CVEs published June 19, 2023
116 CVEs were published on June 19, 2023: 12 critical, 35 high. 1 is now in CISA KEV.
- Published
- 116
- Critical
- 12
- High
- 35
- Medium
- 31
- Low
- 3
- Unrated
- 35
- Now in CISA KEV
- 1
- Fix available
- 41
Most affected products
- Huawei HarmonyOS · Huawei EMUI
- 15
- Huawei EMUI
- 11
- Mozilla Firefox
- 9
- FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. TELLUS an…
- 6
- Mozilla Firefox · Mozilla Thunderbird
- 5
- AI ChatBot
- 2
- Mozilla Firefox ESR · Mozilla Firefox +1
- 2
- Mozilla Firefox for Android · Mozilla Focus for Android
- 2
- org.jeecgframework.boot:jeecg-boot-parent
- 2
- QuBot
- 2
Critical 12
- CVE-2023-31411A remote unprivileged attacker can modify and access configuration settings on the EventCam App due to the absence of API authentication.SICK AG EventCam App
- CVE-2023-31410A remote unprivileged attacker can intercept the communication via e.g.SICK AG EventCam App
- CVE-2023-2907SQLi in MarksoftMarksoft
- CVE-2023-27992The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versZyxel NAS326 firmware · Zyxel NAS540 firmware +1
- CVE-2019-25136A compromised child process could have injected XBL Bindings into privileged CSS rules, resulting in arbitrary code execution and a sandbox Mozilla Firefox
- CVE-2023-34417Memory safety bugs present in Firefox 113.Mozilla Firefox
- CVE-2023-25736An invalid downcast from `nsHTMLDocument` to `nsIContent` could have lead to undefined behavior.Mozilla Firefox
- CVE-2023-29534Different techniques existed to obscure the fullscreen notification in Firefox and Focus for Android.Mozilla Firefox for Android · Mozilla Focus for Android
- CVE-2023-29542A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such asMozilla Firefox · Mozilla Thunderbird
- CVE-2023-29531An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable crMozilla Firefox · Mozilla Thunderbird
- CVE-2023-27396FINS (Factory Interface Network Service) is a message communication protocol, which is designed to be used in closed FA (Factory Automation)Multiple OMRON products which implement FINS protocol
- CVE-2023-34159Improper permission control vulnerability in the Notepad app.Successful exploitation of the vulnerability may lead to privilege escalation, Huawei HarmonyOS · Huawei EMUI
High 35
- CVE-2023-35772WordPress Google Map Shortcode Plugin <= 3.1.2 is vulnerable to Cross Site Scripting (XSS)Alain Gonzalez Google Map Shortcode
- CVE-2023-35775WordPress WP Backup Manager Plugin <= 1.13.1 is vulnerable to Cross Site Scripting (XSS)WP Backup Solutions WP Backup Manager
- CVE-2022-46850WordPress Easy Media Replace Plugin <= 0.1.3 is vulnerable to Arbitrary File DeletionNabil Lemsieh Easy Media Replace
- CVE-2022-47586WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.1.23 is vulnerable to SQL InjectionThemefic Ultimate Addons for Contact Form
- CVE-2023-2492QueryWall: Plug'n Play Firewall <= 1.1.1 - Admin+ SQLiQueryWall: Plug'n Play Firewall
- CVE-2023-2719SupportCandy < 3.1.7 - Subscriber+ SQLiSupportCandy
- CVE-2023-2221WP Custom Cursors < 3.2 - Admin+ SQLiWP Custom Cursors | WordPress Cursor Plugin
- CVE-2023-25733The return value from `gfx::SourceSurfaceSkia::Map()` wasn't being verified which could have potentially lead to a null pointer dereference.Mozilla Firefox
- CVE-2023-25747A potential use-after-free in libaudio was fixed by disabling the AAudio backend when running on Android API below version 30.Mozilla Firefox for Android
- CVE-2022-48486Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.Huawei EMUI
- CVE-2022-48498Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.Huawei EMUI
