# CVEs published 2023-06-12

81 CVEs were published on June 12, 2023: 9 critical, 30 high. Days are UTC.

- [CVE-2023-32674](https://cve.now/CVE-2023-32674.md): Certain versions of HP PC Hardware Diagnostics Windows are potentially vulnerable to buffer overflow. (CVSS 9.8, HP PC Hardware Diagnostics Windows)
- [CVE-2023-32673](https://cve.now/CVE-2023-32673.md): Certain versions of HP PC Hardware Diagnostics Windows, HP Image Assistant, and HP Thunderbolt Dock G2 Firmware are potentially vulnerable t (CVSS 9.8, HP PC Hardware Diagnostics Windows, HP Image Assistant, and…)
- [CVE-2023-26298](https://cve.now/CVE-2023-26298.md): Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges. (CVSS 8.8, HP Device Manager)
- [CVE-2023-26297](https://cve.now/CVE-2023-26297.md): Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges. (CVSS 8.8, HP Device Manager)
- [CVE-2023-26296](https://cve.now/CVE-2023-26296.md): Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges. (CVSS 8.8, HP Device Manager)
- [CVE-2023-26295](https://cve.now/CVE-2023-26295.md): Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges. (CVSS 9.8, HP Device Manager)
- [CVE-2023-26294](https://cve.now/CVE-2023-26294.md): Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges. (CVSS 7.8, HP Device Manager)
- [CVE-2023-1897](https://cve.now/CVE-2023-1897.md): CVE-2023-1897 (CVSS 9.4, Atlas Copco Power Focus)
- [CVE-2023-1898](https://cve.now/CVE-2023-1898.md): CVE-2023-1898 (CVSS 9.4, Atlas Copco Power Focus)
- [CVE-2023-1899](https://cve.now/CVE-2023-1899.md): CVE-2023-1899 (CVSS 9.4, Atlas Copco Power Focus)
- [CVE-2022-43778](https://cve.now/CVE-2022-43778.md): Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may all (CVSS 7.8, HP PC BIOS)
- [CVE-2022-43777](https://cve.now/CVE-2022-43777.md): Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may all (CVSS 7.8, HP PC BIOS)
- [CVE-2022-27541](https://cve.now/CVE-2022-27541.md): Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may all (CVSS 7.8, HP PC BIOS)
- [CVE-2022-27539](https://cve.now/CVE-2022-27539.md): Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may all (CVSS 7.8, HP PC BIOS)
- [CVE-2022-36331](https://cve.now/CVE-2022-36331.md): Impersonation attack causing an Authentication Bypass on Western Digital devices (CVSS 10.0, Western Digital My Cloud OS · Western Digital My Cloud H… +1)
- [CVE-2023-2568](https://cve.now/CVE-2023-2568.md): Photo Gallery by Ays \< 5.1.7 - Reflected XSS (no CVSS, Photo Gallery by Ays)
- [CVE-2023-2362](https://cve.now/CVE-2023-2362.md): Multiple Plugins from Wow-Company - Reflected XSS (CVSS 6.1, Float menu · Bubble Menu +10)
- [CVE-2023-2398](https://cve.now/CVE-2023-2398.md): Icegram Engage \< 3.1.12 - Reflected XSS (no CVSS, Icegram Engage)
- [CVE-2023-0431](https://cve.now/CVE-2023-0431.md): File Away \<= 3.9.9.0.1 - Contributor+ Stored XSS via Shortcode (no CVSS, File Away)
- [CVE-2023-2718](https://cve.now/CVE-2023-2718.md): Contact Form Email \< 1.3.38 - Unauthenticated Stored Cross-Site Scripting (no CVSS, Contact Form Email)
- [CVE-2023-1323](https://cve.now/CVE-2023-1323.md): Easy Forms for MailChimp \< 6.8.9 - Admin+ Stored XSS (CVSS 4.8, Easy Forms for Mailchimp)
- [CVE-2023-34336](https://cve.now/CVE-2023-34336.md): AMI BMC contains a vulnerability in the IPMI handler, where an attacker with the required privileges can cause a buffer overflow, which may (CVSS 8.1, AMI MegaRAC\_SPx)
- [CVE-2023-34335](https://cve.now/CVE-2023-34335.md): AMI BMC contains a vulnerability in the IPMI handler, where an unauthenticated host is allowed to write to a host SPI flash, bypassing secur (CVSS 7.7, AMI MegaRAC\_SPx)
