CVEs published in May 2023
2,572 vulnerabilities, 261 critical, 9 exploited.
- open-xchange ox app suiteOX App Suite before backend 7.10.6-rev37 allows authenticated users to change the appointments of...4.3 Medium
- open-xchange ox app suiteOX App Suite before backend 7.10.6-rev37 has an information leak in the handling of distribution...4.3 Medium
- open-xchange ox app suiteOX App Suite before frontend 7.10.6-rev24 allows the loading (without user consent) of an e-mail...5.3 Medium
- mediawikiAn issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x...4.3 Medium
- audiocodes device manager expressAn issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is...5.3 Medium
- audiocodes device manager expressAn issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is...5.4 Medium
- audiocodes device manager expressAn issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. BrowseFiles...7.2 High
- audiocodes device manager expressAn issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. Remote code...9.8 Critical
- audiocodes device manager expressAn issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is...7.2 High
- audiocodes device manager expressAn issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is an...9.8 Critical
- citadel webcitAn issue was discovered in Citadel through webcit-932. A meddler-in-the-middle attacker can...3.7 Low
- mercurycom mac1200r firmwareA directory traversal vulnerability on Mercury MAC1200R devices allows attackers to read...7.5 High
- citadel webcitAn issue was discovered in Citadel through webcit-926. Meddler-in-the-middle attackers can...5.9 Medium
- lemonldap-ng lemonldap\In LemonLDAP::NG (aka lemonldap-ng) before 2.0.7, the default Apache HTTP Server configuration...9.8 Critical
- itrs group monitor-ninja, itrsgroup ninja +1 moreITRS Group monitor-ninja scheduled_reports.php sql injection5.5 Medium
- metagauss download pluginWordPress Download Plugin Plugin <= 2.0.4 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- supsystic easy google mapsWordPress Easy Google Maps Plugin <= 1.11.7 is vulnerable to Cross Site Request Forgery (CSRF)7.1 High
- woo woocommerce product vendors, woocommerce product vendors +1 moreWordPress WooCommerce Product Vendors Plugin <= 2.1.76 is vulnerable to Cross Site Scripting (XSS)7.1 High
- yoast seo: local, seo +1 moreWordPress Yoast SEO: Local Plugin <= 14.9 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- one rank math seo pro, rank math seo pro +1 moreWordPress Rank Math SEO PRO Plugin <= 3.0.35 is vulnerable to Cross Site Scripting (XSS)7.1 High
- crm perks contact form entries, crmperks contact form entries - contact form 7 wpforms and more +1 moreWordPress Contact Form Entries Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- themeinprogress wip custom loginWordPress WIP Custom Login Plugin <= 1.2.9 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- andré bräkling wp-matomo integration (wp-piwik), wp-matomo integration project integration +1 moreWordPress WP-Piwik Plugin <= 1.0.27 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- woocommerce automatewoo, follow-up emails (automatewoo) +1 moreWordPress WooCommerce Follow-Up Emails Plugin <= 4.9.40 is vulnerable to Cross Site Scripting (XSS)7.1 High
- woocommerce automatewoo, follow-up emails (automatewoo) +1 moreWordPress WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- pluginops mailchimp subscribe formWordPress MailChimp Subscribe Forms Plugin <= 4.0.9.1 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- eventprimeWordPress EventPrime Plugin <= 2.8.6 is vulnerable to Cross Site Scripting (XSS)7.1 High
- awesome motive duplicator pro, awesomemotive duplicator +1 moreWordPress Duplicator Pro Plugin <= 4.5.11 is vulnerable to Cross Site Scripting (XSS)7.1 High
- realmag777 bear, pluginus bear - woocommerce bulk editor and products manager professional +1 moreWordPress BEAR Plugin <= 1.1.3.1 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- crocoblock jetformbuilder, jetformbuilder — dynamic blocks form builder +1 moreWordPress JetFormBuilder Plugin <= 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- ciprian popescu youtube playlist playerWordPress YouTube Playlist Player Plugin <= 4.6.4 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- stephen darlington, wandle software limited smart app bannerWordPress Smart App Banner Plugin <= 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- ashley novelistWordPress Novelist Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- gvectors team woodiscuz – woocommerce comments, gvectors woodiscuz - woocommerce comments +1 moreWordPress WooDiscuz – WooCommerce Comments Plugin <= 2.2.9 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
apache-commons-imagingOSS-FuzzSecurity exception in java.desktop/java.awt.image.DataBufferInt.<init>No score- mh httpbl project httpbl, mback2k mh httpbl extension +1 moremback2k mh_httpbl Extension index.php moduleContent sql injection6.3 Medium
- huge-it portfolio galleryPortfolio Gallery Plugin sql injection6.3 Medium
- bus dispatch and information system project dispatch and information system, code-projects bus dispatch and information system +1 morecode-projects Bus Dispatch and Information System delete_bus.php sql injection6.3 Medium
- ebankitIn ebankIT 6, the public endpoints /public/token/Email/generate and /public/token/SMS/generate...7.4 High
- qtAn issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6...7.5 High
- qt, debian linux, qt qtbase +2 moreAn issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6...5.3 Medium
- yank-note yank noteYank Note (YN) 3.52.1 allows execution of arbitrary code when a crafted file is opened, e.g., via...8.8 High
- gin project ginGin 0.7.4 allows execution of arbitrary code when a crafted file is opened, e.g., via require(...7.8 High
- fs s3900 24t4s firmwareFS S3900-24T4S devices allow authenticated attackers with guest access to escalate their...8.8 High
- open-emr openemr, openemr openemr/openemr +1 moreImproper Authorization in openemr/openemr6.3 Medium
- open-emr openemr, openemr openemr/openemr +1 moreCross-site Scripting (XSS) - Reflected in openemr/openemr8.3 High
- open-emr openemr, openemr openemr/openemr +1 moreCross-site Scripting (XSS) - Generic in openemr/openemr8.3 High
- linuxmint warpinatorWarpinator before 1.6.0 allows remote file deletion via directory traversal in top_dir_basenames.7.5 High
- dedecmsDedeCMS article_allowurl_edit.php code injection6.3 Medium
- jizhicmsJIZHICMS TemplateController.php index server-side request forgery6.3 Medium
- Show moreLoading…