# CVEs published 2023-07-07

57 CVEs were published on July 7, 2023: 6 critical, 3 high. Days are UTC.

- [CVE-2023-32000](https://cve.now/CVE-2023-32000.md): A Cross-Site Scripting (XSS) vulnerability found in UniFi Network (Version 7.3.83 and earlier) allows a malicious actor with Site Administra (no CVSS, Ubiquiti UniFi Network Application)
- [CVE-2023-37270](https://cve.now/CVE-2023-37270.md): Piwigo SQL Injection vulnerability in "User-Agent" (CVSS 7.6, Piwigo)
- [CVE-2023-37269](https://cve.now/CVE-2023-37269.md): Winter CMS vulnerable to stored XSS through privileged upload of SVG file (CVSS 2.0, wintercms winter · wintercms/winter)
- [CVE-2023-37262](https://cve.now/CVE-2023-37262.md): CC: Tweaked SSRF to Cloud Services Metadata Services not Blocked by Default (CVSS 9.6, CC-Tweaked)
- [CVE-2023-37261](https://cve.now/CVE-2023-37261.md): OpenComputers's SSRF to cloud service metadata services and local IPv6 addresses not blocked by default (CVSS 9.6, MightyPirates OpenComputers)
- [CVE-2022-4361](https://cve.now/CVE-2022-4361.md): Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC provide (CVSS 10.0, keycloak · org.keycloak:keycloak-services)
- [CVE-2023-20180](https://cve.now/CVE-2023-20180.md): A vulnerability in the web interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site request (CVSS 4.3, Cisco Webex Meetings)
- [CVE-2023-20133](https://cve.now/CVE-2023-20133.md): A vulnerability in the web interface of Cisco Webex Meetings could allow an authenticated, remote attacker to conduct a stored cross-site sc (CVSS 5.4, Cisco Webex Meetings)
- [CVE-2021-32495](https://cve.now/CVE-2021-32495.md): Radare2 has a use-after-free vulnerability in pyc parser's get\_none\_object function. (CVSS 10.0, radare2)
- [CVE-2021-32494](https://cve.now/CVE-2021-32494.md): Radare2 has a division by zero vulnerability in Mach-O parser's rebase\_buffer function. (CVSS 10.0, radare2)
- [CVE-2021-39014](https://cve.now/CVE-2021-39014.md): IBM Cloud Object Storage System cross-site scripting (CVSS 6.4, IBM Cloud Object Storage System)
- [CVE-2021-33796](https://cve.now/CVE-2021-33796.md): In MuJS before version 1.1.2, a use-after-free flaw in the regexp source property access may cause denial of service. (CVSS 10.0, MuJS)
- [CVE-2021-33798](https://cve.now/CVE-2021-33798.md): A null pointer dereference was found in libpano13, version libpano13-2.9.20. (CVSS 4.7, libpano13)
- [CVE-2023-3544](https://cve.now/CVE-2023-3544.md): GZ Scripts Time Slot Booking Calendar PHP load.php cross site scripting (CVSS 3.5, GZ Scripts Time Slot Booking Calendar PHP)
- [CVE-2023-3543](https://cve.now/CVE-2023-3543.md): GZ Scripts Availability Booking Calendar PHP HTTP POST Request load.php cross site scripting (CVSS 3.5, GZ Scripts Availability Booking Calendar PHP)
- [CVE-2023-37264](https://cve.now/CVE-2023-37264.md): Pipelines do not validate child UIDs (CVSS 3.7, tektoncd pipeline · github.com/tektoncd/pipeline)
- [CVE-2023-3542](https://cve.now/CVE-2023-3542.md): ThinuTech ThinuCMS contact.php cross site scripting (CVSS 3.5, ThinuTech ThinuCMS)
- [CVE-2023-3541](https://cve.now/CVE-2023-3541.md): ThinuTech ThinuCMS author\_posts.php cross site scripting (CVSS 3.5, ThinuTech ThinuCMS)
- [CVE-2023-3540](https://cve.now/CVE-2023-3540.md): SimplePHPscripts NewsLetter Script PHP URL Parameter preview.php cross site scripting (CVSS 3.5, SimplePHPscripts NewsLetter Script PHP)
- [CVE-2023-3539](https://cve.now/CVE-2023-3539.md): SimplePHPscripts Simple Forum PHP URL Parameter preview.php cross site scripting (CVSS 3.5, SimplePHPscripts Simple Forum PHP)
- [CVE-2023-3538](https://cve.now/CVE-2023-3538.md): SimplePHPscripts Photo Gallery PHP URL Parameter preview.php cross site scripting (CVSS 3.5, SimplePHPscripts Photo Gallery PHP)
- [CVE-2023-3537](https://cve.now/CVE-2023-3537.md): SimplePHPscripts News Script PHP Pro URL Parameter preview.php cross site scripting (CVSS 3.5, SimplePHPscripts News Script PHP Pro)
- [CVE-2023-3536](https://cve.now/CVE-2023-3536.md): SimplePHPscripts Funeral Script PHP URL Parameter preview.php cross site scripting (CVSS 3.5, SimplePHPscripts Funeral Script PHP)
- [CVE-2023-3535](https://cve.now/CVE-2023-3535.md): SimplePHPscripts FAQ Script PHP URL Parameter preview.php cross site scripting (CVSS 3.5, SimplePHPscripts FAQ Script PHP)
- [CVE-2023-3534](https://cve.now/CVE-2023-3534.md): SourceCodester Shopping Website check\_availability.php sql injection (CVSS 6.3, SourceCodester Shopping Website)
- [CVE-2020-8934](https://cve.now/CVE-2020-8934.md): Site Kit by Google plugin for WordPress (CVSS 4.3, Site Kit By Google)
- [CVE-2023-33008](https://cve.now/CVE-2023-33008.md): Apache Johnzon: Prevent inefficient internal conversion from BigDecimal at large scale (CVSS 5.3, Apache Software Foundation Apache Johnzon · org.apache.john…)
- [CVE-2023-32183](https://cve.now/CVE-2023-32183.md): Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed hawk2 package allows users with access to the hacluster to escalate t (CVSS 7.8, openSUSE Tumbleweed)
- [CVE-2023-3532](https://cve.now/CVE-2023-3532.md): Cross-site Scripting (XSS) - Stored in outline/outline (CVSS 8.5, outline/outline)
- [CVE-2023-35890](https://cve.now/CVE-2023-35890.md): IBM WebSphere Application Server information disclosure (CVSS 5.1, IBM WebSphere Application Server)
- [CVE-2023-25201](https://cve.now/CVE-2023-25201.md): Cross Site Request Forgery (CSRF) vulnerability in MultiTech Conduit AP MTCAP2-L4E1 MTCAP2-L4E1-868-042A v.6.0.0 allows a remote attacker to (no CVSS)
- [CVE-2023-27845](https://cve.now/CVE-2023-27845.md): SQL injection vulnerability found in PrestaShop lekerawen\_ocs before v.1.4.1 allow a remote attacker to gain privileges via the KerawenHelpe (no CVSS)
- [CVE-2023-29998](https://cve.now/CVE-2023-29998.md): A Cross-site scripting (XSS) vulnerability in the content editor in Gis3W g3w-suite 3.5 allows remote authenticated users to inject arbitrar (no CVSS)
- [CVE-2023-33664](https://cve.now/CVE-2023-33664.md): ai-dev aicombinationsonfly before v0.3.1 was discovered to contain a SQL injection vulnerability via the component /includes/ajax.php. (no CVSS)
- [CVE-2023-34197](https://cve.now/CVE-2023-34197.md): Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before 14300, and SupportCenter Plus before 14300 have a privilege esc (no CVSS)
- [CVE-2023-36201](https://cve.now/CVE-2023-36201.md): An issue in JerryscriptProject jerryscript v.3.0.0 allows an attacker to obtain sensitive information via a crafted script to the arrays. (no CVSS)
- [CVE-2023-36256](https://cve.now/CVE-2023-36256.md): The Online Examination System Project 1.0 version is vulnerable to Cross-Site Request Forgery (CSRF) attacks. (no CVSS)
- [CVE-2023-36992](https://cve.now/CVE-2023-36992.md): PHP injection in TravianZ 8.3.4 and 8.3.3 in the config editor in the admin page allows remote attackers to execute PHP code. (no CVSS)
- [CVE-2023-36993](https://cve.now/CVE-2023-36993.md): The cryptographically insecure random number generator being used in TravianZ 8.3.4 and 8.3.3 in the password reset function allows an attac (no CVSS)
- [CVE-2023-36994](https://cve.now/CVE-2023-36994.md): In TravianZ 8.3.4 and 8.3.3, Incorrect Access Control in the installation script allows an attacker to overwrite the server configuration an (no CVSS)
- [CVE-2023-37061](https://cve.now/CVE-2023-37061.md): Chamilo 1.11.x up to 1.11.20 allows users with an admin privilege account to insert XSS in the languages management section. (no CVSS)
- [CVE-2023-37062](https://cve.now/CVE-2023-37062.md): Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the course categories' definition. (no CVSS)
- [CVE-2023-37063](https://cve.now/CVE-2023-37063.md): Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the careers & promotions management section. (no CVSS)
- [CVE-2023-37064](https://cve.now/CVE-2023-37064.md): Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the extra fields management section. (no CVSS)
- [CVE-2023-37065](https://cve.now/CVE-2023-37065.md): Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the session category management section. (no CVSS)
- [CVE-2023-37066](https://cve.now/CVE-2023-37066.md): Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the skills wheel. (no CVSS)
- [CVE-2023-37067](https://cve.now/CVE-2023-37067.md): Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the classes/usergroups management section. (no CVSS)
- [CVE-2023-37144](https://cve.now/CVE-2023-37144.md): Tenda AC10 v15.03.06.26 was discovered to contain a command injection vulnerability via the mac parameter in the function formWriteFacMac. (no CVSS)
- [CVE-2023-37145](https://cve.now/CVE-2023-37145.md): TOTOLINK LR350 V9.3.5u.6369\_B20220309 was discovered to contain a command injection vulnerability via the hostname parameter in the setOpMod (no CVSS)
- [CVE-2023-37146](https://cve.now/CVE-2023-37146.md): TOTOLINK LR350 V9.3.5u.6369\_B20220309 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFi (no CVSS)
- [CVE-2023-37148](https://cve.now/CVE-2023-37148.md): TOTOLINK LR350 V9.3.5u.6369\_B20220309 was discovered to contain a command injection vulnerability via the ussd parameter in the setUssd func (no CVSS)
- [CVE-2023-37149](https://cve.now/CVE-2023-37149.md): TOTOLINK LR350 V9.3.5u.6369\_B20220309 was discovered to contain a command injection vulnerability via the FileName parameter in the setUploa (no CVSS)
- [CVE-2023-37170](https://cve.now/CVE-2023-37170.md): TOTOLINK A3300R V17.0.0cu.557\_B20221024 was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the lang (no CVSS)
- [CVE-2023-37171](https://cve.now/CVE-2023-37171.md): TOTOLINK A3300R V17.0.0cu.557\_B20221024 was discovered to contain a command injection vulnerability via the admuser parameter in the setPass (no CVSS)
- [CVE-2023-37172](https://cve.now/CVE-2023-37172.md): TOTOLINK A3300R V17.0.0cu.557\_B20221024 was discovered to contain a command injection vulnerability via the ip parameter in the setDiagnosis (no CVSS)
- [CVE-2023-37173](https://cve.now/CVE-2023-37173.md): TOTOLINK A3300R V17.0.0cu.557\_B20221024 was discovered to contain a command injection vulnerability via the command parameter in the setTrac (no CVSS)
- [CVE-2023-37308](https://cve.now/CVE-2023-37308.md): Zoho ManageEngine ADAudit Plus before 7100 allows XSS via the username field. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-07-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.