CVEs published June 22, 2023
111 CVEs were published on June 22, 2023: 3 critical, 29 high.
- Published
- 111
- Critical
- 3
- High
- 29
- Medium
- 38
- Low
- 4
- Unrated
- 37
- Now in CISA KEV
- 0
- Fix available
- 28
Most affected products
- VMware vCenter Server · VMware Cloud Foundation
- 5
- Fortra Globalscape EFT
- 3
- HCL Software HCL BigFix OSD Bare Metal Server
- 3
- moodle · moodle/moodle
- 3
- Advantech R-SeeNet
- 2
- Paul Ryley Site Reviews
- 2
- StylemixThemes MasterStudy LMS WordPress Plugin – for Onlin…
- 2
- Zscaler Client Connector
- 2
- Aakif Kadiwala Tags Cloud Manager
- 1
- AGILELOGIX Store Locator WordPress
- 1
Critical 3
- CVE-2023-3128Grafana is validating Azure AD accounts based on the email claim.Grafana · github.com/grafana/grafana
- CVE-2023-2611Advantech R-SeeNet Use of Hard-coded CredentialsAdvantech R-SeeNet
- CVE-2023-29711An incorrect access control issue was discovered in Interlink PSG-5124 version 1.0.4, allows attackers to execute arbitrary code via crafted
High 29
- CVE-2023-28006HCL BigFix OSD Bare Metal Server is affected by a weak cryptographic algorithm.HCL Software HCL BigFix OSD Bare Metal Server
- CVE-2023-32320Nextcloud Server's brute force protection allows someone to send more requests than intendednextcloud security-advisories
- CVE-2023-28800Output encoding missing in redrurl parameterZscaler Client Connector
- CVE-2023-28799A URL parameter during login flow was vulnerable to injection.Zscaler Client Connector
- CVE-2023-3256Advantech R-SeeNet External Control of File Name or PathAdvantech R-SeeNet
- CVE-2023-35174Livebook Desktop's protocol handler can be exploited to execute arbitrary command on Windowslivebook-dev livebook
- CVE-2023-35926Insecure sandbox in Backstage Scaffolder pluginbackstage · @backstage/plugin-scaffolder-backend
- CVE-2023-33997WordPress bbp style pack Plugin <= 5.5.5 is vulnerable to Cross Site Scripting (XSS)Robin Wilson bbp style pack
- CVE-2023-32960WordPress UpdraftPlus Plugin <= 1.23.3 is vulnerable to Cross Site Request Forgery (CSRF)UpdraftPlus.Com, DavidAnderson UpdraftPlus WordPress Backup…
- CVE-2022-47593WordPress RapidLoad Power-Up for Autoptimize Plugin <= 1.6.35 is vulnerable to SQL InjectionRapidLoad Power-Up for Autoptimize
- CVE-2023-28418WordPress Mediciti Lite Theme <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)Yudlee themes Mediciti Lite
- CVE-2023-20895The VMware vCenter Server contains a memory corruption vulnerability in the implementation of the DCERPC protocol.VMware vCenter Server · VMware Cloud Foundation
- CVE-2023-20894The VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol.VMware vCenter Server · VMware Cloud Foundation
- CVE-2023-20893The VMware vCenter Server contains a use-after-free vulnerability in the implementation of the DCERPC protocol.VMware vCenter Server · VMware Cloud Foundation
- CVE-2023-35918WordPress WooCommerce Bulk Stock Management Plugin <= 2.2.33 is vulnerable to Cross Site Scripting (XSS)WooCommerce Bulk Stock Management
- CVE-2023-20892VMware vCenter Server heap-overflow vulnerabilityVMware vCenter Server · VMware Cloud Foundation
- CVE-2023-23795WordPress Form Builder Plugin <= 1.9.9.0 is vulnerable to Cross Site Request Forgery (CSRF)Muneeb Form Builder
- CVE-2023-28776WordPress Continuous Image Carousel With Lightbox Plugin <= 1.0.15 is vulnerable to Cross Site Scripting (XSS)I Thirteen Web Solution Continuous Image Carousel With Ligh…
- CVE-2023-28750WordPress Albo Pretorio Online Plugin <= 4.6 is vulnerable to Cross Site Scripting (XSS)Ignazio Scimone Albo Pretorio On line
- CVE-2023-28784WordPress Contest Gallery Plugin <= 21.1.2 is vulnerable to Cross Site Scripting (XSS)Contest Gallery
- CVE-2023-28166WordPress Tags Cloud Manager Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)Aakif Kadiwala Tags Cloud Manager
- CVE-2023-32449 Dell PowerStore versions prior to 3.5 contain an improper verification of cryptographic signature vulnerability.Dell PowerStore
- CVE-2019-25152Abandoned Cart Lite for WooCommerce < 5.2.0 and Abandoned Cart Pro for WooCommerce < 7.13.0 - Stored Cross-Site Scriptingtychesoftwares Abandoned Cart Lite for WooCommerce · TYCHE…
- CVE-2023-28956IBM Spectrum Protect Backup-Archive Client privilege escalationIBM Spectrum Protect Backup-Archive Client
- CVE-2023-28094Pega platform clients who are using versions 7.4 through 8.8.x and have upgraded from a version prior to 8.x may be utilizing default credenPegasystems Pega Platform
- CVE-2023-29709An issue was discovered in /cgi-bin/login_rj.cgi in Wildix WSG24POE version 103SP7D190822, allows attackers to bypass authentication.
- CVE-2023-35133Moodle: ssrf risk due to insufficient check on the curl blocked hostsmoodle · moodle/moodle
- CVE-2023-36358TP-Link TL-WR940N V2/V3/V4, TL-WR941ND V5/V6, TL-WR743ND V1 and TL-WR841N V8 were discovered to contain a buffer overflow in the component /
- CVE-2023-36359TP-Link TL-WR940N V4, TL-WR841N V8/V10, TL-WR940N V2/V3 and TL-WR941ND V5/V6 were discovered to contain a buffer overflow in the component /
Medium, low and unrated 79
- CVE-2023-34462netty-handler SniHandler 16MB allocationnetty · io.netty:netty-handler
- CVE-2023-34241CUPS vulnerable to use-after-free in cupsdAcceptClient()OpenPrinting cups
- CVE-2023-34110Flask-AppBuilder vulnerable to possible disclosure of sensitive information on user errordpgaspar Flask-AppBuilder · flask-appbuilder
- CVE-2023-28016HCL BigFix OSD Bare Metal Server is affected by a host header injection vulnerabilityHCL Software HCL BigFix OSD Bare Metal Server
- CVE-2023-3114Terraform Enterprise Agent Pool Controls Allowed Unauthorized Workspaces To Target an Agent PoolHashiCorp Terraform Enterprise
- CVE-2023-23343HCL BigFix OSD Bare Metal Server version 311.12 or lower is affected by a clickjacking vulnerability.HCL Software HCL BigFix OSD Bare Metal Server
- CVE-2023-2991Fortra Globalscape Administration Server Information DisclosureFortra Globalscape EFT
- CVE-2023-2990Fortra Globalscape Administration Server Denial of ServiceFortra Globalscape EFT
- CVE-2023-2989Fortra Globalscape Administration Server Out of Bounds Memory ReadFortra Globalscape EFT
- CVE-2023-3326Network authentication attack via pam_krb5FreeBSD
- CVE-2023-34170WordPress Quick/Bulk Order Form for WooCommerce Plugin <= 3.5.7 is vulnerable to Cross Site Scripting (XSS)WP Overnight Quick/Bulk Order Form for WooCommerce
- CVE-2023-34028WordPress WOLF Plugin <= 1.0.7 is vulnerable to Cross Site Request Forgery (CSRF)realmag777 WOLF – WordPress Posts Bulk Editor and Manager P…
- CVE-2023-34006WordPress Telegram Bot & Channel Plugin <= 3.6.2 is vulnerable to Cross Site Scripting (XSS)Marco Milesi Telegram Bot & Channel
- CVE-2023-25500Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1vaadin · flow-server +2
- CVE-2023-25499Possible information disclosure in non visible componentsvaadin · com.vaadin:vaadin +1
- CVE-2023-28774WordPress Review Stream Plugin <= 1.6.5 is vulnerable to Cross Site Scripting (XSS)Grade Us Review Stream
- CVE-2023-34368WordPress Kanban Boards for WordPress Plugin <= 2.5.20 is vulnerable to Cross Site Scripting (XSS)Kanban for WordPress Kanban Boards for WordPress
- CVE-2023-33323WordPress ARMember Plugin <= 4.0.2 is vulnerable to Cross Site Scripting (XSS)Repute InfoSystems ARMember
- CVE-2023-32239WordPress WoodMart Theme <= 7.2.1 is vulnerable to Cross Site Scripting (XSS)xtemos WoodMart
- CVE-2023-20896The VMware vCenter Server contains an out-of-bounds read vulnerability in the implementation of the DCERPC protocol.VMware vCenter Server · VMware Cloud Foundation
- CVE-2023-28174WordPress eRocket Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS)eLightUp eRocket
- CVE-2023-27452WordPress Button Generator – easily Button Builder Plugin <= 2.3.3 is vulnerable to Cross Site Scripting (XSS)Wow-Company Button Generator – easily Button Builder
