# CVEs published 2023-06-02

141 CVEs were published on June 2, 2023: 15 critical, 47 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2023-2781](https://cve.now/CVE-2023-2781.md): User Email Verification for WooCommerce \<= 3.5.0 - Authentication Bypass (CVSS 8.1, sandeepsoni214 User Email Verification for WooCommerce)
- [CVE-2023-3053](https://cve.now/CVE-2023-3053.md): Page Builder by AZEXO \<= 1.27.133 - Missing Authorization to Post Creation (CVSS 5.4, Page Builder with Image Map by AZEXO)
- [CVE-2023-3052](https://cve.now/CVE-2023-3052.md): Page Builder by AZEXO \<= 1.27.133 - Cross-Site Request Forgery to Post Creation/Modification/Deletion (CVSS 6.3, Page Builder with Image Map by AZEXO)
- [CVE-2023-3055](https://cve.now/CVE-2023-3055.md): Page Builder by AZEXO \<= 1.27.133 - Cross-Site Request Forgery to Stored Cross-Site Scripting via azh\_save (CVSS 6.1, Page Builder with Image Map by AZEXO)
- [CVE-2023-3051](https://cve.now/CVE-2023-3051.md): Page Builder by AZEXO \<= 1.27.133 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, Page Builder with Image Map by AZEXO)
- [CVE-2023-1297](https://cve.now/CVE-2023-1297.md): Consul Cluster Peering can Result in Denial of Service (CVSS 4.9, HashiCorp Consul · github.com/hashicorp/consul)
- [CVE-2023-2816](https://cve.now/CVE-2023-2816.md): Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner (CVSS 8.7, HashiCorp Consul · github.com/hashicorp/consul)
- [CVE-2023-3044](https://cve.now/CVE-2023-3044.md): Divide-by-zero in Xpdf 4.04 due to very large page size (CVSS 3.3, Xpdf)
- [CVE-2023-2687](https://cve.now/CVE-2023-2687.md): Buffer overflow in Platform CLI component in Silicon Labs Gecko SDK v4.2.1 and earlier allows user to overwrite limited structures on the he (CVSS 2.9, silabs.com Gecko SDK)
- [CVE-2023-3068](https://cve.now/CVE-2023-3068.md): Campcodes Retro Cellphone Online Store modal\_add\_product.php sql injection (CVSS 6.3, Campcodes Retro Cellphone Online Store)
- [CVE-2023-34094](https://cve.now/CVE-2023-34094.md): ChuanhuChatGPT vulnerable to unauthorized configuration file access (CVSS 7.5, GaiZhenbiao ChuanhuChatGPT)
- [CVE-2023-3062](https://cve.now/CVE-2023-3062.md): code-projects Agro-School Management System index.php sql injection (CVSS 6.3, code-projects Agro-School Management System)
- [CVE-2023-3061](https://cve.now/CVE-2023-3061.md): code-projects Agro-School Management System Attachment Image btn\_functions.php unrestricted upload (CVSS 6.3, code-projects Agro-School Management System)
- [CVE-2023-3060](https://cve.now/CVE-2023-3060.md): code-projects Agro-School Management System btn\_functions.php doAddQuestion cross site scripting (CVSS 3.5, code-projects Agro-School Management System)
- [CVE-2023-3059](https://cve.now/CVE-2023-3059.md): SourceCodester Online Exam Form Submission update\_s6.php sql injection (CVSS 6.3, SourceCodester Online Exam Form Submission)
- [CVE-2023-3058](https://cve.now/CVE-2023-3058.md): 07FLY CRM User Profile cross site scripting (CVSS 3.5, 07FLY CRM)
- [CVE-2023-3031](https://cve.now/CVE-2023-3031.md): Prestahop module King-Avis - Path traversal (CVSS 4.9, Webbax King-Avis)
- [CVE-2023-3057](https://cve.now/CVE-2023-3057.md): YFCMF Ajax.php path traversal (CVSS 4.3, YFCMF)
- [CVE-2023-3033](https://cve.now/CVE-2023-3033.md): Mobatime web application - broken authorisation mechanisms (CVSS 6.8, Mobatime web application)
- [CVE-2023-3032](https://cve.now/CVE-2023-3032.md): Mobatime web application - Arbitrary file upload (RCE) (CVSS 8.1, Mobatime web application)
