CVEs published in May 2023
2,572 vulnerabilities, 261 critical, 9 exploited.
- codestag stagtoolsStagtools < 2.3.7 - Contributor+ Stored XSS5.4 Medium
- seopressSEOPress < 6.5.0.3 - Admin+ PHP Object Injection7.2 High
- pixelyoursite product catalog feed by pixelyoursite, product catalog feed +1 moreProduct Catalog Feed by PixelYourSite < 2.1.1 - Reflected XSS6.1 Medium
- codename065 download managerDownload Manager Pro < 6.3.0 - Unauthenticated Sensitive Information Disclosure7.5 High
- unknown ruby help deskRuby Help Desk < 1.3.4 - Subscriber+ Ticket Update via IDOR6.5 Medium
- fullworks quick paypal paymentsQuick Paypal Payments < 5.7.26.4 - Admin+ Stored XSS4.8 Medium
- unknown amr ical events lists, amr-ical-events-list project amr-ical-events-list +1 moreAmr Ical Events Lists <= 6.6 - Admin+ Stored XSS4.8 Medium
- automattic limit login attempts, limit login attempts project login attempts +1 moreLimit Login Attempts < 1.7.2 - Subscriber+ Stored XSS5.4 Medium
- geminilabs site reviewsSite Reviews < 6.7.1 - Admin+ Stored XSS4.8 Medium
- unknown zyrex popup, zyrex popup +1 moreZyrex Popup <= 1.0 - Admin+ Arbitrary File Upload7.2 High
- qualcomm qam8295p firmware, qca6574au firmware, qca6696 firmware +11 more +13 moreImproper Access Control in HAB Memory Management8.4 High
- qualcomm 315 5g iot modem firmware, aqt1000 firmware, ar8035 firmware +80 more +82 moreReachable assertion in Modem7.5 High
- qualcomm 9205 lte modem firmware, 9206 lte modem firmware, 9207 lte modem firmware +11 more +13 moreBuffer over-read in Modem8.2 High
- qualcomm 315 5g iot modem firmware, ar8035 firmware, qca6390 firmware +66 more +68 moreReachable assertion in Modem7.5 High
- qualcomm 315 5g iot modem firmware, ar8035 firmware, csra6620 firmware +79 more +81 moreNull pointer dereference in Modem7.5 High
- qualcomm 9205 lte modem firmware, 9206 lte modem firmware, 9207 lte modem firmware +42 more +44 moreNULL pointers dereference in Modem7.5 High
- qualcomm sg4150p firmware, sm6225-ad firmware, sm6225 firmware +6 more +8 moreUse after free in Qualcomm IPC7.8 High
- qualcomm ar8035 firmware, qam8295p firmware, qca6390 firmware +53 more +55 moreImproper Restriction of Operations within the Bounds of a Memory Buffer in Automotive7.8 High
- bestwebsoft job board plugin, job board +1 moreBestWebSoft Job Board Plugin cross site scripting3.5 Low
- webfwd mail subscribe listMail Subscribe List Plugin index.php cross site scripting3.5 Low
libdatetime-timezone-perlDebianlibdatetime-timezone-perl - new timezone databaseNo scoretzdataDebiantzdata - new timezone databaseNo score- evasysMultiple components (such as Onlinetemplate-Verwaltung, Liste aller Teilbereiche, Umfragen...8.1 High
- evasysThe parameters nutzer_titel, nutzer_vn, and nutzer_nn in the user profile, and langID and...5.4 Medium
- evasysA SQL injection issue in Logbuch in evasys before 8.2 Build 2286 and 9.x before 9.0 Build 2401...8.8 High
- moodle, fedoraproject extra packages for enterprise linux, fedora +2 moreMoodle: minor sql injection risk in external wiki method for listing pages5.6 Medium
- moodle, fedoraproject extra packages for enterprise linux, fedora +2 moreMoodle: tinymce loaders susceptible to arbitrary folder creation6.5 Medium
- aigital wireless-n repeater mini router firmwareAn issue in the time-based authentication mechanism of Aigital Aigital Wireless-N Repeater...7.5 High
- rosariosisRosarioSIS vulnerable to CSV Injection5.4 Medium
- zammadZammad 5.3.x (Fixed in 5.4.0) is vulnerable to Incorrect Access Control. An authenticated...6.5 Medium
- zammadZammad 5.3.x (Fixed 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker...6.5 Medium
- dlink dir-868l firmware** UNSUPPORTED WHEN ASSIGNED ** D-Link DIR-868L Hardware version A1, firmware version 1.12 is...9.8 Critical
- gl-inet gl-mt3000 firmwareGL.iNET MT3000 4.1.0 Release 2 is vulnerable to OS Command Injection via /usr/lib/oui-httpd/rpc...9.8 Critical
- asus rt-ac51u firmwareA Cross-site scripting (XSS) vulnerability in the System Log/General Log page of the...5.2 Medium
- shapeshift keepkey firmwareInsufficient length checks in the ShapeShift KeepKey hardware wallet firmware before 7.7.0 allow...3.8 Low
- echa.europa iuclidEuropean Chemicals Agency IUCLID before 6.27.6 allows remote authenticated users to execute...8.8 High
- echa.europa iuclidEuropean Chemicals Agency IUCLID 6.x before 6.27.6 allows authentication bypass because a weak...9.8 Critical
- appium appium-desktop, appium/appium-desktop +1 moreOS Command Injection in appium/appium-desktop9.8 Critical
- octopus deploy, octopus deploy server +1 moreIn affected versions of Octopus Deploy it is possible to unmask variable secrets using the...5.3 Medium
- 3cx3CX before 18 Hotfix 1 build 18.0.3.461 on Windows allows unauthenticated remote attackers to...7.5 High
- 3cx3CX before 18 Update 2 Security Hotfix build 18.0.2.315 on Windows allows unauthenticated remote...7.5 High
- jedoxIncorrect input validation for the default-storage-path in the settings page in Jedox 2020.2.5...8.8 High
- jedoxA Stored cross-site scripting vulnerability in Jedox 2020.2.5 allows remote, authenticated users...5.4 Medium
- jedoxThe integrator in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to create Jobs to...8.8 High
- jedox, jedox cloud +1 moreA Directory Traversal vulnerability in /be/erpc.php in Jedox GmbH Jedox 2020.2.5 allows remote...8.8 High
- jedox, jedox cloud +1 moreImproper Access Control in /tc/rpc in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users...6.5 Medium
- nokia one-ndsIn Nokia One-NDS (aka Network Directory Server) through 20.9, some Sudo permissions can be...8.8 High
- wwbn avideoWWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's account8.0 High
- hashicorp vault, vault enterprise +1 moreVault Enterprise Vulnerable to Padding Oracle Attacks When Using a CBC-based Encryption Mechanism with a HSM2.5 Low
- pallets flaskFlask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header7.5 High
- Show moreLoading…