# CVEs published 2023-07-12

237 CVEs were published on July 12, 2023: 4 critical, 34 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2023-35694](https://cve.now/CVE-2023-35694.md): In DMPixelLogger\_ProcessDmCommand of DMPixelLogger.cpp, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2023-35693](https://cve.now/CVE-2023-35693.md): In incfs\_kill\_sb of fs/incfs/vfs.c, there is a possible memory corruption due to a use after free. (no CVSS, Google Android)
- [CVE-2023-35691](https://cve.now/CVE-2023-35691.md): there is a possible out of bounds read due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2023-21400](https://cve.now/CVE-2023-21400.md): In multiple functions of io\_uring.c, there is a possible kernel memory corruption due to improper locking. (no CVSS, Google Android)
- [CVE-2023-21399](https://cve.now/CVE-2023-21399.md): there is a possible way to bypass cryptographic assurances due to a logic error in the code. (no CVSS, Google Android)
- [CVE-2023-21262](https://cve.now/CVE-2023-21262.md): In startInput of AudioPolicyInterfaceImpl.cpp, there is a possible way of erroneously displaying the microphone privacy indicator due to a r (no CVSS, Google Android)
- [CVE-2023-21257](https://cve.now/CVE-2023-21257.md): In updateSettingsInternalLI of InstallPackageHelper.java, there is a possible way to sideload an app in the work profile due to a missing pe (no CVSS, Google Android)
- [CVE-2023-21256](https://cve.now/CVE-2023-21256.md): In SettingsHomepageActivity.java, there is a possible way to launch arbitrary activities via Settings due to a logic error in the code. (no CVSS, Google Android)
- [CVE-2023-21255](https://cve.now/CVE-2023-21255.md): In multiple functions of binder.c, there is a possible memory corruption due to a use after free. (no CVSS, Google Android)
- [CVE-2023-21254](https://cve.now/CVE-2023-21254.md): In getCurrentState of OneTimePermissionUserManager.java, there is a possible way to hold one-time permissions after the app is being killed (no CVSS, Google Android)
- [CVE-2023-21251](https://cve.now/CVE-2023-21251.md): In onCreate of ConfirmDialog.java, there is a possible way to connect to VNP bypassing user's consent due to improper input validation. (no CVSS, Google Android)
- [CVE-2023-21250](https://cve.now/CVE-2023-21250.md): In gatt\_end\_operation of gatt\_utils.cc, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2023-21249](https://cve.now/CVE-2023-21249.md): In multiple functions of OneTimePermissionUserManager.java, there is a possible one-time permission retention due to a permissions bypass. (no CVSS, Google Android)
- [CVE-2023-21248](https://cve.now/CVE-2023-21248.md): In getAvailabilityStatus of WifiScanningMainSwitchPreferenceController.java, there is a possible way to bypass a device policy restriction d (no CVSS, Google Android)
- [CVE-2023-21247](https://cve.now/CVE-2023-21247.md): In getAvailabilityStatus of BluetoothScanningMainSwitchPreferenceController.java, there is a possible way to bypass a device policy restrict (no CVSS, Google Android)
- [CVE-2023-21246](https://cve.now/CVE-2023-21246.md): In ShortcutInfo of ShortcutInfo.java, there is a possible way for an app to retain notification listening access due to an uncaught exceptio (no CVSS, Google Android)
- [CVE-2023-21245](https://cve.now/CVE-2023-21245.md): In showNextSecurityScreenOrFinish of KeyguardSecurityContainerController.java, there is a possible way to access the lock screen during devi (CVSS 7.8, Google Android)
- [CVE-2023-21243](https://cve.now/CVE-2023-21243.md): In validateForCommonR1andR2 of PasspointConfiguration.java, there is a possible way to inflate the size of a config file with no limits due (no CVSS, Google Android)
- [CVE-2023-21241](https://cve.now/CVE-2023-21241.md): In rw\_i93\_send\_to\_upper of rw\_i93.cc, there is a possible out of bounds write due to an integer overflow. (no CVSS, Google Android)
- [CVE-2023-21240](https://cve.now/CVE-2023-21240.md): In Policy of Policy.java, there is a possible boot loop due to resource exhaustion. (no CVSS, Google Android)
- [CVE-2023-21239](https://cve.now/CVE-2023-21239.md): In visitUris of Notification.java, there is a possible way to leak image data across user boundaries due to a confused deputy. (no CVSS, Google Android)
- [CVE-2023-21238](https://cve.now/CVE-2023-21238.md): In visitUris of RemoteViews.java, there is a possible leak of images between users due to a confused deputy. (no CVSS, Google Android)
- [CVE-2023-21145](https://cve.now/CVE-2023-21145.md): In updatePictureInPictureMode of ActivityRecord.java, there is a possible bypass of background launch restrictions due to a logic error in t (no CVSS, Google Android)
- [CVE-2023-20942](https://cve.now/CVE-2023-20942.md): In openMmapStream of AudioFlinger.cpp, there is a possible way to record audio without displaying the microphone privacy indicator due to a (no CVSS, Google Android)
- [CVE-2023-20918](https://cve.now/CVE-2023-20918.md): In getPendingIntentLaunchFlags of ActivityOptions.java, there is a possible elevation of privilege due to a confused deputy with no addition (no CVSS, Google Android)
- [CVE-2023-34123](https://cve.now/CVE-2023-34123.md): Use of Hard-coded Cryptographic Key vulnerability in SonicWall GMS, SonicWall Analytics. (no CVSS, SonicWall GMS · SonicWall Analytics)
- [CVE-2021-0948](https://cve.now/CVE-2021-0948.md): The PVRSRVBridgeGetMultiCoreInfo ioctl in the PowerVR kernel driver can return uninitialized kernel memory to user space. (no CVSS, Google Android)
- [CVE-2023-3635](https://cve.now/CVE-2023-3635.md): Okio GzipSource unhandled exception Denial of Service (CVSS 5.9, com.squareup.okio:okio · com.squareup.okio:okio-jvm)
- [CVE-2023-3644](https://cve.now/CVE-2023-3644.md): SourceCodester Service Provider Management System sql injection (CVSS 6.3, SourceCodester Service Provider Management System)
- [CVE-2023-3643](https://cve.now/CVE-2023-3643.md): Boss Mini document file inclusion (CVSS 7.3, Boss Mini)
- [CVE-2023-3642](https://cve.now/CVE-2023-3642.md): GZ Scripts Vacation Rental Website HTTP POST Request cross site scripting (CVSS 4.3, GZ Scripts Vacation Rental Website)
- [CVE-2023-3641](https://cve.now/CVE-2023-3641.md): khodakhah NodCMS POST Request blog-comment-4 cross site scripting (CVSS 4.3, khodakhah NodCMS)
- [CVE-2023-38046](https://cve.now/CVE-2023-38046.md): PAN-OS: Read System Files and Resources During Configuration Commit (CVSS 5.5, Palo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1)
- [CVE-2023-29311](https://cve.now/CVE-2023-29311.md): \[FG-VD-23-006\] Adobe InDesign 2023 Out-of-Bound Read Vulnerability IV Notification (CVSS 5.5, Adobe InDesign)
- [CVE-2023-29314](https://cve.now/CVE-2023-29314.md): \[FG-VD-23-013\] Adobe InDesign 2023 Out-of-Bound Read Vulnerability X Notification (CVSS 5.5, Adobe InDesign)
- [CVE-2023-29312](https://cve.now/CVE-2023-29312.md): \[FG-VD-23-004\] Adobe InDesign 2023 Out-of-Bound Read Vulnerability II Notification (CVSS 5.5, Adobe InDesign)
- [CVE-2023-29308](https://cve.now/CVE-2023-29308.md): \[FG-VD-23-009\] Adobe InDesign 2023 Arbitrary Code Execution Vulnerability Notification (CVSS 7.8, Adobe InDesign)
- [CVE-2023-29318](https://cve.now/CVE-2023-29318.md): \[FG-VD-23-011\] Adobe InDesign 2023 Out-of-Bound Read Vulnerability VIII Notification (CVSS 5.5, Adobe InDesign)
- [CVE-2023-29309](https://cve.now/CVE-2023-29309.md): \[FG-VD-23-003\] Adobe InDesign 2023 Out-of-Bound Read Vulnerability Notification (CVSS 5.5, Adobe InDesign)
- [CVE-2023-29317](https://cve.now/CVE-2023-29317.md): \[FG-VD-23-005\] Adobe InDesign 2023 Out-of-Bound Read Vulnerability III Notification (CVSS 5.5, Adobe InDesign)
- [CVE-2023-29316](https://cve.now/CVE-2023-29316.md): \[FG-VD-23-012\] Adobe InDesign 2023 Out-of-Bound Read Vulnerability IX Notification (CVSS 5.5, Adobe InDesign)
- [CVE-2023-29313](https://cve.now/CVE-2023-29313.md): \[FG-VD-23-014\] Adobe InDesign 2023 Out-of-Bound Read Vulnerability XI Notification (CVSS 5.5, Adobe InDesign)
- [CVE-2023-29315](https://cve.now/CVE-2023-29315.md): \[FG-VD-23-008\] Adobe InDesign 2023 Out-of-Bound Read Vulnerability VI Notification (CVSS 5.5, Adobe InDesign)
- [CVE-2023-29319](https://cve.now/CVE-2023-29319.md): \[FG-VD-23-010\] Adobe InDesign 2023 Out-of-Bound Read Vulnerability VII Notification (CVSS 5.5, Adobe InDesign)
- [CVE-2023-29310](https://cve.now/CVE-2023-29310.md): \[FG-VD-23-007\] Adobe InDesign 2023 Out-of-Bound Read Vulnerability V Notification (CVSS 5.5, Adobe InDesign)
- [CVE-2023-37965](https://cve.now/CVE-2023-37965.md): A missing permission check in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers with Overall/Read permission to connect to an (no CVSS, Jenkins Project Jenkins ElasticBox CI Plugin · org.jenkins-…)
- [CVE-2023-37964](https://cve.now/CVE-2023-37964.md): A cross-site request forgery (CSRF) vulnerability in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers to connect to an attack (no CVSS, Jenkins Project Jenkins ElasticBox CI Plugin · org.jenkins-…)
- [CVE-2023-37963](https://cve.now/CVE-2023-37963.md): A missing permission check in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to connect (no CVSS, Jenkins Project Jenkins Benchmark Evaluator Plugin · io.jen…)
- [CVE-2023-37962](https://cve.now/CVE-2023-37962.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers to connect to an (no CVSS, Jenkins Project Jenkins Benchmark Evaluator Plugin · io.jen…)
- [CVE-2023-37961](https://cve.now/CVE-2023-37961.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Auth Plugin 1.14 and earlier allows attackers to trick users into logg (no CVSS, Jenkins Project Jenkins Assembla Auth Plugin · org.jenkins-…)
- [CVE-2023-37960](https://cve.now/CVE-2023-37960.md): Jenkins MathWorks Polyspace Plugin 1.0.5 and earlier allows attackers with Item/Configure permission to send emails with arbitrary files fro (no CVSS, Jenkins Project Jenkins MathWorks Polyspace Plugin · com.ma…)
- [CVE-2023-37959](https://cve.now/CVE-2023-37959.md): A missing permission check in Jenkins Sumologic Publisher Plugin 2.2.1 and earlier allows attackers with Overall/Read permission to connect (no CVSS, Jenkins Project Jenkins Sumologic Publisher Plugin · org.je…)
- [CVE-2023-37958](https://cve.now/CVE-2023-37958.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Sumologic Publisher Plugin 2.2.1 and earlier allows attackers to connect to an (no CVSS, Jenkins Project Jenkins Sumologic Publisher Plugin · org.je…)
