CVEs published June 26, 2023
95 CVEs were published on June 26, 2023: 1 critical, 12 high.
- Published
- 95
- Critical
- 1
- High
- 12
- Medium
- 22
- Low
- 2
- Unrated
- 58
- Now in CISA KEV
- 0
- Fix available
- 47
Most affected products
- Trend Micro Apex One
- 12
- Trend Micro Apex Central
- 11
- Trend Micro Moibile Security for Enterprise
- 9
- Lenovo XClarity Administrator
- 5
- dataease
- 3
- Google Chrome
- 3
- Lenovo System Management Module · Lenovo Fan Power Controll…
- 2
- Wago 750-8202/xxx-xxx · Wago 750-8203/xxx-xxx +27
- 2
- authzed spicedb · github.com/authzed/spicedb
- 1
- bigbluebutton
- 1
Critical 1
High 12
- CVE-2023-3421Use after free in Media in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2023-3420Type Confusion in V8 in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a craftedGoogle Chrome
- CVE-2023-34463Unauthorized users can delete applications in DataEasedataease
- CVE-2023-34420A valid, authenticated LXCA user with elevated privileges may be able to execute command injections through crafted calls to a specific web Lenovo XClarity Administrator
- CVE-2023-34418A valid, authenticated LXCA user may be able to gain unauthorized access to events and other data stored in LXCA due to a SQL injection vulnLenovo XClarity Administrator
- CVE-2023-3113An unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) server that could resulLenovo XClarity Administrator
- CVE-2023-2992An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered underLenovo System Management Module · Lenovo Fan Power Controll…
- CVE-2023-29430WordPress TheRoof Theme <= 1.0.3 is vulnerable to Cross Site Scripting (XSS)CTHthemes TheRoof
- CVE-2023-29427WordPress Amelia Plugin <= 1.0.75 is vulnerable to Cross Site Scripting (XSS)TMS Booking for Appointments and Events Calendar – Amelia
- CVE-2023-29424WordPress ShiftController Employee Shift Scheduling Plugin <= 4.9.23 is vulnerable to Cross Site Scripting (XSS)Plainware ShiftController Employee Shift Scheduling
- CVE-2023-1150WAGO: Series 750-3x/-8x prone to MODBUS server DoSWAGO 750-332 · WAGO 750-362/xxx-xxx +9
- CVE-2023-28992WordPress Coupon Affiliates Plugin <= 5.4.3 is vulnerable to Cross Site Scripting (XSS)Elliot Sowersby, RelyWP Coupon Affiliates – WooCommerce Aff…
Medium, low and unrated 82
- CVE-2023-22834The contour service was not checking that users had permission to create an analysis for a given datasetcom.palantir.contour:contour-dispatch
- CVE-2023-35695A remote attacker could leverage a vulnerability in Trend Micro Mobile Security (Enterprise) 9.8 SP5 to download a particular log file whichTrend Micro Moibile Security for Enterprise
- CVE-2023-34148An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attackeTrend Micro Apex One
- CVE-2023-34147An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attackeTrend Micro Apex One
- CVE-2023-34146An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attackeTrend Micro Apex One
- CVE-2023-34145An untrusted search path vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to Trend Micro Apex One
- CVE-2023-34144An untrusted search path vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to Trend Micro Apex One
- CVE-2023-32605Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site scripting (XSS) attacTrend Micro Apex Central
- CVE-2023-32604Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site scripting (XSS) attacTrend Micro Apex Central
- CVE-2023-32557A path traversal vulnerability in the Trend Micro Apex One and Apex One as a Service could allow an unauthenticated attacker to upload an arTrend Micro Apex One
- CVE-2023-32556A link following vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to disclose sensitivTrend Micro Apex One
- CVE-2023-32555A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalaTrend Micro Apex One
- CVE-2023-32554A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalaTrend Micro Apex One
- CVE-2023-32553An Improper access control vulnerability in Trend Micro Apex One and Apex One as a Service could allow an unauthenticated user under certainTrend Micro Apex One
- CVE-2023-32552An Improper access control vulnerability in Trend Micro Apex One and Apex One as a Service could allow an unauthenticated user under certainTrend Micro Apex One
- CVE-2023-32537Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site scripting (XSS) attacTrend Micro Apex Central
- CVE-2023-32536Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site scripting (XSS) attacTrend Micro Apex Central
- CVE-2023-32535Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an atTrend Micro Apex Central
- CVE-2023-32534Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an atTrend Micro Apex Central
- CVE-2023-32533Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an atTrend Micro Apex Central
- CVE-2023-32532Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an atTrend Micro Apex Central
- CVE-2023-32531Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an atTrend Micro Apex Central
- CVE-2023-32530Vulnerable modules of Trend Micro Apex Central (on-premise) contain vulnerabilities which would allow authenticated users to perform a SQL iTrend Micro Apex Central
- CVE-2023-32529Vulnerable modules of Trend Micro Apex Central (on-premise) contain vulnerabilities which would allow authenticated users to perform a SQL iTrend Micro Apex Central