- [CVE-2023-3056](https://cve.now/CVE-2023-3056.md): YFCMF index.php path traversal (CVSS 4.3, YFCMF)
- [CVE-2023-3000](https://cve.now/CVE-2023-3000.md): SQLi in Erikoglu Technology's ErMon (CVSS 9.8, Erikoglu Technology ErMon)
- [CVE-2023-1159](https://cve.now/CVE-2023-1159.md): The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via service titles in versions up to, and including, 21.5 due t (CVSS 4.0, ladela WordPress Online Booking and Scheduling Plugin – Boo…)
- [CVE-2023-2835](https://cve.now/CVE-2023-2835.md): WP Directory Kit \<= 1.2.3 - Reflected Cross-Site Scripting via 'search' (CVSS 6.1, wpdirectorykit WP Directory Kit)
- [CVE-2023-2063](https://cve.now/CVE-2023-2063.md): Information disclosure, tampering, deletion and destruction vulnerability in MELSEC iQ-R Series / iQ-F Series EtherNet/IP Modules (CVSS 6.3, Mitsubishi Electric MELSEC iQ-R Series EtherNet/IP module R…)
- [CVE-2023-2062](https://cve.now/CVE-2023-2062.md): Information Disclosure vulnerability in EtherNet/IP Configuration tools (CVSS 6.2, Mitsubishi Electric EtherNet/IP Configuration tool for RJ71…)
- [CVE-2023-2061](https://cve.now/CVE-2023-2061.md): Authentication bypass vulnerability in MELSEC iQ-R Series / iQ-F Series EtherNet/IP Modules (CVSS 6.2, Mitsubishi Electric MELSEC iQ-R Series EtherNet/IP module R…)
- [CVE-2023-2060](https://cve.now/CVE-2023-2060.md): Authentication bypass vulnerability in MELSEC iQ-R Series / iQ-F Series EtherNet/IP Modules (CVSS 7.5, Mitsubishi Electric MELSEC iQ-R Series EtherNet/IP module R…)
- [CVE-2023-2201](https://cve.now/CVE-2023-2201.md): Web Directory Free \<= 1.6.8 - Authenticated (Contributor+) SQL Injection via post\_id (CVSS 8.8, mihail-chepovskiy Web Directory Free)
- [CVE-2022-24695](https://cve.now/CVE-2022-24695.md): Bluetooth Classic in Bluetooth Core Specification through 5.3 does not properly conceal device information for Bluetooth transceivers in Non (CVSS 4.3)
- [CVE-2022-45938](https://cve.now/CVE-2022-45938.md): An issue was discovered in Comcast Defined Technologies microeisbss through 2021. (CVSS 8.0)
- [CVE-2022-46307](https://cve.now/CVE-2022-46307.md): SGUDA U-Lock - Broken Access Control (CVSS 8.8, SGUDA U-Lock)
- [CVE-2022-46308](https://cve.now/CVE-2022-46308.md): SGUDA U-Lock - Broken Access Control (CVSS 8.8, SGUDA U-Lock)
- [CVE-2022-47616](https://cve.now/CVE-2022-47616.md): Hitron Technologies Inc. CODA-5310 - Remote Command Execution (CVSS 7.2, Hitron Technologies Hitron CODA-5310)
- [CVE-2022-47617](https://cve.now/CVE-2022-47617.md): Hitron Technologies Inc. CODA-5310 - Hard-coded Cryptographic Key (CVSS 7.2, Hitron Technologies Hitron CODA-5310)
- [CVE-2023-0430](https://cve.now/CVE-2023-0430.md): Certificate OCSP revocation status was not checked when verifying S/Mime signatures. (CVSS 6.5, Mozilla Thunderbird)
- [CVE-2023-0547](https://cve.now/CVE-2023-0547.md): OCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be acce (CVSS 6.5, Mozilla Thunderbird)
- [CVE-2023-0616](https://cve.now/CVE-2023-0616.md): If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and display the message, (CVSS 6.5, Mozilla Thunderbird)
- [CVE-2023-0767](https://cve.now/CVE-2023-0767.md): An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-1945](https://cve.now/CVE-2023-1945.md): Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash. (CVSS 6.5, Mozilla Thunderbird · Mozilla Firefox ESR)
- [CVE-2023-23597](https://cve.now/CVE-2023-23597.md): Logic bug in process allocation allowed to read arbitrary files (no CVSS, Mozilla Firefox)
- [CVE-2023-23598](https://cve.now/CVE-2023-23598.md): Arbitrary file read from GTK drag and drop on Linux (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-23599](https://cve.now/CVE-2023-23599.md): Malicious command could be hidden in devtools output on Windows (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-23600](https://cve.now/CVE-2023-23600.md): Notification permissions persisted between Normal and Private Browsing on Android (no CVSS, Mozilla Firefox)
- [CVE-2023-23601](https://cve.now/CVE-2023-23601.md): URL being dragged from cross-origin iframe into same tab triggers navigation (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-23602](https://cve.now/CVE-2023-23602.md): Content Security Policy wasn't being correctly applied to WebSockets in WebWorkers (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-23603](https://cve.now/CVE-2023-23603.md): Calls to console.log allowed bypassing Content Security Policy via format directive (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-23604](https://cve.now/CVE-2023-23604.md): Creation of duplicate SystemPrincipal from less secure contexts (CVSS 6.5, Mozilla Firefox)
- [CVE-2023-23605](https://cve.now/CVE-2023-23605.md): Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7 (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-23606](https://cve.now/CVE-2023-23606.md): Memory safety bugs fixed in Firefox 109 (CVSS 8.8, Mozilla Firefox)
- [CVE-2023-25728](https://cve.now/CVE-2023-25728.md): The \<code\>Content-Security-Policy-Report-Only\</code\> header could allow an attacker to leak a child iframe's unredacted URI when interaction (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-25729](https://cve.now/CVE-2023-25729.md): Permission prompts for opening external schemes were only shown for \<code\>ContentPrincipals\</code\> resulting in extensions being able to ope (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-25730](https://cve.now/CVE-2023-25730.md): A background script invoking \<code\>requestFullscreen\</code\> and then blocking the main thread could force the browser into fullscreen mode i (CVSS 5.4, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-25731](https://cve.now/CVE-2023-25731.md): Due to URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially be used to overwrite (CVSS 8.8, Mozilla Firefox)
- [CVE-2023-25732](https://cve.now/CVE-2023-25732.md): When encoding data from an \<code\>inputStream\</code\> in \<code\>xpcom\</code\> the size of the input being encoded was not correctly calculated p (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-25734](https://cve.now/CVE-2023-25734.md): After downloading a Windows \<code\>.url\</code\> shortcut from the local filesystem, an attacker could supply a remote path that would lead to (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-25735](https://cve.now/CVE-2023-25735.md): Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-25737](https://cve.now/CVE-2023-25737.md): An invalid downcast from \<code\>nsTextNode\</code\> to \<code\>SVGElement\</code\> could have lead to undefined behavior. (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-25738](https://cve.now/CVE-2023-25738.md): Members of the \<code\>DEVMODEW\</code\> struct set by the printer device driver weren't being validated and could have resulted in invalid valu (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-25739](https://cve.now/CVE-2023-25739.md): Module load requests that failed were not being checked as to whether or not they were cancelled causing a use-after-free in \<code\>ScriptLoa (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-25740](https://cve.now/CVE-2023-25740.md): After downloading a Windows \<code\>.scf\</code\> script from the local filesystem, an attacker could supply a remote path that would lead to un (CVSS 8.8, Mozilla Firefox)
