# CVEs published 2023-06-27

77 CVEs were published on June 27, 2023: 0 critical, 3 high. Days are UTC.

- [CVE-2023-36464](https://cve.now/CVE-2023-36464.md): Infinite Loop when a comment isn't followed by a character in pypdf (CVSS 6.2, py-pdf pypdf · pypdf2 +1)
- [CVE-2023-3436](https://cve.now/CVE-2023-3436.md): Deadlock in Xpdf 4.04 due to PDF object stream references (CVSS 3.3, Xpdf)
- [CVE-2023-36463](https://cve.now/CVE-2023-36463.md): Cross site scripting (XSS) in meldekarten generator (CVSS 5.3, jucktnich meldekarten-generator)
- [CVE-2023-30993](https://cve.now/CVE-2023-30993.md): IBM Cloud Pak for Security information disclosure (CVSS 6.8, IBM Cloud Pak for Security)
- [CVE-2023-23468](https://cve.now/CVE-2023-23468.md): IBM Robotic Process Automation for Cloud Pak access control (CVSS 5.1, IBM Robotic Process Automation for Cloud Pak)
- [CVE-2023-22593](https://cve.now/CVE-2023-22593.md): IBM Robotic Process Automation for Cloud Pak security configuration (CVSS 4.0, IBM Robotic Process Automation for Cloud Pak)
- [CVE-2022-34352](https://cve.now/CVE-2022-34352.md): IBM QRadar information disclosure (CVSS 6.5, IBM Security QRadar SIEM)
- [CVE-2023-26274](https://cve.now/CVE-2023-26274.md): IBM QRadar cross-site scripting (CVSS 4.6, IBM Security QRadar SIEM)
- [CVE-2023-28857](https://cve.now/CVE-2023-28857.md): LDAP password leak in Apereo CAS - GHSL-2023-009 (CVSS 4.0, Apereo CAS · org.apereo.cas:cas-server-support-x509-core)
- [CVE-2023-26276](https://cve.now/CVE-2023-26276.md): IBM QRadar information disclosure (CVSS 5.9, IBM Security QRadar SIEM)
- [CVE-2023-26273](https://cve.now/CVE-2023-26273.md): IBM QRadar security bypass (CVSS 4.3, IBM Security QRadar SIEM)
- [CVE-2023-32339](https://cve.now/CVE-2023-32339.md): IBM Business Automation Workflow cross-site scripting (CVSS 6.1, IBM Business Automation Workflow)
- [CVE-2023-34240](https://cve.now/CVE-2023-34240.md): Weak passwords allowed in cloudexplorer-lite (CVSS 6.5, CloudExplorer-Dev CloudExplorer-Lite)
- [CVE-2023-34099](https://cve.now/CVE-2023-34099.md): Improper mail validation in Shopware (CVSS 5.3, shopware · shopware/shopware)
- [CVE-2023-34098](https://cve.now/CVE-2023-34098.md): Dependency configuration exposed in Shopware (CVSS 5.3, shopware · shopware/shopware)
- [CVE-2023-36002](https://cve.now/CVE-2023-36002.md): ITM Server Missing Authorization for URL validation (CVSS 4.3, Proofpoint Insider Threat Management)
- [CVE-2023-36000](https://cve.now/CVE-2023-36000.md): ITM Server Missing Authorization for Agent Config (CVSS 6.5, Proofpoint Insider Threat Management)
- [CVE-2023-35998](https://cve.now/CVE-2023-35998.md): ITM Server Missing Authorization in SOAP Endpoints (CVSS 4.6, Proofpoint Insider Threat Management)
- [CVE-2023-3432](https://cve.now/CVE-2023-3432.md): Server-Side Request Forgery (SSRF) in plantuml/plantuml (CVSS 7.2, plantuml/plantuml · net.sourceforge.plantuml:plantuml-mit +1)
- [CVE-2023-2818](https://cve.now/CVE-2023-2818.md): ITM Windows Agent Insecure Filesystem Permissions (CVSS 5.5, Proofpoint Insider Threat Management)
- [CVE-2023-3431](https://cve.now/CVE-2023-3431.md): Improper Access Control in plantuml/plantuml (CVSS 5.3, plantuml/plantuml · net.sourceforge.plantuml:plantuml-mit)
- [CVE-2023-3405](https://cve.now/CVE-2023-3405.md): Denial of service condition in M-Files Server (CVSS 7.5, M-Files Server)
- [CVE-2023-2605](https://cve.now/CVE-2023-2605.md): WP Brutal AI \< 2.0.1 - Admin+ Reflected XSS (no CVSS, wpbrutalai)
- [CVE-2023-2795](https://cve.now/CVE-2023-2795.md): CodeColorer \< 0.10.1 – Admin+ Stored Cross-Site Scripting (no CVSS, CodeColorer)
- [CVE-2023-2326](https://cve.now/CVE-2023-2326.md): Gravity Forms Google Sheet Connector \< 1.3.5 - Access Code Update via CSRF (no CVSS, Gravity Forms Google Sheet Connector · gsheetconnector-grav…)
- [CVE-2023-0588](https://cve.now/CVE-2023-0588.md): Catalyst Connect Zoho CRM Client Portal \< 2.1.0 - Reflected XSS (no CVSS, Catalyst Connect Zoho CRM Client Portal)
- [CVE-2023-2624](https://cve.now/CVE-2023-2624.md): KiviCare Management System \< 3.2.1 - Reflected Cross-Site Scripting (no CVSS, KiviCare)
- [CVE-2023-2628](https://cve.now/CVE-2023-2628.md): KiviCare Management System \< 3.2.1 - Multiple CSRF (no CVSS, KiviCare)
- [CVE-2023-1166](https://cve.now/CVE-2023-1166.md): USM Premium \< 16.3 - Admin+ Stored XSS (no CVSS, Ultimate-Premium-Plugin)
- [CVE-2023-2623](https://cve.now/CVE-2023-2623.md): KiviCare Management System \< 3.2.1 - Subscriber+ Sensitive Information Disclosure (no CVSS, KiviCare)
- [CVE-2023-2592](https://cve.now/CVE-2023-2592.md): FormCraft Premium \< 3.9.7 - Admin+ SQLi (no CVSS, FormCraft)
- [CVE-2023-2068](https://cve.now/CVE-2023-2068.md): File Manager Advanced Shortcode \<= 2.3.2 - Unauthenticated Remote Code Execution through shortcode (no CVSS, file-manager-advanced-shortcode)
- [CVE-2023-2711](https://cve.now/CVE-2023-2711.md): Ultimate Product Catalog \< 5.2.6 - Admin+ Stored XSS (no CVSS, Ultimate Product Catalog)
- [CVE-2023-2842](https://cve.now/CVE-2023-2842.md): WP Inventory Manager \< 2.1.0.14 - Inventory Items Deletion via CSRF (no CVSS, WP Inventory Manager)
- [CVE-2023-1891](https://cve.now/CVE-2023-1891.md): Accordion & FAQ \< 1.9.9 - Reflected XSS (no CVSS, Accordion & FAQ)
- [CVE-2023-0873](https://cve.now/CVE-2023-0873.md): Kanban Boards for WordPress \< 2.5.21 - Admin+ Stored XSS (no CVSS, Kanban Boards for WordPress)
- [CVE-2022-4115](https://cve.now/CVE-2022-4115.md): Editorial Calendar \< 3.8.3 - Contributor+ Stored XSS (no CVSS, Editorial Calendar)
- [CVE-2023-2032](https://cve.now/CVE-2023-2032.md): Custom 404 Pro \< 3.8.1 - Multiple SQL Injection (no CVSS, Custom 404 Pro)
- [CVE-2023-2877](https://cve.now/CVE-2023-2877.md): Formidable Forms \< 6.3.1 - Subscriber+ Remote Code Execution (no CVSS, Formidable Forms)
- [CVE-2023-2601](https://cve.now/CVE-2023-2601.md): WP Brutal AI \< 2.0.0 - SQL Injection via CSRF (no CVSS, wpbrutalai)
- [CVE-2023-2744](https://cve.now/CVE-2023-2744.md): WP ERP \< 1.12.4 - Admin+ SQL Injection (no CVSS, WP ERP | Complete HR solution with recruitment & job listin…)
- [CVE-2023-2482](https://cve.now/CVE-2023-2482.md): Responsive CSS EDITOR \<= 1.0 - Admin+ SQLi (no CVSS, Responsive CSS EDITOR)
- [CVE-2023-2178](https://cve.now/CVE-2023-2178.md): Aajoda Testimonials \< 2.2.2 - Admin+ Stored XSS (no CVSS, Aajoda Testimonials)
- [CVE-2023-2580](https://cve.now/CVE-2023-2580.md): AI-Engine \< 1.6.83 - Admin+ Stored XSS (no CVSS, AI Engine: ChatGPT Chatbot, Content Generator, GPT 3 & 4, U…)
- [CVE-2023-2996](https://cve.now/CVE-2023-2996.md): Jetpack \< 12.1.1 - Author+ Arbitrary File Manipulation via API (no CVSS, Jetpack)
- [CVE-2023-2627](https://cve.now/CVE-2023-2627.md): KiviCare Management System \< 3.2.1 - Subscriber+ Unauthorised AJAX Calls (no CVSS, KiviCare)
- [CVE-2023-2743](https://cve.now/CVE-2023-2743.md): WP ERP \< 1.12.4 - Reflected Cross-Site Scripting (CVSS 6.1, WP ERP | Complete HR solution with recruitment & job listin…)
- [CVE-2023-35798](https://cve.now/CVE-2023-35798.md): Airflow Apache ODBC and MSSQL Providers Arbitrary File Read Vulnerability (low (no CVSS), Apache Software Foundation Apache Airflow ODBC Provider… +2)
- [CVE-2023-34395](https://cve.now/CVE-2023-34395.md): Apache Airflow ODBC Provider: Remote code execution vulnerability (CVSS 7.8, Apache Software Foundation Apache Airflow ODBC Provider · a…)
- [CVE-2023-3423](https://cve.now/CVE-2023-3423.md): Weak Password Requirements in cloudexplorer-dev/cloudexplorer-lite (CVSS 6.5, cloudexplorer-dev/cloudexplorer-lite)
- [CVE-2023-3412](https://cve.now/CVE-2023-3412.md): Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite \<= 1.0.0 - Missing Authorization to Stored Cross-Site Scripting (CVSS 6.4, webcraftplugins Image Map Pro – Drag-and-drop Builder for I…)
- [CVE-2023-3411](https://cve.now/CVE-2023-3411.md): Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite \<= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, webcraftplugins Image Map Pro – Drag-and-drop Builder for I…)
- [CVE-2023-3132](https://cve.now/CVE-2023-3132.md): MainWP Child \<= 4.4.1.1 - Information Disclosure via Back-Up Files (CVSS 5.9, MainWP Child – Securely Connects to the MainWP Dashboard to…)
- [CVE-2023-3371](https://cve.now/CVE-2023-3371.md): EmbedPress \<= 3.7.3 - Sensitive Information Exposure (CVSS 5.3, wpdevteam EmbedPress – PDF Embedder, Embed YouTube Videos,…)
- [CVE-2020-18404](https://cve.now/CVE-2020-18404.md): An issue was discovered in espcms version P8.18101601. (no CVSS)
- [CVE-2020-18406](https://cve.now/CVE-2020-18406.md): An issue was discovered in cmseasy v7.0.0 that allows user credentials to be sent in clear text due to no encryption of form data. (no CVSS)
- [CVE-2020-18409](https://cve.now/CVE-2020-18409.md): Cross Site Request Forgery (CSRF) vulnerability was discovered in CatfishCMS 4.8.63 that would allow attackers to obtain administrator permi (no CVSS)
- [CVE-2020-18410](https://cve.now/CVE-2020-18410.md): A stored cross site scripting (XSS) vulnerability in /index.php?admin-master-article-edit of Chaoji CMS v2.18 that allows attackers to obtai (no CVSS)
- [CVE-2020-18413](https://cve.now/CVE-2020-18413.md): Stored cross site scripting (XSS) vulnerability in /index.php?admin-master-navmenu-add of Chaoji CMS v2.18 that allows attackers to execute (no CVSS)
- [CVE-2020-18414](https://cve.now/CVE-2020-18414.md): Stored cross site scripting (XSS) vulnerability in Chaoji CMS v2.18 that allows attackers to execute arbitrary code via /index.php?admin-mas (no CVSS)
- [CVE-2020-18416](https://cve.now/CVE-2020-18416.md): An cross site request forgery (CSRF) vulnerability discovered in Jymusic v2.0.0.,that allows attackers to execute arbitrary code via /admin. (no CVSS)
- [CVE-2020-18418](https://cve.now/CVE-2020-18418.md): A Cross site request forgery (CSRF) vulnerability was discovered in FeiFeiCMS v4.1.190209, which allows attackers to create administrator ac (no CVSS)
- [CVE-2020-19902](https://cve.now/CVE-2020-19902.md): Directory Traversal vulnerability found in Cryptoprof WCMS v.0.3.2 allows a remote attacker to execute arbitrary code via the wex/cssjs.php (no CVSS)
- [CVE-2021-30203](https://cve.now/CVE-2021-30203.md): A reflected cross-site scripting (XSS) vulnerability in the zero parameter of dzzoffice 2.02.1\_SC\_UTF8 allows attackers to execute arbitrary (no CVSS)
- [CVE-2021-30205](https://cve.now/CVE-2021-30205.md): Incorrect access control in the component /index.php?mod=system&op=orgtree of dzzoffice 2.02.1\_SC\_UTF8 allows unauthenticated attackers to b (no CVSS)
- [CVE-2023-25001](https://cve.now/CVE-2023-25001.md): A maliciously crafted SKP file in Autodesk Navisworks 2023 and 2022 be used to trigger use-after-free vulnerability. (no CVSS, Navisworks)
- [CVE-2023-25002](https://cve.now/CVE-2023-25002.md): A maliciously crafted SKP file in Autodesk products is used to trigger use-after-free vulnerability. (no CVSS, Multiple)
- [CVE-2023-25004](https://cve.now/CVE-2023-25004.md): A maliciously crafted pskernel.dll file in Autodesk products is used to trigger integer overflow vulnerabilities. (no CVSS, Autodesk products)
- [CVE-2023-29068](https://cve.now/CVE-2023-29068.md): A maliciously crafted file consumed through pskernel.dll file could lead to memory corruption vulnerabilities. (no CVSS, Autodesk products)
- [CVE-2023-34830](https://cve.now/CVE-2023-34830.md): i-doit Open v24 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the timeout parameter on the login page. (no CVSS)
- [CVE-2023-34835](https://cve.now/CVE-2023-34835.md): A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execut (no CVSS)
- [CVE-2023-34836](https://cve.now/CVE-2023-34836.md): A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execut (no CVSS)
- [CVE-2023-34837](https://cve.now/CVE-2023-34837.md): A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execut (no CVSS)
- [CVE-2023-34838](https://cve.now/CVE-2023-34838.md): A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execut (no CVSS)
- [CVE-2023-34839](https://cve.now/CVE-2023-34839.md): A Cross Site Request Forgery (CSRF) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows a remote attacker to gain privileges via a Custom (no CVSS)
- [CVE-2023-35799](https://cve.now/CVE-2023-35799.md): Stormshield Endpoint Security Evolution 2.0.0 through 2.3.2 has Insecure Permissions. (no CVSS)
- [CVE-2023-35800](https://cve.now/CVE-2023-35800.md): Stormshield Endpoint Security Evolution 2.0.0 through 2.4.2 has Insecure Permissions. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-06-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.