CVEs published June 12, 2023
81 CVEs were published on June 12, 2023: 9 critical, 30 high.
- Published
- 81
- Critical
- 9
- High
- 30
- Medium
- 21
- Low
- 1
- Unrated
- 20
- Now in CISA KEV
- 0
- Fix available
- 24
Most affected products
- AMI MegaRAC_SPx
- 8
- HP Device Manager
- 5
- HP PC BIOS
- 4
- Atlas Copco Power Focus
- 3
- JetBrains YouTrack
- 2
- Phan Chuong IP Metaboxes
- 2
- Apache Software Foundation Apache NiFi · org.apache.nifi:ni…
- 1
- Apache Software Foundation Apache NiFi · org.apache.nifi… +2
- 1
- Aviplugins.com WP Register Profile With Shortcode
- 1
- BrokenCrust This Day In History
- 1
Critical 9
- CVE-2023-32674Certain versions of HP PC Hardware Diagnostics Windows are potentially vulnerable to buffer overflow.HP PC Hardware Diagnostics Windows
- CVE-2023-32673Certain versions of HP PC Hardware Diagnostics Windows, HP Image Assistant, and HP Thunderbolt Dock G2 Firmware are potentially vulnerable tHP PC Hardware Diagnostics Windows, HP Image Assistant, and…
- CVE-2023-26295Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges.HP Device Manager
- CVE-2023-1897CVE-2023-1897Atlas Copco Power Focus
- CVE-2023-1898CVE-2023-1898Atlas Copco Power Focus
- CVE-2023-1899CVE-2023-1899Atlas Copco Power Focus
- CVE-2022-36331Impersonation attack causing an Authentication Bypass on Western Digital devicesWestern Digital My Cloud OS · Western Digital My Cloud H… +1
- CVE-2023-27716An issue was discovered in freakchicken kafkaUI-lite 1.2.11 allows attackers on the same network to gain escalated privileges for the nodes
- CVE-2023-35036In Progress MOVEit Transfer before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022.1.6 (14.1.6), and 2023.0.2 (15.0.2), SQL in
High 30
- CVE-2023-26298Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges.HP Device Manager
- CVE-2023-26297Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges.HP Device Manager
- CVE-2023-26296Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges.HP Device Manager
- CVE-2023-26294Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges.HP Device Manager
- CVE-2022-43778Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allHP PC BIOS
- CVE-2022-43777Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allHP PC BIOS
- CVE-2022-27541Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allHP PC BIOS
- CVE-2022-27539Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allHP PC BIOS
- CVE-2023-34336AMI BMC contains a vulnerability in the IPMI handler, where an attacker with the required privileges can cause a buffer overflow, which may AMI MegaRAC_SPx
- CVE-2023-34335AMI BMC contains a vulnerability in the IPMI handler, where an unauthenticated host is allowed to write to a host SPI flash, bypassing securAMI MegaRAC_SPx
- CVE-2023-34334AMI BMC contains a vulnerability in the SPX REST API, where an attacker with the required privileges can inject arbitrary shell commands, whAMI MegaRAC_SPx
- CVE-2023-34343AMI BMC contains a vulnerability in the SPX REST API, where an attacker with the required privileges can inject arbitrary shell commands, whAMI MegaRAC_SPx
- CVE-2023-34341AMI BMC contains a vulnerability in the SPX REST API, where an attacker with the required privileges can read and write to arbitrary locatioAMI MegaRAC_SPx
- CVE-2023-34105SRS has command injection vulnerability in demonstration api-server for HTTP callback.ossrs srs
- CVE-2023-35053In JetBrains YouTrack before 2023.1.10518 a DoS attack was possible via Helpdesk formsJetBrains YouTrack
- CVE-2023-29385WordPress WP Abstracts Plugin <= 2.6.2 is vulnerable to Cross Site Scripting (XSS)Kevon Adonis WP Abstracts
- CVE-2023-34468Apache NiFi: Potential Code Injection with Database Services using H2Apache Software Foundation Apache NiFi · org.apache.nifi… +2
- CVE-2023-34026WordPress This Day In History Plugin <= 3.10.1 is vulnerable to Cross Site Scripting (XSS)BrokenCrust This Day In History
- CVE-2023-32118WordPress SALERT Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)WPoperation SALERT – Fake Sales Notification WooCommerce
- CVE-2023-32961WordPress Zotpress Plugin <= 7.3.3 is vulnerable to Cross Site Scripting (XSS)Katie Seaborn Zotpress
- CVE-2023-30753WordPress IP Metaboxes Plugin <= 2.1.1 is vulnerable to Cross Site Scripting (XSS)Phan Chuong IP Metaboxes
- CVE-2022-47140WordPress ARMember Plugin <= 4.0.1 is vulnerable to Cross Site Scripting (XSS)Repute InfoSystems ARMember
- CVE-2023-26133All versions of the package progressbar.js are vulnerable to Prototype Pollution via the function extend() in the file utils.js.progressbar.js
- CVE-2023-28478TP-Link EC-70 devices through 2.3.4 Build 20220902 rel.69498 have a Buffer Overflow.
- CVE-2023-30198Prestashop winbizpayment <= 1.0.2 is vulnerable to Incorrect Access Control via modules/winbizpayment/downloads/download.php.
- CVE-2023-32220Milesight NCR/Camera Authentication BypassMilesight NCR/camera
- CVE-2023-32221EaseUS Todo Backup may allow local privilege escalationEaseUS Todo Backup
- CVE-2023-34488NanoMQ 0.17.5 has a one-byte heap-based buffer over-read in the conn_handler function of mqtt_parser.c when it processes malformed messages.
- CVE-2023-34940Asus RT-N10LX Router v2.0.0.39 was discovered to contain a stack overflow via the url parameter at /start-apply.html.
- CVE-2023-35031Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8, Assistant V10 R0, Manager V10 R1 before V10 R1.42.0 and V10 R
Medium, low and unrated 42
- CVE-2023-2568Photo Gallery by Ays < 5.1.7 - Reflected XSSPhoto Gallery by Ays
- CVE-2023-2362Multiple Plugins from Wow-Company - Reflected XSSFloat menu · Bubble Menu +10
- CVE-2023-2398Icegram Engage < 3.1.12 - Reflected XSSIcegram Engage
- CVE-2023-0431File Away <= 3.9.9.0.1 - Contributor+ Stored XSS via ShortcodeFile Away
- CVE-2023-2718Contact Form Email < 1.3.38 - Unauthenticated Stored Cross-Site ScriptingContact Form Email
- CVE-2023-1323Easy Forms for MailChimp < 6.8.9 - Admin+ Stored XSSEasy Forms for Mailchimp
- CVE-2023-34342AMI BMC contains a vulnerability in the IPMI handler, where an attacker can upload and download arbitrary files under certain circumstances,AMI MegaRAC_SPx
- CVE-2023-34345AMI BMC contains a vulnerability in the SPX REST API, where an attacker with the required privileges can access arbitrary files, which may lAMI MegaRAC_SPx
- CVE-2023-34344A vulnerability in the IPMI handler, where an unauthorized attacker can use certain oracles to guess a valid usernameAMI MegaRAC_SPx
- CVE-2023-34246Doorkeeper Improper Authentication vulnerabilitydoorkeeper-gem doorkeeper · doorkeeper
- CVE-2023-35054In JetBrains YouTrack before 2023.1.10518 stored XSS in a Markdown-rendering engine was possibleJetBrains YouTrack
- CVE-2023-34212Apache NiFi: Potential Deserialization of Untrusted Data with JNDI in JMS ComponentsApache Software Foundation Apache NiFi · org.apache.nifi:ni…
- CVE-2023-28933WordPress Call Now Accessibility Button Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)StPeteDesign Call Now Accessibility Button
- CVE-2023-3208RoadFlow Visual Process Engine .NET Core Mvc Login sql injectionRoadFlow Visual Process Engine .NET Core Mvc
- CVE-2023-3206Chengdu VEC40G denial of serviceChengdu VEC40G
- CVE-2023-31236WordPress Scripts n Styles Plugin <= 3.5.7 is vulnerable to Cross Site Scripting (XSS)unFocus Projects Scripts n Styles
- CVE-2023-30745WordPress IP Metaboxes Plugin <= 2.1.1 is vulnerable to Cross Site Scripting (XSS)Phan Chuong IP Metaboxes
- CVE-2023-23822WordPress UTM Tracker Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)Ludwig Media UTM Tracker
- CVE-2023-23819WordPress itemprop WP for SERP/SEO Rich snippets Plugin <= 3.5.201706131 is vulnerable to Cross Site Scripting (XSS)Rolands Umbrovskis itemprop WP for SERP/SEO Rich snippets
