# CVEs published 2023-06-05 72 CVEs were published on June 5, 2023: 5 critical, 24 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2023-22450](https://cve.now/CVE-2023-22450.md): In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability that could allow an attacker to upload an A (CVSS 7.2, Advantech WebAccess/SCADA) - [CVE-2023-32540](https://cve.now/CVE-2023-32540.md): In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file overwrite vulnerability, which could allow an attacker to overwrit (CVSS 7.2, Advantech WebAccess/SCADA) - [CVE-2023-32628](https://cve.now/CVE-2023-32628.md): In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability that could allow an attacker to modify th (CVSS 7.2, Advantech WebAccess/SCADA) - [CVE-2023-34102](https://cve.now/CVE-2023-34102.md): Possible unsafe reflection / partial denial of service in avo (CVSS 8.3, avo-hq avo · avo) - [CVE-2023-34103](https://cve.now/CVE-2023-34103.md): Stored XSS (Cross Site Scripting) in html content based fields of avo (CVSS 7.3, avo-hq avo · avo) - [CVE-2013-10030](https://cve.now/CVE-2013-10030.md): Exit Box Lite Plugin wordpress-exit-box-lite.php information disclosure (CVSS 4.3, Exit Box Lite Plugin) - [CVE-2023-3079](https://cve.now/CVE-2023-3079.md): Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, KEV, Google Chrome) - [CVE-2022-48188](https://cve.now/CVE-2022-48188.md): A buffer overflow vulnerability in the SecureBootDXE BIOS driver of some Lenovo Desktop and ThinkStation models could allow an attacker with (CVSS 6.7, Lenovo ThinkStation BIOS) - [CVE-2022-48181](https://cve.now/CVE-2022-48181.md): An ErrorMessage driver stack-based buffer overflow vulnerability in BIOS of some ThinkPad models could allow an attacker with local access t (CVSS 6.7, Lenovo ThinkStation BIOS) - [CVE-2013-10029](https://cve.now/CVE-2013-10029.md): Exit Box Lite Plugin wordpress-exit-box-lite.php exitboxadmin cross-site request forgery (CVSS 4.3, Exit Box Lite Plugin) - [CVE-2022-4569](https://cve.now/CVE-2022-4569.md): A local privilege escalation vulnerability in the ThinkPad Hybrid USB-C with USB-A Dock Firmware Update Tool could allow an attacker with lo (CVSS 7.8, Lenovo ThinkPad Hybrid USB-C with USB-A Dock Firmware Updat…) - [CVE-2023-34097](https://cve.now/CVE-2023-34097.md): Database password exposed in logs in hoppscotch (CVSS 7.8, hoppscotch) - [CVE-2023-33969](https://cve.now/CVE-2023-33969.md): Stored Cross site scripting in the Task External Link Functionality in Kanboard (CVSS 6.4, kanboard) - [CVE-2023-33970](https://cve.now/CVE-2023-33970.md): Missing access control in internal task links feature in Kanboard (CVSS 5.4, kanboard) - [CVE-2023-33968](https://cve.now/CVE-2023-33968.md): Missing Access Control allows User to move and duplicate tasks in Kanboard (CVSS 5.4, kanboard) - [CVE-2023-33956](https://cve.now/CVE-2023-33956.md): Parameter based Indirect Object Referencing leading to private file exposure in Kanboard (CVSS 4.3, kanboard) - [CVE-2023-29344](https://cve.now/CVE-2023-29344.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office 2019 for Mac · Microsoft 365 Apps for E… +1) - [CVE-2015-10115](https://cve.now/CVE-2015-10115.md): WooSidebars Sidebar Manager Converter Plugin class-woosidebars-sbm-converter.php process\_request redirect (CVSS 4.3, WooSidebars Sidebar Manager Converter Plugin) - [CVE-2015-10114](https://cve.now/CVE-2015-10114.md): WooSidebars Plugin class-woo-sidebars.php enable\_custom\_post\_sidebars redirect (CVSS 4.3, WooSidebars Plugin) - [CVE-2015-10113](https://cve.now/CVE-2015-10113.md): WooFramework Tweaks Plugin wooframework-tweaks.php admin\_screen\_logic redirect (CVSS 3.5, WooFramework Tweaks Plugin) - [CVE-2023-2472](https://cve.now/CVE-2023-2472.md): Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue \< 3.1.61 - Reflected XSS (CVSS 6.1, Newsletter, SMTP, Email marketing and Subscribe forms by Se…) - [CVE-2023-2571](https://cve.now/CVE-2023-2571.md): Quiz Maker \< 6.4.2.7 - Reflected XSS (CVSS 6.1, Quiz Maker) - [CVE-2023-2224](https://cve.now/CVE-2023-2224.md): Seo By 10Web \< 1.2.7 - Admin+ Stored XSS (CVSS 4.8, SEO by 10Web) - [CVE-2023-0900](https://cve.now/CVE-2023-0900.md): AP Pricing Tables Lite \<= 1.1.6 - Admin+ SQLi (CVSS 7.2, Pricing Table Builder) - [CVE-2023-2337](https://cve.now/CVE-2023-2337.md): ConvertKit \< 2.2.1 - Reflected XSS (CVSS 6.1, ConvertKit) - [CVE-2023-2634](https://cve.now/CVE-2023-2634.md): Get Your Number \<= 1.1.3 - Admin+ Stored XSS (CVSS 4.8, Get your number) - [CVE-2022-4946](https://cve.now/CVE-2022-4946.md): Frontend Post WordPress Plugin \<= 2.8.4 - Contributor+ Arbitrary Redirect (CVSS 5.4, Frontend Post WordPress Plugin) - [CVE-2023-0152](https://cve.now/CVE-2023-0152.md): WP Multi Store Locator \<= 2.4 - Contributor+ Stored XSS (CVSS 5.4, WP Multi Store Locator) - [CVE-2023-2572](https://cve.now/CVE-2023-2572.md): Survey Maker \< 3.4.7 - Reflected XSS (CVSS 6.1, Survey Maker) - [CVE-2023-2488](https://cve.now/CVE-2023-2488.md): Stop Spammers Security \< 2023 - Reflected XSS (CVSS 6.1, Stop Spammers Security | Block Spam Users, Comments, Forms) - [CVE-2023-2489](https://cve.now/CVE-2023-2489.md): Stop Spammers Security \< 2023 - Admin+ Stored XSS (CVSS 4.8, Stop Spammers Security | Block Spam Users, Comments, Forms) - [CVE-2023-0545](https://cve.now/CVE-2023-0545.md): Hostel \< 1.1.5.2 - Admin+ Stored XSS (CVSS 4.8, Hostel) - [CVE-2023-2503](https://cve.now/CVE-2023-2503.md): 10WebSocial \< 1.2.9 - Reflected XSS (CVSS 6.1, 10Web Social Post Feed) - [CVE-2023-27989](https://cve.now/CVE-2023-27989.md): A buffer overflow vulnerability in the CGI program of the Zyxel NR7101 firmware versions prior to V1.00(ABUV.8)C0 could allow a remote auth (CVSS 6.5, Zyxel NR7101 firmware) - [CVE-2023-3066](https://cve.now/CVE-2023-3066.md): Mobatime mobile application - Broken authorisation (CVSS 8.1, Mobatime mobile application AMXGT100) - [CVE-2023-3065](https://cve.now/CVE-2023-3065.md): Mobatime mobile application - Authentication bypass (CVSS 9.1, Mobatime mobile application AMXGT100) - [CVE-2023-3064](https://cve.now/CVE-2023-3064.md): Mobatime mobile application - Sensitive information disclosure (CVSS 7.5, Mobatime mobile application AMXGT100) - [CVE-2015-10112](https://cve.now/CVE-2015-10112.md): WooFramework Branding Plugin wooframework-branding.php admin\_screen\_logic redirect (CVSS 4.3, WooFramework Branding Plugin) - [CVE-2023-3100](https://cve.now/CVE-2023-3100.md): IBOS del actionDel sql injection (CVSS 5.5, IBOS) - [CVE-2023-3099](https://cve.now/CVE-2023-3099.md): KylinSoft youker-assistant Arbitrary File dbus.SystemBus delete\_file access control (CVSS 4.4, KylinSoft youker-assistant) - [CVE-2023-3098](https://cve.now/CVE-2023-3098.md): KylinSoft youker-assistant restore\_all\_sound\_file path traversal (CVSS 4.4, KylinSoft youker-assistant) - [CVE-2023-3097](https://cve.now/CVE-2023-3097.md): KylinSoft kylin-software-properties setMainSource os command injection (CVSS 5.3, KylinSoft kylin-software-properties) - [CVE-2023-3096](https://cve.now/CVE-2023-3096.md): KylinSoft kylin-software-properties changedSource access control (CVSS 5.3, KylinSoft kylin-software-properties) - [CVE-2023-0636](https://cve.now/CVE-2023-0636.md): Remote Code Execution via Command Injection (CVSS 7.2, ABB ASPECT®-Enterprise · ABB NEXUS Series +1) - [CVE-2023-0635](https://cve.now/CVE-2023-0635.md): Privilege escalation to root (CVSS 7.8, ABB ASPECT®-Enterprise · ABB NEXUS Series +1) - [CVE-2014-125105](https://cve.now/CVE-2014-125105.md): Broken Link Checker Plugin Settings Page core.php options\_page cross site scripting (CVSS 2.4, Broken Link Checker Plugin) - [CVE-2023-0041](https://cve.now/CVE-2023-0041.md): IBM Security Guardium session fixation (CVSS 6.3, IBM Security Guardium) - [CVE-2023-32334](https://cve.now/CVE-2023-32334.md): IBM Maximo Asset Management information disclosure (CVSS 3.7, IBM Maximo Asset Management · IBM Maximo Application Suite) - [CVE-2023-27861](https://cve.now/CVE-2023-27861.md): IBM