CVEs published June 6, 2023
148 CVEs were published on June 6, 2023: 5 critical, 59 high.
- Published
- 148
- Critical
- 5
- High
- 59
- Medium
- 72
- Low
- 7
- Unrated
- 5
- Now in CISA KEV
- 0
- Fix available
- 24
Most affected products
- Qualcomm Snapdragon
- 32
- Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…
- 20
- Horner Automation Cscape
- 10
- MediaTek MT6768, MT6769, MT6779, MT6781, MT6785, MT6789, MT…
- 5
- MediaTek MT5696, MT5836, MT5838, MT6768, MT6769, MT6779, MT…
- 4
- Canonical Landscape
- 3
- GitLab
- 3
- MediaTek MT5221, MT6789, MT6855, MT6879, MT6895, MT6983, MT…
- 3
- MediaTek MT6789, MT6855, MT8185, MT8195, MT8365, MT8395, MT…
- 3
- Grafana · github.com/grafana/grafana
- 2
Critical 5
- CVE-2023-32550Landscape's Apache server-status is accessible by defaultCanonical Landscape
- CVE-2023-29632PrestaShop jmspagebuilder 3.x is vulnerable to SQL Injection via ajax_jmspagebuilder.php.
- CVE-2023-31569TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection via the setWanCfg function.
- CVE-2023-33532There is a command injection vulnerability in the Netgear R6250 router with Firmware Version 1.0.4.48.
- CVE-2023-34409In Percona Monitoring and Management (PMM) server 2.x before 2.37.1, the authenticate function in auth_server.go does not properly formalize
High 59
- CVE-2023-22833Mandatory control bypass in Lime2com.palantir.lime:lime2
- CVE-2023-33959Verification bypass can cause users into verifying the wrong artifactnotaryproject notation-go · github.com/notaryproject/notati…
- CVE-2023-2801Grafana is an open-source platform for monitoring and observability.Grafana · github.com/grafana/grafana
- CVE-2023-33977Stored cross site scripting (XSS) via unrestricted file upload in Kiwi TCMSkiwitcms Kiwi · kiwitcms
- CVE-2023-34104Regex Injection via Doctype EntitiesNaturalIntelligence fast-xml-parser · fast-xml-parser
- CVE-2023-28653 The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP).Horner Automation Cscape
- CVE-2023-27916 The affected application lacks proper validation of user-supplied data when parsing font files (e.g., FNT).Horner Automation Cscape
- CVE-2023-29503 The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP).Horner Automation Cscape
- CVE-2023-34111Command Injection Vulnerability in `Release PR Merged` Workflow in taosdata/grafanaplugintaosdata grafanaplugin
- CVE-2023-31244 The affected product does not properly validate user-supplied data.Horner Automation Cscape
- CVE-2023-31278Horner Automation Cscape Out-of-bounds ReadHorner Automation Cscape
- CVE-2023-32203Horner Automation Cscape Out-of-bounds WriteHorner Automation Cscape
- CVE-2023-32281 The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP).Horner Automation Cscape
- CVE-2023-32289 The affected application lacks proper validation of user-supplied data when parsing project files (e.g.., CSP).Horner Automation Cscape
- CVE-2023-32539Horner Automation Cscape Out-of-bounds WriteHorner Automation Cscape
- CVE-2023-32545 The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP).Horner Automation Cscape
- CVE-2023-0985Helmholz and MB Connect Line: Account takeover via password reset in multiple productsMB Connect Line mbCONNECT24 · MB Connect Line mymbCONNEC… +2
- CVE-2023-2833ReviewX <= 1.6.13 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege EscalationReviewX – Multi-Criteria Reviews for WooCommerce with Googl…
- CVE-2023-21670Improper Access control in GPU SubsystemQualcomm Snapdragon
- CVE-2023-21669Buffer Over-read in WLAN HOSTQualcomm Snapdragon
- CVE-2023-21661Buffer Over-read in WLAN FirmwareQualcomm Snapdragon
- CVE-2023-21660Buffer Over-read in WLAN FirmwareQualcomm Snapdragon
- CVE-2023-21659Buffer Over-read in WLAN FirmwareQualcomm Snapdragon
- CVE-2023-21658Buffer Over-Read in WLAN FirmwareQualcomm Snapdragon
- CVE-2023-21657Improper Input Validation in AudioQualcomm Snapdragon
- CVE-2023-21656Improper Input Validation in WLAN HOSTQualcomm Snapdragon
- CVE-2023-21632Stack-based Buffer Overflow in Automotive GPUQualcomm Snapdragon
- CVE-2023-21628Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN HALQualcomm Snapdragon
- CVE-2022-40538Reachable assertion in ModemQualcomm Snapdragon
- CVE-2022-40536Improper authentication in ModemQualcomm Snapdragon
- CVE-2022-40529Improper access control in KernelQualcomm Snapdragon
- CVE-2022-40525Information Exposure in Linux Networking FirmwareQualcomm Snapdragon
- CVE-2022-40523Information exposure in KernelQualcomm Snapdragon
- CVE-2022-40522Double free in Linux NetworkingQualcomm Snapdragon
- CVE-2022-40521Improper authorization in ModemQualcomm Snapdragon
- CVE-2022-40507Double free in CoreQualcomm Snapdragon
- CVE-2022-33307Double free in AutomotiveQualcomm Snapdragon
- CVE-2022-33264Stack-based buffer overflow in ModemQualcomm Snapdragon
- CVE-2022-33251Reachable assertion in ModemQualcomm Snapdragon
- CVE-2022-22076Cryptographic issue in CoreQualcomm Snapdragon
- CVE-2022-22060Reachable Assertion in ModemQualcomm Snapdragon
- CVE-2023-30864In Connectivity Service, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…
- CVE-2023-30863In Connectivity Service, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…
- CVE-2022-48438In cp_dump driver, there is a possible out of bounds write due to a missing bounds check.Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…
- CVE-2022-48392In dialer service, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…
- CVE-2022-48390In telephony service, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…
- CVE-2023-2546WP User Switch <= 1.0.2 - Authenticated (Subscriber+) Authentication Bypass via Cookieiqbalrony WP User Switch
- CVE-2023-2132An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 befoGitLab
- CVE-2023-2603A vulnerability was found in libcap.libcap
- CVE-2023-33381A command injection vulnerability was found in the ping functionality of the MitraStar GPT-2741GNAC router (firmware version AR_g5.8_110WVN0
- CVE-2023-33457In Sogou Workflow v0.10.6, memcpy a negtive size in URIParser::parse , may cause buffer-overflow and crash.
- CVE-2023-33530There is a command injection vulnerability in the Tenda G103 Gigabit GPON Terminal with firmware version V1.0.0.5.
- CVE-2023-33533Netgear D6220 with Firmware Version 1.0.0.80, D8500 with Firmware Version 1.0.3.60, R6700 with Firmware Version 1.0.2.26, and R6900 with Fir
- CVE-2023-33569Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via ip/eval/ajax.php?action=update_user.
- CVE-2023-33651An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initia
- CVE-2023-33652Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the componen
- CVE-2023-33653Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the componen
- CVE-2023-33659A heap buffer overflow vulnerability exists in NanoMQ 0.17.2.
- CVE-2023-33747CloudPanel v2.2.2 allows attackers to execute a path traversal.
Medium, low and unrated 84
- CVE-2023-32683URL deny list bypass via oEmbed and image URLs when generating previews in Synapsematrix-org synapse · matrix-synapse
- CVE-2023-32682Improper checks for deactivated users during login in synapsematrix-org synapse · matrix-synapse
- CVE-2023-33958Default `maxSignatureAttempts` in `notation verify` enables an endless data attack in notationnotaryproject notation · github.com/notaryproject/notation
- CVE-2023-33957Denial of service from high number of artifact signatures in notationnotaryproject notation · github.com/notaryproject/notation
- CVE-2023-2183Grafana is an open-source platform for monitoring and observability.Grafana · github.com/grafana/grafana
- CVE-2022-46165Cross-site Scripting (XSS) in Web GUI in syncthingsyncthing · github.com/syncthing/syncthing
- CVE-2023-32551Landscape Open RedirectCanonical Landscape
- CVE-2023-32549Landscape insecure token generationCanonical Landscape
- CVE-2023-30948Retrieval of Attachments to Comments lacks Authorizationcom.palantir.comments:comments
- CVE-2023-20725In preloader, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6779, MT…
- CVE-2023-20724In Bluetooth, there is a possible out of bounds read due to a missing bounds check.MediaTek MT8167, MT8175, MT8183
- CVE-2023-20723In Bluetooth, there is a possible out of bounds read due to a missing bounds check.MediaTek MT8167, MT8175, MT8183
- CVE-2023-20716In wlan, there is a possible out of bounds write due to a missing bounds check.MediaTek MT5221, MT6789, MT6855, MT6879, MT6895, MT6983, MT…
- CVE-2023-20715In wlan, there is a possible out of bounds write due to a missing bounds check.MediaTek MT5221, MT6789, MT6855, MT6879, MT6895, MT6983, MT…
