# CVEs published 2023-06-06

148 CVEs were published on June 6, 2023: 5 critical, 59 high. Days are UTC.

- [CVE-2023-22833](https://cve.now/CVE-2023-22833.md): Mandatory control bypass in Lime2 (CVSS 7.6, com.palantir.lime:lime2)
- [CVE-2023-32683](https://cve.now/CVE-2023-32683.md): URL deny list bypass via oEmbed and image URLs when generating previews in Synapse (CVSS 3.5, matrix-org synapse · matrix-synapse)
- [CVE-2023-32682](https://cve.now/CVE-2023-32682.md): Improper checks for deactivated users during login in synapse (CVSS 5.4, matrix-org synapse · matrix-synapse)
- [CVE-2023-33959](https://cve.now/CVE-2023-33959.md): Verification bypass can cause users into verifying the wrong artifact (CVSS 8.4, notaryproject notation-go · github.com/notaryproject/notati…)
- [CVE-2023-33958](https://cve.now/CVE-2023-33958.md): Default \`maxSignatureAttempts\` in \`notation verify\` enables an endless data attack in notation (CVSS 5.4, notaryproject notation · github.com/notaryproject/notation)
- [CVE-2023-33957](https://cve.now/CVE-2023-33957.md): Denial of service from high number of artifact signatures in notation (CVSS 2.6, notaryproject notation · github.com/notaryproject/notation)
- [CVE-2023-2183](https://cve.now/CVE-2023-2183.md): Grafana is an open-source platform for monitoring and observability. (CVSS 4.1, Grafana · github.com/grafana/grafana)
- [CVE-2023-2801](https://cve.now/CVE-2023-2801.md): Grafana is an open-source platform for monitoring and observability. (CVSS 7.5, Grafana · github.com/grafana/grafana)
- [CVE-2023-33977](https://cve.now/CVE-2023-33977.md): Stored cross site scripting (XSS) via unrestricted file upload in Kiwi TCMS (CVSS 8.1, kiwitcms Kiwi · kiwitcms)
- [CVE-2022-46165](https://cve.now/CVE-2022-46165.md): Cross-site Scripting (XSS) in Web GUI in syncthing (CVSS 4.6, syncthing · github.com/syncthing/syncthing)
- [CVE-2023-34104](https://cve.now/CVE-2023-34104.md): Regex Injection via Doctype Entities (CVSS 7.5, NaturalIntelligence fast-xml-parser · fast-xml-parser)
- [CVE-2023-28653](https://cve.now/CVE-2023-28653.md): The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP). (CVSS 7.8, Horner Automation Cscape)
- [CVE-2023-27916](https://cve.now/CVE-2023-27916.md): The affected application lacks proper validation of user-supplied data when parsing font files (e.g., FNT). (CVSS 7.8, Horner Automation Cscape)
- [CVE-2023-29503](https://cve.now/CVE-2023-29503.md): The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP). (CVSS 7.8, Horner Automation Cscape)
- [CVE-2023-34111](https://cve.now/CVE-2023-34111.md): Command Injection Vulnerability in \`Release PR Merged\` Workflow in taosdata/grafanaplugin (CVSS 8.1, taosdata grafanaplugin)
- [CVE-2023-31244](https://cve.now/CVE-2023-31244.md): The affected product does not properly validate user-supplied data. (CVSS 7.8, Horner Automation Cscape)
- [CVE-2023-31278](https://cve.now/CVE-2023-31278.md): Horner Automation Cscape Out-of-bounds Read (CVSS 7.8, Horner Automation Cscape)
- [CVE-2023-32203](https://cve.now/CVE-2023-32203.md): Horner Automation Cscape Out-of-bounds Write (CVSS 7.8, Horner Automation Cscape)
- [CVE-2023-32281](https://cve.now/CVE-2023-32281.md): The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP). (CVSS 7.8, Horner Automation Cscape)
- [CVE-2023-32289](https://cve.now/CVE-2023-32289.md): The affected application lacks proper validation of user-supplied data when parsing project files (e.g.., CSP). (CVSS 7.8, Horner Automation Cscape)
- [CVE-2023-32539](https://cve.now/CVE-2023-32539.md): Horner Automation Cscape Out-of-bounds Write (CVSS 7.8, Horner Automation Cscape)
- [CVE-2023-32551](https://cve.now/CVE-2023-32551.md): Landscape Open Redirect (CVSS 6.1, Canonical Landscape)
- [CVE-2023-32550](https://cve.now/CVE-2023-32550.md): Landscape's Apache server-status is accessible by default (CVSS 9.3, Canonical Landscape)
- [CVE-2023-32549](https://cve.now/CVE-2023-32549.md): Landscape insecure token generation (CVSS 6.8, Canonical Landscape)