Maximo Application Suite information disclosure (CVSS 5.9, IBM Maximo Application Suite) - [CVE-2020-19028](https://cve.now/CVE-2020-19028.md): \*File Upload vulnerability found in Emlog EmlogCMS v.6.0.0 allows a remote attacker to gain access to sensitive information via the /admin/p (CVSS 7.5) - [CVE-2023-24510](https://cve.now/CVE-2023-24510.md): On the affected platforms running EOS, a malformed DHCP packet might cause the DHCP relay agent to restart. (CVSS 7.5, Arista Networks Arista EOS) - [CVE-2023-29629](https://cve.now/CVE-2023-29629.md): PrestaShop jmsthemelayout 2.5.5 is vulnerable to SQL Injection via ajax\_jmsvermegamenu.php. (CVSS 9.8) - [CVE-2023-29630](https://cve.now/CVE-2023-29630.md): PrestaShop jmsmegamenu 1.1.x and 2.0.x is vulnerable to SQL Injection via ajax\_jmsmegamenu.php. (CVSS 9.8) - [CVE-2023-29631](https://cve.now/CVE-2023-29631.md): PrestaShop jmsslider 1.6.0 is vulnerable to Incorrect Access Control via ajax\_jmsslider.php. (CVSS 9.8) - [CVE-2023-3027](https://cve.now/CVE-2023-3027.md): The grc-policy-propagator allows security escalation within the cluster. (CVSS 7.8, RHACM) - [CVE-2023-3109](https://cve.now/CVE-2023-3109.md): Cross-site Scripting (XSS) - Stored in admidio/admidio (CVSS 6.3, admidio/admidio) - [CVE-2023-3111](https://cve.now/CVE-2023-3111.md): A use after free vulnerability was found in prepare\_to\_relocate in fs/btrfs/relocation.c in btrfs in the Linux Kernel. (CVSS 7.8, Kernel) - [CVE-2023-31893](https://cve.now/CVE-2023-31893.md): Telefnica Brasil Vivo Play (IPTV) Firmware: 2023.04.04.01.06.15 is vulnerable to Denial of Service (DoS) via DNS Recursion. (CVSS 7.5) - [CVE-2023-32766](https://cve.now/CVE-2023-32766.md): Gitpod before 2022.11.3 allows XSS because redirection can occur for some protocols outside of the trusted set of three (vscode: vscode-insi (CVSS 6.1, github.com/gitpod-io/gitpod) - [CVE-2023-33386](https://cve.now/CVE-2023-33386.md): MarsCTF 1.2.1 has an arbitrary file upload vulnerability in the interface for uploading attachments in the background. (CVSS 9.8) - [CVE-2023-33408](https://cve.now/CVE-2023-33408.md): Minical 1.0.0 is vulnerable to Cross Site Scripting (XSS). (CVSS 5.4) - [CVE-2023-33409](https://cve.now/CVE-2023-33409.md): Minical 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF) via minical/public/application/controllers/settings/company.php. (CVSS 6.5) - [CVE-2023-33410](https://cve.now/CVE-2023-33410.md): Minical 1.0.0 and earlier contains a CSV injection vulnerability which allows an attacker to execute remote code. (CVSS 8.8) - [CVE-2023-33518](https://cve.now/CVE-2023-33518.md): emoncms v11 and later was discovered to contain an information disclosure vulnerability which allows attackers to obtain the web directory p (CVSS 5.3) - [CVE-2023-33524](https://cve.now/CVE-2023-33524.md): Advent/SSC Inc. (CVSS 5.3) - [CVE-2023-33690](https://cve.now/CVE-2023-33690.md): SonicJS up to v0.7.0 allows attackers to execute an authenticated path traversal when an attacker injects special characters into the filena (no CVSS) - [CVE-2023-33693](https://cve.now/CVE-2023-33693.md): A buffer overflow in EasyPlayerPro-Win v3.2.19.0106 to v3.6.19.0823 allows attackers to cause a Denial of Service (DoS) via a crafted XML fi (CVSS 7.8) - [CVE-2023-33733](https://cve.now/CVE-2023-33733.md): Reportlab up to v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file. (CVSS 7.8, reportlab) - [CVE-2023-34407](https://cve.now/CVE-2023-34407.md): OfflinePlayerService.exe in Harbinger Offline Player 4.0.6.0.2 allows directory traversal as LocalSystem via ..\\ in a URL. (CVSS 7.5) - [CVE-2023-34408](https://cve.now/CVE-2023-34408.md): DokuWiki before 2023-04-04a allows XSS via RSS titles. (CVSS 5.4) - [CVE-2023-34410](https://cve.now/CVE-2023-34410.md): An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2. (CVSS 5.3) - [CVE-2023-34411](https://cve.now/CVE-2023-34411.md): The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid \