# CVEs published 2023-06-26

95 CVEs were published on June 26, 2023: 1 critical, 12 high. Days are UTC.

- [CVE-2023-22834](https://cve.now/CVE-2023-22834.md): The contour service was not checking that users had permission to create an analysis for a given dataset (CVSS 2.7, com.palantir.contour:contour-dispatch)
- [CVE-2023-30945](https://cve.now/CVE-2023-30945.md): CVE-2023-30945 (CVSS 9.8, com.palantir.gotham:clips2 · com.palantir.video:video-hi… +1)
- [CVE-2023-35695](https://cve.now/CVE-2023-35695.md): A remote attacker could leverage a vulnerability in Trend Micro Mobile Security (Enterprise) 9.8 SP5 to download a particular log file which (no CVSS, Trend Micro Moibile Security for Enterprise)
- [CVE-2023-34148](https://cve.now/CVE-2023-34148.md): An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacke (no CVSS, Trend Micro Apex One)
- [CVE-2023-34147](https://cve.now/CVE-2023-34147.md): An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacke (no CVSS, Trend Micro Apex One)
- [CVE-2023-34146](https://cve.now/CVE-2023-34146.md): An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacke (no CVSS, Trend Micro Apex One)
- [CVE-2023-34145](https://cve.now/CVE-2023-34145.md): An untrusted search path vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to (no CVSS, Trend Micro Apex One)
- [CVE-2023-34144](https://cve.now/CVE-2023-34144.md): An untrusted search path vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to (no CVSS, Trend Micro Apex One)
- [CVE-2023-32605](https://cve.now/CVE-2023-32605.md): Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site scripting (XSS) attac (no CVSS, Trend Micro Apex Central)
- [CVE-2023-32604](https://cve.now/CVE-2023-32604.md): Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site scripting (XSS) attac (no CVSS, Trend Micro Apex Central)
- [CVE-2023-32557](https://cve.now/CVE-2023-32557.md): A path traversal vulnerability in the Trend Micro Apex One and Apex One as a Service could allow an unauthenticated attacker to upload an ar (no CVSS, Trend Micro Apex One)
- [CVE-2023-32556](https://cve.now/CVE-2023-32556.md): A link following vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to disclose sensitiv (no CVSS, Trend Micro Apex One)
- [CVE-2023-32555](https://cve.now/CVE-2023-32555.md): A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escala (no CVSS, Trend Micro Apex One)
- [CVE-2023-32554](https://cve.now/CVE-2023-32554.md): A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escala (no CVSS, Trend Micro Apex One)
- [CVE-2023-32553](https://cve.now/CVE-2023-32553.md): An Improper access control vulnerability in Trend Micro Apex One and Apex One as a Service could allow an unauthenticated user under certain (no CVSS, Trend Micro Apex One)
- [CVE-2023-32552](https://cve.now/CVE-2023-32552.md): An Improper access control vulnerability in Trend Micro Apex One and Apex One as a Service could allow an unauthenticated user under certain (no CVSS, Trend Micro Apex One)
- [CVE-2023-32537](https://cve.now/CVE-2023-32537.md): Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site scripting (XSS) attac (no CVSS, Trend Micro Apex Central)
- [CVE-2023-32536](https://cve.now/CVE-2023-32536.md): Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site scripting (XSS) attac (no CVSS, Trend Micro Apex Central)
- [CVE-2023-32535](https://cve.now/CVE-2023-32535.md): Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an at (no CVSS, Trend Micro Apex Central)
- [CVE-2023-32534](https://cve.now/CVE-2023-32534.md): Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an at (no CVSS, Trend Micro Apex Central)
- [CVE-2023-32533](https://cve.now/CVE-2023-32533.md): Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an at (no CVSS, Trend Micro Apex Central)
- [CVE-2023-32532](https://cve.now/CVE-2023-32532.md): Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an at (no CVSS, Trend Micro Apex Central)
- [CVE-2023-32531](https://cve.now/CVE-2023-32531.md): Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an at (no CVSS, Trend Micro Apex Central)
- [CVE-2023-32530](https://cve.now/CVE-2023-32530.md): Vulnerable modules of Trend Micro Apex Central (on-premise) contain vulnerabilities which would allow authenticated users to perform a SQL i (no CVSS, Trend Micro Apex Central)
- [CVE-2023-32529](https://cve.now/CVE-2023-32529.md): Vulnerable modules of Trend Micro Apex Central (on-premise) contain vulnerabilities which would allow authenticated users to perform a SQL i (no CVSS, Trend Micro Apex Central)
- [CVE-2023-32528](https://cve.now/CVE-2023-32528.md): Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains vulnerable .php files that could allow a remote attacker to execute arbitrary code (no CVSS, Trend Micro Moibile Security for Enterprise)
- [CVE-2023-32527](https://cve.now/CVE-2023-32527.md): Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains vulnerable .php files that could allow a remote attacker to execute arbitrary code (no CVSS, Trend Micro Moibile Security for Enterprise)
- [CVE-2023-32526](https://cve.now/CVE-2023-32526.md): Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains widget vulnerabilities that could allow a remote attacker to create arbitrary file (no CVSS, Trend Micro Moibile Security for Enterprise)
- [CVE-2023-32525](https://cve.now/CVE-2023-32525.md): Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains widget vulnerabilities that could allow a remote attacker to create arbitrary file (no CVSS, Trend Micro Moibile Security for Enterprise)
- [CVE-2023-32524](https://cve.now/CVE-2023-32524.md): Affected versions of Trend Micro Mobile Security (Enterprise) 9.8 SP5 contain some widgets that would allow a remote user to bypass authenti (no CVSS, Trend Micro Moibile Security for Enterprise)
- [CVE-2023-32523](https://cve.now/CVE-2023-32523.md): Affected versions of Trend Micro Mobile Security (Enterprise) 9.8 SP5 contain some widgets that would allow a remote user to bypass authenti (no CVSS, Trend Micro Moibile Security for Enterprise)
- [CVE-2023-32522](https://cve.now/CVE-2023-32522.md): A path traversal exists in a specific dll of Trend Micro Mobile Security (Enterprise) 9.8 SP5 which could allow an authenticated remote atta (no CVSS, Trend Micro Moibile Security for Enterprise)
- [CVE-2023-32521](https://cve.now/CVE-2023-32521.md): A path traversal exists in a specific service dll of Trend Micro Mobile Security (Enterprise) 9.8 SP5 which could allow an unauthenticated r (no CVSS, Trend Micro Moibile Security for Enterprise)
- [CVE-2023-30902](https://cve.now/CVE-2023-30902.md): A privilege escalation vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to unintention (no CVSS, Trend Micro Apex One)
- [CVE-2023-28929](https://cve.now/CVE-2023-28929.md): Trend Micro Security 2021, 2022, and 2023 (Consumer) are vulnerable to a DLL Hijacking vulnerability which could allow an attacker to use a (no CVSS, Trend Micro Security)
- [CVE-2023-35164](https://cve.now/CVE-2023-35164.md): Unauthorized users can manipulate a dashboard created by an administrator in DataEase (CVSS 6.3, dataease)
- [CVE-2023-3422](https://cve.now/CVE-2023-3422.md): Use after free in Guest View in Google Chrome prior to 114.0.5735.198 allowed an attacker who convinced a user to install a malicious extens (no CVSS, Google Chrome)
- [CVE-2023-3421](https://cve.now/CVE-2023-3421.md): Use after free in Media in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a craf (CVSS 8.8, Google Chrome)
- [CVE-2023-3420](https://cve.now/CVE-2023-3420.md): Type Confusion in V8 in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2023-34463](https://cve.now/CVE-2023-34463.md): Unauthorized users can delete applications in DataEase (CVSS 8.1, dataease)
- [CVE-2023-35168](https://cve.now/CVE-2023-35168.md): DataEase has a privilege bypass vulnerability (CVSS 6.5, dataease)
- [CVE-2023-33176](https://cve.now/CVE-2023-33176.md): Blind SSRF When Uploading Presentation in BigBlueButton (CVSS 4.8, bigbluebutton)
- [CVE-2023-34422](https://cve.now/CVE-2023-34422.md): A valid, authenticated LXCA user with elevated privileges may be able to delete folders in the LXCA filesystem through a specifically crafte (CVSS 6.5, Lenovo XClarity Administrator)
- [CVE-2023-34421](https://cve.now/CVE-2023-34421.md): A valid, authenticated LXCA user with elevated privileges may be able to replace filesystem data through a specifically crafted web API call (CVSS 6.5, Lenovo XClarity Administrator)
- [CVE-2023-34420](https://cve.now/CVE-2023-34420.md): A valid, authenticated LXCA user with elevated privileges may be able to execute command injections through crafted calls to a specific web (CVSS 7.2, Lenovo XClarity Administrator)
- [CVE-2023-34418](https://cve.now/CVE-2023-34418.md): A valid, authenticated LXCA user may be able to gain unauthorized access to events and other data stored in LXCA due to a SQL injection vuln (CVSS 8.1, Lenovo XClarity Administrator)
- [CVE-2023-3113](https://cve.now/CVE-2023-3113.md): An unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) server that could resul (CVSS 8.2, Lenovo XClarity Administrator)
- [CVE-2023-2993](https://cve.now/CVE-2023-2993.md): A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a lim (CVSS 5.4, Lenovo System Management Module · Lenovo Fan Power Controll…)
- [CVE-2023-2992](https://cve.now/CVE-2023-2992.md): An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under (CVSS 7.5, Lenovo System Management Module · Lenovo Fan Power Controll…)
- [CVE-2023-2290](https://cve.now/CVE-2023-2290.md): A potential vulnerability in the LenovoFlashDeviceInterface SMI handler may allow an attacker with local access and elevated privileges to e (CVSS 6.4, Lenovo ThinkPad)
- [CVE-2023-35930](https://cve.now/CVE-2023-35930.md): LookupResources may return partial results in spicedb (CVSS 3.7, authzed spicedb · github.com/authzed/spicedb)
- [CVE-2023-35933](https://cve.now/CVE-2023-35933.md): OpenFGA denial of service die to circular relationship (CVSS 5.9, openfga · github.com/openfga/openfga)
- [CVE-2023-2005](https://cve.now/CVE-2023-2005.md): Tenable Plugin Feed ID #202306261202 Fixes Privilege Escalation Vulnerability (CVSS 6.3, Tenable.io · Tenable Nessus +1)
- [CVE-2023-29438](https://cve.now/CVE-2023-29438.md): WordPress SimpleModal Contact Form (SMCF) Plugin \<= 1.2.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Eric Martin SimpleModal Contact Form)
- [CVE-2023-29437](https://cve.now/CVE-2023-29437.md): WordPress Connections Business Directory Plugin \<= 10.4.36 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Steven A. Zahm Connections Business Directory)
- [CVE-2023-29435](https://cve.now/CVE-2023-29435.md): WordPress Cryptocurrency All-in-One Plugin \<= 3.0.19 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Zwaply Cryptocurrency All-in-One)
- [CVE-2023-29436](https://cve.now/CVE-2023-29436.md): WordPress IFrame Shortcode Plugin \<= 1.0.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Flyn San IFrame Shortcode)
- [CVE-2023-29434](https://cve.now/CVE-2023-29434.md): WordPress Optin Forms Plugin \<= 1.3.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, FancyThemes Optin Forms – Simple List Building Plugin for W…)
- [CVE-2023-3398](https://cve.now/CVE-2023-3398.md): Denial of Service in jgraph/drawio (CVSS 5.3, jgraph/drawio)
- [CVE-2023-29430](https://cve.now/CVE-2023-29430.md): WordPress TheRoof Theme \<= 1.0.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, CTHthemes TheRoof)
- [CVE-2023-29427](https://cve.now/CVE-2023-29427.md): WordPress Amelia Plugin \<= 1.0.75 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, TMS Booking for Appointments and Events Calendar – Amelia)
- [CVE-2023-29424](https://cve.now/CVE-2023-29424.md): WordPress ShiftController Employee Shift Scheduling Plugin \<= 4.9.23 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Plainware ShiftController Employee Shift Scheduling)
- [CVE-2023-29423](https://cve.now/CVE-2023-29423.md): WordPress Cancel order request WooCommerce Plugin \<= 1.3.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, PI Websolution Cancel order request / Return order / Repeat…)
- [CVE-2023-22359](https://cve.now/CVE-2023-22359.md): User-enumeration in RestAPI (CVSS 4.3, Tribe29 Checkmk)
- [CVE-2023-1150](https://cve.now/CVE-2023-1150.md): WAGO: Series 750-3x/-8x prone to MODBUS server DoS (CVSS 7.5, WAGO 750-332 · WAGO 750-362/xxx-xxx +9)
- [CVE-2023-1620](https://cve.now/CVE-2023-1620.md): WAGO: DoS in multiple products in multiple versions using Codesys (CVSS 4.9, Wago 750-8202/xxx-xxx · Wago 750-8203/xxx-xxx +27)
- [CVE-2023-1619](https://cve.now/CVE-2023-1619.md): WAGO: DoS in multiple versions of multiple products (CVSS 4.9, Wago 750-8202/xxx-xxx · Wago 750-8203/xxx-xxx +27)
- [CVE-2023-29093](https://cve.now/CVE-2023-29093.md): WordPress Conditional extra fees for woocommerce Plugin \<= 1.0.96 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, PI Websolution Conditional cart fee)
- [CVE-2023-28991](https://cve.now/CVE-2023-28991.md): WordPress Order date time for WooCommerce Plugin \<= 3.0.19 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, PI Websolution Order date, Order pickup, Order date time, P…)
- [CVE-2023-28992](https://cve.now/CVE-2023-28992.md): WordPress Coupon Affiliates Plugin \<= 5.4.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Elliot Sowersby, RelyWP Coupon Affiliates – WooCommerce Aff…)
- [CVE-2023-28988](https://cve.now/CVE-2023-28988.md): WordPress Direct checkout, Add to cart redirect for Woocommerce Plugin \<= 2.1.48 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, PI Websolution Direct checkout, Add to cart redirect, Quick…)
- [CVE-2020-20210](https://cve.now/CVE-2020-20210.md): Bludit 3.9.2 is vulnerable to Remote Code Execution (RCE) via /admin/ajax/upload-images. (no CVSS)
- [CVE-2020-23065](https://cve.now/CVE-2020-23065.md): Cross Site Scripting vulnerabiltiy in eZ Systems AS eZPublish Platform v.5.4 and eZ Publish Legacy v.5.4 allows a remote authenticated attac (no CVSS)
- [CVE-2021-31635](https://cve.now/CVE-2021-31635.md): Server-Side Template Injection (SSTI) vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template f (no CVSS, com.jfinal:jfinal)
- [CVE-2022-40010](https://cve.now/CVE-2022-40010.md): Tenda AC6 AC1200 Smart Dual-Band WiFi Router 15.03.06.50\_multi was discovered to contain a cross-site scripting (XSS) vulnerability via the (no CVSS)
- [CVE-2022-48331](https://cve.now/CVE-2022-48331.md): Widevine Trusted Application (TA) 5.0.0 through 5.1.1 has a drm\_save\_keys feature\_name\_len integer overflow and resultant buffer overflow. (no CVSS)
- [CVE-2022-48332](https://cve.now/CVE-2022-48332.md): Widevine Trusted Application (TA) 5.0.0 through 5.1.1 has a drm\_save\_keys file\_name\_len integer overflow and resultant buffer overflow. (no CVSS)
- [CVE-2022-48333](https://cve.now/CVE-2022-48333.md): Widevine Trusted Application (TA) 5.0.0 through 5.1.1 has a drm\_verify\_keys prefix\_len+feature\_name\_len integer overflow and resultant buffe (no CVSS)
- [CVE-2022-48334](https://cve.now/CVE-2022-48334.md): Widevine Trusted Application (TA) 5.0.0 through 5.1.1 has a drm\_verify\_keys total\_len+file\_name\_len integer overflow and resultant buffer ov (no CVSS)
- [CVE-2022-48335](https://cve.now/CVE-2022-48335.md): Widevine Trusted Application (TA) 5.0.0 through 7.1.1 has a PRDiagVerifyProvisioning integer overflow and resultant buffer overflow. (no CVSS)
- [CVE-2022-48336](https://cve.now/CVE-2022-48336.md): Widevine Trusted Application (TA) 5.0.0 through 7.1.1 has a PRDiagParseAndStoreData integer overflow and resultant buffer overflow. (no CVSS)
- [CVE-2023-25306](https://cve.now/CVE-2023-25306.md): MultiMC Launcher \<= 0.6.16 is vulnerable to Directory Traversal. (no CVSS)
- [CVE-2023-25307](https://cve.now/CVE-2023-25307.md): nothub mrpack-install \<= v0.16.2 is vulnerable to Directory Traversal. (no CVSS, github.com/nothub/mrpack-install)
- [CVE-2023-27082](https://cve.now/CVE-2023-27082.md): Cross Site Scripting (XSS) vulnerability in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev4 allows remote attackers to run arbitrary code (no CVSS)
- [CVE-2023-28485](https://cve.now/CVE-2023-28485.md): A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before 6.75 allows remote authenticated users to inject ar (no CVSS)
- [CVE-2023-29459](https://cve.now/CVE-2023-29459.md): The laola.redbull application through 5.1.9-R for Android exposes the exported activity at.redbullsalzburg.android.AppMode.Default.Splash.Sp (no CVSS)
- [CVE-2023-30261](https://cve.now/CVE-2023-30261.md): Command Injection vulnerability in OpenWB 1.6 and 1.7 allows remote attackers to run arbitrary commands via crafted GET request. (no CVSS)
- [CVE-2023-33404](https://cve.now/CVE-2023-33404.md): An Unrestricted Upload vulnerability, due to insufficient validation on UploadControlled.cs file, in BlogEngine.Net version 3.3.8.0 and earl (no CVSS)
- [CVE-2023-33580](https://cve.now/CVE-2023-33580.md): Phpgurukul Student Study Center Management System V1.0 is vulnerable to Cross Site Scripting (XSS) in the "Admin Name" field on Admin Profil (no CVSS)
- [CVE-2023-34924](https://cve.now/CVE-2023-34924.md): H3C Magic B1STW B1STV100R012 was discovered to contain a stack overflow via the function SetAPInfoById. (no CVSS)
- [CVE-2023-36252](https://cve.now/CVE-2023-36252.md): An issue in Ateme Flamingo XL v.3.6.20 and XS v.3.6.5 allows a remote authenticated attacker to execute arbitrary code and cause a denial of (no CVSS)
- [CVE-2023-36301](https://cve.now/CVE-2023-36301.md): Talend Data Catalog before 8.0-20230221 contain a directory traversal vulnerability in HeaderImageServlet. (no CVSS)
- [CVE-2023-36631](https://cve.now/CVE-2023-36631.md): Lack of access control in wfc.exe in Malwarebytes Binisoft Windows Firewall Control 6.9.2.0 allows local unprivileged users to bypass Window (no CVSS)
- [CVE-2023-36662](https://cve.now/CVE-2023-36662.md): The TechTime User Management components for Atlassian products allow stored XSS on the Bulk User Actions page. (no CVSS)
- [CVE-2023-36675](https://cve.now/CVE-2023-36675.md): An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, and 1.39.x before 1.39.4. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-06-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.