CVEs published July 17, 2023
101 CVEs were published on July 17, 2023: 11 critical, 13 high.
- Published
- 101
- Critical
- 11
- High
- 13
- Medium
- 39
- Low
- 6
- Unrated
- 32
- Now in CISA KEV
- 0
- Fix available
- 28
Most affected products
- Mattermost
- 11
- Zyxel ATP series firmware · Zyxel USG FLEX series firmwa… +3
- 4
- Oliva Expertise EKS
- 3
- TAPHOME Core Platform
- 2
- Zyxel ATP series firmware · Zyxel USG FLEX series firmwa… +5
- 2
- 3dprint
- 1
- A WP Life Album Gallery – WordPress Gallery
- 1
- alextselegidis/easyappointments
- 1
- AN_GradeBook
- 1
- Apache Software Foundation Apache EventMesh (incubating) Ra…
- 1
Critical 11
- CVE-2023-3724TLS 1.3 client issue handling malicious server when not including a KSE and PSK extensionwolfSSL
- CVE-2023-37265Incorrect identification of source IP addresses in CasaOSIceWhaleTech CasaOS-Gateway · github.com/IceWhaleTech/CasaO…
- CVE-2023-37266Weak json web token (JWT) secrets in CasaOSIceWhaleTech CasaOS · github.com/IceWhaleTech/CasaOS
- CVE-2023-2958IDOR in ATS ProOrigin Software ATS Pro
- CVE-2023-2963SQLi in Oliva ExpertiseOliva Expertise EKS
- CVE-2023-3376SQLi in Digital Strategys ZekiwebDigital Strategy Zekiweb
- CVE-2023-26512Apache EventMesh RabbitMQ-Connector plugin allows RCE through deserialization of untrusted dataApache Software Foundation Apache EventMesh (incubating) Ra…
- CVE-2023-3696Prototype Pollution in automattic/mongooseautomattic/mongoose · mongoose
- CVE-2021-37384RCE (Remote Code Execution) vulnerability was found in some Furukawa ONU models, this vulnerability allows remote unauthenticated users to s
- CVE-2023-38427An issue was discovered in the Linux kernel before 6.3.8.
- CVE-2023-38428An issue was discovered in the Linux kernel before 6.3.4.
High 13
- CVE-2023-34141A command injection vulnerability in the access point (AP) management feature of the Zyxel ATP series firmware versions 5.00 through 5.36 PaZyxel ATP series firmware · Zyxel USG FLEX series firmwa… +5
- CVE-2023-34139A command injection vulnerability in the Free Time WiFi hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.36 PatZyxel USG FLEX series firmware · Zyxel VPN series firmware
- CVE-2023-34138A command injection vulnerability in the hotspot management feature of the Zyxel ATP series firmware versions 4.60 through 5.36 Patch 2, USGZyxel ATP series firmware · Zyxel USG FLEX series firmwa… +3
- CVE-2023-33012A command injection vulnerability in the configuration parser of the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX Zyxel ATP series firmware · Zyxel USG FLEX series firmwa… +3
- CVE-2023-33011A format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 thZyxel ATP series firmware · Zyxel USG FLEX series firmwa… +3
- CVE-2023-28767The configuration parser fails to sanitize user-controlled input in the Zyxel ATP series firmware versions 5.10 through 5.36, USG FLEX serieZyxel ATP series firmware · Zyxel USG FLEX series firmwa… +3
- CVE-2023-37475Attacker-controlled parameter can cause denial of service in hamba avrohamba avro · github.com/hamba/avro/v2 +1
- CVE-2023-3615Lack of server certificate validation in websockets connectionMattermost iOS app
- CVE-2023-2959Authentication Bypass by Primary Weakness in Oliva ExpertiseOliva Expertise EKS
- CVE-2023-2760TAPHOME SQL Injection in Core PlatformTAPHOME Core Platform
- CVE-2023-2759TAPHOME Improper Authentication in Core PlatformTAPHOME Core Platform
- CVE-2021-37386Furukawa Electric LatAm 423-41W/AC before v1.1.4 and LD421-21W before v1.3.3 were discovered to contain an HTML injection vulnerability via
- CVE-2023-38404The XPRTLD web application in Veritas InfoScale Operations Manager (VIOM) before 8.0.0.410 allows an authenticated attacker to upload all ty
Medium, low and unrated 77
- CVE-2023-37479Improper sanitization of MXCSR and RFLAGS in OpenEnclaveopenenclave
- CVE-2023-37476Zip slip in OpenRefineOpenRefine · org.openrefine:main
- CVE-2023-37461Path traversal in meterspheremetersphere
- CVE-2023-34140A buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.36 Patch 2, USG FLEX series firmware versions 4.50 Zyxel ATP series firmware · Zyxel USG FLEX series firmwa… +5
- CVE-2023-3593Server crash via a specially crafted markdown inputMattermost
- CVE-2023-3614Denial of Service via specially crafted gif imageMattermost
- CVE-2023-3613Guest accounts invited and added to channels by Welcomebot pluginMattermost Plugins
- CVE-2023-3591Lack of previous password reset tokens on new token creationMattermost
- CVE-2023-3590Deleted attachments in Boards remain accessibleMattermost
- CVE-2023-3587Inconsistent state in UI after boards permission change by system adminMattermost
- CVE-2023-3586 Disabling publicly-shared boards does not disable existing publicly available board linksMattermost
- CVE-2023-3585channel DoS by sharing a boards linkMattermost
- CVE-2023-3584Member can create team with team override scheme Mattermost
- CVE-2023-3582Lack of channel membership check when linking a board to a channelMattermost
- CVE-2022-38062WordPress Download Theme Plugin <= 1.0.9 is vulnerable to Cross Site Request Forgery (CSRF)Metagauss Download Theme
- CVE-2023-3581WebSockets accept connections from HTTPS originMattermost
- CVE-2023-3577Limited blind SSRF to localhost/intranet in interactive dialog implementationMattermost
- CVE-2022-36424WordPress Easy Appointments Plugin <= 3.11.9 is vulnerable to Cross Site Request Forgery (CSRF)Nikola Loncar Easy Appointments
- CVE-2023-37985WordPress Five Star Restaurant Menu Plugin <= 2.4.6 is vulnerable to Cross Site Request Forgery (CSRF)FiveStarPlugins Restaurant Menu and Food Ordering by Five S…
- CVE-2023-37974WordPress WP-FB-AutoConnect Plugin <= 4.6.1 is vulnerable to Cross Site Request Forgery (CSRF)Justin Klein WP Social AutoConnect
- CVE-2023-37968WordPress Falang multilanguage Plugin <= 1.3.39 is vulnerable to Cross Site Request Forgery (CSRF)Faboba Falang multilanguage for WordPress
- CVE-2023-34005WordPress Front End Users Plugin <= 3.2.24 is vulnerable to Cross Site Request Forgery (CSRF)Etoile Web Design Front End Users
- CVE-2022-47172WordPress WooLentor Plugin <= 2.6.2 is vulnerable to Cross Site Request Forgery (CSRF)HasThemes ShopLentor
- CVE-2023-36514WordPress WooCommerce Ship to Multiple Addresses Plugin <= 3.8.5 is vulnerable to Cross Site Request Forgery (CSRF)WooCommerce Shipping Multiple Addresses
- CVE-2023-36513WordPress AutomateWoo Plugin <= 5.7.5 is vulnerable to Cross Site Request Forgery (CSRF)WooCommerce AutomateWoo
- CVE-2023-36511WordPress WooCommerce Order Barcodes Plugin <= 1.6.4 is vulnerable to Cross Site Request Forgery (CSRF)WooCommerce Order Barcodes
- CVE-2023-31216WordPress Ultimate Member Plugin <= 2.6.0 is vulnerable to Cross Site Request Forgery (CSRF)Ultimate Member
- CVE-2023-35880WordPress WooCommerce Brands Plugin <= 1.6.49 is vulnerable to Cross Site Request Forgery (CSRF)WooCommerce Brands
- CVE-2023-35096WordPress myCred Plugin <= 2.5 is vulnerable to Cross Site Request Forgery (CSRF)myCred
- CVE-2023-35089WordPress Recipe Maker For Your Food Blog from Zip Recipes Plugin <= 8.0.7 is vulnerable to Cross Site Request Forgery (CSRF)Really Simple Plugins Recipe Maker For Your Food Blog from…
- CVE-2023-2960XSS in Oliva ExpertiseOliva Expertise EKS
- CVE-2023-2701Gravity Forms < 2.7.5 - Reflected XSSgravityforms
- CVE-2023-0439NEX-Forms < 8.4.4 - Authenticated Stored XSSNEX-Forms
- CVE-2023-2330Caldera Forms Google Sheets Connector < 1.3 - Access Code Update via CSRFCaldera Forms Google Sheets Connector
- CVE-2023-3182Membership Plugin - Restrict Content < 3.2.3 - Reflected XSSMembership Plugin
- CVE-2023-3245Floating Chat Widget < 3.1.2 - Admin+ Stored Cross-Site ScriptingFloating Chat Widget: Contact Chat Icons, Telegram Chat, Li…
- CVE-2023-3179POST SMTP Mailer < 2.5.7 - Account Takeover via CSRFPOST SMTP Mailer
- CVE-2023-1893Login Configurator <= 2.1 - Reflected Cross-Site ScriptingLogin Configurator
- CVE-2023-2143Enable SVG, WebP & ICO Upload <= 1.0.3 - Author+ Stored XSSEnable SVG, WebP & ICO Upload
- CVE-2023-2636AN_GradeBook <= 5.0.1 - Subscriber+ SQLiAN_GradeBook
- CVE-2023-3186Supsystic Popup < 1.10.19 - Prototype PollutionPopup by Supsystic
- CVE-2023-3041Autochat <= 1.1.7- Unauthenticated Stored XSSAutochat Automatic Conversation
- CVE-2023-2579InventoryPress <= 1.7 - Author+ Stored XSSInventoryPress
- CVE-2023-2329WooCommerce Google Sheet Connector < 1.3.6 - Access Code Update via CSRFWooCommerce Google Sheet Connector
- CVE-2022-40233DPrint < 3.5.6.9 - CSRF to arbitrary file downlad3dprint
- CVE-2023-35038WordPress WP PDF Generator Plugin <= 1.2.2 is vulnerable to Cross Site Request Forgery (CSRF)wpexperts.io WP PDF Generator
- CVE-2023-2912SiteManager Embedded service disruptionSecomea SiteManager Embedded
- CVE-2023-27424WordPress Inactive User Deleter Plugin <= 1.59 is vulnerable to Cross Site Request Forgery (CSRF)Korol Yuriy aka Shra Inactive User Deleter
- CVE-2023-23719WordPress Premmerce Plugin <= 1.3.17 is vulnerable to Cross Site Request Forgery (CSRF)Premmerce
- CVE-2023-23646WordPress Album Gallery – WordPress Gallery Plugin <= 1.4.9 is vulnerable to Cross Site Request Forgery (CSRF)A WP Life Album Gallery – WordPress Gallery
- CVE-2023-22672WordPress vSlider Multi Image Slider for WordPress Plugin <= 4.1.2 is vulnerable to Cross Site Request Forgery (CSRF)Mr.Vibe vSlider Multi Image Slider for WordPress
- CVE-2023-27606WordPress WP Reroute Email Plugin <= 1.4.6 is vulnerable to Cross Site Request Forgery (CSRF)Sajjad Hossain WP Reroute Email
- CVE-2023-34036Forwarded header exploit with Spring HATEOAS on WebFluxSpring HATEOAS · org.springframework.hateoas:spring-hateoas
- CVE-2023-3700Authorization Bypass Through User-Controlled Key in alextselegidis/easyappointmentsalextselegidis/easyappointments
- CVE-2022-4952OmniSharp csharp-language-server-protocol JSON Serializer SerializerBase.cs CreateSerializerSettings resource consumptionOmniSharp csharp-language-server-protocol
- CVE-2023-3695Campcodes Beauty Salon Management System add-product.php sql injectionCampcodes Beauty Salon Management System
- CVE-2023-35012IBM Db2 code executionIBM Db2 for Linux, UNIX and Windows
- CVE-2022-30858An issue was discovered in ngiflib 0.4.
- CVE-2023-28864Progress Chef Infra Server before 15.7 allows a local attacker to exploit a /var/opt/opscode/local-mode-cache/backup world-readable temporar
- CVE-2023-31851Cudy LT400 1.13.4 is has a cross-site scripting (XSS) vulnerability in /cgi-bin/luci/admin/network/wireless/status via the iface parameter.
- CVE-2023-31852Cudy LT400 1.13.4 is vulnerable to Cross Site Scripting (XSS) in cgi-bin/luci/admin/network/wireless/config via the iface parameter.
- CVE-2023-31853Cudy LT400 1.13.4 is vulnerable Cross Site Scripting (XSS) in /cgi-bin/luci/admin/network/bandwidth via the icon parameter.
- CVE-2023-34669TOTOLINK CP300+ V5.2cu.7594 contains a Denial of Service vulnerability in function RebootSystem of the file lib/cste_modules/system which ca
- CVE-2023-35818An issue was discovered on Espressif ESP32 3.0 (ESP32_rev300 ROM) devices.
- CVE-2023-36656Cross Site Scripting (XSS) vulnerability in Jaegertracing Jaeger UI before v.1.31.0 allows a remote attacker to execute arbitrary code via t
- CVE-2023-37769stress-test master commit e4c878 was discovered to contain a FPE vulnerability via the component combine_inner at /pixman-combine-float.c.
- CVE-2023-37770faust commit ee39a19 was discovered to contain a stack overflow via the component boxppShared::print() at /boxes/ppbox.cpp.
- CVE-2023-37781An issue in the emqx_sn plugin of EMQX v4.3.8 allows attackers to execute a directory traversal via uploading a crafted .txt file.
- CVE-2023-37791D-Link DIR-619L v2.04(TW) was discovered to contain a stack overflow via the curTime parameter at /goform/formLogin.
- CVE-2023-38403iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field.
- CVE-2023-38405On Crestron 3-Series Control Systems before 1.8001.0187, crafting and sending a specific BACnet packet can cause a crash.
- CVE-2023-38409An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before 6.2.12.
- CVE-2023-38426An issue was discovered in the Linux kernel before 6.3.4.
- CVE-2023-38429An issue was discovered in the Linux kernel before 6.3.4.
- CVE-2023-38430An issue was discovered in the Linux kernel before 6.3.9.
- CVE-2023-38431An issue was discovered in the Linux kernel before 6.3.8.
- CVE-2023-38432An issue was discovered in the Linux kernel before 6.3.10.