# CVEs published 2023-06-13

187 CVEs were published on June 13, 2023: 24 critical, 72 high. 4 are now in CISA KEV. Days are UTC.

- [CVE-2023-33145](https://cve.now/CVE-2023-33145.md): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Edge)
- [CVE-2023-33144](https://cve.now/CVE-2023-33144.md): Visual Studio Code Spoofing Vulnerability (CVSS 6.6, Microsoft Visual Studio Code)
- [CVE-2023-33142](https://cve.now/CVE-2023-33142.md): Microsoft SharePoint Server Elevation of Privilege Vulnerability (CVSS 6.5, Microsoft SharePoint Server)
- [CVE-2023-33140](https://cve.now/CVE-2023-33140.md): Microsoft OneNote Spoofing Vulnerability (CVSS 6.5, Microsoft OneNote for Universal)
- [CVE-2023-33135](https://cve.now/CVE-2023-33135.md): .NET and Visual Studio Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft .NET · Microsoft Visual Studio)
- [CVE-2023-33133](https://cve.now/CVE-2023-33133.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2023-33132](https://cve.now/CVE-2023-33132.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 6.3, Microsoft SharePoint Server)
- [CVE-2023-33131](https://cve.now/CVE-2023-33131.md): Microsoft Outlook Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2023-33130](https://cve.now/CVE-2023-33130.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 7.3, Microsoft SharePoint Server)
- [CVE-2023-33129](https://cve.now/CVE-2023-33129.md): Microsoft SharePoint Server Denial of Service Vulnerability (CVSS 6.5, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2023-33128](https://cve.now/CVE-2023-33128.md): .NET and Visual Studio Remote Code Execution Vulnerability (CVSS 7.3, Microsoft .NET · Microsoft Visual Studio +13)
- [CVE-2023-33126](https://cve.now/CVE-2023-33126.md): .NET and Visual Studio Remote Code Execution Vulnerability (CVSS 7.3, Microsoft .NET · Microsoft Visual Studio +5)
- [CVE-2023-32032](https://cve.now/CVE-2023-32032.md): .NET and Visual Studio Elevation of Privilege Vulnerability (CVSS 6.5, Microsoft .NET · Microsoft Visual Studio +1)
- [CVE-2023-32022](https://cve.now/CVE-2023-32022.md): Windows Server Service Security Feature Bypass Vulnerability (CVSS 7.6, Microsoft Windows Server)
- [CVE-2023-32021](https://cve.now/CVE-2023-32021.md): Windows SMB Witness Service Security Feature Bypass Vulnerability (CVSS 7.1, Microsoft Windows Server)
- [CVE-2023-32020](https://cve.now/CVE-2023-32020.md): Windows DNS Spoofing Vulnerability (CVSS 5.6, Microsoft Windows Server)
- [CVE-2023-32019](https://cve.now/CVE-2023-32019.md): Windows Kernel Information Disclosure Vulnerability (CVSS 4.7, Microsoft Windows)
- [CVE-2023-32018](https://cve.now/CVE-2023-32018.md): Windows Hello Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-32017](https://cve.now/CVE-2023-32017.md): Microsoft PostScript Printer Driver Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-32016](https://cve.now/CVE-2023-32016.md): Windows Installer Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2023-32015](https://cve.now/CVE-2023-32015.md): Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows)
- [CVE-2023-32014](https://cve.now/CVE-2023-32014.md): Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows)
- [CVE-2023-32013](https://cve.now/CVE-2023-32013.md): Windows Hyper-V Denial of Service Vulnerability (CVSS 5.3, Microsoft Windows)
- [CVE-2023-32012](https://cve.now/CVE-2023-32012.md): Windows Container Manager Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-32011](https://cve.now/CVE-2023-32011.md): Windows iSCSI Discovery Service Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2023-32010](https://cve.now/CVE-2023-32010.md): Windows Bus Filter Driver Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2023-32009](https://cve.now/CVE-2023-32009.md): Windows Collaborative Translation Framework Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2023-32008](https://cve.now/CVE-2023-32008.md): Windows Resilient File System (ReFS) Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-29373](https://cve.now/CVE-2023-29373.md): Microsoft ODBC Driver Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2023-29372](https://cve.now/CVE-2023-29372.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2023-29371](https://cve.now/CVE-2023-29371.md): Windows GDI Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-29370](https://cve.now/CVE-2023-29370.md): Windows Media Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-29369](https://cve.now/CVE-2023-29369.md): Remote Procedure Call Runtime Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows Server)
- [CVE-2023-29368](https://cve.now/CVE-2023-29368.md): Windows Filtering Platform Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2023-29367](https://cve.now/CVE-2023-29367.md): iSCSI Target WMI Provider Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows Server)
- [CVE-2023-29366](https://cve.now/CVE-2023-29366.md): Windows Geolocation Service Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows Server · Microsoft Windows)
- [CVE-2023-29365](https://cve.now/CVE-2023-29365.md): Windows Media Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-29364](https://cve.now/CVE-2023-29364.md): Windows Authentication Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2023-29363](https://cve.now/CVE-2023-29363.md): Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows)
- [CVE-2023-29362](https://cve.now/CVE-2023-29362.md): Remote Desktop Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows · Microsoft Remote Desktop client for Win…)
- [CVE-2023-29361](https://cve.now/CVE-2023-29361.md): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows Server · Microsoft Windows)
- [CVE-2023-29360](https://cve.now/CVE-2023-29360.md): Microsoft Streaming Service Elevation of Privilege Vulnerability (CVSS 8.4, KEV, Microsoft Windows)
- [CVE-2023-29359](https://cve.now/CVE-2023-29359.md): GDI Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-29358](https://cve.now/CVE-2023-29358.md): Windows GDI Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-29357](https://cve.now/CVE-2023-29357.md): Microsoft SharePoint Server Elevation of Privilege Vulnerability (CVSS 9.8, KEV, Microsoft SharePoint Server)
- [CVE-2023-29355](https://cve.now/CVE-2023-29355.md): DHCP Server Service Information Disclosure Vulnerability (CVSS 5.3, Microsoft Windows Server)
- [CVE-2023-29352](https://cve.now/CVE-2023-29352.md): Windows Remote Desktop Security Feature Bypass Vulnerability (CVSS 6.5, Microsoft Windows · Microsoft Remote Desktop client for Win…)
- [CVE-2023-29351](https://cve.now/CVE-2023-29351.md): Windows Group Policy Elevation of Privilege Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2023-29346](https://cve.now/CVE-2023-29346.md): NTFS Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-21569](https://cve.now/CVE-2023-21569.md): Azure DevOps Server Spoofing Vulnerability (CVSS 5.5, Microsoft Azure DevOps Server)
- [CVE-2023-21565](https://cve.now/CVE-2023-21565.md): Azure DevOps Server Spoofing Vulnerability (CVSS 7.1, Microsoft Azure DevOps Server)
- [CVE-2023-33146](https://cve.now/CVE-2023-33146.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office 2019 for Mac · Microsoft 365 Apps for E… +1)
- [CVE-2023-33139](https://cve.now/CVE-2023-33139.md): Visual Studio Information Disclosure Vulnerability (CVSS 5.5, Microsoft Visual Studio)
- [CVE-2023-33137](https://cve.now/CVE-2023-33137.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft Excel)
- [CVE-2023-32029](https://cve.now/CVE-2023-32029.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2023-29353](https://cve.now/CVE-2023-29353.md): Sysinternals Process Monitor for Windows Denial of Service Vulnerability (CVSS 5.5, Microsoft Windows Sysinternals Process Monitor · Microsoft…)
- [CVE-2023-24938](https://cve.now/CVE-2023-24938.md): Windows CryptoAPI Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2023-34250](https://cve.now/CVE-2023-34250.md): Discourse vulnerable to exposure of number of topics recently created in private categories (CVSS 4.8, discourse)
- [CVE-2023-32301](https://cve.now/CVE-2023-32301.md): Discourse's canonical url not being used for topic embeddings (CVSS 3.1, discourse)
- [CVE-2023-32061](https://cve.now/CVE-2023-32061.md): Discourse Topic Creation Page Allows iFrame Tag without Restrictions (CVSS 5.4, discourse)
