# CVEs published 2023-06-19

116 CVEs were published on June 19, 2023: 12 critical, 35 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2023-32659](https://cve.now/CVE-2023-32659.md): SUBNET PowerSYSTEM Center Cross-site Scripting (CVSS 6.5, SUBNET Solutions PowerSYSTEM Center)
- [CVE-2023-29158](https://cve.now/CVE-2023-29158.md): SUBNET PowerSYSTEM Center Authentication Bypass by Capture-replay (CVSS 6.1, SUBNET Solutions PowerSYSTEM Center)
- [CVE-2023-3315](https://cve.now/CVE-2023-3315.md): Missing permission checks in Jenkins Team Concert Plugin 2.4.1 and earlier allow attackers with Overall/Read permission to check for the exi (CVSS 4.3, Jenkins Project Jenkins Team Concert Plugin · org.jenkins-c…)
- [CVE-2023-34461](https://cve.now/CVE-2023-34461.md): Cross-site Scripting (XSS) Availability in PyBB (CVSS 4.6, benjjvi PyBB)
- [CVE-2023-31411](https://cve.now/CVE-2023-31411.md): A remote unprivileged attacker can modify and access configuration settings on the EventCam App due to the absence of API authentication. (CVSS 9.8, SICK AG EventCam App)
- [CVE-2023-31410](https://cve.now/CVE-2023-31410.md): A remote unprivileged attacker can intercept the communication via e.g. (CVSS 9.8, SICK AG EventCam App)
- [CVE-2023-35772](https://cve.now/CVE-2023-35772.md): WordPress Google Map Shortcode Plugin \<= 3.1.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Alain Gonzalez Google Map Shortcode)
- [CVE-2023-35775](https://cve.now/CVE-2023-35775.md): WordPress WP Backup Manager Plugin \<= 1.13.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, WP Backup Solutions WP Backup Manager)
- [CVE-2023-35776](https://cve.now/CVE-2023-35776.md): WordPress Sermon'e – Sermons Online Plugin \<= 1.0.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Beplus Sermon'e – Sermons Online)
- [CVE-2023-35779](https://cve.now/CVE-2023-35779.md): WordPress Seed Fonts Plugin 2.3.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Seed Webs Seed Fonts)
- [CVE-2023-33213](https://cve.now/CVE-2023-33213.md): WordPress wpView Plugin \<= 1.3.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, gVectors Display Custom Fields – wpView)
- [CVE-2023-2907](https://cve.now/CVE-2023-2907.md): SQLi in Marksoft (CVSS 9.8, Marksoft)
- [CVE-2023-34373](https://cve.now/CVE-2023-34373.md): WordPress Zephyr Project Manager Plugin \<= 3.3.93 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Dylan James Zephyr Project Manager)
- [CVE-2023-3318](https://cve.now/CVE-2023-3318.md): SourceCodester Resort Management System cross site scripting (CVSS 3.5, SourceCodester Resort Management System)
- [CVE-2022-46850](https://cve.now/CVE-2022-46850.md): WordPress Easy Media Replace Plugin \<= 0.1.3 is vulnerable to Arbitrary File Deletion (CVSS 8.7, Nabil Lemsieh Easy Media Replace)
- [CVE-2022-47586](https://cve.now/CVE-2022-47586.md): WordPress Ultimate Addons for Contact Form 7 Plugin \<= 3.1.23 is vulnerable to SQL Injection (CVSS 8.2, Themefic Ultimate Addons for Contact Form)
- [CVE-2023-27992](https://cve.now/CVE-2023-27992.md): The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware vers (CVSS 9.8, KEV, Zyxel NAS326 firmware · Zyxel NAS540 firmware +1)
- [CVE-2023-3316](https://cve.now/CVE-2023-3316.md): A NULL pointer dereference in TIFFClose() is caused by a failure to open an output file (non-existent path or a path that requires permissions like /dev/null) while specifying zones. (CVSS 5.9, libtiff)
- [CVE-2023-2812](https://cve.now/CVE-2023-2812.md): Ultimate Dashboard \< 3.7.6 - Admin+ Stored XSS (no CVSS, Ultimate Dashboard)
- [CVE-2023-2805](https://cve.now/CVE-2023-2805.md): SupportCandy \< 3.1.7 - Admin+ SQLi (no CVSS, SupportCandy)
- [CVE-2023-2654](https://cve.now/CVE-2023-2654.md): Conditional Menus \< 1.2.1 - Reflected XSS (CVSS 6.1, Conditional Menus)
- [CVE-2023-2751](https://cve.now/CVE-2023-2751.md): Upload Resume \<= 1.2.0 - Captcha Bypass (CVSS 5.3, Upload Resume)
- [CVE-2023-2399](https://cve.now/CVE-2023-2399.md): qubotchat \< 1.1.6 - Unauthenticated Stored XSS (CVSS 6.1, QuBot)
- [CVE-2023-2527](https://cve.now/CVE-2023-2527.md): Integration for Contact Form 7 and Zoho CRM, Bigin \< 1.2.4 - Admin+ SQLi (CVSS 4.8, Integration for Contact Form 7 and Zoho CRM, Bigin)
- [CVE-2023-0489](https://cve.now/CVE-2023-0489.md): SlideOnline \<= 1.2.1 - Contributor+ Stored XSS (no CVSS, SlideOnline)
- [CVE-2023-2359](https://cve.now/CVE-2023-2359.md): Revolution Slider \<= 6.6.12 - Author+ Remote Code Execution (no CVSS, Slider Revolution)
- [CVE-2023-0368](https://cve.now/CVE-2023-0368.md): Responsive Tabs For WPBakery Page Builder \<= 1.1 - Contributor+ Stored XSS (CVSS 5.4, Responsive Tabs For WPBakery Page Builder)
- [CVE-2023-2600](https://cve.now/CVE-2023-2600.md): Custom Base Terms \< 1.0.3 - Admin+ Stored XSS (CVSS 4.8, Custom Base Terms)
- [CVE-2023-2401](https://cve.now/CVE-2023-2401.md): Qubotchat \< 1.1.6 – Admin+ Stored XSS (CVSS 4.8, QuBot)
- [CVE-2023-2899](https://cve.now/CVE-2023-2899.md): Google Map Shortcode \<= 3.1.2 - Contributor+ Stored XSS (CVSS 5.4, Google Map Shortcode)
- [CVE-2023-2492](https://cve.now/CVE-2023-2492.md): QueryWall: Plug'n Play Firewall \<= 1.1.1 - Admin+ SQLi (CVSS 7.2, QueryWall: Plug'n Play Firewall)
- [CVE-2023-2742](https://cve.now/CVE-2023-2742.md): AI ChatBot \< 4.5.5 - Admin+ Stored Cross-Site Scripting (CVSS 4.8, AI ChatBot)
- [CVE-2023-2719](https://cve.now/CVE-2023-2719.md): SupportCandy \< 3.1.7 - Subscriber+ SQLi (CVSS 8.8, SupportCandy)
- [CVE-2023-2221](https://cve.now/CVE-2023-2221.md): WP Custom Cursors \< 3.2 - Admin+ SQLi (CVSS 7.2, WP Custom Cursors | WordPress Cursor Plugin)
- [CVE-2023-2811](https://cve.now/CVE-2023-2811.md): AI ChatBot \< 4.5.6 - Admin+ Stored Cross-Site Scripting (CVSS 4.8, AI ChatBot)
- [CVE-2023-2684](https://cve.now/CVE-2023-2684.md): File Renaming on Upload \< 2.5.2 - Admin+ Stored Cross-Site Scripting (CVSS 4.8, File Renaming on Upload)
- [CVE-2023-2779](https://cve.now/CVE-2023-2779.md): Super Socializer \< 7.13.52 - Reflected XSS (CVSS 6.1, Social Share, Social Login and Social Comments Plugin)
- [CVE-2019-25136](https://cve.now/CVE-2019-25136.md): A compromised child process could have injected XBL Bindings into privileged CSS rules, resulting in arbitrary code execution and a sandbox (CVSS 10.0, Mozilla Firefox)
- [CVE-2023-34417](https://cve.now/CVE-2023-34417.md): Memory safety bugs present in Firefox 113. (CVSS 9.8, Mozilla Firefox)
- [CVE-2023-34415](https://cve.now/CVE-2023-34415.md): When choosing a site-isolated process for a document loaded from a data: URL that was the result of a redirect, Firefox would load that docu (no CVSS, Mozilla Firefox)
- [CVE-2023-25736](https://cve.now/CVE-2023-25736.md): An invalid downcast from \`nsHTMLDocument\` to \`nsIContent\` could have lead to undefined behavior. (CVSS 9.8, Mozilla Firefox)
- [CVE-2023-25733](https://cve.now/CVE-2023-25733.md): The return value from \`gfx::SourceSurfaceSkia::Map()\` wasn't being verified which could have potentially lead to a null pointer dereference. (CVSS 7.5, Mozilla Firefox)
- [CVE-2023-34416](https://cve.now/CVE-2023-34416.md): Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. (no CVSS, Mozilla Firefox ESR · Mozilla Firefox +1)
- [CVE-2023-34414](https://cve.now/CVE-2023-34414.md): The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses to protect prompts and permission dialo (no CVSS, Mozilla Firefox ESR · Mozilla Firefox +1)
- [CVE-2023-29546](https://cve.now/CVE-2023-29546.md): When recording the screen while in Private Browsing on Firefox for Android the address bar and keyboard were not hidden, potentially leaking (CVSS 6.5, Mozilla Firefox for Android · Mozilla Focus for Android)
- [CVE-2023-29534](https://cve.now/CVE-2023-29534.md): Different techniques existed to obscure the fullscreen notification in Firefox and Focus for Android. (CVSS 9.1, Mozilla Firefox for Android · Mozilla Focus for Android)
- [CVE-2023-25747](https://cve.now/CVE-2023-25747.md): A potential use-after-free in libaudio was fixed by disabling the AAudio backend when running on Android API below version 30. (CVSS 7.5, Mozilla Firefox for Android)
- [CVE-2023-29545](https://cve.now/CVE-2023-29545.md): Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have reso (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-29542](https://cve.now/CVE-2023-29542.md): A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-29532](https://cve.now/CVE-2023-29532.md): A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the service at an update file o (CVSS 5.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-29531](https://cve.now/CVE-2023-29531.md): An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable cr (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-32216](https://cve.now/CVE-2023-32216.md): Mozilla developers and community members Ronald Crane, Andrew McCreight, Randell Jesup and the Mozilla Fuzzing Team reported memory safety b (no CVSS, Mozilla Firefox)
- [CVE-2023-32214](https://cve.now/CVE-2023-32214.md): Protocol handlers \`ms-cxh\` and \`ms-cxh-full\` could have been leveraged to trigger a denial of service. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-32210](https://cve.now/CVE-2023-32210.md): Documents were incorrectly assuming an ordering of principal objects when ensuring we were loading an appropriately privileged principal. (no CVSS, Mozilla Firefox)
- [CVE-2023-32209](https://cve.now/CVE-2023-32209.md): A maliciously crafted favicon could have led to an out of memory crash. (no CVSS, Mozilla Firefox)
- [CVE-2023-32208](https://cve.now/CVE-2023-32208.md): Service workers could reveal script base URL due to dynamic \`import()\`. (no CVSS, Mozilla Firefox)
- [CVE-2023-35005](https://cve.now/CVE-2023-35005.md): Apache Airflow: Information disclosure on configuration view (low (no CVSS), Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2022-48486](https://cve.now/CVE-2022-48486.md): Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability. (CVSS 7.5, Huawei EMUI)
- [CVE-2022-48487](https://cve.now/CVE-2022-48487.md): Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability. (no CVSS, Huawei EMUI)
- [CVE-2022-48488](https://cve.now/CVE-2022-48488.md): Vulnerability of bypassing the default desktop security controls.Successful exploitation of this vulnerability may cause unauthorized modifi (CVSS 5.3, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48489](https://cve.now/CVE-2022-48489.md): Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability. (no CVSS, Huawei EMUI)
- [CVE-2022-48490](https://cve.now/CVE-2022-48490.md): Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability. (no CVSS, Huawei EMUI)
- [CVE-2022-48491](https://cve.now/CVE-2022-48491.md): Vulnerability of missing authentication on certain HUAWEI phones.Successful exploitation of this vulnerability can lead to ads and other win (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48492](https://cve.now/CVE-2022-48492.md): Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability. (no CVSS, Huawei EMUI)
- [CVE-2022-48493](https://cve.now/CVE-2022-48493.md): Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability. (no CVSS, Huawei EMUI)
- [CVE-2022-48494](https://cve.now/CVE-2022-48494.md): Vulnerability of lax app identity verification in the pre-authorization function.Successful exploitation of this vulnerability will cause ma (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48495](https://cve.now/CVE-2022-48495.md): Vulnerability of unauthorized access to foreground app information.Successful exploitation of this vulnerability may cause foreground app in (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48496](https://cve.now/CVE-2022-48496.md): Vulnerability of lax app identity verification in the pre-authorization function.Successful exploitation of this vulnerability will cause ma (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48497](https://cve.now/CVE-2022-48497.md): Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability. (no CVSS, Huawei EMUI)
- [CVE-2022-48498](https://cve.now/CVE-2022-48498.md): Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability. (CVSS 7.5, Huawei EMUI)
- [CVE-2022-48499](https://cve.now/CVE-2022-48499.md): Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability. (CVSS 7.5, Huawei EMUI)
- [CVE-2022-48500](https://cve.now/CVE-2022-48500.md): Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability. (CVSS 7.5, Huawei EMUI)
- [CVE-2022-48501](https://cve.now/CVE-2022-48501.md): Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability. (CVSS 7.5, Huawei EMUI)
- [CVE-2022-48506](https://cve.now/CVE-2022-48506.md): A flawed pseudorandom number generator in Dominion Voting Systems ImageCast Precinct (ICP and ICP2) and ImageCast Evolution (ICE) scanners a (CVSS 2.4)
- [CVE-2023-27396](https://cve.now/CVE-2023-27396.md): FINS (Factory Interface Network Service) is a message communication protocol, which is designed to be used in closed FA (Factory Automation) (CVSS 9.8, Multiple OMRON products which implement FINS protocol)
- [CVE-2023-3022](https://cve.now/CVE-2023-3022.md): A flaw was found in the IPv6 module of the Linux kernel. (CVSS 5.5, Linux Kernel)
- [CVE-2023-30759](https://cve.now/CVE-2023-30759.md): The driver installation package created by Printer Driver Packager NX v1.0.02 to v1.1.25 fails to detect its modification and may spawn an u (CVSS 8.4, Ricoh Company Printer Driver Packager NX)
- [CVE-2023-31239](https://cve.now/CVE-2023-31239.md): Stack-based buffer overflow vulnerability in V-Server v4.0.15.0 and V-Server Lite v4.0.15.0 and earlier allows an attacker to execute arbitr (CVSS 7.8, FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. V-Server…)
- [CVE-2023-32201](https://cve.now/CVE-2023-32201.md): Stack-based buffer overflow vulnerability exists in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0. (CVSS 7.8, FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. TELLUS an…)
- [CVE-2023-32270](https://cve.now/CVE-2023-32270.md): Access of memory location after end of buffer issue exists in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0. (CVSS 7.8, FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. TELLUS an…)
- [CVE-2023-32273](https://cve.now/CVE-2023-32273.md): Stack-based buffer overflow vulnerability exists in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0. (CVSS 7.8, FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. TELLUS an…)
- [CVE-2023-32276](https://cve.now/CVE-2023-32276.md): Stack-based buffer overflow vulnerability exists in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0. (CVSS 7.8, FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. TELLUS an…)
- [CVE-2023-32288](https://cve.now/CVE-2023-32288.md): Out-of-bounds read vulnerability exists in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0. (CVSS 7.8, FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. TELLUS an…)
- [CVE-2023-32538](https://cve.now/CVE-2023-32538.md): Stack-based buffer overflow vulnerability exists in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0. (CVSS 7.8, FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. TELLUS an…)
- [CVE-2023-32542](https://cve.now/CVE-2023-32542.md): Out-of-bounds read vulnerability exists in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0. (CVSS 7.8, FUJI ELECTRIC CO. TELLUS and TELLUS Lite)
- [CVE-2023-3312](https://cve.now/CVE-2023-3312.md): A vulnerability was found in drivers/cpufreq/qcom-cpufreq-hw.c in cpufreq subsystem in the Linux Kernel. (CVSS 7.5, Kernel)
- [CVE-2023-34155](https://cve.now/CVE-2023-34155.md): Vulnerability of unauthorized calling on HUAWEI phones and tablets.Successful exploitation of this vulnerability may affect availability. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-34156](https://cve.now/CVE-2023-34156.md): Vulnerability of services denied by early fingerprint APIs on HarmonyOS products.Successful exploitation of this vulnerability may cause ser (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-34158](https://cve.now/CVE-2023-34158.md): Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-party apps to hide app (CVSS 5.3, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-34159](https://cve.now/CVE-2023-34159.md): Improper permission control vulnerability in the Notepad app.Successful exploitation of the vulnerability may lead to privilege escalation, (CVSS 9.8, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-34160](https://cve.now/CVE-2023-34160.md): Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-party apps to hide app (CVSS 5.3, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-34161](https://cve.now/CVE-2023-34161.md): nappropriate authorization vulnerability in the SettingsProvider module.Successful exploitation of this vulnerability may cause features to (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-34162](https://cve.now/CVE-2023-34162.md): Version update determination vulnerability in the user profile module.Successful exploitation of this vulnerability may cause repeated HMS C (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-34163](https://cve.now/CVE-2023-34163.md): Permission control vulnerability in the window management module.Successful exploitation of this vulnerability may cause features to perform (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-34166](https://cve.now/CVE-2023-34166.md): Vulnerability of system restart triggered by abnormal callbacks passed to APIs.Successful exploitation of this vulnerability may cause the s (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-34167](https://cve.now/CVE-2023-34167.md): Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-party apps to hide app (CVSS 5.3, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-34602](https://cve.now/CVE-2023-34602.md): JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByCode at org.jeecg.mod (CVSS 7.5, org.jeecgframework.boot:jeecg-boot-parent)
- [CVE-2023-34603](https://cve.now/CVE-2023-34603.md): JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictInfo at org.jeecg.modu (CVSS 7.5, org.jeecgframework.boot:jeecg-boot-parent)
- [CVE-2023-34641](https://cve.now/CVE-2023-34641.md): KioWare for Windows through v8.33 was discovered to contain an incomplete blacklist filter for blocked dialog boxes on Windows 10. (CVSS 7.8)
- [CVE-2023-34642](https://cve.now/CVE-2023-34642.md): KioWare for Windows through v8.33 was discovered to contain an incomplete blacklist filter for blocked dialog boxes on Windows 10. (CVSS 7.8)
- [CVE-2023-34657](https://cve.now/CVE-2023-34657.md): A stored cross-site scripting (XSS) vulnerability in Eyoucms v1.6.2 allows attackers to execute arbitrary web scripts or HTML via a crafted (CVSS 4.8)
- [CVE-2023-35839](https://cve.now/CVE-2023-35839.md): A bypass in the component sofa-hessian of Solon before v2.3.3 allows attackers to execute arbitrary code via providing crafted payload. (no CVSS, org.noear:solon)
- [CVE-2023-35840](https://cve.now/CVE-2023-35840.md): \_joinPath in elFinderVolumeLocalFileSystem.class.php in elFinder before 2.1.62 allows path traversal in the PHP LocalVolumeDriver connector. (CVSS 6.5, studio-42/elfinder)
- [CVE-2023-35843](https://cve.now/CVE-2023-35843.md): NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on (CVSS 7.5)
- [CVE-2023-35844](https://cve.now/CVE-2023-35844.md): packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .. (CVSS 7.5)
- [CVE-2023-35846](https://cve.now/CVE-2023-35846.md): VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 does not check the transport layer length in a frame before performing port filtering. (CVSS 7.5)
- [CVE-2023-35847](https://cve.now/CVE-2023-35847.md): VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 does not have an MSS lower bound (e.g., it could be zero). (no CVSS)
- [CVE-2023-35848](https://cve.now/CVE-2023-35848.md): VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 lacks certain size calculations before attempting to set a value of an mss structure memb (no CVSS)
- [CVE-2023-35849](https://cve.now/CVE-2023-35849.md): VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 does not properly check whether header sizes would result in accessing data outside of a (no CVSS)
- [CVE-2023-35852](https://cve.now/CVE-2023-35852.md): In Suricata before 6.0.13 (when there is an adversary who controls an external source of rules), a dataset filename, that comes from a rule, (no CVSS)
- [CVE-2023-35853](https://cve.now/CVE-2023-35853.md): In Suricata before 6.0.13, an adversary who controls an external source of Lua rules may be able to execute Lua code. (no CVSS)
- [CVE-2023-35855](https://cve.now/CVE-2023-35855.md): A buffer overflow in Counter-Strike through 8684 allows a game server to execute arbitrary code on a remote client's machine by modifying th (no CVSS)
- [CVE-2023-35856](https://cve.now/CVE-2023-35856.md): A buffer overflow in Nintendo Mario Kart Wii RMCP01, RMCE01, RMCJ01, and RMCK01 can be exploited by a game client to execute arbitrary code (no CVSS)
- [CVE-2023-35857](https://cve.now/CVE-2023-35857.md): In Siren Investigate before 13.2.2, session keys remain active even after logging out. (no CVSS)
- [CVE-2023-35862](https://cve.now/CVE-2023-35862.md): libcoap 4.3.1 contains a buffer over-read via the function coap\_parse\_oscore\_conf\_mem at coap\_oscore.c. (no CVSS)
- [CVE-2023-35866](https://cve.now/CVE-2023-35866.md): In KeePassXC through 2.7.5, a local attacker can make changes to the Database security settings, including master password and second-factor (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-06-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.