# CVEs published 2023-06-14

118 CVEs were published on June 14, 2023: 15 critical, 52 high. Days are UTC.

- [CVE-2023-34452](https://cve.now/CVE-2023-34452.md): Grav vulnerable to Self Cross Site Scripting in /forgot\_password (CVSS 5.4, getgrav grav)
- [CVE-2023-34448](https://cve.now/CVE-2023-34448.md): Grav Server-side Template Injection (SSTI) via Twig Default Filters (CVSS 8.8, getgrav grav · getgrav/grav)
- [CVE-2023-34253](https://cve.now/CVE-2023-34253.md): Grav vulnerable to Server-side Template Injection (SSTI) via Denylist Bypass (CVSS 8.8, getgrav grav · getgrav/grav)
- [CVE-2023-34252](https://cve.now/CVE-2023-34252.md): Grav Server-side Template Injection via Insufficient Validation in filterFilter (CVSS 8.8, getgrav grav · getgrav/grav)
- [CVE-2023-34251](https://cve.now/CVE-2023-34251.md): Grav Server Side Template Injection vulnerability (CVSS 10.0, getgrav grav · getgrav/grav)
- [CVE-2023-2820](https://cve.now/CVE-2023-2820.md): An information disclosure vulnerability in the faye endpoint in Proofpoint Threat Response / Threat Response Auto-Pull (PTR/TRAP) could be u (CVSS 6.1, Proofpoint Threat Response Auto Pull)
- [CVE-2023-2819](https://cve.now/CVE-2023-2819.md): A stored cross-site scripting vulnerability in the Sources UI in Proofpoint Threat Response/ Threat Response Auto Pull (PTR/TRAP) could allo (CVSS 4.3, Proofpoint Threat Response Auto Pull)
- [CVE-2023-1329](https://cve.now/CVE-2023-1329.md): A potential security vulnerability has been identified for certain HP multifunction printers (MFPs). (no CVSS, HP multifunction printers)
- [CVE-2023-34449](https://cve.now/CVE-2023-34449.md): ink! vulnerable to incorrect decoding of storage value when using \`DelegateCall\` (CVSS 5.3, paritytech ink · ink +1)
- [CVE-2023-2976](https://cve.now/CVE-2023-2976.md): Use of temporary directory for file creation in \`FileBackedOutputStream\` in Guava (CVSS 5.5, Google Guava · com.google.guava:guava)
- [CVE-2022-31646](https://cve.now/CVE-2022-31646.md): Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, esc (CVSS 7.8, HP PC BIOS)
- [CVE-2022-31645](https://cve.now/CVE-2022-31645.md): Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, esc (CVSS 7.8, HP PC BIOS)
- [CVE-2022-31644](https://cve.now/CVE-2022-31644.md): Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, esc (CVSS 7.8, HP PC BIOS)
- [CVE-2023-34095](https://cve.now/CVE-2023-34095.md): cpdb-libs vulnerable to buffer overflows via scanf (CVSS 9.8, OpenPrinting cpdb-libs)
- [CVE-2022-31642](https://cve.now/CVE-2022-31642.md): Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, esc (CVSS 7.0, HP PC BIOS)
- [CVE-2023-0009](https://cve.now/CVE-2023-0009.md): GlobalProtect App: Local Privilege Escalation (PE) Vulnerability (CVSS 7.8, Palo Alto Networks GlobalProtect App)
- [CVE-2022-31641](https://cve.now/CVE-2022-31641.md): Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, esc (CVSS 7.0, HP PC BIOS)
- [CVE-2023-0010](https://cve.now/CVE-2023-0010.md): PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in Captive Portal Authentication (CVSS 5.4, Palo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1)
- [CVE-2022-31640](https://cve.now/CVE-2022-31640.md): Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, esc (CVSS 7.0, HP PC BIOS)
- [CVE-2023-32030](https://cve.now/CVE-2023-32030.md): .NET and Visual Studio Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET Framework)
- [CVE-2023-29337](https://cve.now/CVE-2023-29337.md): NuGet Client Remote Code Execution Vulnerability (CVSS 7.1, Microsoft NuGet · Microsoft.Build.NuGetSdkResolver +5)
- [CVE-2023-29331](https://cve.now/CVE-2023-29331.md): .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET · Microsoft Visual Studio +15)
- [CVE-2023-24936](https://cve.now/CVE-2023-24936.md): .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft Visual Studio · Microsoft .NET +13)
- [CVE-2023-24895](https://cve.now/CVE-2023-24895.md): .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft .NET · Microsoft Visual Studio +4)
- [CVE-2023-32031](https://cve.now/CVE-2023-32031.md): Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Exchange Server 2019 Cumulative Update · Microsof…)
- [CVE-2023-32024](https://cve.now/CVE-2023-32024.md): Microsoft Power Apps Spoofing Vulnerability (CVSS 3.0, Microsoft Power Apps)
- [CVE-2023-29326](https://cve.now/CVE-2023-29326.md): .NET Framework Remote Code Execution Vulnerability (CVSS 7.8, Microsoft .NET Framework 3.5 AND · Microsoft .NET Framew… +2)
- [CVE-2023-24897](https://cve.now/CVE-2023-24897.md): .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio · Microsoft .NET +5)
- [CVE-2023-28310](https://cve.now/CVE-2023-28310.md): Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 8.0, Microsoft Exchange Server 2016 Cumulative Update · Microsof…)
- [CVE-2023-34101](https://cve.now/CVE-2023-34101.md): Contiki-NG vulnerable to out-of-bounds read when processing ICMP DAO input (CVSS 7.3, contiki-ng)
- [CVE-2023-32465](https://cve.now/CVE-2023-32465.md): Dell Power Protect Cyber Recovery, contains an Authentication Bypass vulnerability. (CVSS 8.8, Dell PowerProtect Cyber Recovery)
- [CVE-2023-35149](https://cve.now/CVE-2023-35149.md): A missing permission check in Jenkins Digital.ai App Management Publisher Plugin 2.6 and earlier allows attackers with Overall/Read permissi (CVSS 6.5, Jenkins Project Jenkins Digital.ai App Management Publisher…)
- [CVE-2023-35148](https://cve.now/CVE-2023-35148.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Digital.ai App Management Publisher Plugin 2.6 and earlier allows attackers to (no CVSS, Jenkins Project Jenkins Digital.ai App Management Publisher…)
- [CVE-2023-35147](https://cve.now/CVE-2023-35147.md): Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not restrict the AWS SQS queue name path parameter in an HTTP endpoint, allowi (CVSS 6.5, Jenkins Project Jenkins AWS CodeCommit Trigger Plugin · org…)
- [CVE-2023-35146](https://cve.now/CVE-2023-35146.md): Jenkins Template Workflows Plugin 41.v32d86a\_313b\_4a and earlier does not escape names of jobs used as buildings blocks for Template Workflo (no CVSS, Jenkins Project Jenkins Template Workflows Plugin · org.jen…)
- [CVE-2023-35145](https://cve.now/CVE-2023-35145.md): Jenkins Sonargraph Integration Plugin 5.0.1 and earlier does not escape the file path and the project name for the Log file field form valid (CVSS 5.4, Jenkins Project Jenkins Sonargraph Integration Plugin · org…)
- [CVE-2023-35144](https://cve.now/CVE-2023-35144.md): Jenkins Maven Repository Server Plugin 1.10 and earlier does not escape project and build display names on the Build Artifacts As Maven Repo (CVSS 5.4, Jenkins Project Jenkins Maven Repository Server Plugin · je…)
- [CVE-2023-35143](https://cve.now/CVE-2023-35143.md): Jenkins Maven Repository Server Plugin 1.10 and earlier does not escape the versions of build artifacts on the Build Artifacts As Maven Repo (CVSS 5.4, Jenkins Project Jenkins Maven Repository Server Plugin · je…)
- [CVE-2023-35142](https://cve.now/CVE-2023-35142.md): Jenkins Checkmarx Plugin 2022.4.3 and earlier disables SSL/TLS validation for connections to the Checkmarx server by default. (CVSS 8.1, Jenkins Project Jenkins Checkmarx Plugin · com.checkmarx.je…)
- [CVE-2023-35141](https://cve.now/CVE-2023-35141.md): In Jenkins 2.399 and earlier, LTS 2.387.3 and earlier, POST requests are sent in order to load the list of context actions. (CVSS 8.0, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2023-3040](https://cve.now/CVE-2023-3040.md): Out of Bounds Access Leading to Undefined Behavior (CVSS 3.7, Cloudflare lua-resty-json)
- [CVE-2023-3036](https://cve.now/CVE-2023-3036.md): Out of Bounds Slice index in cfnts leads to remote panic (CVSS 8.6, Cloudflare cfnts)
- [CVE-2023-3241](https://cve.now/CVE-2023-3241.md): OTCMS path traversal (CVSS 3.5, OTCMS)
- [CVE-2023-3240](https://cve.now/CVE-2023-3240.md): OTCMS usersNews\_deal.php path traversal (CVSS 3.5, OTCMS)
- [CVE-2023-3239](https://cve.now/CVE-2023-3239.md): OTCMS path traversal (CVSS 3.5, OTCMS)
- [CVE-2023-3238](https://cve.now/CVE-2023-3238.md): OTCMS server-side request forgery (CVSS 6.3, OTCMS)
- [CVE-2023-2570](https://cve.now/CVE-2023-2570.md): A CWE-129: Improper Validation of Array Index vulnerability exists that could cause local denial-of-service, and potentially kernel execu (CVSS 7.0, Schneider Electric EcoStruxure Foxboro DCS Control Core Ser…)
- [CVE-2023-34396](https://cve.now/CVE-2023-34396.md): Apache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart forms (CVSS 4.3, Apache Software Foundation Apache Struts · org.apache.st… +2)
- [CVE-2023-2569](https://cve.now/CVE-2023-2569.md): A CWE-787: Out-of-Bounds Write vulnerability exists that could cause local denial-of-service, elevation of privilege, and potentially kerne (CVSS 7.8, Schneider Electric EcoStruxure Foxboro DCS Control Core Ser…)
- [CVE-2023-34149](https://cve.now/CVE-2023-34149.md): Apache Struts: DoS via OOM owing to not properly checking of list bounds (CVSS 4.3, Apache Software Foundation Apache Struts · org.apache.strut…)
- [CVE-2023-30631](https://cve.now/CVE-2023-30631.md): Apache Traffic Server: Configuration option to block the PUSH method in ATS didn't work (no CVSS, Apache Software Foundation Apache Traffic Server)
- [CVE-2023-33933](https://cve.now/CVE-2023-33933.md): Apache Traffic Server: s3\_auth plugin problem with hash calculation (CVSS 7.5, Apache Software Foundation Apache Traffic Server)
- [CVE-2022-47184](https://cve.now/CVE-2022-47184.md): Apache Traffic Server: The TRACE method can be use to disclose network information (CVSS 7.5, Apache Software Foundation Apache Traffic Server)
- [CVE-2023-3001](https://cve.now/CVE-2023-3001.md): A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious p (CVSS 7.8, Schneider Electric IGSS Dashboard)
- [CVE-2023-3237](https://cve.now/CVE-2023-3237.md): OTCMS hard-coded password (CVSS 6.3, OTCMS)
- [CVE-2023-34000](https://cve.now/CVE-2023-34000.md): WordPress WooCommerce Stripe Payment Gateway Plugin \<= 7.4.0 is vulnerable to Insecure Direct Object References (IDOR) (CVSS 7.5, WooCommerce Stripe Payment Gateway)
- [CVE-2023-1049](https://cve.now/CVE-2023-1049.md): A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause execution of malicious code when (CVSS 7.8, Schneider Electric EcoStruxure™ Operator Terminal Expert ·…)
- [CVE-2023-0837](https://cve.now/CVE-2023-0837.md): An improper authorization check of local device settings in TeamViewer Remote between version 15.41 and 15.42.7 for Windows and macOS allow (CVSS 6.6, TeamViewer Remote)
- [CVE-2023-3236](https://cve.now/CVE-2023-3236.md): mccms Comic.php pic\_save server-side request forgery (CVSS 6.3, mccms)
- [CVE-2023-3235](https://cve.now/CVE-2023-3235.md): mccms Comic.php pic\_api server-side request forgery (CVSS 6.3, mccms)
- [CVE-2023-3234](https://cve.now/CVE-2023-3234.md): Zhong Bang CRMEB PublicController.php put\_image deserialization (CVSS 4.3, Zhong Bang CRMEB)
- [CVE-2023-3233](https://cve.now/CVE-2023-3233.md): Zhong Bang CRMEB PublicController.php get\_image\_base64 server-side request forgery (CVSS 6.3, Zhong Bang CRMEB)
- [CVE-2023-3232](https://cve.now/CVE-2023-3232.md): Zhong Bang CRMEB Image Upload app\_auth deserialization (CVSS 6.3, Zhong Bang CRMEB)
- [CVE-2023-3231](https://cve.now/CVE-2023-3231.md): UJCMS ZIP Package information disclosure (CVSS 3.1, UJCMS)
- [CVE-2023-3189](https://cve.now/CVE-2023-3189.md): SourceCodester Online School Fees System POST Parameter branch.php cross site scripting (CVSS 3.5, SourceCodester Online School Fees System)
- [CVE-2023-24937](https://cve.now/CVE-2023-24937.md): Windows CryptoAPI Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2023-3201](https://cve.now/CVE-2023-3201.md): MStore API \<= 3.9.6 - Cross-Site Request Forgery to Order Title Update (CVSS 4.3, inspireui MStore API – Create Native Android & iOS Apps On…)
- [CVE-2023-3198](https://cve.now/CVE-2023-3198.md): MStore API \<= 3.9.6 - Cross-Site Request Forgery to Order Status Update (CVSS 4.3, inspireui MStore API – Create Native Android & iOS Apps On…)
- [CVE-2023-3200](https://cve.now/CVE-2023-3200.md): MStore API \<= 3.9.6 - Cross-Site Request Forgery to Order Message Update (CVSS 4.3, inspireui MStore API – Create Native Android & iOS Apps On…)
- [CVE-2023-3203](https://cve.now/CVE-2023-3203.md): MStore API \<= 3.9.6 - Cross-Site Request Forgery to Product Limit Update (CVSS 4.3, inspireui MStore API – Create Native Android & iOS Apps On…)
- [CVE-2020-22402](https://cve.now/CVE-2020-22402.md): Cross Site Scripting (XSS) vulnerability in SOGo Web Mail before 4.3.1 allows attackers to obtain user sensitive information when a user rea (CVSS 6.1)
- [CVE-2021-31280](https://cve.now/CVE-2021-31280.md): An issue was discovered in tp5cms through 2017-05-25. (CVSS 6.1)
- [CVE-2023-25367](https://cve.now/CVE-2023-25367.md): Siglent SDS 1104X-E SDS1xx4X-E\_V6.1.37R9.ADS allows unfiltered user input resulting in Remote Code Execution (RCE) with SCPI interface or we (CVSS 9.8)
- [CVE-2023-25368](https://cve.now/CVE-2023-25368.md): Siglent SDS 1104X-E SDS1xx4X-E\_V6.1.37R9.ADS is vulnerable to Incorrect Access Control. (CVSS 7.5)
- [CVE-2023-25369](https://cve.now/CVE-2023-25369.md): Siglent SDS 1104X-E SDS1xx4X-E\_V6.1.37R9.ADS is vulnerable to Denial of Service on the user interface triggered by malformed SCPI command. (CVSS 7.5)
- [CVE-2023-25434](https://cve.now/CVE-2023-25434.md): libtiff 4.5.0 is vulnerable to Buffer Overflow via extractContigSamplesBytes() at /libtiff/tools/tiffcrop.c:3215. (CVSS 8.8)
- [CVE-2023-26062](https://cve.now/CVE-2023-26062.md): A mobile network solution internal fault is found in Nokia Web Element Manager before 22 R1, in which an authenticated, unprivileged user ca (CVSS 7.0)
- [CVE-2023-26965](https://cve.now/CVE-2023-26965.md): loadImage() in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based use after free via a crafted TIFF image. (CVSS 5.5)
- [CVE-2023-30082](https://cve.now/CVE-2023-30082.md): A denial of service attack might be launched against the server if an unusually lengthy password (more than 10000000 characters) is supplied (CVSS 7.5)
- [CVE-2023-30150](https://cve.now/CVE-2023-30150.md): PrestaShop leocustomajax 1.0 and 1.0.0 are vulnerable to SQL Injection via modules/leocustomajax/leoajax.php. (CVSS 9.8)
- [CVE-2023-31671](https://cve.now/CVE-2023-31671.md): PrestaShop postfinance \<= 17.1.13 is vulnerable to SQL Injection via PostfinanceValidationModuleFrontController::postProcess(). (CVSS 9.8)
- [CVE-2023-31746](https://cve.now/CVE-2023-31746.md): There is a command injection vulnerability in the adslr VW2100 router with firmware version M1DV1.0. (CVSS 9.8)
- [CVE-2023-3227](https://cve.now/CVE-2023-3227.md): Insufficient Granularity of Access Control in fossbilling/fossbilling (CVSS 5.4, fossbilling/fossbilling)
- [CVE-2023-3228](https://cve.now/CVE-2023-3228.md): Business Logic Errors in fossbilling/fossbilling (CVSS 5.4, fossbilling/fossbilling)
- [CVE-2023-3229](https://cve.now/CVE-2023-3229.md): Business Logic Errors in fossbilling/fossbilling (CVSS 5.4, fossbilling/fossbilling)
- [CVE-2023-3230](https://cve.now/CVE-2023-3230.md): Missing Authorization in fossbilling/fossbilling (CVSS 4.6, fossbilling/fossbilling)
- [CVE-2023-33515](https://cve.now/CVE-2023-33515.md): SoftExpert Excellence Suite 2.1.9 is vulnerable to Cross Site Scripting (XSS) via query screens. (CVSS 5.4)
- [CVE-2023-34367](https://cve.now/CVE-2023-34367.md): Windows 7 is vulnerable to a full blind TCP/IP hijacking attack. (CVSS 6.5)
- [CVE-2023-34540](https://cve.now/CVE-2023-34540.md): Langchain before v0.0.225 was discovered to contain a remote code execution (RCE) vulnerability in the component JiraAPIWrapper (aka the JIR (no CVSS, langchain)
- [CVE-2023-34565](https://cve.now/CVE-2023-34565.md): Netbox 3.5.1 is vulnerable to Cross Site Scripting (XSS) in the "Create Wireless LAN Groups" function. (no CVSS)
- [CVE-2023-34609](https://cve.now/CVE-2023-34609.md): An issue was discovered flexjson thru 3.3 allows attackers to cause a denial of service or other unspecified impacts via crafted object that (CVSS 7.5)
- [CVE-2023-34610](https://cve.now/CVE-2023-34610.md): An issue was discovered json-io thru 4.14.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object th (CVSS 7.5, com.cedarsoftware:json-io)
- [CVE-2023-34611](https://cve.now/CVE-2023-34611.md): An issue was discovered mjson thru 1.4.1 allows attackers to cause a denial of service or other unspecified impacts via crafted object that (CVSS 7.5)
- [CVE-2023-34612](https://cve.now/CVE-2023-34612.md): An issue was discovered ph-json thru 9.5.5 allows attackers to cause a denial of service or other unspecified impacts via crafted object tha (CVSS 7.5, com.helger.commons:ph-json)
- [CVE-2023-34613](https://cve.now/CVE-2023-34613.md): An issue was discovered sojo thru 1.1.1 allows attackers to cause a denial of service or other unspecified impacts via crafted object that u (CVSS 7.5, net.sf.sojo:sojo)
- [CVE-2023-34614](https://cve.now/CVE-2023-34614.md): An issue was discovered jmarsden/jsonij thru 0.5.2 allows attackers to cause a denial of service or other unspecified impacts via crafted ob (CVSS 7.5, cc.plural:jsonij)
- [CVE-2023-34615](https://cve.now/CVE-2023-34615.md): An issue was discovered JSONUtil thru 5.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object that (CVSS 7.5, net.pwall.json:jsonutil)
- [CVE-2023-34616](https://cve.now/CVE-2023-34616.md): An issue was discovered pbjson thru 0.4.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object that (CVSS 7.5, com.progsbase.libraries:JSON)
- [CVE-2023-34617](https://cve.now/CVE-2023-34617.md): An issue was discovered genson thru 1.6 allows attackers to cause a denial of service or other unspecified impacts via crafted object that u (CVSS 7.5, com.owlike:genson)
- [CVE-2023-34620](https://cve.now/CVE-2023-34620.md): An issue was discovered hjson thru 3.0.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object that (CVSS 7.5, org.hjson:hjson · laktak/hjson +2)
- [CVE-2023-34623](https://cve.now/CVE-2023-34623.md): An issue was discovered jtidy thru r938 allows attackers to cause a denial of service or other unspecified impacts via crafted object that u (CVSS 7.5)
- [CVE-2023-34624](https://cve.now/CVE-2023-34624.md): An issue was discovered htmlcleaner thru = 2.28 allows attackers to cause a denial of service or other unspecified impacts via crafted objec (CVSS 7.5, net.sourceforge.htmlcleaner:htmlcleaner)
- [CVE-2023-34747](https://cve.now/CVE-2023-34747.md): File upload vulnerability in ujcms 6.0.2 via /api/backend/core/web-file-upload/upload. (CVSS 9.8)
- [CVE-2023-34750](https://cve.now/CVE-2023-34750.md): bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the cid parameter at admin/index.php?mode=settings&page=project (CVSS 9.8)
- [CVE-2023-34751](https://cve.now/CVE-2023-34751.md): bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the gid parameter at admin/index.php?mode=user&page=groups&acti (CVSS 9.8)
- [CVE-2023-34752](https://cve.now/CVE-2023-34752.md): bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the lid parameter at admin/index.php?mode=settings&page=lang&ac (CVSS 9.8)
- [CVE-2023-34753](https://cve.now/CVE-2023-34753.md): bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the tid parameter at admin/index.php?mode=settings&page=tmpl&ac (CVSS 9.8)
- [CVE-2023-34754](https://cve.now/CVE-2023-34754.md): bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the pid parameter at admin/index.php?mode=settings&page=plugins (CVSS 9.8)
- [CVE-2023-34755](https://cve.now/CVE-2023-34755.md): bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the userid parameter at admin/index.php?mode=user&action=edit. (CVSS 9.8)
- [CVE-2023-34756](https://cve.now/CVE-2023-34756.md): bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the cid parameter at admin/index.php?mode=settings&page=charset (CVSS 9.8)
- [CVE-2023-34823](https://cve.now/CVE-2023-34823.md): fdkaac before 1.0.5 was discovered to contain a stack overflow in read\_callback function in src/main.c. (CVSS 5.5)
- [CVE-2023-34824](https://cve.now/CVE-2023-34824.md): fdkaac before 1.0.5 was discovered to contain a heap buffer overflow in caf\_info function in caf\_reader.c. (CVSS 5.5)
- [CVE-2023-34865](https://cve.now/CVE-2023-34865.md): Directory traversal vulnerability in ujcms 6.0.2 allows attackers to move files via the rename feature. (CVSS 9.8)
- [CVE-2023-34867](https://cve.now/CVE-2023-34867.md): Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the ecma\_property\_hashmap\_create at jerry-core/ecma/base (CVSS 7.5)
- [CVE-2023-34868](https://cve.now/CVE-2023-34868.md): Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the parser\_parse\_for\_statement\_start at jerry-core/parse (CVSS 7.5)
- [CVE-2023-34878](https://cve.now/CVE-2023-34878.md): An issue was discovered in Ujcms v6.0.2 allows attackers to gain sensitive information via the dir parameter to /api/backend/core/web-file-h (CVSS 7.5)
- [CVE-2023-35110](https://cve.now/CVE-2023-35110.md): An issue was discovered jjson thru 0.1.7 allows attackers to cause a denial of service or other unspecified impacts via crafted object that (CVSS 7.5, de.grobmeier.json:jjson)
- [CVE-2023-35116](https://cve.now/CVE-2023-35116.md): jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyc (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-06-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.