- [CVE-2023-37957](https://cve.now/CVE-2023-37957.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline restFul API Plugin 0.11 and earlier allows attackers to connect to an (no CVSS, Jenkins Project Jenkins Pipeline restFul API Plugin · io.je…)
- [CVE-2023-37956](https://cve.now/CVE-2023-37956.md): A missing permission check in Jenkins Test Results Aggregator Plugin 1.2.13 and earlier allows attackers with Overall/Read permission to con (no CVSS, Jenkins Project Jenkins Test Results Aggregator Plugin · or…)
- [CVE-2023-37955](https://cve.now/CVE-2023-37955.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Test Results Aggregator Plugin 1.2.13 and earlier allows attackers to connect t (no CVSS, Jenkins Project Jenkins Test Results Aggregator Plugin · or…)
- [CVE-2023-37954](https://cve.now/CVE-2023-37954.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Rebuilder Plugin 320.v5a\_0933a\_e7d61 and earlier allows attackers to rebuild a (no CVSS, Jenkins Project Jenkins Rebuilder Plugin · com.sonyericsson…)
- [CVE-2023-37953](https://cve.now/CVE-2023-37953.md): A missing permission check in Jenkins mabl Plugin 0.0.46 and earlier allows attackers with Overall/Read permission to connect to an attacker (no CVSS, Jenkins Project Jenkins mabl Plugin · com.mabl.integration.…)
- [CVE-2023-37952](https://cve.now/CVE-2023-37952.md): A cross-site request forgery (CSRF) vulnerability in Jenkins mabl Plugin 0.0.46 and earlier allows attackers to connect to an attacker-speci (no CVSS, Jenkins Project Jenkins mabl Plugin · com.mabl.integration.…)
- [CVE-2023-37951](https://cve.now/CVE-2023-37951.md): Jenkins mabl Plugin 0.0.46 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure p (no CVSS, Jenkins Project Jenkins mabl Plugin · com.mabl.integration.…)
- [CVE-2023-37950](https://cve.now/CVE-2023-37950.md): A missing permission check in Jenkins mabl Plugin 0.0.46 and earlier allows attackers with Overall/Read permission to enumerate credentials (no CVSS, Jenkins Project Jenkins mabl Plugin · com.mabl.integration.…)
- [CVE-2023-37949](https://cve.now/CVE-2023-37949.md): A missing permission check in Jenkins Orka by MacStadium Plugin 1.33 and earlier allows attackers with Overall/Read permission to connect to (no CVSS, Jenkins Project Jenkins Orka by MacStadium Plugin · io.jenk…)
- [CVE-2023-37948](https://cve.now/CVE-2023-37948.md): Jenkins Oracle Cloud Infrastructure Compute Plugin 1.0.16 and earlier does not validate SSH host keys when connecting OCI clouds, enabling m (no CVSS, Jenkins Project Jenkins Oracle Cloud Infrastructure Compute…)
- [CVE-2023-37947](https://cve.now/CVE-2023-37947.md): Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb\_1a\_20 and earlier improperly determines that a redirect URL after login is legitimately p (no CVSS, Jenkins Project Jenkins OpenShift Login Plugin · org.opensh…)
- [CVE-2023-37946](https://cve.now/CVE-2023-37946.md): Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb\_1a\_20 and earlier does not invalidate the previous session on login. (no CVSS, Jenkins Project Jenkins OpenShift Login Plugin · org.opensh…)
- [CVE-2023-37945](https://cve.now/CVE-2023-37945.md): A missing permission check in Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 through 2.3.0 (both inclusive) allows attackers with Overall/Rea (no CVSS, Jenkins Project Jenkins SAML Single Sign On(SSO) Plugin · i…)
- [CVE-2023-37944](https://cve.now/CVE-2023-37944.md): A missing permission check in Jenkins Datadog Plugin 5.4.1 and earlier allows attackers with Overall/Read permission to connect to an attack (no CVSS, Jenkins Project Jenkins Datadog Plugin · org.datadog.jenkin…)
- [CVE-2023-37943](https://cve.now/CVE-2023-37943.md): Jenkins Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls" options and always performs the connection test to (no CVSS, Jenkins Project Jenkins Active Directory Plugin · org.jenki…)
- [CVE-2023-37942](https://cve.now/CVE-2023-37942.md): Jenkins External Monitor Job Type Plugin 206.v9a\_94ff0b\_4a\_10 and earlier does not configure its XML parser to prevent XML external entity ( (no CVSS, Jenkins Project Jenkins External Monitor Job Type Plugin ·…)
- [CVE-2023-29300](https://cve.now/CVE-2023-29300.md): Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution (CVSS 9.8, KEV, Adobe ColdFusion)
- [CVE-2023-29301](https://cve.now/CVE-2023-29301.md): Adobe ColdFusion Improper Restriction of Excessive Authentication Attempts Security feature bypass (CVSS 7.5, Adobe ColdFusion)
- [CVE-2023-29298](https://cve.now/CVE-2023-29298.md): Adobe ColdFusion Improper Access Control Security feature bypass (CVSS 7.5, KEV, Adobe ColdFusion)
- [CVE-2023-3618](https://cve.now/CVE-2023-3618.md): Segmentation fault in fax3encode in libtiff/tif\_fax3.c (CVSS 6.5, libtiff · Red Hat Enterprise Linux +1)
- [CVE-2023-20210](https://cve.now/CVE-2023-20210.md): A vulnerability in Cisco BroadWorks could allow an authenticated, local attacker to elevate privileges to the root user on an affected devic (CVSS 6.0, Cisco BroadWorks)
- [CVE-2023-20207](https://cve.now/CVE-2023-20207.md): A vulnerability in the logging component of Cisco Duo Authentication Proxy could allow an authenticated, remote attacker to view sensitive i (CVSS 4.9, Cisco Duo Authentication Proxy)
- [CVE-2023-20185](https://cve.now/CVE-2023-20185.md): A vulnerability in the Cisco ACI Multi-Site CloudSec encryption feature of Cisco Nexus 9000 Series Fabric Switches in ACI mode could allow a (CVSS 7.4, Cisco NX-OS System Software in ACI Mode)
- [CVE-2023-37456](https://cve.now/CVE-2023-37456.md): The session restore helper crashed whenever there was no parameter sent to the message handler. (no CVSS, Mozilla Firefox for iOS)
- [CVE-2023-37455](https://cve.now/CVE-2023-37455.md): The permission request prompt from the site in the background tab was overlaid on top of the site in the foreground tab. (no CVSS, Mozilla Firefox for iOS)
- [CVE-2023-3600](https://cve.now/CVE-2023-3600.md): Use-after-free in workers (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-3596](https://cve.now/CVE-2023-3596.md): Rockwell Automation Allen-Bradley ControlLogix Communication Modules vulnerable to Denial of Service (CVSS 7.5, Rockwell Automation 1756-EN4TR Series A · Rockwell Autom… +1)
- [CVE-2023-38069](https://cve.now/CVE-2023-38069.md): In JetBrains IntelliJ IDEA before 2023.1.4 license dialog could be suppressed in certain cases (CVSS 3.3, JetBrains IntelliJ IDEA)
- [CVE-2023-38068](https://cve.now/CVE-2023-38068.md): In JetBrains YouTrack before 2023.1.16597 captcha was not properly validated for Helpdesk forms (CVSS 6.5, JetBrains YouTrack)
- [CVE-2023-38067](https://cve.now/CVE-2023-38067.md): In JetBrains TeamCity before 2023.05.1 build parameters of the "password" type could be written to the agent log (CVSS 4.3, JetBrains TeamCity)
- [CVE-2023-38066](https://cve.now/CVE-2023-38066.md): In JetBrains TeamCity before 2023.05.1 reflected XSS via the Referer header was possible during artifact downloads (CVSS 4.6, JetBrains TeamCity)
- [CVE-2023-38065](https://cve.now/CVE-2023-38065.md): In JetBrains TeamCity before 2023.05.1 stored XSS while viewing the build log was possible (CVSS 4.6, JetBrains TeamCity)
- [CVE-2023-38064](https://cve.now/CVE-2023-38064.md): In JetBrains TeamCity before 2023.05.1 build chain parameters of the "password" type could be written to the agent log (CVSS 4.3, JetBrains TeamCity)
- [CVE-2023-38063](https://cve.now/CVE-2023-38063.md): In JetBrains TeamCity before 2023.05.1 stored XSS while running custom builds was possible (CVSS 4.6, JetBrains TeamCity)
- [CVE-2023-38062](https://cve.now/CVE-2023-38062.md): In JetBrains TeamCity before 2023.05.1 parameters of the "password" type could be shown in the UI in certain composite build configurations (CVSS 4.3, JetBrains TeamCity)
- [CVE-2023-38061](https://cve.now/CVE-2023-38061.md): In JetBrains TeamCity before 2023.05.1 stored XSS when using a custom theme was possible (CVSS 4.6, JetBrains TeamCity)
- [CVE-2023-3595](https://cve.now/CVE-2023-3595.md): Rockwell Automation ControlLogix Communication Modules Vulnerable to Remote Code Execution (CVSS 9.8, Rockwell Automation 1756-EN2T Series A, B, C · Rockwell… +20)
- [CVE-2021-44696](https://cve.now/CVE-2021-44696.md): Adobe Prelude JPEG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Prelude)
- [CVE-2021-43757](https://cve.now/CVE-2021-43757.md): Adobe Media Encoder 3GP File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Media Encoder)
- [CVE-2021-43759](https://cve.now/CVE-2021-43759.md): Adobe Media Encoder MP4 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Media Encoder)
- [CVE-2021-43758](https://cve.now/CVE-2021-43758.md): Adobe Media Encoder MP4 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Media Encoder)
- [CVE-2021-43760](https://cve.now/CVE-2021-43760.md): Adobe Media Encoder MOV File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Media Encoder)
- [CVE-2022-45855](https://cve.now/CVE-2022-45855.md): Apache Ambari: Allows authenticated metrics consumers to perform RCE (CVSS 8.0, Apache Software Foundation Apache Ambari · org.apache.ambar…)
- [CVE-2022-42009](https://cve.now/CVE-2022-42009.md): Apache Ambari: A malicious authenticated user can remotely execute arbitrary code in the context of the application. (CVSS 8.0, Apache Software Foundation Apache Ambari · org.apache.ambar…)
- [CVE-2023-37582](https://cve.now/CVE-2023-37582.md): Apache RocketMQ: Possible remote code execution when using the update configuration function (CVSS 9.8, Apache Software Foundation Apache RocketMQ · org.apache.roc…)
- [CVE-2023-22888](https://cve.now/CVE-2023-22888.md): Apache Airflow: Scheduler remote DoS (low (no CVSS), Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2023-36543](https://cve.now/CVE-2023-36543.md): Apache Airflow: ReDoS via dags function (low (no CVSS), Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2022-46651](https://cve.now/CVE-2022-46651.md): Apache Airflow: Security vulnerability on AirFlow Connections (low (no CVSS), Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2023-22887](https://cve.now/CVE-2023-22887.md): Apache Airflow path traversal by authenticated user (low (no CVSS), Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2023-35908](https://cve.now/CVE-2023-35908.md): Apache Airflow: Access to DAGs without relevant permission (low (no CVSS), Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2023-30428](https://cve.now/CVE-2023-30428.md): Apache Pulsar Broker: Incorrect Authorization Validation for Rest Producer (CVSS 8.2, Apache Software Foundation Apache Pulsar Broker · org.apach…)
