Skip to content
OpenAdvisories

Archive

5 May 2023

Vulnerabilities first published on this day (UTC), newest first.

← April 2023 2023 / May /5 June 2023 →
  1. 139
  2. 281
  3. 378
  4. 487
  5. 542
  6. 69
  7. 74
  8. 8185
  9. 9252
  10. 10210
  11. 11101
  12. 1290
  13. 13 
  14. 1411
  15. 15147
  16. 1695
  17. 1757
  18. 1891
  19. 1927
  20. 2023
  21. 217
  22. 2284
  23. 2399
  24. 2486
  25. 2578
  26. 2688
  27. 2724
  28. 2834
  29. 2934
  30. 30151
  31. 31120
All Critical High Medium Low Exploited only Public exploit

42 results · Feed

  • Medium 4.7
    CVE-2023-29354

    Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

    Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

    Microsoft Microsoft Edge (Chromium-based) Browsers
  • High 7.5
    CVE-2023-29350

    Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

    Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

    Microsoft Microsoft Edge (Chromium-based) Browsers
  • Medium 5.4
    CVE-2022-43866

    IBM Maximo Asset Management cross-site scripting

    IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure with…

    IBM Maximo Asset Management
  • Medium 4.2
    CVE-2020-4914

    IBM Cloud Pak System Software Suite session fixation

    IBM Cloud Pak System Suite 2.3.3.0 through 2.3.3.5 does not invalidate session after logout which could allow a local user to impersonate another user on the system. IBM X-Force ID: 191290.

    IBM Cloud Pak System Software Suite
  • Medium 5.9
    CVE-2023-26285

    IBM MQ denial of service

    IBM MQ 9.2 CD, 9.2 LTS, 9.3 CD, and 9.3 LTS could allow a remote attacker to cause a denial of service due to an error processing invalid data. IBM X-Force ID: 248418.

    IBM MQ
  • Medium 5.5
    CVE-2023-22874

    IBM MQ denial of service

    IBM MQ Clients 9.2 CD, 9.3 CD, and 9.3 LTS are vulnerable to a denial of service attack when processing configuration files. IBM X-Force ID: 244216.

    IBM MQ
  • Medium 5.3
    CVE-2022-43919

    IBM MQ denial of service

    IBM MQ 9.2 CD, 9.2 LTS, 9.3 CD, and 9.3 LTS could allow an authenticated attacker with authorization to craft messages to cause a denial of service. IBM X-Force ID: 241354.

    IBM MQ
  • Medium 6.2
    CVE-2023-30434

    IBM Storage Scale denial of service

    IBM Storage Scale (IBM Spectrum Scale 5.1.0.0 through 5.1.2.9, 5.1.3.0 through 5.1.6.1 and IBM Elastic Storage Systems 6.1.0.0 through 6.1.2.5, 6.1.3.0 through 6.1.6.0) could allow a local user to cause a kernel panic. IBM X-Force ID: 252187.

    IBM Spectrum Scale Elastic Storage System
  • Medium 4.0
    CVE-2022-38707

    IBM Cognos Command Center information disclosure

    IBM Cognos Command Center 10.2.4.1 could allow a local attacker to obtain sensitive information due to insufficient session expiration. IBM X-Force ID: 234179.

    IBM Cognos Command Center
  • High 8.1
    CVE-2021-40331

    Permissions problem in the Apache Ranger Hive Plugin

    An Incorrect Permission Assignment for Critical Resource vulnerability was found in the Apache Ranger Hive Plugin. Any user with SELECT privilege on a database can alter the ownership of the table in Hive when Apache Ranger Hive Plugin is enabled This issue a…

    Apache Software Foundation Apache Ranger Hive Plugin org.apache.ranger:ranger-hive-plugin Maven
  • High 8.4
    CVE-2022-45048

    Apache Ranger: code execution vulnerability in policy expressions

    Authenticated users with appropriate privileges can create policies having expressions that can exploit code execution vulnerability. This issue affects Apache Ranger: 2.3.0. Users are recommended to update to version 2.4.0.

    Apache Software Foundation Apache Ranger org.apache.ranger:ranger Maven
  • High 7.3
    CVE-2023-28068

    Dell Command Monitor, versions 10.9 and prior, contains an improper folder permission vulnerability. A local authentica…

    Dell Dell Command Monitor (DCM)
  • Low —
    GHSA-fwj4-72fm-c93g

    Under-validated ComSpec and cmd.exe resolution in Mutagen projects

    ### Impact Mutagen projects offer shell-based execution functionality. On Windows, the shell is resolved using the standard `%ComSpec%` mechanism, with a fallback to a `%PATH%`-based search for `cmd.exe`. While this is the standard practice on Windows systems…

    github.com/mutagen-io/mutagen Go
  • Low 3.5
    CVE-2017-20183

    External Media without Import Plugin external-media-without-import.php print_media_new_panel cross site scripting

    A vulnerability was found in External Media without Import Plugin up to 1.0.0 on WordPress. It has been declared as problematic. This vulnerability affects the function print_media_new_panel of the file external-media-without-import.php. The manipulation of t…

  • Medium 6.7
    CVE-2023-32269

    An issue was discovered in the Linux kernel before 6.1.11. In net/netrom/af_netrom.c, there is a use-after-free because…

    linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2023-32235 Public exploit Scanner template EPSS 39%