- CVE-2023-20712In wlan, there is a possible out of bounds write due to a missing bounds check.MediaTek MT5221, MT6789, MT6855, MT6879, MT6895, MT6983, MT…
- CVE-2023-20752In keymange, there is a possible out of bounds write due to a missing bounds check.MediaTek MT8167, MT8167S, MT8168, MT8175, MT8195, MT8362A,…
- CVE-2023-20751In keymange, there is a possible out of bounds write due to a missing bounds check.MediaTek MT8167, MT8167S, MT8168, MT8175, MT8195, MT8362A,…
- CVE-2023-20750In swpm, there is a possible out of bounds write due to a race condition.MediaTek MT6835, MT6886, MT6983, MT6985, MT8167, MT8167S, M…
- CVE-2023-20749In swpm, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6789, MT6835, MT6855, MT6879, MT6886, MT6893, MT…
- CVE-2023-20747In vcu, there is a possible memory corruption due to type confusion.MediaTek MT5696, MT5836, MT5838, MT6768, MT6769, MT6779, MT…
- CVE-2023-20746In vcu, there is a possible out of bounds write due to improper locking.MediaTek MT6789, MT6855, MT8167, MT8168, MT8173, MT8185, MT…
- CVE-2023-20745In vcu, there is a possible out of bounds write due to improper locking.MediaTek MT6789, MT6855, MT8185, MT8195, MT8365, MT8395, MT…
- CVE-2023-20744In vcu, there is a possible use after free due to a logic error.MediaTek MT6789, MT6855, MT8185, MT8195, MT8365, MT8395, MT…
- CVE-2023-20743In vcu, there is a possible out of bounds write due to improper locking.MediaTek MT6789, MT6855, MT8185, MT8195, MT8365, MT8395, MT…
- CVE-2023-20742In ril, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6735, MT6737, MT6739, MT6753, MT6757, MT6757C, M…
- CVE-2023-20741In ril, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6735, MT6737, MT6739, MT6753, MT6757, MT6757C, M…
- CVE-2023-20740In vcu, there is a possible memory corruption due to a logic error.MediaTek MT6768, MT6769, MT6779, MT6781, MT6785, MT6789, MT…
- CVE-2023-20739In vcu, there is a possible memory corruption due to a logic error.MediaTek MT6768, MT6769, MT6779, MT6781, MT6785, MT6789, MT…
- CVE-2023-20738In vcu, there is a possible out of bounds write due to a missing bounds check.MediaTek MT5696, MT5836, MT5838, MT6768, MT6769, MT6779, MT…
- CVE-2023-20737In vcu, there is a possible use after free due to improper locking.MediaTek MT6768, MT6769, MT6779, MT6781, MT6785, MT6789, MT…
- CVE-2023-20736In vcu, there is a possible out of bounds write due to a race condition.MediaTek MT6768, MT6769, MT6779, MT6781, MT6785, MT6789, MT…
- CVE-2023-20735In vcu, there is a possible out of bounds write due to a missing bounds check.MediaTek MT5696, MT5836, MT5838, MT6768, MT6769, MT6779, MT…
- CVE-2023-20734In vcu, there is a possible out of bounds write due to a missing bounds check.MediaTek MT5696, MT5836, MT5838, MT6768, MT6769, MT6779, MT…
- CVE-2023-20733In vcu, there is a possible use after free due to improper locking.MediaTek MT6768, MT6769, MT6779, MT6781, MT6785, MT6789, MT…
- CVE-2023-20732In wlan, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6761, MT6762, MT6765, MT6768, MT6769, MT6779, MT…
- CVE-2023-20731In wlan, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6761, MT6762, MT6765, MT6768, MT6769, MT6779, MT…
- CVE-2023-20730In wlan, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6985, MT7902, MT7921, MT8365, MT8518, MT8532
- CVE-2023-20729In wlan, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6985, MT7902, MT7921, MT8365, MT8518, MT8532
- CVE-2023-20728In wlan, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6781, MT6789, MT6833, MT6835, MT6855, MT6877, MT…
- CVE-2023-3121Dahua Smart Parking Management image server-side request forgeryDahua Smart Parking Management
- CVE-2023-3120SourceCodester Service Provider Management System view_service.php sql injectionSourceCodester Service Provider Management System
- CVE-2023-3119SourceCodester Service Provider Management System view.php sql injectionSourceCodester Service Provider Management System
- CVE-2023-1779Helmholz and MB Connect Line: Account takeover via password reset in multiple productsMB Connect Line mbCONNECT24 · MB Connect Line mymbCONNEC… +2
- CVE-2023-20727In wlan, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6789, MT6835, MT6855, MT6879, MT6886, MT6895, MT…