- [CVE-2023-30429](https://cve.now/CVE-2023-30429.md): Apache Pulsar: Incorrect Authorization for Function Worker when using mTLS Authentication through Pulsar Proxy (CVSS 9.6, Apache Software Foundation Apache Pulsar · org.apache.pulsa…)
- [CVE-2023-31007](https://cve.now/CVE-2023-31007.md): Apache Pulsar: Broker does not always disconnect client when authentication data expires (CVSS 0.0, Apache Software Foundation Apache Pulsar · org.apache.pulsa…)
- [CVE-2023-37579](https://cve.now/CVE-2023-37579.md): Apache Pulsar Function Worker: Incorrect Authorization for Function Worker Can Leak Sink/Source Credentials (CVSS 8.2, Apache Software Foundation Apache Pulsar Function Worker ·…)
- [CVE-2022-48451](https://cve.now/CVE-2022-48451.md): In bluetooth service, there is a possible out of bounds write due to race condition. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-33905](https://cve.now/CVE-2023-33905.md): In iwnpi server, there is a possible out of bounds write due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-33904](https://cve.now/CVE-2023-33904.md): In hci\_server, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-48450](https://cve.now/CVE-2022-48450.md): In bluetooth service, there is a possible missing params check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-33903](https://cve.now/CVE-2023-33903.md): In FM service, there is a possible missing params check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-33902](https://cve.now/CVE-2023-33902.md): In bluetooth service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-33901](https://cve.now/CVE-2023-33901.md): In bluetooth service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-33897](https://cve.now/CVE-2023-33897.md): In libimpl-ril, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-33896](https://cve.now/CVE-2023-33896.md): In libimpl-ril, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-33895](https://cve.now/CVE-2023-33895.md): In fastDial service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-33894](https://cve.now/CVE-2023-33894.md): In fastDial service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-33893](https://cve.now/CVE-2023-33893.md): In fastDial service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-33892](https://cve.now/CVE-2023-33892.md): In fastDial service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-33891](https://cve.now/CVE-2023-33891.md): In telephony service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-33890](https://cve.now/CVE-2023-33890.md): In telephony service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-33889](https://cve.now/CVE-2023-33889.md): In telephony service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-33888](https://cve.now/CVE-2023-33888.md): In telephony service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-33887](https://cve.now/CVE-2023-33887.md): In telephony service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-33886](https://cve.now/CVE-2023-33886.md): In telephony service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-33885](https://cve.now/CVE-2023-33885.md): In telephony service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-33884](https://cve.now/CVE-2023-33884.md): In telephony service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-33883](https://cve.now/CVE-2023-33883.md): In telephony service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-33882](https://cve.now/CVE-2023-33882.md): In telephony service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-33881](https://cve.now/CVE-2023-33881.md): In telephony service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-33880](https://cve.now/CVE-2023-33880.md): In music service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-33879](https://cve.now/CVE-2023-33879.md): In music service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-32789](https://cve.now/CVE-2023-32789.md): In telephony service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-32788](https://cve.now/CVE-2023-32788.md): In telephony service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-33900](https://cve.now/CVE-2023-33900.md): In telephony service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-33899](https://cve.now/CVE-2023-33899.md): In telephony service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-33898](https://cve.now/CVE-2023-33898.md): In telephony service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-30913](https://cve.now/CVE-2023-30913.md): In telephony service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-30942](https://cve.now/CVE-2023-30942.md): In telephony service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-30941](https://cve.now/CVE-2023-30941.md): In telephony service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-30940](https://cve.now/CVE-2023-30940.md): In telephony service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-30939](https://cve.now/CVE-2023-30939.md): In telephony service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-30938](https://cve.now/CVE-2023-30938.md): In telephony service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-30937](https://cve.now/CVE-2023-30937.md): In telephony service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-30936](https://cve.now/CVE-2023-30936.md): In telephony service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-30935](https://cve.now/CVE-2023-30935.md): In telephony service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-30934](https://cve.now/CVE-2023-30934.md): In telephony service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-30933](https://cve.now/CVE-2023-30933.md): In telephony service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-30932](https://cve.now/CVE-2023-30932.md): In telephony service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-30931](https://cve.now/CVE-2023-30931.md): In telephony service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-30930](https://cve.now/CVE-2023-30930.md): In telephony service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-30929](https://cve.now/CVE-2023-30929.md): In telephony service, there is a possible missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-30928](https://cve.now/CVE-2023-30928.md): In telephony service, there is a possible missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-30927](https://cve.now/CVE-2023-30927.md): In telephony service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-30926](https://cve.now/CVE-2023-30926.md): In opm service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-30925](https://cve.now/CVE-2023-30925.md): In opm service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-30924](https://cve.now/CVE-2023-30924.md): In messaging service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-30923](https://cve.now/CVE-2023-30923.md): In messaging service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-30922](https://cve.now/CVE-2023-30922.md): In messaging service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-30921](https://cve.now/CVE-2023-30921.md): In messaging service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-30920](https://cve.now/CVE-2023-30920.md): In messaging service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-30919](https://cve.now/CVE-2023-30919.md): In messaging service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-30918](https://cve.now/CVE-2023-30918.md): In telephony service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-30917](https://cve.now/CVE-2023-30917.md): In DMService, there is a possible missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-30916](https://cve.now/CVE-2023-30916.md): In DMService, there is a possible missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2023-3106](https://cve.now/CVE-2023-3106.md): Kernel: netlink socket crash (null pointer deref) in netlink\_dump function (CVSS 6.6, Red Hat Enterprise Linux)
- [CVE-2023-29414](https://cve.now/CVE-2023-29414.md): A CWE-120: Buffer Copy without Checking Size of Input (Classic Buffer Overflow) vulnerability exists that could cause user privilege escala (CVSS 7.8, Schneider Electric Accutech Manager)
- [CVE-2023-32200](https://cve.now/CVE-2023-32200.md): Apache Jena: Exposure of execution in script engine expressions. (CVSS 8.8, Apache Software Foundation Apache Jena · org.apache.jena:je…)
- [CVE-2021-4427](https://cve.now/CVE-2021-4427.md): Vuukle Comments, Reactions, Share Bar, Revenue \<= 3.4.31 - Cross-Site Request Forgery Bypass (CVSS 4.3, Vuukle Comments, Reactions, Share Bar, Revenue)
- [CVE-2020-36761](https://cve.now/CVE-2020-36761.md): Top 10 \<= 2.9.4 - Cross-Site Request Forgery Bypass (CVSS 4.3, ajay WebberZone Top 10 — Popular Posts)
- [CVE-2021-4426](https://cve.now/CVE-2021-4426.md): Absolute Reviews \<= 1.0.8 - Cross-Site Request Forgery Bypass (CVSS 4.3, codesupplyco Absolute Reviews)
- [CVE-2020-36760](https://cve.now/CVE-2020-36760.md): Ocean Extra \<=1.6.5 - Cross-Site Request Forgery Bypass (CVSS 4.3, oceanwp Ocean Extra)
- [CVE-2021-4425](https://cve.now/CVE-2021-4425.md): Defender Security \<= 2.4.6 - Cross-Site Request Forgery Bypass (CVSS 4.3, wpmudev Defender Security – Malware Scanner, Login Security…)
- [CVE-2023-37200](https://cve.now/CVE-2023-37200.md): A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause loss of confidentiality when replaci (CVSS 5.5, Schneider Electric EcoStruxure OPC UA Server Expert)
- [CVE-2023-2763](https://cve.now/CVE-2023-2763.md): Use-After-Free, Out-of-bounds Write and Heap-based Buffer Overflow vulnerabilities exist in the DWG and DXF file reading procedure in SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023 (CVSS 7.8, Dassault Systèmes SOLIDWORKS Desktop)
- [CVE-2023-2762](https://cve.now/CVE-2023-2762.md): Use-After-Free vulnerability in SLDPRT file reading procedure affecting SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023 (CVSS 7.8, Dassault Systèmes SOLIDWORKS Desktop)
- [CVE-2023-37199](https://cve.now/CVE-2023-37199.md): A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an adm (CVSS 6.8, Schneider Electric StruxureWare Data Center Expert)
- [CVE-2021-4424](https://cve.now/CVE-2021-4424.md): Slider Hero \<= 8.2.0 - Cross-Site Request Forgery Bypass (CVSS 4.3, quantumcloud Slider Hero with Video Background, Animation)
- [CVE-2021-4423](https://cve.now/CVE-2021-4423.md): RAYS Grid \<= 1.2.2 - Cross-Site Request Forgery Bypass (CVSS 4.3, it-rays RAYS Grid)
- [CVE-2021-4422](https://cve.now/CVE-2021-4422.md): POST SMTP Mailer \<= 2.0.20 - Cross-Site Request Forgery Bypass (CVSS 4.3, saadiqbal Post SMTP – Complete Email Deliverability and SMT…)
- [CVE-2020-36757](https://cve.now/CVE-2020-36757.md): WP Hotel Booking \<= 1.10.1 - Cross-Site Request Forgery Bypass (CVSS 4.3, thimpress WP Hotel Booking)
- [CVE-2021-4421](https://cve.now/CVE-2021-4421.md): Advanced Popups \<= 1.1.1 - Cross-Site Request Forgery Bypass (CVSS 4.3, codesupplyco Advanced Popups)
- [CVE-2020-36756](https://cve.now/CVE-2020-36756.md): 10WebAnalytics \<= 1.2.8 - Cross-Site Request Forgery Bypass (CVSS 4.3, 10WebAnalytics)
- [CVE-2021-4420](https://cve.now/CVE-2021-4420.md): Sell Media \<= 2.5.5 - Cross-Site Request Forgery Bypass (CVSS 4.3, endortrails Sell Media)
- [CVE-2021-4419](https://cve.now/CVE-2021-4419.md): WP-Backgrounds Lite \<= 2.3 - Cross-Site Request Forgery Bypass (CVSS 4.3, inoplugs WP-Backgrounds Lite)
- [CVE-2023-37198](https://cve.now/CVE-2023-37198.md): A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an (CVSS 6.8, Schneider Electric StruxureWare Data Center Expert)
- [CVE-2023-37197](https://cve.now/CVE-2023-37197.md): A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command ('SQL Injection') vulnerability exists that co (CVSS 8.8, Schneider Electric StruxureWare Data Center Expert)
- [CVE-2023-37196](https://cve.now/CVE-2023-37196.md): A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command ('SQL Injection') vulnerability exists that coul (CVSS 8.8, Schneider Electric StruxureWare Data Center Expert)
- [CVE-2023-2561](https://cve.now/CVE-2023-2561.md): Gallery Metabox \<= 1.5 - Missing Authorization via gallery\_remove (CVSS 4.3, billerickson Gallery Metabox)
- [CVE-2023-3087](https://cve.now/CVE-2023-3087.md): FluentSMTP \<= 2.2.4 - Unauthenticated Stored Cross-Site Scripting via Email Subject (CVSS 7.2, techjewel FluentSMTP – WP SMTP Plugin with Amazon SES, Send…)
- [CVE-2023-3081](https://cve.now/CVE-2023-3081.md): WP Mail Logging \<= 1.11.1 - Unauthenticated Stored Cross-Site Scripting via Email (CVSS 7.2, smub WP Mail Logging)
- [CVE-2023-3166](https://cve.now/CVE-2023-3166.md): Lana Email Logger \<= 1.0.2 - Unauthenticated Stored Cross-Site Scripting via Email Subject (CVSS 7.2, lanacodes Lana Email Logger)
- [CVE-2023-3167](https://cve.now/CVE-2023-3167.md): Mail Queue \<= 1.1 - Unauthenticated Stored Cross-Site Scripting via Email Subject (CVSS 7.2, wdm-team Mail Queue)
- [CVE-2023-3202](https://cve.now/CVE-2023-3202.md): MStore API \<= 3.9.6 - Cross-Site Request Forgery to Firebase Server Key Update (CVSS 4.3, inspireui MStore API – Create Native Android & iOS Apps On…)
- [CVE-2020-36752](https://cve.now/CVE-2020-36752.md): Coming Soon & Maintenance Mode Page \<= 1.57 - Cross-Site Request Forgery Bypass (CVSS 4.3, hookandhook Coming Soon & Maintenance Mode Page & Under Con…)
- [CVE-2023-2517](https://cve.now/CVE-2023-2517.md): Metform Elementor Contact Form Builder \<= 3.3.2 - Cross-Site Request Forgery via permalink\_setup (CVSS 5.4, roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…)
- [CVE-2023-3023](https://cve.now/CVE-2023-3023.md): WP EasyCart \<= 5.4.10 - Authenticated (Administrator+) SQL Injection via 'orderby' (CVSS 7.2, levelfourstorefront Shopping Cart & eCommerce Store)
- [CVE-2023-2869](https://cve.now/CVE-2023-2869.md): WP-Members Membership \<= 3.4.7.3 - Missing Authorization to Settings Update (CVSS 4.3, cbutlerjr WP-Members Membership Plugin)
- [CVE-2023-3369](https://cve.now/CVE-2023-3369.md): About Me 3000 widget \<= 2.2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, d3wp About Me 3000 widget)
- [CVE-2023-3199](https://cve.now/CVE-2023-3199.md): MStore API \<= 3.9.6 - Cross-Site Request Forgery to Order Title Update (CVSS 4.3, inspireui MStore API – Create Native Android & iOS Apps On…)
- [CVE-2023-2562](https://cve.now/CVE-2023-2562.md): Gallery Metabox \<= 1.5 - Missing Authorization via refresh\_metabox (CVSS 4.3, billerickson Gallery Metabox)
- [CVE-2023-3092](https://cve.now/CVE-2023-3092.md): SMTP Mail \<= 1.3.46 - Unauthenticated Stored Cross-Site Scripting via Email Subject (CVSS 7.2, photoboxone SMTP Mail)
- [CVE-2023-3088](https://cve.now/CVE-2023-3088.md): WP Mail Log \<= 1.1.1 - Unauthenticated Stored Cross-Site Scripting via Email (CVSS 7.2, wpvibes WP Mail Log)
- [CVE-2023-3158](https://cve.now/CVE-2023-3158.md): Mail Control \<= 0.2.8 - Unauthenticated Stored Cross-Site Scripting via Email Subject (CVSS 7.2, rahalaboulfeth Mail Control – Email Customizer, SMTP Delive…)
- [CVE-2023-3082](https://cve.now/CVE-2023-3082.md): Post SMTP \<= 2.5.7 - Unauthenticated Stored Cross-Site Scripting via Email (CVSS 7.2, saadiqbal Post SMTP – Complete Email Deliverability and SMT…)
- [CVE-2023-3093](https://cve.now/CVE-2023-3093.md): YaySMTP \<= 2.4.5 - Unauthenticated Stored Cross-Site Scripting via Email (CVSS 7.2, yaycommerce YaySMTP and Email Logs: Amazon SES, SendGrid, O…)
- [CVE-2023-3168](https://cve.now/CVE-2023-3168.md): WP Reroute Email \<= 1.4.9 - Unauthenticated Stored Cross-Site Scripting via Email Subject (CVSS 7.2, msh134 WP Reroute Email)
- [CVE-2023-3011](https://cve.now/CVE-2023-3011.md): ARMember \<= 4.0.5 - Cross-Site Request Forgery (CVSS 6.5, reputeinfosystems ARMember – Membership Plugin, Content Res…)
- [CVE-2023-3135](https://cve.now/CVE-2023-3135.md): Mailtree Log Mail \<= 1.0.0 - Unauthenticated Stored Cross-Site Scripting via Email Subject (CVSS 7.2, oacstudio Mailtree Log Mail)
- [CVE-2023-3525](https://cve.now/CVE-2023-3525.md): The Getnet Argentina para Woocommerce plugin for WordPress is vulnerable to authorization bypass due to missing validation on the 'webhook' (CVSS 7.5, wanderlustcodes Getnet Argentina para Woocommerce)
- [CVE-2023-3105](https://cve.now/CVE-2023-3105.md): LearnDash LMS \<= 4.6.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Change (CVSS 8.8, StellarWP LearnDash LMS)
- [CVE-2023-3080](https://cve.now/CVE-2023-3080.md): WP Mail Catcher \<= 2.1.2 - Unauthenticated Stored Cross-Site Scripting via Email Subject (CVSS 7.2, wardee Mail logging – WP Mail Catcher)
- [CVE-2023-3122](https://cve.now/CVE-2023-3122.md): GD Mail Queue \<= 3.9.3 - Unauthenticated Stored Cross-Site Scripting via Email (CVSS 7.2, gdragon GD Mail Queue)
- [CVE-2021-4417](https://cve.now/CVE-2021-4417.md): Forminator – Contact Form, Payment Form & Custom Form Builder \<= 1.13.4 - Cross-Site Request Forgery Bypass (CVSS 5.4, wpmudev Forminator Forms – Contact Form, Payment Form & Cus…)
- [CVE-2021-4416](https://cve.now/CVE-2021-4416.md): wp-mpdf \<= 3.5.1 - Cross-Site Request Forgery Bypass (CVSS 4.3, fkrauthan wp-mpdf)
- [CVE-2021-4415](https://cve.now/CVE-2021-4415.md): Sunshine Photo Cart \<= 2.8.28 - Cross-Site Request Forgery Bypass (CVSS 4.3, sunshinephotocart Sunshine Photo Cart – Client Photo Galler…)
- [CVE-2021-4414](https://cve.now/CVE-2021-4414.md): Abandoned Cart Lite for WooCommerce \<= 5.8.5 - Cross-Site Request Forgery Bypass (CVSS 4.3, tychesoftwares Abandoned Cart Lite for WooCommerce)
- [CVE-2021-4413](https://cve.now/CVE-2021-4413.md): Process Steps Template Designer \<= 1.2.1 - Cross-Site Request Forgery Bypass (CVSS 4.3, narinder-singh Process Steps Template Designer)
- [CVE-2021-4412](https://cve.now/CVE-2021-4412.md): WP Prayer \<= 1.6.5 - Cross-Site Request Forgery Bypass (CVSS 4.3, abrg WP Prayer)
- [CVE-2021-4411](https://cve.now/CVE-2021-4411.md): WP EasyPay – Square for WordPress \<= 3.2.0 - Cross-Site Request Forgery Bypass (CVSS 4.3, saadiqbal WP Easy Pay – Payment and Donation form Builder f…)
- [CVE-2021-4410](https://cve.now/CVE-2021-4410.md): Qtranslate Slug \<= 1.1.18 - Cross-Site Request Forgery Bypass (CVSS 4.3, carlos\_a\_sanz Qtranslate Slug)
- [CVE-2021-4409](https://cve.now/CVE-2021-4409.md): WooCommerce Etsy Integration \<= 3.3.1 - Cross-Site Request Forgery Bypass (CVSS 4.3, purpleturtlepro Etsy Integration For WooCommerce)
- [CVE-2021-4408](https://cve.now/CVE-2021-4408.md): DW Question & Answer \<= 1.5.8 - Cross-Site Request Forgery Bypass (CVSS 4.3, designwall DW Question & Answer)
- [CVE-2021-4407](https://cve.now/CVE-2021-4407.md): Custom Banners \<= 3.2.2 - Cross-Site Request Forgery Bypass (CVSS 4.3, ghuger Custom Banners)
- [CVE-2020-36750](https://cve.now/CVE-2020-36750.md): EWWW Image Optimizer \<= 5.8.1 - Cross-Site Request Forgery Bypass (CVSS 4.3, nosilver4u EWWW Image Optimizer)
- [CVE-2020-20021](https://cve.now/CVE-2020-20021.md): An issue discovered in MikroTik Router v6.46.3 and earlier allows attacker to cause denial of service via misconfiguration in the SSH daemon (no CVSS)
- [CVE-2023-26563](https://cve.now/CVE-2023-26563.md): The Syncfusion EJ2 Node File Provider 0102271 is vulnerable to filesystem-server.js directory traversal. (no CVSS)
- [CVE-2023-26564](https://cve.now/CVE-2023-26564.md): The Syncfusion EJ2 ASPCore File Provider 3ac357f is vulnerable to Models/PhysicalFileProvider.cs directory traversal. (no CVSS)
- [CVE-2023-30226](https://cve.now/CVE-2023-30226.md): An issue was discovered in function get\_gnu\_verneed in rizinorg Rizin prior to 0.5.0 verneed\_entry allows attackers to cause a denial of ser (no CVSS)
- [CVE-2023-33274](https://cve.now/CVE-2023-33274.md): The authentication mechanism in PowerShield SNMP Web Pro 1.1 contains a vulnerability that allows unauthenticated users to directly access C (no CVSS)
- [CVE-2023-33668](https://cve.now/CVE-2023-33668.md): DigiExam up to v14.0.2 lacks integrity checks for native modules, allowing attackers to access PII and takeover accounts on shared computers (no CVSS)
- [CVE-2023-36266](https://cve.now/CVE-2023-36266.md): An issue was discovered in Keeper Password Manager for Desktop version 16.10.2 (fixed in 17.2), and the KeeperFill Browser Extensions versio (no CVSS)
- [CVE-2023-37627](https://cve.now/CVE-2023-37627.md): Code-projects Online Restaurant Management System 1.0 is vulnerable to SQL Injection. (no CVSS)
- [CVE-2023-37628](https://cve.now/CVE-2023-37628.md): Online Piggery Management System 1.0 is vulnerable to SQL Injection. (no CVSS)
- [CVE-2023-37629](https://cve.now/CVE-2023-37629.md): Online Piggery Management System 1.0 is vulnerable to File Upload. (no CVSS)
- [CVE-2023-37630](https://cve.now/CVE-2023-37630.md): Online Piggery Management System 1.0 is vulnerable to Cross Site Scripting (XSS). (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-07-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.