CVEs published June 9, 2023
118 CVEs were published on June 9, 2023: 2 critical, 26 high.
- Published
- 118
- Critical
- 2
- High
- 26
- Medium
- 84
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 11
Most affected products
- roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…
- 11
- levelfourstorefront Shopping Cart & eCommerce Store
- 6
- wpdevteam Gutenberg Essential Blocks – Page Builder for Gut…
- 5
- realmag777 WPCS – WordPress Currency Switcher Professional
- 4
- cyberlord92 Active Directory Integration / LDAP Integration
- 2
- expresstech Quiz and Survey Master (QSM) – Easy Quiz and Su…
- 2
- froxlor/froxlor
- 2
- Google gRPC · grpcio +2
- 2
- jetmonsters Getwid – Gutenberg Blocks
- 2
- melapress WP Activity Log · wpwhitesecurity WP Activity Log…
- 2
Critical 2
High 26
- CVE-2023-34100Out-of-Bounds Read in contiki-ngcontiki-ng
- CVE-2019-16283A potential security vulnerability has been identified with a version of the HP Softpaq installer that can lead to arbitrary code execution.HP Softpaq installer
- CVE-2023-34245Cross site scripting (XSS) in @udecode/plate-linkudecode plate · @udecode/plate-link
- CVE-2023-32731Information leak in gRPCGoogle gRPC · grpcio +2
- CVE-2023-1428Denial-of-Service in gRPCGoogle gRPC · grpcio +2
- CVE-2023-1895Getwid – Gutenberg Blocks <= 1.8.3 - Authenticated(Subscriber+) Server Side Request Forgeryjetmonsters Getwid – Gutenberg Blocks
- CVE-2023-0721Metform Elementor Contact Form Builder <= 3.3.0 - Unauthenticated CSV Injectionroxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…
- CVE-2023-2237WP Replicate Post <= 4.0.2 - Authenticated (Contributor+) SQL Injectionyudiz WP Replicate Post
- CVE-2023-1615The Ultimate Addons for Contact Form 7 plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in versions up to, and incpsdtowpservice Ultimate Addons for Contact Form
- CVE-2023-2249wpForo Forum <= 2.1.7 - Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contentstomdever wpForo Forum
- CVE-2023-0291Quiz And Survey Master <= 8.0.8 - Unauthenticated Arbitrary Media Deletionexpresstech Quiz and Survey Master (QSM) – Easy Quiz and Su…
- CVE-2023-2484Active Directory Integration / LDAP Integration <= 4.1.4 - Authenticated (Administrator+) SQL Injectioncyberlord92 Active Directory Integration / LDAP Integration
- CVE-2023-0992Shield Security <= 17.0.17 - Unauthenticated Stored Cross-Site Scriptingpaultgoodchild Shield: Blocks Bots, Protects Users, and Pre…
- CVE-2023-2607Multiple Page Generator Plugin <= 3.3.17 - Authenticated (Administrator+) SQL Injectionthemeisle Multiple Page Generator Plugin – MPG
- CVE-2023-1888Directorist <= 7.5.4 - Authenticated (Subscriber+) Arbitrary User Password Reset to Privilege Escalationwpwax Directorist: AI-Powered Business Directory, Listings…
- CVE-2023-2454schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attackepostgresql
- CVE-2023-26465Pega Platform versions 7.2 to 8.8.1 are affected by an XSS issue.Pegasystems Pega Infinity
- CVE-2023-27706Bitwarden Windows desktop application versions prior to v2023.4.0 store biometric keys in Windows Credential Manager, accessible to other lo
- CVE-2023-29749An issue found in Yandex Navigator v.6.60 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the
- CVE-2023-29752An issue found in Facemoji Emoji Keyboard v.2.9.1.2 for Android allows unauthorized apps to cause escalation of privilege attacks by manipul
- CVE-2023-29755An issue found in Twilight v.13.3 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the SharedPr
- CVE-2023-29757An issue found in Blue Light Filter v.1.5.5 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating th
- CVE-2023-29766An issue found in CrossX v.1.15.3 for Android allows a local attacker to cause an escalation of Privileges via the database files.
- CVE-2023-30262An issue found in MIM software Inc MIM License Server and MIMpacs services v.6.9 thru v.7.0 fixed in v.7.0.10 allows a remote unauthenticate
- CVE-2023-3141A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel.Kernel
- CVE-2023-33557Fuel CMS v1.5.2 was discovered to contain a SQL injection vulnerability via the id parameter at /controllers/Blocks.php.
Medium, low and unrated 90
- CVE-2023-3187PHPGurukul Teachers Record Management System Profile Picture changeimage.php unrestricted uploadPHPGurukul Teachers Record Management System
- CVE-2023-32312Client secret not mandatory in UmbracoIdentityExtensionsUmbracoIdentityExtensions
- CVE-2023-2121Vault’s KV Diff Viewer Allowed for HTML InjectionHashiCorp Vault · github.com/hashicorp/vault
- CVE-2023-3184SourceCodester Sales Tracker Management System cross site scriptingSourceCodester Sales Tracker Management System
- CVE-2023-3183SourceCodester Performance Indicator System addproduct.php cross site scriptingSourceCodester Performance Indicator System
- CVE-2023-2261WP Activity Log <= 4.5.0 - Missing Capabilities Check to User Enumerationmelapress WP Activity Log · wpwhitesecurity WP Activity Log…
- CVE-2023-2286WP Activity Log <= 4.5.0 - Cross-Site Request Forgery via ajax_run_cleanupmelapress WP Activity Log · wpwhitesecurity WP Activity Log…
- CVE-2023-2284WP Activity Log Premium <= 4.5.0 - Missing Authorization via ajax_switch_dbwpwhitesecurity WP Activity Log Premium
- CVE-2023-2285WP Activity Log Premium <= 4.5.0 - Cross-Site Request Forgery via ajax_switch_dbwpwhitesecurity WP Activity Log Premium
- CVE-2023-32732Denial-of-Service in gRPCGoogle gRPC · io.grpc:grpc-protobuf +2
- CVE-2023-2892WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_bulk_delete_productlevelfourstorefront Shopping Cart & eCommerce Store
- CVE-2023-2897Brizy Page Builder <= 2.4.18 - IP Address Spoofing to Protection Mechanism Bypassthemefusecom Brizy – Page Builder
- CVE-2023-2894WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_bulk_deactivate_productlevelfourstorefront Shopping Cart & eCommerce Store
- CVE-2023-2893WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_deactivate_productlevelfourstorefront Shopping Cart & eCommerce Store
- CVE-2023-2896WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_duplicate_productlevelfourstorefront Shopping Cart & eCommerce Store
- CVE-2023-2895WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_bulk_activate_productlevelfourstorefront Shopping Cart & eCommerce Store
- CVE-2023-3177SourceCodester Lost and Found Information System view_inquiry.php sql injectionSourceCodester Lost and Found Information System
- CVE-2023-2184WP Responsive Tabs horizontal vertical and accordion Tabs <= 1.1.15 - Reflected Cross-Site Scriptingnik00726 WP Responsive Tabs horizontal vertical and accordi…
- CVE-2023-2083Essential Blocks <= 4.0.6 - Missing Authorization via savewpdevteam Gutenberg Essential Blocks – Page Builder for Gut…
- CVE-2023-1430FluentCRM - Marketing Automation For WordPress <= 2.8.01 - Insufficient Use of Hash as Authorization Controltechjewel FluentCRM – Email Newsletter, Automation, Email M…
- CVE-2023-0692Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_payment_status' shortcoderoxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…
- CVE-2023-2555WPCS – WordPress Currency Switcher Professional <= 1.1.9 - Missing Authorization to Custom Drop-Down Currency Switcher Creationrealmag777 WPCS – WordPress Currency Switcher Professional
- CVE-2023-1016Intuitive Custom Post Order <= 3.1.4.1 - Authenticated (Admin+) SQL Injectionhijiri Intuitive Custom Post Order
- CVE-2023-2031Locatoraid Store Locator <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeplainware Locatoraid Store Locator
- CVE-2023-2557WPCS – WordPress Currency Switcher Professional <= 1.1.9 - Missing Authorization to Arbitrary Custom Drop-Down Currency Switcher Editingrealmag777 WPCS – WordPress Currency Switcher Professional
- CVE-2023-2087Essential Blocks <= 4.0.6 - Cross-Site Request Forgery via savewpdevteam Gutenberg Essential Blocks – Page Builder for Gut…
- CVE-2023-2066Announcement & Notification Banner – Bulletin <= 3.6.0 - Missing Authorization Checksmikewire_rocksolid Announcement & Notification Banner – Bul…
- CVE-2023-2289wordpress vertical image slider plugin <= 1.2.16 - Reflected Cross-Site Scriptingnik00726 Vertical Image Slider
- CVE-2023-1404Weaver Show Posts <= 1.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via Display Namewpweaver Weaver Show Posts
- CVE-2023-0292Quiz And Survey Master <= 8.0.8 - Cross-Site Request Forgery to Arbitrary Media Deletionexpresstech Quiz and Survey Master (QSM) – Easy Quiz and Su…
- CVE-2023-1169OoohBoi Steroids for Elementor <= 2.1.4 - Missing Authorization leading to Authenticated (Subscriber+) Image Uploadsagarpatel124 OoohBoi Steroids for Elementor
- CVE-2023-1807Elementor Addons, Widgets and Enhancements – Stax <= 1.4.3 - Cross-Site Request Forgery via toggle_widgetstaxwp Stax Addons for Elementor
- CVE-2023-2558WPCS – WordPress Currency Switcher Professional <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcoderealmag777 WPCS – WordPress Currency Switcher Professional
- CVE-2023-2891WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_delete_productlevelfourstorefront Shopping Cart & eCommerce Store
- CVE-2023-2556WPCS – WordPress Currency Switcher Professional <= 1.1.9 - Missing Authorization to Arbitrary Custom Drop-Down Currency Switcher Deletionrealmag777 WPCS – WordPress Currency Switcher Professional
- CVE-2023-2067Announcement & Notification Banner – Bulletin <= 3.7.0 - Cross-Site Request Forgerymikewire_rocksolid Announcement & Notification Banner – Bul…
- CVE-2023-1978ShiftController Employee Shift Scheduling <= 4.9.25 - Reflected Cross-Site Scripting via Query Stringplainware ShiftController Employee Shift Scheduling
- CVE-2023-1889Directorist <= 7.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion in listing_taskwpwax Directorist: AI-Powered Business Directory, Listings…
- CVE-2023-2275WooCommerce Multivendor Marketplace – REST API <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order/Order Note Disclosure, Order Note Addition via REST APIwclovers WCFM – Multivendor Marketplace REST API for WooCom…
- CVE-2023-2159CMP – Coming Soon & Maintenance <= 4.1.7 - Maintenance Mode BypassCMP – Coming Soon & Maintenance Plugin by NiteoThemes
- CVE-2023-0729Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_save_sort_orderwickedplugins Wicked Folders – Folder Organizer for Pages,…
- CVE-2023-0708Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_first_name shortcoderoxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…
- CVE-2023-1375WP Fastest Cache <= 1.1.2 - Missing Authorization to Cache Deletionemrevona WP Fastest Cache – WordPress Cache Plugin
- CVE-2023-2085Essential Blocks <= 4.0.6 - Missing Authorization via templateswpdevteam Gutenberg Essential Blocks – Page Builder for Gut…
- CVE-2023-2688WordPress File Upload / WordPress File Upload Pro <= 4.19.1 - Authenticated (Administrator+) Path Traversalnickboss Iptanus File Upload · WordPress File Upload Pro
- CVE-2023-2280WP Directory Kit <= 1.2.2 - Missing Authorization to Plugin Installation, Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_public_actionwpdirectorykit WP Directory Kit
- CVE-2023-2305Download Manager <= 3.2.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodecodename065 Download Manager
- CVE-2023-2086Essential Blocks <= 4.0.6 - Missing Authorization via template_countwpdevteam Gutenberg Essential Blocks – Page Builder for Gut…
- CVE-2023-2189Elementor Addons, Widgets and Enhancements – Stax <= 1.4.3 - Missing Authorization in toggle_widgetstaxwp Stax Addons for Elementor
- CVE-2023-0691Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_last_name shortcoderoxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…
- CVE-2023-0710Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_thankyou shortcoderoxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…
- CVE-2023-2450The FiboSearch - AJAX Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versiondamian-gora FiboSearch – Ajax Search for WooCommerce
- CVE-2023-0688Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_thankyou shortcoderoxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…
- CVE-2023-2599Active Directory Integration / LDAP Integration <= 4.1.4 - Cross-Site Request Forgery to SQL Injectioncyberlord92 Active Directory Integration / LDAP Integration
- CVE-2023-1910Getwid – Gutenberg Blocks <= 1.8.3 - Improper Authorization via get_remote_templates REST endpointjetmonsters Getwid – Gutenberg Blocks
- CVE-2023-0993Shield Security <= 17.0.17 - Missing Authorizationpaultgoodchild Shield: Blocks Bots, Protects Users, and Pre…
- CVE-2023-2584PixelYourSite <= 9.3.6 and PixelYourSite Pro <= 9.6.1 - Authenticated (Administrator+) Stored Cross-Site ScriptingPixelYourSite – Your smart PIXEL (TAG) & API Manager · Pixe…
- CVE-2023-1843Metform Elementor Contact Form Builder <= 3.3.0 - Missing Authorizationroxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…
- CVE-2023-1403Weaver Xtreme Theme <= 5.0.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Display Namewpweaver Weaver Xtreme
- CVE-2023-2402Photo Gallery Slideshow & Masonry Tiled Gallery <= 1.0.13 - Reflected Cross-Site Scriptingnik00726 Photo Gallery Slideshow & Masonry Tiled Gallery
- CVE-2023-0832Under Construction <= 3.96 - Cross-Site Request Forgery via admin_action_install_weglotwebfactory Under Construction
- CVE-2023-2526Easy Google Maps <= 1.11.7 - Cross-Site Request Forgery via AJAX actionsupsysticcom Easy Google Maps
- CVE-2023-1917PowerPress <= 10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodePowerPress Podcasting plugin by Blubrry
- CVE-2023-2452Advanced Woo Search <= 2.77 - Authenticated (Admin+) Stored Cross-Site Scriptingmihail-barinov Advanced Woo Search – Product Search for Woo…
- CVE-2023-2414Online Booking & Scheduling Calendar for WordPress by vcita <= 4.4.6 - Missing Authorization to Settings Update and Arbitrary File UploadOnline Booking & Scheduling Calendar for WordPress by vcita
- CVE-2023-2604Team Circle Image Slider With Lightbox <= 1.0.17 - Reflected Cross-Site Scriptingnik00726 Team Circle Image Slider With Lightbox
- CVE-2023-0709Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_last_name shortcoderoxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…
- CVE-2023-2767WordPress File Upload / WordPress File Upload Pro <= 4.19.1 - Authenticated (Administrator+) Stored Cross-Site Scriptingnickboss Iptanus File Upload · WordPress File Upload Pro
- CVE-2023-0693Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_transaction_id' shortcoderoxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…
- CVE-2023-0695Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf shortcoderoxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…
- CVE-2023-0694Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf shortcoderoxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…
- CVE-2023-2764Draw Attention <= 2.0.11 - Missing Authorization to Arbitrary Post Featured Image Modificationcroixhaug Interactive Image Map Plugin – Draw Attention
- CVE-2023-2084Essential Blocks <= 4.0.6 - Missing Authorization via getwpdevteam Gutenberg Essential Blocks – Page Builder for Gut…
- CVE-2023-0831Under Construction <= 3.96 - Cross-Site Request Forgery via admin_action_ucp_dismiss_noticewebfactory Under Construction
- CVE-2023-3176SourceCodester Lost and Found Information System manage_user.php sql injectionSourceCodester Lost and Found Information System
- CVE-2023-0342MongoDB Ops Manager may disclose sensitive information in Diagnostic ArchiveMongoDB Ops Manager
- CVE-2023-2455Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases whpostgresql
- CVE-2023-29712Cross Site Scripting vulnerability found in Vade Secure Gateway allows a remote attacker to execute arbitrary code via a crafted payload to
- CVE-2023-29713Cross Site Scripting vulnerability found in Vade Secure Gateway allows a remote attacker to execute arbitrary code via a crafted payload to
- CVE-2023-29714Cross Site Scripting vulnerability found in Vade Secure Gateway allows a remote attacker to execute arbitrary code via the username, passwor
- CVE-2023-29751An issue found in Yandex Navigator v.6.60 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the S
- CVE-2023-29753An issue found in Facemoji Emoji Keyboard v.2.9.1.2 for Android allows a local attacker to cause a denial of service via the SharedPreferenc
- CVE-2023-29756An issue found in Twilight v.13.3 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SharedPre
- CVE-2023-29758An issue found in Blue Light Filter v.1.5.5 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the
- CVE-2023-29759An issue found in FlightAware v.5.8.0 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the datab
- CVE-2023-29761An issue found in Sleep v.20230303 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SharedPr
- CVE-2023-29767An issue found in CrossX v.1.15.3 for Android allows a local attacker to cause a persistent denial of service via the database files.
- CVE-2023-3172Path Traversal in froxlor/froxlorfroxlor/froxlor
- CVE-2023-34363An issue was discovered in Progress DataDirect Connect for ODBC before 08.02.2770 for Oracle.
- CVE-2023-34856A Cross Site Scripting (XSS) vulnerability in D-Link DI-7500G-CI-19.05.29A allows attackers to execute arbitrary code via uploading a crafte