# CVEs published 2023-06-29

64 CVEs were published on June 29, 2023: 7 critical, 5 high. Days are UTC.

- [CVE-2023-3465](https://cve.now/CVE-2023-3465.md): SimplePHPscripts Classified Ads Script HTTP POST Request user.php cross site scripting (CVSS 3.5, SimplePHPscripts Classified Ads Script)
- [CVE-2023-36468](https://cve.now/CVE-2023-36468.md): Upgrading doesn't prevent exploiting vulnerable XWiki documents (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-oldcore)
- [CVE-2023-36469](https://cve.now/CVE-2023-36469.md): Code injection through NotificationRSSService in XWiki Platform (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-notifica…)
- [CVE-2023-36470](https://cve.now/CVE-2023-36470.md): Code injection in icon themes of XWiki Platform (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-icon-… +2)
- [CVE-2023-3464](https://cve.now/CVE-2023-3464.md): SimplePHPscripts Classified Ads Script URL Parameter preview.php cross site scripting (CVSS 3.5, SimplePHPscripts Classified Ads Script)
- [CVE-2023-36607](https://cve.now/CVE-2023-36607.md): CVE-2023-36607 (no CVSS, Ovarro TBox RM2 · Ovarro TBox TG2 +3)
- [CVE-2023-36471](https://cve.now/CVE-2023-36471.md): HTML sanitizer allows form elements in restricted in org.xwiki.commons:xwiki-commons-xml (CVSS 9.1, xwiki-commons · org.xwiki.commons:xwiki-commons-xml)
- [CVE-2023-35938](https://cve.now/CVE-2023-35938.md): User access not updated with privilege change in Tuleap (CVSS 4.1, Enalean tuleap)
- [CVE-2023-30946](https://cve.now/CVE-2023-30946.md): Issues notification metadata lacks authorization (CVSS 3.5, com.palantir.issues:issues)
- [CVE-2023-30955](https://cve.now/CVE-2023-30955.md): Foundry workspace-server Developer Mode Authorization Bypass (CVSS 4.3, com.palantir.workspace:workspace)
- [CVE-2023-33190](https://cve.now/CVE-2023-33190.md): Improperly configured permissions in Sealos (CVSS 10.0, labring sealos · github.com/labring/sealos)
- [CVE-2023-31222](https://cve.now/CVE-2023-31222.md): Medtronic Paceart MSMQ Deserialization of Untrusted Data (CVSS 9.8, Medtronic Paceart Optima)
- [CVE-2015-1313](https://cve.now/CVE-2015-1313.md): JetBrains TeamCity 8 and 9 before 9.0.2 allows bypass of account-creation restrictions via a crafted request because the required request da (no CVSS, JetBrains TeamCity)
- [CVE-2023-3458](https://cve.now/CVE-2023-3458.md): SourceCodester Shopping Website forgot-password.php sql injection (CVSS 6.3, SourceCodester Shopping Website)
- [CVE-2023-3457](https://cve.now/CVE-2023-3457.md): SourceCodester Shopping Website index.php sql injection (CVSS 6.3, SourceCodester Shopping Website)
- [CVE-2023-22886](https://cve.now/CVE-2023-22886.md): Apache Airflow JDBC Provider: RCE Vulnerability (CVSS 8.8, Apache Software Foundation Apache Airflow JDBC Provider · a…)
- [CVE-2023-3447](https://cve.now/CVE-2023-3447.md): Active Directory Integration / LDAP Integration \<= 4.1.5 - Authenticated (Subscriber+) LDAP Injection (CVSS 7.6, cyberlord92 Active Directory Integration / LDAP Integration)
- [CVE-2022-23264](https://cve.now/CVE-2022-23264.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 4.7, Microsoft Edge)
- [CVE-2023-1602](https://cve.now/CVE-2023-1602.md): The Short URL plugin for WordPress is vulnerable to stored Cross-Site Scripting via the 'comment' parameter due to insufficient input saniti (CVSS 4.4, kaizencoders Short URL)
- [CVE-2023-2982](https://cve.now/CVE-2023-2982.md): WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) \<= 7.6.4 - Authentication Bypass (CVSS 9.8, cyberlord92 miniOrange Social Login and Register)
- [CVE-2022-26899](https://cve.now/CVE-2022-26899.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 6.3, Microsoft Edge)
