CVEs published May 31, 2023
116 CVEs were published on May 31, 2023: 14 critical, 51 high.
- Published
- 116
- Critical
- 14
- High
- 51
- Medium
- 42
- Low
- 8
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 42
Most affected products
- Microsoft Windows
- 16
- JetBrains TeamCity
- 12
- featherplugins Custom Login Page | Temporary Users | Rebran…
- 3
- gpac/gpac
- 2
- IBM QRadar WinCollect Agent
- 2
- mkucej/i-librarian-free
- 2
- ningzichun Student Management System
- 2
- SourceCodester Lost and Found Information System
- 2
- thorsten/phpmyfaq
- 2
- timhodson Blog-in-Blog
- 2
Critical 14
- CVE-2022-35744Windows Point-to-Point Protocol (PPP) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-34218In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possibleJetBrains TeamCity
- CVE-2023-2987Wordapp <= 1.6.0 - Authorization Bypass through Use of Insufficiently Unique Cryptographic SignatureWordapp
- CVE-2021-45039Multiple models of the Uniview IP Camera (e.g., IPC_G6103 B6103.16.10.B25.201218, IPC_G61, IPC21, IPC23, IPC32, IPC36, IPC62, and IPC_HCMN)
- CVE-2023-29747Story Saver for Instragram - Video Downloader 1.0.6 for Android exists exposed component, the component provides the method to modify the Sh
- CVE-2023-3020Cross-site Scripting (XSS) - Reflected in mkucej/i-librarian-freemkucej/i-librarian-free
- CVE-2023-32217SailPoint IdentityIQ Unsafe use of Reflection VulnerabilitySailPoint IdentityIQ
- CVE-2023-33486TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setOpModeCfg.
- CVE-2023-33487TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contains a command insertion vulnerability in setDiagnosisCfg.This vulnera
- CVE-2023-33508KramerAV VIA GO² < 4.0.1.1326 is vulnerable to unauthenticated file upload resulting in Remote Code Execution (RCE).
- CVE-2023-33509KramerAV VIA GO² < 4.0.1.1326 is vulnerable to SQL Injection.
- CVE-2023-33730Privilege Escalation in the "GetUserCurrentPwd" function in Microworld Technologies eScan Management Console 14.0.1400.2281 allows any remot
- CVE-2023-33735D-Link DIR-846 v1.00A52 was discovered to contain a remote command execution (RCE) vulnerability via the tomography_ping_address parameter i
- CVE-2023-34257An issue was discovered in BMC Patrol through 23.1.00.
High 51
- CVE-2023-26278IBM QRadar WinCollect Agent privilege escalationIBM QRadar WinCollect Agent
- CVE-2023-26277IBM QRadar WinCollect Agent privilege escalationIBM QRadar WinCollect Agent
- CVE-2023-34088Collabora Online has Stored Cross-Site-Scripting vulnerability in admin interfaceCollaboraOnline online
- CVE-2022-35757Windows Cloud Files Mini Filter Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-35756Windows Kerberos Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-35755Windows Print Spooler Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-35753Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-35752Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-35751Windows Hyper-V Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-35750Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-35749Windows Digital Media Receiver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-35748HTTP.sys Denial of Service VulnerabilityMicrosoft Windows Server
- CVE-2022-35746Windows Digital Media Receiver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-35745Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-35743Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-33967EaseProbe vulnerable to SQL injection when using MySQL/PostgreSQL data checkingmegaease easeprobe · github.com/megaease/easeprobe
- CVE-2023-33966Deno missing "--allow-net" permission check for built-in Node modulesdenoland deno · deno +1
- CVE-2023-33964mx-chain-go does not treat invalid transaction with wrong username correctlymultiversx mx-chain-go · github.com/multiversx/mx-chain-go
- CVE-2023-3008ningzichun Student Management System login.php sql injectionningzichun Student Management System
- CVE-2023-2909A Directory traversal vulnerability was found on EZ Sync service of ADMASUSTOR ADM
- CVE-2023-2749A Gain Information vulnerability was found on Download Center.ASUSTOR Download Center
- CVE-2023-25539 Dell NetWorker 19.6.1.2, contains an OS command injection Vulnerability in the NetWorker client.Dell NetWorker NVE
- CVE-2023-2435Blog-in-Blog <= 2.0.0 - Authenticated (Editor+) Local File Inclusion via Shortcodetimhodson Blog-in-Blog
- CVE-2023-2545The Feather Login Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getListOffeatherplugins Custom Login Page | Temporary Users | Rebran…
- CVE-2023-2549The Feather Login Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions starting from 1.0.7 up to, and includingfeatherplugins Custom Login Page | Temporary Users | Rebran…
- CVE-2021-31233SQL Injection vulnerability found in Fighting Cock Information System v.1.0 allows a remote attacker to obtain sensitive information via the
- CVE-2023-3009Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampassnilsteampassnet/teampass
- CVE-2023-30197Incorrect Access Control in the module "My inventory" (myinventory) <= 1.6.6 from Webbax for PrestaShop, allows a guest to download personal
- CVE-2023-30285An issue in Deviniti Issue Sync Synchronization v3.5.2 for Jira allows attackers to obtain the login credentials of a user via a crafted req
- CVE-2023-33485TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contains a post-authentication buffer overflow via parameter sPort/ePort i
- CVE-2023-33507KramerAV VIA GO² < 4.0.1.1326 is vulnerable to Unauthenticated arbitrary file read.
- CVE-2023-33627H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the UpdateSnat interface at /goform/aspForm.
- CVE-2023-33628H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the DelvsList interface at /goform/aspForm.
- CVE-2023-33629H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the DeltriggerList interface at /goform/aspForm.
- CVE-2023-33630H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the EditvsList interface at /goform/aspForm.
- CVE-2023-33631H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the DelSTList interface at /goform/aspForm.
- CVE-2023-33632H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the ipqos_lanip_dellist interface at /goform/aspFor
- CVE-2023-33633H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the UpdateWanParams interface at /goform/aspForm.
- CVE-2023-33634H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the EdittriggerList interface at /goform/aspForm.
- CVE-2023-33635H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the UpdateMacClone interface at /goform/aspForm.
- CVE-2023-33636H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the ipqos_lanip_editlist interface at /goform/aspFo
- CVE-2023-33637H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the DelDNSHnList interface at /goform/aspForm.
- CVE-2023-33638H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the Edit_BasicSSID_5G interface at /goform/aspForm.
- CVE-2023-33639H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the SetMobileAPInfoById interface at /goform/aspFor
- CVE-2023-33640H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the SetAPWifiorLedInfoById interface at /goform/asp
- CVE-2023-33641H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the AddMacList interface at /goform/aspForm.
- CVE-2023-33642H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the Edit_BasicSSID interface at /goform/aspForm.
- CVE-2023-33643H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the AddWlanMacList interface at /goform/aspForm.
- CVE-2023-33718mp4v2 v2.1.3 was discovered to contain a memory leak via MP4File::ReadString() at mp4file_io.cpp
- CVE-2023-33722EDIMAX BR-6288ACL v1.12 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the pppUserName parameter.
- CVE-2023-34258An issue was discovered in BMC Patrol before 22.1.00.
Medium, low and unrated 51
- CVE-2015-10108meitar Inline Google Spreadsheet Viewer Plugin inline-gdocs-viewer.php displayShortcode cross-site request forgerymeitar Inline Google Spreadsheet Viewer Plugin
- CVE-2022-35759Windows Local Security Authority (LSA) Denial of Service VulnerabilityMicrosoft Windows
- CVE-2022-35758Windows Kernel Memory Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2022-35754Unified Write Filter Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-35747Windows Point-to-Point Protocol (PPP) Denial of Service VulnerabilityMicrosoft Windows
- CVE-2023-33979gpt_academic's Configuration File vulnerable to File Information Disclosurebinary-husky gpt_academic
- CVE-2023-33971Formcreator vulnerable to stored XSS from ##FULLFORM##pluginsGLPI formcreator
- CVE-2023-3018SourceCodester Lost and Found Information System access controlSourceCodester Lost and Found Information System
- CVE-2023-3017SourceCodester Lost and Found Information System Manage User Page cross site scriptingSourceCodester Lost and Found Information System
- CVE-2023-2758Contec CONPROSYS HMI System (CHS) v3.5.2 Denial of ServiceContec CONPROSYS HMI System
- CVE-2023-3016yiwent Vip Video Analysis admincore.php cross site scriptingyiwent Vip Video Analysis
- CVE-2023-3015yiwent Vip Video Analysis title.php server-side request forgeryyiwent Vip Video Analysis
- CVE-2023-3014BeipyVideoResolution admincore.php cross site scriptingBeipyVideoResolution
- CVE-2023-34229In JetBrains TeamCity before 2023.05 stored XSS in GitLab Connection page was possibleJetBrains TeamCity
- CVE-2023-34228In JetBrains TeamCity before 2023.05 authentication checks were missing – 2FA was not checked for some sensitive account actionsJetBrains TeamCity
- CVE-2023-34227In JetBrains TeamCity before 2023.05 a specific endpoint was vulnerable to brute force attacksJetBrains TeamCity
- CVE-2023-34226In JetBrains TeamCity before 2023.05 reflected XSS in the Subscriptions page was possibleJetBrains TeamCity