- [CVE-2023-31142](https://cve.now/CVE-2023-31142.md): Discourse's general category permissions could be set back to default (CVSS 2.0, discourse)
- [CVE-2023-2778](https://cve.now/CVE-2023-2778.md): Rockwell Automation FactoryTalk Transaction Manager Vulnerable to Denial-Of-Service (CVSS 7.5, Rockwell Automation FactoryTalk Transaction Manager)
- [CVE-2023-2639](https://cve.now/CVE-2023-2639.md): Rockwell Automation FactoryTalk System Services Vulnerable to Sensitive Information Disclosure (CVSS 4.1, Rockwell Automation FactoryTalk System Services)
- [CVE-2023-2638](https://cve.now/CVE-2023-2638.md): Rockwell Automation FactoryTalk System Services Vulnerable to a Denial-of-Service Attack (CVSS 5.9, Rockwell Automation FactoryTalk System Services)
- [CVE-2023-2637](https://cve.now/CVE-2023-2637.md): Rockwell Automation FactoryTalk System Services Vulnerable To Use Of Hard-Coded Cryptographic Key (CVSS 7.3, Rockwell Automation FactoryTalk System Services)
- [CVE-2022-43684](https://cve.now/CVE-2022-43684.md): ACL bypass in Reporting functionality (CVSS 9.9, ServiceNow Now Platform)
- [CVE-2023-34115](https://cve.now/CVE-2023-34115.md): Buffer copy without checking size of input in Zoom Meeting SDK before 5.13.0 may allow an authenticated user to potentially enable a denia (CVSS 4.3, Zoom Video Communications Zoom Meeting SDK)
- [CVE-2023-34114](https://cve.now/CVE-2023-34114.md): Exposure of resource to wrong sphere in Zoom for Windows and Zoom for MacOS clients before 5.14.10 may allow an authenticated user to poten (CVSS 7.4, Zoom Video Communications Zoom for Windows Client · Zoom Vi…)
- [CVE-2023-3217](https://cve.now/CVE-2023-3217.md): Use after free in WebXR in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a craf (CVSS 8.8, Google Chrome)
- [CVE-2023-3216](https://cve.now/CVE-2023-3216.md): Type confusion in V8 in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2023-3215](https://cve.now/CVE-2023-3215.md): Use after free in WebRTC in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a cra (CVSS 8.8, Google Chrome)
- [CVE-2023-3214](https://cve.now/CVE-2023-3214.md): Use after free in Autofill payments in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruptio (CVSS 8.8, Google Chrome)
- [CVE-2023-34121](https://cve.now/CVE-2023-34121.md): Improper input validation in the Zoom for Windows, Zoom Rooms, Zoom VDI Windows Meeting clients before 5.14.0 may allow an authenticated (CVSS 4.1, Zoom Video Communications Zoom for Windows · Zoom Video… +1)
- [CVE-2023-34120](https://cve.now/CVE-2023-34120.md): Improper privilege management in Zoom for Windows, Zoom Rooms for Windows, and Zoom VDI for Windows clients before 5.14.0 may allow an auth (CVSS 8.7, Zoom Video Communications Zoom for Windows Client · Zoom… +1)
- [CVE-2023-28603](https://cve.now/CVE-2023-28603.md): Zoom VDI client installer prior to 5.14.0 contains an improper access control vulnerability. (CVSS 7.7, Zoom Video Communications Zoom VDI Windows Meeting Client)
- [CVE-2023-28602](https://cve.now/CVE-2023-28602.md): Zoom for Windows clients prior to 5.13.5 contain an improper verification of cryptographic signature vulnerability. (CVSS 2.8, Zoom Video Communications Zoom for Windows Client)
- [CVE-2023-1707](https://cve.now/CVE-2023-1707.md): Certain HP Enterprise LaserJet and HP LaserJet Managed Printers are potentially vulnerable to information disclosure when IPsec is enabled w (CVSS 7.5, HP Enterprise LaserJet and HP LaserJet Managed Printers)
- [CVE-2023-28601](https://cve.now/CVE-2023-28601.md): Zoom for Windows clients prior to 5.14.0 contain an improper restriction of operations within the bounds of a memory buffer vulnerability. (CVSS 8.3, Zoom Video Communications Zoom for Windows Client)
- [CVE-2023-28600](https://cve.now/CVE-2023-28600.md): Zoom for MacOSclients prior to 5.14.0 contain an improper access control vulnerability. (CVSS 5.2, Zoom Video Communications Zoom for macOS Client)
- [CVE-2023-28599](https://cve.now/CVE-2023-28599.md): Zoom clients prior to 5.13.10 contain an HTML injection vulnerability. (CVSS 4.3, Zoom Video Communications Zoom for Android · Zoom Video… +3)