- CVE-2022-48499Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.Huawei EMUI
- CVE-2022-48500Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.Huawei EMUI
- CVE-2022-48501Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.Huawei EMUI
- CVE-2023-30759The driver installation package created by Printer Driver Packager NX v1.0.02 to v1.1.25 fails to detect its modification and may spawn an uRicoh Company Printer Driver Packager NX
- CVE-2023-31239Stack-based buffer overflow vulnerability in V-Server v4.0.15.0 and V-Server Lite v4.0.15.0 and earlier allows an attacker to execute arbitrFUJI ELECTRIC CO., LTD. and Hakko Electronics Co. V-Server…
- CVE-2023-32201Stack-based buffer overflow vulnerability exists in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0.FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. TELLUS an…
- CVE-2023-32270Access of memory location after end of buffer issue exists in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0.FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. TELLUS an…
- CVE-2023-32273Stack-based buffer overflow vulnerability exists in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0.FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. TELLUS an…
- CVE-2023-32276Stack-based buffer overflow vulnerability exists in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0.FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. TELLUS an…
- CVE-2023-32288Out-of-bounds read vulnerability exists in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0.FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. TELLUS an…
- CVE-2023-32538Stack-based buffer overflow vulnerability exists in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0.FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. TELLUS an…
- CVE-2023-32542Out-of-bounds read vulnerability exists in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0.FUJI ELECTRIC CO. TELLUS and TELLUS Lite
- CVE-2023-3312A vulnerability was found in drivers/cpufreq/qcom-cpufreq-hw.c in cpufreq subsystem in the Linux Kernel.Kernel
- CVE-2023-34161nappropriate authorization vulnerability in the SettingsProvider module.Successful exploitation of this vulnerability may cause features to Huawei HarmonyOS · Huawei EMUI
- CVE-2023-34162Version update determination vulnerability in the user profile module.Successful exploitation of this vulnerability may cause repeated HMS CHuawei HarmonyOS · Huawei EMUI
- CVE-2023-34163Permission control vulnerability in the window management module.Successful exploitation of this vulnerability may cause features to performHuawei HarmonyOS · Huawei EMUI
- CVE-2023-34166Vulnerability of system restart triggered by abnormal callbacks passed to APIs.Successful exploitation of this vulnerability may cause the sHuawei HarmonyOS · Huawei EMUI
- CVE-2023-34602JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByCode at org.jeecg.modorg.jeecgframework.boot:jeecg-boot-parent
- CVE-2023-34603JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictInfo at org.jeecg.moduorg.jeecgframework.boot:jeecg-boot-parent
- CVE-2023-34641KioWare for Windows through v8.33 was discovered to contain an incomplete blacklist filter for blocked dialog boxes on Windows 10.
- CVE-2023-34642KioWare for Windows through v8.33 was discovered to contain an incomplete blacklist filter for blocked dialog boxes on Windows 10.
- CVE-2023-35843NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on
- CVE-2023-35844packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow ..
- CVE-2023-35846VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 does not check the transport layer length in a frame before performing port filtering.
