CVEs published in May 2023
2,572 vulnerabilities, 261 critical, 9 exploited.
- huawei emui, harmonyos +1 moreThe window management module lacks permission verification.Successful exploitation of this...7.5 High
libredwgOSS-FuzzUNKNOWN READ in dxf_fixup_stringNo scorelibredwgOSS-FuzzUNKNOWN READ in dxf_fixup_stringNo scorelibredwgOSS-FuzzUNKNOWN READ in dxf_fixup_stringNo score- rental module project module, unknown rental module +1 moreIDOR vulnerability in "Rental Module" developed by third-party for Ideasoft's E-commerce Platform.9.8 Critical
- rental module project module, unknown rental module +1 moreMalicious File Upload vulnerability in "Rental Module" developed by third-party for Ideasoft's E-commerce Platform.9.8 Critical
- dental clinic appointment reservation system project clinic appointment reservation system, sourcecodester dental clinic appointment reservation system +1 moreSourceCodester Dental Clinic Appointment Reservation System POST Parameter service.php cross site scripting3.5 Low
- class scheduling system project scheduling system, sourcecodester class scheduling system +1 moreSourceCodester Class Scheduling System GET Parameter edit_subject.php sql injection6.3 Medium
- ellucian ethos identityEllucian Ethos Identity logout cross site scripting4.3 Medium
- wclovers wcfm membership – woocommerce memberships for multivendor marketplace, wcfm membership +1 moreWCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.10.7 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Password Change9.8 Critical
- groundhogg, trainingbusinesspros groundhogg — crm, newsletters, and marketing automation +1 moreGroundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Disable All Plugins5.4 Medium
- groundhogg, trainingbusinesspros groundhogg — crm, newsletters, and marketing automation +1 moreGroundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Privilege Escalation7.5 High
- groundhogg, trainingbusinesspros groundhogg — crm, newsletters, and marketing automation +1 moreGroundhogg <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode4.9 Medium
- groundhogg, trainingbusinesspros groundhogg — crm, newsletters, and marketing automation +1 moreGroundhogg <= 2.7.9.8 - Missing Authorization to Non-Arbitrary File Upload5.4 Medium
- groundhogg, trainingbusinesspros groundhogg — crm, newsletters, and marketing automation +1 moreGroundhogg <= 2.7.9.8 - Missing Authorization to Update License4.3 Medium
- groundhogg, trainingbusinesspros groundhogg — crm, newsletters, and marketing automation +1 moreGroundhogg <= 2.7.9.8 - Missing Authorization to Admin Account and Ticket Creation4.3 Medium
- obsidianObsidian before 1.2.2 allows calls to unintended APIs (for microphone access, camera access, and...8.2 High
- luatex project luatex, miktex, tug tex live +2 moreLuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file...7.8 High
- zulipUnauthorized user can register an account in specific configurations in Zulip6.5 Medium
- zulipUsers who can send invitations can erroneously add users to streams during invitation in Zulip3.1 Low
- vyperlang vyperNonpayable default functions are sometimes payable in vyper3.7 Low
- craftcms cms, craft cms +1 moreRemote Code Execution via unrestricted file extension in Craft CMS7.2 High
- 3ds 3dexperienceReflected Cross-site Scripting (XSS) vulnerability affecting Release 3DEXPERIENCE R2018x through Release 3DEXPERIENCE R2023x6.1 Medium
- online jewelry store project jewelry store, sourcecodester online jewelry store +1 moreSourceCodester Online Jewelry Store POST Parameter supplier.php sql injection6.3 Medium
- class scheduling system project scheduling system, sourcecodester class scheduling system +1 moreSourceCodester Class Scheduling System POST Parameter save_teacher.php cross site scripting3.5 Low
- ibm infosphere information serverIBM InfoSphere Information Server SQL injection6.3 Medium
- ibm infosphere information serverIBM InfoSphere Information Server information disclosure6.2 Medium
- ibm infosphere information serverIBM InfoSphere Information Server 11.75.5 Medium
- ibm mqIBM MQ information disclosure5.1 Medium
- ibm mqIBM MQ information disclosure6.2 Medium
phpOSS-FuzzHeap-use-after-free in zval_call_destructorNo scoreluceneOSS-FuzzSecurity exception in org.apache.lucene.util.ArrayUtil.growExactNo scoreopenexrOSS-FuzzStack-buffer-overflow in DwaCompressor_readChannelRulesNo scoreliblouisOSS-FuzzHeap-buffer-overflow in _lou_stringHashNo scoreassimpOSS-FuzzInvalid-free in Assimp::FBX::Scope::ScopeNo scoreruncopenSUSESecurity update for runcNo scorecontainerdopenSUSESecurity update for containerdNo scoreterraform-provider-awsopenSUSESecurity update for terraform-provider-awsNo score- dell cloudiq collector, aiops collector +1 moreDell CloudIQ Collector version 1.10.2 contains a missing encryption of sensitive data...6.3 Medium
- weaver e-cologyWeaver e-cology API RequestInfoByXml xml external entity reference5.5 Medium
- mitsubishi electric corporation melsec ws series ws0-geth00200, mitsubishielectric melsec ws0-geth00200 firmware +1 moreAuthentication Bypass Vulnerability in MELSEC WS Series Ethernet Interface Module7.5 High
- vibethemes bp social connectBP Social Connect <= 1.5 - Authentication Bypass9.8 Critical
- foxit pdf editor, pdf reader +1 moreFoxit PDF Reader (12.1.1.15289 and earlier) and Foxit PDF Editor (12.1.1.15289 and all previous...7.8 High
- jizhicmsjizhicms v2.4.6 is vulnerable to Cross Site Scripting (XSS). The content of the article published...5.4 Medium
- dedecmsDedeCMS up to v5.7.108 is vulnerable to XSS in sys_info.php via parameters 'edit___cfg_powerby'...5.4 Medium
- tp-link archer vr1600v firmwareA command injection vulnerability exists in the administrative web portal in TP-Link Archer...6.7 Medium
- sem-cms semcmsSEMCMS 1.5 is vulnerable to SQL Injection via Ant_Rponse.php.9.8 Critical
- webbax customexporterPrestashop customexporter <= 1.7.20 is vulnerable to Incorrect Access Control via modules...7.5 High
- telegramTelegram 9.3.1 and 9.4.0 allows attackers to access restricted files, microphone ,or video...5.5 Medium
- cloudfoundry loggregator-agent, capi-release, cf-deployment +2 moreCloud foundry instances having CAPI version between 1.140 and 1.152.0 along with loggregator...8.1 High
- Show moreLoading…