CVEs published June 2, 2023
141 CVEs were published on June 2, 2023: 15 critical, 47 high. 1 is now in CISA KEV.
- Published
- 141
- Critical
- 15
- High
- 47
- Medium
- 52
- Low
- 4
- Unrated
- 23
- Now in CISA KEV
- 1
- Fix available
- 79
Most affected products
- Mozilla Firefox · Mozilla Thunderbird
- 30
- Mozilla Firefox
- 17
- Mozilla Firefox for Android · Mozilla Firefox +1
- 8
- Mozilla Firefox · Mozilla Focus for Android +1
- 7
- tsolucio/corebos
- 6
- Hitron Technologies Hitron CODA-5310
- 5
- Page Builder with Image Map by AZEXO
- 4
- code-projects Agro-School Management System
- 3
- Mitsubishi Electric MELSEC iQ-R Series EtherNet/IP module R…
- 3
- Mozilla Thunderbird
- 3
Critical 15
- CVE-2023-3000SQLi in Erikoglu Technology's ErMonErikoglu Technology ErMon
- CVE-2023-28698WADE DIGITAL DESIGN CO, LTD. FANTSY - Broken Acesss ControlWADE DIGITAL DESIGN CO FANTSY
- CVE-2023-28701ELITE Web Fax - SQL InjectionELITE Web Fax
- CVE-2023-29746An issue found in The Thaiger v.1.2 for Android allows unauthorized apps to cause a code execution attack by manipulating the SharedPreferen
- CVE-2023-30149SQL injection vulnerability in the City Autocomplete (cityautocomplete) module from ebewe.net for PrestaShop, prior to version 1.8.12 (for P
- CVE-2023-30603Hitron Technologies Inc. CODA-5310 - Using default credentialsHitron Technologies Hitron CODA-5310
- CVE-2023-30604Hitron Technologies Inc. CODA-5310 - Broken Access ControlHitron Technologies Hitron CODA-5310
- CVE-2023-33476ReadyMedia (MiniDLNA) versions from 1.1.15 up to 1.3.2 is vulnerable to Buffer Overflow.
- CVE-2023-33669Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the timeZone parameter in the sub_44db3c function.
- CVE-2023-33670Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the time parameter in the sub_4a79ec function.
- CVE-2023-33671Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the deviceId parameter in the saveParentControlInfo function.
- CVE-2023-33673Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the firewallEn parameter in the formSetFirewallCfg function.
- CVE-2023-33675Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the time parameter in the get_parentControl_list_Info function.
- CVE-2023-33762eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a SQL injection vulnerability via the Activity parameter.
- CVE-2023-34362In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL
High 47
- CVE-2023-2781User Email Verification for WooCommerce <= 3.5.0 - Authentication Bypasssandeepsoni214 User Email Verification for WooCommerce
- CVE-2023-2816Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service OwnerHashiCorp Consul · github.com/hashicorp/consul
- CVE-2023-34094ChuanhuChatGPT vulnerable to unauthorized configuration file accessGaiZhenbiao ChuanhuChatGPT
- CVE-2023-3032Mobatime web application - Arbitrary file upload (RCE)Mobatime web application
- CVE-2023-2060Authentication bypass vulnerability in MELSEC iQ-R Series / iQ-F Series EtherNet/IP ModulesMitsubishi Electric MELSEC iQ-R Series EtherNet/IP module R…
- CVE-2023-2201Web Directory Free <= 1.6.8 - Authenticated (Contributor+) SQL Injection via post_idmihail-chepovskiy Web Directory Free
- CVE-2022-45938An issue was discovered in Comcast Defined Technologies microeisbss through 2021.
- CVE-2022-46307SGUDA U-Lock - Broken Access ControlSGUDA U-Lock
- CVE-2022-46308SGUDA U-Lock - Broken Access ControlSGUDA U-Lock
- CVE-2022-47616Hitron Technologies Inc. CODA-5310 - Remote Command ExecutionHitron Technologies Hitron CODA-5310
- CVE-2022-47617Hitron Technologies Inc. CODA-5310 - Hard-coded Cryptographic KeyHitron Technologies Hitron CODA-5310
- CVE-2023-0767An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributesMozilla Firefox · Mozilla Thunderbird
- CVE-2023-23605Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7Mozilla Firefox · Mozilla Thunderbird
- CVE-2023-23606Memory safety bugs fixed in Firefox 109Mozilla Firefox
- CVE-2023-25729Permission prompts for opening external schemes were only shown for <code>ContentPrincipals</code> resulting in extensions being able to opeMozilla Firefox · Mozilla Thunderbird
- CVE-2023-25731Due to URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially be used to overwriteMozilla Firefox
- CVE-2023-25732When encoding data from an <code>inputStream</code> in <code>xpcom</code> the size of the input being encoded was not correctly calculated pMozilla Firefox · Mozilla Thunderbird
- CVE-2023-25734After downloading a Windows <code>.url</code> shortcut from the local filesystem, an attacker could supply a remote path that would lead to Mozilla Firefox · Mozilla Thunderbird
- CVE-2023-25735Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment Mozilla Firefox · Mozilla Thunderbird
- CVE-2023-25737An invalid downcast from <code>nsTextNode</code> to <code>SVGElement</code> could have lead to undefined behavior.Mozilla Firefox · Mozilla Thunderbird
- CVE-2023-25739Module load requests that failed were not being checked as to whether or not they were cancelled causing a use-after-free in <code>ScriptLoaMozilla Firefox · Mozilla Thunderbird
- CVE-2023-25740After downloading a Windows <code>.scf</code> script from the local filesystem, an attacker could supply a remote path that would lead to unMozilla Firefox
- CVE-2023-25745Memory safety bugs present in Firefox 109.Mozilla Firefox
- CVE-2023-25746Memory safety bugs present in Firefox ESR 102.7.Mozilla Thunderbird · Mozilla Firefox ESR
- CVE-2023-27744An issue was discovered in South River Technologies TitanFTP NextGen server that allows for a vertical privilege escalation leading to remot
- CVE-2023-27745An issue in South River Technologies TitanFTP Before v2.0.1.2102 allows attackers with low-level privileges to perform Administrative action
- CVE-2023-28161If temporary "one-time" permissions, such as the ability to use the Camera, were granted to a document loaded using a file: URL, that permisMozilla Firefox
- CVE-2023-28162While implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type.Mozilla Firefox · Mozilla Thunderbird
- CVE-2023-28176Memory safety bugs present in Firefox 110 and Firefox ESR 102.8.Mozilla Firefox · Mozilla Thunderbird
- CVE-2023-28177Memory safety bugs present in Firefox 110.Mozilla Firefox
- CVE-2023-28699WADE DIGITAL DESIGN CO, LTD. FANTSY - Arbitrary File UploadWADE DIGITAL DESIGN CO FANTSY
- CVE-2023-28702ASUS RT-AC86U - Command InjectionASUS RT-AC86U
- CVE-2023-28703ASUS RT-AC86U - Buffer OverflowASUS RT-AC86U
- CVE-2023-28704Furbo dog camera - Command InjectionFurbo dog camera fireware
- CVE-2023-29541Firefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be interpreted to run attacker-controlled commMozilla Firefox · Mozilla Focus for Android +1
- CVE-2023-29543An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object's debugger vectMozilla Firefox for Android · Mozilla Firefox +1
- CVE-2023-29550Memory safety bugs present in Firefox 111 and Firefox ESR 102.9.Mozilla Firefox · Mozilla Focus for Android +1
- CVE-2023-29551Memory safety bugs present in Firefox 111.Mozilla Firefox for Android · Mozilla Firefox +1
- CVE-2023-29724The BT21 x BTS Wallpaper app 12 for Android allows unauthorized apps to actively request permission to modify data in the database that reco
- CVE-2023-30602Hitron Technologies Inc. CODA-5310 - Insecure service TelnetHitron Technologies Hitron CODA-5310
- CVE-2023-3069Unverified Password Change in tsolucio/corebostsolucio/corebos
- CVE-2023-3070Cross-site Scripting (XSS) - Stored in tsolucio/corebostsolucio/corebos
- CVE-2023-3071Cross-site Scripting (XSS) - Stored in tsolucio/corebostsolucio/corebos
- CVE-2023-3074Cross-site Scripting (XSS) - Stored in tsolucio/corebostsolucio/corebos
- CVE-2023-3075Cross-Site Request Forgery (CSRF) in tsolucio/corebostsolucio/corebos
- CVE-2023-32207A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permissions.Mozilla Firefox · Mozilla Thunderbird
- CVE-2023-33672Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the shareSpeed parameter in the fromSetWifiGusetBasic function.