- [CVE-2023-32545](https://cve.now/CVE-2023-32545.md): The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP). (CVSS 7.8, Horner Automation Cscape)
- [CVE-2023-30948](https://cve.now/CVE-2023-30948.md): Retrieval of Attachments to Comments lacks Authorization (CVSS 6.5, com.palantir.comments:comments)
- [CVE-2023-20725](https://cve.now/CVE-2023-20725.md): In preloader, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6779, MT…)
- [CVE-2023-20724](https://cve.now/CVE-2023-20724.md): In Bluetooth, there is a possible out of bounds read due to a missing bounds check. (no CVSS, MediaTek MT8167, MT8175, MT8183)
- [CVE-2023-20723](https://cve.now/CVE-2023-20723.md): In Bluetooth, there is a possible out of bounds read due to a missing bounds check. (no CVSS, MediaTek MT8167, MT8175, MT8183)
- [CVE-2023-20716](https://cve.now/CVE-2023-20716.md): In wlan, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT5221, MT6789, MT6855, MT6879, MT6895, MT6983, MT…)
- [CVE-2023-20715](https://cve.now/CVE-2023-20715.md): In wlan, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT5221, MT6789, MT6855, MT6879, MT6895, MT6983, MT…)
- [CVE-2023-20712](https://cve.now/CVE-2023-20712.md): In wlan, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT5221, MT6789, MT6855, MT6879, MT6895, MT6983, MT…)
- [CVE-2023-20752](https://cve.now/CVE-2023-20752.md): In keymange, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT8167, MT8167S, MT8168, MT8175, MT8195, MT8362A,…)
- [CVE-2023-20751](https://cve.now/CVE-2023-20751.md): In keymange, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT8167, MT8167S, MT8168, MT8175, MT8195, MT8362A,…)
- [CVE-2023-20750](https://cve.now/CVE-2023-20750.md): In swpm, there is a possible out of bounds write due to a race condition. (CVSS 4.1, MediaTek MT6835, MT6886, MT6983, MT6985, MT8167, MT8167S, M…)
- [CVE-2023-20749](https://cve.now/CVE-2023-20749.md): In swpm, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6789, MT6835, MT6855, MT6879, MT6886, MT6893, MT…)
- [CVE-2023-20747](https://cve.now/CVE-2023-20747.md): In vcu, there is a possible memory corruption due to type confusion. (CVSS 4.4, MediaTek MT5696, MT5836, MT5838, MT6768, MT6769, MT6779, MT…)
- [CVE-2023-20746](https://cve.now/CVE-2023-20746.md): In vcu, there is a possible out of bounds write due to improper locking. (CVSS 6.7, MediaTek MT6789, MT6855, MT8167, MT8168, MT8173, MT8185, MT…)
- [CVE-2023-20745](https://cve.now/CVE-2023-20745.md): In vcu, there is a possible out of bounds write due to improper locking. (CVSS 6.7, MediaTek MT6789, MT6855, MT8185, MT8195, MT8365, MT8395, MT…)
- [CVE-2023-20744](https://cve.now/CVE-2023-20744.md): In vcu, there is a possible use after free due to a logic error. (CVSS 6.7, MediaTek MT6789, MT6855, MT8185, MT8195, MT8365, MT8395, MT…)
- [CVE-2023-20743](https://cve.now/CVE-2023-20743.md): In vcu, there is a possible out of bounds write due to improper locking. (CVSS 6.7, MediaTek MT6789, MT6855, MT8185, MT8195, MT8365, MT8395, MT…)
- [CVE-2023-20742](https://cve.now/CVE-2023-20742.md): In ril, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, MediaTek MT6735, MT6737, MT6739, MT6753, MT6757, MT6757C, M…)
- [CVE-2023-20741](https://cve.now/CVE-2023-20741.md): In ril, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, MediaTek MT6735, MT6737, MT6739, MT6753, MT6757, MT6757C, M…)
- [CVE-2023-20740](https://cve.now/CVE-2023-20740.md): In vcu, there is a possible memory corruption due to a logic error. (CVSS 6.7, MediaTek MT6768, MT6769, MT6779, MT6781, MT6785, MT6789, MT…)
- [CVE-2023-20739](https://cve.now/CVE-2023-20739.md): In vcu, there is a possible memory corruption due to a logic error. (CVSS 6.7, MediaTek MT6768, MT6769, MT6779, MT6781, MT6785, MT6789, MT…)
- [CVE-2023-20738](https://cve.now/CVE-2023-20738.md): In vcu, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT5696, MT5836, MT5838, MT6768, MT6769, MT6779, MT…)
- [CVE-2023-20737](https://cve.now/CVE-2023-20737.md): In vcu, there is a possible use after free due to improper locking. (CVSS 6.7, MediaTek MT6768, MT6769, MT6779, MT6781, MT6785, MT6789, MT…)
- [CVE-2023-20736](https://cve.now/CVE-2023-20736.md): In vcu, there is a possible out of bounds write due to a race condition. (CVSS 6.4, MediaTek MT6768, MT6769, MT6779, MT6781, MT6785, MT6789, MT…)
- [CVE-2023-20735](https://cve.now/CVE-2023-20735.md): In vcu, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT5696, MT5836, MT5838, MT6768, MT6769, MT6779, MT…)
- [CVE-2023-20734](https://cve.now/CVE-2023-20734.md): In vcu, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT5696, MT5836, MT5838, MT6768, MT6769, MT6779, MT…)
- [CVE-2023-20733](https://cve.now/CVE-2023-20733.md): In vcu, there is a possible use after free due to improper locking. (CVSS 6.7, MediaTek MT6768, MT6769, MT6779, MT6781, MT6785, MT6789, MT…)
- [CVE-2023-20732](https://cve.now/CVE-2023-20732.md): In wlan, there is a possible out of bounds read due to a missing bounds check. (CVSS 6.7, MediaTek MT6761, MT6762, MT6765, MT6768, MT6769, MT6779, MT…)
- [CVE-2023-20731](https://cve.now/CVE-2023-20731.md): In wlan, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, MediaTek MT6761, MT6762, MT6765, MT6768, MT6769, MT6779, MT…)
- [CVE-2023-20730](https://cve.now/CVE-2023-20730.md): In wlan, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, MediaTek MT6985, MT7902, MT7921, MT8365, MT8518, MT8532)
- [CVE-2023-20729](https://cve.now/CVE-2023-20729.md): In wlan, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, MediaTek MT6985, MT7902, MT7921, MT8365, MT8518, MT8532)
- [CVE-2023-20728](https://cve.now/CVE-2023-20728.md): In wlan, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, MediaTek MT6781, MT6789, MT6833, MT6835, MT6855, MT6877, MT…)
- [CVE-2023-3121](https://cve.now/CVE-2023-3121.md): Dahua Smart Parking Management image server-side request forgery (CVSS 3.5, Dahua Smart Parking Management)
- [CVE-2023-3120](https://cve.now/CVE-2023-3120.md): SourceCodester Service Provider Management System view\_service.php sql injection (CVSS 6.3, SourceCodester Service Provider Management System)
- [CVE-2023-3119](https://cve.now/CVE-2023-3119.md): SourceCodester Service Provider Management System view.php sql injection (CVSS 6.3, SourceCodester Service Provider Management System)
- [CVE-2023-1779](https://cve.now/CVE-2023-1779.md): Helmholz and MB Connect Line: Account takeover via password reset in multiple products (CVSS 4.3, MB Connect Line mbCONNECT24 · MB Connect Line mymbCONNEC… +2)
- [CVE-2023-0985](https://cve.now/CVE-2023-0985.md): Helmholz and MB Connect Line: Account takeover via password reset in multiple products (CVSS 8.8, MB Connect Line mbCONNECT24 · MB Connect Line mymbCONNEC… +2)
- [CVE-2023-2833](https://cve.now/CVE-2023-2833.md): ReviewX \<= 1.6.13 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8, ReviewX – Multi-Criteria Reviews for WooCommerce with Googl…)
- [CVE-2023-20727](https://cve.now/CVE-2023-20727.md): In wlan, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, MediaTek MT6789, MT6835, MT6855, MT6879, MT6886, MT6895, MT…)
- [CVE-2023-21670](https://cve.now/CVE-2023-21670.md): Improper Access control in GPU Subsystem (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2023-21669](https://cve.now/CVE-2023-21669.md): Buffer Over-read in WLAN HOST (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2023-21661](https://cve.now/CVE-2023-21661.md): Buffer Over-read in WLAN Firmware (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-21660](https://cve.now/CVE-2023-21660.md): Buffer Over-read in WLAN Firmware (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-21659](https://cve.now/CVE-2023-21659.md): Buffer Over-read in WLAN Firmware (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-21658](https://cve.now/CVE-2023-21658.md): Buffer Over-Read in WLAN Firmware (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-21657](https://cve.now/CVE-2023-21657.md): Improper Input Validation in Audio (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2023-21656](https://cve.now/CVE-2023-21656.md): Improper Input Validation in WLAN HOST (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2023-21632](https://cve.now/CVE-2023-21632.md): Stack-based Buffer Overflow in Automotive GPU (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2023-21628](https://cve.now/CVE-2023-21628.md): Buffer Copy Without Checking Size of Input (\`Classic Buffer Overflow\`) in WLAN HAL (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2022-40538](https://cve.now/CVE-2022-40538.md): Reachable assertion in Modem (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2022-40536](https://cve.now/CVE-2022-40536.md): Improper authentication in Modem (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2022-40533](https://cve.now/CVE-2022-40533.md): Untrusted Pointer Dereference in Core (CVSS 6.2, Qualcomm Snapdragon)
- [CVE-2022-40529](https://cve.now/CVE-2022-40529.md): Improper access control in Kernel (CVSS 7.1, Qualcomm Snapdragon)
- [CVE-2022-40525](https://cve.now/CVE-2022-40525.md): Information Exposure in Linux Networking Firmware (CVSS 7.1, Qualcomm Snapdragon)
- [CVE-2022-40523](https://cve.now/CVE-2022-40523.md): Information exposure in Kernel (CVSS 7.1, Qualcomm Snapdragon)
- [CVE-2022-40522](https://cve.now/CVE-2022-40522.md): Double free in Linux Networking (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2022-40521](https://cve.now/CVE-2022-40521.md): Improper authorization in Modem (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2022-40507](https://cve.now/CVE-2022-40507.md): Double free in Core (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2022-33307](https://cve.now/CVE-2022-33307.md): Double free in Automotive (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2022-33303](https://cve.now/CVE-2022-33303.md): Uncontrolled resource consumption in Linux kernel (CVSS 5.5, Qualcomm Snapdragon)
- [CVE-2022-33267](https://cve.now/CVE-2022-33267.md): Improper restriction of operations within the bounds of memory buffer in Linux (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2022-33264](https://cve.now/CVE-2022-33264.md): Stack-based buffer overflow in Modem (CVSS 7.9, Qualcomm Snapdragon)
- [CVE-2022-33263](https://cve.now/CVE-2022-33263.md): Use after free in Core (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2022-33251](https://cve.now/CVE-2022-33251.md): Reachable assertion in Modem (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2022-33240](https://cve.now/CVE-2022-33240.md): Incorrect type conversion or cast in Audio (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2022-33230](https://cve.now/CVE-2022-33230.md): Buffer copy without checking the size of input in FM Host (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2022-33227](https://cve.now/CVE-2022-33227.md): Double free in Linux-Android (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2022-33226](https://cve.now/CVE-2022-33226.md): Buffer copy without checking the size of input in Core (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2022-33224](https://cve.now/CVE-2022-33224.md): Buffer copy without checking the size of input in Core (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2022-22076](https://cve.now/CVE-2022-22076.md): Cryptographic issue in Core (CVSS 7.1, Qualcomm Snapdragon)
- [CVE-2022-22060](https://cve.now/CVE-2022-22060.md): Reachable Assertion in Modem (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-30915](https://cve.now/CVE-2023-30915.md): In email service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-30914](https://cve.now/CVE-2023-30914.md): In email service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-30866](https://cve.now/CVE-2023-30866.md): In telephony service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-30865](https://cve.now/CVE-2023-30865.md): In dialer service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-30864](https://cve.now/CVE-2023-30864.md): In Connectivity