- [CVE-2023-25741](https://cve.now/CVE-2023-25741.md): When dragging and dropping an image cross-origin, the image's size could potentially be leaked. (CVSS 6.5, Mozilla Firefox)
- [CVE-2023-25742](https://cve.now/CVE-2023-25742.md): When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-25743](https://cve.now/CVE-2023-25743.md): A lack of in app notification for entering fullscreen mode could have lead to a malicious website spoofing browser chrome.\<br\>\*This bug only (no CVSS, Mozilla Firefox)
- [CVE-2023-25744](https://cve.now/CVE-2023-25744.md): Mmemory safety bugs present in Firefox 109 and Firefox ESR 102.7. (no CVSS, Mozilla Firefox)
- [CVE-2023-25745](https://cve.now/CVE-2023-25745.md): Memory safety bugs present in Firefox 109. (CVSS 8.8, Mozilla Firefox)
- [CVE-2023-25746](https://cve.now/CVE-2023-25746.md): Memory safety bugs present in Firefox ESR 102.7. (CVSS 8.8, Mozilla Thunderbird · Mozilla Firefox ESR)
- [CVE-2023-25748](https://cve.now/CVE-2023-25748.md): By displaying a prompt with a long description, the fullscreen notification could have been hidden, resulting in potential user confusion or (CVSS 4.3, Mozilla Firefox)
- [CVE-2023-25749](https://cve.now/CVE-2023-25749.md): Android applications with unpatched vulnerabilities can be launched from a browser using Intents, exposing users to these vulnerabilities. (CVSS 4.3, Mozilla Firefox)
- [CVE-2023-25750](https://cve.now/CVE-2023-25750.md): Under certain circumstances, a ServiceWorker's offline cache may have leaked to the file system when using private browsing mode. (CVSS 4.3, Mozilla Firefox)
- [CVE-2023-25751](https://cve.now/CVE-2023-25751.md): Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritten incorrectly. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-25752](https://cve.now/CVE-2023-25752.md): When accessing throttled streams, the count of available bytes needed to be checked in the calling function to be within bounds. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-25780](https://cve.now/CVE-2023-25780.md): Status Internet Co.,Ltd. PowerBPM - Broken Access Control (CVSS 5.7, Status Internet Co. PowerBPM)
- [CVE-2023-27744](https://cve.now/CVE-2023-27744.md): An issue was discovered in South River Technologies TitanFTP NextGen server that allows for a vertical privilege escalation leading to remot (CVSS 7.8)
- [CVE-2023-27745](https://cve.now/CVE-2023-27745.md): An issue in South River Technologies TitanFTP Before v2.0.1.2102 allows attackers with low-level privileges to perform Administrative action (CVSS 8.8)
- [CVE-2023-28159](https://cve.now/CVE-2023-28159.md): The fullscreen notification could have been hidden on Firefox for Android by using download popups, resulting in potential user confusion or (CVSS 4.3, Mozilla Firefox)
- [CVE-2023-28160](https://cve.now/CVE-2023-28160.md): When following a redirect to a publicly accessible web extension file, the URL may have been translated to the actual local path, leaking po (CVSS 6.5, Mozilla Firefox)
- [CVE-2023-28161](https://cve.now/CVE-2023-28161.md): If temporary "one-time" permissions, such as the ability to use the Camera, were granted to a document loaded using a file: URL, that permis (CVSS 8.8, Mozilla Firefox)
