CVEs published July 5, 2023
79 CVEs were published on July 5, 2023: 0 critical, 20 high.
- Published
- 79
- Critical
- 0
- High
- 20
- Medium
- 24
- Low
- 1
- Unrated
- 34
- Now in CISA KEV
- 0
- Fix available
- 40
Most affected products
- Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- 9
- Mozilla Firefox
- 8
- glpi-project glpi
- 7
- AMI MegaRAC_SPx
- 5
- Mozilla Firefox · Mozilla Thunderbird
- 5
- Huawei HarmonyOS · Huawei EMUI
- 4
- 1Panel-dev 1Panel · github.com/1Panel-dev/1Panel
- 2
- Diagon
- 2
- Linux Kernel
- 2
- louislam uptime-kuma · uptime-kuma
- 2
High 20
- CVE-2023-36827Fides vulnerable to Path Traversal in Webserver APIethyca fides · ethyca-fides
- CVE-2023-36821Uptime Kuma vulnerable to authenticated remote code execution via malicious plugin installationlouislam uptime-kuma · uptime-kuma
- CVE-2023-36813Kanboard Authenticated SQL Injections vulnerabilitykanboard
- CVE-2023-36809Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefoxkiwitcms Kiwi · kiwitcms
- CVE-2023-36808GLPI vulnerable to SQL injection through Computer Virtual Machine informationglpi-project glpi
- CVE-2023-35940GLPI vulnerable to unauthenticated access to Dashboard dataglpi-project glpi
- CVE-2023-35939GLPI vulnerable to unauthorized access to Dashboard dataglpi-project glpi
- CVE-2023-35924GLPI vulnerable to SQL injection via inventory agent requestglpi-project glpi
- CVE-2023-35001Linux Kernel nftables Out-Of-Bounds Read/Write VulnerabilityLinux Kernel
- CVE-2023-31248Linux Kernel nftables Use-After-Free Local Privilege Escalation VulnerabilityLinux Kernel
- CVE-2023-34338hard coded cryptographic keyAMI MegaRAC_SPx
- CVE-2023-34337Inadequate Encryption StrengthAMI MegaRAC_SPx
- CVE-2023-27390A heap-based buffer overflow vulnerability exists in the Sequence::DrawText functionality of Diagon v1.0.139.Diagon
- CVE-2023-35974Authenticated Remote Command Execution in the ArubaOS Command Line InterfaceHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-35973Authenticated Remote Command Execution in the ArubaOS Command Line InterfaceHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-35972Authenticated Remote Command Execution in ArubaOS Web-based Management InterfaceHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-35971Unauthenticated Stored Cross-Site Scripting (XSS) in ArubaOS Web-based Management InterfaceHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-3089Ocp & fips modeopenshift · Red Hat OpenShift Serverless +9
- CVE-2023-2880Frauscher Sensortechnik Diagnostic System FDS001 for FAdC/FAdCi Path Traversal vulnerabilityFrauscher Sensortechnik Diagnostic System FDS101 for FAdC/F…
- CVE-2023-37203Insufficient validation in the Drag and Drop API in conjunction with social engineering, may have allowed an attacker to trick end-users intMozilla Firefox
Medium, low and unrated 59
- CVE-2023-36828Statamic's Antlers sanitizer cannot effectively sanitize malicious SVGstatamic cms · statamic/cms
- CVE-2023-36822Uptime Kuma authenticated path traversal via plugin repository name may lead to unavailability or data losslouislam uptime-kuma · uptime-kuma
- CVE-2023-364571Panel vulnerable to command injection when adding container repositories1Panel-dev 1Panel · github.com/1Panel-dev/1Panel
- CVE-2023-364581Panel vulnerable to ommand injection when entering the container terminal1Panel-dev 1Panel · github.com/1Panel-dev/1Panel
- CVE-2023-35936Arbitrary file write is possible in Pandoc when using PDF output or --extract-media with untrusted inputjgm pandoc
- CVE-2023-34457MechanicalSoup vulnerable to malicious web server reading arbitrary files on client using file input inside HTML formMechanicalSoup
- CVE-2023-34244GLPI vulnerable to reflected XSS in search pagesglpi-project glpi
- CVE-2023-34107GLPI vulnerable to unauthorized access to KnowbaseItem dataglpi-project glpi
- CVE-2023-34473Usage of Hard-coded CredentialsAMI MegaRAC_SPx
- CVE-2023-34472AMI SPx contains a vulnerability in the BMC where an Attacker may cause an improper neutralization of CRLF sequences in HTTP Headers.AMI MegaRAC_SPx
- CVE-2023-34471Missing Cryptographic StepAMI MegaRAC_SPx
- CVE-2023-34106GLPI vulnerable to unauthorized access to User dataglpi-project glpi
- CVE-2023-30607icingaweb2-module-jira template and field configuration are susceptible to CSRFicingaweb2-module-jira
- CVE-2023-31194An improper array index validation vulnerability exists in the GraphPlanar::Write functionality of Diagon v1.0.139.Diagon
- CVE-2023-35979Unauthenticated Buffer Overflow Vulnerability in ArubaOS Web-Based Management InterfaceHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-35978Reflected Cross-Site Scripting (XSS) in ArubaOS Web-based Management InterfaceHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-35977Authenticated Sensitive Information Disclosure in ArubaOS Command Line InterfaceHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-35976Authenticated Sensitive Information Disclosure in ArubaOS Command Line InterfaceHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-35975Authenticated Path Traversal in ArubaOS Command Line Interface Allows for Arbitrary File DeletionHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-3515Open Redirect in go-gitea/giteago-gitea/gitea · code.gitea.io/gitea
- CVE-2023-3455Key management vulnerability on system.Huawei HarmonyOS · Huawei EMUI
- CVE-2021-46893Vulnerability of unstrict data verification and parameter check.Huawei HarmonyOS · Huawei EMUI
- CVE-2021-46891Vulnerability of incomplete read and write permission verification in the GPU module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-2538TLS Private Key Accessible to External Partiestyan s5552_bmc
- CVE-2021-46890Vulnerability of incomplete read and write permission verification in the GPU module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-3336TN-5900 Series User Enumeration VulnerabilityMoxa TN-5900 Series
- CVE-2023-37212Memory safety bugs present in Firefox 114.Mozilla Firefox
- CVE-2023-37210A website could prevent a user from exiting full-screen mode via alert and prompt calls.Mozilla Firefox
- CVE-2023-37209A use-after-free condition existed in `NotifyOnHistoryReload` where a `LoadingSessionHistoryEntry` object was freed and a reference to that Mozilla Firefox
- CVE-2023-37206Uploading files which contain symlinks may have allowed an attacker to trick a user into submitting sensitive data to a malicious website.Mozilla Firefox
- CVE-2023-37205The use of RTL Arabic characters in the address bar may have allowed for URL spoofing.Mozilla Firefox
- CVE-2023-37204A website could have obscured the fullscreen notification by using an option element by introducing lag via an expensive computational functMozilla Firefox
- CVE-2023-3482When Firefox is configured to block storage of all cookies, it was still possible to store data in localstorage by using an iframe with a soMozilla Firefox
- CVE-2023-37211Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12.Mozilla Firefox · Mozilla Thunderbird
- CVE-2023-37208When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code.Mozilla Firefox · Mozilla Thunderbird
- CVE-2023-37207A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL.Mozilla Firefox · Mozilla Thunderbird
- CVE-2023-37202Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment Mozilla Firefox · Mozilla Thunderbird
- CVE-2023-37201An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS.Mozilla Firefox · Mozilla Thunderbird
- CVE-2023-34150Apache Any23: Possible excessive allocation of resources reading input.Apache Software Foundation Apache Any23 · org.apache.any23:…
- CVE-2020-23452A cross-site scripting (XSS) vulnerability in Selenium Grid v3.141.59 allows attackers to execute arbitrary web scripts or HTML via a crafte
- CVE-2020-25969gnuplot v5.5 was discovered to contain a buffer overflow via the function plotrequest().
- CVE-2022-42175Insecure Direct Object Reference vulnerability in WHMCS module SolusVM 1 4.1.2 allows an attacker to change the password and hostname of oth
- CVE-2023-25399A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() function.scipy
- CVE-2023-27197PAX A930 device with PayDroid_7.1.1_Virgo_V04.5.02_20220722 can allow an attacker to gain root access by running a crafted binary leveraging
- CVE-2023-27198PAX A930 device with PayDroid_7.1.1_Virgo_V04.5.02_20220722 can allow the execution of arbitrary commands by using the exec service and incl
- CVE-2023-27199PAX Technology A930 PayDroid_7.1.1_Virgo_V04.5.02_20220722 allows attackers to compile a malicious shared library and use LD_PRELOAD to bypa
- CVE-2023-30207A divide by zero issue discovered in Kodi Home Theater Software 19.5 and earlier allows attackers to cause a denial of service via use of cr
- CVE-2023-33201Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability.org.bouncycastle:bcprov-jdk18on · org.bouncycastle:bcpr… +10
- CVE-2023-33335Cross Site Scripting (XSS) in Sophos Sophos iView (The EOL was December 31st 2020) in grpname parameter that allows arbitrary script to be e
- CVE-2023-34654taocms <=3.0.2 is vulnerable to Cross Site Scripting (XSS).
- CVE-2023-35786Zoho ManageEngine ADManager Plus before 7183 allows admin users to exploit an XXE issue to view files.
- CVE-2023-35863In MADEFORNET HTTP Debugger through 9.12, the Windows service does not set the seclevel registry key before launching the driver.
- CVE-2023-36622The websocket configuration endpoint of the Loxone Miniserver Go Gen.2 before 14.1.5.9 allows remote authenticated administrators to inject
- CVE-2023-36623The root password of the Loxone Miniserver Go Gen.2 before 14.2 is calculated using hard-coded secrets and the MAC address.
- CVE-2023-36624Loxone Miniserver Go Gen.2 through 14.0.3.28 allows an authenticated operating system user to escalate privileges via the Sudo configuration
- CVE-2023-36665"protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878.protobufjs
- CVE-2023-36932In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023
- CVE-2023-36933In Progress MOVEit Transfer before 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), it is
- CVE-2023-36934In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023