CVEs published July 7, 2023
57 CVEs were published on July 7, 2023: 6 critical, 3 high.
- Published
- 57
- Critical
- 6
- High
- 3
- Medium
- 8
- Low
- 12
- Unrated
- 28
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- Cisco Webex Meetings
- 2
- radare2
- 2
- ThinuTech ThinuCMS
- 2
- Apache Software Foundation Apache Johnzon · org.apache.john…
- 1
- CC-Tweaked
- 1
- GZ Scripts Availability Booking Calendar PHP
- 1
- GZ Scripts Time Slot Booking Calendar PHP
- 1
- IBM Cloud Object Storage System
- 1
- IBM WebSphere Application Server
- 1
- keycloak · org.keycloak:keycloak-services
- 1
Critical 6
- CVE-2023-37262CC: Tweaked SSRF to Cloud Services Metadata Services not Blocked by DefaultCC-Tweaked
- CVE-2023-37261OpenComputers's SSRF to cloud service metadata services and local IPv6 addresses not blocked by defaultMightyPirates OpenComputers
- CVE-2022-4361Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providekeycloak · org.keycloak:keycloak-services
- CVE-2021-32495Radare2 has a use-after-free vulnerability in pyc parser's get_none_object function.radare2
- CVE-2021-32494Radare2 has a division by zero vulnerability in Mach-O parser's rebase_buffer function.radare2
- CVE-2021-33796In MuJS before version 1.1.2, a use-after-free flaw in the regexp source property access may cause denial of service.MuJS
High 3
- CVE-2023-37270Piwigo SQL Injection vulnerability in "User-Agent"Piwigo
- CVE-2023-32183Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed hawk2 package allows users with access to the hacluster to escalate topenSUSE Tumbleweed
- CVE-2023-3532Cross-site Scripting (XSS) - Stored in outline/outlineoutline/outline
Medium, low and unrated 48
- CVE-2023-32000A Cross-Site Scripting (XSS) vulnerability found in UniFi Network (Version 7.3.83 and earlier) allows a malicious actor with Site AdministraUbiquiti UniFi Network Application
- CVE-2023-37269Winter CMS vulnerable to stored XSS through privileged upload of SVG filewintercms winter · wintercms/winter
- CVE-2023-20180A vulnerability in the web interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site requestCisco Webex Meetings
- CVE-2023-20133A vulnerability in the web interface of Cisco Webex Meetings could allow an authenticated, remote attacker to conduct a stored cross-site scCisco Webex Meetings
- CVE-2021-39014IBM Cloud Object Storage System cross-site scriptingIBM Cloud Object Storage System
- CVE-2021-33798A null pointer dereference was found in libpano13, version libpano13-2.9.20.libpano13
- CVE-2023-3544GZ Scripts Time Slot Booking Calendar PHP load.php cross site scriptingGZ Scripts Time Slot Booking Calendar PHP
- CVE-2023-3543GZ Scripts Availability Booking Calendar PHP HTTP POST Request load.php cross site scriptingGZ Scripts Availability Booking Calendar PHP
- CVE-2023-37264Pipelines do not validate child UIDstektoncd pipeline · github.com/tektoncd/pipeline
- CVE-2023-3542ThinuTech ThinuCMS contact.php cross site scriptingThinuTech ThinuCMS
- CVE-2023-3541ThinuTech ThinuCMS author_posts.php cross site scriptingThinuTech ThinuCMS
- CVE-2023-3540SimplePHPscripts NewsLetter Script PHP URL Parameter preview.php cross site scriptingSimplePHPscripts NewsLetter Script PHP
- CVE-2023-3539SimplePHPscripts Simple Forum PHP URL Parameter preview.php cross site scriptingSimplePHPscripts Simple Forum PHP
- CVE-2023-3538SimplePHPscripts Photo Gallery PHP URL Parameter preview.php cross site scriptingSimplePHPscripts Photo Gallery PHP
- CVE-2023-3537SimplePHPscripts News Script PHP Pro URL Parameter preview.php cross site scriptingSimplePHPscripts News Script PHP Pro
- CVE-2023-3536SimplePHPscripts Funeral Script PHP URL Parameter preview.php cross site scriptingSimplePHPscripts Funeral Script PHP
- CVE-2023-3535SimplePHPscripts FAQ Script PHP URL Parameter preview.php cross site scriptingSimplePHPscripts FAQ Script PHP
- CVE-2023-3534SourceCodester Shopping Website check_availability.php sql injectionSourceCodester Shopping Website
- CVE-2020-8934Site Kit by Google plugin for WordPressSite Kit By Google
- CVE-2023-33008Apache Johnzon: Prevent inefficient internal conversion from BigDecimal at large scaleApache Software Foundation Apache Johnzon · org.apache.john…
- CVE-2023-35890IBM WebSphere Application Server information disclosureIBM WebSphere Application Server
- CVE-2023-25201Cross Site Request Forgery (CSRF) vulnerability in MultiTech Conduit AP MTCAP2-L4E1 MTCAP2-L4E1-868-042A v.6.0.0 allows a remote attacker to
- CVE-2023-27845SQL injection vulnerability found in PrestaShop lekerawen_ocs before v.1.4.1 allow a remote attacker to gain privileges via the KerawenHelpe
- CVE-2023-29998A Cross-site scripting (XSS) vulnerability in the content editor in Gis3W g3w-suite 3.5 allows remote authenticated users to inject arbitrar
- CVE-2023-33664ai-dev aicombinationsonfly before v0.3.1 was discovered to contain a SQL injection vulnerability via the component /includes/ajax.php.
- CVE-2023-34197Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before 14300, and SupportCenter Plus before 14300 have a privilege esc
- CVE-2023-36201An issue in JerryscriptProject jerryscript v.3.0.0 allows an attacker to obtain sensitive information via a crafted script to the arrays.
- CVE-2023-36256The Online Examination System Project 1.0 version is vulnerable to Cross-Site Request Forgery (CSRF) attacks.
- CVE-2023-36992PHP injection in TravianZ 8.3.4 and 8.3.3 in the config editor in the admin page allows remote attackers to execute PHP code.
- CVE-2023-36993The cryptographically insecure random number generator being used in TravianZ 8.3.4 and 8.3.3 in the password reset function allows an attac
- CVE-2023-36994In TravianZ 8.3.4 and 8.3.3, Incorrect Access Control in the installation script allows an attacker to overwrite the server configuration an
- CVE-2023-37061Chamilo 1.11.x up to 1.11.20 allows users with an admin privilege account to insert XSS in the languages management section.
- CVE-2023-37062Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the course categories' definition.
- CVE-2023-37063Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the careers & promotions management section.
- CVE-2023-37064Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the extra fields management section.
- CVE-2023-37065Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the session category management section.
- CVE-2023-37066Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the skills wheel.
- CVE-2023-37067Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the classes/usergroups management section.
- CVE-2023-37144Tenda AC10 v15.03.06.26 was discovered to contain a command injection vulnerability via the mac parameter in the function formWriteFacMac.
- CVE-2023-37145TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the hostname parameter in the setOpMod
- CVE-2023-37146TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFi
- CVE-2023-37148TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the ussd parameter in the setUssd func
- CVE-2023-37149TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the FileName parameter in the setUploa
- CVE-2023-37170TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the lang
- CVE-2023-37171TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the admuser parameter in the setPass
- CVE-2023-37172TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the ip parameter in the setDiagnosis
- CVE-2023-37173TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the command parameter in the setTrac
- CVE-2023-37308Zoho ManageEngine ADAudit Plus before 7100 allows XSS via the username field.