- CVE-2022-45827WordPress Video Contest WordPress Plugin Plugin <= 3.2 is vulnerable to Cross Site Scripting (XSS)GalleryPlugins Video Contest
- CVE-2023-23818WordPress WP Register Profile With Shortcode Plugin <= 3.5.7 is vulnerable to Cross Site Scripting (XSS)Aviplugins.com WP Register Profile With Shortcode
- CVE-2015-10118cchetanonline WP-CopyProtect wp-copyprotect.php CopyProtect_options_page cross site scriptingcchetanonline WP-CopyProtect
- CVE-2020-36732The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the oucrypto-js
- CVE-2022-38156A remote command injection issues exists in the web server of the Kratos SpectralNet device with SpectralNet Narrowband (NB) before 1.7.5.
- CVE-2023-3159A use after free issue was discovered in driver/firewire in outbound_phy_packet_callback in the Linux Kernel.Kernel
- CVE-2023-3161A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel.Linux Kernel
- CVE-2023-32219Mazda cars unlockingMazda
- CVE-2023-33253LabCollector 6.0 though 6.15 allows remote code execution.
- CVE-2023-33290The git-url-parse crate through 0.4.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to normalize_url in libgit-url-parse
- CVE-2023-33492EyouCMS 1.6.2 is vulnerable to Cross Site Scripting (XSS).
- CVE-2023-33625D-Link DIR-600 Hardware Version B5, Firmware Version 2.18 was discovered to contain a command injection vulnerability via the ST parameter i
- CVE-2023-33626D-Link DIR-600 Hardware Version B5, Firmware Version 2.18 was discovered to contain a stack overflow via the gena.cgi binary.
- CVE-2023-34494NanoMQ 0.16.5 is vulnerable to heap-use-after-free in the nano_ctx_send function of nmq_mqtt.c.
- CVE-2023-34581Sourcecodester Service Provider Management System v1.0 is vulnerable to SQL Injection via the ID parameter in /php-spms/?page=services/view&
- CVE-2023-34855A Cross Site Scripting (XSS) vulnerability in Youxun Electronic Equipment (Shanghai) Co., Ltd AC Centralized Management Platform v1.02.040 a
- CVE-2023-34941A stored cross-site scripting (XSS) vulnerability in the urlFilterList function of Asus RT-N10LX Router v2.0.0.39 allows attackers to execut
- CVE-2023-34942Asus RT-N10LX Router v2.0.0.39 was discovered to contain a stack overflow via the mac parameter at /start-apply.html.
- CVE-2023-35032Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8 and Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8 allow co
- CVE-2023-35033Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8, Assistant V10 R0, Manager V10 R1 before V10 R1.42.0 and V10 R
- CVE-2023-35034Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8 and Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8 allow re
- CVE-2023-35035Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8, Assistant V10 R0, Manager V10 R1 before V10 R1.42.0 and V10 R
- CVE-2023-35042GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via java.lang.Runtime.getRuntime().exec in wps:Literaorg.geoserver:gs-wms · org.geoserver:gs-wfs +1