CVEs published June 5, 2023
72 CVEs were published on June 5, 2023: 5 critical, 24 high. 1 is now in CISA KEV.
- Published
- 72
- Critical
- 5
- High
- 24
- Medium
- 39
- Low
- 3
- Unrated
- 1
- Now in CISA KEV
- 1
- Fix available
- 32
Most affected products
- kanboard
- 4
- Advantech WebAccess/SCADA
- 3
- Mobatime mobile application AMXGT100
- 3
- ABB ASPECT®-Enterprise · ABB NEXUS Series +1
- 2
- avo-hq avo · avo
- 2
- Exit Box Lite Plugin
- 2
- KylinSoft kylin-software-properties
- 2
- KylinSoft youker-assistant
- 2
- Lenovo ThinkStation BIOS
- 2
- Stop Spammers Security | Block Spam Users, Comments, Forms
- 2
Critical 5
- CVE-2023-3065Mobatime mobile application - Authentication bypassMobatime mobile application AMXGT100
- CVE-2023-29629PrestaShop jmsthemelayout 2.5.5 is vulnerable to SQL Injection via ajax_jmsvermegamenu.php.
- CVE-2023-29630PrestaShop jmsmegamenu 1.1.x and 2.0.x is vulnerable to SQL Injection via ajax_jmsmegamenu.php.
- CVE-2023-29631PrestaShop jmsslider 1.6.0 is vulnerable to Incorrect Access Control via ajax_jmsslider.php.
- CVE-2023-33386MarsCTF 1.2.1 has an arbitrary file upload vulnerability in the interface for uploading attachments in the background.
High 24
- CVE-2023-22450 In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability that could allow an attacker to upload an AAdvantech WebAccess/SCADA
- CVE-2023-32540 In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file overwrite vulnerability, which could allow an attacker to overwritAdvantech WebAccess/SCADA
- CVE-2023-32628 In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability that could allow an attacker to modify thAdvantech WebAccess/SCADA
- CVE-2023-34102Possible unsafe reflection / partial denial of service in avoavo-hq avo · avo
- CVE-2023-34103Stored XSS (Cross Site Scripting) in html content based fields of avoavo-hq avo · avo
- CVE-2023-3079Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a craftedGoogle Chrome
- CVE-2022-4569A local privilege escalation vulnerability in the ThinkPad Hybrid USB-C with USB-A Dock Firmware Update Tool could allow an attacker with loLenovo ThinkPad Hybrid USB-C with USB-A Dock Firmware Updat…
- CVE-2023-34097Database password exposed in logs in hoppscotchhoppscotch
- CVE-2023-29344Microsoft Office Remote Code Execution VulnerabilityMicrosoft Office 2019 for Mac · Microsoft 365 Apps for E… +1
- CVE-2023-0900AP Pricing Tables Lite <= 1.1.6 - Admin+ SQLiPricing Table Builder
- CVE-2023-3066Mobatime mobile application - Broken authorisationMobatime mobile application AMXGT100
- CVE-2023-3064Mobatime mobile application - Sensitive information disclosureMobatime mobile application AMXGT100
- CVE-2023-0636Remote Code Execution via Command InjectionABB ASPECT®-Enterprise · ABB NEXUS Series +1
- CVE-2023-0635Privilege escalation to rootABB ASPECT®-Enterprise · ABB NEXUS Series +1
- CVE-2020-19028*File Upload vulnerability found in Emlog EmlogCMS v.6.0.0 allows a remote attacker to gain access to sensitive information via the /admin/p
- CVE-2023-24510On the affected platforms running EOS, a malformed DHCP packet might cause the DHCP relay agent to restart.Arista Networks Arista EOS
- CVE-2023-3027The grc-policy-propagator allows security escalation within the cluster.RHACM
- CVE-2023-3111A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relocation.c in btrfs in the Linux Kernel.Kernel
- CVE-2023-31893Telefnica Brasil Vivo Play (IPTV) Firmware: 2023.04.04.01.06.15 is vulnerable to Denial of Service (DoS) via DNS Recursion.
- CVE-2023-33410Minical 1.0.0 and earlier contains a CSV injection vulnerability which allows an attacker to execute remote code.
- CVE-2023-33693A buffer overflow in EasyPlayerPro-Win v3.2.19.0106 to v3.6.19.0823 allows attackers to cause a Denial of Service (DoS) via a crafted XML fi
- CVE-2023-33733Reportlab up to v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file.reportlab
- CVE-2023-34407OfflinePlayerService.exe in Harbinger Offline Player 4.0.6.0.2 allows directory traversal as LocalSystem via ..\ in a URL.