Service, there is a possible missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-30863](https://cve.now/CVE-2023-30863.md): In Connectivity Service, there is a possible missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48448](https://cve.now/CVE-2022-48448.md): In telephony service, there is a possible missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48447](https://cve.now/CVE-2022-48447.md): In telephony service, there is a possible missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48446](https://cve.now/CVE-2022-48446.md): In telephony service, there is a possible missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48445](https://cve.now/CVE-2022-48445.md): In telephony service, there is a possible missing permission check. (CVSS 5.9, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48444](https://cve.now/CVE-2022-48444.md): In telephony service, there is a possible missing permission check. (CVSS 5.9, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48443](https://cve.now/CVE-2022-48443.md): In telephony service, there is a possible missing permission check. (CVSS 5.9, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48442](https://cve.now/CVE-2022-48442.md): In dialer service, there is a possible missing permission check. (CVSS 6.2, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48441](https://cve.now/CVE-2022-48441.md): In dialer service, there is a possible missing permission check. (CVSS 6.2, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48440](https://cve.now/CVE-2022-48440.md): In dialer service, there is a possible missing permission check. (CVSS 6.2, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48439](https://cve.now/CVE-2022-48439.md): In cp\_dump driver, there is a possible out of bounds write due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48438](https://cve.now/CVE-2022-48438.md): In cp\_dump driver, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.3, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48392](https://cve.now/CVE-2022-48392.md): In dialer service, there is a possible missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48391](https://cve.now/CVE-2022-48391.md): In telephony service, there is a possible missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48390](https://cve.now/CVE-2022-48390.md): In telephony service, there is a possible missing permission check. (CVSS 7.3, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2018-25087](https://cve.now/CVE-2018-25087.md): Arborator Server project.cgi start denial of service (CVSS 3.5, Arborator Server)
- [CVE-2017-20185](https://cve.now/CVE-2017-20185.md): Fuzzy SWMP GET Parameter swmp.php cross site scripting (CVSS 3.5, Fuzzy SWMP)
- [CVE-2015-10117](https://cve.now/CVE-2015-10117.md): Gravity Forms DPS PxPay Plugin cross site scripting (CVSS 3.5, Gravity Forms DPS PxPay Plugin)
- [CVE-2023-2546](https://cve.now/CVE-2023-2546.md): WP User Switch \<= 1.0.2 - Authenticated (Subscriber+) Authentication Bypass via Cookie (CVSS 8.8, iqbalrony WP User Switch)
- [CVE-2015-10116](https://cve.now/CVE-2015-10116.md): RealFaviconGenerator Favicon Plugin class-favicon-by-realfavicongenerator-admin.php install\_new\_favicon cross-site request forgery (CVSS 4.3, RealFaviconGenerator Favicon Plugin)
- [CVE-2023-0921](https://cve.now/CVE-2023-0921.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 4.3, GitLab)
- [CVE-2023-1621](https://cve.now/CVE-2023-1621.md): An issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.5, all versions starting from 15.11 before (CVSS 6.5, GitLab)
- [CVE-2023-2132](https://cve.now/CVE-2023-2132.md): An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 befo (CVSS 7.5, GitLab)
- [CVE-2023-2157](https://cve.now/CVE-2023-2157.md): A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing. (CVSS 5.5, ImageMagick)
- [CVE-2023-2253](https://cve.now/CVE-2023-2253.md): A flaw was found in the \`/v2/\_catalog\` endpoint in distribution/distribution, which accepts a parameter to control the maximum number of rec (CVSS 6.5, distribution/distribution · github.com/docker/distributi… +1)
- [CVE-2023-2602](https://cve.now/CVE-2023-2602.md): A vulnerability was found in the pthread\_create() function in libcap. (no CVSS, libcap)
- [CVE-2023-2603](https://cve.now/CVE-2023-2603.md): A vulnerability was found in libcap. (CVSS 7.8, libcap)
- [CVE-2023-27126](https://cve.now/CVE-2023-27126.md): The AES Key-IV pair used by the TP-Link TAPO C200 camera V3 (EU) on firmware version 1.1.22 Build 220725 is reused across all cameras. (CVSS 4.6)
- [CVE-2023-2961](https://cve.now/CVE-2023-2961.md): A segmentation fault flaw was found in the Advancecomp package. (CVSS 3.3, advancecomp)
- [CVE-2023-29632](https://cve.now/CVE-2023-29632.md): PrestaShop jmspagebuilder 3.x is vulnerable to SQL Injection via ajax\_jmspagebuilder.php. (CVSS 9.8)
- [CVE-2023-31569](https://cve.now/CVE-2023-31569.md): TOTOLINK X5000R V9.1.0cu.2350\_B20230313 was discovered to contain a command injection via the setWanCfg function. (CVSS 9.8)
- [CVE-2023-31606](https://cve.now/CVE-2023-31606.md): A Regular Expression Denial of Service (ReDoS) issue was discovered in the sanitize\_html function of redcloth gem v4.0.0. (no CVSS, RedCloth)
- [CVE-2023-33381](https://cve.now/CVE-2023-33381.md): A command injection vulnerability was found in the ping functionality of the MitraStar GPT-2741GNAC router (firmware version AR\_g5.8\_110WVN0 (CVSS 7.2)
- [CVE-2023-33457](https://cve.now/CVE-2023-33457.md): In Sogou Workflow v0.10.6, memcpy a negtive size in URIParser::parse , may cause buffer-overflow and crash. (CVSS 8.8)
- [CVE-2023-33460](https://cve.now/CVE-2023-33460.md): There's a memory leak in yajl 2.1.0 with use of yajl\_tree\_parse function. (CVSS 6.5)
- [CVE-2023-33477](https://cve.now/CVE-2023-33477.md): In Harmonic NSG 9000-6G devices, an authenticated remote user can obtain source code by directly requesting a special path. (CVSS 6.5)
- [CVE-2023-33530](https://cve.now/CVE-2023-33530.md): There is a command injection vulnerability in the Tenda G103 Gigabit GPON Terminal with firmware version V1.0.0.5. (CVSS 8.8)
- [CVE-2023-33532](https://cve.now/CVE-2023-33532.md): There is a command injection vulnerability in the Netgear R6250 router with Firmware Version 1.0.4.48. (CVSS 9.8)
- [CVE-2023-33533](https://cve.now/CVE-2023-33533.md): Netgear D6220 with Firmware Version 1.0.0.80, D8500 with Firmware Version 1.0.3.60, R6700 with Firmware Version 1.0.2.26, and R6900 with Fir (CVSS 8.8)
- [CVE-2023-33569](https://cve.now/CVE-2023-33569.md): Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via ip/eval/ajax.php?action=update\_user. (CVSS 7.2)
- [CVE-2023-33613](https://cve.now/CVE-2023-33613.md): axTLS v2.1.5 was discovered to contain a heap buffer overflow in the bi\_import function in axtls-code/crypto/bigint.c. (CVSS 5.5)
- [CVE-2023-33651](https://cve.now/CVE-2023-33651.md): An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initia (CVSS 7.5)
- [CVE-2023-33652](https://cve.now/CVE-2023-33652.md): Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the componen (CVSS 8.8)
- [CVE-2023-33653](https://cve.now/CVE-2023-33653.md): Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the componen (CVSS 8.8)
- [CVE-2023-33659](https://cve.now/CVE-2023-33659.md): A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. (CVSS 7.5)
- [CVE-2023-33684](https://cve.now/CVE-2023-33684.md): Weak session management in DB Elettronica Telecomunicazioni SpA SFT DAB 600/C Firmware: 1.9.3 Bios firmware: 7.1 (Apr 19 2021) Gui: 2.46 FPG (no CVSS)
- [CVE-2023-33747](https://cve.now/CVE-2023-33747.md): CloudPanel v2.2.2 allows attackers to execute a path traversal. (CVSS 7.8)
- [CVE-2023-34409](https://cve.now/CVE-2023-34409.md): In Percona Monitoring and Management (PMM) server 2.x before 2.37.1, the authenticate function in auth\_server.go does not properly formalize (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-06-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.