CVEs published June 14, 2023
118 CVEs were published on June 14, 2023: 15 critical, 52 high.
- Published
- 118
- Critical
- 15
- High
- 52
- Medium
- 37
- Low
- 7
- Unrated
- 7
- Now in CISA KEV
- 0
- Fix available
- 35
Most affected products
- HP PC BIOS
- 6
- OTCMS
- 5
- fossbilling/fossbilling
- 4
- getgrav grav · getgrav/grav
- 4
- inspireui MStore API – Create Native Android & iOS Apps On…
- 4
- Apache Software Foundation Apache Traffic Server
- 3
- Zhong Bang CRMEB
- 3
- Jenkins Project Jenkins Digital.ai App Management Publisher…
- 2
- Jenkins Project Jenkins Maven Repository Server Plugin · je…
- 2
- mccms
- 2
Critical 15
- CVE-2023-34251Grav Server Side Template Injection vulnerabilitygetgrav grav · getgrav/grav
- CVE-2023-34095cpdb-libs vulnerable to buffer overflows via scanfOpenPrinting cpdb-libs
- CVE-2023-25367Siglent SDS 1104X-E SDS1xx4X-E_V6.1.37R9.ADS allows unfiltered user input resulting in Remote Code Execution (RCE) with SCPI interface or we
- CVE-2023-30150PrestaShop leocustomajax 1.0 and 1.0.0 are vulnerable to SQL Injection via modules/leocustomajax/leoajax.php.
- CVE-2023-31671PrestaShop postfinance <= 17.1.13 is vulnerable to SQL Injection via PostfinanceValidationModuleFrontController::postProcess().
- CVE-2023-31746There is a command injection vulnerability in the adslr VW2100 router with firmware version M1DV1.0.
- CVE-2023-34747File upload vulnerability in ujcms 6.0.2 via /api/backend/core/web-file-upload/upload.
- CVE-2023-34750bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the cid parameter at admin/index.php?mode=settings&page=project
- CVE-2023-34751bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the gid parameter at admin/index.php?mode=user&page=groups&acti
- CVE-2023-34752bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the lid parameter at admin/index.php?mode=settings&page=lang&ac
- CVE-2023-34753bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the tid parameter at admin/index.php?mode=settings&page=tmpl&ac
- CVE-2023-34754bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the pid parameter at admin/index.php?mode=settings&page=plugins
- CVE-2023-34755bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the userid parameter at admin/index.php?mode=user&action=edit.
- CVE-2023-34756bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the cid parameter at admin/index.php?mode=settings&page=charset
- CVE-2023-34865Directory traversal vulnerability in ujcms 6.0.2 allows attackers to move files via the rename feature.
High 52
- CVE-2023-34448Grav Server-side Template Injection (SSTI) via Twig Default Filtersgetgrav grav · getgrav/grav
- CVE-2023-34253Grav vulnerable to Server-side Template Injection (SSTI) via Denylist Bypassgetgrav grav · getgrav/grav
- CVE-2023-34252Grav Server-side Template Injection via Insufficient Validation in filterFiltergetgrav grav · getgrav/grav
- CVE-2022-31646Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escHP PC BIOS
- CVE-2022-31645Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escHP PC BIOS
- CVE-2022-31644Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escHP PC BIOS
- CVE-2022-31642Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escHP PC BIOS
- CVE-2023-0009GlobalProtect App: Local Privilege Escalation (PE) VulnerabilityPalo Alto Networks GlobalProtect App
- CVE-2022-31641Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escHP PC BIOS
- CVE-2022-31640Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escHP PC BIOS
- CVE-2023-32030.NET and Visual Studio Denial of Service VulnerabilityMicrosoft .NET Framework
- CVE-2023-29337NuGet Client Remote Code Execution VulnerabilityMicrosoft NuGet · Microsoft.Build.NuGetSdkResolver +5
- CVE-2023-29331.NET, .NET Framework, and Visual Studio Denial of Service VulnerabilityMicrosoft .NET · Microsoft Visual Studio +15
- CVE-2023-24936.NET, .NET Framework, and Visual Studio Elevation of Privilege VulnerabilityMicrosoft Visual Studio · Microsoft .NET +13
- CVE-2023-24895.NET, .NET Framework, and Visual Studio Remote Code Execution VulnerabilityMicrosoft .NET · Microsoft Visual Studio +4
- CVE-2023-32031Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2019 Cumulative Update · Microsof…
- CVE-2023-29326.NET Framework Remote Code Execution VulnerabilityMicrosoft .NET Framework 3.5 AND · Microsoft .NET Framew… +2
- CVE-2023-24897.NET, .NET Framework, and Visual Studio Remote Code Execution VulnerabilityMicrosoft Visual Studio · Microsoft .NET +5
- CVE-2023-28310Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2016 Cumulative Update · Microsof…
- CVE-2023-34101Contiki-NG vulnerable to out-of-bounds read when processing ICMP DAO inputcontiki-ng
- CVE-2023-32465 Dell Power Protect Cyber Recovery, contains an Authentication Bypass vulnerability.Dell PowerProtect Cyber Recovery
- CVE-2023-35142Jenkins Checkmarx Plugin 2022.4.3 and earlier disables SSL/TLS validation for connections to the Checkmarx server by default.Jenkins Project Jenkins Checkmarx Plugin · com.checkmarx.je…
- CVE-2023-35141In Jenkins 2.399 and earlier, LTS 2.387.3 and earlier, POST requests are sent in order to load the list of context actions.Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2023-3036Out of Bounds Slice index in cfnts leads to remote panicCloudflare cfnts
- CVE-2023-2570 A CWE-129: Improper Validation of Array Index vulnerability exists that could cause local denial-of-service, and potentially kernel execuSchneider Electric EcoStruxure Foxboro DCS Control Core Ser…
- CVE-2023-2569 A CWE-787: Out-of-Bounds Write vulnerability exists that could cause local denial-of-service, elevation of privilege, and potentially kerneSchneider Electric EcoStruxure Foxboro DCS Control Core Ser…
- CVE-2023-33933Apache Traffic Server: s3_auth plugin problem with hash calculationApache Software Foundation Apache Traffic Server
- CVE-2022-47184Apache Traffic Server: The TRACE method can be use to disclose network informationApache Software Foundation Apache Traffic Server
- CVE-2023-3001 A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious pSchneider Electric IGSS Dashboard
- CVE-2023-34000WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.4.0 is vulnerable to Insecure Direct Object References (IDOR)WooCommerce Stripe Payment Gateway
- CVE-2023-1049 A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause execution of malicious code when Schneider Electric EcoStruxure™ Operator Terminal Expert ·…
- CVE-2023-25368Siglent SDS 1104X-E SDS1xx4X-E_V6.1.37R9.ADS is vulnerable to Incorrect Access Control.
- CVE-2023-25369Siglent SDS 1104X-E SDS1xx4X-E_V6.1.37R9.ADS is vulnerable to Denial of Service on the user interface triggered by malformed SCPI command.
- CVE-2023-25434libtiff 4.5.0 is vulnerable to Buffer Overflow via extractContigSamplesBytes() at /libtiff/tools/tiffcrop.c:3215.
