# CVEs published 2023-06-09

118 CVEs were published on June 9, 2023: 2 critical, 26 high. Days are UTC.

- [CVE-2023-3187](https://cve.now/CVE-2023-3187.md): PHPGurukul Teachers Record Management System Profile Picture changeimage.php unrestricted upload (CVSS 6.3, PHPGurukul Teachers Record Management System)
- [CVE-2023-32312](https://cve.now/CVE-2023-32312.md): Client secret not mandatory in UmbracoIdentityExtensions (CVSS 3.7, UmbracoIdentityExtensions)
- [CVE-2023-34100](https://cve.now/CVE-2023-34100.md): Out-of-Bounds Read in contiki-ng (CVSS 7.3, contiki-ng)
- [CVE-2019-16283](https://cve.now/CVE-2019-16283.md): A potential security vulnerability has been identified with a version of the HP Softpaq installer that can lead to arbitrary code execution. (CVSS 7.8, HP Softpaq installer)
- [CVE-2023-34245](https://cve.now/CVE-2023-34245.md): Cross site scripting (XSS) in @udecode/plate-link (CVSS 8.1, udecode plate · @udecode/plate-link)
- [CVE-2023-2121](https://cve.now/CVE-2023-2121.md): Vault’s KV Diff Viewer Allowed for HTML Injection (CVSS 4.3, HashiCorp Vault · github.com/hashicorp/vault)
- [CVE-2023-3184](https://cve.now/CVE-2023-3184.md): SourceCodester Sales Tracker Management System cross site scripting (CVSS 2.4, SourceCodester Sales Tracker Management System)
- [CVE-2023-3183](https://cve.now/CVE-2023-3183.md): SourceCodester Performance Indicator System addproduct.php cross site scripting (CVSS 3.5, SourceCodester Performance Indicator System)
- [CVE-2023-2261](https://cve.now/CVE-2023-2261.md): WP Activity Log \<= 4.5.0 - Missing Capabilities Check to User Enumeration (CVSS 4.3, melapress WP Activity Log · wpwhitesecurity WP Activity Log…)
- [CVE-2023-2286](https://cve.now/CVE-2023-2286.md): WP Activity Log \<= 4.5.0 - Cross-Site Request Forgery via ajax\_run\_cleanup (CVSS 4.3, melapress WP Activity Log · wpwhitesecurity WP Activity Log…)
- [CVE-2023-2284](https://cve.now/CVE-2023-2284.md): WP Activity Log Premium \<= 4.5.0 - Missing Authorization via ajax\_switch\_db (CVSS 4.3, wpwhitesecurity WP Activity Log Premium)
- [CVE-2023-2285](https://cve.now/CVE-2023-2285.md): WP Activity Log Premium \<= 4.5.0 - Cross-Site Request Forgery via ajax\_switch\_db (CVSS 4.3, wpwhitesecurity WP Activity Log Premium)
- [CVE-2023-32731](https://cve.now/CVE-2023-32731.md): Information leak in gRPC (CVSS 7.4, Google gRPC · grpcio +2)
- [CVE-2023-32732](https://cve.now/CVE-2023-32732.md): Denial-of-Service in gRPC (CVSS 5.3, Google gRPC · io.grpc:grpc-protobuf +2)
- [CVE-2023-1428](https://cve.now/CVE-2023-1428.md): Denial-of-Service in gRPC (CVSS 7.5, Google gRPC · grpcio +2)
- [CVE-2023-2892](https://cve.now/CVE-2023-2892.md): WP EasyCart \<= 5.4.8 - Cross-Site Request Forgery via process\_bulk\_delete\_product (CVSS 6.5, levelfourstorefront Shopping Cart & eCommerce Store)
- [CVE-2023-2897](https://cve.now/CVE-2023-2897.md): Brizy Page Builder \<= 2.4.18 - IP Address Spoofing to Protection Mechanism Bypass (CVSS 3.7, themefusecom Brizy – Page Builder)
- [CVE-2023-2894](https://cve.now/CVE-2023-2894.md): WP EasyCart \<= 5.4.8 - Cross-Site Request Forgery via process\_bulk\_deactivate\_product (CVSS 4.3, levelfourstorefront Shopping Cart & eCommerce Store)
- [CVE-2023-2893](https://cve.now/CVE-2023-2893.md): WP EasyCart \<= 5.4.8 - Cross-Site Request Forgery via process\_deactivate\_product (CVSS 4.3, levelfourstorefront Shopping Cart & eCommerce Store)
- [CVE-2023-2896](https://cve.now/CVE-2023-2896.md): WP EasyCart \<= 5.4.8 - Cross-Site Request Forgery via process\_duplicate\_product (CVSS 4.3, levelfourstorefront Shopping Cart & eCommerce Store)
- [CVE-2023-2895](https://cve.now/CVE-2023-2895.md): WP EasyCart \<= 5.4.8 - Cross-Site Request Forgery via process\_bulk\_activate\_product (CVSS 4.3, levelfourstorefront Shopping Cart & eCommerce Store)
- [CVE-2023-3177](https://cve.now/CVE-2023-3177.md): SourceCodester Lost and Found Information System view\_inquiry.php sql injection (CVSS 6.3, SourceCodester Lost and Found Information System)
- [CVE-2023-2184](https://cve.now/CVE-2023-2184.md): WP Responsive Tabs horizontal vertical and accordion Tabs \<= 1.1.15 - Reflected Cross-Site Scripting (CVSS 6.1, nik00726 WP Responsive Tabs horizontal vertical and accordi…)
- [CVE-2023-2083](https://cve.now/CVE-2023-2083.md): Essential Blocks \<= 4.0.6 - Missing Authorization via save (CVSS 4.3, wpdevteam Gutenberg Essential Blocks – Page Builder for Gut…)
- [CVE-2023-1895](https://cve.now/CVE-2023-1895.md): Getwid – Gutenberg Blocks \<= 1.8.3 - Authenticated(Subscriber+) Server Side Request Forgery (CVSS 8.5, jetmonsters Getwid – Gutenberg Blocks)
- [CVE-2023-1430](https://cve.now/CVE-2023-1430.md): FluentCRM - Marketing Automation For WordPress \<= 2.8.01 - Insufficient Use of Hash as Authorization Control (CVSS 6.5, techjewel FluentCRM – Email Newsletter, Automation, Email M…)
- [CVE-2023-0692](https://cve.now/CVE-2023-0692.md): Metform Elementor Contact Form Builder \<= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf\_payment\_status' shortcode (CVSS 4.3, roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…)
- [CVE-2023-2555](https://cve.now/CVE-2023-2555.md): WPCS – WordPress Currency Switcher Professional \<= 1.1.9 - Missing Authorization to Custom Drop-Down Currency Switcher Creation (CVSS 4.3, realmag777 WPCS – WordPress Currency Switcher Professional)
- [CVE-2023-1016](https://cve.now/CVE-2023-1016.md): Intuitive Custom Post Order \<= 3.1.4.1 - Authenticated (Admin+) SQL Injection (CVSS 6.6, hijiri Intuitive Custom Post Order)
- [CVE-2023-2031](https://cve.now/CVE-2023-2031.md): Locatoraid Store Locator \<= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 5.4, plainware Locatoraid Store Locator)
- [CVE-2023-2557](https://cve.now/CVE-2023-2557.md): WPCS – WordPress Currency Switcher Professional \<= 1.1.9 - Missing Authorization to Arbitrary Custom Drop-Down Currency Switcher Editing (CVSS 4.3, realmag777 WPCS – WordPress Currency Switcher Professional)
- [CVE-2023-2087](https://cve.now/CVE-2023-2087.md): Essential Blocks \<= 4.0.6 - Cross-Site Request Forgery via save (CVSS 4.3, wpdevteam Gutenberg Essential Blocks – Page Builder for Gut…)
- [CVE-2023-2066](https://cve.now/CVE-2023-2066.md): Announcement & Notification Banner – Bulletin \<= 3.6.0 - Missing Authorization Checks (CVSS 6.3, mikewire\_rocksolid Announcement & Notification Banner – Bul…)
- [CVE-2023-0721](https://cve.now/CVE-2023-0721.md): Metform Elementor Contact Form Builder \<= 3.3.0 - Unauthenticated CSV Injection (CVSS 8.3, roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…)
- [CVE-2023-2289](https://cve.now/CVE-2023-2289.md): wordpress vertical image slider plugin \<= 1.2.16 - Reflected Cross-Site Scripting (CVSS 6.1, nik00726 Vertical Image Slider)
- [CVE-2023-1404](https://cve.now/CVE-2023-1404.md): Weaver Show Posts \<= 1.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via Display Name (CVSS 6.4, wpweaver Weaver Show Posts)
- [CVE-2023-0292](https://cve.now/CVE-2023-0292.md): Quiz And Survey Master \<= 8.0.8 - Cross-Site Request Forgery to Arbitrary Media Deletion (CVSS 5.4, expresstech Quiz and Survey Master (QSM) – Easy Quiz and Su…)
- [CVE-2023-1169](https://cve.now/CVE-2023-1169.md): OoohBoi Steroids for Elementor \<= 2.1.4 - Missing Authorization leading to Authenticated (Subscriber+) Image Upload (CVSS 4.3, sagarpatel124 OoohBoi Steroids for Elementor)
- [CVE-2023-1807](https://cve.now/CVE-2023-1807.md): Elementor Addons, Widgets and Enhancements – Stax \<= 1.4.3 - Cross-Site Request Forgery via toggle\_widget (CVSS 4.3, staxwp Stax Addons for Elementor)
- [CVE-2023-2558](https://cve.now/CVE-2023-2558.md): WPCS – WordPress Currency Switcher Professional \<= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, realmag777 WPCS – WordPress Currency Switcher Professional)
- [CVE-2023-2891](https://cve.now/CVE-2023-2891.md): WP EasyCart \<= 5.4.8 - Cross-Site Request Forgery via process\_delete\_product (CVSS 6.5, levelfourstorefront Shopping Cart & eCommerce Store)
- [CVE-2023-2556](https://cve.now/CVE-2023-2556.md): WPCS – WordPress Currency Switcher Professional \<= 1.1.9 - Missing Authorization to Arbitrary Custom Drop-Down Currency Switcher Deletion (CVSS 4.3, realmag777 WPCS – WordPress Currency Switcher Professional)
- [CVE-2023-2067](https://cve.now/CVE-2023-2067.md): Announcement & Notification Banner – Bulletin \<= 3.7.0 - Cross-Site Request Forgery (CVSS 6.3, mikewire\_rocksolid Announcement & Notification Banner – Bul…)
- [CVE-2023-1978](https://cve.now/CVE-2023-1978.md): ShiftController Employee Shift Scheduling \<= 4.9.25 - Reflected Cross-Site Scripting via Query String (CVSS 6.1, plainware ShiftController Employee Shift Scheduling)
- [CVE-2023-1889](https://cve.now/CVE-2023-1889.md): Directorist \<= 7.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion in listing\_task (CVSS 6.5, wpwax Directorist: AI-Powered Business Directory, Listings…)
- [CVE-2023-2275](https://cve.now/CVE-2023-2275.md): WooCommerce Multivendor Marketplace – REST API \<= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order/Order Note Disclosure, Order Note Addition via REST API (CVSS 4.3, wclovers WCFM – Multivendor Marketplace REST API for WooCom…)
- [CVE-2023-2159](https://cve.now/CVE-2023-2159.md): CMP – Coming Soon & Maintenance \<= 4.1.7 - Maintenance Mode Bypass (CVSS 5.3, CMP – Coming Soon & Maintenance Plugin by NiteoThemes)
- [CVE-2023-0729](https://cve.now/CVE-2023-0729.md): Wicked Folders \<= 2.18.16 - Cross-Site Request Forgery via ajax\_save\_sort\_order (CVSS 5.4, wickedplugins Wicked Folders – Folder Organizer for Pages,…)
- [CVE-2023-0708](https://cve.now/CVE-2023-0708.md): Metform Elementor Contact Form Builder \<= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf\_first\_name shortcode (CVSS 5.4, roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…)
- [CVE-2023-1375](https://cve.now/CVE-2023-1375.md): WP Fastest Cache \<= 1.1.2 - Missing Authorization to Cache Deletion (CVSS 4.3, emrevona WP Fastest Cache – WordPress Cache Plugin)
- [CVE-2023-2085](https://cve.now/CVE-2023-2085.md): Essential Blocks \<= 4.0.6 - Missing Authorization via templates (CVSS 4.3, wpdevteam Gutenberg Essential Blocks – Page Builder for Gut…)
- [CVE-2023-2688](https://cve.now/CVE-2023-2688.md): WordPress File Upload / WordPress File Upload Pro \<= 4.19.1 - Authenticated (Administrator+) Path Traversal (CVSS 4.9, nickboss Iptanus File Upload · WordPress File Upload Pro)
- [CVE-2023-2280](https://cve.now/CVE-2023-2280.md): WP Directory Kit \<= 1.2.2 - Missing Authorization to Plugin Installation, Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk\_public\_action (CVSS 6.5, wpdirectorykit WP Directory Kit)
- [CVE-2023-2305](https://cve.now/CVE-2023-2305.md): Download Manager \<= 3.2.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, codename065 Download Manager)
- [CVE-2023-2086](https://cve.now/CVE-2023-2086.md): Essential Blocks \<= 4.0.6 - Missing Authorization via template\_count (CVSS 4.3, wpdevteam Gutenberg Essential Blocks – Page Builder for Gut…)
- [CVE-2023-2189](https://cve.now/CVE-2023-2189.md): Elementor Addons, Widgets and Enhancements – Stax \<= 1.4.3 - Missing Authorization in toggle\_widget (CVSS 4.3, staxwp Stax Addons for Elementor)
- [CVE-2023-2237](https://cve.now/CVE-2023-2237.md): WP Replicate Post \<= 4.0.2 - Authenticated (Contributor+) SQL Injection (CVSS 8.8, yudiz WP Replicate Post)
- [CVE-2023-0691](https://cve.now/CVE-2023-0691.md): Metform Elementor Contact Form Builder \<= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf\_last\_name shortcode (CVSS 4.3, roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…)
- [CVE-2023-0710](https://cve.now/CVE-2023-0710.md): Metform Elementor Contact Form Builder \<= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf\_thankyou shortcode (CVSS 4.9, roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…)
- [CVE-2023-2450](https://cve.now/CVE-2023-2450.md): The FiboSearch - AJAX Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in version (CVSS 4.4, damian-gora FiboSearch – Ajax Search for WooCommerce)
- [CVE-2023-0688](https://cve.now/CVE-2023-0688.md): Metform Elementor Contact Form Builder \<= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf\_thankyou shortcode (CVSS 6.5, roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…)
- [CVE-2023-1615](https://cve.now/CVE-2023-1615.md): The Ultimate Addons for Contact Form 7 plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in versions up to, and inc (CVSS 8.8, psdtowpservice Ultimate Addons for Contact Form)
- [CVE-2023-2249](https://cve.now/CVE-2023-2249.md): wpForo Forum \<= 2.1.7 - Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file\_get\_contents (CVSS 8.8, tomdever wpForo Forum)
- [CVE-2023-2599](https://cve.now/CVE-2023-2599.md): Active Directory Integration / LDAP Integration \<= 4.1.4 - Cross-Site Request Forgery to SQL Injection (CVSS 3.1, cyberlord92 Active Directory Integration / LDAP Integration)
- [CVE-2023-1910](https://cve.now/CVE-2023-1910.md): Getwid – Gutenberg Blocks \<= 1.8.3 - Improper Authorization via get\_remote\_templates REST endpoint (CVSS 4.3, jetmonsters Getwid – Gutenberg Blocks)
- [CVE-2023-0291](https://cve.now/CVE-2023-0291.md): Quiz And Survey Master \<= 8.0.8 - Unauthenticated Arbitrary Media Deletion (CVSS 7.2, expresstech Quiz and Survey Master (QSM) – Easy Quiz and Su…)
