CVEs published July 28, 2023
90 CVEs were published on July 28, 2023: 1 critical, 18 high. Browse them by severity, product and exploitation status.
- Published
- 90
- Critical
- 1
- High
- 18
- Medium
- 23
- Low
- 12
- Unrated
- 36
- Now in CISA KEV
- 0
- Fix available
- 62
Most affected products
- Google Chrome
- 34
- discourse
- 6
- Apple macOS
- 5
- Apple tvOS · Apple iOS and iPadOS +2
- 5
- Apple Music for Android
- 2
- Apple Safari · Apple tvOS +3
- 2
- inisev Redirection · inisev Pop-up +9
- 2
- SourceCodester Simple Online Mens Salon Management System
- 2
- ABB AO-OPC
- 1
- Apple iOS and iPadOS · Apple macOS +1
- 1
Critical 1
High 18
- CVE-2023-2313Inappropriate implementation in Sandbox in Google Chrome on Windows prior to 112.0.5615.49 allowed a remote attacker who had compromised…Google Chrome
- CVE-2021-4322Use after free in DevTools in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious…Google Chrome
- CVE-2021-4320Use after free in Blink in Google Chrome prior to 92.0.4515.107 allowed a remote attacker who had compromised the renderer process to…Google Chrome
- CVE-2021-4319Use after free in Blink in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to perform arbitrary read/write via a crafted…Google Chrome
- CVE-2021-4318Object corruption in Blink in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit object corruption via a…Google Chrome
- CVE-2021-4317Use after free in ANGLE in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to perform arbitrary read/write via a crafted…Google Chrome
- CVE-2022-4924Use after free in WebRTC in Google Chrome prior to 97.0.4692.71 allowed a remote attacker who had compromised the renderer process to…Google Chrome
- CVE-2022-4921Use after free in Accessibility in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in…Google Chrome
- CVE-2022-4919Use after free in Base Internals in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to perform arbitrary read/write via a…Google Chrome
- CVE-2022-4918Use after free in UI in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to perform arbitrary read/write via a crafted HTML…Google Chrome
- CVE-2022-4916Use after free in Media in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to perform arbitrary read/write via a crafted…Google Chrome
- CVE-2022-4913Inappropriate implementation in Extensions in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who had compromised the…Google Chrome
- CVE-2022-4912Type Confusion in MathML in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a…Google Chrome
- CVE-2022-4906Inappropriate implementation in Blink in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to perform arbitrary read/write…Google Chrome
- CVE-2023-3598Out of bounds read and write in ANGLE in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap…Google Chrome
- CVE-2023-2685Unquoted Service Path in ABB AO-OPCABB AO-OPC
- CVE-2023-3670Codesys: Vulnerability in CODESYS Development System and CODESYS ScriptingCODESYS Development System · CODESYS Scripting
- CVE-2023-3985SourceCodester Online Jewelry Store login.php sql injectionSourceCodester Online Jewelry Store
Medium, low and unrated 71
- CVE-2023-2314Insufficient data validation in DevTools in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass navigation…Google Chrome
- CVE-2023-2311Insufficient policy enforcement in File System API in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to bypass filesystem…Google Chrome
- CVE-2022-4926Insufficient policy enforcement in Intents in Google Chrome on Android prior to 109.0.5414.119 allowed a remote attacker to bypass same…Google Chrome
- CVE-2021-4324Insufficient policy enforcement in Google Update in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to read arbitrary files…Google Chrome
- CVE-2021-4323Insufficient validation of untrusted input in Extensions in Google Chrome prior to 90.0.4430.72 allowed an attacker who convinced a user…Google Chrome
- CVE-2021-4321Policy bypass in Blink in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted…Google Chrome
- CVE-2021-4316Inappropriate implementation in Cast UI in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to spoof browser UI via a crafted…Google Chrome
- CVE-2022-4925Insufficient validation of untrusted input in QUIC in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to perform header…Google Chrome
- CVE-2022-4923Inappropriate implementation in Omnibox in Google Chrome prior to 99.0.4844.51 allowed an attacker in a privileged network position to…Google Chrome
- CVE-2022-4922Inappropriate implementation in Blink in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to perform UI spoofing via a…Google Chrome
- CVE-2022-4917Incorrect security UI in Notifications in Google Chrome on Android prior to 103.0.5060.53 allowed a remote attacker to obscure the full…Google Chrome
- CVE-2022-4915Inappropriate implementation in URL Formatting in Google Chrome prior to 103.0.5060.134 allowed a remote attacker to perform domain…Google Chrome
- CVE-2022-4914Heap buffer overflow in PrintPreview in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a…Google Chrome
- CVE-2022-4911Insufficient data validation in DevTools in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to bypass content security…Google Chrome
- CVE-2022-4910Inappropriate implementation in Autofill in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to bypass navigation…Google Chrome
- CVE-2022-4909Inappropriate implementation in XML in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially perform an ASLR…Google Chrome
- CVE-2022-4908Inappropriate implementation in iFrame Sandbox in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to leak cross-origin data…Google Chrome
- CVE-2022-4907Uninitialized Use in FFmpeg in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to execute arbitrary code inside a sandbox…Google Chrome
- CVE-2023-3488Uninitialized variable in Gecko Bootloader can leak secure stacksilabs.com Gecko Bootloader
- CVE-2023-38685Discourse's restricted tag information visible to unauthenticated usersdiscourse