    Path Traversal in Ghost

    Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js.

    ghost npm
  • Medium 5.5
    CVE-2023-29934

    llvm-project commit 6c01b5c was discovered to contain a segmentation fault via the component mlir::Type::getDialect().

    llvm-toolchain-14 llvm-toolchain-15 llvm-toolchain-13 llvm-toolchain-15 Debian Ubuntu
  • Medium 5.5
    CVE-2023-29935

    llvm-project commit a0138390 was discovered to contain an assertion failure at !replacements.count(op) && "operation wa…

    rust llvm-toolchain-14 llvm-toolchain-15 llvm-toolchain-13 Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2023-29942

    llvm-project commit a0138390 was discovered to contain a segmentation fault via the component mlir::Type::isa<mlir::LLV…

    rust llvm-toolchain-14 llvm-toolchain-15 llvm-toolchain-13 Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2023-29933

    llvm-project commit bd456297 was discovered to contain a segmentation fault via the component mlir::Block::getArgument.

    llvm-toolchain-15 llvm-toolchain-14 llvm-toolchain-13 llvm-toolchain-15 Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2023-29932

    llvm-project commit fdbc55a5 was discovered to contain a segmentation fault via the component mlir::IROperand<mlir::OpO…

    rust llvm-toolchain-15 llvm-toolchain-14 llvm-toolchain-15 Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2023-29939

    llvm-project commit a0138390 was discovered to contain a segmentation fault via the component mlir::spirv::TargetEnv::T…

    llvm-toolchain-15 llvm-toolchain-14 llvm-toolchain-13 llvm-toolchain-15 Debian Ubuntu
  • Medium 5.5
    CVE-2023-29941

    llvm-project commit a0138390 was discovered to contain a segmentation fault via the component matchAndRewriteSortOp<mli…

    tensorflow llvm-toolchain-14 llvm-toolchain-15 llvm-toolchain-13 Debian Azure Linux
  • High 7.2
    CVE-2023-29963

    S-CMS v5.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /admi…

  • Medium 6.5
    CVE-2023-29659

    libheif vulnerable to segmentation fault via floating point exception

    A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the heif::Fraction::round() function in box.cc, which causes a denial of service.

    libheif libheif github.com/strukturag/libheif Debian Ubuntu Go
  • High 7.2
    CVE-2023-2551

    PHP Remote File Inclusion in unilogies/bumsys

    PHP Remote File Inclusion in GitHub repository unilogies/bumsys prior to 2.1.1.

    unilogies unilogies/bumsys
  • Medium 4.8
    CVE-2023-2553

    Cross-site Scripting (XSS) - Stored in unilogies/bumsys

    Cross-site Scripting (XSS) - Stored in GitHub repository unilogies/bumsys prior to 2.2.0.

    unilogies unilogies/bumsys
  • High 8.8
    CVE-2023-2552

    Cross-Site Request Forgery (CSRF) in unilogies/bumsys

    Cross-Site Request Forgery (CSRF) in GitHub repository unilogies/bumsys prior to 2.1.1.

    unilogies unilogies/bumsys
  • High 7.3
    CVE-2023-2531

    Improper Restriction of Excessive Authentication Attempts in azuracast/azuracast

    Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3.

    AzuraCast azuracast/azuracast azuracast/azuracast Packagist
  • High 8.2
    CVE-2023-2550

    Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

    Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13.

    thorsten thorsten/phpmyfaq thorsten/phpmyfaq Packagist
  • High 7.2
    CVE-2023-2554 EPSS 29%

    External Control of File Name or Path in unilogies/bumsys

    External Control of File Name or Path in GitHub repository unilogies/bumsys prior to 2.2.0.

    unilogies unilogies/bumsys
  • Medium 5.4
    CVE-2023-2516 Public exploit

    Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass

    Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.7.

    nilsteampassnet nilsteampassnet/teampass nilsteampassnet/teampass Packagist
  • Medium 6.1
    CVE-2023-2427

    Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq

    Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.13.

    thorsten thorsten/phpmyfaq thorsten/phpmyfaq Packagist
  • Critical 9.8
    CVE-2023-30013 Public exploit Scanner template EPSS 26%

    TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/…

  • High 7.5
    CVE-2023-30243

    Beijing Netcon NS-ASG Application Security Gateway v6.3 is vulnerable to SQL Injection via TunnelId that allows access …

  • Critical 9.8
    CVE-2023-30122

    An arbitrary file upload vulnerability in the component /admin/ajax.php?action=save_menu of Online Food Ordering System…

  • Critical 9.8
    CVE-2023-30135

    Tenda AC18 v15.03.05.19(6318_)_cn was discovered to contain a command injection vulnerability via the deviceName parame…

  • Critical 9.8
    CVE-2023-30054

    TOTOLINK A7100RU V7.4cu.2313_B20191024 has a Command Injection vulnerability. An attacker can obtain a stable root shel…

  • Critical 9.8
    CVE-2023-30090

    Semcms Shop v4.2 was discovered to contain an arbitrary file uplaod vulnerability via the component SEMCMS_Upfile.php. …

  • High 8.8
    CVE-2023-30065

    MitraStar GPT-2741GNAC-N2 with firmware BR_g5.9_1.11(WVK.0)b32 was discovered to contain a remote code execution (RCE) …