CVEs published June 27, 2023
77 CVEs were published on June 27, 2023: 0 critical, 3 high.
- Published
- 77
- Critical
- 0
- High
- 3
- Medium
- 25
- Low
- 2
- Unrated
- 47
- Now in CISA KEV
- 0
- Fix available
- 39
Most affected products
- IBM Security QRadar SIEM
- 4
- KiviCare
- 4
- Proofpoint Insider Threat Management
- 4
- Autodesk products
- 2
- IBM Robotic Process Automation for Cloud Pak
- 2
- shopware · shopware/shopware
- 2
- webcraftplugins Image Map Pro – Drag-and-drop Builder for I…
- 2
- WP ERP | Complete HR solution with recruitment & job listin…
- 2
- wpbrutalai
- 2
- Aajoda Testimonials
- 1
High 3
- CVE-2023-3432Server-Side Request Forgery (SSRF) in plantuml/plantumlplantuml/plantuml · net.sourceforge.plantuml:plantuml-mit +1
- CVE-2023-3405Denial of service condition in M-Files ServerM-Files Server
- CVE-2023-34395Apache Airflow ODBC Provider: Remote code execution vulnerabilityApache Software Foundation Apache Airflow ODBC Provider · a…
Medium, low and unrated 74
- CVE-2023-36464Infinite Loop when a comment isn't followed by a character in pypdfpy-pdf pypdf · pypdf2 +1
- CVE-2023-3436Deadlock in Xpdf 4.04 due to PDF object stream referencesXpdf
- CVE-2023-36463Cross site scripting (XSS) in meldekarten generator jucktnich meldekarten-generator
- CVE-2023-30993IBM Cloud Pak for Security information disclosureIBM Cloud Pak for Security
- CVE-2023-23468IBM Robotic Process Automation for Cloud Pak access controlIBM Robotic Process Automation for Cloud Pak
- CVE-2023-22593IBM Robotic Process Automation for Cloud Pak security configurationIBM Robotic Process Automation for Cloud Pak
- CVE-2022-34352IBM QRadar information disclosureIBM Security QRadar SIEM
- CVE-2023-26274IBM QRadar cross-site scriptingIBM Security QRadar SIEM
- CVE-2023-28857LDAP password leak in Apereo CAS - GHSL-2023-009Apereo CAS · org.apereo.cas:cas-server-support-x509-core
- CVE-2023-26276IBM QRadar information disclosureIBM Security QRadar SIEM
- CVE-2023-26273IBM QRadar security bypassIBM Security QRadar SIEM
- CVE-2023-32339IBM Business Automation Workflow cross-site scriptingIBM Business Automation Workflow
- CVE-2023-34240Weak passwords allowed in cloudexplorer-liteCloudExplorer-Dev CloudExplorer-Lite
- CVE-2023-34099Improper mail validation in Shopwareshopware · shopware/shopware
- CVE-2023-34098Dependency configuration exposed in Shopwareshopware · shopware/shopware
- CVE-2023-36002ITM Server Missing Authorization for URL validationProofpoint Insider Threat Management
- CVE-2023-36000ITM Server Missing Authorization for Agent ConfigProofpoint Insider Threat Management
- CVE-2023-35998ITM Server Missing Authorization in SOAP EndpointsProofpoint Insider Threat Management
- CVE-2023-2818ITM Windows Agent Insecure Filesystem PermissionsProofpoint Insider Threat Management
- CVE-2023-3431Improper Access Control in plantuml/plantumlplantuml/plantuml · net.sourceforge.plantuml:plantuml-mit
- CVE-2023-2605WP Brutal AI < 2.0.1 - Admin+ Reflected XSSwpbrutalai
- CVE-2023-2795CodeColorer < 0.10.1 – Admin+ Stored Cross-Site ScriptingCodeColorer
- CVE-2023-2326Gravity Forms Google Sheet Connector < 1.3.5 - Access Code Update via CSRFGravity Forms Google Sheet Connector · gsheetconnector-grav…
- CVE-2023-0588Catalyst Connect Zoho CRM Client Portal < 2.1.0 - Reflected XSSCatalyst Connect Zoho CRM Client Portal
- CVE-2023-2624KiviCare Management System < 3.2.1 - Reflected Cross-Site ScriptingKiviCare
- CVE-2023-2628KiviCare Management System < 3.2.1 - Multiple CSRFKiviCare
- CVE-2023-1166USM Premium < 16.3 - Admin+ Stored XSSUltimate-Premium-Plugin
- CVE-2023-2623KiviCare Management System < 3.2.1 - Subscriber+ Sensitive Information DisclosureKiviCare
- CVE-2023-2592FormCraft Premium < 3.9.7 - Admin+ SQLiFormCraft
- CVE-2023-2068File Manager Advanced Shortcode <= 2.3.2 - Unauthenticated Remote Code Execution through shortcodefile-manager-advanced-shortcode
- CVE-2023-2711Ultimate Product Catalog < 5.2.6 - Admin+ Stored XSSUltimate Product Catalog
- CVE-2023-2842WP Inventory Manager < 2.1.0.14 - Inventory Items Deletion via CSRFWP Inventory Manager
- CVE-2023-1891Accordion & FAQ < 1.9.9 - Reflected XSSAccordion & FAQ
- CVE-2023-0873Kanban Boards for WordPress < 2.5.21 - Admin+ Stored XSSKanban Boards for WordPress
- CVE-2022-4115Editorial Calendar < 3.8.3 - Contributor+ Stored XSSEditorial Calendar
- CVE-2023-2032Custom 404 Pro < 3.8.1 - Multiple SQL InjectionCustom 404 Pro
- CVE-2023-2877Formidable Forms < 6.3.1 - Subscriber+ Remote Code ExecutionFormidable Forms
- CVE-2023-2601WP Brutal AI < 2.0.0 - SQL Injection via CSRFwpbrutalai
- CVE-2023-2744WP ERP < 1.12.4 - Admin+ SQL InjectionWP ERP | Complete HR solution with recruitment & job listin…
- CVE-2023-2482Responsive CSS EDITOR <= 1.0 - Admin+ SQLiResponsive CSS EDITOR
- CVE-2023-2178Aajoda Testimonials < 2.2.2 - Admin+ Stored XSSAajoda Testimonials
- CVE-2023-2580AI-Engine < 1.6.83 - Admin+ Stored XSSAI Engine: ChatGPT Chatbot, Content Generator, GPT 3 & 4, U…
- CVE-2023-2996Jetpack < 12.1.1 - Author+ Arbitrary File Manipulation via APIJetpack
- CVE-2023-2627KiviCare Management System < 3.2.1 - Subscriber+ Unauthorised AJAX CallsKiviCare
- CVE-2023-2743WP ERP < 1.12.4 - Reflected Cross-Site ScriptingWP ERP | Complete HR solution with recruitment & job listin…
- CVE-2023-35798Airflow Apache ODBC and MSSQL Providers Arbitrary File Read VulnerabilityApache Software Foundation Apache Airflow ODBC Provider… +2
- CVE-2023-3423Weak Password Requirements in cloudexplorer-dev/cloudexplorer-litecloudexplorer-dev/cloudexplorer-lite
- CVE-2023-3412Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite <= 1.0.0 - Missing Authorization to Stored Cross-Site Scriptingwebcraftplugins Image Map Pro – Drag-and-drop Builder for I…
- CVE-2023-3411Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scriptingwebcraftplugins Image Map Pro – Drag-and-drop Builder for I…
- CVE-2023-3132MainWP Child <= 4.4.1.1 - Information Disclosure via Back-Up FilesMainWP Child – Securely Connects to the MainWP Dashboard to…
- CVE-2023-3371EmbedPress <= 3.7.3 - Sensitive Information Exposurewpdevteam EmbedPress – PDF Embedder, Embed YouTube Videos,…
- CVE-2020-18404An issue was discovered in espcms version P8.18101601.
- CVE-2020-18406An issue was discovered in cmseasy v7.0.0 that allows user credentials to be sent in clear text due to no encryption of form data.
- CVE-2020-18409Cross Site Request Forgery (CSRF) vulnerability was discovered in CatfishCMS 4.8.63 that would allow attackers to obtain administrator permi
- CVE-2020-18410A stored cross site scripting (XSS) vulnerability in /index.php?admin-master-article-edit of Chaoji CMS v2.18 that allows attackers to obtai
- CVE-2020-18413Stored cross site scripting (XSS) vulnerability in /index.php?admin-master-navmenu-add of Chaoji CMS v2.18 that allows attackers to execute
- CVE-2020-18414Stored cross site scripting (XSS) vulnerability in Chaoji CMS v2.18 that allows attackers to execute arbitrary code via /index.php?admin-mas
- CVE-2020-18416An cross site request forgery (CSRF) vulnerability discovered in Jymusic v2.0.0.,that allows attackers to execute arbitrary code via /admin.
- CVE-2020-18418A Cross site request forgery (CSRF) vulnerability was discovered in FeiFeiCMS v4.1.190209, which allows attackers to create administrator ac
- CVE-2020-19902Directory Traversal vulnerability found in Cryptoprof WCMS v.0.3.2 allows a remote attacker to execute arbitrary code via the wex/cssjs.php
- CVE-2021-30203A reflected cross-site scripting (XSS) vulnerability in the zero parameter of dzzoffice 2.02.1_SC_UTF8 allows attackers to execute arbitrary
- CVE-2021-30205Incorrect access control in the component /index.php?mod=system&op=orgtree of dzzoffice 2.02.1_SC_UTF8 allows unauthenticated attackers to b
- CVE-2023-25001A maliciously crafted SKP file in Autodesk Navisworks 2023 and 2022 be used to trigger use-after-free vulnerability.Navisworks
- CVE-2023-25002A maliciously crafted SKP file in Autodesk products is used to trigger use-after-free vulnerability.Multiple
- CVE-2023-25004A maliciously crafted pskernel.dll file in Autodesk products is used to trigger integer overflow vulnerabilities.Autodesk products
- CVE-2023-29068A maliciously crafted file consumed through pskernel.dll file could lead to memory corruption vulnerabilities.Autodesk products
- CVE-2023-34830i-doit Open v24 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the timeout parameter on the login page.
- CVE-2023-34835A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execut
- CVE-2023-34836A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execut
- CVE-2023-34837A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execut
- CVE-2023-34838A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execut
- CVE-2023-34839A Cross Site Request Forgery (CSRF) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows a remote attacker to gain privileges via a Custom
- CVE-2023-35799Stormshield Endpoint Security Evolution 2.0.0 through 2.3.2 has Insecure Permissions.
- CVE-2023-35800Stormshield Endpoint Security Evolution 2.0.0 through 2.4.2 has Insecure Permissions.