- [CVE-2023-32610](https://cve.now/CVE-2023-32610.md): Mailform Pro CGI 4.3.1.2 and earlier allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition. (no CVSS, SYNCK GRAPHICA Mailform Pro CGI)
- [CVE-2022-29147](https://cve.now/CVE-2022-29147.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 3.1, Microsoft Edge)
- [CVE-2022-29146](https://cve.now/CVE-2022-29146.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 8.3, Microsoft Edge)
- [CVE-2022-29144](https://cve.now/CVE-2022-29144.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft Edge)
- [CVE-2023-36476](https://cve.now/CVE-2023-36476.md): \`calamares-nixos-extensions\` LUKS keyfile exposure (CVSS 7.9, calamares-nixos-extensions)
- [CVE-2020-26708](https://cve.now/CVE-2020-26708.md): requests-xml v0.2.3 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitra (no CVSS, requests-xml)
- [CVE-2020-26709](https://cve.now/CVE-2020-26709.md): py-xml v1.0 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code (no CVSS, py-xml)
- [CVE-2020-26710](https://cve.now/CVE-2020-26710.md): easy-parse v0.1.1 was discovered to contain a XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary (no CVSS, easy-parse)
- [CVE-2022-44719](https://cve.now/CVE-2022-44719.md): An issue was discovered in Weblib Ucopia before 6.0.13. (no CVSS)
- [CVE-2022-44720](https://cve.now/CVE-2022-44720.md): An issue was discovered in Weblib Ucopia before 6.0.13. (no CVSS)
- [CVE-2022-46407](https://cve.now/CVE-2022-46407.md): Ericsson Network Manager (ENM), versions prior to 22.2, contains a vulnerability in the REST endpoint “editprofile” where Open Redirect HTTP (no CVSS)
- [CVE-2022-46408](https://cve.now/CVE-2022-46408.md): Ericsson Network Manager (ENM), versions prior to 22.1, contains a vulnerability in the application Network Connectivity Manager (NCM) where (no CVSS)
- [CVE-2023-25433](https://cve.now/CVE-2023-25433.md): libtiff 4.5.0 is vulnerable to Buffer Overflow via /libtiff/tools/tiffcrop.c:8499. (no CVSS)
- [CVE-2023-26085](https://cve.now/CVE-2023-26085.md): A possible out-of-bounds read and write (due to an improper length check of shared memory) was discovered in Arm NN Android-NN-Driver before (no CVSS)
- [CVE-2023-26612](https://cve.now/CVE-2023-26612.md): D-Link DIR-823G firmware version 1.02B05 has a buffer overflow vulnerability, which originates from the HostName field in SetParentsControlI (no CVSS)
- [CVE-2023-26613](https://cve.now/CVE-2023-26613.md): An OS command injection vulnerability in D-Link DIR-823G firmware version 1.02B05 allows unauthorized attackers to execute arbitrary operati (no CVSS)
- [CVE-2023-26616](https://cve.now/CVE-2023-26616.md): D-Link DIR-823G firmware version 1.02B05 has a buffer overflow vulnerability, which originates from the URL field in SetParentsControlInfo. (no CVSS)
- [CVE-2023-26966](https://cve.now/CVE-2023-26966.md): libtiff 4.5.0 is vulnerable to Buffer Overflow in uv\_encode() when libtiff reads a corrupted little-endian TIFF file and specifies the outpu (no CVSS)
- [CVE-2023-33277](https://cve.now/CVE-2023-33277.md): The web interface of Gira Giersiepen Gira KNX/IP-Router 3.1.3683.0 and 3.3.8.0 allows a remote attacker to read sensitive files via director (no CVSS)
- [CVE-2023-33466](https://cve.now/CVE-2023-33466.md): Orthanc before 1.12.0 allows authenticated users with access to the Orthanc API to overwrite arbitrary files on the file system, and in spec (no CVSS)
- [CVE-2023-34486](https://cve.now/CVE-2023-34486.md): itsourcecode Online Hotel Management System Project In PHP v1.0.0 is vulnerable to Cross Site Scripting (XSS). (no CVSS)
- [CVE-2023-34487](https://cve.now/CVE-2023-34487.md): itsourcecode Online Hotel Management System Project In PHP v1.0.0 is vulnerable to SQL Injection. (no CVSS)
- [CVE-2023-34598](https://cve.now/CVE-2023-34598.md): Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to include the content of several files present in the inst (no CVSS)
- [CVE-2023-34599](https://cve.now/CVE-2023-34599.md): Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to execute arbitrary Java (no CVSS)
- [CVE-2023-34648](https://cve.now/CVE-2023-34648.md): A Cross Site Scripting vulnerability in PHPgurukl User Registration Login and User Management System with admin panel v.1.0 allows a local a (no CVSS)
- [CVE-2023-34656](https://cve.now/CVE-2023-34656.md): An issue was discovered with the JSESSION IDs in Xiamen Si Xin Communication Technology Video management system 3.1 thru 4.1 allows attacker (no CVSS)
- [CVE-2023-34658](https://cve.now/CVE-2023-34658.md): Telegram v9.6.3 on iOS allows attackers to hide critical information on the User Interface via calling the function SFSafariViewController. (no CVSS)
- [CVE-2023-34734](https://cve.now/CVE-2023-34734.md): Annet AC Centralized Management Platform 1.02.040 is vulnerable to Stored Cross-Site Scripting (XSS) . (no CVSS)
- [CVE-2023-34735](https://cve.now/CVE-2023-34735.md): Property Cloud Platform Management Center 1.0 is vulnerable to error-based SQL injection. (no CVSS)
- [CVE-2023-34831](https://cve.now/CVE-2023-34831.md): The "Submission Web Form" of Turnitin LTI tool/plugin version 1.3 is affected by HTML Injection attacks. (no CVSS)
- [CVE-2023-34834](https://cve.now/CVE-2023-34834.md): A Directory Browsing vulnerability in MCL-Net version 4.3.5.8788 webserver running on default port 5080, allows attackers to gain sensitive (no CVSS)
- [CVE-2023-34844](https://cve.now/CVE-2023-34844.md): Play With Docker \< 0.0.2 has an insecure CAP\_SYS\_ADMIN privileged mode causing the docker container to escape. (no CVSS)
- [CVE-2023-34849](https://cve.now/CVE-2023-34849.md): An unauthorized command injection vulnerability exists in the ActionLogin function of the webman.lua file in Ikuai router OS through 3.7.1. (no CVSS)
- [CVE-2023-35830](https://cve.now/CVE-2023-35830.md): STW (aka Sensor-Technik Wiedemann) TCG-4 Connectivity Module DeploymentPackage\_v3.03r0-Impala and DeploymentPackage\_v3.04r2-Jellyfish and TC (no CVSS)
- [CVE-2023-36484](https://cve.now/CVE-2023-36484.md): ILIAS 7.21 and 8.0\_beta1 through 8.2 is vulnerable to reflected Cross-Site Scripting (XSS). (no CVSS)
- [CVE-2023-36487](https://cve.now/CVE-2023-36487.md): The password reset function in ILIAS 7.0\_beta1 through 7.20 and 8.0\_beta1 through 8.1 allows remote attackers to take over the account. (no CVSS)
- [CVE-2023-36488](https://cve.now/CVE-2023-36488.md): ILIAS 7.21 and 8.0\_beta1 through 8.2 is vulnerable to stored Cross Site Scripting (XSS). (no CVSS)
- [CVE-2023-36617](https://cve.now/CVE-2023-36617.md): A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. (no CVSS, uri)
- [CVE-2023-37237](https://cve.now/CVE-2023-37237.md): In Veritas NetBackup Appliance before 4.1.0.1 MR3, insecure permissions may allow an authenticated Admin to bypass shell restrictions and ex (CVSS 6.5)
- [CVE-2023-37251](https://cve.now/CVE-2023-37251.md): An issue was discovered in the GoogleAnalyticsMetrics extension for MediaWiki through 1.39.3. (no CVSS)
- [CVE-2023-37254](https://cve.now/CVE-2023-37254.md): An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. (no CVSS)
- [CVE-2023-37255](https://cve.now/CVE-2023-37255.md): An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. (no CVSS)
- [CVE-2023-37256](https://cve.now/CVE-2023-37256.md): An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-06-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.