- CVE-2022-40533Untrusted Pointer Dereference in CoreQualcomm Snapdragon
- CVE-2022-33303Uncontrolled resource consumption in Linux kernelQualcomm Snapdragon
- CVE-2022-33267Improper restriction of operations within the bounds of memory buffer in LinuxQualcomm Snapdragon
- CVE-2022-33263Use after free in CoreQualcomm Snapdragon
- CVE-2022-33240Incorrect type conversion or cast in AudioQualcomm Snapdragon
- CVE-2022-33230Buffer copy without checking the size of input in FM HostQualcomm Snapdragon
- CVE-2022-33227Double free in Linux-AndroidQualcomm Snapdragon
- CVE-2022-33226Buffer copy without checking the size of input in CoreQualcomm Snapdragon
- CVE-2022-33224Buffer copy without checking the size of input in CoreQualcomm Snapdragon
- CVE-2023-30915In email service, there is a missing permission check.Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…
- CVE-2023-30914In email service, there is a missing permission check.Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…
- CVE-2023-30866In telephony service, there is a missing permission check.Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…
- CVE-2023-30865In dialer service, there is a missing permission check.Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…
- CVE-2022-48448In telephony service, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…
- CVE-2022-48447In telephony service, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…
- CVE-2022-48446In telephony service, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…
- CVE-2022-48445In telephony service, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…
- CVE-2022-48444In telephony service, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…
- CVE-2022-48443In telephony service, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…
- CVE-2022-48442In dialer service, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…
- CVE-2022-48441In dialer service, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…
- CVE-2022-48440In dialer service, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…
- CVE-2022-48439In cp_dump driver, there is a possible out of bounds write due to a missing bounds check.Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…
- CVE-2022-48391In telephony service, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…
- CVE-2018-25087Arborator Server project.cgi start denial of serviceArborator Server
- CVE-2017-20185Fuzzy SWMP GET Parameter swmp.php cross site scriptingFuzzy SWMP
- CVE-2015-10117Gravity Forms DPS PxPay Plugin cross site scriptingGravity Forms DPS PxPay Plugin
- CVE-2015-10116RealFaviconGenerator Favicon Plugin class-favicon-by-realfavicongenerator-admin.php install_new_favicon cross-site request forgeryRealFaviconGenerator Favicon Plugin
- CVE-2023-0921Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2023-1621An issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.5, all versions starting from 15.11 before GitLab
- CVE-2023-2157A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing.ImageMagick
- CVE-2023-2253A flaw was found in the `/v2/_catalog` endpoint in distribution/distribution, which accepts a parameter to control the maximum number of recdistribution/distribution · github.com/docker/distributi… +1
- CVE-2023-2602A vulnerability was found in the pthread_create() function in libcap.libcap
- CVE-2023-27126The AES Key-IV pair used by the TP-Link TAPO C200 camera V3 (EU) on firmware version 1.1.22 Build 220725 is reused across all cameras.
- CVE-2023-2961A segmentation fault flaw was found in the Advancecomp package.advancecomp
- CVE-2023-31606A Regular Expression Denial of Service (ReDoS) issue was discovered in the sanitize_html function of redcloth gem v4.0.0.RedCloth
- CVE-2023-33460There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function.
- CVE-2023-33477In Harmonic NSG 9000-6G devices, an authenticated remote user can obtain source code by directly requesting a special path.
- CVE-2023-33613axTLS v2.1.5 was discovered to contain a heap buffer overflow in the bi_import function in axtls-code/crypto/bigint.c.
- CVE-2023-33684Weak session management in DB Elettronica Telecomunicazioni SpA SFT DAB 600/C Firmware: 1.9.3 Bios firmware: 7.1 (Apr 19 2021) Gui: 2.46 FPG