Medium, low and unrated 79
- CVE-2023-3053Page Builder by AZEXO <= 1.27.133 - Missing Authorization to Post CreationPage Builder with Image Map by AZEXO
- CVE-2023-3052Page Builder by AZEXO <= 1.27.133 - Cross-Site Request Forgery to Post Creation/Modification/DeletionPage Builder with Image Map by AZEXO
- CVE-2023-3055Page Builder by AZEXO <= 1.27.133 - Cross-Site Request Forgery to Stored Cross-Site Scripting via azh_savePage Builder with Image Map by AZEXO
- CVE-2023-3051Page Builder by AZEXO <= 1.27.133 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodePage Builder with Image Map by AZEXO
- CVE-2023-1297 Consul Cluster Peering can Result in Denial of ServiceHashiCorp Consul · github.com/hashicorp/consul
- CVE-2023-3044Divide-by-zero in Xpdf 4.04 due to very large page sizeXpdf
- CVE-2023-2687Buffer overflow in Platform CLI component in Silicon Labs Gecko SDK v4.2.1 and earlier allows user to overwrite limited structures on the hesilabs.com Gecko SDK
- CVE-2023-3068Campcodes Retro Cellphone Online Store modal_add_product.php sql injectionCampcodes Retro Cellphone Online Store
- CVE-2023-3062code-projects Agro-School Management System index.php sql injectioncode-projects Agro-School Management System
- CVE-2023-3061code-projects Agro-School Management System Attachment Image btn_functions.php unrestricted uploadcode-projects Agro-School Management System
- CVE-2023-3060code-projects Agro-School Management System btn_functions.php doAddQuestion cross site scriptingcode-projects Agro-School Management System
- CVE-2023-3059SourceCodester Online Exam Form Submission update_s6.php sql injectionSourceCodester Online Exam Form Submission
- CVE-2023-305807FLY CRM User Profile cross site scripting07FLY CRM
- CVE-2023-3031Prestahop module King-Avis - Path traversalWebbax King-Avis
- CVE-2023-3057YFCMF Ajax.php path traversalYFCMF
- CVE-2023-3033Mobatime web application - broken authorisation mechanismsMobatime web application
- CVE-2023-3056YFCMF index.php path traversalYFCMF
- CVE-2023-1159The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via service titles in versions up to, and including, 21.5 due tladela WordPress Online Booking and Scheduling Plugin – Boo…
- CVE-2023-2835WP Directory Kit <= 1.2.3 - Reflected Cross-Site Scripting via 'search'wpdirectorykit WP Directory Kit
- CVE-2023-2063Information disclosure, tampering, deletion and destruction vulnerability in MELSEC iQ-R Series / iQ-F Series EtherNet/IP ModulesMitsubishi Electric MELSEC iQ-R Series EtherNet/IP module R…
- CVE-2023-2062Information Disclosure vulnerability in EtherNet/IP Configuration toolsMitsubishi Electric EtherNet/IP Configuration tool for RJ71…
- CVE-2023-2061Authentication bypass vulnerability in MELSEC iQ-R Series / iQ-F Series EtherNet/IP ModulesMitsubishi Electric MELSEC iQ-R Series EtherNet/IP module R…
- CVE-2022-24695Bluetooth Classic in Bluetooth Core Specification through 5.3 does not properly conceal device information for Bluetooth transceivers in Non
- CVE-2023-0430Certificate OCSP revocation status was not checked when verifying S/Mime signatures.Mozilla Thunderbird
- CVE-2023-0547OCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be acceMozilla Thunderbird
- CVE-2023-0616If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and display the message, Mozilla Thunderbird
- CVE-2023-1945Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash.Mozilla Thunderbird · Mozilla Firefox ESR
- CVE-2023-23597Logic bug in process allocation allowed to read arbitrary filesMozilla Firefox