Medium, low and unrated 69
- CVE-2023-32659SUBNET PowerSYSTEM Center Cross-site ScriptingSUBNET Solutions PowerSYSTEM Center
- CVE-2023-29158SUBNET PowerSYSTEM Center Authentication Bypass by Capture-replaySUBNET Solutions PowerSYSTEM Center
- CVE-2023-3315Missing permission checks in Jenkins Team Concert Plugin 2.4.1 and earlier allow attackers with Overall/Read permission to check for the exiJenkins Project Jenkins Team Concert Plugin · org.jenkins-c…
- CVE-2023-34461Cross-site Scripting (XSS) Availability in PyBBbenjjvi PyBB
- CVE-2023-35776WordPress Sermon'e – Sermons Online Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)Beplus Sermon'e – Sermons Online
- CVE-2023-35779WordPress Seed Fonts Plugin 2.3.1 is vulnerable to Cross Site Scripting (XSS)Seed Webs Seed Fonts
- CVE-2023-33213WordPress wpView Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)gVectors Display Custom Fields – wpView
- CVE-2023-34373WordPress Zephyr Project Manager Plugin <= 3.3.93 is vulnerable to Cross Site Request Forgery (CSRF)Dylan James Zephyr Project Manager
- CVE-2023-3318SourceCodester Resort Management System cross site scriptingSourceCodester Resort Management System
- CVE-2023-3316A NULL pointer dereference in TIFFClose() is caused by a failure to open an output file (non-existent path or a path that requires permissions like /dev/null) while specifying zones.libtiff
- CVE-2023-2812Ultimate Dashboard < 3.7.6 - Admin+ Stored XSSUltimate Dashboard
- CVE-2023-2805SupportCandy < 3.1.7 - Admin+ SQLiSupportCandy
- CVE-2023-2654Conditional Menus < 1.2.1 - Reflected XSSConditional Menus
- CVE-2023-2751Upload Resume <= 1.2.0 - Captcha BypassUpload Resume
- CVE-2023-2399qubotchat < 1.1.6 - Unauthenticated Stored XSSQuBot
- CVE-2023-2527Integration for Contact Form 7 and Zoho CRM, Bigin < 1.2.4 - Admin+ SQLiIntegration for Contact Form 7 and Zoho CRM, Bigin
- CVE-2023-0489SlideOnline <= 1.2.1 - Contributor+ Stored XSSSlideOnline
- CVE-2023-2359Revolution Slider <= 6.6.12 - Author+ Remote Code ExecutionSlider Revolution
- CVE-2023-0368Responsive Tabs For WPBakery Page Builder <= 1.1 - Contributor+ Stored XSSResponsive Tabs For WPBakery Page Builder
- CVE-2023-2600Custom Base Terms < 1.0.3 - Admin+ Stored XSSCustom Base Terms
- CVE-2023-2401Qubotchat < 1.1.6 – Admin+ Stored XSSQuBot
- CVE-2023-2899Google Map Shortcode <= 3.1.2 - Contributor+ Stored XSSGoogle Map Shortcode
- CVE-2023-2742AI ChatBot < 4.5.5 - Admin+ Stored Cross-Site ScriptingAI ChatBot
- CVE-2023-2811AI ChatBot < 4.5.6 - Admin+ Stored Cross-Site ScriptingAI ChatBot
- CVE-2023-2684File Renaming on Upload < 2.5.2 - Admin+ Stored Cross-Site ScriptingFile Renaming on Upload
- CVE-2023-2779Super Socializer < 7.13.52 - Reflected XSSSocial Share, Social Login and Social Comments Plugin
- CVE-2023-34415When choosing a site-isolated process for a document loaded from a data: URL that was the result of a redirect, Firefox would load that docuMozilla Firefox
- CVE-2023-34416Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12.Mozilla Firefox ESR · Mozilla Firefox +1
- CVE-2023-34414The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses to protect prompts and permission dialoMozilla Firefox ESR · Mozilla Firefox +1
- CVE-2023-29546When recording the screen while in Private Browsing on Firefox for Android the address bar and keyboard were not hidden, potentially leakingMozilla Firefox for Android · Mozilla Focus for Android
- CVE-2023-29545Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have resoMozilla Firefox · Mozilla Thunderbird
- CVE-2023-29532A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the service at an update file oMozilla Firefox · Mozilla Thunderbird
- CVE-2023-32216Mozilla developers and community members Ronald Crane, Andrew McCreight, Randell Jesup and the Mozilla Fuzzing Team reported memory safety bMozilla Firefox
- CVE-2023-32214Protocol handlers `ms-cxh` and `ms-cxh-full` could have been leveraged to trigger a denial of service.Mozilla Firefox · Mozilla Thunderbird
- CVE-2023-32210Documents were incorrectly assuming an ordering of principal objects when ensuring we were loading an appropriately privileged principal.Mozilla Firefox
- CVE-2023-32209A maliciously crafted favicon could have led to an out of memory crash.Mozilla Firefox
- CVE-2023-32208Service workers could reveal script base URL due to dynamic `import()`.Mozilla Firefox
