7, Dell PowerPath Windows)
- [CVE-2023-28079](https://cve.now/CVE-2023-28079.md): PowerPath for Windows, versions 7.0, 7.1 & 7.2 contains Insecure File and Folder Permissions vulnerability. (CVSS 7.0, Dell PowerPath Windows)
- [CVE-2023-24568](https://cve.now/CVE-2023-24568.md): Dell NetWorker, contains an Improper Validation of Certificate with Host Mismatch vulnerability in Rabbitmq port which could disallow repla (CVSS 5.0, Dell NetWorker)
- [CVE-2023-20884](https://cve.now/CVE-2023-20884.md): VMware Workspace ONE Access and VMware Identity Manager contain an insecure redirect vulnerability. (CVSS 6.1, VMware Workspace ONE Access (Access), VMware Identity Manag…)
- [CVE-2023-2981](https://cve.now/CVE-2023-2981.md): Abstrium Pydio Cells Chat cross site scripting (CVSS 3.5, Abstrium Pydio Cells · github.com/pydio/cells +1)
- [CVE-2023-2980](https://cve.now/CVE-2023-2980.md): Abstrium Pydio Cells User Creation resource injection (CVSS 6.3, Abstrium Pydio Cells · github.com/pydio/cells +1)
- [CVE-2023-2979](https://cve.now/CVE-2023-2979.md): Abstrium Pydio Cells User Creation access control (CVSS 4.7, Abstrium Pydio Cells)
- [CVE-2023-2978](https://cve.now/CVE-2023-2978.md): Abstrium Pydio Cells Change Subscription authorization (CVSS 4.6, Abstrium Pydio Cells · github.com/pydio/cells +1)
- [CVE-2023-2650](https://cve.now/CVE-2023-2650.md): Possible DoS translating ASN.1 object identifiers (CVSS 6.5, OpenSSL)
- [CVE-2023-33234](https://cve.now/CVE-2023-33234.md): Apache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configuration (CVSS 7.2, Apache Software Foundation Apache Airflow CNCF Kubernetes P…)
- [CVE-2023-2973](https://cve.now/CVE-2023-2973.md): SourceCodester Students Online Internship Timesheet Syste cross site scripting (CVSS 2.4, SourceCodester Students Online Internship Timesheet Syste)
- [CVE-2022-45853](https://cve.now/CVE-2022-45853.md): The privilege escalation vulnerability in the Zyxel GS1900-8 firmware version V2.70(AAHH.3) and the GS1900-8HP firmware version V2.70(AAHI (CVSS 6.7, Zyxel GS1900-8HP firmware · Zyxel GS1900-8 firmware)
- [CVE-2023-2111](https://cve.now/CVE-2023-2111.md): HollerBox \< 2.1.4 - Admin+ SQL Injection (CVSS 4.9, Fast & Effective Popups & Lead-Generation for WordPress)
- [CVE-2023-2296](https://cve.now/CVE-2023-2296.md): Loginizer 1.7.8 - Reflected XSS (no CVSS, Loginizer)
- [CVE-2023-2023](https://cve.now/CVE-2023-2023.md): Custom 404 Pro \< 3.7.3 - Reflected Cross-Site Scripting (CVSS 6.1, Custom 404 Pro)
- [CVE-2023-2223](https://cve.now/CVE-2023-2223.md): Login Rebuilder \< 2.8.1 - Admin+ Stored XSS (no CVSS, Login rebuilder)
- [CVE-2023-0766](https://cve.now/CVE-2023-0766.md): Newsletter Popup \<= 1.2 - Record Deletion via CSRF (CVSS 8.8, Newsletter Popup)
- [CVE-2023-0443](https://cve.now/CVE-2023-0443.md): AnyWhere Elementor \< 1.2.8 - Freemius API Key Disclosure (CVSS 5.3, AnyWhere Elementor)
- [CVE-2023-2117](https://cve.now/CVE-2023-2117.md): Image Optimizer by 10web \< 1.0.27 - Admin+ Path Traversal (CVSS 2.7, Image Optimizer by 10web)
- [CVE-2023-2287](https://cve.now/CVE-2023-2287.md): Orbit Fox \< 2.10.24 - Author+ Server-Side Request Forgery (CVSS 4.3, Orbit Fox by ThemeIsle)
- [CVE-2022-4676](https://cve.now/CVE-2022-4676.md): OSM – OpenStreetMap \<= 6.01 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, OSM)
- [CVE-2023-2288](https://cve.now/CVE-2023-2288.md): Otter - Gutenberg Blocks \< 2.2.6 - Author+ PHAR Deserialization (CVSS 8.8, Otter)
- [CVE-2023-1938](https://cve.now/CVE-2023-1938.md): WP Fatest Cache \< 1.1.5 - Blind SSRF via CSRF (CVSS 8.8, WP Fastest Cache)
- [CVE-2023-0329](https://cve.now/CVE-2023-0329.md): Elementor Website Builder \< 3.12.2 - Admin+ SQLi (CVSS 7.2, Elementor Website Builder)
- [CVE-2023-2113](https://cve.now/CVE-2023-2113.md): Autoptimize \< 3.1.7 - Admin+ Stored Cross-Site Scripting via Settings Import (CVSS 4.8, Autoptimize)
- [CVE-2023-2518](https://cve.now/CVE-2023-2518.md): Easy Forms for Mailchimp \< 6.8.9 - Reflected XSS (CVSS 6.1, Easy Forms for Mailchimp)
- [CVE-2023-1524](https://cve.now/CVE-2023-1524.md): Download Manager \< 3.2.71 - Broken Access Controls (CVSS 6.5, Download Manager)
- [CVE-2023-0733](https://cve.now/CVE-2023-0733.md): Newsletter Popup \<= 1.2 - Unauthenticated Stored XSS (CVSS 6.1, Newsletter Popup)
- [CVE-2023-2470](https://cve.now/CVE-2023-2470.md): Add to Feedly \<= 1.2.11 - Admin+ Stored XSS (no CVSS, Add to Feedly)
- [CVE-2023-2256](https://cve.now/CVE-2023-2256.md): Product Addons & Fields for WooCommerce \< 32.0.7 - Reflected Cross-Site Scripting (no CVSS, Product Addons & Fields for WooCommerce)
- [CVE-2023-30601](https://cve.now/CVE-2023-30601.md): Apache Cassandra: Privilege escalation when enabling FQL/Audit logs (CVSS 7.8, Apache Software Foundation Apache Cassandra · org.apache.ca…)
- [CVE-2023-33955](https://cve.now/CVE-2023-33955.md): Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited (CVSS 4.3, minio console · github.com/minio/console)
- [CVE-2023-33191](https://cve.now/CVE-2023-33191.md): kyverno seccomp control can be circumvented (CVSS 4.6, kyverno · github.com/kyverno/kyverno)
- [CVE-2023-33189](https://cve.now/CVE-2023-33189.md): Incorrect Authorization with specially crafted requests (CVSS 10.0, pomerium · github.com/pomerium/pomerium)
- [CVE-2023-33186](https://cve.now/CVE-2023-33186.md): Cross-site scripting vulnerability in Zulip Server development branch via topic tooltip (CVSS 8.2, zulip)
- [CVE-2023-2970](https://cve.now/CVE-2023-2970.md): MindSpore json\_helper.cc UpdateArray memory corruption (CVSS 3.5, MindSpore)
- [CVE-2023-33193](https://cve.now/CVE-2023-33193.md): Emby Server Proxy Header Spoofing Vulnerability (CVSS 9.1, EmbySupport security)
- [CVE-2023-33183](https://cve.now/CVE-2023-33183.md): Error in calendar when booking an appointment reveals the full path of the website (CVSS 2.6, nextcloud security-advisories)
- [CVE-2023-26130](https://cve.now/CVE-2023-26130.md): Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the cont (CVSS 7.5, yhirose/cpp-httplib)
- [CVE-2023-33182](https://cve.now/CVE-2023-33182.md): Nextcloud Contacts photos only sanitized if mime type is all lower case (CVSS 0.0, nextcloud security-advisories)
- [CVE-2023-33198](https://cve.now/CVE-2023-33198.md): Incorrectly Specified Chat Message Destinations in tgstation-server and DreamMaker API (CVSS 6.1, tgstation-server)
- [CVE-2023-33175](https://cve.now/CVE-2023-33175.md): ToUI allows user-specific variables to be shared between users (CVSS 9.1, mubarakalmehairbi ToUI · toui)
- [CVE-2023-32685](https://cve.now/CVE-2023-32685.md): Clipboard based cross-site scripting (blocked with default CSP) in Kanboard (CVSS 4.4, kanboard)
- [CVE-2023-32698](https://cve.now/CVE-2023-32698.md): nfpm vulnerable to Incorrect Default Permissions (CVSS 7.1, goreleaser nfpm · github.com/goreleaser/nfpm/v2 +1)
- [CVE-2023-32692](https://cve.now/CVE-2023-32692.md): Remote Code Execution Vulnerability in Validation Placeholders (CVSS 9.8, CodeIgniter4 · codeigniter4/framework)
- [CVE-2023-32691](https://cve.now/CVE-2023-32691.md): ginuerzh/gost vulnerable to Timing Attack (CVSS 5.9, ginuerzh gost · github.com/ginuerzh/gost)
