CVEs published in May 2023
2,572 vulnerabilities, 261 critical, 9 exploited.
- proxy project proxyUndefined variable usage in npm package "proxy" leads to remote denial of service7.5 High
- parse-community parse-serverParse Server vulnerable to phishing attack vulnerability that involves uploading malicious HTML file6.3 Medium
- lima-vm limaIn Lima, a malicious disk image could read a single file on the host filesystem as a qcow2/vmdk backing file2.7 Low
- riot-os riotRIOT-OS vulnerable to Out of Bounds Write in _rbuf_add9.8 Critical
- riot-os riotRIOT-OS vulnerable to Race Condition in SFR Timeout7.5 High
- honeywell onewireless, onewireless network wireless device manager firmware +1 morePhysical access to the WDM enables use of USB device to gain access to the WDM6.9 Medium
- honeywell onewireless, onewireless network wireless device manager firmware +1 moreInsecure random number used for generating keys for signing Jwt tokens6.2 Medium
- riot-os riotRIOT-OS vulnerable to NULL pointer dereference during NHC encoding7.5 High
- honeywell onewireless, onewireless network wireless device manager firmware +1 moreUnauthenticated API allowing an attacker to obtain the information about network resources6.5 Medium
- joomla joomla\!, joomla! project cms +1 more[20230501] - Core - Open Redirect and XSS within the mfa select6.1 Medium
- joomla joomla\!, joomla! project cms +1 more[20230502] - Core - Bruteforce prevention within the mfa screen7.5 High
- riot-os riotUsage of Uninitialized Timer during forwarding of Fragments with SFR5.9 Medium
- riot-os riotRIOT-OS vulnerable to NULL pointer dereference in gnrc_pktbuf_mark7.5 High
- riot-os riotRIOT-OS vulnerable to Out of Bounds write in routing with SRH7.5 High
- dell powerpath, powerpath windows +1 morePowerPath for Windows, versions 7.0, 7.1 & 7.2 contains License Key Stored in Cleartext...5.5 Medium
- dell powerpath, powerpath windows +1 morePowerPath for Windows, versions 7.0, 7.1 & 7.2 contains DLL Hijacking Vulnerabilities. A regular...6.7 Medium
- dell powerpath, powerpath windows +1 morePowerPath for Windows, versions 7.0, 7.1 & 7.2 contains Insecure File and Folder Permissions...7.0 High
- dell networkerDell NetWorker, contains an Improper Validation of Certificate with Host Mismatch vulnerability...5.0 Medium
- vmware identity manager, workspace one access, cloud foundation +1 more +3 moreVMware Workspace ONE Access and VMware Identity Manager contain an insecure redirect...6.1 Medium
- abstrium pydio cellsAbstrium Pydio Cells Chat cross site scripting3.5 Low
- abstrium pydio cellsAbstrium Pydio Cells User Creation resource injection6.3 Medium
libredwgOSS-FuzzHeap-double-free in dwg_free_objectNo scoreamazon-ssm-agentopenSUSESecurity update for amazon-ssm-agentNo score- abstrium pydio cellsAbstrium Pydio Cells User Creation access control4.7 Medium
- abstrium pydio cellsAbstrium Pydio Cells Change Subscription authorization4.6 Medium
cniopenSUSESecurity update for cniNo scorecni-pluginsopenSUSESecurity update for cni-pluginsNo scoreterraformSUSESecurity update for terraformNo scoreterraform-provider-helmopenSUSESecurity update for terraform-provider-helmNo score- wireshark, debian linux +1 moreWireshark IEEE-C37.118 parsing buffer overflow6.5 Medium
installation-images-SMOopenSUSESecurity update for installation-imagesNo score- apache airflow cncf kubernetes, apache software foundation airflow cncf kubernetes provider, apache apache-airflow-providers-cncf-kubernetes +2 moreApache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configuration7.2 High
- sourcecodester students online internship timesheet syste, students online internship timesheet system project online internship timesheet system +1 moreSourceCodester Students Online Internship Timesheet Syste cross site scripting2.4 Low
- zyxel gs1900-8 firmware, gs1900-8hp firmware, gs1900-10hp firmware +7 more +9 moreThe privilege escalation vulnerability in the Zyxel GS1900-8 firmware version V2.70(AAHH.3) and the GS1900-8HP firmware version V2.70(AAHI.3) could allow an authenticated, local attacker with administ…6.7 Medium
- groundhogg hollerbox, unknown fast & effective popups & lead-generation for wordpress +1 moreHollerBox < 2.1.4 - Admin+ SQL Injection4.9 Medium
- loginizerLoginizer 1.7.8 - Reflected XSS6.1 Medium
- kunal nagar custom 404 proCustom 404 Pro < 3.7.3 - Reflected Cross-Site Scripting6.1 Medium
- 12net login rebuilderLogin Rebuilder < 2.8.1 - Admin+ Stored XSS4.8 Medium
- newsletter popup project popup, unknown newsletter popup +1 moreNewsletter Popup <= 1.2 - Record Deletion via CSRF8.8 High
- unknown anywhere elementorAnyWhere Elementor < 1.2.8 - Freemius API Key Disclosure5.3 Medium
- themeisle orbit fox by themeisle, orbitfox +1 moreOrbit Fox < 2.10.24 - Author+ Server-Side Request Forgery4.3 Medium
- 10web image optimizer, unknown image optimizer by 10web +1 moreImage Optimizer by 10web < 1.0.27 - Admin+ Path Traversal2.7 Low
- openstreetmap, unknown osm +1 moreOSM – OpenStreetMap <= 6.01 - Contributor+ Stored XSS via Shortcode5.4 Medium
- themeisle otterOtter - Gutenberg Blocks < 2.2.6 - Author+ PHAR Deserialization8.8 High
- unknown wp fastest cacheWP Fatest Cache < 1.1.5 - Blind SSRF via CSRF8.8 High
- autoptimizeAutoptimize < 3.1.7 - Admin+ Stored Cross-Site Scripting via Settings Import4.8 Medium
- elementor website builder, unknown elementor website builder +1 moreElementor Website Builder < 3.12.2 - Admin+ SQLi7.2 High
- unknown easy forms for mailchimpEasy Forms for Mailchimp < 6.8.9 - Reflected XSS6.1 Medium
- codename065 download managerDownload Manager < 3.2.71 - Broken Access Controls6.5 Medium
- newsletter popup project popup, unknown newsletter popup +1 moreNewsletter Popup <= 1.2 - Unauthenticated Stored XSS6.1 Medium
- Show moreLoading…