Security Vulnerabilities - CVEs Published In May 2023
A use-after-free related to unsound inference in the bytecode generation when optimizations are enabled for Hermes prior to commit da8990f737ebb9d9810633502f65ed462b819c09 could have been used by an attacker to achieve remote code execution. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.
CVSS Score
9.8
EPSS Score
0.022
Published
2023-05-18
Improper authentication in OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 allow access to an unauthorized user under certain circumstances.
CVSS Score
10.0
EPSS Score
0.002
Published
2023-05-18
OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 may expose sensitive information to an unauthorized user under certain circumstances.
CVSS Score
5.0
EPSS Score
0.001
Published
2023-05-18
SofaWiki <=3.8.9 is vulnerable to Cross Site Scripting (XSS) via index.php.
CVSS Score
6.1
EPSS Score
0.001
Published
2023-05-18
redis v7.0.10 was discovered to contain a segmentation violation. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.
CVSS Score
7.5
EPSS Score
0.004
Published
2023-05-18
Compiler removal of buffer clearing in sli_cryptoacc_transparent_key_agreement in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.
CVSS Score
3.1
EPSS Score
0.001
Published
2023-05-18
Compiler removal of buffer clearing in
sli_se_driver_key_agreement
in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.
CVSS Score
5.3
EPSS Score
0.001
Published
2023-05-18
Compiler removal of buffer clearing in
sli_se_opaque_import_key
in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.
CVSS Score
5.3
EPSS Score
0.001
Published
2023-05-18
An arbitrary file upload vulnerability in the component /admin/ThemeController.java of PerfreeBlog v3.1.2 allows attackers to execute arbitrary code via a crafted file.
CVSS Score
9.8
EPSS Score
0.001
Published
2023-05-18
Compiler removal of buffer clearing in
sli_crypto_transparent_aead_encrypt_tag
in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.
CVSS Score
3.1
EPSS Score
0.001
Published
2023-05-18