# CVEs published 2023-05-31

116 CVEs were published on May 31, 2023: 14 critical, 51 high. Days are UTC.

- [CVE-2023-26278](https://cve.now/CVE-2023-26278.md): IBM QRadar WinCollect Agent privilege escalation (CVSS 8.2, IBM QRadar WinCollect Agent)
- [CVE-2015-10108](https://cve.now/CVE-2015-10108.md): meitar Inline Google Spreadsheet Viewer Plugin inline-gdocs-viewer.php displayShortcode cross-site request forgery (CVSS 4.3, meitar Inline Google Spreadsheet Viewer Plugin)
- [CVE-2023-26277](https://cve.now/CVE-2023-26277.md): IBM QRadar WinCollect Agent privilege escalation (CVSS 7.8, IBM QRadar WinCollect Agent)
- [CVE-2023-34088](https://cve.now/CVE-2023-34088.md): Collabora Online has Stored Cross-Site-Scripting vulnerability in admin interface (CVSS 8.7, CollaboraOnline online)
- [CVE-2022-35759](https://cve.now/CVE-2022-35759.md): Windows Local Security Authority (LSA) Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2022-35758](https://cve.now/CVE-2022-35758.md): Windows Kernel Memory Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2022-35757](https://cve.now/CVE-2022-35757.md): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2022-35756](https://cve.now/CVE-2022-35756.md): Windows Kerberos Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-35755](https://cve.now/CVE-2022-35755.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2022-35754](https://cve.now/CVE-2022-35754.md): Unified Write Filter Elevation of Privilege Vulnerability (CVSS 6.7, Microsoft Windows)
- [CVE-2022-35753](https://cve.now/CVE-2022-35753.md): Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2022-35752](https://cve.now/CVE-2022-35752.md): Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2022-35751](https://cve.now/CVE-2022-35751.md): Windows Hyper-V Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-35750](https://cve.now/CVE-2022-35750.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-35749](https://cve.now/CVE-2022-35749.md): Windows Digital Media Receiver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-35748](https://cve.now/CVE-2022-35748.md): HTTP.sys Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows Server)
- [CVE-2022-35747](https://cve.now/CVE-2022-35747.md): Windows Point-to-Point Protocol (PPP) Denial of Service Vulnerability (CVSS 5.9, Microsoft Windows)
- [CVE-2022-35746](https://cve.now/CVE-2022-35746.md): Windows Digital Media Receiver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-35745](https://cve.now/CVE-2022-35745.md): Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2022-35744](https://cve.now/CVE-2022-35744.md): Windows Point-to-Point Protocol (PPP) Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows)
- [CVE-2022-35743](https://cve.now/CVE-2022-35743.md): Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-33979](https://cve.now/CVE-2023-33979.md): gpt\_academic's Configuration File vulnerable to File Information Disclosure (CVSS 6.5, binary-husky gpt\_academic)
- [CVE-2023-33971](https://cve.now/CVE-2023-33971.md): Formcreator vulnerable to stored XSS from ##FULLFORM## (CVSS 6.1, pluginsGLPI formcreator)
- [CVE-2023-33967](https://cve.now/CVE-2023-33967.md): EaseProbe vulnerable to SQL injection when using MySQL/PostgreSQL data checking (CVSS 8.3, megaease easeprobe · github.com/megaease/easeprobe)
- [CVE-2023-33966](https://cve.now/CVE-2023-33966.md): Deno missing "--allow-net" permission check for built-in Node modules (CVSS 8.6, denoland deno · deno +1)
- [CVE-2023-33964](https://cve.now/CVE-2023-33964.md): mx-chain-go does not treat invalid transaction with wrong username correctly (CVSS 8.6, multiversx mx-chain-go · github.com/multiversx/mx-chain-go)
- [CVE-2023-3018](https://cve.now/CVE-2023-3018.md): SourceCodester Lost and Found Information System access control (CVSS 6.3, SourceCodester Lost and Found Information System)