- [CVE-2023-28162](https://cve.now/CVE-2023-28162.md): While implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type. (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-28163](https://cve.now/CVE-2023-28163.md): When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would h (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-28164](https://cve.now/CVE-2023-28164.md): Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website spoofing attacks. (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-28176](https://cve.now/CVE-2023-28176.md): Memory safety bugs present in Firefox 110 and Firefox ESR 102.8. (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-28177](https://cve.now/CVE-2023-28177.md): Memory safety bugs present in Firefox 110. (CVSS 8.8, Mozilla Firefox)
- [CVE-2023-28469](https://cve.now/CVE-2023-28469.md): An issue was discovered in the Arm Mali GPU Kernel Driver. (CVSS 5.5)
- [CVE-2023-28698](https://cve.now/CVE-2023-28698.md): WADE DIGITAL DESIGN CO, LTD. FANTSY - Broken Acesss Control (CVSS 9.8, WADE DIGITAL DESIGN CO FANTSY)
- [CVE-2023-28699](https://cve.now/CVE-2023-28699.md): WADE DIGITAL DESIGN CO, LTD. FANTSY - Arbitrary File Upload (CVSS 8.8, WADE DIGITAL DESIGN CO FANTSY)
- [CVE-2023-28700](https://cve.now/CVE-2023-28700.md): ITPison OMICARD EDM - Arbitrary File Upload (CVSS 6.8, ITPison OMICARD EDM)
- [CVE-2023-28701](https://cve.now/CVE-2023-28701.md): ELITE Web Fax - SQL Injection (CVSS 9.8, ELITE Web Fax)
- [CVE-2023-28702](https://cve.now/CVE-2023-28702.md): ASUS RT-AC86U - Command Injection (CVSS 8.8, ASUS RT-AC86U)
- [CVE-2023-28703](https://cve.now/CVE-2023-28703.md): ASUS RT-AC86U - Buffer Overflow (CVSS 7.2, ASUS RT-AC86U)
- [CVE-2023-28704](https://cve.now/CVE-2023-28704.md): Furbo dog camera - Command Injection (CVSS 8.8, Furbo dog camera fireware)
- [CVE-2023-28705](https://cve.now/CVE-2023-28705.md): Openfind Mail2000 - XSS (Reflected Cross-site scripting) (CVSS 5.4, Openfind Mail2000)
- [CVE-2023-29533](https://cve.now/CVE-2023-29533.md): A website could have obscured the fullscreen notification by using a combination of \<code\>window.open\</code\>, fullscreen requests, \<code\>win (no CVSS, Mozilla Firefox · Mozilla Focus for Android +1)
- [CVE-2023-29535](https://cve.now/CVE-2023-29535.md): Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. (no CVSS, Mozilla Firefox · Mozilla Focus for Android +1)
- [CVE-2023-29536](https://cve.now/CVE-2023-29536.md): An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertio (no CVSS, Mozilla Firefox · Mozilla Focus for Android +1)
- [CVE-2023-29537](https://cve.now/CVE-2023-29537.md): Multiple race conditions in the font initialization could have led to memory corruption and execution of attacker-controlled code. (no CVSS, Mozilla Firefox for Android · Mozilla Firefox +1)
- [CVE-2023-29538](https://cve.now/CVE-2023-29538.md): Under specific circumstances a WebExtension may have received a \<code\>jar:file:///\</code\> URI instead of a \<code\>moz-extension:///\</code\> UR (no CVSS, Mozilla Firefox for Android · Mozilla Firefox +1)
- [CVE-2023-29539](https://cve.now/CVE-2023-29539.md): When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL cha (no CVSS, Mozilla Firefox · Mozilla Focus for Android +1)
- [CVE-2023-29540](https://cve.now/CVE-2023-29540.md): Using a redirect embedded into \<code\>sourceMappingUrls\</code\> could allow for navigation to external protocol links in sandboxed iframes wit (no CVSS, Mozilla Firefox for Android · Mozilla Firefox +1)
- [CVE-2023-29541](https://cve.now/CVE-2023-29541.md): Firefox did not properly handle downloads of files ending in \<code\>.desktop\</code\>, which can be interpreted to run attacker-controlled comm (CVSS 8.8, Mozilla Firefox · Mozilla Focus for Android +1)
- [CVE-2023-29543](https://cve.now/CVE-2023-29543.md): An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object's debugger vect (CVSS 8.8, Mozilla Firefox for Android · Mozilla Firefox +1)
- [CVE-2023-29544](https://cve.now/CVE-2023-29544.md): If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused memory corruption and a (CVSS 6.5, Mozilla Firefox for Android · Mozilla Firefox +1)
- [CVE-2023-29547](https://cve.now/CVE-2023-29547.md): When a secure cookie existed in the Firefox cookie jar an insecure cookie for the same domain could have been created, when it should have s (CVSS 6.5, Mozilla Firefox for Android · Mozilla Firefox +1)
- [CVE-2023-29548](https://cve.now/CVE-2023-29548.md): A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. (CVSS 6.5, Mozilla Firefox · Mozilla Focus for Android +1)
- [CVE-2023-29549](https://cve.now/CVE-2023-29549.md): Under certain circumstances, a call to the \<code\>bind\</code\> function may have resulted in the incorrect realm. (CVSS 6.5, Mozilla Firefox for Android · Mozilla Firefox +1)
- [CVE-2023-29550](https://cve.now/CVE-2023-29550.md): Memory safety bugs present in Firefox 111 and Firefox ESR 102.9. (CVSS 8.8, Mozilla Firefox · Mozilla Focus for Android +1)
- [CVE-2023-29551](https://cve.now/CVE-2023-29551.md): Memory safety bugs present in Firefox 111. (CVSS 8.8, Mozilla Firefox for Android · Mozilla Firefox +1)
- [CVE-2023-29724](https://cve.now/CVE-2023-29724.md): The BT21 x BTS Wallpaper app 12 for Android allows unauthorized apps to actively request permission to modify data in the database that reco (CVSS 7.8)
- [CVE-2023-29725](https://cve.now/CVE-2023-29725.md): The BT21 x BTS Wallpaper app 12 for Android allows unauthorized applications to actively request permission to insert data into the database (CVSS 5.5)
- [CVE-2023-29746](https://cve.now/CVE-2023-29746.md): An issue found in The Thaiger v.1.2 for Android allows unauthorized apps to cause a code execution attack by manipulating the SharedPreferen (CVSS 9.8)
- [CVE-2023-30149](https://cve.now/CVE-2023-30149.md): SQL injection vulnerability in the City Autocomplete (cityautocomplete) module from ebewe.net for PrestaShop, prior to version 1.8.12 (for P (CVSS 9.8)
- [CVE-2023-30602](https://cve.now/CVE-2023-30602.md): Hitron Technologies Inc. CODA-5310 - Insecure service Telnet (CVSS 7.5, Hitron Technologies Hitron CODA-5310)
- [CVE-2023-30603](https://cve.now/CVE-2023-30603.md): Hitron Technologies Inc. CODA-5310 - Using default credentials (CVSS 9.8, Hitron Technologies Hitron CODA-5310)
- [CVE-2023-30604](https://cve.now/CVE-2023-30604.md): Hitron Technologies Inc. CODA-5310 - Broken Access Control (CVSS 9.8, Hitron Technologies Hitron CODA-5310)
- [CVE-2023-3067](https://cve.now/CVE-2023-3067.md): Cross-site Scripting (XSS) - Stored in zadam/trilium (CVSS 4.6, zadam/trilium)
- [CVE-2023-3069](https://cve.now/CVE-2023-3069.md): Unverified Password Change in tsolucio/corebos (CVSS 7.6, tsolucio/corebos)
- [CVE-2023-3070](https://cve.now/CVE-2023-3070.md): Cross-site Scripting (XSS) - Stored in tsolucio/corebos (CVSS 7.6, tsolucio/corebos)
- [CVE-2023-3071](https://cve.now/CVE-2023-3071.md): Cross-site Scripting (XSS) - Stored in tsolucio/corebos (CVSS 7.5, tsolucio/corebos)
- [CVE-2023-3073](https://cve.now/CVE-2023-3073.md): Cross-site Scripting (XSS) - Stored in tsolucio/corebos (CVSS 6.5, tsolucio/corebos)
- [CVE-2023-3074](https://cve.now/CVE-2023-3074.md): Cross-site Scripting (XSS) - Stored in tsolucio/corebos (CVSS 8.6, tsolucio/corebos)
- [CVE-2023-3075](https://cve.now/CVE-2023-3075.md): Cross-Site Request Forgery (CSRF) in tsolucio/corebos (CVSS 7.5, tsolucio/corebos)
- [CVE-2023-32205](https://cve.now/CVE-2023-32205.md): In multiple cases browser prompts could have been obscured by popups controlled by content. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-32206](https://cve.now/CVE-2023-32206.md): An out-of-bound read could have led to a crash in the RLBox Expat driver. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-32207](https://cve.now/CVE-2023-32207.md): A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permissions. (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-32211](https://cve.now/CVE-2023-32211.md): A type checking bug would have led to invalid code being compiled. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-32212](https://cve.now/CVE-2023-32212.md): An attacker could have positioned a \`datalist\` element to obscure the address bar. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-32213](https://cve.now/CVE-2023-32213.md): When reading a file, an uninitialized value could have been used as read limit. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-32215](https://cve.now/CVE-2023-32215.md): Mozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian Hengst, Andrew McCreight and the Mozilla (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-33476](https://cve.now/CVE-2023-33476.md): ReadyMedia (MiniDLNA) versions from 1.1.15 up to 1.3.2 is vulnerable to Buffer Overflow. (CVSS 9.8)
- [CVE-2023-33669](https://cve.now/CVE-2023-33669.md): Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the timeZone parameter in the sub\_44db3c function. (CVSS 9.8)
- [CVE-2023-33670](https://cve.now/CVE-2023-33670.md): Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the time parameter in the sub\_4a79ec function. (CVSS 9.8)
- [CVE-2023-33671](https://cve.now/CVE-2023-33671.md): Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the deviceId parameter in the saveParentControlInfo function. (CVSS 9.8)
- [CVE-2023-33672](https://cve.now/CVE-2023-33672.md): Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the shareSpeed parameter in the fromSetWifiGusetBasic function. (CVSS 7.5)
- [CVE-2023-33673](https://cve.now/CVE-2023-33673.md): Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the firewallEn parameter in the formSetFirewallCfg function. (CVSS 9.8)
- [CVE-2023-33675](https://cve.now/CVE-2023-33675.md): Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the time parameter in the get\_parentControl\_list\_Info function. (CVSS 9.8)
- [CVE-2023-33717](https://cve.now/CVE-2023-33717.md): mp4v2 v2.1.3 was discovered to contain a memory leak when a method calling MP4File::ReadBytes() had allocated memory but did not catch excep (CVSS 5.5)
- [CVE-2023-33731](https://cve.now/CVE-2023-33731.md): Reflected Cross Site Scripting (XSS) in the view dashboard detail feature in Microworld Technologies eScan management console 14.0.1400.2281 (CVSS 6.1)
- [CVE-2023-33761](https://cve.now/CVE-2023-33761.md): eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the compo (CVSS 6.1)
- [CVE-2023-33762](https://cve.now/CVE-2023-33762.md): eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a SQL injection vulnerability via the Activity parameter. (CVSS 9.8)
- [CVE-2023-33763](https://cve.now/CVE-2023-33763.md): eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the compo (CVSS 6.1)
- [CVE-2023-34362](https://cve.now/CVE-2023-34362.md): In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL (CVSS 9.8, KEV)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-06-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.