CVEs published June 30, 2023
80 CVEs were published on June 30, 2023: 7 critical, 9 high.
- Published
- 80
- Critical
- 7
- High
- 9
- Medium
- 17
- Low
- 5
- Unrated
- 42
- Now in CISA KEV
- 0
- Fix available
- 28
Most affected products
- WAVLINK TECHNOLOGY WL-WN531AX2
- 5
- HP LaserJet Pro
- 4
- Microsoft Edge
- 4
- fossbilling/fossbilling
- 3
- Western Digital My Cloud OS
- 3
- gradle
- 2
- Implem Pleasanter
- 2
- Ivanti Endpoint Manager
- 2
- joplin
- 2
- py-pdf pypdf · pypdf2
- 2
Critical 7
- CVE-2023-28323A deserialization of untrusted data exists in EPM 2022 Su3 and all prior versions that allows an unauthenticated user to elevate rights.Ivanti Endpoint Manager
- CVE-2023-22814Authentication Bypass issue in My Cloud OS 5 devicesWestern Digital My Cloud OS
- CVE-2023-36812Remote Code Execution in OpenTSDBopentsdb · net.opentsdb:opentsdb
- CVE-2023-3490SQL Injection in fossbilling/fossbillingfossbilling/fossbilling
- CVE-2023-36477Persistent Cross-site Scripting (XSS) through CKEditor Configuration pages in XWiki Platformxwiki-platform · org.xwiki.platform:xwiki-platform-ckedi… +1
- CVE-2023-3249Web3 – Crypto wallet Login & NFT token gating <= 2.6.0 - Authentication Bypasscyberlord92 Web3 – Crypto wallet Login & NFT token gating
- CVE-2023-2834BookIt <= 2.3.7 - Authentication Bypassstellarwp Bookit — Booking & Appointment Calendar
High 9
- CVE-2023-28324A improper input validation vulnerability exists in Ivanti Endpoint Manager 2022 and below that could allow privilege escalation or remote cIvanti Endpoint Manager
- CVE-2023-30586A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission moNodeJS Node
- CVE-2021-31982Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityMicrosoft Edge
- CVE-2023-3493Improper Neutralization of Formula Elements in a CSV File in fossbilling/fossbillingfossbilling/fossbilling
- CVE-2023-3491Unrestricted Upload of File with Dangerous Type in fossbilling/fossbillingfossbilling/fossbilling
- CVE-2023-26135All versions of the package flatnest are vulnerable to Prototype Pollution via the nest() function in the flatnest/nest.js file.flatnest
- CVE-2023-2846Authentication Bypass Vulnerability in MELSEC-F Series main moduleMitsubishi Electric MELSEC-F Series FX3U-16MR/ES · Mit… +148
- CVE-2023-3063SP Project & Document Manager <= 4.67 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Changesmartypants SP Project & Document Manager
- CVE-2023-29241Improper Information in Cybersecurity Guidebook in Bosch Building Integration System (BIS) 5.0 may lead to wrong configuration which allows Bosch BIS
Medium, low and unrated 64
- CVE-2023-28365A backup file vulnerability found in UniFi applications (Version 7.3.83 and earlier) running on Linux operating systems allows application aUbiquiti UniFi Network application
- CVE-2023-30589The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests.NodeJS Node · node +2
- CVE-2023-31997UniFi OS 3.1 introduces a misconfiguration on consoles running UniFi Network that allows users on a local network to access MongoDB.Ubiquiti UniFi OS
- CVE-2023-28364An Open Redirect vulnerability exists prior to version 1.52.117, where the built-in QR scanner in Brave Browser Android navigated to scannedBrave Software Brave Browser Android
- CVE-2021-34475Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2021-42307Microsoft Edge (Chromium-based) Information Disclosure VulnerabilityMicrosoft Edge
- CVE-2021-34506Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityMicrosoft Edge
- CVE-2023-22815Post-authentication remote command injection vulnerability on Western Digital My Cloud OS 5 devicesWestern Digital My Cloud OS
- CVE-2023-22816Limited Post-Authentication Remote Command Injection in My Cloud ProductsWestern Digital My Cloud OS
- CVE-2023-35946Dependency cache path traversal in Gradlegradle
- CVE-2023-35947Path traversal vulnerabilities in handling of Tar archives in Gradlegradle
- CVE-2023-36810Quadratic runtime with malformed PDF missing xref marker in pypdfpy-pdf pypdf · pypdf2
- CVE-2023-36807Infinite Loop when reading malformed objects in pypdfpy-pdf pypdf · pypdf2
- CVE-2023-3485Insecure Default Authorization in Temporal ServerTemporal Technologies Temporal Server · go.temporal.io/serv…
- CVE-2023-35178Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow when performing a GET request to scan jobs.HP LaserJet Pro
- CVE-2023-35177Certain HP LaserJet Pro print products are potentially vulnerable to a stack-based buffer overflow related to the compact font format parserHP LaserJet Pro
- CVE-2023-35176Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow and/or Denial of Service when using the backup & restorHP LaserJet Pro
- CVE-2023-35175Certain HP LaserJet Pro print products are potentially vulnerable to Potential Remote Code Execution and/or Elevation of Privilege via ServeHP LaserJet Pro
- CVE-2023-26299A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (systeHP PC products using AMI UEFI Firmware
- CVE-2023-3478IBOS OA Add User edit&op=member actionEdit sql injectionIBOS OA
- CVE-2023-3479Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacphestiacp/hestiacp
- CVE-2023-3477RocketSoft Rocket LMS Contact Form store cross site scriptingRocketSoft Rocket LMS
- CVE-2023-3476SimplePHPscripts GuestBook Script URL Parameter preview.php cross site scriptingSimplePHPscripts GuestBook Script
- CVE-2023-3475SimplePHPscripts Event Script URL Parameter preview.php cross site scriptingSimplePHPscripts Event Script
