CVEs published June 29, 2023
64 CVEs were published on June 29, 2023: 7 critical, 5 high.
- Published
- 64
- Critical
- 7
- High
- 5
- Medium
- 8
- Low
- 4
- Unrated
- 40
- Now in CISA KEV
- 0
- Fix available
- 18
Most affected products
- Microsoft Edge
- 5
- SimplePHPscripts Classified Ads Script
- 2
- SourceCodester Shopping Website
- 2
- Apache Software Foundation Apache Airflow JDBC Provider · a…
- 1
- calamares-nixos-extensions
- 1
- com.palantir.issues:issues
- 1
- com.palantir.workspace:workspace
- 1
- cyberlord92 Active Directory Integration / LDAP Integration
- 1
- cyberlord92 miniOrange Social Login and Register
- 1
- easy-parse
- 1
Critical 7
- CVE-2023-36468Upgrading doesn't prevent exploiting vulnerable XWiki documentsxwiki-platform · org.xwiki.platform:xwiki-platform-oldcore
- CVE-2023-36469Code injection through NotificationRSSService in XWiki Platformxwiki-platform · org.xwiki.platform:xwiki-platform-notifica…
- CVE-2023-36470Code injection in icon themes of XWiki Platformxwiki-platform · org.xwiki.platform:xwiki-platform-icon-… +2
- CVE-2023-36471HTML sanitizer allows form elements in restricted in org.xwiki.commons:xwiki-commons-xmlxwiki-commons · org.xwiki.commons:xwiki-commons-xml
- CVE-2023-33190Improperly configured permissions in Sealoslabring sealos · github.com/labring/sealos
- CVE-2023-31222Medtronic Paceart MSMQ Deserialization of Untrusted DataMedtronic Paceart Optima
- CVE-2023-2982WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.4 - Authentication Bypasscyberlord92 miniOrange Social Login and Register
High 5
- CVE-2023-22886Apache Airflow JDBC Provider: RCE VulnerabilityApache Software Foundation Apache Airflow JDBC Provider · a…
- CVE-2023-3447Active Directory Integration / LDAP Integration <= 4.1.5 - Authenticated (Subscriber+) LDAP Injectioncyberlord92 Active Directory Integration / LDAP Integration
- CVE-2022-29146Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2022-29144Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2023-36476`calamares-nixos-extensions` LUKS keyfile exposurecalamares-nixos-extensions
Medium, low and unrated 52
- CVE-2023-3465SimplePHPscripts Classified Ads Script HTTP POST Request user.php cross site scriptingSimplePHPscripts Classified Ads Script
- CVE-2023-3464SimplePHPscripts Classified Ads Script URL Parameter preview.php cross site scriptingSimplePHPscripts Classified Ads Script
- CVE-2023-36607CVE-2023-36607Ovarro TBox RM2 · Ovarro TBox TG2 +3
- CVE-2023-35938User access not updated with privilege change in TuleapEnalean tuleap
- CVE-2023-30946Issues notification metadata lacks authorizationcom.palantir.issues:issues
- CVE-2023-30955Foundry workspace-server Developer Mode Authorization Bypasscom.palantir.workspace:workspace
- CVE-2015-1313JetBrains TeamCity 8 and 9 before 9.0.2 allows bypass of account-creation restrictions via a crafted request because the required request daJetBrains TeamCity
- CVE-2023-3458SourceCodester Shopping Website forgot-password.php sql injectionSourceCodester Shopping Website
- CVE-2023-3457SourceCodester Shopping Website index.php sql injectionSourceCodester Shopping Website
- CVE-2022-23264Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2023-1602The Short URL plugin for WordPress is vulnerable to stored Cross-Site Scripting via the 'comment' parameter due to insufficient input sanitikaizencoders Short URL
- CVE-2022-26899Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2023-32610Mailform Pro CGI 4.3.1.2 and earlier allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition.SYNCK GRAPHICA Mailform Pro CGI
- CVE-2022-29147Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2020-26708requests-xml v0.2.3 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrarequests-xml
- CVE-2020-26709py-xml v1.0 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code py-xml
- CVE-2020-26710easy-parse v0.1.1 was discovered to contain a XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary easy-parse
- CVE-2022-44719An issue was discovered in Weblib Ucopia before 6.0.13.
- CVE-2022-44720An issue was discovered in Weblib Ucopia before 6.0.13.
- CVE-2022-46407Ericsson Network Manager (ENM), versions prior to 22.2, contains a vulnerability in the REST endpoint “editprofile” where Open Redirect HTTP
- CVE-2022-46408Ericsson Network Manager (ENM), versions prior to 22.1, contains a vulnerability in the application Network Connectivity Manager (NCM) where
- CVE-2023-25433libtiff 4.5.0 is vulnerable to Buffer Overflow via /libtiff/tools/tiffcrop.c:8499.
- CVE-2023-26085A possible out-of-bounds read and write (due to an improper length check of shared memory) was discovered in Arm NN Android-NN-Driver before
- CVE-2023-26612D-Link DIR-823G firmware version 1.02B05 has a buffer overflow vulnerability, which originates from the HostName field in SetParentsControlI
- CVE-2023-26613An OS command injection vulnerability in D-Link DIR-823G firmware version 1.02B05 allows unauthorized attackers to execute arbitrary operati
- CVE-2023-26616D-Link DIR-823G firmware version 1.02B05 has a buffer overflow vulnerability, which originates from the URL field in SetParentsControlInfo.
- CVE-2023-26966libtiff 4.5.0 is vulnerable to Buffer Overflow in uv_encode() when libtiff reads a corrupted little-endian TIFF file and specifies the outpu
- CVE-2023-33277The web interface of Gira Giersiepen Gira KNX/IP-Router 3.1.3683.0 and 3.3.8.0 allows a remote attacker to read sensitive files via director
- CVE-2023-33466Orthanc before 1.12.0 allows authenticated users with access to the Orthanc API to overwrite arbitrary files on the file system, and in spec
- CVE-2023-34486itsourcecode Online Hotel Management System Project In PHP v1.0.0 is vulnerable to Cross Site Scripting (XSS).
- CVE-2023-34487itsourcecode Online Hotel Management System Project In PHP v1.0.0 is vulnerable to SQL Injection.
- CVE-2023-34598Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to include the content of several files present in the inst
- CVE-2023-34599Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to execute arbitrary Java
- CVE-2023-34648A Cross Site Scripting vulnerability in PHPgurukl User Registration Login and User Management System with admin panel v.1.0 allows a local a
- CVE-2023-34656An issue was discovered with the JSESSION IDs in Xiamen Si Xin Communication Technology Video management system 3.1 thru 4.1 allows attacker
- CVE-2023-34658Telegram v9.6.3 on iOS allows attackers to hide critical information on the User Interface via calling the function SFSafariViewController.
- CVE-2023-34734Annet AC Centralized Management Platform 1.02.040 is vulnerable to Stored Cross-Site Scripting (XSS) .
- CVE-2023-34735Property Cloud Platform Management Center 1.0 is vulnerable to error-based SQL injection.
- CVE-2023-34831The "Submission Web Form" of Turnitin LTI tool/plugin version 1.3 is affected by HTML Injection attacks.
- CVE-2023-34834A Directory Browsing vulnerability in MCL-Net version 4.3.5.8788 webserver running on default port 5080, allows attackers to gain sensitive
- CVE-2023-34844Play With Docker < 0.0.2 has an insecure CAP_SYS_ADMIN privileged mode causing the docker container to escape.
- CVE-2023-34849An unauthorized command injection vulnerability exists in the ActionLogin function of the webman.lua file in Ikuai router OS through 3.7.1.
- CVE-2023-35830STW (aka Sensor-Technik Wiedemann) TCG-4 Connectivity Module DeploymentPackage_v3.03r0-Impala and DeploymentPackage_v3.04r2-Jellyfish and TC
- CVE-2023-36484ILIAS 7.21 and 8.0_beta1 through 8.2 is vulnerable to reflected Cross-Site Scripting (XSS).
- CVE-2023-36487The password reset function in ILIAS 7.0_beta1 through 7.20 and 8.0_beta1 through 8.1 allows remote attackers to take over the account.
- CVE-2023-36488ILIAS 7.21 and 8.0_beta1 through 8.2 is vulnerable to stored Cross Site Scripting (XSS).
- CVE-2023-36617A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby.uri
- CVE-2023-37237In Veritas NetBackup Appliance before 4.1.0.1 MR3, insecure permissions may allow an authenticated Admin to bypass shell restrictions and ex
- CVE-2023-37251An issue was discovered in the GoogleAnalyticsMetrics extension for MediaWiki through 1.39.3.
- CVE-2023-37254An issue was discovered in the Cargo extension for MediaWiki through 1.39.3.
- CVE-2023-37255An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3.
- CVE-2023-37256An issue was discovered in the Cargo extension for MediaWiki through 1.39.3.