# CVEs published 2023-06-01

76 CVEs were published on June 1, 2023: 8 critical, 33 high. Days are UTC.

- [CVE-2016-15032](https://cve.now/CVE-2016-15032.md): mback2k mh\_httpbl Extension class.tx\_mhhttpbl.php stopOutput cross site scripting (CVSS 3.5, mback2k mh\_httpbl Extension)
- [CVE-2015-10110](https://cve.now/CVE-2015-10110.md): ruddernation TinyChat Room Spy Plugin room-spy.php wp\_show\_room\_spy cross site scripting (CVSS 3.5, ruddernation TinyChat Room Spy Plugin)
- [CVE-2023-34339](https://cve.now/CVE-2023-34339.md): In JetBrains Ktor before 2.3.1 headers containing authentication data could be added to the exception's message (CVSS 3.3, JetBrains Ktor)
- [CVE-2023-32709](https://cve.now/CVE-2023-32709.md): Low-privileged User can View Hashed Default Splunk Password (CVSS 4.3, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2023-32707](https://cve.now/CVE-2023-32707.md): ‘edit\_user’ Capability Privilege Escalation (CVSS 8.8, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2023-32713](https://cve.now/CVE-2023-32713.md): Local Privilege Escalation via the ‘streamfwd’ program in Splunk App for Stream (CVSS 7.8, Splunk App for Stream)
- [CVE-2023-32712](https://cve.now/CVE-2023-32712.md): Unauthenticated Log Injection in Splunk Enterprise (CVSS 8.6, Splunk Enterprise · Splunk Universal Forwarder)
- [CVE-2023-32714](https://cve.now/CVE-2023-32714.md): Path Traversal in Splunk App for Lookup File Editing (CVSS 8.1, Splunk App for Lookup File Editing)
- [CVE-2023-32716](https://cve.now/CVE-2023-32716.md): Denial of Service via the 'dump' SPL command (CVSS 6.5, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2023-32710](https://cve.now/CVE-2023-32710.md): Information Disclosure via the ‘copyresults’ SPL Command (CVSS 4.8, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2023-32717](https://cve.now/CVE-2023-32717.md): Role-based Access Control (RBAC) Bypass on '/services/indexing/preview' REST Endpoint Can Overwrite Search Results (CVSS 4.3, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2023-32706](https://cve.now/CVE-2023-32706.md): Denial Of Service due to Untrusted XML Tag in XML Parser within SAML Authentication (CVSS 7.7, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2023-32715](https://cve.now/CVE-2023-32715.md): Self Cross-Site Scripting (XSS) on Splunk App for Lookup File Editing (CVSS 4.7, Splunk App for Lookup File Editing)
- [CVE-2023-32711](https://cve.now/CVE-2023-32711.md): Persistent Cross-Site Scripting (XSS) through a URL Validation Bypass within a Dashboard View (CVSS 5.4, Splunk Enterprise)
- [CVE-2023-32708](https://cve.now/CVE-2023-32708.md): HTTP Response Splitting via the ‘rest’ SPL Command (CVSS 7.2, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2023-34092](https://cve.now/CVE-2023-34092.md): Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) (CVSS 7.5, vitejs vite · vite)
- [CVE-2023-34091](https://cve.now/CVE-2023-34091.md): Kyverno resource with a deletionTimestamp may allow policy circumvention (CVSS 6.5, kyverno · github.com/kyverno/kyverno)
- [CVE-2023-33960](https://cve.now/CVE-2023-33960.md): OpenProject vulnerable to project identifier information leakage through robots.txt (CVSS 7.5, opf openproject)
- [CVE-2023-32690](https://cve.now/CVE-2023-32690.md): Responder can Invoke Undefined Behavior in libspdm Requester (CVSS 5.7, DMTF libspdm)