- [CVE-2023-34334](https://cve.now/CVE-2023-34334.md): AMI BMC contains a vulnerability in the SPX REST API, where an attacker with the required privileges can inject arbitrary shell commands, wh (CVSS 7.2, AMI MegaRAC\_SPx)
- [CVE-2023-34343](https://cve.now/CVE-2023-34343.md): AMI BMC contains a vulnerability in the SPX REST API, where an attacker with the required privileges can inject arbitrary shell commands, wh (CVSS 7.2, AMI MegaRAC\_SPx)
- [CVE-2023-34342](https://cve.now/CVE-2023-34342.md): AMI BMC contains a vulnerability in the IPMI handler, where an attacker can upload and download arbitrary files under certain circumstances, (CVSS 6.0, AMI MegaRAC\_SPx)
- [CVE-2023-34341](https://cve.now/CVE-2023-34341.md): AMI BMC contains a vulnerability in the SPX REST API, where an attacker with the required privileges can read and write to arbitrary locatio (CVSS 7.2, AMI MegaRAC\_SPx)
- [CVE-2023-34345](https://cve.now/CVE-2023-34345.md): AMI BMC contains a vulnerability in the SPX REST API, where an attacker with the required privileges can access arbitrary files, which may l (CVSS 6.5, AMI MegaRAC\_SPx)
- [CVE-2023-34344](https://cve.now/CVE-2023-34344.md): A vulnerability in the IPMI handler, where an unauthorized attacker can use certain oracles to guess a valid username (CVSS 5.3, AMI MegaRAC\_SPx)
- [CVE-2023-34246](https://cve.now/CVE-2023-34246.md): Doorkeeper Improper Authentication vulnerability (CVSS 4.2, doorkeeper-gem doorkeeper · doorkeeper)
- [CVE-2023-34105](https://cve.now/CVE-2023-34105.md): SRS has command injection vulnerability in demonstration api-server for HTTP callback. (CVSS 7.5, ossrs srs)
- [CVE-2023-35054](https://cve.now/CVE-2023-35054.md): In JetBrains YouTrack before 2023.1.10518 stored XSS in a Markdown-rendering engine was possible (CVSS 4.6, JetBrains YouTrack)
- [CVE-2023-35053](https://cve.now/CVE-2023-35053.md): In JetBrains YouTrack before 2023.1.10518 a DoS attack was possible via Helpdesk forms (CVSS 7.5, JetBrains YouTrack)
- [CVE-2023-29385](https://cve.now/CVE-2023-29385.md): WordPress WP Abstracts Plugin \<= 2.6.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Kevon Adonis WP Abstracts)
- [CVE-2023-34212](https://cve.now/CVE-2023-34212.md): Apache NiFi: Potential Deserialization of Untrusted Data with JNDI in JMS Components (no CVSS, Apache Software Foundation Apache NiFi · org.apache.nifi:ni…)
- [CVE-2023-28933](https://cve.now/CVE-2023-28933.md): WordPress Call Now Accessibility Button Plugin \<= 1.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, StPeteDesign Call Now Accessibility Button)
- [CVE-2023-34468](https://cve.now/CVE-2023-34468.md): Apache NiFi: Potential Code Injection with Database Services using H2 (CVSS 8.8, Apache Software Foundation Apache NiFi · org.apache.nifi… +2)
- [CVE-2023-34026](https://cve.now/CVE-2023-34026.md): WordPress This Day In History Plugin \<= 3.10.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, BrokenCrust This Day In History)
- [CVE-2023-3208](https://cve.now/CVE-2023-3208.md): RoadFlow Visual Process Engine .NET Core Mvc Login sql injection (CVSS 6.3, RoadFlow Visual Process Engine .NET Core Mvc)
- [CVE-2023-3206](https://cve.now/CVE-2023-3206.md): Chengdu VEC40G denial of service (CVSS 5.3, Chengdu VEC40G)
- [CVE-2023-32118](https://cve.now/CVE-2023-32118.md): WordPress SALERT Plugin \<= 1.2.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, WPoperation SALERT – Fake Sales Notification WooCommerce)
- [CVE-2023-31236](https://cve.now/CVE-2023-31236.md): WordPress Scripts n Styles Plugin \<= 3.5.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, unFocus Projects Scripts n Styles)
- [CVE-2023-32961](https://cve.now/CVE-2023-32961.md): WordPress Zotpress Plugin \<= 7.3.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Katie Seaborn Zotpress)
- [CVE-2023-30745](https://cve.now/CVE-2023-30745.md): WordPress IP Metaboxes Plugin \<= 2.1.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Phan Chuong IP Metaboxes)
- [CVE-2023-30753](https://cve.now/CVE-2023-30753.md): WordPress IP Metaboxes Plugin \<= 2.1.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Phan Chuong IP Metaboxes)
- [CVE-2023-23822](https://cve.now/CVE-2023-23822.md): WordPress UTM Tracker Plugin \<= 1.3.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Ludwig Media UTM Tracker)
- [CVE-2023-23819](https://cve.now/CVE-2023-23819.md): WordPress itemprop WP for SERP/SEO Rich snippets Plugin \<= 3.5.201706131 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Rolands Umbrovskis itemprop WP for SERP/SEO Rich snippets)
- [CVE-2022-47140](https://cve.now/CVE-2022-47140.md): WordPress ARMember Plugin \<= 4.0.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Repute InfoSystems ARMember)
- [CVE-2022-45827](https://cve.now/CVE-2022-45827.md): WordPress Video Contest WordPress Plugin Plugin \<= 3.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, GalleryPlugins Video Contest)
- [CVE-2023-23818](https://cve.now/CVE-2023-23818.md): WordPress WP Register Profile With Shortcode Plugin \<= 3.5.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Aviplugins.com WP Register Profile With Shortcode)
- [CVE-2015-10118](https://cve.now/CVE-2015-10118.md): cchetanonline WP-CopyProtect wp-copyprotect.php CopyProtect\_options\_page cross site scripting (CVSS 3.5, cchetanonline WP-CopyProtect)
- [CVE-2023-26133](https://cve.now/CVE-2023-26133.md): All versions of the package progressbar.js are vulnerable to Prototype Pollution via the function extend() in the file utils.js. (CVSS 8.2, progressbar.js)
- [CVE-2020-36732](https://cve.now/CVE-2020-36732.md): The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the ou (CVSS 5.3, crypto-js)
- [CVE-2022-38156](https://cve.now/CVE-2022-38156.md): A remote command injection issues exists in the web server of the Kratos SpectralNet device with SpectralNet Narrowband (NB) before 1.7.5. (no CVSS)
- [CVE-2023-27716](https://cve.now/CVE-2023-27716.md): An issue was discovered in freakchicken kafkaUI-lite 1.2.11 allows attackers on the same network to gain escalated privileges for the nodes (CVSS 9.8)
- [CVE-2023-28478](https://cve.now/CVE-2023-28478.md): TP-Link EC-70 devices through 2.3.4 Build 20220902 rel.69498 have a Buffer Overflow. (CVSS 8.8)
- [CVE-2023-30198](https://cve.now/CVE-2023-30198.md): Prestashop winbizpayment \<= 1.0.2 is vulnerable to Incorrect Access Control via modules/winbizpayment/downloads/download.php. (CVSS 7.5)
- [CVE-2023-3159](https://cve.now/CVE-2023-3159.md): A use after free issue was discovered in driver/firewire in outbound\_phy\_packet\_callback in the Linux Kernel. (CVSS 6.7, Kernel)
- [CVE-2023-3161](https://cve.now/CVE-2023-3161.md): A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. (CVSS 5.5, Linux Kernel)
- [CVE-2023-32219](https://cve.now/CVE-2023-32219.md): Mazda cars unlocking (CVSS 6.5, Mazda)
- [CVE-2023-32220](https://cve.now/CVE-2023-32220.md): Milesight NCR/Camera Authentication Bypass (CVSS 8.2, Milesight NCR/camera)
- [CVE-2023-32221](https://cve.now/CVE-2023-32221.md): EaseUS Todo Backup may allow local privilege escalation (CVSS 8.8, EaseUS Todo Backup)
- [CVE-2023-33253](https://cve.now/CVE-2023-33253.md): LabCollector 6.0 though 6.15 allows remote code execution. (no CVSS)
- [CVE-2023-33290](https://cve.now/CVE-2023-33290.md): The git-url-parse crate through 0.4.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to normalize\_url in lib (no CVSS, git-url-parse)
- [CVE-2023-33492](https://cve.now/CVE-2023-33492.md): EyouCMS 1.6.2 is vulnerable to Cross Site Scripting (XSS). (no CVSS)
- [CVE-2023-33625](https://cve.now/CVE-2023-33625.md): D-Link DIR-600 Hardware Version B5, Firmware Version 2.18 was discovered to contain a command injection vulnerability via the ST parameter i (no CVSS)
- [CVE-2023-33626](https://cve.now/CVE-2023-33626.md): D-Link DIR-600 Hardware Version B5, Firmware Version 2.18 was discovered to contain a stack overflow via the gena.cgi binary. (no CVSS)
- [CVE-2023-34488](https://cve.now/CVE-2023-34488.md): NanoMQ 0.17.5 has a one-byte heap-based buffer over-read in the conn\_handler function of mqtt\_parser.c when it processes malformed messages. (CVSS 8.0)
- [CVE-2023-34494](https://cve.now/CVE-2023-34494.md): NanoMQ 0.16.5 is vulnerable to heap-use-after-free in the nano\_ctx\_send function of nmq\_mqtt.c. (no CVSS)
- [CVE-2023-34581](https://cve.now/CVE-2023-34581.md): Sourcecodester Service Provider Management System v1.0 is vulnerable to SQL Injection via the ID parameter in /php-spms/?page=services/view& (no CVSS)
- [CVE-2023-34855](https://cve.now/CVE-2023-34855.md): A Cross Site Scripting (XSS) vulnerability in Youxun Electronic Equipment (Shanghai) Co., Ltd AC Centralized Management Platform v1.02.040 a (no CVSS)
- [CVE-2023-34940](https://cve.now/CVE-2023-34940.md): Asus RT-N10LX Router v2.0.0.39 was discovered to contain a stack overflow via the url parameter at /start-apply.html. (CVSS 7.5)
- [CVE-2023-34941](https://cve.now/CVE-2023-34941.md): A stored cross-site scripting (XSS) vulnerability in the urlFilterList function of Asus RT-N10LX Router v2.0.0.39 allows attackers to execut (CVSS 5.4)
- [CVE-2023-34942](https://cve.now/CVE-2023-34942.md): Asus RT-N10LX Router v2.0.0.39 was discovered to contain a stack overflow via the mac parameter at /start-apply.html. (no CVSS)
- [CVE-2023-35031](https://cve.now/CVE-2023-35031.md): Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8, Assistant V10 R0, Manager V10 R1 before V10 R1.42.0 and V10 R (CVSS 8.8)
- [CVE-2023-35032](https://cve.now/CVE-2023-35032.md): Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8 and Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8 allow co (no CVSS)
- [CVE-2023-35033](https://cve.now/CVE-2023-35033.md): Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8, Assistant V10 R0, Manager V10 R1 before V10 R1.42.0 and V10 R (no CVSS)
- [CVE-2023-35034](https://cve.now/CVE-2023-35034.md): Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8 and Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8 allow re (no CVSS)
- [CVE-2023-35035](https://cve.now/CVE-2023-35035.md): Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8, Assistant V10 R0, Manager V10 R1 before V10 R1.42.0 and V10 R (no CVSS)
- [CVE-2023-35036](https://cve.now/CVE-2023-35036.md): In Progress MOVEit Transfer before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022.1.6 (14.1.6), and 2023.0.2 (15.0.2), SQL in (CVSS 9.1)
- [CVE-2023-35042](https://cve.now/CVE-2023-35042.md): GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via java.lang.Runtime.getRuntime().exec in wps:Litera (no CVSS, org.geoserver:gs-wms · org.geoserver:gs-wfs +1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-06-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.