- CVE-2023-34411The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid <! token (such as <!DOCTYPEs/%<!A nestingxml-rs
Medium, low and unrated 43
- CVE-2013-10030Exit Box Lite Plugin wordpress-exit-box-lite.php information disclosureExit Box Lite Plugin
- CVE-2022-48188A buffer overflow vulnerability in the SecureBootDXE BIOS driver of some Lenovo Desktop and ThinkStation models could allow an attacker withLenovo ThinkStation BIOS
- CVE-2022-48181An ErrorMessage driver stack-based buffer overflow vulnerability in BIOS of some ThinkPad models could allow an attacker with local access tLenovo ThinkStation BIOS
- CVE-2013-10029Exit Box Lite Plugin wordpress-exit-box-lite.php exitboxadmin cross-site request forgeryExit Box Lite Plugin
- CVE-2023-33969Stored Cross site scripting in the Task External Link Functionality in Kanboardkanboard
- CVE-2023-33970Missing access control in internal task links feature in Kanboardkanboard
- CVE-2023-33968Missing Access Control allows User to move and duplicate tasks in Kanboardkanboard
- CVE-2023-33956Parameter based Indirect Object Referencing leading to private file exposure in Kanboardkanboard
- CVE-2015-10115WooSidebars Sidebar Manager Converter Plugin class-woosidebars-sbm-converter.php process_request redirectWooSidebars Sidebar Manager Converter Plugin
- CVE-2015-10114WooSidebars Plugin class-woo-sidebars.php enable_custom_post_sidebars redirectWooSidebars Plugin
- CVE-2015-10113WooFramework Tweaks Plugin wooframework-tweaks.php admin_screen_logic redirectWooFramework Tweaks Plugin
- CVE-2023-2472Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue < 3.1.61 - Reflected XSSNewsletter, SMTP, Email marketing and Subscribe forms by Se…
- CVE-2023-2571Quiz Maker < 6.4.2.7 - Reflected XSSQuiz Maker
- CVE-2023-2224Seo By 10Web < 1.2.7 - Admin+ Stored XSSSEO by 10Web
- CVE-2023-2337ConvertKit < 2.2.1 - Reflected XSSConvertKit
- CVE-2023-2634Get Your Number <= 1.1.3 - Admin+ Stored XSSGet your number
- CVE-2022-4946Frontend Post WordPress Plugin <= 2.8.4 - Contributor+ Arbitrary RedirectFrontend Post WordPress Plugin
- CVE-2023-0152WP Multi Store Locator <= 2.4 - Contributor+ Stored XSSWP Multi Store Locator
- CVE-2023-2572Survey Maker < 3.4.7 - Reflected XSSSurvey Maker
- CVE-2023-2488Stop Spammers Security < 2023 - Reflected XSSStop Spammers Security | Block Spam Users, Comments, Forms
- CVE-2023-2489Stop Spammers Security < 2023 - Admin+ Stored XSSStop Spammers Security | Block Spam Users, Comments, Forms
- CVE-2023-0545Hostel < 1.1.5.2 - Admin+ Stored XSSHostel
- CVE-2023-250310WebSocial < 1.2.9 - Reflected XSS10Web Social Post Feed
- CVE-2023-27989A buffer overflow vulnerability in the CGI program of the Zyxel NR7101 firmware versions prior to V1.00(ABUV.8)C0 could allow a remote authZyxel NR7101 firmware
- CVE-2015-10112WooFramework Branding Plugin wooframework-branding.php admin_screen_logic redirectWooFramework Branding Plugin
- CVE-2023-3100IBOS del actionDel sql injectionIBOS
- CVE-2023-3099KylinSoft youker-assistant Arbitrary File dbus.SystemBus delete_file access controlKylinSoft youker-assistant
- CVE-2023-3098KylinSoft youker-assistant restore_all_sound_file path traversalKylinSoft youker-assistant
- CVE-2023-3097KylinSoft kylin-software-properties setMainSource os command injectionKylinSoft kylin-software-properties
- CVE-2023-3096KylinSoft kylin-software-properties changedSource access controlKylinSoft kylin-software-properties
- CVE-2014-125105Broken Link Checker Plugin Settings Page core.php options_page cross site scriptingBroken Link Checker Plugin
- CVE-2023-0041IBM Security Guardium session fixationIBM Security Guardium
- CVE-2023-32334IBM Maximo Asset Management information disclosureIBM Maximo Asset Management · IBM Maximo Application Suite
- CVE-2023-27861IBM Maximo Application Suite information disclosureIBM Maximo Application Suite
- CVE-2023-3109Cross-site Scripting (XSS) - Stored in admidio/admidioadmidio/admidio
- CVE-2023-32766Gitpod before 2022.11.3 allows XSS because redirection can occur for some protocols outside of the trusted set of three (vscode: vscode-insigithub.com/gitpod-io/gitpod
- CVE-2023-33408Minical 1.0.0 is vulnerable to Cross Site Scripting (XSS).
- CVE-2023-33409Minical 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF) via minical/public/application/controllers/settings/company.php.
- CVE-2023-33518emoncms v11 and later was discovered to contain an information disclosure vulnerability which allows attackers to obtain the web directory p
- CVE-2023-33524Advent/SSC Inc.
- CVE-2023-33690SonicJS up to v0.7.0 allows attackers to execute an authenticated path traversal when an attacker injects special characters into the filena
- CVE-2023-34408DokuWiki before 2023-04-04a allows XSS via RSS titles.
- CVE-2023-34410An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2.