- CVE-2023-38684Discourse vulnerable to ossible DDoS due to unbounded limits in various controller actionsdiscourse
- CVE-2023-38498Discourse vulnerable to DoS via defer queuediscourse
- CVE-2023-37906Discourse vulnerable to DoS via post edit reasondiscourse
- CVE-2023-37904Discourse Race Condition in Accept Invitediscourse
- CVE-2023-37467Discourse CSP nonce reuse vulnerability for anonymous usersdiscourse
Show all 71 entriesShow fewer entries
- CVE-2023-3990Mingsoft MCMS HTTP POST Request search.do cross site scriptingMingsoft MCMS · net.mingsoft:ms-mcms
- CVE-2023-3989SourceCodester Jewelry Store System add_customer.php cross site scriptingSourceCodester Jewelry Store System
- CVE-2023-3988Cafe Billing System Order index.php sql injectionCafe Billing System
- CVE-2023-3987SourceCodester Simple Online Mens Salon Management System sql injectionSourceCodester Simple Online Mens Salon Management System
- CVE-2023-3986SourceCodester Simple Online Mens Salon Management System cross site scriptingSourceCodester Simple Online Mens Salon Management System
- CVE-2023-0958Inisev Plugins (Various Versions) - Missing Authorization on handle_installation functioninisev Redirection · inisev Pop-up +9
- CVE-2023-3977Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation functioninisev Redirection · inisev Pop-up +9
- CVE-2023-37285An out-of-bounds read was addressed with improved bounds checking.Apple macOS · Apple iOS and iPadOS
- CVE-2023-32654A logic issue was addressed with improved state management.Apple macOS
- CVE-2023-38609An injection issue was addressed with improved input validation.Apple macOS
- CVE-2023-38598A use-after-free issue was addressed with improved memory management.Apple tvOS · Apple iOS and iPadOS +2
- CVE-2023-28203The issue was addressed with improved checks.Apple Music for Android
- CVE-2023-38604An out-of-bounds write issue was addressed with improved input validation.Apple tvOS · Apple iOS and iPadOS +2
- CVE-2023-38599A logic issue was addressed with improved state management.Apple Safari · Apple tvOS +3
- CVE-2023-36495An integer overflow was addressed with improved input validation.Apple tvOS · Apple iOS and iPadOS +2
- CVE-2023-38592A logic issue was addressed with improved restrictions.Apple tvOS · Apple iOS and iPadOS +2
- CVE-2023-32445This issue was addressed with improved checks.Apple Safari · Apple tvOS +3
- CVE-2023-38571This issue was addressed with improved validation of symlinks.Apple macOS
- CVE-2023-32444A logic issue was addressed with improved validation.Apple macOS
- CVE-2023-38590A buffer overflow issue was addressed with improved memory handling.Apple tvOS · Apple iOS and iPadOS +2
- CVE-2023-38601This issue was addressed by removing the vulnerable code.Apple macOS
- CVE-2023-32427This issue was addressed by using HTTPS when sending information over the network.Apple Music for Android
- CVE-2023-34425The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +1
- CVE-2023-3984phpscriptpoint RecipePoint recipe-result sql injectionphpscriptpoint RecipePoint
- CVE-2023-3774Vault Enterprise Namespace Creation May Lead to Denial of ServiceHashiCorp Vault Enterprise
- CVE-2022-31454Yii 2 v2.0.45 was discovered to contain a cross-site scripting (XSS) vulnerability via the endpoint /books.
- CVE-2023-31932Sql injection vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to execute arbitrary code via the viewid…
- CVE-2023-31933Sql injection vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to execute arbitrary code via the editid…
- CVE-2023-31934Cross Site Scripting vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to obtain sensitive information via…
- CVE-2023-31935Cross Site Scripting vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to obtain sensitive information via…
- CVE-2023-31936Sql injection vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to execute arbitrary code via the viewid…
- CVE-2023-31937Sql injection vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to execute arbitrary code via the editid…
- CVE-2023-37754PowerJob v4.3.3 was discovered to contain a remote command execution (RCE) vulnerability via the instanceId parameter at /instance/detail.tech.powerjob:powerjob-common
- CVE-2023-38331Zoho ManageEngine Support Center Plus 14001 and below is vulnerable to stored XSS in the products module.
- CVE-2023-38988An issue in the delete function in the OaNotifyController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete…
- CVE-2023-38992jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData.org.jeecgframework.boot:jeecg-boot-common
- CVE-2023-39010BoofCV 0.42 was discovered to contain a code injection vulnerability via the component boofcv.io.calibration.CalibrationIO.load.org.boofcv:boofcv-core
- CVE-2023-39013Duke v1.2 and below was discovered to contain a code injection vulnerability via the component…no.priv.garshol.duke:duke
- CVE-2023-39015webmagic-extension v0.9.0 and below was discovered to contain a code injection vulnerability via the component…us.codecraft:webmagic-core
- CVE-2023-39016bboss-persistent v6.0.9 and below was discovered to contain a code injection vulnerability in the component…
- CVE-2023-39017quartz-jobs 2.3.2 and below was discovered to contain a code injection vulnerability in the component…
- CVE-2023-39018FFmpeg 0.7.0 and below was discovered to contain a code injection vulnerability in the component net.bramp.ffmpeg.FFmpeg.<constructor>.
- CVE-2023-39020stanford-parser v3.9.2 and below was discovered to contain a code injection vulnerability in the component…edu.stanford.nlp:stanford-parser
- CVE-2023-39021wix-embedded-mysql v4.6.1 and below was discovered to contain a code injection vulnerability in the component…com.wix:wix-embedded-mysql
- CVE-2023-39022oscore v2.2.6 and below was discovered to contain a code injection vulnerability in the component…opensymphony:oscore
- CVE-2023-39023university compass v2.2.0 and below was discovered to contain a code injection vulnerability in the component…