CVEs published June 20, 2023
64 CVEs were published on June 20, 2023: 12 critical, 22 high. 1 is now in CISA KEV.
- Published
- 64
- Critical
- 12
- High
- 22
- Medium
- 26
- Low
- 3
- Unrated
- 1
- Now in CISA KEV
- 1
- Fix available
- 8
Most affected products
- OX Software OX App Suite
- 9
- feehi/cms
- 2
- Chromium libwebp
- 1
- Cloudflare WARP Client
- 1
- craftcms/cms
- 1
- Devolutions Server
- 1
- Enphase Envoy
- 1
- Enphase Installer Toolkit
- 1
- EventPrime
- 1
- Flothemes Flo Forms – Easy Drag & Drop Form Builder
- 1
Critical 12
- CVE-2023-35166Privilege escalation (PR) from account through TipsPanelxwiki-platform · org.xwiki.platform:xwiki-platform-help-ui
- CVE-2020-20413SQL injection vulnerability found in WUZHICMS v.4.1.0 allows a remote attacker to execute arbitrary code via the checktitle() function in ad
- CVE-2020-20703Buffer Overflow vulnerability in VIM v.8.1.2135 allows a remote attacker to execute arbitrary code via the operand parameter.
- CVE-2020-20718File Upload vulnerability in PluckCMS v.4.7.10 dev versions allows a remote attacker to execute arbitrary code via a crafted image file to t
- CVE-2020-20735File Upload vulnerability in LJCMS v.4.3.R60321 allows a remote attacker to execute arbitrary code via the ljcms/index.php parameter.
- CVE-2020-21174File Upload vulenrability in liufee CMS v.2.0.7.1 allows a remote attacker to execute arbitrary code via the image suffix function.feehi/cms
- CVE-2020-21474File Upload vulnerability in NucleusCMS v.3.71 allows a remote attacker to execute arbitrary code via the /nucleus/plugins/skinfiles/?dir=rs
- CVE-2020-21489File Upload vulnerability in Feehicms v.2.0.8 allows a remote attacker to execute arbitrary code via the /admin/index.php?r=admin-user%2Fupdfeehi/cms
- CVE-2023-34541Langchain 0.0.171 is vulnerable to Arbitrary code execution in load_prompt.langchain
- CVE-2023-34563netgear R6250 Firmware Version 1.0.4.48 is vulnerable to Buffer Overflow after authentication.
- CVE-2023-34600Adiscon LogAnalyzer v4.1.13 and before is vulnerable to SQL Injection.
- CVE-2023-35885CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication.
High 22
- CVE-2023-32274Enphase Installer Toolkit Android App Use of Hard-coded CredentialsEnphase Installer Toolkit
- CVE-2023-2533PaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRFPaperCut NG/MF
- CVE-2023-3337PuneethReddyHC Online Shopping System Advanced Admin Registration reg.php improper authenticationPuneethReddyHC Online Shopping System Advanced
- CVE-2023-35097WordPress WP Affiliate Links Plugin <= 0.1.1 is vulnerable to Cross Site Scripting (XSS)Internet Marketing Dojo WP Affiliate Links
- CVE-2023-35098WordPress NextGen GalleryView Plugin <= 0.5.5 is vulnerable to Cross Site Scripting (XSS)John Brien WordPress NextGen GalleryView
- CVE-2023-1862Remote access to warp-svc.exe in Cloudflare WARPCloudflare WARP Client
- CVE-2023-26436Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during deOX Software OX App Suite
- CVE-2023-35884WordPress EventPrime Plugin <= 3.0.5 is vulnerable to Cross Site Scripting (XSS)EventPrime
- CVE-2023-3325CMS Commander <= 2.287 - Authorization Bypass through Use of Insufficiently Unique Cryptographic Signaturethoefter CMS Commander – Manage Multiple Sites
- CVE-2020-20067File upload vulnerability in ebCMS v.1.1.0 allows a remote attacker to execute arbitrary code via the upload type parameter.
- CVE-2020-20335Buffer Overflow vulnerability in Antirez Kilo before commit 7709a04ae8520c5b04d261616098cebf742f5a23 allows a remote attacker to cause a den
- CVE-2020-20491SQL injection vulnerability in OpenCart v.2.2.00 thru 3.0.3.2 allows a remote attacker to execute arbitrary code via the Fba plugin function
- CVE-2020-20636SQL injection vulnerability found in Joyplus-cms v.1.6.0 allows a remote attacker to access sensitive information via the id parameter of th
- CVE-2020-20726Cross Site Request Forgery vulnerability in Gila GilaCMS v.1.11.4 allows a remote attacker to execute arbitrary code via the cm/update_rows/gilacms/gila
- CVE-2020-20918An issue discovered in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary php code via the hidden parameter to admin.php
- CVE-2020-20919File upload vulnerability in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary code and access sensitive information via
- CVE-2020-20969File Upload vulnerability in PluckCMS v.4.7.10 allows a remote attacker to execute arbitrary code via the trashcan_restoreitem.php file.
- CVE-2020-21252Cross Site Request Forgery vulnerability in Neeke HongCMS 3.0.0 allows a remote attacker to execute arbitrary code and escalate privileges v
- CVE-2020-21325An issue in WUZHI CMS v.4.1.0 allows a remote attacker to execute arbitrary code via the set_chache method of the function\common.func.php f
- CVE-2020-21366Cross Site Request Forgery vulnerability in GreenCMS v.2.3 allows an attacker to gain privileges via the adduser function of index.php.
- CVE-2020-21400SQL injection vulnerability in gaozhifeng PHPMyWind v.5.6 allows a remote attacker to execute arbitrary code via the id variable in the modi
- CVE-2020-21486SQL injection vulnerability in PHPOK v.5.4.
Medium, low and unrated 30
- CVE-2023-33869Enphase Envoy OS Command InjectionEnphase Envoy
- CVE-2023-2400Improper deletion of resource in the user management feature in Devolutions Server 2023.1.8 and earlier allows an administrator to view useDevolutions Server
- CVE-2023-3340SourceCodester Online School Fees System GET Parameter ajx.php sql injectionSourceCodester Online School Fees System
- CVE-2023-35095WordPress Flo Forms Plugin <= 1.0.40 is vulnerable to Cross Site Scripting (XSS)Flothemes Flo Forms – Easy Drag & Drop Form Builder
- CVE-2023-1999Use after free in libwebpChromium libwebp
- CVE-2023-35878WordPress Extra User Details Plugin <= 0.5 is vulnerable to Cross Site Scripting (XSS)Vadym K. Extra User Details
- CVE-2023-35882WordPress Super Socializer Plugin <= 7.13.52 is vulnerable to Cross Site Scripting (XSS)Team Heateor Super Socializer
- CVE-2023-26435It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT documents.OX Software OX App Suite
- CVE-2023-26434When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes.OX Software OX App Suite
- CVE-2023-26433When adding an external mail account, processing of IMAP "capabilities" responses are not limited to plausible sizes.OX Software OX App Suite
- CVE-2023-26432When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes.OX Software OX App Suite
- CVE-2023-26431IPv4-mapped IPv6 addresses did not get recognized as "local" by the code and a connection attempt is made.OX Software OX App Suite
- CVE-2023-26429Control characters were not removed when exporting user feedback content.OX Software OX App Suite
- CVE-2023-26428Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same context.OX Software OX App Suite
- CVE-2023-26427Default permissions for a properties file were too permissive.OX Software OX App Suite
- CVE-2023-3320The WP Sticky Social plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1.musilda WP Sticky Social
- CVE-2020-20070Cross Site Scripting vulnerability found in wkeyuan DWSurvey 1.0 allows a remote attacker to execute arbitrary code via thequltemld paramete
- CVE-2020-20502Cross Site Request Forgery found in yzCMS v.2.0 allows a remote attacker to execute arbitrary code via the token check function.
- CVE-2020-20697Cross Site Scripting vulnerability in khodakhah NodCMS v.3.0 allows a remote attacker to execute arbitrary code and gain access to senstiviekhodakhah/nodcms
- CVE-2020-20725Cross Site Scripting vulnerability in taogogo taoCMS v.2.5 beta5.1 allows remote attacker to execute arbitrary code via the name field in ad
- CVE-2020-21052Cross Site Scripting vulnerability in zrlog zrlog v.2.1.3 allows a remote attacker to execute arbitrary code via the nickame parameter of th
- CVE-2020-21058Cross Site Scripting vulnerability in Typora v.0.9.79 allows a remote attacker to execute arbitrary code via the mermaid sytax.
- CVE-2020-21246Cross Site Scripting vulnerability in YiiCMS v.1.0 allows a remote attacker to execute arbitrary code via the news function.sheng/yiicms
- CVE-2020-21268Cross Site Scripting vulnerability in EasySoft ZenTao v.11.6.4 allows a remote attacker to execute arbitrary code via the lastComment parame
- CVE-2020-21485Cross Site Scripting vulnerability in Alluxio v.1.8.1 allows a remote attacker to executea arbitrary code via the path parameter in the broworg.alluxio:alluxio-parent
- CVE-2023-3220An issue was discovered in the Linux kernel through 6.1-rc8.Linux kernel
- CVE-2023-33495Craft CMS through 4.4.9 is vulnerable to HTML Injection.craftcms/cms
- CVE-2023-34596A vulnerability in Aeotec WallMote Switch firmware v2.3 allows attackers to cause a Denial of Service (DoS) via a crafted Z-Wave message.
- CVE-2023-34597A vulnerability in Fibaro Motion Sensor firmware v3.4 allows attackers to cause a Denial of Service (DoS) via a crafted Z-Wave message.
- CVE-2023-35854Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session