# CVEs published 2023-07-18

149 CVEs were published on July 18, 2023: 6 critical, 28 high. Days are UTC.

- [CVE-2023-22506](https://cve.now/CVE-2023-22506.md): This High severity Injection and RCE (Remote Code Execution) vulnerability known as CVE-2023-22506 was introduced in version 8.0.0 of Bamboo (CVSS 7.5, Atlassian Bamboo Data Center · Atlassian Bamboo Server)
- [CVE-2023-22508](https://cve.now/CVE-2023-22508.md): This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22508 was introduced in version 6.1.0 of Confluence Data Cent (CVSS 8.5, Atlassian Confluence Data Center · Atlassian Confluence Ser…)
- [CVE-2023-3527](https://cve.now/CVE-2023-3527.md): Avaya Call Management System CSV injection vulnerability (CVSS 6.8, Avaya Call Management System)
- [CVE-2023-22505](https://cve.now/CVE-2023-22505.md): This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22505 was introduced in version 8.0.0 of Confluence Data Cent (CVSS 8.0, Atlassian Confluence Data Center · Atlassian Confluence Ser…)
- [CVE-2023-37897](https://cve.now/CVE-2023-37897.md): Server-side Template Injection (SSTI) in grav (CVSS 7.2, getgrav grav · getgrav/grav)
- [CVE-2023-22062](https://cve.now/CVE-2023-22062.md): Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Repository). (CVSS 8.5, Oracle Hyperion Financial Reporting)
- [CVE-2023-22061](https://cve.now/CVE-2023-22061.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Visual Analyzer). (CVSS 5.4, Oracle Business Intelligence Enterprise Edition)
- [CVE-2023-22060](https://cve.now/CVE-2023-22060.md): Vulnerability in the Oracle Hyperion Workspace product of Oracle Hyperion (component: UI and Visualization). (CVSS 7.6, Oracle Hyperion BI+)
- [CVE-2023-22058](https://cve.now/CVE-2023-22058.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). (CVSS 4.4, Oracle MySQL Server)
- [CVE-2023-22057](https://cve.now/CVE-2023-22057.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-22056](https://cve.now/CVE-2023-22056.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-22055](https://cve.now/CVE-2023-22055.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). (CVSS 6.1, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2023-22054](https://cve.now/CVE-2023-22054.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-22053](https://cve.now/CVE-2023-22053.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). (CVSS 5.9, Oracle MySQL Server)
- [CVE-2023-22052](https://cve.now/CVE-2023-22052.md): Vulnerability in the Java VM component of Oracle Database Server. (CVSS 3.1, Oracle Database - Enterprise Edition)
- [CVE-2023-22051](https://cve.now/CVE-2023-22051.md): Vulnerability in the Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: GraalVM Compiler). (CVSS 3.7, Oracle GraalVM Enterprise Edition)
- [CVE-2023-22050](https://cve.now/CVE-2023-22050.md): Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). (CVSS 5.4, Oracle JD Edwards EnterpriseOne Orchestrator)
- [CVE-2023-22049](https://cve.now/CVE-2023-22049.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Librari (CVSS 3.7, Oracle Java SE JDK and JRE)
- [CVE-2023-22048](https://cve.now/CVE-2023-22048.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth). (CVSS 3.1, Oracle MySQL Server)
- [CVE-2023-22047](https://cve.now/CVE-2023-22047.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). (CVSS 7.5, Oracle PeopleSoft Enterprise PT PeopleTools)
- [CVE-2023-22046](https://cve.now/CVE-2023-22046.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-22045](https://cve.now/CVE-2023-22045.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot (CVSS 3.7, Oracle Java SE JDK and JRE)
- [CVE-2023-22044](https://cve.now/CVE-2023-22044.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot (CVSS 3.7, Oracle Java SE JDK and JRE)
- [CVE-2023-22043](https://cve.now/CVE-2023-22043.md): Vulnerability in Oracle Java SE (component: JavaFX). (CVSS 5.9, Oracle Java SE JDK and JRE)
- [CVE-2023-22042](https://cve.now/CVE-2023-22042.md): Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Diagnostics). (CVSS 6.1, Oracle Applications Framework)
- [CVE-2023-22041](https://cve.now/CVE-2023-22041.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot (CVSS 5.1, Oracle Java SE JDK and JRE)
- [CVE-2023-22040](https://cve.now/CVE-2023-22040.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 6.5, Oracle WebLogic Server)
- [CVE-2023-22039](https://cve.now/CVE-2023-22039.md): Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: WebClient). (CVSS 5.4, Oracle Agile PLM Framework)
- [CVE-2023-22038](https://cve.now/CVE-2023-22038.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). (CVSS 2.7, Oracle MySQL Server)
- [CVE-2023-22037](https://cve.now/CVE-2023-22037.md): Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: MS Excel Specific). (CVSS 6.5, Oracle Web Applications Desktop Integrator)
- [CVE-2023-22036](https://cve.now/CVE-2023-22036.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Utility (CVSS 3.7, Oracle Java SE JDK and JRE)
- [CVE-2023-22035](https://cve.now/CVE-2023-22035.md): Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: iSurvey Module). (CVSS 6.1, Oracle Scripting)
- [CVE-2023-22034](https://cve.now/CVE-2023-22034.md): Vulnerability in the Unified Audit component of Oracle Database Server. (CVSS 4.9, Oracle Database - Enterprise Edition)
- [CVE-2023-22033](https://cve.now/CVE-2023-22033.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.4, Oracle MySQL Server)
- [CVE-2023-22031](https://cve.now/CVE-2023-22031.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 4.4, Oracle WebLogic Server)
- [CVE-2023-22027](https://cve.now/CVE-2023-22027.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). (CVSS 4.3, Oracle Business Intelligence Enterprise Edition)
- [CVE-2023-22023](https://cve.now/CVE-2023-22023.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: Device Driver Interface). (CVSS 7.8, Oracle Solaris Operating System)
- [CVE-2023-22022](https://cve.now/CVE-2023-22022.md): Vulnerability in the Oracle Health Sciences Sciences Data Management Workbench product of Oracle Health Sciences Applications (component: Bl (CVSS 6.5, Oracle Life Sciences Data Management Workbench)
- [CVE-2023-22021](https://cve.now/CVE-2023-22021.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). (CVSS 4.3, Oracle Business Intelligence Enterprise Edition)
- [CVE-2023-22020](https://cve.now/CVE-2023-22020.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). (CVSS 5.4, Oracle Business Intelligence Enterprise Edition)
- [CVE-2023-22018](https://cve.now/CVE-2023-22018.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 8.1, Oracle VM VirtualBox)
- [CVE-2023-22017](https://cve.now/CVE-2023-22017.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 5.5, Oracle VM VirtualBox)
- [CVE-2023-22016](https://cve.now/CVE-2023-22016.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 4.2, Oracle VM VirtualBox)
- [CVE-2023-22014](https://cve.now/CVE-2023-22014.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). (CVSS 8.4, Oracle PeopleSoft Enterprise PT PeopleTools)
- [CVE-2023-22013](https://cve.now/CVE-2023-22013.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). (CVSS 4.3, Oracle Business Intelligence Enterprise Edition)
- [CVE-2023-22012](https://cve.now/CVE-2023-22012.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). (CVSS 4.3, Oracle Business Intelligence Enterprise Edition)
- [CVE-2023-22011](https://cve.now/CVE-2023-22011.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). (CVSS 5.4, Oracle Business Intelligence Enterprise Edition)
- [CVE-2023-22010](https://cve.now/CVE-2023-22010.md): Vulnerability in Oracle Essbase (component: Security and Provisioning). (CVSS 2.2, Oracle Hyperion Essbase)
- [CVE-2023-22009](https://cve.now/CVE-2023-22009.md): Vulnerability in the Oracle Self-Service Human Resources product of Oracle E-Business Suite (component: Workforce Management). (CVSS 4.3, Oracle Self-Service Human Resources)
- [CVE-2023-22008](https://cve.now/CVE-2023-22008.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-22007](https://cve.now/CVE-2023-22007.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-22006](https://cve.now/CVE-2023-22006.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Network (CVSS 3.1, Oracle Java SE JDK and JRE)
- [CVE-2023-22005](https://cve.now/CVE-2023-22005.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). (CVSS 4.4, Oracle MySQL Server)
- [CVE-2023-22004](https://cve.now/CVE-2023-22004.md): Vulnerability in the Oracle Applications Technology product of Oracle E-Business Suite (component: Reports Configuration). (CVSS 4.3, Oracle E-Business Suite Technology Stack)
- [CVE-2023-21994](https://cve.now/CVE-2023-21994.md): Vulnerability in the Oracle Mobile Security Suite product of Oracle Fusion Middleware (component: Android Mobile Authenticator App). (CVSS 6.5, Oracle Mobile Security Suite)
- [CVE-2023-21983](https://cve.now/CVE-2023-21983.md): Vulnerability in the Application Express Administration product of Oracle Application Express (component: None). (CVSS 5.6, Oracle Application Express)
- [CVE-2023-21975](https://cve.now/CVE-2023-21975.md): Vulnerability in the Application Express Customers Plugin product of Oracle Application Express (component: User Account). (CVSS 9.0, Oracle Application Express)
- [CVE-2023-21974](https://cve.now/CVE-2023-21974.md): Vulnerability in the Application Express Team Calendar Plugin product of Oracle Application Express (component: User Account). (CVSS 9.0, Oracle Application Express)
- [CVE-2023-21961](https://cve.now/CVE-2023-21961.md): Vulnerability in the Oracle Hyperion Essbase Administration Services product of Oracle Essbase (component: EAS Administration and EAS Consol (CVSS 6.0, Oracle Hyperion Essbase Administration Services)
- [CVE-2023-21950](https://cve.now/CVE-2023-21950.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-21949](https://cve.now/CVE-2023-21949.md): Vulnerability in the Advanced Networking Option component of Oracle Database Server. (CVSS 3.7, Oracle Advanced Networking Option)
- [CVE-2023-2913](https://cve.now/CVE-2023-2913.md): Rockwell Automation ThinManager ThinServer Path Traversal Vulnerability (CVSS 7.5, Rockwell Automation ThinManager ThinServer)
- [CVE-2023-28023](https://cve.now/CVE-2023-28023.md): HCL BigFix WebUI Software Distribution is affected by a cross site server request forgery vulnerability (CVSS 4.9, HCL Software HCL BigFix WebUI Software Distribution)
- [CVE-2023-28021](https://cve.now/CVE-2023-28021.md): BigFix WebUI is vulnerable to use of a risky cryptographic algorithm (CVSS 5.9, HCL Software HCL BigFix WebUI)
- [CVE-2023-37477](https://cve.now/CVE-2023-37477.md): Command injection in firewall ip functionality in 1Panel (CVSS 7.2, 1Panel-dev 1Panel · github.com/1Panel-dev/1Panel)
- [CVE-2023-37480](https://cve.now/CVE-2023-37480.md): Fides Webserver Vulnerable to Zip Bomb File Uploads (CVSS 2.7, ethyca fides · ethyca-fides)
- [CVE-2023-37481](https://cve.now/CVE-2023-37481.md): Fides Webserver Vulnerable to SVG Bomb File Uploads (CVSS 2.7, ethyca fides · ethyca-fides)
- [CVE-2023-28020](https://cve.now/CVE-2023-28020.md): URL redirection affects BigFix WebUI (CVSS 4.7, HCL Software HCL BigFix WebUI)
- [CVE-2023-28019](https://cve.now/CVE-2023-28019.md): An SQL injection affects BigFix WebUI API (CVSS 5.5, HCL Software HCL BigFix WebUI API)
- [CVE-2023-33312](https://cve.now/CVE-2023-33312.md): WordPress Easy Captcha Plugin \<= 1.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, wppal Easy Captcha)
- [CVE-2023-35763](https://cve.now/CVE-2023-35763.md): Iagona ScrutisWeb Use of Hard-coded Cryptographic Key (CVSS 5.5, iagona ScrutisWeb)
- [CVE-2023-33871](https://cve.now/CVE-2023-33871.md): Iagona ScrutisWeb Absolute Path Traversal (CVSS 7.5, iagona ScrutisWeb)
- [CVE-2023-38257](https://cve.now/CVE-2023-38257.md): CVE-2023-38257 (CVSS 7.5, iagona ScrutisWeb)
- [CVE-2023-33329](https://cve.now/CVE-2023-33329.md): WordPress Custom Post Type Generator Plugin \<= 2.4.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Hijiri Custom Post Type Generator)
- [CVE-2023-35189](https://cve.now/CVE-2023-35189.md): Iagona ScrutisWeb Unrestricted Upload of File with Dangerous Type (CVSS 10.0, iagona ScrutisWeb)
- [CVE-2023-34330](https://cve.now/CVE-2023-34330.md): Code injection via Dynamic Redfish Extension interface (CVSS 8.2, AMI MegaRAC\_SPx12 · AMI MegaRAC\_SPx13)
- [CVE-2023-34329](https://cve.now/CVE-2023-34329.md): Authentication Bypass via HTTP Header Spoofing (CVSS 9.1, AMI MegaRAC\_SPx12)
- [CVE-2021-4428](https://cve.now/CVE-2021-4428.md): what3words Autosuggest Plugin Setting class-w3w-autosuggest-public.php enqueue\_scripts information disclosure (CVSS 2.7, what3words Autosuggest Plugin)
- [CVE-2023-37259](https://cve.now/CVE-2023-37259.md): Cross site scripting in Export Chat feature (CVSS 6.1, matrix-org matrix-react-sdk · matrix-react-sdk)
- [CVE-2023-33231](https://cve.now/CVE-2023-33231.md): XSS in SolarWinds Database Performance Analyzer 2023.2 (CVSS 6.1, SolarWinds DPA)
- [CVE-2023-0160](https://cve.now/CVE-2023-0160.md): Possibility of deadlock in libbpf function sock\_hash\_delete\_elem (CVSS 4.7, kernel · Red Hat Enterprise Linux +1)
- [CVE-2023-34035](https://cve.now/CVE-2023-34035.md): Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfig (CVSS 7.3, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2023-2263](https://cve.now/CVE-2023-2263.md): Rockwell Automation Kinetix 5700 DC Bus Power Supply Series A – CIP Message Attack Could Cause Denial-Of-Service (CVSS 7.5, Rockwell Automation Kinetix 5700 DC Bus Power Supply Series…)
- [CVE-2020-36762](https://cve.now/CVE-2020-36762.md): ONS Digital RAS Collection Instrument comment.yml jobs os command injection (CVSS 5.5, ONS Digital RAS Collection Instrument)
- [CVE-2023-36383](https://cve.now/CVE-2023-36383.md): WordPress Event Manager for WooCommerce Plugin \<= 3.9.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, MagePeople Team Event Manager and Tickets Selling Plugin fo…)
- [CVE-2023-36384](https://cve.now/CVE-2023-36384.md): WordPress Booking Calendar Contact Form Plugin \<= 1.2.40 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, CodePeople Booking Calendar Contact Form)
- [CVE-2023-24390](https://cve.now/CVE-2023-24390.md): WordPress WeSecur Security Plugin \<= 1.2.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, WeSecur Security)
- [CVE-2022-47421](https://cve.now/CVE-2022-47421.md): WordPress ARMember (free) and ARMember (premium) plugins - vulnerable to Auth. Stored Cross Site Scripting (XSS) (CVSS 5.9, Repute InfoSystems ARMember)
- [CVE-2023-30906](https://cve.now/CVE-2023-30906.md): The vulnerability could be locally exploited to allow escalation of privilege. (CVSS 7.5, Hewlett Packard Enterprise (HPE) HPE Intelligent Provisioni…)
- [CVE-2022-34155](https://cve.now/CVE-2022-34155.md): WordPress OAuth Single Sign On – SSO (OAuth Client) Plugin \<= 6.23.3 is vulnerable to Broken Authentication (CVSS 8.8, miniOrange OAuth Single Sign On – SSO)
- [CVE-2023-32965](https://cve.now/CVE-2023-32965.md): WordPress Jazz Popups Plugin \<= 1.8.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, CRUDLab Jazz Popups)
- [CVE-2018-25088](https://cve.now/CVE-2018-25088.md): Blue Yonder postgraas\_server PostgreSQL Backend postgres\_cluster\_driver.py create\_postgres\_db sql injection (CVSS 5.5, Blue Yonder postgraas\_server · postgraas-server)
- [CVE-2023-23660](https://cve.now/CVE-2023-23660.md): WordPress MainWP Maintenance Extension Plugin \<= 4.1.1 is vulnerable to SQL Injection (CVSS 8.5, MainWP Maintenance Extension)
- [CVE-2023-37892](https://cve.now/CVE-2023-37892.md): WordPress Shortcode IMDB Plugin \<= 6.0.8 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Kemal YAZICI - PluginPress Shortcode IMDB)
- [CVE-2023-37973](https://cve.now/CVE-2023-37973.md): WordPress Replace Word Plugin \<= 2.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, David Pokorny Replace Word)
- [CVE-2023-37889](https://cve.now/CVE-2023-37889.md): WordPress WPAdmin AWS CDN Plugin \<= 2.0.13 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, WPAdmin AWS CDN)
- [CVE-2023-25036](https://cve.now/CVE-2023-25036.md): WordPress Social Media Icons Widget Plugin \<= 1.6 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, akhlesh-nagar, a.ankit Social Media Icons Widget)
- [CVE-2023-37387](https://cve.now/CVE-2023-37387.md): WordPress Classified Listing Plugin \<= 2.4.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, RadiusTheme Classified Listing)
- [CVE-2022-47169](https://cve.now/CVE-2022-47169.md): WordPress Visibility Logic for Elementor Plugin \<= 2.3.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, StaxWP Visibility Logic for Elementor)
- [CVE-2023-37386](https://cve.now/CVE-2023-37386.md): WordPress Media Library Helper by Codexin Plugin \<= 1.2.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Media Library Helper)
- [CVE-2023-25475](https://cve.now/CVE-2023-25475.md): WordPress Smart YouTube PRO Plugin \<= 4.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Vladimir Prelovac Smart YouTube PRO)
- [CVE-2023-3743](https://cve.now/CVE-2023-3743.md): SQL injection vulnerability in LeoTheme's Ap Page Builder (CVSS 7.5, LeoTheme Ap Page Builder)
- [CVE-2022-45828](https://cve.now/CVE-2022-45828.md): WordPress NOO Timetable Plugin \<= 2.1.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, NooTheme Noo Timetable)
- [CVE-2022-46857](https://cve.now/CVE-2022-46857.md): WordPress SiteAlert (Formerly WP Health) Plugin \<= 1.9.7 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, SiteAlert)
- [CVE-2023-25473](https://cve.now/CVE-2023-25473.md): WordPress Flickr Justified Gallery Plugin \<= 3.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Miro Mannino Flickr Justified Gallery)
- [CVE-2023-25482](https://cve.now/CVE-2023-25482.md): WordPress WP Tiles Plugin \<= 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Mike Martel WP Tiles)
- [CVE-2023-2433](https://cve.now/CVE-2023-2433.md): YARPP – Yet Another Related Posts Plugin \<= 5.30.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, jeffparker YARPP – Yet Another Related Posts Plugin)
- [CVE-2015-10122](https://cve.now/CVE-2015-10122.md): wp-donate Plugin donate-display.php sql injection (CVSS 6.3, wp-donate Plugin)
- [CVE-2023-3403](https://cve.now/CVE-2023-3403.md): ProfileGrid \<= 5.5.1 - Missing Authorization to User Import (CVSS 5.4, metagauss ProfileGrid – User Profiles, Groups and Communiti…)
- [CVE-2023-3714](https://cve.now/CVE-2023-3714.md): ProfileGrid \<= 5.5.2 - Missing Authorization to Arbitrary Group Option Modification and Privilege Escalation (CVSS 7.5, metagauss ProfileGrid – User Profiles, Groups and Communiti…)
- [CVE-2023-3713](https://cve.now/CVE-2023-3713.md): ProfileGrid \<= 5.5.1 - Authenticated (Subscriber+) Arbitrary Option Update (CVSS 8.8, metagauss ProfileGrid – User Profiles, Groups and Communiti…)
- [CVE-2023-3459](https://cve.now/CVE-2023-3459.md): Export and Import Users and Customers \<= 2.4.1 - Missing Authorization to Authenticated (Shop Manager) Arbitrary User Password Change (CVSS 7.2, webtoffee Export and Import Users and Customers)
- [CVE-2023-34143](https://cve.now/CVE-2023-34143.md): Improper Validation of Certificate Vulnerability in Hitachi Device Manager (CVSS 5.6, Hitachi Device Manager)
- [CVE-2023-34142](https://cve.now/CVE-2023-34142.md): Cleartext Transmission Vulnerability in Hitachi Device Manager (CVSS 9.0, Hitachi Device Manager)
- [CVE-2023-3709](https://cve.now/CVE-2023-3709.md): Royal Elementor Addons \<=1.3.70 - Unauthenticated MailChimp API Key Disclosure (CVSS 5.3, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2023-3708](https://cve.now/CVE-2023-3708.md): Multiple DeoThemes Themes \<= (Various Versions) - Reflected Cross-Site Scripting (CVSS 6.1, deothemes Amela · Deothemes MedikAid | Medical Health Ca… +3)
- [CVE-2022-4146](https://cve.now/CVE-2022-4146.md): EL Injection Vulnerability in Hitachi Replication Manager (CVSS 7.3, Hitachi Replication Manager)
- [CVE-2020-36695](https://cve.now/CVE-2020-36695.md): File and Directory Permission Vulnerability in Hitachi Command Suite (CVSS 6.6, Hitachi Device Manager · Hitachi Tiered Storage Manager +3)
- [CVE-2023-31998](https://cve.now/CVE-2023-31998.md): A heap overflow vulnerability found in EdgeRouters and Aircubes allows a malicious actor to interrupt UPnP service to said devices. (CVSS 5.9, Ubiquiti EdgeRouter · Ubiquiti Aircube)
- [CVE-2021-43072](https://cve.now/CVE-2021-43072.md): A buffer copy without checking size of input ('classic buffer overflow') in Fortinet FortiAnalyzer version 7.0.2 and below, version 6.4.7 an (CVSS 6.3, Fortinet FortiAnalyzer · Fortinet FortiManager)
- [CVE-2020-22159](https://cve.now/CVE-2020-22159.md): EVERTZ devices 3080IPX exe-guest-v1.2-r26125, 7801FC 1.3 Build 27, and 7890IXG V494 are vulnerable to Arbitrary File Upload, allowing an aut (no CVSS)
- [CVE-2020-23909](https://cve.now/CVE-2020-23909.md): Heap-based buffer over-read in function png\_convert\_4 in file pngex.cc in AdvanceMAME through 2.1. (no CVSS)
- [CVE-2020-23910](https://cve.now/CVE-2020-23910.md): Stack-based buffer overflow vulnerability in asn1c through v0.9.28 via function genhash\_get in genhash.c. (no CVSS)
- [CVE-2020-23911](https://cve.now/CVE-2020-23911.md): An issue was discovered in asn1c through v0.9.28. (no CVSS)
- [CVE-2021-32256](https://cve.now/CVE-2021-32256.md): An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.36. (no CVSS)
- [CVE-2021-33294](https://cve.now/CVE-2021-33294.md): In elfutils 0.183, an infinite loop was found in the function handle\_symtab in readelf.c .Which allows attackers to cause a denial of servic (no CVSS)
- [CVE-2021-34119](https://cve.now/CVE-2021-34119.md): A flaw was discovered in htmodoc 1.9.12 in function parse\_paragraph in ps-pdf.cxx ,this flaw possibly allows possible code execution and a d (no CVSS)
- [CVE-2021-34121](https://cve.now/CVE-2021-34121.md): An Out of Bounds flaw was discovered in htmodoc 1.9.12 in function parse\_tree() in toc.cxx, this possibly leads to memory layout information (no CVSS)
- [CVE-2021-34123](https://cve.now/CVE-2021-34123.md): An issue was discovered on atasm, version 1.09. (no CVSS)
- [CVE-2021-37522](https://cve.now/CVE-2021-37522.md): SQL injection vulnerability in HKing2802 Locke-Bot 2.0.2 allows remote attackers to run arbitrary SQL commands via crafted string to /src/db (no CVSS)
