CVEs published June 8, 2023
40 CVEs were published on June 8, 2023: 6 critical, 12 high.
- Published
- 40
- Critical
- 6
- High
- 12
- Medium
- 18
- Low
- 3
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 13
Most affected products
- IBM Sterling Partner Engagement Manager
- 3
- Go toolchain cmd/go · toolchain
- 2
- IBM TXSeries for Multiplatforms · IBM CICS TX Standard +1
- 2
- bytedeco javacpp-presets
- 1
- github.com/gin-gonic/gin
- 1
- Go standard library runtime · stdlib
- 1
- Go toolchain cmd/go · Go toolchain cmd/cgo +1
- 1
- google.golang.org/protobuf/encoding/prototext · google.g… +1
- 1
- Sensormatic Electronics, a subsidiary of Johnson Controls I…
- 1
- sni Thruk
- 1
Critical 6
- CVE-2023-29405Improper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/goGo toolchain cmd/go · Go toolchain cmd/cgo +1
- CVE-2023-29404Improper handling of non-optional LDFLAGS in go command with cgo in cmd/goGo toolchain cmd/go · toolchain
- CVE-2023-29402Code injection via go command with cgo in cmd/goGo toolchain cmd/go · toolchain
- CVE-2023-2986Abandoned Cart Lite for WooCommerce <= 5.15.1 - Authentication Bypasstychesoftwares Abandoned Cart Lite for WooCommerce
- CVE-2023-33443Incorrect access control in the administrative functionalities of BES--6024PB-I50H1 VideoPlayTool v2.0.1.0 allow attackers to execute arbitr
- CVE-2023-34566Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter time at /goform/saveParentControlInfo.
High 12
- CVE-2023-34230Snowflake Connector vulnerable to Command Injectionsnowflakedb snowflake-connector-net · Snowflake.Data
- CVE-2023-24535Panic when parsing invalid messages in google.golang.org/protobufgoogle.golang.org/protobuf/encoding/prototext · google.g… +1
- CVE-2023-34233Snowflake Python Connector vulnerable to Command Injectionsnowflakedb snowflake-connector-python · snowflake-connecto…
- CVE-2023-29403Unsafe behavior in setuid/setgid binaries in runtimeGo standard library runtime · stdlib
- CVE-2023-34232Snowflake NodeJS Driver vulnerable to Command Injectionsnowflakedb snowflake-connector-nodejs · snowflake-sdk
- CVE-2023-0954Debug feature in Sensormatic Electronics Illustra Dome and PTZ camerasSensormatic Electronics, a subsidiary of Johnson Controls I…
- CVE-2023-34231Snowflake Golang Driver vulnerable to Command Injectionsnowflakedb gosnowflake · github.com/snowflakedb/gosnowflake
- CVE-2023-32749Pydio Cells allows users by default to create so-called external users in order to share files with them.
- CVE-2023-33657A use-after-free vulnerability exists in NanoMQ 0.17.2.
- CVE-2023-33658A heap buffer overflow vulnerability exists in NanoMQ 0.17.2.
- CVE-2023-33660A heap buffer overflow vulnerability exists in NanoMQ 0.17.2.
- CVE-2023-34962Incorrect access control in Chamilo v1.11.x up to v1.11.18 allows a student to arbitrarily access and modify another student's personal note
Medium, low and unrated 22
- CVE-2023-34112JavaCPP project actions vulnerable to code injection bytedeco javacpp-presets
- CVE-2023-34243Windows user name disclosure in TGstationtgstation-server
- CVE-2023-29401Improper handling of filenames in Content-Disposition HTTP header in github.com/gin-gonic/gingithub.com/gin-gonic/gin
- CVE-2023-34096Thruk has Path Traversal Vulnerability in panorama.pmsni Thruk
- CVE-2023-3165SourceCodester Life Insurance Management System POST Parameter insertNominee.php cross site scriptingSourceCodester Life Insurance Management System
- CVE-2023-3163y_project RuoYi filterKeyword resource consumptiony_project RuoYi · com.ruoyi:ruoyi
- CVE-2023-23480IBM Sterling Partner Engagement Manager cross-site scriptingIBM Sterling Partner Engagement Manager
- CVE-2023-23481IBM Sterling Partner Engagement Manager cross-site scriptingIBM Sterling Partner Engagement Manager
- CVE-2023-23482IBM Sterling Partner Engagement Manager clickjackingIBM Sterling Partner Engagement Manager
- CVE-2023-33846IBM CICS TX cross-site scriptingIBM TXSeries for Multiplatforms · IBM CICS TX Standard +1
- CVE-2023-33847IBM CICS TX information disclosureIBM TXSeries for Multiplatforms · IBM CICS TX Standard +1
- CVE-2023-32750Pydio Cells through 4.1.2 allows SSRF.
- CVE-2023-32751Pydio Cells through 4.1.2 allows XSS.
- CVE-2023-34567Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter list at /goform/SetVirtualServerCfg.
- CVE-2023-34568Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter time at /goform/PowerSaveSet.
- CVE-2023-34569Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter list at /goform/SetNetControlList.
- CVE-2023-34570Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter devName at /goform/SetOnlineDevName.
- CVE-2023-34571Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter shareSpeed at /goform/WifiGuestSet.
- CVE-2023-34958Incorrect access control in Chamilo 1.11.* up to 1.11.18 allows a student subscribed to a given course to download documents belonging to an
- CVE-2023-34959An issue in Chamilo v1.11.* up to v1.11.18 allows attackers to execute a Server-Side Request Forgery (SSRF) and obtain information on the se
- CVE-2023-34961Chamilo v1.11.x up to v1.11.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the /feedback/comment field.
- CVE-2023-34969D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon.