Skip to content
OpenAdvisories

Archive

May 2023

Vulnerabilities first published in this month (UTC), newest first.

← April 2023 2023 / May June 2023 →
  1. 139
  2. 281
  3. 378
  4. 487
  5. 542
  6. 69
  7. 74
  8. 8185
  9. 9252
  10. 10210
  11. 11101
  12. 1290
  13. 13 
  14. 1411
  15. 15147
  16. 1695
  17. 1757
  18. 1891
  19. 1927
  20. 2023
  21. 217
  22. 2284
  23. 2399
  24. 2486
  25. 2578
  26. 2688
  27. 2724
  28. 2834
  29. 2934
  30. 30151
  31. 31120
All Critical High Medium Low Exploited only Public exploit

1,208 results · Clear filters · Feed

  • Medium 5.5
    CVE-2023-22874

    IBM MQ denial of service

    IBM MQ Clients 9.2 CD, 9.3 CD, and 9.3 LTS are vulnerable to a denial of service attack when processing configuration files. IBM X-Force ID: 244216.

    IBM MQ
  • Medium 5.3
    CVE-2022-43919

    IBM MQ denial of service

    IBM MQ 9.2 CD, 9.2 LTS, 9.3 CD, and 9.3 LTS could allow an authenticated attacker with authorization to craft messages to cause a denial of service. IBM X-Force ID: 241354.

    IBM MQ
  • Medium 6.2
    CVE-2023-30434

    IBM Storage Scale denial of service

    IBM Storage Scale (IBM Spectrum Scale 5.1.0.0 through 5.1.2.9, 5.1.3.0 through 5.1.6.1 and IBM Elastic Storage Systems 6.1.0.0 through 6.1.2.5, 6.1.3.0 through 6.1.6.0) could allow a local user to cause a kernel panic. IBM X-Force ID: 252187.

    IBM Spectrum Scale Elastic Storage System
  • Medium 4.0
    CVE-2022-38707

    IBM Cognos Command Center information disclosure

    IBM Cognos Command Center 10.2.4.1 could allow a local attacker to obtain sensitive information due to insufficient session expiration. IBM X-Force ID: 234179.

    IBM Cognos Command Center
  • Medium 6.7
    CVE-2023-32269

    An issue was discovered in the Linux kernel before 6.1.11. In net/netrom/af_netrom.c, there is a use-after-free because…

    linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2023-29934

    llvm-project commit 6c01b5c was discovered to contain a segmentation fault via the component mlir::Type::getDialect().

    llvm-toolchain-14 llvm-toolchain-15 llvm-toolchain-13 llvm-toolchain-15 Debian Ubuntu
  • Medium 5.5
    CVE-2023-29935

    llvm-project commit a0138390 was discovered to contain an assertion failure at !replacements.count(op) && "operation wa…

    rust llvm-toolchain-15 llvm-toolchain-14 llvm-toolchain-13 Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2023-29942

    llvm-project commit a0138390 was discovered to contain a segmentation fault via the component mlir::Type::isa<mlir::LLV…

    rust llvm-toolchain-15 llvm-toolchain-14 llvm-toolchain-15 Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2023-29933

    llvm-project commit bd456297 was discovered to contain a segmentation fault via the component mlir::Block::getArgument.

    llvm-toolchain-15 llvm-toolchain-14 llvm-toolchain-13 llvm-toolchain-15 Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2023-29932

    llvm-project commit fdbc55a5 was discovered to contain a segmentation fault via the component mlir::IROperand<mlir::OpO…

    rust llvm-toolchain-15 llvm-toolchain-14 llvm-toolchain-13 Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2023-29939

    llvm-project commit a0138390 was discovered to contain a segmentation fault via the component mlir::spirv::TargetEnv::T…

    llvm-toolchain-14 llvm-toolchain-15 llvm-toolchain-13 llvm-toolchain-15 Debian Ubuntu
  • Medium 5.5
    CVE-2023-29941

    llvm-project commit a0138390 was discovered to contain a segmentation fault via the component matchAndRewriteSortOp<mli…

    tensorflow llvm-toolchain-15 llvm-toolchain-14 llvm-toolchain-13 Debian Azure Linux
  • Medium 6.5
    CVE-2023-29659

    libheif vulnerable to segmentation fault via floating point exception

    A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the heif::Fraction::round() function in box.cc, which causes a denial of service.

    libheif libheif github.com/strukturag/libheif Debian Ubuntu Go
  • Medium 4.8
    CVE-2023-2553

    Cross-site Scripting (XSS) - Stored in unilogies/bumsys

    Cross-site Scripting (XSS) - Stored in GitHub repository unilogies/bumsys prior to 2.2.0.

    unilogies unilogies/bumsys
  • Medium 5.4
    CVE-2023-2516 Public exploit

    Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass

    Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.7.

    nilsteampassnet nilsteampassnet/teampass nilsteampassnet/teampass Packagist
  • Medium 6.1
    CVE-2023-2427

    Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq

    Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.13.

    thorsten thorsten/phpmyfaq thorsten/phpmyfaq Packagist
  • Medium 5.3
    CVE-2023-1894

    A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation. An i…

    Puppet Puppet Enterprise Puppet server puppet Debian Ubuntu
  • Medium 5.9
    CVE-2022-47434

    WordPress PB SEO Friendly Images Plugin <= 4.0.5 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PB SEO Friendly Images plugin <= 4.0.5 versions.

    PB SEO Friendly Images PB SEO Friendly Images
  • Medium 6.5
    CVE-2023-25982

    WordPress Simple YouTube Responsive Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Eirudo Simple YouTube Responsive plugin <= 2.5 versions.

    Eirudo Simple YouTube Responsive
  • Medium 5.9
    CVE-2023-25977

    WordPress CPT – Speakers Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in 9seeds.Com CPT – Speakers plugin <= 1.1 versions.

    9seeds.com CPT – Speakers
  • Medium 5.9
    CVE-2023-25458

    WordPress TypeSquare Webfonts for ConoHa Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in GMO Internet Group, Inc. TypeSquare Webfonts for ConoHa plugin <= 2.0.3 versions.

    GMO Internet Group TypeSquare Webfonts for ConoHa
  • Medium 6.3
    CVE-2023-2524

    Control iD RHiD direct request

    A vulnerability classified as critical has been found in Control iD RHiD 23.3.19.0. This affects an unknown part of the file /v2/#/. The manipulation leads to direct request. It is possible to initiate the attack remotely. The associated identifier of this vu…

    Control iD RHiD
  • Medium 4.7
    CVE-2023-2522 EPSS 34%

    Chengdu VEC40G Network Detection os command injection

    A vulnerability was found in Chengdu VEC40G 3.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /send_order.cgi?parameter=access_detect of the component Network Detection. The manipulation of the argum…

    Chengdu VEC40G
  • Medium 6.8
    CVE-2023-30550

    IDOR vulnerability exists in metersphere

    MeterSphere is an open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing, and performance testing. This IDOR vulnerability allows the administrator of a project to modify other projects under the works…

    metersphere metersphere
  • Medium 5.4
    CVE-2023-30619

    XSS in the tooltip via an artifact title

    Tuleap Open ALM is a Libre and Open Source tool for end to end traceability of application and system developments. The title of an artifact is not properly escaped in the tooltip. A malicious user with the capability to create an artifact or to edit a field …

    Enalean tuleap
  • Medium 6.4
    CVE-2023-23470

    IBM i privilege escalation

    IBM i 7.2, 7.3, 7.4, and 7.5 could allow an authenticated privileged administrator to gain elevated privileges in non-default configurations, as a result of improper SQL processing. By using a specially crafted SQL operation, the administrator could exploit t…

    IBM i
  • Medium 5.9
    CVE-2023-26010

    WordPress WPMobile.App Plugin <= 11.18 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPMobile.App plugin <= 11.18 versions.

    WPMobile.App WPMobile.App
  • Medium 5.9
    CVE-2023-26012

    WordPress Custom Login Page Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Denzel Chia | Phire Design Custom Login Page plugin <= 2.0 versions.

    Denzel Chia | Phire Design Custom Login Page
  • Medium 5.9
    CVE-2023-26016

    WordPress Simple Portfolio Gallery Plugin <= 0.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Tauhidul Alam Simple Portfolio Gallery plugin <= 0.1 versions.

    Tauhidul Alam Simple Portfolio Gallery
  • Medium 6.5
    CVE-2022-45818

    WordPress Hero Banner Ultimate Plugin <= 1.3.4 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WP OnlineSupport, Essential Plugin Hero Banner Ultimate plugin <= 1.3.4 versions.

    WP OnlineSupport, Essential Plugin Hero Banner Ultimate
  • Medium 5.9
    CVE-2023-25962

    WordPress Accordions Plugin <= 2.3.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Biplob Adhikari Accordion – Multiple Accordion or FAQs Builder plugin <= 2.3.0 versions.

    Biplob Adhikari Accordion – Multiple Accordion or FAQs Builder
  • Medium 5.9
    CVE-2023-25934

    DELL ECS prior to 3.8.0.2 contains an improper verification of cryptographic signature vulnerability. A network attacke…

    Dell ECS
  • Medium 5.6
    CVE-2023-26125

    Improper input validation in github.com/gin-gonic/gin

    Versions of the package github.com/gin-gonic/gin before 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a specially crafted request via the X-Forwarded-Prefix header, potentially leading to cache poisoning. **Note:** Although …

    github.com/gin-gonic/gin golang-github-gin-gonic-gin golang-github-gin-gonic-gin Debian Ubuntu Go
  • Medium 5.5
    CVE-2023-31413

    Filebeat versions through 7.17.9 and 8.6.2 have a flaw in httpjson input that allows the http request Authorization or …

    Elastic Filebeat
  • Medium 5.4
    CVE-2023-27075

    Stored cross site scripting in Microbin

    A cross-site scripting vulnerability (XSS) in the component microbin/src/pasta.rs of Microbin v1.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

    microbin crates.io
  • Medium 5.4
    CVE-2023-30094

    Cross-site scripting in TotalJS

    A stored cross-site scripting (XSS) vulnerability in TotalJS Flow v10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the platform name field in the settings module.

    total4 npm
  • Medium 6.1
    CVE-2023-30093

    ONOS vulnerable to Cross-site Scripting

    A cross-site scripting (XSS) vulnerability in Open Networking Foundation ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter of the API documentation dashboard.

    org.onosproject:onos-archetypes Maven
  • Medium 5.4
    CVE-2023-30216

    Insecure permissions in the updateUserInfo function of newbee-mall before commit 1f2c2dfy allows attackers to obtain us…

  • Medium 5.4
    CVE-2023-30184

    A stored cross-site scripting (XSS) vulnerability in Typecho v1.2.0 allows attackers to execute arbitrary web scripts o…

  • Medium 5.4
    CVE-2023-30096

    A stored cross-site scripting (XSS) vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbit…