CVEs published June 15, 2023
94 CVEs were published on June 15, 2023: 4 critical, 19 high.
- Published
- 94
- Critical
- 4
- High
- 19
- Medium
- 33
- Low
- 3
- Unrated
- 35
- Now in CISA KEV
- 0
- Fix available
- 23
Most affected products
- Android
- 27
- Adobe Magento Commerce · magento/community-edition +1
- 10
- IBM Security Directory Suite VA
- 6
- Adobe Experience Manager
- 4
- Liferay Portal · Liferay DXP +2
- 3
- xerial snappy-java · org.xerial.snappy:snappy-java
- 3
- Adobe Commerce · magento/community-edition +1
- 2
- Netskope Client
- 2
- Adobe Animate
- 1
- Adobe Substance3D - Designer
- 1
Critical 4
- CVE-2023-2686Buffer overflow in Wi-Fi Commissioning MicriumOS example in Silicon Labs Gecko SDK v4.2.3 or earlier allows connected device to write payloasilabs.com Gecko Platform
- CVE-2023-29297Admin-to-admin stored XSS via cache poisoningAdobe Magento Commerce · magento/community-edition +1
- CVE-2023-31672In the PrestaShop < 2.4.3 module "Length, weight or volume sell" (ailinear) there is a SQL injection vulnerability.
- CVE-2023-34800D-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter at genacgi_main.
High 19
- CVE-2023-2080Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Forcepoint Cloud Security Gateway (CSGForcepoint Cloud Security Gateway
- CVE-2023-34455snappy-java's unchecked chunk length leads to DoSxerial snappy-java · org.xerial.snappy:snappy-java
- CVE-2023-24420WordPress Admin side data storage for Contact Form 7 Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)Zestard Technologies Admin side data storage for Contact Fo…
- CVE-2023-27634WordPress Intrepidity Theme <= 1.5.1 is vulnerable to Cross Site Request Forgery (CSRF)Shingo Intrepidity
- CVE-2023-28175Improper Authorization in SSH server in Bosch VMS 11.0, 11.1.0, and 11.1.1 allows a remote authenticated user to access resources within theBosch BVMS · Bosch DIVAR IP
- CVE-2023-2847Local privilege escalation in ESET products for Linux and MacOSESET Server Security for Linux · ESET Endpoint Antivirus… +2
- CVE-2022-4149Local privilege escalation using log fileNetskope Client
- CVE-2023-2270Local privilege escalationNetskope Client
- CVE-2023-35030Cross-site request forgery (CSRF) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and LiLiferay Portal · Liferay DXP +2
- CVE-2022-32752IBM Security Directory Suite VA command executionIBM Security Directory Suite VA
- CVE-2022-32757IBM Security Directory Suite VA information disclosureIBM Security Directory Suite VA
- CVE-2022-33166IBM Security Directory Suite VA file uploadIBM Security Directory Suite VA
- CVE-2022-33168IBM Security Directory Suite VA denial of serviceIBM Security Directory Suite VA
- CVE-2023-21618ZDI-CAN-20963: Adobe Substance 3D Designer SBS File Parsing Uninitialized Variable Remote Code Execution VulnerabilityAdobe Substance3D - Designer
- CVE-2023-22248Adobe Commerce Incorrect Authorization Security feature bypassAdobe Magento Commerce · magento/community-edition +1
- CVE-2023-23841SolarWinds Serv-U Exposure of Sensitive Information VulnerabilitySolarWinds ServU
- CVE-2023-28809Some access control products are vulnerable to a session hijacking attack because the product does not update the session ID after a user suhikvision DS-K1T804AXX · hikvision DS-K1T341AXX +4
- CVE-2023-29321Adobe Animate FLA files Use After Free Arbitrary code executionAdobe Animate
- CVE-2023-33243RedTeam Pentesting discovered that the web interface of STARFACE as well as its REST API allows authentication using the SHA512 hash of the
Medium, low and unrated 71
- CVE-2023-2747Uninitialized IV in Silicon Labs SE FW v2.0.0 through v 2.2.1 for internally stored datasilabs.com GSDK
- CVE-2023-34242Cilium vulnerable to information leakage via incorrect ReferenceGrant handlingcilium · github.com/cilium/cilium
- CVE-2023-2683Connection update while closing connection may lead to denial-of-servicesilabs.com Bluetooth SDK
- CVE-2023-34454snappy-java's Integer Overflow vulnerability in compress leads to DoSxerial snappy-java · org.xerial.snappy:snappy-java
- CVE-2023-34453snappy-java's Integer Overflow vulnerability in shuffle leads to DoSxerial snappy-java · org.xerial.snappy:snappy-java
- CVE-2023-25055WordPress Google XML Sitemap for Videos Plugin <= 2.6.1 is vulnerable to Cross Site Request Forgery (CSRF)Amit Agarwal Google XML Sitemap for Videos
- CVE-2023-3276Dromara HuTool XML Parsing Module XmlUtil.java readBySax xml external entity referenceDromara HuTool · cn.hutool:hutool-core
- CVE-2023-3275PHPGurukul Rail Pass Management System POST Request view-pass-detail.php sql injectionPHPGurukul Rail Pass Management System
- CVE-2023-3274code-projects Supplier Management System Picture btn_functions.php unrestricted uploadcode-projects Supplier Management System
- CVE-2023-25972WordPress Старт Plugin <= 3.7 is vulnerable to Cross Site Scripting (XSS)IKSWEB WordPress Старт
- CVE-2023-25450WordPress GiveWP Plugin <= 2.25.1 is vulnerable to Cross Site Request Forgery (CSRF)GiveWP – Donation Plugin and Fundraising Platform
- CVE-2023-23802WordPress HT Easy GA4 ( Google Analytics 4 ) Plugin <= 1.0.6 is vulnerable to Cross Site Request Forgery (CSRF)HasThemes HT Easy GA4
- CVE-2023-25449WordPress CformsII Plugin <=15.0.4 is vulnerable to Cross Site Request Forgery (CSRF)Oliver Seidel, Bastian Germann cformsII
- CVE-2023-32229Due to an error in the software interface to the secure element chip on Bosch IP cameras of family CPP13 and CPP14, the chip can be permanenBosch Camera Firmware
- CVE-2023-35029Open redirect vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 updateLiferay Portal · Liferay DXP +2
- CVE-2023-3193Cross-site scripting (XSS) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.73, and Liferay DLiferay Portal · Liferay DXP +2
- CVE-2022-33159IBM Security Directory Suite VA information disclosureIBM Security Directory Suite VA
- CVE-2022-33163IBM Security Directory Suite VA information disclosureIBM Security Directory Suite VA
- CVE-2023-25683IBM PowerVM Hypervisor information disclosureIBM PowerVM Hypervisor
- CVE-2022-22307IBM Security Guardium privilege escalationIBM Security Guardium
- CVE-2021-0701In PVRSRVBridgeSyncPrimOpCreate of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allAndroid
- CVE-2021-0945In _PMRCreate of the PowerVR kernel driver, a missing bounds check means it is possible to overwrite heap memory via PhysmemNewRamBackedPMR.Android
- CVE-2023-21095In canStartSystemGesture of RecentsAnimationDeviceState.java, there is a possible partial lockscreen bypass due to a race condition.Android
- CVE-2023-21101In multiple functions of WVDrmPlugin.cpp, there is a possible use after free due to a race condition.Android
- CVE-2023-21105In multiple functions of ChooserActivity.java, there is a possible cross-user media read due to a confused deputy.Android
- CVE-2023-21108In sdpu_build_uuid_seq of sdp_discovery.cc, there is a possible out of bounds write due to a use after free.Android
- CVE-2023-21115In btm_sec_encrypt_change of btm_sec.cc, there is a possible way to downgrade the link key type due to improperly used crypto.Android
- CVE-2023-21120In multiple functions of cdm_engine.cpp, there is a possible use-after-free due to improper locking.Android
- CVE-2023-21121In onResume of AppManagementFragment.java, there is a possible way to prevent users from forgetting a previously connected VPN due to impropAndroid
- CVE-2023-21122In various functions of various files, there is a possible way to bypass the DISALLOW_DEBUGGING_FEATURES restriction for tracing due to a miAndroid
- CVE-2023-21123In multiple functions of multiple files, there is a possible way to bypass the DISALLOW_DEBUGGING_FEATURES restriction for tracing due to a Android
- CVE-2023-21124In run of multiple files, there is a possible escalation of privilege due to unsafe deserialization.Android
- CVE-2023-21126In bindOutputSwitcherAndBroadcastButton of MediaControlPanel.java, there is a possible launch arbitrary activity under SysUI due to Unsafe IAndroid
- CVE-2023-21127In readSampleData of NuMediaExtractor.cpp, there is a possible out of bounds write due to uninitialized data.Android
- CVE-2023-21128In various functions of AppStandbyController.java, there is a possible way to break manageability scenarios due to a logic error in the codeAndroid
- CVE-2023-21129In getFullScreenIntentDecision of NotificationInterruptStateProviderImpl.java, there is a possible activity launch while the app is in the bAndroid
- CVE-2023-21130In btm_ble_periodic_adv_sync_lost of btm_ble_gap.cc, there is a possible remote code execution due to a buffer overflow.Android
- CVE-2023-21131In checkKeyIntentParceledCorrectly() of ActivityManagerService.java, there is a possible bypass of Parcel Mismatch mitigations due to a logiAndroid
- CVE-2023-21135In onCreate of NotificationAccessSettings.java, there is a possible failure to persist notifications settings due to improper input validatiAndroid
- CVE-2023-21136In multiple functions of JobStore.java, there is a possible way to cause a crash on startup due to improper input validation.Android
- CVE-2023-21137In several methods of JobStore.java, uncaught exceptions in job map parsing could lead to local persistent denial of service with no additioAndroid
- CVE-2023-21138In onNullBinding of CallRedirectionProcessor.java, there is a possible long lived connection due to improper input validation.Android
- CVE-2023-21139In bindPlayer of MediaControlPanel.java, there is a possible launch arbitrary activity in SysUI due to Unsafe Intent.Android
- CVE-2023-21141In several functions of several files, there is a possible way to access developer mode traces due to a permissions bypass.Android
- CVE-2023-21142In multiple files, there is a possible way to access traces in the dev mode due to a permissions bypass.Android
- CVE-2023-21143In multiple functions of multiple files, there is a possible way to make the device unusable due to improper input validation.Android
- CVE-2023-21144In doInBackground of NotificationContentInflater.java, there is a possible temporary denial or service due to long running operations.Android
- CVE-2023-24030An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0 and 8.8.15.
- CVE-2023-24031An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 8.8.15.
- CVE-2023-24032In Zimbra Collaboration Suite through 9.0 and 8.8.15, an attacker (who has initial user access to a Zimbra server instance) can execute comm
- CVE-2023-28810Some access control/intercom products have unauthorized modification of device network configuration vulnerabilities.hikvision DS-K1T804AXX · hikvision DS-K1T341AXX +6
- CVE-2023-29287Adobe Commerce Information Exposure Security feature bypassAdobe Magento Commerce · magento/community-edition +1
- CVE-2023-29288Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce · magento/community-edition +1
- CVE-2023-29289Adobe Commerce XML Injection Security feature bypassAdobe Magento Commerce · magento/community-edition +1
- CVE-2023-29290Adobe Commerce Guest Cart Shipping Address Overwrite IDOR Adobe Magento Commerce · magento/community-edition +1
- CVE-2023-29291Server Side Request Forgery (SSRF) in USPS carrier integration configurationAdobe Magento Commerce · magento/community-edition +1
- CVE-2023-29292Server Side Request Forgery (SSRF) in FedEx carrier integration configurationAdobe Magento Commerce · magento/community-edition +1
- CVE-2023-29293Adobe Commerce | Improper Input Validation (CWE-20)Adobe Commerce · magento/community-edition +1
- CVE-2023-29294Bypass Purchase Order Approval using Company User in Adobe Commerce B2BAdobe Magento Commerce · magento/community-edition +1
- CVE-2023-29295Insecure Direct Object Reference (IDOR) in Create Quote FunctionAdobe Magento Commerce · magento/community-edition +1
- CVE-2023-29296[Cloud] Customer suspects IDOR vulnerabilityAdobe Magento Commerce · magento/community-edition +1
- CVE-2023-29302Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)Adobe Experience Manager
- CVE-2023-29304Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)Adobe Experience Manager
- CVE-2023-29307Open Redirect on AEM TargetAdobe Experience Manager
- CVE-2023-29322Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)Adobe Experience Manager
- CVE-2023-34626Piwigo 13.7.0 is vulnerable to SQL Injection via the "Users" function.
- CVE-2023-34666Cross-site scripting (XSS) vulnerability in Phpgurukul Cyber Cafe Management System 1.0 allows remote attackers to inject arbitrary web scri
- CVE-2023-34797Broken access control in the Registration page (/Registration.aspx) of Termenos CWX v8.5.6 allows attackers to access sensitive information.
- CVE-2023-34833An arbitrary file upload vulnerability in the component /api/upload.php of ThinkAdmin v6 allows attackers to execute arbitrary code via a cr
- CVE-2023-34852PublicCMS <=V4.0.202302 is vulnerable to Insecure Permissions.
- CVE-2023-34880cmseasy v7.7.7.7 20230520 was discovered to contain a path traversal vulnerability via the add_action method at lib/admin/language_admin.php