# CVEs published 2023-07-10

125 CVEs were published on July 10, 2023: 10 critical, 14 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2023-3608](https://cve.now/CVE-2023-3608.md): Ruijie BCR810W Tracert Page os command injection (CVSS 4.7, Ruijie BCR810W)
- [CVE-2023-24489](https://cve.now/CVE-2023-24489.md): A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthent (CVSS 9.8, KEV, Citrix ShareFile Storage Zones Controller)
- [CVE-2023-30956](https://cve.now/CVE-2023-30956.md): IDOR in Foundry Comments allows retrieval of attachments (CVSS 5.3, com.palantir.comments:comments)
- [CVE-2023-24490](https://cve.now/CVE-2023-24490.md): Users with only access to launch VDA applications can launch an unauthorized desktop (CVSS 6.3, Virtual Delivery Agents for Windows for CVAD and Citrix Daa…)
- [CVE-2023-30960](https://cve.now/CVE-2023-30960.md): Insecure Direct Object Reference (IDOR) in Foundry job-tracker (CVSS 4.3, com.palantir.foundry.jobtracker:job-tracker)
- [CVE-2023-30963](https://cve.now/CVE-2023-30963.md): Stored XSS in Foundry Slate Query Dropdown menu (CVSS 5.4, com.palantir.foundry:foundry-frontend)
- [CVE-2023-3607](https://cve.now/CVE-2023-3607.md): kodbox WebConsole Plug-In webconsole.php.txt Execute os command injection (CVSS 5.5, kodbox)
- [CVE-2023-22835](https://cve.now/CVE-2023-22835.md): Denial of Service in Foundry Issues (CVSS 7.7, com.palantir.foundry:foundry-frontend · com.palantir.issues…)
- [CVE-2023-24487](https://cve.now/CVE-2023-24487.md): Arbitrary file read (CVSS 6.3, Citrix ADC and Citrix Gateway)
- [CVE-2023-24488](https://cve.now/CVE-2023-24488.md): Cross site scripting (CVSS 6.1, Citrix ADC and Citrix Gateway)
- [CVE-2023-24486](https://cve.now/CVE-2023-24486.md): Local user access to a system where another user is utilizing a vulnerable version of Citrix Workspace App for Linux to launch published desktops and applications (CVSS 5.5, Citrix Workspace app for Linux)
- [CVE-2023-3606](https://cve.now/CVE-2023-3606.md): TamronOS ping os command injection (CVSS 6.3, TamronOS)
- [CVE-2023-34432](https://cve.now/CVE-2023-34432.md): Heap-buffer-overflow in src/formats\_i.c (CVSS 7.8, sox · Red Hat Enterprise Linux +1)
- [CVE-2023-3605](https://cve.now/CVE-2023-3605.md): PHPGurukul Online Shopping Portal Registration Page excessive authentication (CVSS 6.5, PHPGurukul Online Shopping Portal)
- [CVE-2023-30765](https://cve.now/CVE-2023-30765.md): ​Delta Electronics InfraSuite Device Master Improper Access Control (CVSS 8.8, Delta Electronics Infrasuite Device Master)
- [CVE-2023-34316](https://cve.now/CVE-2023-34316.md): Delta Electronics InfraSuite Device Master Improper Access Control (CVSS 6.5, Delta Electronics Infrasuite Device Master)
- [CVE-2023-34347](https://cve.now/CVE-2023-34347.md): ​Delta Electronics InfraSuite Device Master Deserialization of Untrusted Data (CVSS 9.8, Delta Electronics Infrasuite Device Master)
- [CVE-2023-3599](https://cve.now/CVE-2023-3599.md): SourceCodester Best Fee Management System Add User admin\_class.php save\_user access control (CVSS 6.3, SourceCodester Best Fee Management System)
- [CVE-2023-34318](https://cve.now/CVE-2023-34318.md): Heap-buffer-overflow in src/hcom.c (CVSS 7.8, sox · Red Hat Enterprise Linux +1)
- [CVE-2023-32627](https://cve.now/CVE-2023-32627.md): Floating point exception in src/voc.c (CVSS 6.2, sox · Red Hat Enterprise Linux +2)
- [CVE-2023-26590](https://cve.now/CVE-2023-26590.md): Floating point exception in src/aiff.c (CVSS 6.2, sox · Red Hat Enterprise Linux +1)
- [CVE-2016-15034](https://cve.now/CVE-2016-15034.md): Dynacase Webdesk freedomrss\_search.php freedomrss\_search sql injection (CVSS 5.5, Dynacase Webdesk)
- [CVE-2023-23348](https://cve.now/CVE-2023-23348.md): HCL Launch is vulnerable to sensitive information disclosure (CVSS 5.1, HCL Software HCL Launch)
- [CVE-2023-37277](https://cve.now/CVE-2023-37277.md): XWiki Platform vulnerable to cross-site request forgery (CSRF) via the REST API (CVSS 9.7, xwiki-platform · org.xwiki.platform:xwiki-platform-rest-… +2)
- [CVE-2023-37392](https://cve.now/CVE-2023-37392.md): WordPress WP Dummy Content Generator Plugin \<= 2.3.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Deepak Anand WP Dummy Content Generator)
- [CVE-2023-35912](https://cve.now/CVE-2023-35912.md): WordPress Potent Donations for WooCommerce Plugin \<= 1.1.9 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, WP Zone Potent Donations for WooCommerce)
- [CVE-2023-36691](https://cve.now/CVE-2023-36691.md): WordPress WebwinkelKeur Plugin \<= 3.24 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Albert Peschar WebwinkelKeur)
- [CVE-2023-23787](https://cve.now/CVE-2023-23787.md): WordPress Premmerce Redirect Manager Plugin \<= 1.0.9 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Premmerce Redirect Manager)
- [CVE-2023-28995](https://cve.now/CVE-2023-28995.md): WordPress Configurable Tag Cloud Plugin \<= 5.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Keith Solomon Configurable Tag Cloud)
- [CVE-2023-23993](https://cve.now/CVE-2023-23993.md): WordPress IP Blocker Lite Plugin \<= 11.1.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, LionScripts.com LionScripts: IP Blocker Lite)
- [CVE-2023-32254](https://cve.now/CVE-2023-32254.md): Tree connection race condition remote code execution vulnerability (CVSS 9.8, kernel · Red Hat Enterprise Linux +1)
- [CVE-2023-32250](https://cve.now/CVE-2023-32250.md): Session race condition remote code execution vulnerability (CVSS 9.0, kernel · Red Hat Enterprise Linux +1)
- [CVE-2023-28986](https://cve.now/CVE-2023-28986.md): WordPress Affiliates Manager Plugin \<= 2.9.20 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, wp.insider, wpaffiliatemgr Affiliates Manager)
- [CVE-2023-1183](https://cve.now/CVE-2023-1183.md): Arbitrary file write (CVSS 5.0, libreoffice · Red Hat Enterprise Linux +1)
- [CVE-2015-10121](https://cve.now/CVE-2015-10121.md): Beeliked Microsite Plugin beelikedmicrosite.php embed\_handler cross site scripting (CVSS 3.5, Beeliked Microsite Plugin)
- [CVE-2023-29095](https://cve.now/CVE-2023-29095.md): WordPress RSVPMarker Plugin \< 10.5.5 is vulnerable to SQL Injection (CVSS 7.6, David F. Carr RSVPMaker)
- [CVE-2023-28989](https://cve.now/CVE-2023-28989.md): WordPress Happy Addons for Elementor Plugin \<= 3.8.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, weDevs Happy Addons for Elementor)
- [CVE-2023-25478](https://cve.now/CVE-2023-25478.md): WordPress Weather Station Plugin \<= 3.8.12 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Jason Rouet Weather Station)
- [CVE-2023-1208](https://cve.now/CVE-2023-1208.md): HTTP Headers \< 1.18.11 - Admin+ Remote Code Execution (no CVSS, HTTP Headers)
- [CVE-2023-3219](https://cve.now/CVE-2023-3219.md): EventON \< 2.1.2 - Unauthenticated Post Access via IDOR (no CVSS, EventON)
- [CVE-2023-3131](https://cve.now/CVE-2023-3131.md): MStore API \< 3.9.7 - Subscriber+ Unauthorized Settings Update (no CVSS, MStore API)
- [CVE-2023-3225](https://cve.now/CVE-2023-3225.md): Float menu \< 5.0.3 - Admin+ Stored Cross-Site Scripting (no CVSS, Float menu)
- [CVE-2023-2967](https://cve.now/CVE-2023-2967.md): TinyMCE Custom Styles \< 1.1.4 - Admin+ Stored Cross-Site Scripting (CVSS 4.8, TinyMCE Custom Styles)
- [CVE-2023-2635](https://cve.now/CVE-2023-2635.md): Call Now Accessibility Button \< 1.1 - Admin+ Stored XSS (no CVSS, Call Now Accessibility Button)
- [CVE-2023-3209](https://cve.now/CVE-2023-3209.md): MStore API \< 3.9.7 - Settings Update via CSRF (no CVSS, MStore API)
- [CVE-2023-2029](https://cve.now/CVE-2023-2029.md): PrePost SEO \<= 3.0 - Admin+ Stored Cross-Site Scripting (no CVSS, PrePost SEO)
- [CVE-2023-2028](https://cve.now/CVE-2023-2028.md): Call Now Accessibility Button \< 1.1 - Admin+ Stored Cross Site Scripting (no CVSS, Call Now Accessibility Button)
- [CVE-2023-3175](https://cve.now/CVE-2023-3175.md): AI ChatBot \< 4.6.1 - Admin+ Stored Cross-Site Scripting (no CVSS, AI ChatBot)
- [CVE-2023-2709](https://cve.now/CVE-2023-2709.md): AN\_GradeBook \<= 5.0.1 - Admin+ XSS (no CVSS, AN\_GradeBook)
- [CVE-2023-3118](https://cve.now/CVE-2023-3118.md): Export All URLs \< 4.6 - Reflected XSS (CVSS 6.1, Export All URLs)
- [CVE-2023-2529](https://cve.now/CVE-2023-2529.md): Enable SVG Uploads \<= 2.1.5 - Author+ Stored XSS via SVG (no CVSS, Enable SVG Uploads)
- [CVE-2023-1597](https://cve.now/CVE-2023-1597.md): tagDiv Cloud Library \< 2.7 - Unauthenticated Arbitrary User Metadata Update to Privilege Escalation (no CVSS, tagDiv Cloud Library)
- [CVE-2023-2495](https://cve.now/CVE-2023-2495.md): Greeklish-permalink \< 3.5 - Unauthenticated Post Slug Update (no CVSS, Greeklish-permalink)
- [CVE-2023-1780](https://cve.now/CVE-2023-1780.md): Companion Sitemap Generator \< 4.5.3 - Reflected XSS (no CVSS, Companion Sitemap Generator)
- [CVE-2023-2964](https://cve.now/CVE-2023-2964.md): Simple Iframe \< 1.2.0 - Contributor+ Stored XSS (CVSS 5.4, Simple Iframe)
- [CVE-2023-2026](https://cve.now/CVE-2023-2026.md): Image Protector \<= 1.1 - Admin+ Stored Cross-Site Scripting (no CVSS, Image Protector)
- [CVE-2023-1119](https://cve.now/CVE-2023-1119.md): Multiple Plugins - Cross-Site Scripting From Third-party Library (CVSS 6.1, WP-Optimize · SrbTransLatin)
- [CVE-2023-3077](https://cve.now/CVE-2023-3077.md): MStore API \< 3.9.8 - Unauthenticated Blind SQLi (no CVSS, MStore API)
- [CVE-2023-3076](https://cve.now/CVE-2023-3076.md): MStore API \< 3.9.9 - Unauthenticated Privilege Escalation (no CVSS, MStore API)
- [CVE-2023-2578](https://cve.now/CVE-2023-2578.md): Buy Me a Coffee \< 3.7 - Admin+ Stored XSS (no CVSS, Buy Me a Coffee)
- [CVE-2023-2493](https://cve.now/CVE-2023-2493.md): All In One Redirection \< 2.2.0 - Admin+ SQLi (no CVSS, All In One Redirection)
- [CVE-2023-2796](https://cve.now/CVE-2023-2796.md): EventON \< 2.1.2 - Unauthenticated Event Access (no CVSS, EventON)
- [CVE-2023-3129](https://cve.now/CVE-2023-3129.md): URL Shortify \< 1.7.0 - Admin+ Cross Site Scripting (no CVSS, URL Shortify)
- [CVE-2023-22695](https://cve.now/CVE-2023-22695.md): WordPress Custom Field Template Plugin \<= 2.5.8 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Hiroaki Miyashita Custom Field Template)
- [CVE-2023-22694](https://cve.now/CVE-2023-22694.md): WordPress BigContact Plugin \<= 1.5.8 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Arian Khosravi, Norik Davtian BigContact Contact Page)
- [CVE-2023-23869](https://cve.now/CVE-2023-23869.md): WordPress Google XML Sitemap for Mobile Plugin \<= 1.6.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Amit Agarwal Google XML Sitemap for Mobile)
- [CVE-2023-23897](https://cve.now/CVE-2023-23897.md): WordPress Simple Mobile URL Redirect Plugin \<= 1.7.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Ozette Plugins Simple Mobile URL Redirect)
- [CVE-2015-10120](https://cve.now/CVE-2015-10120.md): WDS Multisite Aggregate Plugin WDS\_Multisite\_Aggregate\_Options.php update\_options cross site scripting (CVSS 3.5, WDS Multisite Aggregate Plugin)
- [CVE-2023-24405](https://cve.now/CVE-2023-24405.md): WordPress Contact Form 7 – PayPal & Stripe Add-on Plugin \<= 1.9.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Scott Paterson Contact Form 7 – PayPal & Stripe Add-on)
- [CVE-2023-23804](https://cve.now/CVE-2023-23804.md): WordPress HT Feed Plugin \<= 1.2.7 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, HasThemes HT Feed)
- [CVE-2023-22673](https://cve.now/CVE-2023-22673.md): WordPress Website Monetization by MageNet Plugin \<= 1.0.29.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Website Monetization by MageNet)
- [CVE-2023-3580](https://cve.now/CVE-2023-3580.md): Improper Handling of Additional Special Element in squidex/squidex (CVSS 5.4, squidex/squidex)
- [CVE-2023-3579](https://cve.now/CVE-2023-3579.md): HadSky User cross-site request forgery (CVSS 4.3, HadSky)
- [CVE-2023-3578](https://cve.now/CVE-2023-3578.md): DedeCMS co\_do.php server-side request forgery (CVSS 5.5, DedeCMS)
- [CVE-2023-24395](https://cve.now/CVE-2023-24395.md): WordPress Contact Form 7 Redirect & Thank You Page Plugin \<= 1.0.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Scott Paterson Contact Form 7 Redirect & Thank You Page)
- [CVE-2023-35699](https://cve.now/CVE-2023-35699.md): Cleartext Storage on Disk in the SICK ICR890-4 could allow an unauthenticated attacker with local access to the device to disclose sensitive (CVSS 5.3, SICK AG ICR890-4)
- [CVE-2023-35698](https://cve.now/CVE-2023-35698.md): Observable Response Discrepancy in the SICK ICR890-4 could allow a remote attacker to identify valid usernames for the FTP server from the r (CVSS 5.3, SICK AG ICR890-4)
- [CVE-2023-35697](https://cve.now/CVE-2023-35697.md): Improper Restriction of Excessive Authentication Attempts in the SICK ICR890-4 could allow a remote attacker to brute-force user credentials (CVSS 5.3, SICK AG ICR890-4)
- [CVE-2023-35696](https://cve.now/CVE-2023-35696.md): Unauthenticated endpoints in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the de (CVSS 7.5, SICK AG ICR890-4)
- [CVE-2023-3273](https://cve.now/CVE-2023-3273.md): Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to affect the availability of the device by chan (CVSS 7.5, SICK AG ICR890-4)
- [CVE-2023-34442](https://cve.now/CVE-2023-34442.md): Apache Camel JIRA: Temporary file information disclosure in Camel-Jira (low (no CVSS), Apache Software Foundation Apache Camel JIRA · org.apache.c…)
- [CVE-2015-10119](https://cve.now/CVE-2015-10119.md): View All Posts Page Plugin view-all-posts-pages.php action\_admin\_notices\_activation cross site scripting (CVSS 3.5, View All Posts Page Plugin)
- [CVE-2023-35887](https://cve.now/CVE-2023-35887.md): Apache MINA SSHD: Information disclosure bugs with RootedFilesystem (CVSS 5.0, Apache Software Foundation Apache MINA SSHD · org.apache… +2)
- [CVE-2023-3272](https://cve.now/CVE-2023-3272.md): Cleartext Transmission of Sensitive Information in the SICK ICR890-4 could allow a remote attacker to gather sensitive information by interc (CVSS 7.5, SICK AG ICR890-4)