- [CVE-2023-28598](https://cve.now/CVE-2023-28598.md): Zoom for Linux clients prior to 5.13.10 contain an HTML injection vulnerability. (CVSS 7.5, Zoom Video Communications Zoom for Linux clients)
- [CVE-2023-20867](https://cve.now/CVE-2023-20867.md): VMware Tools Authentication Bypass Vulnerability (CVSS 3.9, KEV, VMware Tools)
- [CVE-2023-34249](https://cve.now/CVE-2023-34249.md): benjjvi/PyBB may send unsanitized request to SQL database (CVSS 9.8, benjjvi PyBB)
- [CVE-2023-34247](https://cve.now/CVE-2023-34247.md): @keystone-6/auth Open Redirect vulnerability (CVSS 6.1, keystonejs keystone · @keystone-6/auth)
- [CVE-2023-28303](https://cve.now/CVE-2023-28303.md): Windows Snipping Tool Information Disclosure Vulnerability (CVSS 3.3, Microsoft Snipping Tool · Microsoft Snip & Sketch for Windo…)
- [CVE-2022-31639](https://cve.now/CVE-2022-31639.md): Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might all (CVSS 7.8, HP PC BIOS)
- [CVE-2022-31638](https://cve.now/CVE-2022-31638.md): Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might all (CVSS 7.8, HP PC BIOS)
- [CVE-2022-31637](https://cve.now/CVE-2022-31637.md): Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might all (CVSS 7.8, HP PC BIOS)
- [CVE-2022-31636](https://cve.now/CVE-2022-31636.md): Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might all (CVSS 7.8, HP PC BIOS)
- [CVE-2022-31635](https://cve.now/CVE-2022-31635.md): Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might all (CVSS 7.8, HP PC BIOS)
- [CVE-2023-25978](https://cve.now/CVE-2023-25978.md): WordPress Protected Posts Logout Button Plugin \<= 1.4.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Nate Reist Protected Posts Logout Button)
- [CVE-2023-27624](https://cve.now/CVE-2023-27624.md): WordPress Redirect After Login Plugin \<= 0.1.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Marcelotorres Redirect After Login)
- [CVE-2023-28620](https://cve.now/CVE-2023-28620.md): WordPress Cyberus Key Plugin \<= 1.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Cyberus Labs Cyberus Key)
- [CVE-2023-26528](https://cve.now/CVE-2023-26528.md): WordPress Shipyaari Shipping Management Plugin \<= 1.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, jinit9906 Shipyaari Shipping Management)
- [CVE-2023-26538](https://cve.now/CVE-2023-26538.md): WordPress Chat Bee Plugin \<= 1.1.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Kamyabsoft Chat Bee)
- [CVE-2023-25964](https://cve.now/CVE-2023-25964.md): WordPress We’re Open! Plugin \<= 1.46 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Noah Hearle, Design Extreme We’re Open!)
- [CVE-2022-42880](https://cve.now/CVE-2022-42880.md): WordPress Auto Upload Images Plugin \<= 3.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 6.1, Ali Irani Auto Upload Images)
- [CVE-2023-23831](https://cve.now/CVE-2023-23831.md): WordPress Rating Widget Plugin \<= 3.1.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Rating-Widget: Star Review System)
- [CVE-2023-35064](https://cve.now/CVE-2023-35064.md): SQLi in Satos Mobile (CVSS 9.8, Satos Mobile)
- [CVE-2023-3050](https://cve.now/CVE-2023-3050.md): Authentication Bypass in TMT's Lockcell (CVSS 9.8, TMT Lockcell)
- [CVE-2023-3049](https://cve.now/CVE-2023-3049.md): File Upload in TMT's Lockcell (CVSS 9.8, TMT Lockcell)
- [CVE-2023-3048](https://cve.now/CVE-2023-3048.md): IDOR in TMT's Lockcell (CVSS 9.8, TMT Lockcell)
- [CVE-2023-3047](https://cve.now/CVE-2023-3047.md): SQLi in TMT's Lockcell (CVSS 9.8, TMT Lockcell)
- [CVE-2023-2807](https://cve.now/CVE-2023-2807.md): Authentication bypass in password reset process (CVSS 6.4, Artica PFMS Pandora FMS)
- [CVE-2023-33305](https://cve.now/CVE-2023-33305.md): A loop with unreachable exit condition ('infinite loop') in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS version 7.0.0 through 7.0. (CVSS 4.9, Fortinet FortiWeb · Fortinet FortiOS +1)
- [CVE-2023-29178](https://cve.now/CVE-2023-29178.md): A access of uninitialized pointer vulnerability \[CWE-824\] vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4, FortiOS 7.0.0 through 7.0.1 (CVSS 3.9, Fortinet FortiOS · Fortinet FortiProxy)
- [CVE-2023-29175](https://cve.now/CVE-2023-29175.md): An improper certificate validation vulnerability \[CWE-295\] in FortiOS 6.2 all versions, 6.4 all versions, 7.0.0 through 7.0.10, 7.2.0 and Fo (CVSS 4.4, Fortinet FortiOS · Fortinet FortiProxy)
- [CVE-2023-28000](https://cve.now/CVE-2023-28000.md): An improper neutralization of special elements used in an OS command vulnerability \[CWE-78\] in FortiADC CLI 7.1.0, 7.0.0 through 7.0.3, 6.2. (CVSS 6.3, Fortinet FortiADC)
- [CVE-2023-27997](https://cve.now/CVE-2023-27997.md): A heap-based buffer overflow vulnerability \[CWE-122\] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, (CVSS 9.2, KEV, Fortinet FortiOS-6K7K · Fortinet FortiProxy +1)
- [CVE-2023-26210](https://cve.now/CVE-2023-26210.md): Multiple improper neutralization of special elements used in an os command ('OS Command Injection') vulnerabilties \[CWE-78\] vulnerability in (CVSS 7.8, Fortinet FortiADC · Fortinet FortiADCManager)
- [CVE-2023-26204](https://cve.now/CVE-2023-26204.md): A plaintext storage of a password vulnerability \[CWE-256\] in FortiSIEM 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all version (CVSS 3.6, Fortinet FortiSIEM)
- [CVE-2023-26207](https://cve.now/CVE-2023-26207.md): An insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4 and FortiProxy 7.0.0 through 7.0.1 (CVSS 3.3, Fortinet FortiProxy · Fortinet FortiOS)
- [CVE-2023-25609](https://cve.now/CVE-2023-25609.md): A server-side request forgery (SSRF) vulnerability \[CWE-918\] in FortiManager and FortiAnalyzer GUI 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, (CVSS 4.2, Fortinet FortiAnalyzer · Fortinet FortiManager)
- [CVE-2023-22639](https://cve.now/CVE-2023-22639.md): A out-of-bounds write in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.10, FortiOS version 6.4.0 through 6 (CVSS 6.3, Fortinet FortiOS · Fortinet FortiProxy)
- [CVE-2023-22633](https://cve.now/CVE-2023-22633.md): An improper permissions, privileges, and access controls vulnerability \[CWE-264\] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and be (CVSS 7.2, Fortinet FortiNAC)
- [CVE-2022-43953](https://cve.now/CVE-2022-43953.md): A use of externally-controlled format string in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS all versions 7.0, FortiOS all versions (CVSS 6.3, Fortinet FortiProxy · Fortinet FortiOS)
- [CVE-2022-43949](https://cve.now/CVE-2022-43949.md): A use of a broken or risky cryptographic algorithm \[CWE-327\] in Fortinet FortiSIEM before 6.7.1 allows a remote unauthenticated attacker to (CVSS 5.9, Fortinet FortiSIEM)
- [CVE-2022-42478](https://cve.now/CVE-2022-42478.md): An Improper Restriction of Excessive Authentication Attempts \[CWE-307\] in FortiSIEM below 7.0.0 may allow a non-privileged user with access (CVSS 8.1, Fortinet FortiSIEM)
- [CVE-2022-42474](https://cve.now/CVE-2022-42474.md): A relative path traversal vulnerability \[CWE-23\] in Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9 and before 6.4 (CVSS 6.2, Fortinet FortiSwitchManager · Fortinet FortiProxy +1)
- [CVE-2022-41327](https://cve.now/CVE-2022-41327.md): A cleartext transmission of sensitive information vulnerability \[CWE-319\] in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0 (CVSS 7.6, Fortinet FortiOS · Fortinet FortiProxy)
- [CVE-2022-39946](https://cve.now/CVE-2022-39946.md): An access control vulnerability \[CWE-284\] in FortiNAC version 9.4.2 and below, version 9.2.7 and below, 9.1 all versions, 8.8 all versions, (CVSS 7.2, Fortinet FortiNAC)
- [CVE-2022-33877](https://cve.now/CVE-2022-33877.md): An incorrect default permission \[CWE-276\] vulnerability in FortiClient (Windows) versions 7.0.0 through 7.0.6 and 6.4.0 through 6.4.8 and Fo (CVSS 6.8, Fortinet FortiConverter · Fortinet FortiClientWindows)
- [CVE-2023-33921](https://cve.now/CVE-2023-33921.md): A vulnerability has been identified in CP-8031 MASTER MODULE (All versions \< CPCI85 V05), CP-8050 MASTER MODULE (All versions \< CPCI85 V05). (CVSS 6.8, Siemens CP-8031 MASTER MODULE · Siemens CP-8050 MASTER MODU…)
- [CVE-2023-33920](https://cve.now/CVE-2023-33920.md): A vulnerability has been identified in CP-8031 MASTER MODULE (All versions \< CPCI85 V05), CP-8050 MASTER MODULE (All versions \< CPCI85 V05). (CVSS 6.8, Siemens CP-8031 MASTER MODULE · Siemens CP-8050 MASTER MODU…)
- [CVE-2023-33919](https://cve.now/CVE-2023-33919.md): A vulnerability has been identified in CP-8031 MASTER MODULE (All versions \< CPCI85 V05), CP-8050 MASTER MODULE (All versions \< CPCI85 V05). (CVSS 7.2, Siemens CP-8031 MASTER MODULE · Siemens CP-8050 MASTER MODU…)
- [CVE-2023-33124](https://cve.now/CVE-2023-33124.md): A vulnerability has been identified in JT2Go (All versions \< V14.2.0.3), Teamcenter Visualization V13.2 (All versions \< V13.2.0.13), Teamcen (CVSS 7.8, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2023-33123](https://cve.now/CVE-2023-33123.md): A vulnerability has been identified in JT2Go (All versions \< V14.2.0.3), Teamcenter Visualization V13.2 (All versions \< V13.2.0.13), Teamcen (CVSS 7.8, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2023-33122](https://cve.now/CVE-2023-33122.md): A vulnerability has been identified in JT2Go (All versions \< V14.2.0.3), Teamcenter Visualization V13.2 (All versions \< V13.2.0.13), Teamcen (CVSS 3.3, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2023-33121](https://cve.now/CVE-2023-33121.md): A vulnerability has been identified in JT2Go (All versions \< V14.2.0.3), Teamcenter Visualization V13.2 (All versions \< V13.2.0.13), Teamcen (CVSS 3.3, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2023-31238](https://cve.now/CVE-2023-31238.md): A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions \< V3.11), SICAM P850 (7KG8500-0AA00-2AA0) (All versions (CVSS 5.5, Siemens SICAM P850 · Siemens SICAM P855 +1)
- [CVE-2023-30901](https://cve.now/CVE-2023-30901.md): A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions \< V3.11), SICAM P850 (7KG8500-0AA00-2AA0) (All versions (CVSS 4.3, Siemens SICAM P850 · Siemens SICAM P855 +1)
- [CVE-2023-30897](https://cve.now/CVE-2023-30897.md): A vulnerability has been identified in SIMATIC WinCC (All versions \< V7.5.2.13). (CVSS 7.8, Siemens SIMATIC WinCC)
- [CVE-2023-30757](https://cve.now/CVE-2023-30757.md): A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation P (CVSS 6.2, Siemens Totally Integrated Automation Portal (TIA Portal))
- [CVE-2023-29129](https://cve.now/CVE-2023-29129.md): A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions \>= V1.17.3 \< V1.18.0), Mendix SAML (Mendix 7 compatib (CVSS 9.1, Siemens Mendix SAML)
- [CVE-2023-28829](https://cve.now/CVE-2023-28829.md): A vulnerability has been identified in SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15 (All versions), SIMATIC PCS 7 (CVSS 3.9, Siemens SIMATIC NET PC Software · Siemens SIMATIC PCS 7 +2)
- [CVE-2023-27465](https://cve.now/CVE-2023-27465.md): A vulnerability has been identified in SIMOTION C240 (All versions \>= V5.4 \< V5.5 SP1), SIMOTION C240 PN (All versions \>= V5.4 \< V5.5 SP1), (CVSS 4.6, Siemens SIMOTION C240 · Siemens SIMOTION D410-2 DP +9)
- [CVE-2023-25910](https://cve.now/CVE-2023-25910.md): A vulnerability has been identified in SIMATIC PCS 7 (All versions \< V9.1 SP2 UC04), SIMATIC S7-PM (All versions \< V5.7 SP1 HF1), SIMATIC S7 (CVSS 10.0, Siemens SIMATIC PCS · Siemens SIMATIC S7-PM +1)
- [CVE-2023-2729](https://cve.now/CVE-2023-2729.md): Use of insufficiently random values vulnerability in User Management Functionality in Synology DiskStation Manager (DSM) before 7.2-64561 al (CVSS 5.9, Synology DiskStation Manager · Synology Unified Controll… +1)
- [CVE-2023-0142](https://cve.now/CVE-2023-0142.md): Uncontrolled search path element vulnerability in Backup Management functionality in Synology DiskStation Manager (DSM) before 6.2.4-25556-8 (CVSS 6.5, Synology DiskStation Manager · Synology Unified Controll… +1)
- [CVE-2023-2673](https://cve.now/CVE-2023-2673.md): PHOENIX CONTACT: FL/TC MGUARD prone to Improper Input Validation (CVSS 5.3, PHOENIX CONTACT FL MGUARD)
- [CVE-2023-2876](https://cve.now/CVE-2023-2876.md): Session cookie exposure for client side script (CVSS 3.1, ABB REX640 PCL1 · ABB REX640 PCL2 +1)
- [CVE-2023-33991](https://cve.now/CVE-2023-33991.md): Stored Cross-Site Scripting (Stored XSS) vulnerability in SAP UI5 Variant Management (CVSS 8.2, SAP\_SE SAP UI5 Variant Management)
- [CVE-2023-33986](https://cve.now/CVE-2023-33986.md): Cross-Site Scripting (XSS) vulnerability in SAP CRM ABAP (Grantor Management) (CVSS 6.1, SAP\_SE SAP CRM ABAP)
- [CVE-2023-33985](https://cve.now/CVE-2023-33985.md): Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal (CVSS 6.1, SAP\_SE SAP NetWeaver Enterprise Portal)
- [CVE-2023-33984](https://cve.now/CVE-2023-33984.md): Cross-Site Scripting (XSS) vulnerability in NetWeaver (Design Time Repository) (CVSS 6.4, SAP\_SE SAP NetWeaver)
- [CVE-2023-32115](https://cve.now/CVE-2023-32115.md): SQL Injection in Master Data Synchronization (MDS COMPARE TOOL) (CVSS 4.2, SAP\_SE Master Data Synchronization)
- [CVE-2023-32114](https://cve.now/CVE-2023-32114.md): Denial of Service in SAP NetWeaver (CVSS 2.7, SAP\_SE SAP NetWeaver)
- [CVE-2023-2827](https://cve.now/CVE-2023-2827.md): Missing Authentication in SAP Plant Connectivity and Production Connector for SAP Digital (CVSS 7.9, SAP\_SE SAP Plant Connectivity)
- [CVE-2023-2563](https://cve.now/CVE-2023-2563.md): WordPress Contact Forms by Cimatti \<= 1.5.7 - Cross-Site Request Forgery via \_accua\_forms\_form\_edit\_action (CVSS 4.3, Contact Forms by Cimatti)
- [CVE-2023-2278](https://cve.now/CVE-2023-2278.md): WP Directory Kit \<= 1.1.9 - Unauthenticated Local File Inclusion via wdk\_public\_action (CVSS 9.8, wpdirectorykit WP Directory Kit)
- [CVE-2023-2277](https://cve.now/CVE-2023-2277.md): WP Directory Kit \<= 1.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting via wdk\_resultitem (CVSS 6.1, wpdirectorykit WP Directory Kit)
- [CVE-2023-2351](https://cve.now/CVE-2023-2351.md): WP Directory Kit \<= 1.2.3 - Missing Authorization to Plugin Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk\_admin\_action (CVSS 6.5, wpdirectorykit WP Directory Kit)
- [CVE-2022-28550](https://cve.now/CVE-2022-28550.md): Matthias-Wandel/jhead jhead 3.06 is vulnerable to Buffer Overflow via shellescape(), jhead.c, jhead. (CVSS 9.8)
- [CVE-2022-47376](https://cve.now/CVE-2022-47376.md): The Alaris Infusion Central software, versions 1.1 to 1.3.2, may contain a recoverable password after the installation. (CVSS 7.3, Alaris Infusion Central)
- [CVE-2023-24469](https://cve.now/CVE-2023-24469.md): Potential Cross-Site Scripting in ArcSight Logger versions prior to 7.3.0 (CVSS 6.1, ArcSight Logger)
- [CVE-2023-24470](https://cve.now/CVE-2023-24470.md): Potential XML External Entity Injection in ArcSight Logger versions prior to 7.3.0. (CVSS 9.1, ArcSight Logger)
- [CVE-2023-24546](https://cve.now/CVE-2023-24546.md): On affected versions of the CloudVision Portal improper access controls on the connection from devices to CloudVision could enable a malicio (CVSS 8.1, CloudVision)
- [CVE-2023-27836](https://cve.now/CVE-2023-27836.md): TP-Link TL-WPA8630P (US)\_ V2\_ Version 171011 was discovered to contain a command injection vulnerability via the devicePwd parameter in the (CVSS 9.8)
- [CVE-2023-27837](https://cve.now/CVE-2023-27837.md): TP-Link TL-WPA8630P (US)\_ V2\_ Version 171011 was discovered to contain a command injection vulnerability via the key parameter in the functi (CVSS 9.8)
- [CVE-2023-29160](https://cve.now/CVE-2023-29160.md): Stack-based buffer overflow vulnerability exists in FRENIC RHC Loader v1.1.0.3. (CVSS 7.8, FUJI ELECTRIC CO. FRENIC RHC Loader)
- [CVE-2023-29167](https://cve.now/CVE-2023-29167.md): Out-of-bound reads vulnerability exists in FRENIC RHC Loader v1.1.0.3. (CVSS 7.8, FUJI ELECTRIC CO. FRENIC RHC Loader)
- [CVE-2023-29498](https://cve.now/CVE-2023-29498.md): Improper restriction of XML external entity reference (XXE) vulnerability exists in FRENIC RHC Loader v1.1.0.3 and earlier. (CVSS 5.5, FUJI ELECTRIC CO. FRENIC RHC Loader)
- [CVE-2023-29501](https://cve.now/CVE-2023-29501.md): Jiyu Kukan Toku-Toku coupon App for iOS versions 3.5.0 and earlier, and Jiyu Kukan Toku-Toku coupon App for Android versions 3.5.0 and earli (no CVSS, RUNSYSTEM CO. Jiyu Kukan Toku-Toku coupon App for iOS, and…)
- [CVE-2023-29562](https://cve.now/CVE-2023-29562.md): TP-Link TL-WPA7510 (EU)\_V2\_190125 was discovered to contain a stack overflow via the operation parameter at /admin/locale. (CVSS 9.8)
- [CVE-2023-30179](https://cve.now/CVE-2023-30179.md): CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI). (CVSS 7.2)
- [CVE-2023-30762](https://cve.now/CVE-2023-30762.md): Improper authentication vulnerability exists in KB-AHR series and KB-IRIP series. (CVSS 9.8, KbDevice KB-AHR series and KB-IRIP series)
- [CVE-2023-30764](https://cve.now/CVE-2023-30764.md): OS command injection vulnerability exists in KB-AHR series and KB-IRIP series. (CVSS 9.8, KbDevice KB-AHR series and KB-IRIP series)
- [CVE-2023-30766](https://cve.now/CVE-2023-30766.md): Hidden functionality issue exists in KB-AHR series and KB-IRIP series. (CVSS 9.8, KbDevice KB-AHR series and KB-IRIP series)
- [CVE-2023-31195](https://cve.now/CVE-2023-31195.md): ASUS Router RT-AX3000 Firmware versions prior to 3.0.0.4.388.23403 uses sensitive cookies without 'Secure' attribute. (CVSS 5.3, ASUSTeK COMPUTER ASUS Router RT-AX3000)
- [CVE-2023-31196](https://cve.now/CVE-2023-31196.md): Missing authentication for critical function in Wi-Fi AP UNIT allows a remote unauthenticated attacker to obtain sensitive information of th (CVSS 7.5, Inaba Denki Sangyo Co. Wi-Fi AP UNIT)
- [CVE-2023-31198](https://cve.now/CVE-2023-31198.md): OS command injection vulnerability exists in Wi-Fi AP UNIT allows. (CVSS 7.2, Inaba Denki Sangyo Co. Wi-Fi AP UNIT)
- [CVE-2023-31437](https://cve.now/CVE-2023-31437.md): An issue was discovered in systemd 253. (CVSS 5.3)
- [CVE-2023-31438](https://cve.now/CVE-2023-31438.md): An issue was discovered in systemd 253. (no CVSS)
- [CVE-2023-31439](https://cve.now/CVE-2023-31439.md): An issue was discovered in systemd 253. (no CVSS)
- [CVE-2023-31541](https://cve.now/CVE-2023-31541.md): A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature of the CKEditor v1.2.3 plugin for Redmine, (CVSS 9.8)
- [CVE-2023-3218](https://cve.now/CVE-2023-3218.md): Race Condition within a Thread in it-novum/openitcockpit (CVSS 6.5, it-novum/openitcockpit)
- [CVE-2023-3224](https://cve.now/CVE-2023-3224.md): Code Injection in nuxt/nuxt (CVSS 8.1, nuxt/nuxt · nuxt)
- [CVE-2023-32546](https://cve.now/CVE-2023-32546.md): Code injection vulnerability exists in Chatwork Desktop Application (Mac) 2.6.43 and earlier. (CVSS 4.4, Chatwork Co. Chatwork Desktop Application)
- [CVE-2023-32548](https://cve.now/CVE-2023-32548.md): OS command injection vulnerability exists in WPS Office version 10.8.0.6186. (CVSS 8.1, KINGSOFT JAPAN WPS Office)
- [CVE-2023-33568](https://cve.now/CVE-2023-33568.md): An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer fil (no CVSS, dolibarr/dolibarr)
- [CVE-2023-33620](https://cve.now/CVE-2023-33620.md): GL.iNET GL-AR750S-Ext firmware v3.215 uses an insecure protocol in its communications which allows attackers to eavesdrop via a man-in-the-m (no CVSS)
- [CVE-2023-33621](https://cve.now/CVE-2023-33621.md): GL.iNET GL-AR750S-Ext firmware v3.215 inserts the admin authentication token into a GET request when the OpenVPN Server config file is downl (no CVSS)
- [CVE-2023-33695](https://cve.now/CVE-2023-33695.md): Hutool v5.8.17 and below was discovered to contain an information disclosure vulnerability via the File.createTempFile() function at /core/i (no CVSS, cn.hutool:hutool-core)
- [CVE-2023-33817](https://cve.now/CVE-2023-33817.md): hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability. (no CVSS)
- [CVE-2023-34537](https://cve.now/CVE-2023-34537.md): A Reflected XSS was discovered in HotelDruid version 3.0.5, an attacker can issue malicious code/command on affected webpage's parameter to (no CVSS)
- [CVE-2023-34944](https://cve.now/CVE-2023-34944.md): An arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo 1.11.\* up to v1.11.18 allows attackers to execute arb (no CVSS)
- [CVE-2023-34965](https://cve.now/CVE-2023-34965.md): SSPanel-Uim 2023.3 does not restrict access to the /link/ interface which can lead to a leak of user information. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-06-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.