- [CVE-2023-0993](https://cve.now/CVE-2023-0993.md): Shield Security \<= 17.0.17 - Missing Authorization (CVSS 4.3, paultgoodchild Shield: Blocks Bots, Protects Users, and Pre…)
- [CVE-2023-2584](https://cve.now/CVE-2023-2584.md): PixelYourSite \<= 9.3.6 and PixelYourSite Pro \<= 9.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, PixelYourSite – Your smart PIXEL (TAG) & API Manager · Pixe…)
- [CVE-2023-1843](https://cve.now/CVE-2023-1843.md): Metform Elementor Contact Form Builder \<= 3.3.0 - Missing Authorization (CVSS 6.5, roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…)
- [CVE-2023-1403](https://cve.now/CVE-2023-1403.md): Weaver Xtreme Theme \<= 5.0.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Display Name (CVSS 6.4, wpweaver Weaver Xtreme)
- [CVE-2023-2402](https://cve.now/CVE-2023-2402.md): Photo Gallery Slideshow & Masonry Tiled Gallery \<= 1.0.13 - Reflected Cross-Site Scripting (CVSS 6.1, nik00726 Photo Gallery Slideshow & Masonry Tiled Gallery)
- [CVE-2023-0832](https://cve.now/CVE-2023-0832.md): Under Construction \<= 3.96 - Cross-Site Request Forgery via admin\_action\_install\_weglot (CVSS 4.3, webfactory Under Construction)
- [CVE-2023-2526](https://cve.now/CVE-2023-2526.md): Easy Google Maps \<= 1.11.7 - Cross-Site Request Forgery via AJAX action (CVSS 5.4, supsysticcom Easy Google Maps)
- [CVE-2023-1917](https://cve.now/CVE-2023-1917.md): PowerPress \<= 10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 5.4, PowerPress Podcasting plugin by Blubrry)
- [CVE-2023-2452](https://cve.now/CVE-2023-2452.md): Advanced Woo Search \<= 2.77 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, mihail-barinov Advanced Woo Search – Product Search for Woo…)
- [CVE-2023-2484](https://cve.now/CVE-2023-2484.md): Active Directory Integration / LDAP Integration \<= 4.1.4 - Authenticated (Administrator+) SQL Injection (CVSS 7.2, cyberlord92 Active Directory Integration / LDAP Integration)
- [CVE-2023-2414](https://cve.now/CVE-2023-2414.md): Online Booking & Scheduling Calendar for WordPress by vcita \<= 4.4.6 - Missing Authorization to Settings Update and Arbitrary File Upload (CVSS 5.4, Online Booking & Scheduling Calendar for WordPress by vcita)
- [CVE-2023-2604](https://cve.now/CVE-2023-2604.md): Team Circle Image Slider With Lightbox \<= 1.0.17 - Reflected Cross-Site Scripting (CVSS 6.1, nik00726 Team Circle Image Slider With Lightbox)
- [CVE-2023-0709](https://cve.now/CVE-2023-0709.md): Metform Elementor Contact Form Builder \<= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf\_last\_name shortcode (CVSS 5.4, roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…)
- [CVE-2023-2767](https://cve.now/CVE-2023-2767.md): WordPress File Upload / WordPress File Upload Pro \<= 4.19.1 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, nickboss Iptanus File Upload · WordPress File Upload Pro)
- [CVE-2023-0693](https://cve.now/CVE-2023-0693.md): Metform Elementor Contact Form Builder \<= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf\_transaction\_id' shortcode (CVSS 6.5, roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…)
- [CVE-2023-0695](https://cve.now/CVE-2023-0695.md): Metform Elementor Contact Form Builder \<= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf shortcode (CVSS 5.4, roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…)
- [CVE-2023-0694](https://cve.now/CVE-2023-0694.md): Metform Elementor Contact Form Builder \<= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf shortcode (CVSS 6.5, roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…)
- [CVE-2023-2764](https://cve.now/CVE-2023-2764.md): Draw Attention \<= 2.0.11 - Missing Authorization to Arbitrary Post Featured Image Modification (CVSS 4.3, croixhaug Interactive Image Map Plugin – Draw Attention)
- [CVE-2023-0992](https://cve.now/CVE-2023-0992.md): Shield Security \<= 17.0.17 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, paultgoodchild Shield: Blocks Bots, Protects Users, and Pre…)
- [CVE-2023-2607](https://cve.now/CVE-2023-2607.md): Multiple Page Generator Plugin \<= 3.3.17 - Authenticated (Administrator+) SQL Injection (CVSS 7.2, themeisle Multiple Page Generator Plugin – MPG)
- [CVE-2023-2084](https://cve.now/CVE-2023-2084.md): Essential Blocks \<= 4.0.6 - Missing Authorization via get (CVSS 4.3, wpdevteam Gutenberg Essential Blocks – Page Builder for Gut…)
- [CVE-2023-0831](https://cve.now/CVE-2023-0831.md): Under Construction \<= 3.96 - Cross-Site Request Forgery via admin\_action\_ucp\_dismiss\_notice (CVSS 4.3, webfactory Under Construction)
- [CVE-2023-1888](https://cve.now/CVE-2023-1888.md): Directorist \<= 7.5.4 - Authenticated (Subscriber+) Arbitrary User Password Reset to Privilege Escalation (CVSS 8.8, wpwax Directorist: AI-Powered Business Directory, Listings…)
- [CVE-2023-3176](https://cve.now/CVE-2023-3176.md): SourceCodester Lost and Found Information System manage\_user.php sql injection (CVSS 6.3, SourceCodester Lost and Found Information System)
- [CVE-2023-0342](https://cve.now/CVE-2023-0342.md): MongoDB Ops Manager may disclose sensitive information in Diagnostic Archive (CVSS 3.1, MongoDB Ops Manager)
- [CVE-2023-2454](https://cve.now/CVE-2023-2454.md): schema\_element defeats protective search\_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacke (CVSS 7.2, postgresql)
- [CVE-2023-2455](https://cve.now/CVE-2023-2455.md): Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases wh (CVSS 5.4, postgresql)
- [CVE-2023-26465](https://cve.now/CVE-2023-26465.md): Pega Platform versions 7.2 to 8.8.1 are affected by an XSS issue. (CVSS 8.0, Pegasystems Pega Infinity)
- [CVE-2023-27706](https://cve.now/CVE-2023-27706.md): Bitwarden Windows desktop application versions prior to v2023.4.0 store biometric keys in Windows Credential Manager, accessible to other lo (CVSS 7.1)
- [CVE-2023-29712](https://cve.now/CVE-2023-29712.md): Cross Site Scripting vulnerability found in Vade Secure Gateway allows a remote attacker to execute arbitrary code via a crafted payload to (CVSS 6.1)
- [CVE-2023-29713](https://cve.now/CVE-2023-29713.md): Cross Site Scripting vulnerability found in Vade Secure Gateway allows a remote attacker to execute arbitrary code via a crafted payload to (CVSS 6.1)
- [CVE-2023-29714](https://cve.now/CVE-2023-29714.md): Cross Site Scripting vulnerability found in Vade Secure Gateway allows a remote attacker to execute arbitrary code via the username, passwor (CVSS 6.1)
- [CVE-2023-29749](https://cve.now/CVE-2023-29749.md): An issue found in Yandex Navigator v.6.60 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the (CVSS 7.8)
- [CVE-2023-29751](https://cve.now/CVE-2023-29751.md): An issue found in Yandex Navigator v.6.60 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the S (CVSS 5.5)
- [CVE-2023-29752](https://cve.now/CVE-2023-29752.md): An issue found in Facemoji Emoji Keyboard v.2.9.1.2 for Android allows unauthorized apps to cause escalation of privilege attacks by manipul (CVSS 7.8)
- [CVE-2023-29753](https://cve.now/CVE-2023-29753.md): An issue found in Facemoji Emoji Keyboard v.2.9.1.2 for Android allows a local attacker to cause a denial of service via the SharedPreferenc (CVSS 5.5)
- [CVE-2023-29755](https://cve.now/CVE-2023-29755.md): An issue found in Twilight v.13.3 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the SharedPr (CVSS 7.8)
- [CVE-2023-29756](https://cve.now/CVE-2023-29756.md): An issue found in Twilight v.13.3 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SharedPre (CVSS 5.5)
- [CVE-2023-29757](https://cve.now/CVE-2023-29757.md): An issue found in Blue Light Filter v.1.5.5 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating th (CVSS 7.8)
- [CVE-2023-29758](https://cve.now/CVE-2023-29758.md): An issue found in Blue Light Filter v.1.5.5 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the (CVSS 5.5)
- [CVE-2023-29759](https://cve.now/CVE-2023-29759.md): An issue found in FlightAware v.5.8.0 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the datab (CVSS 5.5)
- [CVE-2023-29761](https://cve.now/CVE-2023-29761.md): An issue found in Sleep v.20230303 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SharedPr (CVSS 5.5)
- [CVE-2023-29766](https://cve.now/CVE-2023-29766.md): An issue found in CrossX v.1.15.3 for Android allows a local attacker to cause an escalation of Privileges via the database files. (CVSS 7.8)
- [CVE-2023-29767](https://cve.now/CVE-2023-29767.md): An issue found in CrossX v.1.15.3 for Android allows a local attacker to cause a persistent denial of service via the database files. (CVSS 5.5)
- [CVE-2023-30262](https://cve.now/CVE-2023-30262.md): An issue found in MIM software Inc MIM License Server and MIMpacs services v.6.9 thru v.7.0 fixed in v.7.0.10 allows a remote unauthenticate (CVSS 8.8)
- [CVE-2023-3141](https://cve.now/CVE-2023-3141.md): A use-after-free flaw was found in r592\_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. (CVSS 7.1, Kernel)
- [CVE-2023-3172](https://cve.now/CVE-2023-3172.md): Path Traversal in froxlor/froxlor (CVSS 6.5, froxlor/froxlor)
- [CVE-2023-3173](https://cve.now/CVE-2023-3173.md): Improper Restriction of Excessive Authentication Attempts in froxlor/froxlor (CVSS 9.8, froxlor/froxlor)
- [CVE-2023-33557](https://cve.now/CVE-2023-33557.md): Fuel CMS v1.5.2 was discovered to contain a SQL injection vulnerability via the id parameter at /controllers/Blocks.php. (CVSS 8.8)
- [CVE-2023-34363](https://cve.now/CVE-2023-34363.md): An issue was discovered in Progress DataDirect Connect for ODBC before 08.02.2770 for Oracle. (CVSS 5.9)
- [CVE-2023-34364](https://cve.now/CVE-2023-34364.md): A buffer overflow was discovered in Progress DataDirect Connect for ODBC before 08.02.2770 for Oracle. (CVSS 9.8)
- [CVE-2023-34856](https://cve.now/CVE-2023-34856.md): A Cross Site Scripting (XSS) vulnerability in D-Link DI-7500G-CI-19.05.29A allows attackers to execute arbitrary code via uploading a crafte (CVSS 5.4)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-06-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.