- CVE-2023-23598Arbitrary file read from GTK drag and drop on LinuxMozilla Firefox · Mozilla Thunderbird
- CVE-2023-23599Malicious command could be hidden in devtools output on WindowsMozilla Firefox · Mozilla Thunderbird
- CVE-2023-23600Notification permissions persisted between Normal and Private Browsing on AndroidMozilla Firefox
- CVE-2023-23601URL being dragged from cross-origin iframe into same tab triggers navigationMozilla Firefox · Mozilla Thunderbird
- CVE-2023-23602Content Security Policy wasn't being correctly applied to WebSockets in WebWorkersMozilla Firefox · Mozilla Thunderbird
- CVE-2023-23603Calls to console.log allowed bypassing Content Security Policy via format directiveMozilla Firefox · Mozilla Thunderbird
- CVE-2023-23604Creation of duplicate SystemPrincipal from less secure contextsMozilla Firefox
- CVE-2023-25728The <code>Content-Security-Policy-Report-Only</code> header could allow an attacker to leak a child iframe's unredacted URI when interactionMozilla Firefox · Mozilla Thunderbird
- CVE-2023-25730A background script invoking <code>requestFullscreen</code> and then blocking the main thread could force the browser into fullscreen mode iMozilla Firefox · Mozilla Thunderbird
- CVE-2023-25738Members of the <code>DEVMODEW</code> struct set by the printer device driver weren't being validated and could have resulted in invalid valuMozilla Firefox · Mozilla Thunderbird
- CVE-2023-25741When dragging and dropping an image cross-origin, the image's size could potentially be leaked.Mozilla Firefox
- CVE-2023-25742When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash.Mozilla Firefox · Mozilla Thunderbird
- CVE-2023-25743A lack of in app notification for entering fullscreen mode could have lead to a malicious website spoofing browser chrome.<br>*This bug onlyMozilla Firefox
- CVE-2023-25744Mmemory safety bugs present in Firefox 109 and Firefox ESR 102.7.Mozilla Firefox
- CVE-2023-25748By displaying a prompt with a long description, the fullscreen notification could have been hidden, resulting in potential user confusion orMozilla Firefox
- CVE-2023-25749Android applications with unpatched vulnerabilities can be launched from a browser using Intents, exposing users to these vulnerabilities.Mozilla Firefox
- CVE-2023-25750Under certain circumstances, a ServiceWorker's offline cache may have leaked to the file system when using private browsing mode.Mozilla Firefox
- CVE-2023-25751Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritten incorrectly.Mozilla Firefox · Mozilla Thunderbird
- CVE-2023-25752When accessing throttled streams, the count of available bytes needed to be checked in the calling function to be within bounds.Mozilla Firefox · Mozilla Thunderbird
- CVE-2023-25780Status Internet Co.,Ltd. PowerBPM - Broken Access ControlStatus Internet Co. PowerBPM
- CVE-2023-28159The fullscreen notification could have been hidden on Firefox for Android by using download popups, resulting in potential user confusion orMozilla Firefox
- CVE-2023-28160When following a redirect to a publicly accessible web extension file, the URL may have been translated to the actual local path, leaking poMozilla Firefox
- CVE-2023-28163When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would hMozilla Firefox · Mozilla Thunderbird
- CVE-2023-28164Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website spoofing attacks.Mozilla Firefox · Mozilla Thunderbird
- CVE-2023-28469An issue was discovered in the Arm Mali GPU Kernel Driver.
- CVE-2023-28700ITPison OMICARD EDM - Arbitrary File UploadITPison OMICARD EDM
- CVE-2023-28705Openfind Mail2000 - XSS (Reflected Cross-site scripting)Openfind Mail2000
- CVE-2023-29533A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscreen requests, <code>winMozilla Firefox · Mozilla Focus for Android +1
- CVE-2023-29535Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced.Mozilla Firefox · Mozilla Focus for Android +1
- CVE-2023-29536An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertioMozilla Firefox · Mozilla Focus for Android +1
- CVE-2023-29537Multiple race conditions in the font initialization could have led to memory corruption and execution of attacker-controlled code.Mozilla Firefox for Android · Mozilla Firefox +1
- CVE-2023-29538Under specific circumstances a WebExtension may have received a <code>jar:file:///</code> URI instead of a <code>moz-extension:///</code> URMozilla Firefox for Android · Mozilla Firefox +1
- CVE-2023-29539When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL chaMozilla Firefox · Mozilla Focus for Android +1
- CVE-2023-29540Using a redirect embedded into <code>sourceMappingUrls</code> could allow for navigation to external protocol links in sandboxed iframes witMozilla Firefox for Android · Mozilla Firefox +1
- CVE-2023-29544If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused memory corruption and aMozilla Firefox for Android · Mozilla Firefox +1
- CVE-2023-29547When a secure cookie existed in the Firefox cookie jar an insecure cookie for the same domain could have been created, when it should have sMozilla Firefox for Android · Mozilla Firefox +1
- CVE-2023-29548A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result.Mozilla Firefox · Mozilla Focus for Android +1
- CVE-2023-29549Under certain circumstances, a call to the <code>bind</code> function may have resulted in the incorrect realm.Mozilla Firefox for Android · Mozilla Firefox +1
- CVE-2023-29725The BT21 x BTS Wallpaper app 12 for Android allows unauthorized applications to actively request permission to insert data into the database
- CVE-2023-3067Cross-site Scripting (XSS) - Stored in zadam/triliumzadam/trilium
- CVE-2023-3073Cross-site Scripting (XSS) - Stored in tsolucio/corebostsolucio/corebos
- CVE-2023-32205In multiple cases browser prompts could have been obscured by popups controlled by content.Mozilla Firefox · Mozilla Thunderbird
- CVE-2023-32206An out-of-bound read could have led to a crash in the RLBox Expat driver.Mozilla Firefox · Mozilla Thunderbird
- CVE-2023-32211A type checking bug would have led to invalid code being compiled.Mozilla Firefox · Mozilla Thunderbird
- CVE-2023-32212An attacker could have positioned a `datalist` element to obscure the address bar.Mozilla Firefox · Mozilla Thunderbird
- CVE-2023-32213When reading a file, an uninitialized value could have been used as read limit.Mozilla Firefox · Mozilla Thunderbird
- CVE-2023-32215Mozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian Hengst, Andrew McCreight and the MozillaMozilla Firefox · Mozilla Thunderbird
- CVE-2023-33717mp4v2 v2.1.3 was discovered to contain a memory leak when a method calling MP4File::ReadBytes() had allocated memory but did not catch excep
- CVE-2023-33731Reflected Cross Site Scripting (XSS) in the view dashboard detail feature in Microworld Technologies eScan management console 14.0.1400.2281
- CVE-2023-33761eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the compo
- CVE-2023-33763eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the compo