CVEs published in May 2023
2,572 vulnerabilities, 261 critical, 9 exploited.
- reactphp httpReactPHP's HTTP server continues parsing unused multipart parts after reaching limits5.3 Medium
- dgraphDgraph Audit Log Encryption nonce reuse3.3 Low
- sucms project sucmsSucms cross site scripting3.5 Low
- jinher oa, weaver e-office +1 moreWeaver OA jx2_config.ini file access5.3 Medium
- jinher oa, weaver e-office +1 moreWeaver OA downfile.php absolute path traversal4.3 Medium
- checkmkReading host_configs does not honour contact groups4.3 Medium
- snow software spe slm, snowsoftware snow license manager +1 moreData leakage in Adobe connector for SPE edition of SLM4.1 Medium
- ibm powervm hypervisorIBM PowerVM gain access9.3 Critical
- wordpressWordPress Core < 6.2.1 - Directory Traversal5.4 Medium
- checkmkLivestatus command injection in RestAPI8.3 High
- haxx curl, apple macos, netapp clustered data ontap +5 more +7 moreA denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several...5.9 Medium
- abb terra ac wallbox (ce) symbiosis, terra ac wallbox (ce) terra ac ptb, terra ac wallbox (jp) +12 more +14 moreConfiguration data is exchanged in plaintext and could be available to a nearby attacker if present during configuration or usage of the device via Bluetooth Low Energy (BLE).7.1 High
- abb terra ac wallbox (ce) symbiosis, terra ac wallbox (ce) terra ac ptb, terra ac wallbox (jp) +12 more +14 moreAuthentication to access the AC wallbox via its Bluetooth Low Energy (BLE) channel can be bypassed,8.8 High
- asustor adm, looksgood, soundsgood +2 moreA Cross-Site Scripting(XSS) vulnerability was found on ADM7.1 High
- haxx curl, apple macos, fedoraproject fedora +6 more +8 moreAn information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers,...3.7 Low
- haxx curl, apple macos, debian linux +7 more +9 moreAn improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports...5.9 Medium
- haxx curl, apple macos, netapp clustered data ontap +5 more +7 moreA use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to...7.5 High
- encode starletteStarlette has Path Traversal vulnerability in StaticFiles7.5 High
- xootix otp login & register woocommerce, otp login woocommerce \& gravity forms +1 moreOTP Login Woocommerce & Gravity Forms <= 2.2 - Authentication Bypass to Privilege Escalation8.1 High
- themeisle multiple page generator, multiple page generator plugin – mpg +1 moreMultiple Page Generator Plugin <= 3.3.17 - Cross-Site Request Forgery to SQL Injection3.1 Low
- symcon ip symconThe web interface of Symcon IP-Symcon before 6.3 (i.e., before 2023-05-12) allows a remote...7.5 High
- savysoda wifi hd wireless disk drivesavysoda Wifi HD Wireless Disk Drive 11 is vulnerable to Local File Inclusion.7.5 High
- freeguppy guppyGuppY CMS 6.00.10 is vulnerable to Unrestricted File Upload which allows remote attackers to...9.8 Critical
- mobilemouse mobile mouseRPA Technology Mobile Mouse 3.6.0.4 is vulnerable to Remote Code Execution (RCE).9.8 Critical
- davinci project davinciIn davinci 0.3.0-rc after logging in, the user can connect to the mysql malicious server by...6.5 Medium
- yasm project yasmyasm 1.3.0.55.g101bc was discovered to contain a heap-use-after-free via the function...5.5 Medium
- yasm project yasmyasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the function...7.8 High
- yasm project yasmyasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the function...5.5 Medium
- nasm netwide assemblerThere exists a heap buffer overflow in nasm 2.16.02rc1 (GitHub commit: b952891).7.8 High
- escanav escan management consoleCross Site Scripting (XSS) in the edit user form in Microworld Technologies eScan management...9.0 Critical
- escanav escan management consoleSQL injection in the View User Profile in MicroWorld eScan Management Console 14.0.1400.2281...7.2 High
- tp-link tl-wpa4530 kit firmwareTP-Link TL-WPA4530 KIT V2 (EU)_170406 and V2 (EU)_161115 is vulnerable to Command Injection via...8.8 High
- tp-link tl-wpa4530 kit firmwareTP-Link TL-WPA4530 KIT V2 (EU)_170406 and V2 (EU)_161115 is vulnerable to Command Injection via...8.8 High
- churchcrmChurchCRM v4.5.4 is vulnerable to Reflected Cross-Site Scripting (XSS) via image file.4.8 Medium
- bluditBludit v3.14.1 is vulnerable to Stored Cross Site Scripting (XSS) via SVG file on site logo.5.4 Medium
- cdesigner project cdesignerPrestaShop cdesigner < 3.1.9 is vulnerable to SQL Injection via...9.8 Critical
- exelysis unified communications solutionCross Site Scripting vulnerability found in Exelysis Unified Communication Solution (EUCS) v.1.0...6.1 Medium
- lfprojects mlflow, mlflow mlflow/mlflow +1 morePath Traversal: '\..\filename' in mlflow/mlflow9.8 Critical
- pimcore pimcore/customer-data-framework, customer management framework +1 moreSQL Injection in pimcore/customer-data-framework6.5 Medium
- phpmyfaq, thorsten thorsten/phpmyfaq +1 moreCross-site Scripting (XSS) - Stored in thorsten/phpmyfaq7.2 High
- phpmyfaq, thorsten thorsten/phpmyfaq +1 moreCross-site Scripting (XSS) - Stored in thorsten/phpmyfaq7.2 High
- libtiff, fedoraproject fedora, redhat enterprise linux +2 moreA NULL pointer dereference flaw was found in Libtiff's LZWDecode() function in the libtiff...5.5 Medium
- piwigoPiwigo v13.5.0 was discovered to contain a SQL injection vulnerability via the order[0][dir]...8.8 High
- linuxfoundation cups-filters, debian linux, fedoraproject fedora +2 moreCommand injection in cups-filters8.8 High
- canon ij network tool, canon inc. ij nw tool +1 moreCanon IJ Network Tool/Ver.4.7.5 and earlier (supported OS: OS X 10.9.5-macOS 13),IJ Network Tool...6.5 Medium
- canon ij network tool, canon inc. ij nw tool +1 moreCanon IJ Network Tool/Ver.4.7.5 and earlier (supported OS: OS X 10.9.5-macOS 13),IJ Network Tool...6.5 Medium
- algoo tracimAlgoo Tracim before 4.4.2 allows XSS via HTML file upload.6.1 Medium
- xenMishandling of guest SSBD selection on AMD hardware The current logic to set SSBD on AMD Family...3.3 Low
- supsystic contact form, supsysticcom contact form by supsystic +1 moreContact Form by Supsystic <= 1.7.24 - Cross-Site Request Forgery via AJAX action5.4 Medium
indentMageiaUpdated indent packages fix security vulnerabilityNo score- Show moreLoading…