Archive
May 2023
Vulnerabilities first published in this month (UTC), newest first.
1,208 results · Clear filters · Feed
-
Medium 5.4
A stored cross-site scripting (XSS) vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbit…
-
Medium 5.4
A stored cross-site scripting (XSS) vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbit…
-
Medium 4.4
Out-of-bounds Read vulnerability while processing CMD_COLDWALLET_BTC_SET_PRV_UTXO in bc_core trustlet from Samsung Bloc…
-
Medium 6.7
Out-of-bounds Write vulnerability while processing BC_TUI_CMD_UPDATE_SCREEN in bc_tui trustlet from Samsung Blockchain …
-
Medium 4.4
Out-of-bounds Read vulnerability while processing BC_TUI_CMD_SEND_RESOURCE_DATA_ARRAY command in bc_tui trustlet from S…
-
Medium 5.1
Improper access control vulnerability in AppLock prior to SMR May-2023 Release 1 allows local attackers without proper …
-
Medium 5.7
Improper input validation vulnerability in FactoryTest application prior to SMR May-2023 Release 1 allows local attacke…
-
Medium 5.6
Potential buffer overflow vulnerability in mm_Plmncoordination.c in Shannon baseband prior to SMR May-2023 Release 1 al…
-
Medium 6.7
Out-of-bounds Write vulnerability while processing BC_TUI_CMD_SEND_RESOURCE_DATA command in bc_tui trustlet from Samsun…
-
Medium 5.3
Improper export of android application components vulnerability in ImagePreviewActivity in Call Settings to SMR May-202…
-
Medium 5.1
Improper access control vulnerability in Telephony framework prior to SMR May-2023 Release 1 allows local attackers to …
-
Medium 5.6
Potential buffer overflow vulnerability in mm_LteInterRatManagement.c in Shannon baseband prior to SMR May-2023 Release…
-
Medium 6.1
Active Debug Code vulnerability in ActivityManagerService prior to SMR May-2023 Release 1 allows attacker to use debug …
-
Medium 6.0
Improper input validation vulnerability in setPartnerTAInfo in mPOS TUI trustlet prior to SMR May-2023 Release 1 allows…
-
Medium 6.7
Out-of-bounds Write vulnerability while processing BC_TUI_CMD_SEND_RESOURCE_DATA_ARRAY command in bc_tui trustlet from …
-
Medium 5.3
Improper export of android application components vulnerability in VideoPreviewActivity in Call Settings to SMR May-202…
-
Medium 4.7
Improper access control in GearManagerStub prior to SMR May-2023 Release 1 allows a local attacker to delete applicatio…
-
Medium 4.4
Use of externally-controlled format string vulnerability in mPOS TUI trustlet prior to SMR May-2023 Release 1 allows lo…
-
Medium 6.0
Double free validation vulnerability in setPinPadImages in mPOS TUI trustlet prior to SMR May-2023 Release 1 allows loc…
-
Medium 4.0
Improper access control in Samsung Core Service prior to version 2.1.00.36 allows attacker to write arbitrary file in s…
-
Medium 5.6
Potential buffer overflow vulnerability in auth api in mm_Authentication.c in Shannon baseband prior to SMR May-2023 Re…
-
Medium 4.4CVE-2023-21492 Exploited
Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypas…
KEV May 19, 2023 -
Medium 6.8
Improper access control vulnerability in SemShareFileProvider prior to SMR May-2023 Release 1 allows local attackers to…
-
Medium 4.4
Improper access control vulnerablility in Tips prior to SMR May-2023 Release 1 allows local attackers to launch arbitra…
-
Medium 4.4
Out-of-bounds Read vulnerability while processing BC_TUI_CMD_UPDATE_SCREEN in bc_tui trustlet from Samsung Blockchain K…
-
Medium 4.0
Improper access control vulnerability in Knox Enrollment Service prior to SMR May-2023 Release 1 allow attacker install…
-
Medium 5.9
An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in Forti…
-
Medium 6.1
A use of hard-coded credentials vulnerability [CWE-798] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, …
-
Medium 5.0
A weak authentication vulnerability [CWE-1390] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all v…
-
Medium 5.7
A relative path traversal [CWE-23] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a privileged attacker to …
-
Medium 4.8
IBM WebSphere Application Server information disclosure
IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and IBM WebSphere Application Server Liberty, when configured to communicate with the Web Server Plug-ins for IBM WebSphere Application Server, could allow an authenticated user to conduct spoofing attacks.…
-
Medium 4.3
WordPress Community by PeepSo Plugin <= 6.0.2.0 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo plugin <= 6.0.2.0 versions.
-
Medium 5.9
WordPress Jobs for WordPress Plugin <= 2.5.10.2 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in BlueGlass Jobs for WordPress plugin <= 2.5.10.2 versions.
-
Medium 5.9
WordPress Bing Site Verification plugin using Meta Tag Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Himanshu Bing Site Verification plugin using Meta Tag plugin <= 1.0 versions.
-
Medium 5.9
WordPress Circles Gallery Plugin <= 1.0.10 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in GreenTreeLabs Circles Gallery plugin <= 1.0.10 versions.
-
Medium 5.4
BIG-IQ iControl REST Vulnerability
An authenticated attacker granted a Viewer or Auditor role on a BIG-IQ can upload arbitrary files using an undisclosed iControl REST endpoint. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
-
Medium 4.3
BIG-IP Configuration utility vulnerability
A directory traversal vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which may allow an authenticated attacker to read files with .xml extension. Access to restricted information is limited and the attacker does not control wh…
-
Medium 5.9
WordPress Sponsors Carousel Plugin <= 4.02 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Sergey Panasenko Sponsors Carousel plugin <= 4.02 versions.
-
Medium 5.3
BIG-IP TMM SSL vulnerability
When an SSL profile is configured on a Virtual Server, undisclosed traffic can cause an increase in CPU or SSL accelerator resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
-
Medium 5.9
BIG-IP Edge Client for Windows and Mac OS vulnerability
In the pre connection stage, an improper enforcement of message integrity vulnerability exists in BIG-IP Edge Client for Windows and Mac OS. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.