- [CVE-2023-3017](https://cve.now/CVE-2023-3017.md): SourceCodester Lost and Found Information System Manage User Page cross site scripting (CVSS 2.4, SourceCodester Lost and Found Information System)
- [CVE-2023-2758](https://cve.now/CVE-2023-2758.md): Contec CONPROSYS HMI System (CHS) v3.5.2 Denial of Service (CVSS 3.7, Contec CONPROSYS HMI System)
- [CVE-2023-3016](https://cve.now/CVE-2023-3016.md): yiwent Vip Video Analysis admincore.php cross site scripting (CVSS 3.5, yiwent Vip Video Analysis)
- [CVE-2023-3015](https://cve.now/CVE-2023-3015.md): yiwent Vip Video Analysis title.php server-side request forgery (CVSS 6.3, yiwent Vip Video Analysis)
- [CVE-2023-3014](https://cve.now/CVE-2023-3014.md): BeipyVideoResolution admincore.php cross site scripting (CVSS 3.5, BeipyVideoResolution)
- [CVE-2023-34229](https://cve.now/CVE-2023-34229.md): In JetBrains TeamCity before 2023.05 stored XSS in GitLab Connection page was possible (CVSS 4.6, JetBrains TeamCity)
- [CVE-2023-34228](https://cve.now/CVE-2023-34228.md): In JetBrains TeamCity before 2023.05 authentication checks were missing – 2FA was not checked for some sensitive account actions (CVSS 5.3, JetBrains TeamCity)
- [CVE-2023-34227](https://cve.now/CVE-2023-34227.md): In JetBrains TeamCity before 2023.05 a specific endpoint was vulnerable to brute force attacks (CVSS 5.3, JetBrains TeamCity)
- [CVE-2023-34226](https://cve.now/CVE-2023-34226.md): In JetBrains TeamCity before 2023.05 reflected XSS in the Subscriptions page was possible (CVSS 4.6, JetBrains TeamCity)
- [CVE-2023-34225](https://cve.now/CVE-2023-34225.md): In JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possible (CVSS 4.6, JetBrains TeamCity)
- [CVE-2023-34224](https://cve.now/CVE-2023-34224.md): In JetBrains TeamCity before 2023.05 open redirect during oAuth configuration was possible (CVSS 4.8, JetBrains TeamCity)
- [CVE-2023-34223](https://cve.now/CVE-2023-34223.md): In JetBrains TeamCity before 2023.05 parameters of the "password" type from build dependencies could be logged in some cases (CVSS 4.3, JetBrains TeamCity)
- [CVE-2023-34222](https://cve.now/CVE-2023-34222.md): In JetBrains TeamCity before 2023.05 possible XSS in the Plugin Vendor URL was possible (CVSS 4.6, JetBrains TeamCity)
- [CVE-2023-34221](https://cve.now/CVE-2023-34221.md): In JetBrains TeamCity before 2023.05 stored XSS in the Show Connection page was possible (CVSS 4.6, JetBrains TeamCity)
- [CVE-2023-34220](https://cve.now/CVE-2023-34220.md): In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possible (CVSS 4.6, JetBrains TeamCity)
- [CVE-2023-34219](https://cve.now/CVE-2023-34219.md): In JetBrains TeamCity before 2023.05 improper permission checks allowed users without appropriate permissions to edit Build Configuration se (CVSS 4.3, JetBrains TeamCity)
- [CVE-2023-34218](https://cve.now/CVE-2023-34218.md): In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible (CVSS 9.1, JetBrains TeamCity)
- [CVE-2023-3008](https://cve.now/CVE-2023-3008.md): ningzichun Student Management System login.php sql injection (CVSS 7.3, ningzichun Student Management System)
- [CVE-2023-3007](https://cve.now/CVE-2023-3007.md): ningzichun Student Management System Password Reset resetPassword.php password recovery (CVSS 6.5, ningzichun Student Management System)
- [CVE-2023-2909](https://cve.now/CVE-2023-2909.md): A Directory traversal vulnerability was found on EZ Sync service of ADM (CVSS 8.5, ASUSTOR ADM)
- [CVE-2023-3005](https://cve.now/CVE-2023-3005.md): SourceCodester Local Service Search Engine Management System POST Parameter cross site scripting (CVSS 3.5, SourceCodester Local Service Search Engine Management System)
- [CVE-2023-3004](https://cve.now/CVE-2023-3004.md): SourceCodester Simple Chat System POST Parameter sql injection (CVSS 6.3, SourceCodester Simple Chat System)
- [CVE-2023-2749](https://cve.now/CVE-2023-2749.md): A Gain Information vulnerability was found on Download Center. (CVSS 8.6, ASUSTOR Download Center)
- [CVE-2023-3003](https://cve.now/CVE-2023-3003.md): SourceCodester Train Station Ticketing System GET Parameter manage\_prices.php sql injection (CVSS 6.3, SourceCodester Train Station Ticketing System)
- [CVE-2023-26131](https://cve.now/CVE-2023-26131.md): All versions of the package github.com/xyproto/algernon/engine; all versions of the package github.com/xyproto/algernon/themes are vulnerabl (CVSS 5.4, github.com/xyproto/algernon/engine · github.com/xyproto/… +1)
- [CVE-2023-25539](https://cve.now/CVE-2023-25539.md): Dell NetWorker 19.6.1.2, contains an OS command injection Vulnerability in the NetWorker client. (CVSS 8.4, Dell NetWorker NVE)
- [CVE-2023-2304](https://cve.now/CVE-2023-2304.md): Favorites \<= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, kylephillips Favorites)
- [CVE-2023-2836](https://cve.now/CVE-2023-2836.md): CRM Perks Forms \<= 1.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, crmperks CRM Perks Forms – WordPress Form Builder)
- [CVE-2023-2434](https://cve.now/CVE-2023-2434.md): Nested Pages \<= 3.2.3 - Missing Authorization to Authenticated (Editor+) Plugin Settings Reset (CVSS 3.8, kylephillips Nested Pages)
- [CVE-2023-1661](https://cve.now/CVE-2023-1661.md): Display post meta, term meta, comment meta, and user meta \<= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, trasweb Display post meta, term meta, comment meta, and use…)
- [CVE-2015-10107](https://cve.now/CVE-2015-10107.md): Simplr Registration Form Plus+ Plugin cross site scripting (CVSS 3.5, Simplr Registration Form Plus+ Plugin)
- [CVE-2014-125103](https://cve.now/CVE-2014-125103.md): BestWebSoft Twitter Plugin twitter.php twttr\_settings\_page cross site scripting (CVSS 2.4, BestWebSoft Twitter Plugin)
- [CVE-2023-2435](https://cve.now/CVE-2023-2435.md): Blog-in-Blog \<= 2.0.0 - Authenticated (Editor+) Local File Inclusion via Shortcode (CVSS 7.2, timhodson Blog-in-Blog)
- [CVE-2023-2545](https://cve.now/CVE-2023-2545.md): The Feather Login Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getListOf (CVSS 8.1, featherplugins Custom Login Page | Temporary Users | Rebran…)
- [CVE-2023-2987](https://cve.now/CVE-2023-2987.md): Wordapp \<= 1.6.0 - Authorization Bypass through Use of Insufficiently Unique Cryptographic Signature (CVSS 9.8, Wordapp)
- [CVE-2023-2547](https://cve.now/CVE-2023-2547.md): The Feather Login Page plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'deleteUser' (CVSS 5.4, featherplugins Custom Login Page | Temporary Users | Rebran…)
- [CVE-2023-2436](https://cve.now/CVE-2023-2436.md): Blog-in-Blog \<= 2.0.0 - Authenticated (Editor+) Stored Cross-Site Scripting via Shortcode (CVSS 4.4, timhodson Blog-in-Blog)
- [CVE-2023-2549](https://cve.now/CVE-2023-2549.md): The Feather Login Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions starting from 1.0.7 up to, and including (CVSS 8.8, featherplugins Custom Login Page | Temporary Users | Rebran…)
- [CVE-2021-31233](https://cve.now/CVE-2021-31233.md): SQL Injection vulnerability found in Fighting Cock Information System v.1.0 allows a remote attacker to obtain sensitive information via the (CVSS 7.5)
- [CVE-2021-45039](https://cve.now/CVE-2021-45039.md): Multiple models of the Uniview IP Camera (e.g., IPC\_G6103 B6103.16.10.B25.201218, IPC\_G61, IPC21, IPC23, IPC32, IPC36, IPC62, and IPC\_HCMN) (CVSS 9.8)
- [CVE-2022-48502](https://cve.now/CVE-2022-48502.md): An issue was discovered in the Linux kernel before 6.2. (no CVSS)
- [CVE-2023-23562](https://cve.now/CVE-2023-23562.md): Stormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control that allows an authenticated user can update global parameter (CVSS 4.3)
- [CVE-2023-26842](https://cve.now/CVE-2023-26842.md): A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the (CVSS 5.4)
- [CVE-2023-29747](https://cve.now/CVE-2023-29747.md): Story Saver for Instragram - Video Downloader 1.0.6 for Android exists exposed component, the component provides the method to modify the Sh (CVSS 9.8)
- [CVE-2023-2998](https://cve.now/CVE-2023-2998.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 6.0, thorsten/phpmyfaq)
- [CVE-2023-2999](https://cve.now/CVE-2023-2999.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 6.7, thorsten/phpmyfaq)
- [CVE-2023-3006](https://cve.now/CVE-2023-3006.md): A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes actual again for the new hw AmpereO (CVSS 5.5, Kernel)
- [CVE-2023-3009](https://cve.now/CVE-2023-3009.md): Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass (CVSS 8.1, nilsteampassnet/teampass)
- [CVE-2023-3012](https://cve.now/CVE-2023-3012.md): NULL Pointer Dereference in gpac/gpac (CVSS 5.3, gpac/gpac)
- [CVE-2023-3013](https://cve.now/CVE-2023-3013.md): Unchecked Return Value in gpac/gpac (CVSS 4.4, gpac/gpac)
- [CVE-2023-30197](https://cve.now/CVE-2023-30197.md): Incorrect Access Control in the module "My inventory" (myinventory) \<= 1.6.6 from Webbax for PrestaShop, allows a guest to download personal (CVSS 7.5)
- [CVE-2023-3020](https://cve.now/CVE-2023-3020.md): Cross-site Scripting (XSS) - Reflected in mkucej/i-librarian-free (CVSS 9.0, mkucej/i-librarian-free)
- [CVE-2023-3021](https://cve.now/CVE-2023-3021.md): Cross-site Scripting (XSS) - Stored in mkucej/i-librarian-free (CVSS 4.1, mkucej/i-librarian-free)
- [CVE-2023-30285](https://cve.now/CVE-2023-30285.md): An issue in Deviniti Issue Sync Synchronization v3.5.2 for Jira allows attackers to obtain the login credentials of a user via a crafted req (CVSS 7.5)
- [CVE-2023-31548](https://cve.now/CVE-2023-31548.md): A stored Cross-site scripting (XSS) vulnerability in the FundRaiserEditor.php component of ChurchCRM v4.5.3 allows attackers to execute arbi (CVSS 5.4)
- [CVE-2023-32217](https://cve.now/CVE-2023-32217.md): SailPoint IdentityIQ Unsafe use of Reflection Vulnerability (CVSS 9.0, SailPoint IdentityIQ)
- [CVE-2023-33287](https://cve.now/CVE-2023-33287.md): A stored cross-site scripting (XSS) vulnerability in the Inline Table Editing application before 3.8.0 for Confluence allows attackers to st (CVSS 5.4)
- [CVE-2023-33485](https://cve.now/CVE-2023-33485.md): TOTOLINK X5000R V9.1.0u.6118\_B20201102 and V9.1.0u.6369\_B20230113 contains a post-authentication buffer overflow via parameter sPort/ePort i (CVSS 8.8)
- [CVE-2023-33486](https://cve.now/CVE-2023-33486.md): TOTOLINK X5000R V9.1.0u.6118\_B20201102 and V9.1.0u.6369\_B20230113 contain a command insertion vulnerability in setOpModeCfg. (CVSS 9.8)
- [CVE-2023-33487](https://cve.now/CVE-2023-33487.md): TOTOLINK X5000R V9.1.0u.6118\_B20201102 and V9.1.0u.6369\_B20230113 contains a command insertion vulnerability in setDiagnosisCfg.This vulnera (CVSS 9.8)
- [CVE-2023-33507](https://cve.now/CVE-2023-33507.md): KramerAV VIA GO² \< 4.0.1.1326 is vulnerable to Unauthenticated arbitrary file read. (CVSS 7.5)
- [CVE-2023-33508](https://cve.now/CVE-2023-33508.md): KramerAV VIA GO² \< 4.0.1.1326 is vulnerable to unauthenticated file upload resulting in Remote Code Execution (RCE). (CVSS 9.8)
- [CVE-2023-33509](https://cve.now/CVE-2023-33509.md): KramerAV VIA GO² \< 4.0.1.1326 is vulnerable to SQL Injection. (CVSS 9.8)
- [CVE-2023-33627](https://cve.now/CVE-2023-33627.md): H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the UpdateSnat interface at /goform/aspForm. (CVSS 7.2)
- [CVE-2023-33628](https://cve.now/CVE-2023-33628.md): H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the DelvsList interface at /goform/aspForm. (CVSS 7.2)
- [CVE-2023-33629](https://cve.now/CVE-2023-33629.md): H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the DeltriggerList interface at /goform/aspForm. (CVSS 7.2)
- [CVE-2023-33630](https://cve.now/CVE-2023-33630.md): H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the EditvsList interface at /goform/aspForm. (CVSS 7.2)
- [CVE-2023-33631](https://cve.now/CVE-2023-33631.md): H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the DelSTList interface at /goform/aspForm. (CVSS 7.2)
- [CVE-2023-33632](https://cve.now/CVE-2023-33632.md): H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the ipqos\_lanip\_dellist interface at /goform/aspFor (CVSS 7.2)
- [CVE-2023-33633](https://cve.now/CVE-2023-33633.md): H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the UpdateWanParams interface at /goform/aspForm. (CVSS 7.2)
- [CVE-2023-33634](https://cve.now/CVE-2023-33634.md): H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the EdittriggerList interface at /goform/aspForm. (CVSS 7.2)
- [CVE-2023-33635](https://cve.now/CVE-2023-33635.md): H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the UpdateMacClone interface at /goform/aspForm. (CVSS 7.2)
- [CVE-2023-33636](https://cve.now/CVE-2023-33636.md): H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the ipqos\_lanip\_editlist interface at /goform/aspFo (CVSS 7.2)
- [CVE-2023-33637](https://cve.now/CVE-2023-33637.md): H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the DelDNSHnList interface at /goform/aspForm. (CVSS 7.2)
- [CVE-2023-33638](https://cve.now/CVE-2023-33638.md): H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the Edit\_BasicSSID\_5G interface at /goform/aspForm. (CVSS 7.2)
- [CVE-2023-33639](https://cve.now/CVE-2023-33639.md): H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the SetMobileAPInfoById interface at /goform/aspFor (CVSS 7.2)
- [CVE-2023-33640](https://cve.now/CVE-2023-33640.md): H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the SetAPWifiorLedInfoById interface at /goform/asp (CVSS 7.2)
- [CVE-2023-33641](https://cve.now/CVE-2023-33641.md): H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the AddMacList interface at /goform/aspForm. (CVSS 7.2)
- [CVE-2023-33642](https://cve.now/CVE-2023-33642.md): H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the Edit\_BasicSSID interface at /goform/aspForm. (CVSS 7.2)
- [CVE-2023-33643](https://cve.now/CVE-2023-33643.md): H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the AddWlanMacList interface at /goform/aspForm. (CVSS 7.2)
- [CVE-2023-33718](https://cve.now/CVE-2023-33718.md): mp4v2 v2.1.3 was discovered to contain a memory leak via MP4File::ReadString() at mp4file\_io.cpp (CVSS 8.8)
- [CVE-2023-33722](https://cve.now/CVE-2023-33722.md): EDIMAX BR-6288ACL v1.12 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the pppUserName parameter. (CVSS 8.8)
- [CVE-2023-33730](https://cve.now/CVE-2023-33730.md): Privilege Escalation in the "GetUserCurrentPwd" function in Microworld Technologies eScan Management Console 14.0.1400.2281 allows any remot (CVSS 9.8)
- [CVE-2023-33732](https://cve.now/CVE-2023-33732.md): Cross Site Scripting (XSS) in the New Policy form in Microworld Technologies eScan management console 14.0.1400.2281 allows a remote attacke (CVSS 6.1)
- [CVE-2023-33735](https://cve.now/CVE-2023-33735.md): D-Link DIR-846 v1.00A52 was discovered to contain a remote command execution (RCE) vulnerability via the tomography\_ping\_address parameter i (CVSS 9.8)
- [CVE-2023-33736](https://cve.now/CVE-2023-33736.md): A stored cross-site scripting (XSS) vulnerability in Dcat-Admin v2.1.3-beta allows attackers to execute arbitrary web scripts or HTML via a (CVSS 5.4, dcat/laravel-admin)
- [CVE-2023-34256](https://cve.now/CVE-2023-34256.md): An issue was discovered in the Linux kernel before 6.3.3. (CVSS 5.5)
- [CVE-2023-34257](https://cve.now/CVE-2023-34257.md): An issue was discovered in BMC Patrol through 23.1.00. (CVSS 9.8)
- [CVE-2023-34258](https://cve.now/CVE-2023-34258.md): An issue was discovered in BMC Patrol before 22.1.00. (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-05-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.