# CVEs published 2023-06-21 29 CVEs were published on June 21, 2023: 5 critical, 14 high. Days are UTC. - [CVE-2023-3110](https://cve.now/CVE-2023-3110.md): Buffer overflow in S0 Decryption on Unify Gateway (CVSS 9.6, Silicon Labs Unify Gateway) - [CVE-2023-0972](https://cve.now/CVE-2023-0972.md): Buffer overflow in S0 Decryption on Z/IP Gatweay (CVSS 9.6, Silicon Labs Z/IP Gateway) - [CVE-2023-0971](https://cve.now/CVE-2023-0971.md): Command Authentication Bypass in Z/IP Gateway (CVSS 9.6, Silicon Labs Z/IP Gateway) - [CVE-2023-0970](https://cve.now/CVE-2023-0970.md): Serial API Buffer Overflow in Z/IP Gateway (CVSS 7.1, Silicon Labs Z/IP Gateway) - [CVE-2023-0969](https://cve.now/CVE-2023-0969.md): Global read overflow in Z/IP Gateway (CVSS 3.5, Silicon Labs Z/IP Gateway) - [CVE-2023-2911](https://cve.now/CVE-2023-2911.md): Exceeding the recursive-clients quota may cause named to terminate unexpectedly when stale-answer-client-timeout is set to 0 (CVSS 7.5, ISC BIND) - [CVE-2023-2829](https://cve.now/CVE-2023-2829.md): Malformed NSEC records can cause named to terminate unexpectedly when synth-from-dnssec is enabled (CVSS 7.5, ISC BIND) - [CVE-2023-2828](https://cve.now/CVE-2023-2828.md): named's configured cache size limit can be significantly exceeded (CVSS 7.5, ISC BIND) - [CVE-2023-27414](https://cve.now/CVE-2023-27414.md): WordPress Popup box Plugin \<= 3.4.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Popup Box Team Popup box) - [CVE-2023-27429](https://cve.now/CVE-2023-27429.md): WordPress Jetpack CRM Plugin \<= 5.4.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Automattic - Jetpack CRM team Jetpack CRM) - [CVE-2023-27432](https://cve.now/CVE-2023-27432.md): WordPress Manage Upload Limit Plugin \<= 1.0.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, WpSimpleTools Manage Upload Limit) - [CVE-2023-27439](https://cve.now/CVE-2023-27439.md): WordPress New Adman Plugin \<= 1.6.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, gl\_SPICE New Adman) - [CVE-2023-27450](https://cve.now/CVE-2023-27450.md): WordPress Leyka Plugin \<= 3.29.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Teplitsa of social technologies Leyka) - [CVE-2022-3372](https://cve.now/CVE-2022-3372.md): Cross-Site Request Forgery (CSRF) in Riello UPS Netman-204 (CVSS 8.8, Riello UPS Netman-204) - [CVE-2023-27443](https://cve.now/CVE-2023-27443.md): WordPress Simple Vimeo Shortcode Plugin \<= 2.9.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Grant Kimball Simple Vimeo Shortcode) - [CVE-2023-34981](https://cve.now/CVE-2023-34981.md): Apache Tomcat: AJP response header mix-up (CVSS 7.5, Apache Software Foundation Apache Tomcat · org.apache.to… +1) - [CVE-2023-34340](https://cve.now/CVE-2023-34340.md): Apache Accumulo: Accumulo 2.1.0 may incorrectly validate cached credentials (CVSS 9.8, Apache Software Foundation Apache Accumulo · org.apache.acc…) - [CVE-2023-3339](https://cve.now/CVE-2023-3339.md): code-projects Agro-School Management System exam-delete.php sql injection (CVSS 6.3, code-projects Agro-School Management System) - [CVE-2022-25883](https://cve.now/CVE-2022-25883.md): Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when (CVSS 5.3, semver) - [CVE-2022-45287](https://cve.now/CVE-2022-45287.md): An access control issue in Registration.aspx of Temenos CWX 8.5.6 allows authenticated attackers to escalate privileges and perform arbitrar (CVSS 8.8) - [CVE-2023-0026](https://cve.now/CVE-2023-0026.md): 2023-06: Out-of-Cycle Security Bulletin: Junos OS and Junos OS Evolved: A BGP session will flap upon receipt of a specific, optional transitive attribute (CVSS 7.5, Juniper Networks Junos OS) - [CVE-2023-24261](https://cve.now/CVE-2023-24261.md): A vulnerability in GL.iNET GL-E750 Mudi before firmware v3.216 allows authenticated attackers to execute arbitrary code via a crafted POST r (CVSS 7.2) - [CVE-2023-25435](https://cve.now/CVE-2023-25435.md): libtiff 4.5.0 is vulnerable to Buffer Overflow via extractContigSamplesShifted8bits() at /libtiff/tools/tiffcrop.c:3753. (CVSS 5.5) - [CVE-2023-27243](https://cve.now/CVE-2023-27243.md): An access control issue in Makves DCAP v3.0.0.122 allows unauthenticated attackers to obtain cleartext credentials via a crafted web request (CVSS 7.5) - [CVE-2023-33289](https://cve.now/CVE-2023-33289.md): The urlnorm crate through 0.1.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to lib.rs. (CVSS 7.5) - [CVE-2023-33405](https://cve.now/CVE-2023-33405.md): Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect. (CVSS 6.1) - [CVE-2023-33584](https://cve.now/CVE-2023-33584.md): Sourcecodester Enrollment System Project V1.0 is vulnerable to SQL Injection (SQLI) attacks, which allow an attacker to manipulate the SQL q (CVSS 9.8) - [CVE-2023-33591](https://cve.now/CVE-2023-33591.md): User Registration & Login and User Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the compo (CVSS 6.1) - [CVE-2023-33725](https://cve.now/CVE-2023-33725.md): Broadleaf 5.x and 6.x (including 5.2.25-GA and 6.2.6-GA) was discovered to contain a cross-site scripting (XSS) vulnerability via a customer (CVSS 6.1, org.broadleafcommerce:broadleaf) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2023-06-21 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.