- [CVE-2022-26563](https://cve.now/CVE-2022-26563.md): An issue was discovered in Tildeslash Monit before 5.31.0, allows remote attackers to gain escilated privlidges due to improper PAM-authoriz (no CVSS)
- [CVE-2022-33064](https://cve.now/CVE-2022-33064.md): An off-by-one error in function wav\_read\_header in src/wav.c in Libsndfile 1.1.0, results in a write out of bound, which allows an attacker (no CVSS)
- [CVE-2022-33065](https://cve.now/CVE-2022-33065.md): Multiple signed integers overflow in function au\_read\_header in src/au.c and in functions mat4\_open and mat4\_read\_header in src/mat4.c in Li (no CVSS)
- [CVE-2022-41409](https://cve.now/CVE-2022-41409.md): Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via nega (no CVSS)
- [CVE-2022-47085](https://cve.now/CVE-2022-47085.md): An issue was discovered in ostree before 2022.7 allows attackers to cause a denial of service or other unspecified impacts via the print\_pan (no CVSS, ostree)
- [CVE-2023-30153](https://cve.now/CVE-2023-30153.md): An SQL injection vulnerability in the Payplug (payplug) module for PrestaShop, in versions 3.6.0, 3.6.1, 3.6.2, 3.6.3, 3.7.0 and 3.7.1, allo (CVSS 9.8)
- [CVE-2023-30383](https://cve.now/CVE-2023-30383.md): TP-LINK Archer C50v2 Archer C50(US)\_V2\_160801, TP-LINK Archer C20v1 Archer\_C20\_V1\_150707, and TP-LINK Archer C2v1 Archer\_C2\_US\_\_V1\_170228 we (no CVSS)
- [CVE-2023-31441](https://cve.now/CVE-2023-31441.md): In NATO Communications and Information Agency anet (aka Advisor Network) through 3.3.0, an attacker can provide a crafted JSON file to sanit (no CVSS)
- [CVE-2023-33265](https://cve.now/CVE-2023-33265.md): In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing au (no CVSS, com.hazelcast:hazelcast · com.hazelcast:hazelcast-enterprise)
- [CVE-2023-36669](https://cve.now/CVE-2023-36669.md): Missing Authentication for a Critical Function within the Kratos NGC Indoor Unit (IDU) before 11.4 allows remote attackers to obtain arbitra (no CVSS)
- [CVE-2023-36670](https://cve.now/CVE-2023-36670.md): A remotely exploitable command injection vulnerability was found on the Kratos NGC-IDU 9.1.0.4. (no CVSS)
- [CVE-2023-37139](https://cve.now/CVE-2023-37139.md): ChakraCore branch master cbb9b was discovered to contain a stack overflow vulnerability via the function Js::ScopeSlots::IsDebuggerScopeSlot (no CVSS)
- [CVE-2023-37140](https://cve.now/CVE-2023-37140.md): ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::DiagScopeVariablesWalker::GetChildren (no CVSS)
- [CVE-2023-37141](https://cve.now/CVE-2023-37141.md): ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::ProfilingHelpers::ProfiledNewScArray( (no CVSS)
- [CVE-2023-37142](https://cve.now/CVE-2023-37142.md): ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::EntryPointInfo::HasInlinees(). (no CVSS)
- [CVE-2023-37143](https://cve.now/CVE-2023-37143.md): ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function BackwardPass::IsEmptyLoopAfterMemOp(). (no CVSS)
- [CVE-2023-37758](https://cve.now/CVE-2023-37758.md): D-LINK DIR-815 v1.01 was discovered to contain a buffer overflow via the component /web/captcha.cgi. (no CVSS)
- [CVE-2023-37788](https://cve.now/CVE-2023-37788.md): goproxy v1.1 was discovered to contain an issue which can lead to a Denial of service (DoS) via unspecified vectors. (no CVSS, github.com/elazarl/goproxy)
- [CVE-2023-38434](https://cve.now/CVE-2023-38434.md): xHTTP 72f812d has a double free in close\_connection in xhttp.c via a malformed HTTP request method. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-07-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.