- CVE-2023-3474SimplePHPscripts Simple Blog URL Parameter preview.php cross site scriptingSimplePHPscripts Simple Blog
- CVE-2023-3473Campcodes Retro Cellphone Online Store edit_product.php sql injectionCampcodes Retro Cellphone Online Store
- CVE-2023-28387"NewsPicks" App for Android versions 10.4.5 and earlier and "NewsPicks" App for iOS versions 10.4.2 and earlier use hard-coded credentials, "NewsPicks" App for Android · "NewsPicks" App for iOS
- CVE-2023-32622Improper neutralization of special elements in WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privWAVLINK TECHNOLOGY WL-WN531AX2
- CVE-2023-32621WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to upload arbitrary files and execute OS WAVLINK TECHNOLOGY WL-WN531AX2
- CVE-2023-32620Improper authentication vulnerability in WL-WN531AX2 firmware versions prior to 2023526 allows a network-adjacent attacker to obtain a passwWAVLINK TECHNOLOGY WL-WN531AX2
- CVE-2023-32613Exposure of resource to wrong sphere issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow a network-adjacent attaWAVLINK TECHNOLOGY WL-WN531AX2
- CVE-2023-32612Client-side enforcement of server-side security issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow an attacker WAVLINK TECHNOLOGY WL-WN531AX2
- CVE-2023-32608Directory traversal vulnerability in Pleasanter (Community Edition and Enterprise Edition) 1.3.39.2 and earlier versions allows a remote autImplem Pleasanter
- CVE-2023-32607Stored cross-site scripting vulnerability in Pleasanter (Community Edition and Enterprise Edition) 1.3.39.2 and earlier versions allows a rImplem Pleasanter
- CVE-2023-36539Exposure of information intended to be encrypted by some Zoom clients may lead to disclosure of sensitive information.Zoom Video Communications Zoom clients
- CVE-2023-3469Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaqthorsten/phpmyfaq
- CVE-2020-18432File Upload vulnerability in SEMCMS PHP 3.7 allows remote attackers to upload arbitrary files and gain escalated privileges.
- CVE-2023-1206A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a user makes a new kind ofKernel
- CVE-2023-27469Malwarebytes Anti-Exploit 4.4.0.220 is vulnerable to arbitrary file deletion and denial of service via an ALPC message in which FullFileName
- CVE-2023-2908Libtiff: null pointer dereference in tif_dir.cLibtiff · Red Hat Enterprise Linux +1
- CVE-2023-29145The Malwarebytes EDR 1.0.11 for Linux driver doesn't properly ensure whitelisting of executable libraries loaded by executable files, allowi
- CVE-2023-29147In Malwarebytes EDR 1.0.11 for Linux, it is possible to bypass the detection layers that depend on inode identifiers, because an identifier
- CVE-2023-31543A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the cpipreqs
- CVE-2023-33276The web interface of Gira Giersiepen Gira KNX/IP-Router 3.1.3683.0 and 3.3.8.0 responds with a "404 - Not Found" status code if a path is ac
- CVE-2023-33298com.perimeter81.osx.HelperTool in Perimeter81 10.0.0.19 on macOS allows Local Privilege Escalation (to root) via shell metacharacters in usi
- CVE-2023-33336Reflected cross site scripting (XSS) vulnerability was discovered in Sophos Web Appliance v4.3.9.1 that allows for arbitrary code to be inpu
- CVE-2023-3338Crash due to a null pointer dereference in the dn_nsp_send functionkernel · Red Hat Enterprise Linux +1
- CVE-2023-34840angular-ui-notification v0.1.0, v0.2.0, and v0.3.6 was discovered to contain a cross-site scripting (XSS) vulnerability.angular-ui-notification
- CVE-2023-36143Maxprint Maxlink 1200G v3.4.11E has an OS command injection vulnerability in the "Diagnostic tool" functionality of the device.
- CVE-2023-36144An authentication bypass in Intelbras Switch SG 2404 MR in firmware 1.00.54 allows an unauthenticated attacker to download the backup file o
- CVE-2023-36146A Stored Cross-Site Scripting (XSS) vulnerability was found in Multilaser RE 170 using firmware 2.2.6733.
- CVE-2023-36347A broken authentication mechanism in the endpoint excel.php of POS Codekop v2.0 allows unauthenticated attackers to download selling data.
- CVE-2023-37298Joplin before 2.11.5 allows XSS via a USE element in an SVG document.joplin
- CVE-2023-37299Joplin before 2.11.5 allows XSS via an AREA element of an image map.joplin
- CVE-2023-37300An issue was discovered in the CheckUserLog API in the CheckUser extension for MediaWiki through 1.39.3.
- CVE-2023-37301An issue was discovered in SubmitEntityAction in Wikibase in MediaWiki through 1.39.3.
- CVE-2023-37302An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3.wikibase/wikibase
- CVE-2023-37303An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3.
- CVE-2023-37304An issue was discovered in the DoubleWiki extension for MediaWiki through 1.39.3.
- CVE-2023-37305An issue was discovered in the ProofreadPage (aka Proofread Page) extension for MediaWiki through 1.39.3.
- CVE-2023-37306MISP 2.4.172 mishandles different certificate file extensions in server sync.
- CVE-2023-37307In MISP before 2.4.172, title_for_layout is not properly sanitized in Correlations, CorrelationExclusions, and Layouts.
- CVE-2023-37360pacparser_find_proxy in Pacparser before 1.4.2 allows JavaScript injection, and possibly privilege escalation, when the attacker controls thpacparser
- CVE-2023-37365Hnswlib 0.7.0 has a double free in init_index when the M argument is a large integer.hnswlib