CVEs published June 16, 2023
78 CVEs were published on June 16, 2023: 7 critical, 18 high.
- Published
- 78
- Critical
- 7
- High
- 18
- Medium
- 28
- Low
- 3
- Unrated
- 22
- Now in CISA KEV
- 0
- Fix available
- 17
Most affected products
- Mattermost
- 8
- Huawei BiSheng-WNM
- 3
- Huawei HarmonyOS
- 3
- ImageMagick
- 3
- Microsoft ODBC Driver 17 for SQL Server on Linux · Micro… +5
- 3
- Fortinet FortiOS · Fortinet FortiProxy
- 2
- org.jeecgframework.boot:jeecg-boot-parent
- 2
- Alexander Suess asMember
- 1
- Cloud Foundry Notifications · Cloud Foundry SMB-volume r… +1
- 1
- Contact ITPison
- 1
Critical 7
- CVE-2022-48472A Huawei printer has a system command injection vulnerability.Huawei BiSheng-WNM
- CVE-2023-34157Vulnerability of HwWatchHealth being hijacked.Successful exploitation of this vulnerability may cause repeated pop-up windows of the app.Huawei HarmonyOS
- CVE-2023-25366In Siglent SDS 1104X-E SDS1xx4X-E_V6.1.37R9.ADS, insecure SCPI interface discloses web password.
- CVE-2023-32752L7 Networks InstantScan & InstantQoS - Arbitrary File UploadL7 Networks InstantScan · L7 Networks InstantQoS
- CVE-2023-32753ITPison OMICARD EDM - Arbitrary File UploadContact ITPison
- CVE-2023-32754Thinking Software Efence - SQL injectionThinking Software Efence
- CVE-2023-34548Simple Customer Relationship Management 1.0 is vulnerable to SQL Injection via the email parameter.
High 18
- CVE-2023-30625rudder-server vulnerable to SQL Injectionrudderlabs rudder-server · github.com/rudderlabs/rudder-ser…
- CVE-2022-48471There is a misinterpretation of input vulnerability in Huawei Printer.Huawei BiSheng-WNM
- CVE-2022-48330A Huawei sound box product has an out-of-bounds write vulnerability.Huawei FLMG-10
- CVE-2023-27420WordPress Arya Multipurpose Theme <= 1.0.5 is vulnerable to Cross Site Scripting (XSS)Everest Themes Arya Multipurpose
- CVE-2023-29349Microsoft ODBC and OLE DB Remote Code Execution VulnerabilityMicrosoft OLE DB Driver 18 for SQL Server · Microsoft OL… +7
- CVE-2023-32028Microsoft SQL OLE DB Remote Code Execution VulnerabilityMicrosoft OLE DB Driver 19 for SQL Server · Microsoft OL… +1
- CVE-2023-32027Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft ODBC Driver 17 for SQL Server on Linux · Micro… +5
- CVE-2023-32026Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft ODBC Driver 17 for SQL Server on MacOS · Micro… +5
- CVE-2023-32025Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft ODBC Driver 17 for SQL Server on Linux · Micro… +5
- CVE-2023-29356Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft ODBC Driver 17 for SQL Server on Linux · Micro… +5
- CVE-2023-24243CData RSB Connect v22.0.8336 was discovered to contain a Server-Side Request Forgery (SSRF).
- CVE-2023-25645There is a permission and access control vulnerability in some ZTE AndroidTV STBs.UP T2 4K, ZXV10 B866V2-H, ZXV10 B866V2, ZXV10 B860H V5D0,…
- CVE-2023-3268An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c in the relayfs.Linux kernel
- CVE-2023-3293Cross-site Scripting (XSS) - Stored in salesagility/suitecrm-coresalesagility/suitecrm-core
- CVE-2023-3294Cross-site Scripting (XSS) - DOM in saleor/react-storefrontsaleor/react-storefront
- CVE-2023-34645jfinal CMS 5.1.0 has an arbitrary file read vulnerability.
- CVE-2023-35782The ipandlanguageredirect extension before 5.1.2 for TYPO3 allows SQL Injection.in2code/ipandlanguageredirect
- CVE-2023-35788An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7.
Medium, low and unrated 53
- CVE-2023-34459OpenZeppelin Contracts's MerkleProof multiproofs may allow proving arbitrary leaves for specific treesopenzeppelin-contracts · @openzeppelin/contracts +1
- CVE-2023-30905The MC990 X and UV300 RMC component has and inadequate default configuration that could be exploited to obtain enhanced privilege.Hewlett Packard Enterprise (HPE) HPE MC990 X RMC firmware
- CVE-2023-30904A security vulnerability in HPE Insight Remote Support may result in the local disclosure of privileged LDAP information.Hewlett Packard Enterprise (HPE) HPE Insight Remote Support
- CVE-2023-30903HP-UX could be exploited locally to create a Denial of Service (DoS) when any physical interface is configured with IPv6/inet6.Hewlett Packard Enterprise (HPE) HP-UX
- CVE-2022-48469There is a traffic hijacking vulnerability in Huawei routers.Huawei B535-232a
- CVE-2022-48473There is a misinterpretation of input vulnerability in Huawei Printer.Huawei BiSheng-WNM
- CVE-2023-20885CF workflows leak credentials in system audit logsCloud Foundry Notifications · Cloud Foundry SMB-volume r… +1
- CVE-2023-26537WordPress WP No External Links Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)nicolly WP No External Links
- CVE-2023-25974WordPress wp2syslog Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS)psicosi448 wp2syslog
- CVE-2023-26527WordPress Debug Assistant Plugin <= 1.4 is vulnerable to Cross Site Scripting (XSS)WPIndeed Debug Assistant
- CVE-2023-26515WordPress Simple Slug Translate Plugin <= 2.7.2 is vulnerable to Cross Site Scripting (XSS)Ko Takagi Simple Slug Translate
- CVE-2023-33307A null pointer dereference in Fortinet FortiOS before 7.2.5 and before 7.0.11, FortiProxy before 7.2.3 and before 7.0.9 allows attacker to dFortinet FortiOS · Fortinet FortiProxy
- CVE-2023-33306A null pointer dereference in Fortinet FortiOS before 7.2.5, before 7.0.11 and before 6.4.13, FortiProxy before 7.2.4 and before 7.0.10 allFortinet FortiOS · Fortinet FortiProxy
- CVE-2023-2785Specially crafted search query can cause large log entries in postgresMattermost
- CVE-2023-2831Denial of Service while unescaping a Markdown stringMattermost
- CVE-2023-2797Path traversal in GitHub plugin's code preview featureMattermost Github Plugin
- CVE-2023-2793Stack exhaustion in PreparePostForClientWithEmbedsAndImagesMattermost
- CVE-2023-2792Ephemeral messages return private channel contents in permalink previewsMattermost
- CVE-2023-2791Playbooks lets you edit arbitrary postsMattermost
- CVE-2023-2788Deactivated user can retain access using oauth2 apiMattermost
- CVE-2023-26541WordPress asMember Plugin <= 1.5.4 is vulnerable to Cross Site Scripting (XSS)Alexander Suess asMember
- CVE-2023-2787Collapsed Reply Threads APIs leak message contents from private channelsMattermost
- CVE-2023-2786Channel commands execution doesn't properly verify permissionsMattermost
- CVE-2023-2784Apps Framework allows install requests from regular members via an internal pathMattermost App Framework
- CVE-2023-25963WordPress JS Job Manager Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)JoomSky JS Job Manager
- CVE-2023-2783App Framework does not checks for the secret provided in the incoming webhook requestMattermost App Framework · github.com/mattermost/mattermost…
- CVE-2023-26013WordPress Strong Testimonials Plugin <= 3.0.2 is vulnerable to Cross Site Scripting (XSS)WPChill Strong Testimonials
- CVE-2023-2431Bypass of seccomp profile enforcementKubernetes · k8s.io/kubernetes
- CVE-2023-34165Unauthorized access vulnerability in the Save for later feature provided by AI Touch.Successful exploitation of this vulnerability may causeHuawei HarmonyOS
- CVE-2023-34154Vulnerability of undefined permissions in HUAWEI VR screen projection.Successful exploitation of this vulnerability will cause third-party aHuawei HarmonyOS
- CVE-2023-25185An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B.
- CVE-2023-25186An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B.
- CVE-2023-25187An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B.
- CVE-2023-25188An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B.
- CVE-2023-30222An information disclosure vulnerability in 4D SAS 4D Server Application v17, v18, v19 R7 and earlier allows attackers to retrieve password h
- CVE-2023-30223A broken authentication vulnerability in 4D SAS 4D Server software v17, v18, v19 R7, and earlier allows attackers to send crafted TCP packet
- CVE-2023-30453The Teamlead Reminder plugin through 2.6.5 for Jira allows persistent XSS via the message parameter.
- CVE-2023-3195A stack-based buffer overflow issue was found in ImageMagick's coders/tiff.c.ImageMagick
- CVE-2023-3291Heap-based Buffer Overflow in gpac/gpacgpac/gpac
- CVE-2023-33438A stored Cross-site scripting (XSS) vulnerability in Wolters Kluwer TeamMate+ 35.0.11.0 allows remote attackers to inject arbitrary web scri
- CVE-2023-34474A heap-based buffer overflow issue was discovered in ImageMagick's ReadTIM2ImageData() function in coders/tim2.c.ImageMagick
- CVE-2023-34475A heap use after free issue was discovered in ImageMagick's ReplaceXmpValue() function in MagickCore/profile.c.ImageMagick
- CVE-2023-34659jeecg-boot 3.5.0 and 3.5.1 have a SQL injection vulnerability the id parameter of the /jeecg-boot/jmreport/show interface.org.jeecgframework.boot:jeecg-boot-parent
- CVE-2023-34660jjeecg-boot V3.5.0 has an unauthorized arbitrary file upload in /jeecg-boot/jmreport/upload interface.org.jeecgframework.boot:jeecg-boot-parent
- CVE-2023-34733A lack of exception handling in the Volkswagen Discover Media Infotainment System Software Version 0876 allows attackers to cause a Denial o
- CVE-2023-34795xlsxio v0.1.2 to v0.2.34 was discovered to contain a free of uninitialized pointer in the xlsxioread_sheetlist_close() function.
- CVE-2023-34832TP-Link Archer AX10(EU)_V1.2_230220 was discovered to contain a buffer overflow via the function FUN_131e8 - 0x132B4.
- CVE-2023-34845Bludit v3.14.1 was discovered to contain an arbitrary file upload vulnerability in the component /admin/new-content.
- CVE-2023-35708In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3), a SQL
- CVE-2023-35783The ke_search (aka Faceted Search) extension before 4.0.3, 4.1.x through 4.6.x before 4.6.6, and 5.x before 5.0.2 for TYPO3 allows XSS via itpwd/ke_search
- CVE-2023-35784A double free or use after free could occur after SSL_clear in OpenBSD 7.2 before errata 026 and 7.3 before errata 004, and in LibreSSL befo
- CVE-2023-35789An issue was discovered in the C AMQP client library (aka rabbitmq-c) through 0.13.0 for RabbitMQ.
- CVE-2023-35790An issue was discovered in dec_patch_dictionary.cc in libjxl before 0.8.2.