- CVE-2023-32528Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains vulnerable .php files that could allow a remote attacker to execute arbitrary codeTrend Micro Moibile Security for Enterprise
- CVE-2023-32527Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains vulnerable .php files that could allow a remote attacker to execute arbitrary codeTrend Micro Moibile Security for Enterprise
- CVE-2023-32526Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains widget vulnerabilities that could allow a remote attacker to create arbitrary fileTrend Micro Moibile Security for Enterprise
- CVE-2023-32525Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains widget vulnerabilities that could allow a remote attacker to create arbitrary fileTrend Micro Moibile Security for Enterprise
- CVE-2023-32524Affected versions of Trend Micro Mobile Security (Enterprise) 9.8 SP5 contain some widgets that would allow a remote user to bypass authentiTrend Micro Moibile Security for Enterprise
- CVE-2023-32523Affected versions of Trend Micro Mobile Security (Enterprise) 9.8 SP5 contain some widgets that would allow a remote user to bypass authentiTrend Micro Moibile Security for Enterprise
- CVE-2023-32522A path traversal exists in a specific dll of Trend Micro Mobile Security (Enterprise) 9.8 SP5 which could allow an authenticated remote attaTrend Micro Moibile Security for Enterprise
- CVE-2023-32521A path traversal exists in a specific service dll of Trend Micro Mobile Security (Enterprise) 9.8 SP5 which could allow an unauthenticated rTrend Micro Moibile Security for Enterprise
- CVE-2023-30902A privilege escalation vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to unintentionTrend Micro Apex One
- CVE-2023-28929Trend Micro Security 2021, 2022, and 2023 (Consumer) are vulnerable to a DLL Hijacking vulnerability which could allow an attacker to use a Trend Micro Security
- CVE-2023-35164Unauthorized users can manipulate a dashboard created by an administrator in DataEasedataease
- CVE-2023-3422Use after free in Guest View in Google Chrome prior to 114.0.5735.198 allowed an attacker who convinced a user to install a malicious extensGoogle Chrome
- CVE-2023-35168DataEase has a privilege bypass vulnerabilitydataease
- CVE-2023-33176Blind SSRF When Uploading Presentation in BigBlueButtonbigbluebutton
- CVE-2023-34422A valid, authenticated LXCA user with elevated privileges may be able to delete folders in the LXCA filesystem through a specifically crafteLenovo XClarity Administrator
- CVE-2023-34421A valid, authenticated LXCA user with elevated privileges may be able to replace filesystem data through a specifically crafted web API callLenovo XClarity Administrator
- CVE-2023-2993A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limLenovo System Management Module · Lenovo Fan Power Controll…
- CVE-2023-2290A potential vulnerability in the LenovoFlashDeviceInterface SMI handler may allow an attacker with local access and elevated privileges to eLenovo ThinkPad
- CVE-2023-35930LookupResources may return partial results in spicedbauthzed spicedb · github.com/authzed/spicedb
- CVE-2023-35933OpenFGA denial of service die to circular relationshipopenfga · github.com/openfga/openfga
- CVE-2023-2005Tenable Plugin Feed ID #202306261202 Fixes Privilege Escalation VulnerabilityTenable.io · Tenable Nessus +1
- CVE-2023-29438WordPress SimpleModal Contact Form (SMCF) Plugin <= 1.2.9 is vulnerable to Cross Site Scripting (XSS)Eric Martin SimpleModal Contact Form
- CVE-2023-29437WordPress Connections Business Directory Plugin <= 10.4.36 is vulnerable to Cross Site Scripting (XSS)Steven A. Zahm Connections Business Directory
- CVE-2023-29435WordPress Cryptocurrency All-in-One Plugin <= 3.0.19 is vulnerable to Cross Site Scripting (XSS)Zwaply Cryptocurrency All-in-One
- CVE-2023-29436WordPress IFrame Shortcode Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS)Flyn San IFrame Shortcode
- CVE-2023-29434WordPress Optin Forms Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)FancyThemes Optin Forms – Simple List Building Plugin for W…
- CVE-2023-3398Denial of Service in jgraph/drawiojgraph/drawio
- CVE-2023-29423WordPress Cancel order request WooCommerce Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)PI Websolution Cancel order request / Return order / Repeat…
- CVE-2023-22359User-enumeration in RestAPITribe29 Checkmk
- CVE-2023-1620WAGO: DoS in multiple products in multiple versions using CodesysWago 750-8202/xxx-xxx · Wago 750-8203/xxx-xxx +27
- CVE-2023-1619WAGO: DoS in multiple versions of multiple productsWago 750-8202/xxx-xxx · Wago 750-8203/xxx-xxx +27
- CVE-2023-29093WordPress Conditional extra fees for woocommerce Plugin <= 1.0.96 is vulnerable to Cross Site Scripting (XSS)PI Websolution Conditional cart fee
- CVE-2023-28991WordPress Order date time for WooCommerce Plugin <= 3.0.19 is vulnerable to Cross Site Scripting (XSS)PI Websolution Order date, Order pickup, Order date time, P…
- CVE-2023-28988WordPress Direct checkout, Add to cart redirect for Woocommerce Plugin <= 2.1.48 is vulnerable to Cross Site Scripting (XSS)PI Websolution Direct checkout, Add to cart redirect, Quick…
- CVE-2020-20210Bludit 3.9.2 is vulnerable to Remote Code Execution (RCE) via /admin/ajax/upload-images.
- CVE-2020-23065Cross Site Scripting vulnerabiltiy in eZ Systems AS eZPublish Platform v.5.4 and eZ Publish Legacy v.5.4 allows a remote authenticated attac
- CVE-2021-31635Server-Side Template Injection (SSTI) vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template fcom.jfinal:jfinal
- CVE-2022-40010Tenda AC6 AC1200 Smart Dual-Band WiFi Router 15.03.06.50_multi was discovered to contain a cross-site scripting (XSS) vulnerability via the
- CVE-2022-48331Widevine Trusted Application (TA) 5.0.0 through 5.1.1 has a drm_save_keys feature_name_len integer overflow and resultant buffer overflow.
- CVE-2022-48332Widevine Trusted Application (TA) 5.0.0 through 5.1.1 has a drm_save_keys file_name_len integer overflow and resultant buffer overflow.
- CVE-2022-48333Widevine Trusted Application (TA) 5.0.0 through 5.1.1 has a drm_verify_keys prefix_len+feature_name_len integer overflow and resultant buffe
- CVE-2022-48334Widevine Trusted Application (TA) 5.0.0 through 5.1.1 has a drm_verify_keys total_len+file_name_len integer overflow and resultant buffer ov
- CVE-2022-48335Widevine Trusted Application (TA) 5.0.0 through 7.1.1 has a PRDiagVerifyProvisioning integer overflow and resultant buffer overflow.
- CVE-2022-48336Widevine Trusted Application (TA) 5.0.0 through 7.1.1 has a PRDiagParseAndStoreData integer overflow and resultant buffer overflow.
- CVE-2023-25306MultiMC Launcher <= 0.6.16 is vulnerable to Directory Traversal.
- CVE-2023-25307nothub mrpack-install <= v0.16.2 is vulnerable to Directory Traversal.github.com/nothub/mrpack-install
- CVE-2023-27082Cross Site Scripting (XSS) vulnerability in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev4 allows remote attackers to run arbitrary code
- CVE-2023-28485A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before 6.75 allows remote authenticated users to inject ar
- CVE-2023-29459The laola.redbull application through 5.1.9-R for Android exposes the exported activity at.redbullsalzburg.android.AppMode.Default.Splash.Sp
- CVE-2023-30261Command Injection vulnerability in OpenWB 1.6 and 1.7 allows remote attackers to run arbitrary commands via crafted GET request.
- CVE-2023-33404An Unrestricted Upload vulnerability, due to insufficient validation on UploadControlled.cs file, in BlogEngine.Net version 3.3.8.0 and earl
- CVE-2023-33580Phpgurukul Student Study Center Management System V1.0 is vulnerable to Cross Site Scripting (XSS) in the "Admin Name" field on Admin Profil
- CVE-2023-34924H3C Magic B1STW B1STV100R012 was discovered to contain a stack overflow via the function SetAPInfoById.
- CVE-2023-36252An issue in Ateme Flamingo XL v.3.6.20 and XS v.3.6.5 allows a remote authenticated attacker to execute arbitrary code and cause a denial of
- CVE-2023-36301Talend Data Catalog before 8.0-20230221 contain a directory traversal vulnerability in HeaderImageServlet.
- CVE-2023-36631Lack of access control in wfc.exe in Malwarebytes Binisoft Windows Firewall Control 6.9.2.0 allows local unprivileged users to bypass Window
- CVE-2023-36662The TechTime User Management components for Atlassian products allow stored XSS on the Bulk User Actions page.
- CVE-2023-36675An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, and 1.39.x before 1.39.4.