- [CVE-2022-36243](https://cve.now/CVE-2022-36243.md): Directory Traversal on Shop Beat Services (CVSS 5.3, Shop Beat studio)
- [CVE-2022-36244](https://cve.now/CVE-2022-36244.md): Multiple Stored Cross-Site Scripting Vulnerabilities on Shop Beat Services (CVSS 5.4, Shop Beat studio)
- [CVE-2022-36246](https://cve.now/CVE-2022-36246.md): Shop Beat Services Vulnerable To Insecure Permissions (CVSS 9.8, Shop Beat studio)
- [CVE-2022-36247](https://cve.now/CVE-2022-36247.md): Shop Beat Services Vulnerable To IDOR (CVSS 9.1, Shop Beat studio)
- [CVE-2022-36249](https://cve.now/CVE-2022-36249.md): Shop Beat Services Vulnerable To Bypass 2FA via APIs (CVSS 5.4, Shop Beat studio)
- [CVE-2022-36250](https://cve.now/CVE-2022-36250.md): Cross Site Request Forgery on Shop Beat Services (CVSS 8.8, Shop Beat studio)
- [CVE-2022-39071](https://cve.now/CVE-2022-39071.md): There is an unauthorized access vulnerability in some ZTE mobile phones. (CVSS 7.1, ZTE Blade A52, ZTE Blade A51, ZTE Blade A3 Lite, ZTE Blade…)
- [CVE-2022-39074](https://cve.now/CVE-2022-39074.md): There is an unauthorized access vulnerability in some ZTE mobile phones. (CVSS 3.3, ZTE Blade A52, ZTE Blade A51, ZTE Blade A3 Lite, ZTE Blade…)
- [CVE-2022-39075](https://cve.now/CVE-2022-39075.md): There is an unauthorized access vulnerability in some ZTE mobile phones. (CVSS 7.1, ZTE Blade A52, ZTE Blade A51, ZTE Blade A3 Lite, ZTE Blade…)
- [CVE-2022-47028](https://cve.now/CVE-2022-47028.md): An issue discovered in Action Launcher for Android v50.5 allows an attacker to cause a denial of service via arbitary data injection to func (CVSS 5.5)
- [CVE-2022-47029](https://cve.now/CVE-2022-47029.md): An issue was found in Action Launcher v50.5 allows an attacker to escalate privilege via modification of the intent string to function updat (CVSS 7.8)
- [CVE-2022-47525](https://cve.now/CVE-2022-47525.md): Fox-IT DataDiode (aka Fox DataDiode) 3.4.3 suffers from a Divide-by-Zero vulnerability in the packet parser. (CVSS 7.5)
- [CVE-2022-47526](https://cve.now/CVE-2022-47526.md): Fox-IT DataDiode (aka Fox DataDiode) 3.4.3 suffers from a path traversal vulnerability with resultant arbitrary writing of files. (CVSS 9.8)
- [CVE-2023-0779](https://cve.now/CVE-2023-0779.md): net: shell: Improper input validation (CVSS 6.7, zephyrproject-rtos zephyr)
- [CVE-2023-23561](https://cve.now/CVE-2023-23561.md): Stormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control: authenticated users can read sensitive information. (CVSS 5.5)
- [CVE-2023-23956](https://cve.now/CVE-2023-23956.md): A user can supply malicious HTML and JavaScript code that will be executed in the client browser (CVSS 6.1, Symantec SiteMinder WebAgent)
- [CVE-2023-27988](https://cve.now/CVE-2023-27988.md): The post-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.13)C0 could allow an authe (CVSS 7.2, Zyxel NAS326 firmware)
- [CVE-2023-28344](https://cve.now/CVE-2023-28344.md): An issue was discovered in Faronics Insight 10.0.19045 on Windows. (CVSS 7.1)
- [CVE-2023-28345](https://cve.now/CVE-2023-28345.md): An issue was discovered in Faronics Insight 10.0.19045 on Windows. (CVSS 4.6)
- [CVE-2023-28346](https://cve.now/CVE-2023-28346.md): An issue was discovered in Faronics Insight 10.0.19045 on Windows. (CVSS 7.3)
- [CVE-2023-28347](https://cve.now/CVE-2023-28347.md): An issue was discovered in Faronics Insight 10.0.19045 on Windows. (CVSS 9.6)
- [CVE-2023-28348](https://cve.now/CVE-2023-28348.md): An issue was discovered in Faronics Insight 10.0.19045 on Windows. (CVSS 7.4)
- [CVE-2023-28349](https://cve.now/CVE-2023-28349.md): An issue was discovered in Faronics Insight 10.0.19045 on Windows. (CVSS 8.8)
- [CVE-2023-28350](https://cve.now/CVE-2023-28350.md): An issue was discovered in Faronics Insight 10.0.19045 on Windows. (CVSS 6.1)
- [CVE-2023-28351](https://cve.now/CVE-2023-28351.md): An issue was discovered in Faronics Insight 10.0.19045 on Windows. (CVSS 3.3)
- [CVE-2023-28352](https://cve.now/CVE-2023-28352.md): An issue was discovered in Faronics Insight 10.0.19045 on Windows. (CVSS 7.4)
- [CVE-2023-28353](https://cve.now/CVE-2023-28353.md): An issue was discovered in Faronics Insight 10.0.19045 on Windows. (CVSS 8.8)
- [CVE-2023-2952](https://cve.now/CVE-2023-2952.md): XRA dissector infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture (CVSS 5.3, Wireshark Foundation Wireshark)
- [CVE-2023-2953](https://cve.now/CVE-2023-2953.md): A vulnerability was found in openldap. (CVSS 7.5, openldap)
- [CVE-2023-2972](https://cve.now/CVE-2023-2972.md): Prototype Pollution in antfu/utils (CVSS 5.4, antfu/utils · @antfu/utils)
- [CVE-2023-29726](https://cve.now/CVE-2023-29726.md): The Call Blocker application 6.6.3 for Android incorrectly opens a key component that an attacker can use to inject large amounts of dirty d (CVSS 7.5)
- [CVE-2023-29727](https://cve.now/CVE-2023-29727.md): The Call Blocker application 6.6.3 for Android allows unauthorized applications to use exposed components to delete data stored in its datab (CVSS 9.8)
- [CVE-2023-29728](https://cve.now/CVE-2023-29728.md): The Call Blocker application 6.6.3 for Android allows attackers to tamper with feature-related data, resulting in a severe elevation of priv (CVSS 9.8)
- [CVE-2023-29731](https://cve.now/CVE-2023-29731.md): SoLive 1.6.14 thru 1.6.20 for Android has an exposed component that provides a method to modify the SharedPreference file. (CVSS 7.5)
- [CVE-2023-29732](https://cve.now/CVE-2023-29732.md): SoLive 1.6.14 thru 1.6.20 for Android exists exposed component, the component provides the method to modify the SharedPreference file. (CVSS 9.8)
- [CVE-2023-29733](https://cve.now/CVE-2023-29733.md): The Lock Master app 2.2.4 for Android allows unauthorized apps to modify the values in its SharedPreference files. (no CVSS)
- [CVE-2023-29734](https://cve.now/CVE-2023-29734.md): An issue found in edjing Mix v.7.09.01 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the dat (no CVSS)
- [CVE-2023-29735](https://cve.now/CVE-2023-29735.md): An issue found in edjing Mix v.7.09.01 for Android allows a local attacker to cause a denial of service via the database files. (no CVSS)
- [CVE-2023-29737](https://cve.now/CVE-2023-29737.md): An issue found in Wave Animated Keyboard Emoji v.1.70.7 for Android allows a local attacker to cause a denial of service via the database fi (no CVSS)
- [CVE-2023-29738](https://cve.now/CVE-2023-29738.md): An issue found in Wave Animated Keyboard Emoji v.1.70.7 for Android allows a local attacker to cause code execution and escalation of Privil (CVSS 7.8)
- [CVE-2023-29739](https://cve.now/CVE-2023-29739.md): An issue found in Alarm Clock for Heavy Sleepers v.5.3.2 for Android allows unauthorized apps to cause escalation of privilege attacks by ma (CVSS 9.8)
- [CVE-2023-29740](https://cve.now/CVE-2023-29740.md): An issue found in Alarm Clock for Heavy Sleepers v.5.3.2 for Android allows unauthorized apps to cause a denial of service attack by manipul (CVSS 7.5)
- [CVE-2023-29741](https://cve.now/CVE-2023-29741.md): An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause an escalation of privileges attack by manipulating the d (CVSS 9.8)
- [CVE-2023-29742](https://cve.now/CVE-2023-29742.md): An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a code execution attack by manipulating the database. (CVSS 7.8)
- [CVE-2023-29743](https://cve.now/CVE-2023-29743.md): An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service attack by manipulating th (CVSS 7.5)
- [CVE-2023-29745](https://cve.now/CVE-2023-29745.md): An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service attack by manipulating th (CVSS 7.1)
- [CVE-2023-2983](https://cve.now/CVE-2023-2983.md): Privilege Defined With Unsafe Actions in pimcore/pimcore (CVSS 6.5, pimcore/pimcore)
- [CVE-2023-2984](https://cve.now/CVE-2023-2984.md): Path Traversal: '\\..\\filename' in pimcore/pimcore (CVSS 6.3, pimcore/pimcore)
- [CVE-2023-30196](https://cve.now/CVE-2023-30196.md): Prestashop salesbooster \<= 1.10.4 is vulnerable to Incorrect Access Control via modules/salesbooster/downloads/download.php. (CVSS 7.5)
- [CVE-2023-31184](https://cve.now/CVE-2023-31184.md): ROZCOM client (CVSS 6.2, ROZCOM client)
- [CVE-2023-31185](https://cve.now/CVE-2023-31185.md): ROZCOM server framework (CVSS 7.5, ROZCOM server framework)
- [CVE-2023-31186](https://cve.now/CVE-2023-31186.md): Avaya IX Workforce Engagement - User Enumeration - CWE-204: Observable Response Discrepancy (CVSS 5.3, Avaya IX Workforce Engagement)
- [CVE-2023-31187](https://cve.now/CVE-2023-31187.md): Avaya IX Workforce Engagement - CWE-522: Insufficiently Protected Credentials (CVSS 6.5, Avaya IX Workforce Engagement)
- [CVE-2023-32218](https://cve.now/CVE-2023-32218.md): Avaya IX Workforce Engagement - CWE-601: URL Redirection to Untrusted Site ('Open Redirect') (CVSS 6.1, Avaya IX Workforce Engagement)
- [CVE-2023-33245](https://cve.now/CVE-2023-33245.md): Minecraft through 1.19 and 1.20 pre-releases before 7 (Java) allow arbitrary file overwrite, and possibly code execution, via crafted world (CVSS 8.8)
- [CVE-2023-33656](https://cve.now/CVE-2023-33656.md): A memory leak vulnerability exists in NanoMQ 0.17.2. (CVSS 5.5)
- [CVE-2023-33734](https://cve.now/CVE-2023-33734.md): BlueCMS v1.6 was discovered to contain a SQL injection vulnerability via the keywords parameter at search.php. (CVSS 9.8)
- [CVE-2023-33740](https://cve.now/CVE-2023-33740.md): Incorrect access control in luowice v3.5.18 allows attackers to access cloud source code information via modification fo the Verify paramete (CVSS 7.5)
- [CVE-2023-33741](https://cve.now/CVE-2023-33741.md): Macrovideo v380pro v1.4.97 shares the device id and password when sharing the device. (CVSS 7.5)
- [CVE-2023-34151](https://cve.now/CVE-2023-34151.md): A vulnerability was found in ImageMagick. (no CVSS, ImageMagick)
- [CVE-2023-34152](https://cve.now/CVE-2023-34152.md): A vulnerability was found in ImageMagick. (CVSS 9.8, ImageMagick)
- [CVE-2023-34153](https://cve.now/CVE-2023-34153.md): A vulnerability was found in ImageMagick. (CVSS 7.8, ImageMagick)
- [CVE-2023-34204](https://cve.now/CVE-2023-34204.md): imapsync through 2.229 uses predictable paths under /tmp and /var/tmp in its default mode of operation. (CVSS 6.5)
- [CVE-2023-34205](https://cve.now/CVE-2023-34205.md): In Moov signedxml through 1.0.0, parsing the raw XML (as received) can result in different output than parsing the canonicalized XML. (CVSS 9.1, github.com/moov-io/signedxml)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-05-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.