CVEs published July 3, 2023
41 CVEs were published on July 3, 2023: 1 critical, 13 high.
- Published
- 41
- Critical
- 1
- High
- 13
- Medium
- 9
- Low
- 2
- Unrated
- 16
- Now in CISA KEV
- 0
- Fix available
- 11
Most affected products
- Ovarro TBox MS-CPU32 · Ovarro TBox MS-CPU32-S2 +3
- 5
- cometbft · github.com/cometbft/cometbft
- 2
- Kubernetes · k8s.io/kubernetes
- 2
- NVIDIA DGX A100/A800
- 2
- Trellix Enterprise Security Manager
- 2
- Apache Software Foundation Apache Airflow Apache Hive Provi…
- 1
- Bubka 2FAuth
- 1
- django
- 1
- Google Chrome
- 1
- IBM i
- 1
Critical 1
High 13
- CVE-2023-25522 NVIDIA DGX A100/A800 contains a vulnerability in SBIOS where an attacker may cause improper input validation by providing configuratiNVIDIA DGX A100/A800
- CVE-2023-25521 NVIDIA DGX A100/A800 contains a vulnerability in SBIOS where an attacker may cause execution with unnecessary privileges by leveraging NVIDIA DGX A100/A800
- CVE-2023-25517 NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a guest OS may be able to control resources fNVIDIA vGPU software
- CVE-2023-25516 NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where an unprivileged user can cause an integer overNVIDIA GPU Display Driver for Linux
- CVE-2023-30990IBM i command executionIBM i
- CVE-2023-36609 The affected TBox RTUs run OpenVPN with root privileges and can run user defined configuration scripts.Ovarro TBox MS-CPU32 · Ovarro TBox MS-CPU32-S2 +3
- CVE-2023-36817The King's Temple Church website Leaked Stripe API Key in Public Code Repositorytktchurch website
- CVE-2023-36815Sealos billing system permission control defectlabring sealos · github.com/labring/sealos
- CVE-2023-36814zopefoundation's Products.CMFCore vulnerable to unauthenticated denial of service and crash via unchecked use of input with Python's marshal modulezopefoundation Products.CMFCore · products-cmfcore
- CVE-2023-34451CometBFT may duplicate transactions in the mempool's data structurescometbft · github.com/cometbft/cometbft
- CVE-2023-3314 A vulnerability arises out of a failure to comprehensively sanitize the processing of a zip file(s).Trellix Enterprise Security Manager
- CVE-2023-3313 An OS common injection vulnerability exists in the ESM certificate API, whereby incorrectly neutralized special elements may have allowed aTrellix Enterprise Security Manager
- CVE-2023-36053In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (reguladjango
Medium, low and unrated 27
- CVE-2023-25523 NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in the nvdisasm binary file, where an attacker may cause a NULL pointeNVIDIA CUDA Toolkit
- CVE-2023-2728Bypassing enforce mountable secrets policy imposed by the ServiceAccount admission pluginKubernetes · k8s.io/kubernetes
- CVE-2023-2727Bypassing policies imposed by the ImagePolicyWebhook admission pluginKubernetes · k8s.io/kubernetes
- CVE-2023-3395 All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory.Ovarro TBox MS-CPU32 · Ovarro TBox MS-CPU32-S2 +3
- CVE-2023-36611 The affected TBox RTUs allow low privilege users to access software security tokens of higher privilege.Ovarro TBox MS-CPU32 · Ovarro TBox MS-CPU32-S2 +3
- CVE-2023-36610 The affected TBox RTUs generate software security tokens using insufficient entropy.Ovarro TBox MS-CPU32 · Ovarro TBox MS-CPU32-S2 +3
- CVE-2023-36608 The affected TBox RTUs store hashed passwords using MD5 encryption, which is an insecure encryption algorithm.Ovarro TBox MS-CPU32 · Ovarro TBox MS-CPU32-S2 +3
- CVE-2023-36819Knowage-Server vulnerable to Path traversal in download functionalitiesKnowageLabs Knowage-Server
- CVE-2023-3497Out of bounds read in Google Security Processor firmware in Google Chrome on Chrome OS prior to 114.0.5735.90 allowed a local attacker to peGoogle Chrome
- CVE-2023-34450CometBFT PeerState JSON serialization deadlockcometbft · github.com/cometbft/cometbft
- CVE-2023-36816Cross-Site Scripting (XSS) at Account creation in 2FAuthBubka 2FAuth
- CVE-2023-3438 An unquoted Windows search path vulnerability existed in the install the MOVE 4.10.x and earlier Windows install service (mvagtsce.exe).Trellix Move
- CVE-2020-22151Permissions vulnerability in Fuel-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted zip file to the assests param
- CVE-2020-22152Cross Site Scripting vulnerability in daylight studio FUEL- CMS v.1.4.6 allows a remote attacker to execute arbitrary code via the page titl
- CVE-2020-22153File Upload vulnerability in FUEL-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted .php file to the upload param
- CVE-2020-22597An issue in Jerrscript- project Jerryscrip v.
- CVE-2023-22906Hero Qubo HCD01_02_V1.38_20220125 devices allow TELNET access with root privileges by default, without a password.
- CVE-2023-26258Arcserve UDP through 9.0.6034 allows authentication bypass.
- CVE-2023-26509AnyDesk 7.0.8 allows remote Denial of Service.
- CVE-2023-36162Cross Site Request Forgery vulnerability in ZZCMS v.2023 and earlier allows a remote attacker to gain privileges via the add function in adm
- CVE-2023-36183Buffer Overflow vulnerability in OpenImageIO v.2.4.12.0 and before allows a remote to execute arbitrary code and obtain sensitive informatio
- CVE-2023-36222Cross Site Scripting vulnerability in mlogclub bbs-go v.
- CVE-2023-36223Cross Site Scripting vulnerability in mlogclub bbs-go v.
- CVE-2023-36258An issue in LangChain before 0.0.236 allows an attacker to execute arbitrary code because Python code with os.system, exec, or eval can be ulangchain
- CVE-2023-36291Cross Site Scripting vulnerability in Maxsite CMS v.108.7 allows a remote attacker to execute arbitrary code via the f_content parameter in
- CVE-2023-36377Buffer Overflow vulnerability in mtrojnar osslsigncode v.2.3 and before allows a local attacker to execute arbitrary code via a crafted .exe
- CVE-2023-37378Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory.