CVEs published July 10, 2023
125 CVEs were published on July 10, 2023: 10 critical, 14 high. 1 is now in CISA KEV.
- Published
- 125
- Critical
- 10
- High
- 14
- Medium
- 57
- Low
- 5
- Unrated
- 39
- Now in CISA KEV
- 1
- Fix available
- 57
Most affected products
- SICK AG ICR890-4
- 8
- OSNEXUS QuantaStor
- 6
- MStore API
- 4
- zephyrproject-rtos Zephyr
- 4
- Delta Electronics Infrasuite Device Master
- 3
- sox · Red Hat Enterprise Linux +1
- 3
- Call Now Accessibility Button
- 2
- Citrix ADC and Citrix Gateway
- 2
- EventON
- 2
- IBM Watson Knowledge Catalog on Cloud Pak for Data
- 2
Critical 10
- CVE-2023-24489A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthentCitrix ShareFile Storage Zones Controller
- CVE-2023-34347Delta Electronics InfraSuite Device Master Deserialization of Untrusted DataDelta Electronics Infrasuite Device Master
- CVE-2023-37277XWiki Platform vulnerable to cross-site request forgery (CSRF) via the REST APIxwiki-platform · org.xwiki.platform:xwiki-platform-rest-… +2
- CVE-2023-32254Tree connection race condition remote code execution vulnerabilitykernel · Red Hat Enterprise Linux +1
- CVE-2023-32250Session race condition remote code execution vulnerabilitykernel · Red Hat Enterprise Linux +1
- CVE-2021-4406Authenticated Remote COmmand Execution as root in OSNEXUS QuantaStor version 6.0.0.355 and othersOSNEXUS QuantaStor
- CVE-2021-42081Authenticated Remote Command Execution vulnerability in OSNEXUS QuantaStor before 6.0.0.355OSNEXUS QuantaStor
- CVE-2023-37286SmartBPM.NET - Use of Hard-Coded Credentials - 1SamrtSoft SmartBPM.NET
- CVE-2023-37287SmartBPM.NET - Use of Hard-Coded Credentials - 2SamrtSoft SmartBPM.NET
- CVE-2023-37712Tenda AC1206 V15.03.06.23, F1202 V1.2.0.20(408), and FH1202 V1.2.0.20(408) were discovered to contain a stack overflow in the page parameter
High 14
- CVE-2023-22835Denial of Service in Foundry Issuescom.palantir.foundry:foundry-frontend · com.palantir.issues…
- CVE-2023-34432Heap-buffer-overflow in src/formats_i.csox · Red Hat Enterprise Linux +1
- CVE-2023-30765Delta Electronics InfraSuite Device Master Improper Access ControlDelta Electronics Infrasuite Device Master
- CVE-2023-34318Heap-buffer-overflow in src/hcom.csox · Red Hat Enterprise Linux +1
- CVE-2023-29095WordPress RSVPMarker Plugin < 10.5.5 is vulnerable to SQL InjectionDavid F. Carr RSVPMaker
- CVE-2023-35696Unauthenticated endpoints in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the deSICK AG ICR890-4
- CVE-2023-3273Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to affect the availability of the device by chanSICK AG ICR890-4
- CVE-2023-3272Cleartext Transmission of Sensitive Information in the SICK ICR890-4 could allow a remote attacker to gather sensitive information by intercSICK AG ICR890-4
- CVE-2023-3271Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to gather information about the system and downlSICK AG ICR890-4
- CVE-2023-3270Exposure of Sensitive Information to an Unauthorized Actor in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sSICK AG ICR890-4
- CVE-2021-42080Reflected XSS vulnerability in OSNEXUS QuantaStor before 6.0.0.355OSNEXUS QuantaStor
- CVE-2021-42082Local Privilege Escalation to root in OSNEXUS QuantaStor before 6.0.0.355OSNEXUS QuantaStor
- CVE-2021-42083Authenticated Stored XSS in OSNEXUS QuantaStor 6.0.0.335OSNEXUS QuantaStor
- CVE-2023-28958IBM Watson Knowledge Catalog CSV injectionIBM Watson Knowledge Catalog on Cloud Pak for Data
Medium, low and unrated 101
- CVE-2023-3608Ruijie BCR810W Tracert Page os command injectionRuijie BCR810W
- CVE-2023-30956IDOR in Foundry Comments allows retrieval of attachmentscom.palantir.comments:comments
- CVE-2023-24490Users with only access to launch VDA applications can launch an unauthorized desktopVirtual Delivery Agents for Windows for CVAD and Citrix Daa…
- CVE-2023-30960Insecure Direct Object Reference (IDOR) in Foundry job-trackercom.palantir.foundry.jobtracker:job-tracker
- CVE-2023-30963Stored XSS in Foundry Slate Query Dropdown menucom.palantir.foundry:foundry-frontend
- CVE-2023-3607kodbox WebConsole Plug-In webconsole.php.txt Execute os command injectionkodbox
- CVE-2023-24487Arbitrary file readCitrix ADC and Citrix Gateway
- CVE-2023-24488Cross site scriptingCitrix ADC and Citrix Gateway
- CVE-2023-24486Local user access to a system where another user is utilizing a vulnerable version of Citrix Workspace App for Linux to launch published desktops and applicationsCitrix Workspace app for Linux
- CVE-2023-3606TamronOS ping os command injectionTamronOS
- CVE-2023-3605PHPGurukul Online Shopping Portal Registration Page excessive authenticationPHPGurukul Online Shopping Portal
- CVE-2023-34316Delta Electronics InfraSuite Device Master Improper Access ControlDelta Electronics Infrasuite Device Master
- CVE-2023-3599SourceCodester Best Fee Management System Add User admin_class.php save_user access controlSourceCodester Best Fee Management System
- CVE-2023-32627Floating point exception in src/voc.csox · Red Hat Enterprise Linux +2
- CVE-2023-26590Floating point exception in src/aiff.csox · Red Hat Enterprise Linux +1
- CVE-2016-15034Dynacase Webdesk freedomrss_search.php freedomrss_search sql injectionDynacase Webdesk
- CVE-2023-23348HCL Launch is vulnerable to sensitive information disclosureHCL Software HCL Launch
- CVE-2023-37392WordPress WP Dummy Content Generator Plugin <= 2.3.0 is vulnerable to Cross Site Request Forgery (CSRF)Deepak Anand WP Dummy Content Generator
- CVE-2023-35912WordPress Potent Donations for WooCommerce Plugin <= 1.1.9 is vulnerable to Cross Site Request Forgery (CSRF)WP Zone Potent Donations for WooCommerce
- CVE-2023-36691WordPress WebwinkelKeur Plugin <= 3.24 is vulnerable to Cross Site Request Forgery (CSRF)Albert Peschar WebwinkelKeur
- CVE-2023-23787WordPress Premmerce Redirect Manager Plugin <= 1.0.9 is vulnerable to Cross Site Request Forgery (CSRF)Premmerce Redirect Manager
- CVE-2023-28995WordPress Configurable Tag Cloud Plugin <= 5.2 is vulnerable to Cross Site Request Forgery (CSRF)Keith Solomon Configurable Tag Cloud
- CVE-2023-23993WordPress IP Blocker Lite Plugin <= 11.1.1 is vulnerable to Cross Site Request Forgery (CSRF)LionScripts.com LionScripts: IP Blocker Lite
- CVE-2023-28986WordPress Affiliates Manager Plugin <= 2.9.20 is vulnerable to Cross Site Request Forgery (CSRF)wp.insider, wpaffiliatemgr Affiliates Manager
- CVE-2023-1183Arbitrary file writelibreoffice · Red Hat Enterprise Linux +1
- CVE-2015-10121Beeliked Microsite Plugin beelikedmicrosite.php embed_handler cross site scriptingBeeliked Microsite Plugin
- CVE-2023-28989WordPress Happy Addons for Elementor Plugin <= 3.8.2 is vulnerable to Cross Site Request Forgery (CSRF)weDevs Happy Addons for Elementor
- CVE-2023-25478WordPress Weather Station Plugin <= 3.8.12 is vulnerable to Cross Site Request Forgery (CSRF)Jason Rouet Weather Station
- CVE-2023-1208HTTP Headers < 1.18.11 - Admin+ Remote Code ExecutionHTTP Headers
- CVE-2023-3219EventON < 2.1.2 - Unauthenticated Post Access via IDOREventON
- CVE-2023-3131MStore API < 3.9.7 - Subscriber+ Unauthorized Settings UpdateMStore API
- CVE-2023-3225Float menu < 5.0.3 - Admin+ Stored Cross-Site ScriptingFloat menu
- CVE-2023-2967TinyMCE Custom Styles < 1.1.4 - Admin+ Stored Cross-Site ScriptingTinyMCE Custom Styles
- CVE-2023-2635Call Now Accessibility Button < 1.1 - Admin+ Stored XSSCall Now Accessibility Button
- CVE-2023-3209MStore API < 3.9.7 - Settings Update via CSRFMStore API
- CVE-2023-2029PrePost SEO <= 3.0 - Admin+ Stored Cross-Site ScriptingPrePost SEO
- CVE-2023-2028Call Now Accessibility Button < 1.1 - Admin+ Stored Cross Site ScriptingCall Now Accessibility Button
- CVE-2023-3175AI ChatBot < 4.6.1 - Admin+ Stored Cross-Site ScriptingAI ChatBot
- CVE-2023-2709AN_GradeBook <= 5.0.1 - Admin+ XSSAN_GradeBook
- CVE-2023-3118Export All URLs < 4.6 - Reflected XSSExport All URLs
- CVE-2023-2529Enable SVG Uploads <= 2.1.5 - Author+ Stored XSS via SVGEnable SVG Uploads
- CVE-2023-1597tagDiv Cloud Library < 2.7 - Unauthenticated Arbitrary User Metadata Update to Privilege EscalationtagDiv Cloud Library
- CVE-2023-2495Greeklish-permalink < 3.5 - Unauthenticated Post Slug UpdateGreeklish-permalink
- CVE-2023-1780Companion Sitemap Generator < 4.5.3 - Reflected XSSCompanion Sitemap Generator
- CVE-2023-2964Simple Iframe < 1.2.0 - Contributor+ Stored XSSSimple Iframe
- CVE-2023-2026Image Protector <= 1.1 - Admin+ Stored Cross-Site ScriptingImage Protector
- CVE-2023-1119Multiple Plugins - Cross-Site Scripting From Third-party LibraryWP-Optimize · SrbTransLatin
- CVE-2023-3077MStore API < 3.9.8 - Unauthenticated Blind SQLiMStore API
- CVE-2023-3076MStore API < 3.9.9 - Unauthenticated Privilege EscalationMStore API
- CVE-2023-2578Buy Me a Coffee < 3.7 - Admin+ Stored XSSBuy Me a Coffee
- CVE-2023-2493All In One Redirection < 2.2.0 - Admin+ SQLiAll In One Redirection
- CVE-2023-2796EventON < 2.1.2 - Unauthenticated Event AccessEventON
- CVE-2023-3129URL Shortify < 1.7.0 - Admin+ Cross Site ScriptingURL Shortify
- CVE-2023-22695WordPress Custom Field Template Plugin <= 2.5.8 is vulnerable to Cross Site Request Forgery (CSRF)Hiroaki Miyashita Custom Field Template
- CVE-2023-22694WordPress BigContact Plugin <= 1.5.8 is vulnerable to Cross Site Request Forgery (CSRF)Arian Khosravi, Norik Davtian BigContact Contact Page
- CVE-2023-23869WordPress Google XML Sitemap for Mobile Plugin <= 1.6.1 is vulnerable to Cross Site Request Forgery (CSRF)Amit Agarwal Google XML Sitemap for Mobile
- CVE-2023-23897WordPress Simple Mobile URL Redirect Plugin <= 1.7.2 is vulnerable to Cross Site Request Forgery (CSRF)Ozette Plugins Simple Mobile URL Redirect
- CVE-2015-10120WDS Multisite Aggregate Plugin WDS_Multisite_Aggregate_Options.php update_options cross site scriptingWDS Multisite Aggregate Plugin
- CVE-2023-24405WordPress Contact Form 7 – PayPal & Stripe Add-on Plugin <= 1.9.3 is vulnerable to Cross Site Request Forgery (CSRF)Scott Paterson Contact Form 7 – PayPal & Stripe Add-on
- CVE-2023-23804WordPress HT Feed Plugin <= 1.2.7 is vulnerable to Cross Site Request Forgery (CSRF)HasThemes HT Feed
- CVE-2023-22673WordPress Website Monetization by MageNet Plugin <= 1.0.29.1 is vulnerable to Cross Site Request Forgery (CSRF)Website Monetization by MageNet
- CVE-2023-3580Improper Handling of Additional Special Element in squidex/squidexsquidex/squidex
- CVE-2023-3579HadSky User cross-site request forgeryHadSky
- CVE-2023-3578DedeCMS co_do.php server-side request forgeryDedeCMS
- CVE-2023-24395WordPress Contact Form 7 Redirect & Thank You Page Plugin <= 1.0.3 is vulnerable to Cross Site Request Forgery (CSRF)Scott Paterson Contact Form 7 Redirect & Thank You Page
- CVE-2023-35699Cleartext Storage on Disk in the SICK ICR890-4 could allow an unauthenticated attacker with local access to the device to disclose sensitiveSICK AG ICR890-4
- CVE-2023-35698Observable Response Discrepancy in the SICK ICR890-4 could allow a remote attacker to identify valid usernames for the FTP server from the rSICK AG ICR890-4
- CVE-2023-35697Improper Restriction of Excessive Authentication Attempts in the SICK ICR890-4 could allow a remote attacker to brute-force user credentialsSICK AG ICR890-4
- CVE-2023-34442Apache Camel JIRA: Temporary file information disclosure in Camel-JiraApache Software Foundation Apache Camel JIRA · org.apache.c…
- CVE-2015-10119View All Posts Page Plugin view-all-posts-pages.php action_admin_notices_activation cross site scriptingView All Posts Page Plugin
- CVE-2023-35887Apache MINA SSHD: Information disclosure bugs with RootedFilesystemApache Software Foundation Apache MINA SSHD · org.apache… +2
- CVE-2023-3574Improper Authorization in pimcore/customer-data-frameworkpimcore/customer-data-framework · pimcore/customer-manageme…
- CVE-2023-3568Open Redirect in alextselegidis/easyappointmentsalextselegidis/easyappointments
- CVE-2021-42079SSRF vulnerability in OSNEXUS QuantaStor before 6.0.0.355OSNEXUS QuantaStor
- CVE-2023-1901HCI send_sync Dangling Semaphore Reference Re-usezephyrproject-rtos Zephyr
- CVE-2023-2234BT HCI host union variant confusionzephyrproject-rtos Zephyr
- CVE-2023-1902HCI Connection Creation Dangling State Reference Re-usezephyrproject-rtos Zephyr
- CVE-2023-0359ipv6: Missing ipv6 nullptr-check in handle_ra_inputzephyrproject-rtos Zephyr
- CVE-2023-28955IBM Watson Knowledge Catalog denial of serviceIBM Watson Knowledge Catalog on Cloud Pak for Data
- CVE-2023-27540IBM Watson CP4D Data Stores denial of serviceIBM Watson CP4D Data Stores
- CVE-2023-28953IBM Cognos Analytics on Cloud Pak for Data improper access controlIBM Cognos Analytics Cartridge for Cloud Pak for Data
- CVE-2023-30442IBM Db2 denial of serviceIBM Db2 for Linux, UNIX and Windows
- CVE-2023-36375Cross Site Scripting vulnerability in Hostel Management System v2.1 allows an attacker to execute arbitrary code via a crafted payload to th
- CVE-2023-36376Cross-Site Scripting (XSS) vulnerability in Hostel Management System v.2.1 allows attackers to execute arbitrary web scripts or HTML via a c
- CVE-2023-36936Cross-Site Scripting (XSS) vulnerability in PHPGurukul Online Security Guards Hiring System using PHP and MySQL 1.0 allows attackers to exec
- CVE-2023-36939Cross-Site Scripting (XSS) vulnerability in Hostel Management System v2.1 allows an attacker to execute arbitrary code via a crafted payload
- CVE-2023-36940Cross Site Scripting (XSS) vulnerability in PHPGurukul Online Fire Reporting System Using PHP and MySQL v.1.2 allows attackers to execute ar
- CVE-2023-37150Sourcecodester Online Pizza Ordering System v1.0 has a Cross-site scripting (XSS) vulnerability in "/admin/index.php?page=categories" Catego
- CVE-2023-37152Projectworlds Online Art Gallery Project 1.0 allows unauthenticated users to perform arbitrary file uploads via the adminHome.php page.
- CVE-2023-37153KodExplorer 4.51 contains a Cross-Site Scripting (XSS) vulnerability in the Description box of the Light App creation feature.
- CVE-2023-37288SmartBPM.NET - Path TraversalSmartSoft SmartBPM.NET
- CVE-2023-37700Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the ssid parameter in the form_fast_setting_wifi_set function.
- CVE-2023-37701Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the deviceId parameter in the addWifiMacFilter function.
- CVE-2023-37702Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the deviceId parameter in the formSetDeviceName function.
- CVE-2023-37703Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the speed_dir parameter in the formSetSpeedWan function.
- CVE-2023-37704Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the deviceId parameter in the formSetClientState function.
- CVE-2023-37705Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the page parameter in the fromAddressNat function.
- CVE-2023-37706Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the entrys parameter in the fromAddressNat function.
- CVE-2023-37707Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the page parameter in the fromVirtualSer function.
- CVE-2023-37710Tenda AC1206 V15.03.06.23 and AC10 V15.03.06.47 were discovered to contain a stack overflow in the wpapsk_crypto parameter in the fromSetWir
- CVE-2023-37711Tenda AC1206 V15.03.06.23 and AC10 V15.03.06.47 were discovered to contain a stack overflow in the deviceId parameter in the saveParentContr