- CVE-2023-26534WordPress WP Repost Plugin <= 0.1 is vulnerable to Cross Site Scripting (XSS)OneWebsite WP Repost
- CVE-2023-26539WordPress Advanced Text Widget Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS)Max Chirkov Advanced Text Widget
- CVE-2023-35917WordPress WooCommerce PayPal Payments Plugin <= 2.0.4 is vulnerable to Cross Site Request Forgery (CSRF)WooCommerce PayPal Payments
- CVE-2023-30500WordPress WPForms plugins - Reflected Cross Site Scripting (XSS) vulnerabilityWPForms Lite · WPForms Pro
- CVE-2023-23811WordPress Smoothscroller Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)Neil Gee Smoothscroller
- CVE-2023-23807WordPress MojoPlug Slide Panel Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)Qumos MojoPlug Slide Panel
- CVE-2023-28778WordPress Pagination by BestWebSoft Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS)BestWebSoft Pagination
- CVE-2023-35093WordPress MasterStudy LMS Plugin <= 3.0.8 is vulnerable to Broken Access ControlStylemixThemes MasterStudy LMS WordPress Plugin – for Onlin…
- CVE-2023-35090WordPress MasterStudy LMS Plugin <= 3.0.8 is vulnerable to Cross Site Scripting (XSS)StylemixThemes MasterStudy LMS WordPress Plugin – for Onlin…
- CVE-2023-31213WordPress WPBakery Page Builder Plugin < 6.13.0 is vulnerable to Cross Site Scripting (XSS)WPBakery Page Builder
- CVE-2023-28695WordPress VigilanTor Plugin <= 1.3.10 is vulnerable to Cross Site Scripting (XSS)Drew Phillips VigilanTor
- CVE-2023-27618WordPress Store Locator WordPress Plugin <= 1.4.9 is vulnerable to Cross Site Scripting (XSS)AGILELOGIX Store Locator WordPress
- CVE-2023-28534WordPress WP Job Portal Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)WP Job Portal – A Complete Job Board
- CVE-2023-28496WordPress SMTP2GO Plugin <= 1.4.2 is vulnerable to Cross Site Scripting (XSS)SMTP2GO – Email Made Easy
- CVE-2023-28423WordPress Modern Footnotes Plugin <= 1.4.15 is vulnerable to Cross Site Scripting (XSS)Prism Tech Studios Modern Footnotes
- CVE-2023-28171WordPress Brilliance Theme <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)WP Chill Brilliance
- CVE-2023-27612WordPress Site Reviews Plugin <= 6.5.1 is vulnerable to Cross Site Scripting (XSS)Paul Ryley Site Reviews
- CVE-2023-27629WordPress Site Reviews Plugin <= 6.5.1 is vulnerable to Cross Site Scripting (XSS)Paul Ryley Site Reviews
- CVE-2023-27413WordPress W4 Post List Plugin <= 2.4.4 is vulnerable to Cross Site Scripting (XSS)Shazzad Hossain Khan W4 Post List
- CVE-2023-27631WordPress Daily Prayer Time Plugin <= 2023.05.04 is vulnerable to Cross Site Scripting (XSS)mmrs151 Daily Prayer Time
- CVE-2023-26115All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regularword-wrap · org.webjars.npm:word-wrap
- CVE-2023-33842IBM SPSS Modeler information disclosureIBM SPSS Modeler
- CVE-2023-27083An issue discovered in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev5 allows remote attackers to run arbitrary code via manage file func
- CVE-2023-29707Cross Site Scripting (XSS) vulnerability in GBCOM LAC WEB Control Center version lac-1.3.x, allows attackers to create an arbitrary device.
- CVE-2023-29708An issue was discovered in /cgi-bin/adm.cgi in WavLink WavRouter version RPT70HA1.x, allows attackers to force a factory reset via crafted p
- CVE-2023-29931laravel-s 3.7.35 is vulnerable to Local File Inclusion via /src/Illuminate/Laravel.php.hhxsv5/laravel-s
- CVE-2023-30347Cross Site Scripting (XSS) vulnerability in Neox Contact Center 2.3.9, via the serach_sms_api_name parameter to the SMA API search.
- CVE-2023-31867Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection.
- CVE-2023-31868Sage X3 version 12.14.0.50-0 is vulnerable to Cross Site Scripting (XSS).
- CVE-2023-32571Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods inSystem.Linq.Dynamic.Core
- CVE-2023-33387A reflected cross-site scripting (XSS) vulnerability in DATEV eG Personal-Management System Comfort/Comfort Plus v15.1.0 to v16.1.1 P4 allow
- CVE-2023-34553An issue was discovered in WAFU Keyless Smart Lock v1.0 allows attackers to unlock a device via code replay attack.
- CVE-2023-34601Jeesite before commit 10742d3 was discovered to contain a SQL injection vulnerability via the component ${businessTable} at /act/ActDao.xml.
- CVE-2023-34796Cross site scripting (XSS) vulnerabiliy in dmarcts-report-viewer dashboard versions 1.1 and thru commit 8a1d882b4c481a05e296e9b38a7961e91214
- CVE-2023-34923XML Signature Wrapping (XSW) in SAML-based Single Sign-on feature in TOPdesk v12.10.12 allows bad actors with credentials to authenticate wi
- CVE-2023-34927Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint /api/set-password.github.com/casdoor/casdoor
- CVE-2023-34939Onlyoffice Community Server before v12.5.2 was discovered to contain a remote code execution (RCE) vulnerability via the component UploadPro
- CVE-2023-35131Moodle: xss risk on groups pagemoodle · moodle/moodle
- CVE-2023-35132Moodle: minor sql injection risk on mnet sso access control pagemoodle · moodle/moodle
- CVE-2023-36093There is a storage type cross site scripting (XSS) vulnerability in the filing number of the Basic Information tab on the backend management
- CVE-2023-36097funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install.funadmin/funadmin
- CVE-2023-36239libming listswf 0.4.7 was discovered to contain a buffer overflow in the parseSWF_DEFINEFONTINFO() function at parser.c.
- CVE-2023-36243FLVMeta v1.2.1 was discovered to contain a buffer overflow via the xml_on_metadata_tag_only function at dump_xml.c.
- CVE-2023-36354TP-Link TL-WR940N V4, TL-WR841N V8/V10, TL-WR740N V1/V2, TL-WR940N V2/V3, and TL-WR941ND V5/V6 were discovered to contain a buffer overflow
- CVE-2023-36355TP-Link TL-WR940N V4 was discovered to contain a buffer overflow via the ipStart parameter at /userRpm/WanDynamicIpV6CfgRpm.
- CVE-2023-36356TP-Link TL-WR940N V2/V4/V6, TL-WR841N V8, TL-WR941ND V5, and TL-WR740N V1/V2 were discovered to contain a buffer read out-of-bounds via the
- CVE-2023-36357An issue in the /userRpm/LocalManageControlRpm component of TP-Link TL-WR940N V2/V4/V6, TL-WR841N V8/V10, and TL-WR941ND V5 allows attackers
- CVE-2023-36362An issue in the rel_sequences component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via cra
- CVE-2023-36363An issue in the __nss_database_lookup component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS)
- CVE-2023-36364An issue in the rel_deps component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted
- CVE-2023-36365An issue in the sql_trans_copy_key component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) vi
- CVE-2023-36366An issue in the log_create_delta component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause Denial of Service (DoS) via cr
- CVE-2023-36367An issue in the BLOBcmp component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted S
- CVE-2023-36368An issue in the cs_bind_ubat component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via craf
- CVE-2023-36369An issue in the list_append component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via craft
- CVE-2023-36370An issue in the gc_col component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQ
- CVE-2023-36371An issue in the GDKfree component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted S