CVEs published in May 2023
2,572 vulnerabilities, 261 critical, 9 exploited.
- jenkins email extension, jenkins project email extension plugin +1 moreJenkins Email Extension Plugin Cross-Site Request Forgery vulnerability4.3 Medium
- jenkins email extension, jenkins project email extension plugin +1 moreJenkins Email Extension Plugin missing permission check4.3 Medium
- jenkins project ldap plugin, jenkins lightweight directory access protocol +1 moreJenkins LDAP Plugin vulnerable to Cross-Site Request Forgery4.3 Medium
- jenkins project pipeline: job plugin, jenkins pipeline\ +1 moreJenkins Pipeline: Job Plugin vulnerable to stored Cross-site Scripting5.4 Medium
- gira homeserver, home server firmware +1 moreGira HomeServer hslist cross site scripting4.3 Medium
- dell cloudlinkCloudLink 7.1.2 and all prior versions contain a broken or risky cryptographic algorithm...5.9 Medium
conmonSUSESecurity update for conmonNo score- jinher oa, tongda2000 tongda office anywhere +1 moreTongda OA GatewayController.php actionGetdata unrestricted upload6.3 Medium
- fooplugins foogalleryWordPress FooGallery Plugin <= 2.2.35 is vulnerable to Cross Site Scripting (XSS)7.1 High
xsalsa20poly1305crates.iocrate has been renamed to `crypto_secretbox`No score- sequoia-pgp buffered-readerbuffered-reader vulnerable to out-of-bounds array access leading to panic2.9 Low
- sequoia-pgp sequoia, sequoia-openpgp +1 moresequoia-openpgp vulnerable to out-of-bounds array access leading to panic2.9 Low
- tyche softwares arconix shortcodesWordPress Arconix Shortcodes Plugin <= 2.1.7 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- denis wpjam basic, wpjam basic project basic +1 moreWordPress WPJAM Basic Plugin <= 6.2.1 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- netreviews sas verified reviews (avis vérifiés), skeepers verified reviews \(avis verifies\) +1 moreWordPress Verified Reviews (Avis Vérifiés) Plugin <= 2.3.13 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- richard leishman mail subscribe listWordPress Mail Subscribe List Plugin <= 2.1.9 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- wpmanage uji popupWordPress Uji Popup Plugin <= 1.4.3 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
prometheus-sap_host_exporterSUSESecurity update for prometheus-sap_host_exporterNo scoreprometheus-sap_host_exporteropenSUSESecurity update for prometheus-sap_host_exporterNo score- formilla live chat by formilla, live chat +1 moreWordPress Live Chat by Formilla – Real-time Chat & Chatbots Plugin Plugin <= 1.3 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- metagauss registrationmagic, registrationmagic – custom registration forms, user registration, payment, and user login +1 moreRegistrationMagic <= 5.2.0.5 - Authenticated (Admin+) Insecure Direct Object Reference to Arbitrary User Password Change6.6 Medium
- metagauss registrationmagic, registrationmagic – custom registration forms, user registration, payment, and user login +1 moreRegistrationMagic <= 5.2.1.0 - Authentication Bypass9.8 Critical
- bruno "aesqe" babic file gallery, file gallery project gallery +1 moreWordPress File Gallery Plugin <= 1.8.5.3 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- harish chouhan, themeist i recommend thisWordPress I Recommend This Plugin <= 3.8.3 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- synology router manager, router manager (srm) +1 moreImproper neutralization of special elements used in an OS command ('OS Command Injection')...9.8 Critical
- synology router manager, router manager (srm) +1 moreImproper neutralization of special elements used in an OS command ('OS Command Injection')...8.1 High
- schneider electric opc factory server (ofs), schneider-electric opc factory server +1 moreA CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could...5.0 Medium
firefoxUbuntufirefox regressionsNo score- i13websolution video carousel slider with lightboxvideo carousel slider with lightbox <= 1.0.22 - Reflected Cross-Site Scripting6.1 Medium
- i thirteen web solution video galleryVideo Gallery <= 1.0.10 - Reflected Cross-Site Scripting6.1 Medium
- glazedlists glazed listsglazedlists XML Deserialization vulnerability9.8 Critical
- oretnom23 online computer and laptop storeSourcecodester Online Computer and Laptop Store 1.0 allows unrestricted file upload and can lead...9.8 Critical
- totolink cp300\+ firmwareA command injection vulnerability in the hostTime parameter in the function NTPSyncWithHostof...9.8 Critical
- davinci project davincidavinci 0.3.0-rc is vulnerable to Server-side request forgery (SSRF).8.8 High
- videogo project videogoIncorrect access control in Videogo v6.8.1 allows attackers to access images from other devices...7.5 High
- videogo project videogoIncorrect access control in Videogo v6.8.1 allows attackers to bind shared devices after the...5.3 Medium
- luowiceInsecure permissions in luowice 3.5.18 allow attackers to view information for other alarm...7.5 High
- tenda ac5 firmwareTenda AC5 router V15.03.06.28 was discovered to contain a remote code execution (RCE)...9.8 Critical
- s9y serendipityAn arbitrary file upload vulnerability in Serendipity 2.4-beta1 allows attackers to execute...8.8 High
- bluditAn issue in Bludit 4.0.0-rc-2 allows authenticated attackers to change the Administrator password...8.8 High
- alkacon opencmsalkacon-OpenCMS vulnerable to stored Cross-site Scripting5.4 Medium
- pharmacy management system project management systemPharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the...9.8 Critical
- morosystems easymindThe MoroSystems EasyMind - Mind Maps plugin before 2.15.0 for Confluence allows persistent XSS...5.4 Medium
- storecommander scquickaccountingInsecure permissions in the ps_customer table of Prestashop scquickaccounting before v3.7.3...6.5 Medium
- posthemes posstaticblocksPrestashop posstaticblocks <= 1.0.0 is vulnerable to SQL Injection via posstaticblocks:...9.8 Critical
- dlink dir-605l firmwareD-Link DIR-605L firmware version 1.17B01 BETA is vulnerable to stack overflow via /goform...9.8 Critical
- sage 300Versions of Sage 300 through 2022 implement role-based access controls that are only enforced...4.3 Medium
- idurarapp idurarIDURAR ERP/CRM v1 was discovered to contain a SQL injection vulnerability via the component /api...9.8 Critical
- pimcore, pimcore pimcore/pimcore +1 moreCross-site Scripting (XSS) - Stored in pimcore/pimcore6.3 Medium
- getvideostream videostreamVideostream macOS app 0.5.0 and 0.4.3 has a Race Condition. The Updater privileged script...7.0 High
- Show moreLoading…