- CVE-2023-35005Apache Airflow: Information disclosure on configuration viewApache Software Foundation Apache Airflow · apache-airflow
- CVE-2022-48487Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.Huawei EMUI
- CVE-2022-48488Vulnerability of bypassing the default desktop security controls.Successful exploitation of this vulnerability may cause unauthorized modifiHuawei HarmonyOS · Huawei EMUI
- CVE-2022-48489Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.Huawei EMUI
- CVE-2022-48490Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.Huawei EMUI
- CVE-2022-48491Vulnerability of missing authentication on certain HUAWEI phones.Successful exploitation of this vulnerability can lead to ads and other winHuawei HarmonyOS · Huawei EMUI
- CVE-2022-48492Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.Huawei EMUI
- CVE-2022-48493Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.Huawei EMUI
- CVE-2022-48494Vulnerability of lax app identity verification in the pre-authorization function.Successful exploitation of this vulnerability will cause maHuawei HarmonyOS · Huawei EMUI
- CVE-2022-48495Vulnerability of unauthorized access to foreground app information.Successful exploitation of this vulnerability may cause foreground app inHuawei HarmonyOS · Huawei EMUI
- CVE-2022-48496Vulnerability of lax app identity verification in the pre-authorization function.Successful exploitation of this vulnerability will cause maHuawei HarmonyOS · Huawei EMUI
- CVE-2022-48497Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.Huawei EMUI
- CVE-2022-48506A flawed pseudorandom number generator in Dominion Voting Systems ImageCast Precinct (ICP and ICP2) and ImageCast Evolution (ICE) scanners a
- CVE-2023-3022A flaw was found in the IPv6 module of the Linux kernel.Linux Kernel
- CVE-2023-34155Vulnerability of unauthorized calling on HUAWEI phones and tablets.Successful exploitation of this vulnerability may affect availability.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-34156Vulnerability of services denied by early fingerprint APIs on HarmonyOS products.Successful exploitation of this vulnerability may cause serHuawei HarmonyOS · Huawei EMUI
- CVE-2023-34158Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-party apps to hide app Huawei HarmonyOS · Huawei EMUI
- CVE-2023-34160Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-party apps to hide app Huawei HarmonyOS · Huawei EMUI
- CVE-2023-34167Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-party apps to hide app Huawei HarmonyOS · Huawei EMUI
- CVE-2023-34657A stored cross-site scripting (XSS) vulnerability in Eyoucms v1.6.2 allows attackers to execute arbitrary web scripts or HTML via a crafted
- CVE-2023-35839A bypass in the component sofa-hessian of Solon before v2.3.3 allows attackers to execute arbitrary code via providing crafted payload.org.noear:solon
- CVE-2023-35840_joinPath in elFinderVolumeLocalFileSystem.class.php in elFinder before 2.1.62 allows path traversal in the PHP LocalVolumeDriver connector.studio-42/elfinder
- CVE-2023-35847VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 does not have an MSS lower bound (e.g., it could be zero).
- CVE-2023-35848VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 lacks certain size calculations before attempting to set a value of an mss structure memb
- CVE-2023-35849VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 does not properly check whether header sizes would result in accessing data outside of a
- CVE-2023-35852In Suricata before 6.0.13 (when there is an adversary who controls an external source of rules), a dataset filename, that comes from a rule,
- CVE-2023-35853In Suricata before 6.0.13, an adversary who controls an external source of Lua rules may be able to execute Lua code.
- CVE-2023-35855A buffer overflow in Counter-Strike through 8684 allows a game server to execute arbitrary code on a remote client's machine by modifying th
- CVE-2023-35856A buffer overflow in Nintendo Mario Kart Wii RMCP01, RMCE01, RMCJ01, and RMCK01 can be exploited by a game client to execute arbitrary code
- CVE-2023-35857In Siren Investigate before 13.2.2, session keys remain active even after logging out.
- CVE-2023-35862libcoap 4.3.1 contains a buffer over-read via the function coap_parse_oscore_conf_mem at coap_oscore.c.
- CVE-2023-35866In KeePassXC through 2.7.5, a local attacker can make changes to the Database security settings, including master password and second-factor