- [CVE-2023-32324](https://cve.now/CVE-2023-32324.md): OpenPrinting CUPS vulnerable to heap buffer overflow (CVSS 7.5, OpenPrinting cups)
- [CVE-2023-28043](https://cve.now/CVE-2023-28043.md): Dell SCG 5.14 contains an information disclosure vulnerability during the SRS to SCG upgrade path. (CVSS 6.5, Dell Secure Connect Gateway)
- [CVE-2023-28066](https://cve.now/CVE-2023-28066.md): Dell OS Recovery Tool, versions 2.2.4013 and 2.3.7012.0, contain an Improper Access Control Vulnerability. (CVSS 7.3, Dell OS Recovery Tool)
- [CVE-2023-33963](https://cve.now/CVE-2023-33963.md): DataEase data source has deserialization vulnerability (CVSS 9.8, dataease)
- [CVE-2023-32310](https://cve.now/CVE-2023-32310.md): DataEase API interface has IDOR vulnerability (CVSS 8.1, dataease · io.dataease:dataease-plugin-common)
- [CVE-2023-33965](https://cve.now/CVE-2023-33965.md): Brook's tproxy server is vulnerable to a drive-by command injection. (CVSS 9.7, txthinking brook · github.com/txthinking/brook)
- [CVE-2023-3035](https://cve.now/CVE-2023-3035.md): Guangdong Pythagorean OA Office System Schedule cross site scripting (CVSS 3.5, Guangdong Pythagorean OA Office System)
- [CVE-2015-10109](https://cve.now/CVE-2015-10109.md): Video Playlist and Gallery Plugin wp-media-cincopa.php cross-site request forgery (CVSS 4.3, Video Playlist and Gallery Plugin)
- [CVE-2014-125104](https://cve.now/CVE-2014-125104.md): VaultPress Plugin MailPoet Plugin class.vaultpress-hotfixes.php protect\_aioseo\_ajax unrestricted upload (CVSS 6.3, VaultPress Plugin)
- [CVE-2022-43760](https://cve.now/CVE-2022-43760.md): An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SUSE Rancher allows users in some h (CVSS 8.4, SUSE Rancher · github.com/rancher/rancher)
- [CVE-2023-22647](https://cve.now/CVE-2023-22647.md): An Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage their existing permissions to manipulate K (CVSS 9.9, SUSE Rancher · github.com/rancher/rancher)
- [CVE-2023-22648](https://cve.now/CVE-2023-22648.md): A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users while they (CVSS 8.0, SUSE Rancher · github.com/rancher/rancher)
- [CVE-2023-22652](https://cve.now/CVE-2023-22652.md): Stack buffer overflow in "read\_file" function (CVSS 3.3, openSUSE libeconf)
- [CVE-2023-32181](https://cve.now/CVE-2023-32181.md): Stack buffer overflow in "econf\_writeFile" function (CVSS 3.3, openSUSE libeconf)
- [CVE-2018-25086](https://cve.now/CVE-2018-25086.md): sea75300 FanPress CM Template Preview templatepreview.php getArticlesPreview cross site scripting (CVSS 3.5, sea75300 FanPress CM)
- [CVE-2023-3029](https://cve.now/CVE-2023-3029.md): Guangdong Pythagorean OA Office System delete cross-site request forgery (CVSS 4.3, Guangdong Pythagorean OA Office System)
- [CVE-2022-4332](https://cve.now/CVE-2022-4332.md): Sprecher: Vulnerable firmware verification (CVSS 6.8, Sprecher Automation SPRECON-E-C/P/T3 CPU PU244x)
- [CVE-2022-4333](https://cve.now/CVE-2022-4333.md): Sprecher: Sprecon maintenance access with hardcoded credentials (CVSS 9.8, Sprecher Automation SPRECON-E CPU PU243x · Sprecher Auto… +2)
- [CVE-2023-3028](https://cve.now/CVE-2023-3028.md): Improper backend communication allows access and manipulation of the telemetry data (CVSS 8.6, Hangzhou Hopechart IoT Technology Co. HQT401)
- [CVE-2010-10010](https://cve.now/CVE-2010-10010.md): Stars Alliance PsychoStats login.php cross site scripting (CVSS 3.5, Stars Alliance PsychoStats)
- [CVE-2023-24584](https://cve.now/CVE-2023-24584.md): Controller 6000 buffer overflow via upload feature in web interface (CVSS 7.5, Gallagher Controller)
- [CVE-2022-35742](https://cve.now/CVE-2022-35742.md): Microsoft Outlook Denial of Service Vulnerability (CVSS 7.5, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2023-23952](https://cve.now/CVE-2023-23952.md): Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Command Injection vulnerability. (CVSS 9.8, Advanced Secure Gateway, Content Analysis)
- [CVE-2023-23953](https://cve.now/CVE-2023-23953.md): Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to an Elevation of Privilege vulnerability. (CVSS 7.8, Advanced Secure Gateway, Content Analysis)
- [CVE-2023-23954](https://cve.now/CVE-2023-23954.md): Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Stored Cross-Site Scripting vulnerability (CVSS 5.4, Advanced Secure Gateway, Content Analysis)
- [CVE-2023-23955](https://cve.now/CVE-2023-23955.md): Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Server-Side Request Forgery vulnerability (CVSS 8.1, Advanced Secure Gateway, Content Analysis)
- [CVE-2023-2598](https://cve.now/CVE-2023-2598.md): A flaw was found in the fixed buffer registration code for io\_uring (io\_sqe\_buffer\_register in io\_uring/rsrc.c) in the Linux kernel that all (CVSS 7.8, Kernel)
- [CVE-2023-27639](https://cve.now/CVE-2023-27639.md): An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. (CVSS 7.5)
- [CVE-2023-27640](https://cve.now/CVE-2023-27640.md): An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. (CVSS 7.5)
- [CVE-2023-28147](https://cve.now/CVE-2023-28147.md): An issue was discovered in the Arm Mali GPU Kernel Driver. (CVSS 5.5)
- [CVE-2023-28399](https://cve.now/CVE-2023-28399.md): Incorrect permission assignment for critical resource exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. (CVSS 7.8, Contec Co. CONPROSYS HMI System)
- [CVE-2023-28651](https://cve.now/CVE-2023-28651.md): Cross-site scripting vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. (CVSS 4.8, Contec Co. CONPROSYS HMI System)
- [CVE-2023-28657](https://cve.now/CVE-2023-28657.md): Improper access control vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. (CVSS 8.8, Contec Co. CONPROSYS HMI System)
- [CVE-2023-28713](https://cve.now/CVE-2023-28713.md): Plaintext storage of a password exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. (CVSS 8.1, Contec Co. CONPROSYS HMI System)
- [CVE-2023-28824](https://cve.now/CVE-2023-28824.md): Server-side request forgery vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. (CVSS 4.9, Contec Co. CONPROSYS HMI System)
- [CVE-2023-28937](https://cve.now/CVE-2023-28937.md): DataSpider Servista version 4.4 and earlier uses a hard-coded cryptographic key. (CVSS 8.8, SAISON INFORMATION SYSTEMS CO. DataSpider Servista)
- [CVE-2023-29154](https://cve.now/CVE-2023-29154.md): SQL injection vulnerability exists in the CONPROSYS HMI System (CHS) versions prior to 3.5.3. (CVSS 7.2, Contec Co. CONPROSYS HMI System)
- [CVE-2023-29159](https://cve.now/CVE-2023-29159.md): Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to vie (CVSS 7.5, Encode Starlette · starlette)
- [CVE-2023-29722](https://cve.now/CVE-2023-29722.md): The Glitter Unicorn Wallpaper app for Android 7.0 thru 8.0 allows unauthorized apps to actively request permission to modify data in the dat (CVSS 9.1)
- [CVE-2023-29723](https://cve.now/CVE-2023-29723.md): The Glitter Unicorn Wallpaper app for Android 7.0 thru 8.0 allows unauthorized applications to actively request permission to insert data in (CVSS 7.5)
- [CVE-2023-29736](https://cve.now/CVE-2023-29736.md): Keyboard Themes 1.275.1.164 for Android contains a dictionary traversal vulnerability that allows unauthorized apps to overwrite arbitrary f (CVSS 9.8)
- [CVE-2023-29748](https://cve.now/CVE-2023-29748.md): Story Saver for Instragram - Video Downloader 1.0.6 for Android has an exposed component that provides a method to modify the SharedPreferen (CVSS 7.5)
- [CVE-2023-2977](https://cve.now/CVE-2023-2977.md): A vulnerbility was found in OpenSC. (CVSS 7.1, OpenSC)
- [CVE-2023-2985](https://cve.now/CVE-2023-2985.md): A use after free flaw was found in hfsplus\_put\_super in fs/hfsplus/super.c in the Linux Kernel. (CVSS 5.5, Kernel)
- [CVE-2023-3026](https://cve.now/CVE-2023-3026.md): Cross-site Scripting (XSS) - Stored in jgraph/drawio (CVSS 6.5, jgraph/drawio)
- [CVE-2023-30758](https://cve.now/CVE-2023-30758.md): Cross-site scripting vulnerability in Pleasanter 1.3.38.1 and earlier allows a remote authenticated attacker to inject an arbitrary script. (CVSS 5.4, Implem Pleasanter)
- [CVE-2023-33461](https://cve.now/CVE-2023-33461.md): iniparser v4.1 is vulnerable to NULL Pointer Dereference in function iniparser\_getlongint which misses check NULL for function iniparser\_get (CVSS 5.5)
- [CVE-2023-33544](https://cve.now/CVE-2023-33544.md): hawtio 2.17.2 is vulnerable to Path Traversal. (CVSS 5.5, io.hawt:project)
- [CVE-2023-33546](https://cve.now/CVE-2023-33546.md): Janino 3.1.9 and earlier are subject to denial of service (DOS) attacks when using the expression evaluator.guess parameter name method. (no CVSS, org.codehaus.janino:janino-parent)
- [CVE-2023-33551](https://cve.now/CVE-2023-33551.md): Heap Buffer Overflow in the erofsfsck\_dirent\_iter function in fsck/main.c in erofs-utils v1.6 allows remote attackers to execute arbitrary c (CVSS 7.8)
- [CVE-2023-33552](https://cve.now/CVE-2023-33552.md): Heap Buffer Overflow in the erofs\_read\_one\_data function at data.c in erofs-utils v1.6 allows remote attackers to execute arbitrary code via (CVSS 7.8)
- [CVE-2023-33716](https://cve.now/CVE-2023-33716.md): mp4v2 v2.1.3 was discovered to contain a memory leak via the class MP4StringProperty at mp4property.cpp. (CVSS 5.5)
- [CVE-2023-33719](https://cve.now/CVE-2023-33719.md): mp4v2 v2.1.3 was discovered to contain a memory leak via MP4SdpAtom::Read() at atom\_sdp.cpp (CVSS 5.5)
- [CVE-2023-33754](https://cve.now/CVE-2023-33754.md): The captive portal in Inpiazza Cloud WiFi versions prior to v4.2.17 does not enforce limits on the number of attempts for password recovery, (CVSS 6.5)
- [CVE-2023-33764](https://cve.now/CVE-2023-33764.md): eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the componen (CVSS 5.4)
- [CVE-2023-33778](https://cve.now/CVE-2023-33778.md): Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2. (CVSS 9.8)
- [CVE-2023-34312](https://cve.now/CVE-2023-34312.md): In Tencent QQ through 9.7.8.29039 and TIM through 3.4.7.22084, QQProtect.exe and QQProtectEngine.dll do not validate pointers from inter-pro (CVSS 7.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-06-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.