CVEs published July 3, 2023
41 CVEs were published on July 3, 2023: 1 critical, 13 high. Browse them by severity, product and exploitation status.
- Published
- 41
- Critical
- 1
- High
- 13
- Medium
- 10
- Low
- 2
- Unrated
- 15
- Now in CISA KEV
- 0
- Fix available
- 11
Most affected products
- Ovarro TBox MS-CPU32 · Ovarro TBox MS-CPU32-S2 +3
- 5
- cometbft · github.com/cometbft/cometbft
- 2
- Kubernetes · k8s.io/kubernetes
- 2
- NVIDIA DGX A100/A800
- 2
- Trellix Enterprise Security Manager
- 2
- Apache Software Foundation Apache Airflow Apache Hive Provi…
- 1
- Bubka 2FAuth
- 1
- django
- 1
- Google Chrome
- 1
- IBM i
- 1
Critical 1
High 13
- CVE-2023-25522NVIDIA DGX A100/A800 contains a vulnerability in SBIOS where an attacker may cause improper input validation by providing configuration…NVIDIA DGX A100/A800
- CVE-2023-25521NVIDIA DGX A100/A800 contains a vulnerability in SBIOS where an attacker may cause execution with unnecessary privileges by leveraging a…NVIDIA DGX A100/A800
- CVE-2023-25517NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a guest OS may be able to control resources…NVIDIA vGPU software
- CVE-2023-25516NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where an unprivileged user can cause an integer…NVIDIA GPU Display Driver for Linux
- CVE-2023-30990IBM i command executionIBM i
- CVE-2023-36609The affected TBox RTUs run OpenVPN with root privileges and can run user defined configuration scripts.Ovarro TBox MS-CPU32 · Ovarro TBox MS-CPU32-S2 +3
- CVE-2023-36817The King's Temple Church website Leaked Stripe API Key in Public Code Repositorytktchurch website
- CVE-2023-36815Sealos billing system permission control defectlabring sealos · github.com/labring/sealos
- CVE-2023-36814zopefoundation's Products.CMFCore vulnerable to unauthenticated denial of service and crash via unchecked use of input with Python's…zopefoundation Products.CMFCore · products-cmfcore
- CVE-2023-34451CometBFT may duplicate transactions in the mempool's data structurescometbft · github.com/cometbft/cometbft
- CVE-2023-3314A vulnerability arises out of a failure to comprehensively sanitize the processing of a zip file(s).Trellix Enterprise Security Manager
- CVE-2023-3313An OS common injection vulnerability exists in the ESM certificate API, whereby incorrectly neutralized special elements may have allowed…Trellix Enterprise Security Manager
- CVE-2023-36053In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS…django
Medium, low and unrated 27
- CVE-2023-25523NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in the nvdisasm binary file, where an attacker may cause a NULL pointer…NVIDIA CUDA Toolkit
- CVE-2023-2728Bypassing enforce mountable secrets policy imposed by the ServiceAccount admission pluginKubernetes · k8s.io/kubernetes
- CVE-2023-2727Bypassing policies imposed by the ImagePolicyWebhook admission pluginKubernetes · k8s.io/kubernetes
- CVE-2023-3395All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory.Ovarro TBox MS-CPU32 · Ovarro TBox MS-CPU32-S2 +3
- CVE-2023-36611The affected TBox RTUs allow low privilege users to access software security tokens of higher privilege.Ovarro TBox MS-CPU32 · Ovarro TBox MS-CPU32-S2 +3
- CVE-2023-36610The affected TBox RTUs generate software security tokens using insufficient entropy.Ovarro TBox MS-CPU32 · Ovarro TBox MS-CPU32-S2 +3
- CVE-2023-36608The affected TBox RTUs store hashed passwords using MD5 encryption, which is an insecure encryption algorithm.Ovarro TBox MS-CPU32 · Ovarro TBox MS-CPU32-S2 +3
- CVE-2023-36819Knowage-Server vulnerable to Path traversal in download functionalitiesKnowageLabs Knowage-Server
- CVE-2023-3497Out of bounds read in Google Security Processor firmware in Google Chrome on Chrome OS prior to 114.0.5735.90 allowed a local attacker to…Google Chrome
- CVE-2023-34450CometBFT PeerState JSON serialization deadlockcometbft · github.com/cometbft/cometbft
- CVE-2023-36816Cross-Site Scripting (XSS) at Account creation in 2FAuthBubka 2FAuth
- CVE-2023-3438An unquoted Windows search path vulnerability existed in the install the MOVE 4.10.x and earlier Windows install service (mvagtsce.exe).Trellix Move
- CVE-2020-22151Permissions vulnerability in Fuel-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted zip file to the assests…
- CVE-2020-22152Cross Site Scripting vulnerability in daylight studio FUEL- CMS v.1.4.6 allows a remote attacker to execute arbitrary code via the page…
- CVE-2020-22153File Upload vulnerability in FUEL-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted .php file to the upload…
- CVE-2020-22597An issue in Jerrscript- project Jerryscrip v.
- CVE-2023-22906Hero Qubo HCD01_02_V1.38_20220125 devices allow TELNET access with root privileges by default, without a password.
- CVE-2023-26258Arcserve UDP through 9.0.6034 allows authentication bypass.
- CVE-2023-26509AnyDesk 7.0.8 allows remote Denial of Service.
- CVE-2023-36162Cross Site Request Forgery vulnerability in ZZCMS v.2023 and earlier allows a remote attacker to gain privileges via the add function in…
- CVE-2023-36183Buffer Overflow vulnerability in OpenImageIO v.2.4.12.0 and before allows a remote to execute arbitrary code and obtain sensitive…
- CVE-2023-36222Cross Site Scripting vulnerability in mlogclub bbs-go v.
- CVE-2023-36223Cross Site Scripting vulnerability in mlogclub bbs-go v.
- CVE-2023-36258An issue in LangChain before 0.0.236 allows an attacker to execute arbitrary code because Python code with os.system, exec, or eval can be…langchain
- CVE-2023-36291Cross Site Scripting vulnerability in Maxsite CMS v.108.7 allows a remote attacker to execute arbitrary code via the f_content parameter…