# CVEs published 2023-07-05

79 CVEs were published on July 5, 2023: 0 critical, 20 high. Days are UTC.

- [CVE-2023-36828](https://cve.now/CVE-2023-36828.md): Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG (CVSS 5.5, statamic cms · statamic/cms)
- [CVE-2023-36827](https://cve.now/CVE-2023-36827.md): Fides vulnerable to Path Traversal in Webserver API (CVSS 7.5, ethyca fides · ethyca-fides)
- [CVE-2023-36822](https://cve.now/CVE-2023-36822.md): Uptime Kuma authenticated path traversal via plugin repository name may lead to unavailability or data loss (CVSS 6.5, louislam uptime-kuma · uptime-kuma)
- [CVE-2023-36821](https://cve.now/CVE-2023-36821.md): Uptime Kuma vulnerable to authenticated remote code execution via malicious plugin installation (CVSS 8.8, louislam uptime-kuma · uptime-kuma)
- [CVE-2023-36813](https://cve.now/CVE-2023-36813.md): Kanboard Authenticated SQL Injections vulnerability (CVSS 7.1, kanboard)
- [CVE-2023-36809](https://cve.now/CVE-2023-36809.md): Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox (CVSS 8.1, kiwitcms Kiwi · kiwitcms)
- [CVE-2023-36457](https://cve.now/CVE-2023-36457.md): 1Panel vulnerable to command injection when adding container repositories (CVSS 6.3, 1Panel-dev 1Panel · github.com/1Panel-dev/1Panel)
- [CVE-2023-36458](https://cve.now/CVE-2023-36458.md): 1Panel vulnerable to ommand injection when entering the container terminal (CVSS 6.3, 1Panel-dev 1Panel · github.com/1Panel-dev/1Panel)
- [CVE-2023-36808](https://cve.now/CVE-2023-36808.md): GLPI vulnerable to SQL injection through Computer Virtual Machine information (CVSS 8.6, glpi-project glpi)
- [CVE-2023-35940](https://cve.now/CVE-2023-35940.md): GLPI vulnerable to unauthenticated access to Dashboard data (CVSS 7.5, glpi-project glpi)
- [CVE-2023-35939](https://cve.now/CVE-2023-35939.md): GLPI vulnerable to unauthorized access to Dashboard data (CVSS 8.1, glpi-project glpi)
- [CVE-2023-35936](https://cve.now/CVE-2023-35936.md): Arbitrary file write is possible in Pandoc when using PDF output or --extract-media with untrusted input (CVSS 6.0, jgm pandoc)
- [CVE-2023-35924](https://cve.now/CVE-2023-35924.md): GLPI vulnerable to SQL injection via inventory agent request (CVSS 8.6, glpi-project glpi)
- [CVE-2023-34457](https://cve.now/CVE-2023-34457.md): MechanicalSoup vulnerable to malicious web server reading arbitrary files on client using file input inside HTML form (CVSS 5.9, MechanicalSoup)
- [CVE-2023-34244](https://cve.now/CVE-2023-34244.md): GLPI vulnerable to reflected XSS in search pages (CVSS 6.5, glpi-project glpi)
- [CVE-2023-34107](https://cve.now/CVE-2023-34107.md): GLPI vulnerable to unauthorized access to KnowbaseItem data (CVSS 6.5, glpi-project glpi)
- [CVE-2023-35001](https://cve.now/CVE-2023-35001.md): Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability (CVSS 7.8, Linux Kernel)
- [CVE-2023-31248](https://cve.now/CVE-2023-31248.md): Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability (CVSS 7.8, Linux Kernel)
- [CVE-2023-34473](https://cve.now/CVE-2023-34473.md): Usage of Hard-coded Credentials (CVSS 6.6, AMI MegaRAC\_SPx)
- [CVE-2023-34472](https://cve.now/CVE-2023-34472.md): AMI SPx contains a vulnerability in the BMC where an Attacker may cause an improper neutralization of CRLF sequences in HTTP Headers. (CVSS 5.7, AMI MegaRAC\_SPx)
- [CVE-2023-34471](https://cve.now/CVE-2023-34471.md): Missing Cryptographic Step (CVSS 6.3, AMI MegaRAC\_SPx)
- [CVE-2023-34338](https://cve.now/CVE-2023-34338.md): hard coded cryptographic key (CVSS 7.1, AMI MegaRAC\_SPx)
- [CVE-2023-34337](https://cve.now/CVE-2023-34337.md): Inadequate Encryption Strength (CVSS 7.6, AMI MegaRAC\_SPx)
- [CVE-2023-34106](https://cve.now/CVE-2023-34106.md): GLPI vulnerable to unauthorized access to User data (CVSS 6.5, glpi-project glpi)
- [CVE-2023-30607](https://cve.now/CVE-2023-30607.md): icingaweb2-module-jira template and field configuration are susceptible to CSRF (CVSS 5.0, icingaweb2-module-jira)
- [CVE-2023-27390](https://cve.now/CVE-2023-27390.md): A heap-based buffer overflow vulnerability exists in the Sequence::DrawText functionality of Diagon v1.0.139. (CVSS 7.8, Diagon)
- [CVE-2023-31194](https://cve.now/CVE-2023-31194.md): An improper array index validation vulnerability exists in the GraphPlanar::Write functionality of Diagon v1.0.139. (CVSS 5.3, Diagon)
- [CVE-2023-35979](https://cve.now/CVE-2023-35979.md): Unauthenticated Buffer Overflow Vulnerability in ArubaOS Web-Based Management Interface (CVSS 5.3, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-35978](https://cve.now/CVE-2023-35978.md): Reflected Cross-Site Scripting (XSS) in ArubaOS Web-based Management Interface (CVSS 6.1, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-35977](https://cve.now/CVE-2023-35977.md): Authenticated Sensitive Information Disclosure in ArubaOS Command Line Interface (CVSS 6.5, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-35976](https://cve.now/CVE-2023-35976.md): Authenticated Sensitive Information Disclosure in ArubaOS Command Line Interface (CVSS 6.5, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-35975](https://cve.now/CVE-2023-35975.md): Authenticated Path Traversal in ArubaOS Command Line Interface Allows for Arbitrary File Deletion (CVSS 6.5, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-35974](https://cve.now/CVE-2023-35974.md): Authenticated Remote Command Execution in the ArubaOS Command Line Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-35973](https://cve.now/CVE-2023-35973.md): Authenticated Remote Command Execution in the ArubaOS Command Line Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-35972](https://cve.now/CVE-2023-35972.md): Authenticated Remote Command Execution in ArubaOS Web-based Management Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-35971](https://cve.now/CVE-2023-35971.md): Unauthenticated Stored Cross-Site Scripting (XSS) in ArubaOS Web-based Management Interface (CVSS 8.8, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-3515](https://cve.now/CVE-2023-3515.md): Open Redirect in go-gitea/gitea (CVSS 3.0, go-gitea/gitea · code.gitea.io/gitea)
- [CVE-2023-3089](https://cve.now/CVE-2023-3089.md): Ocp & fips mode (CVSS 7.0, openshift · Red Hat OpenShift Serverless +9)
- [CVE-2023-3455](https://cve.now/CVE-2023-3455.md): Key management vulnerability on system. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2021-46893](https://cve.now/CVE-2021-46893.md): Vulnerability of unstrict data verification and parameter check. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2021-46891](https://cve.now/CVE-2021-46891.md): Vulnerability of incomplete read and write permission verification in the GPU module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-2538](https://cve.now/CVE-2023-2538.md): TLS Private Key Accessible to External Parties (CVSS 5.8, tyan s5552\_bmc)
- [CVE-2021-46890](https://cve.now/CVE-2021-46890.md): Vulnerability of incomplete read and write permission verification in the GPU module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-3336](https://cve.now/CVE-2023-3336.md): TN-5900 Series User Enumeration Vulnerability (CVSS 5.3, Moxa TN-5900 Series)
- [CVE-2023-37212](https://cve.now/CVE-2023-37212.md): Memory safety bugs present in Firefox 114. (no CVSS, Mozilla Firefox)
- [CVE-2023-37210](https://cve.now/CVE-2023-37210.md): A website could prevent a user from exiting full-screen mode via alert and prompt calls. (no CVSS, Mozilla Firefox)
- [CVE-2023-37209](https://cve.now/CVE-2023-37209.md): A use-after-free condition existed in \`NotifyOnHistoryReload\` where a \`LoadingSessionHistoryEntry\` object was freed and a reference to that (no CVSS, Mozilla Firefox)
- [CVE-2023-2880](https://cve.now/CVE-2023-2880.md): Frauscher Sensortechnik Diagnostic System FDS001 for FAdC/FAdCi Path Traversal vulnerability (CVSS 7.5, Frauscher Sensortechnik Diagnostic System FDS101 for FAdC/F…)
- [CVE-2023-37206](https://cve.now/CVE-2023-37206.md): Uploading files which contain symlinks may have allowed an attacker to trick a user into submitting sensitive data to a malicious website. (no CVSS, Mozilla Firefox)
- [CVE-2023-37205](https://cve.now/CVE-2023-37205.md): The use of RTL Arabic characters in the address bar may have allowed for URL spoofing. (no CVSS, Mozilla Firefox)
- [CVE-2023-37204](https://cve.now/CVE-2023-37204.md): A website could have obscured the fullscreen notification by using an option element by introducing lag via an expensive computational funct (no CVSS, Mozilla Firefox)
- [CVE-2023-37203](https://cve.now/CVE-2023-37203.md): Insufficient validation in the Drag and Drop API in conjunction with social engineering, may have allowed an attacker to trick end-users int (CVSS 7.8, Mozilla Firefox)
- [CVE-2023-3482](https://cve.now/CVE-2023-3482.md): When Firefox is configured to block storage of all cookies, it was still possible to store data in localstorage by using an iframe with a so (no CVSS, Mozilla Firefox)
- [CVE-2023-37211](https://cve.now/CVE-2023-37211.md): Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-37208](https://cve.now/CVE-2023-37208.md): When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-37207](https://cve.now/CVE-2023-37207.md): A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-37202](https://cve.now/CVE-2023-37202.md): Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-37201](https://cve.now/CVE-2023-37201.md): An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-34150](https://cve.now/CVE-2023-34150.md): Apache Any23: Possible excessive allocation of resources reading input. (CVSS 6.5, Apache Software Foundation Apache Any23 · org.apache.any23:…)
- [CVE-2020-23452](https://cve.now/CVE-2020-23452.md): A cross-site scripting (XSS) vulnerability in Selenium Grid v3.141.59 allows attackers to execute arbitrary web scripts or HTML via a crafte (no CVSS)
- [CVE-2020-25969](https://cve.now/CVE-2020-25969.md): gnuplot v5.5 was discovered to contain a buffer overflow via the function plotrequest(). (no CVSS)
- [CVE-2022-42175](https://cve.now/CVE-2022-42175.md): Insecure Direct Object Reference vulnerability in WHMCS module SolusVM 1 4.1.2 allows an attacker to change the password and hostname of oth (no CVSS)
- [CVE-2023-25399](https://cve.now/CVE-2023-25399.md): A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py\_FindObjects() function. (CVSS 5.5, scipy)
- [CVE-2023-27197](https://cve.now/CVE-2023-27197.md): PAX A930 device with PayDroid\_7.1.1\_Virgo\_V04.5.02\_20220722 can allow an attacker to gain root access by running a crafted binary leveraging (no CVSS)
- [CVE-2023-27198](https://cve.now/CVE-2023-27198.md): PAX A930 device with PayDroid\_7.1.1\_Virgo\_V04.5.02\_20220722 can allow the execution of arbitrary commands by using the exec service and incl (CVSS 6.8)
- [CVE-2023-27199](https://cve.now/CVE-2023-27199.md): PAX Technology A930 PayDroid\_7.1.1\_Virgo\_V04.5.02\_20220722 allows attackers to compile a malicious shared library and use LD\_PRELOAD to bypa (no CVSS)
- [CVE-2023-30207](https://cve.now/CVE-2023-30207.md): A divide by zero issue discovered in Kodi Home Theater Software 19.5 and earlier allows attackers to cause a denial of service via use of cr (no CVSS)
- [CVE-2023-33201](https://cve.now/CVE-2023-33201.md): Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. (no CVSS, org.bouncycastle:bcprov-jdk18on · org.bouncycastle:bcpr… +10)
- [CVE-2023-33335](https://cve.now/CVE-2023-33335.md): Cross Site Scripting (XSS) in Sophos Sophos iView (The EOL was December 31st 2020) in grpname parameter that allows arbitrary script to be e (no CVSS)
- [CVE-2023-34654](https://cve.now/CVE-2023-34654.md): taocms \<=3.0.2 is vulnerable to Cross Site Scripting (XSS). (no CVSS)
- [CVE-2023-35786](https://cve.now/CVE-2023-35786.md): Zoho ManageEngine ADManager Plus before 7183 allows admin users to exploit an XXE issue to view files. (no CVSS)
- [CVE-2023-35863](https://cve.now/CVE-2023-35863.md): In MADEFORNET HTTP Debugger through 9.12, the Windows service does not set the seclevel registry key before launching the driver. (no CVSS)
- [CVE-2023-36622](https://cve.now/CVE-2023-36622.md): The websocket configuration endpoint of the Loxone Miniserver Go Gen.2 before 14.1.5.9 allows remote authenticated administrators to inject (no CVSS)
- [CVE-2023-36623](https://cve.now/CVE-2023-36623.md): The root password of the Loxone Miniserver Go Gen.2 before 14.2 is calculated using hard-coded secrets and the MAC address. (no CVSS)
- [CVE-2023-36624](https://cve.now/CVE-2023-36624.md): Loxone Miniserver Go Gen.2 through 14.0.3.28 allows an authenticated operating system user to escalate privileges via the Sudo configuration (no CVSS)
- [CVE-2023-36665](https://cve.now/CVE-2023-36665.md): "protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. (no CVSS, protobufjs)
- [CVE-2023-36932](https://cve.now/CVE-2023-36932.md): In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023 (no CVSS)
- [CVE-2023-36933](https://cve.now/CVE-2023-36933.md): In Progress MOVEit Transfer before 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), it is (no CVSS)
- [CVE-2023-36934](https://cve.now/CVE-2023-36934.md): In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023 (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-07-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.