# CVEs published 2023-07-06

203 CVEs were published on July 6, 2023: 6 critical, 88 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2023-35120](https://cve.now/CVE-2023-35120.md): PiiGAB M-Bus Cross-Site Request Forgery (CVSS 8.8, PiiGAB M-Bus SoftwarePack)
- [CVE-2023-34433](https://cve.now/CVE-2023-34433.md): PiiGAB M-Bus Use of Password Hash With Insufficient Computational Effort (CVSS 7.5, PiiGAB M-Bus SoftwarePack)
- [CVE-2023-34995](https://cve.now/CVE-2023-34995.md): PiiGAB M-Bus Weak Password Requirements (CVSS 7.5, PiiGAB M-Bus SoftwarePack)
- [CVE-2023-32652](https://cve.now/CVE-2023-32652.md): PiiGAB M-Bus Cross-site Scripting (CVSS 8.0, PiiGAB M-Bus SoftwarePack)
- [CVE-2023-35765](https://cve.now/CVE-2023-35765.md): PiiGAB M-Bus Plaintext Storage of a Password (CVSS 6.5, PiiGAB M-Bus SoftwarePack)
- [CVE-2023-35987](https://cve.now/CVE-2023-35987.md): PiiGAB M-Bus Use of Hard-coded Credentials (CVSS 9.8, PiiGAB M-Bus SoftwarePack)
- [CVE-2023-31277](https://cve.now/CVE-2023-31277.md): PiiGAB M-Bus Unprotected Transport of Credentials (CVSS 7.5, PiiGAB M-Bus SoftwarePack)
- [CVE-2023-33868](https://cve.now/CVE-2023-33868.md): PiiGAB M-Bus Improper Restriction of Excessive Authentication Attempts (CVSS 5.9, PiiGAB M-Bus SoftwarePack)
- [CVE-2023-36859](https://cve.now/CVE-2023-36859.md): PiiGAB M-Bus Code Injection (CVSS 8.8, PiiGAB M-Bus SoftwarePack)
- [CVE-2023-20899](https://cve.now/CVE-2023-20899.md): VMware SD-WAN (Edge) contains a bypass authentication vulnerability. (no CVSS, VMware SD-WAN)
- [CVE-2023-36829](https://cve.now/CVE-2023-36829.md): Sentry CORS misconfiguration vulnerability (CVSS 6.8, getsentry sentry · sentry)
- [CVE-2023-35934](https://cve.now/CVE-2023-35934.md): yt-dlp File Downloader cookie leak (CVSS 6.1, yt-dlp)
- [CVE-2023-3531](https://cve.now/CVE-2023-3531.md): Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass (CVSS 8.1, nilsteampassnet/teampass)
- [CVE-2023-36462](https://cve.now/CVE-2023-36462.md): Mastodon's verified profile links can be formatted in a misleading way (CVSS 5.4, mastodon)
- [CVE-2023-36461](https://cve.now/CVE-2023-36461.md): Mastodon vulnerable to Denial of Service through slow HTTP responses (CVSS 7.5, mastodon)
- [CVE-2023-36460](https://cve.now/CVE-2023-36460.md): Mastodon vulnerable to arbitrary file creation through media attachments (CVSS 10.0, mastodon)
- [CVE-2023-3529](https://cve.now/CVE-2023-3529.md): Rotem Dynamics Rotem CRM OTP URI Interface information exposure (CVSS 5.3, Rotem Dynamics Rotem CRM)
- [CVE-2023-36459](https://cve.now/CVE-2023-36459.md): Mastodon vulnerable to Cross-site Scripting through oEmbed preview cards (CVSS 9.3, mastodon)
- [CVE-2023-36456](https://cve.now/CVE-2023-36456.md): Authentik lacks Proxy IP headers validation (CVSS 8.3, goauthentik authentik)
- [CVE-2023-3528](https://cve.now/CVE-2023-3528.md): ThinuTech ThinuCMS category.php sql injection (CVSS 6.3, ThinuTech ThinuCMS)
- [CVE-2023-1298](https://cve.now/CVE-2023-1298.md): ServiceNow has released upgrades and patches that address a Reflected Cross-Site scripting (XSS) vulnerability that was identified in the Se (CVSS 4.3, ServiceNow Now User Experience)
- [CVE-2023-37260](https://cve.now/CVE-2023-37260.md): league/oauth2-server key exposed in exception message when passing as string and providing invalid pass phrase (CVSS 8.2, thephpleague oauth2-server · league/oauth2-server)
- [CVE-2023-36823](https://cve.now/CVE-2023-36823.md): Sanitize vulnerable to Cross-site Scripting via insufficient neutralization of \`style\` element content (CVSS 7.1, rgrove sanitize · sanitize)
- [CVE-2023-36830](https://cve.now/CVE-2023-36830.md): SQLFluff vulnerability for users with access to config file, using \`library\_path\` to call arbitrary python code. (CVSS 6.3, sqlfluff)
- [CVE-2023-23550](https://cve.now/CVE-2023-23550.md): An OS command injection vulnerability exists in the ys\_thirdparty user\_delete functionality of Milesight UR32L v32.3.0.5. (CVSS 7.2, Milesight UR32L)
- [CVE-2023-23547](https://cve.now/CVE-2023-23547.md): A directory traversal vulnerability exists in the luci2-io file-export mib functionality of Milesight UR32L v32.3.0.5. (CVSS 6.5, Milesight UR32L)
- [CVE-2023-23571](https://cve.now/CVE-2023-23571.md): An access violation vulnerability exists in the eventcore functionality of Milesight UR32L v32.3.0.5. (CVSS 7.5, Milesight UR32L)
- [CVE-2023-23902](https://cve.now/CVE-2023-23902.md): A buffer overflow vulnerability exists in the uhttpd login functionality of Milesight UR32L v32.3.0.5. (CVSS 9.8, Milesight UR32L)
- [CVE-2023-22306](https://cve.now/CVE-2023-22306.md): An OS command injection vulnerability exists in the libzebra.so bridge\_group functionality of Milesight UR32L v32.3.0.5. (CVSS 7.2, Milesight UR32L)
- [CVE-2023-22659](https://cve.now/CVE-2023-22659.md): An os command injection vulnerability exists in the libzebra.so change\_hostname functionality of Milesight UR32L v32.3.0.5. (CVSS 7.2, Milesight UR32L)
- [CVE-2023-22844](https://cve.now/CVE-2023-22844.md): An authentication bypass vulnerability exists in the requestHandlers.js verifyToken functionality of Milesight VPN v2.0.2. (CVSS 7.3, MilesightVPN)
- [CVE-2023-22319](https://cve.now/CVE-2023-22319.md): A sql injection vulnerability exists in the requestHandlers.js LoginAuth functionality of Milesight VPN v2.0.2. (CVSS 7.3, MilesightVPN)
- [CVE-2023-23907](https://cve.now/CVE-2023-23907.md): A directory traversal vulnerability exists in the server.js start functionality of Milesight VPN v2.0.2. (CVSS 7.5, MilesightVPN)
- [CVE-2023-22371](https://cve.now/CVE-2023-22371.md): An os command injection vulnerability exists in the liburvpn.so create\_private\_key functionality of Milesight VPN v2.0.2. (CVSS 8.1, MilesightVPN)
- [CVE-2023-24497](https://cve.now/CVE-2023-24497.md): Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail\_device functionality of Milesight VPN v2.0.2. (CVSS 4.7, MilesightVPN)
- [CVE-2023-24496](https://cve.now/CVE-2023-24496.md): Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail\_device functionality of Milesight VPN v2.0.2. (CVSS 4.7, MilesightVPN)
- [CVE-2023-23546](https://cve.now/CVE-2023-23546.md): A misconfiguration vulnerability exists in the urvpn\_client functionality of Milesight UR32L v32.3.0.5. (CVSS 4.2, Milesight UR32L)
- [CVE-2023-24520](https://cve.now/CVE-2023-24520.md): Two OS command injection vulnerability exist in the vtysh\_ubus toolsh\_excute.constprop.1 functionality of Milesight UR32L v32.3.0.5. (CVSS 8.8, Milesight UR32L)
- [CVE-2023-24519](https://cve.now/CVE-2023-24519.md): Two OS command injection vulnerability exist in the vtysh\_ubus toolsh\_excute.constprop.1 functionality of Milesight UR32L v32.3.0.5. (CVSS 8.8, Milesight UR32L)
- [CVE-2023-24583](https://cve.now/CVE-2023-24583.md): Two OS command injection vulnerabilities exist in the urvpn\_client cmd\_name\_action functionality of Milesight UR32L v32.3.0.5. (CVSS 8.8, Milesight UR32L)
- [CVE-2023-24582](https://cve.now/CVE-2023-24582.md): Two OS command injection vulnerabilities exist in the urvpn\_client cmd\_name\_action functionality of Milesight UR32L v32.3.0.5. (CVSS 8.8, Milesight UR32L)
- [CVE-2023-22365](https://cve.now/CVE-2023-22365.md): An OS command injection vulnerability exists in the ys\_thirdparty check\_system\_user functionality of Milesight UR32L v32.3.0.5. (CVSS 7.2, Milesight UR32L)
- [CVE-2023-22299](https://cve.now/CVE-2023-22299.md): An OS command injection vulnerability exists in the vtysh\_ubus \_get\_fw\_logs functionality of Milesight UR32L v32.3.0.5. (CVSS 8.8, Milesight UR32L)
- [CVE-2023-24595](https://cve.now/CVE-2023-24595.md): An OS command injection vulnerability exists in the ys\_thirdparty system\_user\_script functionality of Milesight UR32L v32.3.0.5. (CVSS 7.2, Milesight UR32L)
- [CVE-2023-22653](https://cve.now/CVE-2023-22653.md): An OS command injection vulnerability exists in the vtysh\_ubus tcpdump\_start\_cb functionality of Milesight UR32L v32.3.0.5. (CVSS 8.8, Milesight UR32L)
- [CVE-2023-24018](https://cve.now/CVE-2023-24018.md): A stack-based buffer overflow vulnerability exists in the libzebra.so.0.0.0 security\_decrypt\_password functionality of Milesight UR32L v32.3 (CVSS 8.8, Milesight UR32L)
- [CVE-2023-25124](https://cve.now/CVE-2023-25124.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25123](https://cve.now/CVE-2023-25123.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25122](https://cve.now/CVE-2023-25122.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25121](https://cve.now/CVE-2023-25121.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25120](https://cve.now/CVE-2023-25120.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25119](https://cve.now/CVE-2023-25119.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25118](https://cve.now/CVE-2023-25118.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25117](https://cve.now/CVE-2023-25117.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25116](https://cve.now/CVE-2023-25116.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25115](https://cve.now/CVE-2023-25115.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25114](https://cve.now/CVE-2023-25114.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25113](https://cve.now/CVE-2023-25113.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25112](https://cve.now/CVE-2023-25112.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25111](https://cve.now/CVE-2023-25111.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25110](https://cve.now/CVE-2023-25110.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25109](https://cve.now/CVE-2023-25109.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25108](https://cve.now/CVE-2023-25108.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25107](https://cve.now/CVE-2023-25107.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25106](https://cve.now/CVE-2023-25106.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25105](https://cve.now/CVE-2023-25105.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25104](https://cve.now/CVE-2023-25104.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25103](https://cve.now/CVE-2023-25103.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25102](https://cve.now/CVE-2023-25102.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25101](https://cve.now/CVE-2023-25101.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25100](https://cve.now/CVE-2023-25100.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25099](https://cve.now/CVE-2023-25099.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25098](https://cve.now/CVE-2023-25098.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25097](https://cve.now/CVE-2023-25097.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25096](https://cve.now/CVE-2023-25096.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25095](https://cve.now/CVE-2023-25095.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25094](https://cve.now/CVE-2023-25094.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25093](https://cve.now/CVE-2023-25093.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25092](https://cve.now/CVE-2023-25092.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25091](https://cve.now/CVE-2023-25091.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25090](https://cve.now/CVE-2023-25090.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25089](https://cve.now/CVE-2023-25089.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25088](https://cve.now/CVE-2023-25088.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25087](https://cve.now/CVE-2023-25087.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25086](https://cve.now/CVE-2023-25086.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25085](https://cve.now/CVE-2023-25085.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25084](https://cve.now/CVE-2023-25084.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25083](https://cve.now/CVE-2023-25083.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25082](https://cve.now/CVE-2023-25082.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25081](https://cve.now/CVE-2023-25081.md): Multiple buffer overflow vulnerabilities exist in the vtysh\_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat (CVSS 7.2, Milesight UR32L)
- [CVE-2023-24019](https://cve.now/CVE-2023-24019.md): A stack-based buffer overflow vulnerability exists in the urvpn\_client http\_connection\_readcb functionality of Milesight UR32L v32.3.0.5. (CVSS 8.1, Milesight UR32L)
- [CVE-2023-25583](https://cve.now/CVE-2023-25583.md): Two OS command injection vulnerabilities exist in the zebra vlan\_name functionality of Milesight UR32L v32.3.0.5. (CVSS 7.2, Milesight UR32L)
- [CVE-2023-25582](https://cve.now/CVE-2023-25582.md): Two OS command injection vulnerabilities exist in the zebra vlan\_name functionality of Milesight UR32L v32.3.0.5. (CVSS 7.2, Milesight UR32L)
- [CVE-2023-35948](https://cve.now/CVE-2023-35948.md): Novu Open Redirect Vulnerability in Sign-In with GitHub Functionality (CVSS 5.4, novuhq novu)
- [CVE-2023-35937](https://cve.now/CVE-2023-35937.md): Metersphere missing permission check (CVSS 6.0, metersphere)
- [CVE-2022-48520](https://cve.now/CVE-2022-48520.md): Unauthorized access vulnerability in the SystemUI module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48519](https://cve.now/CVE-2022-48519.md): Unauthorized access vulnerability in the SystemUI module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48518](https://cve.now/CVE-2022-48518.md): Vulnerability of signature verification in the iaware system being initialized later than the time when the system broadcasts are sent. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-1695](https://cve.now/CVE-2023-1695.md): Vulnerability of failures to capture exceptions in the communication framework. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-1691](https://cve.now/CVE-2023-1691.md): Vulnerability of failures to capture exceptions in the communication framework. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48517](https://cve.now/CVE-2022-48517.md): Unauthorized service access vulnerability in the DSoftBus module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48516](https://cve.now/CVE-2022-48516.md): Vulnerability that a unique value can be obtained by a third-party app in the DSoftBus module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48515](https://cve.now/CVE-2022-48515.md): Vulnerability of inappropriate permission control in Nearby. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48514](https://cve.now/CVE-2022-48514.md): The Sepolicy module has inappropriate permission control on the use of Netlink.Successful exploitation of this vulnerability may affect conf (no CVSS, Huawei HarmonyOS)
- [CVE-2022-48513](https://cve.now/CVE-2022-48513.md): Vulnerability of identity verification being bypassed in the Gallery module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2021-46892](https://cve.now/CVE-2021-46892.md): Encryption bypass vulnerability in Maintenance mode. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48511](https://cve.now/CVE-2022-48511.md): Use After Free (UAF) vulnerability in the audio PCM driver module under special conditions. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48510](https://cve.now/CVE-2022-48510.md): Input verification vulnerability in the AMS module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48509](https://cve.now/CVE-2022-48509.md): Race condition vulnerability due to multi-thread access to mutually exclusive resources in Huawei Share. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48507](https://cve.now/CVE-2022-48507.md): Vulnerability of identity verification being bypassed in the storage module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-34164](https://cve.now/CVE-2023-34164.md): Vulnerability of incomplete input parameter verification in the communication framework module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-3456](https://cve.now/CVE-2023-3456.md): Vulnerability of kernel raw address leakage in the hang detector module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-37245](https://cve.now/CVE-2023-37245.md): Buffer overflow vulnerability in the modem pinctrl module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-37242](https://cve.now/CVE-2023-37242.md): Vulnerability of commands from the modem being intercepted in the atcmdserver module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-37241](https://cve.now/CVE-2023-37241.md): Input verification vulnerability in the WMS API. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-37240](https://cve.now/CVE-2023-37240.md): Vulnerability of missing input length verification in the distributed file system. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-37239](https://cve.now/CVE-2023-37239.md): Format string vulnerability in the distributed file system. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-37238](https://cve.now/CVE-2023-37238.md): Vulnerability of apps' permission to access a certain API being incompletely verified in the wireless projection module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2021-46894](https://cve.now/CVE-2021-46894.md): Use After Free (UAF) vulnerability in the uinput module.Successful exploitation of this vulnerability may lead to kernel privilege escalatio (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48512](https://cve.now/CVE-2022-48512.md): Use After Free (UAF) vulnerability in the Vdecoderservice service. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48508](https://cve.now/CVE-2022-48508.md): Inappropriate authorization vulnerability in the system apps. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-3523](https://cve.now/CVE-2023-3523.md): Out-of-bounds Read in gpac/gpac (CVSS 6.1, gpac/gpac)
- [CVE-2023-26137](https://cve.now/CVE-2023-26137.md): All versions of the package drogonframework/drogon are vulnerable to HTTP Response Splitting when untrusted user input is used to build head (CVSS 7.2, drogonframework/drogon)
- [CVE-2023-26138](https://cve.now/CVE-2023-26138.md): All versions of the package drogonframework/drogon are vulnerable to CRLF Injection when untrusted user input is used to set request headers (CVSS 5.4, drogonframework/drogon)
- [CVE-2023-30678](https://cve.now/CVE-2023-30678.md): Potential zip path traversal vulnerability in Calendar application prior to version 12.4.07.15 in Android 13 allows attackers to write arbit (CVSS 5.1, Samsung Mobile Calendar)
- [CVE-2023-30677](https://cve.now/CVE-2023-30677.md): Improper access control vulnerability in Samsung Pass prior to version 4.2.03.1 allows physical attackers to access data of Samsung Pass on (CVSS 6.1, Samsung Mobile Samsung Pass)
- [CVE-2023-30676](https://cve.now/CVE-2023-30676.md): Improper access control vulnerability in Samsung Pass prior to version 4.2.03.1 allows physical attackers to access data of Samsung Pass. (CVSS 4.6, Samsung Mobile Samsung Pass)
- [CVE-2023-30675](https://cve.now/CVE-2023-30675.md): Improper authentication in Samsung Pass prior to version 4.2.03.1 allows local attacker to access stored account information when Samsung Wa (CVSS 6.2, Samsung Mobile Samsung Pass)
- [CVE-2023-30674](https://cve.now/CVE-2023-30674.md): Improper configuration in Samsung Internet prior to version 21.0.0.41 allows attacker to bypass SameSite Cookie. (CVSS 6.5, Samsung Mobile Samsung Internet)
- [CVE-2023-30673](https://cve.now/CVE-2023-30673.md): Improper validation of integrity check vulnerability in Smart Switch PC prior to version 4.3.23052\_1 allows local attackers to delete arbitr (CVSS 5.5, Samsung Mobile Smart Switch PC)
- [CVE-2023-30672](https://cve.now/CVE-2023-30672.md): Improper privilege management vulnerability in Samsung Smart Switch for Windows Installer prior to version 4.3.23043\_3 allows attackers to c (CVSS 6.8, Samsung Mobile Samsung Smart Switch)
- [CVE-2023-30671](https://cve.now/CVE-2023-30671.md): Logic error in package installation via adb command prior to SMR Jul-2023 Release 1 allows local attackers to downgrade installed applicatio (CVSS 6.3, Samsung Mobile Devices)
- [CVE-2023-30670](https://cve.now/CVE-2023-30670.md): Out-of-bounds Write in BuildIpcFactoryDeviceTestEvent of libsec-ril prior to SMR Jul-2023 Release 1 allows local attacker to execute arbitra (CVSS 6.7, Samsung Mobile Devices)
- [CVE-2023-30669](https://cve.now/CVE-2023-30669.md): Out-of-bounds Write in DoOemFactorySendFactoryTestResult of libsec-ril prior to SMR Jul-2023 Release 1 allows local attacker to execute arbi (CVSS 6.7, Samsung Mobile Devices)
- [CVE-2023-30668](https://cve.now/CVE-2023-30668.md): Out-of-bounds Write in BuildOemSecureSimLockResponse of libsec-ril prior to SMR Jul-2023 Release 1 allows local attacker to execute arbitrar (CVSS 6.7, Samsung Mobile Devices)
- [CVE-2023-30667](https://cve.now/CVE-2023-30667.md): Improper access control in Audio system service prior to SMR Jul-2023 Release 1 allows attacker to send broadcast with system privilege. (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2023-30666](https://cve.now/CVE-2023-30666.md): Improper input validation vulnerability in DoOemImeiSetPreconfig in libsec-ril prior to SMR Jul-2023 Release 1 allows local attackers to cau (CVSS 5.3, Samsung Mobile Devices)
- [CVE-2023-30665](https://cve.now/CVE-2023-30665.md): Improper input validation vulnerability in OnOemServiceMode in libsec-ril prior to SMR Jul-2023 Release 1 allows local attackers to cause an (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2023-30664](https://cve.now/CVE-2023-30664.md): Improper input validation vulnerability in RegisteredMSISDN prior to SMR Jul-2023 Release 1 allows local attackers to launch privileged acti (CVSS 8.5, Samsung Mobile Devices)
- [CVE-2023-30663](https://cve.now/CVE-2023-30663.md): Improper input validation vulnerability in OemPersonalizationSetLock in libsec-ril prior to SMR Jul-2023 Release 1 allows local attackers to (CVSS 5.3, Samsung Mobile Devices)
- [CVE-2023-30662](https://cve.now/CVE-2023-30662.md): Exposure of Sensitive Information vulnerability in getChipIds in UwbAospAdapterService prior to SMR Jul-2023 Release 1 allows local attacker (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2023-30661](https://cve.now/CVE-2023-30661.md): Exposure of Sensitive Information vulnerability in getChipInfos in UwbAospAdapterService prior to SMR Jul-2023 Release 1 allows local attack (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2023-30660](https://cve.now/CVE-2023-30660.md): Exposure of Sensitive Information vulnerability in getDefaultChipId in UwbAospAdapterService prior to SMR Jul-2023 Release 1 allows local at (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2023-30659](https://cve.now/CVE-2023-30659.md): Improper input validation vulnerability in Transaction prior to SMR Jul-2023 Release 1 allows local attackers to launch privileged activitie (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2023-30658](https://cve.now/CVE-2023-30658.md): Improper input validation vulnerability in DataProfile prior to SMR Jul-2023 Release 1 allows local attackers to launch privileged activitie (CVSS 8.5, Samsung Mobile Devices)
- [CVE-2023-30657](https://cve.now/CVE-2023-30657.md): Improper input validation vulnerability in EnhancedAttestationResult prior to SMR Jul-2023 Release 1 allows local attackers to launch privil (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2023-30656](https://cve.now/CVE-2023-30656.md): Improper input validation vulnerability in LSOItemData prior to SMR Jul-2023 Release 1 allows attackers to launch certain activities. (CVSS 8.5, Samsung Mobile Devices)
- [CVE-2023-30655](https://cve.now/CVE-2023-30655.md): Improper input validation vulnerability in SCEPProfile prior to SMR Jul-2023 Release 1 allows local attackers to launch privileged activitie (CVSS 8.5, Samsung Mobile Devices)
- [CVE-2023-30653](https://cve.now/CVE-2023-30653.md): Out of bounds read and write in enableTspDevice of sysinput HAL service prior to SMR Jul-2023 Release 1 allows local attackers to execute ar (CVSS 6.7, Samsung Mobile Devices)
- [CVE-2023-30652](https://cve.now/CVE-2023-30652.md): Out of bounds read and write in callrunTspCmdNoRead of sysinput HAL service prior to SMR Jul-2023 Release 1 allows local attackers to execut (CVSS 6.7, Samsung Mobile Devices)
- [CVE-2023-30651](https://cve.now/CVE-2023-30651.md): Out of bounds read and write in callgetTspsysfs of sysinput HAL service prior to SMR Jul-2023 Release 1 allows local attackers to execute ar (CVSS 6.7, Samsung Mobile Devices)
- [CVE-2023-30650](https://cve.now/CVE-2023-30650.md): Out of bounds read and write in callrunTspCmd of sysinput HAL service prior to SMR Jul-2023 Release 1 allows local attackers to execute arbi (CVSS 6.7, Samsung Mobile Devices)
- [CVE-2023-30649](https://cve.now/CVE-2023-30649.md): Heap out of bound write vulnerability in RmtUimNeedApdu of RILD prior to SMR Jul-2023 Release 1 allows attackers to execute arbitrary code. (CVSS 7.8, Samsung Mobile Devices)
- [CVE-2023-30648](https://cve.now/CVE-2023-30648.md): Stack out-of-bounds write vulnerability in IpcRxImeiUpdateImeiNoti of RILD priro to SMR Jul-2023 Release 1 cause a denial of service on the (CVSS 3.3, Samsung Mobile Devices)
- [CVE-2023-30647](https://cve.now/CVE-2023-30647.md): Heap out of bound write vulnerability in IpcRxUsimPhoneBookCapa of RILD prior to SMR Jul-2023 Release 1 allows attackers to execute arbitrar (CVSS 7.8, Samsung Mobile Devices)
- [CVE-2023-30646](https://cve.now/CVE-2023-30646.md): Heap out of bound write vulnerability in BroadcastSmsConfig of RILD prior to SMR Jul-2023 Release 1 allows attackers to execute arbitrary co (CVSS 7.8, Samsung Mobile Devices)
- [CVE-2023-30645](https://cve.now/CVE-2023-30645.md): Heap out of bound write vulnerability in IpcRxIncomingCBMsg of RILD prior to SMR Jul-2023 Release 1 allows attackers to execute arbitrary co (CVSS 7.8, Samsung Mobile Devices)
- [CVE-2023-30644](https://cve.now/CVE-2023-30644.md): Stack out of bound write vulnerability in CdmaSmsParser of RILD prior to SMR Jul-2023 Release 1 allows attackers to execute arbitrary code. (CVSS 7.8, Samsung Mobile Devices)
- [CVE-2023-30643](https://cve.now/CVE-2023-30643.md): Missing authentication vulnerability in Galaxy Themes Service prior to SMR Jul-2023 Release 1 allows local attackers to delete arbitrary non (CVSS 7.7, Samsung Mobile Devices)
- [CVE-2023-30642](https://cve.now/CVE-2023-30642.md): Improper privilege management vulnerability in Galaxy Themes Service prior to SMR Jul-2023 Release 1 allows local attackers to call privileg (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2023-30641](https://cve.now/CVE-2023-30641.md): Improper access control vulnerability in Settings prior to SMR Jul-2023 Release 1 allows physical attacker to use restricted user profile to (CVSS 4.3, Samsung Mobile Devices)
- [CVE-2023-30640](https://cve.now/CVE-2023-30640.md): Improper access control vulnerability in PersonaManagerService prior to SMR Jul-2023 Release 1 allows local attackers to change confiugratio (CVSS 4.3, Samsung Mobile Devices)
- [CVE-2023-3521](https://cve.now/CVE-2023-3521.md): Cross-site Scripting (XSS) - Reflected in fossbilling/fossbilling (CVSS 5.4, fossbilling/fossbilling)
- [CVE-2023-3520](https://cve.now/CVE-2023-3520.md): Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in it-novum/openitcockpit (CVSS 4.3, it-novum/openitcockpit)
- [CVE-2020-21861](https://cve.now/CVE-2020-21861.md): File upload vulnerability in DuxCMS 2.1 allows attackers to execute arbitrary php code via duxcms/AdminUpload/upload. (no CVSS)
- [CVE-2020-21862](https://cve.now/CVE-2020-21862.md): Directory traversal vulnerability in DuxCMS 2.1 allows attackers to delete arbitrary files via /admin/AdminBackup/del. (no CVSS)
- [CVE-2020-22336](https://cve.now/CVE-2020-22336.md): An issue was discovered in pdfcrack 0.17 thru 0.18, allows attackers to execute arbitrary code via a stack overflow in the MD5 function. (no CVSS)
- [CVE-2021-46896](https://cve.now/CVE-2021-46896.md): Buffer Overflow vulnerability in PX4-Autopilot allows attackers to cause a denial of service via handler function handling msgid 332. (no CVSS)
- [CVE-2022-46080](https://cve.now/CVE-2022-46080.md): Nexxt Nebula 1200-AC 15.03.06.60 allows authentication bypass and command execution by using the HTTPD service to enable TELNET. (no CVSS)
- [CVE-2023-24256](https://cve.now/CVE-2023-24256.md): An issue in the com.nextev.datastatistic component of NIO EC6 Aspen before v3.3.0 allows attackers to escalate privileges via path traversal (no CVSS)
- [CVE-2023-27225](https://cve.now/CVE-2023-27225.md): A cross-site scripting (XSS) vulnerability in User Registration & Login and User Management System with Admin Panel v3 allows attackers to e (no CVSS)
- [CVE-2023-29381](https://cve.now/CVE-2023-29381.md): An issue in Zimbra Collaboration (ZCS) v.8.8.15 and v.9.0 allows a remote attacker to escalate privileges and obtain sensitive information v (no CVSS)
- [CVE-2023-29382](https://cve.now/CVE-2023-29382.md): An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows an attacker to execute arbitrary code via the sfdc\_preauth.jsp component. (no CVSS)
- [CVE-2023-29656](https://cve.now/CVE-2023-29656.md): An improper authorization vulnerability in Darktrace mobile app (Android) prior to version 6.0.15 allows disabled and low-privilege users to (no CVSS)
- [CVE-2023-29824](https://cve.now/CVE-2023-29824.md): A use-after-free issue was discovered in Py\_FindObjects() function in SciPy versions prior to 1.8.0. (CVSS 9.8, scipy)
- [CVE-2023-30195](https://cve.now/CVE-2023-30195.md): In the module "Detailed Order" (lgdetailedorder) in version up to 1.1.20 from Linea Grafica for PrestaShop, a guest can download personal in (CVSS 7.5)
- [CVE-2023-30319](https://cve.now/CVE-2023-30319.md): Cross Site Scripting (XSS) vulnerability in username field in /src/chatbotapp/LoginServlet.java in wliang6 ChatEngine commit fded8e710ad59f8 (no CVSS)
- [CVE-2023-30320](https://cve.now/CVE-2023-30320.md): Cross Site Scripting (XSS) vulnerability in textMessage field in /src/chatbotapp/chatWindow.java in wliang6 ChatEngine commit fded8e710ad59f (no CVSS)
- [CVE-2023-30321](https://cve.now/CVE-2023-30321.md): Cross Site Scripting (XSS) vulnerability in textMessage field in /src/chatbotapp/LoginServlet.java in wliang6 ChatEngine commit fded8e710ad5 (no CVSS)
- [CVE-2023-30322](https://cve.now/CVE-2023-30322.md): Cross Site Scripting (XSS) vulnerability in username field in /src/chatbotapp/chatWindow.java in Payatu ChatEngine v.1.0, allows attackers t (no CVSS)
- [CVE-2023-30323](https://cve.now/CVE-2023-30323.md): SQL Injection vulnerability in username field in /src/chatbotapp/chatWindow.java in Payatu ChatEngine v.1.0, allows attackers to gain sensit (no CVSS)
- [CVE-2023-30325](https://cve.now/CVE-2023-30325.md): SQL Injection vulnerability in textMessage parameter in /src/chatbotapp/chatWindow.java in wliang6 ChatEngine v.1.0, allows attackers to gai (no CVSS)
- [CVE-2023-30326](https://cve.now/CVE-2023-30326.md): Cross Site Scripting (XSS) vulnerability in username field in /WebContent/WEB-INF/lib/chatbox.jsp in wliang6 ChatEngine commit fded8e710ad59 (no CVSS)
- [CVE-2023-34192](https://cve.now/CVE-2023-34192.md): Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted scr (CVSS 9.0, KEV)
- [CVE-2023-34193](https://cve.now/CVE-2023-34193.md): File Upload vulnerability in Zimbra ZCS 8.8.15 allows an authenticated privileged user to execute arbitrary code and obtain sensitive inform (no CVSS)
- [CVE-2023-36188](https://cve.now/CVE-2023-36188.md): An issue in langchain v.0.0.64 allows a remote attacker to execute arbitrary code via the PALChain parameter in the Python exec method. (no CVSS, langchain)
- [CVE-2023-36189](https://cve.now/CVE-2023-36189.md): SQL injection vulnerability in langchain before v0.0.247 allows a remote attacker to obtain sensitive information via the SQLDatabaseChain c (CVSS 7.5, langchain)
- [CVE-2023-36968](https://cve.now/CVE-2023-36968.md): A SQL Injection vulnerability detected in Food Ordering System v1.0 allows attackers to run commands on the database by sending crafted SQL (no CVSS)
- [CVE-2023-36969](https://cve.now/CVE-2023-36969.md): CMS Made Simple v2.2.17 is vulnerable to Remote Command Execution via the File Upload Function. (no CVSS)
- [CVE-2023-36970](https://cve.now/CVE-2023-36970.md): A Cross-site scripting (XSS) vulnerability in CMS Made Simple v2.2.17 allows remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2023-36995](https://cve.now/CVE-2023-36995.md): TravianZ through 8.3.4 allows XSS via the Alliance tag/name, the statistics page, the link preferences, the Admin Logs, or the COOKUSR cooki (no CVSS)
- [CVE-2023-37122](https://cve.now/CVE-2023-37122.md): A stored cross-site scripting (XSS) vulnerability in Bagecms v3.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted (no CVSS)
- [CVE-2023-37124](https://cve.now/CVE-2023-37124.md): A stored cross-site scripting (XSS) vulnerability in the Site Setup module of SEACMS v12.1 allows attackers to execute arbitrary web scripts (no CVSS)
- [CVE-2023-37125](https://cve.now/CVE-2023-37125.md): A stored cross-site scripting (XSS) vulnerability in the Management Custom label module of SEACMS v12.1 allows attackers to execute arbitrar (no CVSS)
- [CVE-2023-37131](https://cve.now/CVE-2023-37131.md): A Cross-Site Request Forgery (CSRF) in the component /public/admin/profile/update.html of YznCMS v1.1.0 allows attackers to arbitrarily chan (no CVSS)
- [CVE-2023-37132](https://cve.now/CVE-2023-37132.md): A stored cross-site scripting (XSS) vulnerability in the custom variables module of eyoucms v1.6.3 allows attackers to execute arbitrary web (no CVSS)
- [CVE-2023-37133](https://cve.now/CVE-2023-37133.md): A stored cross-site scripting (XSS) vulnerability in the Column management module of eyoucms v1.6.3 allows attackers to execute arbitrary we (no CVSS)
- [CVE-2023-37134](https://cve.now/CVE-2023-37134.md): A stored cross-site scripting (XSS) vulnerability in the Basic Information module of eyoucms v1.6.3 allows attackers to execute arbitrary we (no CVSS)
- [CVE-2023-37135](https://cve.now/CVE-2023-37135.md): A stored cross-site scripting (XSS) vulnerability in the Image Upload module of eyoucms v1.6.3 allows attackers to execute arbitrary web scr (no CVSS)
- [CVE-2023-37136](https://cve.now/CVE-2023-37136.md): A stored cross-site scripting (XSS) vulnerability in the Basic Website Information module of eyoucms v1.6.3 allows attackers to execute arbi (no CVSS)
- [CVE-2023-37192](https://cve.now/CVE-2023-37192.md): Memory management and protection issues in Bitcoin Core v22 allows attackers to modify the stored sending address within the app's memory, p (no CVSS)
- [CVE-2023-37453](https://cve.now/CVE-2023-37453.md): An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. (CVSS 4.6)
- [CVE-2023-37454](https://cve.now/CVE-2023-37454.md): An issue was discovered in the Linux kernel through 6.4.2. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-07-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.