CVEs published in May 2023
2,572 vulnerabilities, 261 critical, 9 exploited.
- invernyx smartcars 3A stored cross-site scripting (XSS) vulnerability in TFDi Design smartCARS 3 v0.7.0 and below allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the body of…5.4 Medium
- xuxueli xxl-jobPrivilege escalation in XXL-Job8.8 High
- mp4v2 project mp4v2mp4v2 v2.1.2 was discovered to contain a memory leak via the class MP4BytesProperty.6.5 Medium
- faculty evaluation system project evaluation systemSourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via /eval...7.2 High
- faculty evaluation system project evaluation systemSourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin...7.2 High
- skycaijiskycaiji v2.5.4 is vulnerable to Cross Site Scripting (XSS). Attackers can achieve backend XSS by...5.4 Medium
- uthscsa papaya viewerAn issue was discovered in Papaya Viewer 4a42701. User-supplied input in form of DICOM or NIFTI...6.1 Medium
- talend data catalogTalend Data Catalog remote harvesting server before 8.0-20230413 contains a /upgrade endpoint...7.5 High
- huawei emui, harmonyos +1 moreThe hwPartsDFR module has a vulnerability in API calling verification. Successful exploitation of...7.5 High
- huawei emui, harmonyos +1 moreThe SDK for the MediaPlaybackController module has improper permission verification. Successful...7.5 High
- huawei emui, harmonyos +1 moreThe Gallery app has the risk of hijacking attacks. Successful exploitation of this vulnerability...3.3 Low
- tuzitio camaleon cmsServer-Side Template Injection in Camaleon CMS9.8 Critical
- debian linux, linux kernel, netapp h300s firmware +5 more +7 moreThere is a null-pointer-dereference flaw found in f2fs_write_end_io in fs/f2fs/data.c in the...4.7 Medium
- wireshark, debian linux +1 moreGDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via...6.3 Medium
- wireshark, debian linux +1 moreNetScaler file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of...5.3 Medium
- wireshark, debian linux +1 moreBLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service...5.3 Medium
- wireshark, debian linux +1 moreVMS TCPIPtrace file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of...5.3 Medium
- wireshark, debian linux +1 moreCandump log parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service...5.3 Medium
- wireshark, debian linux +1 moreBLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service...5.3 Medium
- encourage technologies co.,ltd. ess rec agent server edition series, et-x ess rec +1 moreDirectory traversal vulnerability in ESS REC Agent Server Edition series allows an authenticated...8.1 High
- gitlabAn issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated...10.0 Critical
- craftcms craft cmsStored cross site scripting in Craft CMS5.4 Medium
- netapp blue xp connectorNetApp Blue XP Connector versions prior to 3.9.25 expose information via a directory listing. A...5.3 Medium
- usebottles bottles, fedoraproject fedora +1 moreBottles before 51.0 mishandles YAML load, which allows remote code execution via a crafted file.7.8 High
- samsung galaxy storeXSS vulnerability from InstantPlay in Galaxy Store prior to version 4.5.49.8 allows attackers to...7.5 High
- samsung galaxy storeInstantPlay which included vulnerable script which could execute javascript in Galaxy Store prior...7.5 High
- samsung galaxy storeImproper scheme validation from InstantPlay Deeplink in Galaxy Store prior to version 4.5.49.8...7.5 High
- spring boot, vmware spring boot +1 moreSpring Boot Welcome Page Denial of Service7.5 High
- cloudfoundry routing release, cf-deployment +1 moreIn Cloud foundry routing release versions from 0.262.0 and prior to 0.266.0,a bug in the gorouter...5.9 Medium
- vmware nsx-t, broadcom vmware nsx-t data center +1 moreNSX-T contains a reflected cross-site scripting vulnerability due to a lack of input validation....6.1 Medium
- keycloak, redhat build of quarkus, jboss a-mq +2 more +4 moreKeycloak Untrusted Certificate Validation vulnerability6.5 Medium
- huawei emui, harmonyos +1 moreThe online authentication provided by the hwKitAssistant lacks strict identity verification of...5.3 Medium
- huawei emui, harmonyos +1 moreThe reminder module lacks an authentication mechanism for broadcasts received. Successful...7.5 High
- huawei emuiInteger overflow vulnerability in some phones. Successful exploitation of this vulnerability may...7.5 High
- huawei harmonyosThe facial recognition TA of some products has the out-of-bounds memory read vulnerability....9.8 Critical
- huawei harmonyosThe facial recognition TA of some products lacks memory length verification. Successful...9.8 Critical
- nagvisNagvis before 1.9.34 was discovered to contain an arbitrary file read vulnerability via the...9.1 Critical
- huawei emuiLack of length check vulnerability in the HW_KEYMASTER module. Successful exploitation of this...9.8 Critical
- huawei emui, harmonyos +1 moreThe video framework has memory overwriting caused by addition overflow. Successful exploitation...7.5 High
- huawei emui, harmonyos +1 moreThe video framework has memory overwriting caused by addition overflow. Successful exploitation...7.5 High
- huawei emui, harmonyos +1 moreThe video framework has memory overwriting caused by addition overflow. Successful exploitation...7.5 High
- huawei emui, harmonyos +1 moreThe video framework has memory overwriting caused by addition overflow. Successful exploitation...7.5 High
- huawei emui, harmonyos +1 moreThe video framework has memory overwriting caused by addition overflow. Successful exploitation...7.5 High
- huawei emui, harmonyos +1 moreThe video framework has memory overwriting caused by addition overflow. Successful exploitation...7.5 High
- kiteworks security-advisories, nextcloud user oidc +1 moreNextcloud user_oidc app is missing brute force protection8.0 High
- c-ares, debian linux, fedoraproject fedora +2 more0-byte UDP payload DoS in c-ares7.5 High
- nfine rapid development platformNFine Rapid Development Platform access control4.3 Medium
- nfine rapid development platformNFine Rapid Development Platform access control4.3 Medium
- c-ares, fedoraproject fedora +1 moreInsufficient randomness in generation of DNS query IDs in c-ares5.9 Medium
- c-ares, debian linux, fedoraproject fedora +2 moreBuffer Underwrite in ares_inet_net_pton()4.1 Medium
- Show moreLoading…