- CVE-2023-26062A mobile network solution internal fault is found in Nokia Web Element Manager before 22 R1, in which an authenticated, unprivileged user ca
- CVE-2023-30082A denial of service attack might be launched against the server if an unusually lengthy password (more than 10000000 characters) is supplied
- CVE-2023-34609An issue was discovered flexjson thru 3.3 allows attackers to cause a denial of service or other unspecified impacts via crafted object that
- CVE-2023-34610An issue was discovered json-io thru 4.14.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object thcom.cedarsoftware:json-io
- CVE-2023-34611An issue was discovered mjson thru 1.4.1 allows attackers to cause a denial of service or other unspecified impacts via crafted object that
- CVE-2023-34612An issue was discovered ph-json thru 9.5.5 allows attackers to cause a denial of service or other unspecified impacts via crafted object thacom.helger.commons:ph-json
- CVE-2023-34613An issue was discovered sojo thru 1.1.1 allows attackers to cause a denial of service or other unspecified impacts via crafted object that unet.sf.sojo:sojo
- CVE-2023-34614An issue was discovered jmarsden/jsonij thru 0.5.2 allows attackers to cause a denial of service or other unspecified impacts via crafted obcc.plural:jsonij
- CVE-2023-34615An issue was discovered JSONUtil thru 5.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object thatnet.pwall.json:jsonutil
- CVE-2023-34616An issue was discovered pbjson thru 0.4.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object thatcom.progsbase.libraries:JSON
- CVE-2023-34617An issue was discovered genson thru 1.6 allows attackers to cause a denial of service or other unspecified impacts via crafted object that ucom.owlike:genson
- CVE-2023-34620An issue was discovered hjson thru 3.0.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object that org.hjson:hjson · laktak/hjson +2
- CVE-2023-34623An issue was discovered jtidy thru r938 allows attackers to cause a denial of service or other unspecified impacts via crafted object that u
- CVE-2023-34624An issue was discovered htmlcleaner thru = 2.28 allows attackers to cause a denial of service or other unspecified impacts via crafted objecnet.sourceforge.htmlcleaner:htmlcleaner
- CVE-2023-34867Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the ecma_property_hashmap_create at jerry-core/ecma/base
- CVE-2023-34868Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the parser_parse_for_statement_start at jerry-core/parse
- CVE-2023-34878An issue was discovered in Ujcms v6.0.2 allows attackers to gain sensitive information via the dir parameter to /api/backend/core/web-file-h
- CVE-2023-35110An issue was discovered jjson thru 0.1.7 allows attackers to cause a denial of service or other unspecified impacts via crafted object that de.grobmeier.json:jjson
Medium, low and unrated 51
- CVE-2023-34452Grav vulnerable to Self Cross Site Scripting in /forgot_passwordgetgrav grav
- CVE-2023-2820An information disclosure vulnerability in the faye endpoint in Proofpoint Threat Response / Threat Response Auto-Pull (PTR/TRAP) could be uProofpoint Threat Response Auto Pull
- CVE-2023-2819A stored cross-site scripting vulnerability in the Sources UI in Proofpoint Threat Response/ Threat Response Auto Pull (PTR/TRAP) could alloProofpoint Threat Response Auto Pull
- CVE-2023-1329A potential security vulnerability has been identified for certain HP multifunction printers (MFPs).HP multifunction printers
- CVE-2023-34449ink! vulnerable to incorrect decoding of storage value when using `DelegateCall`paritytech ink · ink +1
- CVE-2023-2976Use of temporary directory for file creation in `FileBackedOutputStream` in GuavaGoogle Guava · com.google.guava:guava
- CVE-2023-0010PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in Captive Portal AuthenticationPalo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1
- CVE-2023-32024Microsoft Power Apps Spoofing VulnerabilityMicrosoft Power Apps
- CVE-2023-35149A missing permission check in Jenkins Digital.ai App Management Publisher Plugin 2.6 and earlier allows attackers with Overall/Read permissiJenkins Project Jenkins Digital.ai App Management Publisher…
- CVE-2023-35148A cross-site request forgery (CSRF) vulnerability in Jenkins Digital.ai App Management Publisher Plugin 2.6 and earlier allows attackers to Jenkins Project Jenkins Digital.ai App Management Publisher…
- CVE-2023-35147Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not restrict the AWS SQS queue name path parameter in an HTTP endpoint, allowiJenkins Project Jenkins AWS CodeCommit Trigger Plugin · org…
- CVE-2023-35146Jenkins Template Workflows Plugin 41.v32d86a_313b_4a and earlier does not escape names of jobs used as buildings blocks for Template WorkfloJenkins Project Jenkins Template Workflows Plugin · org.jen…
- CVE-2023-35145Jenkins Sonargraph Integration Plugin 5.0.1 and earlier does not escape the file path and the project name for the Log file field form validJenkins Project Jenkins Sonargraph Integration Plugin · org…
- CVE-2023-35144Jenkins Maven Repository Server Plugin 1.10 and earlier does not escape project and build display names on the Build Artifacts As Maven RepoJenkins Project Jenkins Maven Repository Server Plugin · je…
- CVE-2023-35143Jenkins Maven Repository Server Plugin 1.10 and earlier does not escape the versions of build artifacts on the Build Artifacts As Maven RepoJenkins Project Jenkins Maven Repository Server Plugin · je…
- CVE-2023-3040Out of Bounds Access Leading to Undefined BehaviorCloudflare lua-resty-json
- CVE-2023-3241OTCMS path traversalOTCMS
- CVE-2023-3240OTCMS usersNews_deal.php path traversalOTCMS
- CVE-2023-3239OTCMS path traversalOTCMS
- CVE-2023-3238OTCMS server-side request forgeryOTCMS
- CVE-2023-34396Apache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart formsApache Software Foundation Apache Struts · org.apache.st… +2
- CVE-2023-34149Apache Struts: DoS via OOM owing to not properly checking of list boundsApache Software Foundation Apache Struts · org.apache.strut…
- CVE-2023-30631Apache Traffic Server: Configuration option to block the PUSH method in ATS didn't workApache Software Foundation Apache Traffic Server
- CVE-2023-3237OTCMS hard-coded passwordOTCMS
- CVE-2023-0837An improper authorization check of local device settings in TeamViewer Remote between version 15.41 and 15.42.7 for Windows and macOS allowTeamViewer Remote
- CVE-2023-3236mccms Comic.php pic_save server-side request forgerymccms
- CVE-2023-3235mccms Comic.php pic_api server-side request forgerymccms
- CVE-2023-3234Zhong Bang CRMEB PublicController.php put_image deserializationZhong Bang CRMEB
- CVE-2023-3233Zhong Bang CRMEB PublicController.php get_image_base64 server-side request forgeryZhong Bang CRMEB
- CVE-2023-3232Zhong Bang CRMEB Image Upload app_auth deserializationZhong Bang CRMEB
- CVE-2023-3231UJCMS ZIP Package information disclosureUJCMS
- CVE-2023-3189SourceCodester Online School Fees System POST Parameter branch.php cross site scriptingSourceCodester Online School Fees System
- CVE-2023-24937Windows CryptoAPI Denial of Service VulnerabilityMicrosoft Windows
- CVE-2023-3201MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Title Updateinspireui MStore API – Create Native Android & iOS Apps On…
- CVE-2023-3198MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Status Updateinspireui MStore API – Create Native Android & iOS Apps On…
- CVE-2023-3200MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Message Updateinspireui MStore API – Create Native Android & iOS Apps On…
- CVE-2023-3203MStore API <= 3.9.6 - Cross-Site Request Forgery to Product Limit Updateinspireui MStore API – Create Native Android & iOS Apps On…
- CVE-2020-22402Cross Site Scripting (XSS) vulnerability in SOGo Web Mail before 4.3.1 allows attackers to obtain user sensitive information when a user rea
- CVE-2021-31280An issue was discovered in tp5cms through 2017-05-25.
- CVE-2023-26965loadImage() in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based use after free via a crafted TIFF image.
- CVE-2023-3227Insufficient Granularity of Access Control in fossbilling/fossbillingfossbilling/fossbilling
- CVE-2023-3228Business Logic Errors in fossbilling/fossbillingfossbilling/fossbilling
- CVE-2023-3229Business Logic Errors in fossbilling/fossbillingfossbilling/fossbilling
- CVE-2023-3230Missing Authorization in fossbilling/fossbillingfossbilling/fossbilling
- CVE-2023-33515SoftExpert Excellence Suite 2.1.9 is vulnerable to Cross Site Scripting (XSS) via query screens.
- CVE-2023-34367Windows 7 is vulnerable to a full blind TCP/IP hijacking attack.
- CVE-2023-34540Langchain before v0.0.225 was discovered to contain a remote code execution (RCE) vulnerability in the component JiraAPIWrapper (aka the JIRlangchain
- CVE-2023-34565Netbox 3.5.1 is vulnerable to Cross Site Scripting (XSS) in the "Create Wireless LAN Groups" function.
- CVE-2023-34823fdkaac before 1.0.5 was discovered to contain a stack overflow in read_callback function in src/main.c.
- CVE-2023-34824fdkaac before 1.0.5 was discovered to contain a heap buffer overflow in caf_info function in caf_reader.c.
- CVE-2023-35116jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyc