# CVEs published 2023-06-08

40 CVEs were published on June 8, 2023: 6 critical, 12 high. Days are UTC.

- [CVE-2023-34112](https://cve.now/CVE-2023-34112.md): JavaCPP project actions vulnerable to code injection (CVSS 4.3, bytedeco javacpp-presets)
- [CVE-2023-34243](https://cve.now/CVE-2023-34243.md): Windows user name disclosure in TGstation (CVSS 5.8, tgstation-server)
- [CVE-2023-34230](https://cve.now/CVE-2023-34230.md): Snowflake Connector vulnerable to Command Injection (CVSS 7.3, snowflakedb snowflake-connector-net · Snowflake.Data)
- [CVE-2023-29401](https://cve.now/CVE-2023-29401.md): Improper handling of filenames in Content-Disposition HTTP header in github.com/gin-gonic/gin (CVSS 4.3, github.com/gin-gonic/gin)
- [CVE-2023-24535](https://cve.now/CVE-2023-24535.md): Panic when parsing invalid messages in google.golang.org/protobuf (CVSS 7.5, google.golang.org/protobuf/encoding/prototext · google.g… +1)
- [CVE-2023-34233](https://cve.now/CVE-2023-34233.md): Snowflake Python Connector vulnerable to Command Injection (CVSS 7.3, snowflakedb snowflake-connector-python · snowflake-connecto…)
- [CVE-2023-29405](https://cve.now/CVE-2023-29405.md): Improper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/go (CVSS 9.8, Go toolchain cmd/go · Go toolchain cmd/cgo +1)
- [CVE-2023-29404](https://cve.now/CVE-2023-29404.md): Improper handling of non-optional LDFLAGS in go command with cgo in cmd/go (CVSS 9.8, Go toolchain cmd/go · toolchain)
- [CVE-2023-29403](https://cve.now/CVE-2023-29403.md): Unsafe behavior in setuid/setgid binaries in runtime (CVSS 7.8, Go standard library runtime · stdlib)
- [CVE-2023-29402](https://cve.now/CVE-2023-29402.md): Code injection via go command with cgo in cmd/go (CVSS 9.8, Go toolchain cmd/go · toolchain)
- [CVE-2023-34232](https://cve.now/CVE-2023-34232.md): Snowflake NodeJS Driver vulnerable to Command Injection (CVSS 7.3, snowflakedb snowflake-connector-nodejs · snowflake-sdk)
- [CVE-2023-0954](https://cve.now/CVE-2023-0954.md): Debug feature in Sensormatic Electronics Illustra Dome and PTZ cameras (CVSS 8.3, Sensormatic Electronics, a subsidiary of Johnson Controls I…)
- [CVE-2023-34231](https://cve.now/CVE-2023-34231.md): Snowflake Golang Driver vulnerable to Command Injection (CVSS 7.3, snowflakedb gosnowflake · github.com/snowflakedb/gosnowflake)
- [CVE-2023-34096](https://cve.now/CVE-2023-34096.md): Thruk has Path Traversal Vulnerability in panorama.pm (CVSS 6.5, sni Thruk)
- [CVE-2023-3165](https://cve.now/CVE-2023-3165.md): SourceCodester Life Insurance Management System POST Parameter insertNominee.php cross site scripting (CVSS 3.5, SourceCodester Life Insurance Management System)
- [CVE-2023-3163](https://cve.now/CVE-2023-3163.md): y\_project RuoYi filterKeyword resource consumption (CVSS 3.5, y\_project RuoYi · com.ruoyi:ruoyi)
- [CVE-2023-2986](https://cve.now/CVE-2023-2986.md): Abandoned Cart Lite for WooCommerce \<= 5.15.1 - Authentication Bypass (CVSS 9.8, tychesoftwares Abandoned Cart Lite for WooCommerce)
- [CVE-2023-23480](https://cve.now/CVE-2023-23480.md): IBM Sterling Partner Engagement Manager cross-site scripting (CVSS 5.4, IBM Sterling Partner Engagement Manager)
- [CVE-2023-23481](https://cve.now/CVE-2023-23481.md): IBM Sterling Partner Engagement Manager cross-site scripting (CVSS 6.4, IBM Sterling Partner Engagement Manager)
- [CVE-2023-23482](https://cve.now/CVE-2023-23482.md): IBM Sterling Partner Engagement Manager clickjacking (CVSS 5.4, IBM Sterling Partner Engagement Manager)
- [CVE-2023-33846](https://cve.now/CVE-2023-33846.md): IBM CICS TX cross-site scripting (CVSS 5.4, IBM TXSeries for Multiplatforms · IBM CICS TX Standard +1)
- [CVE-2023-33847](https://cve.now/CVE-2023-33847.md): IBM CICS TX information disclosure (CVSS 3.7, IBM TXSeries for Multiplatforms · IBM CICS TX Standard +1)
- [CVE-2023-32749](https://cve.now/CVE-2023-32749.md): Pydio Cells allows users by default to create so-called external users in order to share files with them. (CVSS 8.8)
- [CVE-2023-32750](https://cve.now/CVE-2023-32750.md): Pydio Cells through 4.1.2 allows SSRF. (CVSS 6.5)
- [CVE-2023-32751](https://cve.now/CVE-2023-32751.md): Pydio Cells through 4.1.2 allows XSS. (CVSS 5.4)
- [CVE-2023-33443](https://cve.now/CVE-2023-33443.md): Incorrect access control in the administrative functionalities of BES--6024PB-I50H1 VideoPlayTool v2.0.1.0 allow attackers to execute arbitr (CVSS 9.8)
- [CVE-2023-33657](https://cve.now/CVE-2023-33657.md): A use-after-free vulnerability exists in NanoMQ 0.17.2. (CVSS 7.5)
- [CVE-2023-33658](https://cve.now/CVE-2023-33658.md): A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. (CVSS 7.5)
- [CVE-2023-33660](https://cve.now/CVE-2023-33660.md): A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. (CVSS 7.5)
- [CVE-2023-34566](https://cve.now/CVE-2023-34566.md): Tenda AC10 v4 US\_AC10V4.0si\_V16.03.10.13\_cn was discovered to contain a stack overflow via parameter time at /goform/saveParentControlInfo. (CVSS 9.8)
- [CVE-2023-34567](https://cve.now/CVE-2023-34567.md): Tenda AC10 v4 US\_AC10V4.0si\_V16.03.10.13\_cn was discovered to contain a stack overflow via parameter list at /goform/SetVirtualServerCfg. (CVSS 6.7)
- [CVE-2023-34568](https://cve.now/CVE-2023-34568.md): Tenda AC10 v4 US\_AC10V4.0si\_V16.03.10.13\_cn was discovered to contain a stack overflow via parameter time at /goform/PowerSaveSet. (CVSS 6.7)
- [CVE-2023-34569](https://cve.now/CVE-2023-34569.md): Tenda AC10 v4 US\_AC10V4.0si\_V16.03.10.13\_cn was discovered to contain a stack overflow via parameter list at /goform/SetNetControlList. (no CVSS)
- [CVE-2023-34570](https://cve.now/CVE-2023-34570.md): Tenda AC10 v4 US\_AC10V4.0si\_V16.03.10.13\_cn was discovered to contain a stack overflow via parameter devName at /goform/SetOnlineDevName. (CVSS 6.7)
- [CVE-2023-34571](https://cve.now/CVE-2023-34571.md): Tenda AC10 v4 US\_AC10V4.0si\_V16.03.10.13\_cn was discovered to contain a stack overflow via parameter shareSpeed at /goform/WifiGuestSet. (CVSS 6.7)
- [CVE-2023-34958](https://cve.now/CVE-2023-34958.md): Incorrect access control in Chamilo 1.11.\* up to 1.11.18 allows a student subscribed to a given course to download documents belonging to an (CVSS 4.3)
- [CVE-2023-34959](https://cve.now/CVE-2023-34959.md): An issue in Chamilo v1.11.\* up to v1.11.18 allows attackers to execute a Server-Side Request Forgery (SSRF) and obtain information on the se (CVSS 5.3)
- [CVE-2023-34961](https://cve.now/CVE-2023-34961.md): Chamilo v1.11.x up to v1.11.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the /feedback/comment field. (CVSS 6.1)
- [CVE-2023-34962](https://cve.now/CVE-2023-34962.md): Incorrect access control in Chamilo v1.11.x up to v1.11.18 allows a student to arbitrarily access and modify another student's personal note (CVSS 8.1)
- [CVE-2023-34969](https://cve.now/CVE-2023-34969.md): D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. (CVSS 6.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-06-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.