CVEs published June 1, 2023
76 CVEs were published on June 1, 2023: 8 critical, 33 high.
- Published
- 76
- Critical
- 8
- High
- 33
- Medium
- 26
- Low
- 8
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 35
Most affected products
- Splunk Enterprise · Splunk Cloud Platform
- 7
- Contec Co. CONPROSYS HMI System
- 6
- Advanced Secure Gateway, Content Analysis
- 4
- SUSE Rancher · github.com/rancher/rancher
- 3
- Guangdong Pythagorean OA Office System
- 2
- Kernel
- 2
- openSUSE libeconf
- 2
- Splunk App for Lookup File Editing
- 2
- dataease
- 1
- dataease · io.dataease:dataease-plugin-common
- 1
Critical 8
- CVE-2023-33963DataEase data source has deserialization vulnerabilitydataease
- CVE-2023-33965Brook's tproxy server is vulnerable to a drive-by command injection.txthinking brook · github.com/txthinking/brook
- CVE-2023-22647An Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage their existing permissions to manipulate KSUSE Rancher · github.com/rancher/rancher
- CVE-2022-4333Sprecher: Sprecon maintenance access with hardcoded credentialsSprecher Automation SPRECON-E CPU PU243x · Sprecher Auto… +2
- CVE-2023-23952Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Command Injection vulnerability.Advanced Secure Gateway, Content Analysis
- CVE-2023-29722The Glitter Unicorn Wallpaper app for Android 7.0 thru 8.0 allows unauthorized apps to actively request permission to modify data in the dat
- CVE-2023-29736Keyboard Themes 1.275.1.164 for Android contains a dictionary traversal vulnerability that allows unauthorized apps to overwrite arbitrary f
- CVE-2023-33778Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.
High 33
- CVE-2023-32707‘edit_user’ Capability Privilege EscalationSplunk Enterprise · Splunk Cloud Platform
- CVE-2023-32713Local Privilege Escalation via the ‘streamfwd’ program in Splunk App for StreamSplunk App for Stream
- CVE-2023-32712Unauthenticated Log Injection in Splunk EnterpriseSplunk Enterprise · Splunk Universal Forwarder
- CVE-2023-32714Path Traversal in Splunk App for Lookup File EditingSplunk App for Lookup File Editing
- CVE-2023-32706Denial Of Service due to Untrusted XML Tag in XML Parser within SAML AuthenticationSplunk Enterprise · Splunk Cloud Platform
- CVE-2023-32708HTTP Response Splitting via the ‘rest’ SPL CommandSplunk Enterprise · Splunk Cloud Platform
- CVE-2023-34092Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)vitejs vite · vite
- CVE-2023-33960OpenProject vulnerable to project identifier information leakage through robots.txtopf openproject
- CVE-2023-32324OpenPrinting CUPS vulnerable to heap buffer overflowOpenPrinting cups
- CVE-2023-28066 Dell OS Recovery Tool, versions 2.2.4013 and 2.3.7012.0, contain an Improper Access Control Vulnerability.Dell OS Recovery Tool
- CVE-2023-32310DataEase API interface has IDOR vulnerabilitydataease · io.dataease:dataease-plugin-common
- CVE-2022-43760An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SUSE Rancher allows users in some hSUSE Rancher · github.com/rancher/rancher
- CVE-2023-22648A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users while theySUSE Rancher · github.com/rancher/rancher
- CVE-2023-3028Improper backend communication allows access and manipulation of the telemetry dataHangzhou Hopechart IoT Technology Co. HQT401
- CVE-2023-24584Controller 6000 buffer overflow via upload feature in web interfaceGallagher Controller
- CVE-2022-35742Microsoft Outlook Denial of Service VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise +1
- CVE-2023-23953Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to an Elevation of Privilege vulnerability.Advanced Secure Gateway, Content Analysis
- CVE-2023-23955Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Server-Side Request Forgery vulnerabilityAdvanced Secure Gateway, Content Analysis
- CVE-2023-2598A flaw was found in the fixed buffer registration code for io_uring (io_sqe_buffer_register in io_uring/rsrc.c) in the Linux kernel that allKernel
- CVE-2023-27639An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop.
- CVE-2023-27640An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop.
- CVE-2023-28399Incorrect permission assignment for critical resource exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3.Contec Co. CONPROSYS HMI System
- CVE-2023-28657Improper access control vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3.Contec Co. CONPROSYS HMI System
- CVE-2023-28713Plaintext storage of a password exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3.Contec Co. CONPROSYS HMI System
- CVE-2023-28937DataSpider Servista version 4.4 and earlier uses a hard-coded cryptographic key.SAISON INFORMATION SYSTEMS CO. DataSpider Servista
- CVE-2023-29154SQL injection vulnerability exists in the CONPROSYS HMI System (CHS) versions prior to 3.5.3.Contec Co. CONPROSYS HMI System
- CVE-2023-29159Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to vieEncode Starlette · starlette
- CVE-2023-29723The Glitter Unicorn Wallpaper app for Android 7.0 thru 8.0 allows unauthorized applications to actively request permission to insert data in
- CVE-2023-29748Story Saver for Instragram - Video Downloader 1.0.6 for Android has an exposed component that provides a method to modify the SharedPreferen
- CVE-2023-2977A vulnerbility was found in OpenSC.OpenSC
- CVE-2023-33551Heap Buffer Overflow in the erofsfsck_dirent_iter function in fsck/main.c in erofs-utils v1.6 allows remote attackers to execute arbitrary c
- CVE-2023-33552Heap Buffer Overflow in the erofs_read_one_data function at data.c in erofs-utils v1.6 allows remote attackers to execute arbitrary code via
- CVE-2023-34312In Tencent QQ through 9.7.8.29039 and TIM through 3.4.7.22084, QQProtect.exe and QQProtectEngine.dll do not validate pointers from inter-pro
Medium, low and unrated 35
- CVE-2016-15032mback2k mh_httpbl Extension class.tx_mhhttpbl.php stopOutput cross site scriptingmback2k mh_httpbl Extension
- CVE-2015-10110ruddernation TinyChat Room Spy Plugin room-spy.php wp_show_room_spy cross site scriptingruddernation TinyChat Room Spy Plugin
- CVE-2023-34339In JetBrains Ktor before 2.3.1 headers containing authentication data could be added to the exception's messageJetBrains Ktor
- CVE-2023-32709Low-privileged User can View Hashed Default Splunk PasswordSplunk Enterprise · Splunk Cloud Platform
- CVE-2023-32716Denial of Service via the 'dump' SPL commandSplunk Enterprise · Splunk Cloud Platform
- CVE-2023-32710Information Disclosure via the ‘copyresults’ SPL CommandSplunk Enterprise · Splunk Cloud Platform
- CVE-2023-32717Role-based Access Control (RBAC) Bypass on '/services/indexing/preview' REST Endpoint Can Overwrite Search ResultsSplunk Enterprise · Splunk Cloud Platform
- CVE-2023-32715Self Cross-Site Scripting (XSS) on Splunk App for Lookup File EditingSplunk App for Lookup File Editing
- CVE-2023-32711Persistent Cross-Site Scripting (XSS) through a URL Validation Bypass within a Dashboard ViewSplunk Enterprise
- CVE-2023-34091Kyverno resource with a deletionTimestamp may allow policy circumventionkyverno · github.com/kyverno/kyverno
- CVE-2023-32690Responder can Invoke Undefined Behavior in libspdm RequesterDMTF libspdm
- CVE-2023-28043 Dell SCG 5.14 contains an information disclosure vulnerability during the SRS to SCG upgrade path.Dell Secure Connect Gateway
- CVE-2023-3035Guangdong Pythagorean OA Office System Schedule cross site scriptingGuangdong Pythagorean OA Office System
- CVE-2015-10109Video Playlist and Gallery Plugin wp-media-cincopa.php cross-site request forgeryVideo Playlist and Gallery Plugin
- CVE-2014-125104VaultPress Plugin MailPoet Plugin class.vaultpress-hotfixes.php protect_aioseo_ajax unrestricted uploadVaultPress Plugin
- CVE-2023-22652Stack buffer overflow in "read_file" functionopenSUSE libeconf
- CVE-2023-32181Stack buffer overflow in "econf_writeFile" functionopenSUSE libeconf
- CVE-2018-25086sea75300 FanPress CM Template Preview templatepreview.php getArticlesPreview cross site scriptingsea75300 FanPress CM
- CVE-2023-3029Guangdong Pythagorean OA Office System delete cross-site request forgeryGuangdong Pythagorean OA Office System
- CVE-2022-4332Sprecher: Vulnerable firmware verificationSprecher Automation SPRECON-E-C/P/T3 CPU PU244x
- CVE-2010-10010Stars Alliance PsychoStats login.php cross site scriptingStars Alliance PsychoStats
- CVE-2023-23954Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Stored Cross-Site Scripting vulnerabilityAdvanced Secure Gateway, Content Analysis
- CVE-2023-28147An issue was discovered in the Arm Mali GPU Kernel Driver.
- CVE-2023-28651Cross-site scripting vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3.Contec Co. CONPROSYS HMI System
- CVE-2023-28824Server-side request forgery vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3.Contec Co. CONPROSYS HMI System
- CVE-2023-2985A use after free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel.Kernel
- CVE-2023-3026Cross-site Scripting (XSS) - Stored in jgraph/drawiojgraph/drawio
- CVE-2023-30758Cross-site scripting vulnerability in Pleasanter 1.3.38.1 and earlier allows a remote authenticated attacker to inject an arbitrary script.Implem Pleasanter
- CVE-2023-33461iniparser v4.1 is vulnerable to NULL Pointer Dereference in function iniparser_getlongint which misses check NULL for function iniparser_get
- CVE-2023-33544hawtio 2.17.2 is vulnerable to Path Traversal.io.hawt:project
- CVE-2023-33546Janino 3.1.9 and earlier are subject to denial of service (DOS) attacks when using the expression evaluator.guess parameter name method.org.codehaus.janino:janino-parent
- CVE-2023-33716mp4v2 v2.1.3 was discovered to contain a memory leak via the class MP4StringProperty at mp4property.cpp.
- CVE-2023-33719mp4v2 v2.1.3 was discovered to contain a memory leak via MP4SdpAtom::Read() at atom_sdp.cpp
- CVE-2023-33754The captive portal in Inpiazza Cloud WiFi versions prior to v4.2.17 does not enforce limits on the number of attempts for password recovery,
- CVE-2023-33764eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the componen