- CVE-2023-34225In JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possibleJetBrains TeamCity
- CVE-2023-34224In JetBrains TeamCity before 2023.05 open redirect during oAuth configuration was possibleJetBrains TeamCity
- CVE-2023-34223In JetBrains TeamCity before 2023.05 parameters of the "password" type from build dependencies could be logged in some casesJetBrains TeamCity
- CVE-2023-34222In JetBrains TeamCity before 2023.05 possible XSS in the Plugin Vendor URL was possibleJetBrains TeamCity
- CVE-2023-34221In JetBrains TeamCity before 2023.05 stored XSS in the Show Connection page was possibleJetBrains TeamCity
- CVE-2023-34220In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possibleJetBrains TeamCity
- CVE-2023-34219In JetBrains TeamCity before 2023.05 improper permission checks allowed users without appropriate permissions to edit Build Configuration seJetBrains TeamCity
- CVE-2023-3007ningzichun Student Management System Password Reset resetPassword.php password recoveryningzichun Student Management System
- CVE-2023-3005SourceCodester Local Service Search Engine Management System POST Parameter cross site scriptingSourceCodester Local Service Search Engine Management System
- CVE-2023-3004SourceCodester Simple Chat System POST Parameter sql injectionSourceCodester Simple Chat System
- CVE-2023-3003SourceCodester Train Station Ticketing System GET Parameter manage_prices.php sql injectionSourceCodester Train Station Ticketing System
- CVE-2023-26131All versions of the package github.com/xyproto/algernon/engine; all versions of the package github.com/xyproto/algernon/themes are vulnerablgithub.com/xyproto/algernon/engine · github.com/xyproto/… +1
- CVE-2023-2304Favorites <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodekylephillips Favorites
- CVE-2023-2836CRM Perks Forms <= 1.1.1 - Authenticated (Admin+) Stored Cross-Site Scriptingcrmperks CRM Perks Forms – WordPress Form Builder
- CVE-2023-2434Nested Pages <= 3.2.3 - Missing Authorization to Authenticated (Editor+) Plugin Settings Resetkylephillips Nested Pages
- CVE-2023-1661Display post meta, term meta, comment meta, and user meta <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingtrasweb Display post meta, term meta, comment meta, and use…
- CVE-2015-10107Simplr Registration Form Plus+ Plugin cross site scriptingSimplr Registration Form Plus+ Plugin
- CVE-2014-125103BestWebSoft Twitter Plugin twitter.php twttr_settings_page cross site scriptingBestWebSoft Twitter Plugin
- CVE-2023-2547The Feather Login Page plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'deleteUser'featherplugins Custom Login Page | Temporary Users | Rebran…
- CVE-2023-2436Blog-in-Blog <= 2.0.0 - Authenticated (Editor+) Stored Cross-Site Scripting via Shortcodetimhodson Blog-in-Blog
- CVE-2022-48502An issue was discovered in the Linux kernel before 6.2.
- CVE-2023-23562Stormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control that allows an authenticated user can update global parameter
- CVE-2023-26842A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the
- CVE-2023-2998Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaqthorsten/phpmyfaq
- CVE-2023-2999Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaqthorsten/phpmyfaq
- CVE-2023-3006A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes actual again for the new hw AmpereOKernel
- CVE-2023-3012NULL Pointer Dereference in gpac/gpacgpac/gpac
- CVE-2023-3013Unchecked Return Value in gpac/gpacgpac/gpac
- CVE-2023-3021Cross-site Scripting (XSS) - Stored in mkucej/i-librarian-freemkucej/i-librarian-free
- CVE-2023-31548A stored Cross-site scripting (XSS) vulnerability in the FundRaiserEditor.php component of ChurchCRM v4.5.3 allows attackers to execute arbi
- CVE-2023-33287A stored cross-site scripting (XSS) vulnerability in the Inline Table Editing application before 3.8.0 for Confluence allows attackers to st
- CVE-2023-33732Cross Site Scripting (XSS) in the New Policy form in Microworld Technologies eScan management console 14.0.1400.2281 allows a remote attacke
- CVE-2023-33736A stored cross-site scripting (XSS) vulnerability in Dcat-Admin v2.1.3-beta allows attackers to execute arbitrary web scripts or HTML via a dcat/laravel-admin
- CVE-2023-34256An issue was discovered in the Linux kernel before 6.3.3.