Archive
May 2023
Vulnerabilities first published in this month (UTC), newest first.
1,208 results · Clear filters · Feed
-
Medium 5.5
This issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16…
-
Medium 5.5
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS B…
-
Medium 6.5
The issue was addressed by removing origin information. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.…
-
Medium 6.3
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3. An app may be able to break ou…
-
Medium 5.5
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3, tvOS 16.…
-
Medium 6.7
The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 1…
-
Medium 5.5
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, macO…
-
Medium 5.5
This issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4. Fil…
-
Medium 5.5
Multiple validation issues were addressed with improved input sanitization. This issue is fixed in macOS Ventura 13.3, …
-
Medium 6.3
This issue was addressed with improved entitlements. This issue is fixed in Xcode 14.3, macOS Big Sur 11.7.7, macOS Mon…
-
Medium 5.5
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, macO…
-
Medium 5.5
A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Ventura 13.3, iOS 15.7.…
-
Medium 6.1
A prototype pollution vulnerability exists in Strikingly CMS which can result in reflected cross-site scripting (XSS) i…
-
Medium 6.7
A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inode si…
-
Medium 5.4
MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in…
-
Medium 5.4
MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in…
-
Medium 5.4
MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in…
-
Medium 5.3CVE-2023-30019 Scanner template
imgproxy is vulnerable to Server-Side Request Forgery
imgproxy <=3.14.0 is vulnerable to Server-Side Request Forgery (SSRF) due to a lack of sanitization of the imageURL parameter.
-
Medium 6.1
AsmBB v2.9.1 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the MiniMag.asm and bbco…
-
Medium 5.4
MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in…
-
Medium 5.3
A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 16.4 and iPadOS 16.4. A user …
-
Medium 5.5
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventur…
-
Medium 5.5
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, macO…
-
Medium 5.5
The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 1…
-
Medium 5.5
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Big Sur 11.7.5. Processi…
-
Medium 5.5
A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4. An …
-
Medium 5.5
A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4. An …
-
Medium 5.5
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventur…
-
Medium 4.1
AXIS OS 11.0.X - 11.3.x use a static RSA key in legacy LUA-components to protect Axis-specific source code. The static …
-
Medium 6.5
WordPress Cookie Notice & Compliance for GDPR / CCPA Plugin <= 2.4.6 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Hu-manity.Co Cookie Notice & Compliance for GDPR / CCPA plugin <= 2.4.6 versions.
-
Medium 5.9
WordPress JCH Optimize Plugin <= 3.2.2 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Samuel Marshall JCH Optimize plugin <= 3.2.2 versions.
-
Medium 5.9
WordPress Dashboard Widgets Suite Plugin <= 3.2.1 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jeff Starr Dashboard Widgets Suite plugin <= 3.2.1 versions.
-
Medium 5.9
WordPress Publish to Schedule Plugin <= 4.5.4 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alex Benfica Publish to Schedule plugin <= 4.5.4 versions.
-
Medium 5.1
IBM UrbanCode Deploy (UCD) information disclosure
IBM UrbanCode Deploy (UCD) versions up to 7.3.0.1 could disclose sensitive password information during a manual edit of the agentrelay.properties file. IBM X-Force ID: 240148.
-
Medium 5.4
IBM Business Automation Workflow cross-site scripting
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in th…
-
Medium 4.4
IBM QRadar Data Synchronization App information disclosure
IBM QRadar Data Synchronization App 1.0 through 3.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 217370.
-
Medium 4.7
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
-
Medium 5.4
IBM Maximo Asset Management cross-site scripting
IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure with…
-
Medium 4.2
IBM Cloud Pak System Software Suite session fixation
IBM Cloud Pak System Suite 2.3.3.0 through 2.3.3.5 does not invalidate session after logout which could allow a local user to impersonate another user on the system. IBM X-Force ID: 191290.
-
Medium 5.9
IBM MQ denial of service
IBM MQ 9.2 CD, 9.2 LTS, 9.3 CD, and 9.3 LTS could allow a remote attacker to cause a denial of service due to an error processing invalid data. IBM X-Force ID: 248418.