CVEs published July 14, 2023
60 CVEs were published on July 14, 2023: 2 critical, 18 high.
- Published
- 60
- Critical
- 2
- High
- 18
- Medium
- 23
- Low
- 1
- Unrated
- 16
- Now in CISA KEV
- 0
- Fix available
- 32
Most affected products
- Juniper Networks Junos OS
- 11
- discourse
- 2
- Razer Central
- 2
- Savoir-faire Linux Jami
- 2
- Wireshark Foundation Wireshark
- 2
- 9001 copyparty · copyparty
- 1
- Bitdefender Engines
- 1
- buymeacoffee Buy Me a Coffee – Button and Widget Plugin
- 1
- cryptography
- 1
- de.codecentric:spring-boot-admin-server
- 1
Critical 2
High 18
- CVE-2023-34236Information Disclosure Vulnerability in Weave GitOps Terraform Controllerweaveworks tf-controller · github.com/weaveworks/tf-control…
- CVE-2023-37464Incorrect Authentication Tag length usage in AES GCM decryption in OpenIDC/cjoseOpenIDC cjose
- CVE-2023-37472Query injection in Knowage serverKnowageLabs Knowage-Server
- CVE-2023-37473Limited code execution in zenstruck/collectionszenstruck collection · zenstruck/collection
- CVE-2023-37474Path traversal in copyparty9001 copyparty · copyparty
- CVE-2023-3633Out of Bounds Memory Corruption Issue in CEVA EngineBitdefender Engines
- CVE-2023-36887Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2023-36835Junos OS: QFX10000 Series: All traffic will be dropped after a specific valid IP packet has been received which needs to be routed over a VXLAN tunnelJuniper Networks Junos OS
- CVE-2023-28985SRX Series and MX Series: An FPC core is observed when IDP is enabled on the device and a specific malformed SSL packet is receivedJuniper Networks Junos OS
- CVE-2023-36832Junos OS: MX Series: PFE crash upon receipt of specific packet destined to an AMS interfaceJuniper Networks Junos OS
- CVE-2023-36831Junos OS: SRX Series: jbuf memory leak when SSL Proxy and UTM Web-Filtering is appliedJuniper Networks Junos OS
- CVE-2023-3673SQL Injection in pimcore/pimcorepimcore/pimcore
- CVE-2023-3672Cross-site Scripting (XSS) - DOM in plaidweb/webmention.jsplaidweb/webmention.js · webmention.js
- CVE-2023-3514RazerCentralSerivce Unsafe Named Pipe Permission Escalation of Privilege VulnerabilityRazer Central
- CVE-2023-3513RazerCentralService Unsafe Deserialization Escalation of PrivilegeRazer Central
- CVE-2023-32759An issue in Archer Platform before v.6.13 and fixed in 6.12.0.6 and 6.13.0 allows an authenticated attacker to obtain sensitive information
- CVE-2023-32760An issue in Archer Platform before v.6.13 fixed in v.6.12.0.6 and v.6.13.0 allows an authenticated attacker to obtain sensitive information
- CVE-2023-32761Cross Site Request Forgery (CSRF) vulnerability in Archer Platform before v.6.13 and fixed in v.6.12.0.6 and v.6.13.0 allows an authenticate
Medium, low and unrated 40
- CVE-2023-36818Denial of service via User Custom Sidebar Section Unlimited Link Creation in discoursediscourse
- CVE-2023-36466Topic Title Validation Skipped When Changing Category in Discoursediscourse
- CVE-2023-37268User login confusion with SSO in warpgatewarp-tech warpgate
- CVE-2023-36850Junos OS: MX Series: An MPC will crash upon receipt of a malformed CFM packet.Juniper Networks Junos OS
- CVE-2023-36849Junos OS and Junos OS Evolved: The l2cpd will crash when a malformed LLDP packet is receivedJuniper Networks Junos OS
- CVE-2023-36888Microsoft Edge for Android (Chromium-based) Tampering VulnerabilityMicrosoft Edge for Android
- CVE-2023-36883Microsoft Edge for iOS Spoofing VulnerabilityMicrosoft Edge for iOS
- CVE-2023-36848Junos OS: MX Series: The FPC will crash on receiving a malformed CFM packetJuniper Networks Junos OS
- CVE-2023-36840Junos OS and Junos OS Evolved: An rpd crash occurs when a specific L2VPN command is runJuniper Networks Junos OS
- CVE-2023-36836Junos OS and Junos OS Evolved: In a MoFRR scenario an rpd core may be observed when a low privileged CLI command is executedJuniper Networks Junos OS
- CVE-2023-24896Dynamics 365 Finance Spoofing VulnerabilityMicrosoft Dynamics 365 for Finance and Operations
- CVE-2023-38253W3m: out of bounds read in growbuf_to_str() at w3m/indep.cw3m · Red Hat Enterprise Linux +2
- CVE-2023-38252W3m: out of bounds read in strnew_size() at w3m/str.cRed Hat Enterprise Linux
- CVE-2023-36834Junos OS: SRX 4600 and SRX 5000 Series: The receipt of specific genuine packets by SRXes configured for L2 transparency will cause a DoSJuniper Networks Junos OS
- CVE-2023-36833Junos OS Evolved: PTX10001-36MR, and PTX10004, PTX10008, PTX10016 with LC1201/1202: The aftman-bt process will crash in a MoFRR scenario after multiple link flapsJuniper Networks Junos OS Evolved
- CVE-2023-36838Junos OS: SRX Series: A flowd core occurs when running a low privileged CLI commandJuniper Networks Junos OS
- CVE-2023-35692In getLocationCache of GeoLocation.java, there is a possible way to send a mock location during an emergency call due to improper input valiGoogle Android
- CVE-2023-3434QRC Handler without Input Validation in JamiSavoir-faire Linux Jami
- CVE-2023-3433Local Denial of Service in JamiSavoir-faire Linux Jami
- CVE-2023-2975AES-SIV implementation ignores empty associated data entriesOpenSSL
- CVE-2023-3649Buffer Over-read in WiresharkWireshark Foundation Wireshark
- CVE-2023-3648Mismatched Memory Management Routines in WiresharkWireshark Foundation Wireshark
- CVE-2023-2082Buy Me a Coffee – Button and Widget Plugin <= 3.6 - Authenticated (Subscriber+) Stored Cross-Site Scriptingbuymeacoffee Buy Me a Coffee – Button and Widget Plugin
- CVE-2023-37223Cross Site Scripting (XSS) vulnerability in Archer Platform before v.6.13 and fixed in v.6.12.0.6 and v.6.13.0 allows a remote authenticated
- CVE-2023-37224An issue in Archer Platform before v.6.13 fixed in v.6.12.0.6 and v.6.13.0 allows an authenticated attacker to obtain sensitive information
- CVE-2023-37714Tenda F1202 V1.0BR_V1.2.0.20(408), FH1202_V1.2.0.19_EN were discovered to contain a stack overflow in the page parameter in the function fro
- CVE-2023-37715Tenda F1202 V1.0BR_V1.2.0.20(408), FH1202_V1.2.0.19_EN were discovered to contain a stack overflow in the page parameter in the function frm
- CVE-2023-37716Tenda F1202 V1.0BR_V1.2.0.20(408) and FH1202_V1.2.0.19_EN, AC10 V1.0, AC1206 V1.0, AC7 V1.0, AC5 V1.0, and AC9 V3.0 were discovered to conta
- CVE-2023-37717Tenda F1202 V1.0BR_V1.2.0.20(408) and FH1202_V1.2.0.19_EN, AC10 V1.0, AC1206 V1.0, AC7 V1.0, AC5 V1.0, and AC9 V3.0 were discovered to conta
- CVE-2023-37718Tenda F1202 V1.0BR_V1.2.0.20(408), FH1202_V1.2.0.19_EN were discovered to contain a stack overflow in the page parameter in the function fro
- CVE-2023-37719Tenda F1202 V1.0BR_V1.2.0.20(408), FH1202_V1.2.0.19_EN were discovered to contain a stack overflow in the page parameter in the function fro
- CVE-2023-37721Tenda F1202 V1.0BR_V1.2.0.20(408), FH1202_V1.2.0.19_EN were discovered to contain a stack overflow in the page parameter in the function fro
- CVE-2023-37722Tenda F1202 V1.0BR_V1.2.0.20(408), FH1202_V1.2.0.19_EN were discovered to contain a stack overflow in the page parameter in the function fro
- CVE-2023-37723Tenda F1202 V1.0BR_V1.2.0.20(408), FH1202_V1.2.0.19_EN were discovered to contain a stack overflow in the page parameter in the function fro
- CVE-2023-37793WAYOS FBM-291W 19.09.11V was discovered to contain a buffer overflow via the component /upgrade_filter.asp.
- CVE-2023-37794WAYOS FBM-291W 19.09.11V was discovered to contain a command injection vulnerability via the component /upgrade_filter.asp.
- CVE-2023-38286Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin (aka Spring Boot Admin) through 3.1.1 and other products, allows sandbox bypasde.codecentric:spring-boot-admin-server
- CVE-2023-38325The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options.cryptography
- CVE-2023-38336netkit-rcp in rsh-client 0.17-24 allows command injection via filenames because /bin/sh is used by susystem, a related issue to CVE-2006-022
- CVE-2023-38337rswag before 2.10.1 allows remote attackers to read arbitrary JSON and YAML files via directory traversal, because rswag-api can expose a firswag