- [CVE-2023-3271](https://cve.now/CVE-2023-3271.md): Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to gather information about the system and downl (CVSS 8.2, SICK AG ICR890-4)
- [CVE-2023-3270](https://cve.now/CVE-2023-3270.md): Exposure of Sensitive Information to an Unauthorized Actor in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve s (CVSS 8.6, SICK AG ICR890-4)
- [CVE-2023-3574](https://cve.now/CVE-2023-3574.md): Improper Authorization in pimcore/customer-data-framework (CVSS 6.3, pimcore/customer-data-framework · pimcore/customer-manageme…)
- [CVE-2023-3568](https://cve.now/CVE-2023-3568.md): Open Redirect in alextselegidis/easyappointments (CVSS 6.3, alextselegidis/easyappointments)
- [CVE-2021-4406](https://cve.now/CVE-2021-4406.md): Authenticated Remote COmmand Execution as root in OSNEXUS QuantaStor version 6.0.0.355 and others (CVSS 9.1, OSNEXUS QuantaStor)
- [CVE-2021-42081](https://cve.now/CVE-2021-42081.md): Authenticated Remote Command Execution vulnerability in OSNEXUS QuantaStor before 6.0.0.355 (CVSS 9.1, OSNEXUS QuantaStor)
- [CVE-2021-42079](https://cve.now/CVE-2021-42079.md): SSRF vulnerability in OSNEXUS QuantaStor before 6.0.0.355 (CVSS 6.2, OSNEXUS QuantaStor)
- [CVE-2021-42080](https://cve.now/CVE-2021-42080.md): Reflected XSS vulnerability in OSNEXUS QuantaStor before 6.0.0.355 (CVSS 7.4, OSNEXUS QuantaStor)
- [CVE-2021-42082](https://cve.now/CVE-2021-42082.md): Local Privilege Escalation to root in OSNEXUS QuantaStor before 6.0.0.355 (CVSS 7.8, OSNEXUS QuantaStor)
- [CVE-2021-42083](https://cve.now/CVE-2021-42083.md): Authenticated Stored XSS in OSNEXUS QuantaStor 6.0.0.335 (CVSS 8.7, OSNEXUS QuantaStor)
- [CVE-2023-1901](https://cve.now/CVE-2023-1901.md): HCI send\_sync Dangling Semaphore Reference Re-use (CVSS 5.9, zephyrproject-rtos Zephyr)
- [CVE-2023-2234](https://cve.now/CVE-2023-2234.md): BT HCI host union variant confusion (CVSS 6.8, zephyrproject-rtos Zephyr)
- [CVE-2023-1902](https://cve.now/CVE-2023-1902.md): HCI Connection Creation Dangling State Reference Re-use (CVSS 5.9, zephyrproject-rtos Zephyr)
- [CVE-2023-0359](https://cve.now/CVE-2023-0359.md): ipv6: Missing ipv6 nullptr-check in handle\_ra\_input (CVSS 5.9, zephyrproject-rtos Zephyr)
- [CVE-2023-28955](https://cve.now/CVE-2023-28955.md): IBM Watson Knowledge Catalog denial of service (CVSS 6.5, IBM Watson Knowledge Catalog on Cloud Pak for Data)
- [CVE-2023-28958](https://cve.now/CVE-2023-28958.md): IBM Watson Knowledge Catalog CSV injection (CVSS 7.0, IBM Watson Knowledge Catalog on Cloud Pak for Data)
- [CVE-2023-27540](https://cve.now/CVE-2023-27540.md): IBM Watson CP4D Data Stores denial of service (CVSS 5.9, IBM Watson CP4D Data Stores)
- [CVE-2023-28953](https://cve.now/CVE-2023-28953.md): IBM Cognos Analytics on Cloud Pak for Data improper access control (CVSS 3.1, IBM Cognos Analytics Cartridge for Cloud Pak for Data)
- [CVE-2023-30442](https://cve.now/CVE-2023-30442.md): IBM Db2 denial of service (CVSS 5.9, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2023-36375](https://cve.now/CVE-2023-36375.md): Cross Site Scripting vulnerability in Hostel Management System v2.1 allows an attacker to execute arbitrary code via a crafted payload to th (no CVSS)
- [CVE-2023-36376](https://cve.now/CVE-2023-36376.md): Cross-Site Scripting (XSS) vulnerability in Hostel Management System v.2.1 allows attackers to execute arbitrary web scripts or HTML via a c (no CVSS)
- [CVE-2023-36936](https://cve.now/CVE-2023-36936.md): Cross-Site Scripting (XSS) vulnerability in PHPGurukul Online Security Guards Hiring System using PHP and MySQL 1.0 allows attackers to exec (no CVSS)
- [CVE-2023-36939](https://cve.now/CVE-2023-36939.md): Cross-Site Scripting (XSS) vulnerability in Hostel Management System v2.1 allows an attacker to execute arbitrary code via a crafted payload (no CVSS)
- [CVE-2023-36940](https://cve.now/CVE-2023-36940.md): Cross Site Scripting (XSS) vulnerability in PHPGurukul Online Fire Reporting System Using PHP and MySQL v.1.2 allows attackers to execute ar (no CVSS)
- [CVE-2023-37150](https://cve.now/CVE-2023-37150.md): Sourcecodester Online Pizza Ordering System v1.0 has a Cross-site scripting (XSS) vulnerability in "/admin/index.php?page=categories" Catego (no CVSS)
- [CVE-2023-37152](https://cve.now/CVE-2023-37152.md): Projectworlds Online Art Gallery Project 1.0 allows unauthenticated users to perform arbitrary file uploads via the adminHome.php page. (no CVSS)
- [CVE-2023-37153](https://cve.now/CVE-2023-37153.md): KodExplorer 4.51 contains a Cross-Site Scripting (XSS) vulnerability in the Description box of the Light App creation feature. (no CVSS)
- [CVE-2023-37286](https://cve.now/CVE-2023-37286.md): SmartBPM.NET - Use of Hard-Coded Credentials - 1 (CVSS 9.8, SamrtSoft SmartBPM.NET)
- [CVE-2023-37287](https://cve.now/CVE-2023-37287.md): SmartBPM.NET - Use of Hard-Coded Credentials - 2 (CVSS 9.1, SamrtSoft SmartBPM.NET)
- [CVE-2023-37288](https://cve.now/CVE-2023-37288.md): SmartBPM.NET - Path Traversal (CVSS 6.5, SmartSoft SmartBPM.NET)
- [CVE-2023-37700](https://cve.now/CVE-2023-37700.md): Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the ssid parameter in the form\_fast\_setting\_wifi\_set function. (no CVSS)
- [CVE-2023-37701](https://cve.now/CVE-2023-37701.md): Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the deviceId parameter in the addWifiMacFilter function. (no CVSS)
- [CVE-2023-37702](https://cve.now/CVE-2023-37702.md): Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the deviceId parameter in the formSetDeviceName function. (no CVSS)
- [CVE-2023-37703](https://cve.now/CVE-2023-37703.md): Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the speed\_dir parameter in the formSetSpeedWan function. (no CVSS)
- [CVE-2023-37704](https://cve.now/CVE-2023-37704.md): Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the deviceId parameter in the formSetClientState function. (no CVSS)
- [CVE-2023-37705](https://cve.now/CVE-2023-37705.md): Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the page parameter in the fromAddressNat function. (no CVSS)
- [CVE-2023-37706](https://cve.now/CVE-2023-37706.md): Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the entrys parameter in the fromAddressNat function. (no CVSS)
- [CVE-2023-37707](https://cve.now/CVE-2023-37707.md): Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the page parameter in the fromVirtualSer function. (no CVSS)
- [CVE-2023-37710](https://cve.now/CVE-2023-37710.md): Tenda AC1206 V15.03.06.23 and AC10 V15.03.06.47 were discovered to contain a stack overflow in the wpapsk\_crypto parameter in the fromSetWir (no CVSS)
- [CVE-2023-37711](https://cve.now/CVE-2023-37711.md): Tenda AC1206 V15.03.06.23 and AC10 V15.03.06.47 were discovered to contain a stack overflow in the deviceId parameter in the saveParentContr (no CVSS)
- [CVE-2023-37712](https://cve.now/CVE-2023-37712.md): Tenda AC1206 V15.03.06.23, F1202 V1.2.0.20(408), and FH1202 V1.2.0.20(408) were discovered to contain a stack overflow in the page parameter (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-07-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.