Archive

25 May 2023

Vulnerabilities first published on this day (UTC), newest first.

← April 2023 2023 / May /25 June 2023 →

All Critical High Medium Low Exploited only Public exploit

48 results · Clear filters · Feed

Medium 4.3

CVE-2022-47135

WordPress Chronoforms Plugin <= 7.0.9 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in chronoengine.Com Chronoforms plugin <= 7.0.9 versions.

chronoengine.com Chronoforms

May 25, 2023
Medium 6.1

CVE-2022-46907 Public exploit

Apache JSPWiki: XSS Injection points in several plugins

A carefully crafted request on several JSPWiki plugins could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users…

Apache Software Foundation Apache JSPWiki org.apache.jspwiki:jspwiki-main org.apache.jspwiki:jspwiki-war Maven

May 25, 2023
Medium 5.4

CVE-2023-33750

A stored cross-site scripting (XSS) vulnerability in mipjz v5.0.5 allows attackers to execute arbitrary web scripts or …

May 25, 2023
Medium 5.4

CVE-2023-33751

A stored cross-site scripting (XSS) vulnerability in mipjz v5.0.5 allows attackers to execute arbitrary web scripts or …

May 25, 2023
Medium 6.1

CVE-2023-28370

Open redirect in Tornado

Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL.

tornadoweb tornado salt python-tornado Debian Ubuntu Azure Linux PyPI

May 25, 2023
Medium 6.7

CVE-2023-2881

Storing Passwords in a Recoverable Format in pimcore/customer-data-framework

Storing Passwords in a Recoverable Format in GitHub repository pimcore/customer-data-framework prior to 3.3.10.

pimcore Pimcore Customer Data Framework pimcore/customer-management-framework-bundle Packagist

May 25, 2023
Medium 6.5

CVE-2023-2804

A heap-based buffer overflow issue was discovered in libjpeg-turbo in h2v2_merged_upsample_internal() function of jdmrg…

libjpeg-turbo libjpeg-turbo Alpine Wolfi

May 25, 2023
Medium 6.1

CVE-2023-25439 Public exploit

Stored Cross Site Scripting (XSS) vulnerability in Square Pig FusionInvoice 2023-1.0, allows attackers to execute arbit…

May 25, 2023