# CVEs published 2023-07-03

41 CVEs were published on July 3, 2023: 1 critical, 13 high. Days are UTC.

- [CVE-2023-25523](https://cve.now/CVE-2023-25523.md): NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in the nvdisasm binary file, where an attacker may cause a NULL pointe (CVSS 3.3, NVIDIA CUDA Toolkit)
- [CVE-2023-25522](https://cve.now/CVE-2023-25522.md): NVIDIA DGX A100/A800 contains a vulnerability in SBIOS where an attacker may cause improper input validation by providing configurati (CVSS 7.5, NVIDIA DGX A100/A800)
- [CVE-2023-25521](https://cve.now/CVE-2023-25521.md): NVIDIA DGX A100/A800 contains a vulnerability in SBIOS where an attacker may cause execution with unnecessary privileges by leveraging (CVSS 7.5, NVIDIA DGX A100/A800)
- [CVE-2023-25517](https://cve.now/CVE-2023-25517.md): NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a guest OS may be able to control resources f (CVSS 7.1, NVIDIA vGPU software)
- [CVE-2023-25516](https://cve.now/CVE-2023-25516.md): NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where an unprivileged user can cause an integer over (CVSS 7.1, NVIDIA GPU Display Driver for Linux)
- [CVE-2023-30990](https://cve.now/CVE-2023-30990.md): IBM i command execution (CVSS 8.6, IBM i)
- [CVE-2023-2728](https://cve.now/CVE-2023-2728.md): Bypassing enforce mountable secrets policy imposed by the ServiceAccount admission plugin (CVSS 6.5, Kubernetes · k8s.io/kubernetes)
- [CVE-2023-2727](https://cve.now/CVE-2023-2727.md): Bypassing policies imposed by the ImagePolicyWebhook admission plugin (CVSS 6.5, Kubernetes · k8s.io/kubernetes)
- [CVE-2023-3395](https://cve.now/CVE-2023-3395.md): ​All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory. (CVSS 6.5, Ovarro TBox MS-CPU32 · Ovarro ​TBox MS-CPU32-S2 +3)
- [CVE-2023-36611](https://cve.now/CVE-2023-36611.md): The affected TBox RTUs allow low privilege users to access software security tokens of higher privilege. (CVSS 6.5, Ovarro TBox MS-CPU32 · Ovarro ​TBox MS-CPU32-S2 +3)
- [CVE-2023-36610](https://cve.now/CVE-2023-36610.md): ​The affected TBox RTUs generate software security tokens using insufficient entropy. (CVSS 5.9, Ovarro TBox MS-CPU32 · Ovarro ​TBox MS-CPU32-S2 +3)
- [CVE-2023-36609](https://cve.now/CVE-2023-36609.md): The affected TBox RTUs run OpenVPN with root privileges and can run user defined configuration scripts. (CVSS 7.2, Ovarro TBox MS-CPU32 · Ovarro ​TBox MS-CPU32-S2 +3)
- [CVE-2023-36608](https://cve.now/CVE-2023-36608.md): The affected TBox RTUs store hashed passwords using MD5 encryption, which is an insecure encryption algorithm. (CVSS 6.5, Ovarro TBox MS-CPU32 · Ovarro ​TBox MS-CPU32-S2 +3)
- [CVE-2023-36819](https://cve.now/CVE-2023-36819.md): Knowage-Server vulnerable to Path traversal in download functionalities (CVSS 6.5, KnowageLabs Knowage-Server)
- [CVE-2023-36817](https://cve.now/CVE-2023-36817.md): The King's Temple Church website Leaked Stripe API Key in Public Code Repository (CVSS 7.5, tktchurch website)
- [CVE-2023-36815](https://cve.now/CVE-2023-36815.md): Sealos billing system permission control defect (CVSS 7.3, labring sealos · github.com/labring/sealos)
- [CVE-2023-3497](https://cve.now/CVE-2023-3497.md): Out of bounds read in Google Security Processor firmware in Google Chrome on Chrome OS prior to 114.0.5735.90 allowed a local attacker to pe (no CVSS, Google Chrome)
- [CVE-2023-36814](https://cve.now/CVE-2023-36814.md): zopefoundation's Products.CMFCore vulnerable to unauthenticated denial of service and crash via unchecked use of input with Python's marshal module (CVSS 7.5, zopefoundation Products.CMFCore · products-cmfcore)
- [CVE-2023-34450](https://cve.now/CVE-2023-34450.md): CometBFT PeerState JSON serialization deadlock (CVSS 3.7, cometbft · github.com/cometbft/cometbft)
- [CVE-2023-34451](https://cve.now/CVE-2023-34451.md): CometBFT may duplicate transactions in the mempool's data structures (CVSS 8.2, cometbft · github.com/cometbft/cometbft)
- [CVE-2023-36816](https://cve.now/CVE-2023-36816.md): Cross-Site Scripting (XSS) at Account creation in 2FAuth (CVSS 6.1, Bubka 2FAuth)
- [CVE-2023-35797](https://cve.now/CVE-2023-35797.md): Apache Airflow Hive Provider Beeline RCE with Principal (CVSS 9.8, Apache Software Foundation Apache Airflow Apache Hive Provi…)
- [CVE-2023-3314](https://cve.now/CVE-2023-3314.md): A vulnerability arises out of a failure to comprehensively sanitize the processing of a zip file(s). (CVSS 8.1, Trellix Enterprise Security Manager)
- [CVE-2023-3313](https://cve.now/CVE-2023-3313.md): An OS common injection vulnerability exists in the ESM certificate API, whereby incorrectly neutralized special elements may have allowed a (CVSS 7.8, Trellix Enterprise Security Manager)
- [CVE-2023-3438](https://cve.now/CVE-2023-3438.md): An unquoted Windows search path vulnerability existed in the install the MOVE 4.10.x and earlier Windows install service (mvagtsce.exe). (CVSS 4.4, Trellix Move)
- [CVE-2020-22151](https://cve.now/CVE-2020-22151.md): Permissions vulnerability in Fuel-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted zip file to the assests param (no CVSS)
- [CVE-2020-22152](https://cve.now/CVE-2020-22152.md): Cross Site Scripting vulnerability in daylight studio FUEL- CMS v.1.4.6 allows a remote attacker to execute arbitrary code via the page titl (no CVSS)
- [CVE-2020-22153](https://cve.now/CVE-2020-22153.md): File Upload vulnerability in FUEL-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted .php file to the upload param (no CVSS)
- [CVE-2020-22597](https://cve.now/CVE-2020-22597.md): An issue in Jerrscript- project Jerryscrip v. (no CVSS)
- [CVE-2023-22906](https://cve.now/CVE-2023-22906.md): Hero Qubo HCD01\_02\_V1.38\_20220125 devices allow TELNET access with root privileges by default, without a password. (no CVSS)
- [CVE-2023-26258](https://cve.now/CVE-2023-26258.md): Arcserve UDP through 9.0.6034 allows authentication bypass. (no CVSS)
- [CVE-2023-26509](https://cve.now/CVE-2023-26509.md): AnyDesk 7.0.8 allows remote Denial of Service. (no CVSS)
- [CVE-2023-36053](https://cve.now/CVE-2023-36053.md): In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regula (CVSS 7.5, django)
- [CVE-2023-36162](https://cve.now/CVE-2023-36162.md): Cross Site Request Forgery vulnerability in ZZCMS v.2023 and earlier allows a remote attacker to gain privileges via the add function in adm (no CVSS)
- [CVE-2023-36183](https://cve.now/CVE-2023-36183.md): Buffer Overflow vulnerability in OpenImageIO v.2.4.12.0 and before allows a remote to execute arbitrary code and obtain sensitive informatio (no CVSS)
- [CVE-2023-36222](https://cve.now/CVE-2023-36222.md): Cross Site Scripting vulnerability in mlogclub bbs-go v. (no CVSS)
- [CVE-2023-36223](https://cve.now/CVE-2023-36223.md): Cross Site Scripting vulnerability in mlogclub bbs-go v. (no CVSS)
- [CVE-2023-36258](https://cve.now/CVE-2023-36258.md): An issue in LangChain before 0.0.236 allows an attacker to execute arbitrary code because Python code with os.system, exec, or eval can be u (no CVSS, langchain)
- [CVE-2023-36291](https://cve.now/CVE-2023-36291.md): Cross Site Scripting vulnerability in Maxsite CMS v.108.7 allows a remote attacker to execute arbitrary code via the f\_content parameter in (no CVSS)
- [CVE-2023-36377](https://cve.now/CVE-2023-36377.md): Buffer Overflow vulnerability in mtrojnar osslsigncode v.2.3 and before allows a local attacker to execute arbitrary code via a crafted .exe (no CVSS)
- [CVE-2023-37378](https://cve.now/CVE-2023-37378.md): Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-07-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.