# CVEs published 2023-06-23

191 CVEs were published on June 23, 2023: 15 critical, 27 high. 6 are now in CISA KEV. Days are UTC.

- [CVE-2023-1721](https://cve.now/CVE-2023-1721.md): Yoga Class Registration System 1.0 - RCE (CVSS 9.1, Yoga Class Registration System)
- [CVE-2023-1783](https://cve.now/CVE-2023-1783.md): OrangeScrum 2.0.11 - AWS Credentials Leak via PDF Rendering (CVSS 6.5, Orangescrum)
- [CVE-2023-35932](https://cve.now/CVE-2023-35932.md): jcvi vulnerable to Configuration Injection due to unsanitized user input (CVSS 7.1, tanghaibao jcvi · jcvi)
- [CVE-2023-35928](https://cve.now/CVE-2023-35928.md): Nextcloud user scoped external storage can be used to gather credentials of other users (CVSS 8.5, nextcloud security-advisories)
- [CVE-2023-35927](https://cve.now/CVE-2023-35927.md): Nextcloud system addressbooks can be modified by malicious trusted server (CVSS 7.6, nextcloud security-advisories)
- [CVE-2023-35173](https://cve.now/CVE-2023-35173.md): End-to-End encrypted file-drops can be made inaccessible (CVSS 5.7, nextcloud security-advisories)
- [CVE-2023-35172](https://cve.now/CVE-2023-35172.md): Nextcloud Server password reset endpoint is not brute force protected (CVSS 8.7, nextcloud security-advisories)
- [CVE-2023-35171](https://cve.now/CVE-2023-35171.md): Nextcloud Server vulnerable to open redirect on "Unsupported browser" warning (CVSS 4.1, nextcloud security-advisories)
- [CVE-2023-35169](https://cve.now/CVE-2023-35169.md): php-imap vulnerable to RCE through a directory traversal vulnerability (CVSS 9.1, Webklex php-imap · webklex/php-imap +1)
- [CVE-2023-35165](https://cve.now/CVE-2023-35165.md): AWS CDK EKS overly permissive trust policies (CVSS 6.6, aws-cdk · aws-cdk-lib +1)
- [CVE-2023-35163](https://cve.now/CVE-2023-35163.md): Vega's validators able to submit duplicate transactions (CVSS 6.0, vegaprotocol vega · code.vegaprotocol.io/vega)
- [CVE-2023-35154](https://cve.now/CVE-2023-35154.md): Knowage-Server vulnerable to account validation bypass (CVSS 7.2, KnowageLabs Knowage-Server)
- [CVE-2023-34254](https://cve.now/CVE-2023-34254.md): Remote inventory task command injection when using ssh command mode (CVSS 7.7, glpi-project glpi-agent)
- [CVE-2023-35931](https://cve.now/CVE-2023-35931.md): Shescape potential environment variable exposure on Windows with CMD (CVSS 3.1, ericcornelissen shescape · shescape)
- [CVE-2023-34460](https://cve.now/CVE-2023-34460.md): Tauri vulnerable to Regression on Filesystem Scope Checks for Dotfiles (CVSS 4.8, tauri-apps tauri · tauri)
- [CVE-2023-35167](https://cve.now/CVE-2023-35167.md): When setting EntityOptions.apiPrefilter to a function, the filter is not applied to API requests for a resource by Id (CVSS 5.0, remult)
- [CVE-2023-35162](https://cve.now/CVE-2023-35162.md): XPlatform Wiki vulnerable to cross-site scripting via xcontinue parameter in preview actions template (CVSS 9.7, xwiki-platform · org.xwiki.platform:xwiki-platform-flamingo…)
- [CVE-2023-35161](https://cve.now/CVE-2023-35161.md): XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in DeleteApplication page (CVSS 9.7, xwiki-platform · org.xwiki.platform:xwiki-platform-appwithi…)
- [CVE-2023-35160](https://cve.now/CVE-2023-35160.md): XWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit template (CVSS 9.7, xwiki-platform · org.xwiki.platform:xwiki-platform-web-temp…)
- [CVE-2023-35159](https://cve.now/CVE-2023-35159.md): XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template (CVSS 9.7, xwiki-platform · org.xwiki.platform:xwiki-platform-web-temp…)
- [CVE-2023-35158](https://cve.now/CVE-2023-35158.md): XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in restore template (CVSS 9.7, xwiki-platform · org.xwiki.platform:xwiki-platform-flamingo…)
- [CVE-2023-35157](https://cve.now/CVE-2023-35157.md): XWiki Platform vulnerable to reflected cross-site scripting via delattachment action (CVSS 8.5, xwiki-platform · org.xwiki.platform:xwiki-platform-oldcore)
- [CVE-2023-35156](https://cve.now/CVE-2023-35156.md): XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in delete template (CVSS 9.7, xwiki-platform · org.xwiki.platform:xwiki-platform-flamingo…)
- [CVE-2023-35155](https://cve.now/CVE-2023-35155.md): XWiki Platform vulnerable to cross-site scripting in target parameter via share page by email (CVSS 8.8, xwiki-platform · org.xwiki.platform:xwiki-platform-sharepag…)
- [CVE-2023-3394](https://cve.now/CVE-2023-3394.md): Session Fixation in fossbilling/fossbilling (CVSS 6.8, fossbilling/fossbilling)
- [CVE-2023-3393](https://cve.now/CVE-2023-3393.md): Code Injection in fossbilling/fossbilling (CVSS 8.0, fossbilling/fossbilling)
- [CVE-2023-25520](https://cve.now/CVE-2023-25520.md): NVIDIA Jetson Linux Driver Package contains a vulnerability in nvbootctrl, where a privileged local attacker can configure invalid settings (CVSS 4.4, NVIDIA Jetson AGX Xavier series, Jetson Xavier NX, Jetson T…)
- [CVE-2023-35153](https://cve.now/CVE-2023-35153.md): XWiki Platform vulnerable to stored cross-site scripting in ClassEditSheet page via name parameters (CVSS 9.1, xwiki-platform · org.xwiki.platform:xwiki-platform-appwithi…)
- [CVE-2023-25518](https://cve.now/CVE-2023-25518.md): NVIDIA Jetson contains a vulnerability in CBoot, where the PCIe controller is initialized without IOMMU, which may allow an attacker with p (CVSS 7.1, NVIDIA Jetson AGX Xavier series, Jetson Xavier NX)
- [CVE-2023-25515](https://cve.now/CVE-2023-25515.md): NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where unexpected untrusted data is parsed, which may lead to cod (CVSS 7.8, NVIDIA GPU Display Driver for Windows and Linux)
- [CVE-2023-35152](https://cve.now/CVE-2023-35152.md): XWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResults (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-like-ui)
- [CVE-2023-35151](https://cve.now/CVE-2023-35151.md): XWiki Platform may show email addresses in clear in REST results (CVSS 7.5, xwiki-platform · org.xwiki.platform:xwiki-platform-rest-ser…)
- [CVE-2023-35150](https://cve.now/CVE-2023-35150.md): XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application (CVSS 9.9, xwiki-platform · org.xwiki.platform:xwiki-platform-invitati…)
- [CVE-2023-34467](https://cve.now/CVE-2023-34467.md): XWiki Platform may retrieve email addresses of all users (CVSS 7.5, xwiki-platform · org.xwiki.platform:xwiki-platform-livetabl…)
- [CVE-2023-3391](https://cve.now/CVE-2023-3391.md): SourceCodester Human Resource Management System detailview.php sql injection (CVSS 6.3, SourceCodester Human Resource Management System)
- [CVE-2023-34466](https://cve.now/CVE-2023-34466.md): XWiki Platform's tags on non-viewable pages can be revealed to users (CVSS 4.3, xwiki-platform · org.xwiki.platform:xwiki-platform-tag-api)
- [CVE-2023-34465](https://cve.now/CVE-2023-34465.md): XWiki Platform's Mail.MailConfig can be edited by any user with edit rights (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-mail-sen…)
- [CVE-2023-35925](https://cve.now/CVE-2023-35925.md): FastAsyncWorldEdit vulnerable to Uncontrolled Resource Consumption (CVSS 6.2, IntellectualSites FastAsyncWorldEdit · com.fastasyncworl… +1)
- [CVE-2023-34464](https://cve.now/CVE-2023-34464.md): XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template (CVSS 9.1, xwiki-platform · org.xwiki.platform:xwiki-platform-web +1)
- [CVE-2022-47614](https://cve.now/CVE-2022-47614.md): WordPress MStore API Plugin \<= 3.9.7 is vulnerable to SQL Injection (CVSS 7.5, InspireUI MStore API)
- [CVE-2023-23679](https://cve.now/CVE-2023-23679.md): WordPress JS Help Desk – Best Help Desk & Support Plugin Plugin \<= 2.7.7 is vulnerable to Insecure Direct Object References (IDOR) (CVSS 4.6, JS Help Desk)
- [CVE-2023-28751](https://cve.now/CVE-2023-28751.md): WordPress Wp Ultimate Review Plugin \<= 2.0.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Wpmet Wp Ultimate Review)
- [CVE-2023-27427](https://cve.now/CVE-2023-27427.md): WordPress CRM Memberships Plugin \<= 1.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, NTZApps CRM Memberships)
- [CVE-2023-29100](https://cve.now/CVE-2023-29100.md): WordPress The7 Theme \<= 11.6.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Dream-Theme The7)
- [CVE-2023-32580](https://cve.now/CVE-2023-32580.md): WordPress Password Protected Plugin \<= 2.6.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, WPExperts Password Protected)
- [CVE-2023-35048](https://cve.now/CVE-2023-35048.md): WordPress Booking and Rental Manager Plugin \<= 1.2.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, MagePeople Team Booking and Rental Manager for Bike)
- [CVE-2023-34021](https://cve.now/CVE-2023-34021.md): WordPress Church Admin Plugin \<= 3.7.29 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Andy Moyle Church Admin)
- [CVE-2023-34012](https://cve.now/CVE-2023-34012.md): WordPress Premium Addons PRO Plugin \<= 2.8.24 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Premium Addons for Elementor Premium Addons PRO)
- [CVE-2023-28065](https://cve.now/CVE-2023-28065.md): Dell Command | Update, Dell Update, and Alienware Update versions 4.8.0 and prior contain an Insecure Operation on Windows Junction / Mount (CVSS 6.7, Dell Command Update)
- [CVE-2023-28064](https://cve.now/CVE-2023-28064.md): Dell BIOS contains an Out-of-bounds Write vulnerability. (CVSS 3.5, Dell CPG BIOS)
- [CVE-2023-32480](https://cve.now/CVE-2023-32480.md): Dell BIOS contains an Improper Input Validation vulnerability. (CVSS 6.8, Dell CPG BIOS)
- [CVE-2023-28073](https://cve.now/CVE-2023-28073.md): Dell BIOS contains an improper authentication vulnerability. (CVSS 8.2, Dell CPG BIOS)
- [CVE-2023-28071](https://cve.now/CVE-2023-28071.md): Dell Command | Update, Dell Update, and Alienware Update versions 4.9.0, A01 and prior contain an Insecure Operation on Windows Junction / (CVSS 6.3, Dell Command Update)
- [CVE-2023-28058](https://cve.now/CVE-2023-28058.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 5.1, Dell CPG BIOS)
- [CVE-2023-28050](https://cve.now/CVE-2023-28050.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 5.1, Dell CPG BIOS)
- [CVE-2023-28026](https://cve.now/CVE-2023-28026.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 5.1, Dell CPG BIOS)
- [CVE-2023-28044](https://cve.now/CVE-2023-28044.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 5.1, Dell CPG BIOS)
- [CVE-2023-28060](https://cve.now/CVE-2023-28060.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 5.1, Dell CPG BIOS)
- [CVE-2023-25938](https://cve.now/CVE-2023-25938.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 5.1, Dell CPG BIOS)
- [CVE-2023-28031](https://cve.now/CVE-2023-28031.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 5.1, Dell CPG BIOS)
- [CVE-2023-28034](https://cve.now/CVE-2023-28034.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 5.1, Dell CPG BIOS)
- [CVE-2023-28027](https://cve.now/CVE-2023-28027.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 5.1, Dell CPG BIOS)
- [CVE-2023-28036](https://cve.now/CVE-2023-28036.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 5.1, Dell CPG BIOS)
- [CVE-2023-3383](https://cve.now/CVE-2023-3383.md): SourceCodester Game Result Matrix System GET Parameter athlete-profile.php sql injection (CVSS 6.3, SourceCodester Game Result Matrix System)
- [CVE-2023-3382](https://cve.now/CVE-2023-3382.md): SourceCodester Game Result Matrix System GET Parameter save-delegates.php cross site scripting (CVSS 3.5, SourceCodester Game Result Matrix System)
- [CVE-2023-28032](https://cve.now/CVE-2023-28032.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 5.1, Dell CPG BIOS)
- [CVE-2023-28028](https://cve.now/CVE-2023-28028.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 5.1, Dell CPG BIOS)
- [CVE-2023-28039](https://cve.now/CVE-2023-28039.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 5.1, Dell CPG BIOS)
- [CVE-2023-28040](https://cve.now/CVE-2023-28040.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 5.1, Dell CPG BIOS)
- [CVE-2023-28056](https://cve.now/CVE-2023-28056.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 5.1, Dell CPG BIOS)
- [CVE-2023-28030](https://cve.now/CVE-2023-28030.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 5.1, Dell CPG BIOS)
- [CVE-2023-25937](https://cve.now/CVE-2023-25937.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 5.1, Dell CPG BIOS)
- [CVE-2023-28033](https://cve.now/CVE-2023-28033.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 5.1, Dell CPG BIOS)
- [CVE-2023-28035](https://cve.now/CVE-2023-28035.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 5.1, Dell CPG BIOS)
- [CVE-2023-3381](https://cve.now/CVE-2023-3381.md): SourceCodester Online School Fees System GET Parameter datatable.php cross site scripting (CVSS 3.5, SourceCodester Online School Fees System)
- [CVE-2023-3380](https://cve.now/CVE-2023-3380.md): Wavlink WN579X3 Ping Test adm.cgi injection (CVSS 4.7, Wavlink WN579X3)
- [CVE-2023-28041](https://cve.now/CVE-2023-28041.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 5.1, Dell CPG BIOS)
- [CVE-2023-28042](https://cve.now/CVE-2023-28042.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 5.1, Dell CPG BIOS)
- [CVE-2023-28061](https://cve.now/CVE-2023-28061.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 5.1, Dell CPG BIOS)
- [CVE-2023-28059](https://cve.now/CVE-2023-28059.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 5.1, Dell CPG BIOS)
- [CVE-2023-28029](https://cve.now/CVE-2023-28029.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 5.1, Dell CPG BIOS)
- [CVE-2023-28054](https://cve.now/CVE-2023-28054.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 5.1, Dell CPG BIOS)
- [CVE-2023-28052](https://cve.now/CVE-2023-28052.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 5.1, Dell CPG BIOS)
- [CVE-2023-25936](https://cve.now/CVE-2023-25936.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 5.1, Dell CPG BIOS)
- [CVE-2023-32464](https://cve.now/CVE-2023-32464.md): Dell VxRail, versions prior to 7.0.450, contain an improper certificate validation vulnerability. (CVSS 2.7, Dell EMC VxRail Appliance)
- [CVE-2023-32463](https://cve.now/CVE-2023-32463.md): Dell VxRail, version(s) 8.0.100 and earlier contain a denial-of-service vulnerability in the upgrade functionality. (CVSS 3.4, Dell EMC VxRail Appliance)
- [CVE-2023-33299](https://cve.now/CVE-2023-33299.md): A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attack (CVSS 9.6, Fortinet FortiNAC)
- [CVE-2023-31469](https://cve.now/CVE-2023-31469.md): Apache StreamPipes: Privilege escalation through non-admin user (CVSS 8.8, Apache Software Foundation Apache StreamPipes · org.apache.…)
- [CVE-2023-23344](https://cve.now/CVE-2023-23344.md): HCL BigFix WebUI Insights is susceptible to a lack of sufficient authorization (CVSS 3.0, HCL Software HCL BigFix WebUI Insights)
- [CVE-2023-33141](https://cve.now/CVE-2023-33141.md): Yet Another Reverse Proxy (YARP) Denial of Service Vulnerability (CVSS 7.5, Microsoft YARP · Yarp.ReverseProxy)
- [CVE-2022-22630](https://cve.now/CVE-2022-22630.md): A use after free issue was addressed with improved memory management. (no CVSS, Apple macOS)
- [CVE-2022-42792](https://cve.now/CVE-2022-42792.md): This issue was addressed with improved data protection. (no CVSS, Apple iOS and iPadOS)
- [CVE-2022-42807](https://cve.now/CVE-2022-42807.md): A logic issue was addressed with improved state management. (no CVSS, Apple macOS)
- [CVE-2022-42834](https://cve.now/CVE-2022-42834.md): An access issue was addressed with improved access restrictions. (CVSS 3.3, Apple macOS)
- [CVE-2022-42860](https://cve.now/CVE-2022-42860.md): This issue was addressed with improved checks to prevent unauthorized actions. (no CVSS, Apple macOS)
- [CVE-2022-46715](https://cve.now/CVE-2022-46715.md): A logic issue was addressed with improved checks. (no CVSS, Apple iOS and iPadOS)
- [CVE-2022-46718](https://cve.now/CVE-2022-46718.md): A logic issue was addressed with improved restrictions. (no CVSS, Apple macOS)
- [CVE-2023-23516](https://cve.now/CVE-2023-23516.md): The issue was addressed with improved memory handling. (no CVSS, Apple macOS)
- [CVE-2023-23539](https://cve.now/CVE-2023-23539.md): A buffer overflow issue was addressed with improved memory handling. (no CVSS, Apple macOS)
- [CVE-2023-25003](https://cve.now/CVE-2023-25003.md): A maliciously crafted pskernel.dll file in Autodesk AutoCAD 2023 and Maya 2022 may be used to trigger out-of-bound read write / read vulnera (no CVSS, AutoCAD, Maya)
- [CVE-2023-27908](https://cve.now/CVE-2023-27908.md): A maliciously crafted DLL file can be forced to write beyond allocated boundaries in the Autodesk installer when parsing the DLL files and c (no CVSS, Autodesk installer)
- [CVE-2023-27930](https://cve.now/CVE-2023-27930.md): A type confusion issue was addressed with improved checks. (no CVSS, Apple macOS · Apple watchOS +2)
- [CVE-2023-27940](https://cve.now/CVE-2023-27940.md): The issue was addressed with additional permissions checks. (no CVSS, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-27964](https://cve.now/CVE-2023-27964.md): An authentication issue was addressed with improved state management. (no CVSS, Apple AirPods Firmware Update E)
- [CVE-2023-28191](https://cve.now/CVE-2023-28191.md): This issue was addressed with improved redaction of sensitive information. (no CVSS, Apple macOS · Apple watchOS +2)
- [CVE-2023-28202](https://cve.now/CVE-2023-28202.md): This issue was addressed with improved state management. (no CVSS, Apple macOS · Apple watchOS +2)
- [CVE-2023-28204](https://cve.now/CVE-2023-28204.md): An out-of-bounds read was addressed with improved input validation. (CVSS 6.5, KEV, Apple macOS · Apple Safari +3)
- [CVE-2023-29860](https://cve.now/CVE-2023-29860.md): An insecure permissions in /Taier/API/tenant/listTenant interface in DTStack Taier 1.3.0 allows attackers to view sensitive information via (no CVSS)
- [CVE-2023-30258](https://cve.now/CVE-2023-30258.md): Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenti (CVSS 9.8)
- [CVE-2023-30260](https://cve.now/CVE-2023-30260.md): Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST (no CVSS, billz/raspap-webgui)
- [CVE-2023-30362](https://cve.now/CVE-2023-30362.md): Buffer Overflow vulnerability in coap\_send function in libcoap library 4.3.1-103-g52cfd56 fixed in 4.3.1-120-ge242200 allows attackers to ob (no CVSS)
- [CVE-2023-3212](https://cve.now/CVE-2023-3212.md): A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. (no CVSS, Linux kernel)
- [CVE-2023-32351](https://cve.now/CVE-2023-32351.md): A logic issue was addressed with improved checks. (no CVSS, Apple iTunes for Windows)
- [CVE-2023-32352](https://cve.now/CVE-2023-32352.md): A logic issue was addressed with improved checks. (no CVSS, Apple macOS · Apple watchOS +1)
- [CVE-2023-32353](https://cve.now/CVE-2023-32353.md): A logic issue was addressed with improved checks. (no CVSS, Apple iTunes for Windows)
- [CVE-2023-32354](https://cve.now/CVE-2023-32354.md): An out-of-bounds read was addressed with improved input validation. (no CVSS, Apple watchOS · Apple iOS and iPadOS +1)
- [CVE-2023-32355](https://cve.now/CVE-2023-32355.md): A logic issue was addressed with improved state management. (no CVSS, Apple macOS)
- [CVE-2023-32357](https://cve.now/CVE-2023-32357.md): An authorization issue was addressed with improved state management. (no CVSS, Apple macOS · Apple watchOS +2)
- [CVE-2023-32360](https://cve.now/CVE-2023-32360.md): An authentication issue was addressed with improved state management. (no CVSS, Apple macOS)
- [CVE-2023-32363](https://cve.now/CVE-2023-32363.md): A permissions issue was addressed by removing vulnerable code and adding additional checks. (no CVSS, Apple macOS)
- [CVE-2023-32365](https://cve.now/CVE-2023-32365.md): The issue was addressed with improved checks. (no CVSS, Apple iOS and iPadOS)
- [CVE-2023-32367](https://cve.now/CVE-2023-32367.md): This issue was addressed with improved entitlements. (no CVSS, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-32368](https://cve.now/CVE-2023-32368.md): An out-of-bounds read was addressed with improved input validation. (no CVSS, Apple macOS · Apple watchOS +2)
- [CVE-2023-32369](https://cve.now/CVE-2023-32369.md): A logic issue was addressed with improved state management. (CVSS 6.0, Apple macOS)
- [CVE-2023-32371](https://cve.now/CVE-2023-32371.md): The issue was addressed with improved checks. (CVSS 6.3, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-32372](https://cve.now/CVE-2023-32372.md): An out-of-bounds read was addressed with improved input validation. (CVSS 5.5, Apple macOS · Apple watchOS +2)
- [CVE-2023-32373](https://cve.now/CVE-2023-32373.md): A use-after-free issue was addressed with improved memory management. (CVSS 8.8, KEV, Apple macOS · Apple Safari +3)
- [CVE-2023-32375](https://cve.now/CVE-2023-32375.md): An out-of-bounds read was addressed with improved input validation. (CVSS 5.5, Apple macOS)
- [CVE-2023-32376](https://cve.now/CVE-2023-32376.md): This issue was addressed with improved entitlements. (no CVSS, Apple macOS · Apple watchOS +2)
- [CVE-2023-32380](https://cve.now/CVE-2023-32380.md): An out-of-bounds write issue was addressed with improved bounds checking. (no CVSS, Apple macOS)
- [CVE-2023-32382](https://cve.now/CVE-2023-32382.md): An out-of-bounds read was addressed with improved input validation. (no CVSS, Apple macOS)
- [CVE-2023-32384](https://cve.now/CVE-2023-32384.md): A buffer overflow was addressed with improved bounds checking. (no CVSS, Apple macOS · Apple watchOS +2)
- [CVE-2023-32385](https://cve.now/CVE-2023-32385.md): A denial-of-service issue was addressed with improved memory handling. (no CVSS, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-32386](https://cve.now/CVE-2023-32386.md): A privacy issue was addressed with improved handling of temporary files. (no CVSS, Apple macOS)
- [CVE-2023-32387](https://cve.now/CVE-2023-32387.md): A use-after-free issue was addressed with improved memory management. (no CVSS, Apple macOS)
- [CVE-2023-32388](https://cve.now/CVE-2023-32388.md): A privacy issue was addressed with improved private data redaction for log entries. (no CVSS, Apple macOS · Apple watchOS +1)
- [CVE-2023-32389](https://cve.now/CVE-2023-32389.md): This issue was addressed with improved redaction of sensitive information. (no CVSS, Apple macOS · Apple watchOS +2)
- [CVE-2023-32390](https://cve.now/CVE-2023-32390.md): The issue was addressed with improved checks. (no CVSS, Apple macOS · Apple watchOS +1)
- [CVE-2023-32391](https://cve.now/CVE-2023-32391.md): The issue was addressed with improved checks. (no CVSS, Apple macOS · Apple watchOS +1)
- [CVE-2023-32392](https://cve.now/CVE-2023-32392.md): A privacy issue was addressed with improved private data redaction for log entries. (no CVSS, Apple macOS · Apple watchOS +2)
- [CVE-2023-32394](https://cve.now/CVE-2023-32394.md): The issue was addressed with improved checks. (no CVSS, Apple macOS · Apple watchOS +2)
- [CVE-2023-32395](https://cve.now/CVE-2023-32395.md): A logic issue was addressed with improved state management. (no CVSS, Apple macOS)
- [CVE-2023-32397](https://cve.now/CVE-2023-32397.md): A logic issue was addressed with improved state management. (no CVSS, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-32398](https://cve.now/CVE-2023-32398.md): A use-after-free issue was addressed with improved memory management. (no CVSS, Apple macOS · Apple watchOS +2)
- [CVE-2023-32399](https://cve.now/CVE-2023-32399.md): The issue was addressed with improved handling of caches. (no CVSS, Apple macOS · Apple watchOS +2)
- [CVE-2023-32400](https://cve.now/CVE-2023-32400.md): This issue was addressed with improved checks. (no CVSS, Apple macOS · Apple watchOS +1)
- [CVE-2023-32402](https://cve.now/CVE-2023-32402.md): An out-of-bounds read was addressed with improved input validation. (no CVSS, Apple macOS · Apple Safari +3)
- [CVE-2023-32403](https://cve.now/CVE-2023-32403.md): This issue was addressed with improved redaction of sensitive information. (no CVSS, Apple macOS · Apple watchOS +2)
- [CVE-2023-32404](https://cve.now/CVE-2023-32404.md): This issue was addressed with improved entitlements. (no CVSS, Apple macOS · Apple watchOS +1)
- [CVE-2023-32405](https://cve.now/CVE-2023-32405.md): A logic issue was addressed with improved checks. (no CVSS, Apple macOS)
- [CVE-2023-32407](https://cve.now/CVE-2023-32407.md): A logic issue was addressed with improved state management. (no CVSS, Apple macOS · Apple watchOS +2)
- [CVE-2023-32408](https://cve.now/CVE-2023-32408.md): The issue was addressed with improved handling of caches. (no CVSS, Apple macOS · Apple watchOS +2)
- [CVE-2023-32409](https://cve.now/CVE-2023-32409.md): The issue was addressed with improved bounds checks. (CVSS 8.6, KEV, Apple macOS · Apple Safari +3)
- [CVE-2023-32410](https://cve.now/CVE-2023-32410.md): An out-of-bounds read was addressed with improved input validation. (no CVSS, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-32411](https://cve.now/CVE-2023-32411.md): This issue was addressed with improved entitlements. (no CVSS, Apple macOS · Apple iOS and iPadOS +1)
- [CVE-2023-32412](https://cve.now/CVE-2023-32412.md): A use-after-free issue was addressed with improved memory management. (no CVSS, Apple macOS · Apple watchOS +2)
- [CVE-2023-32413](https://cve.now/CVE-2023-32413.md): A race condition was addressed with improved state handling. (no CVSS, Apple macOS · Apple watchOS +2)
- [CVE-2023-32414](https://cve.now/CVE-2023-32414.md): The issue was addressed with improved checks. (no CVSS, Apple macOS)
- [CVE-2023-32415](https://cve.now/CVE-2023-32415.md): This issue was addressed with improved redaction of sensitive information. (no CVSS, Apple macOS · Apple iOS and iPadOS +1)
- [CVE-2023-32417](https://cve.now/CVE-2023-32417.md): This issue was addressed by restricting options offered on a locked device. (no CVSS, Apple watchOS)
- [CVE-2023-32419](https://cve.now/CVE-2023-32419.md): The issue was addressed with improved bounds checks. (no CVSS, Apple iOS and iPadOS)
- [CVE-2023-32420](https://cve.now/CVE-2023-32420.md): An out-of-bounds read was addressed with improved input validation. (no CVSS, Apple macOS · Apple watchOS +2)
- [CVE-2023-32422](https://cve.now/CVE-2023-32422.md): This issue was addressed by adding additional SQLite logging restrictions. (no CVSS, Apple macOS · Apple iOS and iPadOS +1)
- [CVE-2023-32423](https://cve.now/CVE-2023-32423.md): A buffer overflow issue was addressed with improved memory handling. (no CVSS, Apple macOS · Apple Safari +3)
- [CVE-2023-32434](https://cve.now/CVE-2023-32434.md): An integer overflow was addressed with improved input validation. (CVSS 7.8, KEV, Apple macOS · Apple iOS and iPadOS +1)
- [CVE-2023-32435](https://cve.now/CVE-2023-32435.md): A memory corruption issue was addressed with improved state management. (CVSS 8.8, KEV, Apple macOS · Apple iOS and iPadOS +1)
- [CVE-2023-32439](https://cve.now/CVE-2023-32439.md): A type confusion issue was addressed with improved checks. (CVSS 8.8, KEV, Apple iOS and iPadOS · Apple Safari +1)
- [CVE-2023-3302](https://cve.now/CVE-2023-3302.md): Improper Neutralization of Formula Elements in a CSV File in admidio/admidio (CVSS 6.6, admidio/admidio)
- [CVE-2023-3303](https://cve.now/CVE-2023-3303.md): Improper Access Control in admidio/admidio (CVSS 6.4, admidio/admidio)
- [CVE-2023-3304](https://cve.now/CVE-2023-3304.md): Improper Access Control in admidio/admidio (CVSS 5.9, admidio/admidio)
- [CVE-2023-3317](https://cve.now/CVE-2023-3317.md): A use-after-free flaw was found in mt7921\_check\_offload\_capability in drivers/net/wireless/mediatek/mt76/mt7921/init.c in wifi mt76/mt7921 s (CVSS 7.1, Kernel)
- [CVE-2023-34188](https://cve.now/CVE-2023-34188.md): The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. (no CVSS)
- [CVE-2023-34203](https://cve.now/CVE-2023-34203.md): In Progress OpenEdge OEM (OpenEdge Management) and OEE (OpenEdge Explorer) before 12.7, a remote user (who has any OEM or OEE role) could pe (no CVSS)
- [CVE-2023-34671](https://cve.now/CVE-2023-34671.md): Improper Access Control leads to privilege escalation affecting Elenos ETG150 FM transmitter running on version 3.12 by exploiting user's ro (no CVSS)
- [CVE-2023-34672](https://cve.now/CVE-2023-34672.md): Improper Access Control leads to adding a high-privilege user affecting Elenos ETG150 FM transmitter running on version 3.12 by exploiting u (no CVSS)
- [CVE-2023-34673](https://cve.now/CVE-2023-34673.md): Elenos ETG150 FM transmitter running on version 3.12 was discovered to be leaking SMTP credentials and other sensitive information by exploi (no CVSS)
- [CVE-2023-35759](https://cve.now/CVE-2023-35759.md): In Progress WhatsUp Gold before 23.0.0, an SNMP-related application endpoint failed to adequately sanitize malicious input. (no CVSS)
- [CVE-2023-35801](https://cve.now/CVE-2023-35801.md): A directory traversal vulnerability in Safe Software FME Server before 2022.2.5 allows an attacker to bypass validation when editing a netwo (no CVSS)
- [CVE-2023-36192](https://cve.now/CVE-2023-36192.md): Sngrep v1.6.0 was discovered to contain a heap buffer overflow via the function capture\_ws\_check\_packet at /src/capture.c. (no CVSS)
- [CVE-2023-36193](https://cve.now/CVE-2023-36193.md): Gifsicle v1.9.3 was discovered to contain a heap buffer overflow via the ambiguity\_error component at /src/clp.c. (no CVSS)
- [CVE-2023-36271](https://cve.now/CVE-2023-36271.md): LibreDWG v0.10 to v0.12.5 was discovered to contain a heap buffer overflow via the function bit\_wcs2nlen at bits.c. (no CVSS)
- [CVE-2023-36272](https://cve.now/CVE-2023-36272.md): LibreDWG v0.10 to v0.12.5 was discovered to contain a heap buffer overflow via the function bit\_utf8\_to\_TU at bits.c. (CVSS 8.8)
- [CVE-2023-36273](https://cve.now/CVE-2023-36273.md): LibreDWG v0.12.5 was discovered to contain a heap buffer overflow via the function bit\_calc\_CRC at bits.c. (no CVSS)
- [CVE-2023-36274](https://cve.now/CVE-2023-36274.md): LibreDWG v0.11 to v0.12.5 was discovered to contain a heap buffer overflow via the function bit\_write\_TF at bits.c. (no CVSS)
- [CVE-2023-36284](https://cve.now/CVE-2023-36284.md): An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter date\_from, date\_to, and id\_product allows a remo (no CVSS)
- [CVE-2023-36287](https://cve.now/CVE-2023-36287.md): An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cook (no CVSS)
- [CVE-2023-36288](https://cve.now/CVE-2023-36288.md): An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cook (no CVSS)
- [CVE-2023-36289](https://cve.now/CVE-2023-36289.md): An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cook (no CVSS)
- [CVE-2023-36345](https://cve.now/CVE-2023-36345.md): A Cross-Site Request Forgery (CSRF) in POS Codekop v2.0 allows attackers to escalate privileges. (no CVSS)
- [CVE-2023-36346](https://cve.now/CVE-2023-36346.md): POS Codekop v2.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the nm\_member parameter at print.php. (no CVSS)
- [CVE-2023-36348](https://cve.now/CVE-2023-36348.md): POS Codekop v2.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the filename parameter. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-06-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.